Efficient Collision-Resistant Hashing from Worst-Case Assumptions on - - PowerPoint PPT Presentation

▶
efficient collision resistant hashing from worst case
SMART_READER_LITE
LIVE PREVIEW

Efficient Collision-Resistant Hashing from Worst-Case Assumptions on - - PowerPoint PPT Presentation

May 29, 2023 268 likes •902 views

Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices Chris Peikert 1 Alon Rosen 2 1 MIT CSAIL 2 Harvard DEAS Theory of Cryptography Conference 5 March 2006 Chris Peikert, Alon Rosen (MIT, Harvard) Efficient

slide-1
SLIDE 1

Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices

Chris Peikert1 Alon Rosen2

1MIT CSAIL 2Harvard DEAS

Theory of Cryptography Conference 5 March 2006

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 1 / 12

slide-2
SLIDE 2

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto sig PRG ZK comm Ind Sets . . .

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-3
SLIDE 3

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] sig PRG ZK comm Ind Sets . . .

  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-4
SLIDE 4

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] sig PRG ZK comm Ind Sets . . .

  • wf
  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-5
SLIDE 5

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] sig PRG ZK comm Ind Sets . . .

  • wf
  • wf
  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-6
SLIDE 6

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] sig PRG ZK comm Ind Sets . . .

  • wf
  • wf
  • wf
  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-7
SLIDE 7

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] sig PRG ZK comm Ind Sets . . .

  • wf
  • wf
  • wf
  • wf
  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-8
SLIDE 8

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] sig PRG ZK comm Ind Sets . . .

  • wf
  • wf
  • wf
  • wf
  • wf
  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-9
SLIDE 9

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] sig PRG ZK comm Ind Sets . . .

  • wf
  • wf
  • wf
  • wf
  • wf
  • wf
  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-10
SLIDE 10

One-Wayness vs. Collision-Resistance

One-Way Function (family):

a, y = fa(x)

hard

− → x′ ∈ f −1

a (y)

✔ Sufficient for some crypto ✗ But applications use OWFs inefficiently. . . This is inherent (black-box)! [GeTr, GGK, HoKa] ✗ Can’t realize some notions at all! (black-box) sig PRG ZK comm Ind Sets . . .

  • wf
  • wf
  • wf
  • wf
  • wf
  • wf
  • wf
  • wf
  • wf

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-11
SLIDE 11

One-Wayness vs. Collision-Resistance

Collision-Resistant Hash (family):

a

hard

− → x, x′ : fa(x) = fa(x′)

✔ Can construct more applications sig PRG ZK comm Ind Sets . . .

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-12
SLIDE 12

One-Wayness vs. Collision-Resistance

Collision-Resistant Hash (family):

a

hard

− → x, x′ : fa(x) = fa(x′)

✔ Can construct more applications ✔ Applications use hashing efficiently! sig PRG ZK comm Ind Sets . . . collision resist hash coll resist hash

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-13
SLIDE 13

One-Wayness vs. Collision-Resistance

Collision-Resistant Hash (family):

a

hard

− → x, x′ : fa(x) = fa(x′)

✔ Can construct more applications ✔ Applications use hashing efficiently! ?? BUT: is the hash itself efficient? sig PRG ZK comm Ind Sets . . . collision resist hash coll resist hash

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-14
SLIDE 14

One-Wayness vs. Collision-Resistance

Collision-Resistant Hash (family):

a

hard

− → x, x′ : fa(x) = fa(x′)

✔ Can construct more applications ✔ Applications use hashing efficiently! ?? BUT: is the hash itself efficient? ☞ MD5, SHA-1 highlight need for sound & efficient hashes sig PRG ZK comm Ind Sets . . . collision resist hash coll resist hash

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 2 / 12

slide-15
SLIDE 15

Our Contributions

Hash Function

✔ Very efficient: evaluate with just a few FFTs ✔ Collision-resistant: worst-case assumption on cyclic lattices ✔ Tighter & simpler security reduction than related works

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 3 / 12

slide-16
SLIDE 16

Our Contributions

Hash Function

✔ Very efficient: evaluate with just a few FFTs ✔ Collision-resistant: worst-case assumption on cyclic lattices ✔ Tighter & simpler security reduction than related works

Understanding

✔ New algebraic interpretation of cyclic lattices ✔ New and tight connections among problems on cyclic lattices

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 3 / 12

slide-17
SLIDE 17

Our Contributions

Hash Function

✔ Very efficient: evaluate with just a few FFTs ✔ Collision-resistant: worst-case assumption on cyclic lattices ✔ Tighter & simpler security reduction than related works

Understanding

✔ New algebraic interpretation of cyclic lattices ✔ New and tight connections among problems on cyclic lattices ☞ Our function is a certain kind of knapsack. . .

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 3 / 12

slide-18
SLIDE 18

Generalized Knapsack Function [Mic02]

Let R be a ring with + and ×, and let S ⊆ R. For:

  • A = (a1, . . . , am) ∈ Rm

— m “weights”: key

  • X = (x1, . . . , xm) ∈ Sm

— m “coeffs”: input fA(X) =

m

  • i=1

ai × xi

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 4 / 12

slide-19
SLIDE 19

Generalized Knapsack Function [Mic02]

Let R be a ring with + and ×, and let S ⊆ R. For:

  • A = (a1, . . . , am) ∈ Rm

— m “weights”: key

  • X = (x1, . . . , xm) ∈ Sm

— m “coeffs”: input fA(X) =

m

  • i=1

ai × xi ☞ Efficiency determined by m (“width”); runtime of ×, +.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 4 / 12

slide-20
SLIDE 20

Generalized Knapsack Function [Mic02]

Let R be a ring with + and ×, and let S ⊆ R. For:

  • A = (a1, . . . , am) ∈ Rm

— m “weights”: key

  • X = (x1, . . . , xm) ∈ Sm

— m “coeffs”: input fA(X) =

m

  • i=1

ai × xi ☞ Efficiency determined by m (“width”); runtime of ×, +.

Lineage of Cryptographic Knapsacks

Knapsack Function Security Notion Efficient? [Ajt96, GGH97] collision-resistant ✗ [Mic02]

  • ne-way

✔ Today collision-resistant ✔✔

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 4 / 12

slide-21
SLIDE 21

Micciancio’s Function

  • R = (Zn

p, +, ⊗), where ⊗ is cyclic convolution:

  | a |   ⊗   | x |   =      a0 an−1 · · · a1 a1 a0 · · · a2 . . . . . . ... . . . an−1 an−2 · · · a0      ·      x0 x1 . . . xn−1     

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

slide-22
SLIDE 22

Micciancio’s Function

  • R = (Zn

p, +, ⊗), where ⊗ is cyclic convolution:

  | a |   ⊗   | x |   =      a0 an−1 · · · a1 a1 a0 · · · a2 . . . . . . ... . . . an−1 an−2 · · · a0      ·      x0 x1 . . . xn−1     

  • S = {x ∈ R : x∞ is small}.

(Note: |S| is exponential in n.)

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

slide-23
SLIDE 23

Micciancio’s Function

  • R = (Zn

p, +, ⊗), where ⊗ is cyclic convolution:

  | a |   ⊗   | x |   =      a0 an−1 · · · a1 a1 a0 · · · a2 . . . . . . ... . . . an−1 an−2 · · · a0      ·      x0 x1 . . . xn−1     

  • S = {x ∈ R : x∞ is small}.

(Note: |S| is exponential in n.)

Evaluating f

A =   | | | a1 a2 · · · am | | |   ∈ Rm X =   | | | x1 x2 · · · xm | | |   ∈ Sm fA(X) =

  • i

  | ai |   ⊗   | xi |  

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

slide-24
SLIDE 24

Micciancio’s Function

  • R = (Zn

p, +, ⊗), where ⊗ is cyclic convolution:

  | a |   ⊗   | x |   =      a0 an−1 · · · a1 a1 a0 · · · a2 . . . . . . ... . . . an−1 an−2 · · · a0      ·      x0 x1 . . . xn−1     

  • S = {x ∈ R : x∞ is small}.

(Note: |S| is exponential in n.)

Theorem

“decoding” in cyclic lattices hard to approx in the worst case ⇓ fA one-way on the average (for any width m = ω(1)).

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

slide-25
SLIDE 25

Micciancio’s Function

  • R = (Zn

p, +, ⊗), where ⊗ is cyclic convolution:

  | a |   ⊗   | x |   =      a0 an−1 · · · a1 a1 a0 · · · a2 . . . . . . ... . . . an−1 an−2 · · · a0      ·      x0 x1 . . . xn−1     

  • S = {x ∈ R : x∞ is small}.

(Note: |S| is exponential in n.)

Theorem

“decoding” in cyclic lattices hard to approx in the worst case ⇓ fA one-way on the average (for any width m = ω(1)). Efficient: just m FFTs; small key

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

slide-26
SLIDE 26

Micciancio’s Function

  • R = (Zn

p, +, ⊗), where ⊗ is cyclic convolution:

  | a |   ⊗   | x |   =      a0 an−1 · · · a1 a1 a0 · · · a2 . . . . . . ... . . . an−1 an−2 · · · a0      ·      x0 x1 . . . xn−1     

  • S = {x ∈ R : x∞ is small}.

(Note: |S| is exponential in n.)

Theorem

“decoding” in cyclic lattices hard to approx in the worst case ⇓ fA one-way on the average (for any width m = ω(1)). Efficient: just m FFTs; small key Open Question: Like [Ajt96], is f collision-resistant?

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

slide-27
SLIDE 27

Micciancio’s Function

  • R = (Zn

p, +, ⊗), where ⊗ is cyclic convolution:

  | a |   ⊗   | x |   =      a0 an−1 · · · a1 a1 a0 · · · a2 . . . . . . ... . . . an−1 an−2 · · · a0      ·      x0 x1 . . . xn−1     

  • S = {x ∈ R : x∞ is small}.

(Note: |S| is exponential in n.)

Theorem

“decoding” in cyclic lattices hard to approx in the worst case ⇓ fA one-way on the average (for any width m = ω(1)). Efficient: just m FFTs; small key Open Question: Like [Ajt96], is f collision-resistant? Today: No! (But we have a remedy. . . )

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 5 / 12

slide-28
SLIDE 28

Collisions via an Algebraic View

Ring R = Zn

p under ⊗ has algebraic structure:

x = (x0, . . . , xn−1) ∈ Zn

p

⇆ x(α) =

  • xjαj ∈ Zp[α]

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 6 / 12

slide-29
SLIDE 29

Collisions via an Algebraic View

Ring R = Zn

p under ⊗ has algebraic structure:

x = (x0, . . . , xn−1) ∈ Zn

p

⇆ x(α) =

  • xjαj ∈ Zp[α]

Fact 1: Convolution is polynomial multiplication, mod αn − 1. a ⊗ x ⇆ a(α) · x(α) mod (αn − 1)

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 6 / 12

slide-30
SLIDE 30

Collisions via an Algebraic View

Ring R = Zn

p under ⊗ has algebraic structure:

x = (x0, . . . , xn−1) ∈ Zn

p

⇆ x(α) =

  • xjαj ∈ Zp[α]

Fact 1: Convolution is polynomial multiplication, mod αn − 1. a ⊗ x ⇆ a(α) · x(α) mod (αn − 1) Fact 2: Modulus αn − 1 is reducible. (αn − 1) = (α − 1)(αn−1 + · · · + 1)

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 6 / 12

slide-31
SLIDE 31

Collisions via an Algebraic View

Ring R = Zn

p under ⊗ has algebraic structure:

x = (x0, . . . , xn−1) ∈ Zn

p

⇆ x(α) =

  • xjαj ∈ Zp[α]

Fact 1: Convolution is polynomial multiplication, mod αn − 1. a ⊗ x ⇆ a(α) · x(α) mod (αn − 1) Fact 2: Modulus αn − 1 is reducible. (αn − 1) = (α − 1)(αn−1 + · · · + 1) Fact 3: (α − 1) divides uniform ai(α) in Zp[α] w/prob 1/p.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 6 / 12

slide-32
SLIDE 32

Collisions via an Algebraic View

Ring R = Zn

p under ⊗ has algebraic structure:

x = (x0, . . . , xn−1) ∈ Zn

p

⇆ x(α) =

  • xjαj ∈ Zp[α]

Fact 1: Convolution is polynomial multiplication, mod αn − 1. a ⊗ x ⇆ a(α) · x(α) mod (αn − 1) Fact 2: Modulus αn − 1 is reducible. (αn − 1) = (α − 1)(αn−1 + · · · + 1) Fact 3: (α − 1) divides uniform ai(α) in Zp[α] w/prob 1/p. Yields a collision: ai(α) · (αn−1 + · · · + 1)

  • xi

= ai(α) ·

  • x′

i

mod(αn − 1) Works because Zp[α]/(αn − 1) is not an integral domain.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 6 / 12

slide-33
SLIDE 33

Our Function

Choose n prime.

  • (α − 1) and (αn−1+· · ·+1) are irreducible in Z[α].
  • So arithmetic mod(αn − 1) decomposes into two integral domains.

(Chinese remaindering)

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 7 / 12

slide-34
SLIDE 34

Our Function

Choose n prime.

  • (α − 1) and (αn−1+· · ·+1) are irreducible in Z[α].
  • So arithmetic mod(αn − 1) decomposes into two integral domains.

(Chinese remaindering) Then: ☞ R = (Zn

p, +, ⊗)

☞ S = {x ∈ R : x∞ small, and (α − 1) | x(α) in Z[α]}.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 7 / 12

slide-35
SLIDE 35

Our Function

Choose n prime.

  • (α − 1) and (αn−1+· · ·+1) are irreducible in Z[α].
  • So arithmetic mod(αn − 1) decomposes into two integral domains.

(Chinese remaindering) Then: ☞ R = (Zn

p, +, ⊗)

☞ S = {x ∈ R : x∞ small, and (α − 1) | x(α) in Z[α]}. ☞ Rules out our collisions, but is it provably secure?

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 7 / 12

slide-36
SLIDE 36

Our Function

Choose n prime.

  • (α − 1) and (αn−1+· · ·+1) are irreducible in Z[α].
  • So arithmetic mod(αn − 1) decomposes into two integral domains.

(Chinese remaindering) Then: ☞ R = (Zn

p, +, ⊗)

☞ S = {x ∈ R : x∞ small, and (α − 1) | x(α) in Z[α]}. ☞ Rules out our collisions, but is it provably secure?

Theorem (Us)

shortest vec in cyclic lattices hard to approx in worst case (prime n) ⇓ fA collision-resistant on the average, for width m = O(1)!

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 7 / 12

slide-37
SLIDE 37

Our Function

Choose n prime.

  • (α − 1) and (αn−1+· · ·+1) are irreducible in Z[α].
  • So arithmetic mod(αn − 1) decomposes into two integral domains.

(Chinese remaindering) Then: ☞ R = (Zn

p, +, ⊗)

☞ S = {x ∈ R : x∞ small, and (α − 1) | x(α) in Z[α]}. ☞ Rules out our collisions, but is it provably secure?

Theorem (Us)

shortest vec in cyclic lattices hard to approx in worst case (prime n) ⇓ fA collision-resistant on the average, for width m = O(1)! Very efficient: even 2 FFTs suffice

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 7 / 12

slide-38
SLIDE 38

Our Function

Choose n prime.

  • (α − 1) and (αn−1+· · ·+1) are irreducible in Z[α].
  • So arithmetic mod(αn − 1) decomposes into two integral domains.

(Chinese remaindering) Then: ☞ R = (Zn

p, +, ⊗)

☞ S = {x ∈ R : x∞ small, and (α − 1) | x(α) in Z[α]}. ☞ Rules out our collisions, but is it provably secure?

Theorem (Us, LM)

shortest vec in cyclic lattices hard to approx in worst case (prime n) ⇓ fA collision-resistant on the average, for width m = O(1)! Very efficient: even 2 FFTs suffice

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 7 / 12

slide-39
SLIDE 39

(Cyclic) Lattices

Let B = {b1, . . . , bn} ⊂ Zn be linearly independent. The lattice L(B) ⊂ Zn having basis B is: L(B) = d

  • i=1

cibi | ∀ i, ci ∈ Z

  • .

(0,0) Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 8 / 12

slide-40
SLIDE 40

(Cyclic) Lattices

Let B = {b1, . . . , bn} ⊂ Zn be linearly independent. The lattice L(B) ⊂ Zn having basis B is: L(B) = d

  • i=1

cibi | ∀ i, ci ∈ Z

  • .

Lattice Λ is cyclic if x ∈ Λ ⇒ rot(x) ∈ Λ. For x = (x0, . . . , xn−1): rot(x) = (xn−1, x0, . . . , xn−2).

(0,0) Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 8 / 12

slide-41
SLIDE 41

(Cyclic) Lattices

Let B = {b1, . . . , bn} ⊂ Zn be linearly independent. The lattice L(B) ⊂ Zn having basis B is: L(B) = d

  • i=1

cibi | ∀ i, ci ∈ Z

  • .

Lattice Λ is cyclic if x ∈ Λ ⇒ rot(x) ∈ Λ. For x = (x0, . . . , xn−1): rot(x) = (xn−1, x0, . . . , xn−2). Cyclic lattices are closed under convolution with any v ∈ Zn: x ⊗ v =      x0 xn−1 · · · x1 x1 x0 · · · x2 . . . . . . ... . . . xn−1 xn−2 · · · x0      ·      v0 v1 . . . vn−1      ∈ Λ.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 8 / 12

slide-42
SLIDE 42

Complexity of Shortest Vector

Shortest Vector Problem (SVP)

Given B, find v ∈ L(B), v = 0 s.t. v (approx) minimal.

(0,0) Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 9 / 12

slide-43
SLIDE 43

Complexity of Shortest Vector

Shortest Vector Problem (SVP)

Given B, find v ∈ L(B), v = 0 s.t. v (approx) minimal.

Complexity

  • In general, NP-hard to approx to any const fact [Ajt, Mic, Kho].

But no NP-hardness known for cyclic lattices.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 9 / 12

slide-44
SLIDE 44

Complexity of Shortest Vector

Shortest Vector Problem (SVP)

Given B, find v ∈ L(B), v = 0 s.t. v (approx) minimal.

Complexity

  • In general, NP-hard to approx to any const fact [Ajt, Mic, Kho].

But no NP-hardness known for cyclic lattices.

  • Best (general) algorithms yield approx factors 2˜

Θ(n) [LLL, Sch].

Don’t seem to perform better on cyclic lattices.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 9 / 12

slide-45
SLIDE 45

Complexity of Shortest Vector

Shortest Vector Problem (SVP)

Given B, find v ∈ L(B), v = 0 s.t. v (approx) minimal.

Complexity

  • In general, NP-hard to approx to any const fact [Ajt, Mic, Kho].

But no NP-hardness known for cyclic lattices.

  • Best (general) algorithms yield approx factors 2˜

Θ(n) [LLL, Sch].

Don’t seem to perform better on cyclic lattices. (We can’t solve it, either!)

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 9 / 12

slide-46
SLIDE 46

Complexity of Shortest Vector

Shortest Vector Problem (SVP)

Given B, find v ∈ L(B), v = 0 s.t. v (approx) minimal.

Complexity

  • In general, NP-hard to approx to any const fact [Ajt, Mic, Kho].

But no NP-hardness known for cyclic lattices.

  • Best (general) algorithms yield approx factors 2˜

Θ(n) [LLL, Sch].

Don’t seem to perform better on cyclic lattices. (We can’t solve it, either!)

Our Assumption

For prime dimensions n, SVP hard to approx to within ˜ Θ(n) in cyclic lattices, in the worst case.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 9 / 12

slide-47
SLIDE 47

Our New Understanding of Cyclic Lattices

☞ Linear algebra of cyclic lattices is tied to polynomial algebra.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 10 / 12

slide-48
SLIDE 48

Our New Understanding of Cyclic Lattices

☞ Linear algebra of cyclic lattices is tied to polynomial algebra. For any polynomial Φ(α) | (αn − 1), define the linear subspace: HΦ = {x ∈ Rn : Φ(α) divides x(α) in R[α]}

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 10 / 12

slide-49
SLIDE 49

Our New Understanding of Cyclic Lattices

☞ Linear algebra of cyclic lattices is tied to polynomial algebra. For any polynomial Φ(α) | (αn − 1), define the linear subspace: HΦ = {x ∈ Rn : Φ(α) divides x(α) in R[α]} Lemma 1: HΦ is closed under rot (cyclic shift).

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 10 / 12

slide-50
SLIDE 50

Our New Understanding of Cyclic Lattices

☞ Linear algebra of cyclic lattices is tied to polynomial algebra. For any polynomial Φ(α) | (αn − 1), define the linear subspace: HΦ = {x ∈ Rn : Φ(α) divides x(α) in R[α]} Lemma 1: HΦ is closed under rot (cyclic shift). Lemma 2: Let n be prime, and x ∈ Λ ∩ Hα−1. Then x, rot(x), . . . , rotn−2(x) are linearly independent, and span Hα−1.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 10 / 12

slide-51
SLIDE 51

Our New Understanding of Cyclic Lattices

☞ Linear algebra of cyclic lattices is tied to polynomial algebra. For any polynomial Φ(α) | (αn − 1), define the linear subspace: HΦ = {x ∈ Rn : Φ(α) divides x(α) in R[α]} Lemma 1: HΦ is closed under rot (cyclic shift). Lemma 2: Let n be prime, and x ∈ Λ ∩ Hα−1. Then x, rot(x), . . . , rotn−2(x) are linearly independent, and span Hα−1. Lemma 3: shortest in Λ ≈ shortest in (Λ ∩ Hα−1).

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 10 / 12

slide-52
SLIDE 52

Our New Understanding of Cyclic Lattices

☞ Linear algebra of cyclic lattices is tied to polynomial algebra. For any polynomial Φ(α) | (αn − 1), define the linear subspace: HΦ = {x ∈ Rn : Φ(α) divides x(α) in R[α]} Lemma 1: HΦ is closed under rot (cyclic shift). Lemma 2: Let n be prime, and x ∈ Λ ∩ Hα−1. Then x, rot(x), . . . , rotn−2(x) are linearly independent, and span Hα−1. Lemma 3: shortest in Λ ≈ shortest in (Λ ∩ Hα−1). Corollary: Hα−1 is “hard-core” for SVP .

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 10 / 12

slide-53
SLIDE 53

Worst-Case to Average-Case Reduction

Solve SVP in Hα−1

For any B = {b1, . . . , bn} ⊂ Zn generating lattice Λ, approximate shortest v ∈ Λ ∩ Hα−1.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 11 / 12

slide-54
SLIDE 54

Worst-Case to Average-Case Reduction

Solve SVP in Hα−1

For any B = {b1, . . . , bn} ⊂ Zn generating lattice Λ, approximate shortest v ∈ Λ ∩ Hα−1.

Given

Oracle O finds collisions in our fA, but only for uniform keys A.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 11 / 12

slide-55
SLIDE 55

Worst-Case to Average-Case Reduction

Solve SVP in Hα−1

For any B = {b1, . . . , bn} ⊂ Zn generating lattice Λ, approximate shortest v ∈ Λ ∩ Hα−1.

Given

Oracle O finds collisions in our fA, but only for uniform keys A.

Reduction

Resembles [Ajt96, GGH97, CN97, M02, M’02, MR04], with improvements: ✔ “Bad” oracle answers are very rare (with elementary proof). (Integral domain.) ✔ Each iteration needs to find only one vector (not n). (Rotations are lin indep.) ⇒ Simpler, tighter security reduction.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 11 / 12

slide-56
SLIDE 56

Worst-Case to Average-Case Reduction

Solve SVP in Hα−1

For any B = {b1, . . . , bn} ⊂ Zn generating lattice Λ, approximate shortest v ∈ Λ ∩ Hα−1.

Given

Oracle O finds collisions in our fA, but only for uniform keys A.

Reduction

Resembles [Ajt96, GGH97, CN97, M02, M’02, MR04], with improvements: ✔ “Bad” oracle answers are very rare (with elementary proof). (Integral domain.) ✔ Each iteration needs to find only one vector (not n). (Rotations are lin indep.) ⇒ Simpler, tighter security reduction.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 11 / 12

slide-57
SLIDE 57

Worst-Case to Average-Case Reduction

Solve SVP in Hα−1

For any B = {b1, . . . , bn} ⊂ Zn generating lattice Λ, approximate shortest v ∈ Λ ∩ Hα−1.

Given

Oracle O finds collisions in our fA, but only for uniform keys A.

Reduction

Resembles [Ajt96, GGH97, CN97, M02, M’02, MR04], with improvements: ✔ “Bad” oracle answers are very rare (with elementary proof). (Integral domain.) ✔ Each iteration needs to find only one vector (not n). (Rotations are lin indep.) ⇒ Simpler, tighter security reduction.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 11 / 12

slide-58
SLIDE 58

Conclusions

☞ Cyclic lattices yield very efficient cryptographic functions.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 12 / 12

slide-59
SLIDE 59

Conclusions

☞ Cyclic lattices yield very efficient cryptographic functions.

  • More algebraic structure than general lattices.
  • Tightly-connected computational problems.

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 12 / 12

slide-60
SLIDE 60

Conclusions

☞ Cyclic lattices yield very efficient cryptographic functions.

  • More algebraic structure than general lattices.
  • Tightly-connected computational problems.

Open Question

What is their worst-case complexity?

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 12 / 12

slide-61
SLIDE 61

Conclusions

☞ Cyclic lattices yield very efficient cryptographic functions.

  • More algebraic structure than general lattices.
  • Tightly-connected computational problems.

Open Question

What is their worst-case complexity? thank you

Chris Peikert, Alon Rosen (MIT, Harvard) Efficient Collision-Resistant Hashing TCC 2006 12 / 12