Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert 1 Alon Rosen 2 1 SRI International 2 Harvard SEAS → IDC Herzliya STOC 2007 1 / 15
Worst-case versus average-case complexity Lattices are an intriguing case study: ◮ Believed hard in the worst case ◮ Worst-case / average-case reductions 2 / 15
Worst-case versus average-case complexity Lattices are an intriguing case study: ◮ Believed hard in the worst case ◮ Worst-case / average-case reductions This Talk. . . ◮ Not (exactly) about crypto ◮ Special, natural class of algebraic lattices ◮ Very tight worst-case/average-case reductions • Much tighter than known for general lattices ◮ Distinctions between decision and search ◮ Many open problems 2 / 15
Lattices Let B = { b 1 , . . . , b n } ⊂ R n be linearly independent. The n -dim lattice L having basis B is: n b 1 � L = ( Z · b i ) i = 1 b 2 3 / 15
Lattices Let B = { b 1 , . . . , b n } ⊂ R n be linearly independent. The n -dim lattice L having basis B is: n b 1 � L = ( Z · b i ) P i = 1 b 2 Fundamental region: Parallelepiped P spanned by b i s. 3 / 15
Lattices Let B = { b 1 , . . . , b n } ⊂ R n be linearly independent. The n -dim lattice L having basis B is: n b 1 � L = ( Z · b i ) P i = 1 b 2 λ 1 Fundamental region: Parallelepiped P spanned by b i s. Minimum distance: λ 1 = length of shortest nonzero v ∈ L . 3 / 15
Lattices Let B = { b 1 , . . . , b n } ⊂ R n be linearly independent. The n -dim lattice L having basis B is: n b 1 � L = ( Z · b i ) P i = 1 b 2 λ 1 Fundamental region: Parallelepiped P spanned by b i s. Minimum distance: λ 1 = length of shortest nonzero v ∈ L . Minkowski’s Theorem √ n · vol ( P ) 1 / n ≤ λ 1 (Non-constructive, non-algorithmic proof. . . ) 3 / 15
Shortest Vector Problem (SVP) Approximation factor γ = γ ( n ) . Decision: Given basis, distinguish λ 1 ≤ 1 from λ 1 > γ . 4 / 15
Shortest Vector Problem (SVP) Approximation factor γ = γ ( n ) . Decision: Given basis, distinguish λ 1 ≤ 1 from λ 1 > γ . Search: Given basis, find nonzero v ∈ L such that � v � ≤ γ · λ 1 . 4 / 15
Shortest Vector Problem (SVP) Approximation factor γ = γ ( n ) . Decision: Given basis, distinguish λ 1 ≤ 1 from λ 1 > γ . Search: Given basis, find nonzero v ∈ L such that � v � ≤ γ · λ 1 . Hardness ◮ Almost-polynomial factors γ ( n ) [Ajt,Mic,Kho,HaRe] 4 / 15
Shortest Vector Problem (SVP) Approximation factor γ = γ ( n ) . Decision: Given basis, distinguish λ 1 ≤ 1 from λ 1 > γ . Search: Given basis, find nonzero v ∈ L such that � v � ≤ γ · λ 1 . Hardness ◮ Almost-polynomial factors γ ( n ) [Ajt,Mic,Kho,HaRe] Algorithms for SVP γ ◮ γ ( n ) ∼ 2 n approximation in poly-time [LLL] ◮ Can trade-off running time/approximation [Sch,AKS] 4 / 15
Worst-Case/Average-Case Connections [Ajtai,. . . ] For some γ ( n ) = poly ( n ) (“connection factor”): SVP γ hard in the worst case ⇓ problems hard on the average 5 / 15
Worst-Case/Average-Case Connections [Ajtai,. . . ] For some γ ( n ) = poly ( n ) (“connection factor”): SVP γ hard in the worst case ⇓ problems hard on the average Cryptographic Applications ◮ One-way & collision-resistant functions [Ajtai,GGH,. . . ] ◮ Public-key encryption [AjtaiDwork,Regev] 5 / 15
Worst-Case/Average-Case Connections [Ajtai,. . . ] For some γ ( n ) = poly ( n ) (“connection factor”): SVP γ hard in the worst case ⇓ problems hard on the average Cryptographic Applications ◮ One-way & collision-resistant functions [Ajtai,GGH,. . . ] ◮ Public-key encryption [AjtaiDwork,Regev] Optimizing the Connection Factor γ ◮ Interesting to characterize complexity ◮ Important for crypto due to time/accuracy tradeoff ◮ Current best γ ( n ) ∼ n [MicciancioRegev] 5 / 15
This Work: Ideal Lattices ◮ Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. 6 / 15
This Work: Ideal Lattices ◮ Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. ◮ Our interest: number fields with small root discriminant. 6 / 15
This Work: Ideal Lattices ◮ Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. ◮ Our interest: number fields with small root discriminant. SVP on Ideal Lattices ◮ Well-known bottleneck in number theory algorithms: Ideal reduction, unit & class group computation, . . . 6 / 15
This Work: Ideal Lattices ◮ Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. ◮ Our interest: number fields with small root discriminant. SVP on Ideal Lattices ◮ Well-known bottleneck in number theory algorithms: Ideal reduction, unit & class group computation, . . . ◮ Decision-SVP is easy to approximate: λ 1 ≈ Minkowski bound. Not NP-hard! 6 / 15
This Work: Ideal Lattices ◮ Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. ◮ Our interest: number fields with small root discriminant. SVP on Ideal Lattices ◮ Well-known bottleneck in number theory algorithms: Ideal reduction, unit & class group computation, . . . ◮ Decision-SVP is easy to approximate: λ 1 ≈ Minkowski bound. Not NP-hard! ◮ Search-SVP appears hard, despite structure. Best known algorithms [LLL,Sch,AKS] . 6 / 15
Our Results Complexity of Ideal Lattices 1 Connection factors as low as γ = √ log n . • Based on search-SVP . (Decision is easy .) • For SVP in any ℓ p norm. (Stay for CCC.) Classic win-win situation. 2 Relations among problems on ideal lattices (SVP , CVP). 7 / 15
Our Results Complexity of Ideal Lattices 1 Connection factors as low as γ = √ log n . • Based on search-SVP . (Decision is easy .) • For SVP in any ℓ p norm. (Stay for CCC.) Classic win-win situation. 2 Relations among problems on ideal lattices (SVP , CVP). Subtleties No efficient constructions of best number fields (yet). ⇒ Non-uniformity (preprocessing) in reductions. ⇒ Crypto is tricky. ⇒ Many interesting open problems! 7 / 15
Other Special Classes of Lattices 1 “Unique” shortest vector: • One-way/CR functions [Ajtai,GGH] • Public-key encryption [AjtaiDwork,Regev] 8 / 15
Other Special Classes of Lattices 1 “Unique” shortest vector: • One-way/CR functions [Ajtai,GGH] • Public-key encryption [AjtaiDwork,Regev] 2 Cyclic lattices: • Efficient & compact OWFs [Micciancio] • Collision-resistant hashing [PeikertRosen,LyubashevskyMicciancio] 8 / 15
Other Special Classes of Lattices 1 “Unique” shortest vector: • One-way/CR functions [Ajtai,GGH] • Public-key encryption [AjtaiDwork,Regev] 2 Cyclic lattices: • Efficient & compact OWFs [Micciancio] • Collision-resistant hashing [PeikertRosen,LyubashevskyMicciancio] Structure used for functionality & efficiency. Connection factors γ ∼ n or more. 8 / 15
Worst-to-Average Reduction [Ajtai,. . . ] Average-Case Problem For uniform a 1 , . . . , a m ← Z n mod q , find short nonzero z ∈ Z m : � z i a i = 0 mod q . 9 / 15
Worst-to-Average Reduction [Ajtai,. . . ] Average-Case Problem For uniform a 1 , . . . , a m ← Z n mod q , find short nonzero z ∈ Z m : � z i a i = 0 mod q . Reduction i ∈ R n , derive uniform a i ’s 1 Sample offset vectors 2 Get short solution z ∈ Z m 3 Output ( � z i · i ) ∈ L 9 / 15
Worst-to-Average Reduction [Ajtai,. . . ] Average-Case Problem For uniform a 1 , . . . , a m ← Z n mod q , find short nonzero z ∈ Z m : � z i a i = 0 mod q . Reduction i ∈ R n , derive uniform a i ’s 1 Sample offset vectors 2 Get short solution z ∈ Z m 3 Output ( � z i · i ) ∈ L 9 / 15
Worst-to-Average Reduction [Ajtai,. . . ] Average-Case Problem For uniform a 1 , . . . , a m ← Z n mod q , find short nonzero z ∈ Z m : � z i a i = 0 mod q . Reduction i ∈ R n , derive uniform a i ’s 1 Sample offset vectors 2 Get short solution z ∈ Z m 3 Output ( � z i · i ) ∈ L 9 / 15
Worst-to-Average Reduction [Ajtai,. . . ] Average-Case Problem For uniform a 1 , . . . , a m ← Z n mod q , find short nonzero z ∈ Z m : � z i a i = 0 mod q . Reduction i ∈ R n , derive uniform a i ’s 1 Sample offset vectors 2 Get short solution z ∈ Z m 3 Output ( � z i · i ) ∈ L 9 / 15
Worst-to-Average Reduction [Ajtai,. . . ] Average-Case Problem For uniform a 1 , . . . , a m ← Z n mod q , find short nonzero z ∈ Z m : � z i a i = 0 mod q . Reduction i ∈ R n , derive uniform a i ’s 1 Sample offset vectors 2 Get short solution z ∈ Z m 3 Output ( � z i · i ) ∈ L Connection Factor ◮ Size of solution z ∈ Z m ◮ Lengths of offset vectors i 9 / 15
Our Approach ◮ Replace “1-dim” integers Z with “ n -dim integers” O K . O K = ring of algebraic integers in number field K of degree n . 10 / 15
Our Approach ◮ Replace “1-dim” integers Z with “ n -dim integers” O K . O K = ring of algebraic integers in number field K of degree n . • Has + and × , “absolute value” |·| , . . . 10 / 15
Recommend
More recommend
