Recovering Short Generators of Principal Ideals in Cyclotomic Rings

Transcription

1 Recovering Short Generators of Principal Ideals in Cyclotomic Rings Ronald Cramer, Léo Ducas, Chris Peikert, Oded Regev 9 July 205 Simons Institute Workshop on Math of Modern Crypto / 5

2 Short Generators of Ideals in Cryptography A few recent lattice-related cryptoschemes [SV0, GGH3, LSS4, CGS4] share this KeyGen: sk Choose a short g in some ring R (e.g., R = Z[X]/(X n + )) pk Output a bad Z-basis B (e.g., the HNF) of the ideal gr 2 / 5

3 Short Generators of Ideals in Cryptography A few recent lattice-related cryptoschemes [SV0, GGH3, LSS4, CGS4] share this KeyGen: sk Choose a short g in some ring R (e.g., R = Z[X]/(X n + )) pk Output a bad Z-basis B (e.g., the HNF) of the ideal gr Key recovery in two steps: 2 / 5

4 Short Generators of Ideals in Cryptography A few recent lattice-related cryptoschemes [SV0, GGH3, LSS4, CGS4] share this KeyGen: sk Choose a short g in some ring R (e.g., R = Z[X]/(X n + )) pk Output a bad Z-basis B (e.g., the HNF) of the ideal gr Key recovery in two steps: Principal Ideal Problem (PIP): Given a Z-basis B of a principal ideal I, recover some generator h (i.e., I = hr) 2 / 5

5 Short Generators of Ideals in Cryptography A few recent lattice-related cryptoschemes [SV0, GGH3, LSS4, CGS4] share this KeyGen: sk Choose a short g in some ring R (e.g., R = Z[X]/(X n + )) pk Output a bad Z-basis B (e.g., the HNF) of the ideal gr Key recovery in two steps: Principal Ideal Problem (PIP): Given a Z-basis B of a principal ideal I, recover some generator h (i.e., I = hr) 2 Short Generator Problem (SGP): Given an arbitrary generator h of I, recover the short generator g (up to trivial equivalences) 2 / 5

6 Short Generators of Ideals in Cryptography A few recent lattice-related cryptoschemes [SV0, GGH3, LSS4, CGS4] share this KeyGen: sk Choose a short g in some ring R (e.g., R = Z[X]/(X n + )) pk Output a bad Z-basis B (e.g., the HNF) of the ideal gr Key recovery in two steps: Principal Ideal Problem (PIP): Given a Z-basis B of a principal ideal I, recover some generator h (i.e., I = hr) 2 Short Generator Problem (SGP): Given an arbitrary generator h of I, recover the short generator g (up to trivial equivalences) Not obvious a priori that g is even uniquely defined. But any short enough element in I suffices to break system. 2 / 5

7 Cost of the Two Steps Principal Ideal Problem (find some generator h) Subexponential 2 Õ(n 2/3) -time classical algorithm [BF4, Bia4]. Major progress toward poly-time quantum algorithm [EHKS4, BS5, CGS4]. 3 / 5

8 Cost of the Two Steps Principal Ideal Problem (find some generator h) Subexponential 2 Õ(n 2/3) -time classical algorithm [BF4, Bia4]. Major progress toward poly-time quantum algorithm [EHKS4, BS5, CGS4]. 2 Short Generator Problem (find the short generator g) In general, essentially CVP on the log-unit lattice of ring... 3 / 5

9 Cost of the Two Steps Principal Ideal Problem (find some generator h) Subexponential 2 Õ(n 2/3) -time classical algorithm [BF4, Bia4]. Major progress toward poly-time quantum algorithm [EHKS4, BS5, CGS4]. 2 Short Generator Problem (find the short generator g) In general, essentially CVP on the log-unit lattice of ring but is actually a BDD problem in the cryptographic setting. 3 / 5

10 Cost of the Two Steps Principal Ideal Problem (find some generator h) Subexponential 2 Õ(n 2/3) -time classical algorithm [BF4, Bia4]. Major progress toward poly-time quantum algorithm [EHKS4, BS5, CGS4]. 2 Short Generator Problem (find the short generator g) In general, essentially CVP on the log-unit lattice of ring but is actually a BDD problem in the cryptographic setting.!! Claimed to be easy in power-of-2 cyclotomics [CGS4], and experimentally confirmed for relevant dimensions [She4, Sch5]. 3 / 5

11 Cost of the Two Steps Principal Ideal Problem (find some generator h) Subexponential 2 Õ(n 2/3) -time classical algorithm [BF4, Bia4]. Major progress toward poly-time quantum algorithm [EHKS4, BS5, CGS4]. 2 Short Generator Problem (find the short generator g) In general, essentially CVP on the log-unit lattice of ring but is actually a BDD problem in the cryptographic setting.!! Claimed to be easy in power-of-2 cyclotomics [CGS4], and experimentally confirmed for relevant dimensions [She4, Sch5]. But no convincing explanation why it works. 3 / 5

12 Cost of the Two Steps Principal Ideal Problem (find some generator h) Subexponential 2 Õ(n 2/3) -time classical algorithm [BF4, Bia4]. Major progress toward poly-time quantum algorithm [EHKS4, BS5, CGS4]. 2 Short Generator Problem (find the short generator g) In general, essentially CVP on the log-unit lattice of ring but is actually a BDD problem in the cryptographic setting.!! Claimed to be easy in power-of-2 cyclotomics [CGS4], and experimentally confirmed for relevant dimensions [She4, Sch5]. But no convincing explanation why it works. This Work: Main Theorem In cryptographic setting, SGP can be solved in classical polynomial time, for any prime-power cyclotomic number ring R = Z[ζ p k]. 3 / 5

13 What Does This Mean for Ring-Based Crypto? The referenced works are classically weakened, and quantumly broken. 4 / 5

14 What Does This Mean for Ring-Based Crypto? The referenced works are classically weakened, and quantumly broken. Most ring-based crypto is unaffected, because its security is lower-bounded by harder/more general problems: SG-PI-SVP PI-SVP I-SVP R-SIS/LWE crypto 4 / 5

15 What Does This Mean for Ring-Based Crypto? The referenced works are classically weakened, and quantumly broken. Most ring-based crypto is unaffected, because its security is lower-bounded by harder/more general problems: SG-PI-SVP PI-SVP I-SVP R-SIS/LWE crypto Attack crucially relies on ideal having exceptionally short generator. Such ideals are extremely rare: for almost all principal ideals, the shortest generator is vastly longer than the shortest vector. 4 / 5

16 What Does This Mean for Ring-Based Crypto? The referenced works are classically weakened, and quantumly broken. Most ring-based crypto is unaffected, because its security is lower-bounded by harder/more general problems: SG-PI-SVP PI-SVP I-SVP R-SIS/LWE crypto Attack crucially relies on ideal having exceptionally short generator. Such ideals are extremely rare: for almost all principal ideals, the shortest generator is vastly longer than the shortest vector. Devising hard distributions of lattice problems is very tricky: exploitable structure abounds! 2 Worst-case hardness protects us from weak instances. 4 / 5

17 Agenda Introduction 2 Log-Unit Lattice 3 Attack and Proof Outline 5 / 5

18 (Logarithmic) Embedding Let K = Q[X]/f(X) be a number field of degree n and let σ i : K C be its n complex embeddings. The canonical embedding is σ : K C n The logarithmic embedding is Log: K \ {0} R n x (σ (x),..., σ n (x)). x (log σ (x),..., log σ n (x) ). It is a group homomorphism from (K \ {0}, ) to (R n, +). Example: Power-of-2 Cyclotomics K = Q[X]/(X n + ) for n = 2 k. σ i (X) = ω 2i, where ω = exp(π /n). Log(X j ) = 0 and Log( X) = [whiteboard] 6 / 5

19 Example: Embedding σ(z[ 2]) R 2 x-axis: σ (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b / 5

20 Example: Embedding σ(z[ 2]) R 2 x-axis: σ (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b 2 component-wise multiplication / 5

21 Example: Embedding σ(z[ 2]) R 2 x-axis: σ (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b 2 component-wise multiplication Symmetries induced by mult. by, 2 conjugation / 5

22 Example: Embedding σ(z[ 2]) R 2 x-axis: σ (a + b 2) = a + b 2 y-axis: σ 2 (a + b 2) = a b 2 component-wise multiplication Symmetries induced by mult. by, 2 conjugation 2 2 Orthogonal elements Units (algebraic norm ) Isonorms 7 / 5

23 Example: Logarithmic Embedding Log Z[ 2] Λ ={ } is a rank- lattice of R 2, orthogonal to (, ) 8 / 5

24 Example: Logarithmic Embedding Log Z[ 2] { } are finite # shifted copies of Λ 8 / 5

25 Example: Logarithmic Embedding Log Z[ 2] Some { } may be empty (e.g., no elements of norm 3) 8 / 5

26 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. 9 / 5

27 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. Dirichlet s Unit Theorem: the kernel of Log is the cyclic group of roots of unity in R, and Λ R n is a lattice of rank r + c, orthogonal to (where K has r real embeddings and 2c complex embeddings) 9 / 5

28 Unit Group and the Log-Unit Lattice Let R denote the mult. group of units of R, and Λ = Log R R n. Dirichlet s Unit Theorem: the kernel of Log is the cyclic group of roots of unity in R, and Λ R n is a lattice of rank r + c, orthogonal to (where K has r real embeddings and 2c complex embeddings) Short Generators via CVP Elements g, h R generate the same ideal if and only if g = h u for some unit u R, i.e., Log g = Log h + Log u Log h + Λ. In particular, g is a smallest generator iff Log g is a shortest element of Log h + Λ. 9 / 5

29 Decoding Λ = Log Z[ 2] Decoding mod Λ into various fundamental domains. 0 / 5

30 Decoding Λ = Log Z[ 2] Decoding mod Λ into various fundamental domains. 0 / 5

31 Decoding Λ = Log Z[ 2] Decoding mod Λ into various fundamental domains. 0 / 5

32 Decoding Λ = Log Z[ 2] Decoding mod Λ into various fundamental domains. 0 / 5

33 Round-Off Decoding The simplest algorithm to solve CVP/BDD: Round(B, t) for B a basis of Λ Return B frac(b t). Used as a decoding algorithm, its correctness is characterized by the error e and the dual basis B = B T. Fact Suppose h = u + g for some u Λ. If b j, g [ 2, 2 ) for all j, then Round(B, h) = g. / 5

34 Recovering the Short Generator: Proof Outline Construct a basis B of the log-unit lattice Λ = Log R. For K = Q(ζm ), m = p k, a canonical (almost -)basis is given by b j = Log ζj, 2 j < m/2, j coprime with m. ζ it only generates a sublattice of finite index h +, which is conjectured to be small 2 / 5

35 Recovering the Short Generator: Proof Outline Construct a basis B of the log-unit lattice Λ = Log R. For K = Q(ζm ), m = p k, a canonical (almost -)basis is given by b j = Log ζj, 2 j < m/2, j coprime with m. ζ 2 Prove that the basis B is good, i.e., all b j are small. it only generates a sublattice of finite index h +, which is conjectured to be small 2 / 5

36 Recovering the Short Generator: Proof Outline Construct a basis B of the log-unit lattice Λ = Log R. For K = Q(ζm ), m = p k, a canonical (almost -)basis is given by b j = Log ζj, 2 j < m/2, j coprime with m. ζ 2 Prove that the basis B is good, i.e., all b j are small. 3 Prove that g = Log g is sufficiently small when g generated as in cryptosystem, so that b j, g [ 2, 2 ). it only generates a sublattice of finite index h +, which is conjectured to be small 2 / 5

37 Recovering the Short Generator: Proof Outline Construct a basis B of the log-unit lattice Λ = Log R. For K = Q(ζm ), m = p k, a canonical (almost -)basis is given by b j = Log ζj, 2 j < m/2, j coprime with m. ζ 2 Prove that the basis B is good, i.e., all b j are small. 3 Prove that g = Log g is sufficiently small when g generated as in cryptosystem, so that b j, g [ 2, 2 ). Technical Contributions 2 Show b j = Õ(/ m) using Gauss sums and Dirichlet L-series. 3 Bound b j, g using theory of subexponential random variables. it only generates a sublattice of finite index h +, which is conjectured to be small 2 / 5

38 Open Problems (Easy?) Extend to non-prime-power cyclotomics. 3 / 5

39 Open Problems (Easy?) Extend to non-prime-power cyclotomics. (Not hard?) Extend to nice non-cyclotomic families of number fields K. Enough to find a good enough basis of Log O K (or a dense enough sublattice). 3 / 5

40 Open Problems (Easy?) Extend to non-prime-power cyclotomics. (Not hard?) Extend to nice non-cyclotomic families of number fields K. Enough to find a good enough basis of Log O K (or a dense enough sublattice). (Hard.) Asymptotically bound h + for cyclotomics. 3 / 5

41 Open Problems (Easy?) Extend to non-prime-power cyclotomics. (Not hard?) Extend to nice non-cyclotomic families of number fields K. Enough to find a good enough basis of Log O K (or a dense enough sublattice). (Hard.) Asymptotically bound h + for cyclotomics. Thanks! 3 / 5

42 References I J.-F. Biasse and C. Fieker. Subexponential class group and unit group computation in large degree number fields. LMS Journal of Computation and Mathematics, 7: , 204. Jean-François Biasse. Subexponential time relations in the class group of large degree number fields. Adv. Math. Commun., 8(4): , 204. J.-F. Biasse and F. Song. A polynomial time quantum algorithm for computing class groups and solving the principal ideal problem in arbitrary degree number fields In preparation. Peter Campbell, Michael Groves, and Dan Shepherd. Soliloquy: A cautionary tale. ETSI 2nd Quantum-Safe Crypto Workshop, 204. Available at and_attacks/s07_groves_annex.pdf. Kirsten Eisenträger, Sean Hallgren, Alexei Kitaev, and Fang Song. A quantum algorithm for computing the unit group of an arbitrary degree number field. In Proceedings of the 46th Annual ACM Symposium on Theory of Computing, pages ACM, / 5

43 References II Sanjam Garg, Craig Gentry, and Shai Halevi. Candidate multilinear maps from ideal lattices. In EUROCRYPT, pages 7, 203. Adeline Langlois, Damien Stehlé, and Ron Steinfeld. Gghlite: More efficient multilinear maps from ideal lattices. In Advances in Cryptology EUROCRYPT 204, pages Springer, 204. John Schank. LogCvp, Pari implementation of CVP in log Z[ζ 2 n] Dan Shepherd, December 204. Personal communication. Nigel P. Smart and Frederik Vercauteren. Fully homomorphic encryption with relatively small key and ciphertext sizes. In Public Key Cryptography, pages , / 5