Lattice-based cryptography: reduced to a special closest vector - PowerPoint PPT Presentation

1 2 Lattice-based cryptography: reduced to a special closest vector Episode V: problem which is much easier the ring strikes back than the general problem. As an application, we solved four out Daniel J. Bernstein of the five numerical challenges University of Illinois at Chicago proposed on the Internet by the authors of the cryptosystem. Crypto 1999 Nguyen: “At Crypto At least two of those four ’97, Goldreich, Goldwasser and challenges were conjectured to Halevi proposed a public-key be intractable. We discuss ways cryptosystem based on the closest to prevent the flaw, but conclude vector problem in a lattice, which that, even modified, the scheme is known to be NP-hard. We cannot provide sufficient security show that : : : the problem of without being impractical.” decrypting ciphertexts can be

1 2 Lattice-based cryptography: reduced to a special closest vector Fix would de V: problem which is much easier dimension ring strikes back than the general problem. As an “Public k application, we solved four out J. Bernstein Crypto 1998 of the five numerical challenges University of Illinois at Chicago “Provably proposed on the Internet by the system b authors of the cryptosystem. 1999 Nguyen: “At Crypto At least two of those four Goldreich, Goldwasser and challenges were conjectured to proposed a public-key be intractable. We discuss ways cryptosystem based on the closest to prevent the flaw, but conclude problem in a lattice, which that, even modified, the scheme wn to be NP-hard. We cannot provide sufficient security that : : : the problem of without being impractical.” decrypting ciphertexts can be

1 2 cryptography: reduced to a special closest vector Fix would “probably problem which is much easier dimension ≥ 400” back than the general problem. As an “Public key ≈ 1.8 application, we solved four out Bernstein Crypto 1998 Nguy of the five numerical challenges Illinois at Chicago “Provably secure” proposed on the Internet by the system breakable with authors of the cryptosystem. Nguyen: “At Crypto At least two of those four Goldwasser and challenges were conjectured to a public-key be intractable. We discuss ways sed on the closest to prevent the flaw, but conclude in a lattice, which that, even modified, the scheme NP-hard. We cannot provide sufficient security the problem of without being impractical.” ciphertexts can be

1 2 cryptography: reduced to a special closest vector Fix would “probably need problem which is much easier dimension ≥ 400” for securit than the general problem. As an “Public key ≈ 1.8 Mbytes”. application, we solved four out Crypto 1998 Nguyen–Stern: of the five numerical challenges Chicago “Provably secure” Ajtai–Dwo proposed on the Internet by the system breakable with 20MB authors of the cryptosystem. Crypto At least two of those four and challenges were conjectured to ey be intractable. We discuss ways closest to prevent the flaw, but conclude lattice, which that, even modified, the scheme We cannot provide sufficient security of without being impractical.” be

2 3 reduced to a special closest vector Fix would “probably need problem which is much easier dimension ≥ 400” for security: than the general problem. As an “Public key ≈ 1.8 Mbytes”. application, we solved four out Crypto 1998 Nguyen–Stern: of the five numerical challenges “Provably secure” Ajtai–Dwork proposed on the Internet by the system breakable with 20MB keys. authors of the cryptosystem. At least two of those four challenges were conjectured to be intractable. We discuss ways to prevent the flaw, but conclude that, even modified, the scheme cannot provide sufficient security without being impractical.”

2 3 reduced to a special closest vector Fix would “probably need problem which is much easier dimension ≥ 400” for security: than the general problem. As an “Public key ≈ 1.8 Mbytes”. application, we solved four out Crypto 1998 Nguyen–Stern: of the five numerical challenges “Provably secure” Ajtai–Dwork proposed on the Internet by the system breakable with 20MB keys. authors of the cryptosystem. Compare to 1978 McEliece At least two of those four code-based cryptosystem: challenges were conjectured to much more stable security story be intractable. We discuss ways through dozens of attack papers. to prevent the flaw, but conclude Typical parameters: 1MB key for that, even modified, the scheme > 2 128 post-quantum security. cannot provide sufficient security without being impractical.”

2 3 reduced to a special closest vector Fix would “probably need 2017.05: roblem which is much easier dimension ≥ 400” for security: following the general problem. As an “Public key ≈ 1.8 Mbytes”. “Lattice-based application, we solved four out “Lattice-based Crypto 1998 Nguyen–Stern: five numerical challenges currently “Provably secure” Ajtai–Dwork osed on the Internet by the for post-quantum system breakable with 20MB keys. rs of the cryptosystem. Compare to 1978 McEliece least two of those four code-based cryptosystem: challenges were conjectured to much more stable security story intractable. We discuss ways through dozens of attack papers. revent the flaw, but conclude Typical parameters: 1MB key for even modified, the scheme > 2 128 post-quantum security. cannot provide sufficient security without being impractical.”

2 3 ecial closest vector Fix would “probably need 2017.05: Lattice student is much easier dimension ≥ 400” for security: following text to Wikip general problem. As an “Public key ≈ 1.8 Mbytes”. “Lattice-based cryptography”: solved four out “Lattice-based constructions Crypto 1998 Nguyen–Stern: numerical challenges currently the prima “Provably secure” Ajtai–Dwork Internet by the for post-quantum cryptogra system breakable with 20MB keys. cryptosystem. Compare to 1978 McEliece those four code-based cryptosystem: conjectured to much more stable security story e discuss ways through dozens of attack papers. flaw, but conclude Typical parameters: 1MB key for dified, the scheme > 2 128 post-quantum security. sufficient security impractical.”

2 3 closest vector Fix would “probably need 2017.05: Lattice student adds easier dimension ≥ 400” for security: following text to Wikipedia page As an “Public key ≈ 1.8 Mbytes”. “Lattice-based cryptography”: four out “Lattice-based constructions Crypto 1998 Nguyen–Stern: challenges currently the primary candidates “Provably secure” Ajtai–Dwork y the for post-quantum cryptography system breakable with 20MB keys. cryptosystem. Compare to 1978 McEliece code-based cryptosystem: conjectured to much more stable security story ways through dozens of attack papers. conclude Typical parameters: 1MB key for scheme > 2 128 post-quantum security. security ractical.”

3 4 Fix would “probably need 2017.05: Lattice student adds the dimension ≥ 400” for security: following text to Wikipedia page “Public key ≈ 1.8 Mbytes”. “Lattice-based cryptography”: “Lattice-based constructions are Crypto 1998 Nguyen–Stern: currently the primary candidates “Provably secure” Ajtai–Dwork for post-quantum cryptography.” system breakable with 20MB keys. Compare to 1978 McEliece code-based cryptosystem: much more stable security story through dozens of attack papers. Typical parameters: 1MB key for > 2 128 post-quantum security.

3 4 Fix would “probably need 2017.05: Lattice student adds the dimension ≥ 400” for security: following text to Wikipedia page “Public key ≈ 1.8 Mbytes”. “Lattice-based cryptography”: “Lattice-based constructions are Crypto 1998 Nguyen–Stern: currently the primary candidates “Provably secure” Ajtai–Dwork for post-quantum cryptography.” system breakable with 20MB keys. — [citation needed] Compare to 1978 McEliece code-based cryptosystem: much more stable security story through dozens of attack papers. Typical parameters: 1MB key for > 2 128 post-quantum security.

3 4 Fix would “probably need 2017.05: Lattice student adds the dimension ≥ 400” for security: following text to Wikipedia page “Public key ≈ 1.8 Mbytes”. “Lattice-based cryptography”: “Lattice-based constructions are Crypto 1998 Nguyen–Stern: currently the primary candidates “Provably secure” Ajtai–Dwork for post-quantum cryptography.” system breakable with 20MB keys. — [citation needed] Compare to 1978 McEliece code-based cryptosystem: 2016.07: Google rolls out much more stable security story large-scale experiment with through dozens of attack papers. post-quantum crypto between Typical parameters: 1MB key for Chrome and some Google sites. > 2 128 post-quantum security. Uses lattice-based crypto.