AIOL: An Improved Orthogonal Lattice Algorithm for the General Approximate Common Divisor Problem

1. Introduction

Background. The approximate common divisor (ACD) problem was firstly studied by Howgrave-Graham [1]. Further interest in this problem was inspired by the proposal of fully homomorphic encryption (FHE) due to Van Dijk et al. [2], as well as cryptographic constructions proposed subsequently [3,4,5]. The security of these cryptosystems depends on the hardness assumption of the ACD problem and its variants.

The ACD problem is usually formulated in two ways: the problem of general approximate common divisor (GACD) and the problem of partial approximate common divisor (PACD). Both of them take as inputs polynomially many samples $x_i=p{q}_i+r_i$ with sufficiently small but non-zero $r_i$, and aim to work out the hidden common divisorp, while the latter is given an additional exact sample $x_0=p{q}_0$ (i.e. $r_0=0$). Intuitively, the PACD problem is easier than GACD, considering that one can work out p directly if he/she knows the factorization of the additional sample $x_0$, whereas the capability of integer factorization has no direct impact on the GACD problem. However, Van Dijk et al. pointed out that at present there is no PACD algorithm that does not work for GACD [2]. And the usefulness of PACD has been demonstrated by a much more efficient construction of FHE scheme [3] of which the security is proved relied on PACD, rather than on GACD.

The original papers [1,2] presented a few possible lattice attacks on the GACD problem, including orthogonal lattices (OL) method, simultaneous diophantine approximation (SDA) method, and multivariate polynomial equations (MP) method. Further cryptanalytic work was done by [4,6,7,8,9,10,11,12,13,14]. Among these work, the OL algorithm due to Ding and Tao [8] is ingenious by using the well-know LLL algorithm for twice to accurately recover the error vector $\mathbf{r}$. After mapping the given GACD instances into a lattice $\mathcal{L}$, the first calling LLL is to find suitable $t-z(z=1,2)$ short vectors ${\mathbf{u}}_i(i=1,2,\cdots ,t-z)$ for establishing the equations

$$\mathbf{U}·\mathbf{x}=\mathbf{U}·\mathbf{r}for\mathbf{U}=\left[{\mathbf{u}}_1\right|\cdots \left|{\mathbf{u}}_{t-z}\right],$$

(1)

where ${\mathbf{u}}_{\mathbf{i}}=\left(u_{i1},u_{i2},\cdots ,u_{it}\right).$ Then, a new lattice ${\mathcal{L}}^{\prime }$ is constructed by using the base vectors of the solution space of (1), and the second calling LLL is to recover the error vector $\mathbf{r}$ accurately. With knowing $\mathbf{r}$ it is very easy to recover p even for a primary school student, say by using the extended Euclidean algorithm. According to Ding and Tao [8], it is an amazing thing that why the first calling LLL over $\mathcal{L}$ should give solutions for (1), and they claimed that a theoretical proof would be a very significant result. Another merit of the Ding-Tao’s method is that the setting on the related parameters is simple and this makes the implementation of OL attacks towards GACD-based cryptosystems very easy in practice. For example, the lower bound of the number of samples t depends only on $\gamma$, and the length of the short vector $\mathbf{v}$ depends only on t and $\gamma$.

Motivation and Contributions. With further experiments on the Ding-Tao’s algorithm, we find that the actual effect of the algorithm is better than they claimed. In particular, we realize that the conditions $\rho <\eta /2$ and $t\ge {\left(4\gamma \right)}^{1/3}$ could be relaxed and merged, and the second calling LLL could also be saved. Moreover, we find that even for failure executions of the Ding-Tao’s algorithm, there is a high probability that the recovered p differs from the actual value by only 1 or very small numbers. Therefore, our motivation in this work is to propose an improved OL algorithm to reduce both space and time costs for solving the GACD problem. Our main contributions are summarized as follows:

• First, we modify the range of parameters $N,t$ and $\parallel \mathbf{v}\parallel$ in the Ding-Tao’s algorithm, so that we need to build lattice and call LLL for only once, and the success rate for recovering p reaches $100\%$, under the merged condition

  $$t\ge max\left\{4,\frac{5}{3}⌈\eta -\rho -\sqrt{{(\eta -\rho )}^2-1.2(\gamma +\rho )}⌉\right\}.$$

  (2)
  Note that (2) also implies $\rho \le \eta +0.6-\sqrt{1.2(\eta +\gamma +3)}$, no matter whether $\rho <\eta /2$ holds.
• Second, based on the above modification, we give a proof on why in our algorithm AIOL, the only once calling LLL will give us solutions for $\left(1\right)$. This can be viewed as a theoretical answer towards the Ding-Tao’s amazing question;
• Third, we give the possible differences between the recovered of p and the actual hidden common divisor when the error vector $\mathbf{r}$ is recovered. Knowing these differences is in turn helpful for recovering p, and thus expanding the scope of OL attacks.

Roadmap. The remained contents are organized as follows: In Section 2, the formal definitions of the problems of GACD and PACD are given, and the lattice concepts and the LLL algorithm are introduced beriefly; In Section 3, the orthogonal lattice based approach, including our improvements, for GACD are explored and developed in detail; Experiments and comparisons as well as related discussions are presented in Section 4; Finally, concluding remarks are given in Section 5.

2. Preliminaries

Throughout this paper, we make the following agreeent on notations: Capital boldface letters denote matrices, e.g. $\mathbf{A}$, while lowercase bold letters denote vectors e.g. $\mathbf{a}$; Let $(·,·)$ and $\parallel ·\parallel$ be the inner product and the $l_2$ Euclidean length respectively, and ${\mathbf{A}}^{\mathbf{T}}$ denote the transpose of matrix $\mathbf{A}$; The logarithmic notation log always takes 2 as the base, while $\lceil r\rceil$ denotes the smallest integer not less r.

Definition 1 

(ACD Distribution). Given $\gamma ,\eta ,\rho \in \mathbb{N}$, let p be an η-bit odd integer, the ACD distribution, $D_{\gamma ,\rho }\left(p\right)$, is an efficiently sampleable distribution define as follows:

$$D_{\gamma ,\rho }\left(p\right)=\{pq+r|q\stackrel{}{\leftarrow }\mathbb{Z}\cap (0,2^{\gamma }/p),r\stackrel{}{\leftarrow }\mathbb{Z}\cap (-2^{\rho },2^{\rho })\}.$$

(3)

Definition 2 

(GACD Problem). Given access to an ACD distribution $D_{\gamma ,\rho }\left(p\right)$ as a oracle, the objective of the general approximate common divisor (GACD) problem is to find p.

Definition 3 

(PACD Problem). Given access to an ACD distribution $D_{\gamma ,\rho }\left(p\right)$ as a oracle, with the restriction that the first output of $D_{\gamma ,\rho }\left(p\right)$ is $x_0=p{q}_0$ for some $q_0\stackrel{}{\leftarrow }\mathbb{Z}\cap (0,2^{\gamma }/p)$, the objective of the partial approximate common divisor (PACD) problem is to find p.

Remark 1. 

Apparently, a PACD instance is a GACD by coincidence only with the probability that is negligible with respect to ρ.

Definition 4 

($\delta -$LLL reduction basis). Given a lattice basis $\mathbf{B}=({\mathbf{b}}_{\mathbf{1}},\cdots ,{\mathbf{b}}_{\mathbf{n}})$, the corresponding Gram-Schmidt basis ${\mathbf{B}}^{*}=({\mathbf{b}}_{\mathbf{1}}^{*},\cdots ,{\mathbf{b}}_{\mathbf{n}}^{*})$, $\mathbf{B}$ is a reduced basis if and only if the following two conditions are satisfied:

(1) (Size condition) ${\displaystyle {\mu }_{i,j}=\frac{({\mathbf{b}}_{\mathbf{i}},{\mathbf{b}}_{\mathbf{j}}^{*})}{{\parallel {\mathbf{b}}_{\mathbf{j}}^{*}\parallel }^2}\le 1/2}$, for all $1\le j<i\le n$;

(2) (Lovász condition) $\parallel {\mathbf{b}}_{\mathbf{i}}^{*}{\parallel }^2\ge (\delta -{\mu }_{i,i-1}^2){\parallel {\mathbf{b}}_{\mathbf{i}-\mathbf{1}}^{*}\parallel }^2$, for all $1<i\le n$, where $1/4<\delta <1$.

Definition 5 

(Geometric Series Assumption [15]). Given Gram-Schmidt basis $({\mathbf{b}}_{\mathbf{1}}^{*},\cdots ,{\mathbf{b}}_{\mathbf{n}}^{*})$,

$$\frac{\parallel {\mathbf{b}}_{\mathbf{i}}^{*}\parallel }{\parallel {\mathbf{b}}_{\mathbf{1}}\parallel }={\theta }^{i-1},$$

(4)

for $i=1,2,\cdots ,n$, where $3/4\le \theta <1$ is called GSA constant.

The Geometric Series Assumption (GSA) means the length of Gram-Schmidt basis $\parallel {\mathbf{b}}_{\mathbf{i}}^{*}\parallel$ with LLL reduction decays geometrically with quotient $\theta$ and indicates

$$\parallel {\mathbf{b}}_{\mathbf{i}}^{*}\parallel \le \parallel {\mathbf{b}}_{\mathbf{1}}\parallel (i=1,2,\cdots ,n).$$

(5)

Theorem 1. 

[16] Given a LLL reduction lattice basis $\mathbf{B}=({\mathbf{b}}_{\mathbf{1}},\cdots ,{\mathbf{b}}_{\mathbf{n}})$, $({\mathbf{b}}_{\mathbf{1}}^{*},\cdots ,{\mathbf{b}}_{\mathbf{n}}^{*})$ is the corresponding Gram-schmidt basis. The following results hold:

(1) ${\displaystyle \parallel {\mathbf{b}}_{\mathbf{1}}\parallel \le {\alpha }^{\frac{n-1}{4}}|det{\left(\mathbf{B}\right)}^{\frac{1}{n}}|}$;

(2) ${\displaystyle \parallel {\mathbf{b}}_{\mathbf{j}}^{*}\parallel \le {\alpha }^{\frac{(i-j)}{2}}\parallel {\mathbf{b}}_{\mathbf{i}}^{*}\parallel }$, for $1\le j<i\le n$;

(3) $\parallel {\mathbf{b}}_{\mathbf{j}}\parallel \le {\alpha }^{\frac{(i-1)}{2}}\parallel {\mathbf{b}}_{\mathbf{i}}^{*}\parallel$, for $1\le j<i\le n$;

where ${\displaystyle \alpha =\frac{1}{\delta -\frac{1}{4}}}$, δ is the parameter in the Definition 4.

3. Orthogonal Lattice (OL) based approach

3.1. The basic idea of OL algorithm

Nguyen and Stern [17] have demonstrated the usefulness of the orthogonal lattice in cryptanalysis, and this has been used in several ways to attack the ACD problem. The idea is to find $\mathbf{u}=(u_1,u_2,\cdots ,u_t)\in {\mathcal{L}}^{\perp }(\mathbf{q},\mathbf{r})$ that is orthogonal to both $\mathbf{q}=(q_1,q_2,\cdots ,q_t)$ and $\mathbf{r}=(r_1,r_2,\cdots ,r_t)$. Since $x_i=p{q}_i+r_i$, $\mathbf{x}=(x_1,x_2,\cdots ,x_t)$ is orthogonal to $\mathbf{u}$. The task is to find $t-1$ linearly independent vectors $\mathbf{u}$ shorter than any vector in ${\mathcal{L}}^{\perp }\left(\mathbf{x}\right)$ to recover $\mathbf{q}$, $\mathbf{r}$ and therefore p.

Based on the idea of Nguyen and Stern, the current idea is to find $t-z(z=1,2)$ linearly independent vectors $\mathbf{u}$ only orthogonal to $\mathbf{q}$. The core steps of the current OL algorithm include the following two steps:

First, find $t-z(z=1,2)$ linearly independent vectors $\mathbf{u}$ orthogonal to $\mathbf{q}$, that is,

$$\sum _{i=1}^t{u}_i·q_i=0$$

(6)

then establish and solve indefinite equations (1).

Second, find small positive integer solutions to (15). At present, the common way to find the small solutions is to construct the lattice ${\mathcal{L}}^{\prime }$ with basis matrix

$$\mathbf{B}=\left(\begin{array}{c}{\mathbf{d}}_{\mathbf{0}}\\ {\mathbf{d}}_{\mathbf{1}}\\ ⋮\\ {\mathbf{d}}_{\mathbf{z}}\end{array}\right)$$

(7)

and then employ the LLL algorithm to reduce the basis matrix $\mathbf{B}$, with the hope of that the first output is the vector $\mathbf{r}$. However, at present, what can meet this expectation are experimental conditions, and there is still a lack of theory.

Let the general solution formula of (15) be

$$\mathbf{d}={\mathbf{d}}_{\mathbf{0}}+t_1{\mathbf{d}}_{\mathbf{1}}+\cdots +{\mathbf{d}}_{\mathbf{z}}$$

(8)

where ${\mathbf{d}}_{\mathbf{0}}$ is a special solution of (15), $t_1,\cdots ,t_z$ are integers, ${\mathbf{d}}_{\mathbf{1}},\cdots ,{\mathbf{d}}_{\mathbf{z}}$ is a basis of integer solution space for the corresponding homogeneous linear equations.

Let ${\mathbf{d}}^{\prime }\in {\mathcal{L}}^{\prime }$ , then

$${\mathbf{d}}^{\prime }=k_0{\mathbf{d}}_{\mathbf{0}}+k_1{\mathbf{d}}_{\mathbf{1}}+\cdots +k_z{\mathbf{d}}_{\mathbf{z}}$$

(9)

where $k_0,k_1,\cdots ,k_z$ are integers. Obviously, when $k_0=1$, (9) = (8). Reduce the lattice $\mathbf{B}$ to ${\mathbf{B}}^{\prime }$:

$${\mathbf{B}}^{\prime }=\left(\begin{array}{c}{\mathbf{d}}_{\mathbf{0}}^{\prime }\\ {\mathbf{d}}_{\mathbf{1}}^{\prime }\\ ⋮\\ {\mathbf{d}}_{\mathbf{z}}^{\prime }\end{array}\right).$$

(10)

To facilitate finding $\mathbf{r}$, consider the explicit vectors ${\mathbf{d}}_{\mathbf{0}}^{\prime },{\mathbf{d}}_{\mathbf{1}}^{\prime },\cdots ,{\mathbf{d}}_{\mathbf{z}}^{\prime }$. It’s easy to deduce that only one of them is the solution to (15).

Let ${\mathbf{d}}_{\mathbf{i}}^{\prime }$ is the solution to (15), and if ${\mathbf{d}}_{\mathbf{i}}^{\prime }={\mathbf{d}}_{\mathbf{0}}^{\prime }$, then ${\mathbf{d}}_{\mathbf{0}}^{\prime }$ is probably equal to $\mathbf{r}$. With this in mind, Ding and Tao [8] found the conditions that the algorithm can work well (theoretically not proved):

$$\rho <\frac{\eta }{2}andt\ge {\left(4\gamma \right)}^{1/3}.$$

(11)

In addition, if ${\mathbf{d}}_{\mathbf{i}}^{\prime }\ne {\mathbf{d}}_{\mathbf{0}}$, we find an interesting thing that the recovery value $p^{\prime }$ is only 1 or a very small number different from the true value p in many cases of our experiment. And our experiments lead to the following general conclusions between p and $p^{\prime }$:

Let ${\mathbf{d}}_{\mathbf{i}}^{\prime }=(u_{i1},u_{i2},\cdots ,u_{it})\ne {\mathbf{d}}_{\mathbf{0}}^{\prime },d_{ru}=gcd(r_1-u_{i1},r_2-u_{i2},\cdots ,r_t-u_{it}),$ then

$$p^{\prime }-p=d_{ru},$$

(12)

where $p^{\prime }$ is the recovered value of p. So, if ${\mathbf{d}}_{\mathbf{i}}^{\prime }\ne {\mathbf{d}}_{\mathbf{0}}$, using vector ${\mathbf{d}}_{\mathbf{i}}^{\prime }$, $p^{\prime }$ can be restored. And since $d_{ru}$ is bounded, p can be restored by $p^{\prime }$.

In summary, one of the outputs ${\mathbf{d}}_{\mathbf{1}},\cdots ,{\mathbf{d}}_{\mathbf{z}}$ generated by the LLL algorithm can be used to recover $\mathbf{r}$ under the appropriate conditions.

3.2. Our Proposal

In this part, an improved OL algorithm, AIOL, is described in detail.

Algorithm 1: AIOL: An improved OL algorithm for GACD

Input: The GACD parameters $\gamma ,\eta ,\rho \in \mathbb{N}$, and t ACD samples $\{x_1,\cdots ,x_t\}\stackrel{\$}{\leftarrow }{D}_{\gamma ,\rho }\left(p\right)$, with t satisfying $$t\ge max\left\{4,⌈\frac{5}{3}\left(\eta -\rho -\sqrt{{(\eta -\rho )}^2-1.2(\gamma +\rho )}\right)⌉\right\}.$$ (13) Output: The approximate greatest common divisor p. 1. Randomly choose $N\in (2^{\gamma +\eta -1},2^{\gamma +\eta })$. And then constract a lattice $\mathcal{L}$ with the basis $$B=\left(\begin{array}{ccccc}1& & & & x_1\\ & 1& & & x_2\\ & & \ddots & & ⋮\\ & & & 1& x_t\\ & & & & N\end{array}\right).$$ (14) 2. Reduce lattice $\mathcal{L}$ by calling the LLL algorithm with $\delta =3/4$. Let the reduced basis be $\mathbf{V}=\left[{\mathbf{v}}_{\mathbf{1}}\right|\cdots \left|{\mathbf{v}}_{\mathbf{t}+\mathbf{1}}\right]$, where ${\mathbf{v}}_{\mathbf{i}}=(u_{i1},\cdots ,u_{it},v_{i(t+1)}),(i=1,2,\cdots ,t+1).$ 3. Collect short vectors from $\mathbf{V}$ so that $\parallel {\mathbf{v}}_{\mathbf{i}}\parallel <2^{\eta -\rho -2-log\sqrt{t}}$, $(i=1,2,\cdots ,t-z)$, where $z=1,2$. And then, solve the following Diophantine equations with t unknowns $r_1,\cdots ,r_t$: $$\sum _{j=1}^t{u}_{ij}·r_i=\sum _{j=1}^t{u}_{ij}·x_i(i=1,\cdots ,t-z).$$ (15) 4. Rewrite the integer solutions of (15) as follows: $$\mathbf{d}={\mathbf{d}}_{\mathbf{0}}+t_1{\mathbf{d}}_{\mathbf{1}}+\cdots +t_z{\mathbf{d}}_{\mathbf{z}},$$ (16) where ${\mathbf{d}}_{\mathbf{0}}$ is a special solution of the Diophantine equations, $t_1,\cdots ,t_z$ are integers, ${\mathbf{d}}_{\mathbf{1}},\cdots ,{\mathbf{d}}_{\mathbf{z}}$ is a basis of integer solution space for the corresponding homogeneous linear equations. 5. Let $\mathbf{r}={\mathbf{d}}_{\mathbf{0}}$. 6. Compute $p=gcd(x_1-r_1,x_2-r_2)$.

Through the proof in the next section, it can be seen that when the condition

$${(\eta -\rho )}^2\ge 1.2(\gamma +\rho )$$

(17)

or equivelently

$$\rho \le \eta +0.6-\sqrt{1.2(\eta +\gamma +3)}$$

(18)

holds, the algorithm AIOL will successfully recover p.

3.3. The proof of AIOL algorithm

Lemma 1. 

For ∀$\mathbf{v}\in \mathcal{L}$, if $\parallel \mathbf{v}\parallel <2^{\eta -\rho -2-log\sqrt{t}}$, then the equation (15) holds.

Proof. 

Let $\mathbf{v}=(u_1,u_2,\cdots ,u_t,{\sum }_{i=1}^t{u}_i{x}_i+u_{t+1}N)$, $M=2^{\eta -\rho -2-log\sqrt{t}}$, then

$$\parallel \mathbf{v}\parallel =\sqrt{\sum _{i=1}^t{u}_i^2+{\left(\sum _{i=1}^t{u}_i{x}_i+u_{t+1}N\right)}^2}<M.$$

(19)

Thus

$$|u_i|<M,\left|\sum _{i=1}^t{u}_i{x}_i+u_{t+1}N\right|<M(1\le i\le t).$$

(20)

Since $2^{\gamma +\eta -1}\le N\le 2^{\gamma +\eta },$

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \left|\sum _{i=1}^t{u}_i{x}_i\right|& \le 2^{\gamma }\sqrt{t}·\parallel \mathbf{u}\parallel \hfill \\ \hfill & \le 2^{\gamma }\sqrt{t}·\parallel \mathbf{v}\parallel \hfill \\ \hfill & \le 2^{\gamma }\sqrt{t}·2^{\eta -\rho -2-log\sqrt{t}}\hfill \\ \hfill & =2^{\gamma +\eta -\rho -2}<N/2.\hfill \end{array}\end{array}$$

(21)

Therefore, there is no modular N operation and $u_{t+1}=0$. So $\mathbf{v}=(u_1,u_2,\cdots ,u_t,{\sum }_{i=1}^t{u}_i{x}_i)$.

We also have

$$\left|\sum _{i=1}^t{u}_i{r}_i\right|\le 2^{\rho }\sqrt{t}·\parallel \mathbf{v}\parallel \le 2^{\eta -2}.$$

(22)

To prove that (6) holds, suppose $\left|{\sum }_{i=1}^t{u}_i{q}_i\right|\ne 0$, so

$$p\left|\sum _{i=1}^t{u}_i{q}_i\right|\ge p\ge 2^{\eta -1}$$

(23)

$$\left|\sum _{i=1}^t{u}_i{x}_i\right|=\left|p\sum _{i=1}^t{u}_i{q}_i+\sum _{i=1}^t{u}_i{r}_i\right|\ge p\left|\sum _{i=1}^t{u}_i{q}_i\right|-\left|\sum _{i=1}^t{u}_i{r}_i\right|\ge 2^{\eta -1}-2^{\eta -2}=2^{\eta -2},$$

(24)

but

$$\left|\sum _{i=1}^t{u}_i{x}_i+u_{t+1}N\right|=\left|\sum _{i=1}^t{u}_i{x}_i\right|<M=2^{\eta -\rho -2-log\sqrt{t}}<2^{\eta -2}.$$

(25)

This is a contradiction. The equations (6) and (15) hold. Then Lemma 1 holds. □

Lemma 2. 

If the number t of samples satisfies

$${(4/3)}^{(3t-2)/4}·2^{(\gamma +\eta )/(t+1)}\le 2^{\eta -\rho -2-log\sqrt{t}},$$

(26)

then LLL reduction basis vectors is valid for the construction of equation (15).

Proof. 

For the $(t-1)$-th LLL reduction basis vector ${\mathbf{v}}_{\mathbf{t}-\mathbf{1}}$, whose length can be estimated

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \parallel {\mathbf{v}}_{\mathbf{t}-\mathbf{1}}\parallel & \le {\alpha }^{(t-1)/2}\parallel {\mathbf{v}}_{\mathbf{t}}^{*}\parallel \hfill \\ \hfill & ={(4/3)}^{(t-1)/2}\parallel {\mathbf{v}}_{\mathbf{t}}^{*}\parallel (\alpha =4/3)\hfill \\ \hfill & \le {(4/3)}^{(t-1)/2}\parallel {\mathbf{v}}_{\mathbf{1}}\parallel \left(by\left(5\right)\right)\hfill \\ \hfill & \le {(4/3)}^{(t-1)/2}·{(4/3)}^{t/4}·{\left|\mathbf{B}\right|}^{1/(t+1)}\left(byTheorem 1\right)\hfill \\ \hfill & \le {(4/3)}^{(3t-2)/4}·2^{(\gamma +\eta )/(t+1)}.\hfill \end{array}\end{array}$$

(27)

According to Lemma 1, equation (15) holds when (26) is true. □

Based on the above two lemmas, the following theorem can be obtained.

Theorem 2. 

When GACD parameters satisfy (17) or (18) and the number of samples satisfy (13), then we construct the equation (15) to be true.

Proof. 

From the condition (26), the length of LLL reduction basis vectors satisfies Lemma 2, then LLL reduction basis vectors is valid for the constrction of the equation (15). Combined the above two lemmas, we simiplify the inequation and ignore some small terms to get the following bound of sample numbers t. The specific process is as follows: take the logarithm base 2 on both sides of (26) to obtain:

$$\frac{3t-2}{4}log\frac{4}{3}+\frac{\gamma +\eta }{t+1}\le \eta -\rho -2-log\sqrt{t}.$$

(28)

Remove some smaller items of (28), $log\frac{4}{3}\approx 0.4$, we have

$$0.3t+\frac{\gamma +\eta }{t+1}\le \eta -\rho ,$$

(29)

Sort out the formula (29), we get

$$0.3t^2-(\eta -\rho -0.3)t+(\gamma +\eta )\le 0,$$

(30)

then

$$0.3t^2-(\eta -\rho )t+(\gamma +\eta )\le 0,$$

(31)

By solving the inequality (31), we can get

$$t\ge \frac{5}{3}\left(\eta -\rho -\sqrt{{(\eta -\rho )}^2-1.2(\gamma +\rho )}\right).$$

(32)

In summary, when conditions (18) and (32) hold, the algorithm can recover p successfully. Note that the condition $t\ge 4$ comes from the third step of AIOL where we need to collect at least 2 short vectors for building the required Diophantine equations. Then the condition (13) is true. Hence,Theorem 2 holds. □

4. Experiments and Comparisons

In this section, we conduct experiments towards our algorithm AIOL, as well as the Ding-Tao’s algorithm. The experimental environment is specified as below: Intel(R) Core (TM) Processor i5-1235U CPU (1.30 GHz) with 16 GB of memory, Windows 10 OS, and Maple 2021 coding language.

The experiments are organized as two steps. Firstly, to test the effects on relaxation on conditions of $\rho$ and t, we adopt the following settings on the related parameters:

• Fix $\eta =160$;
• Let $\gamma =300,400,500,1000,1500,2000$ respectively;
• For each case of setting on $\gamma$, running the Ding-Tao’s algorithm and our AIOL algorithm for 100 times for different $\rho$ (resp. t) around the upper (resp. lower) bound of $\rho$ (resp. t) given by the Ding-Tao’s condition (11) and our condition (13,18), respectively.
• Then, for each case, collect the success rate for recovering the hidden common divisor p, as well as the maximal $\rho$ (resp. the minimal t) that enables the related algorithms work. These results are summaried in Table 1, where the symbol ’–’ indicates that in this case the related failed to work out.

From Table 1, we can see that:

• The overall success rate of our algorithm is 100%, which is observably higher than that of in the Ding-Tao’s algorithm, under the same settings on $\eta ,\gamma$ and a similar scale of t. Moreover, even for bigger settings on $\rho$ in AIOL, the success rates are still higher than those of obtained by the Ding-Tao’s algorithm for the smaller settings on $\rho$. 1
• The condition on $\rho$ given by the Ding-Tao’s condition (11) is irrelevant, considering for $\gamma =300$ and $\gamma =1000$, the maximal values of $\rho$ for ensuring the Ding-Tao’s a high success rate are 103 and 30, respectively. They are respectively either observably bigger or smaller than the given bound $79<\eta /2$.
• The condition on $\rho$ given by AIOL is relaxed to the case of $\rho >\eta /2$. And this condition is tight in the sense that for all these cases, the the maximal values of $\rho$ for ensuring AIOL success are almost same with the bound given by (18).
• The condition on t given by the Ding-Tao’s condition (11) is rigorous in the sense that for even small t, our tests on the Ding-Tao’s algorithm failed, whereas the condition on t given by (13) in AIOL is loose since for even small t, our algorithm still works well. At present, we have no idea to give a tight bound on choicing t for the AIOL algorithm.

Secondly, to test the scalability, as well as the speed, we adopt the settings according to experiments given by Ding and Tao in [8]. That is,

• Fix $\eta =1000$ and $\rho =450$;
• Let $\gamma =5000,10000,15000,20000$ respectively;
• In Ding-Tao’s algorithm, let $t=18,40,59,85$ respectively, according to what was given in [8], while in our algorithm AIOL, t is set to $10,20,29,38$ respectively – calculated according to the condition given by (13).
• Then, for each case, we run Ding-Tao’s algorithm and our algorithm respectively, and then collect the running time for getting correct results in Table 2. (Note that for conveniences doing comparisons, partial data on the running time in Ding-Tao’s paper [8] is referenced here.)

From Table 2, we can see that:

• Both our algorithm AIOL and the Ding-Tao’s algorithm have good performance in scalability in the parameter $\gamma$. Moreover, the AIOL algorithm can find the correct solutions with even smaller t, this in turn means less space cost for storing the ACD samples.
• With the sample computational environments (i.e. MAPLE coding on an Intel i5 CPU with 1.30 GHz clocks), our AIOL algorithm runs much quicker than the Ding-Tao’s algorithm, under the same settings on $\gamma ,\eta$ and $\rho$.
• Ding-Tao’s tests given in [8] (i.e. MAGMA coding on two Quad-Core Intel Processor Q9400 CPUs with 2.66 GHz clocks) are much quicker than our tests on both AIOL and the Ding-Tao’s algorithm. We think that this might be mainly attributed to the differences of computational environments.

5. Conclusions

The interest in the general approximate common divisor (GACD) problem is excited by the possibility of building fully homomorphic encryptions over integers, though many such kind of cryptographic constructions were broken. In fact, from an even abstract point, the GACD problem can be viewed as a learning-with-error (LWE) version of the greatest common divisor (GCD) problem over the 1-dimension lattice $\mathbb{Z}$. Although we know that all lattice problems are easy for low dimensions, more efforts are still needed to tackle the GACD problem. In this paper, an improved orthogonal lattice algorithm, AIOL, is proposed for solving GACD. Compared with the Ding-Tao’s OL method, the parameter conditions for suit for AIOL is relaxed, and the experiments show that the success rate of AIOL is enhanced observably.