Lattice-Based Cryptography: Mathematical and Computational Background. Chris Peikert Georgia Institute of Technology.

Lattice-Based Cryptography: Mathematical and Computational Background Chris Peikert Georgia Institute of Technology crypt@b-it 2013 1 / 18

Lattice-Based Cryptography y = g x mod p m e mod N e(g a, g b ) N = p q = 2 / 18

Lattice-Based Cryptography = 2 / 18

Lattice-Based Cryptography = Why? Simple description and implementation (Images courtesy xkcd.org) 2 / 18

Lattice-Based Cryptography = Why? Simple description and implementation Efficient: linear, highly parallel operations (Images courtesy xkcd.org) 2 / 18

Lattice-Based Cryptography = Why? Simple description and implementation Efficient: linear, highly parallel operations Resists quantum attacks (so far) (Images courtesy xkcd.org) 2 / 18

Lattice-Based Cryptography = Why? Simple description and implementation Efficient: linear, highly parallel operations Resists quantum attacks (so far) Security from worst-case assumptions [Ajtai96,... ] (Images courtesy xkcd.org) 2 / 18

Part 1: Mathematical Background Coming up: 1 Definitions: lattice, basis, determinant, cosets, successive minima,... 2 Two simple bounds on the minimum distance. 3 / 18

Lattices Lattice L of dimension n: a discrete additive subgroup of R n. 4 / 18

Lattices Lattice L of dimension n: a discrete additive subgroup of R n. Additive subgroup: 0 L, and x, y L = x, x + y L. 4 / 18

Lattices Lattice L of dimension n: a discrete additive subgroup of R n. Additive subgroup: 0 L, and x, y L = x, x + y L. Discrete: for all x L, exists ε > 0 s.t. L Ball(x, ε) = {x}. 4 / 18

Lattices Lattice L of dimension n: a discrete additive subgroup of R n. Additive subgroup: 0 L, and x, y L = x, x + y L. Discrete: for all x L, exists ε > 0 s.t. L Ball(x, ε) = {x}. Lattices Not lattices {0}, Z R Q R 2Z, cz for any c R 2Z + 1 = {odd x Z} Z n R n Z + 2Z 3 2 1 0 1 2 3 4 / 18

This Week: Only Full-Rank Integer Lattices Integer lattice: L Z n. (Essentially equivalent to rational lattice, by scaling.) 5 / 18

This Week: Only Full-Rank Integer Lattices Integer lattice: L Z n. (Essentially equivalent to rational lattice, by scaling.) Full-rank lattice: span(l) = R n. Equivalently, L has a set of n linearly independent vectors. 5 / 18

Representing Lattices: Bases Basis of L: ordered set (i.e., matrix) B = (b 1, b 2,..., b n ) s.t. { n } L = L(B) = B Z n = c i b i : c i Z. The b i must be linearly ind., because span(l) = span(b) = R n. The fundamental parallelepiped of basis B is P(B) = B [ 1 2, 1 2) n. i=1 b 2 b 1 O 6 / 18

Cosets and Determinant Quotient group Z n /L consists of cosets v + L: shifts of the lattice. Recall: v 1 + L = v 2 + L iff v 1 v 2 L. v 7 / 18

Cosets and Determinant Quotient group Z n /L consists of cosets v + L: shifts of the lattice. Recall: v 1 + L = v 2 + L iff v 1 v 2 L. Determinant det(l) = Z n /L = det(b) = vol(p(b)), any basis B. For any basis B and v R n, (v + L) P(B) = { v}. Write v = v mod B, the distinguished representative of v + L. v 7 / 18

Successive Minima The minimum distance of L is λ 1 (L) = min v = min x y. 0 v L distinct x,y L b 1 b 2 λ 1 8 / 18

Successive Minima The minimum distance of L is λ 1 (L) = min v = min x y. 0 v L distinct x,y L More generally, the ith successive minimum (i = 1,..., n) is λ i (L) = min{r : L contains i linearly ind. vectors of length r} = min{r : dim(span(l B(r))) i}. b 1 λ 2 b 2 λ 1 8 / 18

Gram-Schmidt Orthogonalization and Lower Bounding λ 1 The GSO (or QR decomposition) of basis B is: b 1 B = QR = Q b 2...., Q orthonormal bn b 2 b 2 b 1 = b 1 9 / 18

Gram-Schmidt Orthogonalization and Lower Bounding λ 1 The GSO (or QR decomposition) of basis B is: b 1 B = QR = Q b 2...., Q orthonormal bn Facts: P( B) = B [ 1 2, 1 2 )n is a fund. region; det(l) = n i=1 b i. b 2 b 2 b 1 = b 1 9 / 18

Upper Bounding λ 1 : Minkowski s Theorem Theorem Any convex, centrally symmetric body S of volume > 2 n det(l) contains a nonzero lattice point. Corollary: λ 1 (L) n det(l) 1/n. 10 / 18

Upper Bounding λ 1 : Minkowski s Theorem Theorem Any convex, centrally symmetric body S of volume > 2 n det(l) contains a nonzero lattice point. Corollary: λ 1 (L) n det(l) 1/n. Proof of Theorem 1 Let S = S/2, so vol(s ) > det(l). 2 By pigeonhole argument, distinct x, y S s.t. x y L. 3 Now 2x, 2y S by central symmetry, so x y S by convexity. Proof of Corollary 1 Ball of radius > n det(l) 1/n is convex and centrally symmetric. 10 / 18

Part 2: Computational Background Lattices are a source of many seemingly hard problems: SVP, CVP, usvp, SIVP, BDD, CRP, DGS,... & decision variants. 11 / 18

Part 2: Computational Background Lattices are a source of many seemingly hard problems: SVP, CVP, usvp, SIVP, BDD, CRP, DGS,... & decision variants. We ll focus on the two most relevant to cryptography: the (approximate) Shortest Vector Problem (SVP γ and GapSVP γ ) and Bounded-Distance Decoding (BDD) problem. 1 They admit worst-case/average-case reductions (to SIS and LWE). 11 / 18

Shortest Vector Problem: SVP γ and GapSVP γ Approximation problems with factor γ = γ(n): Search: given basis B, find nonzero v L s.t. v γ λ 1 (L). b 1 γ λ 1 b 2 λ 1 12 / 18

Shortest Vector Problem: SVP γ and GapSVP γ Approximation problems with factor γ = γ(n): Search: given basis B, find nonzero v L s.t. v γ λ 1 (L). Decision: given basis B and real d, decide between λ 1 (L) d versus λ 1 (L) > γ d. Clearly GapSVP γ SVP γ, but the reverse direction is open! b 2 b 1 d γd 12 / 18

Complexity of GapSVP Clearly, (Gap)SVP γ can only get easier as γ increases. 13 / 18

Complexity of GapSVP Clearly, (Gap)SVP γ can only get easier as γ increases. γ = 2 (log n)1 ɛ n n 2 n NP-hard [Ajtai 98,... ] NP conp [GG 98,AR 05] crypto [Ajtai 96,... ] SVP P [LLL 82,Schnorr 87] For γ = poly(n), best algorithm is 2 n time & space [AKS 01,MV 10,... ] 13 / 18

An Algorithm for SVP 2 (n 1)/2 [LLL 82] Key idea: manipulate basis to ensure b i+1 2 1 2 b i 2, for all i. 14 / 18

An Algorithm for SVP 2 (n 1)/2 [LLL 82] Key idea: manipulate basis to ensure b i+1 2 1 2 b i 2, for all i. This implies b 1 2 (n 1)/2 min b i 2 (n 1)/2 λ 1 (L). i 14 / 18

An Algorithm for SVP 2 (n 1)/2 [LLL 82] Key idea: manipulate basis to ensure b i+1 2 1 2 b i 2, for all i. This implies b 1 2 (n 1)/2 min b i 2 (n 1)/2 λ 1 (L). i In two dimensions: given basis B = (b 1, b 2 ), 1 Let b 2 b 2 c b 1 for the c Z s.t. b 2 b 2 + [ 1 2, 1 2 ) b 1. 2 If b 2 2 < 3 4 b 1 2, swap b 1 b 2 and loop. Else end. Claim 1: At end, b 2 2 1 2 b 1 2 (as desired). Proof: At end, 3 4 b 1 2 b 2 2 b 2 2 + 1 4 b 1 2. Claim 2: Algorithm terminates after poly( B ) many iterations. Proof: Define Φ(B) = b 1 2 b 2 = b 1 det(l). When we swap, Φ decreases by > 3 2 factor. It starts as 2 poly( B ) and cannot go below 1. 14 / 18

Related: Shortest Independent Vectors Problem (SIVP γ ) Given basis B, find lin. ind. v 1,..., v n L s.t. v i γ λ n (L). b 1 λ 2 γ λ 2 λ 1 b 2 15 / 18

Related: Shortest Independent Vectors Problem (SIVP γ ) Given basis B, find lin. ind. v 1,..., v n L s.t. v i γ λ n (L). LLL algorithm also solves SIVP 2 (n 1)/2. b 1 λ 2 γ λ 2 λ 1 b 2 15 / 18

Related: Shortest Independent Vectors Problem (SIVP γ ) Given basis B, find lin. ind. v 1,..., v n L s.t. v i γ λ n (L). LLL algorithm also solves SIVP 2 (n 1)/2. We know GapSVP γ SIVP γ, but the reverse direction is open! b 1 λ 2 γ λ 2 λ 1 b 2 15 / 18

Bounded-Distance Decoding (BDD) Search: given basis B, point t, and real d < λ 1 /2 s.t. dist(t, L) d, find the (unique) v L closest to t. t b 1 b 2 16 / 18

Bounded-Distance Decoding (BDD) Search: given basis B, point t, and real d < λ 1 /2 s.t. dist(t, L) d, find the (unique) v L closest to t. Equivalently, given coset t + L e s.t. e d, find e. Decision: given basis B, coset t + L, and real d, decide between dist(0, t + L) d versus > γ d. b 1 t + L b 2 16 / 18

Algorithms for BDD [Babai 86] Round off: Using a good basis B, output e = t mod B. Works if Ball(d) P(B): radius d = min b i /2. i b 1 b 1 b 2 b 2 17 / 18

Algorithms for BDD [Babai 86] Round off: Using a good basis B, output e = t mod B. Works if Ball(d) P(B): radius d = min b i /2. i Nearest plane: Output e = t mod B. Proceeds iteratively. Works if Ball(d) P( B): radius d = min b i /2. i b 1 b 2 b 2 17 / 18

Wrapping Up Now you know (almost) everything you need to know about lattices (to do cryptography, at least). We ve covered a lot: do the exercises to reinforce your understanding! Tomorrow: the cryptographic problems SIS and LWE (as SVP and BDD variants), and some basic applications. 18 / 18