Lattice Reduction of Modular, Convolution, and NTRU Lattices

Transcription

1 Summer School on Computational Number Theory and Applications to Cryptography Laramie, Wyoming, June 19 July 7, 2006 Lattice Reduction of Modular, Convolution, and NTRU Lattices Project suggested by Joe Silverman Background: A lattice is a regular array of points in R n. A lattice may be described by specifying a basis of vectors v 1,..., v n R n. The corresponding lattice is the Z-linear span of the basis vectors, L = { a 1 v 1 + a 2 v a n v n : a 1, a 2,..., a n Z }. Of course, a lattice has many different possible bases. Two fundamental computational problems in the theory of lattices are: Shortest Vector Problem (SVP) Find the shortest nonzero vector in L Closest Vector Problem (CVP) Given a vector t R n not in L, find a vector in L that is closest to t. Lattices have been used extensively in cryptography, both as a tool for breaking cryptosystems and as a source of hard problems for creating cryptosystems. For both of these purposes it is important to understand the difficulty of solving SVP and CVP in lattices of moderately high dimension. Lattice reduction algorithms are used to solve these problems. In this project you will learn about LLL-BKZ, one of the most powerful known lattice reduction algorithms, and you will study its effectiveness in solving SVP a certain class of cryptographically significant lattices. The LLL (Lenstra-Lenstra-Lovász) algorithm runs in polynomial time and is guaranteed to find a vector in L that is not more than about 2 n/2 times longer than the actual shortest vector (although LLL often does better than this). LLL works by swapping pairs of vectors and performing approximate Gram-Schmidt orthogonalization. The block variant of LLL, called LLL-BKZ, replaces the pair swapping with a more complicated operation on blocks of β vectors. (BKZ stands for Block Korkin-Zolotarev.) LLL-BKZ always finds a vector that is at most (approximately) β n/β times longer than the actual shortest vector,

2 but at a cost that the running time is exponential in β. For cryptographic (and other) applications, it is important to know in practice how increasing the block size actually improves the output. You will study this question for the following sorts of lattices. A Modular Lattice of Type (N, q) is a 2N-dimensional lattice generated by the rows of a matrix of the form h 00 h 01 h 0,N h 10 h 11 h 1,N h L Mod = RowSpan N 1,0 h N 1,1 h N 1,N q q q where integers h ij are chosen to satisfy 1 2 q < h ij 1 2 q. Notice that it takes approximately N 2 log 2 (q) bits to describe a modular lattice of type (N, q). A Convolution (Modular) Lattice of Type (N, q) is a modular lattice in which the rows in the h-block are cyclic rotatations of one another, h 0 h 1 h N h N 1 h 0 h N h L CML = RowSpan 1 h 2 h q q q It takes only about N log 2 (q) bits to describe a convolution modular lattice. Finally, an NTRU Lattice of Type (N, q, d) is a convolution modular lattice that contains a short vector of the form where [f 0, f 1,..., f N 1, g 0, g 1,..., g N 1 ], f 0,..., f N 1, g 0,..., g N 1 {0, 1} and N 1 i=0 f i = N 1 i=0 g i = d.

3 These are the lattices assosciated to the NTRU public key cryptosystem. The vector h = (h 0,..., h N 1 ) is the public key and the short (f, g) vector is the private key. Logistics/Timeline: Week 1: Learn how LLL works [2] and learn about the block version LLL- BKZ [11]. Analyze the Gaussian heuristic for modular lattices (learn about the Γ-function, compute the exact volume of unit ball in R n ) [6]. Experiment: Learn how to use LLL-BKZ in the NTL computer package [7, 8]. Week 2: Learn about the NTRU cryptosystem (key generation, encryption, decryption) and how finding an NTRU private key is (probably) equivalent to solving SVP in an NTRU lattice [4, 12, 9]. Experiments: Run experiments on Modular and Convolution Lattices using LLL- BKZ (say with q N/2). Analyze the output and study how the blocksize β affects the output. (Compare the output to the Gaussian expected shortest vector.) Specific questions: Do Modular and Convolution Lattices behave differently? Try to find a relation between β, and the length of the shortest vector found by LLL-BKZ. (Repeat with different N/q ratios.) Week 3: Study some of the other applications of lattices to cryptography. Possible topics include: (1) Using lattices to find small solutions to congruences and an application to breaking RSA under certain circumstances [1, 3, 5]. (2) Using lattices to break various versions of knapsack cryptosystems [10]. Experiments: Program NTRU key generation and use it to create NTRU lattices of type (N, q, d) (say with q N/2 and d N/3). Rerun the experiments from Week 2 on NTRU lattices and see how the results differ from the Week 2 experiments.

4 Specific question: As a function of N, what is the smallest blocksize β that is needed to find the NTRU key? Additional Experiment (for those who like to play around with the guts of computer packages): The implementation of LLL-BKZ in NTL is for arbitrary lattices. However, modular and convolution lattices L Z 2N contain the sublattice qz 2N, so we can always reduce the coordinates modulo q. So do the following. First, when LLL-BKZ is running, find out what is the largest integer coordinate that appears during internal computations. In particular, is it signficantly larger than q? Second, if so, modify the LLL-BKZ algorithm in NTL so that it always reduces all coordinates modulo q and see if this makes NTL run significantly faster on modular lattices. Designated Experts: Lattices: Joe Silverman (week 1 only), Qingquan Wu. NTL Computer Package: Mike Jacobson, Eric Landquist, Jonathan Webster. References [1] Johannes Blömer and Alexander May. Low secret exponent RSA revisited. In Cryptography and lattices (Providence, RI, 2001), volume 2146 of Lecture Notes in Comput. Sci., pages Springer, Berlin, [An application of lattices to cryptography.]. [2] Henri Cohen. A course in computational algebraic number theory, volume 138 of Graduate Texts in Mathematics. Springer-Verlag, Berlin, [Textbook with a description of the LLL algorithm and implementation notes.]. [3] Don Coppersmith. Finding small solutions to small degree polynomials. In Cryptography and lattices (Providence, RI, 2001), volume 2146 of Lecture Notes in Comput. Sci., pages Springer, Berlin, [An application of lattices to cryptography.]. [4] Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman. NTRU: a ring-based public key cryptosystem. In Algorithmic number theory (Portland, OR, 1998), volume 1423 of Lecture Notes in Comput. Sci., pages Springer, Berlin, [The original description of the NTRU public key cryptosystem.]. [5] Nick Howgrave-Graham. Approximate integer common divisors. In Cryptography and lattices (Providence, RI, 2001), volume 2146 of Lecture Notes in Comput. Sci., pages Springer, Berlin, [An application of lattices to cryptography.]. [6] Alexander May and Joseph H. Silverman. Dimension reduction methods for convolution modular lattices. In Cryptography and lattices (Providence, RI, 2001), volume 2146 of Lecture Notes in Comput. Sci., pages Springer, Berlin, [Some analysis of convolution modular lattices and NTRU lattices.].

5 [7] NTL home page. [8] NTL LLL documentation. [NTL web page describing routines for performing lattice basis reduction, including very fast and robust implementations of the Schnorr-Euchner LLL and Block Korkin Zolotarev reduction algorithm, as well as an integer-only reduction algorithm.]. [9] NTRU tutorial. [Tutorials on the NTRU public key cryptosystem.]. [10] A. M. Odlyzko. The rise and fall of knapsack cryptosystems. In Cryptology and computational number theory (Boulder, CO, 1989), volume 42 of Proc. Sympos. Appl. Math., pages Amer. Math. Soc., Providence, RI, [The title says it all!]. [11] C.-P. Schnorr. A hierarchy of polynomial time lattice basis reduction algorithms. Theoret. Comput. Sci., 53(2-3): , [The LLL-BKZ algorithm.]. [12] Joseph H. Silverman. Lattices, cryptography, and the NTRU public key cryptosystem. In Unusual applications of number theory, volume 64 of DIMACS Ser. Discrete Math. Theoret. Comput. Sci., pages Amer. Math. Soc., Providence, RI, [An overview of lattices and NTRU.].