[Paper Review] Search-to-Decision Reductions for Lattice Problems with Approximation Factors (Slightly) Greater Than One

Noah Stephens-Davidowitz|arXiv (Cornell University)|Dec 13, 2015

Cryptography and Data Security17 references3 citations

TL;DR

This paper presents the first dimension-preserving search-to-decision reductions for lattice problems with approximation factors slightly greater than one, specifically reducing γ^{O(n/log n)}-SVP to γ-GapSVP and γ^{O(n)}-CVP to γ-GapCVP for γ ≤ 1 + O(log n / n). The approach uses iterative lattice basis transformations and oracle queries to progressively shrink the shortest vector, achieving tighter approximation factors than prior work.

ABSTRACT

We show the first dimension-preserving search-to-decision reductions for approximate SVP and CVP. In particular, for any $γ\leq 1 + O(\log n/n)$, we obtain an efficient dimension-preserving reduction from $γ^{O(n/\log n)}$-SVP to $γ$-GapSVP and an efficient dimension-preserving reduction from $γ^{O(n)}$-CVP to $γ$-GapCVP. These results generalize the known equivalences of the search and decision versions of these problems in the exact case when $γ= 1$. For SVP, we actually obtain something slightly stronger than a search-to-decision reduction---we reduce $γ^{O(n/\log n)}$-SVP to $γ$-unique SVP, a potentially easier problem than $γ$-GapSVP.

Motivation & Objective

• To close the gap in understanding the relationship between search and decision versions of lattice problems for approximation factors slightly above 1.
• To develop efficient, dimension-preserving reductions from approximate SVP and CVP to their decision counterparts (GapSVP and GapCVP).
• To improve upon prior reductions in [Che13, HP14] by achieving better approximation parameters for the search problems.
• To formalize a reduction framework that enables proving the equivalence of search and decision problems in the approximate regime.

Proposed method

• Constructs a sequence of lattices L^{(i)} with controlled index and shortest vector length ratios using basis transformations.
• For each lattice L^{(i)}, queries a γ-GapSVP oracle on p+1 related lattices L_{i,j} to identify the one with the shortest shortest vector.
• Uses the oracle results to update the basis coefficients a₁^{(i)}, a₂^{(i)}, a₃^{(i)} such that λ₁(L^{(i+1)}) ≤ γ·λ₁(L^{(i)}).
• Applies a recursive reduction step on a derived sublattice L′, either omitting b_{n-1} or b_n, based on the p-adic valuation of basis coefficients.
• Employs a stopping condition after ℓ = O(n / log p) iterations to ensure the final output vector is within γ^{O(n/log n)} of the true shortest vector.
• Uses a geometric argument based on Lemma 2.6 to show that any short vector in L^{(ℓ)} must lie in the reduced sublattice L′, preserving the correctness of the recursive call.

Experimental results

Research questions

• RQ1 Can search-to-decision reductions be constructed for SVP and CVP when the approximation factor γ > 1, particularly for γ close to 1?
• RQ2 Is it possible to maintain dimension preservation in such reductions while achieving sub-exponential approximation factors in the search problem?
• RQ3 How do the approximation parameters of the search problem relate to those of the decision problem in the approximate regime?
• RQ4 Can the reduction framework be generalized beyond the exact case (γ=1) to yield tighter bounds than prior work?
• RQ5 What is the optimal trade-off between the number of oracle queries and the approximation factor in such reductions?

Key findings

• The paper achieves a dimension-preserving reduction from γ^{O(n/log n)}-SVP to γ-GapSVP for any γ ≤ 1 + O(log n / n), improving upon prior work.
• It provides a similar reduction from γ^{O(n)}-CVP to γ-GapCVP under the same γ-bound, establishing a new equivalence in the approximate regime.
• The reduction for SVP is actually stronger, reducing γ^{O(n/log n)}-SVP to γ-unique SVP, a potentially easier variant than γ-GapSVP.
• The approximation factor of the search problem is shown to be γ^{O(n²/log p)} for the final output, which simplifies to γ^{O(n/log n)} when p is chosen as a function of n.
• The reduction framework is shown to be correct through a geometric argument that ensures all short vectors in intermediate lattices L^{(ℓ)} are contained in the recursive sublattice L′.
• The authors acknowledge prior work by Cheng [Che13] and Hu-Pan [HP14] but emphasize that their results achieve better parameters than these earlier reductions.