Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion On algebraic variants of the LWE problem Damien Stehl´ e Based on joint works with M. Rosca, A. Sakzad, R. Steinfeld and A. Wallet Figures borrowed from M. Rosca and A. Wallet ENS de Lyon , Bitdefender, U. Monash ICERM, April 2018 Damien Stehl´ e On algebraic variants of LWE 24/04/2018 1/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion What is this talk about Signatures PKE FHE Hash SIS LWE IBE [Ajt96] [Reg05] ApproxSVP SIS and LWE are lattice problems that are convenient for cryptographic design. We’ll focus on “efficient” variants of LWE. Damien Stehl´ e On algebraic variants of LWE 24/04/2018 2/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion LWE [Reg05] LWE parameters: m ≥ n ≥ 1, q ≥ 2 and α > 0. m s s find A A + , e n ֓ U ( Z m × n A ← ), q ֓ U ( Z n s ← q ), α q Gaussian error distribution D α q ֓ D m e ← α q . Typical parameters : n proportional to the bit-security, q = n Θ(1) , m = Θ( n log q ), α ≈ √ n / q . Damien Stehl´ e On algebraic variants of LWE 24/04/2018 3/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion LWE [Reg05] LWE parameters: m ≥ n ≥ 1, q ≥ 2 and α > 0. m s s find A A + , e n ֓ U ( Z m × n A ← ), q ֓ U ( Z n s ← q ), α q Gaussian error distribution D α q ֓ D m e ← α q . Typical parameters : n proportional to the bit-security, q = n Θ(1) , m = Θ( n log q ), α ≈ √ n / q . Damien Stehl´ e On algebraic variants of LWE 24/04/2018 3/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Search LWE as a Closest Vector Problem variant m s s find A A + , e n A defines the Construction-A lattice L q ( A ) = A Z n q + q Z m . As + e mod q is a point near that lattice. Finding s is finding the closest vector in L q ( A ). LWE is CVP for a uniformly sampled Construction-A lattice, a random lattice vector and a Gaussian lattice offset. Damien Stehl´ e On algebraic variants of LWE 24/04/2018 4/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Decision LWE Decide whether a given ( A , b ) is uniformly sampled or of the form ( A , As + e ) with A and s uniform and e sampled from D m α q . This is a distribution distinguishing problem. More convenient for cryptographic design. There are poly-time reductions between search-LWE and decision-LWE [Re05,MiMo11] . [During the talk, I will focus on the search variant] Damien Stehl´ e On algebraic variants of LWE 24/04/2018 5/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Decision LWE Decide whether a given ( A , b ) is uniformly sampled or of the form ( A , As + e ) with A and s uniform and e sampled from D m α q . This is a distribution distinguishing problem. More convenient for cryptographic design. There are poly-time reductions between search-LWE and decision-LWE [Re05,MiMo11] . [During the talk, I will focus on the search variant] Damien Stehl´ e On algebraic variants of LWE 24/04/2018 5/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion (for α q ≥ 2 √ n ) Hardness results on LWE The Approximate Shortest Vector Problem ApproxSIVP γ : Given B ∈ Z n × n defining L , find ( b i ) i ≤ n in L lin. indep. such that max � b i � ≤ γ · λ n ( L ). Regev’s worst-case to average-case reduction For q prime and ≤ n O (1) , there is a quantum poly-time reduction from ApproxSIVP γ in dimension n to LWE n , m , q ,α , with γ ≈ n /α . Best known attack for most parameter ranges: lattice reduction. � � n log q log 2 α · log( n log q Time ≈ exp log 2 α ) Damien Stehl´ e On algebraic variants of LWE 24/04/2018 6/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion (for α q ≥ 2 √ n ) Hardness results on LWE The Approximate Shortest Vector Problem ApproxSIVP γ : Given B ∈ Z n × n defining L , find ( b i ) i ≤ n in L lin. indep. such that max � b i � ≤ γ · λ n ( L ). Regev’s worst-case to average-case reduction For q prime and ≤ n O (1) , there is a quantum poly-time reduction from ApproxSIVP γ in dimension n to LWE n , m , q ,α , with γ ≈ n /α . Best known attack for most parameter ranges: lattice reduction. � � n log q log 2 α · log( n log q Time ≈ exp log 2 α ) Damien Stehl´ e On algebraic variants of LWE 24/04/2018 6/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion LWE is “inefficient” Best known attack for most parameter ranges: lattice reduction. � � n log q log 2 α log( n log q Time ≈ exp log 2 α ) Representing an LWE instance is quadratic in the bit-security. One then performs (at least) matrix-vector multiplications... Frodo: submission to the NIST post-quantum standardization process public-key and ciphertexts ≈ 10 kB encryption and decryption ≈ 2 million cycles. Damien Stehl´ e On algebraic variants of LWE 24/04/2018 7/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion LWE is “inefficient” Best known attack for most parameter ranges: lattice reduction. � � n log q log 2 α log( n log q Time ≈ exp log 2 α ) Representing an LWE instance is quadratic in the bit-security. One then performs (at least) matrix-vector multiplications... Frodo: submission to the NIST post-quantum standardization process public-key and ciphertexts ≈ 10 kB encryption and decryption ≈ 2 million cycles. Damien Stehl´ e On algebraic variants of LWE 24/04/2018 7/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Road-map The Learning With Errors problem Algebraic variants of the LWE problem On Polynomial-LWE and Ring-LWE The Middle-Product-LWE problem Damien Stehl´ e On algebraic variants of LWE 24/04/2018 8/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Take structured matrices! Damien Stehl´ e On algebraic variants of LWE 24/04/2018 9/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Polynomial-LWE [SSTX09] Let q ≥ 2, α > 0, f ∈ Z [ x ] monic irreducible of degree n . Search P-LWE f Given ( a 1 , . . . , a m ) and ( a 1 · s + e 1 , . . . , a m · s + e m ), find s . s uniform in Z q [ x ] / f All a i ’s uniform in Z q [ x ] / f The coefficients of the e i ’s are sampled from D α q This is LWE, with matrix A made of stacked blocks Rot f ( a i ). The j -th row of Rot f ( a i ) is made of the coefficients of x j − 1 · a i mod f . Damien Stehl´ e On algebraic variants of LWE 24/04/2018 10/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Polynomial-LWE [SSTX09] Let q ≥ 2, α > 0, f ∈ Z [ x ] monic irreducible of degree n . Search P-LWE f Given ( a 1 , . . . , a m ) and ( a 1 · s + e 1 , . . . , a m · s + e m ), find s . s uniform in Z q [ x ] / f All a i ’s uniform in Z q [ x ] / f The coefficients of the e i ’s are sampled from D α q This is LWE, with matrix A made of stacked blocks Rot f ( a i ). The j -th row of Rot f ( a i ) is made of the coefficients of x j − 1 · a i mod f . Damien Stehl´ e On algebraic variants of LWE 24/04/2018 10/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Polynomial-LWE [SSTX09] Let q ≥ 2, α > 0, f ∈ Z [ x ] monic irreducible of degree n . Search P-LWE f Given ( a 1 , . . . , a m ) and ( a 1 · s + e 1 , . . . , a m · s + e m ), find s . s uniform in Z q [ x ] / f All a i ’s uniform in Z q [ x ] / f The coefficients of the e i ’s are sampled from D α q This is LWE, with matrix A made of stacked blocks Rot f ( a i ). The j -th row of Rot f ( a i ) is made of the coefficients of x j − 1 · a i mod f . Damien Stehl´ e On algebraic variants of LWE 24/04/2018 10/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Hardness of P-LWE [SSTX09] - oversimplified For any f monic irreducible, there is a quantum reduction from ApproxSVP γ for ideals of Z [ x ] / f to search P-LWE f . The error rate α is proportional to γ and EF( f ) := max i < 2 n � x i mod f � . This is an adaptation of Regev’s ac-wc reduction Vacuous if ApproxSVP for ideals of Z [ x ] / f is easy Damien Stehl´ e On algebraic variants of LWE 24/04/2018 11/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Hardness of P-LWE [SSTX09] - oversimplified For any f monic irreducible, there is a quantum reduction from ApproxSVP γ for ideals of Z [ x ] / f to search P-LWE f . The error rate α is proportional to γ and EF( f ) := max i < 2 n � x i mod f � . This is an adaptation of Regev’s ac-wc reduction Vacuous if ApproxSVP for ideals of Z [ x ] / f is easy Damien Stehl´ e On algebraic variants of LWE 24/04/2018 11/32
Introduction LWE Algebraic variants P-LWE and R-LWE MP-LWE Conclusion Ideal-SVP [SSTX09] - oversimplified For any f monic irreducible, there is a quantum reduction from ApproxSVP for ideals of Z [ x ] / f to search P-LWE f . The reduction may be vacuous if ApproxSVP for ideals of Z [ x ] / f is easy For large approx. factors and some f ’s, faster algorithms are known for such lattices [see L´ eo’s talk] This wouldn’t necessarily impact the P-LWE f hardness The situation is not necessarily uniform across all f ’s Damien Stehl´ e On algebraic variants of LWE 24/04/2018 12/32
Recommend
More recommend
