Public-Key Cryptosystems from the Worst-Case Shortest Vector - PowerPoint PPT Presentation

Public-Key Cryptosystems from the Worst-Case Shortest Vector Problem Chris Peikert SRI → Georgia Tech Impagliazzo’s World Workshop 1 / 16

This Talk 1 State of Lattice-Based Cryptography 2 Main Result: Public-Key Encryption based on GapSVP 3 Proof & Future Work 2 / 16

Shortest Vector Problem(s) A lattice L ⊂ R n having basis B = { b 1 , . . . , b n } is: b 2 n b 1 � L = ( Z · b i ) i = 1 λ 3 / 16

Shortest Vector Problem(s) A lattice L ⊂ R n having basis B = { b 1 , . . . , b n } is: b 2 n b 1 � L = ( Z · b i ) i = 1 λ Shortest Vector Problem ( γ - GapSVP ) ◮ Given B , decide: λ ≤ 1 or λ > γ ? 3 / 16

Shortest Vector Problem(s) A lattice L ⊂ R n having basis B = { b 1 , . . . , b n } is: n � L = ( Z · b i ) λ i = 1 b 1 b 2 Shortest Vector Problem ( γ - GapSVP ) ◮ Given B , decide: λ ≤ 1 or λ > γ ? 3 / 16

Shortest Vector Problem(s) A lattice L ⊂ R n having basis B = { b 1 , . . . , b n } is: b 1 n b 2 � L = ( Z · b i ) i = 1 λ γ · λ Shortest Vector Problem ( γ - GapSVP ) ◮ Given B , decide: λ ≤ 1 or λ > γ ? Unique SVP ( γ - uSVP ) ◮ Given B with ‘ γ -unique’ shortest vector, find it. 3 / 16

Worst-Case Complexity GapSVP √ n γ = 2 ( log n ) 1 − ǫ 2 ∼ n n NP-hard ∗ ∈ coNP ∈ P (some) crypto [Ajt96,. . . , [Ajt98,. . . ,HR07] [GG98,AR05] [LLL82,Sch87] MR04,Reg05] 4 / 16

Worst-Case Complexity GapSVP √ n γ = 2 ( log n ) 1 − ǫ 2 ∼ n n NP-hard ∗ ∈ coNP ∈ P (some) crypto [Ajt96,. . . , [Ajt98,. . . ,HR07] [GG98,AR05] [LLL82,Sch87] MR04,Reg05] ◮ For γ = poly ( n ) , best algorithm is 2 n time & space [AKS01] 4 / 16

Worst-Case Complexity GapSVP √ n γ = 2 ( log n ) 1 − ǫ 2 ∼ n n NP-hard ∗ ∈ coNP ∈ P (some) crypto [Ajt96,. . . , [Ajt98,. . . ,HR07] [GG98,AR05] [LLL82,Sch87] MR04,Reg05] ◮ For γ = poly ( n ) , best algorithm is 2 n time & space [AKS01] uSVP √ n γ = 4 n 1 . 5 ?? ∈ coAM crypto NP-hard [AD97/07,Reg03] [Cai98] 4 / 16

Taxonomy of Lattice-Based Crypto ‘minicrypt’ OWF [Ajt96,. . . ] Sigs [LM08,GPV08] ID schemes [MV03,Lyu08] 5 / 16

Taxonomy of Lattice-Based Crypto ‘minicrypt’ OWF [Ajt96,. . . ] Sigs [LM08,GPV08] ID schemes [MV03,Lyu08] ☞ GapSVP etc. hard 5 / 16

Taxonomy of Lattice-Based Crypto ‘CRYPTOMANIA’ ‘minicrypt’ OWF [Ajt96,. . . ] PKE [AD97,Reg03,Reg05] Sigs CCA [PW08] [LM08,GPV08] ID schemes [MV03,Lyu08] ID-based [GPV08] ☞ GapSVP etc. hard 5 / 16

Taxonomy of Lattice-Based Crypto ‘CRYPTOMANIA’ ‘minicrypt’ OWF [Ajt96,. . . ] PKE [AD97,Reg03,Reg05] Sigs CCA [PW08] [LM08,GPV08] ID schemes [MV03,Lyu08] ID-based [GPV08] (Obl. tran. [PVW08], leakage [AGV09], homom [G09], KDM [ACPS09], HIBE [P09]) ☞ GapSVP etc. hard 5 / 16

Taxonomy of Lattice-Based Crypto ‘CRYPTOMANIA’ ‘minicrypt’ OWF [Ajt96,. . . ] PKE [AD97,Reg03,Reg05] Sigs CCA [PW08] [LM08,GPV08] ID schemes [MV03,Lyu08] ID-based [GPV08] (Obl. tran. [PVW08], leakage [AGV09], homom [G09], KDM [ACPS09], HIBE [P09]) ☞ GapSVP etc. hard ☞ uSVP hard ☞ GapSVP etc. quantum -hard 5 / 16

Learning With Errors ◮ Generalizes ‘learning parity with noise’: dim n , modulus q ≥ 2 6 / 16

Learning With Errors ◮ Generalizes ‘learning parity with noise’: dim n , modulus q ≥ 2 ◮ Search: find s ∈ Z n q given ‘noisy random inner products’ , b 1 ≈ � a 1 , s � mod q a 1 a 2 , b 2 ≈ � a 2 , s � mod q . . . 6 / 16

Learning With Errors ◮ Generalizes ‘learning parity with noise’: dim n , modulus q ≥ 2 ◮ Search: find s ∈ Z n q given ‘noisy random inner products’ , b 1 = � a 1 , s � + x 1 mod q a 1 a 2 , b 2 = � a 2 , s � + x 2 mod q . . . Uniform a i ∈ Z n q , Gaussian errors x i α · q ≥ √ n 6 / 16

Learning With Errors ◮ Generalizes ‘learning parity with noise’: dim n , modulus q ≥ 2 ◮ Search: find s ∈ Z n q given ‘noisy random inner products’ , b 1 = � a 1 , s � + x 1 mod q a 1 a 2 , b 2 = � a 2 , s � + x 2 mod q . . . Uniform a i ∈ Z n q , Gaussian errors x i α · q ≥ √ n ◮ Decision: distinguish from uniform ( a i , b i ) 6 / 16

Learning With Errors ◮ Generalizes ‘learning parity with noise’: dim n , modulus q ≥ 2 ◮ Search: find s ∈ Z n q given ‘noisy random inner products’ , b 1 = � a 1 , s � + x 1 mod q a 1 a 2 , b 2 = � a 2 , s � + x 2 mod q . . . Uniform a i ∈ Z n q , Gaussian errors x i α · q ≥ √ n ◮ Decision: distinguish from uniform ( a i , b i ) State of the Art ( n /α ) -GapSVP etc. ≤ search-LWE ≤ decision-LWE ≤ crypto quantum prime q = poly ( n ) [R05,PW08,GPV08, PVW08,AGV09,ACPS09,. . . ] [Reg05] [BFKL94,R05] 6 / 16

Our Results First public-key encryption based on classical GapSVP hardness 7 / 16

Our Results First public-key encryption based on classical GapSVP hardness 1 Classical reduction: GapSVP ≤ Learning With Errors 7 / 16

Our Results First public-key encryption based on classical GapSVP hardness 1 Classical reduction: GapSVP ≤ Learning With Errors ⋆ Standard ( n /α ) -GapSVP: large LWE modulus q ≥ 2 n 7 / 16

Our Results First public-key encryption based on classical GapSVP hardness 1 Classical reduction: GapSVP ≤ Learning With Errors ⋆ Standard ( n /α ) -GapSVP: large LWE modulus q ≥ 2 n ⋆ ‘Improve ζ to ( n /α ) ’-GapSVP: q ≈ ζ [ = poly ( n ) ] 7 / 16

Our Results First public-key encryption based on classical GapSVP hardness 1 Classical reduction: GapSVP ≤ Learning With Errors ⋆ Standard ( n /α ) -GapSVP: large LWE modulus q ≥ 2 n ⋆ ‘Improve ζ to ( n /α ) ’-GapSVP: q ≈ ζ [ = poly ( n ) ] 2 LWE search = decision for large q [ ≫ poly ( n ) ] ⇒ GapSVP-hardness of prior LWE-based crypto [Reg05,. . . ] 7 / 16

Our Results First public-key encryption based on classical GapSVP hardness 1 Classical reduction: GapSVP ≤ Learning With Errors ⋆ Standard ( n /α ) -GapSVP: large LWE modulus q ≥ 2 n ⋆ ‘Improve ζ to ( n /α ) ’-GapSVP: q ≈ ζ [ = poly ( n ) ] 2 LWE search = decision for large q [ ≫ poly ( n ) ] ⇒ GapSVP-hardness of prior LWE-based crypto [Reg05,. . . ] 3 New LWE-based chosen ciphertext-secure encryption ⋆ Much simpler, milder assumption than prior CCA [PW08] 7 / 16

[Regev05] Reduction to LWE BDD on L : d ≪ λ/ 2 BDD L ∗ classical LWE 8 / 16

[Regev05] Reduction to LWE BDD on L : d ≪ λ/ 2 q u a n t u m BDD BDD L ∗ L ∗ classical classical LWE LWE 8 / 16

[Regev05] Reduction to LWE BDD on L : d ≪ λ/ 2 q q u u a a n n t t u u m m BDD BDD L ∗ L ∗ classical classical LWE LWE 8 / 16

[Regev05] Reduction to LWE BDD on L : d ≪ λ/ 2 q q u u a a n n t t u u m m BDD BDD L ∗ L ∗ classical classical GapSVP SIVP LWE LWE 8 / 16

Why Quantum? ◮ “Obvious” answer: iterative step L ∗ quantum FT BDD on L 9 / 16

Why Quantum? ◮ “Obvious” answer: iterative step L ∗ quantum FT BDD on L ◮ Another answer: to make use of BDD/LWE oracle 1 Choose some x ∈ L 2 Perturb to y ≈ x x y y 3 Invoke oracle on y BDD ( LWE ) 9 / 16

Why Quantum? ◮ “Obvious” answer: iterative step L ∗ quantum FT BDD on L ◮ Another answer: to make use of BDD/LWE oracle 1 Choose some x ∈ L 2 Perturb to y ≈ x x y y 3 Invoke oracle on y BDD ( LWE ) 4 Returns x — we already knew that! x 9 / 16

Why Quantum? ◮ “Obvious” answer: iterative step L ∗ quantum FT BDD on L ◮ Another answer: to make use of BDD/LWE oracle 1 Choose some x ∈ L 2 Perturb to y ≈ x x y y 3 Invoke oracle on y BDD ( LWE ) 4 Returns x — we already knew that! ✔ Quantum can x “uncompute” x 9 / 16

Our Approach New way of solving GapSVP in a reduction 10 / 16

Our Approach New way of solving GapSVP in a reduction “The Usual” x y y BDD ( LWE ) x 10 / 16

Our Approach New way of solving GapSVP in a reduction IMAGINE “The Usual” x y x y y y BDD BDD ( LWE ) ( LWE ) x ?? 10 / 16

Our Approach New way of solving GapSVP in a reduction IMAGINE “The Usual” Illegal BDD instance ⇓ x y Incorrect (& unknown!) LWE distribution x y y y BDD BDD ( LWE ) ( LWE ) x ?? 10 / 16

Our Approach New way of solving GapSVP in a reduction IMAGINE “The Usual” Illegal BDD instance ⇓ x y Incorrect (& unknown!) LWE distribution x y SO WHAT! y y When λ ≪ d , oracle cannot guess x BDD BDD ⇓ ( LWE ) ( LWE ) Distinguishes large λ from small x ?? 10 / 16

Our Approach New way of solving GapSVP in a reduction IMAGINE “The Usual” Illegal BDD instance ⇓ x y Incorrect (& unknown!) LWE distribution x y SO WHAT! y y When λ ≪ d , oracle cannot guess x BDD BDD ⇓ ( LWE ) ( LWE ) Distinguishes large λ from small x ?? ◮ View as [GoldGold98] AM proof between reduction and oracle 10 / 16

Technical Obstacles 1 What about in BDD → LWE reduction? (No quantum allowed!) 11 / 16

Technical Obstacles 1 What about in BDD → LWE reduction? (No quantum allowed!) ⋆ Use [GPV08] sampling algorithm with ‘best available’ basis for L ∗ . 11 / 16