Algebraically Structured LWE, Revisited Chris Peikert Zachary Pepin University of Michigan TCC 2019 1 / 13
‘Algebraic’ Learning With Errors ◮ A foundation of efficient lattice crypto: Ring-LWE, Module-LWE, Polynomial-LWE, Order-LWE, Middle-Product-LWE, . . . 2 / 13
‘Algebraic’ Learning With Errors ◮ A foundation of efficient lattice crypto: Ring-LWE, Module-LWE, Polynomial-LWE, Order-LWE, Middle-Product-LWE, . . . ◮ Hardness supported by a web of reductions, from worst-case problems on algebraic lattices and among the problems themselves [SSTX’09,LPR’10,LS’15,L’16,PRS’17,RSSS’17,AD’17,RSW’18,BBPS’18,. . . ] 2 / 13
‘Algebraic’ Learning With Errors ◮ A foundation of efficient lattice crypto: Ring-LWE, Module-LWE, Polynomial-LWE, Order-LWE, Middle-Product-LWE, . . . ◮ Hardness supported by a web of reductions, from worst-case problems on algebraic lattices and among the problems themselves [SSTX’09,LPR’10,LS’15,L’16,PRS’17,RSSS’17,AD’17,RSW’18,BBPS’18,. . . ] 2 / 13
‘Algebraic’ Learning With Errors ◮ A foundation of efficient lattice crypto: Ring-LWE, Module-LWE, Polynomial-LWE, Order-LWE, Middle-Product-LWE, . . . ◮ Hardness supported by a web of reductions, from worst-case problems on algebraic lattices and among the problems themselves [SSTX’09,LPR’10,LS’15,L’16,PRS’17,RSSS’17,AD’17,RSW’18,BBPS’18,. . . ] ◮ But these reductions are often difficult to understand and use: 2 / 13
‘Algebraic’ Learning With Errors ◮ A foundation of efficient lattice crypto: Ring-LWE, Module-LWE, Polynomial-LWE, Order-LWE, Middle-Product-LWE, . . . ◮ Hardness supported by a web of reductions, from worst-case problems on algebraic lattices and among the problems themselves [SSTX’09,LPR’10,LS’15,L’16,PRS’17,RSSS’17,AD’17,RSW’18,BBPS’18,. . . ] ◮ But these reductions are often difficult to understand and use: ⋆ Several steps between problems of interest ⋆ Complex analysis and parameters ⋆ Frequently large blowup and distortion of error distributions, across different metrics ⋆ Sometimes non-uniform advice that appears hard to compute 2 / 13
Prior Hardness of Ring-LWE and MP-LWE (dual) O K -LWE [LPR’10,PRS’17] worst-case approx- O K -SIVP 3 / 13
Prior Hardness of Ring-LWE and MP-LWE (primal) O K -LWE complex & non-uniform; [LPR’10,DD’12,RSW’18] expands error (dual) O K -LWE [LPR’10,PRS’17] worst-case approx- O K -SIVP 3 / 13
Prior Hardness of Ring-LWE and MP-LWE (primal) Z [ α ] -LWE complex & non-uniform; [RSW’18] expands error by ≥ � V α � , � V − 1 α � (primal) O K -LWE complex & non-uniform; [LPR’10,DD’12,RSW’18] expands error (dual) O K -LWE [LPR’10,PRS’17] worst-case approx- O K -SIVP 3 / 13
Prior Hardness of Ring-LWE and MP-LWE MP-LWE n,d for any α s.t. d ≤ deg( α ) ≤ n , [RSSS’17] expands error by ≥ d · EF ( α ) (primal) Z [ α ] -LWE complex & non-uniform; [RSW’18] expands error by ≥ � V α � , � V − 1 α � (primal) O K -LWE complex & non-uniform; [LPR’10,DD’12,RSW’18] expands error (dual) O K -LWE [LPR’10,PRS’17] worst-case approx- O K -SIVP 3 / 13
Our Contributions Definitions 1 A unified L -LWE problem class covering all proposed algebraic LWEs (over number-field rings) 4 / 13
Our Contributions Definitions 1 A unified L -LWE problem class covering all proposed algebraic LWEs (over number-field rings) 2 A unified Generalized-LWE problem class covering all proposed LWEs (over commutative rings) 4 / 13
Our Contributions Definitions 1 A unified L -LWE problem class covering all proposed algebraic LWEs (over number-field rings) 2 A unified Generalized-LWE problem class covering all proposed LWEs (over commutative rings) Reductions ◮ Simpler, tighter reductions among algebraic and general LWEs 4 / 13
Our Contributions Definitions 1 A unified L -LWE problem class covering all proposed algebraic LWEs (over number-field rings) 2 A unified Generalized-LWE problem class covering all proposed LWEs (over commutative rings) Reductions ◮ Simpler, tighter reductions among algebraic and general LWEs ⋆ All have easy-to-analyze effects on the error distribution ⋆ Some are even error preserving 4 / 13
Our Contributions Definitions 1 A unified L -LWE problem class covering all proposed algebraic LWEs (over number-field rings) 2 A unified Generalized-LWE problem class covering all proposed LWEs (over commutative rings) Reductions ◮ Simpler, tighter reductions among algebraic and general LWEs ⋆ All have easy-to-analyze effects on the error distribution ⋆ Some are even error preserving ◮ Error-preserving L -LWE ≤ L ′ -LWE under mild conditions on L ′ ⊆ L . 4 / 13
Our Contributions Definitions 1 A unified L -LWE problem class covering all proposed algebraic LWEs (over number-field rings) 2 A unified Generalized-LWE problem class covering all proposed LWEs (over commutative rings) Reductions ◮ Simpler, tighter reductions among algebraic and general LWEs ⋆ All have easy-to-analyze effects on the error distribution ⋆ Some are even error preserving ◮ Error-preserving L -LWE ≤ L ′ -LWE under mild conditions on L ′ ⊆ L . ◮ For any order L = Z [ α ] with d ≤ deg( α ) ≤ n , Z [ α ] -LWE ≤ MP-LWE n,d with error expansion � V α � . 4 / 13
New Hardness of MP-LWE MP-LWE n,d d ≤ deg( α ) ≤ n , expands by ≥ d · EF ( α ) (primal) Z [ α ] -LWE complex & non-uniform; expands by ≥ � V α � , � V − 1 α � (primal) O K -LWE complex & non-uniform; expands error (dual) O K -LWE worst-case approx- O K -SIVP 5 / 13
New Hardness of MP-LWE MP-LWE n,d d ≤ deg( α ) ≤ n , expands by ≥ d · EF ( α ) (dual) Z [ α ] -LWE (primal) Z [ α ] -LWE complex & non-uniform; expands by ≥ � V α � , � V − 1 α � ( L to L ′ ) (primal) O K -LWE simple & uniform, preserves error complex & non-uniform; expands error (dual) O K -LWE worst-case approx- O K -SIVP 5 / 13
New Hardness of MP-LWE simple & uniform, MP-LWE n,d expands by � V α � , d ≤ deg( α ) ≤ n d ≤ deg( α ) ≤ n , expands by ≥ d · EF ( α ) (dual) Z [ α ] -LWE (primal) Z [ α ] -LWE complex & non-uniform; expands by ≥ � V α � , � V − 1 α � ( L to L ′ ) (primal) O K -LWE simple & uniform, preserves error complex & non-uniform; expands error (dual) O K -LWE worst-case approx- O K -SIVP 5 / 13
Ring-LWE and Variants Ring-LWE ◮ Let K = Q ( α ) be a number field and R = O K be its ring of integers. = Z [ x ] / ( x n + 1) for n = 2 k .) (E.g., R ∼ 6 / 13
Ring-LWE and Variants Ring-LWE ◮ Let K = Q ( α ) be a number field and R = O K be its ring of integers. = Z [ x ] / ( x n + 1) for n = 2 k .) (E.g., R ∼ ◮ R -LWE q for secret s ∈ R ∨ q concerns ‘noisy random products’ � a ← R q , b ≈ s · a ∈ R ∨ � . q 6 / 13
Ring-LWE and Variants Ring-LWE ◮ Let K = Q ( α ) be a number field and R = O K be its ring of integers. = Z [ x ] / ( x n + 1) for n = 2 k .) (E.g., R ∼ ◮ R -LWE q for secret s ∈ R ∨ q concerns ‘noisy random products’ � a ← R q , b ≈ s · a ∈ R ∨ � . q Order-LWE ◮ Same, but R = O is some arbitrary order of K (not necessarily O K ). 6 / 13
Ring-LWE and Variants Ring-LWE ◮ Let K = Q ( α ) be a number field and R = O K be its ring of integers. = Z [ x ] / ( x n + 1) for n = 2 k .) (E.g., R ∼ ◮ R -LWE q for secret s ∈ R ∨ q concerns ‘noisy random products’ � a ← R q , b ≈ s · a ∈ R ∨ � . q Order-LWE ◮ Same, but R = O is some arbitrary order of K (not necessarily O K ). Poly-LWE ◮ Same, but R = Z [ α ] ∼ = Z [ x ] /f ( x ) and s, a, s · a ∈ R q (no dual R ∨ q ). 6 / 13
New Unified Problem: L -LWE ◮ Let K = Q ( α ) be a number field and L ⊂ K any (full-rank) lattice. 7 / 13
New Unified Problem: L -LWE ◮ Let K = Q ( α ) be a number field and L ⊂ K any (full-rank) lattice. ◮ The coefficient ring of L , which is an order of K , is O L := { x ∈ K : x L ⊆ L} = ( L · L ∨ ) ∨ . 7 / 13
New Unified Problem: L -LWE ◮ Let K = Q ( α ) be a number field and L ⊂ K any (full-rank) lattice. ◮ The coefficient ring of L , which is an order of K , is O L := { x ∈ K : x L ⊆ L} = ( L · L ∨ ) ∨ . Note: if L is an order O or its dual O ∨ , then O L = O . 7 / 13
New Unified Problem: L -LWE ◮ Let K = Q ( α ) be a number field and L ⊂ K any (full-rank) lattice. ◮ The coefficient ring of L , which is an order of K , is O L := { x ∈ K : x L ⊆ L} = ( L · L ∨ ) ∨ . Note: if L is an order O or its dual O ∨ , then O L = O . The L -LWE Problem 7 / 13
New Unified Problem: L -LWE ◮ Let K = Q ( α ) be a number field and L ⊂ K any (full-rank) lattice. ◮ The coefficient ring of L , which is an order of K , is O L := { x ∈ K : x L ⊆ L} = ( L · L ∨ ) ∨ . Note: if L is an order O or its dual O ∨ , then O L = O . The L -LWE Problem ◮ L -LWE q for secret s ∈ L ∨ q concerns noisy products a ← O L q , b ≈ s · a ∈ L ∨ � � . q 7 / 13
Recommend
More recommend
