Cryptography from worst-case complexity assumptions Daniele - - PowerPoint PPT Presentation
Cryptography from worst-case complexity assumptions Daniele Micciancio UC San Diego LLL+25 June 2007 (Caen, France) Outline Introduction Lattices and algorithms Complexity and Cryptography Lattice based cryptography Lattice
– Lattices and algorithms – Complexity and Cryptography
– Lattice based hash functions – Other cryptographic primitives
– Choosing security parameters – Using lattices with special properties
– Lattices and algorithms – Complexity and Cryptography
– Lattice based hash functions – Other cryptographic primitives
– Choosing security parameters – Using lattices with special properties
– Given a lattice L, find the nonzero lattice
– Given a lattice L, find n lin. independent
– Still useful in many algorithmic applications
– Assume no efficient algorithm solves lattice
– Application: design cryptographic functions
O(1)
n
NP NP hard n coAM coAM / coNP coNP P P / RP RP 2n
– not NP
γ = n100
– Bob generates (pk,sk), and publishes pk – Alice retrieves pk, and send E(pk,m) to Bob – Bob uses sk to retrieve m = D(sk,E(pk,m))
E(pk,m) Bob Adversary Alice: ... Bob: pk Oded: ... Alice m m
– Bob generates (pk,sk), and publishes pk
– Computing m from pk & E(pk,m) is hard with
E(pk,m) Bob Adversary Alice: ... Bob: pk Oded: ... Alice m ??? m
– H(pk, {0,1}N) = {0,1}n, N>>n
– finding collisions H(pk,m) = H(pk,m') is hard
Bob Adversary Alice H(pk,m')=h? To Bob: m m m' pk, H(pk,m)=h H(pk,.) {0,1}N {0,1}n
– e.g., factoring large prime product N=pq
– e.g., modular squaring f(x) = x2 mod N
– If you were able to compute square roots
– A problem can be solved in time T(n) if there
– Used in algorithms and complexity: P,NP,etc.
– There is an algorithm that solves a large
– Used in cryptography: assume there is no
– fN(x) = x2 mod N, where N=pq, ... – Inverting fN is as hard as factoring N
hard fN's All fN's hard N's All N's
hard fN's All L's hard L easy fN's
– Lattices and algorithms – Complexity and Cryptography
– Lattice based hash functions – Other cryptographic primitives
– Using lattices with special properties – Choosing security parameters
A(x1,...,xm ) = b.
– 0/1 vectors x, y such that Ax = Ay – Equiv.: -1/0/1 vector z =(x-y) such that Az=0
– m > log2 |G|, e.g., G = Zn/(pZn), m =2n log(p)
– Assume can break random function fA(x) – Use attack(A) to solve SIVP on any lattice B
– A need to depend on B – A should be uniformly random, given B
Lattice problem Worst-case hard Cryptographic function f(x) Attack Approximation algorithm construction security proof
– Subset-sum over R – Key: random points a1,...,am in Rn – Function: fA(x1,...,xm) = Σi aixi , (xi in {0,1}) – fA : {0,1}m --> Rn
– Range Rn is infinite, so fA never compresses – We will address this using ZM
n instead of Rn
– Generate random key as ai=vi+ri (i=1,...n) – Find a collision fA(x1,...,xm)=fA(y1,...,ym) – Notice: Σi ai zi = 0, where zi = xi - yi
Lattice vector short vector
– Cannot pick uniformly random lattice point vi – Range of the function Rn is infinite
– Work “modulo L(B)” – Use fine grid Zn/q instead of Rn
– fA(x) = Ax mod q, where A is in Zq
mxn
x
– (L(B)) = smallest s s.t. ρ1/s(L(B)* \ {0}) ≤ .
– For s = (L(B)), distribution (s-nρs mod B) is
– (L(B)) < log(n) λn(L(B))
O(s n1/2)
Approximate SIVP Arbitrary lattice dimension = n Exact (Lmax) SVP Random lattice dimension = m >> n reduction
– [Ajt], [CN], [Mic], [MR]
– [AD, Reg] public key encryption based on
– [Mic], [PR], [LM] hash functions with
– Requires planting a trapdoor for decryption – Can be done by using lattices where λ1<< λ2
– Solve SVP on special class of lattices such
– Still worst-case assumption, but over smaller
O(n) bits
m=O(n)
2n bits
m = O(1)
– ai in ZN, xi in {0,...,M}, e.g. M=2n and N=22n – ILP with few vars: insecure!
– ai in Zp[X] / q(X), e.g. – xi in {0,...,pd}n
– L closed under [1,2,3,4,5] ----> [2,3,4,5,1]
– R = Z[X] / q(X) is isomorphic to Zn – h: 5X2+3X-1 ----> [5,3,-1]
– q(X) arbitrary monic polynomial – h(S) where S is an ideal of Z[X]/q(X) – If q(X) = Xn – 1, same as h(S) cyclic
– Coefficients vector – Conjugates vector (Eval. at q-roots)
– q(X)=Xn+1, q(ω2n
2k+1)=0, g(X)=X3+2X2+3X+4
– g(X) ----> [1,2,3,4] – g(X) ----> [g(ω2n),g(ω2n
3),g(ω2n 5),g(ω2n 7)]
– 1/n1/2 < maxk |g(ω2n
2k+1)| / maxk |gk| < n1/2
– Lattices and algorithms – Complexity and Cryptography
– Lattice based hash functions – Other cryptographic primitives
– Choosing security parameters – Using lattices with special properties
– Large enough so no efficient algorithm solves
– Traditional challenge/cryptanalysis? Or not?
– Designer picks random challenges – Cryptanalysts break challenges for money – Only appropriate for average-case
– Designer picks worst possible input lattice – Problem: how can one find such worst
– Worst-case examples for BKZ [Ajt] – Faster variants of LLL, etc. [Sch,NS,GHKN]
– Algorithms may perform better in practice
– Heuristics: randomize basis vectors, etc.
– The algorithm is the challenge! – Designer has to disprove the challenge by
– ... socially unacceptable
– E.g., random matrix A
– E.g., find collision Ax=Ay
– Each application requires new cryptanalysis – Why proving security at all?
– Attacks can be avoided by increasing security
– No conceptual security flaw in cryptographic
– Tell us what distribution should be used
– E.g., λ1<< λ2
– E.g., Rot(L) = L
– Symplectic lattices are slightly easier [GHN] – Polytime approximation within poly(n)? – NP-hard in the worst-case?
– Open problem: Given (random) lattice, decide
– No NP-hardness result known – Cryptanalysis gives experimental evidence
– Prove anything about uSVP
– Closely related to lattices arising in Algebraic
– ANT among first applications of LLL, still no
– LLL is “geometric”, it does not see algebraic
– Applying LLL to ANT: great success story – It is time to apply ANT to lattice reduction!