Analyzing Blockwise Lattice Algorithms using Dynamical Systems

Transcription

1 Analyzing Blockwise Lattice Algorithms using Dynamical Systems Guillaume Hanrot, Xavier Pujol, Damien Stehlé ENS Lyon, LIP (CNRS ENSL INRIA UCBL - ULyon) Analyzing Blockwise Lattice Algorithms using Dynamical Systems 1/16

2 Context Lattices provide exponentially hard problems suitable for public key cryptography. Best known attacks on lattice-based cryptosystems rely on blockwise lattice reduction algorithms. Understanding these algorithms helps assessing the security of LBC. The most widely used reduction algorithm is BKZ. No reasonable time bound was known about BKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 2/16

3 Context Lattices provide exponentially hard problems suitable for public key cryptography. Best known attacks on lattice-based cryptosystems rely on blockwise lattice reduction algorithms. Understanding these algorithms helps assessing the security of LBC. The most widely used reduction algorithm is BKZ. No reasonable time bound was known about BKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 2/16

4 Context Lattices provide exponentially hard problems suitable for public key cryptography. Best known attacks on lattice-based cryptosystems rely on blockwise lattice reduction algorithms. Understanding these algorithms helps assessing the security of LBC. The most widely used reduction algorithm is BKZ. No reasonable time bound was known about BKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 2/16

5 Context Lattices provide exponentially hard problems suitable for public key cryptography. Best known attacks on lattice-based cryptosystems rely on blockwise lattice reduction algorithms. Understanding these algorithms helps assessing the security of LBC. The most widely used reduction algorithm is BKZ. No reasonable time bound was known about BKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 2/16

6 Context Lattices provide exponentially hard problems suitable for public key cryptography. Best known attacks on lattice-based cryptosystems rely on blockwise lattice reduction algorithms. Understanding these algorithms helps assessing the security of LBC. The most widely used reduction algorithm is BKZ. No reasonable time bound was known about BKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 2/16

7 Contributions We give the first worst-case analysis of BKZ. We introduce a new BKZ model. It gives new tools for understanding lattice algorithms. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 3/16

8 Contributions We give the first worst-case analysis of BKZ. We introduce a new BKZ model. It gives new tools for understanding lattice algorithms. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 3/16

9 Contributions We give the first worst-case analysis of BKZ. We introduce a new BKZ model. It gives new tools for understanding lattice algorithms. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 3/16

10 Lattices a 1 a 2 (SVP) Analyzing Blockwise Lattice Algorithms using Dynamical Systems 4/16

11 Lattices b 1 b 2 (SVP)Lattice reduction(svp) Analyzing Blockwise Lattice Algorithms using Dynamical Systems 4/16

12 Lattices b 1 b 2 (SVP)Determinant(SVP) Analyzing Blockwise Lattice Algorithms using Dynamical Systems 4/16

13 Lattices b 1 b 2 Hermite factor of B: HF(b 1,...,b n ) = b 1 (detl) 1/n Goal of lattice reduction: find a basis with small HF. If b 1 is a shortest vector 0, then HF(b 1,...,b n ) γ n, with γ n = Hermite constant n. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 4/16

14 Lattices b 1 b 2 Hermite factor of B: HF(b 1,...,b n ) = b 1 (detl) 1/n Goal of lattice reduction: find a basis with small HF. If b 1 is a shortest vector 0, then HF(b 1,...,b n ) γ n, with γ n = Hermite constant n. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 4/16

15 Lattices b 1 b 2 Hermite factor of B: HF(b 1,...,b n ) = b 1 (detl) 1/n Goal of lattice reduction: find a basis with small HF. If b 1 is a shortest vector 0, then HF(b 1,...,b n ) γ n, with γ n = Hermite constant n. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 4/16

16 Hierarchy of lattice reductions in dimension n x i = log b i for i n (b 1,...,b n = Gram-Schmidt basis of B). Analyzing Blockwise Lattice Algorithms using Dynamical Systems 5/16

17 Hierarchy of lattice reductions in dimension n x i = log b i for i n (b 1,...,b n = Gram-Schmidt basis of B). HKZ Hermite-Korkine-Zolorareff BKZ β Block Korkine-Zolotareff LLL Lenstra-Lenstra-Lovász x 1 x 2 x 3 x 4 x 5 x 6 HF: γ n (γ β ) n 2β (γ 2 ) n 2 Time: 2 O(n) 2 O(β)? Poly(n) Analyzing Blockwise Lattice Algorithms using Dynamical Systems 5/16

18 Hierarchy of lattice reductions in dimension n x i = log b i for i n (b 1,...,b n = Gram-Schmidt basis of B). HKZ Hermite-Korkine-Zolorareff BKZ β Block Korkine-Zolotareff LLL Lenstra-Lenstra-Lovász x 1 x 2 x 3 x 4 x 5 x 6 x 6 HF: γ n (γ β ) n 2β (γ 2 ) n 2 Time: 2 O(n) 2 O(β)? Poly(n) x 1 x 2 x 3 x 4 x 5 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 5/16

19 Hierarchy of lattice reductions in dimension n x i = log b i for i n (b 1,...,b n = Gram-Schmidt basis of B). HKZ Hermite-Korkine-Zolorareff BKZ β Block Korkine-Zolotareff LLL Lenstra-Lenstra-Lovász x 1 x 2 x 3 x 4 x 5 x 6 x 1 x 2 x 3 x 4 x 5 x 6 x 1 x 2 x 3 x 4 x 5 x 6 HF: γ n (γ β ) n 2β (γ 2 ) n 2 Time: 2 O(n) 2 O(β)? Poly(n) Analyzing Blockwise Lattice Algorithms using Dynamical Systems 5/16

20 Known results on blockwise algorithms BKZ Schnorr (1987): first hierarchies between LLL and HKZ. Schnorr and Euchner (1994): algorithm for BKZ-reduction. Gama and Nguyen (2008): BKZ behaves badly when the block size is 25. Other reductions in time 2 O(β) Poly(n): Schnorr (1987) : Semi-block-2β-reduction. Gama et al. (2006): Block-Rankin-reduction. Gama and Nguyen (2008): Slide-reduction....but BKZ remains the most efficient in practice. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 6/16

21 Known results on blockwise algorithms BKZ Schnorr (1987): first hierarchies between LLL and HKZ. Schnorr and Euchner (1994): algorithm for BKZ-reduction. Gama and Nguyen (2008): BKZ behaves badly when the block size is 25. Other reductions in time 2 O(β) Poly(n): Schnorr (1987) : Semi-block-2β-reduction. Gama et al. (2006): Block-Rankin-reduction. Gama and Nguyen (2008): Slide-reduction....but BKZ remains the most efficient in practice. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 6/16

22 Known results on blockwise algorithms BKZ Schnorr (1987): first hierarchies between LLL and HKZ. Schnorr and Euchner (1994): algorithm for BKZ-reduction. Gama and Nguyen (2008): BKZ behaves badly when the block size is 25. Other reductions in time 2 O(β) Poly(n): Schnorr (1987) : Semi-block-2β-reduction. Gama et al. (2006): Block-Rankin-reduction. Gama and Nguyen (2008): Slide-reduction....but BKZ remains the most efficient in practice. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 6/16

23 Known results on blockwise algorithms BKZ Schnorr (1987): first hierarchies between LLL and HKZ. Schnorr and Euchner (1994): algorithm for BKZ-reduction. Gama and Nguyen (2008): BKZ behaves badly when the block size is 25. Other reductions in time 2 O(β) Poly(n): Schnorr (1987) : Semi-block-2β-reduction. Gama et al. (2006): Block-Rankin-reduction. Gama and Nguyen (2008): Slide-reduction....but BKZ remains the most efficient in practice. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 6/16

24 Known results on blockwise algorithms BKZ Schnorr (1987): first hierarchies between LLL and HKZ. Schnorr and Euchner (1994): algorithm for BKZ-reduction. Gama and Nguyen (2008): BKZ behaves badly when the block size is 25. Other reductions in time 2 O(β) Poly(n): Schnorr (1987) : Semi-block-2β-reduction. Gama et al. (2006): Block-Rankin-reduction. Gama and Nguyen (2008): Slide-reduction....but BKZ remains the most efficient in practice. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 6/16

25 BKZ Algorithm (BKZ β, modified version) Input: B of dimension n. Repeat... times For i from 1 to n β +1 do Size-reduce B. HKZ-reduce a projection of the block (b i,...,b i+β 1 ). Report the transformation on B. Termination? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 7/16

26 BKZ Algorithm (BKZ β, modified version) Input: B of dimension n. Repeat... times For i from 1 to n β +1 do Size-reduce B. HKZ-reduce a projection of the block (b i,...,b i+β 1 ). Report the transformation on B. Termination? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 7/16

27 BKZ Algorithm (BKZ β, modified version) Input: B of dimension n. Repeat... times For i from 1 to n β +1 do Size-reduce B. HKZ-reduce a projection of the block (b i,...,b i+β 1 ). Report the transformation on B. Termination? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 7/16

28 Progress made during the execution of BKZ Quality of BKZ output BKZ Hermite factor ^ (1 / n) Number of tours Experience on 64 LLL-reduced knapsack-like matrices (n = 108, β = 24). Analyzing Blockwise Lattice Algorithms using Dynamical Systems 8/16

29 Progress made during the execution of BKZ Quality of BKZ output BKZ Hermite factor ^ (1 / n) Number of tours Experience on 64 LLL-reduced knapsack-like matrices (n = 108, β = 24). Analyzing Blockwise Lattice Algorithms using Dynamical Systems 8/16

30 Our result γ β = Hermite constant β. L a lattice with basis (b 1,...,b n ). Theorem ( n 3 After O β 2 ( log n ǫ +loglogmax b i (detl) 1/n BKZ β returns a basis C of L such that: HF(C) (1+ǫ)γ β n 1 2(β 1) )) calls to HKZ β, Analyzing Blockwise Lattice Algorithms using Dynamical Systems 9/16

31 Sandpile model We consider only x i = log bi for i n. We assume that HKZ-reductions correspond to a fixed pattern. The information on the initial x i s fully determines the x i s after a call to HKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 10/16

32 Sandpile model We consider only x i = log bi for i n. We assume that HKZ-reductions correspond to a fixed pattern. The information on the initial x i s fully determines the x i s after a call to HKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 10/16

33 Sandpile model We consider only x i = log bi for i n. We assume that HKZ-reductions correspond to a fixed pattern. The information on the initial x i s fully determines the x i s after a call to HKZ. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 10/16

34 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

35 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

36 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

37 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

38 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

39 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

40 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

41 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 Analyzing Blockwise Lattice Algorithms using Dynamical Systems 11/16

42 Matrix interpretation X = (x 1,...,x n ) T X 0.5 A 1 X X 1 A 1 X +Γ 1 X 2 A 2 X 1 +Γ 2... X k = A k X k +Γ k with k = n β +1 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 A full tour: X AX +Γ Analyzing Blockwise Lattice Algorithms using Dynamical Systems 12/16

43 Matrix interpretation x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 X = (x 1,...,x n ) T X 0.5 A 1 X X 1 A 1 X +Γ 1 X 2 A 2 X 1 +Γ 2... X k = A k X k +Γ k with k = n β +1 A full tour: X AX +Γ Analyzing Blockwise Lattice Algorithms using Dynamical Systems 12/16

44 Matrix interpretation x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 X = (x 1,...,x n ) T X 0.5 A 1 X X 1 A 1 X +Γ 1 X 2 A 2 X 1 +Γ 2... X k = A k X k +Γ k with k = n β +1 A full tour: X AX +Γ Analyzing Blockwise Lattice Algorithms using Dynamical Systems 12/16

45 Matrix interpretation X = (x 1,...,x n ) T X 0.5 A 1 X X 1 A 1 X +Γ 1 X 2 A 2 X 1 +Γ 2... X k = A k X k +Γ k with k = n β +1 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 A full tour: X AX +Γ Analyzing Blockwise Lattice Algorithms using Dynamical Systems 12/16

46 Matrix interpretation X = (x 1,...,x n ) T X 0.5 A 1 X X 1 A 1 X +Γ 1 X 2 A 2 X 1 +Γ 2... X k = A k X k +Γ k with k = n β +1 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 A full tour: X AX +Γ Analyzing Blockwise Lattice Algorithms using Dynamical Systems 12/16

47 Matrix interpretation X = (x 1,...,x n ) T X 0.5 A 1 X X 1 A 1 X +Γ 1 X 2 A 2 X 1 +Γ 2... X k = A k X k +Γ k with k = n β +1 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 A full tour: X AX +Γ Analyzing Blockwise Lattice Algorithms using Dynamical Systems 12/16

48 Quality of the output Method: study the fixed point of: X = AX +Γ The β last x i s have the shape of an HKZ-reduced basis. Asymptotically, line of slope logγ β β 1. x i O((logβ) 2 ) Corresponds to a Hermite factor close to γ n 1 2(β 1) β. i Analyzing Blockwise Lattice Algorithms using Dynamical Systems 13/16

49 Quality of the output Method: study the fixed point of: X = AX +Γ The β last x i s have the shape of an HKZ-reduced basis. Asymptotically, line of slope logγ β β 1. (n β) logγ β β 1 x i O((logβ) 2 ) Corresponds to a Hermite factor close to γ n 1 2(β 1) β. i Analyzing Blockwise Lattice Algorithms using Dynamical Systems 13/16

50 Quality of the output Method: study the fixed point of: X = AX +Γ The β last x i s have the shape of an HKZ-reduced basis. Asymptotically, line of slope logγ β β 1. (n β) logγ β β 1 x i O((logβ) 2 ) Corresponds to a Hermite factor close to γ n 1 2(β 1) β. i Analyzing Blockwise Lattice Algorithms using Dynamical Systems 13/16

51 Fast convergence Dynamical system: X AX +Γ Method: study of the eigenvalues of A T A. Result: the largest eigenvalue of A T A smaller than 1 is 1 1 β 2 2 n 2. X X decreases by a constant factor every n2 β 2 tours. leads to the claimed complexity bound. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 14/16

52 Fast convergence Dynamical system: X AX +Γ Method: study of the eigenvalues of A T A. Result: the largest eigenvalue of A T A smaller than 1 is 1 1 β 2 2 n 2. X X decreases by a constant factor every n2 β 2 tours. leads to the claimed complexity bound. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 14/16

53 Fast convergence Dynamical system: X AX +Γ Method: study of the eigenvalues of A T A. Result: the largest eigenvalue of A T A smaller than 1 is 1 1 β 2 2 n 2. X X decreases by a constant factor every n2 β 2 tours. leads to the claimed complexity bound. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 14/16

54 From the model to the real algorithm The results from the previous section cannot be used directly. By averaging the x i s, a rigorous adaptation becomes possible. Working on the averages suffices to get the result. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 15/16

55 From the model to the real algorithm The results from the previous section cannot be used directly. By averaging the x i s, a rigorous adaptation becomes possible. Working on the averages suffices to get the result. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 15/16

56 From the model to the real algorithm The results from the previous section cannot be used directly. By averaging the x i s, a rigorous adaptation becomes possible. Working on the averages suffices to get the result. Analyzing Blockwise Lattice Algorithms using Dynamical Systems 15/16

57 Conclusion First analysis of BKZ. New methodology for analysing blockwise algorithms. Better strategies for reducing? The worst-case analysis does not fully explains the practical behaviour. Predictive model? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 16/16

58 Conclusion First analysis of BKZ. New methodology for analysing blockwise algorithms. Better strategies for reducing? The worst-case analysis does not fully explains the practical behaviour. Predictive model? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 16/16

59 Conclusion First analysis of BKZ. New methodology for analysing blockwise algorithms. Better strategies for reducing? The worst-case analysis does not fully explains the practical behaviour. Predictive model? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 16/16

60 Conclusion First analysis of BKZ. New methodology for analysing blockwise algorithms. Better strategies for reducing? The worst-case analysis does not fully explains the practical behaviour. Predictive model? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 16/16

61 Conclusion First analysis of BKZ. New methodology for analysing blockwise algorithms. Better strategies for reducing? The worst-case analysis does not fully explains the practical behaviour. Predictive model? Analyzing Blockwise Lattice Algorithms using Dynamical Systems 16/16