An Efficient and Parallel Gaussian Sampler for Lattices Chris - PowerPoint PPT Presentation

An Efficient and Parallel Gaussian Sampler for Lattices Chris Peikert Georgia Tech CRYPTO 2010 1 / 10

Lattice-Based Crypto L ⊂ R n b 2 b 1 2 / 10

Lattice-Based Crypto L ⊂ R n p 1 p 2 2 / 10

Lattice-Based Crypto L ⊂ R n b 2 p 1 b 1 = ⇒ p 2 (Images courtesy xkcd.org) 2 / 10

Lattice-Based Crypto L ⊂ R n b 2 p 1 b 1 = ⇒ p 2 ✔ Asymptotically efficient & highly parallelizable (Images courtesy xkcd.org) 2 / 10

Lattice-Based Crypto L ⊂ R n b 2 p 1 b 1 = ⇒ p 2 ✔ Asymptotically efficient & highly parallelizable ✔ Worst-case assumptions (& quantum-resistant?) [Ajtai’96,. . . ] (Images courtesy xkcd.org) 2 / 10

Lattice-Based Crypto L ⊂ R n b 2 p 1 b 1 = ⇒ p 2 ✔ Asymptotically efficient & highly parallelizable ✔ Worst-case assumptions (& quantum-resistant?) [Ajtai’96,. . . ] ✔ Many rich applications: ⋆ ‘Hash-and-sign’ signatures [GPV’08, CHKP’10, R’10, B’10] ⋆ (Hierarchical) IBE [GPV’08, CHKP’10, ABB’10a, ABB’10b] ⋆ Fully homomorphic encryption [G’09, SV’10, vDGHV’10] (Images courtesy xkcd.org) 2 / 10

Gaussian Sampling on Lattices ◮ Given ‘good’ basis B and center c , sample discrete Gaussian on L b 2 c b 1 [B’93,R’03,AR’04,MR’04,. . . ] 3 / 10

Gaussian Sampling on Lattices ◮ Given ‘good’ basis B and center c , sample discrete Gaussian on L ⋆ ‘Zero-knowledge’ operation: leaks no information about B [GPV’08] b 2 c b 1 [B’93,R’03,AR’04,MR’04,. . . ] 3 / 10

Gaussian Sampling on Lattices ◮ Given ‘good’ basis B and center c , sample discrete Gaussian on L ⋆ ‘Zero-knowledge’ operation: leaks no information about B [GPV’08] b 2 c b 1 [B’93,R’03,AR’04,MR’04,. . . ] Crypto Applications ◮ ‘Answering queries:’ signing, (H)IBE key extraction, (NI)ZK 3 / 10

Gaussian Sampling on Lattices ◮ Given ‘good’ basis B and center c , sample discrete Gaussian on L ⋆ ‘Zero-knowledge’ operation: leaks no information about B [GPV’08] b 2 c b 1 [B’93,R’03,AR’04,MR’04,. . . ] Crypto Applications ◮ ‘Answering queries:’ signing, (H)IBE key extraction, (NI)ZK ◮ Worst-case / average-case reductions [GPV’08,P’09,LPR’10,G’10] 3 / 10

Gaussian Sampling on Lattices ◮ Given ‘good’ basis B and center c , sample discrete Gaussian on L ⋆ ‘Zero-knowledge’ operation: leaks no information about B [GPV’08] b 2 c b 1 [B’93,R’03,AR’04,MR’04,. . . ] Crypto Applications ◮ ‘Answering queries:’ signing, (H)IBE key extraction, (NI)ZK ◮ Worst-case / average-case reductions [GPV’08,P’09,LPR’10,G’10] ◮ Narrower Gaussian ⇒ smaller keys ⇒ more efficient schemes 3 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 Good News, and Bad News. . . 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 Good News, and Bad News. . . ✔ Narrow: width ≈ max � � b i � = max dist between adjacent ‘planes’ 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 Good News, and Bad News. . . ✔ Narrow: width ≈ max � � b i � = max dist between adjacent ‘planes’ ✗ Not efficient: time = Ω( n 3 ) , high-precision real arithmetic 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 Good News, and Bad News. . . ✔ Narrow: width ≈ max � � b i � = max dist between adjacent ‘planes’ ✗ Not efficient: time = Ω( n 3 ) , high-precision real arithmetic ✗ Inherently sequential: n adaptive iterations 4 / 10

The GPV Sampling Algorithm ◮ ‘Nearest-plane’ algorithm w/ randomized rounding [Babai’86,Klein’00] b 2 c b 1 Good News, and Bad News. . . ✔ Narrow: width ≈ max � � b i � = max dist between adjacent ‘planes’ ✗ Not efficient: time = Ω( n 3 ) , high-precision real arithmetic ✗ Inherently sequential: n adaptive iterations ✗ No efficiency improvement for ring-based crypto [NTRU’98,M’02,. . . ] 4 / 10

Our Contributions 1 A new Gaussian sampling algorithm for lattices. 5 / 10

Our Contributions 1 A new Gaussian sampling algorithm for lattices. Key Features ⋆ Simple & efficient: ≈ 4 n 2 online adds and mults, modulo a small integer 5 / 10

Our Contributions 1 A new Gaussian sampling algorithm for lattices. Key Features ⋆ Simple & efficient: ≈ 4 n 2 online adds and mults, modulo a small integer Even better: ˜ O ( n ) time for ring-based schemes! 5 / 10

Our Contributions 1 A new Gaussian sampling algorithm for lattices. Key Features ⋆ Simple & efficient: ≈ 4 n 2 online adds and mults, modulo a small integer Even better: ˜ O ( n ) time for ring-based schemes! ⋆ Fully parallelizable: n 2 / P operations on each of P ≤ n 2 processors 5 / 10

Our Contributions 1 A new Gaussian sampling algorithm for lattices. Key Features ⋆ Simple & efficient: ≈ 4 n 2 online adds and mults, modulo a small integer Even better: ˜ O ( n ) time for ring-based schemes! ⋆ Fully parallelizable: n 2 / P operations on each of P ≤ n 2 processors ⋆ High quality: for crypto lattices, same ∗ Gaussian width as GPV 5 / 10

Our Contributions 1 A new Gaussian sampling algorithm for lattices. Key Features ⋆ Simple & efficient: ≈ 4 n 2 online adds and mults, modulo a small integer Even better: ˜ O ( n ) time for ring-based schemes! ⋆ Fully parallelizable: n 2 / P operations on each of P ≤ n 2 processors ⋆ High quality: for crypto lattices, same ∗ Gaussian width as GPV 2 A general ‘convolution theorem’ for discrete Gaussians. Other applications: LWE error distribution, bi-deniable encryption [OP’10] , . . . 5 / 10

A First Attempt c �→ B · ⌊ B − 1 · c ⌉ . ◮ [Babai’86] ‘simple rounding:’ (Fast & Parallel!) b 2 c b 1 6 / 10

A First Attempt c �→ B · ⌊ B − 1 · c ⌉ . ◮ [Babai’86] ‘simple rounding:’ (Fast & Parallel!) b 2 c b 1 6 / 10

A First Attempt c �→ B · ⌊ B − 1 · c ⌉ . ◮ [Babai’86] ‘simple rounding:’ (Fast & Parallel!) ◮ Deterministic rounding is insecure [NguyenRegev’06] . . . b 2 c b 1 6 / 10

A First Attempt c �→ B · ⌊ B − 1 · c ⌉ $ . ◮ [Babai’86] ‘simple rounding:’ (Fast & Parallel!) ◮ Deterministic rounding is insecure [NguyenRegev’06] . . . . . . but what about randomized rounding? b 2 c b 1 6 / 10

A First Attempt c �→ B · ⌊ B − 1 · c ⌉ $ . ◮ [Babai’86] ‘simple rounding:’ (Fast & Parallel!) ◮ Deterministic rounding is insecure [NguyenRegev’06] . . . . . . but what about randomized rounding? b 2 c b 1 6 / 10

A First Attempt c �→ B · ⌊ B − 1 · c ⌉ $ . ◮ [Babai’86] ‘simple rounding:’ (Fast & Parallel!) ◮ Deterministic rounding is insecure [NguyenRegev’06] . . . . . . but what about randomized rounding? b 2 c b 1 ◮ Non-spherical distribution: has covariance � x · x t � ≈ B · B t . Σ := Exp x 6 / 10

A First Attempt c �→ B · ⌊ B − 1 · c ⌉ $ . ◮ [Babai’86] ‘simple rounding:’ (Fast & Parallel!) ◮ Deterministic rounding is insecure [NguyenRegev’06] . . . . . . but what about randomized rounding? b 2 c b 1 ◮ Non-spherical distribution: has covariance � x · x t � ≈ B · B t . Σ := Exp x Covariance can be measured — and it leaks B ! (up to rotation) 6 / 10

Inspiration: Some Facts About Gaussians 1 Continuous Gaussian ⇐ ⇒ positive definite covariance matrix Σ . (pos def: u t Σ u > 0 for all unit u .) 7 / 10

Inspiration: Some Facts About Gaussians 1 Continuous Gaussian ⇐ ⇒ positive definite covariance matrix Σ . (pos def: u t Σ u > 0 for all unit u .) ⇒ covariance s 2 I . Spherical Gaussian ⇐ 7 / 10

Inspiration: Some Facts About Gaussians 1 Continuous Gaussian ⇐ ⇒ positive definite covariance matrix Σ . (pos def: u t Σ u > 0 for all unit u .) ⇒ covariance s 2 I . Spherical Gaussian ⇐ 2 Convolution of Gaussians: + = Σ = s 2 I Σ 1 + Σ 2 = 7 / 10

Inspiration: Some Facts About Gaussians 1 Continuous Gaussian ⇐ ⇒ positive definite covariance matrix Σ . (pos def: u t Σ u > 0 for all unit u .) ⇒ covariance s 2 I . Spherical Gaussian ⇐ 2 Convolution of Gaussians: + = Σ = s 2 I Σ 1 + Σ 2 = 3 Given Σ 1 , how small can s be? For Σ 2 := s 2 I − Σ 1 , 7 / 10