Efficient Collision-Resistant Hashing from Worst-Case Assumptions on - PowerPoint PPT Presentation

Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices Chris Peikert 1 Alon Rosen 2 1 MIT CSAIL 2 Harvard DEAS Theory of Cryptography Conference 5 March 2006 Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 1 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto PRG comm . . . sig ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] PRG comm . . . sig owf ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] PRG comm . . . owf sig owf ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] PRG comm . . . owf sig owf owf ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] PRG comm . . . owf owf sig owf owf ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] PRG comm . . . owf owf sig owf owf owf ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] PRG comm . . . owf owf owf sig owf owf owf ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] PRG comm . . . owf owf owf sig owf owf owf owf ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance One-Way Function (family): → x ′ ∈ f − 1 hard a , y = f a ( x ) − a ( y ) ✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently . . . This is inherent (black-box)! [GeTr, GGK, HoKa] ✗ Can’t realize some notions at all! (black-box) PRG comm . . . owf owf owf sig owf owf owf owf ZK Ind Sets owf owf Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance Collision-Resistant Hash (family): → x , x ′ : f a ( x ) = f a ( x ′ ) hard − a ✔ Can construct more applications PRG comm . . . sig ZK Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance Collision-Resistant Hash (family): → x , x ′ : f a ( x ) = f a ( x ′ ) hard − a ✔ Can construct more applications ✔ Applications use hashing efficiently! PRG comm . . . sig collision resist hash ZK coll resist hash Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance Collision-Resistant Hash (family): → x , x ′ : f a ( x ) = f a ( x ′ ) hard − a ✔ Can construct more applications ✔ Applications use hashing efficiently! ?? BUT: is the hash itself efficient? PRG comm . . . sig collision resist hash ZK coll resist hash Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

One-Wayness vs. Collision-Resistance Collision-Resistant Hash (family): → x , x ′ : f a ( x ) = f a ( x ′ ) hard − a ✔ Can construct more applications ✔ Applications use hashing efficiently! ?? BUT: is the hash itself efficient? ☞ MD5, SHA-1 highlight need for sound & efficient hashes PRG comm . . . sig collision resist hash ZK coll resist hash Ind Sets Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

Our Contributions Hash Function ✔ Very efficient: evaluate with just a few FFTs ✔ Collision-resistant: worst-case assumption on cyclic lattices ✔ Tighter & simpler security reduction than related works Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 3 / 12

Our Contributions Hash Function ✔ Very efficient: evaluate with just a few FFTs ✔ Collision-resistant: worst-case assumption on cyclic lattices ✔ Tighter & simpler security reduction than related works Understanding ✔ New algebraic interpretation of cyclic lattices ✔ New and tight connections among problems on cyclic lattices Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 3 / 12

Our Contributions Hash Function ✔ Very efficient: evaluate with just a few FFTs ✔ Collision-resistant: worst-case assumption on cyclic lattices ✔ Tighter & simpler security reduction than related works Understanding ✔ New algebraic interpretation of cyclic lattices ✔ New and tight connections among problems on cyclic lattices Our function is a certain kind of knapsack. . . ☞ Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 3 / 12

Generalized Knapsack Function [Mic02] Let R be a ring with + and × , and let S ⊆ R . For: • A = ( a 1 , . . . , a m ) ∈ R m — m “weights”: key • X = ( x 1 , . . . , x m ) ∈ S m — m “coeffs”: input m � f A ( X ) = a i × x i i = 1 Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 4 / 12

Generalized Knapsack Function [Mic02] Let R be a ring with + and × , and let S ⊆ R . For: • A = ( a 1 , . . . , a m ) ∈ R m — m “weights”: key • X = ( x 1 , . . . , x m ) ∈ S m — m “coeffs”: input m � f A ( X ) = a i × x i i = 1 Efficiency determined by m (“width”); runtime of × , + . ☞ Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 4 / 12

Generalized Knapsack Function [Mic02] Let R be a ring with + and × , and let S ⊆ R . For: • A = ( a 1 , . . . , a m ) ∈ R m — m “weights”: key • X = ( x 1 , . . . , x m ) ∈ S m — m “coeffs”: input m � f A ( X ) = a i × x i i = 1 Efficiency determined by m (“width”); runtime of × , + . ☞ Lineage of Cryptographic Knapsacks Knapsack Function Security Notion Efficient? [Ajt96, GGH97] collision-resistant ✗ [Mic02] one-way ✔ Today collision-resistant ✔✔ Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 4 / 12

Micciancio’s Function • R = ( Z n p , + , ⊗ ) , where ⊗ is cyclic convolution:     · · · a 0 a n − 1 a 1 x 0     | | · · ·  a 1 a 0 a 2   x 1   ⊗  =      · a x . . . .   ...  . . .   .  . . . .    | | a n − 1 a n − 2 · · · a 0 x n − 1 Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

Micciancio’s Function • R = ( Z n p , + , ⊗ ) , where ⊗ is cyclic convolution:     · · · a 0 a n − 1 a 1 x 0     | | · · ·  a 1 a 0 a 2   x 1   ⊗  =      · a x . . . .   ...  . . .   .  . . . .    | | a n − 1 a n − 2 · · · a 0 x n − 1 • S = { x ∈ R : � x � ∞ is small } . (Note: | S | is exponential in n .) Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12