On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem
|
|
|
- Jemima Hines
- 5 years ago
- Views:
Transcription
1 On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky Daniele Micciancio To appear at Crypto 2009
2 Lattices Lattice: A discrete subgroup of R n Group elements are vectors. Group operation is the usual vector addition.
3 Lattices Basis: A set of linearly independent vectors that generate the lattice.
4 Lattices Basis: A set of linearly independent vectors that generate the lattice.
5 Shortest Vector Problem SVP(B): Given a lattice basis B, find the shortest vector SVP g (B): Given a lattice basis B, find a vector that is no more than g times longer than the shortest vector
6 Minimum Distance Problem (Decision Version of SVP) GapSVP(B,d): Given a lattice basis B, is the shortest vector at most d? GapSVP g (B,d): Given a lattice basis B, answer YES if shortest vector at most d. Answer NO if shortest vector greater than gd.
7 Hardness of SVP and GapSVP SVP g and GapSVP g are NP-hard for any constant g [Kho '04] SVP g and GapSVP g can be solved for g=2 O(nloglogn/logn) [LLL '82, AKS '01] SVP and GapSVP can be solved exactly in time 2 O(n) [AKS '01] GapSVP g < SVP g, but SVP g < GapSVP g not known to exist. Big open question!
8 Shortest Independent Vector Problem r: smallest number such that ball of radius r contains n linearly independent lattice vectors SIVP g (B): Given a lattice basis B of dimension n, find n linearly independent vectors of length at most gr
9 Unique Shortest Vector Problem usvp g (B): Given a lattice basis B where the shortest vector is g times smaller than the second shortest linearly independent vector, find the shortest vector
10 Bounded Distance Decoding Have a lattice with minimum distance d (don't necessarily know d) BDD g (B,t): Given a lattice basis B and a target t such that dist(b,t)<gd, find the nearest lattice vector to t
11 Why are Lattices Interesting? (In Cryptography) Ajtai ('96) showed that solving average instances of lattice problems implies solving all instances of lattice problems Possible to base cryptography on worst-case instances of problems
12 Lattice-Based Primitives Minicrypt One-way functions [Ajt '96] Collision-resistant hash functions [Ajt '96,MR '07] Public-Key Cryptosystems [AD '97] (usvp) [Reg '03] (usvp) Identification schemes [MV '03,Lyu '08, KTX '08] Signature schemes [LM '08, GPV '08] All Based on SIVP and GapSVP
13 Lattice-Based Primitives Minicrypt One-way functions [Ajt '96] Collision-resistant hash functions [Ajt '96,MR '07] Identification schemes [MV '03,Lyu '08, KTX '08] Signature schemes [LM '08, GPV '08] Public-Key Cryptosystems [AD '97] (usvp) [Reg '03] (usvp) [Reg '05] (SIVP and GapSVP under quantum reductions) [Pei '09] (GapSVP) All Based on SIVP and GapSVP
14 Cryptosystem Hardness Assumptions Ajtai-Dwork '97 Regev '03 Regev '05 Peikert '09 usvp BDD GapSVP SIVP (quantum) O(n 2 ) O(n 1.5 ) O(n 1.5 ) O(n 1.5 ) O(n 2 ) O(n 2.5 )
15 Cryptosystem Hardness Assumptions usvp BDD GapSVP SIVP (quantum) Ajtai-Dwork '97 O(n 2 ) O(n 2 ) O(n 2.5 ) O(n 3 ) Regev '03 O(n 1.5 ) O(n 1.5 ) O(n 2 ) O(n 2.5 ) Regev ' O(n 1.5 ) Peikert '09 O(n 1.5 ) O(n 1.5 ) O(n 2 ) O(n 2.5 ) Implications of our results
16 Lattice-Based Primitives Minicrypt One-way functions [Ajt '96] Collision-resistant hash functions [Ajt '96,MR '07] Identification schemes [MV '03,Lyu '08, KTX '08] Signature schemes [LM '08, GPV '08] All Based on GapSVP and SIVP Public-Key Cryptosystems [AD '97] (usvp) [Reg '03] (usvp) [Reg '05] (SIVP and GapSVP under quantum reductions) [Pei '09] (GapSVP) All Based on GapSVP and quantum SIVP Major Open Problem: Construct cryptosystems based on SIVP
17 Reductions GapSVP BDD usvp
18 SIVP n n (quantum reduction) GapSVP BDD usvp
19 SIVP Minicrypt primitives n (quantum reduction) GapSVP BDD Cryptosystems Regev '05 Peikert ' usvp Cryptosystems Ajtai-Dwork '97 Regev '03
20 [Ban '93] SIVP [Ajt '97,...] Minicrypt primitives n [Reg '05] n (quantum reduction) GapSVP [GG '97,Pei '09] BDD Cryptosystems Regev '05 Peikert ' [Reg '03] (worse factor) usvp Cryptosystems Ajtai-Dwork '97 Regev '03
21 SIVP Minicrypt primitives (quantum reduction) GapSVP BDD Cryptosystems usvp
22 Proof Sketch (GapSVP<BDD) Recall the Goldreich-Goldwasser proof that GapSVP coam is in
23 Proof Sketch (GapSVP<BDD) Recall the Goldreich-Goldwasser proof that GapSVP coam is in Suppose the minimum distance is d
24 Proof Sketch (GapSVP<BDD) 1. Verifier picks a random lattice point and a random point within distance d/2 of the lattice point. Sends the random point to the prover.
25 Proof Sketch (GapSVP<BDD) 1. Verifier picks a random lattice point and a random point within distance d/2 of the lattice point. Sends the random point to the prover. 2. Prover finds the closest lattice point and sends it to the verifier
26 Proof Sketch (GapSVP<BDD) 1. Verifier picks a random lattice point and a random point within distance d/2 of the lattice point. Sends the random point to the prover. 2. Prover finds the closest lattice point and sends it to the verifier 3. Verifier accepts iff he got back his own lattice point
27 Proof Sketch (GapSVP<BDD) Recall the Goldreich-Goldwasser proof that GapSVP coam is in Suppose the minimum distance is d, but the prover cheats and says it's d
28 Proof Sketch (GapSVP<BDD)
29 Proof Sketch (GapSVP<BDD) non-negligible overlap
30 Proof Sketch (GapSVP<BDD) Prover will make mistakes a non-negligible fraction of the time non-negligible overlap
31 Proof Sketch (GapSVP<BDD) How powerful must the prover be to always return the correct point?
32 Proof Sketch (GapSVP<BDD) Prover just needs to be a BDD oracle [Peikert '09]
33 Proof Sketch (GapSVP<BDD) So, if you have a BDD oracle, just play the game by yourself. Create a random lattice point, add noise, use BDD oracle, and see if you always get back your lattice point.
34 Proof Sketch (BDD < usvp)
35 Proof Sketch (BDD < usvp)
36 Proof Sketch (BDD < usvp)
37 Proof Sketch (BDD < usvp)
38 Proof Sketch (BDD < usvp)
39 Proof Sketch (BDD < usvp) New basis vector used exactly once in constructing the unique shortest vector
40 Proof Sketch (BDD < usvp) New basis vector used exactly once in constructing the unique shortest vector
41 Proof Sketch (BDD < usvp) New basis vector used exactly once in constructing the unique shortest vector Subtracting unique shortest vector from new basis vector gives the closest point to the target.
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem. Vadim Lyubashevsky Daniele Micciancio
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky Daniele Micciancio Lattices Lattice: A discrete additive subgroup of R n Lattices Basis: A set
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky and Daniele Micciancio May 9, 009 Abstract We prove the equivalence, up to a small polynomial
Dimension-Preserving Reductions Between Lattice Problems
Dimension-Preserving Reductions Between Lattice Problems Noah Stephens-Davidowitz Courant Institute of Mathematical Sciences, New York University. noahsd@cs.nyu.edu Last updated September 6, 2016. Abstract
Public-Key Cryptosystems from the Worst-Case Shortest Vector Problem. Chris Peikert Georgia Tech
1 / 14 Public-Key Cryptosystems from the Worst-Case Shortest Vector Problem Chris Peikert Georgia Tech Computer Security & Cryptography Workshop 12 April 2010 2 / 14 Talk Outline 1 State of Lattice-Based
Lattice-Based Cryptography: Mathematical and Computational Background. Chris Peikert Georgia Institute of Technology.
Lattice-Based Cryptography: Mathematical and Computational Background Chris Peikert Georgia Institute of Technology crypt@b-it 2013 1 / 18 Lattice-Based Cryptography y = g x mod p m e mod N e(g a, g b
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky 1 and Daniele Micciancio 2 1 School of Computer Science, Tel Aviv University Tel Aviv 69978, Israel.
Background: Lattices and the Learning-with-Errors problem
Background: Lattices and the Learning-with-Errors problem China Summer School on Lattices and Cryptography, June 2014 Starting Point: Linear Equations Easy to solve a linear system of equations A s = b
Dwork 97/07, Regev Lyubashvsky-Micciancio. Micciancio 09. PKE from worst-case. usvp. Relations between worst-case usvp,, BDD, GapSVP
The unique-svp World 1. Ajtai-Dwork Dwork 97/07, Regev 03 PKE from worst-case usvp 2. Lyubashvsky-Micciancio Micciancio 09 Shai Halevi, IBM, July 2009 Relations between worst-case usvp,, BDD, GapSVP Many
Limits on the Hardness of Lattice Problems in l p Norms
Limits on the Hardness of Lattice Problems in l p Norms Chris Peikert Abstract Several recent papers have established limits on the computational difficulty of lattice problems, focusing primarily on the
Proving Hardness of LWE
Winter School on Lattice-Based Cryptography and Applications Bar-Ilan University, Israel 22/2/2012 Proving Hardness of LWE Bar-Ilan University Dept. of Computer Science (based on [R05, J. of the ACM])
Ideal Lattices and Ring-LWE: Overview and Open Problems. Chris Peikert Georgia Institute of Technology. ICERM 23 April 2015
Ideal Lattices and Ring-LWE: Overview and Open Problems Chris Peikert Georgia Institute of Technology ICERM 23 April 2015 1 / 16 Agenda 1 Ring-LWE and its hardness from ideal lattices 2 Open questions
CS Topics in Cryptography January 28, Lecture 5
CS 4501-6501 Topics in Cryptography January 28, 2015 Lecture 5 Lecturer: Mohammad Mahmoody Scribe: Ameer Mohammed 1 Learning with Errors: Motivation An important goal in cryptography is to find problems
Improved Zero-knowledge Protocol for the ISIS Problem, and Applications
Improved Zero-knowledge Protocol for the ISIS Problem, and Applications Khoa Nguyen, Nanyang Technological University (Based on a joint work with San Ling, Damien Stehlé and Huaxiong Wang) December, 29,
Classical hardness of Learning with Errors
Classical hardness of Learning with Errors Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé Adeline Langlois Classical Hardness of LWE 1/ 13 Our
COS 598D - Lattices. scribe: Srdjan Krstic
COS 598D - Lattices scribe: Srdjan Krstic Introduction In the first part we will give a brief introduction to lattices and their relevance in some topics in computer science. Then we show some specific
Post-quantum key exchange for the Internet based on lattices
Post-quantum key exchange for the Internet based on lattices Craig Costello Talk at MSR India Bangalore, India December 21, 2016 Based on J. Bos, C. Costello, M. Naehrig, D. Stebila Post-Quantum Key Exchange
Classical hardness of the Learning with Errors problem
Classical hardness of the Learning with Errors problem Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé August 12, 2013 Adeline Langlois Hardness
A Decade of Lattice Cryptography
A Decade of Lattice Cryptography Chris Peikert 1 September 26, 2015 1 Department of Computer Science and Engineering, University of Michigan. Much of this work was done while at the School of Computer
Lattice-based Cryptography
Lattice-based Cryptography Oded Regev Tel Aviv University, Israel Abstract. We describe some of the recent progress on lattice-based cryptography, starting from the seminal work of Ajtai, and ending with
Oded Regev Courant Institute, NYU
Fast er algorithm for the Shortest Vector Problem Oded Regev Courant Institute, NYU (joint with Aggarwal, Dadush, and Stephens-Davidowitz) A lattice is a set of points Lattices L={a 1 v 1 + +a n v n a
Lattice-Based Cryptography. Chris Peikert University of Michigan. QCrypt 2016
Lattice-Based Cryptography Chris Peikert University of Michigan QCrypt 2016 1 / 24 Agenda 1 Foundations: lattice problems, SIS/LWE and their applications 2 Ring-Based Crypto: NTRU, Ring-SIS/LWE and ideal
Limits on the Hardness of Lattice Problems in l p Norms
Electronic Colloquium on Computational Complexity, Revision 1 of Report No. 148 (2006) Limits on the Hardness of Lattice Problems in l p Norms Chris Peikert 15 February, 2007 Abstract We show that several
Gauss Sieve on GPUs. Shang-Yi Yang 1, Po-Chun Kuo 1, Bo-Yin Yang 2, and Chen-Mou Cheng 1
Gauss Sieve on GPUs Shang-Yi Yang 1, Po-Chun Kuo 1, Bo-Yin Yang 2, and Chen-Mou Cheng 1 1 Department of Electrical Engineering, National Taiwan University, Taipei, Taiwan {ilway25,kbj,doug}@crypto.tw 2
Weaknesses in Ring-LWE
Weaknesses in Ring-LWE joint with (Yara Elias, Kristin E. Lauter, and Ekin Ozman) and (Hao Chen and Kristin E. Lauter) ECC, September 29th, 2015 Lattice-Based Cryptography Post-quantum cryptography Ajtai-Dwork:
Classical hardness of Learning with Errors
Classical hardness of Learning with Errors Zvika Brakerski 1 Adeline Langlois 2 Chris Peikert 3 Oded Regev 4 Damien Stehlé 2 1 Stanford University 2 ENS de Lyon 3 Georgia Tech 4 New York University Our
Hardness and advantages of Module-SIS and Module-LWE
Hardness and advantages of Module-SIS and Module-LWE Adeline Roux-Langlois EMSEC: Univ Rennes, CNRS, IRISA April 24, 2018 Adeline Roux-Langlois Hardness and advantages of Module-SIS and LWE April 24, 2018
Hard Instances of Lattice Problems
Hard Instances of Lattice Problems Average Case - Worst Case Connections Christos Litsas 28 June 2012 Outline Abstract Lattices The Random Class Worst-Case - Average-Case Connection Abstract Christos Litsas
A Lattice-Based Threshold Ring Signature Scheme (TRSS-L)
A Lattice-Based Threshold Ring Signature Scheme (TRSS-L) Pierre-Louis Cayrel 1 Richard Lindner 2 Markus Rückert 2 Rosemberg Silva 3 1 Center for Advanced Security Research Darmstadt (CASED) 2 Technische
New Lattice Based Cryptographic Constructions
New Lattice Based Cryptographic Constructions Oded Regev August 7, 2004 Abstract We introduce the use of Fourier analysis on lattices as an integral part of a lattice based construction. The tools we develop
Solving Hard Lattice Problems and the Security of Lattice-Based Cryptosystems
Solving Hard Lattice Problems and the Security of Lattice-Based Cryptosystems Thijs Laarhoven Joop van de Pol Benne de Weger September 10, 2012 Abstract This paper is a tutorial introduction to the present
Finding Short Generators of Ideals, and Implications for Cryptography. Chris Peikert University of Michigan
Finding Short Generators of Ideals, and Implications for Cryptography Chris Peikert University of Michigan ANTS XII 29 August 2016 Based on work with Ronald Cramer, Léo Ducas, and Oded Regev 1 / 20 Lattice-Based
Post-Quantum Cryptography
Post-Quantum Cryptography Sebastian Schmittner Institute for Theoretical Physics University of Cologne 2015-10-26 Talk @ U23 @ CCC Cologne This work is licensed under a Creative Commons Attribution-ShareAlike
An Efficient Lattice-based Secret Sharing Construction
An Efficient Lattice-based Secret Sharing Construction Rachid El Bansarkhani 1 and Mohammed Meziani 2 1 Technische Universität Darmstadt Fachbereich Informatik Kryptographie und Computeralgebra, Hochschulstraße
An intro to lattices and learning with errors
A way to keep your secrets secret in a post-quantum world Some images in this talk authored by me Many, excellent lattice images in this talk authored by Oded Regev and available in papers and surveys
Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors
1 / 15 Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert 1 Alon Rosen 2 1 SRI International 2 Harvard SEAS IDC Herzliya STOC 2007 2 / 15 Worst-case versus average-case
Solving Closest Vector Instances Using an Approximate Shortest Independent Vectors Oracle
Tian CL, Wei W, Lin DD. Solving closest vector instances using an approximate shortest independent vectors oracle. JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY 306): 1370 1377 Nov. 015. DOI 10.1007/s11390-015-
COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective
COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective THE KLUWER INTERNATIONAL SERIES IN ENGINEERING AND COMPUTER SCIENCE COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective Daniele Micciancio
Lecture 5: CVP and Babai s Algorithm
NYU, Fall 2016 Lattices Mini Course Lecture 5: CVP and Babai s Algorithm Lecturer: Noah Stephens-Davidowitz 51 The Closest Vector Problem 511 Inhomogeneous linear equations Recall that, in our first lecture,
Practical Analysis of Key Recovery Attack against Search-LWE Problem
Practical Analysis of Key Recovery Attack against Search-LWE Problem The 11 th International Workshop on Security, Sep. 13 th 2016 Momonari Kudo, Junpei Yamaguchi, Yang Guo and Masaya Yasuda 1 Graduate
Solving All Lattice Problems in Deterministic Single Exponential Time
Solving All Lattice Problems in Deterministic Single Exponential Time (Joint work with P. Voulgaris, STOC 2010) UCSD March 22, 2011 Lattices Traditional area of mathematics Bridge between number theory
Lattice-Based Cryptography
Liljana Babinkostova Department of Mathematics Computing Colloquium Series Detecting Sensor-hijack Attacks in Wearable Medical Systems Krishna Venkatasubramanian Worcester Polytechnic Institute Quantum
Public-Key Cryptographic Primitives Provably as Secure as Subset Sum
Public-Key Cryptographic Primitives Provably as Secure as Subset Sum Vadim Lyubashevsky 1, Adriana Palacio 2, and Gil Segev 3 1 Tel-Aviv University, Tel-Aviv, Israel vlyubash@cs.ucsd.edu 2 Bowdoin College,
Notes for Lecture 16
COS 533: Advanced Cryptography Lecture 16 (11/13/2017) Lecturer: Mark Zhandry Princeton University Scribe: Boriana Gjura Notes for Lecture 16 1 Lattices (continued) 1.1 Last time. We defined lattices as
On Worst-Case to Average-Case Reductions for NP Problems
On Worst-Case to Average-Case Reductions for NP Problems Andrej Bogdanov Luca Trevisan January 27, 2005 Abstract We show that if an NP-complete problem has a non-adaptive self-corrector with respect to
Lattice Based Crypto: Answering Questions You Don't Understand
Lattice Based Crypto: Answering Questions You Don't Understand Vadim Lyubashevsky INRIA / ENS, Paris Cryptography Secure communication in the presence of adversaries Symmetric-Key Cryptography Secret key
A Digital Signature Scheme based on CVP
A Digital Signature Scheme based on CVP Thomas Plantard Willy Susilo Khin Than Win Centre for Computer and Information Security Research Universiy Of Wollongong http://www.uow.edu.au/ thomaspl thomaspl@uow.edu.au
How to Use Short Basis : Trapdoors for Hard Lattices and new Cryptographic Constructions
Presentation Article presentation, for the ENS Lattice Based Crypto Workgroup http://www.di.ens.fr/~pnguyen/lbc.html, 30 September 2009 How to Use Short Basis : Trapdoors for http://www.cc.gatech.edu/~cpeikert/pubs/trap_lattice.pdf
Shortest Vector Problem (1982; Lenstra, Lenstra, Lovasz)
Shortest Vector Problem (1982; Lenstra, Lenstra, Lovasz) Daniele Micciancio, University of California at San Diego, www.cs.ucsd.edu/ daniele entry editor: Sanjeev Khanna INDEX TERMS: Point lattices. Algorithmic
Quantum-secure symmetric-key cryptography based on Hidden Shifts
Quantum-secure symmetric-key cryptography based on Hidden Shifts Gorjan Alagic QMATH, Department of Mathematical Sciences University of Copenhagen Alexander Russell Department of Computer Science & Engineering
Pseudorandomness of Ring-LWE for Any Ring and Modulus. Chris Peikert University of Michigan
Pseudorandomness of Ring-LWE for Any Ring and Modulus Chris Peikert University of Michigan Oded Regev Noah Stephens-Davidowitz (to appear, STOC 17) 10 March 2017 1 / 14 Lattice-Based Cryptography y = g
Limits on the Hardness of Lattice Problems in l p Norms
Electronic Colloquium on Computational Complexity, Report No. 148 (2006) Limits on the Hardness of Lattice Problems in l p Norms Chris Peikert December 3, 2006 Abstract We show that for any p 2, lattice
Density of Ideal Lattices
Density of Ideal Lattices - Preliminary Draft - Johannes Buchmann and Richard Lindner Technische Universität Darmstadt, Department of Computer Science Hochschulstraße 10, 64289 Darmstadt, Germany buchmann,rlindner@cdc.informatik.tu-darmstadt.de
Lattice-Based Identification Schemes Secure Under Active Attacks
Lattice-Based Identification Schemes Secure Under Active Attacks Vadim Lyubashevsky University of California, San Diego 9500 Gilman Drive, La Jolla, CA 92093-0404, USA vlyubash@cs.ucsd.edu Abstract. There
Chosen-Ciphertext Security from Subset Sum
Chosen-Ciphertext Security from Subset Sum Sebastian Faust 1, Daniel Masny 1, and Daniele Venturi 2 1 Horst-Görtz Institute for IT Security and Faculty of Mathematics, Ruhr-Universität Bochum, Bochum,
Computational complexity of lattice problems and cyclic lattices
Computational complexity of lattice problems and cyclic lattices Lenny Fukshansky Claremont McKenna College Undergraduate Summer Research Program ICERM - Brown University July 28, 2014 Euclidean lattices
1 Introduction An old folklore rooted in Brassard's paper [7] states that \cryptography" cannot be based on NPhard problems. However, what Brassard ha
![1 Introduction An old folklore rooted in Brassard's paper [7] states that \cryptography cannot be based on NPhard problems. However, what Brassard ha](/thumbs/90/102179828.jpg "1 Introduction An old folklore rooted in Brassard's paper [7] states that \cryptography cannot be based on NPhard problems. However, what Brassard ha")
On the possibility of basing Cryptography on the assumption that P 6= N P Oded Goldreich Department of Computer Science Weizmann Institute of Science Rehovot, Israel. oded@wisdom.weizmann.ac.il Sha Goldwasser
Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller
Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller Daniele Micciancio 1 Chris Peikert 2 1 UC San Diego 2 Georgia Tech April 2012 1 / 16 Lattice-Based Cryptography y = g x mod p m e mod N e(g a,
Open problems in lattice-based cryptography
University of Auckland, New Zealand Plan Goal: Highlight some hot topics in cryptography, and good targets for mathematical cryptanalysis. Approximate GCD Homomorphic encryption NTRU and Ring-LWE Multi-linear
Augmented Learning with Errors: The Untapped Potential of the Error Term
Augmented Learning with Errors: The Untapped Potential of the Error Term Rachid El Bansarkhani, Özgür Dagdelen, and Johannes Buchmann Technische Universität Darmstadt Fachbereich Informatik Kryptographie
Classical Hardness of Learning with Errors
Classical Hardness of Learning with Errors Zvika Brakerski Adeline Langlois Chris Peikert Oded Regev Damien Stehlé Abstract We show that the Learning with Errors (LWE) problem is classically at least as
Solving the Shortest Lattice Vector Problem in Time n
Solving the Shortest Lattice Vector Problem in Time.465n Xavier Pujol 1 and Damien Stehlé 1 Université de Lyon, Laboratoire LIP, CNRS-ENSL-INRIA-UCBL, 46 Allée d Italie, 69364 Lyon Cedex 07, France CNRS,
Upper Bound on λ 1. Science, Guangzhou University, Guangzhou, China 2 Zhengzhou University of Light Industry, Zhengzhou, China
Λ A Huiwen Jia 1, Chunming Tang 1, Yanhua Zhang 2 hwjia@gzhu.edu.cn, ctang@gzhu.edu.cn, and yhzhang@zzuli.edu.cn 1 Key Laboratory of Information Security, School of Mathematics and Information Science,
Solving BDD by Enumeration: An Update
Solving BDD by Enumeration: An Update Mingjie Liu, Phong Q. Nguyen To cite this version: Mingjie Liu, Phong Q. Nguyen. Solving BDD by Enumeration: An Update. Ed Dawson. CT-RSA 2013 - The Cryptographers
Lattice Signatures Without Trapdoors
Lattice Signatures Without Trapdoors Vadim Lyubashevsky INRIA / École Normale Supérieure Abstract. We provide an alternative method for constructing lattice-based digital signatures which does not use
Lecture 7 Limits on inapproximability
Tel Aviv University, Fall 004 Lattices in Computer Science Lecture 7 Limits on inapproximability Lecturer: Oded Regev Scribe: Michael Khanevsky Let us recall the promise problem GapCVP γ. DEFINITION 1
Improved Zero-knowledge Proofs of Knowledge for the ISIS Problem, and Applications
Improved Zero-knowledge Proofs of Knowledge for the ISIS Problem, and Applications San Ling 1, Khoa Nguyen 1, Damien Stehlé 2, Huaxiong Wang 1 1 Division of Mathematical Sciences, School of Physical and
Pseudorandom Knapsacks and the Sample Complexity of LWE Search-to- Decision Reductions
Pseudorandom Knapsacks and the Sample Complexity of LWE Search-to- Decision Reductions Crypto 2011 Daniele Micciancio Petros Mol August 17, 2011 1 Learning With Errors (LWE) secret public: integers n,
Lossy Trapdoor Functions and Their Applications
1 / 15 Lossy Trapdoor Functions and Their Applications Chris Peikert Brent Waters SRI International On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information
Notes for Lecture 15
COS 533: Advanced Cryptography Lecture 15 (November 8, 2017) Lecturer: Mark Zhandry Princeton University Scribe: Kevin Liu Notes for Lecture 15 1 Lattices A lattice looks something like the following.
Fully homomorphic encryption scheme using ideal lattices. Gentry s STOC 09 paper - Part II
Fully homomorphic encryption scheme using ideal lattices Gentry s STOC 09 paper - Part GGH cryptosystem Gentry s scheme is a GGH-like scheme. GGH: Goldreich, Goldwasser, Halevi. ased on the hardness of
Lecture 6: Lattice Trapdoor Constructions
Homomorphic Encryption and Lattices, Spring 0 Instructor: Shai Halevi Lecture 6: Lattice Trapdoor Constructions April 7, 0 Scribe: Nir Bitansky This lecture is based on the trapdoor constructions due to
Lattice Cryptography
CSE 206A: Lattice Algorithms and Applications Winter 2016 Lattice Cryptography Instructor: Daniele Micciancio UCSD CSE Lattice cryptography studies the construction of cryptographic functions whose security
Hardness of the Covering Radius Problem on Lattices
Hardness of the Covering Radius Problem on Lattices Ishay Haviv Oded Regev June 6, 2006 Abstract We provide the first hardness result for the Covering Radius Problem on lattices (CRP). Namely, we show
Algorithmic Problems for Metrics on Permutation Groups
Algorithmic Problems for Metrics on Permutation Groups V. Arvind and Pushkar S. Joglekar Institute of Mathematical Sciences C.I.T Campus,Chennai 600 113, India {arvind,pushkar}@imsc.res.in Abstract. Given
Some Sieving Algorithms for Lattice Problems
Foundations of Software Technology and Theoretical Computer Science (Bangalore) 2008. Editors: R. Hariharan, M. Mukund, V. Vinay; pp - Some Sieving Algorithms for Lattice Problems V. Arvind and Pushkar
Algorithms for ray class groups and Hilbert class fields
(Quantum) Algorithms for ray class groups and Hilbert class fields Sean Hallgren joint with Kirsten Eisentraeger Penn State 1 Quantum Algorithms Quantum algorithms for number theoretic problems: Factoring
Lattice Basis Reduction Part 1: Concepts
Lattice Basis Reduction Part 1: Concepts Sanzheng Qiao Department of Computing and Software McMaster University, Canada qiao@mcmaster.ca www.cas.mcmaster.ca/ qiao October 25, 2011, revised February 2012
Practical Lattice-Based Digital Signature Schemes
Practical Lattice-Based Digital Signature Schemes Howe, J., Poppelmann, T., O'Neill, M., O'Sullivan, E., & Guneysu, T. (2015). Practical Lattice-Based Digital Signature Schemes. ACM Transactions on Embedded
Zero-knowledge Identification based on Lattices with Low Communication Costs
Zero-knowledge Identification based on Lattices with Low Communication Costs Rosemberg Silva 1, Pierre-Louis Cayrel 2, Richard Lindner 3 1 State University of Campinas (UNICAMP) Institute of Computing
Asymptotically Efficient Lattice-Based Digital Signatures
Asymptotically Efficient Lattice-Based Digital Signatures Vadim Lyubashevsky 1 and Daniele Micciancio 2 1 IBM Research Zurich 2 University of California, San Diego Abstract. We present a general framework
Running head: IDEAL LATTICE CRYPTOGRAPHY 1. Ideal Lattice Cryptography: Escaping the Cryptopocalypse. Stephen Gillen. Georgia Institute of Technology
Running head: IDEAL LATTICE CRYPTOGRAPHY 1 Ideal Lattice Cryptography: Escaping the Cryptopocalypse Stephen Gillen Georgia Institute of Technology MATH 6122 Algebra II April 29, 2016 IDEAL LATTICE CRYPTOGRAPHY
Ring-SIS and Ideal Lattices
Ring-SIS and Ideal Lattices Noah Stephens-Davidowitz (for Vinod Vaikuntanathan s class) 1 Recalling h A, and its inefficiency As we have seen, the SIS problem yields a very simple collision-resistant hash
On Ideal Lattices and Learning with Errors Over Rings
On Ideal Lattices and Learning with Errors Over Rings Vadim Lyubashevsky Chris Peikert Oded Regev June 25, 2013 Abstract The learning with errors (LWE) problem is to distinguish random linear equations,
Post-Quantum Cryptography & Privacy. Andreas Hülsing
Post-Quantum Cryptography & Privacy Andreas Hülsing Privacy? Too abstract? How to achieve privacy? Under the hood... Public-key crypto ECC RSA DSA Secret-key crypto AES SHA2 SHA1... Combination of both
Lattices. A Lattice is a discrete subgroup of the additive group of n-dimensional space R n.
Lattices A Lattice is a discrete subgroup of the additive group of n-dimensional space R n. Lattices have many uses in cryptography. They may be used to define cryptosystems and to break other ciphers.
BEYOND POST QUANTUM CRYPTOGRAPHY
BEYOND POST QUANTUM CRYPTOGRAPHY Mark Zhandry Stanford University Joint work with Dan Boneh Classical Cryptography Post-Quantum Cryptography All communication stays classical Beyond Post-Quantum Cryptography
Lattice Signatures Without Trapdoors
Lattice Signatures Without Trapdoors Vadim Lyubashevsky INRIA / École Normale Supérieure Abstract. We provide an alternative method for constructing lattice-based digital signatures which does not use
Short Stickelberger Class Relations and application to Ideal-SVP
Short Stickelberger Class Relations and application to Ideal-SVP Ronald Cramer Léo Ducas Benjamin Wesolowski Leiden University, The Netherlands CWI, Amsterdam, The Netherlands EPFL, Lausanne, Switzerland
Parameter selection in Ring-LWE-based cryptography
Parameter selection in Ring-LWE-based cryptography Rachel Player Information Security Group, Royal Holloway, University of London based on joint works with Martin R. Albrecht, Hao Chen, Kim Laine, and
Quantum-resistant cryptography
Quantum-resistant cryptography Background: In quantum computers, states are represented as vectors in a Hilbert space. Quantum gates act on the space and allow us to manipulate quantum states with combination
A Framework to Select Parameters for Lattice-Based Cryptography
A Framework to Select Parameters for Lattice-Based Cryptography Nabil Alkeilani Alkadri, Johannes Buchmann, Rachid El Bansarkhani, and Juliane Krämer Technische Universität Darmstadt Department of Computer
Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors
Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert Alon Rosen November 26, 2006 Abstract We demonstrate an average-case problem which is as hard as finding γ(n)-approximate
Simple Lattice Trapdoor Sampling from a Broad Class of Distributions
Simple Lattice Trapdoor Sampling from a Broad Class of Distributions Vadim Lyubashevsky 1 and Daniel Wichs 2 1 Inria/ENS, Paris 2 Northeastern University Abstract. At the center of many lattice-based constructions
Asymptotically Efficient Lattice-Based Digital Signatures
Asymptotically Efficient Lattice-Based Digital Signatures Vadim Lyubashevsky and Daniele Micciancio University of California, San Diego La Jolla, CA 92093-0404, USA {vlyubash,daniele}@cs.ucsd.edu Abstract.
A Fast Phase-Based Enumeration Algorithm for SVP Challenge through y-sparse Representations of Short Lattice Vectors
A Fast Phase-Based Enumeration Algorithm for SVP Challenge through y-sparse Representations of Short Lattice Vectors Dan Ding 1, Guizhen Zhu 2, Yang Yu 1, Zhongxiang Zheng 1 1 Department of Computer Science
A Lattice-Based Batch Identification Scheme
A Lattice-Based Batch Identification Scheme Rosemberg Silva, Pierre-Louis Cayrel, Richard Lindner To cite this version: Rosemberg Silva, Pierre-Louis Cayrel, Richard Lindner. A Lattice-Based Batch Identification
Key Recovery for LWE in Polynomial Time
Key Recovery for LWE in Polynomial Time Kim Laine 1 and Kristin Lauter 2 1 Microsoft Research, USA kimlaine@microsoftcom 2 Microsoft Research, USA klauter@microsoftcom Abstract We discuss a higher dimensional
A SELECTION OF RECENT LATTICE-BASED SIGNATURE AND ENCRYPTION SCHEMES
t m Mathematical Publications DOI: 10.2478/v10127-012-0040-x Tatra Mt. Math. Publ. 53 (2012), 81 102 A SELECTION OF RECENT LATTICE-BASED SIGNATURE AND ENCRYPTION SCHEMES Rachid El Bansarkhani Daniel Cabarcas
Proxy Re-Encryption in a Stronger Security Model Extended from CT-RSA2012
Proxy Re-Encryption in a Stronger Security Model Extended from CT-RSA2012 Manh Ha Nguyen Tokyo Institute of Technology Toshiyuki Isshiki 1,2 and Keisuke Tanaka 2 1 NEC Corporation 2 Tokyo Institute of
Generating Shorter Bases for Hard Random Lattices
Generating Shorter Bases for Hard Random Lattices Joël Alwen New York University Chris Peikert Georgia Institute of Technology July 10, 2010 Abstract We revisit the problem of generating a hard random