0
$\begingroup$

We know (search) approximate Shortest Vector Problem ($\mathsf{SVP}_{\gamma}$): Given an arbitrary basis $\mathbf{B}$ of some lattice $\mathcal{L}=\mathcal{L}(\mathbf{B})$, find a shortest non-zero lattice vector, i.e., a $\mathbf{v}\in\mathcal{L}$ for which $\|\mathbf{v}\|\leq\gamma(n)\cdot\lambda_{1}(\mathcal{L})$.

But, when they want to define decision version of $\mathsf{SVP}_{\gamma}$, they formulate it as a promise problem which is a special case of the decision problem.

My questions are:

  1. In general (i.e. in complexity theory), What are the advantages of defining a problem as a promise problem rather than the more general case, i.e., decision problem?
  2. Why cryptographers (maybe mathematicians?) have defined the decision version of this specific problem as a promise problem (and in gap formulation)?
  3. In [a decade of lattice cryptography, page 29] has been stated that

... for typical choices of rings the decision problem $\mathsf{GapSVP}_{\gamma}$ for small $\gamma=\mathsf{poly}(n)$ factors is actually easy on ideal lattices, ...

If we consider the decision version of $\mathsf{SVP}_{\gamma}$ on ideal lattices for the same typical choices of rings as above, is this problem hard now?

I appreciate any explanatoion or refrences in advance. I'm not familiar with complexity thoery (I didn't understand this question in computer science stack exchange) and know little about ideal lattices and $\textsf{Ring-SIS}, \textsf{Ring-LWE}$.

$\endgroup$

1 Answer 1

1
$\begingroup$

You have it backwards. A decision problem is a special case of a promise problem.

A decision problem is given by a language $L\subseteq \{0,1\}^*$. An algorithm decides this language if

  1. For every $x\in L$, $A(x) = 1$, and
  2. For every $x\not\in L$, $A(x) = 0$.

A promise problem is given by a decomposition $\{0,1\}^* = L_0\sqcup L_1\sqcup L_\bot$. An algorithm solves this promise problem if

  1. For every $x\in L_0$, $A(x) = 0$, and
  2. For every $x\in L_1$, $A(x) = 1$.

There are no requirements for $x\in L_\bot$. Given a decision problem $L$, note that it is also a promise problem $(L_0, L_1,L_\bot) := (L^c, L, \emptyset)$. There isn't a general way to convert an arbitrary promise problem to a decision problem.


Next, why do we care about promise problems? I'll explain with $\mathsf{SVP}_\gamma$. First, recall $\mathsf{SVP}$ (the "decision problem").

The language $\mathsf{SVP}$ is given by $\{(B, t)\in\mathbb{R}^{n\times n}\times \mathbb{R}_{\geq 0} \mid \lambda_1(L(B)) \leq t\}$.

Note that this is not exactly correct. One should include that $B$ has a poly-sized description in the dimension as well. Perhaps you let $N = \mathsf{poly}(n)$ and $B\in [-N, N]^n\cap \mathbb{Z}^n$, or something of this sort. I won't bother with these details though.

To decide $\mathsf{SVP}$, an algorithm must (implicitly) be able to compute $\lambda_1(L(B))$ accurately. In particular, by binary searching on the value of $t$, one can convert any decider for $\mathsf{SVP}$ into an algorithm that computes $\lambda_1(L(B))$, to any arbitrary level of precision.

Next, imagine if we have an algorithm that cannot approximate $\lambda_1(L(B))$ arbitrarily well (e.g. cannot solve $\mathsf{SVP}$), but still yields some non-trivial approximation. Depending on the quality of the estimate, we might be in a regime where

  1. $\mathsf{SVP}$ may still be hard. Yay!
  2. Cryptography may still break. Boo!

So $\mathsf{SVP}$ seems like the wrong problem to look at. Instead, we define the appropriate promise problem $\mathsf{SVP}_\gamma$.

Let \begin{align} L_0 &= \{(B, t)\in\mathbb{R}^{n\times n}\times \mathbb{R}_{\geq 0}\mid \lambda_1(L(B)) > \gamma(n)t\}\\ L_1 &= \{(B, t)\in\mathbb{R}^{n\times n}\times \mathbb{R}_{\geq 0}\mid \lambda_1(L(B)) \leq t\} \end{align} Define $\mathsf{SVP}_\gamma$ to be the promise problem $(L_0, L_1, (L_0\cup L_1)^c)$.

Again, we should also introduce some restriction so that $(B, t)$ admit poly-sized representations in $n$.

Now, an algorithm that solves the promise problem must only be correct on instances $(B, t)$ for which $\frac{t}{\lambda_1(B(L))}\in [0, 1]\cup [\gamma(n), \infty)$. In particular, there is the region $(1, \gamma(n))$ (which one might think of as corresponding to "hard instances") for which the algorithm need not be correct, while still "solving" $\mathsf{SVP}_\gamma$. If we try to run our aformentioned binary search argument, it should be easy to check that an algorithm solving the promise problem $\mathsf{SVP}_\gamma$ can only be used to approximately compute $\lambda_1(L(B))$, up to (multiplicative) approximation error at most $\gamma(n)$. So we don't solve $\mathsf{SVP}$, but for small enough $\gamma$ we might still do something interesting.

Of course, $\mathsf{SVP}_\gamma$ also better matches what we can theoretically prove about lattice problems. For example, Regev's reduction (which motivates the hardness of LWE, at least theoretically) may be phrased at a high-level as

If one can solve LWE (appropriately parameterized) in the average-case, then one can solve $\mathsf{SVP}_\gamma$ (for a certain $\gamma\approx \sqrt{n}$) in the worst-case.

Note that this is another reason why we care about promise problems. If we had a stronger version of Regev's reduction (that was roughly the above with $\gamma = 1$), there would be little reason to talk about $\mathsf{SVP}_\gamma$. Such a reduction would be a massive breakthrough, as $\mathsf{SVP}_1$ is NP hard, so it would imply cryptography based on an NP hard problem. $\mathsf{SVP}_\gamma$ (for $\gamma$ coming from Regev's reduction) is in $\mathsf{NP}\cap\mathsf{coNP}$, so is not expected to be NP hard (and is in a similar situation as things like factoring, discrete logarithm, etc.).

$\endgroup$
2
  • 1
    $\begingroup$ Your definition of SVP$_\gamma$ should reduce to SVP: I could just give an SVP$_\gamma$ solver a pair $(B,t/\gamma(n))$. I thought the promise version was that (in the language of the first part of the answer) $L_0=\{(B,t) : \lambda_1(L(B))\leq t\}$ and $L_1=\{(B,t): \lambda_1(L(B)) \geq \gamma(n)t\}$ and $L_\perp$ is everything else. $\endgroup$
    – Sam Jaques
    Commented Nov 12 at 19:49
  • $\begingroup$ Yes, that seems right to me. I'll edit accordingly $\endgroup$
    – Mark Schultz-Wu
    Commented Nov 13 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.