On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem

uSVP-BDD On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky Daniele Micciancio Advances in Cryptology CRYPTO 2009

Santa Barbara, CA, USA

2009 8

We prove the equivalence, up to a small polynomial approximation factor (n/ log(n))^0.5, of the lattice problems uSVP (unique Shortest Vector Problem), BDD (Bounded Distance Decoding) and GapSVP (the decision version of the Shortest Vector Problem). This resolves a long-standing open problem about the relationship between uSVP and the more standard GapSVP, as well the BDD problem commonly used in coding theory. The main cryptographic application of our work is the proof that the Ajtai-Dwork [STOC 1997] and the Regev [J. ACM 51(6):899-942] cryptosystems, which were previously only known to be based on the hardness of uSVP, can be equivalently based on the hardness of worst-case GapSVP_O(n^2.5) and GapSVP_O(n²), respectively. Also, in the case of uSVP and BDD, our connection is very tight, establishing the equivalence (within a small constant approximation factor) between the two most central problems used in lattice based public key cryptography and coding theory.