Lattice Cryptography: Introduction and Open Problems Daniele - PowerPoint PPT Presentation

Lattice Cryptography: Introduction and Open Problems Daniele Micciancio Department of Computer Science and Engineering University of California, San Diego August 2015 Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 1 / 32

Point Lattices The simplest example of lattice is Z n = { ( x 1 , . . . , x n ): x i ∈ Z } Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 2 / 32

Point Lattices The simplest example of lattice is Z n = { ( x 1 , . . . , x n ): x i ∈ Z } Other lattices are obtained by applying a linear transformation B : x = ( x 1 , . . . , x n ) �→ Bx = x 1 · b 1 + · · · + x n · b n (0 , 1) b 2 B b 1 (1 , 0) Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 2 / 32

Lattice Cryptography cryptanalysis crypto design today 1982 1996 Lenstra, Lenstra, Lovasz (1982) : The “LLL” paper “Factoring Polynomials with Rational Coefficients” Algorithmic breakthrough Efficient approximate solution of lattice problems Exponential approximation factor, but very good in practice Killer App: Cryptanalysis Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 3 / 32

Lattice Cryptography cryptanalysis crypto design today 1982 1996 Lenstra, Lenstra, Lovasz (1982) : The “LLL” paper “Factoring Polynomials with Rational Coefficients” Algorithmic breakthrough Efficient approximate solution of lattice problems Exponential approximation factor, but very good in practice Killer App: Cryptanalysis Ajtai (1996) : “Generating Hard Instances of Lattice Problems” Marks the beginning of the modern use of lattices in the design of cryptographic functions Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 3 / 32

Ajtai’s paper (quotes) “cryptography . . . generation of a specific instance of a problem in NP which is thought to be difficult”. “NP-hard problems” “very famous question (e.g., prime factorization).” “Unfortunately ‘difficult to solve’ means . . . in the worst case” “no guidance about how to create [a hard instance]” “possible solution” “find a set of randomly generated problems”, and 1 “show that if there is an algorithm which [works] with a positive 2 probability, then there is also an algorithm which solves the famous problem in the worst case.” “In this paper we give such a class of random problems.” Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 4 / 32

Example: Discrete Logrithm (DLOG) p : a prime Z ∗ p : multiplicative group p : generator of (prime order sub-)group G = { g i : i ∈ Z } ⊆ Z ∗ g ∈ Z ∗ p Input: h = g i mod p DLOG Problem Given p , g , h , recover i (modulo q = o ( g )) Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 5 / 32

Example: Discrete Logrithm (DLOG) p : a prime Z ∗ p : multiplicative group p : generator of (prime order sub-)group G = { g i : i ∈ Z } ⊆ Z ∗ g ∈ Z ∗ p Input: h = g i mod p DLOG Problem Given p , g , h , recover i (modulo q = o ( g )) Random Self Reducibility If you can solve DLOG for random g and h (with some probability), then you can solve it for any g , h in the worst-case. Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 5 / 32

DLOG: Random Self Reducibility (RSR) 1 Given arbitrary g , h Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 6 / 32

DLOG: Random Self Reducibility (RSR) 1 Given arbitrary g , h 2 Compute g ′ = g a and h ′ = h ab for random a , b ∈ Z ∗ q . Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 6 / 32

DLOG: Random Self Reducibility (RSR) 1 Given arbitrary g , h 2 Compute g ′ = g a and h ′ = h ab for random a , b ∈ Z ∗ q . 3 Notice: g ′ , h ′ ∈ G are (almost) uniformly random h ′ = h ab = g iab = ( g ′ ) ib Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 6 / 32

DLOG: Random Self Reducibility (RSR) 1 Given arbitrary g , h 2 Compute g ′ = g a and h ′ = h ab for random a , b ∈ Z ∗ q . 3 Notice: g ′ , h ′ ∈ G are (almost) uniformly random h ′ = h ab = g iab = ( g ′ ) ib 4 Find j = DLOG ( g ′ , h ′ ) = ib Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 6 / 32

DLOG: Random Self Reducibility (RSR) 1 Given arbitrary g , h 2 Compute g ′ = g a and h ′ = h ab for random a , b ∈ Z ∗ q . 3 Notice: g ′ , h ′ ∈ G are (almost) uniformly random h ′ = h ab = g iab = ( g ′ ) ib 4 Find j = DLOG ( g ′ , h ′ ) = ib 5 Output j / b (mod q ). Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 6 / 32

DLOG: Random Self Reducibility (RSR) 1 Given arbitrary g , h 2 Compute g ′ = g a and h ′ = h ab for random a , b ∈ Z ∗ q . 3 Notice: g ′ , h ′ ∈ G are (almost) uniformly random h ′ = h ab = g iab = ( g ′ ) ib 4 Find j = DLOG ( g ′ , h ′ ) = ib 5 Output j / b (mod q ). Conclusion We know how to choose g , h ∈ G . But, how do we choose G ? Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 6 / 32

DLOG vs Lattices (1) Lattice Assumption The complexity of solving lattice problems in n -dimensional lattices grows superpolynomially (or exponentially) in n . Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 7 / 32

DLOG vs Lattices (1) Lattice Assumption The complexity of solving lattice problems in n -dimensional lattices grows superpolynomially (or exponentially) in n . Similarly, one may conjecture that the complexity of DLOG grows superpolynomially in n = log p or n = log | G | . Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 7 / 32

DLOG vs Lattices (1) Lattice Assumption The complexity of solving lattice problems in n -dimensional lattices grows superpolynomially (or exponentially) in n . Similarly, one may conjecture that the complexity of DLOG grows superpolynomially in n = log p or n = log | G | . This is not the same: For any n , there are (exponentially) many primes p . Typically, p is chosen at random among all n -bit primes Assumption is still average-case: DLOG is hard for random p . Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 7 / 32

DLOG vs Lattices (1) Lattice Assumption The complexity of solving lattice problems in n -dimensional lattices grows superpolynomially (or exponentially) in n . Similarly, one may conjecture that the complexity of DLOG grows superpolynomially in n = log p or n = log | G | . This is not the same: For any n , there are (exponentially) many primes p . Typically, p is chosen at random among all n -bit primes Assumption is still average-case: DLOG is hard for random p . We do not know how to reduce DLOG ( Z ∗ p ) to DLOG ( Z ∗ q ). RSR provides no guidance on how to choose p . Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 7 / 32

DLOG vs Lattices (2) Alternative assumption DLOG( p n ) is hard when p n is the smallest prime > 2 n . Equivalent to worst-case family of problems (indexed by n ) Ad-hoc: problem definition seems rather arbitrary Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 8 / 32

DLOG vs Lattices (2) Alternative assumption DLOG( p n ) is hard when p n is the smallest prime > 2 n . Equivalent to worst-case family of problems (indexed by n ) Ad-hoc: problem definition seems rather arbitrary There is more: Lattice problems in dimension n reduce to lattice problems in dimension m > n : ⇒ B O B = O ∞ No such reduction for DLOG: ? DLOG ( p n ) = ⇒ DLOG ( p n +1 ) Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 8 / 32

DLOG vs Lattices (3) Other (natural) representations: G = ( Z ∗ p , · ) ≡ ( Z p − 1 , +) but “DLOG” in ( Z p − 1 , +) is easy. Other (still natural) groups: G = Z ∗ pq Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 9 / 32

DLOG vs Lattices (3) Other (natural) representations: G = ( Z ∗ p , · ) ≡ ( Z p − 1 , +) but “DLOG” in ( Z p − 1 , +) is easy. Other (still natural) groups: G = Z ∗ pq Question Assume one of DLOG ( Z p ) and DLOG ( Z p · q ) is polynomial time solvable, and one is not. Which group family would you choose? Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 9 / 32

DLOG vs Lattices (3) Other (natural) representations: G = ( Z ∗ p , · ) ≡ ( Z p − 1 , +) but “DLOG” in ( Z p − 1 , +) is easy. Other (still natural) groups: G = Z ∗ pq Question Assume one of DLOG ( Z p ) and DLOG ( Z p · q ) is polynomial time solvable, and one is not. Which group family would you choose? Chinese Reminder Theorem (CRT): Z pq ≈ Z p × Z q DLOG ( Z ∗ ⇒ DLOG ( Z ∗ p ) = pq ) . Reduction in the other direction requires factoring. Daniele Micciancio (UCSD) Lattice Cryptography: Introduction and Open Problems August 2015 9 / 32