Ideal Lattices and Ring-LWE: Overview and Open Problems. Chris Peikert Georgia Institute of Technology. ICERM 23 April 2015

Transcription

1 Ideal Lattices and Ring-LWE: Overview and Open Problems Chris Peikert Georgia Institute of Technology ICERM 23 April / 16

2 Agenda 1 Ring-LWE and its hardness from ideal lattices 2 Open questions Selected bibliography: LPR 10 V Lyubashevsky, C Peikert, O Regev On Ideal Lattices and Learning with Errors Over Rings, Eurocrypt 10 and JACM 13 LPR 13 V Lyubashevsky, C Peikert, O Regev A Toolkit for Ring-LWE Cryptography, Eurocrypt 13 2 / 16

3 A Brief, Selective History of Lattice Cryptography 1996 Ajtai s worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 3 / 16

4 A Brief, Selective History of Lattice Cryptography 1996 Ajtai s worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient ring-based encryption (heuristic security) 3 / 16

5 A Brief, Selective History of Lattice Cryptography 1996 Ajtai s worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient ring-based encryption (heuristic security) 2002 Micciancio s ring-based one-way function with worst-case hardness (no encryption) 3 / 16

6 A Brief, Selective History of Lattice Cryptography 1996 Ajtai s worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient ring-based encryption (heuristic security) 2002 Micciancio s ring-based one-way function with worst-case hardness (no encryption) 2005 Regev s LWE: encryption with worst-case hardness (inefficient) 3 / 16

7 A Brief, Selective History of Lattice Cryptography 1996 Ajtai s worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient ring-based encryption (heuristic security) 2002 Micciancio s ring-based one-way function with worst-case hardness (no encryption) 2005 Regev s LWE: encryption with worst-case hardness (inefficient) 2008 Countless applications of LWE (still inefficient) 3 / 16

8 A Brief, Selective History of Lattice Cryptography 1996 Ajtai s worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient ring-based encryption (heuristic security) 2002 Micciancio s ring-based one-way function with worst-case hardness (no encryption) 2005 Regev s LWE: encryption with worst-case hardness (inefficient) 2008 Countless applications of LWE (still inefficient) 2010 Ring-LWE: efficient encryption, worst-case hardness () 3 / 16

9 Learning With Errors [Regev 05] Parameters: dimension n, modulus q = poly(n) 4 / 16

10 Learning With Errors [Regev 05] Parameters: dimension n, modulus q = poly(n) Search: find secret s Z n q given many noisy inner products a 1 Z n q, b 1 a 1, s mod q a 2 Z n q, b 2 a 2, s mod q 4 / 16

11 Learning With Errors [Regev 05] Parameters: dimension n, modulus q = poly(n) Search: find secret s Z n q given many noisy inner products a 1 Z n q, b 1 = a 1, s + e 1 Z q a 2 Z n q, b 2 = a 2, s + e 2 Z q n error q 4 / 16

12 Learning With Errors [Regev 05] Parameters: dimension n, modulus q = poly(n) Search: find secret s Z n q given many noisy inner products A, b = As + e n error q 4 / 16

13 Learning With Errors [Regev 05] Parameters: dimension n, modulus q = poly(n) Search: find secret s Z n q given many noisy inner products A, b = As + e n error q Decision: distinguish (A, b) from uniform (A, b) 4 / 16

14 Learning With Errors [Regev 05] Parameters: dimension n, modulus q = poly(n) Search: find secret s Z n q given many noisy inner products A, b = As + e n error q Decision: distinguish (A, b) from uniform (A, b) LWE is Hard ( maybe even for quantum!) worst case lattice problems (quantum [R 05]) search-lwe [BFKL 93,R 05, ] decision-lwe crypto 4 / 16

15 Learning With Errors [Regev 05] Parameters: dimension n, modulus q = poly(n) Search: find secret s Z n q given many noisy inner products A, b = As + e n error q Decision: distinguish (A, b) from uniform (A, b) LWE is Hard ( maybe even for quantum!) worst case lattice problems (quantum [R 05]) search-lwe [BFKL 93,R 05, ] decision-lwe crypto Also a classical reduction for search-lwe [P 09,BLPRS 13] 4 / 16

16 LWE is Versatile What kinds of crypto can we do with LWE? 5 / 16

17 LWE is Versatile What kinds of crypto can we do with LWE? Public Key Encryption and Oblivious Transfer Actively Secure PKE (w/o RO) [R 05,PVW 08] [PW 08,P 09,MP 12] 5 / 16

18 LWE is Versatile What kinds of crypto can we do with LWE? Public Key Encryption and Oblivious Transfer Actively Secure PKE (w/o RO) [R 05,PVW 08] [PW 08,P 09,MP 12] Identity-Based Encryption (in RO model) Hierarchical ID-Based Encryption (w/o RO) [GPV 08] [CHKP 10,ABB 10] 5 / 16

19 LWE is Versatile What kinds of crypto can we do with LWE? Public Key Encryption and Oblivious Transfer Actively Secure PKE (w/o RO) [R 05,PVW 08] [PW 08,P 09,MP 12] Identity-Based Encryption (in RO model) Hierarchical ID-Based Encryption (w/o RO) [GPV 08] [CHKP 10,ABB 10] Leakage-Resilient Crypto [AGV 09,DGKPV 10,GKPV 10,ADNSWW 10, ] Fully Homomorphic Encryption [BV 11,BGV 12,GSW 13, ] Attribute-Based Encryption [AFV 11,GVW 13,BGG+ 14, ] Symmetric-Key Primitives [BPR 12,BMLR 13,BP 14, ] Other Exotic Encryption [ACPS 09,BHHI 10,OP 10, ] the list goes on 5 / 16

20 LWE is (Sort Of) Efficient ( ai ) s + e = b Z q Getting one pseudorandom scalar requires an n-dim inner product mod q 6 / 16

21 LWE is (Sort Of) Efficient ( ai ) s + e = b Z q Getting one pseudorandom scalar requires an n-dim inner product mod q Can amortize each a i over many secrets s j, but still Õ(n) work per scalar output 6 / 16

22 LWE is (Sort Of) Efficient ( ai ) s + e = b Z q Getting one pseudorandom scalar requires an n-dim inner product mod q Can amortize each a i over many secrets s j, but still Õ(n) work per scalar output Cryptosystems have rather large keys: pk = A, } {{ } n b Ω(n) 6 / 16

23 LWE is (Sort Of) Efficient ( ai ) s + e = b Z q Getting one pseudorandom scalar requires an n-dim inner product mod q Can amortize each a i over many secrets s j, but still Õ(n) work per scalar output Cryptosystems have rather large keys: pk = A, b Ω(n) } {{ } n Can fix A for all users, but still n 2 work to encrypt & decrypt an n-bit message 6 / 16

24 Wishful Thinking a i s + e i = b i Zn q Get n pseudorandom scalars from just one (cheap) product operation? 7 / 16

25 Wishful Thinking a i s + e i = b i Zn q Get n pseudorandom scalars from just one (cheap) product operation? Question How to define the product so that (a i, b i ) is pseudorandom? 7 / 16

26 Wishful Thinking a i s + e i = b i Zn q Get n pseudorandom scalars from just one (cheap) product operation? Question How to define the product so that (a i, b i ) is pseudorandom? Careful! With small error, coordinate-wise multiplication is insecure! 7 / 16

27 Wishful Thinking a i s + e i = b i Zn q Get n pseudorandom scalars from just one (cheap) product operation? Question How to define the product so that (a i, b i ) is pseudorandom? Careful! With small error, coordinate-wise multiplication is insecure! Answer = multiplication in a polynomial ring: eg, Z q [X]/(X n + 1) Fast and practical with FFT: n log n operations mod q 7 / 16

28 Wishful Thinking a i s + e i = b i Zn q Get n pseudorandom scalars from just one (cheap) product operation? Question How to define the product so that (a i, b i ) is pseudorandom? Careful! With small error, coordinate-wise multiplication is insecure! Answer = multiplication in a polynomial ring: eg, Z q [X]/(X n + 1) Fast and practical with FFT: n log n operations mod q Same ring structures used in NTRU cryptosystem [HPS 98], & in compact one-way / CR hash functions [Mic 02,PR 06,LM 06, ] 7 / 16

29 LWE Over Rings, Over Simplified Let R = Z[X]/(X n + 1) for n a power of two, and R q = R/qR 8 / 16

30 LWE Over Rings, Over Simplified Let R = Z[X]/(X n + 1) for n a power of two, and R q = R/qR Elements of R q are deg < n polynomials with mod-q coefficients Operations in Rq are very efficient using FFT-like algorithms 8 / 16

31 LWE Over Rings, Over Simplified Let R = Z[X]/(X n + 1) for n a power of two, and R q = R/qR Elements of R q are deg < n polynomials with mod-q coefficients Operations in Rq are very efficient using FFT-like algorithms Search: find secret ring element s(x) R q, given: a 1 R q, b 1 = a 1 s + e 1 R q a 2 R q, b 2 = a 2 s + e 2 R q a 3 R q, b 3 = a 3 s + e 3 R q (e i R are small ) 8 / 16

32 LWE Over Rings, Over Simplified Let R = Z[X]/(X n + 1) for n a power of two, and R q = R/qR Elements of R q are deg < n polynomials with mod-q coefficients Operations in Rq are very efficient using FFT-like algorithms Search: find secret ring element s(x) R q, given: a 1 R q, b 1 = a 1 s + e 1 R q a 2 R q, b 2 = a 2 s + e 2 R q a 3 R q, b 3 = a 3 s + e 3 R q (e i R are small ) Note: (a i, b i ) are uniformly random subject to b i a i s 0 8 / 16

33 LWE Over Rings, Over Simplified Let R = Z[X]/(X n + 1) for n a power of two, and R q = R/qR Elements of R q are deg < n polynomials with mod-q coefficients Operations in Rq are very efficient using FFT-like algorithms Search: find secret ring element s(x) R q, given: a 1 R q, b 1 = a 1 s + e 1 R q a 2 R q, b 2 = a 2 s + e 2 R q a 3 R q, b 3 = a 3 s + e 3 R q (e i R are small ) Note: (a i, b i ) are uniformly random subject to b i a i s 0 Decision: distinguish (a i, b i ) from uniform (a i, b i ) R q R q (with noticeable advantage) 8 / 16

34 Hardness of Ring-LWE Two main theorems (reductions): worst-case approx-svp on ideal lattices in R (quantum, any R = O K ) search R-LWE (classical, any cyclotomic R) decision R-LWE 9 / 16

35 Hardness of Ring-LWE Two main theorems (reductions): worst-case approx-svp on ideal lattices in R (quantum, any R = O K ) search R-LWE (classical, any cyclotomic R) decision R-LWE 1 If you can find s given (a i, b i ), then you can find approximately shortest vectors in any ideal lattice in R (using a quantum algorithm) 9 / 16

36 Hardness of Ring-LWE Two main theorems (reductions): worst-case approx-svp on ideal lattices in R (quantum, any R = O K ) search R-LWE (classical, any cyclotomic R) decision R-LWE 1 If you can find s given (a i, b i ), then you can find approximately shortest vectors in any ideal lattice in R (using a quantum algorithm) 2 If you can distinguish (a i, b i ) from (a i, b i ), then you can find s 9 / 16

37 Hardness of Ring-LWE Two main theorems (reductions): worst-case approx-svp on ideal lattices in R (quantum, any R = O K ) search R-LWE (classical, any cyclotomic R) decision R-LWE Then: 1 If you can find s given (a i, b i ), then you can find approximately shortest vectors in any ideal lattice in R (using a quantum algorithm) 2 If you can distinguish (a i, b i ) from (a i, b i ), then you can find s decision R-LWE lots of crypto 9 / 16

38 Hardness of Ring-LWE Two main theorems (reductions): worst-case approx-svp on ideal lattices in R (quantum, any R = O K ) search R-LWE (classical, any cyclotomic R) decision R-LWE Then: 1 If you can find s given (a i, b i ), then you can find approximately shortest vectors in any ideal lattice in R (using a quantum algorithm) 2 If you can distinguish (a i, b i ) from (a i, b i ), then you can find s decision R-LWE lots of crypto If you can break the crypto, then you can distinguish (ai, b i ) from (a i, b i ) 9 / 16

39 Ideal Lattices Say R = Z[X]/(X n + 1) for power-of-two n (Or R = O K) An ideal I R is closed under + and, and under with R 10 / 16

40 Ideal Lattices Say R = Z[X]/(X n + 1) for power-of-two n (Or R = O K) An ideal I R is closed under + and, and under with R To get ideal lattices, embed R and its ideals into R n How? 10 / 16

41 Ideal Lattices Say R = Z[X]/(X n + 1) for power-of-two n (Or R = O K) An ideal I R is closed under + and, and under with R To get ideal lattices, embed R and its ideals into R n How? 1 Obvious answer: coefficient embedding a 0 + a 1 X + + a n 1 X n 1 R (a 0,, a n 1 ) Z n 10 / 16

42 Ideal Lattices Say R = Z[X]/(X n + 1) for power-of-two n (Or R = O K) An ideal I R is closed under + and, and under with R To get ideal lattices, embed R and its ideals into R n How? 1 Obvious answer: coefficient embedding a 0 + a 1 X + + a n 1 X n 1 R (a 0,, a n 1 ) Z n + is coordinate-wise, but analyzing is cumbersome 10 / 16

43 Ideal Lattices Say R = Z[X]/(X n + 1) for power-of-two n (Or R = O K) An ideal I R is closed under + and, and under with R To get ideal lattices, embed R and its ideals into C n How? 1 Obvious answer: coefficient embedding a 0 + a 1 X + + a n 1 X n 1 R (a 0,, a n 1 ) Z n + is coordinate-wise, but analyzing is cumbersome 2 [Minkowski]: canonical embedding Let ω = exp(πi/n) C, so roots of X n + 1 are ω 1, ω 3,, ω 2n 1 Embed: a(x) R (a(ω 1 ), a(ω 3 ),, a(ω 2n 1 )) C n 10 / 16

44 Ideal Lattices Say R = Z[X]/(X n + 1) for power-of-two n (Or R = O K) An ideal I R is closed under + and, and under with R To get ideal lattices, embed R and its ideals into C n How? 1 Obvious answer: coefficient embedding a 0 + a 1 X + + a n 1 X n 1 R (a 0,, a n 1 ) Z n + is coordinate-wise, but analyzing is cumbersome 2 [Minkowski]: canonical embedding Let ω = exp(πi/n) C, so roots of X n + 1 are ω 1, ω 3,, ω 2n 1 Embed: a(x) R (a(ω 1 ), a(ω 3 ),, a(ω 2n 1 )) C n Both + and are coordinate-wise 10 / 16

45 Ideal Lattices Say R = Z[X]/(X n + 1) for power-of-two n (Or R = O K) An ideal I R is closed under + and, and under with R To get ideal lattices, embed R and its ideals into R n How? 1 Obvious answer: coefficient embedding a 0 + a 1 X + + a n 1 X n 1 R (a 0,, a n 1 ) Z n + is coordinate-wise, but analyzing is cumbersome 2 [Minkowski]: canonical embedding Let ω = exp(πi/n) C, so roots of X n + 1 are ω 1, ω 3,, ω 2n 1 Embed: a(x) R (a(ω 1 ), a(ω 3 ),, a(ω 2n 1 )) C n Both + and are coordinate-wise (NB: LWE error distribution is Gaussian in canonical embedding) 10 / 16

46 Ideal Lattices Say R = Z[X]/(X 2 + 1) Embeddings map X ±i σ(x) = (i, i) σ(1) = (1, 1)

47 Ideal Lattices Say R = Z[X]/(X 2 + 1) Embeddings map X ±i I = X 2, 3X + 1 is an ideal in R σ(x) = (i, i) σ(1) = (1, 1) σ(x 2) σ( 3X + 1) 11 / 16

48 Ideal Lattices Say R = Z[X]/(X 2 + 1) Embeddings map X ±i I = X 2, 3X + 1 is an ideal in R σ(x) = (i, i) σ(1) = (1, 1) σ(x 2) σ( 3X + 1) (Approximate) Shortest Vector Problem Given (an arbitrary basis of) an arbitrary ideal I R, find a nearly shortest nonzero a I 11 / 16

49 Hardness of Search Ring-LWE Theorem 1 For any large enough q, solving search R-LWE is as hard as quantumly solving poly(n)-approx SVP in any (worst-case) ideal lattice in R = O K 12 / 16

50 Hardness of Search Ring-LWE Theorem 1 For any large enough q, solving search R-LWE is as hard as quantumly solving poly(n)-approx SVP in any (worst-case) ideal lattice in R = O K Proof follows the template of [Regev 05] for LWE & arbitrary lattices Quantum component used as black-box; only classical part needs adaptation to the ring setting 12 / 16

51 Hardness of Search Ring-LWE Theorem 1 For any large enough q, solving search R-LWE is as hard as quantumly solving poly(n)-approx SVP in any (worst-case) ideal lattice in R = O K Proof follows the template of [Regev 05] for LWE & arbitrary lattices Quantum component used as black-box; only classical part needs adaptation to the ring setting Main technique: clearing ideals while preserving R-module structure: I/qI R/qR, I /qi R /qr Uses Chinese remainder theorem and theory of duality for ideals 12 / 16

52 Hardness of Decision Ring-LWE Theorem 2 Solving decision R-LWE in any cyclotomic R = Z[ζ m ] = Z[X]/Φ m (X) (for any poly(n)-bounded prime q = 1 mod m) is as hard as solving search R-LWE 13 / 16

53 Hardness of Decision Ring-LWE Theorem 2 Solving decision R-LWE in any cyclotomic R = Z[ζ m ] = Z[X]/Φ m (X) (for any poly(n)-bounded prime q = 1 mod m) is as hard as solving search R-LWE Facts Used in the Proof Z q has order q 1 = 0 mod m, so has an element ω of order m 13 / 16

54 Hardness of Decision Ring-LWE Theorem 2 Solving decision R-LWE in any cyclotomic R = Z[ζ m ] = Z[X]/Φ m (X) (for any poly(n)-bounded prime q = 1 mod m) is as hard as solving search R-LWE Facts Used in the Proof Z q has order q 1 = 0 mod m, so has an element ω of order m Modulo q, Φ m (X) has n = ϕ(m) roots ω j, for j Z m 13 / 16

55 Hardness of Decision Ring-LWE Theorem 2 Solving decision R-LWE in any cyclotomic R = Z[ζ m ] = Z[X]/Φ m (X) (for any poly(n)-bounded prime q = 1 mod m) is as hard as solving search R-LWE Facts Used in the Proof Z q has order q 1 = 0 mod m, so has an element ω of order m Modulo q, Φ m (X) has n = ϕ(m) roots ω j, for j Z m So there is a ring isomorphism R q = Z n q given by a(x) R q ( a(ω j ) ) j Z m Z n q 13 / 16

56 Hardness of Decision Ring-LWE Theorem 2 Proof Sketch Solving decision Ring-LWE in R q = Z q [X]/Φ m (X) is as hard as solving search Ring-LWE Given: O distinguishes samples (a, b a s) from uniform (a, b) Goal: Find s R q, given samples (a, b a s) 14 / 16

57 Hardness of Decision Ring-LWE Theorem 2 Proof Sketch Solving decision Ring-LWE in R q = Z q [X]/Φ m (X) is as hard as solving search Ring-LWE Given: O distinguishes samples (a, b a s) from uniform (a, b) Goal: Find s R q, given samples (a, b a s) 1 Equivalent to finding s(ω j ) Z q for all j Z m 14 / 16

58 Hardness of Decision Ring-LWE Theorem 2 Proof Sketch Solving decision Ring-LWE in R q = Z q [X]/Φ m (X) is as hard as solving search Ring-LWE Given: O distinguishes samples (a, b a s) from uniform (a, b) Goal: Find s R q, given samples (a, b a s) 1 Equivalent to finding s(ω j ) Z q for all j Z m 2 Hybrid argument: randomize one b(ω j ) Z q ; or two; or three; or Then O must distinguish relative to some ω j 14 / 16

59 Hardness of Decision Ring-LWE Theorem 2 Proof Sketch Solving decision Ring-LWE in R q = Z q [X]/Φ m (X) is as hard as solving search Ring-LWE Given: O distinguishes samples (a, b a s) from uniform (a, b) Goal: Find s R q, given samples (a, b a s) 1 Equivalent to finding s(ω j ) Z q for all j Z m 2 Hybrid argument: randomize one b(ω j ) Z q ; or two; or three; or Then O must distinguish relative to some ω j 3 Using O, guess-and-check to find s(ω j ) Z q 14 / 16

60 Hardness of Decision Ring-LWE Theorem 2 Proof Sketch Solving decision Ring-LWE in R q = Z q [X]/Φ m (X) is as hard as solving search Ring-LWE Given: O distinguishes samples (a, b a s) from uniform (a, b) Goal: Find s R q, given samples (a, b a s) 1 Equivalent to finding s(ω j ) Z q for all j Z m 2 Hybrid argument: randomize one b(ω j ) Z q ; or two; or three; or Then O must distinguish relative to some ω j 3 Using O, guess-and-check to find s(ω j ) Z q 4 How to find other s(ω j )? Couldn t O be useless at other roots? 14 / 16

61 Hardness of Decision Ring-LWE Theorem 2 Proof Sketch Solving decision Ring-LWE in R q = Z q [X]/Φ m (X) is as hard as solving search Ring-LWE Given: O distinguishes samples (a, b a s) from uniform (a, b) Goal: Find s R q, given samples (a, b a s) 1 Equivalent to finding s(ω j ) Z q for all j Z m 2 Hybrid argument: randomize one b(ω j ) Z q ; or two; or three; or Then O must distinguish relative to some ω j 3 Using O, guess-and-check to find s(ω j ) Z q 4 How to find other s(ω j )? Couldn t O be useless at other roots? ω ω k (k Z m) permutes roots of Φ m (X), and preserves error 14 / 16

62 Hardness of Decision Ring-LWE Theorem 2 Proof Sketch Solving decision Ring-LWE in R q = Z q [X]/Φ m (X) is as hard as solving search Ring-LWE Given: O distinguishes samples (a, b a s) from uniform (a, b) Goal: Find s R q, given samples (a, b a s) 1 Equivalent to finding s(ω j ) Z q for all j Z m 2 Hybrid argument: randomize one b(ω j ) Z q ; or two; or three; or Then O must distinguish relative to some ω j 3 Using O, guess-and-check to find s(ω j ) Z q 4 How to find other s(ω j )? Couldn t O be useless at other roots? ω ω k (k Z m) permutes roots of Φ m (X), and preserves error So send each ω j to ω j, and use O to find s(ω j ) 14 / 16

63 Open Problems: Reductions 1 Search-R-LWE is quantumly at least as hard as approx-r-svp Is there a classical reduction? 15 / 16

64 Open Problems: Reductions 1 Search-R-LWE is quantumly at least as hard as approx-r-svp Is there a classical reduction? [P 09] reduces GapSVP (ie, estimate λ 1 (L)) on general lattices to plain-lwe, classically 15 / 16

65 Open Problems: Reductions 1 Search-R-LWE is quantumly at least as hard as approx-r-svp Is there a classical reduction? [P 09] reduces GapSVP (ie, estimate λ 1 (L)) on general lattices to plain-lwe, classically But estimating λ 1 (L) is trivially easy on ideal lattices! Finding short vectors is what appears hard 15 / 16

66 Open Problems: Reductions 1 Search-R-LWE is quantumly at least as hard as approx-r-svp Is there a classical reduction? [P 09] reduces GapSVP (ie, estimate λ 1 (L)) on general lattices to plain-lwe, classically But estimating λ 1 (L) is trivially easy on ideal lattices! Finding short vectors is what appears hard 2 Search- and decision-r-lwe are equivalent in cyclotomic R Does this hold in other kinds of rings? 15 / 16

67 Open Problems: Reductions 1 Search-R-LWE is quantumly at least as hard as approx-r-svp Is there a classical reduction? [P 09] reduces GapSVP (ie, estimate λ 1 (L)) on general lattices to plain-lwe, classically But estimating λ 1 (L) is trivially easy on ideal lattices! Finding short vectors is what appears hard 2 Search- and decision-r-lwe are equivalent in cyclotomic R Does this hold in other kinds of rings? Yes, for any Galois number field (identical proof) 15 / 16

68 Open Problems: Reductions 1 Search-R-LWE is quantumly at least as hard as approx-r-svp Is there a classical reduction? [P 09] reduces GapSVP (ie, estimate λ 1 (L)) on general lattices to plain-lwe, classically But estimating λ 1 (L) is trivially easy on ideal lattices! Finding short vectors is what appears hard 2 Search- and decision-r-lwe are equivalent in cyclotomic R Does this hold in other kinds of rings? Yes, for any Galois number field (identical proof) Probably not, for carefully constructed rings S, moduli q, and errors! Decision-S-LWE easily broken, but search unaffected [EHL 14,ELOS 15] Update 8/2016: both search and decision are broken [CIV 16,P 16] 15 / 16

69 Open Problems: Reductions 1 Search-R-LWE is quantumly at least as hard as approx-r-svp Is there a classical reduction? [P 09] reduces GapSVP (ie, estimate λ 1 (L)) on general lattices to plain-lwe, classically But estimating λ 1 (L) is trivially easy on ideal lattices! Finding short vectors is what appears hard 2 Search- and decision-r-lwe are equivalent in cyclotomic R Does this hold in other kinds of rings? Yes, for any Galois number field (identical proof) Probably not, for carefully constructed rings S, moduli q, and errors! Decision-S-LWE easily broken, but search unaffected [EHL 14,ELOS 15] Update 8/2016: both search and decision are broken [CIV 16,P 16] cyclotomic fields, used for Ring-LWE, are uniquely protected against the attacks presented in this paper 15 / 16

70 Open Problems: Attacks 1 We know approx-r-svp R-LWE (quantumly) Other direction? Can we solve R-LWE using an oracle for approx-r-svp? 16 / 16

71 Open Problems: Attacks 1 We know approx-r-svp R-LWE (quantumly) Other direction? Can we solve R-LWE using an oracle for approx-r-svp? R-LWE samples (ai, b i ) i=1,,l don t readily translate to ideals in R 16 / 16

72 Open Problems: Attacks 1 We know approx-r-svp R-LWE (quantumly) Other direction? Can we solve R-LWE using an oracle for approx-r-svp? R-LWE samples (ai, b i ) i=1,,l don t readily translate to ideals in R They do yield a BDD instance on an R-module lattice: L = { (v i ) : v i = a i z (mod qr) } R l 16 / 16

73 Open Problems: Attacks 1 We know approx-r-svp R-LWE (quantumly) Other direction? Can we solve R-LWE using an oracle for approx-r-svp? R-LWE samples (ai, b i ) i=1,,l don t readily translate to ideals in R They do yield a BDD instance on an R-module lattice: L = { (v i ) : v i = a i z (mod qr) } R l 2 How hard/easy is approx-r-svp, anyway? (In cyclotomics etc) 16 / 16

74 Open Problems: Attacks 1 We know approx-r-svp R-LWE (quantumly) Other direction? Can we solve R-LWE using an oracle for approx-r-svp? R-LWE samples (ai, b i ) i=1,,l don t readily translate to ideals in R They do yield a BDD instance on an R-module lattice: L = { (v i ) : v i = a i z (mod qr) } R l 2 How hard/easy is approx-r-svp, anyway? (In cyclotomics etc) Despite abundant ring structure (eg, subfields, Galois), no substantial improvement over attacks on general lattices 16 / 16

75 Open Problems: Attacks 1 We know approx-r-svp R-LWE (quantumly) Other direction? Can we solve R-LWE using an oracle for approx-r-svp? R-LWE samples (ai, b i ) i=1,,l don t readily translate to ideals in R They do yield a BDD instance on an R-module lattice: L = { (v i ) : v i = a i z (mod qr) } R l 2 How hard/easy is approx-r-svp, anyway? (In cyclotomics etc) Despite abundant ring structure (eg, subfields, Galois), no substantial improvement over attacks on general lattices Next up: attacks on a specialized variant: given a principal ideal I guaranteed to have an unusually short generator, find it 16 / 16

76 Open Problems: Attacks 1 We know approx-r-svp R-LWE (quantumly) Other direction? Can we solve R-LWE using an oracle for approx-r-svp? R-LWE samples (ai, b i ) i=1,,l don t readily translate to ideals in R They do yield a BDD instance on an R-module lattice: L = { (v i ) : v i = a i z (mod qr) } R l 2 How hard/easy is approx-r-svp, anyway? (In cyclotomics etc) Despite abundant ring structure (eg, subfields, Galois), no substantial improvement over attacks on general lattices Next up: attacks on a specialized variant: given a principal ideal I guaranteed to have an unusually short generator, find it These conditions are extremely rare for general ideals, so (worst-case) approx-r-svp is unaffected 16 / 16