10/04/18. P [P(x)] 1 negl(n).

Transcription

1 Mastemath, Sping 208 Into to Lattice lgs & Cypto Lectue 0 0/04/8 Lectues: D. Dadush, L. Ducas Scibe: K. de Boe Intoduction In this lectue, we will teat two main pats. Duing the fist pat we continue the poof that the SIS-function f is a one-way function by the two-to-one lemma. The second pat teats a new topic, still elated to cyptogaphy: a commitment scheme with SIS as undelying poblem. 2 eliminaies In all subseuent sections, we will use implicitly that eveything is paametized by n. m, poly(n), fo example. We will use the following notation x X, (x) fo So, [(x)] negl(n). x X Given any distibution D on X, we wite x D, (x) fo [(x)] negl(n). x D Note the implicit paametization in n. We call two distibutions, B on a finite set X statistically close, denoted s B, wheneve (, B) := 2 [ = x] [B = x] < negl(n). x X 3 One-Way function fom SIS (continued) In the pevious lectue notes, we defined the function f (x) = x mod. In this section, we ae going to pove that this function is actually a one-way function, when choosing the ight paametes. ccoding to the two-to-one lemma, we need to pove that fo cetain paametes fo almost all keys, the function f is two-to-one (o two-to-one). The most staightfowad stategy to pove that f is two-to-one is by using an uppe bound fo the coveing adius µ(λ ()). To obtain this, one could stat by bounding λ fom below, hence λ n fom above, and theefoe bounding the coveing adius. We will do this using duality and tansfeence theoems. (, Lemma Λ () = Λ ) T i.e. Λ () and Λ ( T ) ae dual lattices up to -scaling. Execise ove above lemma. Lemma 2 Let be pime., λ (Λ ()) O( n/m ). oof: Set S = {y + Z m y Z m and y B} fo the set of cosets in Z m. Then S (2B + ) m, and theefoe, fo any non-zeo vecto x Z n \ {0}, [ T x mod S] = S / m (2B + ) m m.

2 By the union bound, we have [λ (Λ ()) B] = [ x Z n s.t. T x + Z m S] Z n /Z n [ T x + Z m S] = S n m (2B + ) m n m. Choosing 2B + = 2 n/m n/m = O( n/m ) yields that λ (Λ ()) O( n/m ) with eo pobability 2 n. Lemma 3 Let = p k be a pime powe., λ (Λ ()) O( n/m ). oof: The shotest nonzeo lattice vecto y in Λ () is of the fom y = T x, with x Z n \pz n. Othewise, if x pz n, we could divide the vecto y by p to obtain a shote vecto. Fo any fixed x Z n \pz n, the vecto T x + Z m is a andom coset in Z m (fo andom ). Using the same set S = {y + Z m y Z m and y B} as befoe, we obtain [λ (Λ ()) B] = [ x Z n \pz n s.t. T x + Z m S] Z n \pz n [ T x + Z m S] = ( n (/p) n ) S m (2B + ) m n m. Theefoe, the same bound applies as in Lemma 2. Fom tansfeence, we know that λ (Λ)µ(Λ ) m. pplying both Lemma and 2, we obtain : µ(λ ()) m/λ (Λ ()) O(m n/m ). Fo any lattice Λ (with dimension ) and any x span(λ) it holds that 4µ(Λ) B2 n (Λ + x) 2. So, fo Λ = Λ (), thee exists a x x + Λ () such that x = x and x 4µ(Λ). This ewite as f (x ) = f (x) fo x = x. Theefoe, fo any x Z m, thee exists a x = x such that f (x ) = f (x) and x O(m n/m ). Fom this, we obtain the following. Theoem 4 The SIS-based function family f : Z n m { β,..., β} n Z m with paamete β = O(m n/m ) is a one-way function, assuming that SIS n,m,,β is had. 4 Commitment scheme 4. Intoduction commitment potocol is one of the most basic cyptogaphic potocols. s often in cyptogaphy, such a potocol is explained best in the context of two playes, two people that want to inteact which each othe in some sense. In this case, the playes have diffeent oles. One of the playes is the so-called committe, which we call Cody, and the othe is the veifie, called Vea. The committe Cody has the following ole. He wants to bind himself to a cetain decision, but doesn t want to eveal this decision ight away, but late. Note that this binding means that Cody can t change the decision made. The ole of the veifie Vea is moe abstact; he task is to check whethe the committe Cody eally plays fai game, e.g. that he doesn t change his decision. eople often imagine these oles in the following context. The committe Cody and veifie Vea ae geogaphically fa apat. Cody wites his decision on pape, puts the pape in a locke 2

3 Committe Vei f ie Commitment phase c Revelation phase, m Veification phase (c, ) ok? Figue : Schematic desciption of a commitment scheme safe, locks the safe, and sends the safe to Vea, while keeping the key of the locke with himself. Vea now eceives a closed locke, whee she doesn t have the key of. Theefoe Vea cannot see the decision of Cody. When Cody wants to eveal his decision, he sends the key to Vea, allowing he to open the locke and check the decision. In the above stoy, Cody can t change his decision, and Vea can t see the decision befoe Cody sends he the key. In a eal-life setting, people don t send safe lockes, but use cyptogaphy. How does a commitment scheme look like, cyptogaphically? In figue, a vey boad desciption of a commitment scheme is depicted. Geneally, thee ae thee phases; the commitment phase, whee the committe commits to his decision, the evelation phase, whee the committe eveals his decision, and the veification phase, in which the veifie checks whethe the committe played fai game. In the commitment phase, the committe Cody sends his commitment sting c. The idea is that the veifie Vea cannot lean anything fom c about the decision of Cody. Late, when Cody wants to eveal his decision, he sends the sting and his decision m to Vea. With this exta infomation, Vea can check whethe Cody eally committed to decision m in the commitment phase. The idea is that the commitment c could only eveal the decision m, and no othe decision. This is called binding; in a late section this notion is made pecise. 4.2 Definition In the following definition, we denote by K a space of public keys, by C a commitment sting space and by R a space of andom stings with distibution D. The sta in {} is the Kleene sta. Definition 5 (Commitment scheme) commitment scheme is a tiple of algoithms: Keygen : {} K, the (public) key geneation function. It has (fomally) as input a sting of the fom n, allowing the geneation function to use a poly(n) amount of time. Commit : K {0, } R C, the commitment function. It has as input a public key, a bit (to which the committe commits) and some andom sting, geneated accoding to the distibution D. The output is an element in the commitment sting space. 3

4 Veif : K {0, } R C {0, }, the veifying function. It has as input a public key, a bit (which the veifie ties to veify), a sting fom R and the commitment sting. Definition 6 commitment scheme is called coect if pk KeyGen( n ), µ, it holds that Veif(pk, µ,, c) =, whee c = Commit(pk, µ, ). statistically hiding if pk KeyGen( n ) holds Commit(pk, 0, ) s Commit(pk,, ) ove the distibution D on R. computationally binding if pobabilistic polynomial time algoithms and pk KeyGen( n ) holds [ Veif(pk, 0, 0, c) = and Veif(pk, 0,, c) = 0 ( 0,, c) (pk) ] negl(n) In othe wods, the statistically hiding popety ensues that, even with infinite computational essouces, it is impossible to distinguish a commitment of 0 fom a commitment of given only the public key (but not the andomness ). The computationnally binding popety ensues that, with limited comutaional essouces, it is impossible to poduce a commitment that can be opened to both values 0 and : the pove can not change his mind afte having povided the commitment. 4.3 Constuction of a commitment scheme fom SIS n example of a lattice-based commitment scheme can be obtained by consideing SIS-elated function f = x mod. One obtains such a scheme by putting the tiple of functions Keygen, Commit and Veif as follows. The key geneating function KeyGen takes as input n and outputs a matix (that seves as public key) =: pk unifomly andom fom Z n m, whee m is a paamete whose value will be decided late. Fo the andom set R and its distibution D, put R = Z m and D = D Z m,σ the discete Gaussian distibution on Z m, whee σ poly(n). The commitment function is defined as follows: Commit(pk =, µ, ) := mod, whee µ {0, }. Hee, is the vecto that is obtained by concatenating; (µ ). To veify the commitment on input (pk, µ,, c), check whethe = c mod and β. If this is both tue, set Veif(pk, µ,, c) =, othewise 0. Lemma 7 Fo appopiate paametes, above scheme is coect, statistically hiding and computationally binding, assuming that the SIS n,m,,2β is had. oof: (Coectness) Choose β poly(n) in such a way that σ β. Then, by constuction, = c mod, and with ovewhelming pobability (tail bound of the discete Gaussian distibution), β and theefoe (m ) β. 4

5 (Computationally binding) Suppose a pobabilistic polynomial time algoithm is able to 0 find (on input ) a tiple ( 0,, c) such that = c = mod with nonnegligible pobability. Then the vecto v = is a SISn,m,,2β solution. Theefoe, 0 0 this advesay solves SIS with these paametes, which is a contadiction, as we assumed that this was had. (Statistically hiding) The goal is to pove that = pk KeyGen( n ) holds Commit(pk, 0, ) s Commit(pk,, ), i.e., that the statistical distance is negligible. Decompose into a fist column a 0 and the est of the matix : = (a 0 ). Ou aim is to pove that = 2 [ = c] [ + a 0 = c] negl(n). c C Define Λ c If σ η ε (Λ c = {x Z m x c mod }. Then, by constuction DZ m,σ [ = c] = ρ σ(λ c ( )) ρ σ (Z m ) ()), the smoothing paamete of Λ c ( ), then we know that (infomally) ( ) is the same, up to a facto the cumulative weight of the Gaussians of any coset of Λ c ( ± ε) [Lectue 8, Lemma 5]. In paticula, ρ σ (Λ (c a 0) ( )) [ ε, + ε] ρ σ (Λ c ( )). Theefoe = 2 [ = c] [ + a 0 = c] = c C 2ρ σ (Z m ) c C ρ σ (Λ (c a 0) ( )) ρ σ (Λ c ( )) 2ρ σ (Z m ) c C ε ρ σ (Λ c ( )) ε/2 In ode to know the paamete choice fo σ, we need to estimate η ε (Λ c ()) with ε negl(n). This is because σ needs to be lage than the smoothing paamete. Execise 2 ovide a lowe bound fo η ε (Λ c ()), using Lemma 2 fom this lectue, and [Lectue 7, Theoem 4]. 5