Module-LWE vs. Ring-LWE? Amit Deo Royal Holloway, University of - PowerPoint PPT Presentation

Module-LWE vs. Ring-LWE? Amit Deo Royal Holloway, University of London 15 January, 2018 1/56

Main Aim of the Talk 1. Discuss popular variants of the LWE problem 2. Present a collection of reductions between the variants 3. Explicitly state parameter expansions in the reductions 2/56

Outline 1. Definitions 2. Motivation for Ring/Module-LWE 3. Normal Form Secrets 4. “BLPRS13” Style Reductions 5. “Structure-Building” Reduction 3/56

Section 1 Definitions 4/56

Notation Vectors x ∈ Z n q : ◮ Entries integers modulo q , i.e. Z q ◮ Dimension n , i.e. x = ( x 0 , . . . , x n − 1 ) Ring elements r ∈ R q = Z q [ X ] / ( X n + 1): ◮ Coefficients integers modulo q ◮ Degree at most n − 1 i.e. r = r 0 + r 1 · X + · · · + r n − 1 · X n − 1 ∈ Z q [ X ] / ( X n + 1) ◮ Coefficient Embedding r = ( r 0 , . . . , r n − 1 ) ∈ Z n q 5/56

Notation Module elements m ∈ R d q : ◮ A d -tuple of ring elements m = ( m 0 , . . . , m d − 1 ) ◮ Multiplication: m · n := m 0 n 0 + · · · + m d − 1 · n d − 1 Terminology : ◮ q is a “modulus” ◮ n is a “(ring) dimension” ◮ d is a “module rank” ◮ m is the number of samples 6/56

Notation: Distributions ◮ U ( X ) - uniform distribution over set X 7/56

Notation: Distributions ◮ U ( X ) - uniform distribution over set X ◮ χ σ - discrete gaussian over the integers, s.d. σ ◮ D Λ ,σ - discrete gaussian over lattice Λ, s.d. σ ◮ D Λ , r - discrete ellipsoidal gaussian with s.d.’s r i ∈ R 7/56

Notation: Distributions ◮ U ( X ) - uniform distribution over set X ◮ χ σ - discrete gaussian over the integers, s.d. σ ◮ D Λ ,σ - discrete gaussian over lattice Λ, s.d. σ ◮ D Λ , r - discrete ellipsoidal gaussian with s.d.’s r i ∈ R ◮ D σ - continuous gaussian over R ◮ D r - continuous ellipsoidal gaussian over R n with s.d.’s r i 7/56

Generic LWE Problem Framework Given some uniform random a , b = a · s + e : ◮ (search LWE) decode the noisy product b i.e. recover s from b for “small” e ◮ (decision LWE) distinguish b from uniform random 8/56

Generic LWE Problem Framework Given some uniform random a , b = a · s + e : ◮ (search LWE) decode the noisy product b i.e. recover s from b for “small” e ◮ (decision LWE) distinguish b from uniform random Plain LWE sample: a ← Z n q ; s ← U or χ n σ , e ← χ σ ; b ∈ Z q a 1 e 1 b 1 a 2 e 2 b 2 . + a m = s a 1 a 2 … , … … … a m e m b m 8/56

Distributions and Parameters ◮ Uniform a ◮ Error distribution: discrete gaussian e ← χ σ ◮ Secret distribution: uniform s or s ← χ n σ Plain LWE sample: a ← Z n q ; s ← χ n σ , e ← χ σ ; b ∈ Z q 9/56

Distributions and Parameters ◮ Uniform a ◮ Error distribution: discrete gaussian e ← χ σ ◮ Secret distribution: uniform s or s ← χ n σ Plain LWE sample: a ← Z n q ; s ← χ n σ , e ← χ σ ; b ∈ Z q ◮ Absolute error σ ◮ Error rate α := σ/ q 9/56

Practical Ring-LWE Let R q = Z q [ X ] / ( X n + 1). Given some uniform random a ∈ R q , ◮ (search) recover s ∈ R q from b = a · s + e for “small” e ∈ R q ◮ (decision) decide whether b = a · s + e or b is random 10/56

Practical Ring-LWE Let R q = Z q [ X ] / ( X n + 1). Given some uniform random a ∈ R q , ◮ (search) recover s ∈ R q from b = a · s + e for “small” e ∈ R q ◮ (decision) decide whether b = a · s + e or b is random Error distribution: s , e ← χ n σ n a . s + e a = b , n 10/56

Almost Proper Ring-LWE Given some uniform random a ∈ R q , ◮ (search) recover s ∈ ( R q ) d from b = 1 q a · s + e mod 1 for “small” e ∈ R q ◮ (decision) decide whether b = 1 q a · s + e mod 1 or b is random Notes: ◮ The error distribution is now continuous ◮ The discrete Gaussian distribution χ σ becomes continuous Gaussian D α where α := σ/ q ◮ Ignoring canonical embedding and dual ring 11/56

Practical Module-LWE Given some uniform random a ∈ ( R q ) d , ◮ (search) recover s ∈ ( R q ) d from b = a · s + e for “small” e ∈ R q ◮ (decision) decide whether b = a · s + e or b is random 12/56

Practical Module-LWE Given some uniform random a ∈ ( R q ) d , ◮ (search) recover s ∈ ( R q ) d from b = a · s + e for “small” e ∈ R q ◮ (decision) decide whether b = a · s + e or b is random Error distribution: s ← χ nd σ , e ← χ n σ nd a . a + = s b e , n 12/56

Almost Proper Module-LWE Given some uniform random a ∈ ( R q ) d , ◮ (search) recover s ∈ ( R q ) d from b = 1 q a · s + e mod 1 for “small” e ∈ R q ◮ (decision) decide whether b = 1 q a · s + e mod 1 or b is random Notes: ◮ The error distribution is now continuous ◮ The discrete Gaussian distribution χ σ becomes continuous Gaussian D α where α := σ/ q ◮ Once again, we ignore canonical embedding and dual ring 13/56

Other Variants ◮ Learning with Rounding (LWR) ◮ Compact-LWE ◮ Binary-LWE ◮ And many more 14/56

Section 2 Motivation for Ring-LWE/Module-LWE 15/56

Efficiency vs. Security ◮ Representing n LWE samples: ◮ O ( n ) integers (Ring-LWE) ◮ O ( nd ) integers (Module-LWE) ◮ O ( n 2 ) integers (LWE) 16/56

Efficiency vs. Security ◮ Representing n LWE samples: ◮ O ( n ) integers (Ring-LWE) ◮ O ( nd ) integers (Module-LWE) ◮ O ( n 2 ) integers (LWE) ◮ Lattice hardness: ◮ Ideal lattices SIVP (Ring-LWE) ◮ Module lattices SIVP (Module-LWE) ◮ General lattices SIVP (LWE) 16/56

Flexibility of Module-LWE ◮ R = Z q [ X ] / ( X n + 1) for power-of-two n ◮ Effective Ring-LWE dimensions: 256 , 512 , 1024 , 2048 , . . . ◮ Effective Module-LWE dimensions: 256 · d , d = 1 , 2 , . . . Note: The cost of multiplying using Module-LWE is larger than the cost of multiplying for Ring-LWE of the same effective dimension. 17/56

Section 3 Transforming Secret Distributions 18/56

Normal Form LWE Lemma Let q be prime. Given m > n uniform secret LWE samples ( A , b ) ∈ Z n × m × Z m q , we can produce m − n normal form LWE q samples ( A ′ , b ′ ) ∈ Z n × ( m − n ) × Z ( m − n ) (with significant probability q q 1 − O (1 / q ) ). 19/56

Normal Form LWE Lemma Let q be prime. Given m > n uniform secret LWE samples ( A , b ) ∈ Z n × m × Z m q , we can produce m − n normal form LWE q samples ( A ′ , b ′ ) ∈ Z n × ( m − n ) × Z ( m − n ) (with significant probability q q 1 − O (1 / q ) ). Proof. 1. Write A = [ A 1 | A 2 ] where A 1 ∈ Z n × n is invertible. q 2. b = [ b 1 | b 2 ] T := [ A 1 | A 2 ] T s + [ e 1 | e 2 ] T 3. Set A ′ := − A − 1 1 A 2 , b ′ := A ′ T b 1 + b 2 = A ′ e 1 + e 2 . 19/56

Non-Uniform Secret − → Uniform Secret Lemma Given a LWE sample ( a , b ) with non-uniform secret s, we can obtain a LWE sample ( a , ˜ b ) with a uniform secret ˜ s. Proof. 1. Sample s ′ ← U . 2. Output LWE sample � � b := b + a · s ′ = a · ( s ′ + s ) + e = ( a , a · ( s ′ + s ) + e ). a , ˜ 20/56

Section 4 BLPRS13 Style Reductions 21/56

Modulus-Dimension Switching LWE Reduction 1 Lemma There exists a reduction from → LWE m , n ′ = n / k , q ′ = q k , D β where β = O ( α √ n ) . LWE m , n , q , D α − “We can reduce the dimension at the cost of increasing the modulus while changing the error rate by a √ n factor without decreasing hardness.” 1 Z. Brakerski, A. Langlois, C. Peikert, O. Regev, D. St´ ehle. Classical hardness of learning with errors. STOC13 22/56

Reduction Intuition Goal Find a reduction (i.e. transformation F ) such that the original LWE distribution almost maps to the target LWE distribution where the effect that F has on the secret is reversible. F (LWE) ∼ indist. LWE ′ a ′ ∈ Z n / k F a ∈ Z n − → q q k s ′ ∈ Z n / k F s ∈ Z n − → q q k � 1 � 1 � � b ′ = q k a ′ · s ′ + e ′ F b = q a · s + e mod 1 − → mod 1 23/56

Reduction Intuition n = 3 , n / k = 1 a ′ = a 0 + qa 1 + q 2 a 2 s ′ = s 2 + qs 1 + q 2 s 0 24/56

Reduction Intuition n = 3 , n / k = 1 a ′ = a 0 + qa 1 + q 2 a 2 s ′ = s 2 + qs 1 + q 2 s 0 q 3 a ′ · s ′ ≡ 0 + 1 1 q a · s + 1 = ⇒ q 2 ( a 0 · s 1 + a 1 · s 2 ) + . . . mod 1 ≅ 1 q a · s mod 1 24/56

Reduction Intuition n = 3 , n / k = 1 a ′ = a 0 + qa 1 + q 2 a 2 s ′ = s 2 + qs 1 + q 2 s 0 q 3 a ′ · s ′ ≡ 0 + 1 1 q a · s + 1 = ⇒ q 2 ( a 0 · s 1 + a 1 · s 2 ) + . . . mod 1 ≅ 1 q a · s mod 1 Therefore take b ′ = b 24/56

A Closer Look at the Error Distribution Want to analyse the distribution of: b ′ − 1 q n a ′ · s ′ = e − � q j − i − 1 a j s i i > j Problem: ◮ q j − i − 1 a j s i are not continuous gaussians ✗ 25/56

INTERLUDE: Fixing a “Bad” Error Distribution - Discrete Version Aim Given bad non-Gaussian distribution ˆ e , make it look like a discrete Gaussian. How? Drown by adding a wide discrete Gaussian i.e. consider ˆ e + χ σ 26/56

Fixing a “Bad” Error Distribution - Discrete Version 0.35 0.3 0.25 0.2 0.15 0.1 0.05 -4 -2 2 4 27/56

Drowning ( σ = 3) 0.14 0.12 0.1 0.08 0.06 0.04 0.02 -15 -10 -5 5 10 15 28/56

Drowning ( σ = 10) 0.04 0.03 0.02 0.01 -30 -20 -10 10 20 30 29/56

Drowning ( σ = 10) 0.04 0.03 0.02 0.01 -4 -2 2 4 30/56