Lattice-based cryptography (I) Thijs Laarhoven ts - PowerPoint PPT Presentation

Lattice-based cryptography (I) Thijs Laarhoven ♠❛✐❧❅t❤✐❥s✳❝♦♠ ❤tt♣✿✴✴✇✇✇✳t❤✐❥s✳❝♦♠✴ PQCrypto Summer School 2017 (June 20, 2017)

Part 1: Lattices, cryptography, and lattice basis reduction Thijs Laarhoven ♠❛✐❧❅t❤✐❥s✳❝♦♠ ❤tt♣✿✴✴✇✇✇✳t❤✐❥s✳❝♦♠✴ PQCrypto Summer School 2017 (June 20, 2017)

Lattices What is a lattice? O

Lattices What is a lattice? b 2 b 1 O

Lattices What is a lattice? b 2 b 1 O

Lattices Shortest Vector Problem (SVP) b 2 b 1 s O

Lattices Shortest Vector Problem (SVP) b 2 b 1 s O - s

Lattices Closest Vector Problem (CVP) t b 2 b 1 O

Lattices Closest Vector Problem (CVP) t b 2 v b 1 O

Lattices Lattice basis reduction b 2 b 1 r 2 r 1 O

Outline Motivation: GGH encryption Lattice basis reduction Gauss reduction LLL reduction BKZ reduction

Outline Motivation: GGH encryption Lattice basis reduction Gauss reduction LLL reduction BKZ reduction

GGH cryptosystem Overview � � r 1 Private key: R = r 2 � � b 1 Public key: B = b 2 Encrypt m : v = m B c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Private key � � r 1 Private key: R = r 2 � � b 1 Public key: B = b 2 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Private key � � r 1 Private key: R = r 2 � � b 1 Public key: B = r 2 b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Public key � � r 1 Private key: R = r 2 � � b 1 Public key: B = r 2 b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Public key � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Encryption � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Encryption � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 b 2 r 1 Encrypt m : v v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Encryption � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with good basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with good basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with good basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with good basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v' v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with bad basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with bad basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with bad basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Decryption with bad basis � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v = m B O v' c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

GGH cryptosystem Overview � � r 1 b 2 Private key: R = r 2 b 1 � � b 1 Public key: B = r 2 c b 2 r 1 Encrypt m : v v = m B O c = v + e Decrypt c : v ′ = ⌊ c R − 1 ⌉ R m ′ = v ′ B − 1

Outline Motivation: GGH encryption Lattice basis reduction Gauss reduction LLL reduction BKZ reduction

Gauss reduction b 2 b 1 O

Gauss reduction b 2 b 1 O

Gauss reduction b 1 b 2 O

Gauss reduction b 1 b 2 O

Gauss reduction b 1 b 2 O

Gauss reduction b 1 b 2 O

Gauss reduction b 1 b 2 O

Gauss reduction Given B = { b 1 , b 2 } , repeat two steps: • Swap : If � b 1 � > � b 2 � , then swap b 1 and b 2 . • Reduce : While � b 2 ± b 1 � < � b 2 � , replace b 2 ← b 2 ± b 1 .

Gauss reduction Given B = { b 1 , b 2 } , repeat two steps: • Swap : If � b 1 � > � b 2 � , then swap b 1 and b 2 . • Reduce : While � b 2 ± b 1 � < � b 2 � , replace b 2 ← b 2 ± b 1 . At the end, b 1 is a shortest (non-zero) lattice vector and b 2 a “second shortest” (non-zero) lattice vector.

Gauss reduction

Gauss reduction

LLL algorithm Lenstra-Lenstra-Lovasz (LLL) algorithm [ LLL82 ] • Blockwise generalization of Gauss reduction • Do reductions / swaps on ( b i , b i + 1 ) for i = 1,..., n − 1

LLL algorithm

LLL algorithm

LLL algorithm

BKZ algorithm Lenstra-Lenstra-Lovasz (LLL) algorithm [ LLL82 ] • Blockwise generalization of Gauss reduction • Do reductions / swaps on ( b i , b i + 1 ) for i = 1,..., n − 1

BKZ algorithm Lenstra-Lenstra-Lovasz (LLL) algorithm [ LLL82 ] • Blockwise generalization of Gauss reduction • Do reductions / swaps on ( b i , b i + 1 ) for i = 1,..., n − 1 • Basis quality deteriorates with the dimension n ◮ Theoretically: � b 1 � ≤ 1.075 n · det ( � ) ◮ Experimentally: � b 1 � ≈ 1.022 n · det ( � )

BKZ algorithm Lenstra-Lenstra-Lovasz (LLL) algorithm [ LLL82 ] • Blockwise generalization of Gauss reduction • Do reductions / swaps on ( b i , b i + 1 ) for i = 1,..., n − 1 • Basis quality deteriorates with the dimension n ◮ Theoretically: � b 1 � ≤ 1.075 n · det ( � ) ◮ Experimentally: � b 1 � ≈ 1.022 n · det ( � ) Blockwise Korkine-Zolotarev (BKZ) reduction [ Sch87, SE94 ] • Blockwise generalization of Korkine-Zolotarev reduction • Do reductions / swaps on ( b i ,..., b i + k − 1 ) for i = 1,..., n − k + 1 • Blocksize k offers time-quality tradeoff

LLL algorithm

BKZ algorithm

BKZ algorithm Lenstra-Lenstra-Lovasz (LLL) algorithm [ LLL82 ] • Blockwise generalization of Gauss reduction • Do reductions / swaps on ( b i , b i + 1 ) for i = 1,..., n − 1 • Basis quality deteriorates with the dimension n ◮ Theoretically: � b 1 � ≤ 1.075 n · det ( � ) ◮ Experimentally: � b 1 � ≈ 1.022 n · det ( � ) Blockwise Korkine-Zolotarev (BKZ) reduction [ Sch87, SE94 ] • Blockwise generalization of Korkine-Zolotarev reduction • Do reductions / swaps on ( b i ,..., b i + k − 1 ) for i = 1,..., n − k + 1 • Blocksize k offers time-quality tradeoff

BKZ algorithm Lenstra-Lenstra-Lovasz (LLL) algorithm [ LLL82 ] • Blockwise generalization of Gauss reduction • Do reductions / swaps on ( b i , b i + 1 ) for i = 1,..., n − 1 • Basis quality deteriorates with the dimension n ◮ Theoretically: � b 1 � ≤ 1.075 n · det ( � ) ◮ Experimentally: � b 1 � ≈ 1.022 n · det ( � ) Blockwise Korkine-Zolotarev (BKZ) reduction [ Sch87, SE94 ] • Blockwise generalization of Korkine-Zolotarev reduction • Do reductions / swaps on ( b i ,..., b i + k − 1 ) for i = 1,..., n − k + 1 • Blocksize k offers time-quality tradeoff BKZ uses exact SVP algorithm in dimension k as subroutine

BKZ algorithm Lenstra-Lenstra-Lovasz (LLL) algorithm [ LLL82 ] • Blockwise generalization of Gauss reduction • Do reductions / swaps on ( b i , b i + 1 ) for i = 1,..., n − 1 • Basis quality deteriorates with the dimension n ◮ Theoretically: � b 1 � ≤ 1.075 n · det ( � ) ◮ Experimentally: � b 1 � ≈ 1.022 n · det ( � ) Blockwise Korkine-Zolotarev (BKZ) reduction [ Sch87, SE94 ] • Blockwise generalization of Korkine-Zolotarev reduction • Do reductions / swaps on ( b i ,..., b i + k − 1 ) for i = 1,..., n − k + 1 • Blocksize k offers time-quality tradeoff BKZ uses exact SVP algorithm in dimension k as subroutine Next hour: How to solve exact SVP in high dimensions?