Analysis of BKZ Guillaume Hanrot, Xavier Pujol, Damien Stehl e - PowerPoint PPT Presentation

Analysis of BKZ Guillaume Hanrot, Xavier Pujol, Damien Stehl´ e ENSL, LIP, CNRS, INRIA, Universit´ e de Lyon, UCBL May 5, 2011 Analysis of BKZ 1/32

b b b b b b b b b b b b b b b b b Lattices a 1 a 2 (SVP) Analysis of BKZ 2/32

b b b b b b b b b b b b b b b b b Lattices b 1 (SVP)Shortest vector problem (SVP)(SVP) Analysis of BKZ 2/32

b b b b b b b b b b b b b b b b b Lattices b 2 b 1 (SVP)Lattice reduction(SVP) Analysis of BKZ 2/32

b b b b b b b b b b b b b b b b b Lattices b 2 b 1 (SVP)Determinant(SVP) Analysis of BKZ 2/32

b b b b b b b b b b b b b b b b b Lattices b 2 b 1 Hermite factor: � b 1 � HF ( b 1 , . . . , b n ) = (det L ) 1 / n Goal of lattice reduction: find a basis with small HF. If b 1 is a shortest vector, then HF ( b 1 , . . . , b n ) ≤ √ γ n , with γ n = Hermite constant ≤ n . Analysis of BKZ 2/32

b b b b b b b b b b b b b b b b b Lattices b 2 b 1 Hermite factor: � b 1 � HF ( b 1 , . . . , b n ) = (det L ) 1 / n Goal of lattice reduction: find a basis with small HF. If b 1 is a shortest vector, then HF ( b 1 , . . . , b n ) ≤ √ γ n , with γ n = Hermite constant ≤ n . Analysis of BKZ 2/32

b b b b b b b b b b b b b b b b b Lattices b 2 b 1 Hermite factor: � b 1 � HF ( b 1 , . . . , b n ) = (det L ) 1 / n Goal of lattice reduction: find a basis with small HF. If b 1 is a shortest vector, then HF ( b 1 , . . . , b n ) ≤ √ γ n , with γ n = Hermite constant ≤ n . Analysis of BKZ 2/32

Lattice reduction Lattice reduction and shortest vector problem: The security of lattice-based cryptosystems relies on the hardness of (variants of) SVP. SVP and lattice reduction are interdependent problems. Hierarchy of lattice reductions in dimension n : HKZ BKZ β LLL Hermite √ γ n n − 1 n − 1 ≃ ( γ β (1 + ǫ )) ( γ 2 (1 + ǫ )) 2( β − 1) 2 factor 2 O ( n ) 2 O ( β ) × ? Time Poly ( n ) HKZ = Hermite-Korkine-Zolotareff BKZ = Block Korkine-Zolotareff Analysis of BKZ 3/32

Lattice reduction Lattice reduction and shortest vector problem: The security of lattice-based cryptosystems relies on the hardness of (variants of) SVP. SVP and lattice reduction are interdependent problems. Hierarchy of lattice reductions in dimension n : HKZ BKZ β LLL Hermite √ γ n n − 1 n − 1 ≃ ( γ β (1 + ǫ )) ( γ 2 (1 + ǫ )) 2( β − 1) 2 factor 2 O ( n ) 2 O ( β ) × ? Time Poly ( n ) HKZ = Hermite-Korkine-Zolotareff BKZ = Block Korkine-Zolotareff Analysis of BKZ 3/32

Lattice reduction Lattice reduction and shortest vector problem: The security of lattice-based cryptosystems relies on the hardness of (variants of) SVP. SVP and lattice reduction are interdependent problems. Hierarchy of lattice reductions in dimension n : HKZ BKZ β LLL Hermite √ γ n n − 1 n − 1 ≃ ( γ β (1 + ǫ )) ( γ 2 (1 + ǫ )) 2( β − 1) 2 factor 2 O ( n ) 2 O ( β ) × ? Time Poly ( n ) HKZ = Hermite-Korkine-Zolotareff BKZ = Block Korkine-Zolotareff Analysis of BKZ 3/32

Lattice reduction Lattice reduction and shortest vector problem: The security of lattice-based cryptosystems relies on the hardness of (variants of) SVP. SVP and lattice reduction are interdependent problems. Hierarchy of lattice reductions in dimension n : HKZ BKZ β LLL Hermite √ γ n n − 1 n − 1 ≃ ( γ β (1 + ǫ )) ( γ 2 (1 + ǫ )) 2( β − 1) 2 factor 2 O ( n ) 2 O ( β ) × ? Time Poly ( n ) HKZ = Hermite-Korkine-Zolotareff BKZ = Block Korkine-Zolotareff Analysis of BKZ 3/32

History of BKZ Practice Theory Schnorr and Euchner (1994): Schnorr (1987): first algorithm for BKZ-reduction, hierarchies of algorithms without complexity analysis. between LLL and HKZ. Shoup: first public Gama et al. (2006): implementation of BKZ in Block-Rankin-reduction. NTL. Gama and Nguyen (2008): Gama and Nguyen (2008): Slide-reduction. BKZ behaves badly when the block size is ≥ 25. Analysis of BKZ 4/32

History of BKZ Practice Theory Schnorr and Euchner (1994): Schnorr (1987): first algorithm for BKZ-reduction, hierarchies of algorithms without complexity analysis. between LLL and HKZ. Shoup: first public Gama et al. (2006): implementation of BKZ in Block-Rankin-reduction. NTL. Gama and Nguyen (2008): Gama and Nguyen (2008): Slide-reduction. BKZ behaves badly when the block size is ≥ 25. Analysis of BKZ 4/32

History of BKZ Practice Theory Schnorr and Euchner (1994): Schnorr (1987): first algorithm for BKZ-reduction, hierarchies of algorithms without complexity analysis. between LLL and HKZ. Shoup: first public Gama et al. (2006): implementation of BKZ in Block-Rankin-reduction. NTL. Gama and Nguyen (2008): Gama and Nguyen (2008): Slide-reduction. BKZ behaves badly when the block size is ≥ 25. Analysis of BKZ 4/32

History of BKZ Practice Theory Schnorr and Euchner (1994): Schnorr (1987): first algorithm for BKZ-reduction, hierarchies of algorithms without complexity analysis. between LLL and HKZ. Shoup: first public Gama et al. (2006): implementation of BKZ in Block-Rankin-reduction. NTL. Gama and Nguyen (2008): Gama and Nguyen (2008): Slide-reduction. BKZ behaves badly when the block size is ≥ 25. Analysis of BKZ 4/32

History of BKZ Practice Theory Schnorr and Euchner (1994): Schnorr (1987): first algorithm for BKZ-reduction, hierarchies of algorithms without complexity analysis. between LLL and HKZ. Shoup: first public Gama et al. (2006): implementation of BKZ in Block-Rankin-reduction. NTL. Gama and Nguyen (2008): Gama and Nguyen (2008): Slide-reduction. BKZ behaves badly when the block size is ≥ 25. Analysis of BKZ 4/32

History of BKZ Practice Theory Schnorr and Euchner (1994): Schnorr (1987): first algorithm for BKZ-reduction, hierarchies of algorithms without complexity analysis. between LLL and HKZ. Shoup: first public Gama et al. (2006): implementation of BKZ in Block-Rankin-reduction. NTL. Gama and Nguyen (2008): Gama and Nguyen (2008): Slide-reduction. BKZ behaves badly when the block size is ≥ 25. Analysis of BKZ 4/32

Slide-reduction: Outputs a basis whose theoretical quality is equivalent to BKZ. Polynomial number of calls to a SVP oracle. Not as efficient as BKZ in practice. Analysis of BKZ 5/32

Progress made during the execution of BKZ Quality of BKZ output 1.021 BKZ BKZ’ 1.02 1.019 1.018 Hermite factor 1.017 1.016 1.015 1.014 1.013 1.012 0 20 40 60 80 100 Number of tours Experience on 64 LLL-reduced knapsack-like matrices ( n = 108 , β = 24). Analysis of BKZ 6/32

Progress made during the execution of BKZ Quality of BKZ output 1.021 BKZ BKZ’ 1.02 1.019 1.018 Hermite factor 1.017 1.016 1.015 1.014 1.013 1.012 0 200 400 600 800 1000 1200 Number of tours Experience on 64 LLL-reduced knapsack-like matrices ( n = 108 , β = 24). Analysis of BKZ 6/32

Our result γ β = Hermite constant ≤ β . L a lattice with basis ( b 1 , . . . , b n ). Theorem � n 3 � �� � b i � log n After O ǫ + log log max calls to HKZ β , β 2 (det L ) 1 / n BKZ β returns a basis C of L such that: 2( β − 1) + 3 n − 1 HF ( C ) ≤ (1 + ǫ ) γ β 2 Analysis of BKZ 7/32

Reminders on lattice reduction 1 Analysis of BKZ in the sandpile model 2 Analysis of BKZ 3 Applications to LLL 4 Conclusion 5 Analysis of BKZ 8/32

Reminders on lattice reduction 1 Analysis of BKZ in the sandpile model 2 Analysis of BKZ 3 Applications to LLL 4 Conclusion 5 Analysis of BKZ 9/32

Gram-Schmidt orthogonalization b 1 , . . . , b n linearly independent. The Gram-Schmidt orthogona- b 3 lization b ∗ 1 , . . . , b ∗ n is defined by: For all i > j , ( b i , b ∗ j ) µ i , j = j � 2 . � b ∗ For all i , i = b i − � b ∗ j < i µ i , j b ∗ j . b 2 b 1 A basis is size-reduced if all the | µ i , j | are ≤ 1 2 . Analysis of BKZ 10/32

Gram-Schmidt orthogonalization b 1 , . . . , b n linearly independent. The Gram-Schmidt orthogona- b 3 lization b ∗ 1 , . . . , b ∗ b ∗ n is defined by: 3 For all i > j , ( b i , b ∗ j ) µ i , j = j � 2 . � b ∗ b ∗ For all i , 2 i = b i − � b ∗ j < i µ i , j b ∗ j . b 2 = b ∗ b 1 1 A basis is size-reduced if all the | µ i , j | are ≤ 1 2 . Analysis of BKZ 10/32

Gram-Schmidt orthogonalization b 1 , . . . , b n linearly independent. The Gram-Schmidt orthogona- b 3 lization b ∗ 1 , . . . , b ∗ b ∗ n is defined by: 3 For all i > j , ( b i , b ∗ j ) µ i , j = j � 2 . � b ∗ b ∗ For all i , 2 i = b i − � b ∗ j < i µ i , j b ∗ j . b 2 = b ∗ b 1 1 A basis is size-reduced if all the | µ i , j | are ≤ 1 2 . Analysis of BKZ 10/32

LLL B is δ -LLL-reduced if: It is size-reduced; i � 2 ≤ � b ∗ i +1 � 2 + µ 2 i � 2 for all i < n . δ � b ∗ i +1 , i � b ∗ → x i ≤ 1 ( x i = log � b ∗ 2 log γ 2 + x i +1 − log δ i � ) Analysis of BKZ 11/32

LLL B is δ -LLL-reduced if: It is size-reduced; i � 2 ≤ � b ∗ i +1 � 2 + µ 2 i � 2 for all i < n . δ � b ∗ i +1 , i � b ∗ → x i ≤ 1 ( x i = log � b ∗ 2 log γ 2 + x i +1 − log δ i � ) 1 2 log γ 2 − log δ x 1 x 2 x 3 x 4 x 5 Analysis of BKZ 11/32