A NEW ALGORITHM FOR THE VARIANTS OF ACD PROBLEM Jung Hee Cheon, Wonhee Cho, Minki Hhan, Minsik Kang, Jiseung Kim, Changmin Lee ENS de Lyon June 27, 2019 Changmin Lee Analysis of CRT-ACD June 27, 2019 1 / 23
Approximate Common-Divisor Problem[HG01] Partial Approximate Common Divisor problem(PACD): a 0 = pq 0 = pq 1 + r 1 ≡ r 1 mod p a 1 . . . . . . = pq ℓ + r ℓ ≡ r ℓ mod p a ℓ where p is a big secret prime and r i ≪ p . Question : Given ( a 0 , . . . , a ℓ ), Can we recover p ? Answer : SDA, OLA, Coppersmith Method Changmin Lee Analysis of CRT-ACD June 27, 2019 2 / 23
Approximate Common-Divisor Problem[HG01] Partial Approximate Common Divisor problem(PACD): a 0 = pq 0 = pq 1 + r 1 ≡ r 1 mod p a 1 . . . . . . = pq ℓ + r ℓ ≡ r ℓ mod p a ℓ where p is a big secret prime and r i ≪ p . Question : Given ( a 0 , . . . , a ℓ ), Can we recover p ? Answer : SDA, OLA, Coppersmith Method Changmin Lee Analysis of CRT-ACD June 27, 2019 2 / 23
Approximate Common-Divisor Problem[HG01] Application: J.-S. Coron, A. Mandal, D. Naccache, M. Tibouchi. Fully homomorphic encryption over the integers with shorter public keys. CRYPTO 2011. J.-S. Coron, D. Naccache, M. Tibouchi. Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers. EUROCRYPT 2012. J. H. Cheon, D. Stehle. Fully Homomorphic Encryption over the Integers Revisited. EUROCRYPT 2015. Changmin Lee Analysis of CRT-ACD June 27, 2019 3 / 23
Chinese Remainder Theorem-ACD Problem[CCK+13] CRT-ACD (Simple version): n � = N p i i =1 ≡ r i 1 mod p i a 1 . . . ≡ r i ℓ mod p i a ℓ where p i are big secret primes ( η -bit) and r ij ( ρ -bit) ≪ p i . Question : Given ( N , a 1 , . . . , a ℓ ), Can we recover p i ? What if n = 2 ? Changmin Lee Analysis of CRT-ACD June 27, 2019 4 / 23
Chinese Remainder Theorem-ACD Problem[CCK+13] CRT-ACD (Simple version): n � = N p i i =1 ≡ r i 1 mod p i a 1 . . . ≡ r i ℓ mod p i a ℓ where p i are big secret primes ( η -bit) and r ij ( ρ -bit) ≪ p i . Question : Given ( N , a 1 , . . . , a ℓ ), Can we recover p i ? What if n = 2 ? Changmin Lee Analysis of CRT-ACD June 27, 2019 4 / 23
Chinese Remainder Theorem-ACD Problem[CCK+13] Application: J. H. Cheon, J.-S. Coron, J. Kim, M. S. Lee, T. Lepoint, M. Tibouchi, A. Yun. Batch Fully Homomorphic Encryption over the Integers. EUROCRYPT 2013. J.-S. Coron, T. Lepoint, M. Tibouchi, Practical Multilinear Maps over the Integers. CRYPTO13 J.-S. Coron, T. Lepoint, M. Tibouchi, New Multilinear Maps Over the Integers. CRYPTO15 Changmin Lee Analysis of CRT-ACD June 27, 2019 5 / 23
Varinant of Chinese Remainder Theorem-ACD Problem CRT-ACD with a dual instance(CRT-ACDwDI): n � = N p i i =1 ≡ r i 1 mod p i a 1 . . . ≡ r i ℓ mod p i a ℓ � = d i · N / p i D i where p i are big secret primes ( η -bit) and r ij ( ρ -bit) , d i ≪ p i . Question : Given ( N , a 1 , . . . , a ℓ , D ), Can we recover p i ? Answer : Yes! Changmin Lee Analysis of CRT-ACD June 27, 2019 6 / 23
Varinant of Chinese Remainder Theorem-ACD Problem CRT-ACD with a dual instance(CRT-ACDwDI): n � = N p i i =1 ≡ r i 1 mod p i a 1 . . . ≡ r i ℓ mod p i a ℓ � = d i · N / p i D i where p i are big secret primes ( η -bit) and r ij ( ρ -bit) , d i ≪ p i . Question : Given ( N , a 1 , . . . , a ℓ , D ), Can we recover p i ? Answer : Yes! Changmin Lee Analysis of CRT-ACD June 27, 2019 6 / 23
Result Current Status There are 3 types of algorithms for solving PACD Algorithms for PACD cannot be applied to CRT-ACD . There is no algebraic algorithm to solve the CRT-ACD problem. It is not known which parameter is safe. CRT-ACDwDI is solved in polynomial time in n , η [CHLRS15]. Our results We present an algorithm to solve the CRT-ACD problem It is solved in polynomial time if n ≤ η − 4 · ρ . We provide the first guideline to set n . Changmin Lee Analysis of CRT-ACD June 27, 2019 7 / 23
Result Current Status There are 3 types of algorithms for solving PACD Algorithms for PACD cannot be applied to CRT-ACD . There is no algebraic algorithm to solve the CRT-ACD problem. It is not known which parameter is safe. CRT-ACDwDI is solved in polynomial time in n , η [CHLRS15]. Our results We present an algorithm to solve the CRT-ACD problem It is solved in polynomial time if n ≤ η − 4 · ρ . We provide the first guideline to set n . Changmin Lee Analysis of CRT-ACD June 27, 2019 7 / 23
Cryptanalysis of CRT-ACD Changmin Lee Analysis of CRT-ACD June 27, 2019 8 / 23
Notation Notation: � − 1 n p i , 1 n � � � CRT ( p i ) ( r i ) defined as the unique integer in p i 2 2 i =1 i =1 which is congruent to r i mod p i for all i ∈ { 1 , . . . , n } n � N = p i i =1 p i = N / p i . ˆ Note that we assume n = 2 for the sake of simplicity. So we use the notation CRT ( p 1 , p 2 ) ( r i , 1 , r i , 2 ) as well. Changmin Lee Analysis of CRT-ACD June 27, 2019 9 / 23
Definition of CRT-ACD and Dual instance Definition (CRT-ACD Problem, Simple version) Let p 1 and p 2 be η -bit integers and r i , 1 and r i , 2 be ρ -bit integers with ρ < η . The CRT-ACD problem is: Given many samples CRT ( p 1 , p 2 ) ( r i , 1 , r i , 2 ) and N , find p 1 , p 2 . Definition (Dual instance, Simple version) Let p 1 and p 2 be parameters of CRT-ACD problem. Dual instance of CRT-ACD is defined as an integer that is expressed in the following form. n � D = d i · ˆ p i = d 1 · p 2 + d 2 · p 1 , i where | d i | ≤ 2 η − 3 ρ − log n = 2 η − 3 ρ − log 2 . Changmin Lee Analysis of CRT-ACD June 27, 2019 10 / 23
Attack Outline Our results We present an algorithm to solve the CRT-ACD problem Our algorithm consists of 2 steps The first step is to obtain a dual instance only from the CRT-ACD samples. Using the previous algorithm for CRT-ACDwDI, all the factors p i can be recovered. Changmin Lee Analysis of CRT-ACD June 27, 2019 11 / 23
Observation Put b j := CRT ( p 1 , p 2 ) ( r j , 1 , r j , 2 ) = p 1 · q j , 1 + r j , 1 = p 2 · q j , 2 + r j , 2 . For any dual instance d = d 1 · ˆ p 1 + d 2 · ˆ p 2 , the followings hold: [ d · b j ] N ≡ [ d 1 · ˆ p 1 · ( p 1 · q j , 1 + r j , 1 ) + d 2 · ˆ p 2 · ( p 2 · q j , 2 + r j , 2 )] N ≡ [ d 1 · ˆ p 1 · r j , 1 + d 2 · ˆ p 2 · r j , 2 ] N = d 1 · ˆ p 1 · r j , 1 + d 2 · ˆ p 2 · r j , 2 Small! compared to N p i | ≤ 2 2 η − 2 ρ ≪ N / 2 | � 2 ∵ | d i | ≤ 2 η − 3 ρ − log 2 , i =1 d i · r j , i · ˆ Changmin Lee Analysis of CRT-ACD June 27, 2019 12 / 23
Step 1: How to find a dual instance Consider a lattice L generated by the following matrix: 1 0 0 0 0 0 0 0 b 1 N B = b 2 0 N 0 0 0 0 0 b 3 N b 4 0 0 0 N ([ d ] N , [ d · b 1 ] N , [ d · b 2 ] N , [ d · b 3 ] N , [ d · b 4 ] N ) T is a short vector in a lattice L if d is a dual instance. We will show that the first entry of any short vectors in a lattice L is a dual instance. Changmin Lee Analysis of CRT-ACD June 27, 2019 13 / 23
Step 1: Idea Sketch Let E = ( E 1 , E 2 , E 3 , E 4 , E 5 ) T be a lattice point of L . We hold: For any element E 1 ∈ Z can be written as e 1 · ˆ p 1 + e 2 · ˆ p 2 . E i = [ E 1 · b i ] N = e 1 · r i , 1 · ˆ p 1 + e 2 · r i , 2 · ˆ p 2 mod N . Hence, we have the following relation: E = ( E 1 , E 2 , E 3 , E 4 , E 5 ) � ˆ � � 1 � 0 p 1 r 1 , 1 r 2 , 1 r 3 , 1 r 4 , 1 = ( e 1 , e 2 ) · · 0 ˆ 1 p 2 r 1 , 2 r 2 , 2 r 3 , 2 r 4 , 2 E · ˆ = P · R mod N We want to show that � E · ˆ P mod N � ∞ is small. It implies that � E � ∞ is small. Changmin Lee Analysis of CRT-ACD June 27, 2019 14 / 23
Step 1: Idea Sketch Let E = ( E 1 , E 2 , E 3 , E 4 , E 5 ) T be a lattice point of L . We hold: For any element E 1 ∈ Z can be written as e 1 · ˆ p 1 + e 2 · ˆ p 2 . E i = [ E 1 · b i ] N = e 1 · r i , 1 · ˆ p 1 + e 2 · r i , 2 · ˆ p 2 mod N . Hence, we have the following relation: E = ( E 1 , E 2 , E 3 , E 4 , E 5 ) � ˆ � � 1 � 0 p 1 r 1 , 1 r 2 , 1 r 3 , 1 r 4 , 1 = ( e 1 , e 2 ) · · 0 ˆ 1 p 2 r 1 , 2 r 2 , 2 r 3 , 2 r 4 , 2 E · ˆ = P · R mod N We want to show that � E · ˆ P mod N � ∞ is small. It implies that � E � ∞ is small. Changmin Lee Analysis of CRT-ACD June 27, 2019 14 / 23
Step 1: Idea Sketch We obtain the inequality as follows: � E · R − 1 mod N � ∞ ≤ � E · R − 1 � ∞ � E · ˆ P mod N � ∞ = � E � ∞ · � R − 1 � ∞ · n , ≤ where R − 1 is a right inverse of R . We show that the smallness of � E � ∞ with a lattice reduction algorithm. (It is possible when n ≤ η − 4 · ρ .) � R − 1 � ∞ with Gaussian Heuristics. From the equation, the size of e i · ˆ p i is bounded for all i . Changmin Lee Analysis of CRT-ACD June 27, 2019 15 / 23
Result Let n , η, ρ be parameters of the CRT-ACD Problem. When 2 n instances are given, we can find a dual instance under the condition n ≤ η − 4 ρ in polynomial time with LLL algorithm 2 log β · ( η − 4 ρ ) in 2 O ( β ) time with BKZ algorithm β − 1 n ≤ Changmin Lee Analysis of CRT-ACD June 27, 2019 16 / 23
Recommend
More recommend
