Tuning GaussSieve for Speed

Abstract

The area of lattice-based cryptography is growing ever-more prominent as a paradigm for quantum-resistant cryptography. One of the most important hard problem underpinning the security of lattice-based cryptosystems is the shortest vector problem (SVP). At present, two approaches dominate methods for solving instances of this problem in practice: enumeration and sieving. In 2010, Micciancio and Voulgaris presented a heuristic member of the sieving family, known as GaussSieve, demonstrating it to be comparable to enumeration methods in practice. With contemporary lattice-based cryptographic proposals relying largely on the hardness of solving the shortest and closest vector problems in ideal lattices, examining possible improvements to sieving algorithms becomes highly pertinent since, at present, only sieving algorithms have been successfully adapted to solve such instances more efficiently than in the random lattice case. In this paper, we propose a number of heuristic improvements to GaussSieve, which can also be applied to other sieving algorithms for SVP.

A Pseudocode of our Optimized GaussSieve

The below pseudocode displays our proposed modifications to GaussSieve. In lines (3)–(9) we incorporate our multiple-randomized-bases optimization, and in the function GaussReduce(p,$\mathsf {L},\mathsf {S},k$) we embed the cheap test SIP implementing our XOR + population count computation for the approximation of the angle between two vectors. The optimized Gaussian sampler modifies the function SampleKlein.

In the pseudocode, the parameter $k\in \mathbb {Z}^{+}$ defines the bounds on the XOR + population count, within which we assume that a pair of vectors is Gauss-reduced, i.e. if $n/2 - k \le \langle \tilde{\mathbf {a}}, \tilde{\mathbf {b}}\rangle \le n/2+k$, we assume the pair $\mathbf {a},\mathbf {b}$ are Gauss-reduced.