Classical hardness of Learning with Errors

Transcription

1 Classical hardness of Learning with Errors Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé Adeline Langlois Classical Hardness of LWE 1/ 13

2 Our main results Not quantum GapSVP in dimension n A classical reduction from a worst-case lattice problem to the Learning with Errors problem with small modulus. Dimension n Polynomial in n Adeline Langlois Classical Hardness of LWE 2/ 13

3 Outline 1. Lattices: definitions and problems 2. Lattice-based cryptography: LWE and a public-key encryption 3. Our main result: classical hardness of LWE for polynomial modulus Adeline Langlois Classical Hardness of LWE 3/ 13

4 Lattices and problems b 2 b 1 Lattice L(B) = { n 1=i a ib i, a i Z}, where the (b i ) 1 i n s, linearly independent vectors, are a basis of L(B). Adeline Langlois Classical Hardness of LWE 4/ 13

5 Lattices and problems Definitions: 1st minimum; 2nd minimum. λ 2 λ 1 Lattice L(B) = { n 1=i a ib i, a i Z}, where the (b i ) 1 i n s, linearly independent vectors, are a basis of L(B). Adeline Langlois Classical Hardness of LWE 4/ 13

6 Lattices and problems Definitions: 1st minimum; 2nd minimum. Problems : b 1 Shortest Vector Pbm. (computational or decisional version) Lattice L(B) = { n 1=i a ib i, a i Z}, where the (b i ) 1 i n s, linearly independent vectors, are a basis of L(B). Adeline Langlois Classical Hardness of LWE 4/ 13

7 Lattices and problems b 2 Definitions: 1st minimum; 2nd minimum. Problems : b 1 Shortest Vector Pbm. (computational or decisional version) Shortest Independent Vectors Pbm. Lattice L(B) = { n 1=i a ib i, a i Z}, where the (b i ) 1 i n s, linearly independent vectors, are a basis of L(B). Adeline Langlois Classical Hardness of LWE 4/ 13

8 Lattices and problems Definitions: 1st minimum; 2nd minimum. b 2 Problems : b 1 Shortest Vector Pbm. (computational or decisional version) Shortest Independent Vectors Pbm. Approximation factor: γ. Conjecture There is no polynomial time algorithm that approximates these lattice problems to within polynomial factors. Adeline Langlois Classical Hardness of LWE 4/ 13

9 LWE-based cryptography From basic to very advanced primitives Public key encryption [Regev 2005,...]; Identity-based encryption [Gentry, Peikert and Vaikuntanathan 2008,...]; Attribute-based encryption [Boyen 2013; Gorbunov, Vaikuntanathan and Wee 2013]; Fully homomorphic encryption [Brakerski and Vaikuntanathan 2011,...]. Advantages of LWE-based primitives Efficient, especially when the modulus is polynomial; Security proofs from the hardness of LWE; Likely to resist attacks from quantum computers. Adeline Langlois Classical Hardness of LWE 5/ 13

10 The Learning With Errors problem [Regev05] LWE n q (with m arbitrarily large) Given m A, A s + e find s n A U(Z m n q ), s U(Z n q ), e D Z m,αq with α = o(1). αq Discrete Gaussian error Decision version: Distinguish from (A, b) with b uniform. Adeline Langlois Classical Hardness of LWE 6/ 13

11 LWE: solve a linear system with noise Find (s 1, s 2, s 3, s 4, s 5 ) such that: s s s 3 + 2s 4 + s 5 16 mod 23 3s 1 + 2s s 3 + 7s 4 + 8s 5 17 mod 23 15s s s 3 + s s 5 3 mod 23 17s s 2 + s s 4 + 3s 5 8 mod 23 2s 1 + s s 3 + 6s 4 + 2s 5 9 mod 23 4s 1 + 4s 2 + s 3 + 5s 4 + s 5 18 mod 23 11s s 2 + 5s 3 + s 4 + 9s 5 7 mod 23 Arbitrary number of equations. Other interpretation: decoding a uniform linear code for the Euclidean distance. Adeline Langlois Classical Hardness of LWE 7/ 13

12 An example of Public-Key Encryption[Regev 2005] Parameters: n, m, q Z, α R, Keys: sk = s and pk = ( A, b ), with b = A s + e mod q where s U(Z n q ), A U(Z m n q ), e D Z m,αq. Encryption (M {0, 1}): Let r U({0, 1} m ), r r u T = A, v = b + q/2. M Adeline Langlois Classical Hardness of LWE 8/ 13

13 An example of Public-Key Encryption[Regev 2005] Parameters: n, m, q Z, α R, Keys: sk = s and pk = ( A, b ), with b = A s + e mod q where s U(Z n q ), A U(Z m n q ), e D Z m,αq. Encryption (M {0, 1}): Let r U({0, 1} m ), u T = r A, v = r b + q/2. M Decryption of (u, v): compute v u T s, r r A s + e + q/2. M A s = small + q/2. M } {{ } } {{ } v u T s If close from 0: return 0, if close from q/2 : return 1. Adeline Langlois Classical Hardness of LWE 8/ 13

14 An example of Public-Key Encryption[Regev 2005] Parameters: n, m, q Z, α R, Keys: sk = s and pk = ( A, b ), with b = A s + e mod q where s U(Z n q ), A U(Z m n q ), e D Z m,αq. Encryption (M {0, 1}): Let r U({0, 1} m ), r r u T = A, v = b + q/2. M Decryption of (u, v): compute v u T s, r r A s + e + q/2. M } {{ } v } {{ } u T s A s = small + q/2. M LWE hard Regev s scheme is "secure". Adeline Langlois Classical Hardness of LWE 8/ 13

15 Prior reductions from worst-case lattice problem to LWE [Regev05] A quantum reduction; with q polynomial. Quantum computer? [Peikert09] A classical reduction; with q exponential, [Peikert09] A classical reduction; based on a non-standard lattice problem; with q polynomial. Inefficient primitives Hardness? Adeline Langlois Classical Hardness of LWE 9/ 13

16 Prior reductions from worst-case lattice problem to LWE [Regev05] A quantum reduction; with q polynomial. [Peikert09] A classical reduction; with q exponential, [Peikert09] A classical reduction; based on a non-standard lattice problem; with q polynomial. Our main result A classical reduction, from a standard worst-case lattice problem, with q polynomial. Adeline Langlois Classical Hardness of LWE 9/ 13

17 Main component in the proof: a self reduction Recall that [Peikert09] already showed hardness of LWE with q exponential. How do we obtain a hardness proof for q polynomial? Adeline Langlois Classical Hardness of LWE 10/ 13

18 Main component in the proof: a self reduction Recall that [Peikert09] already showed hardness of LWE with q exponential. How do we obtain a hardness proof for q polynomial? All we have to do is show the following reduction: A reduction from LWE with modulus q exponential to LWE with modulus p polynomial. Adeline Langlois Classical Hardness of LWE 10/ 13

19 Modulus Switching A reduction from LWE with modulus q to LWE with modulus p. How to map (A, As + e) mod q to (A, A s + e ) mod p? Transform A U(Z m n q ) to A U(Z m n p ); First idea: A = p q A? Adeline Langlois Classical Hardness of LWE 11/ 13

20 Modulus Switching A reduction from LWE with modulus q to LWE with modulus p. How to map (A, As + e) mod q to (A, A s + e ) mod p? Transform A U(Z m n q ) to A U(Z m n p ); First idea: A = p q A? Two main problems: 1. The distribution is not uniform: A naive rounding introduces artefacts. solution Add a Gaussian rounding to smooth the distribution: A = p q A + R. 2. In A s + e, the rounding errors gets multiplied by the secret s (which is uniform is Z n q ). Adeline Langlois Classical Hardness of LWE 11/ 13

21 From large to small secret From LWE with arbitrary secret to LWE with binary secret. Inspired by ideas from cryptography (prior reduction by [Goldwasser, Kalai, Peikert and Vaikuntanathan 2010]) ; but different and stronger techniques. Definition of LWE: m A, A s + e find s n From s uniform in Z n q to s uniform in {0, 1} n. Consequence: this reduction expands the dimension from n to n log q. Adeline Langlois Classical Hardness of LWE 12/ 13

22 Summary of our new hardness proof of LWE Our main result A classical reduction from GapSVP in dimension n to LWE in dimension n with poly(n) modulus. Reductions of the proof: Problem Dimension Modulus Secret GapSVP n 0 LWE 1 n large Z n q LWE n large small 2 LWE n poly(n) in Z n q [Peikert09] New New Adeline Langlois Classical Hardness of LWE 13/ 13

23 Conclusion Our main result A classical reduction from GapSVP in dimension n to LWE in dimension n with poly(n) modulus. Other results The hardness of LWE n q is a function of n log q. Open problems: Is there a classical reduction as good as the one in [Regev05]? 1. We lose a quadratic term in the dimension; 2. We do not have the same hard problem on lattices than Regev. Adeline Langlois Classical Hardness of LWE 13/ 13