Worst-Case to Average-Case Reduction for SIS Vadim Lyubashevsky INRIA / ENS, Paris Lattice-Based Crypto & Applications 1 Bar-Ilan University Israel 2012
Session Outline • Average-Case Problems – The Small Integer Solution (SIS) problem • Gaussian Distributions and Lattices • Reducing a Worst-Case Lattice Problem to SIS Lattice-Based Crypto & Applications 2 Bar-Ilan University Israel 2012
THE AVERAGE-CASE PROBLEMS Lattice-Based Crypto & Applications 3 Bar-Ilan University, Israel 2012
Lattice Problems Worst-Case Average-Case Learning With Errors Small Integer Solution Problem (LWE) Problem (SIS) One-Way Functions Public Key Encryption … Collision-Resistant Hash Functions (Cryptomania) Digital Signatures Identification Schemes (Minicrypt) Lattice-Based Crypto & Applications 4 Bar-Ilan University Israel 2012
SIVP BDD quantum Worst-Case Average-Case Learning With Errors Small Integer Solution Problem (LWE) Problem (SIS) One-Way Functions Public Key Encryption … Collision-Resistant Hash Functions (Cryptomania) Digital Signatures Identification Schemes (Minicrypt) Lattice-Based Crypto & Applications 5 Bar-Ilan University Israel 2012
Small Integer Solution Problem n Given: Random vectors a 1 ,...,a m in Z q Find: non-trivial solution z 1 ,...,z m in {-1,0,1} such that n z 1 in Z q 0 a 1 a 2 a m + z 2 z m + … + = Observations: If size of z i is not restricted, then the problem is trivial Immediately implies a collision-resistant hash function A relationship to lattices emerges … Lattice-Based Crypto & Applications 6 Bar-Ilan University Israel 2012
Relationship of SIS to Lattice Problems Find: non-trivial solution z 1 ,...,z m in {-1,0,1} such that n in Z q z 1 0 a 1 a 2 a m + z 2 + … + z m = Let S be the set of all integer z =(z 1 ,…, z m ), such that a 1 z 1 + … + a m z m =0 mod q S is a lattice! SIS problem asks to find a short vector in S. Lattice-Based Crypto & Applications 7 Bar-Ilan University, Israel 2012
Representing Lattices L ⊥ ( A ) = { z in Z m : Az = 0 mod q} L( B ) = { z : z = Bx for x in Z n } B x z = z = 0 mod q A Worst-Case to Average-Case Reduction: Approximately solving SIVP in all lattices < Finding short vectors in these lattices (m ≈ nlog n) Lattice-Based Crypto & Applications 8 Bar-Ilan University, Israel 2012
SIVP BDD quantum Worst-Case Average-Case Learning With Errors Small Integer Solution Problem (LWE) Problem (SIS) One-Way Functions Public Key Encryption … Collision-Resistant Hash Functions (Cryptomania) Digital Signatures Identification Schemes (Minicrypt) Lattice-Based Crypto & Applications 9 Bar-Ilan University Israel 2012
Collision-Resistant Hash Functions For a random h in H, H It is hard to find: x 1 , x 2 in D such that D R h(x 1 ) = h(x 2 ) Lattice-Based Crypto & Applications 10 Bar-Ilan University Israel 2012
Collision-Resistant Hash Function n Given: Random vectors a 1 ,...,a m in Z q Find: non-trivial solution z 1 ,...,z m in {-1,0,1} such that n in Z q z 1 0 a 1 a 2 a m + z 2 z m + … + = A =( a 1 ,..., a m ) Define h A : {0,1} m → Z q n where h A ( z 1 ,..., z m )= a 1 z 1 + … + a m z m Domain of h = {0,1} m (size = 2 m ) Range of h = Z q n (size = q n ) Set m>nlog q to get compression Collision: a 1 z 1 + … + a m z m = a 1 y 1 + … + a m y m So, a 1 (z 1 -y 1 ) + … + a m (z m -y m ) = 0 and z i -y i are in {-1,0,1} Lattice-Based Crypto & Applications 11 Bar-Ilan University Israel 2012
SIVP BDD quantum Worst-Case Average-Case Learning With Errors Small Integer Solution Problem (LWE) Problem (SIS) One-Way Functions Public Key Encryption … Collision-Resistant Hash Functions (Cryptomania) Digital Signatures Identification Schemes (Minicrypt) Lattice-Based Crypto & Applications 12 Bar-Ilan University Israel 2012
THE GAUSSIAN (NORMAL) DISTRIBUTION Lattice-Based Crypto & Applications 13 Bar-Ilan University, Israel 2012
Definition 1-dimensional Gaussian distribution: ρ s (x) = (1/s) e - π x 2 /s 2 It’s a Normal distribution: Centered at 0 Standard deviation: s/√ 2 π Lattice-Based Crypto & Applications 14 Bar-Ilan University, Israel 2012
Example (s=1) Lattice-Based Crypto & Applications 15 Bar-Ilan University, Israel 2012
Example (s=1 and 5) Lattice-Based Crypto & Applications 16 Bar-Ilan University, Israel 2012
2-Dimensional Gaussian 1-dim gaussian on the x 1 axis: 2 /s 2 ρ s (x 1 ) = (1/s) e - π x 1 1-dim gaussian on the x 2 axis: 2 /s 2 ρ s (x 2 ) = (1/s) e - π x 2 ρ s (x 1 ,x 2 ) = ρ s (x 1 ) ∙ ρ s (x 2 ) 2 /s 2 ∙ (1/s)e - π x 2 2 /s 2 = (1/s)e - π x 1 = (1/s) 2 e - π (x 1 2 + x 2 2 )/s 2 | 2 /s 2 ρ s ( x ) = (1/s) 2 e - π | | x | Lattice-Based Crypto & Applications 17 Bar-Ilan University, Israel 2012
2-Dimensional Example Lattice-Based Crypto & Applications 18 Bar-Ilan University, Israel 2012
n-Dimensional Gaussian n-dimensional Gaussian distribution: | 2 /s 2 ρ s ( x ) = (1/s) n e - π | | x | It’s an n -dimensional Normal distribution: Centered at 0 Standard deviation: s/√ 2 π Lattice-Based Crypto & Applications 19 Bar-Ilan University, Israel 2012
Useful Properties of the Gaussian Distribution 1. It is a Product Distribution 2. It is Spherically-Symmetric 3. It is “uniform” modulo parallelepipeds Lattice-Based Crypto & Applications 20 Bar-Ilan University, Israel 2012
Product Distribution ρ s ( x ) = ρ s (x 1 ) ∙ … ∙ ρ s (x n ) Lattice-Based Crypto & Applications 21 Bar-Ilan University, Israel 2012
Spherically Symmetric | 2 /s 2 ρ s ( x )= (1/s) n e - π | | x | The probability of x only depends on its length The distribution is “axis - independent” Lattice-Based Crypto & Applications 22 Bar-Ilan University, Israel 2012
Generating Uniform Elements on a Line Segment ρ s (x)= (1/s) e - π x 2 /s 2 and s=5M, for some positive M if X ~ ρ s , then for all m < M, Δ (X mod m , Uniform [0, m) ) < 2 -110 Lattice-Based Crypto & Applications 23 Bar-Ilan University, Israel 2012
Example (s=1,m=1) Lattice-Based Crypto & Applications 24 Bar-Ilan University, Israel 2012
Example (s=1,m=1, .9, .8) Lattice-Based Crypto & Applications 25 Bar-Ilan University, Israel 2012
Example (s=2) Lattice-Based Crypto & Applications 26 Bar-Ilan University, Israel 2012
Example (s=5, m=1) Lattice-Based Crypto & Applications 27 Bar-Ilan University, Israel 2012
Generating Uniform Elements in an n-dimensional Parallelepiped Reducing modulo a parallelepiped Lattice-Based Crypto & Applications 28 Bar-Ilan University, Israel 2012
Generating Uniform Elements in an n-Dimensional Box Box B with dimensions (m 1 , … , m n ), all m i < M. Generate X 1 , … , X n ~ ρ s (x) = (1/s) e - π x 2 /s 2 , where s=5M For each j, Δ (X j mod m , Uniform [0, m j ) ) < 2 -110 Thus Δ ((X 1 mod m 1 , … , X n mod m n ) , Uniform( B )) < n2 -110 | 2 /s 2 for s=5M, Δ ( X mod B , Uniform( B )) < n2 -110 ≈ 0 So, if X ~ ρ s ( x ) = (1/s) n e - π | | x | m 2 B m 1 Lattice-Based Crypto & Applications 29 Bar-Ilan University, Israel 2012
Generating Uniform Elements in a Rotated n-Dimensional Box | 2 /s 2 is a spherical distribution ρ s ( x ) = (1/s) n e - π | | x | So rotating axes doesn’t affect it Lattice-Based Crypto & Applications 30 Bar-Ilan University, Israel 2012
Generating Uniform Elements in a Rotated n-Dimensional Box | 2 /s 2 is a spherical distribution ρ s ( x ) = (1/s) n e - π | | x | So rotating axes doesn’t affect it Thus, Δ ( X mod B’ , Uniform( B’ )) ≈ 0 Lattice-Based Crypto & Applications 31 Bar-Ilan University, Israel 2012
Generating Uniform Elements in Parallelepipeds | 2 /s 2 Suppose we have X ~ ρ s ( x ) = (1/s) n e - π | | x | and X mod A is uniform Is X uniform modulo B ? Lattice-Based Crypto & Applications 32 Bar-Ilan University, Israel 2012
Generating Uniform Elements in Parallelepipeds If B is much bigger than A (i.e. has a bigger determinant), then probably NO. Lattice-Based Crypto & Applications 33 Bar-Ilan University, Israel 2012
Generating Uniform Elements in Parallelepipeds If B is much bigger than A (i.e. has a bigger determinant), then probably NO. But what if B = AU when det( U )=1? Still … not necessarily. A B Lattice-Based Crypto & Applications 34 Bar-Ilan University, Israel 2012
Generating Uniform Elements in Parallelepipeds If B = AU and det( U )=1, then X mod A is uniform X mod B is uniform if: 1.) U is an integer matrix or 2.) U is an upper-triangular matrix with 1 ’s on the diagonal Lattice-Based Crypto & Applications 35 Bar-Ilan University, Israel 2012
Some Simplifying Assumptions Pretend that the space R n is divided into a very very fine grid. Any two parallelepipeds that have the same determinant have the same number of grid points inside them. Lattice-Based Crypto & Applications 36 Bar-Ilan University, Israel 2012
Recommend
More recommend
