On Beating $2^n$ for the Closest Vector Problem

Abstract

The Closest Vector Problem (CVP) is a computational problem in lattices that is central to modern cryptography. The study of its fine-grained complexity has gained momentum in the last few years, partly due to the upcoming deployment of lattice-based cryptosystems in practice. A main motivating question has been if there is a $(2-\varepsilon)^n$ time algorithm on lattices of rank $n$, or whether it can be ruled out by SETH. Previous work came tantalizingly close to a negative answer by showing a $2^{(1-o(1))n}$ lower bound under SETH if the underlying distance metric is changed from the standard $\ell_2$ norm to other $\ell_p$ norms. Moreover, barriers toward proving such results for $\ell_2$ (and any even $p$) were established. In this paper we show \emph{positive results} for a natural special case of the problem that has hitherto seemed just as hard, namely $(0,1)$-$\mathsf{CVP}$ where the lattice vectors are restricted to be sums of subsets of basis vectors (meaning that all coefficients are $0$ or $1$). All previous hardness results applied to this problem, and none of the previous algorithmic techniques could benefit from it. We prove the following results, which follow from new reductions from $(0,1)$-$\mathsf{CVP}$ to weighted Max-SAT and minimum-weight $k$-Clique. 1. An $O(1.7299^n)$ time algorithm for exact $(0,1)$-$\mathsf{CVP}_2$ in Euclidean norm, breaking the natural $2^n$ barrier, as long as the absolute value of all coordinates in the input vectors is $2^{o(n)}$. 2. A computational equivalence between $(0,1)$-$\mathsf{CVP}_p$ and Max-$p$-SAT for all even $p$. 3. The minimum-weight-$k$-Clique conjecture from fine-grained complexity and its numerous consequences (which include the APSP conjecture) can now be supported by the hardness of a lattice problem, namely $(0,1)$-$\mathsf{CVP}_2$.