Hard Instances of Lattice Problems
|
|
- Quentin Spencer
- 6 years ago
- Views:
Transcription
1 Hard Instances of Lattice Problems Average Case - Worst Case Connections Christos Litsas 28 June 2012
2 Outline Abstract Lattices The Random Class Worst-Case - Average-Case Connection
3 Abstract Christos Litsas (NTUA) Average Case - Worst Case Connections 3/31
4 Hard Problems Already Exist All Time Classic Hard Problems NP-Complete problems Factorization Discrete Logarithm reduces to average case: log g2 t = (log g1 g 2 )(log g1 t) 1 Christos Litsas (NTUA) Average Case - Worst Case Connections 4/31
5 Hard Problems Already Exist All Time Classic Hard Problems NP-Complete problems Factorization Discrete Logarithm reduces to average case: log g2 t = (log g1 g 2 )(log g1 t) 1 Worst-Case Hardness Those problems are hard only under certain distributions. Often it is not clear how to find such a distribution. Christos Litsas (NTUA) Average Case - Worst Case Connections 4/31
6 One Step Further Worst-Case Vs. Average-Case Hardness A random class of lattices so that if the SVP is easy to solve then the above problems are easy in every lattice. Christos Litsas (NTUA) Average Case - Worst Case Connections 5/31
7 Lattices Christos Litsas (NTUA) Average Case - Worst Case Connections 6/31
8 Lattice Definition Definition Let B R m n, we consider the set L = {y : y = B x x Z 1 n }, that is the set of all integer linear combinations of B. We call every L with the above properties a lattice. Christos Litsas (NTUA) Average Case - Worst Case Connections 7/31
9 Lattices Figure: An example of a lattice and its basis. Christos Litsas (NTUA) Average Case - Worst Case Connections 8/31
10 Lattices Figure: A lattice has more than one bases. Christos Litsas (NTUA) Average Case - Worst Case Connections 9/31
11 Properties Multiplication by a unimodular matrix produces a new basis. Christos Litsas (NTUA) Average Case - Worst Case Connections 10/31
12 Properties Multiplication by a unimodular matrix produces a new basis. Infinite (countable) different bases. Christos Litsas (NTUA) Average Case - Worst Case Connections 10/31
13 Properties Multiplication by a unimodular matrix produces a new basis. Infinite (countable) different bases. The only part of a lattice that is known is the place where the basis vectors lie. Christos Litsas (NTUA) Average Case - Worst Case Connections 10/31
14 Fundamental Parallelepiped Definition Let L be a lattice, and let a basis for L is B = [b 1,..., b n ], b i are the column vectors of B, then we define the set n P(B) = {y : y = x i b i, x i [ 1 2, 1 )}. We call P(B) the 2 i=0 fundamental parallelepiped of L with respect to the basis B. Christos Litsas (NTUA) Average Case - Worst Case Connections 11/31
15 Mathematical Tools Equivalence relation, mod B. Christos Litsas (NTUA) Average Case - Worst Case Connections 12/31
16 Mathematical Tools Equivalence relation, mod B. Efficiently computable distinguished representatives as t B B 1 t. Christos Litsas (NTUA) Average Case - Worst Case Connections 12/31
17 Mathematical Tools Equivalence relation, mod B. Efficiently computable distinguished representatives as t B B 1 t. Partition of the space R n by multiplies of fundamental parallelepiped. Christos Litsas (NTUA) Average Case - Worst Case Connections 12/31
18 Lattice Problems & Solutions Classic Hard Problems P1 approximate SVP P2 approximate unique SVP P3 approximate SIVP (find a basis) Christos Litsas (NTUA) Average Case - Worst Case Connections 13/31
19 Lattice Problems & Solutions Classic Hard Problems P1 approximate SVP P2 approximate unique SVP P3 approximate SIVP (find a basis) Classic Algorithms and Bounds LLL Reduction Algorithm (2 n 1 2 sh(l) approximation). Babai s Nearest Plane Algorithm. Christos Litsas (NTUA) Average Case - Worst Case Connections 13/31
20 Lattice Problems & Solutions Classic Hard Problems P1 approximate SVP P2 approximate unique SVP P3 approximate SIVP (find a basis) Classic Algorithms and Bounds LLL Reduction Algorithm (2 n 1 2 sh(l) approximation). Babai s Nearest Plane Algorithm. Bounds Shor proved that in LLL the approximation factor can be replaced by (1 + ɛ) n. Minkowski (Convex Body Theorems) sh(l) c n det(l) 1 n Christos Litsas (NTUA) Average Case - Worst Case Connections 13/31
21 More on Lattices... Definition (Dual Lattice) Let L be a lattice, we define the dual lattice to be the set L = {y : x L x, y Z}. Christos Litsas (NTUA) Average Case - Worst Case Connections 14/31
22 More on Lattices... Definition (Dual Lattice) Let L be a lattice, we define the dual lattice to be the set L = {y : x L x, y Z}. Definition (Smoothing Parameter) For any n-dimensional lattice L and ɛ R +, we define its smoothing parameter η ɛ (L) to be the smallest s such that ρ 1/s (L \ {0}) ɛ. Christos Litsas (NTUA) Average Case - Worst Case Connections 14/31
23 Sampling Lemma For any s > 0, c R n and lattice L(B), the statistical distance between D s,c mod P(B) and the uniform distribution over P(B) is at most 1 2 ρ 1/s(L(B) \ {0}). In particular, for any ɛ > 0 and any s η ɛ (B), holds that (D s,c mod P(B), U(P(B))) ɛ/2 Christos Litsas (NTUA) Average Case - Worst Case Connections 15/31
24 The Random Class Christos Litsas (NTUA) Average Case - Worst Case Connections 16/31
25 Definition of L and Λ 1. L: q-ary lattice. 2. Λ: the perpendicular lattice of L. Christos Litsas (NTUA) Average Case - Worst Case Connections 17/31
26 Definition of L and Λ Symbols B = (u 1 : u 2 :... : u m ), u i Z n. Lattice: L(B, q) = {y : y = B x mod q, x Z 1 m } (L(B, q) Z n ). Perpendicular Lattice: Λ(B, q) = {y : y B 0 mod q} (Λ(B, q) Z n ). Parameters m = [c 1 n log n] q = [n c 2] Christos Litsas (NTUA) Average Case - Worst Case Connections 18/31
27 Our Goal Our Goal 1. Redefine the basis B so that if there is a PT algorithm that finds a shortest vector in Λ then it breaks P1, P2, P3 in any lattice. Christos Litsas (NTUA) Average Case - Worst Case Connections 19/31
28 First Step Substitute B by λ Define λ = (v 1,..., v m ), v i Z n q. Every v i is chosen independently and with uniform distribution from the set of all vectors in Z n q. Christos Litsas (NTUA) Average Case - Worst Case Connections 20/31
29 First Step Substitute B by λ Define λ = (v 1,..., v m ), v i Z n q. Every v i is chosen independently and with uniform distribution from the set of all vectors in Z n q. Simultaneous Diophantine Equations The problem of finding a SV in Λ(λ, q) is equivalent to solve a linear simultaneous Diophantine equation. Christos Litsas (NTUA) Average Case - Worst Case Connections 20/31
30 First Step Substitute B by λ Define λ = (v 1,..., v m ), v i Z n q. Every v i is chosen independently and with uniform distribution from the set of all vectors in Z n q. Simultaneous Diophantine Equations The problem of finding a SV in Λ(λ, q) is equivalent to solve a linear simultaneous Diophantine equation. Theorem (Dirichlet) If c 1 is sufficiently large with respect to c 2 then there is always a SV in Λ(λ, q) which is sorter than n. Christos Litsas (NTUA) Average Case - Worst Case Connections 20/31
31 Problem :-( Λ(λ, q) is Unknown to Everybody (Crypto Only) It seems that there is no way of constructing a shortest vector in Λ(λ, q). So we don t have a trapdoor! Christos Litsas (NTUA) Average Case - Worst Case Connections 21/31
32 Second Step Substitute λ by λ Define λ = (v 1,..., v m ), i {1,..., m 1}v i Z n q also v i is chosen independently and with uniform distribution from the set m 1 of all vectors in Z n q. We also define v m = δ i v i. Where δ i is i=1 a, randomly generated, sequence of 0 and 1 s. Christos Litsas (NTUA) Average Case - Worst Case Connections 22/31
33 Second Step Substitute λ by λ Define λ = (v 1,..., v m ), i {1,..., m 1}v i Z n q also v i is chosen independently and with uniform distribution from the set m 1 of all vectors in Z n q. We also define v m = δ i v i. Where δ i is i=1 a, randomly generated, sequence of 0 and 1 s. No Loss of Generality The distribution of λ is exponentially close to the uniform distribution. P(λ = x) 1 A 1, where A is the set of all 2cn x A possible values of λ. Christos Litsas (NTUA) Average Case - Worst Case Connections 22/31
34 Worst-Case - Average-Case Connection Christos Litsas (NTUA) Average Case - Worst Case Connections 23/31
35 Main Theorem Theorem There are absolute constants c 1, c 2, c 3 so that the following holds: Suppose that there is a PPT algorithm A which given a value of the random variable λ n,c1,c 2 as an input, with a probability of at least 1 2 outputs a nonzero vector of Λ(λ n,c 1,c 2, [n c 1]) of length at most n. Then, there is a PPT algorithm B with the following properties: If the linearly independent vectors a 1,..., a n Z n are given as an input then in polynomial time in size(a i ) gives the output 1 (d 1,..., d n ) so that with probability of greater than 1 2 size(a i ) (d 1,..., d n ) is a basis with max d i n c 3bl(L) Christos Litsas (NTUA) Average Case - Worst Case Connections 24/31
36 Main Tool for the Proof Easy Construction of a Basis There is a polynomial time algorithm that from a set of n linearly independent vectors r 1,..., r n L can construct a basis s 1,..., s n of L so that max s i n max r i Christos Litsas (NTUA) Average Case - Worst Case Connections 25/31
37 Main Tool for the Proof Easy Construction of a Basis There is a polynomial time algorithm that from a set of n linearly independent vectors r 1,..., r n L can construct a basis s 1,..., s n of L so that max s i n max r i Defining a new Goal Construct a set of n linearly independent vectors of L so that each of them is shorter than n c 3 1 bl(l). Christos Litsas (NTUA) Average Case - Worst Case Connections 25/31
38 Proof of Main Theorem Assume that we have the set of linearly independent vectors a 1,..., a n L. Let M = max a i Christos Litsas (NTUA) Average Case - Worst Case Connections 26/31
39 Proof of Main Theorem Assume that we have the set of linearly independent vectors a 1,..., a n L. Let M = max a i First Case (Trivial) If M n c 3 1 bl(l) we are done. Christos Litsas (NTUA) Average Case - Worst Case Connections 26/31
40 Proof of Main Theorem Assume that we have the set of linearly independent vectors a 1,..., a n L. Let M = max a i First Case (Trivial) If M n c 3 1 bl(l) we are done. Second Case (Hmmm...) If M > n c3 1 bl(l) we construct (?) a set of linearly independent vectors of b 1,..., b n L so that max b i M 2. Then we repeat the algorithm with input the set b 1,..., b n. After log 2 M 2 size(a i ) steps we get a set of linearly independent vectors where each of them is shorter than n c3 1 bl(l). Christos Litsas (NTUA) Average Case - Worst Case Connections 26/31
41 max b i M 2 1. Starting from the set a 1,..., a n L we construct a set of linearly independent vectors f 1,..., f n L so that max f i n 3 M and also the parallelepiped W = P(f 1,..., f n ) is very close to a cube. 2. We cut W into q n parallelepipeds each of the form ti q f i + 1 q W, where 0 t i < q is a sequence of integers. 3. We take a random sequence of lattice points ξ 1,..., ξ m, m = c 1 n log n from W. Let ξ j t (j) i q f i + 1 q W then we define v j = (t (j) 1,..., t(j) n ). 4. Apply A to the input λ = (v 1,..., v m ) and get a vector (h 1,..., h m ) Z n. 5. Then the vector h j (ξ j η j ) L and its length is at most M 2, where η j = t (j) i q f i. Christos Litsas (NTUA) Average Case - Worst Case Connections 27/31
42 References Christos Litsas (NTUA) Average Case - Worst Case Connections 28/31
43 References Miklos Ajtai (1996). Generating Hard Instances of Lattice Problems (Extended Abstract). STOC 96, pp Daniele Micciancio, Oded Regev (2005). Worst-case to Average-case Reductions based on Gaussian Measures. FOCS 04. Christos Litsas (NTUA) Average Case - Worst Case Connections 29/31
44 References Ravindran Kannan (1987). Algorithmic Geometry of Numbers. Annual Review of Comp. Sci, pp L. Babai (1986). On Lovasz lattice reduction and the nearest lattice point problem Proc. STACS 85, pp H.W. Lenstra, A.K. Lenstra, L. Lovasz (1982). Factoring polynomials with rational coefficients. Mathematische Annalen, pp Christos Litsas (NTUA) Average Case - Worst Case Connections 30/31
45 Thank you!!! Christos Litsas (NTUA) Average Case - Worst Case Connections 31/31
and the polynomial-time Turing p reduction from approximate CVP to SVP given in [10], the present authors obtained a n=2-approximation algorithm that
Sampling short lattice vectors and the closest lattice vector problem Miklos Ajtai Ravi Kumar D. Sivakumar IBM Almaden Research Center 650 Harry Road, San Jose, CA 95120. fajtai, ravi, sivag@almaden.ibm.com
More informationShortest Vector Problem (1982; Lenstra, Lenstra, Lovasz)
Shortest Vector Problem (1982; Lenstra, Lenstra, Lovasz) Daniele Micciancio, University of California at San Diego, www.cs.ucsd.edu/ daniele entry editor: Sanjeev Khanna INDEX TERMS: Point lattices. Algorithmic
More informationCOS 598D - Lattices. scribe: Srdjan Krstic
COS 598D - Lattices scribe: Srdjan Krstic Introduction In the first part we will give a brief introduction to lattices and their relevance in some topics in computer science. Then we show some specific
More informationDimension-Preserving Reductions Between Lattice Problems
Dimension-Preserving Reductions Between Lattice Problems Noah Stephens-Davidowitz Courant Institute of Mathematical Sciences, New York University. noahsd@cs.nyu.edu Last updated September 6, 2016. Abstract
More informationSome Sieving Algorithms for Lattice Problems
Foundations of Software Technology and Theoretical Computer Science (Bangalore) 2008. Editors: R. Hariharan, M. Mukund, V. Vinay; pp - Some Sieving Algorithms for Lattice Problems V. Arvind and Pushkar
More informationSolving All Lattice Problems in Deterministic Single Exponential Time
Solving All Lattice Problems in Deterministic Single Exponential Time (Joint work with P. Voulgaris, STOC 2010) UCSD March 22, 2011 Lattices Traditional area of mathematics Bridge between number theory
More informationFrom the Shortest Vector Problem to the Dihedral Hidden Subgroup Problem
From the Shortest Vector Problem to the Dihedral Hidden Subgroup Problem Curtis Bright December 9, 011 Abstract In Quantum Computation and Lattice Problems [11] Oded Regev presented the first known connection
More informationLattice-Based Cryptography: Mathematical and Computational Background. Chris Peikert Georgia Institute of Technology.
Lattice-Based Cryptography: Mathematical and Computational Background Chris Peikert Georgia Institute of Technology crypt@b-it 2013 1 / 18 Lattice-Based Cryptography y = g x mod p m e mod N e(g a, g b
More informationLattices Part II Dual Lattices, Fourier Transform, Smoothing Parameter, Public Key Encryption
Lattices Part II Dual Lattices, Fourier Transform, Smoothing Parameter, Public Key Encryption Boaz Barak May 12, 2008 The first two sections are based on Oded Regev s lecture notes, and the third one on
More informationCSE 206A: Lattice Algorithms and Applications Spring Basis Reduction. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Spring 2014 Basis Reduction Instructor: Daniele Micciancio UCSD CSE No efficient algorithm is known to find the shortest vector in a lattice (in arbitrary
More informationBackground: Lattices and the Learning-with-Errors problem
Background: Lattices and the Learning-with-Errors problem China Summer School on Lattices and Cryptography, June 2014 Starting Point: Linear Equations Easy to solve a linear system of equations A s = b
More informationUpper Bound on λ 1. Science, Guangzhou University, Guangzhou, China 2 Zhengzhou University of Light Industry, Zhengzhou, China
Λ A Huiwen Jia 1, Chunming Tang 1, Yanhua Zhang 2 hwjia@gzhu.edu.cn, ctang@gzhu.edu.cn, and yhzhang@zzuli.edu.cn 1 Key Laboratory of Information Security, School of Mathematics and Information Science,
More informationLattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors
1 / 15 Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert 1 Alon Rosen 2 1 SRI International 2 Harvard SEAS IDC Herzliya STOC 2007 2 / 15 Worst-case versus average-case
More informationLattice-based Cryptography
Lattice-based Cryptography Oded Regev Tel Aviv University, Israel Abstract. We describe some of the recent progress on lattice-based cryptography, starting from the seminal work of Ajtai, and ending with
More information1 Shortest Vector Problem
Lattices in Cryptography University of Michigan, Fall 25 Lecture 2 SVP, Gram-Schmidt, LLL Instructor: Chris Peikert Scribe: Hank Carter Shortest Vector Problem Last time we defined the minimum distance
More informationOn Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky 1 and Daniele Micciancio 2 1 School of Computer Science, Tel Aviv University Tel Aviv 69978, Israel.
More informationSimultaneous Diophantine Approximation with Excluded Primes. László Babai Daniel Štefankovič
Simultaneous Diophantine Approximation with Excluded Primes László Babai Daniel Štefankovič Dirichlet (1842) Simultaneous Diophantine Approximation Given reals integers α,,...,, 1 α 2 α n Q r1,..., r n
More informationCSE 206A: Lattice Algorithms and Applications Spring Minkowski s theorem. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Spring 2014 Minkowski s theorem Instructor: Daniele Micciancio UCSD CSE There are many important quantities associated to a lattice. Some of them, like the
More information1: Introduction to Lattices
CSE 206A: Lattice Algorithms and Applications Winter 2012 Instructor: Daniele Micciancio 1: Introduction to Lattices UCSD CSE Lattices are regular arrangements of points in Euclidean space. The simplest
More informationAn intro to lattices and learning with errors
A way to keep your secrets secret in a post-quantum world Some images in this talk authored by me Many, excellent lattice images in this talk authored by Oded Regev and available in papers and surveys
More informationReduction of Smith Normal Form Transformation Matrices
Reduction of Smith Normal Form Transformation Matrices G. Jäger, Kiel Abstract Smith normal form computations are important in group theory, module theory and number theory. We consider the transformation
More informationDwork 97/07, Regev Lyubashvsky-Micciancio. Micciancio 09. PKE from worst-case. usvp. Relations between worst-case usvp,, BDD, GapSVP
The unique-svp World 1. Ajtai-Dwork Dwork 97/07, Regev 03 PKE from worst-case usvp 2. Lyubashvsky-Micciancio Micciancio 09 Shai Halevi, IBM, July 2009 Relations between worst-case usvp,, BDD, GapSVP Many
More informationM4. Lecture 3. THE LLL ALGORITHM AND COPPERSMITH S METHOD
M4. Lecture 3. THE LLL ALGORITHM AND COPPERSMITH S METHOD Ha Tran, Dung H. Duong, Khuong A. Nguyen. SEAMS summer school 2015 HCM University of Science 1 / 31 1 The LLL algorithm History Applications of
More informationSub-Linear Root Detection for Sparse Polynomials Over Finite Fields
1 / 27 Sub-Linear Root Detection for Sparse Polynomials Over Finite Fields Jingguo Bi Institute for Advanced Study Tsinghua University Beijing, China October, 2014 Vienna, Austria This is a joint work
More informationsatisfying ( i ; j ) = ij Here ij = if i = j and 0 otherwise The idea to use lattices is the following Suppose we are given a lattice L and a point ~x
Dual Vectors and Lower Bounds for the Nearest Lattice Point Problem Johan Hastad* MIT Abstract: We prove that given a point ~z outside a given lattice L then there is a dual vector which gives a fairly
More informationSolving Closest Vector Instances Using an Approximate Shortest Independent Vectors Oracle
Tian CL, Wei W, Lin DD. Solving closest vector instances using an approximate shortest independent vectors oracle. JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY 306): 1370 1377 Nov. 015. DOI 10.1007/s11390-015-
More informationOn Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky Daniele Micciancio To appear at Crypto 2009 Lattices Lattice: A discrete subgroup of R n Group
More informationOn Approximating the Covering Radius and Finding Dense Lattice Subspaces
On Approximating the Covering Radius and Finding Dense Lattice Subspaces Daniel Dadush Centrum Wiskunde & Informatica (CWI) ICERM April 2018 Outline 1. Integer Programming and the Kannan-Lovász (KL) Conjecture.
More informationNew Conjectures in the Geometry of Numbers
New Conjectures in the Geometry of Numbers Daniel Dadush Centrum Wiskunde & Informatica (CWI) Oded Regev New York University Talk Outline 1. A Reverse Minkowski Inequality & its conjectured Strengthening.
More informationOn Nearly Orthogonal Lattice Bases
On Nearly Orthogonal Lattice Bases Ramesh Neelamani, Sanjeeb Dash, and Richard G. Baraniuk July 14, 2005 Abstract We study nearly orthogonal lattice bases, or bases where the angle between any basis vector
More informationLecture 7 Limits on inapproximability
Tel Aviv University, Fall 004 Lattices in Computer Science Lecture 7 Limits on inapproximability Lecturer: Oded Regev Scribe: Michael Khanevsky Let us recall the promise problem GapCVP γ. DEFINITION 1
More informationHardness of the Covering Radius Problem on Lattices
Hardness of the Covering Radius Problem on Lattices Ishay Haviv Oded Regev June 6, 2006 Abstract We provide the first hardness result for the Covering Radius Problem on lattices (CRP). Namely, we show
More informationLower bounds of shortest vector lengths in random knapsack lattices and random NTRU lattices
Lower bounds of shortest vector lengths in random knapsack lattices and random NTRU lattices Jingguo Bi 1 and Qi Cheng 2 1 Lab of Cryptographic Technology and Information Security School of Mathematics
More informationThe Shortest Vector Problem (Lattice Reduction Algorithms)
The Shortest Vector Problem (Lattice Reduction Algorithms) Approximation Algorithms by V. Vazirani, Chapter 27 - Problem statement, general discussion - Lattices: brief introduction - The Gauss algorithm
More informationLocally Dense Codes. Daniele Micciancio. August 26, 2013
Electronic Colloquium on Computational Complexity, Report No. 115 (2013) Locally Dense Codes Daniele Micciancio August 26, 2013 Abstract The Minimum Distance Problem (MDP), i.e., the computational task
More informationCOMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective
COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective THE KLUWER INTERNATIONAL SERIES IN ENGINEERING AND COMPUTER SCIENCE COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective Daniele Micciancio
More informationOn Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky and Daniele Micciancio May 9, 009 Abstract We prove the equivalence, up to a small polynomial
More informationLecture 5: CVP and Babai s Algorithm
NYU, Fall 2016 Lattices Mini Course Lecture 5: CVP and Babai s Algorithm Lecturer: Noah Stephens-Davidowitz 51 The Closest Vector Problem 511 Inhomogeneous linear equations Recall that, in our first lecture,
More informationTensor-based Hardness of the Shortest Vector Problem to within Almost Polynomial Factors
Tensor-based Hardness of the Shortest Vector Problem to within Almost Polynomial Factors Ishay Haviv Oded Regev March 2, 2007 Abstract We show that unless NP RTIME(2 poly(log n) ), for any ε > 0 there
More informationFrom the shortest vector problem to the dihedral hidden subgroup problem
From the shortest vector problem to the dihedral hidden subgroup problem Curtis Bright University of Waterloo December 8, 2011 1 / 19 Reduction Roughly, problem A reduces to problem B means there is a
More informationCSC 2414 Lattices in Computer Science September 27, Lecture 4. An Efficient Algorithm for Integer Programming in constant dimensions
CSC 2414 Lattices in Computer Science September 27, 2011 Lecture 4 Lecturer: Vinod Vaikuntanathan Scribe: Wesley George Topics covered this lecture: SV P CV P Approximating CVP: Babai s Nearest Plane Algorithm
More informationA Fast Phase-Based Enumeration Algorithm for SVP Challenge through y-sparse Representations of Short Lattice Vectors
A Fast Phase-Based Enumeration Algorithm for SVP Challenge through y-sparse Representations of Short Lattice Vectors Dan Ding 1, Guizhen Zhu 2, Yang Yu 1, Zhongxiang Zheng 1 1 Department of Computer Science
More informationOn Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem. Vadim Lyubashevsky Daniele Micciancio
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky Daniele Micciancio Lattices Lattice: A discrete additive subgroup of R n Lattices Basis: A set
More informationLooking back at lattice-based cryptanalysis
September 2009 Lattices A lattice is a discrete subgroup of R n Equivalently, set of integral linear combinations: α 1 b1 + + α n bm with m n Lattice reduction Lattice reduction looks for a good basis
More informationLattice-Based Cryptography
Liljana Babinkostova Department of Mathematics Computing Colloquium Series Detecting Sensor-hijack Attacks in Wearable Medical Systems Krishna Venkatasubramanian Worcester Polytechnic Institute Quantum
More informationPractical Analysis of Key Recovery Attack against Search-LWE Problem
Practical Analysis of Key Recovery Attack against Search-LWE Problem The 11 th International Workshop on Security, Sep. 13 th 2016 Momonari Kudo, Junpei Yamaguchi, Yang Guo and Masaya Yasuda 1 Graduate
More informationLimits on the Hardness of Lattice Problems in l p Norms
Electronic Colloquium on Computational Complexity, Report No. 148 (2006) Limits on the Hardness of Lattice Problems in l p Norms Chris Peikert December 3, 2006 Abstract We show that for any p 2, lattice
More informationInapproximability Results for the Closest Vector Problem with Preprocessing over l Norm
Electronic Colloquium on Computational Complexity, Report No. 52 (2006) Inapproximability Results for the Closest Vector Problem with Preprocessing over l Norm Wenbin Chen Jiangtao Meng Abstract We show
More informationNote on shortest and nearest lattice vectors
Note on shortest and nearest lattice vectors Martin Henk Fachbereich Mathematik, Sekr. 6-1 Technische Universität Berlin Straße des 17. Juni 136 D-10623 Berlin Germany henk@math.tu-berlin.de We show that
More informationA Disaggregation Approach for Solving Linear Diophantine Equations 1
Applied Mathematical Sciences, Vol. 12, 2018, no. 18, 871-878 HIKARI Ltd, www.m-hikari.com https://doi.org/10.12988/ams.2018.8687 A Disaggregation Approach for Solving Linear Diophantine Equations 1 Baiyi
More informationCentrum Wiskunde & Informatica, Amsterdam, The Netherlands
Logarithmic Lattices Léo Ducas Centrum Wiskunde & Informatica, Amsterdam, The Netherlands Workshop: Computational Challenges in the Theory of Lattices ICERM, Brown University, Providence, RI, USA, April
More informationLower Bounds of Shortest Vector Lengths in Random NTRU Lattices
Lower Bounds of Shortest Vector Lengths in Random NTRU Lattices Jingguo Bi 1,2 and Qi Cheng 2 1 School of Mathematics Shandong University Jinan, 250100, P.R. China. Email: jguobi@mail.sdu.edu.cn 2 School
More informationCSE 206A: Lattice Algorithms and Applications Winter The dual lattice. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Winter 2016 The dual lattice Instructor: Daniele Micciancio UCSD CSE 1 Dual Lattice and Dual Basis Definition 1 The dual of a lattice Λ is the set ˆΛ of all
More informationApplication of the LLL Algorithm in Sphere Decoding
Application of the LLL Algorithm in Sphere Decoding Sanzheng Qiao Department of Computing and Software McMaster University August 20, 2008 Outline 1 Introduction Application Integer Least Squares 2 Sphere
More informationCSC 2414 Lattices in Computer Science October 11, Lecture 5
CSC 244 Lattices in Computer Science October, 2 Lecture 5 Lecturer: Vinod Vaikuntanathan Scribe: Joel Oren In the last class, we studied methods for (approximately) solving the following two problems:
More informationA Digital Signature Scheme based on CVP
A Digital Signature Scheme based on CVP Thomas Plantard Willy Susilo Khin Than Win Centre for Computer and Information Security Research Universiy Of Wollongong http://www.uow.edu.au/ thomaspl thomaspl@uow.edu.au
More informationDiophantine equations via weighted LLL algorithm
Cryptanalysis of a public key cryptosystem based on Diophantine equations via weighted LLL algorithm Momonari Kudo Graduate School of Mathematics, Kyushu University, JAPAN Kyushu University Number Theory
More information9 Knapsack Cryptography
9 Knapsack Cryptography In the past four weeks, we ve discussed public-key encryption systems that depend on various problems that we believe to be hard: prime factorization, the discrete logarithm, and
More informationA Lattice-Based Public-Key Cryptosystem
A Lattice-Based Public-Key Cryptosystem Jin-Yi Cai and Thomas W. Cusick 1 Department of Computer Science State University of New York at Buffalo, Buffalo, NY 1460 cai@cs.buffalo.edu Department of Mathematics
More informationLattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors
Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert Alon Rosen November 26, 2006 Abstract We demonstrate an average-case problem which is as hard as finding γ(n)-approximate
More informationLattice Reduction Algorithms: Theory and Practice
Lattice Reduction Algorithms: Theory and Practice Phong Q. Nguyen INRIA and ENS, Département d informatique, 45 rue d Ulm, 75005 Paris, France http://www.di.ens.fr/~pnguyen/ Abstract. Lattice reduction
More informationCryptanalysis of the Quadratic Generator
Cryptanalysis of the Quadratic Generator Domingo Gomez, Jaime Gutierrez, Alvar Ibeas Faculty of Sciences, University of Cantabria, Santander E 39071, Spain jaime.gutierrez@unican.es Abstract. Let p be
More informationLattice Reduction for Modular Knapsack
Lattice Reduction for Modular Knapsack Thomas Plantard, Willy Susilo, and Zhenfei Zhang Centre for Computer and Information Security Research School of Computer Science & Software Engineering (SCSSE) University
More informationWorst case complexity of the optimal LLL algorithm
Worst case complexity of the optimal LLL algorithm ALI AKHAVI GREYC - Université de Caen, F-14032 Caen Cedex, France aliakhavi@infounicaenfr Abstract In this paper, we consider the open problem of the
More informationNew Lattice Based Cryptographic Constructions
New Lattice Based Cryptographic Constructions Oded Regev August 7, 2004 Abstract We introduce the use of Fourier analysis on lattices as an integral part of a lattice based construction. The tools we develop
More informationAlgorithms for ray class groups and Hilbert class fields
(Quantum) Algorithms for ray class groups and Hilbert class fields Sean Hallgren joint with Kirsten Eisentraeger Penn State 1 Quantum Algorithms Quantum algorithms for number theoretic problems: Factoring
More informationSolving the Shortest Lattice Vector Problem in Time n
Solving the Shortest Lattice Vector Problem in Time.465n Xavier Pujol 1 and Damien Stehlé 1 Université de Lyon, Laboratoire LIP, CNRS-ENSL-INRIA-UCBL, 46 Allée d Italie, 69364 Lyon Cedex 07, France CNRS,
More informationPost-Quantum Cryptography
Post-Quantum Cryptography Sebastian Schmittner Institute for Theoretical Physics University of Cologne 2015-10-26 Talk @ U23 @ CCC Cologne This work is licensed under a Creative Commons Attribution-ShareAlike
More informationImproved Analysis of Kannan s Shortest Lattice Vector Algorithm
mproved Analysis of Kannan s Shortest Lattice Vector Algorithm Abstract The security of lattice-based cryptosystems such as NTRU GGH and Ajtai-Dwork essentially relies upon the intractability of computing
More informationIsodual Reduction of Lattices
Isodual Reduction of Lattices Nicholas A. Howgrave-Graham nhowgravegraham@ntru.com NTRU Cryptosystems Inc., USA Abstract We define a new notion of a reduced lattice, based on a quantity introduced in the
More informationOn Nearly Orthogonal Lattice Bases and Random Lattices
On Nearly Orthogonal Lattice Bases and Random Lattices Ramesh Neelamani, Sanjeeb Dash, and Richard G. Baraniuk September 18, 2006 Abstract We study lattice bases where the angle between any basis vector
More informationLattice reduction for modular knapsack
University of Wollongong Research Online Faculty of Engineering and Information Sciences - Papers: Part A Faculty of Engineering and Information Sciences 2013 Lattice reduction for modular knapsack Thomas
More informationProving Hardness of LWE
Winter School on Lattice-Based Cryptography and Applications Bar-Ilan University, Israel 22/2/2012 Proving Hardness of LWE Bar-Ilan University Dept. of Computer Science (based on [R05, J. of the ACM])
More informationDensity of Ideal Lattices
Density of Ideal Lattices - Preliminary Draft - Johannes Buchmann and Richard Lindner Technische Universität Darmstadt, Department of Computer Science Hochschulstraße 10, 64289 Darmstadt, Germany buchmann,rlindner@cdc.informatik.tu-darmstadt.de
More informationLimits on the Hardness of Lattice Problems in l p Norms
Limits on the Hardness of Lattice Problems in l p Norms Chris Peikert Abstract Several recent papers have established limits on the computational difficulty of lattice problems, focusing primarily on the
More informationOded Regev Courant Institute, NYU
Fast er algorithm for the Shortest Vector Problem Oded Regev Courant Institute, NYU (joint with Aggarwal, Dadush, and Stephens-Davidowitz) A lattice is a set of points Lattices L={a 1 v 1 + +a n v n a
More information47-831: Advanced Integer Programming Lecturer: Amitabh Basu Lecture 2 Date: 03/18/2010
47-831: Advanced Integer Programming Lecturer: Amitabh Basu Lecture Date: 03/18/010 We saw in the previous lecture that a lattice Λ can have many bases. In fact, if Λ is a lattice of a subspace L with
More informationHow to Factor N 1 and N 2 When p 1 = p 2 mod 2 t
How to Factor N 1 and N 2 When p 1 = p 2 mod 2 t Kaoru Kurosawa and Takuma Ueda Ibaraki University, Japan Abstract. Let N 1 = p 1q 1 and N 2 = p 2q 2 be two different RSA moduli. Suppose that p 1 = p 2
More informationNoninteractive Statistical Zero-Knowledge Proofs for Lattice Problems
Noninteractive Statistical Zero-Knowledge Proofs for Lattice Problems Chris Peikert 1, and Vinod Vaikuntanathan 2, 1 SRI International, cpeikert@alum.mit.edu 2 MIT, vinodv@mit.edu Abstract. We construct
More informationImplicit factorization of unbalanced RSA moduli
Implicit factorization of unbalanced RSA moduli Abderrahmane Nitaj 1 and Muhammad Rezal Kamel Ariffin 2 1 Laboratoire de Mathématiques Nicolas Oresme Université de Caen Basse Normandie, France abderrahmane.nitaj@unicaen.fr
More informationAn Algorithmist s Toolkit Lecture 18
18.409 An Algorithmist s Toolkit 2009-11-12 Lecture 18 Lecturer: Jonathan Kelner Scribe: Colin Jia Zheng 1 Lattice Definition. (Lattice) Given n linearly independent vectors b 1,, b n R m, the lattice
More informationShort solutions for a linear Diophantine equation
Lecturas Matemáticas Volumen 27 (2006), páginas 5 16 Short solutions for a linear Diophantine equation H. Esmaeili Bu-Ali Sina University, Hamedan, Iran Abstract. It is known that finding the shortest
More informationLattice Cryptography
CSE 206A: Lattice Algorithms and Applications Winter 2016 Lattice Cryptography Instructor: Daniele Micciancio UCSD CSE Lattice cryptography studies the construction of cryptographic functions whose security
More informationLimits on the Hardness of Lattice Problems in l p Norms
Electronic Colloquium on Computational Complexity, Revision 1 of Report No. 148 (2006) Limits on the Hardness of Lattice Problems in l p Norms Chris Peikert 15 February, 2007 Abstract We show that several
More informationApproximating-CVP to within Almost-Polynomial Factors is NP-Hard
Approximating-CVP to within Almost-Polynomial Factors is NP-Hard I Dinur Tel-Aviv University dinur@mathtauacil G Kindler Tel-Aviv University puzne@mathtauacil S Safra Tel-Aviv University Abstract This
More informationEnumeration. Phong Nguyễn
Enumeration Phong Nguyễn http://www.di.ens.fr/~pnguyen March 2017 References Joint work with: Yoshinori Aono, published at EUROCRYPT 2017: «Random Sampling Revisited: Lattice Enumeration with Discrete
More informationThe Euclidean Distortion of Flat Tori
The Euclidean Distortion of Flat Tori Ishay Haviv Oded Regev June 0, 010 Abstract We show that for every n-dimensional lattice L the torus R n /L can be embedded with distortion O(n log n) into a Hilbert
More informationCSE 206A: Lattice Algorithms and Applications Spring Basic Algorithms. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Spring 2014 Basic Algorithms Instructor: Daniele Micciancio UCSD CSE We have already seen an algorithm to compute the Gram-Schmidt orthogonalization of a lattice
More informationAn Efficient and Parallel Gaussian Sampler for Lattices
An Efficient and Parallel Gaussian Sampler for Lattices Chris Peikert Georgia Institute of Technology Abstract. At the heart of many recent lattice-based cryptographic schemes is a polynomial-time algorithm
More informationNotes for Lecture 16
COS 533: Advanced Cryptography Lecture 16 (11/13/2017) Lecturer: Mark Zhandry Princeton University Scribe: Boriana Gjura Notes for Lecture 16 1 Lattices (continued) 1.1 Last time. We defined lattices as
More informationA new attack on RSA with a composed decryption exponent
A new attack on RSA with a composed decryption exponent Abderrahmane Nitaj and Mohamed Ould Douh,2 Laboratoire de Mathématiques Nicolas Oresme Université de Caen, Basse Normandie, France abderrahmane.nitaj@unicaen.fr
More informationLattices. A Lattice is a discrete subgroup of the additive group of n-dimensional space R n.
Lattices A Lattice is a discrete subgroup of the additive group of n-dimensional space R n. Lattices have many uses in cryptography. They may be used to define cryptosystems and to break other ciphers.
More informationarxiv: v1 [cs.ds] 2 Nov 2013
On the Lattice Isomorphism Problem Ishay Haviv Oded Regev arxiv:1311.0366v1 [cs.ds] 2 Nov 2013 Abstract We study the Lattice Isomorphism Problem (LIP), in which given two lattices L 1 and L 2 the goal
More informationLecture 2: Lattices and Bases
CSE 206A: Lattice Algorithms and Applications Spring 2007 Lecture 2: Lattices and Bases Lecturer: Daniele Micciancio Scribe: Daniele Micciancio Motivated by the many applications described in the first
More informationClassical hardness of the Learning with Errors problem
Classical hardness of the Learning with Errors problem Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé August 12, 2013 Adeline Langlois Hardness
More informationLattice Basis Reduction Part 1: Concepts
Lattice Basis Reduction Part 1: Concepts Sanzheng Qiao Department of Computing and Software McMaster University, Canada qiao@mcmaster.ca www.cas.mcmaster.ca/ qiao October 25, 2011, revised February 2012
More informationLattice Basis Reduction and the LLL Algorithm
Lattice Basis Reduction and the LLL Algorithm Curtis Bright May 21, 2009 1 2 Point Lattices A point lattice is a discrete additive subgroup of R n. A basis for a lattice L R n is a set of linearly independent
More informationOn estimating the lattice security of NTRU
On estimating the lattice security of NTRU Nick Howgrave-Graham, Jeff Hoffstein, Jill Pipher, William Whyte NTRU Cryptosystems Abstract. This report explicitly refutes the analysis behind a recent claim
More informationCS Topics in Cryptography January 28, Lecture 5
CS 4501-6501 Topics in Cryptography January 28, 2015 Lecture 5 Lecturer: Mohammad Mahmoody Scribe: Ameer Mohammed 1 Learning with Errors: Motivation An important goal in cryptography is to find problems
More informationTrapdoors for Lattices: Simpler, Tighter, Faster, Smaller
Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller Daniele Micciancio 1 Chris Peikert 2 1 UC San Diego 2 Georgia Tech April 2012 1 / 16 Lattice-Based Cryptography y = g x mod p m e mod N e(g a,
More information