Finding Short Generators of Ideals, and Implications for Cryptography. Chris Peikert University of Michigan

Transcription

1 Finding Short Generators of Ideals, and Implications for Cryptography Chris Peikert University of Michigan ANTS XII 29 August 2016 Based on work with Ronald Cramer, Léo Ducas, and Oded Regev 1 / 20

2 Lattice-Based Cryptography High-dimensional lattices in R n appear to offer (quantumly) hard problems that are useful for cryptography. E.g., the approximate Shortest Vector Problem: λ 1 v b 2 b 1 2 / 20

3 Lattice-Based Cryptography High-dimensional lattices in R n appear to offer (quantumly) hard problems that are useful for cryptography. E.g., the approximate Shortest Vector Problem: λ 1 v b 2 b 1 Cryptography requires average-case hardness: systems must be infeasible to break for random keys & outputs (w/ very high prob). 2 / 20

4 A Brief History of Lattice Cryptography 1978 Ad-hoc constructions: Merkle-Hellman, GGH/NTRU signatures, SV/Soliloquy, multilinear maps,... 3 / 20

5 A Brief History of Lattice Cryptography 1978 Ad-hoc constructions: Merkle-Hellman, GGH/NTRU signatures, SV/Soliloquy, multilinear maps,... Many broken or severely weakened due to Achilles heels: random instances from the system are easier than intended. 3 / 20

6 A Brief History of Lattice Cryptography 1978 Ad-hoc constructions: Merkle-Hellman, GGH/NTRU signatures, SV/Soliloquy, multilinear maps,... Many broken or severely weakened due to Achilles heels: random instances from the system are easier than intended Worst-case to average-case reductions for lattice problems. [Ajtai 96,AjtaiDwork 97,(Micciancio)Regev 03-05,... ] 3 / 20

7 A Brief History of Lattice Cryptography 1978 Ad-hoc constructions: Merkle-Hellman, GGH/NTRU signatures, SV/Soliloquy, multilinear maps,... Many broken or severely weakened due to Achilles heels: random instances from the system are easier than intended Worst-case to average-case reductions for lattice problems. [Ajtai 96,AjtaiDwork 97,(Micciancio)Regev 03-05,... ] Random instances are provably at least as hard as all instances of some lattice problems, via poly-time reduction. 3 / 20

8 A Brief History of Lattice Cryptography 1978 Ad-hoc constructions: Merkle-Hellman, GGH/NTRU signatures, SV/Soliloquy, multilinear maps,... Many broken or severely weakened due to Achilles heels: random instances from the system are easier than intended Worst-case to average-case reductions for lattice problems. [Ajtai 96,AjtaiDwork 97,(Micciancio)Regev 03-05,... ] Random instances are provably at least as hard as all instances of some lattice problems, via poly-time reduction. Not so inefficient (though this is changing). 3 / 20

9 A Brief History of Lattice Cryptography 1978 Ad-hoc constructions: Merkle-Hellman, GGH/NTRU signatures, SV/Soliloquy, multilinear maps,... Many broken or severely weakened due to Achilles heels: random instances from the system are easier than intended Worst-case to average-case reductions for lattice problems. [Ajtai 96,AjtaiDwork 97,(Micciancio)Regev 03-05,... ] Random instances are provably at least as hard as all instances of some lattice problems, via poly-time reduction. Not so inefficient (though this is changing) NTRU efficient ring-based encryption: ad-hoc design, but unbroken for suitable parameters. [HoffsteinPipherSilverman 98,... ] 3 / 20

10 A Brief History of Lattice Cryptography 1978 Ad-hoc constructions: Merkle-Hellman, GGH/NTRU signatures, SV/Soliloquy, multilinear maps,... Many broken or severely weakened due to Achilles heels: random instances from the system are easier than intended Worst-case to average-case reductions for lattice problems. [Ajtai 96,AjtaiDwork 97,(Micciancio)Regev 03-05,... ] Random instances are provably at least as hard as all instances of some lattice problems, via poly-time reduction. Not so inefficient (though this is changing) NTRU efficient ring-based encryption: ad-hoc design, but unbroken for suitable parameters. [HoffsteinPipherSilverman 98,... ] 2002 Ring-based crypto with worst-case hardness from ideal lattices. [Micciancio 02,LyubashevskyPeikertRegev 10,... ] 3 / 20

11 Ideal Lattice Cryptography 1 Some ad-hoc ideal-based cryptosystems (e.g., [SV 10,GGH 13,CGS 14]) share this KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., HNF) of the principal ideal I = gr. 4 / 20

12 Ideal Lattice Cryptography 1 Some ad-hoc ideal-based cryptosystems (e.g., [SV 10,GGH 13,CGS 14]) share this KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., HNF) of the principal ideal I = gr. 2 Many systems use Learning With Errors over Rings [LyuPeiReg 10]: a 1 R/qR, b 1 = s a 1 + e 1 R/qR a 2 R/qR, b 2 = s a 2 + e 2 R/qR. errors e i R are small relative to q 4 / 20

13 Ideal Lattice Cryptography 1 Some ad-hoc ideal-based cryptosystems (e.g., [SV 10,GGH 13,CGS 14]) share this KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., HNF) of the principal ideal I = gr. 2 Many systems use Learning With Errors over Rings [LyuPeiReg 10]: a 1 R/qR, b 1 = s a 1 + e 1 R/qR a 2 R/qR, b 2 = s a 2 + e 2 R/qR. For appropriate rings and error distributions, errors e i R are small relative to q worst-case approx-svp on any ideal lattice in R quant search R-LWE decision R-LWE 4 / 20

14 Ideal Lattice Cryptography 1 Some ad-hoc ideal-based cryptosystems (e.g., [SV 10,GGH 13,CGS 14]) share this KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., HNF) of the principal ideal I = gr. 2 Many systems use Learning With Errors over Rings [LyuPeiReg 10]: a 1 R/qR, b 1 = s a 1 + e 1 R/qR a 2 R/qR, b 2 = s a 2 + e 2 R/qR. For appropriate rings and error distributions, errors e i R are small relative to q worst-case approx-svp on any ideal lattice in R quant search R-LWE decision R-LWE (Note: no explicit ideals in Ring-LWE problem, only in reductions.) 4 / 20

15 Agenda 1 Finding short generators (when they exist) of principal ideals 2 Bounds for generators of arbitrary principal ideals 3 Implications for cryptography and open problems 5 / 20

16 Part 1: Finding Short Generators (when they exist) 6 / 20

17 Key Recovery Recall ad-hoc KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., the HNF) of the principal ideal I = gr. 7 / 20

18 Key Recovery Recall ad-hoc KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., the HNF) of the principal ideal I = gr. (Decryption works given any sufficiently short v I, e.g., g X i.) 7 / 20

19 Key Recovery Recall ad-hoc KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., the HNF) of the principal ideal I = gr. (Decryption works given any sufficiently short v I, e.g., g X i.) Secret-key recovery in two steps: 7 / 20

20 Key Recovery Recall ad-hoc KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., the HNF) of the principal ideal I = gr. (Decryption works given any sufficiently short v I, e.g., g X i.) Secret-key recovery in two steps: Principal Ideal Problem 1 Given a Z-basis B of a principal ideal I, find some generator h of I. 7 / 20

21 Key Recovery Recall ad-hoc KeyGen: sk = Short g in some known ring R, often R = Z[ζ 2 k]. pk = Bad Z-basis (e.g., the HNF) of the principal ideal I = gr. (Decryption works given any sufficiently short v I, e.g., g X i.) Secret-key recovery in two steps: Principal Ideal Problem 1 Given a Z-basis B of a principal ideal I, find some generator h of I. Short Generator Problem 2 Given an arbitrary generator h of I, find a sufficiently short generator. 7 / 20

22 How to Perform the Steps 1 Principal Ideal Problem (PIP) has a: classical subexponential 2Õ(n2/3) -time algorithm [BF 14,B 14] quantum polynomial-time algorithm [EHKS 14,CGS 14,BS 14] 8 / 20

23 How to Perform the Steps 1 Principal Ideal Problem (PIP) has a: classical subexponential 2Õ(n2/3) -time algorithm [BF 14,B 14] quantum polynomial-time algorithm [EHKS 14,CGS 14,BS 14] 2 Short Generator Problem (SGP): Can be seen as a Closest Vector Problem in the log-unit lattice of R... 8 / 20

24 How to Perform the Steps 1 Principal Ideal Problem (PIP) has a: classical subexponential 2Õ(n2/3) -time algorithm [BF 14,B 14] quantum polynomial-time algorithm [EHKS 14,CGS 14,BS 14] 2 Short Generator Problem (SGP): Can be seen as a Closest Vector Problem in the log-unit lattice of R but is actually Bounded Distance Decoding for KeyGen s instances. 8 / 20

25 How to Perform the Steps 1 Principal Ideal Problem (PIP) has a: classical subexponential 2Õ(n2/3) -time algorithm [BF 14,B 14] quantum polynomial-time algorithm [EHKS 14,CGS 14,BS 14] 2 Short Generator Problem (SGP): Can be seen as a Closest Vector Problem in the log-unit lattice of R but is actually Bounded Distance Decoding for KeyGen s instances. Was claimed to be easy in two-power cyclotomic rings [CamGroShe 14] and experimentally confirmed in relevant dimensions [Shank 15] 8 / 20

26 How to Perform the Steps 1 Principal Ideal Problem (PIP) has a: classical subexponential 2Õ(n2/3) -time algorithm [BF 14,B 14] quantum polynomial-time algorithm [EHKS 14,CGS 14,BS 14] 2 Short Generator Problem (SGP): Can be seen as a Closest Vector Problem in the log-unit lattice of R but is actually Bounded Distance Decoding for KeyGen s instances. Was claimed to be easy in two-power cyclotomic rings [CamGroShe 14] and experimentally confirmed in relevant dimensions [Shank 15] Theorem 1 [CramerDucasPeikertRegev Eurocrypt 16] SGP can be solved in classical polynomial time on KeyGen s random instances for any prime-power cyclotomic ring R = Z[ζ p k]. 8 / 20

27 How to Perform the Steps 1 Principal Ideal Problem (PIP) has a: classical subexponential 2Õ(n2/3) -time algorithm [BF 14,B 14] quantum polynomial-time algorithm [EHKS 14,CGS 14,BS 14] 2 Short Generator Problem (SGP): Can be seen as a Closest Vector Problem in the log-unit lattice of R but is actually Bounded Distance Decoding for KeyGen s instances. Was claimed to be easy in two-power cyclotomic rings [CamGroShe 14] and experimentally confirmed in relevant dimensions [Shank 15] Theorem 1 [CramerDucasPeikertRegev Eurocrypt 16] SGP can be solved in classical polynomial time on KeyGen s random instances for any prime-power cyclotomic ring R = Z[ζ p k]. ( assuming h + poly(dim)) 8 / 20

28 (Logarithmic) Embedding Let K = Q[X]/f(X) be a number field of degree n, and let σ i : K C be its n complex embeddings. The canonical embedding is the ring homom. σ : K C n x (σ 1 (x),..., σ n (x)). 9 / 20

29 (Logarithmic) Embedding Let K = Q[X]/f(X) be a number field of degree n, and let σ i : K C be its n complex embeddings. The canonical embedding is the ring homom. σ : K C n The logarithmic embedding is Log: K R n x (σ 1 (x),..., σ n (x)). x (log σ 1 (x),..., log σ n (x) ). It is a group homomorphism from (K, ) to (R n, +). 9 / 20

30 (Logarithmic) Embedding Let K = Q[X]/f(X) be a number field of degree n, and let σ i : K C be its n complex embeddings. The canonical embedding is the ring homom. σ : K C n The logarithmic embedding is Log: K R n x (σ 1 (x),..., σ n (x)). x (log σ 1 (x),..., log σ n (x) ). It is a group homomorphism from (K, ) to (R n, +). Example: Two-Power Cyclotomics K = Q[X]/(X n + 1) for n = 2 k. σ i (X) = ω 2i 1, where ω = exp(π 1/n) C. Log(X j ) = 0 for all j. 9 / 20

31 Example: Embedding σ(z[ 2]) R 2 x-axis: σ 1 (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b / 20

32 Example: Embedding σ(z[ 2]) R 2 x-axis: σ 1 (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b 2 component-wise multiplication / 20

33 Example: Embedding σ(z[ 2]) R 2 x-axis: σ 1 (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b 2 component-wise multiplication Symmetries induced by multiplication by 1, 2 conjugation / 20

34 Example: Embedding σ(z[ 2]) R 2 x-axis: σ 1 (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b 2 component-wise multiplication Symmetries induced by multiplication by 1, 2 conjugation 2 2 Orthogonal lattice axes Units (algebraic norm 1) Isonorms 10 / 20

35 Example: Logarithmic Embedding Log Z[ 2] Λ ={ } is a rank-1 lattice Λ R 2, orthogonal to / 20

36 Example: Logarithmic Embedding Log Z[ 2] { } are finite # of shifted copies (cosets) of Λ / 20

37 Example: Logarithmic Embedding Log Z[ 2] Some { } may be empty (e.g., no elements of norm 3) / 20

38 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. 12 / 20

39 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. Dirichlet Unit Theorem The kernel of Log is the cyclic subgroup of roots of unity in R, and Λ R n is a lattice of rank r + c 1, orthogonal to 1 (where K has r real embeddings and 2c complex embeddings) 12 / 20

40 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. Dirichlet Unit Theorem The kernel of Log is the cyclic subgroup of roots of unity in R, and Λ R n is a lattice of rank r + c 1, orthogonal to 1 (where K has r real embeddings and 2c complex embeddings) Shortest Generators from Bounded Distance Decoding Elements g, h R generate the same ideal if and only if g = h u for some unit u R, i.e., Log g = Log h + Log u Log h + Λ. 12 / 20

41 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. Dirichlet Unit Theorem The kernel of Log is the cyclic subgroup of roots of unity in R, and Λ R n is a lattice of rank r + c 1, orthogonal to 1 (where K has r real embeddings and 2c complex embeddings) Shortest Generators from Bounded Distance Decoding Elements g, h R generate the same ideal if and only if g = h u for some unit u R, i.e., Log g = Log h + Log u Log h + Λ. By KeyGen, we know that Log h + Λ has a short g = Log g. 12 / 20

42 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. Dirichlet Unit Theorem The kernel of Log is the cyclic subgroup of roots of unity in R, and Λ R n is a lattice of rank r + c 1, orthogonal to 1 (where K has r real embeddings and 2c complex embeddings) Shortest Generators from Bounded Distance Decoding Elements g, h R generate the same ideal if and only if g = h u for some unit u R, i.e., Log g = Log h + Log u Log h + Λ. By KeyGen, we know that Log h + Λ has a short g = Log g. Our goal is to decode such g, yielding g (up to roots of unity). 12 / 20

43 Decoding Λ = Log Z[ 2] Decoding cosets h + Λ into various fundamental domains of Λ / 20

44 Decoding Λ = Log Z[ 2] Decoding cosets h + Λ into various fundamental domains of Λ / 20

45 Decoding Λ = Log Z[ 2] Decoding cosets h + Λ into various fundamental domains of Λ / 20

46 Decoding Λ = Log Z[ 2] Decoding cosets h + Λ into various fundamental domains of Λ / 20

47 Round-Off Decoding The simplest lattice-decoding algorithm: Round(B, h) for a basis B of Λ and h R n Return B frac(b 1 h), where frac: R n [ 1 2, 1 2 )n. b 2 g b 1 h 14 / 20

48 Round-Off Decoding The simplest lattice-decoding algorithm: Round(B, h) for a basis B of Λ and h R n Return B frac(b 1 h), where frac: R n [ 1 2, 1 2 )n. b 2 g b 1 h Behavior is characterized by the offset and the dual basis B = B t. Trivial Fact Suppose h = g + u for some u Λ. If b j, g [ 1 2, 1 2 ) for all j, then Round(B, h) = g. 14 / 20

49 Recovering a Short Generator: Proof Outline 1 Obtain a good basis B of the log-unit lattice Λ = Log R. For K = Q(ζ m ), m = p k, a standard (almost 1 -)basis of Λ is given by b j = Log 1 ζj, 1 < j < m/2, gcd(j, m) = 1. 1 ζ 1 it generates a sublattice of finite index h +, which is conjectured to be small. 15 / 20

50 Recovering a Short Generator: Proof Outline 1 Obtain a good basis B of the log-unit lattice Λ = Log R. For K = Q(ζ m ), m = p k, a standard (almost 1 -)basis of Λ is given by b j = Log 1 ζj, 1 < j < m/2, gcd(j, m) = 1. 1 ζ 2 Prove that B is good, i.e., all b j are small. 1 it generates a sublattice of finite index h +, which is conjectured to be small. 15 / 20

51 Recovering a Short Generator: Proof Outline 1 Obtain a good basis B of the log-unit lattice Λ = Log R. For K = Q(ζ m ), m = p k, a standard (almost 1 -)basis of Λ is given by b j = Log 1 ζj, 1 < j < m/2, gcd(j, m) = 1. 1 ζ 2 Prove that B is good, i.e., all b j are small. 3 Prove that g = Log g from KeyGen is sufficiently small, so that b j, g [ 1 2, 1 2 ) and round-off decoding yields g. 1 it generates a sublattice of finite index h +, which is conjectured to be small. 15 / 20

52 Recovering a Short Generator: Proof Outline 1 Obtain a good basis B of the log-unit lattice Λ = Log R. For K = Q(ζ m ), m = p k, a standard (almost 1 -)basis of Λ is given by b j = Log 1 ζj, 1 < j < m/2, gcd(j, m) = 1. 1 ζ 2 Prove that B is good, i.e., all b j are small. 3 Prove that g = Log g from KeyGen is sufficiently small, so that b j, g [ 1 2, 1 2 ) and round-off decoding yields g. Technical Steps Bound b j = Õ(1/ m) using Gauss sums and Dirichlet L-series. Bound b j, g 1 2 via subexponential random variables. 1 it generates a sublattice of finite index h +, which is conjectured to be small. 15 / 20

53 Part 2: Bounds for Generators of Arbitrary Principal Ideals 16 / 20

54 Average Case Versus Worst Case Cryptanalysis of KeyGen exploited the promise that the public principal ideal has a quite short generator g (for BDD on g + Λ). 17 / 20

55 Average Case Versus Worst Case Cryptanalysis of KeyGen exploited the promise that the public principal ideal has a quite short generator g (for BDD on g + Λ). How (a)typical are such principal ideals? 17 / 20

56 Average Case Versus Worst Case Cryptanalysis of KeyGen exploited the promise that the public principal ideal has a quite short generator g (for BDD on g + Λ). How (a)typical are such principal ideals? Recall that breaking Ring-LWE implies (quantumly) solving approx-svp, usually for small poly factors, on any ideal in the ring. 17 / 20

57 Average Case Versus Worst Case Cryptanalysis of KeyGen exploited the promise that the public principal ideal has a quite short generator g (for BDD on g + Λ). How (a)typical are such principal ideals? Recall that breaking Ring-LWE implies (quantumly) solving approx-svp, usually for small poly factors, on any ideal in the ring. Do log-unit attacks apply to this problem? To Ring-LWE itself? 17 / 20

58 Average Case Versus Worst Case Cryptanalysis of KeyGen exploited the promise that the public principal ideal has a quite short generator g (for BDD on g + Λ). How (a)typical are such principal ideals? Recall that breaking Ring-LWE implies (quantumly) solving approx-svp, usually for small poly factors, on any ideal in the ring. Do log-unit attacks apply to this problem? To Ring-LWE itself? In cyclotomic rings R = Z[ζ m ] of prime-power conductor m: 17 / 20

59 Average Case Versus Worst Case Cryptanalysis of KeyGen exploited the promise that the public principal ideal has a quite short generator g (for BDD on g + Λ). How (a)typical are such principal ideals? Recall that breaking Ring-LWE implies (quantumly) solving approx-svp, usually for small poly factors, on any ideal in the ring. Do log-unit attacks apply to this problem? To Ring-LWE itself? In cyclotomic rings R = Z[ζ m ] of prime-power conductor m: Upper Bound [CDPR 16] Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx SVP on I. 17 / 20

60 Average Case Versus Worst Case Cryptanalysis of KeyGen exploited the promise that the public principal ideal has a quite short generator g (for BDD on g + Λ). How (a)typical are such principal ideals? Recall that breaking Ring-LWE implies (quantumly) solving approx-svp, usually for small poly factors, on any ideal in the ring. Do log-unit attacks apply to this problem? To Ring-LWE itself? In cyclotomic rings R = Z[ζ m ] of prime-power conductor m: Upper Bound [CDPR 16] Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx SVP on I. Lower Bound [CDPR 16] For most principal ideals, their shortest generators are only 2 Ω( m/ log m) SVP approximations. (Assuming h + = 2 O(m).) 17 / 20

61 Proof Outline: Upper Bound Theorem Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx-svp on I. 18 / 20

62 Proof Outline: Upper Bound Theorem Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx-svp on I. (Cf. average case from KeyGen, where we solve SVP exactly.) 18 / 20

63 Proof Outline: Upper Bound Theorem Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx-svp on I. (Cf. average case from KeyGen, where we solve SVP exactly.) For principal ideal hr, the generators have log-embeddings Log h + Λ. 18 / 20

64 Proof Outline: Upper Bound Theorem Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx-svp on I. (Cf. average case from KeyGen, where we solve SVP exactly.) For principal ideal hr, the generators have log-embeddings Log h + Λ. Make l norm of Log g Log h + Λ small to get a short-ish generator. (Note: Log g, 1 = log N(I) for all generators g.) 18 / 20

65 Proof Outline: Upper Bound Theorem Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx-svp on I. (Cf. average case from KeyGen, where we solve SVP exactly.) For principal ideal hr, the generators have log-embeddings Log h + Λ. Make l norm of Log g Log h + Λ small to get a short-ish generator. (Note: Log g, 1 = log N(I) for all generators g.) A simple randomized round-off algorithm using the good (almost-)basis B of Λ yields Log g O( m log m) + 1 n log N(I). 18 / 20

66 Proof Outline: Upper Bound Theorem Given any generator of a principal ideal I (e.g., via quantum PIP algorithm), we can efficiently solve 2 O( m log m) -approx-svp on I. (Cf. average case from KeyGen, where we solve SVP exactly.) For principal ideal hr, the generators have log-embeddings Log h + Λ. Make l norm of Log g Log h + Λ small to get a short-ish generator. (Note: Log g, 1 = log N(I) for all generators g.) A simple randomized round-off algorithm using the good (almost-)basis B of Λ yields Log g O( m log m) + 1 n log N(I). Therefore, g 2 O( m log m) N(I) 1/n 2 O( m log m) λ 1 (I). 18 / 20

67 Proof Outline: Lower Bound Theorem For most principal ideals, their shortest generators are only 2 Ω( m/ log m) SVP approximations. (Assuming h + = 2 O(m).) 19 / 20

68 Proof Outline: Lower Bound Theorem For most principal ideals, their shortest generators are only 2 Ω( m/ log m) SVP approximations. (Assuming h + = 2 O(m).) So returning a generator yields 2 Ω( m) SVP approx, in the worst case. 19 / 20

69 Proof Outline: Lower Bound Theorem For most principal ideals, their shortest generators are only 2 Ω( m/ log m) SVP approximations. (Assuming h + = 2 O(m).) So returning a generator yields 2 Ω( m) SVP approx, in the worst case. For any g = Log g span(λ), some coordinate is s = g 1 /(2n), so g exp(s). 19 / 20

70 Proof Outline: Lower Bound Theorem For most principal ideals, their shortest generators are only 2 Ω( m/ log m) SVP approximations. (Assuming h + = 2 O(m).) So returning a generator yields 2 Ω( m) SVP approx, in the worst case. For any g = Log g span(λ), some coordinate is s = g 1 /(2n), so g exp(s). Therefore, we care about the l 1 covering radius: µ 1 (Λ) := max min g 1. h span(λ) g h+λ 19 / 20

71 Proof Outline: Lower Bound Theorem For most principal ideals, their shortest generators are only 2 Ω( m/ log m) SVP approximations. (Assuming h + = 2 O(m).) So returning a generator yields 2 Ω( m) SVP approx, in the worst case. For any g = Log g span(λ), some coordinate is s = g 1 /(2n), so g exp(s). Therefore, we care about the l 1 covering radius: µ 1 (Λ) := max min g 1. h span(λ) g h+λ In the worst case, a shortest generator approximates SVP to only a exp(ω(µ 1 (Λ)/n)) factor. 19 / 20

72 Proof Outline: Lower Bound Theorem For most principal ideals, their shortest generators are only 2 Ω( m/ log m) SVP approximations. (Assuming h + = 2 O(m).) So returning a generator yields 2 Ω( m) SVP approx, in the worst case. For any g = Log g span(λ), some coordinate is s = g 1 /(2n), so g exp(s). Therefore, we care about the l 1 covering radius: µ 1 (Λ) := max min g 1. h span(λ) g h+λ In the worst case, a shortest generator approximates SVP to only a exp(ω(µ 1 (Λ)/n)) factor. Bound µ 1 (Λ) Ω(m 3/2 / log m) using volume argument. 19 / 20

73 Open Problems 1 Extend to non-principal ideals. [CramerDucasWesolowski 16, preprint] 20 / 20

74 Open Problems 1 Extend to non-principal ideals. [CramerDucasWesolowski 16, preprint] 2 Extend to proposed non-cyclotomic number fields, e.g., R = Z[X]/(X p X 1). [Bernstein 14] Seems sufficient to find a good full-rank set in Λ = Log R. It s easy to find several good units; full rank is unclear. 20 / 20

75 Open Problems 1 Extend to non-principal ideals. [CramerDucasWesolowski 16, preprint] 2 Extend to proposed non-cyclotomic number fields, e.g., R = Z[X]/(X p X 1). [Bernstein 14] Seems sufficient to find a good full-rank set in Λ = Log R. It s easy to find several good units; full rank is unclear. 3 Circumvent the 2 Ω( m) SVP approx barrier for generators. Find a short generator of a cleverly chosen ideal IJ? 20 / 20

76 Open Problems 1 Extend to non-principal ideals. [CramerDucasWesolowski 16, preprint] 2 Extend to proposed non-cyclotomic number fields, e.g., R = Z[X]/(X p X 1). [Bernstein 14] Seems sufficient to find a good full-rank set in Λ = Log R. It s easy to find several good units; full rank is unclear. 3 Circumvent the 2 Ω( m) SVP approx barrier for generators. Find a short generator of a cleverly chosen ideal IJ? 4 Apply or extend any of these techniques against NTRU/Ring-LWE. Ideal-SVP is a lower bound for Ring-LWE; is it an upper bound? 20 / 20

77 Open Problems 1 Extend to non-principal ideals. [CramerDucasWesolowski 16, preprint] 2 Extend to proposed non-cyclotomic number fields, e.g., R = Z[X]/(X p X 1). [Bernstein 14] Seems sufficient to find a good full-rank set in Λ = Log R. It s easy to find several good units; full rank is unclear. 3 Circumvent the 2 Ω( m) SVP approx barrier for generators. Find a short generator of a cleverly chosen ideal IJ? 4 Apply or extend any of these techniques against NTRU/Ring-LWE. Ideal-SVP is a lower bound for Ring-LWE; is it an upper bound? Thanks! 20 / 20