🤖 AI Summary
The shortest vector problem (SVP) is a foundational computational challenge in lattice-based cryptography.
Method: This paper introduces a novel algorithmic framework for SVP based on bounded-distance decoding (BDD) and discrete Gaussian sampling (DGS), establishing— for the first time—the time–memory trade-off for DGS at the smoothing parameter. It integrates lattice basis reduction, kissing-number bounds, and QRAM-aware architecture design, moving beyond classical enumeration and sieving paradigms.
Contribution/Results: We present the first subexponential quantum SVP algorithm with runtime $2^{0.95n}$; optimized via QRAM, it improves to $2^{0.667n}$. The classical variant achieves $2^{1.292n}$, while the quantum version without QRAM runs in $2^{0.750n}$—all substantially outperforming the prior state-of-the-art $2^n$ bound of ADRS15. These results represent significant advances in both asymptotic complexity and practical resource efficiency for lattice algorithms.
📝 Abstract
The most important computational problem on lattices is the Shortest Vector Problem (SVP). In this paper, we present new algorithms that improve the state-of-the-art for provable classical/quantum algorithms for SVP. We present the following results. $ullet$ A new algorithm for SVP that provides a smooth tradeoff between time complexity and memory requirement. For any positive integer $4leq qleq sqrt{n}$, our algorithm takes $q^{13n+o(n)}$ time and requires $poly(n)cdot q^{16n/q^2}$ memory. This tradeoff which ranges from enumeration ($q=sqrt{n}$) to sieving ($q$ constant), is a consequence of a new time-memory tradeoff for Discrete Gaussian sampling above the smoothing parameter. $ullet$ A quantum algorithm for SVP that runs in time $2^{0.950n+o(n)}$ and requires $2^{0.5n+o(n)}$ classical memory and poly(n) qubits. In Quantum Random Access Memory (QRAM) model this algorithm takes only $2^{0.835n+o(n)}$ time and requires a QRAM of size $2^{0.293n+o(n)}$, poly(n) qubits and $2^{0.5n}$ classical space. This improves over the previously fastest classical (which is also the fastest quantum) algorithm due to [ADRS15] that has a time and space complexity $2^{n+o(n)}$. $ullet$ A classical algorithm for SVP that runs in time $2^{1.669n+o(n)}$ time and $2^{0.5n+o(n)}$ space. This improves over an algorithm of [CCL18] that has the same space complexity. The time complexity of our classical and quantum algorithms are obtained using a known upper bound on a quantity related to the lattice kissing number which is $2^{0.402n}$. We conjecture that for most lattices this quantity is a $2^{o(n)}$. Assuming that this is the case, our classical algorithm runs in time $2^{1.292n+o(n)}$, our quantum algorithm runs in time $2^{0.750n+o(n)}$ and our quantum algorithm in QRAM model runs in time $2^{0.667n+o(n)}$.
