Lattice-Based Cryptography: Short Integer Solution (SIS) and - PowerPoint PPT Presentation

Lattice-Based Cryptography: Short Integer Solution (SIS) and Learning With Errors (LWE) Chris Peikert Georgia Institute of Technology crypt@b-it 2013 1 / 17

Recall: Lattices ◮ Full-rank additive subgroup in Z m . O 2 / 17

Recall: Lattices ◮ Full-rank additive subgroup in Z m . ◮ Basis B = ( b 1 , . . . , b m ) : m � L ( B ) = B · Z m = b 2 ( Z · b i ) i =1 b 1 O 2 / 17

Recall: Lattices ◮ Full-rank additive subgroup in Z m . ◮ Basis B = ( b 1 , . . . , b m ) : m � L ( B ) = B · Z m = b 1 ( Z · b i ) i =1 b 2 O 2 / 17

Recall: Lattices ◮ Full-rank additive subgroup in Z m . ◮ Basis B = ( b 1 , . . . , b m ) : m � L ( B ) = B · Z m = b 1 ( Z · b i ) i =1 b 2 O (Other representations too . . . ) 2 / 17

Recall: Lattices ◮ Full-rank additive subgroup in Z m . ◮ Basis B = ( b 1 , . . . , b m ) : m � L ( B ) = B · Z m = b 1 ( Z · b i ) i =1 b 2 O (Other representations too . . . ) Hard Problems ◮ Find/detect short nonzero lattice vector(s): SVP, GapSVP, SIVP ◮ Decode under small amount of error: BDD 2 / 17

A Hard Problem: Short Integer Solution ◮ Z n (e.g., q ≈ n 3 ) q = n -dimensional vectors modulo q 3 / 17

A Hard Problem: Short Integer Solution ◮ Z n (e.g., q ≈ n 3 ) q = n -dimensional vectors modulo q       | | | ∈ Z n · · · a 1 a 2 a m       q | | | 3 / 17

A Hard Problem: Short Integer Solution ◮ Z n (e.g., q ≈ n 3 ) q = n -dimensional vectors modulo q ◮ Goal: find nontrivial small z 1 , . . . , z m ∈ Z such that:         | | | |  + z 2 ·  + · · · + z m ·  =  ∈ Z n z 1 · 0 a 1 a 2 a m     q | | | | 3 / 17

A Hard Problem: Short Integer Solution ◮ Z n (e.g., q ≈ n 3 ) q = n -dimensional vectors modulo q ◮ Goal: find nontrivial short z ∈ Z m such that:          = 0 ∈ Z n  · · · · · · · · A  z    q � �� � m 3 / 17

A Hard Problem: Short Integer Solution ◮ Z n (e.g., q ≈ n 3 ) q = n -dimensional vectors modulo q ◮ Goal: find nontrivial short z ∈ Z m such that:         = 0 ∈ Z n   · · · · · · · · A  z    q � �� � m One-Way & Collision-Resistant Hash Function ◮ Set m > n lg q . Define f A : { 0 , 1 } m → Z n q as f A ( x ) = Ax . 3 / 17

A Hard Problem: Short Integer Solution ◮ Z n (e.g., q ≈ n 3 ) q = n -dimensional vectors modulo q ◮ Goal: find nontrivial short z ∈ Z m such that:         = 0 ∈ Z n   · · · · · · · · A  z    q � �� � m One-Way & Collision-Resistant Hash Function ◮ Set m > n lg q . Define f A : { 0 , 1 } m → Z n q as f A ( x ) = Ax . ◮ Collision x , x ′ ∈ { 0 , 1 } m where Ax = Ax ′ . . . 3 / 17

A Hard Problem: Short Integer Solution ◮ Z n (e.g., q ≈ n 3 ) q = n -dimensional vectors modulo q ◮ Goal: find nontrivial short z ∈ Z m such that:         = 0 ∈ Z n   · · · · · · · · A  z    q � �� � m One-Way & Collision-Resistant Hash Function ◮ Set m > n lg q . Define f A : { 0 , 1 } m → Z n q as f A ( x ) = Ax . ◮ Collision x , x ′ ∈ { 0 , 1 } m where Ax = Ax ′ . . . . . . yields solution z = x − x ′ ∈ { 0 , ± 1 } m , of norm � z � ≤ √ m . 3 / 17

Cool! (but what does this have to do with lattices?) 4 / 17

Cool! (but what does this have to do with lattices?) ◮ Parity-check matrix A = ( a 1 , . . . , a m ) ∈ Z n × m q defines the ‘ q -ary’ integer lattice L ⊥ ( A ) = { z ∈ Z m : Az = 0 } . O 4 / 17

Cool! (but what does this have to do with lattices?) ◮ Parity-check matrix (0 , q ) A = ( a 1 , . . . , a m ) ∈ Z n × m q defines the ‘ q -ary’ integer lattice L ⊥ ( A ) = { z ∈ Z m : Az = 0 } . ( q, 0) O 4 / 17

Cool! (but what does this have to do with lattices?) ◮ Parity-check matrix (0 , q ) A = ( a 1 , . . . , a m ) ∈ Z n × m q defines the ‘ q -ary’ integer lattice L ⊥ ( A ) = { z ∈ Z m : Az = 0 } . ◮ SIS is SVP on random lattices L ⊥ ( A ) ! ( q, 0) O 4 / 17

Cool! (but what does this have to do with lattices?) ◮ Parity-check matrix (0 , q ) A = ( a 1 , . . . , a m ) ∈ Z n × m q defines the ‘ q -ary’ integer lattice L ⊥ ( A ) = { z ∈ Z m : Az = 0 } . ◮ SIS is SVP on random lattices L ⊥ ( A ) ! x ( q, 0) ◮ Syndrome u ∈ Z n q defines coset O L ⊥ u ( A ) = { x : Ax = u } , x �→ Ax reduces x modulo L ⊥ ( A ) . 4 / 17

Cool! (but what does this have to do with lattices?) ◮ Parity-check matrix (0 , q ) A = ( a 1 , . . . , a m ) ∈ Z n × m q defines the ‘ q -ary’ integer lattice L ⊥ ( A ) = { z ∈ Z m : Az = 0 } . ◮ SIS is SVP on random lattices L ⊥ ( A ) ! ( q, 0) ◮ Syndrome u ∈ Z n q defines coset O L ⊥ u ( A ) = { x : Ax = u } , x �→ Ax reduces x modulo L ⊥ ( A ) . Worst-Case/Average-Case Connection [Ajtai’96,. . . ] Finding short ( � z � ≤ β ≪ q ) nonzero z ∈ L ⊥ ( A ) for uniformly random A ∈ Z n × m q ⇓ solving GapSVP β √ n and SIVP β √ n on any n -dim lattice. 4 / 17

A “Key” Trick ◮ Generate uniform A with a short solution x (s.t. Ax = 0 ): 5 / 17

A “Key” Trick ◮ Generate uniform A with a short solution x (s.t. Ax = 0 ): m for (say) ¯ 1 Choose ¯ x ← { 0 , 1 } ¯ A ← Z n × ¯ and ¯ m ≥ 2 n lg q . m q 5 / 17

A “Key” Trick ◮ Generate uniform A with a short solution x (s.t. Ax = 0 ): m for (say) ¯ 1 Choose ¯ x ← { 0 , 1 } ¯ A ← Z n × ¯ and ¯ m ≥ 2 n lg q . m q 2 Let A = [ ¯ A | − ¯ x modulo L ⊥ ( ¯ A ¯ x ] and x = [ ¯ 1 ] . (We just reduced − ¯ x A ) .) 5 / 17

A “Key” Trick ◮ Generate uniform A with a short solution x (s.t. Ax = 0 ): m for (say) ¯ 1 Choose ¯ x ← { 0 , 1 } ¯ A ← Z n × ¯ and ¯ m ≥ 2 n lg q . m q 2 Let A = [ ¯ A | − ¯ x modulo L ⊥ ( ¯ A ¯ x ] and x = [ ¯ 1 ] . (We just reduced − ¯ x A ) .) � ¯ � ◮ For many short solutions, let A = [ ¯ A | − ¯ A ¯ X X ] and X = . I 5 / 17

A “Key” Trick ◮ Generate uniform A with a short solution x (s.t. Ax = 0 ): m for (say) ¯ 1 Choose ¯ x ← { 0 , 1 } ¯ A ← Z n × ¯ and ¯ m ≥ 2 n lg q . m q 2 Let A = [ ¯ A | − ¯ x modulo L ⊥ ( ¯ A ¯ x ] and x = [ ¯ 1 ] . (We just reduced − ¯ x A ) .) � ¯ � ◮ For many short solutions, let A = [ ¯ A | − ¯ A ¯ X X ] and X = . I ◮ Nothing special about { 0 , 1 } ¯ m : enough entropy suffices (essentially). 5 / 17

A “Key” Trick ◮ Generate uniform A with a short solution x (s.t. Ax = 0 ): m for (say) ¯ 1 Choose ¯ x ← { 0 , 1 } ¯ A ← Z n × ¯ and ¯ m ≥ 2 n lg q . m q 2 Let A = [ ¯ A | − ¯ x modulo L ⊥ ( ¯ A ¯ x ] and x = [ ¯ 1 ] . (We just reduced − ¯ x A ) .) � ¯ � ◮ For many short solutions, let A = [ ¯ A | − ¯ A ¯ X X ] and X = . I ◮ Nothing special about { 0 , 1 } ¯ m : enough entropy suffices (essentially). ‘Leftover Hash’ Lemma s ◮ Over choice of ¯ x , matrix A = [ ¯ A | − ¯ A and ¯ A ¯ x ] ≈ uniform. m → Z n � � A : { 0 , 1 } ¯ ◮ Proof: family f ¯ is pairwise independent; q ¯ x has sufficient (min-)entropy. 5 / 17

A “Key” Trick ◮ Generate uniform A with a short solution x (s.t. Ax = 0 ): m for (say) ¯ 1 Choose ¯ x ← { 0 , 1 } ¯ A ← Z n × ¯ and ¯ m ≥ 2 n lg q . m q 2 Let A = [ ¯ A | − ¯ x modulo L ⊥ ( ¯ A ¯ x ] and x = [ ¯ 1 ] . (We just reduced − ¯ x A ) .) � ¯ � ◮ For many short solutions, let A = [ ¯ A | − ¯ A ¯ X X ] and X = . I ◮ Nothing special about { 0 , 1 } ¯ m : enough entropy suffices (essentially). ‘Leftover Hash’ Lemma s ◮ Over choice of ¯ x , matrix A = [ ¯ A | − ¯ A and ¯ A ¯ x ] ≈ uniform. m → Z n � � A : { 0 , 1 } ¯ ◮ Proof: family f ¯ is pairwise independent; q ¯ x has sufficient (min-)entropy. Dirty Little Secret ◮ This trick — reducing a short vector modulo a lattice — is the only one-way function used in all of lattice crypto! 5 / 17

Another Hard Problem: Learning With Errors [Regev’05] ◮ As before, dimension n and modulus q ≥ 2 6 / 17

Another Hard Problem: Learning With Errors [Regev’05] ◮ As before, dimension n and modulus q ≥ 2 ◮ Search: find s ∈ Z n q given ‘noisy random inner products’ a 1 ← Z n q , b 1 = � s , a 1 � + e 1 a 2 ← Z n q , b 2 = � s , a 2 � + e 2 . . . 6 / 17

Another Hard Problem: Learning With Errors [Regev’05] ◮ As before, dimension n and modulus q ≥ 2 , error rate α ≪ 1 ◮ Search: find s ∈ Z n q given ‘noisy random inner products’ a 1 ← Z n q , b 1 = � s , a 1 � + e 1 a 2 ← Z n q , b 2 = � s , a 2 � + e 2 . . . Errors e i ← χ = Gaussian over Z , width αq . αq > √ n 6 / 17

Another Hard Problem: Learning With Errors [Regev’05] ◮ As before, dimension n and modulus q ≥ 2 , error rate α ≪ 1 ◮ Search: find s ∈ Z n q given ‘noisy random inner products’   | |  , b t = s t A + e t A = · · · a 1 a m  | | Errors e i ← χ = Gaussian over Z , width αq . αq > √ n 6 / 17