I have no clue how to go about proving this, though.

]]>Hi Thijs,

RE, Frodo, thanks for the correction! I’ve updated the post.

I’m not at all sure about kissing numbers in l_p norms, but the maximum number of closest vectors is known and is fairly straightforward for all l_p norms: the maximum possible number of closest vectors for 1 < p < infinity is 2^n and is unbounded for l_1 and l_infinity (even in two dimensions).

For 1 < p < infinity, the integer lattice together with the all (1/2)s vector as a target yields a lower bound of 2^n, and the upper bound follows by a pigeonhole/coset averaging argument. Namely, suppose that there are 2^n + 1 closest lattice vectors to a given target. Then, there must be two such closest vectors v, w that lie in the same coset mod twice the lattice. But then (v + w)/2 is also a lattice vector, and, by the strict convexity of the l_p norm for 1 < p < infinity, it is strictly closer to the target than v or w, which is a contradiction.

Accordingly, it might be reasonable to guess that the “right” time complexity of CVP_p for 1 < p < infinity is 2^n. This would match our lower bound for all such p that are not even integers.

]]>Hi Huck,

I believe the original Frodo preprint (https://eprint.iacr.org/2016/659/20160628:211043) coined the term “paranoid”, even though indeed it seems that their latest version no longer mentions this term.

And I guess then an interesting geometrical question would be to figure out what are the kissing constants and maximum numbers of closest vectors for arbitrary ell_p norms? (I’m not sure how much is known about that for p other than 2 or infinity.)

]]>Hi Thijs,

In this case the attribution to Albrecht et al. was for the descriptive and colorful choice of the word “paranoid.” They attribute the bound itself to New Hope, but it appears in both the Frodo and New Hope submissions, and perhaps a number of other places.

I agree that it is natural to hypothesize that the worst-case complexity of exact SVP (resp. CVP) in a given norm is essentially the kissing number (resp. maximum possible number of closest vectors) in that norm. We discuss this a bit for l_infinity at the end of Section 2.2/in Open problem 6.

]]>While I’m nitpicking: I believe [A+18] only collected the security models from all the NIST submissions, and the “paranoid” bound 0.2075 was proposed in the Frodo submission.

On a higher level, I liked Huck’s informal explanation on the difference between (Euclidean) SVP and CVP in that there can be up to 2^n closest lattice vectors to a target vector (e.g. the all-0.5 vector in Z^n) which with a small perturbation can be hard to distinguish, but there can only be at most 2^(0.401n) shortest non-zero lattice vectors of equal norm in a lattice due to bounds on the kissing constant. So I suppose that while we expect the 2^n for CVP to be tight, one might conjecture that the true worst-case hardness for SVP might lie at 2^(0.401n), or whatever is the actual scaling of the kissing constant in high dimensions. Perhaps similar arguments can be used to make educated guesses about the “true worst-case hardness” of SVP and CVP in any norm?

]]>