Oded Goldreich, Daniele Micciancio, Shmuel Safra, and Jean-Pierre Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. In Electronic Colloquium on Computational Complexity, technical reports. ECCC, 1999.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....of [74] is supported by the result of Ajtai [6] who showed that the shortest vector problem is NP hard under randomized reductions. Micciancio [54] furthermore proved that finding an approximate solution within any constant factor less than is also NP hard for randomized reductions. It is known [37], 43] however, that the shortest vector problem is not harder than the closest vector problem. The CLOSESTPOINT algorithm can be straightforwardly modified to solve the shortest vector problem. The idea is to submit as the input and exclude as a potential output. Algorithmically, the changes ....

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert, "Approximating shortest lattice vectors is not harder than approximating closest lattice vectors," Inform. Processing Lett., vol. 71, pp. 55--61, July 1999.

....[98, 97] simplified and improved the result by showing that approximating SVP to within a factor 2 is also NP hard under randomized reductions. The NP hardness of SVP under deterministic (Karp) reductions remains an open problem. CVP seems to be a more difficult problem. Goldreich et al. [62] recently noticed that CVP cannot be easier than SVP: given an oracle that approximates CVP to within a factor f(d) one can approximate SVP in polynomial time to within the same factor f(d) Reciprocally, Kannan proved in [78, Section 7] that any algorithm approximating SVP to within a ....

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors, 1999. Available at [47] as TR99-002.

....[82, 81] simplified and improved the result by showing that approximating SVP to within a factor 2 is also NP hard under randomized reductions. The NP hardness of SVP under deterministic (Karp) reductions remains an open problem. CVP seems to be a more difficult problem. Goldreich et al. [50] recently noticed that CVP cannot be easier than SVP: given an oracle that approximates CVP to within a factor f(d) one can approximate SVP in polynomial time to within the same factor f(d) Reciprocally, Kannan proved in [64] that any algorithm approximating SVP to within a non decreasing ....

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Available at [39] at TR99-002.

....and Goldwasser showed that CVP is unlikely to be NP hard to approximate within p n= log n [7] Cai [4] showed a worst case to average case reduction for certain approximate versions of CVP. In general, CVP seems to be a harder problem than SVP; for example, it was shown by Goldreich et al. [8] that if one can approximate CVP, then one can approximate SVP to within the same factor in essentially the same time. A few words of comparison between our method and that of Ravi Kannan [10] Kannan also presents a deterministic polynomial time Turing reduction from approximate CVP to the ....

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Information Processing Letters, 71:55--61, 1999.

....1 = 1 (L) min kvk : v 2 L; v 6= 0g: 114 If t is any vector, we use a similar notation 1 (t) 1 (t; L) min kt vk : v 2 Lg to denote the distance from t to a closest vector in L. In terms of theoretical complexity theory, CVP may be a little harder to solve than SVP (but see [5]) However, for most problems there appears to be very little di erence in practice. More precisely, if (L; t) is an n dimensional CVP to be solved, then one forms the (n 1) dimensional lattice L 0 = f(v; 0) v 2 Lg fk(t; c) k 2 Zg R n 1 : For an appropriately chosen value of c, a ....

O. Goldreich, D. Micciancio, S. Safra and J.P. Seifert, Approximating shortest lattice vectors is not harder than approximating closest vectors, Information Processing Letters, vol. 71, pp. 55-61, 1999.

....is supported by the result of Ajtai [5] who showed that the shortest vector problem is NP hard under randomized reductions. Micciancio [34] furthermore proved that finding an approximate solution within any constant factor less than p 2 is also NP hard for randomized reductions. It is known [22,26], however, that the shortest vector problem is not harder than the closest vector problem. The ClosestPoint algorithm can be straightforwardly modified to solve the shortest vector problem. The idea is to submit x = 0 as the input and exclude x = 0 as a potential output. Algorithmically, the ....

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert, "Approximating shortest lattice vectors is not harder than approximating closest lattice vectors," Information Processing Letters, vol. 71, pp. 55--61, July 1999.

....[82, 81] simplified and improved the result by showing that approximating SVP to within a factor p 2 is also NP hard under randomized reductions. The NP hardness of SVP under deterministic (Karp) reductions remains an open problem. CVP seems to be a more difficult problem. Goldreich et al. [50] recently noticed that CVP cannot be easier than SVP: given an oracle that approximates CVP to within a factor f(d) one can approximate SVP in polynomial time to within the same factor f(d) Reciprocally, Kannan proved in [64] that any algorithm approximating SVP to within a non decreasing ....

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Available at [39] at TR99-002.

No context found.

Oded Goldreich, Daniele Micciancio, Shmuel Safra, and Jean-Pierre Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. In Electronic Colloquium on Computational Complexity, technical reports. ECCC, 1999.

No context found.

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Information Processing Letters, 71(2):55--61, 1999.

No context found.

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Information Processing Letters, 1999. To appear.

.... lattice [11, 4, 13] On the other hand, CVP is NP hard to approximate within a factor fl = 2 ln 1 Gammaffl n [3, 5] and SVP is NP hard (for randomized reductions) to approximate within any factor less than p 2 [12] The relation between the two problems has also been investigated, and in [9] it is proved that CVP is at least as hard as SVP. In general, finding good approximations to SVP and CVP seems to be computationally hard problems and have been used as the basis of various cryptographic protocols (e.g. 1, 2, 8] The approximation problems associated to the shortest vector ....

....prover that p s is bounded away from 1, and therefore also the soundness error p p s is bounded away from 1. This concludes the proof of Proposition 2. Interestingly, the proof systems we just described for SVP and CVP are reminiscent of the connection between the two problems discovered in [9]. In that work, an SVP instance B is reduced to a CVP problem by removing some basis vector b i from the lattice L(B) by doubling the corresponding basis element, and then looking for a lattice vector (in the doubled sub lattice) closest to b i . Our protocols for SVP, doubles the basis vectors 2B ....

[Article contains additional citation context not shown here]

Oded Goldreich, Daniele Micciancio, Shmuel Safra, and Jean-Pierre Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. In Electronic Colloquium on Computational Complexity, technical reports. ECCC, 1999.

....GGH, vs. O(n 4 ) for AD. For RSA and El Gamal systems, key size is O(n) and computation time is O(n 3 ) The authors of GGH argued that the increase in size of the keys was more than compensated by the decrease in computation time. Ajtai s work [1] initiated a substantial amount of research [7, 2, 22, 13, 9, 6, 17] on the hardness of SVP, CVP, and related problems. We now know that SVP is NP hard for polynomial random reductions [2] even up to some constant [22] CVP is NP hard [11] and approximating CVP to within almost polynomial factors is also NP hard [9] In fact, SVP cannot be harder than CVP: it ....

....of SVP, CVP, and related problems. We now know that SVP is NP hard for polynomial random reductions [2] even up to some constant [22] CVP is NP hard [11] and approximating CVP to within almost polynomial factors is also NP hard [9] In fact, SVP cannot be harder than CVP: it was recently shown [17] that one can approximate SVP to any factor in polynomial time given an approximation CVP oracle for the same factor and dimension. On the other hand, approximating SVP or CVP to p n= log(n) are unlikely to be NP hard [13] n denotes the lattice dimension) Furthermore, there exist ....

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Available at [10] as TR99-002.

No context found.

O. Goldreich, D. Micciancio, S. Safra, and J.-P. Seifert. Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Inform. Process. Lett., 71(2):55--61, 1999.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC