New (and Old) Proof Systems for Lattice Problems Navid Alamati - PowerPoint PPT Presentation

New (and Old) Proof Systems for Lattice Problems Navid Alamati Chris Peikert Noah Stephens-Davidowitz PKC 2018 1 / 13

Zero-Knowledge Proofs [GoldwasserMicaliRackoff’85] ◮ A protocol allowing an unbounded Prover P to convince a skeptical, bounded Verifier V that some x ∈ L . 2 / 13

Zero-Knowledge Proofs [GoldwasserMicaliRackoff’85] ◮ A protocol allowing an unbounded Prover P to convince a skeptical, bounded Verifier V that some x ∈ L . ◮ The (honest) verifier learns nothing more than the truth of statement: ∃ efficient simulator S such that ∀ x ∈ L : View V [ P ( x ) ↔ V ( x )] ≈ S ( x ) . 2 / 13

Zero-Knowledge Proofs [GoldwasserMicaliRackoff’85] ◮ A protocol allowing an unbounded Prover P to convince a skeptical, bounded Verifier V that some x ∈ L . ◮ The (honest) verifier learns nothing more than the truth of statement: ∃ efficient simulator S such that ∀ x ∈ L : View V [ P ( x ) ↔ V ( x )] ≈ S ( x ) . ◮ Statistical ZK (SZK): “ ≈ ” means statistically indistinguishable. 2 / 13

Zero-Knowledge Proofs [GoldwasserMicaliRackoff’85] ◮ A protocol allowing an unbounded Prover P to convince a skeptical, bounded Verifier V that some x ∈ L . ◮ The (honest) verifier learns nothing more than the truth of statement: ∃ efficient simulator S such that ∀ x ∈ L : View V [ P ( x ) ↔ V ( x )] ≈ S ( x ) . ◮ Statistical ZK (SZK): “ ≈ ” means statistically indistinguishable. ◮ Honest-verifier SZK ≡ general SZK [GSV’98] . 2 / 13

Zero-Knowledge Proofs [GoldwasserMicaliRackoff’85] ◮ A protocol allowing an unbounded Prover P to convince a skeptical, bounded Verifier V that some x ∈ L . ◮ The (honest) verifier learns nothing more than the truth of statement: ∃ efficient simulator S such that ∀ x ∈ L : View V [ P ( x ) ↔ V ( x )] ≈ S ( x ) . ◮ Statistical ZK (SZK): “ ≈ ” means statistically indistinguishable. ◮ Honest-verifier SZK ≡ general SZK [GSV’98] . ◮ SZK proofs are powerful: secure against unbounded malicious P ∗ , V ∗ . 2 / 13

Noninteractive SZK [GoldreichSahaiVadhan’99] ◮ Consists of only one message from P to V . 3 / 13

Noninteractive SZK [GoldreichSahaiVadhan’99] ◮ Consists of only one message from P to V . ◮ Both P and V have access to a uniformly random string. 3 / 13

Noninteractive SZK [GoldreichSahaiVadhan’99] ◮ Consists of only one message from P to V . ◮ Both P and V have access to a uniformly random string. SZK versus NISZK ⋆ Both SZK and NISZK have complete problems [SV’97, GSV’99] 3 / 13

Noninteractive SZK [GoldreichSahaiVadhan’99] ◮ Consists of only one message from P to V . ◮ Both P and V have access to a uniformly random string. SZK versus NISZK ⋆ Both SZK and NISZK have complete problems [SV’97, GSV’99] ⋆ SZK is closed under complement [SV’97] , but NISZK is not known to be. 3 / 13

Noninteractive SZK [GoldreichSahaiVadhan’99] ◮ Consists of only one message from P to V . ◮ Both P and V have access to a uniformly random string. SZK versus NISZK ⋆ Both SZK and NISZK have complete problems [SV’97, GSV’99] ⋆ SZK is closed under complement [SV’97] , but NISZK is not known to be. ⋆ NISZK is closed under complement ⇐ ⇒ NISZK = SKZ [GSV’99] 3 / 13

Lattices ◮ An n -dimensional lattice L ⊂ R n is a discrete additive subgroup, generated by a (non-unique) basis B = { b 1 , . . . , b n } : n b 1 � L = ( Z · b i ) i =1 b 2 O 4 / 13

Lattices ◮ An n -dimensional lattice L ⊂ R n is a discrete additive subgroup, generated by a (non-unique) basis B = { b 1 , . . . , b n } : n b 1 � L = ( Z · b i ) x i =1 b 2 O ◮ Represent coset x + L ∈ ( R n / L ) by unique ¯ x ∈ ( x + L ) ∩ P ( B ) . 4 / 13

Lattices ◮ An n -dimensional lattice L ⊂ R n is a discrete additive subgroup, generated by a (non-unique) basis B = { b 1 , . . . , b n } : n b 1 � L = ( Z · b i ) i =1 b 2 O λ 1 ◮ Represent coset x + L ∈ ( R n / L ) by unique ¯ x ∈ ( x + L ) ∩ P ( B ) . ◮ Minimum distance: length of shortest nonzero lattice vector λ 1 ( L ) = min 0 � = v ∈L � v � . 4 / 13

Lattices ◮ An n -dimensional lattice L ⊂ R n is a discrete additive subgroup, generated by a (non-unique) basis B = { b 1 , . . . , b n } : n � L = ( Z · b i ) i =1 ◮ Represent coset x + L ∈ ( R n / L ) by unique ¯ x ∈ ( x + L ) ∩ P ( B ) . ◮ Minimum distance: length of shortest nonzero lattice vector λ 1 ( L ) = min 0 � = v ∈L � v � . ◮ Covering radius: maximum distance from the lattice µ ( L ) = max x ∈ R n dist ( x , L ) . 4 / 13

The Smoothing Parameter [MicciancioRegev’04] ◮ η ε ( L ) = minimal Gaussian ‘blur’ that ‘smooths out’ L (up to error ε : think 2 − n ≤ ε ≤ 1 / 2) 5 / 13

The Smoothing Parameter [MicciancioRegev’04] ◮ η ε ( L ) = minimal Gaussian ‘blur’ that ‘smooths out’ L (up to error ε : think 2 − n ≤ ε ≤ 1 / 2) 5 / 13

The Smoothing Parameter [MicciancioRegev’04] ◮ η ε ( L ) = minimal Gaussian ‘blur’ that ‘smooths out’ L (up to error ε : think 2 − n ≤ ε ≤ 1 / 2) 5 / 13

The Smoothing Parameter [MicciancioRegev’04] ◮ η ε ( L ) = minimal Gaussian ‘blur’ that ‘smooths out’ L (up to error ε : think 2 − n ≤ ε ≤ 1 / 2) 5 / 13

The Smoothing Parameter [MicciancioRegev’04] ◮ η ε ( L ) = minimal Gaussian ‘blur’ that ‘smooths out’ L (up to error ε : think 2 − n ≤ ε ≤ 1 / 2) Applications ◮ Worst-case to average-case reductions [MR’04,Regev’05] 5 / 13

The Smoothing Parameter [MicciancioRegev’04] ◮ η ε ( L ) = minimal Gaussian ‘blur’ that ‘smooths out’ L (up to error ε : think 2 − n ≤ ε ≤ 1 / 2) Applications ◮ Worst-case to average-case reductions [MR’04,Regev’05] ◮ Constructions of cryptographic primitives [GPV’08,. . . ] 5 / 13

The Smoothing Parameter [MicciancioRegev’04] ◮ η ε ( L ) = minimal Gaussian ‘blur’ that ‘smooths out’ L (up to error ε : think 2 − n ≤ ε ≤ 1 / 2) Applications ◮ Worst-case to average-case reductions [MR’04,Regev’05] ◮ Constructions of cryptographic primitives [GPV’08,. . . ] ◮ Algorithms for SVP and CVP [ADRS’15,ADS’15] 5 / 13

The Smoothing Parameter Problem [ChungDadushLiuPeikert’13] Definition: γ -GapSPP ε ◮ Given a lattice L , is η ε ( L ) ≤ 1 OR η ε ( L ) > γ ? 6 / 13

The Smoothing Parameter Problem [ChungDadushLiuPeikert’13] Definition: γ -GapSPP ε ◮ Given a lattice L , is η ε ( L ) ≤ 1 OR η ε ( L ) > γ ? ◮ Equivalent to ‘classical’ problems like GapSVP, up to ≈ √ n factors. 6 / 13

The Smoothing Parameter Problem [ChungDadushLiuPeikert’13] Definition: γ -GapSPP ε ◮ Given a lattice L , is η ε ( L ) ≤ 1 OR η ε ( L ) > γ ? ◮ Equivalent to ‘classical’ problems like GapSVP, up to ≈ √ n factors. We’re interested in non-trivial factors, where equivalence doesn’t help. 6 / 13

The Smoothing Parameter Problem [ChungDadushLiuPeikert’13] Definition: γ -GapSPP ε ◮ Given a lattice L , is η ε ( L ) ≤ 1 OR η ε ( L ) > γ ? ◮ Equivalent to ‘classical’ problems like GapSVP, up to ≈ √ n factors. We’re interested in non-trivial factors, where equivalence doesn’t help. GapSPP is Central 6 / 13

The Smoothing Parameter Problem [ChungDadushLiuPeikert’13] Definition: γ -GapSPP ε ◮ Given a lattice L , is η ε ( L ) ≤ 1 OR η ε ( L ) > γ ? ◮ Equivalent to ‘classical’ problems like GapSVP, up to ≈ √ n factors. We’re interested in non-trivial factors, where equivalence doesn’t help. GapSPP is Central ◮ Replacing ‘classic’ problems w/GapSPP in proof systems [GG’98] and worst-case to average-case reductions [MR’04,R’05] subsumes the original results, and yields seemingly stronger ones. 6 / 13

The Smoothing Parameter Problem [ChungDadushLiuPeikert’13] Definition: γ -GapSPP ε ◮ Given a lattice L , is η ε ( L ) ≤ 1 OR η ε ( L ) > γ ? ◮ Equivalent to ‘classical’ problems like GapSVP, up to ≈ √ n factors. We’re interested in non-trivial factors, where equivalence doesn’t help. GapSPP is Central ◮ Replacing ‘classic’ problems w/GapSPP in proof systems [GG’98] and worst-case to average-case reductions [MR’04,R’05] subsumes the original results, and yields seemingly stronger ones. ◮ GapSPP ∈ SZK ⊆ AM ∩ coAM [CDLP’13] , but classic problems ∈ NISZK, coNP [AR’04,PV’08] . 6 / 13

The Smoothing Parameter Problem [ChungDadushLiuPeikert’13] Definition: γ -GapSPP ε ◮ Given a lattice L , is η ε ( L ) ≤ 1 OR η ε ( L ) > γ ? ◮ Equivalent to ‘classical’ problems like GapSVP, up to ≈ √ n factors. We’re interested in non-trivial factors, where equivalence doesn’t help. GapSPP is Central ◮ Replacing ‘classic’ problems w/GapSPP in proof systems [GG’98] and worst-case to average-case reductions [MR’04,R’05] subsumes the original results, and yields seemingly stronger ones. ◮ GapSPP ∈ SZK ⊆ AM ∩ coAM [CDLP’13] , but classic problems ∈ NISZK, coNP [AR’04,PV’08] . Motivating Question Are there noninteractive proof systems for GapSPP? 6 / 13

Our Results ◮ Noninteractive (NISZK/coNP) proof systems for GapSPP, improving prior ‘trivial’ factors by ≈ √ n . 7 / 13