Improvement and Efficient Implementation of a Lattice-based - - PowerPoint PPT Presentation

▶
improvement and efficient implementation of a lattice
SMART_READER_LITE
LIVE PREVIEW

Improvement and Efficient Implementation of a Lattice-based - - PowerPoint PPT Presentation

Feb 12, 2023 178 likes •639 views

Improvement and Efficient Implementation of a Lattice-based Signature scheme Rachid El Bansarkhani, Johannes Buchmann Technische Universit at Darmstadt TU Darmstadt August 2013 Rachid El Bansarkhani Lattice-based Signatures1 Outline

slide-1
SLIDE 1

Improvement and Efficient Implementation of a Lattice-based Signature scheme

Rachid El Bansarkhani, Johannes Buchmann Technische Universit¨ at Darmstadt TU Darmstadt August 2013

Rachid El Bansarkhani Lattice-based Signatures1

slide-2
SLIDE 2

Outline

Introduction to Lattice-based Crypto Lattice-based Hash Function Lattice-based Signature Scheme Contributions Experimental Resaults

Rachid El Bansarkhani Lattice-based Signatures2

slide-3
SLIDE 3

Introduction

A lattice is the set of all integer linear combinations of (linearly independent) basis vectors B = {b1, . . . , bn} ∈ Rn: L =

n

  • i=1

bi · Z = {Bx : x ∈ Zn} ⊂ Rn A lattice has infinitely many bases: L =

n

  • i=1

ci · Z Definition (Lattices) A discrete additive subgroup of Rn

Rachid El Bansarkhani Lattice-based Signatures3

slide-4
SLIDE 4

Introduction

A lattice is the set of all integer linear combinations of (linearly independent) basis vectors B = {b1, . . . , bn} ∈ Rn: L =

n

  • i=1

bi · Z = {Bx : x ∈ Zn} ⊂ Rn A lattice has infinitely many bases: L =

n

  • i=1

ci · Z Definition (Lattices) A discrete additive subgroup of Rn

Rachid El Bansarkhani Lattice-based Signatures3

slide-5
SLIDE 5

Introduction

A lattice is the set of all integer linear combinations of (linearly independent) basis vectors B = {b1, . . . , bn} ∈ Rn: L =

n

  • i=1

bi · Z = {Bx : x ∈ Zn} ⊂ Rn A lattice has infinitely many bases: L =

n

  • i=1

ci · Z Definition (Lattices) A discrete additive subgroup of Rn

Rachid El Bansarkhani Lattice-based Signatures3

slide-6
SLIDE 6

Introduction

The shortest vector v in a lattice: lattice point with minimum distance λ1 = v to the origin λ1(L) = min

x=0, x∈L x

More generally, λk denotes the smallest radius of a ball containing k linearly independent vectors

Rachid El Bansarkhani Lattice-based Signatures4

slide-7
SLIDE 7

Introduction

The shortest vector v in a lattice: lattice point with minimum distance λ1 = v to the origin λ1(L) = min

x=0, x∈L x

More generally, λk denotes the smallest radius of a ball containing k linearly independent vectors

Rachid El Bansarkhani Lattice-based Signatures4

slide-8
SLIDE 8

Computational Problems

Definition (Shortest Vector Problem) Given a basis B = {b1, . . . , bn}, find the shortest nonzero vector v in the lattice L(B), i.e. v = λ1

Rachid El Bansarkhani Lattice-based Signatures5

slide-9
SLIDE 9

Computational Problems

Definition (Shortest Vector Problem) Given a basis B = {b1, . . . , bn}, find the shortest nonzero vector v in the lattice L(B), i.e. v = λ1

Rachid El Bansarkhani Lattice-based Signatures5

slide-10
SLIDE 10

Computational Problems

Definition (Shortest Vector Problem) Given a basis B = {b1, . . . , bn}, find the shortest nonzero vector v in the lattice L(B), i.e. v = λ1

Rachid El Bansarkhani Lattice-based Signatures5

slide-11
SLIDE 11

Hash function

Lattice-based hash function [Ajtai96]: fA(x) = A · x mod q Input parameters: q ∈ Z (e.g. 219) Choose A ∈ Zn×m

q

uniformly at random, n (e.g. n=256) is main security parameter m > n · log2 q x is from a bounded domain, e.g. x ∈ {0, 1}n

Rachid El Bansarkhani Lattice-based Signatures6

slide-12
SLIDE 12

Hash function

Lattice-based hash function [Ajtai96]: fA(x) = A · x mod q Input parameters: q ∈ Z (e.g. 219) Choose A ∈ Zn×m

q

uniformly at random, n (e.g. n=256) is main security parameter m > n · log2 q x is from a bounded domain, e.g. x ∈ {0, 1}n

Rachid El Bansarkhani Lattice-based Signatures6

slide-13
SLIDE 13

Hash function

Lattice-based hash function [Ajtai96]: fA(x) = A · x mod q Input parameters: q ∈ Z (e.g. 219) Choose A ∈ Zn×m

q

uniformly at random, n (e.g. n=256) is main security parameter m > n · log2 q x is from a bounded domain, e.g. x ∈ {0, 1}n

Rachid El Bansarkhani Lattice-based Signatures6

slide-14
SLIDE 14

Hash function

Lattice-based hash function [Ajtai96]: fA(x) = A · x mod q Input parameters: q ∈ Z (e.g. 219) Choose A ∈ Zn×m

q

uniformly at random, n (e.g. n=256) is main security parameter m > n · log2 q x is from a bounded domain, e.g. x ∈ {0, 1}n

Rachid El Bansarkhani Lattice-based Signatures6

slide-15
SLIDE 15

Hash Function

fA(x) = A · x mod q: is a compression function maps m bits to n log2 q bits inversion and finding collisions as hard as worst-case lattice problems

Rachid El Bansarkhani Lattice-based Signatures7

slide-16
SLIDE 16

Hash Function

Hardness of finding collisions Finding collisions in the average case, where A is chosen at random, is hard, provided approximating SIVP is hard in the worst-case

Rachid El Bansarkhani Lattice-based Signatures8

slide-17
SLIDE 17

From Hash Functions to a Signature Scheme

Signature scheme by Gentry, Peikert and Vaikunthanatan [GPV08] using Preimage Sampleable Trapdoor Functions (PSTF): Hash-and-Sign for lattices Keygen: random matrix A ∈ Zn×m

q

and trapdoor R, RO H(·), PSTF: fA(x) = A · x mod q Signing of message m: signature σ = f −1

A (H(m)) using

trapdoor R. Verification: σ ≤ bound and fA(σ) = H(m) Similar to RSA Hash-and-Sign, but Verification process differs Forging signatures as hard as inverting lattice-based hash functions Secure in the RO

Rachid El Bansarkhani Lattice-based Signatures9

slide-18
SLIDE 18

From Hash Functions to a Signature Scheme

Signature scheme by Gentry, Peikert and Vaikunthanatan [GPV08] using Preimage Sampleable Trapdoor Functions (PSTF): Hash-and-Sign for lattices Keygen: random matrix A ∈ Zn×m

q

and trapdoor R, RO H(·), PSTF: fA(x) = A · x mod q Signing of message m: signature σ = f −1

A (H(m)) using

trapdoor R. Verification: σ ≤ bound and fA(σ) = H(m) Similar to RSA Hash-and-Sign, but Verification process differs Forging signatures as hard as inverting lattice-based hash functions Secure in the RO

Rachid El Bansarkhani Lattice-based Signatures9

slide-19
SLIDE 19

From Hash Functions to a Signature Scheme

Signature scheme by Gentry, Peikert and Vaikunthanatan [GPV08] using Preimage Sampleable Trapdoor Functions (PSTF): Hash-and-Sign for lattices Keygen: random matrix A ∈ Zn×m

q

and trapdoor R, RO H(·), PSTF: fA(x) = A · x mod q Signing of message m: signature σ = f −1

A (H(m)) using

trapdoor R. Verification: σ ≤ bound and fA(σ) = H(m) Similar to RSA Hash-and-Sign, but Verification process differs Forging signatures as hard as inverting lattice-based hash functions Secure in the RO

Rachid El Bansarkhani Lattice-based Signatures9

slide-20
SLIDE 20

From Hash Functions to a Signature Scheme

Signature scheme by Gentry, Peikert and Vaikunthanatan [GPV08] using Preimage Sampleable Trapdoor Functions (PSTF): Hash-and-Sign for lattices Keygen: random matrix A ∈ Zn×m

q

and trapdoor R, RO H(·), PSTF: fA(x) = A · x mod q Signing of message m: signature σ = f −1

A (H(m)) using

trapdoor R. Verification: σ ≤ bound and fA(σ) = H(m) Similar to RSA Hash-and-Sign, but Verification process differs Forging signatures as hard as inverting lattice-based hash functions Secure in the RO

Rachid El Bansarkhani Lattice-based Signatures9

slide-21
SLIDE 21

From Hash Functions to a Signature Scheme

Signature scheme by Gentry, Peikert and Vaikunthanatan [GPV08] using Preimage Sampleable Trapdoor Functions (PSTF): Hash-and-Sign for lattices Keygen: random matrix A ∈ Zn×m

q

and trapdoor R, RO H(·), PSTF: fA(x) = A · x mod q Signing of message m: signature σ = f −1

A (H(m)) using

trapdoor R. Verification: σ ≤ bound and fA(σ) = H(m) Similar to RSA Hash-and-Sign, but Verification process differs Forging signatures as hard as inverting lattice-based hash functions Secure in the RO

Rachid El Bansarkhani Lattice-based Signatures9

slide-22
SLIDE 22

From Hash Functions to a Signature Scheme

Signature scheme by Gentry, Peikert and Vaikunthanatan [GPV08] using Preimage Sampleable Trapdoor Functions (PSTF): Hash-and-Sign for lattices Keygen: random matrix A ∈ Zn×m

q

and trapdoor R, RO H(·), PSTF: fA(x) = A · x mod q Signing of message m: signature σ = f −1

A (H(m)) using

trapdoor R. Verification: σ ≤ bound and fA(σ) = H(m) Similar to RSA Hash-and-Sign, but Verification process differs Forging signatures as hard as inverting lattice-based hash functions Secure in the RO

Rachid El Bansarkhani Lattice-based Signatures9

slide-23
SLIDE 23

From Hash Hunctions to a Signature Scheme

Main challenge: How to generate random Matrix A, enabling the signer to sign messages? Solution: Use the trapdoor R to generate a random matrix A.

Rachid El Bansarkhani Lattice-based Signatures10

slide-24
SLIDE 24

From Hash Functions to a Signature Scheme

Construction of A according to Micciancio an Peikert [MP12]: A = ¯ A | G − ¯ AR

  • Parameters:

¯ A ∈ Zn×n

q

is uniformly dist. R ∈ Zn×nk is the secret/trapdoor (small entries) A is pseudorandom (comp. instantiation)

Rachid El Bansarkhani Lattice-based Signatures11

slide-25
SLIDE 25

From Hash Functions to a Signature Scheme

Implementation issues: q = 2k more suitable for practice entries of R are sampled from a discrete Gaussian G =    1 2 . . . 2k−1 ... 1 2 . . . 2k−1   

Rachid El Bansarkhani Lattice-based Signatures12

slide-26
SLIDE 26

From Hash Functions to a Signature Scheme

Implementation issues: q = 2k more suitable for practice entries of R are sampled from a discrete Gaussian G =    1 2 . . . 2k−1 ... 1 2 . . . 2k−1   

Rachid El Bansarkhani Lattice-based Signatures12

slide-27
SLIDE 27

From Hash Functions to a Signature Scheme

Implementation issues: q = 2k more suitable for practice entries of R are sampled from a discrete Gaussian G =    1 2 . . . 2k−1 ... 1 2 . . . 2k−1   

Rachid El Bansarkhani Lattice-based Signatures12

slide-28
SLIDE 28

From Hash Functions to a Signature Scheme

How to compute signature f −1(u), u =      u1 u2 . . . un      ∈ Zn

q:

Sample x ∈ Znk according to the discrete Gaussian distribution s.th. G · x = u mod q Then signature σ = R I

  • · x is a preimage of u

Proof: A · σ = ¯ A | G − ¯ AR

  • ·

R I

  • · x =

¯ AR · x + (G − ¯ AR) · x = G · x = u

Rachid El Bansarkhani Lattice-based Signatures13

slide-29
SLIDE 29

From Hash Functions to a Signature Scheme

How to compute signature f −1(u), u =      u1 u2 . . . un      ∈ Zn

q:

Sample x ∈ Znk according to the discrete Gaussian distribution s.th. G · x = u mod q Then signature σ = R I

  • · x is a preimage of u

Proof: A · σ = ¯ A | G − ¯ AR

  • ·

R I

  • · x =

¯ AR · x + (G − ¯ AR) · x = G · x = u

Rachid El Bansarkhani Lattice-based Signatures13

slide-30
SLIDE 30

From Hash Functions to a Signature Scheme

How to compute signature f −1(u), u =      u1 u2 . . . un      ∈ Zn

q:

Sample x ∈ Znk according to the discrete Gaussian distribution s.th. G · x = u mod q Then signature σ = R I

  • · x is a preimage of u

Proof: A · σ = ¯ A | G − ¯ AR

  • ·

R I

  • · x =

¯ AR · x + (G − ¯ AR) · x = G · x = u

Rachid El Bansarkhani Lattice-based Signatures13

slide-31
SLIDE 31

From Hash Hunctions to a Signature Scheme

Problem: Distribution of σ is skewed Leaks information about the trapdoor Need for spherically distributed signatures

Rachid El Bansarkhani Lattice-based Signatures14

slide-32
SLIDE 32

Signature Scheme

Solution: Add perturbations p to correct distribution of signature Sample perturbations p with covariance matrix C = s2I − r2

RR⊤ R R⊤ I

  • and perturbation matrix

√ C Compute perturbed syndrome v = H(m) − Ap = u − Ap Sample x such that Gx = v Signatures: σ = R I

  • · x + p

Distribution of signatures independent from secret key

Rachid El Bansarkhani Lattice-based Signatures15

slide-33
SLIDE 33

Contributions

Implementation and Improvements: Construction of the ring variant for more efficiency and practicality Space improvement of perturbation matrix used to sample preimages Runtime improvement of Keygen and Signing due to improved perturbation matrix (sparse) and ring variant Implementation of the signature scheme (ring and matrix variant)

Rachid El Bansarkhani Lattice-based Signatures16

slide-34
SLIDE 34

Contributions

Implementation and Improvements: Construction of the ring variant for more efficiency and practicality Space improvement of perturbation matrix used to sample preimages Runtime improvement of Keygen and Signing due to improved perturbation matrix (sparse) and ring variant Implementation of the signature scheme (ring and matrix variant)

Rachid El Bansarkhani Lattice-based Signatures16

slide-35
SLIDE 35

Contributions

Implementation and Improvements: Construction of the ring variant for more efficiency and practicality Space improvement of perturbation matrix used to sample preimages Runtime improvement of Keygen and Signing due to improved perturbation matrix (sparse) and ring variant Implementation of the signature scheme (ring and matrix variant)

Rachid El Bansarkhani Lattice-based Signatures16

slide-36
SLIDE 36

Contributions

Implementation and Improvements: Construction of the ring variant for more efficiency and practicality Space improvement of perturbation matrix used to sample preimages Runtime improvement of Keygen and Signing due to improved perturbation matrix (sparse) and ring variant Implementation of the signature scheme (ring and matrix variant)

Rachid El Bansarkhani Lattice-based Signatures16

slide-37
SLIDE 37

Contributions

Ring variant: Consider the Ring Rq = Zq[X]/xn + 1 for n = 2d and q = 2k Choose a polynomial a uniformly at random from Rq Draw k Ring-LWE-samples ari + ei Furthermore, consider the primitive vector of polynomials g⊤ = [1, . . . , 2k−1] The public key is A = [1, a, g1 − (ar1 + e1), . . . , gk − (ark + ek)]

Rachid El Bansarkhani Lattice-based Signatures17

slide-38
SLIDE 38

Contributions

A = [1, a, g1 − (ar1 + e1), . . . , gk − (ark + ek)] A primitive matrix of polynomials G is explicitly not required [a, ar1 + e1, . . . , ark + ek] is pseudorandom Sampling preimages slightly differs from the matrix variant

Rachid El Bansarkhani Lattice-based Signatures18

slide-39
SLIDE 39

Contributions

How to sample x ∈ Rk−1

q

such that g⊤x =

k−1

  • i=0

2ixi = u ∈ Rq Consider matrix expansion of g⊤: ˜ G = [In|2In| . . . |2k−1In] There exists permutation matrix P s.th. ˜ G = G · P =  

1 2 . . . 2k−1 ... 1 2 . . . 2k−1

  · P G from matrix variant

Rachid El Bansarkhani Lattice-based Signatures19

slide-40
SLIDE 40

Contributions

How to sample x ∈ Rk−1

q

such that g⊤x = u ∈ Rq We have ˜ G ·   x1 . . . xk−1   = u Thus, sample x s.th. G · x = u ˜ x = P⊤ · x is a preimage for ˜ G since ˜ G˜ x = G · PP⊤ · x = Gx = u If x spherically distributed, then so ˜ x.

Rachid El Bansarkhani Lattice-based Signatures20

slide-41
SLIDE 41

Contributions

How to sign a message m: Sample perturbation polynomials p = [p1, . . . , pk+2] Compute perturbed syndrome v = H(m) − A · p Sample x ∈ Rk s.th. g⊤x = v Signature is σ = p + [ex, rx, r1x1, . . . , rkxk] Signature is spherically distributed

Rachid El Bansarkhani Lattice-based Signatures21

slide-42
SLIDE 42

Experimental results

Running times for ring (polynomials) and matrix version

Rachid El Bansarkhani Lattice-based Signatures22

slide-43
SLIDE 43

Experimental results

Sizes for ring (polynomials) and matrix version

Rachid El Bansarkhani Lattice-based Signatures23

slide-44
SLIDE 44

Thanks for your attention!

Rachid El Bansarkhani Lattice-based Signatures24