2 Settings Continuous setting: C n : a lattice, : component-wise - PowerPoint PPT Presentation

L ogarithmic L attices L´ eo Ducas Centrum Wiskunde & Informatica, Amsterdam, The Netherlands Workshop: Computational Challenges in the Theory of Lattices ICERM, Brown University, Providence, RI, USA, April 23-27, 2018 L. Ducas (CWI) Logarithmic Lattices April 2018 1 / 29

2 Settings Continuous setting: Λ ⊂ C n : a lattice, ⊙ : component-wise product on C n . v ∈ C n �→ (exp( v 1 ) , . . . , exp( v n )) ⊙ Λ Exp Λ : � L = { v ∈ C n s.t. Exp Λ ( v ) = Λ } . Discrete setting: B = { p 1 , . . . p n } ⊂ K × : a set of primes of a field K . [ · ] : K × → G , a multiplicative morphism to a finite abelian group G . v ∈ Z n �→ �� � p v i Exp B : � i L = { v ∈ Z n s.t. Exp B ( v ) = Id G } . L. Ducas (CWI) Logarithmic Lattices April 2018 2 / 29

Logarithm Problem Logarithms are only defined mod L : Exp B ( x ) = Exp B ( y ) ⇔ x ∈ y + L Log B ( g ) := Exp − 1 B ( g ) = x + L s.t. Exp B ( x ) = g Hidden Subgroup Problem Find the lattice L (a set of generators of L ). (typically: find one non-zero vector ⇒ find the whole lattice) Classically: Index Calculus Methods, Quantumly: [Eisentrger Hallgren Kitaev Song 14] Discrete Logarithm Problem mod p R = Z , g , h ∈ ( Z / p Z ) × , [ · ] : x �→ x mod p , L = ( p − 1) Z is known. DLP: Find a representative x ∈ Log( g ) L. Ducas (CWI) Logarithmic Lattices April 2018 3 / 29

Short Logarithm Problems ? ... non-zero vector in a lattice (coset) ... Non-zero vector in a lattice, you said ? How short can it be ? Can it be found efficiently ? Fair question, but why would that matter ? L. Ducas (CWI) Logarithmic Lattices April 2018 4 / 29

Short Logarithm Problems ? ... non-zero vector in a lattice (coset) ... Non-zero vector in a lattice, you said ? How short can it be ? Can it be found efficiently ? Fair question, but why would that matter ? L. Ducas (CWI) Logarithmic Lattices April 2018 4 / 29

Short Logarithm Problems ? ... non-zero vector in a lattice (coset) ... Non-zero vector in a lattice, you said ? How short can it be ? Can it be found efficiently ? Fair question, but why would that matter ? L. Ducas (CWI) Logarithmic Lattices April 2018 4 / 29

Short Logarithm Problems ? ... non-zero vector in a lattice (coset) ... Non-zero vector in a lattice, you said ? How short can it be ? Can it be found efficiently ? Fair question, but why would that matter ? L. Ducas (CWI) Logarithmic Lattices April 2018 4 / 29

Short Logarithm Problems ? Example (DLP over ( Z / p Z ) × ) dim L = 1: Shortest solution trivially found... Example (Inside Index Caculus) Step 1 (relation collection) find many vectors M = ( v 1 . . . v m ) ∈ L . Step 2 (linear algebra) Solve the linear system Mx = y . Step 2 is faster if M is sparse: we want to make M “shorter” ! But dim L = HUGE: limited to ad-hoc micro improvements. More interesting cases for lattice theoretician and algorithmicians ? L. Ducas (CWI) Logarithmic Lattices April 2018 5 / 29

3 encounters with L ogarithmic L attices [Cramer D. Peikert Regev 16] : Dirichlet’s Unit lattice [Cramer D. Wesolowsky 17] : Stickelberger’s Class-relation lattice Summary: These lattices admits a known almost-orthogonal basis ⇒ Can use lattice algorithm to solve ‘short-DLP’ ⇒ Break some crypto [Chor Rivest ’89] : Logarithmic lattices over ( Z / p Z ) × Summary: Make certain ‘short-DLP’ easy by design, get an efficiently decodable lattice, hide it for Crypto. [D. Pierrot ’18] : Logarithmic lattices over ( Z / p Z ) × Summary: Remove crypto from Chor-Rivest. Optimize asymptotically. Get close to Minkowski’s bound. L. Ducas (CWI) Logarithmic Lattices April 2018 6 / 29

3 encounters with L ogarithmic L attices [Cramer D. Peikert Regev 16] : Dirichlet’s Unit lattice [Cramer D. Wesolowsky 17] : Stickelberger’s Class-relation lattice Summary: These lattices admits a known almost-orthogonal basis ⇒ Can use lattice algorithm to solve ‘short-DLP’ ⇒ Break some crypto [Chor Rivest ’89] : Logarithmic lattices over ( Z / p Z ) × Summary: Make certain ‘short-DLP’ easy by design, get an efficiently decodable lattice, hide it for Crypto. [D. Pierrot ’18] : Logarithmic lattices over ( Z / p Z ) × Summary: Remove crypto from Chor-Rivest. Optimize asymptotically. Get close to Minkowski’s bound. L. Ducas (CWI) Logarithmic Lattices April 2018 6 / 29

3 encounters with L ogarithmic L attices [Cramer D. Peikert Regev 16] : Dirichlet’s Unit lattice [Cramer D. Wesolowsky 17] : Stickelberger’s Class-relation lattice Summary: These lattices admits a known almost-orthogonal basis ⇒ Can use lattice algorithm to solve ‘short-DLP’ ⇒ Break some crypto [Chor Rivest ’89] : Logarithmic lattices over ( Z / p Z ) × Summary: Make certain ‘short-DLP’ easy by design, get an efficiently decodable lattice, hide it for Crypto. [D. Pierrot ’18] : Logarithmic lattices over ( Z / p Z ) × Summary: Remove crypto from Chor-Rivest. Optimize asymptotically. Get close to Minkowski’s bound. L. Ducas (CWI) Logarithmic Lattices April 2018 6 / 29

Part 1: The L ogarithmic L attice of cyclotomic units Part 2: Short Stickelberger’s C ℓ ass relations Part 3: Chor-Rivest dense S phere- P acking with efficient decoding For a Survey on 1 and 2, see [D. ’17] , http://www.nieuwarchief.nl/serie5/pdf/naw5-2017-18-3-184.pdf L. Ducas (CWI) Logarithmic Lattices April 2018 7 / 29

Part 1: The L ogarithmic L attice of cyclotomic units L. Ducas (CWI) Logarithmic Lattices April 2018 8 / 29

Ideals and Principal Ideals Cyclotomic number field: K (= Q ( ω m )), ring of integer R = O K (= Z [ ω m ]). Definition (Ideals) ◮ An integral ideal is a subset h ⊂ O K closed under addition, and by multiplication by elements of O K , ◮ A (fractional) ideal is a subset f ⊂ K of the form f = 1 x h , where x ∈ Z , ◮ A principal ideal is an ideal f of the form f = g O K for some g ∈ K . In particular, ideals are lattices. We denote F K the set of fractional ideals, and P K the set of principal ideals. L. Ducas (CWI) Logarithmic Lattices April 2018 9 / 29

The Problem Short generator recovery Given h ∈ R , find a small generator g of the ideal ( h ). Note that g ∈ ( h ) is a generator iff g = u · h for some unit u ∈ R × . We need to explore the (multiplicative) unit group R × . Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 6 / 21

The Problem Short generator recovery Given h ∈ R , find a small generator g of the ideal ( h ). Note that g ∈ ( h ) is a generator iff g = u · h for some unit u ∈ R × . We need to explore the (multiplicative) unit group R × . Translation an to additive problem Take logarithms: Log : g �→ (log | σ 1 ( g ) | , . . . , log | σ n ( g ) | ) ∈ R n where the σ i ’s are the canonical embeddings K → C . Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 6 / 21

The Unit Group and the log-unit lattice Let R × denotes the multiplicative group of units of R . Let Λ = Log R × . Theorem (Dirichlet unit Theorem) Λ ⊂ R n is a lattice (of a given rank). Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 7 / 21

The Unit Group and the log-unit lattice Let R × denotes the multiplicative group of units of R . Let Λ = Log R × . Theorem (Dirichlet unit Theorem) Λ ⊂ R n is a lattice (of a given rank). Reduction to a Close Vector Problem Elements g is a generator of ( h ) if and only if Log g ∈ Log h + Λ . Moreover the map Log preserves some geometric information: g is the “smallest” generator iff Log g is the “smallest” in Log h + Λ. Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 7 / 21

√ → R 2 Example: Embedding Z [ 2] ֒ √ √ ◮ x -axis: σ 1 ( a + b 2) = a + b 2 √ √ ◮ y -axis: σ 2 ( a + b 2) = a − b 2 ◮ component-wise additions and 2 multiplications 1 1 0 1 p 1 + 2 − 1 p 2 Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 8 / 21

√ → R 2 Example: Embedding Z [ 2] ֒ √ √ ◮ x -axis: σ 1 ( a + b 2) = a + b 2 √ √ ◮ y -axis: σ 2 ( a + b 2) = a − b 2 ◮ component-wise additions and 2 multiplications 1 1 0 1 p 1 + 2 − 1 p 2 � “Orthogonal” elements � Units (algebraic norm 1) � “Isonorms” curves Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 8 / 21

√ Example: Logarithmic Embedding Log Z [ 2] ( {•} , +) is a sub-monoid of R 2 Log 1 − − → 1 Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 9 / 21

√ Example: Logarithmic Embedding Log Z [ 2] Λ =( {•} , +) ∩ � is a lattice of R 2 , orthogonal to (1 , 1) Log 1 − − → 1 Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 9 / 21

√ Example: Logarithmic Embedding Log Z [ 2] {•} ∩ � are shifted finite copies of Λ Log 1 − − → 1 Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 9 / 21

√ 2] × Reduction modulo Λ = Log Z [ The reduction modΛ for various fundamental domains. Log 1 − − → 1 Cramer, D. , Peikert, Regev (Leiden, CWI,NYU, UM) Recovering Short Generators Eurocrypt , May 2016 10 / 21