A History of Lattice-Based Encryption (in order of increasing - PowerPoint PPT Presentation

A History of Lattice-Based Encryption (in order of increasing efficiency) Vadim Lyubashevsky INRIA / ENS, Paris Lattice-Based Crypto & Applications 1 Bar-Ilan University, Israel 2012

Lattice-Based Encryption Schemes 1. NTRU [Hoffstein, Pipher , Silverman ‘98] 2. LWE-Based [Regev ‘05] 3. Ring-LWE Based [L, Peikert, Regev ’10] 4. “NTRU - like” with a proof of security [Stehle, Steinfeld ‘11] Lattice-Based Crypto & Applications 2 Bar-Ilan University, Israel 2012

Subset Sum Problem Subset-Sum Based [L, Palacio, Segev ‘10] LWE-Based [Regev ‘05] Ring-LWE Based [L, Peikert, Regev ’10] “ NTRU- like” with a proof of security [Stehle, Steinfeld ‘11] NTRU [Hoffstein, Pipher , Silverman ‘98] Lattice-Based Crypto & Applications 3 Bar-Ilan University, Israel 2012

THE SUBSET SUM PROBLEM Lattice-Based Crypto & Applications 4 Bar-Ilan University, Israel 2012

Subset Sum Problem a i , T in Z M a i are chosen randomly T is a sum of a random subset of the a i a 1 a 2 a 3 … a n T Find a subset of a i 's that sums to T (mod M) Lattice-Based Crypto & Applications 5 Bar-Ilan University, Israel 2012

Subset Sum Problem a i , T in Z 49 a i are chosen randomly T is a sum of a random subset of the a i 15 31 24 3 14 11 15 + 31 + 14 = 11 (mod 49) Lattice-Based Crypto & Applications 6 Bar-Ilan University, Israel 2012

How Hard is Subset Sum? a i , T in Z M a 1 a 2 a 3 … a n T Find a subset of a i 's that sums to T (mod M) Hardness Depends on: • Size of n and M • Relationship between n and M Lattice-Based Crypto & Applications 7 Bar-Ilan University, Israel 2012

Complexity of Solving Subset Sum M 2 log²(n) 2 n 2 n log(n) 2 n² 2 Ω(n) poly(n) poly(n) run-time “generalized birthday attacks” “lattice reduction attacks” [FlaPrz05,Lyu06,Sha08] [LagOdl85,Fri86] Lattice-Based Crypto & Applications 8 Bar-Ilan University, Israel 2012

Subset Sum Crypto  Why?  simple operations  exponential hardness  very different from number theoretic assumptions  resists quantum attacks Lattice-Based Crypto & Applications 9 Bar-Ilan University, Israel 2012

Subset Sum is “Pseudorandom” [Impagliazzo-Naor 1989]: For random a 1 ,...,a n in Z M and random x 1 ,...,x n in {0,1}, distinguishing the distribution (a 1 ,...,a n , a 1 x 1 +...+a n x n mod M) n+1 ) from the uniform distribution U(Z M is as hard as finding x 1 ,...,x n Lattice-Based Crypto & Applications 10 Bar-Ilan University, Israel 2012

What About Public-Key Encryption?  Many early attempts  None of them had proofs of security  All seem to be broken Lattice-Based Crypto & Applications 11 Bar-Ilan University, Israel 2012

Merkle-Hellman Cryptosystem a 1 ,...,a n are super-increasing (a j > a 1 +...+a j-1 ) knowing a 1 ,...,a n and a 1 x 1 +...+a n x n , we can recover all the x i Secret key: Super-increasing a 1 ,...,a n , and M > a 1 +...+a n and r such that gcd(r,M)=1 Public Key: w i =ra i mod M Encrypt(x 1 ,...,x n )=w 1 x 1 +...+w n x n =r(a 1 x 1 +...+a n x n ) Decrypt(T): Compute r -1 T mod M and recover all x i Lattice-Based Crypto & Applications 12 Bar-Ilan University, Israel 2012

Merkle-Hellman Cryptosystem a 1 ,...,a n are super-increasing (a j > a 1 +...+a j-1 ) knowing a 1 ,...,a n and a 1 x 1 +...+a n x n , we can recover all the x i Secret key: Super-increasing a 1 ,...,a n , and M > a 1 +...+a n and r such that gcd(r,M)=1 Public Key: w i =ra i mod M Encrypt(x 1 ,...,x n )=w 1 x 1 +...+w n x n =r(a 1 x 1 +...+a n x n ) Decrypt(T): Compute r -1 T mod M Not Random!! (was exploited in attacks) and recover all x i Lattice-Based Crypto & Applications 13 Bar-Ilan University, Israel 2012

CRYPTOSYSTEM BASED ON SUBSET SUM [L, PALACIO, SEGEV 2010] Lattice-Based Crypto & Applications 14 Bar-Ilan University, Israel 2012

Subset Sum Cryptosystem  Semantically secure based on Subset Sum for M ≈ n n  Main tools Subset sum is pseudo-random Addition in (Z q ) n is “kind of like” addition in Z M where M=q n  The proof is very simple Lattice-Based Crypto & Applications 15 Bar-Ilan University, Israel 2012

Facts About Addition Want to add 4679 + 3907 + 8465 + 1343 mod 10 4 2 1 2 4 6 7 9 4 6 7 9 3 9 0 7 3 9 0 7 8 4 6 5 8 4 6 5 1 3 4 3 1 3 4 3 6 2 7 4 8 3 9 4 Adding n numbers (written in base q) modulo q m → carries < n If q>>n, then Adding with carries ≈ Adding without carries (i.e. in Z M ) (i.e. in (Z q ) n ) Lattice-Based Crypto & Applications 16 Bar-Ilan University, Israel 2012

So... 1 1 0 1 4 6 7 9 1 1 0 1 4 6 7 9 3 9 0 7 3 9 0 7 8 4 6 5 8 4 6 5 1 6 4 3 1 6 4 3 + 2 1 1 0 8 1 1 9 = 0 2 2 9 = NOT Pseudorandom! Pseudorandom based on Subset Sum! Lattice-Based Crypto & Applications 17 Bar-Ilan University, Israel 2012

Column Subset Sum Addition Is Also Pseudorandom 4 6 7 9 1 1 0 3 9 0 7 1 1 9 + = 8 4 6 5 0 1 8 1 6 4 3 1 0 0 Lattice-Based Crypto & Applications 18 Bar-Ilan University, Israel 2012

“Hybrid” Subset Sum Addition Is Also Pseudorandom 1 0 0 1 4 6 7 9 0 3 9 0 7 9 8 4 6 5 8 pseudorandom 1 6 4 3 0 1 1 1 0 0 + 6 3 2 2 0 = Lattice-Based Crypto & Applications 19 Bar-Ilan University, Israel 2012

Encryption Scheme r A A s t t + = {0,1} n + {0,1} n n x n Z q = u v Public Key Lattice-Based Crypto & Applications 20 Bar-Ilan University, Israel 2012

Encryption Scheme r A A s t t + = + = u v Is pseudo-random based on the hardness of the subset sum problem Lattice-Based Crypto & Applications 21 Bar-Ilan University, Israel 2012

Encryption Scheme r A A s t t + = + = u v v r r = + A A s s + r + = A A s s Lattice-Based Crypto & Applications 22 Bar-Ilan University, Israel 2012

Encryption Scheme r A A s t t + = + = u v r u + = A s s r ≈ v + = s A Lattice-Based Crypto & Applications 23 Bar-Ilan University, Israel 2012

Encryption Scheme r A A s t t + = + = u v Encryption of 0 v - u = s Lattice-Based Crypto & Applications 24 Bar-Ilan University, Israel 2012

Encryption Scheme r A A s t t + = + = u v + 0 q/2 = Encryption of 1 u v’ u v’ - + q/2 = s Lattice-Based Crypto & Applications 25 Bar-Ilan University, Israel 2012

CRYPTOSYSTEM BASED ON LWE [REGEV 2005] Lattice-Based Crypto & Applications 26 Bar-Ilan University, Israel 2012

Encryption Scheme (what we needed) r A A s t t + = + = u v “small” Pseudorandom Lattice-Based Crypto & Applications 27 Bar-Ilan University, Israel 2012

Picking the “Carries” • In Subset Sum: carries were deterministic • What if … we pick the “carries” at random from some distribution? Lattice-Based Crypto & Applications 28 Bar-Ilan University, Israel 2012

So... 1 1 0 1 4 6 7 9 2 3 0 1 4 6 7 9 3 9 0 7 3 9 0 7 8 4 6 5 8 4 6 5 1 6 4 3 1 6 4 3 + 2 1 1 0 + 1 3 2 1 0 2 2 9 7 2 0 3 = = Pseudorandom Pseudorandom based on based on LWE [Reg ‘ 05] Subset Sum Lattice-Based Crypto & Applications 29 Bar-Ilan University, Israel 2012

LWE vs. Subset Sum • The Subset Sum assumption has “deterministic noise ” • The LWE assumption is more “versatile” LWE Problem a 1 a 2 s + e = b . . . n 2 a m Lattice-Based Crypto & Applications n 30 Bar-Ilan University, Israel 2012

LWE vs. Subset Sum • The Subset Sum assumption has “deterministic noise ” • The LWE assumption is more “versatile” Subset Sum Problem s a 1 a 2 … a n = b n 2 + Lattice-Based Crypto & Applications 31 n Bar-Ilan University, Israel 2012

LWE / Subset Sum Encryption r A A s t t + = + = u v n-bit Encryption Have Want Õ(n) / Õ(n 2 ) Public Key Size O(n) Secret Key Size Õ(n) / Õ (n 2 ) O(n) Ciphertext Expansion Õ(n) / Õ (1) O(1) Encryption Time Õ(n 3 ) / Õ (n 2 ) O(n) Õ(n 2 ) Decryption Time O(n) Lattice-Based Crypto & Applications 32 Bar-Ilan University, Israel 2012

CRYPTOSYSTEM BASED ON RING-LWE [L, PEIKERT, REGEV 2010] Lattice-Based Crypto & Applications 33 Bar-Ilan University, Israel 2012

Source of Inefficiency of LWE Getting just one extra random-looking 2 8 7 3 1 2 1 + = * number requires n random numbers 0 and a small error element. 2 1 Wishful thinking: get n random numbers and produce n pseudo-random numbers in “one shot” 2 1 8 0 + = * 7 2 3 1 Lattice-Based Crypto & Applications 34 Bar-Ilan University, Israel 2012

Use Polynomials f(x) is a polynomial x n + a n-1 x n-1 + … + a 1 x + a 0 R = Z p [x]/(f(x)) is a polynomial ring with • Addition mod p • Polynomial multiplication mod p and f(x) Each element of R consists of n elements in Z p In R: • small+small = small • small*small = small (depending on f(x) ) Lattice-Based Crypto & Applications 35 Bar-Ilan University, Israel 2012