筛选最接近的晶格向量（带预处理）
Sieving for closest lattice vectors (with preprocessing)
摘要：
基于格的密码学是近年来出现的一种高效、安全的后量子密码学。其安全性的两个主要困难问题是最短向量问题（SVP）和最接近向量问题（CVP）。已经研究了用于解决这些问题的各种算法，并且对于SVP，格筛选目前在渐近时间复杂度方面占主导地位：人们可以在高维$d$中在时间$2^{0.292d}$中解析地解决SVP [BDGL'16]。虽然几个SVP算法也可以用来解决CVP，但不清楚这是否也适用于启发式格筛选方法。CVP的最佳时间复杂度目前是$2^{0.377d}$ [BGJ'14]。在本文中，我们重新审视筛分算法解决SVP，并研究如何修改这些算法可以解决CVP及其变种。我们的第一种方法是针对解决一个问题的实例，并最大限度地减少了一个单一的CVP实例的时间复杂度为$2^{0.292d}$的整体时间复杂度。我们的第二种方法最大限度地减少了摊销的时间复杂度为同一格上的几个实例，在一个更大的预处理成本的成本。在$2^{0.136d}$时间内，我们可以用$2^{0.636d}$空间和预处理来解决最接近向量问题（CVPP），而查询复杂度甚至可以降低到$2^{εd}$，代价是$(1/ε)^{O(d)}$的预处理时间和内存复杂度。对于更简单的CVP变体，例如近似CVP和有界距离解码（BDD），我们进一步展示了预处理方法如何实现更好的复杂性。例如，如果$k = Ω(\sqrt{d/\log d})$，我们可以在多项式时间内用多项式大小的建议来求解具有大近似因子$k$的近似CVPP，从而精确地缩小[AR'04]的决策CVPP结果与[DRS'14]的搜索CVPP结果之间的差距。
英文摘要：
Lattice-based cryptography has recently emerged as a prime candidate for efficient and secure post-quantum cryptography. The two main hard problems underlying its security are the shortest vector problem (SVP) and the closest vector problem (CVP). Various algorithms have been studied for solving these problems, and for SVP, lattice sieving currently dominates in terms of the asymptotic time complexity: one can heuristically solve SVP in time $2^{0.292d}$ in high dimensions $d$ [BDGL'16]. Although several SVP algorithms can also be used to solve CVP, it is not clear whether this also holds for heuristic lattice sieving methods. The best time complexity for CVP is currently $2^{0.377d}$ [BGJ'14]. In this paper we revisit sieving algorithms for solving SVP, and study how these algorithms can be modified to solve CVP and its variants as well. Our first method is aimed at solving one problem instance and minimizes the overall time complexity for a single CVP instance with a time complexity of $2^{0.292d}$. Our second method minimizes the amortized time complexity for several instances on the same lattice, at the cost of a larger preprocessing cost. We can solve the closest vector problem with preprocessing (CVPP) with $2^{0.636d}$ space and preprocessing, in $2^{0.136d}$ time, while the query complexity can even be reduced to $2^{εd}$ at the cost of preprocessing time and memory complexities of $(1/ε)^{O(d)}$. For easier variants of CVP, such as approximate CVP and bounded distance decoding (BDD), we further show how the preprocessing method achieves even better complexities. For instance, we can solve approximate CVPP with large approximation factors $k$ with polynomial-sized advice in polynomial time if $k = Ω(\sqrt{d/\log d})$, heuristically closing the gap between the decision-CVPP result of [AR'04] and the search-CVPP result of [DRS'14].
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
