Slide Reduction, Revisited---Filling the Gaps in SVP Approximation

TL;DR

This paper generalizes a lattice reduction algorithm to efficiently solve the approximate Shortest Vector Problem (SVP) for a wide range of approximation factors, significantly impacting cryptographic applications.

Contribution

It extends Gama and Nguyen's slide reduction algorithm to cover all relevant approximation factors for cryptography, providing the fastest provably correct solutions.

Findings

Developed a generalized slide reduction algorithm for approximate SVP

Achieved the fastest provably correct algorithms for a broad range of approximation factors

Focused on the approximation range most relevant for cryptography

Abstract

We show how to generalize Gama and Nguyen's slide reduction algorithm [STOC '08] for solving the approximate Shortest Vector Problem over lattices (SVP). As a result, we show the fastest provably correct algorithm for $\delta$-approximate SVP for all approximation factors $n^{1/2+\varepsilon} \leq \delta \leq n^{O(1)}$. This is the range of approximation factors most relevant for cryptography.

Tables

Table 1. Table 1: Algorithms for solving SVP. We write [A] + + [B] to denote the algorithm that uses basis reduction from [A] with the exact/near-exact SVP algorithm from [B], and we write [*] for this work. The “folklore” column represents a result that was likely known to many experts in the field but apparently never published.

Approximation factor	Previous best		Folklore		This work
Exact	$2^n$	[ADRS15]	—		—
$\Omega \left(1\right)\le \delta \le \sqrt{n}$	$2^{0.802n}$	[WLW15]	—		—
$n^c$ for $c\in [\frac{1}{2},1]$	$2^{0.802n}$	[WLW15]	—		$2^{\frac{0.802n}{2c}}$	[*]$+$[WLW15]
$n^c$ for $c\ge 1$	$2^{\frac{n}{\lfloor c+1\rfloor }}$	[GN08]+[ADRS15]	$2^{\frac{0.802n}{\lfloor c+1\rfloor }}$	[GN08]+[WLW15]	$2^{\frac{0.802n}{c+1}}$	[*]$+$[WLW15]

Equations

$$\mathcal{L}:=\mathcal{L}(\mathbf{B})=\{z_1{\mathbf{b}}_1+\cdots +z_n{\mathbf{b}}_n:z_i\in \mathbb{Z}\}$$

$${\gamma }_n:=\sup \frac{{\lambda }_1(\mathcal{L}{)}^2}{\mathrm{vol}(\mathcal{L}{)}^{2/n}},$$

$${\delta }_{\mathsf{MW},H}:={\gamma }_k^{\frac{n-1}{2(k-1)}}.$$

$${\delta }_{\mathsf{GN},H}:={\gamma }_k^{\frac{\lceil n{\rceil }_k-1}{2(k-1)}}{\delta }_{\mathsf{GN},S}:={\gamma }_k^{\frac{\lceil n{\rceil }_k-k}{k-1}},$$

$${\delta }_H:=({\delta }^2{\gamma }_k{)}^{\frac{n-1}{2(k-1)}}{\delta }_S:=\delta ({\delta }^2{\gamma }_k{)}^{\frac{n-k}{k-1}}.$$

$${\delta }_S:={\delta }^2\sqrt{{\gamma }_k}({\delta }^2{\gamma }_q{)}^{\frac{q+1}{q-1}\cdot \frac{n-k}{2k}}\lesssim \delta ({\delta }^2{\gamma }_k{)}^{\frac{n}{2k}},$$

$${\mathcal{L}}^{\times }=\{\mathbf{w}\in \mathrm{span}(\mathcal{L}):⟨\mathbf{w},\mathbf{y}⟩\in \mathbb{Z}\text{for all}\mathbf{y}\in \mathcal{L}\}.$$

$$\Vert {\mathbf{b}}_1\Vert \le {\delta }^{2d/(d-1)}\Vert {\mathbf{b}}_{d+1}^{\ast }\Vert .$$

$${\delta }^{-d/(d-1)}\Vert {\mathbf{b}}_1\Vert \le \mathrm{vol}(\mathbf{B}{)}^{1/(d+1)}\le {\delta }^{d/(d-1)}\Vert {\mathbf{b}}_{d+1}^{\ast }\Vert .$$

$$\Vert {\mathbf{b}}_1{\Vert }^{d-1}\le {\delta }^d\mathrm{vol}({\mathbf{B}}_{[2,d]}).$$

$$\mathrm{vol}({\mathbf{B}}_{[2,d]})\le {\delta }^d\Vert {\mathbf{b}}_{d+1}^{\ast }{\Vert }^{d-1}.$$

$$\Vert {\mathbf{b}}_1{\Vert }^n\le {\eta }^{2d(n-d)}\Vert {\mathbf{b}}_1{\Vert }^d\cdot \Vert {\mathbf{b}}_{d+1}^{\ast }{\Vert }^{n-d}\le {\eta }^{2(n-d)d+d(d-1)+(n-d)(n-d-1)}\mathrm{vol}(\mathbf{B})={\eta }^{n(n-1)}\mathrm{vol}(\mathbf{B}),$$

$$\Vert {\mathbf{b}}_1\Vert \le (1+\epsilon )\cdot ({\delta }^2{\gamma }_k{)}^{\frac{n-1}{2(k-1)}}\mathrm{vol}(\mathcal{L}{)}^{1/n}$$

$$y_i:=\frac{(n-k-i+1)(k+i-1)}{k-1}\cdot \log (\delta \sqrt{{\gamma }_k})\text{for}i=1,\dots ,n-k.$$

$$\max_{1\leq i\leq n-k}\big{|}x_{i}^{(\ell)}/y_{i}-1\big{|}\leq(1-\xi)\max_{1\leq i\leq n-k}\big{|}x_{i}^{(\ell-1)}/y_{i}-1\big{|}\;,$$

$$\max_{1\leq i\leq n-k}\big{|}x_{i}^{(0)}/y_{i}-1\big{|}\leq\frac{k(n-k)\log(5\|\mathbf{B}^{(0)}\|)}{y_{1}}\;.$$

$$\frac{x_1^{(N)}-y_1}{y_1}$$

$$\le e^{-4(k-1{)}^{2}N/(5n^2)}\cdot \frac{k(n-k)\log (5\Vert {\mathbf{B}}^{(0)}\Vert )}{y_1}$$

$$\le \frac{k\log (1+\epsilon )}{y_1}.$$

$$\mathrm{vol}\big{(}\mathbf{B}_{[1,k]}^{(N)}\big{)}\leq(1+\varepsilon)^{k}\cdot(\delta^{2}\gamma_{k})^{\frac{(n-k)k}{2(k-1)}}\mathrm{vol}(\mathcal{L})^{k/n}\;.$$

$$\|\mathbf{b}_{1}\|\leq\delta\sqrt{\gamma_{k}}\cdot\mathrm{vol}\big{(}\mathbf{B}_{[1,k]}^{(N)}\big{)}^{1/k}\leq(1+\varepsilon)(\delta^{2}\gamma_{k})^{\frac{n-1}{2(k-1)}}\mathrm{vol}(\mathcal{L})^{1/n}\;,$$

$${\lambda }_1(\mathcal{L}({\mathbf{B}}_{[1,k]}))\le \delta \sqrt{{\gamma }_k}({\delta }^2{\gamma }_q{)}^{\frac{q+1}{q-1}\cdot \frac{n-k}{2k}}{\lambda }_1(\mathcal{L}).$$

$$\Vert {\mathbf{b}}_i^{\ast }\Vert /\delta \le \Vert {\pi }_i(\mathbf{v})\Vert \le \Vert \mathbf{v}\Vert ={\lambda }_1(\mathcal{L}),$$

$$\mathrm{vol}({\mathbf{B}}_{[1,k]})$$

$$\le (\delta \sqrt{{\gamma }_q}{)}^{q(q+1)/(q-1))}\Vert {\mathbf{b}}_q^{\ast }{\Vert }^q\cdot \prod _{i=q+1}^k\Vert {\mathbf{b}}_i^{\ast }\Vert$$

$$\le ({\delta }^2{\gamma }_q{)}^{\frac{q+1}{q-1}\cdot \frac{n-k}{2}}(\delta {\lambda }_1(\mathcal{L}){)}^k,$$

$${\lambda }_1(\mathcal{L}({\mathbf{B}}_{[1,k]}))\le \sqrt{{\gamma }_k}\mathrm{vol}({\mathbf{B}}_{[1,k]}{)}^{1/k}\le \delta \sqrt{{\gamma }_k}({\delta }^2{\gamma }_q{)}^{\frac{q+1}{q-1}\cdot \frac{n-k}{2k}}{\lambda }_1(\mathcal{L}),$$

$$P(\mathbf{B}):=\mathrm{vol}({\mathbf{B}}_{[1,q]}{)}^2\in {\mathbb{Z}}^{+}.$$

$${\delta }^{\prime }={\delta }^2\sqrt{{\gamma }_k}((1+\epsilon {)}^2{\delta }^2{\gamma }_q{)}^{\frac{q+1}{q-1}\cdot \frac{n-k}{2k}}\le O({\delta }^{2c+1}{n}^c),$$

$$\Vert {\mathbf{b}}_1\Vert \le ({\delta }^2{\gamma }_k{)}^{\frac{n-1}{2(k-1)}}\mathrm{vol}(\mathcal{L}{)}^{1/n}.$$

$$\Vert {\mathbf{b}}_1\Vert \le \delta ({\delta }^2{\gamma }_k{)}^{\frac{n-k}{k-1}}{\lambda }_1(\mathcal{L}),$$

$$P(\mathbf{B}):=\prod _{i=1}^{p-1}\mathrm{vol}({\mathbf{B}}_{[1,ik+q]}{)}^2\in {\mathbb{Z}}^{+}.$$

Full text

1 Introduction

A lattice $\mathcal{L}\subset\mathbb{R}^{m}$ is the set of integer linear combinations

[TABLE]

of linearly independent basis vectors $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})\in\mathbb{R}^{m\times n}$. We call $n$ the rank of the lattice.

The Shortest Vector Problem (SVP) is the computational search problem in which the input is (a basis for) a lattice $\mathcal{L}\subseteq\mathbb{Z}^{m}$, and the goal is to output a non-zero lattice vector $\mathbf{y}\in\mathcal{L}$ with minimal length, $\|\mathbf{y}\|=\lambda_{1}(\mathcal{L}):=\min_{\mathbf{x}\in\mathcal{L}_{\neq\mathbf{0}}}\|\mathbf{x}\|$. For $\delta\geq 1$, the $\delta$-approximate variant of SVP ($\delta$-SVP) is the relaxation of this problem in which any non-zero lattice vector $\mathbf{y}\in\mathcal{L}_{\neq\mathbf{0}}$ with $\|\mathbf{y}\|\leq\delta\cdot\lambda_{1}(\mathcal{L})$ is a valid solution.

A closely related problem is $\delta$-Hermite SVP ($\delta$-HSVP, sometimes also called Minkowski SVP), which asks us to find a non-zero lattice vector $\mathbf{y}\in\mathcal{L}_{\neq\mathbf{0}}$ with $\|\mathbf{y}\|\leq\delta\cdot\mathrm{vol}(\mathcal{L})^{1/n}$, where $\mathrm{vol}(\mathcal{L}):=\det(\mathbf{B}^{T}\mathbf{B})^{1/2}$ is the covolume of the lattice. Hermite’s constant $\gamma_{n}$ is (the square of) the minimal possible approximation factor that can be achieved in the worst case. I.e.,

[TABLE]

where the supremum is over lattices $\mathcal{L}\subset\mathbb{R}^{n}$ with full rank $n$. Hermite’s constant is only known exactly for $1\leq n\leq 8$ and $n=24$, but it is known to be asymptotically linear in $n$, i.e., $\gamma_{n}=\Theta(n)$. HSVP and Hermite’s constant play a large role in algorithms for $\delta$-SVP.

Starting with the celebrated work of Lenstra, Lenstra, and Lovász in 1982 [LLL82], algorithms for solving $\delta$-(H)SVP for a wide range of parameters $\delta$ have found innumerable applications, including factoring polynomials over the rationals [LLL82], integer programming [Len83, Kan83, DPV11], cryptanalysis [Sha84, Odl90, JS98, NS01], etc. More recently, many cryptographic primitives have been constructed whose security is based on the (worst-case) hardness of $\delta$-SVP or closely related lattice problems [Ajt96, Reg09, GPV08, Pei09, Pei16]. Such lattice-based cryptographic constructions are likely to be used on massive scales (e.g., as part of the TLS protocol) in the not-too-distant future [NIS18], and in practice, the security of these constructions depends on the fastest algorithms for $\delta$-(H)SVP, typically for $\delta=\mathrm{poly}(n)$.

Work on $\delta$-(H)SVP has followed two distinct tracks. There has been a long line of work showing progressively faster algorithms for exact SVP (i.e., $\delta=1$) [Kan83, AKS01, NV08, PS09, MV13]. However, even the fastest such algorithm (with proven correctness) runs in time $2^{n+o(n)}$ [ADRS15, AS18]. So, these algorithms are only useful for rather small $n$.

This paper is part of a separate line of work on basis reduction algorithms [LLL82, Sch87, SE94, GHKN06, GN08, HPS11, MW16]. (See [NV10] and  [MW16] for a much more complete list of works on basis reduction.) At a high level, these are reductions from $\delta$-(H)SVP on lattices with rank $n$ to exact SVP on lattices with rank $k\leq n$. More specifically, these algorithms divide a basis $\mathbf{B}$ into projected blocks $\mathbf{B}_{[i,i+k-1]}$ with block size $k$, where $\mathbf{B}_{[i,j]}=(\pi_{i}(\mathbf{b}_{i}),\pi_{i}(\mathbf{b}_{i+1}),\ldots,\pi_{i}(\mathbf{b}_{j}))$ and $\pi_{i}$ is the orthogonal projection onto the subspace orthogonal to $\mathbf{b}_{1},\ldots,\mathbf{b}_{i-1}$. Basis reduction algorithms use their SVP oracle to find short vectors in these (low-rank) blocks and incorporate these short vectors into the lattice basis $\mathbf{B}$. By doing this repeatedly (at most $\mathrm{poly}(n,\log\|\mathbf{B}\|)$ times) with a cleverly chosen sequence of blocks, such algorithms progressively improve the “quality” of the basis $\mathbf{B}$ until $\mathbf{b}_{1}$ is a solution to $\delta$-(H)SVP for some $\delta\geq 1$. The goal, of course, is to take the block size $k$ to be small enough that we can actually run an exact algorithm on lattices with rank $k$ in reasonable time while still achieving a relatively good approximation factor $\delta$.

For HSVP, the DBKZ algorithm due to Micciancio and Walter yields the best proven approximation factor for all ranks $n$ and block sizes $k$ [MW16]. Specifically, it achieves an approximation factor of

[TABLE]

(Recall that $\gamma_{k}=\Theta(k)$ is Hermite’s constant. Here and throughout the introduction, we have left out low-order factors that can be made arbitrarily close to one.) Using a result due to Lovász [Lov86], this can be converted into an algorithm for $\delta_{\mathsf{MW},H}^{2}$-SVP. However, the slide reduction algorithm of Gama and Nguyen [GN08] achieves a better approximation factor for SVP. It yields

[TABLE]

for HSVP and SVP respectively, where we write $\lceil n\rceil_{k}:=k\cdot\lceil n/k\rceil$ for $n$ rounded up to the nearest multiple of $k$. (We have included the result for HSVP in Eq. (2) for completeness, though it is clearly no better than Eq. (1).)

The discontinuous approximation factor in Eq. (2) is the result of an unfortunate limitation of slide reduction: it only works when the block size $k$ divides the rank $n$. If $n$ is not divisible by $k$, then we must artificially pad our basis so that it has rank $\lceil n\rceil_{k}$, which results in the rather odd expressions in Eq. (2). Of course, for $n\gg k$, this rounding has little effect on the approximation factor. But, for cryptographic applications, we are interested in small polynomial approximation factors $\delta\approx n^{c}$ for relatively small constants $c$, i.e., in the case when $k=\Theta(n)$. For such values of $k$ and $n$, this rounding operation can cost us a constant factor in the exponent of the approximation factor, essentially changing $n^{c}$ to $n^{\lceil c\rceil}$. Such constants in the exponent have a large effect on the security of lattice-based cryptography.111The security of lattice-based cryptography is actually assessed using heuristic algorithms that outperform Eq. (2) empirically [APS15], so that Eq. (2) is not and should not be used directly for this purpose. In this work, we restrict our attention to what we can prove.

1.1 Our results

Our first main contribution is a generalization of Gama and Nguyen’s slide reduction [GN08] without the limitation that the rank $n$ must be a multiple of the block size $k$. Indeed, we achieve exactly the approximation factor shown in Eq. (2) without any rounding, as we show below.

As a very small additional contribution, we allow for the possibility that the underlying SVP algorithm for lattices with rank $k$ only solves $\delta$-approximate SVP for some $\delta>1$. This technique was already known to folklore and used in practice, and the proof requires no new ideas. Nevertheless, we believe that this work is the first to formally show that a $\delta$-SVP algorithm suffices and to compute the exact dependence on $\delta$. (This minor change proves quite useful when we instantiate our $\delta$-SVP subroutine with the $2^{0.802k}$-time $\delta$-SVP algorithm for some large constant $\delta\gg 1$ due to Liu, Wang, Xu, and Zheng [LWXZ11, WLW15]. See Table 1 and Figure 1.)

Theorem 1.1** (Informal, slide reduction for $n\geq 2k$).**

For any approximation factor $\delta\geq 1$ and block size $k:=k(n)\geq 2$, there is an efficient reduction from $\delta_{H}$-HSVP and $\delta_{S}$-SVP on lattices with rank $n\geq 2k$ to $\delta$-SVP on lattices with rank $k$, where

[TABLE]

Notice in particular that this matches Eq. (2) in the case when $\delta=1$ and $k$ divides $n$. (This is not surprising, since our algorithm is essentially identical to the original algorithm from [GN08] in this case.) Theorem 1.1 also matches the approximation factor for HSVP achieved by [MW16], as shown in Eq. (1), so that the best (proven) approximation factor for both problems is now achieved by a single algorithm.

However, Theorem 1.1 only applies for $n\geq 2k$. Our second main contribution is an algorithm that works for $k\leq n\leq 2k$. To our knowledge, this is the first algorithm that provably achieves sublinear approximation factors for SVP and is asymptotically faster than, say, the fastest algorithm for $O(1)$-SVP. (We overcame a small barrier here. See the discussion in Section 3.)

Theorem 1.2** (Informal, slide reduction for $n\leq 2k$).**

For any approximation factor $\delta\geq 1$ and block size $k\in[n/2,n]$, there is an efficient reduction from $\delta_{S}$-SVP on lattices with rank $n$ to $\delta$-SVP on lattices with rank $k$, where

[TABLE]

and $q:=n-k\leq k$.

Together, these algorithms yield the asymptotically fastest proven running times for $\delta$-SVP for all approximation factors $n^{1/2+\varepsilon}\leq\delta\leq n^{O(1)}$—with a particularly large improvement when $\delta=n^{c}$ for $1/2<c<1$ or for any $c$ slightly smaller than an integer. Table 1 and Figure 1 summarize the current state of the art.

1.2 Our techniques

We first briefly recall some of the details of Gama and Nguyen’s slide reduction. Slide reduction divides the basis $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})\in\mathbb{R}^{m\times n}$ evenly into disjoint “primal blocks” $\mathbf{B}_{[ik+1,(i+1)k]}$ of length $k$. (Notice that this already requires $n$ to be divisible by $k$.) It also defines certain “dual blocks” $\mathbf{B}_{[ik+2,(i+1)k+1]}$, which are the primal blocks shifted one to the right. The algorithm then tries to simultaneously satisfy certain primal and dual conditions on these blocks. Namely, it tries to SVP-reduce each primal block—i.e., it tries to make the first vector in the block $\mathbf{b}_{ik+1}^{*}$ a shortest vector in $\mathcal{L}(\mathbf{B}_{[ik+1,(i+1)k]})$, where $\mathbf{b}_{j}^{*}:=\pi_{j}(\mathbf{b}_{j})$. Simultaneously, it tries to dual SVP-reduce (DSVP-reduce) the dual blocks. (See Section 2.3 for the definition of DSVP reduction.) We call a basis that satisfies all of these conditions simultaneously slide-reduced.

An SVP oracle for lattices with rank $k$ is sufficient to enforce all primal conditions or all dual conditions separately. (E.g., we can enforce the primal conditions by simply finding a shortest non-zero vector in each primal block and including this vector in an updated basis for the block.) Furthermore, if all primal and dual conditions hold simultaneously, then $\|\mathbf{b}_{1}\|\leq\delta_{\mathsf{GN},S}\lambda_{1}(\mathcal{L})$ with $\delta_{\mathsf{GN},S}$ as in Eq. (2), so that $\|\mathbf{b}_{1}\|$ yields a solution to $\delta_{\mathsf{GN},S}$-SVP. This follows from repeated application of a “gluing” lemma on such bases, which shows how to “glue together” two reduced block to obtain a larger reduced block. (See Lemma 2.2.) Finally, Gama and Nguyen showed that, if we alternate between SVP-reducing the primal blocks and DSVP-reducing the dual blocks, then the basis will converge quite rapidly to a slide-reduced basis (up to some small slack) [GN08]. Combining all of these facts together yields the main result in [GN08]. (See Section 4.)

The case $n>2k$.

We wish to extend slide reduction to the case when $n=pk+q$ for $1\leq q<k$. So, intuitively, we have to decide what to do with “the extra $q$ vectors in the basis.”

We start by observing that the analysis of slide reduction (and, in particular, this “gluing” property) does not quite require the first block $\mathbf{B}_{[1,k]}$ to be SVP-reduced. Instead, it essentially only requires it to be “HSVP-reduced.” I.e., we do not really need $\|\mathbf{b}_{1}\|\leq\delta_{S}\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,k]}))$; we basically only need $\|\mathbf{b}_{1}\|\leq\delta_{H}\mathrm{vol}(\mathbf{B}_{[1,k]})^{1/k}$. Something similar holds for the first dual block, so that at least for the first block and the corresponding dual block, we basically only need an HSVP oracle.222We are ignoring a certain degenerate case here for simplicity. Namely, if all short vectors happen to lie in the span of the first block, and these vectors happen to be very short relative to the volume of the first block, then calling an HSVP oracle on the first block might not be sufficient to solve approximate SVP. Of course, if we know a low-dimensional subspace that contains the shortest non-zero vector, then finding short lattice vectors is much easier. This degenerate case is therefore easily handled separately (but it does in fact need to be handled separately).

This suggests that we might want to simply add the extra $q$ vectors to the first block. I.e., we can take one “big block” $\mathbf{B}_{[1,k+q]}$ of length $k+q$, and $p-1$ “regular” blocks $\mathbf{B}_{[ik+q+1,(i+1)k+q]}$ of length $k$. The regular blocks satisfy the same conditions as in [GN08]—they are SVP-reduced and the corresponding dual blocks are DSVP-reduced. For the big first block, we replace SVP reduction by an appropriate notion of HSVP reduction. Similarly, we replace DSVP reduction of the (big) first dual block by the appropriate dual notion of HSVP reduction.

To get the best results, we instantiate our HSVP oracle with the algorithm from [MW16]. Since we only need an oracle for HSVP, we are able to take advantage of the very impressive approximation factor achieved by [MW16] for this problem (i.e., Eq. (1)). In fact, the approximation factor achieved by [MW16] is exactly what we need to apply our gluing lemma. (This is not a coincidence, as we explain in Section 4.) The result is Theorem 1.1.

The case $n<2k$.

For $n=k+q<2k$, the above idea cannot work. In particular, a “big block” of size $k+q$ in this case would be our entire basis! So, instead of working with one big block and some “regular blocks” of size $k$, we work with a “small block” of size $q$ and one regular block of size $k$. We then simply perform slide reduction with (primal) blocks $\mathbf{B}_{[1,q]}$ and $\mathbf{B}_{[q+1,n]}=\mathbf{B}_{[n-k+1,n]}$. If we were to stop here, we would achieve an approximation factor of roughly $\gamma_{q}$, which for $q=\Theta(k)$ is essentially the same as the approximation factor of roughly $\gamma_{k}$ that we get when the rank is $2k$. I.e., we would essentially “pay for two blocks of length $k$,” even though one block has size $q<k$.

However, we notice that a slide-reduced basis guarantees more than just a short first vector. It also promises a very strong bound on $\mathrm{vol}(\mathbf{B}_{[1,q]})$. In particular, since $q<k$ and since we have access to an oracle for lattices with rank $k$, it is natural to try to extend this small block $\mathbf{B}_{[1,q]}$ with low volume to a larger block $\mathbf{B}_{[1,k]}$ of length $k$ that still has low volume. Indeed, we can use our SVP oracle to guarantee that $\mathbf{B}_{[q+1,k]}$ consists of relatively short vectors so that $\mathrm{vol}(\mathbf{B}_{[q+1,k]})$ is relatively small as well. (Formally, we SVP-reduce $\mathbf{B}_{[i,n]}$ for $i\in[q+1,k]$. Again, we are ignoring a certain degenerate case, as in Footnote 2.) This allows us to upper bound $\mathrm{vol}(\mathbf{B}_{[1,k]})=\mathrm{vol}(\mathbf{B}_{[1,q]})\cdot\mathrm{vol}(\mathbf{B}_{[q+1,k]})$, which implies that $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,k]}))$ is relatively short. We can therefore find a short vector by making an additional SVP oracle call on $\mathcal{L}(\mathbf{B}_{[1,k]})$. (Micciancio and Walter used a similar idea in [MW16].)

1.3 Open questions and directions for future work

Table 1 suggests an obvious open question: can we find a non-trivial basis reduction algorithm that provably solves $\delta$-SVP for $\delta\leq O(\sqrt{n})$? More formally, can we reduce $O(\sqrt{n})$-SVP on lattices with rank $n$ to exact SVP on lattices with rank $k=cn$ for some constant $c<1$. Our current proof techniques seem to run into a fundamental barrier here in that they seem more-or-less incapable of achieving $\delta\ll\sqrt{\gamma_{k}}$. This setting is interesting in practice, as many record lattice computations use block reduction with $k\geq n/2$ as a subroutine, such as [CN12]. (One can provably achieve approximation factors $\delta\ll\sqrt{\gamma_{k}}$ when $k=(1-o(1))n$ with a bit of work,333For example, it is immediate from the proof of Theorem 3.2 that the (very simple) notion of a slide-reduced basis for $n\leq 2k$ in Definition 3.1 is already enough to obtain $\delta\approx\gamma_{n-k}\approx n-k$. So, for $n\lesssim k+\sqrt{k}$, this already achieves $\delta\lesssim\sqrt{n}$. With a bit more work, one can show that an extra oracle call like the one used in Corollary 3.4 can yield a still better approximation factor in this rather extreme setting of $k=(1-o(1))n$. but it is not clear if these extreme parameters are useful.)

Next, we recall that this work shows how to exploit the existing very impressive algorithms for HSVP (in particular, DBKZ [MW16]) to obtain better algorithms for SVP. This suggests two closely related questions for future work: (1) can we find better algorithms for HSVP (e.g., for $\delta$-HSVP with $\delta\approx\sqrt{\gamma_{n}}$—i.e., “near-exact” HSVP); and (2) where else can we profitably replace SVP oracles with HSVP oracles? Indeed, most of our analysis (and the analysis of other basis reduction algorithms) treats the $\delta$-SVP oracle as a $\delta\sqrt{\gamma_{k}}$-HSVP oracle. We identified one way to exploit this to actually get a faster algorithm, but perhaps more can be done here—particularly if we find faster algorithms for HSVP.

We also leave it to future work to implement our algorithms and to study how they perform in practice. Indeed, Micciancio and Walter showed that (a slightly optimized version of) slide reduction is competitive with even the best heuristic algorithms in practice, in terms of both the running time and the approximation factor [MW16]. Since our algorithms are generalizations of slide reduction, one might guess that they also perform well in practice. We leave it to others to confirm or refute this guess.

Finally, we note that we present two distinct (though similar) algorithms: one for lattices with rank $n\leq 2k$ and one for lattices with rank $n\geq 2k$. It is natural to ask whether there is a single algorithm that works in both regimes. Perhaps work on this question could even lead to better approximation factors.

2 Preliminaries

We denote column vectors $\mathbf{x}\in\mathbb{R}^{m}$ by bold lower-case letters. Matrices $\mathbf{B}\in\mathbb{R}^{m\times n}$ are denoted by bold upper-case letters, and we often think of a matrix as a list of column vectors, $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})$. For a matrix $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})$ with $n$ linearly independent columns, we write $\mathcal{L}(\mathbf{B}):=\{z_{1}\mathbf{b}_{1}+\cdots+z_{n}\mathbf{b}_{n}\ :\ z_{i}\in\mathbb{Z}\}$ for the lattice generated by $\mathbf{B}$ and $\|\mathbf{B}\|=\max\{\|\mathbf{b}_{1}\|,\ldots,\|\mathbf{b}_{n}\|\}$ for the maximum norm of a column. We often implicitly assume that $m\geq n$ and that a basis matrix $\mathbf{B}\in\mathbb{R}^{m\times n}$ has rank $n$ (i.e., that the columns of $\mathbf{B}$ are linearly independent). We use the notation $\log:=\log_{2}$ to mean the logarithm with base two.

2.1 Lattices

For any lattice $\mathcal{L}$, its dual lattice is

[TABLE]

If $\mathbf{B}\in\mathbb{R}^{m\times n}$ is a basis of $\mathcal{L}$, then $\mathcal{L}^{\times}$ has basis $\mathbf{B}^{\times}:=\mathbf{B}(\mathbf{B}^{T}\mathbf{B})^{-1}$, called the dual basis of $\mathbf{B}$. The reversed dual basis $\mathbf{B}^{-s}$ of $\mathbf{B}$ is simply $\mathbf{B}^{\times}$ with its columns in reversed order [GHN06].

2.2 Gram-Schmidt-Orthogonalization

For a basis $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})\in\mathbb{R}^{m\times n}$, we associate a sequence of projections $\pi_{i}:=\pi_{\{\mathbf{b}_{1},\ldots,\mathbf{b}_{i-1}\}^{\perp}}$. Here, $\pi_{W^{\perp}}$ means the orthogonal projection onto the subspace $W^{\perp}$ orthogonal to $W$. As in [GN08], $\mathbf{B}_{[i,j]}$ denotes the projected block $(\pi_{i}(\mathbf{b}_{i}),\pi_{i}(\mathbf{b}_{i+1}),\ldots,\pi_{i}(\mathbf{b}_{j}))$.

We also associate to $\mathbf{B}$ its Gram-Schmidt orthogonalization (GSO) $\mathbf{B}^{\ast}:=(\mathbf{b}_{1}^{\ast},\ldots,\mathbf{b}_{n}^{\ast})$, where $\mathbf{b}_{i}^{*}:=\pi_{i}(\mathbf{b}_{i})=\mathbf{b}_{i}-\sum_{j<i}\mu_{i,j}\mathbf{b}_{j}^{*}$, and $\mu_{i,j}=\langle\mathbf{b}_{i},\mathbf{b}_{j}^{*}\rangle/\|\mathbf{b}_{j}^{*}\|^{2}$.

We say that $\mathbf{B}$ is size-reduced if $|\mu_{i,j}|\leq\frac{1}{2}$ for all $i\neq j$: then $\|\mathbf{B}\|\leq\sqrt{n}\|\mathbf{B}^{\ast}\|$. Transforming a basis into this form without modifying $\mathcal{L}(\mathbf{B})$ or $\mathbf{B}^{\ast}$ is called size reduction, and this can be done easily and efficiently.

2.3 Lattice basis reduction

LLL reduction.

Let $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})$ be a size-reduced basis. For $\varepsilon\in[0,1]$, we say that $\mathbf{B}$ is $\varepsilon$-LLL-reduced [LLL82] if every rank-two projected block $\mathbf{B}_{[i,i+1]}$ satisfies Lovász’s condition: $\|\mathbf{b}_{i}^{\ast}\|^{2}\leq(1+\varepsilon)\|\mu_{i,i-1}\mathbf{b}_{i-1}^{\ast}+\mathbf{b}_{i}^{\ast}\|^{2}$ for $1<i\leq n$. For $\varepsilon\geq 1/\mathrm{poly}(n)$, one can efficiently compute an $\varepsilon$-LLL-reduced basis for a given lattice.

SVP reduction and its extensions.

Let $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})$ be a basis of a lattice $\mathcal{L}$ and $\delta\geq 1$ be an approximation factor.

We say that $\mathbf{B}$ is $\delta$-SVP-reduced if $\|\mathbf{b}_{1}\|\leq\delta\cdot\lambda_{1}(\mathcal{L})$. Similarly, we say that $\mathbf{B}$ is $\delta$-HSVP-reduced if $\|\mathbf{b}_{1}\|\leq\delta\cdot\mathrm{vol}(\mathcal{L})^{1/n}$.

$\mathbf{B}$ is $\delta$-DSVP-reduced [GN08] (where D stands for dual) if the reversed dual basis $\mathbf{B}^{-s}$ is $\delta$-SVP-reduced and $\mathbf{B}$ is $\frac{1}{3}$-LLL-reduced. Similarly, we say that $\mathbf{B}$ is $\delta$-DHSVP-reduced if $\mathbf{B}^{-s}$ is $\delta$-HSVP-reduced.

The existence of such $\delta$-DSVP-reduced bases is guaranteed by a classical property of LLL that $\|\mathbf{b}_{n}^{\ast}\|$ never decreases during the LLL-reduction process [LLL82].

We can efficiently compute a $\delta$-(D)SVP-reduced basis for a given rank $n$ lattice $\mathcal{L}\subseteq\mathbb{Z}^{m}$ with access to an oracle for $\delta$-SVP on lattices with rank at most $n$. Furthermore, given a basis $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})\in\mathbb{Z}^{m\times n}$ of $\mathcal{L}$ and an index $i\in[1,n-k+1]$, we can use a $\delta$-SVP oracle for lattices with rank at most $k$ to efficiently compute a size-reduced basis $\mathbf{C}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{i-1},\mathbf{c}_{i},\ldots,\mathbf{c}_{i+k-1},\mathbf{b}_{i+k},\ldots,\mathbf{b}_{n})$ of $\mathcal{L}$ such that the block $\mathbf{C}_{[i,i+k-1]}$ is $\delta$-SVP reduced or $\delta$-DSVP reduced:

• •

If $\mathbf{C}_{[i,i+k-1]}$ is $\delta$-SVP-reduced, the procedures in [GN08, MW16] equipped with $\delta$-SVP-oracle ensure that $\|\mathbf{C}^{\ast}\|\leq\|\mathbf{B}^{\ast}\|$;

• •

If $\mathbf{C}_{[i,i+k-1]}$ is $\delta$-DSVP-reduced, the inherent LLL reduction implies $\|\mathbf{C}^{\ast}\|\leq 2^{k}\|\mathbf{B}^{\ast}\|$. Indeed, the GSO of $\mathbf{C}_{[i,i+k-1]}$ satisfies $\|(\mathbf{C}_{[i,i+k-1]})^{\ast}\|\leq 2^{k/2}\lambda_{k}(\mathcal{L}(\mathbf{C}_{[i,i+k-1]}))$ (by [LLL82, p. 518, Line 27]) and $\lambda_{k}(\mathcal{L}(\mathbf{C}_{[i,i+k-1]}))\leq\sqrt{k}\|\mathbf{B}^{\ast}\|$. Here, $\lambda_{k}(\cdot)$ denotes the $k$-th minimum.

With size-reduction, we can iteratively perform $\mathrm{poly}(n,\log\|\mathbf{B}\|)$ many such operations efficiently. In particular, doing so will not increase $\|\mathbf{B}^{\ast}\|$ by more than a factor of $2^{\mathrm{poly}(n,\log\|B\|)}$, and therefore the same is true of $\|\mathbf{B}\|$. That is, all intermediate entries and the total cost during execution (excluding oracle queries) remain polynomially bounded in the initial input size; See, e.g., [GN08, LN14] for the evidence. Therefore, to bound the running time of basis reduction, it suffices to bound the number of calls to these block reduction subprocedures.

Twin reduction and gluing.

We define the following notion, which was implicit in [GN08] and will arise repeatedly in our proofs. $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{d+1})$ is $\delta$-twin-reduced if $\mathbf{B}_{[1,d]}$ is $\delta$-HSVP-reduced and $\mathbf{B}_{[2,d+1]}$ is $\delta$-DHSVP-reduced. The usefulness of twin reduction is illustrated by the following fact, which is the key idea behind Gama and Nguyen’s slide reduction (and is remarkably simple in hindsight).

Fact 2.1**.**

If $\mathbf{B}:=(\mathbf{b}_{1},\ldots,\mathbf{b}_{d+1})\in\mathbb{R}^{m\times(d+1)}$ is $\delta$-twin-reduced, then

[TABLE]

Furthermore,

[TABLE]

Proof.

By definition, we have $\|\mathbf{b}_{1}\|^{d}\leq\delta^{d}\mathrm{vol}(\mathbf{B}_{[1,d]})$, which is equivalent to

[TABLE]

Similarly,

[TABLE]

Combining these two inequalities yields Eq. (3).

Finally, we have $\|\mathbf{b}_{1}\|^{d}\|\mathbf{b}_{d+1}^{*}\|\leq\delta^{d}\mathrm{vol}(\mathbf{B})$. Applying Eq. (3) implies the first inequality in Eq. (4), and similar analysis yields the second inequality. ∎

The following gluing lemma, which is more-or-less implicit in prior work, shows conditions on the blocks $\mathbf{B}_{[1,d]}$ and $\mathbf{B}_{[d+1,n]}$ that are sufficient to imply (H)SVP reduction of the full basis $\mathbf{B}$. Notice in particular that the decay of the Gram-Schmidt vectors guaranteed by Eq. (3) is what is needed for Item 2 of the lemma below, when $\eta=\delta^{1/(d-1)}$. And, with this same choice of $\eta$, the HSVP reduction requirement on $\mathbf{B}_{[1,d]}$ in Fact 2.1 is the same as the one in Item 2 of Lemma 2.2.

Lemma 2.2** (The gluing lemma).**

Let $\mathbf{B}:=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})\in\mathbb{R}^{m\times n}$, $\alpha,\beta,\eta\geq 1$, and $1\leq d\leq n$.

If $\mathbf{B}_{[d+1,n]}$ is $\beta$-SVP-reduced, $\|\mathbf{b}_{1}\|\leq\alpha\|\mathbf{b}_{d+1}^{*}\|$, and $\lambda_{1}(\mathcal{L}(\mathbf{B}))<\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,d]}))$, then $\mathbf{B}$ is $\alpha\beta$-SVP-reduced. 2. 2.

If $\mathbf{B}_{[1,d]}$ is $\eta^{d-1}$-HSVP-reduced, $\mathbf{B}_{[d+1,n]}$ is $\eta^{n-d-1}$-HSVP-reduced, and $\|\mathbf{b}_{1}\|\leq\eta^{2d}\|\mathbf{b}_{d+1}^{*}\|$, then $\mathbf{B}$ is $\eta^{n-1}$-HSVP-reduced.

Proof.

For Item 1, since $\lambda_{1}(\mathcal{L}(\mathbf{B}))<\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,d]}))$, there exists a shortest non-zero vector $\mathbf{u}\in\mathcal{L}(\mathbf{B})$ with $\|\mathbf{u}\|=\lambda_{1}(\mathcal{L}(\mathbf{B}))$ and $\pi_{d}(\mathbf{u})\neq 0$. Since $\mathbf{B}_{[d+1,n]}$ is $\beta$-SVP-reduced, it follows that $\|\mathbf{b}_{d+1}^{*}\|/\beta\leq\|\pi_{d}(\mathbf{u})\|\leq\|\mathbf{u}\|=\lambda_{1}(\mathcal{L}(\mathbf{B}))$. Finally, we have $\|\mathbf{b}_{1}\|\leq\alpha\|\mathbf{b}_{d+1}^{*}\|\leq\alpha\beta\lambda_{1}(\mathcal{L})$ as needed.

Turning to Item 2, we note that the HSVP conditions imply that $\|\mathbf{b}_{1}\|^{d}\leq\eta^{d(d-1)}\mathrm{vol}(\mathbf{B}_{[1,d]})$ and $\|\mathbf{b}_{d+1}^{*}\|^{n-d}\leq\eta^{(n-d)(n-d-1)}\mathrm{vol}(\mathbf{B}_{[d+1,n]})$. Using the bound on $\|\mathbf{b}_{1}\|$ relative to $\|\mathbf{b}_{d+1}^{*}\|$, we have

[TABLE]

as needed. ∎

2.4 The Micciancio-Walter DBKZ algorithm

We recall Micciancio and Walter’s elegant DBKZ algorithm [MW16], as we will need it later. Formally, we slightly generalize DBKZ by allowing for the use of a $\delta$-SVP-oracle. We provide only a high-level sketch of the proof of correctness, as the full proof is the same as the proof in [MW16], with Hermite’s constant $\gamma_{k}$ replaced by $\delta^{2}\gamma_{k}$.

Theorem 2.3**.**

For integers $n>k\geq 2$, an approximation factor $1\leq\delta\leq 2^{k}$, an input basis $\mathbf{B}_{0}\in\mathbb{Z}^{m\times n}$ for a lattice $\mathcal{L}\subseteq\mathbb{Z}^{m}$, and $N:=\lceil(2n^{2}/(k-1)^{2})\cdot\log(n\log(5\|\mathbf{B}_{0}\|)/\varepsilon)\rceil$ for some $\varepsilon\in[2^{-\mathrm{poly}(n)},1]$, Algorithm 1 outputs a basis $\mathbf{B}$ of $\mathcal{L}$ in polynomial time (excluding oracle queries) such that

[TABLE]

by making $N\cdot(2n-2k+1)+1$ calls to the $\delta$-SVP oracle for lattices with rank $k$.

Proof sketch.

We briefly sketch a proof of the theorem, but we outsource the most technical step to a claim from [MW16], which was originally proven in [Neu17]. Let $\mathbf{B}^{(\ell)}$ be the basis immediately after the $\ell$th tour, and let $x_{i}^{(\ell)}:=\log\mathrm{vol}(\mathbf{B}_{[1,k+i-1]}^{(\ell)})-\frac{k+i-1}{n}\log\mathrm{vol}(\mathcal{L})$ for $i=1,\ldots,n-k$. Let

[TABLE]

By [MW16, Claim 3] (originally proven in [Neu17]), we have

[TABLE]

where $\xi:=1/(1+n^{2}/(4k(k-1)))\geq 4(k-1)^{2}/(5n^{2})$. Furthermore, notice that

[TABLE]

It follows that

[TABLE]

In other words,

[TABLE]

Notice that the first vector $\mathbf{b}_{1}$ of the output basis is a $\delta$-approximate shortest vector in \mathcal{L}\big{(}\mathbf{B}_{[1,k]}^{(N)}\big{)}. Therefore,

[TABLE]

as needed. ∎

3 Slide reduction for $n\leq 2k$

In this section, we consider a generalization of Gama and Nguyen’s slide reduction that applies to the case when $k<n\leq 2k$ [GN08]. Our definition in this case is not particularly novel or surprising, as it is essentially identical to Gama and Nguyen’s except that our blocks are not the same size.444The only difference, apart from the approximation factor $\delta$, is that we use SVP reduction instead of HKZ reduction for the primal. It is clear from the proof in [GN08] that only SVP reduction is required, as was observed in [MW16]. We do require that additional blocks $\mathbf{B}_{[i,n]}$ for $q+1\leq i\leq k$ are SVP-reduced, which is quite similar to simply HKZ-reducing $\mathbf{B}_{[q+1,n]}$, but this requirement plays a distinct role in our analysis, as we discuss below.

What is surprising about this definition is that it allows us to achieve sublinear approximation factors for SVP when the rank is $n=k+q$ for $q=\Theta(k)$. Before this work, it seemed that approximation factors less than roughly $\gamma_{q}\approx n$ could not be achieved using the techniques of slide reduction (or, for that matter, any other known techniques with formal proofs). Indeed, our slide-reduced basis only achieves $\|\mathbf{b}_{1}\|\lesssim\gamma_{q}\lambda_{1}(\mathcal{L})$, which is the approximation factor resulting from the gluing lemma, Lemma 2.2. (This inequality is tight.) We overcome this barrier by using our additional constraints on the primal together with some additional properties of slide-reduced bases (namely, Eq. (4)) to bound $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,k]}))$. Perhaps surprisingly, the resulting bound is much better than the bound on $\|\mathbf{b}_{1}\|$, which allows us to find a much shorter vector with an additional oracle call.

Definition 3.1** (Slide reduction).**

Let $n=k+q$ where $1\leq q\leq k$ are integers. A basis $\mathbf{B}$ of a lattice with rank $n$ is $(\delta,k)$-slide-reduced (with block size $k\geq 2$ and approximation factor $\delta\geq 1$) if it is size-reduced and satisfies the following set of conditions.

Primal conditions: The blocks $\mathbf{B}_{[1,q]}$ and $\mathbf{B}_{[i,n]}$ for $i\in[q+1,\max\{k,q+1\}]$ are $\delta$-SVP-reduced. 2. 2.

Dual condition: the block $\mathbf{B}_{[2,q+1]}$ is $\delta$-DSVP-reduced.

A reader familiar with the slide reduction algorithm from [GN08] will not be surprised to learn that such a basis can be found (up to some small slack) using polynomially many calls to a $\delta$-SVP oracle on lattices with rank at most $k$. Before presenting and analyzing the algorithm, we show that such a slide-reduced basis is in fact useful for approximating SVP with sub-linear factors. (We note in passing that a slight modification of the proof of Theorem 3.2 yields a better result when $q=o(k)$. This does not seem very useful on its own, though, since when $q=o(k)$, the running times of our best SVP algorithms are essentially the same for rank $k$ and rank $k+q$.)

Theorem 3.2**.**

Let $\mathcal{L}$ be a lattice with rank $n=k+q$ where $2\leq q\leq k$ are integers. For any $\delta\geq 1$, if a basis $\mathbf{B}$ of $\mathcal{L}$ is $(\delta,k)$-slide-reduced, then,

[TABLE]

Proof.

Let $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})$. We distinguish two cases.

First, suppose that there exists an index $i\in[q+1,\max\{k,q+1\}]$ such that $\|\mathbf{b}_{i}^{\ast}\|>\delta\lambda_{1}(\mathcal{L})$. Let $\mathbf{v}$ be a shortest non-zero vector of $\mathcal{L}$. We claim that $\pi_{i}(\mathbf{v})=0$, i.e., that $\mathbf{v}\in\mathcal{L}(\mathbf{B}_{[1,i-1]})$. If this is not the case, since $\mathbf{B}_{[i,n]}$ is $\delta$-SVP-reduced, we have that

[TABLE]

which is a contradiction. Thus, we see that $\mathbf{v}\in\mathcal{L}(\mathbf{B}_{[1,i-1]})\subseteq\mathcal{L}(\mathbf{B}_{[1,k]})$, and hence $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,k]}))=\lambda_{1}(\mathcal{L})$ (which is much stronger than what we need).

Now, suppose that $\|\mathbf{b}_{i}^{\ast}\|\leq\delta\lambda_{1}(\mathcal{L})$ for all indices $i\in[q+1,\max\{k,q+1\}]$. By definition, the primal and dual conditions imply that $\mathbf{B}_{[1,q+1]}$ is $\delta\sqrt{\gamma_{q}}$-twin-reduced. Therefore, by Eq. (4) of Fact 2.1, we have

[TABLE]

where we have used the assumption that $\|\mathbf{b}_{i}^{\ast}\|\leq\delta\lambda_{1}(L)$ for all indices $i\in[q+1,\max\{k,q+1\}]$ (and by convention we take the product to equal one in the special case when $q=k$). By the definition of Hermite’s constant, this implies that

[TABLE]

as needed. ∎

3.1 The slide reduction algorithm for $n\leq 2k$

We now present our slight generalization of Gama and Nguyen’s slide reduction algorithm that works for all $k+2\leq n\leq 2k$.

Our proof that Algorithm 2 runs in polynomial time (excluding oracle calls) is essentially identical to the proof in [GN08].

Theorem 3.3**.**

For $\varepsilon\geq 1/\mathrm{poly}(n)$, Algorithm 2 runs in polynomial time (excluding oracle calls), makes polynomially many calls to its $\delta$-SVP oracle, and outputs a $((1+\varepsilon)\delta,k)$-slide-reduced basis of the input lattice $\mathcal{L}$.

Proof.

First, notice that if Algorithm 2 terminates, then its output must be $((1+\varepsilon)\delta,k)$-slide-reduced. So, we only need to argue that the algorithm runs in polynomial time (excluding oracle calls).

Let $\mathbf{B}_{0}\in\mathbb{Z}^{m\times n}$ be the input basis and let $\mathbf{B}\in\mathbb{Z}^{m\times n}$ denote the current basis during the execution of the algorithm. As is common in the analysis of basis reduction algorithms [LLL82, GN08, LN14], we consider an integral potential of the form

[TABLE]

The initial potential satisfies $\log P(\mathbf{B}_{0})\leq 2q\cdot\log\|\mathbf{B}_{0}\|$, and every operation in Algorithm 2 either preserves or significantly decreases $P(\mathbf{B})$. More precisely, if the $\delta$-DSVP-reduction step (i.e., Step 8) occurs, then the potential $P(\mathbf{B})$ decreases by a multiplicative factor of at least $(1+\varepsilon)^{2}$. No other step changes $\mathcal{L}(\mathbf{B}_{[1,q]})$ or $P(\mathbf{B})$.

Therefore, Algorithm 2 updates $\mathcal{L}(\mathbf{B}_{[1,q]})$ at most $\frac{\log P(\mathbf{B}_{0})}{2\log(1+\varepsilon)}$ times, and hence it makes at most $\frac{qk\log\|\mathbf{B}_{0}\|}{\log(1+\varepsilon)}$ calls to the $\delta$-SVP-oracle. From the complexity statement in Section 2.3, it follows that Algorithm 2 runs efficiently (excluding the running time of oracle calls). ∎

Corollary 3.4**.**

For any constant $c\in(1/2,1]$ and $\delta:=\delta(n)\geq 1$, there is an efficient reduction from $O(\delta^{2c+1}n^{c})$-SVP on lattices with rank $n$ to $\delta$-SVP on lattices with rank $k:=\lceil n/(2c)\rceil$.

Proof.

On input (a basis for) an integer lattice $\mathcal{L}\subseteq\mathbb{Z}^{m}$ with rank $n$, the reduction first calls Algorithm 2 to compute a $((1+\varepsilon)\delta,k)$-slide-reduced basis $\mathbf{B}$ of $\mathcal{L}$ with, say, $\varepsilon=1/n$. The reduction then uses its $\delta$-SVP oracle once more on $\mathbf{B}_{[1,k]}$ and returns the resulting nonzero short lattice vector.

It is immediate from Theorem 3.3 that this reduction is efficient, and by Theorem 3.2, the output vector is a $\delta^{\prime}$-approximate shortest vector, where

[TABLE]

as needed. ∎

4 Slide reduction for $n\geq 2k$

We now introduce a generalized version of slide reduction for lattices with any rank $n\geq 2k$. As we explained in Section 1.2, at a high level, our generalization of the definition from [GN08] is the same as the original, except that (1) our first block $\mathbf{B}_{[1,k+q]}$ is bigger than the others (out of necessity, since we can no longer divide our basis evenly into disjoint blocks of size $k$); and (2) we only $\eta$-HSVP reduce the first block (since we cannot afford to $\delta$-SVP reduce a block with size larger than $k$). Thus, our notion of slide reduction can be restated as “the first block and the first dual block are $\eta$-(D)HSVP reduced and the rest of the basis $\mathbf{B}_{[k+q+1,n]}$ is slide-reduced in the sense of [GN08].”555Apart from the approximation factor $\delta$, there is one minor difference between our primal conditions and those of [GN08]. We only require the primal blocks to be SVP-reduced, while [GN08] required them to be HKZ-reduced, which is a stronger condition. It is clear from the proof in [GN08] that only SVP reduction is required, as was observed in [MW16].

However, the specific value of $\eta$ that we choose in our definition below might look unnatural at first. We first present the definition and then explain where $\eta$ comes from.

Definition 4.1** (Slide reduction).**

Let $n,k,p,q$ be integers such that $n=pk+q$ with $p,k\geq 2$ and $0\leq q\leq k-1$, and let $\delta\geq 1$. A basis $\mathbf{B}\in\mathbb{R}^{m\times n}$ is $(\delta,k)$-slide-reduced if it is size-reduced and satisfies the following three sets of conditions.

Mordell conditions: The block $\mathbf{B}_{[1,k+q]}$ is $\eta$-HSVP-reduced and the block $\mathbf{B}_{[2,k+q+1]}$ is $\eta$-DHSVP-reduced for $\eta:=(\delta^{2}\gamma_{k})^{\frac{k+q-1}{2(k-1)}}$. 2. 2.

Primal conditions: for all $i\in[1,p-1]$, the block $\mathbf{B}_{[ik+q+1,(i+1)k+q]}$ is $\delta$-SVP-reduced. 3. 3.

Dual conditions: for all $i\in[1,p-2]$, the block $\mathbf{B}_{[ik+q+2,(i+1)k+q+1]}$ is $\delta$-DSVP-reduced.666When $p=2$, there are simply no dual conditions.

There are two ways to explain our specific choice of $\eta$. Most simply, notice that the output of the DBKZ algorithm—due to [MW16] and presented in Section 2.4—is $\eta$-HSVP reduced when the input basis has rank $k+q$ (up to some small slack $\varepsilon$). In other words, one reason that we choose this value of $\eta$ is because we actually can $\eta$-HSVP reduce a block of size $k+q$ efficiently with access to a $\delta$-SVP oracle for lattices with rank $k$. If we could do better, then we would in fact obtain a better algorithm, but we do not know how. Second, this value of $\eta$ is natural in this context because it is the choice that “makes the final approximation factor for HSVP match the approximation factor for the first block.” I.e., the theorem below shows that when we plug in this value of $\eta$, a slide-reduced basis of rank $n$ is $(\delta^{2}\gamma_{k})^{\frac{n-1}{2(k-1)}}$-HSVP, which nicely matches the approximation factor of $\eta=(\delta^{2}\gamma_{k})^{\frac{k+q-1}{2(k-1)}}$-HSVP that we need for the first block (whose rank is $k+q$). At a technical level, this is captured by Fact 2.1 and Lemma 2.2.

Of course, the fact that these two arguments suggest the same value of $\eta$ is not a coincidence. Both arguments are essentially disguised proofs of Mordell’s inequality, which says that $\gamma_{n}\leq\gamma_{k}^{(n-1)/(k-1)}$ for $2\leq k\leq n$. E.g., with $\delta=1$ the primal Mordell condition says that $\mathbf{b}_{1}$ yields a witness to Mordell’s inequality for $\mathbf{B}_{[1,k+q]}$.

Theorem 4.2**.**

For any $\delta\geq 1$, $k\geq 2$, and $n\geq 2k$, if $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})\in\mathbb{R}^{m\times n}$ is a $(\delta,k)$-slide-reduced basis of a lattice $\mathcal{L}$, then

[TABLE]

Furthermore, if $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,k+q]}))>\lambda_{1}(\mathcal{L})$ , then

[TABLE]

where $0\leq q\leq k-1$ is such that $n=pk+q$.

Proof.

Let $d:=k+q$. Theorem A.1 of Appendix A shows that $\mathbf{B}_{[d+1,n]}$ is both $(\delta^{2}\gamma_{k})^{\frac{n-d-1}{2(k-1)}}$-HSVP-reduced and $(\delta^{2}\gamma_{k})^{\frac{n-d-k}{(k-1)}}$-SVP-reduced. (We relegate this theorem and its proof to the appendix because it is essentially just a restatement of [GN08, Theorem 1], since $\mathbf{B}_{[d+1,n]}$ is effectively just a slide-reduced basis in the original sense of [GN08].) Furthermore, $\mathbf{B}_{[1,d+1]}$ is $(\delta^{2}\gamma_{k})^{\frac{d-1}{2(k-1)}}$-twin-reduced, so that $\|\mathbf{b}_{1}\|\leq(\delta^{2}\gamma_{k})^{\frac{d}{k-1}}\|\mathbf{b}_{d+1}^{*}\|$. Applying Lemma 2.2 then yields both Eq. (5) and Eq. (6). ∎

4.1 The slide reduction algorithm for $n\geq 2k$

We now present our slight generalization of Gama and Nguyen’s slide reduction algorithm that works for all $n\geq 2k$. Our proof that the algorithm runs in polynomial time (excluding oracle calls) is essentially identical to the proof in [GN08].

Theorem 4.3**.**

For $\varepsilon\in[1/\mathrm{poly}(n),1]$, Algorithm 3 runs in polynomial time (excluding oracle calls), makes polynomially many calls to its $\delta$-SVP oracle, and outputs a $((1+\varepsilon)\delta,k)$-slide-reduced basis of the input lattice $\mathcal{L}$.

Proof.

First, notice that if Algorithm 3 terminates, then its output is $((1+\varepsilon)\delta,k)$-slide-reduced. So, we only need to argue that the algorithm runs in polynomial time (excluding oracle calls).

Let $\mathbf{B}_{0}\in\mathbb{Z}^{m\times n}$ be the input basis and let $\mathbf{B}\in\mathbb{Z}^{m\times n}$ denote the current basis during the execution of Algorithm 3. As is common in the analysis of basis reduction algorithms [LLL82, GN08, LN14], we consider an integral potential of the form

[TABLE]

The initial potential satisfies $\log P(\mathbf{B}_{0})\leq 2n^{2}\cdot\log\|\mathbf{B}_{0}\|$, and every operation in Algorithm 3 either preserves or significantly decreases $P(\mathbf{B})$. In particular, the potential is unaffected by the primal steps (i.e., Steps 2 and 4), which leave $\mathrm{vol}(\mathbf{B}_{[1,ik+q]})$ unchanged for all $i$. The dual steps (i.e., Steps 7 and 12) either leave $\mathrm{vol}(\mathbf{B}_{[1,ik+q]})$ for all $i$ or decrease $P(\mathbf{B})$ by a multiplicative factor of at least $(1+\varepsilon)$.

Therefore, Algorithm 2 updates $\mathrm{vol}(\mathbf{B}_{[1,ik+q]})$ for some $i$ at most $\log P(\mathbf{B}_{0})/\log(1+\varepsilon)$ times. Hence, it makes at most $4pn^{2}\log\|\mathbf{B}_{0}\|/\log(1+\varepsilon)$ calls to the SVP oracle in the SVP and DSVP reduction steps (i.e., Steps 4 and 12), and similarly at most $4n^{2}\log\|\mathbf{B}_{0}\|/\log(1+\varepsilon)$ calls to Algorithm 1. From the complexity statement in Section 2.3, it follows that Algorithm 2 runs efficiently (excluding the running time of oracle calls), as needed.

∎

Corollary 4.4**.**

For any constant $c\geq 1$ and $\delta:=\delta(n)\geq 1$, there is an efficient reduction from $O(\delta^{2c+1}n^{c})$-SVP on lattices with rank $n$ to $\delta$-SVP on lattices with rank $k:=\lfloor n/(c+1)\rfloor$.

Proof.

On input (a basis for) an integer lattice $\mathcal{L}\subseteq\mathbb{Z}^{m}$ with rank $n$, the reduction first calls Algorithm 3 to compute a $((1+\varepsilon)\delta,k)$-slide-reduced basis $\mathbf{B}=(\mathbf{b}_{1},\cdots,\mathbf{b}_{n})$ of $\mathcal{L}$ with, say, $\varepsilon=1/n$. Then, the reduction uses the procedure from Corollary 3.4 on the lattice $\mathcal{L}(\mathbf{B}_{[1,2k]})$ with $c=1$ (i.e., slide reduction on a lattice with rank $2k$), to find a vector $\mathbf{v}\in\mathcal{L}(\mathbf{B}_{[1,2k]})$ with $0<\|\mathbf{v}\|\leq O(\delta^{3}n)\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,2k]}))$. Finally, the reduction outputs the shorter of the two vectors $\mathbf{b}_{1}$ and $\mathbf{v}$.

It is immediate from Corollary 3.4 and Theorem 4.3 that this reduction is efficient. To prove correctness, we consider two cases.

First, suppose that $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,k+q]}))=\lambda_{1}(\mathcal{L})$. Then,

[TABLE]

so that the algorithm will output a $O(\delta^{2c+1}n^{c})$-approximate shortest vector.

On the other hand, if $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[1,k+q]}))>\lambda_{1}(\mathcal{L})$, then by Theorem 4.2, we have

[TABLE]

so that the algorithm also outputs a $O(\delta^{2c+1}n^{c})$-approximate shortest vector in this case. ∎

Appendix A Properties of Gama and Nguyen’s slide reduction

In the theorem below, $\mathbf{B}_{[d+1,n]}$ is essentially just a slide-reduced basis in the sense of [GN08]. So, the following is more-or-less just a restatement of [GN08, Theorem 1].

Theorem A.1**.**

Let $\mathbf{B}=(\mathbf{b}_{1},\ldots,\mathbf{b}_{n})\in\mathbb{R}^{m\times n}$ with $n=pk+d$ for some $p\geq 1$ and $d\geq k$ be $(\delta,k)$-slide reduced in the sense of Definition 4.1. Then,

[TABLE]

Proof.

By definition, for each $i\in[0,p-2]$, the block $\mathbf{B}_{[ik+d+1,(i+1)k+d+1]}$ is $\delta\sqrt{\gamma_{k}}$-twin reduced. By Eq. (3) of Fact 2.1, we see that

[TABLE]

which implies (7) by induction.

We prove (8) and (9) by induction over $p$. If $p=1$, then both inequalities hold as $\mathbf{B}_{[d+1,n]}$ is $\delta$-SVP reduced by the definition of slide reduction. Now, assume that Eqs. (8) and (9) hold for $p-1\geq 1$. Then $\mathbf{B}$ satisfies the requirements of the theorem with $d^{\prime}:=d+k$ and $p^{\prime}:=p-1$. Therefore, by the induction hypothesis, we have

[TABLE]

Since $\mathbf{B}_{[d+1,d+k]}$ is $\delta\sqrt{\gamma_{k}}$-HSVP reduced, we may apply Lemma 2.2, which proves (8) for $\mathbf{B}_{[d+1,n]}$.

Furthermore, if $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[d+1,n]}))<\lambda_{1}(\mathcal{L}(\mathbf{B}_{[d+1,d+k+1]}))$, then $\mathbf{B}_{[d+1,n]}$ is $\delta^{\prime}$-SVP-reduced for

[TABLE]

as needed. If not, then $\lambda_{1}(\mathcal{L}(\mathbf{B}_{[d+1,n]}))=\lambda_{1}(\mathcal{L}(\mathbf{B}_{[d+1,d+k+1]}))$, and $\|\mathbf{b}_{1}\|\leq\delta\lambda_{1}(\mathcal{L}(\mathbf{B}_{[d+1,n]}))$ because $\mathbf{B}_{[d+1,d+k+1]}$ is $\delta$-SVP reduced. In all cases, we proved (9). ∎