How to Use a Short Basis: Trapdoors for Hard Lattices and New - - PowerPoint PPT Presentation

▶
how to use a short basis trapdoors for hard lattices and
SMART_READER_LITE
LIVE PREVIEW

How to Use a Short Basis: Trapdoors for Hard Lattices and New - - PowerPoint PPT Presentation

May 27, 2023 692 likes •1.48k views

How to Use a Short Basis: Trapdoors for Hard Lattices and New Cryptographic Constructions Chris Peikert SRI Work with Craig Gentry and Vinod Vaikuntanathan 1 / 14 Digital Signatures 2 / 14 Digital Signatures (public) (secret) 2 / 14

slide-1
SLIDE 1

How to Use a Short Basis: Trapdoors for Hard Lattices and New Cryptographic Constructions

Chris Peikert SRI

Work with Craig Gentry and Vinod Vaikuntanathan

1 / 14

slide-2
SLIDE 2

Digital Signatures

2 / 14

slide-3
SLIDE 3

Digital Signatures

(secret) (public)

2 / 14

slide-4
SLIDE 4

Digital Signatures

(secret) (public) “I love you” ✔

2 / 14

slide-5
SLIDE 5

Digital Signatures

(secret) (public) “It’s over” ✗

2 / 14

slide-6
SLIDE 6

Trapdoor Permutations

[DiffieHellman76]

◮ Public function f, secret “trapdoor” f −1

3 / 14

slide-7
SLIDE 7

Trapdoor Permutations

[DiffieHellman76]

◮ Public function f, secret “trapdoor” f −1 Dom Dom x y f

3 / 14

slide-8
SLIDE 8

Trapdoor Permutations

[DiffieHellman76]

◮ Public function f, secret “trapdoor” f −1 Dom Dom x y

3 / 14

slide-9
SLIDE 9

Trapdoor Permutations

[DiffieHellman76]

◮ Public function f, secret “trapdoor” f −1 Dom Dom x y f −1

3 / 14

slide-10
SLIDE 10

Trapdoor Permutations

[DiffieHellman76]

◮ Public function f, secret “trapdoor” f −1 Dom Dom x y f −1 ◮ Candidates: [RSA78,Rabin79,Paillier99]

✔ “General assumption” ✔ Applications: digital signatures, OT, NIZK, . . .

3 / 14

slide-11
SLIDE 11

Trapdoor Permutations

[DiffieHellman76]

◮ Public function f, secret “trapdoor” f −1 Dom Dom x y f −1 ◮ Candidates: [RSA78,Rabin79,Paillier99]

✔ “General assumption” ✔ Applications: digital signatures, OT, NIZK, . . .

◮ All rely on hardness of factoring

✗ Complex: 2048-bit exponentiation ✗ Lack of diversity ✗ Broken by quantum algorithms [Shor]

3 / 14

slide-12
SLIDE 12

Lattice-Based Cryptography

What’s To Like ◮ Simple & efficient: linear ops, small integers ◮ Resist subexp & quantum attacks (so far) ◮ Security from worst-case hardness [Ajtai,. . . ]

4 / 14

slide-13
SLIDE 13

Lattice-Based Cryptography

What’s To Like ◮ Simple & efficient: linear ops, small integers ◮ Resist subexp & quantum attacks (so far) ◮ Security from worst-case hardness [Ajtai,. . . ] What’s Known

1 One-way & collision-resistant functions [Ajtai,. . . ,MicciancioRegev] 2 Public-key encryption [AjtaiDwork,Regev] 3 Recent developments [LyubMicc,PeikWat,. . . ]

4 / 14

slide-14
SLIDE 14

Lattice-Based Cryptography

What’s To Like ◮ Simple & efficient: linear ops, small integers ◮ Resist subexp & quantum attacks (so far) ◮ Security from worst-case hardness [Ajtai,. . . ] What’s Known

1 One-way & collision-resistant functions [Ajtai,. . . ,MicciancioRegev] 2 Public-key encryption [AjtaiDwork,Regev] 3 Recent developments [LyubMicc,PeikWat,. . . ]

What’s Missing ◮ Everything else! Practical signatures, protocols, “advanced” crypto, . . .

4 / 14

slide-15
SLIDE 15

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

5 / 14

slide-16
SLIDE 16

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f

5 / 14

slide-17
SLIDE 17

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f

5 / 14

slide-18
SLIDE 18

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f −1

5 / 14

slide-19
SLIDE 19

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f −1

  • Generate (x, y) in two equivalent ways:

D x y

f

R y x

f −1

5 / 14

slide-20
SLIDE 20

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f −1

  • Generate (x, y) in two equivalent ways:

D x y

f

R y x

f −1

  • “As good as” trapdoor permutations in many applications

5 / 14

slide-21
SLIDE 21

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f −1

  • Generate (x, y) in two equivalent ways:

D x y

f

R y x

f −1

  • “As good as” trapdoor permutations in many applications

2 “Hash and sign” signatures: FDH etc.

5 / 14

slide-22
SLIDE 22

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f −1

  • Generate (x, y) in two equivalent ways:

D x y

f

R y x

f −1

  • “As good as” trapdoor permutations in many applications

2 “Hash and sign” signatures: FDH etc. 3 Identity-based encryption, OT [PVW], NCE [CDMW], NISZK [PV], . . .

5 / 14

slide-23
SLIDE 23

Results: New Lattice-Based Crypto

1 Preimage sampleable trapdoor functions

D R x y f −1

  • Generate (x, y) in two equivalent ways:

D x y

f

R y x

f −1

  • “As good as” trapdoor permutations in many applications

2 “Hash and sign” signatures: FDH etc. 3 Identity-based encryption, OT [PVW], NCE [CDMW], NISZK [PV], . . .

New Algorithmic Tool ◮ “Oblivious decoder” on lattices

5 / 14

slide-24
SLIDE 24

Lattices

A lattice L ⊂ Rn having basis B = {b1, . . . , bn} is: L =

n

  • i=1

(Z · bi)

O b1 b2 6 / 14

slide-25
SLIDE 25

Lattices

A lattice L ⊂ Rn having basis B = {b1, . . . , bn} is: L =

n

  • i=1

(Z · bi)

O b1 b2 6 / 14

slide-26
SLIDE 26

Lattices

A lattice L ⊂ Rn having basis B = {b1, . . . , bn} is: L =

n

  • i=1

(Z · bi)

O b1 b2

Shortest Vector Problem (SVPγ) ◮ Given B, find (nonzero) v ∈ L within γ factor of shortest.

6 / 14

slide-27
SLIDE 27

Lattices

A lattice L ⊂ Rn having basis B = {b1, . . . , bn} is: L =

n

  • i=1

(Z · bi)

O t β b1 b2

Shortest Vector Problem (SVPγ) ◮ Given B, find (nonzero) v ∈ L within γ factor of shortest. Absolute Distance Decoding (ADDβ) ◮ Given B and target t ∈ Rn, find some v ∈ L within distance β.

6 / 14

slide-28
SLIDE 28

Complexity of Lattice Problems

SVPγ in the Worst Case γ = O(1) NP-hard

[Ajt,Mic,Kho]

poly(n) 2n time

[AKS]

2n poly(n) time

[LLL,Sch]

7 / 14

slide-29
SLIDE 29

Complexity of Lattice Problems

SVPγ in the Worst Case γ = O(1) NP-hard

[Ajt,Mic,Kho]

poly(n) 2n time

[AKS]

2n poly(n) time

[LLL,Sch]

Average-Case ◮ [Ajtai96,. . . ,MicciancioRegev04]: SVPγ random lattice as hard as SVPγ·n every lattice

7 / 14

slide-30
SLIDE 30

Complexity of Lattice Problems

SVPγ in the Worst Case γ = O(1) NP-hard

[Ajt,Mic,Kho]

poly(n) 2n time

[AKS]

2n poly(n) time

[LLL,Sch]

Average-Case ◮ [Ajtai96,. . . ,MicciancioRegev04]: ADDβ random lattice as hard as SVPβ·n every lattice ◮ Decoding hard on average, too

7 / 14

slide-31
SLIDE 31

Complexity of Lattice Problems

SVPγ in the Worst Case γ = O(1) NP-hard

[Ajt,Mic,Kho]

poly(n) 2n time

[AKS]

2n poly(n) time

[LLL,Sch]

Average-Case ◮ [Ajtai96,. . . ,MicciancioRegev04]: ADDβ random lattice as hard as SVPβ·n every lattice ◮ Decoding hard on average, too Bottom Line ◮ On random lattices, SVPγ and ADDβ seem exponentially hard

7 / 14

slide-32
SLIDE 32

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S

s1 s2 b1 b2 8 / 14

slide-33
SLIDE 33

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

s1 s2 8 / 14

slide-34
SLIDE 34

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

s1 s2 8 / 14

slide-35
SLIDE 35

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

s1 s2 8 / 14

slide-36
SLIDE 36

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

s1 s2 8 / 14

slide-37
SLIDE 37

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

s1 s2 8 / 14

slide-38
SLIDE 38

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

s1 s2 8 / 14

slide-39
SLIDE 39

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

s1 s2 8 / 14

slide-40
SLIDE 40

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai]

8 / 14

slide-41
SLIDE 41

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai] Issues

1 Generating short & hard bases together

  • Ad-hoc, no worst-case hardness

8 / 14

slide-42
SLIDE 42

GGH Signatures

[GoldreichGoldwasserHalevi96]

◮ “Hard” (public) verification basis B, short (secret) signing basis S ◮ Sign with “nearest-plane” algorithm [Babai] Issues

1 Generating short & hard bases together

  • Ad-hoc, no worst-case hardness

2 Secret key leakage

  • Total break after several signatures [NguyenRegev]

8 / 14

slide-43
SLIDE 43

Gaussians and Lattices

9 / 14

slide-44
SLIDE 44

Gaussians and Lattices

9 / 14

slide-45
SLIDE 45

Gaussians and Lattices

9 / 14

slide-46
SLIDE 46

Gaussians and Lattices

“Uniform” in Rn when std dev ≥ shortest basis

[Regev,MicciancioRegev]

9 / 14

slide-47
SLIDE 47

Our Trapdoor Function

◮ “Hard” public basis B, short secret basis S

[Ajtai99,AP08]

b1 b2 s1 s2 10 / 14

slide-48
SLIDE 48

Our Trapdoor Function

◮ “Hard” public basis B, short secret basis S

[Ajtai99,AP08]

◮ Input v ∈ L, error e

10 / 14

slide-49
SLIDE 49

Our Trapdoor Function

◮ “Hard” public basis B, short secret basis S

[Ajtai99,AP08]

◮ Input v ∈ L, error e

10 / 14

slide-50
SLIDE 50

Our Trapdoor Function

◮ “Hard” public basis B, short secret basis S

[Ajtai99,AP08]

◮ Input v ∈ L, error e ◮ Uniform output t

t 10 / 14

slide-51
SLIDE 51

Our Trapdoor Function

◮ “Hard” public basis B, short secret basis S

[Ajtai99,AP08]

◮ Input v ∈ L, error e ◮ Uniform output t

t 10 / 14

slide-52
SLIDE 52

Our Trapdoor Function

◮ “Hard” public basis B, short secret basis S

[Ajtai99,AP08]

◮ Input v ∈ L, error e ◮ Uniform output t

t

◮ Conditional distribution is “discrete Gaussian” DL,t Analysis tool in

[Ban,AR,Reg,MR,Pei,. . . ]

10 / 14

slide-53
SLIDE 53

Inverting: Gaussian Sampler / Decoder

◮ Given basis S, samples DL,t for any std dev ≥ maxsi

  • Leaks nothing about S!

11 / 14

slide-54
SLIDE 54

Inverting: Gaussian Sampler / Decoder

◮ Given basis S, samples DL,t for any std dev ≥ maxsi

  • Leaks nothing about S!

◮ Randomized nearest-plane [Babai,Klein]

t s1 s2 11 / 14

slide-55
SLIDE 55

Inverting: Gaussian Sampler / Decoder

◮ Given basis S, samples DL,t for any std dev ≥ maxsi

  • Leaks nothing about S!

◮ Randomized nearest-plane [Babai,Klein]

t s1 s2 11 / 14

slide-56
SLIDE 56

Inverting: Gaussian Sampler / Decoder

◮ Given basis S, samples DL,t for any std dev ≥ maxsi

  • Leaks nothing about S!

◮ Randomized nearest-plane [Babai,Klein]

t s1 s2 11 / 14

slide-57
SLIDE 57

Inverting: Gaussian Sampler / Decoder

◮ Given basis S, samples DL,t for any std dev ≥ maxsi

  • Leaks nothing about S!

◮ Randomized nearest-plane [Babai,Klein]

t s1 s2 11 / 14

slide-58
SLIDE 58

Inverting: Gaussian Sampler / Decoder

◮ Given basis S, samples DL,t for any std dev ≥ maxsi

  • Leaks nothing about S!

◮ Randomized nearest-plane [Babai,Klein]

t s1 s2

[Klein]: std dev ≤ min ˜

si ⇒ solves CVP variant

11 / 14

slide-59
SLIDE 59

Inverting: Gaussian Sampler / Decoder

◮ Given basis S, samples DL,t for any std dev ≥ maxsi

  • Leaks nothing about S!

◮ Randomized nearest-plane [Babai,Klein]

t s1 s2

[Klein]: std dev ≤ min ˜

si ⇒ solves CVP variant

[This work]: std dev ≥ max˜

si ⇒ samples DL,t exactly∗

11 / 14

slide-60
SLIDE 60

Identity-Based Encryption

◮ Proposed by [Shamir84]:

12 / 14

slide-61
SLIDE 61

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk

12 / 14

slide-62
SLIDE 62

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .

12 / 14

slide-63
SLIDE 63

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .
  • With msk: extract skAlice or skBob or . . .

12 / 14

slide-64
SLIDE 64

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .
  • With msk: extract skAlice or skBob or . . .

◮ [BonehFranklin01]: bilinear pairings

12 / 14

slide-65
SLIDE 65

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .
  • With msk: extract skAlice or skBob or . . .

◮ [BonehFranklin01]: bilinear pairings ◮ [Cocks01]: quadratic residuosity (mod N = pq)

12 / 14

slide-66
SLIDE 66

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .
  • With msk: extract skAlice or skBob or . . .

◮ [BonehFranklin01]: bilinear pairings ◮ [Cocks01]: quadratic residuosity (mod N = pq) Lattice-based QR-based [Cocks,BGH] mpk random lattice random N = p · q

12 / 14

slide-67
SLIDE 67

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .
  • With msk: extract skAlice or skBob or . . .

◮ [BonehFranklin01]: bilinear pairings ◮ [Cocks01]: quadratic residuosity (mod N = pq) Lattice-based QR-based [Cocks,BGH] mpk random lattice random N = p · q msk trapdoor basis trapdoor p, q

12 / 14

slide-68
SLIDE 68

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .
  • With msk: extract skAlice or skBob or . . .

◮ [BonehFranklin01]: bilinear pairings ◮ [Cocks01]: quadratic residuosity (mod N = pq) Lattice-based QR-based [Cocks,BGH] mpk random lattice random N = p · q msk trapdoor basis trapdoor p, q Hash(ID) uniform y ∈ Rn uniform y ∈ QRN

12 / 14

slide-69
SLIDE 69

Identity-Based Encryption

◮ Proposed by [Shamir84]:

  • Master keys mpk, msk
  • With mpk: encrypt to ID “Alice” or “Bob” or . . .
  • With msk: extract skAlice or skBob or . . .

◮ [BonehFranklin01]: bilinear pairings ◮ [Cocks01]: quadratic residuosity (mod N = pq) Lattice-based QR-based [Cocks,BGH] mpk random lattice random N = p · q msk trapdoor basis trapdoor p, q Hash(ID) uniform y ∈ Rn uniform y ∈ QRN skID random ∈ f −1(y) random √y

12 / 14

slide-70
SLIDE 70

Cryptosystem with Master Trapdoor

Primal L Dual L∗

sk pk 13 / 14

slide-71
SLIDE 71

Cryptosystem with Master Trapdoor

Primal L Dual L∗

sk pk v

◮ For v ∈ L∗: v, pk = v, sk mod 1

13 / 14

slide-72
SLIDE 72

Cryptosystem with Master Trapdoor

Primal L Dual L∗

sk pk v w

◮ For v ∈ L∗: v, pk = v, sk mod 1 ◮ For w ≈ v: v, pk ≈ w, sk mod 1 “quasi”-agreement

13 / 14

slide-73
SLIDE 73

Cryptosystem with Master Trapdoor

Primal L Dual L∗

sk pk v w

◮ For v ∈ L∗: v, pk = v, sk mod 1 ◮ For w ≈ v: v, pk ≈ w, sk mod 1 “quasi”-agreement ◮ Security: decoding w, a.k.a. “learning with errors”

  • Quantum worst-case connection [Regev]
  • Now: classical worst-case hardness [P]

13 / 14

slide-74
SLIDE 74

Open Problems

1 Tighter sampling for random lattices ?

14 / 14

slide-75
SLIDE 75

Open Problems

1 Tighter sampling for random lattices ? 2 Practical “plain model” signatures ?

14 / 14

slide-76
SLIDE 76

Open Problems

1 Tighter sampling for random lattices ? 2 Practical “plain model” signatures ? 3 Relate factoring to lattice problems ?

14 / 14

slide-77
SLIDE 77

Open Problems

1 Tighter sampling for random lattices ? 2 Practical “plain model” signatures ? 3 Relate factoring to lattice problems ? 4 “Essence” of quantum-immune crypto ?

14 / 14

slide-78
SLIDE 78

Open Problems

1 Tighter sampling for random lattices ? 2 Practical “plain model” signatures ? 3 Relate factoring to lattice problems ? 4 “Essence” of quantum-immune crypto ?

Thanks!

(Artwork courtesy of xkcd.org) 14 / 14