1
$\begingroup$

We know (search) approximate Shortest Vector Problem ($\mathsf{SVP}_{\gamma}$): Given an arbitrary basis $\mathbf{B}$ of some lattice $\mathcal{L}=\mathcal{L}(\mathbf{B})$, find a shortest non-zero lattice vector, i.e., a $\mathbf{v}\in\mathcal{L}$ for which $\|\mathbf{v}\|\leq\gamma(n)\cdot\lambda_{1}(\mathcal{L})$.

But, when they want to define decision version of $\mathsf{SVP}_{\gamma}$, they formulate it as a promise problem which is a special case of the decision problem.

My questions are:

  1. In general (i.e. in complexity theory), What are the advantages of defining a problem as a promise problem rather than the more general case, i.e., decision problem?
  2. Why cryptographers (maybe mathematicians?) have defined the decision version of this specific problem as a promise problem (and in gap formulation)?
  3. In [a decade of lattice cryptography, page 29] has been stated that

... for typical choices of rings the decision problem $\mathsf{GapSVP}_{\gamma}$ for small $\gamma=\mathsf{poly}(n)$ factors is actually easy on ideal lattices, ...

If we consider the decision version of $\mathsf{SVP}_{\gamma}$ on ideal lattices for the same typical choices of rings as above, is this problem hard now?

I appreciate any explanatoion or refrences in advance. I'm not familiar with complexity thoery (I didn't understand this question in computer science stack exchange) and know little about ideal lattices and $\textsf{Ring-SIS}, \textsf{Ring-LWE}$.

$\endgroup$

1 Answer 1

2
$\begingroup$

You have it backwards. A decision problem is a special case of a promise problem.

A decision problem is given by a language $L\subseteq \{0,1\}^*$. An algorithm decides this language if

  1. For every $x\in L$, $A(x) = 1$, and
  2. For every $x\not\in L$, $A(x) = 0$.

A promise problem is given by a decomposition $\{0,1\}^* = L_0\sqcup L_1\sqcup L_\bot$. An algorithm solves this promise problem if

  1. For every $x\in L_0$, $A(x) = 0$, and
  2. For every $x\in L_1$, $A(x) = 1$.

There are no requirements for $x\in L_\bot$. Given a decision problem $L$, note that it is also a promise problem $(L_0, L_1,L_\bot) := (L^c, L, \emptyset)$. There isn't a general way to convert an arbitrary promise problem to a decision problem.


Next, why do we care about promise problems? I'll explain with $\mathsf{SVP}_\gamma$. First, recall $\mathsf{SVP}$ (the "decision problem").

The language $\mathsf{SVP}$ is given by $\{(B, t)\in\mathbb{R}^{n\times n}\times \mathbb{R}_{\geq 0} \mid \lambda_1(L(B)) \leq t\}$.

Note that this is not exactly correct. One should include that $B$ has a poly-sized description in the dimension as well. Perhaps you let $N = \mathsf{poly}(n)$ and $B\in [-N, N]^n\cap \mathbb{Z}^n$, or something of this sort. I won't bother with these details though.

To decide $\mathsf{SVP}$, an algorithm must (implicitly) be able to compute $\lambda_1(L(B))$ accurately. In particular, by binary searching on the value of $t$, one can convert any decider for $\mathsf{SVP}$ into an algorithm that computes $\lambda_1(L(B))$, to any arbitrary level of precision.

Next, imagine if we have an algorithm that cannot approximate $\lambda_1(L(B))$ arbitrarily well (e.g. cannot solve $\mathsf{SVP}$), but still yields some non-trivial approximation. Depending on the quality of the estimate, we might be in a regime where

  1. $\mathsf{SVP}$ may still be hard. Yay!
  2. Cryptography may still break. Boo!

So $\mathsf{SVP}$ seems like the wrong problem to look at. Instead, we define the appropriate promise problem $\mathsf{SVP}_\gamma$.

Let \begin{align} L_0 &= \{(B, t)\in\mathbb{R}^{n\times n}\times \mathbb{R}_{\geq 0}\mid \lambda_1(L(B)) > \gamma(n)t\}\\ L_1 &= \{(B, t)\in\mathbb{R}^{n\times n}\times \mathbb{R}_{\geq 0}\mid \lambda_1(L(B)) \leq t\} \end{align} Define $\mathsf{SVP}_\gamma$ to be the promise problem $(L_0, L_1, (L_0\cup L_1)^c)$.

Again, we should also introduce some restriction so that $(B, t)$ admit poly-sized representations in $n$.

Now, an algorithm that solves the promise problem must only be correct on instances $(B, t)$ for which $\frac{t}{\lambda_1(B(L))}\in [0, 1]\cup [\gamma(n), \infty)$. In particular, there is the region $(1, \gamma(n))$ (which one might think of as corresponding to "hard instances") for which the algorithm need not be correct, while still "solving" $\mathsf{SVP}_\gamma$. If we try to run our aformentioned binary search argument, it should be easy to check that an algorithm solving the promise problem $\mathsf{SVP}_\gamma$ can only be used to approximately compute $\lambda_1(L(B))$, up to (multiplicative) approximation error at most $\gamma(n)$. So we don't solve $\mathsf{SVP}$, but for small enough $\gamma$ we might still do something interesting.

Of course, $\mathsf{SVP}_\gamma$ also better matches what we can theoretically prove about lattice problems. For example, Regev's reduction (which motivates the hardness of LWE, at least theoretically) may be phrased at a high-level as

If one can solve LWE (appropriately parameterized) in the average-case, then one can solve $\mathsf{SVP}_\gamma$ (for a certain $\gamma\approx \sqrt{n}$) in the worst-case.

Note that this is another reason why we care about promise problems. If we had a stronger version of Regev's reduction (that was roughly the above with $\gamma = 1$), there would be little reason to talk about $\mathsf{SVP}_\gamma$. Such a reduction would be a massive breakthrough, as $\mathsf{SVP}_1$ is NP hard, so it would imply cryptography based on an NP hard problem. $\mathsf{SVP}_\gamma$ (for $\gamma$ coming from Regev's reduction) is in $\mathsf{NP}\cap\mathsf{coNP}$, so is not expected to be NP hard (and is in a similar situation as things like factoring, discrete logarithm, etc.).

$\endgroup$
2
  • 1
    $\begingroup$ Your definition of SVP$_\gamma$ should reduce to SVP: I could just give an SVP$_\gamma$ solver a pair $(B,t/\gamma(n))$. I thought the promise version was that (in the language of the first part of the answer) $L_0=\{(B,t) : \lambda_1(L(B))\leq t\}$ and $L_1=\{(B,t): \lambda_1(L(B)) \geq \gamma(n)t\}$ and $L_\perp$ is everything else. $\endgroup$ Commented Nov 12, 2024 at 19:49
  • $\begingroup$ Yes, that seems right to me. I'll edit accordingly $\endgroup$ Commented Nov 13, 2024 at 0:20

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.