# Discrete Gaussian Sampling Reduces to CVP and SVP

@article{StephensDavidowitz2016DiscreteGS,
title={Discrete Gaussian Sampling Reduces to CVP and SVP},
author={Noah Stephens-Davidowitz},
journal={ArXiv},
year={2016},
volume={abs/1506.07490}
}
The discrete Gaussian $D_{L- t, s}$ is the distribution that assigns to each vector $x$ in a shifted lattice $L - t$ probability proportional to $e^{-\pi \|x\|^2/s^2}$. It has long been an important tool in the study of lattices. More recently, algorithms for discrete Gaussian sampling (DGS) have found many applications in computer science. In particular, polynomial-time algorithms for DGS with very high parameters $s$ have found many uses in cryptography and in reductions between lattice…
36 Citations

## Figures and Tables from this paper

### Solving the Shortest Vector Problem in 2n Time Using Discrete Gaussian Sampling: Extended Abstract

• Computer Science, Mathematics
STOC
• 2015
The SVP result follows from a natural reduction from SVP to DGS, and a more refined algorithm for DGS above the so-called smoothing parameter of the lattice, which can generate 2n/2 discrete Gaussian samples in just 1.93-approximate decision SVP.

### Improved (Provable) Algorithms for the Shortest Vector Problem via Bounded Distance Decoding

• Computer Science
STACS
• 2021
New algorithms that improve the state-of-the-art for provable classical/quantum algorithms for SVP are presented, including a new algorithm that provides a smooth tradeoff between time complexity and memory requirement.

### Solving the Closest Vector Problem in 2^n Time -- The Discrete Gaussian Strikes Again!

• Computer Science, Mathematics
2015 IEEE 56th Annual Symposium on Foundations of Computer Science
• 2015
A 2n+o(n)-time and space randomized algorithm for solving the exact Closest Vector Problem (CVP) on n-dimensional Euclidean lattices and it is shown that the approximate closest vectors to a target vector t can be grouped into “lower-dimensional clusters,” and the discrete Gaussian sampling algorithm can be used to solve this variant of approximate CVP.

### On the Gaussian Measure Over Lattices

We study the Gaussian mass of a lattice coset ρs(L − t) := ∑ y∈L exp(−π‖y − t‖/s) , where L ⊂ R is a lattice and t ∈ R is a vector describing a shift of the lattice. In particular, we use bounds on

### Quadratic Time, Linear Space Algorithms for Gram-Schmidt Orthogonalization and Gaussian Sampling in Structured Lattices

• Computer Science, Mathematics
EUROCRYPT
• 2015
The main result of the current work is a series of algorithms that ultimately lead to a sampling procedure producing the same outputs as the Klein/GPV one, but requiring only linear-storage when working on lattices used in ideal-lattice cryptography.

### Enumerative Lattice Algorithms in any Norm Via M-ellipsoid Coverings

• Mathematics, Computer Science
2011 IEEE 52nd Annual Symposium on Foundations of Computer Science
• 2011
A novel algorithm for enumerating lattice points in any convex body known as the M-ellipsoid is given, and an expected O(f*(n))^n-time algorithm for Integer Programming, where f*( n) denotes the optimal bound in the so-calledflatnesstheorem, which is conjectured to be f* (n) = O(n).

### Finding Shortest Lattice Vectors in the Presence of Gaps

• Computer Science
CT-RSA
• 2015
An SVP approximation algorithm modified by the ListSieve-Birthday algorithm, which terminates sieve process earlier and relaxes the birthday search, and hence decreases the time complexity significantly.

### Worst-case to average-case reductions based on Gaussian measures

• Computer Science, Mathematics
45th Annual IEEE Symposium on Foundations of Computer Science
• 2004
It is shown that solving modular linear equation on the average is at least as hard as approximating several lattice problems in the worst case within a factor almost linear in the rank of the lattice, and it is proved that the distribution that one obtains after adding Gaussian noise to the lattices has the following interesting property.

### The shortest vector problem in L2 is NP-hard for randomized reductions (extended abstract)

• M. Ajtai
• Mathematics, Computer Science
STOC '98
• 1998
There is a prob-abilistic Turing-machine which in polynomial time reduces any problem in NP to instances of the shortest vector problem, provided that it can use an oracle which returns the solution of the longest vector problem if an instance of it is presented (by giving a basis of the corresponding lattice).

### Lattice Sparsification and the Approximate Closest Vector Problem

• Computer Science, Mathematics
Theory Comput.
• 2016
A method for "spar-sifying" any input lattice while approximately maintaining its metric structure is employed, which employs the idea of random sublattice restrictions, which was first employed by Khot for proving hardness for Shortest Vector Problem (SVP) under lp norms.