On Beating 2ⁿ for the Closest Vector Problem

The Closest Vector Problem (CVP) is a computational problem in lattices that is central to modern cryptography. The study of its fine-grained complexity has gained momentum in the last few years, partly due to the upcoming deployment of lattice-based cryptosystems in practice. A main motivating question has been if there is a (2 − ε)ⁿ time algorithm on lattices of rank n, or whether it can be ruled out by SETH. Previous work came tantalizingly close to a negative answer by showing a 2(^1−o(1))ⁿ lower bound under SETH if the underlying distance metric is changed from the standard ℓ2 norm to other ℓp norms (specifically, any norm where p is not an even integer). Moreover, barriers toward proving such results for ℓ2 (and any even p) were established. In this paper we show positive results for a natural special case of the problem that has hitherto seemed just as hard, namely (0, 1)-CVP where the lattice vectors are restricted to be sums of subsets of basis vectors (meaning that all coefficients are 0 or 1). All previous hardness results applied to this problem, and none of the previous algorithmic techniques could benefit from it. We prove the following results, which follow from new reductions from (0, 1)-CVP to weighted Max-SAT and minimum-weight k-Clique. • An O(1.7299ⁿ) time algorithm for exact (0, 1)-CVP2 in Euclidean norm, breaking the natural 2ⁿ barrier, as long as the absolute value of all coordinates in the input vectors is 2^o(n). • A computational equivalence between (0, 1)-CVPp and Max-p-SAT for all even p (a reduction from Max-p-SAT to (0, 1)-CVPp was previously known). • The minimum-weight-k-Clique conjecture from fine-grained complexity and its numerous consequences (which include the APSP conjecture) can now be supported by the hardness of a lattice problem, namely (0, 1)-CVP2. Similar results also hold for the Shortest Vector Problem.