A History of Lattice-Based Encryption (in order of increasing - - PowerPoint PPT Presentation

▶
a history of lattice based
SMART_READER_LITE
LIVE PREVIEW

A History of Lattice-Based Encryption (in order of increasing - - PowerPoint PPT Presentation

Jul 24, 2023 368 likes •851 views

A History of Lattice-Based Encryption (in order of increasing efficiency) Vadim Lyubashevsky INRIA / ENS, Paris Lattice-Based Crypto & Applications 1 Bar-Ilan University, Israel 2012 Lattice-Based Encryption Schemes 1. NTRU [Hoffstein,

slide-1
SLIDE 1

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 1

A History of Lattice-Based Encryption

(in order of increasing efficiency)

Vadim Lyubashevsky INRIA / ENS, Paris

slide-2
SLIDE 2

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 2

Lattice-Based Encryption Schemes

  • 1. NTRU [Hoffstein, Pipher, Silverman ‘98]
  • 2. LWE-Based [Regev ‘05]
  • 3. Ring-LWE Based [L, Peikert, Regev ’10]
  • 4. “NTRU-like” with a proof of security [Stehle, Steinfeld ‘11]
slide-3
SLIDE 3

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 3

Subset Sum Problem Subset-Sum Based [L, Palacio, Segev ‘10] LWE-Based [Regev ‘05] Ring-LWE Based [L, Peikert, Regev ’10] “NTRU-like” with a proof of security [Stehle, Steinfeld ‘11] NTRU [Hoffstein, Pipher, Silverman ‘98]

slide-4
SLIDE 4

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 4

THE SUBSET SUM PROBLEM

slide-5
SLIDE 5

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 5

ai , T in ZM ai are chosen randomly T is a sum of a random subset of the ai a1 a2 a3 … an T Find a subset of ai's that sums to T (mod M)

Subset Sum Problem

slide-6
SLIDE 6

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 6

ai , T in Z49 ai are chosen randomly T is a sum of a random subset of the ai 15 31 24 3 14 11 15 + 31 + 14 = 11 (mod 49)

Subset Sum Problem

slide-7
SLIDE 7

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 7

How Hard is Subset Sum?

ai , T in ZM a1 a2 a3 … an T Find a subset of ai's that sums to T (mod M) Hardness Depends on:

  • Size of n and M
  • Relationship between n and M
slide-8
SLIDE 8

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 8

Complexity of Solving Subset Sum

M run-time

2log²(n) 2n 2n log(n) 2n² poly(n) 2Ω(n) poly(n) “generalized birthday attacks” [FlaPrz05,Lyu06,Sha08] “lattice reduction attacks” [LagOdl85,Fri86]

slide-9
SLIDE 9

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 9

Subset Sum Crypto

 Why?

simple operations

exponential hardness

very different from number theoretic assumptions

resists quantum attacks

slide-10
SLIDE 10

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 10

Subset Sum is “Pseudorandom”

[Impagliazzo-Naor 1989]:

For random a1,...,an in ZM and random x1,...,xn in {0,1}, distinguishing the distribution (a1,...,an, a1x1+...+anxn mod M) from the uniform distribution U(ZM

n+1)

is as hard as finding x1,...,xn

slide-11
SLIDE 11

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 11

What About Public-Key Encryption?

 Many early attempts  None of them had proofs of security  All seem to be broken

slide-12
SLIDE 12

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 12

Merkle-Hellman Cryptosystem

a1,...,an are super-increasing (aj > a1+...+aj-1) knowing a1,...,an and a1x1+...+anxn , we can recover all the xi Secret key: Super-increasing a1,...,an, and M > a1+...+an and r such that gcd(r,M)=1 Public Key: wi=rai mod M Encrypt(x1,...,xn)=w1x1+...+wnxn

=r(a1x1+...+anxn)

Decrypt(T): Compute r-1T mod M and recover all xi

slide-13
SLIDE 13

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 13

Merkle-Hellman Cryptosystem

a1,...,an are super-increasing (aj > a1+...+aj-1) knowing a1,...,an and a1x1+...+anxn , we can recover all the xi Secret key: Super-increasing a1,...,an, and M > a1+...+an and r such that gcd(r,M)=1 Public Key: wi=rai mod M Encrypt(x1,...,xn)=w1x1+...+wnxn

=r(a1x1+...+anxn)

Decrypt(T): Compute r-1T mod M and recover all xi

Not Random!!

(was exploited in attacks)

slide-14
SLIDE 14

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 14

CRYPTOSYSTEM BASED ON SUBSET SUM [L, PALACIO, SEGEV 2010]

slide-15
SLIDE 15

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 15

Subset Sum Cryptosystem

 Semantically secure based on Subset Sum for

M ≈ nn

 Main tools

Subset sum is pseudo-random Addition in (Zq)n

is “kind of like” addition in ZM

where M=qn

 The proof is very simple

slide-16
SLIDE 16

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 16

Facts About Addition

4

2

9

1

3

2

8

Adding n numbers (written in base q) modulo qm → carries < n If q>>n, then Adding with carries ≈ Adding without carries (i.e. in ZM) (i.e. in (Zq)n )

4 6 7 9 3 9 0 7 8 4 6 5 1 3 4 3 4 7 2 6 4 6 7 9 3 9 0 7 8 4 6 5 1 3 4 3

Want to add 4679 + 3907 + 8465 + 1343 mod 104

slide-17
SLIDE 17

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 17

So...

4 6 7 9 3 9 0 7 8 4 6 5 1 6 4 3 1 1 0 1 8 1 1 9 4 6 7 9 3 9 0 7 8 4 6 5 1 6 4 3 1 1 0 1

+ 2 1 1 0

0 2 2 9

= = NOT Pseudorandom! Pseudorandom based on Subset Sum!

slide-18
SLIDE 18

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 18

Column Subset Sum Addition Is Also Pseudorandom

4 6 7 9 3 9 0 7 8 4 6 5 1 6 4 3 1 1 1 1 1 1 9 8 + =

slide-19
SLIDE 19

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 19

“Hybrid” Subset Sum Addition Is Also Pseudorandom

4 6 7 9 0 3 9 0 7 9 8 4 6 5 8 1 6 4 3 0 1 0 0 1

+

1 1 1 0 0 6 3 2 2 0

=

pseudorandom

slide-20
SLIDE 20

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 20

Encryption Scheme

A

s t = +

A

t r + u v = Public Key

{0,1}n {0,1}n Zq

n x n

slide-21
SLIDE 21

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 21

Encryption Scheme

A

s t = +

A

t r + u v =

Is pseudo-random based on the hardness

  • f the subset sum problem
slide-22
SLIDE 22

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 22

Encryption Scheme

A

s t = +

A

t r + u v =

v A s + r + A s r A s r + A s = =

slide-23
SLIDE 23

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 23

Encryption Scheme

A

s t = +

A

t r + u v =

u s A r s = + A r s + = ≈ v

slide-24
SLIDE 24

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 24

u s v - =

Encryption Scheme

A

s t = +

A

t r + u v =

Encryption of 0

slide-25
SLIDE 25

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 25

u s

  • =

Encryption Scheme

A

s t = +

A

t r + u v =

Encryption of 1

+ u = +

q/2 q/2

v’ v’

slide-26
SLIDE 26

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 26

CRYPTOSYSTEM BASED ON LWE [REGEV 2005]

slide-27
SLIDE 27

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 27

Encryption Scheme

(what we needed)

A

s t = +

A

t r + u v =

Pseudorandom “small”

slide-28
SLIDE 28

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 28

Picking the “Carries”

  • In Subset Sum: carries were deterministic
  • What if … we pick the “carries” at random

from some distribution?

slide-29
SLIDE 29

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 29

So...

4 6 7 9 3 9 0 7 8 4 6 5 1 6 4 3 1 1 0 1

+ 2 1 1 0

0 2 2 9

=

Pseudorandom based on Subset Sum

4 6 7 9 3 9 0 7 8 4 6 5 1 6 4 3 2 3 0 1

+ 1 3 2 1

7 2 0 3

=

Pseudorandom based on LWE [Reg ‘05]

slide-30
SLIDE 30

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 30

LWE vs. Subset Sum

  • The Subset Sum assumption has “deterministic

noise”

  • The LWE assumption is more “versatile”

. . . a1 a2 am s + e = b

LWE Problem

n2 n

slide-31
SLIDE 31

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 31

LWE vs. Subset Sum

  • The Subset Sum assumption has “deterministic

noise”

  • The LWE assumption is more “versatile”

s + = b

Subset Sum Problem

n2 n

a2 a1 an …

slide-32
SLIDE 32

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 32

LWE / Subset Sum Encryption

A

s t = +

A

t r + u v =

n-bit Encryption Have Want Public Key Size Õ(n) / Õ(n2) O(n) Secret Key Size Õ(n) / Õ (n2) O(n) Ciphertext Expansion Õ(n) / Õ (1) O(1) Encryption Time Õ(n3) / Õ (n2) O(n) Decryption Time Õ(n2) O(n)

slide-33
SLIDE 33

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 33

CRYPTOSYSTEM BASED ON RING-LWE [L, PEIKERT, REGEV 2010]

slide-34
SLIDE 34

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 34

Source of Inefficiency of LWE

1 2 1 3 7 8 2 2 * + = 1 Getting just one extra random-looking number requires n random numbers and a small error element. Wishful thinking: get n random numbers and produce n pseudo-random numbers in “one shot” 2 8 7 3 * + = 1 2 1

slide-35
SLIDE 35

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 35

Use Polynomials

f(x) is a polynomial xn + an-1xn-1 + … + a1x + a0 R = Zp[x]/(f(x)) is a polynomial ring with

  • Addition mod p
  • Polynomial multiplication mod p and f(x)

Each element of R consists of n elements in Zp In R:

  • small+small = small
  • small*small = small (depending on f(x) )
slide-36
SLIDE 36

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 36

Polynomial Interpretation of the LWE- based cryptosystem

a s t r a u r t v v u s + + + = = =

  • r

t + r a + s r a s + + r a + s r + s =

  • =

Public Key

slide-37
SLIDE 37

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 37

Security

a s t r a u r t v + + + = = = Pseudorandom??

slide-38
SLIDE 38

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 38

Decision Learning With Errors over Rings

a1

a2 a3 …

am

s

b1

b2 b3

…

bm

+ =

a1

a2 a3 …

am

b1

b2 b3

…

bm

Theorem [LPR ‘10]: In cyclotomic rings, Search-RLWE < Decision-RLWE

World 1 World 2

slide-39
SLIDE 39

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 39

Security

a s t r a u r t v + + + = = = Pseudorandom!!

slide-40
SLIDE 40

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 40

Use Polynomials in Zp[x]/(f(x))

a s t r a u r t v + + + = = =

n-bit Encryption From LWE / SS From Ring-LWE Public Key Size Õ(n) / Õ(n2) Õ(n) Secret Key Size Õ(n) / Õ (n2) Õ(n) Ciphertext Expansion Õ(n) / Õ (1) Õ(1) Encryption Time Õ(n3) / Õ (n2) Õ(n) Decryption Time Õ(n2) Õ(n)

slide-41
SLIDE 41

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 41

1-ELEMENT CRYPTOSYSTEM BASED ON RING-LWE [STEHLE, STEINFELD 2011]

slide-42
SLIDE 42

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 42

Number of Ring Elements

a s t r a u r t v + + + = = = u v + m

p 2 , Can you have a ciphertext with just 1 ring element?

Encryption of m:

slide-43
SLIDE 43

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 43

Stehle, Steinfeld Cryptosystem

f g a a r + + m u 2 = u g r + + m 2 f g g = u g mod 2 = m g u g mod 2 = g m =

Uniformly random Pseudorandom based on Ring-LWE

mod p mod p

“small” coefficients

slide-44
SLIDE 44

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 44

NTRU CRYPTOSYSTEM [HOFFSTEIN, PIPHER, SILVERMAN 1998]

slide-45
SLIDE 45

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 45

NTRU Cryptosystem

f g a a r + + m u 2 = =

“looks” random If a is random, then pseudorandom based on Ring-LWE

f g

  • Very small

u g r + + m 2 f g g =

mod p mod p

Since f, g are smaller, p can be smaller as well

slide-46
SLIDE 46

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 46

(Textbook) NTRU Cryptosystem / Trap-Door Function

f g a = f g

  • Very small

u g r + m 2 f g =

mod p

a r + m u 2 =

mod p

u g mod 2 = m g u g mod 2 = g m

slide-47
SLIDE 47

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 47

References

  • Jeffrey Hoffstein, Jill Pipher, Joseph H. Silverman (1998): NTRU:

A Ring-Based Public Key Cryptosystem

  • Oded Regev (2005): On lattices, learning with errors, random

linear codes, and cryptography

  • Vadim Lyubashevsky, Adriana Palacio, Gil Segev (2010): Public-

Key Cryptographic Primitives Provably as Secure as Subset Sum

  • Vadim Lyubashevsky, Chris Peikert, Oded Regev (2010): On Ideal

Lattices and Learning with Errors over Rings

  • Damien Stehlé, Ron Steinfeld (2011): Making NTRU as Secure as

Worst-Case Problems over Ideal Lattices