LightNews — News, ranked by scholars

Ryan O'Donnell

@booleananalysis.bsky.social

I finished the proof of "ETH false" (#3SAT in subexponential time) in my grad complexity class at CMU today (mod some easy exercises).

I think it's nice that it can be done just using classical complexity theory ingredients - it fits well in the course!

www.youtube.com/watch?v=3Cdl...

ETH False II: completing the proof

YouTube video by Ryan O'Donnell

www.youtube.com

November 5, 2026 at 4:20 PM

arxiv cs.DS

@arxiv-cs-ds.bsky.social

Daniel Lokshtanov, Fahad Panolan, Saket Saurabh, Jie Xue, Meirav Zehavi
Vertex Deletion on $H$-Induced-Minor-Free Graphs: Subexponential FPT Algorithms and Approximation Schemes
https://arxiv.org/abs/2611.09071

November 9, 2026 at 5:33 PM

Andrea

@valkyrie.hacker.gf

Elliptic curves discrete log in O(2^(b/(log(b)^(1/4))) (asymptotically, probably not faster for cryptographic-sized curves): github.com/bochum-crypt...

subexponential-ecdl/subexponential-ecdl.pdf at main · bochum-crypto/subexponential-ecdl

Contribute to bochum-crypto/subexponential-ecdl development by creating an account on GitHub.

github.com

October 31, 2026 at 9:41 PM

ePrint Updates

@eprint.ing.bot

Subexponential Algorithms for LWE via Rejection Sampling on Superlattices (Ligeng Fan, Changpeng Shao, Hongbo Li, Dingkang Wang) ia.cr/2026/2640

Abstract. Recent superlattice algorithms have improved the provable complexity of lattice problems. Ducas, Engelberts, and Loyer used this framework to obtain a subexponential algorithm for infinity-norm short integer solution, while also identifying a key obstacle to extending it to learning with errors (LWE). A similar difficulty arose in the analysis of Kirchner and Fouque, whose claimed subexponential running time with only linearly many LWE samples was not rigorously established. Building on the framework of Ducas, Engelberts, and Loyer, we develop two refinements based on rejection sampling that solve this open problem.

First, we use rejection sampling to cancel the shift-dependent normalization factor that arises when sampling from a shifted, scaled integer lattice. This factor is a product of one-dimensional Gaussian masses and can be evaluated efficiently. This yields a provably subexponential classical search-LWE algorithm for prime q ∈ [n², 2n²] and constant Gaussian error width. It uses only m = 4n independent samples and runs in time and space exp (O(n/ln ln n)).

Second, we use random auxiliary superlattices and apply rejection sampling to the difference of two Gaussian lattice samples, ensuring that the accepted output follows the desired discrete Gaussian distribution up to a small statistical error. For q = n^(κ + o(1)), m = n + h = O(n), and R = hln q/[mln (2 + σ)] → ∞, the resulting algorithm uses time and space 2^((1/2 + o(1))n/ln R), where σ is the Gaussian error width. In particular, for σ = n^(o(1)) and any fixed m/n > 1, our algorithm achieves provable subexponential classical running time, whereas the primal and dual baselines have exponential-time bounds and earlier provable subexponential BKW analyses require Ω(nln n) samples.

November 9, 2026 at 2:04 AM

arXiv cs.DS Data Structures and Algorithms

@csds-bot.bsky.social

Daniel Lokshtanov, Fahad Panolan, Saket Saurabh, Jie Xue, Meirav Zehavi: Vertex Deletion on $H$-Induced-Minor-Free Graphs: Subexponential FPT Algorithms and Approximation Schemes https://arxiv.org/abs/2611.09071 https://arxiv.org/pdf/2611.09071 https://arxiv.org/html/2611.09071

November 9, 2026 at 6:40 AM

Theory of Computing Report

@theory.report

Simulating Nondeterministic Turing Machines in Subexponential Deterministic Time

**Authors:** Carmen Strassle, Bernardo Subercaseaux We show that every multitape nondeterministic Turing machine can be simulated deterministically in subexponential time. Specifically, we show that the recent algorithms for $3$-$\mathsf{SAT}$ presented by OpenAI and Anthropic imply $\mathsf{NTIME}[t]\subseteq\mathsf{DTIME}[2^{O(t \log \log t/\sqrt{\log t})}]$, and that a stronger consequence of their proof yields \\[\mathsf{NTIME}[t] \subseteq\mathsf{DTIME}[2^{O(t /\sqrt{\log t})}]. \\] More generally, we show that any subexponential time algorithm for solving circuit-CSPs transfers to a deterministic simulation of $\mathsf{NTIME}$ with the same savings. Our results follow from new generalizations of Cook--Levin, which may be of independent interest.

arxiv.org

November 10, 2026 at 12:47 PM

ePrint Updates

@eprint.ing.bot

Provable Subexponential Algorithms for NIST Third-Round Lattice Families (Yiming Gao, Xuyuan Han, Honggang Hu) ia.cr/2026/2386

Abstract. We give provable classical subexponential algorithms for secret recovery in growing parameter families associated with NIST third-round lattice candidates. For the Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, and Dilithium/ML-DSA families studied here, polynomial moduli and polylogarithmic coefficient scales yield recovery of the short secret component in expected time and space 2^((1/2 + o(1))n/ln ln n).

For noisy or rounded linear relations, we exploit an exact gap in the squared Euclidean norm of a comparison vector defined by each coordinate guess. One Gaussian list suffices to identify every secret coordinate by binary search, without enumerating the others. We establish the required sampling guarantees through new geometric bounds for structured public operators over prime and power of two moduli. The construction builds on the Wagner-style Gaussian sampling framework of Ducas, Engelberts, and Loyer (CRYPTO 2025) and the low-error decision-LWE algorithm of Han, Gao, and Hu (2026).

For quotient relations of NTRU type, we develop an affine slice search: fixing coordinates restricts candidate pairs to slices of the public lattice, and their estimated Gaussian masses guide the choice of each next coordinate. In the stated modulus window, Falcon’s key generation quality condition supplies the required mass bound. The algorithm then recovers an equivalent signing key with high probability in time and space 2^(O(n/ln ln n)). The same search recovers the short key core for cyclic NTRU-HPS/HRSS.

Together, these results give subexponential algorithms for problem families associated with all seven NIST third-round lattice candidates. Despite the subexponential complexity, our results do not establish a reduction in the concrete security of the currently specified parameter sets.

November 9, 2026 at 1:35 AM

Karl Pettersson

@karlpettersson.bsky.social

109 A cases in Sweden week 44, so still a subexponential increase.

But this week, we have somewhat colder and drier weather in the most populous parts of the country, and children have returned from the fall vacation, so it may take off now.

November 5, 2026 at 7:12 PM

ePrint Updates

@eprint.ing.bot

Provable Subexponential Algorithms for Module-SIS and Module-LWE (William Youmans) ia.cr/2026/2420

$Abstract. Ducas, Engelberts and Loyer (CRYPTO 2025) turned Wagner’s generalized birthday algorithm into a provable subexponential-time Gaussian sampler for unstructured short integer solutions. Recent preprints of Han, Gao and Hu, and of Chen, Jiang, Wang and Zhang, obtain low-sample decision learning-with-errors algorithms from this framework. We extend it to module matrices over power-of-two cyclotomic rings, for every residue degree of the prime modulus. For fixed module ranks k, ℓ ≥ 1, let n = kd, m = (k + ℓ)d, and suppose $\ln(q/\sqrt n)=(\ln n)^{b+o(1)}$. For every fixed b, c, ξ > 0, we solve Module-SIS with coefficient infinity-norm bound q/(ln n)^(c) in worst-case time and space 2^((1/(2b) + ξ)n/ln ln n). For matrix-independent errors satisfying $\|e\|\le\sigma\sqrt m$ with probability 1 − o(1) and ln (2 + σ) = (ln n)^(a + o(1)), 0 ≤ a < b, decision and search Module-LWE take 2^((1/(2(b − a)) + ξ)n/ln ln n). Success is 1 − o(1) using only the given k + ℓ ring samples; error coordinates need not be independent. The structural ingredient is a Chinese-remainder-support uncertainty bound: the loss of randomness of sparse dual labels is compensated by an arithmetic lower bound on their length. Scalar row perturbations give search over the base field, and small integer shears remove a singular-block loss. Projection, the Han–Gao–Hu martingale analysis, and a finite enumeration sampler give a common algorithmic framework. We also prove sample-preserving scalar search-LWE and narrow Module-LWE algorithms. In particular, for polynomial prime q = n^(κ + o(1)), κ > 1/2, one ring sample and growing rank suffice for decision and search in time and space 2^((1/2 + ξ)n/ln ln n) when the sample supplies (1 + o(1))n/ln ln n scalar responses. Here “narrow” restricts both secret and error. Separate heuristic estimates in the model of Ducas, Engelberts and Loyer suggest that Wagner-style attacks do not reach the NIST security targets of ML-KEM and ML-DSA.$ Image showing part 2 of abstract.

November 9, 2026 at 1:39 AM

David Picard

@davidpicard.eurosky.social

The bizarre era of watching AI generated videos explaining AI generated TCS results...

www.youtube.com/watch?v=YmU4...

The Exponential Time Hypothesis Is False? OpenAI's Claimed Subexponential #SAT Algorithm, Explained

YouTube video by TCS Proofs

www.youtube.com

November 2, 2026 at 12:22 PM

ePrint Updates

@eprint.ing.bot

A Note on Extractable Witness Encryption in Generic Groups (Matteo Campanelli) ia.cr/2026/2399

Abstract. Hair and Sahai (arXiv:2609.18275v1) have recently proposed a construction of witness encryption for NP satisfying semantic security. In this note we observe that this recent witness-encryption construction is unconditionally extractable in the generic group model. This yields a construction of extractable witness encryption without assuming subexponential soundness of SNARGs, in contrast to the recent work of Jin (ePrint 2026/2063), which requires this assumption. The result in this note, moreover, complements the concurrent work of Chen and Vaikuntanathan (ePrint 2026/2346), who show the same construction to be public-coin extractable under a knowledge-style assumption; our argument is unconditional in the GGM.

November 9, 2026 at 1:37 AM

ePrint Updates

@eprint.ing.bot

How Secure are NTRU+ Keys? Analysing the Best Module Attacks (Paola de Perthuis, Filip Trenkić) ia.cr/2026/2527

Abstract. A recent analysis of module-BKZ [Ducas–Engleberts–Perthuis, Asiacrypt’25] predicts subexponential speedups for lattice reduction on module lattices over cyclotomic fields whose conductor has small odd prime factors. This threatens NTRU+, the South Korean standard for key encapsulation, and related schemes; however, the short vectors one seeks to find are short in the coefficient geometry, whereas module-BKZ operates in the canonical geometry.

We introduce relative canonical and relative coefficient embeddings, realising a module over a cyclotomic field K as a module over any subfield L, and characterise when the two agree up to scaling: exactly when the radicals of their respective conductors c and ℓ satisfy rad(c)/rad(ℓ) ∈ {1, 2}. Furthermore we quantify the distortion incurred in general when passing between embeddings, and hence identify the optimal subfield for module-BKZ and BKZ to use.

Estimating the cost of the best attack with simulation-based models [Perthuis–Trenkić, PQCrypto’26], we find that the best module attack saves only 4–10 blocksizes, costing NTRU+ keys at most three bits of security in the Core-SVP model.

We further extend the analysis of overstretched NTRU regimes [Ducas–Woerden, Asiacrypt’19] to the module setting, and find the fatigue point is reached sooner than with unstructured counterparts, though NTRU+ parameterisations remain safe.

November 9, 2026 at 1:51 AM

ePrint Updates

@eprint.ing.bot

A Subexponential Algorithm for Binary LWE with Sublinear Samples (Zhili Chen, Kaijie Jiang, Anyu Wang, Chuanqi Zhang) ia.cr/2026/2289

Abstract. We study Binary LWE with polynomial modulus in the regime of a linear number of samples. Prior work of Kirchner and Fouque and of Herold, Kirshanova, and May (CRYPTO ’15, DCC ’18) gives an algorithm running in time exp (O(n/log log n)) using O(nlog n) samples, leaving open whether the same complexity can be achieved with only m = Θ(n) samples.

We resolve this problem by showing that the same complexity is achievable with even a sublinear number of samples. Fix any constant a > 1/2, let q = n^(a + o(1)) be an odd prime, and let m = ⌈n/log log n⌉. We give a randomized algorithm that distinguishes (A, A^(⊤)s + e) ∈ ℤ_(q)^(n × m) × ℤ_(q)^(m) from a uniformly random pair, for every fixed secret–error pair satisfying ∥s∥₂² + ∥e∥₂² = O(m + n). Its expected running time and space are exp (O(n/log log n)).

A crucial component is a new instantiation of the auxiliary superlattices in the Gaussian–Wagner framework of Ducas, Engelberts, and Loyer (CRYPTO ’25). These superlattices have sufficiently small smoothing parameters even when the approximation parameter for the entire output list is subexponentially small, while still admitting exact shifted discrete Gaussian sampling within the claimed running time. A Euclidean dual-minimum argument simultaneously controls the smoothing parameters of all projected relevant lattices. Combining the resulting short vectors with an Aharonov–Regev Fourier distinguisher yields the claimed sublinear sample LWE algorithm.

November 9, 2026 at 1:24 AM

🇵🇸Tim Henke (tɪm 'ɦɛŋ.kə)

@timhenke.bsky.social

FWIW I don't think "big numbers exist" invalidates the poly vs exp distinction, but also it's worth noting that the sense in which OAI showed 3-SAT is subexponential is not closed under polynomial reduction

November 1, 2026 at 11:36 AM

Huck Bennett

@huckbennett.bsky.social

Yes, faster exponential-time algorithms were known for 3-SAT, but not subexponential-time algorithms. Hence ETH. Here's one such alg.

November 1, 2026 at 1:28 AM

arXiv cs.CC Computational Complexity

@cscc-bot.bsky.social

Ruhollah Majdoddin: Lowered crossover points of Anthropic's subexponential 3-SAT algorithm https://arxiv.org/abs/2610.41622 https://arxiv.org/pdf/2610.41622 https://arxiv.org/html/2610.41622

November 2, 2026 at 6:38 AM

Helger Lipmaa

@helger.bsky.social

Next week I should talk about the subexponential elliptic curve discrete logarithm algorithm (but I am not teaching that class)

Ryan O'Donnell @booleananalysis.bsky.social · 12d

I lectured on the "ETH false" (#3SAT in subexponential time) result in my grad complexity class at CMU today.

Didn't have time in 80 mins to do the full proof, but I hope I got across the main plan, and some of the basic TCS ingredients going into it.

youtu.be/_HlQGMcQWhA

ETH False

YouTube video by Ryan O'Donnell

youtu.be

October 30, 2026 at 7:56 PM

Daniel McLaury

@danielmclaury.bsky.social

A recent paper claims SAT is subexponential. Still no reason to think it's polynomial, but we don't *know* it isn't.

October 31, 2026 at 10:44 AM

Informaq - Bitesize Quantum Insights

@informaq.bsky.social

Novel shallow quantum circuits for data loading reduce circuit depth from linear to O(√n) for multivariable functions on hypercubes, trading depth for subexponential ancilla qubits in Clifford+T gate set.

#QuantumCircuits #QuantumAlgorithms #Research

Shallow Data-Loading Circuits for Multivariable Functions

arxiv.org

November 3, 2026 at 8:28 AM

ePrint Updates

@eprint.ing.bot

Provably Subexponential Algorithms for Bounded-Error LWE with Few Samples (Haoxing Lin, Prashant Nalini Vasudevan) ia.cr/2026/2426

Abstract. We show that a variant of the Wagner/BKW-style algorithm for LWE of Kirchner and Fouque [KF15] solves decision and search LWE with secrets of size n over prime moduli q = n^(κ + o(1)), for any fixed κ > 0, with errors bounded by exp ((ln n)^(o(1))), in time 2^(O(n/ln ln n)) given n + O(n/ln ln n) original samples. Further, if each coordinate of the secret is also bounded by exp ((ln n)^(o(1))), the same time bound holds with errors bounded by n^(o(1)) and only O(n/ln ln q) samples.

Earlier, it was known that Kirchner and Fouque’s algorithm could solve LWE with these parameters in subexponential time with a much larger number of samples m = Ω(nlog n) [HKM18]. Ducas et al. [DEL25] showed that an adaptation of this algorithm could solve the corresponding dual, the SIS^(∞) problem, with a suitable norm bound q/polylog (n) and m = n + ω(n/ln ln n) variables in subexponential time. Whereas their analysis involves interpreting the algorithm in terms of chains of lattices, our approach is quite elementary and is based on bounding the lower moments of a Fourier statistic.

November 9, 2026 at 1:40 AM

Clément Canonne

@ccanonne.github.io

#3SAT in subexponential time: a heroic lecture by Ryan O'Donnell, merely two days after the announcement. (But who's counting?*)

*besides, well, the algorithm

www.youtube.com/watch?v=_HlQ...

Ryan O'Donnell @booleananalysis.bsky.social · 12d

I lectured on the "ETH false" (#3SAT in subexponential time) result in my grad complexity class at CMU today.

Didn't have time in 80 mins to do the full proof, but I hope I got across the main plan, and some of the basic TCS ingredients going into it.

youtu.be/_HlQGMcQWhA

ETH False

YouTube video by Ryan O'Donnell

youtu.be

October 30, 2026 at 7:55 AM