The Systematic Normal Form (SysNF) is a canonical form of lattices introduced in [Eldar,Shor '16], in which the basis entries satisfy a certain co-primality condition. Using a "smooth" analysis of lattices by SysNF lattices we design a quantum algorithm that can efficiently solve the following variant of the bounded-distance-decoding problem: given a lattice L, a vector v, and numbers b = λ_1(L)/n^{17}, a = λ_1(L)/n^{13} decide if v's distance from L is in the range [a/2, a] or at most b, where λ_1(L) is the length of L's shortest non-zero vector. Improving these parameters to a = b = λ_1(L)/\sqrt{n} would invalidate one of the security assumptions of the Learning-with-Errors (LWE) cryptosystem against quantum attacks.
The Systematic Normal Form (SysNF) is a canonical form of lattices introduced in [Eldar,Shor '16], in which the basis entries satisfy a certain co-primality condition. Using a "smooth" analysis of lattices by SysNF lattices we design a quantum algorithm that can efficiently solve the following variant of the bounded-distance-decoding problem: given a lattice L, a vector v, and numbers b = λ_1(L)/n^{17}, a = λ_1(L)/n^{13} decide if v's distance from L is in the range [a/2, a] or at most b, where λ_1(L) is the length of L's shortest non-zero vector. Improving these parameters to a = b = λ_1(L)/\sqrt{n} would invalidate one of the security assumptions of the Learning-with-Errors (LWE) cryptosystem against quantum attacks.
In this work, we introduce a definition of the Discrete Fourier Transform (DFT) on Euclidean lattices in Rn, that generalizes the n-th fold DFT of the integer lattice Zn to arbitrary lattices. This definition is not applicable for every lattice, but can be defined on lattices known as Systematic Normal Form (SysNF) introduced in \cite{ES16}. Systematic Normal Form lattices are sets of integer vectors that satisfy a single homogeneous modular equation, which itself satisfies a certain number-theoretic property. Such lattices form a dense set in the space of n-dimensional lattices, and can be used to approximate efficiently any lattice. This implies that for every lattice L a DFT can be computed efficiently on a lattice near L. Our proof of the statement above uses arguments from quantum computing, and as an application of our definition we show a quantum algorithm for sampling from discrete distributions on lattices, that extends our ability to sample efficiently from the discrete Gaussian distribution \cite{GPV08} to any distribution that is sufficiently "smooth". We conjecture that studying the eigenvectors of the newly-defined lattice DFT may provide new insights into the structure of lattices, especially regarding hard computational problems, like the shortest vector problem.
The advent of quantum computing poses a significant existential threat to current public-key cryptographic systems, most notably RSA and Elliptic Curve Cryptography (ECC), which rely on the presumed hardness of integer factorization and discrete logarithm problems. Shor's algorithm, a quantum algorithm, can efficiently solve these problems, rendering classical asymmetric primitives insecure. This paper addresses the imperative need for post-quantum cryptography (PQC) by exploring lattice-based constructs as robust alternatives for asymmetric primitives. We provide a comprehensive overview of the fundamental mathematical problems underlying lattice-based cryptography, such as the Shortest Vector Problem (SVP), Closest Vector Problem (CVP), Learning With Errors (LWE), and Ring Learning With Errors (RLWE). The paper surveys prominent lattice-based schemes, including NTRU, CRYSTALS-Kyber, and CRYSTALS-Dilithium, analyzing their security foundations, performance characteristics, and the extent to which they offer a viable "post-quantum RSA." We delve into the methodology of constructing these primitives, discuss their resilience against both classical and quantum attacks, and evaluate their practical implications for key sizes, computational efficiency, and deployment challenges. Our analysis highlights that lattice-based cryptography, particularly the NIST-standardized schemes, presents a strong candidate for securing digital communications in the quantum era, offering provable security rooted in worst-case to average-case reductions for lattice problems.
In this paper, we provide a comprehensive overview of a recent debate over the quantum versus classical solvability of bounded distance decoding (BDD). Specifically, we review the work of Eldar and Hallgren [EH22], [Hal21] demonstrating a quantum algorithm solving λ12−Ω(klogq)-BDD in polynomial time for lattices of periodicity q, finite group rank k, and shortest lattice vector length λ1. Subsequently, we prove the results of [DvW21a], [DvW21b] with far greater detail and elaboration than in the original work. Namely, we show that there exists a deterministic, classical algorithm achieving the same result.
The most important computational problem on lattices is the Shortest Vector Problem (SVP). In this paper, we present new algorithms that improve the state-of-the-art for provable classical/quantum algorithms for SVP. We present the following results. ∙ A new algorithm for SVP that provides a smooth tradeoff between time complexity and memory requirement. For any positive integer 4≤q≤n, our algorithm takes q13n+o(n) time and requires poly(n)⋅q16n/q2 memory. This tradeoff which ranges from enumeration (q=n) to sieving (q constant), is a consequence of a new time-memory tradeoff for Discrete Gaussian sampling above the smoothing parameter. ∙ A quantum algorithm for SVP that runs in time 20.950n+o(n) and requires 20.5n+o(n) classical memory and poly(n) qubits. In Quantum Random Access Memory (QRAM) model this algorithm takes only 20.835n+o(n) time and requires a QRAM of size 20.293n+o(n), poly(n) qubits and 20.5n classical space. This improves over the previously fastest classical (which is also the fastest quantum) algorithm due to [ADRS15] that has a time and space complexity 2n+o(n). ∙ A classical algorithm for SVP that runs in time 21.669n+o(n) time and 20.5n+o(n) space. This improves over an algorithm of [CCL18] that has the same space complexity. The time complexity of our classical and quantum algorithms are obtained using a known upper bound on a quantity related to the lattice kissing number which is 20.402n. We conjecture that for most lattices this quantity is a 2o(n). Assuming that this is the case, our classical algorithm runs in time 21.292n+o(n), our quantum algorithm runs in time 20.750n+o(n) and our quantum algorithm in QRAM model runs in time 20.667n+o(n).
We construct public-key cryptosystems that are secure assuming theworst-case hardness of approximating the minimum distance on n-dimensional lattices to within small Poly(n) factors. Prior cryptosystems with worst-case connections were based either on the shortest vector problem for a special class of lattices (Ajtai and Dwork, STOC 1997; Regev, J. ACM 2004), or on the conjectured hardness of lattice problems for quantum algorithms (Regev, STOC 2005). Our main technical innovation is a reduction from variants of the shortest vector problem to corresponding versions of the "learning with errors" (LWE) problem; previously, only a quantum reduction of this kind was known. As an additional contribution, we construct a natural chosen ciphertext-secure cryptosystem having a much simpler description and tighter underlying worst-case approximation factor than prior schemes.
The most important computational problem on lattices is the Shortest Vector Problem (SVP). In this paper, we present new algorithms that improve the state-of-the-art for provable classical/quantum algorithms for SVP. We present the following results. 1) A new algorithm for SVP that provides a smooth tradeoff between time complexity and memory requirement. For any positive integer 4 ≤ q ≤ √n, our algorithm takes q^{13n+o(n)} time and requires poly(n)⋅ q^{16n/q²} memory. This tradeoff which ranges from enumeration (q = √n) to sieving (q constant), is a consequence of a new time-memory tradeoff for Discrete Gaussian sampling above the smoothing parameter. 2) A quantum algorithm that runs in time 2^{0.9533n+o(n)} and requires 2^{0.5n+o(n)} classical memory and poly(n) qubits. This improves over the previously fastest classical (which is also the fastest quantum) algorithm due to [Divesh Aggarwal et al., 2015] that has a time and space complexity 2^{n+o(n)}. 3) A classical algorithm for SVP that runs in time 2^{1.741n+o(n)} time and 2^{0.5n+o(n)} space. This improves over an algorithm of [Yanlin Chen et al., 2018] that has the same space complexity. The time complexity of our classical and quantum algorithms are expressed using a quantity related to the kissing number of a lattice. A known upper bound of this quantity is 2^{0.402n}, but in practice for most lattices, it can be much smaller and even 2^o(n). In that case, our classical algorithm runs in time 2^{1.292n} and our quantum algorithm runs in time 2^{0.750n}.