All Along the Ring Tower Algebraic Structures for Fun and Profit - PowerPoint PPT Presentation

All Along the Ring Tower Algebraic Structures for Fun and Profit Thomas Prest joint work w/ {Léo Ducas} ∪ {Thomas Pornin} ∪ {Léo Ducas, Steven Galbraith, Yang Yu} RISC × PROMETHEUS Seminar, 03/05/2019

Introduc�on I Three Case Studies II Generalized Bézout Equa�ons i Generalized Four Square Theorem ii iii Efficient La�ce Decoding III Conclusion 2 / 21

Rings in La�ce-Based Cryptography It is typical in la�ce-based cryptography to use matrices with coefficients in Z q [ x ] / ( x d + 1 ) rather than Z q : Communica�on costs typically go O ( d 2 ) ⇒ O ( d ) 1 2 Computa�on costs typically go O ( d 2 ) ⇒ O ( d log d ) But in some situa�ons this addi�onal structure seems ineffec�ve: 1 Matrix decomposi�on (Cholesky, Gram-Schmidt, etc.) Solving equa�ons in a ring which is not a field (e.g. Z [ x ] / ( x d + 1 ) ) 2 Algorithms can take �me up to Θ ( d 2 ) or Θ ( d 3 ) . 3 / 21

The State of Affairs What naïve solu�ons do: View Q [ x ] / ( x d + 1 ) as either a Q -linear space of dimension d , an 1 extension field of Q of degree d , etc. 2 This ignores the rich structure of cyclotomic rings and fields. What happens when we open the black box? 4 / 21

Cyclotomic Fields - Opening the Black Box For d a power-of-two, we note: ➳ Q d = Q [ x ] / ( x d + 1 ) the d -th cyclotomic field ➳ Z d = Z [ x ] / ( x d + 1 ) the d -th cyclotomic ring We have this tower of fields: Q ⊊ Q 2 ⊊ · · · ⊆ Q d / 2 ⊊ Q d As well as this chain of isomorphisms: Q d ∼ = ( Q 2 ) d / 2 ∼ = ( Q d / 2 ) 2 ∼ = . . . ∼ = Q d At a high level: ➳ The field norm and field trace allows to move in the tower of fields ➳ Ring isomorphisms allow us to move in the chain of ring isomorphisms 5 / 21

Traces and Norms in Cyclotomic Fields Defini�on: For a (finite) field extension L / K : ➳ The field trace is: ➳ The field norm is: Tr L / K : L → K N L / K : L → K ∑ ∏ f �→ σ ( f ) f �→ σ ( f ) σ ∈ Gal ( L / K ) σ ∈ Gal ( L / K ) Concretely: if f ( x ) = f e ( x 2 ) + x · f o ( x 2 ) ∈ Q d , then f × ( x ) = f ( − x ) and: ➳ Tr Q d / Q d / 2 ( f ) = f + f × ➳ N Q d / Q d / 2 ( f ) = f · f × = 2 · f e ( x 2 ) = f 2 e ( x 2 ) − x 2 f 2 o ( x 2 ) Composi�on proper�es: ➳ Tr L / K ◦ Tr M / L = Tr M / K ➳ N L / K ◦ N M / L = N M / K Homomorphic proper�es: ➳ Tr L / K ( a + b ) = Tr L / K ( a )+ Tr L / K ( b ) ➳ N L / K ( a · b ) = N L / K ( a ) · N L / K ( b ) 6 / 21

Introduc�on I Three Case Studies II Generalized Bézout Equa�ons i Generalized Four Square Theorem ii iii Efficient La�ce Decoding III Conclusion 7 / 21

g f However, some schemes require a full trapdoor B : G F Hash-then-sign [PFH 17], IBE [DLP14], HIBE [CG17] More generally, anything based on trapdoor sampling [GPV08] x d x d Problem: Given f g x 1 , find F G x 1 such that: f G g F q Problem 1 - Comple�ng NTRU Bases NTRU La�ces: ➳ Prevalent in la�ce-based crypto [ 1 , for h = g × f − 1 mod ( φ , q ) . h ] ➳ Public key is A = ➳ Private key is B such that B × A t = 0 mod ( φ , q ) [ g − f ] Some schemes only require a par�al trapdoor B = : ➳ Fiat-Shamir [ZCHW17], encryp�on [SHRS17], FHE [LTV12, BLLN13] 8 / 21

x d x d Problem: Given f g x 1 , find F G x 1 such that: f G g F q Problem 1 - Comple�ng NTRU Bases NTRU La�ces: ➳ Prevalent in la�ce-based crypto [ 1 , for h = g × f − 1 mod ( φ , q ) . h ] ➳ Public key is A = ➳ Private key is B such that B × A t = 0 mod ( φ , q ) [ g − f ] Some schemes only require a par�al trapdoor B = : ➳ Fiat-Shamir [ZCHW17], encryp�on [SHRS17], FHE [LTV12, BLLN13] [ g ] − f However, some schemes require a full trapdoor B = : G − F ➳ Hash-then-sign [PFH + 17], IBE [DLP14], HIBE [CG17] ➳ More generally, anything based on trapdoor sampling [GPV08] 8 / 21

Problem 1 - Comple�ng NTRU Bases NTRU La�ces: ➳ Prevalent in la�ce-based crypto [ 1 , for h = g × f − 1 mod ( φ , q ) . h ] ➳ Public key is A = ➳ Private key is B such that B × A t = 0 mod ( φ , q ) [ g − f ] Some schemes only require a par�al trapdoor B = : ➳ Fiat-Shamir [ZCHW17], encryp�on [SHRS17], FHE [LTV12, BLLN13] [ g ] − f However, some schemes require a full trapdoor B = : G − F ➳ Hash-then-sign [PFH + 17], IBE [DLP14], HIBE [CG17] ➳ More generally, anything based on trapdoor sampling [GPV08] Problem: Given f , g ∈ Z [ x ] / ( x d + 1 ) , find F , G ∈ Z [ x ] / ( x d + 1 ) such that: f · G − g · F = q 8 / 21

Fun fact If we can solve the problem projected over Z d / 2 , i.e.: N Z d / Z d / 2 ( f ) · G ′ − N Z d / Z d / 2 ( g ) · F ′ = 1 for some F ′ , G ′ , then we have this rela�onship over Z d : f · ( f × G ′ ) − g · ( g × F ′ ) = 1 This leads to a simple algorithm: 1 Project 2 Solve 3 Li� 9 / 21

F G F 1 G 1 N d 2 f N d 2 g d d F 2 G 2 N d 4 f N d 4 g d d . . . . . . . . . N f N g F G d d At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ⊊ Z d / 2 ⊊ Z d / 4 ⊊ . . . ⊊ Z 10 / 21

F G F 1 G 1 F 2 G 2 N d 4 f N d 4 g d d . . . . . . . . . N f N g F G d d At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ↓ ⊊ N Z d / Z d / 2 ( f ) , N Z d / Z d / 2 ( g ) Z d / 2 ∋ ⊊ Z d / 4 ⊊ . . . ⊊ Z 10 / 21

F G F 1 G 1 F 2 G 2 . . . . . . . . . N f N g F G d d At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ↓ ⊊ N Z d / Z d / 2 ( f ) , N Z d / Z d / 2 ( g ) Z d / 2 ∋ ↓ ⊊ N Z d / Z d / 4 ( f ) , N Z d / Z d / 4 ( g ) Z d / 4 ∋ ⊊ . . . ⊊ Z 10 / 21

F G F 1 G 1 F 2 G 2 . . . N f N g F G d d At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ↓ ⊊ N Z d / Z d / 2 ( f ) , N Z d / Z d / 2 ( g ) Z d / 2 ∋ ↓ ⊊ N Z d / Z d / 4 ( f ) , N Z d / Z d / 4 ( g ) Z d / 4 ∋ ↓ ⊊ . . . . . . . . . ⊊ Z 10 / 21

F G F 1 G 1 F 2 G 2 . . . F G At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ↓ ⊊ N Z d / Z d / 2 ( f ) , N Z d / Z d / 2 ( g ) Z d / 2 ∋ ↓ ⊊ N Z d / Z d / 4 ( f ) , N Z d / Z d / 4 ( g ) Z d / 4 ∋ ↓ ⊊ . . . . . . . . . ↓ ⊊ N Z d / Z ( f ) , N Z d / Z ( g ) ∋ Z 10 / 21

F G F 1 G 1 F 2 G 2 . . . At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ↓ ⊊ N Z d / Z d / 2 ( f ) , N Z d / Z d / 2 ( g ) Z d / 2 ∋ ↓ ⊊ N Z d / Z d / 4 ( f ) , N Z d / Z d / 4 ( g ) Z d / 4 ∋ ↓ ⊊ . . . . . . . . . ↓ ⊊ N Z d / Z ( f ) , N Z d / Z ( g ) F [ ℓ ] , G [ ℓ ] ∋ → Z 10 / 21

F G F 1 G 1 F 2 G 2 At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ↓ ⊊ N Z d / Z d / 2 ( f ) , N Z d / Z d / 2 ( g ) Z d / 2 ∋ ↓ ⊊ N Z d / Z d / 4 ( f ) , N Z d / Z d / 4 ( g ) Z d / 4 ∋ ↓ ⊊ . . . . . . . . . . . . ↓ ↑ ⊊ N Z d / Z ( f ) , N Z d / Z ( g ) F [ ℓ ] , G [ ℓ ] ∋ → Z 10 / 21

F G F 1 G 1 At each lower level: The coefficients grow (in bitsize) by a factor 2... ... but the number of coefficients is divided by 2. Space-saving trick: recompute lazily N i f N i g at each step Allows a linear �me-memory trade-off by a factor log n Outline of the Solver f , g Z d ∋ ↓ ⊊ N Z d / Z d / 2 ( f ) , N Z d / Z d / 2 ( g ) Z d / 2 ∋ ↓ ⊊ F [ 2 ] , G [ 2 ] N Z d / Z d / 4 ( f ) , N Z d / Z d / 4 ( g ) Z d / 4 ∋ → ↓ ↑ ⊊ . . . . . . . . . . . . ↓ ↑ ⊊ N Z d / Z ( f ) , N Z d / Z ( g ) F [ ℓ ] , G [ ℓ ] ∋ → Z 10 / 21