Welcome to the resource topic for 2024/080
Title:
Memory adds no cost to lattice sieving for computers in 3 or more spatial dimensions
Authors: Samuel Jaques
Abstract:The security of lattice-based crytography (LWE, NTRU, and FHE) depends on the hardness of the shortest-vector problem (SVP). Sieving algorithms give the lowest asymptotic runtime to solve SVP, but depend on exponential memory. Memory access costs much more in reality than in the RAM model, so we consider a computational model where processors, memory, and meters of wire are in constant proportions to each other. While this adds substantial costs to route data during lattice sieving, we modify existing algorithms to amortize these costs and find that, asymptotically, a classical computer can achieve the previous RAM model cost of 2^{0.2925d+o(d)} to sieve a d-dimensional lattice for a computer existing in 3 or more spatial dimensions, and can reach 2^{0.3113d+o(d)} in 2 spatial dimensions, where “spatial dimensions” are the dimensions of the physical geometry in which the computer exists.
Under some assumptions about the constant terms of memory access, we estimate increases in bit security between 3 to 29 bits for different Kyber parameter sets and 4 to 28 bits for Dilithium.
ePrint: https://eprint.iacr.org/2024/080
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .