The BKZ algorithm. Joop van de Pol

Transcription

1 The BKZ algorithm Department of Computer Science, University f Bristol, Merchant Venturers Building, Woodland Road, Bristol, BS8 1UB United Kingdom. May 9th, 2014 The BKZ algorithm Slide 1

2 utline Lattices Basis Reduction LLL BKZ Enumeration BKZ 2.0 pen questions The BKZ algorithm Slide 2

3 Lattices b 2 b 1 Lattices are represented by a basis. The BKZ algorithm Slide 3

4 Lattices Lattices are represented by a basis. This basis is not unique. The BKZ algorithm Slide 3

5 Lattices Lattices are represented by a basis. This basis is not unique. Many bases span the same lattice. Some are better than others. The BKZ algorithm Slide 3

6 Lattices Lattice problems are about finding short and close vectors. The BKZ algorithm Slide 3

7 Lattices Lattice problems are about finding short and close vectors. The BKZ algorithm Slide 3

8 Lattices Lattice problems are about finding short and close vectors. In practice it suffices to find short and orthogonal basis vectors. The BKZ algorithm Slide 3

9 Gram-Schmidt Iterative process to orthonormalize a set of vectors b 1,..., b d : b 1 := b 1 b i i 1 := b i µ ij b j, where µ ij = b i, b j b for all 1 j < i d. j 2 j=1 Result: vectors b 1,..., b d that are pairwise orthogonal. They span the same space as b 1,..., b d. The BKZ algorithm Slide 4

10 Gram-Schmidt Iterative process to orthonormalize a set of vectors b 1,..., b d : b 1 := b 1 b i i 1 := b i µ ij b j, where µ ij = b i, b j b for all 1 j < i d. j 2 j=1 Result: vectors b 1,..., b d that are pairwise orthogonal. They span the same space as b 1,..., b d. In lattices: only integral combinations are allowed, b 1,..., b d span the same lattice! will not The BKZ algorithm Slide 4

11 Gram-Schmidt b 2 b 1 The BKZ algorithm Slide 5

12 Gram-Schmidt b 2 b 1 = b 1 Forget that we are in a lattice. The BKZ algorithm Slide 5

13 Gram-Schmidt b 2 b 1 = b 1 b 2 Projecting b 2 gives b 2. The BKZ algorithm Slide 5

14 Gram-Schmidt b 2 b 1 = b 1 b 2 b 2 is not a lattice vector. The BKZ algorithm Slide 5

15 Gram-Schmidt b 2 b 1 = b 1 b 2 But there is a lattice vector within 1 2 b 1 from b 2 : b 2 := b 2 µ 2,1 b 1. The BKZ algorithm Slide 5

16 Gram-Schmidt b 2 b 1 = b 1 b 2 b 2 It is always possible to choose a basis close to the Gram Schmidt vectors. This basis is called size-reduced. The BKZ algorithm Slide 5

17 LLL (1982) First polynomial-time basis reduction algorithm. Ideas: Always take the basis closest to Gram-Schmidt. The BKZ algorithm Slide 6

18 LLL (1982) First polynomial-time basis reduction algorithm. Ideas: Always take the basis closest to Gram-Schmidt. Improve Gram-Schmidt vectors by changing their order. The BKZ algorithm Slide 6

19 LLL (1982) First polynomial-time basis reduction algorithm. Ideas: Always take the basis closest to Gram-Schmidt. Improve Gram-Schmidt vectors by changing their order. Being greedy when ordering basis vectors is bad for the complexity. b 1,..., b i, b i+1,..., b d b 1,..., b i, b i+1,..., b d The BKZ algorithm Slide 6

20 LLL (1982) First polynomial-time basis reduction algorithm. Ideas: Always take the basis closest to Gram-Schmidt. Improve Gram-Schmidt vectors by changing their order. Being greedy when ordering basis vectors is bad for the complexity. b 1,..., b i, b i+1,..., b d b 1,..., b i, b i+1,..., b d What happens when b i and b i+1 are swapped? nly b i and b i+1 change. New b i becomes b i+1 + µ i+1,ib i. The BKZ algorithm Slide 6

21 LLL (1982) First polynomial-time basis reduction algorithm. Ideas: Always take the basis closest to Gram-Schmidt. Improve Gram-Schmidt vectors by changing their order. Being greedy when ordering basis vectors is bad for the complexity. b 1,..., b i, b i+1,..., b d b 1,..., b i, b i+1,..., b d What happens when b i and b i+1 are swapped? nly b i and b i+1 change. New b i becomes b i+1 + µ i+1,ib i. Swap when b i+1 + µ i+1,ib i 2 < δ b i 2, for δ (1/4, 1). The BKZ algorithm Slide 6

22 BKZ (1987, 1994) Trade-off between basis quality and time. b 1,..., b i, b i+1,..., b i+β 1,..., b d b 1,..., b i, b i+1,..., b i+β 1,..., b d The BKZ algorithm Slide 7

23 BKZ (1987, 1994) Trade-off between basis quality and time. b 1,..., b i, b i+1,..., b i+β 1,..., b d b 1,..., b i, b i+1,..., b i+β 1,..., b d Compute b new, a combination of vectors b i, b i+1,..., b i+β 1 such that it becomes the shortest possible i th Gram-Schmidt vector. The BKZ algorithm Slide 7

24 BKZ (1987, 1994) Trade-off between basis quality and time. b 1,..., b i, b i+1,..., b i+β 1,..., b d b 1,..., b i, b i+1,..., b i+β 1,..., b d Compute b new, a combination of vectors b i, b i+1,..., b i+β 1 such that it becomes the shortest possible i th Gram-Schmidt vector. If b new 2 < δ b i 2, insert b new into the basis: b 1,..., b i 1, b new, b i,..., b d The BKZ algorithm Slide 7

25 BKZ (1987, 1994) Trade-off between basis quality and time. b 1,..., b i, b i+1,..., b i+β 1,..., b d b 1,..., b i, b i+1,..., b i+β 1,..., b d Compute b new, a combination of vectors b i, b i+1,..., b i+β 1 such that it becomes the shortest possible i th Gram-Schmidt vector. If b new 2 < δ b i 2, insert b new into the basis: b 1,..., b i 1, b new, b i,..., b d Now LLL is used to remove the linear dependency created by the extra vector. BKZ moves cyclically through the basis indices i. The BKZ algorithm Slide 7

26 BKZ (1987, 1994) Trade-off between basis quality and time. b 1,..., b i, b i+1,..., b i+β 1,..., b d b 1,..., b i, b i+1,..., b i+β 1,..., b d Compute b new, a combination of vectors b i, b i+1,..., b i+β 1 such that it becomes the shortest possible i th Gram-Schmidt vector. If b new 2 < δ b i 2, insert b new into the basis: b 1,..., b i 1, b new, b i,..., b d Now LLL is used to remove the linear dependency created by the extra vector. BKZ moves cyclically through the basis indices i. Note: we do not have a good bound on the time complexity of BKZ. The BKZ algorithm Slide 7

27 BKZ (1987, 1994) Compute b new, a combination of vectors b i, b i+1,..., b i+β 1 such that it becomes the shortest possible i th Gram-Schmidt vector. The BKZ algorithm Slide 8

28 BKZ (1987, 1994) Compute b new, a combination of vectors b i, b i+1,..., b i+β 1 such that it becomes the shortest possible i th Gram-Schmidt vector. This is equivalent to solving SVP (!) in a (projected) lattice of dimension β. BKZ uses an SVP-oracle for lower dimensions to find this vector b new. The BKZ algorithm Slide 8

29 BKZ (1987, 1994) Compute b new, a combination of vectors b i, b i+1,..., b i+β 1 such that it becomes the shortest possible i th Gram-Schmidt vector. This is equivalent to solving SVP (!) in a (projected) lattice of dimension β. BKZ uses an SVP-oracle for lower dimensions to find this vector b new. In practice enumeration is used: enumerate all lattice points within a certain radius around the origin. The BKZ algorithm Slide 8

30 Enumeration b 2 b 1 The BKZ algorithm Slide 9

31 Enumeration b 2 b 1 1) Choose a bound. The BKZ algorithm Slide 9

32 Enumeration b 2 b 1 = b 1 b 2 2) Do the Gram-Schmidt. The BKZ algorithm Slide 9

33 Enumeration b 2 b 1 = b 1 b 2 3) Project whole lattice. The BKZ algorithm Slide 9

34 Enumeration b 2 b 1 = b 1 b 2 Lattice vector within bound its projection within bound. The BKZ algorithm Slide 9

35 Enumeration b 2 b 1 = b 1 b 2 4) Enumerate all vectors in projected lattice within bound. The BKZ algorithm Slide 9

36 Enumeration b 2 b 1 = b 1 b 2 5) For each vector in projected lattice, enumerate all lattice vectors. The BKZ algorithm Slide 9

37 Enumeration b 2 b 1 = b 1 b 2 5) For each vector in projected lattice, enumerate all lattice vectors. The BKZ algorithm Slide 9

38 Enumeration b 2 b 1 = b 1 b 2 6) Pick the shortest vector. The BKZ algorithm Slide 9

39 Enumeration as a tree b 1 = b 1 b 2 Enumeration is like a tree search. The BKZ algorithm Slide 10

40 Enumeration as a tree b 1 = b 1 b 2 Enumeration is like a tree search. Each level corresponds to a projected lattice. The BKZ algorithm Slide 10

41 Enumeration as a tree b 1 = b 1 b 2 Enumeration is like a tree search. Each level corresponds to a projected lattice. The leaves correspond to lattice vectors. The BKZ algorithm Slide 10

42 Extreme pruning b 1 = b 1 b 2 Branches near the edge yield fewer leaves. The BKZ algorithm Slide 11

43 Extreme pruning b 1 = b 1 b 2 Branches near the edge yield fewer leaves. Pruning decreases the size of the tree. The BKZ algorithm Slide 11

44 Extreme pruning b 1 = b 1 b 2 Branches near the edge yield fewer leaves. Pruning decreases the size of the tree. It might also remove the solutions. The BKZ algorithm Slide 11

45 Extreme pruning b 1 = b 1 b 2 Extreme pruning: probability p of finding the solution, but more than p 1 times faster. The BKZ algorithm Slide 11

46 Extreme pruning b 1 = b 1 b 2 Extreme pruning: probability p of finding the solution, but more than p 1 times faster. This gives a speed-up of 2 d/2. The BKZ algorithm Slide 11

47 BKZ 2.0 Extreme pruning requires a good bound on the length of the shortest vector. For small β the Gaussian Heuristic does not hold. The BKZ algorithm Slide 12

48 BKZ 2.0 Extreme pruning requires a good bound on the length of the shortest vector. For small β the Gaussian Heuristic does not hold. For β > 40, the projected lattices behave like random lattices. The Gaussian Heuristic gives us a good bound. The BKZ algorithm Slide 12

49 BKZ 2.0 Extreme pruning requires a good bound on the length of the shortest vector. For small β the Gaussian Heuristic does not hold. For β > 40, the projected lattices behave like random lattices. The Gaussian Heuristic gives us a good bound. Chen and Nguyen proposed BKZ 2.0 with the following improvements over the original: Better enumeration bound Extreme pruning Aborting BKZ after a fixed number of rounds Better preprocessing of the blocks The BKZ algorithm Slide 12

50 pen questions Regarding BKZ (2.0): Many heuristics. What can we prove? Destroys local structure for global improvement. Can this be done better? What about structured (ideal) lattices? Can we speed it up using a quantum computer? In general: Are there better classical algorithms? What about quantum algorithms? The BKZ algorithm Slide 13

51 Questions? The BKZ algorithm Slide 14