Lattices: From Worst-Case, to Average-Case, to Cryptography Chris - PowerPoint PPT Presentation

Lattices: From Worst-Case, to Average-Case, to Cryptography Chris Peikert Georgia Institute of Technology Public Key Cryptography and the Geometry of Numbers 6 May 2010 1 / 16

Talk Agenda 1 Smoothing and discrete Gaussians 2 From worst-case to average-case 3 Basic crypto applications 2 / 16

Part 1: The Smoothing Parameter and Discrete Gaussians ◮ D. Micciancio, O. Regev (FOCS 2004) “Worst-Case to Average-Case Reductions Based on Gaussian Measures” ◮ C. Gentry, C. Peikert, V. Vaikuntanathan (STOC 2008) “Trapdoors for Hard Lattices and New Cryptographic Constructions” 3 / 16

The Smoothing Parameter [AR’04,MR’04] ◮ Gaussian function ρ ( x ) = e − π � x � 2 . Scaled: ρ s ( x ) = ρ ( x / s ) . Dual L ∗ Primal L ˆ f ( w ) ∝ ρ 1 / s ( w ) for w ∈ L ∗ f s ( x ) ∝ ρ s ( L + x ) 4 / 16

The Smoothing Parameter [AR’04,MR’04] ◮ Gaussian function ρ ( x ) = e − π � x � 2 . Scaled: ρ s ( x ) = ρ ( x / s ) . Dual L ∗ Primal L ˆ f ( w ) ∝ ρ 1 / s ( w ) for w ∈ L ∗ f s ( x ) ∝ ρ s ( L + x ) 4 / 16

The Smoothing Parameter [AR’04,MR’04] ◮ Gaussian function ρ ( x ) = e − π � x � 2 . Scaled: ρ s ( x ) = ρ ( x / s ) . Dual L ∗ Primal L ˆ f ( w ) ∝ ρ 1 / s ( w ) for w ∈ L ∗ f s ( x ) ∝ ρ s ( L + x ) 4 / 16

The Smoothing Parameter [AR’04,MR’04] ◮ Gaussian function ρ ( x ) = e − π � x � 2 . Scaled: ρ s ( x ) = ρ ( x / s ) . Dual L ∗ Primal L ˆ f ( w ) ∝ ρ 1 / s ( w ) for w ∈ L ∗ f s ( x ) ∝ ρ s ( L + x ) 4 / 16

The Smoothing Parameter [AR’04,MR’04] ◮ Gaussian function ρ ( x ) = e − π � x � 2 . Scaled: ρ s ( x ) = ρ ( x / s ) . Dual L ∗ Primal L ˆ f ( w ) ∝ ρ 1 / s ( w ) for w ∈ L ∗ f s ( x ) ∝ ρ s ( L + x ) Definition: Smoothing Parameter smooth ( L ) = min s > 0 such that ρ ( s L ∗ \ { 0 } ) ≤ negl ( n ) 4 / 16

The Smoothing Parameter [AR’04,MR’04] ◮ Gaussian function ρ ( x ) = e − π � x � 2 . Scaled: ρ s ( x ) = ρ ( x / s ) . Dual L ∗ Primal L ˆ f ( w ) ∝ ρ 1 / s ( w ) for w ∈ L ∗ f s ( x ) ∝ ρ s ( L + x ) Key Fact For s ≥ smooth ( L ) , every coset has equal ∗ mass: ρ s ( L + x ) ≈ ρ s ( L ) . 4 / 16

Smoothing Parameter of Z n Theorem smooth ( Z n ) ≤ ω ( √ log n ) 5 / 16

Smoothing Parameter of Z n Theorem smooth ( Z n ) ≤ ω ( √ log n ) Need to show: ρ ( s Z n \ { 0 } ) ≤ negl when s = ω ( √ log n ) . s O 5 / 16

Smoothing Parameter of Z n Theorem smooth ( Z n ) ≤ ω ( √ log n ) Need to show: ρ ( s Z n \ { 0 } ) ≤ negl when s = ω ( √ log n ) . Lemma: Tail Bound [Banaszczyk’95] For any lattice L , ) ≤ 2 exp ( − π s 2 ) · ρ ( L ) ρ ( L \ s O 5 / 16

Smoothing Parameter of Z n Theorem smooth ( Z n ) ≤ ω ( √ log n ) Need to show: ρ ( s Z n \ { 0 } ) ≤ negl when s = ω ( √ log n ) . Lemma: Tail Bound [Banaszczyk’95] For any lattice L , ) ≤ 2 exp ( − π s 2 ) · ρ ( L ) ρ ( L \ s O 5 / 16

Smoothing Parameter of Z n Theorem smooth ( Z n ) ≤ ω ( √ log n ) Need to show: ρ ( s Z n \ { 0 } ) ≤ negl when s = ω ( √ log n ) . Lemma: Tail Bound [Banaszczyk’95] For any lattice L , ) ≤ 2 exp ( − π s 2 ) · ρ ( L ) ρ ( L \ s O By union bound, p := ρ ( s Z n \ { 0 } ) = ρ ( s Z n \ ) ≤ n · negl · ρ ( s Z n ) = negl · ( 1 + p ) . � 5 / 16

Smoothing Parameter of Any Lattice [MR’04,GPV’08] ◮ Gram-Schmidt orthogonalization � B . (Note: � � B � := max i � � b i � ≤ max i � b i � ) Dual L ∗ Primal L b 2 � b 2 � b 1 = b 1 6 / 16

Smoothing Parameter of Any Lattice [MR’04,GPV’08] ◮ Gram-Schmidt orthogonalization � B . (Note: � � B � := max i � � b i � ≤ max i � b i � ) Theorem B � · ω ( √ log n ) . Let B be any basis of L . Then smooth ( L ) ≤ � � Dual L ∗ Primal L b 2 � b 2 � b 1 = b 1 6 / 16

Smoothing Parameter of Any Lattice [MR’04,GPV’08] ◮ Gram-Schmidt orthogonalization � B . (Note: � � B � := max i � � b i � ≤ max i � b i � ) Theorem B � · ω ( √ log n ) . Let B be any basis of L . Then smooth ( L ) ≤ � � ◮ Dual basis: � b ∗ i , b j � = δ ij . (GSO in reverse.) Dual L ∗ Primal L � b ∗ 2 = b ∗ 2 b 2 � b 2 � b 1 = b 1 � b ∗ 1 b ∗ 1 6 / 16

Smoothing Parameter of Any Lattice [MR’04,GPV’08] ◮ Gram-Schmidt orthogonalization � B . (Note: � � B � := max i � � b i � ≤ max i � b i � ) Theorem B � · ω ( √ log n ) . Let B be any basis of L . Then smooth ( L ) ≤ � � ◮ Dual basis: � b ∗ Fact: � � i � = 1 / � � b ∗ i , b j � = δ ij . (GSO in reverse.) b i � Dual L ∗ Primal L � b ∗ 2 = b ∗ 2 b 2 � b 2 � b 1 = b 1 � b ∗ 1 b ∗ 1 6 / 16

Discrete Gaussians over Lattices Suppose x ∼ Gauss ( s ) for s ≥ smooth ( L ) . 7 / 16

Discrete Gaussians over Lattices Suppose x ∼ Gauss ( s ) for s ≥ smooth ( L ) . 1 x belongs to uniform ∗ coset L + c [ ∀ c , ρ s ( L + c ) ≈ ρ s ( L ) ] 7 / 16

Discrete Gaussians over Lattices Suppose x ∼ Gauss ( s ) for s ≥ smooth ( L ) . 1 x belongs to uniform ∗ coset L + c [ ∀ c , ρ s ( L + c ) ≈ ρ s ( L ) ] 2 Given c , conditional distrib of x ∈ L + c is: D L + c , s ( x ) ∝ ρ s ( x ) . 7 / 16

Discrete Gaussians over Lattices Suppose x ∼ Gauss ( s ) for s ≥ smooth ( L ) . 1 x belongs to uniform ∗ coset L + c [ ∀ c , ρ s ( L + c ) ≈ ρ s ( L ) ] 2 Given c , conditional distrib of x ∈ L + c is: D L + c , s ( x ) ∝ ρ s ( x ) . Gaussian-like Properties 1 High probability tail bounds: for x ∼ D L + c , s , s · √ n � x � ≤ � for unit u , |� x , u �| ≤ s · ω ( log n ) 7 / 16

Discrete Gaussians over Lattices Suppose x ∼ Gauss ( s ) for s ≥ smooth ( L ) . 1 x belongs to uniform ∗ coset L + c [ ∀ c , ρ s ( L + c ) ≈ ρ s ( L ) ] 2 Given c , conditional distrib of x ∈ L + c is: D L + c , s ( x ) ∝ ρ s ( x ) . Gaussian-like Properties 1 High probability tail bounds: for x ∼ D L + c , s , s · √ n � x � ≤ � for unit u , |� x , u �| ≤ s · ω ( log n ) 2 Additive: if x ∼ D L + c , s and y ∼ D L + d , t , then x + y ∼ D L + c + d , √ s 2 + t 2 7 / 16

Discrete Gaussians over Lattices Suppose x ∼ Gauss ( s ) for s ≥ smooth ( L ) . 1 x belongs to uniform ∗ coset L + c [ ∀ c , ρ s ( L + c ) ≈ ρ s ( L ) ] 2 Given c , conditional distrib of x ∈ L + c is: D L + c , s ( x ) ∝ ρ s ( x ) . Gaussian-like Properties 1 High probability tail bounds: for x ∼ D L + c , s , s · √ n � x � ≤ � for unit u , |� x , u �| ≤ s · ω ( log n ) 2 Additive: if x ∼ D L + c , s and y ∼ D L + d , t , then x + y ∼ D L + c + d , √ s 2 + t 2 3 Unpredictable: min-entropy ≥ n 7 / 16

Discrete Gaussians over Lattices Suppose x ∼ Gauss ( s ) for s ≥ smooth ( L ) . 1 x belongs to uniform ∗ coset L + c [ ∀ c , ρ s ( L + c ) ≈ ρ s ( L ) ] 2 Given c , conditional distrib of x ∈ L + c is: D L + c , s ( x ) ∝ ρ s ( x ) . Gaussian-like Properties 1 High probability tail bounds: for x ∼ D L + c , s , s · √ n � x � ≤ � for unit u , |� x , u �| ≤ s · ω ( log n ) 2 Additive: if x ∼ D L + c , s and y ∼ D L + d , t , then x + y ∼ D L + c + d , √ s 2 + t 2 3 Unpredictable: min-entropy ≥ n 4 Many more . . . 7 / 16

Sampling a Discrete Gaussian [GPV’08,P’10] ◮ Given basis B and c ∈ R n , efficiently sample D L− c , s for s ≥ � � B � ⋆ Output distribution is ‘oblivious’ to input basis B 8 / 16

Sampling a Discrete Gaussian [GPV’08,P’10] ◮ Given basis B and c ∈ R n , efficiently sample D L− c , s for s ≥ � � B � ⋆ Output distribution is ‘oblivious’ to input basis B ◮ “Nearest-plane” algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 8 / 16

Sampling a Discrete Gaussian [GPV’08,P’10] ◮ Given basis B and c ∈ R n , efficiently sample D L− c , s for s ≥ � � B � ⋆ Output distribution is ‘oblivious’ to input basis B ◮ “Nearest-plane” algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 8 / 16

Sampling a Discrete Gaussian [GPV’08,P’10] ◮ Given basis B and c ∈ R n , efficiently sample D L− c , s for s ≥ � � B � ⋆ Output distribution is ‘oblivious’ to input basis B ◮ “Nearest-plane” algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 8 / 16

Sampling a Discrete Gaussian [GPV’08,P’10] ◮ Given basis B and c ∈ R n , efficiently sample D L− c , s for s ≥ � � B � ⋆ Output distribution is ‘oblivious’ to input basis B ◮ “Nearest-plane” algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 8 / 16

Sampling a Discrete Gaussian [GPV’08,P’10] ◮ Given basis B and c ∈ R n , efficiently sample D L− c , s for s ≥ � � B � ⋆ Output distribution is ‘oblivious’ to input basis B ◮ “Nearest-plane” algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 ◮ Proof: by smoothing, D L− c , s ( plane ) depends only on dist ( c , plane ) 8 / 16