Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors

Transcription

1 1 / 15 Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert 1 Alon Rosen 2 1 SRI International 2 Harvard SEAS IDC Herzliya STOC 2007

2 2 / 15 Worst-case versus average-case complexity Lattices are an intriguing case study: Believed hard in the worst case Worst-case / average-case reductions

3 2 / 15 Worst-case versus average-case complexity Lattices are an intriguing case study: Believed hard in the worst case Worst-case / average-case reductions This Talk... Not (exactly) about crypto Special, natural class of algebraic lattices Very tight worst-case/average-case reductions Much tighter than known for general lattices Distinctions between decision and search Many open problems

4 3 / 15 Lattices Let B = {b 1,..., b n } R n be linearly independent. The n-dim lattice L having basis B is: L = n (Z b i ) i=1 b 2 b 1

5 3 / 15 Lattices Let B = {b 1,..., b n } R n be linearly independent. The n-dim lattice L having basis B is: L = n (Z b i ) i=1 b 2 b 1 P Fundamental region: Parallelepiped P spanned by b i s.

6 3 / 15 Lattices Let B = {b 1,..., b n } R n be linearly independent. The n-dim lattice L having basis B is: L = n (Z b i ) i=1 λ 1 b 2 b 1 P Fundamental region: Parallelepiped P spanned by b i s. Minimum distance: λ 1 = length of shortest nonzero v L.

7 3 / 15 Lattices Let B = {b 1,..., b n } R n be linearly independent. The n-dim lattice L having basis B is: L = n (Z b i ) i=1 λ 1 b 2 b 1 P Fundamental region: Parallelepiped P spanned by b i s. Minimum distance: λ 1 = length of shortest nonzero v L. Minkowski s Theorem λ 1 n vol(p) 1/n (Non-constructive, non-algorithmic proof... )

8 4 / 15 Shortest Vector Problem (SVP) Approximation factor γ = γ(n). Decision: Given basis, distinguish λ 1 1 from λ 1 > γ.

9 4 / 15 Shortest Vector Problem (SVP) Approximation factor γ = γ(n). Decision: Given basis, distinguish λ 1 1 from λ 1 > γ. Search: Given basis, find nonzero v L such that v γ λ 1.

10 4 / 15 Shortest Vector Problem (SVP) Approximation factor γ = γ(n). Decision: Given basis, distinguish λ 1 1 from λ 1 > γ. Search: Given basis, find nonzero v L such that v γ λ 1. Hardness Almost-polynomial factors γ(n) [Ajt,Mic,Kho,HaRe]

11 Shortest Vector Problem (SVP) Approximation factor γ = γ(n). Decision: Given basis, distinguish λ 1 1 from λ 1 > γ. Search: Given basis, find nonzero v L such that v γ λ 1. Hardness Almost-polynomial factors γ(n) [Ajt,Mic,Kho,HaRe] Algorithms for SVP γ γ(n) 2 n approximation in poly-time [LLL] Can trade-off running time/approximation [Sch,AKS] 4 / 15

12 5 / 15 Worst-Case/Average-Case Connections [Ajtai,... ] For some γ(n) = poly(n) ( connection factor ): SVP γ hard in the worst case problems hard on the average

13 Worst-Case/Average-Case Connections [Ajtai,... ] For some γ(n) = poly(n) ( connection factor ): SVP γ hard in the worst case problems hard on the average Cryptographic Applications One-way & collision-resistant functions [Ajtai,GGH,... ] Public-key encryption [AjtaiDwork,Regev] 5 / 15

14 5 / 15 Worst-Case/Average-Case Connections [Ajtai,... ] For some γ(n) = poly(n) ( connection factor ): SVP γ hard in the worst case problems hard on the average Cryptographic Applications One-way & collision-resistant functions [Ajtai,GGH,... ] Public-key encryption [AjtaiDwork,Regev] Optimizing the Connection Factor γ Interesting to characterize complexity Important for crypto due to time/accuracy tradeoff Current best γ(n) n [MicciancioRegev]

15 6 / 15 This Work: Ideal Lattices Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field.

16 6 / 15 This Work: Ideal Lattices Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. Our interest: number fields with small root discriminant.

17 6 / 15 This Work: Ideal Lattices Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. Our interest: number fields with small root discriminant. SVP on Ideal Lattices Well-known bottleneck in number theory algorithms: Ideal reduction, unit & class group computation,...

18 6 / 15 This Work: Ideal Lattices Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. Our interest: number fields with small root discriminant. SVP on Ideal Lattices Well-known bottleneck in number theory algorithms: Ideal reduction, unit & class group computation,... Decision-SVP is easy to approximate: λ 1 Minkowski bound. Not NP-hard!

19 6 / 15 This Work: Ideal Lattices Ideal lattices: special class from algebraic number theory. Ideals in the ring of integers of a number field. Our interest: number fields with small root discriminant. SVP on Ideal Lattices Well-known bottleneck in number theory algorithms: Ideal reduction, unit & class group computation,... Decision-SVP is easy to approximate: λ 1 Minkowski bound. Not NP-hard! Search-SVP appears hard, despite structure. Best known algorithms [LLL,Sch,AKS].

20 7 / 15 Our Results Complexity of Ideal Lattices 1 Connection factors as low as γ = log n. Based on search-svp. (Decision is easy.) For SVP in any l p norm. (Stay for CCC.) Classic win-win situation. 2 Relations among problems on ideal lattices (SVP, CVP).

21 Our Results Complexity of Ideal Lattices 1 Connection factors as low as γ = log n. Based on search-svp. For SVP in any l p norm. (Decision is easy.) (Stay for CCC.) Classic win-win situation. 2 Relations among problems on ideal lattices (SVP, CVP). Subtleties No efficient constructions of best number fields (yet). Non-uniformity (preprocessing) in reductions. Crypto is tricky. Many interesting open problems! 7 / 15

22 8 / 15 Other Special Classes of Lattices 1 Unique shortest vector: One-way/CR functions [Ajtai,GGH] Public-key encryption [AjtaiDwork,Regev]

23 8 / 15 Other Special Classes of Lattices 1 Unique shortest vector: One-way/CR functions [Ajtai,GGH] Public-key encryption [AjtaiDwork,Regev] 2 Cyclic lattices: Efficient & compact OWFs [Micciancio] Collision-resistant hashing [PeikertRosen,LyubashevskyMicciancio]

24 8 / 15 Other Special Classes of Lattices 1 Unique shortest vector: One-way/CR functions [Ajtai,GGH] Public-key encryption [AjtaiDwork,Regev] 2 Cyclic lattices: Efficient & compact OWFs [Micciancio] Collision-resistant hashing [PeikertRosen,LyubashevskyMicciancio] Structure used for functionality & efficiency. Connection factors γ n or more.

25 9 / 15 Worst-to-Average Reduction [Ajtai,... ] Average-Case Problem For uniform a 1,..., a m Z n mod q, find short nonzero z Z m : zi a i = 0 mod q.

26 9 / 15 Worst-to-Average Reduction [Ajtai,... ] Average-Case Problem For uniform a 1,..., a m Z n mod q, find short nonzero z Z m : zi a i = 0 mod q. Reduction 1 Sample offset vectors i R n, derive uniform a i s 2 Get short solution z Z m 3 Output ( z i i) L

27 9 / 15 Worst-to-Average Reduction [Ajtai,... ] Average-Case Problem For uniform a 1,..., a m Z n mod q, find short nonzero z Z m : zi a i = 0 mod q. Reduction 1 Sample offset vectors i R n, derive uniform a i s 2 Get short solution z Z m 3 Output ( z i i) L

28 9 / 15 Worst-to-Average Reduction [Ajtai,... ] Average-Case Problem For uniform a 1,..., a m Z n mod q, find short nonzero z Z m : zi a i = 0 mod q. Reduction 1 Sample offset vectors i R n, derive uniform a i s 2 Get short solution z Z m 3 Output ( z i i) L

29 9 / 15 Worst-to-Average Reduction [Ajtai,... ] Average-Case Problem For uniform a 1,..., a m Z n mod q, find short nonzero z Z m : zi a i = 0 mod q. Reduction 1 Sample offset vectors i R n, derive uniform a i s 2 Get short solution z Z m 3 Output ( z i i) L

30 9 / 15 Worst-to-Average Reduction [Ajtai,... ] Average-Case Problem For uniform a 1,..., a m Z n mod q, find short nonzero z Z m : zi a i = 0 mod q. Reduction 1 Sample offset vectors i R n, derive uniform a i s 2 Get short solution z Z m 3 Output ( z i i) L Connection Factor Size of solution z Z m Lengths of offset vectors i

31 10 / 15 Our Approach Replace 1-dim integers Z with n-dim integers O K. O K = ring of algebraic integers in number field K of degree n.

32 10 / 15 Our Approach Replace 1-dim integers Z with n-dim integers O K. O K = ring of algebraic integers in number field K of degree n. Has + and, absolute value,...

33 10 / 15 Our Approach Replace 1-dim integers Z with n-dim integers O K. O K = ring of algebraic integers in number field K of degree n. Has + and, absolute value,... Is an n-dim lattice under K s canonical embedding. Z 0 O K

34 10 / 15 Our Approach Replace 1-dim integers Z with n-dim integers O K. O K = ring of algebraic integers in number field K of degree n. Has + and, absolute value,... Is an n-dim lattice under K s canonical embedding. Before After Worst-case object lattice in R n : ideal in O K : (Z bi ) for b i R n (OK b i ) for b i O K

35 10 / 15 Our Approach Replace 1-dim integers Z with n-dim integers O K. O K = ring of algebraic integers in number field K of degree n. Has + and, absolute value,... Is an n-dim lattice under K s canonical embedding. Before After Worst-case object lattice in R n : ideal in O K : (Z bi ) for b i R n (OK b i ) for b i O K for a i Z n mod q for a i O K mod q Avg-case problem find small z i Z: find small z i O K : zi a i = 0 mod q zi a i = 0 mod q

36 11 / 15 Improving the Reduction Replace Z with O K. Use K having constant root discriminant (as function of dim n).

37 11 / 15 Improving the Reduction Replace Z with O K. Use K having constant root discriminant (as function of dim n). 1. Size of solution z Before n log n After log n 2. Length of offsets n λ 1 λ 1

38 11 / 15 Improving the Reduction Replace Z with O K. Use K having constant root discriminant (as function of dim n). 1. Size of solution z Before n log n After log n 2. Length of offsets n λ 1 λ 1 1 Why shorter solutions? O K is much denser than Z.

39 11 / 15 Improving the Reduction Replace Z with O K. Use K having constant root discriminant (as function of dim n). 1. Size of solution z Before n log n After log n 2. Length of offsets n λ 1 λ 1 1 Why shorter solutions? O K is much denser than Z. 2 Why shorter offsets? Ideal lattice primal & dual have (optimally) large λ 1.

40 Crash Course in Algebraic Number Theory 12 / 15

41 Crash Course in Algebraic Number Theory 12 / 15

42 Pretty Pictures: Ideal Lattices 13 / 15

43 Pretty Pictures: Ideal Lattices 13 / 15

44 Pretty Pictures: Ideal Lattices 13 / 15

45 13 / 15 Pretty Pictures: Ideal Lattices Root discriminant D K = (fundamental volume) 2/n

46 13 / 15 Pretty Pictures: Ideal Lattices Root discriminant D K = (fundamental volume) 2/n n p DK

47 x y = 2 n p DK Pretty Pictures: Ideal Lattices Root discriminant D K = (fundamental volume) 2/n x y = 1 x y = 1 13 / 15

48 x y = 2 n p DK Pretty Pictures: Ideal Lattices Root discriminant D K = (fundamental volume) 2/n Minimum distance λ 1 easy to estimate x y = 1 x y = 1 n 13 / 15

49 13 / 15 Pretty Pictures: Ideal Lattices Root discriminant D K = (fundamental volume) 2/n Minimum distance λ 1 easy to estimate Same for dual lattice short offsets x y = 2 x y = 1 x y = 1 n n p DK

50 14 / 15 Shorter Average-Case Solutions O K is much denser than Z. z β Z 0 2β elements O K β n elements!

51 14 / 15 Shorter Average-Case Solutions O K is much denser than Z. z β Z 0 2β elements O K β n elements!

52 14 / 15 Shorter Average-Case Solutions O K is much denser than Z. z β Z 0 2β elements O K β n elements! Solutions taken over O K instead of Z.

53 14 / 15 Shorter Average-Case Solutions O K is much denser than Z. z β Z 0 2β elements O K β n elements! Solutions taken over O K instead of Z. Denser O K denser, shorter solutions.

54 15 / 15 Open Problems Good families of number fields K are crucial!

55 15 / 15 Open Problems Good families of number fields K are crucial! 1 Need small root discriminant D K (as function of dim n). Families with D K < 100 exist & are easy to verify. Q1: Are there efficient asymptotic constructions?

56 15 / 15 Open Problems Good families of number fields K are crucial! 1 Need small root discriminant D K (as function of dim n). Families with D K < 100 exist & are easy to verify. Q1: Are there efficient asymptotic constructions? Concrete good K known up to n 85 Even D K n 2/3 is useful

57 15 / 15 Open Problems Good families of number fields K are crucial! 1 Need small root discriminant D K (as function of dim n). Families with D K < 100 exist & are easy to verify. Q1: Are there efficient asymptotic constructions? Concrete good K known up to n 85 Even D K n 2/3 is useful 2 Reductions are non-uniform: need short basis for O K. Q2: Can explicit constructions yield this advice for free?

58 15 / 15 Open Problems Good families of number fields K are crucial! 1 Need small root discriminant D K (as function of dim n). Families with D K < 100 exist & are easy to verify. Q1: Are there efficient asymptotic constructions? Concrete good K known up to n 85 Even D K n 2/3 is useful 2 Reductions are non-uniform: need short basis for O K. Q2: Can explicit constructions yield this advice for free? 3 Crypto is tricky: must map {0, 1} to short elts of O K. Q3: Can this be done efficiently?