Mildly Short Vectors in Cyclotomic Ideal Lattices in Quantum Polynomial Time

In this article, we study the geometry of units and ideals cyclotomic rings derive an algorithm to find a mildly short vector in any given ideal lattice quantum polynomial time, under some plausible number-theoretic assumptions. More precisely, ring conductor m , finds approximation shortest by factor exp (Õ(√ )). This result exposes unexpected hardness gap between these structured lattices general lattices: The best known time generic algorithms can only reach (Õ(m)). Following recent series attacks, results call into question various problems over lattices, such as Ideal-SVP Ring-LWE, upon which relies security number cryptographic schemes. N OTE . article is extended version conference paper [11]. are generalized arbitrary fields. particular, also extend Reference [10] addition, prove numerical stability method [10]. These appeared Ph.D. dissertation third author [46].