[PPT] - On Basing Search SIVP on NP-Hardness Tianren Liu MIT liutr@mit.edu PowerPoint Presentation

SLIDE 1

On Basing Search SIVP on NP-Hardness

Tianren Liu

MIT liutr@mit.edu

Sixteenth IACR Theory of Cryptography Conference

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 1 / 18

SLIDE 2

Assumptions and Primitives in Cryptography

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 2 / 18

SLIDE 3

Assumptions and Primitives in Cryptography

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc Can we prove the security of a cryptographic primitive from the minimal assumption NP BPP? (Brassard 1979)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 2 / 18

SLIDE 4

(Black-box) Security Proofs

To prove the security of X based on NP BPP, find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X”, RA solves SAT R

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 3 / 18

SLIDE 5

(Black-box) Security Proofs

To prove the security of X based on NP BPP, find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X”, RA solves SAT R A

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 3 / 18

SLIDE 6

(Black-box) Security Proofs

To prove the security of X based on NP BPP, find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X”, RA solves SAT R A

x

accepts w.p. ≥ 2/3, if x ∈ SAT accepts w.p. ≤ 1/3, if x / ∈ SAT

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 3 / 18

SLIDE 7

Impossibility Results

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc Trapdoor Permutation PIR Add-Homomorphic Enc OWP No known cryptographic scheme based on NP BPP. Several negative results* [Brassard’79, . . . ]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

SLIDE 8

Impossibility Results

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc Trapdoor Permutation PIR Add-Homomorphic Enc OWP One-way Permutations

[Brassard’79]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

SLIDE 9

Impossibility Results

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc Trapdoor Permutation PIR Add-Homomorphic Enc OWP OWF∗ One-way Permutations

[Brassard’79]

Size-Verifiable One-way Functions

[Akavia-Goldreich-Goldwasser- Moshkovitz’06, Bogdanov-Brzuska’14]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

SLIDE 10

Impossibility Results

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc Trapdoor Permutation PIR Add-Homomorphic Enc OWP OWF∗ Add-Homomorphic Encryption

[Bogdanov-Lee’13]

One-way Permutations

[Brassard’79]

Size-Verifiable One-way Functions

[Akavia-Goldreich-Goldwasser- Moshkovitz’06, Bogdanov-Brzuska’14]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

SLIDE 11

Impossibility Results

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc Trapdoor Permutation PIR Add-Homomorphic Enc OWP OWF∗ Add-Homomorphic Encryption

[Bogdanov-Lee’13]

Private Information Retrieval

[Liu-Vaikuntanathan’16]

One-way Permutations

[Brassard’79]

Size-Verifiable One-way Functions

[Akavia-Goldreich-Goldwasser- Moshkovitz’06, Bogdanov-Brzuska’14]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

SLIDE 12

Impossibility Results (restricting the reductions)

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc Trapdoor Permutation PIR Add-Homomorphic Enc OWP Public-key Encryption Scheme, via “smart” reduction

[Goldreich-Goldwasser’98]

Collision-resistant Hash Functions, via constant-adaptive reduction

[Haitner-Mahmoody-Xiao’09]

Average-case NP, via non-adaptive reduction

[Bogdanov-Trevisan’06]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

SLIDE 13

A New Hope

Trapdoor Permutation PIR Add-Homomorphic Enc OWP

Hardness of Lattice Problems

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

SLIDE 14

A New Hope

Trapdoor Permutation PIR Add-Homomorphic Enc OWP

Hardness of Lattice Problems

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc SIS LWE A successful history of lattice-based cryptography

[GGH’97, Regev’05, GPV’08, Gentry’09, BV’11, . . . ]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

SLIDE 15

A New Hope

Trapdoor Permutation PIR Add-Homomorphic Enc OWP

Hardness of Lattice Problems

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc SIS LWE SIVP BPP gapSVP, gapSIVP BPP A successful history of lattice-based cryptography

[GGH’97, Regev’05, GPV’08, Gentry’09, BV’11, . . . ]

Based on worst-case hardness

f lattice problems

such as SIVP, gapSVP

[Ajtai’96, MR’04, Regev’05, Peikert’09, LPR’10, MP’12, . . . ]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

SLIDE 16

A New Hope

Trapdoor Permutation PIR Add-Homomorphic Enc OWP

Hardness of Lattice Problems

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc SIS LWE SIVP BPP gapSVP, gapSIVP BPP

Impossibility Results [GG’00,

MV’03,AR’04,GMR’04,PV’08]

gapSVP ˜

O(√n), gapSIVP ˜ O(√n)

are not NP-hard unless polynomial hierarchy collapses.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

SLIDE 17

A New Hope

Trapdoor Permutation PIR Add-Homomorphic Enc OWP

Hardness of Lattice Problems

NP BPP Avg-NP BPP OWF CRHF Pub-key Enc SIS LWE SIVP BPP gapSVP, gapSIVP BPP

Impossibility Results [GG’00,

MV’03,AR’04,GMR’04,PV’08]

gapSVP ˜

O(√n), gapSIVP ˜ O(√n)

are not NP-hard unless polynomial hierarchy collapses.

Our Result

Search problem SIVP ˜

O(n) is not

NP-hard unless polynomial hierarchy collapses.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

SLIDE 18

Lattice

Full-rank discrete additive subgroup in Rn

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 19

Lattice

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 20

Lattice

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 21

Lattice

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2 b′

1

b′

2

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 22

Lattice Problems

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2 b′

1

b′

2

Shortest Independent Vector Problem (SIVP)

Search Find shortest basis in lattice L(B).

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 23

Lattice Problems

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2 b′

1

b′

2

Shortest Independent Vector Problem (SIVP)

Search Find shortest basis in lattice L(B). Decision Given a real d, distinguish between λn(B) ≤ d and λn(B) > d. λn(B) := length of the shortest basis in lattice L(B).

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 24

Lattice Problems

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2 b′

1

b′

2

Shortest Independent Vector Problem (SIVP), γ-Approx.

Search Find shortest basis in lattice L(B). Decision Given a real d, distinguish between λn(B) ≤ d and λn(B) > d. λn(B) := length of the shortest basis in lattice L(B).

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 25

Lattice Problems

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2 b′

1

b′

2

Shortest Independent Vector Problem (SIVP), γ-Approx.

SIVPγ Find short basis whose length ≤ γ · λn(B). Decision Given a real d, distinguish between λn(B) ≤ d and λn(B) > d. λn(B) := length of the shortest basis in lattice L(B).

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 26

Lattice Problems

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2 b′

1

b′

2

Shortest Independent Vector Problem (SIVP), γ-Approx.

SIVPγ Find short basis whose length ≤ γ · λn(B). GapSIVPγ Given a real d, distinguish between λn(B) ≤ d and λn(B) > γ · d. λn(B) := length of the shortest basis in lattice L(B).

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 27

Lattice Problems

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} b1 b2 b′

1

b′

2

Shortest Vector Problem (SVP), γ-Approx.

SVPγ Find short non-zero vector whose length ≤ γ · λ1(B). GapSVPγ Given a real d, distinguish between λ1(B) ≤ d and λ1(B) > γ · d. λ1(B) := length of the shortest non-zero vector in lattice L(B).

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 28

Lattice Problems

Full-rank discrete additive subgroup in Rn Basis B = (b1, . . . , bn) ∈ Rn×n L(B) := {Bz | z ∈ Zn} gapSVPγ gapSIVPγ SVPγ SIVPγ Crypto ∗ ∗ ∗ poly(n) loss on γ b1 b2 b′

1

b′

2

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

SLIDE 29

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 30

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ γ = O(1) NP-hard gapSIVPγ ≥ SAT for γ = O(1) [Bl¨

mer-Seifert’99, Haviv-Regev’06]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 31

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ γ = O(1) NP-hard gapSIVPγ ≥ SAT for γ = O(1) [Bl¨

mer-Seifert’99, Haviv-Regev’06]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 32

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ γ = O(1) NP-hard γ = 2n ∈ P SIVPγ ∈ P for γ = 2n [LLL]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 33

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ γ = O(1) NP-hard γ = 2n ∈ P SIVPγ ∈ P for γ = 2n [LLL]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 34

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ γ = O(1) NP-hard γ = 2n ∈ P γ = ˜ Ω(√n) not NP-hard gapSIVPγ ∈ NP ∩ coNP for γ = √n [Ban’93, GMR’04] gapSIVPγ ∈ NP ∩ coAM for γ =

n/ log n [BS’99, GMR’04]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 35

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ γ = O(1) NP-hard γ = 2n ∈ P γ = ˜ Ω(√n) ∈ SZK gapSIVPγ ∈ SZK for any γ = ω(√n log n) [PV’08]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 36

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ γ = O(1) NP-hard γ = 2n ∈ P γ = ˜ Ω(√n) ∈ SZK γ = poly(n)

??

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 37

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ Crypto γ = O(1) NP-hard γ = 2n ∈ P γ = ˜ Ω(√n) ∈ SZK γ = ω(n log n)

??

SIVPγ = ⇒ CRHF for any γ = ω(n log n) [Micciancio-Regev’04]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 38

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ Crypto γ = O(1) NP-hard γ = 2n ∈ P γ = Ω(n) γ = ω(n log n)

??

In ideal lattices, gapSIVPn ∈ P

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 39

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ Crypto γ = O(1) NP-hard γ = 2n ∈ P γ = ˜ Ω(√n) ∈ SZK γ = ω(n log n)

??

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 40

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ Crypto γ = O(1) NP-hard γ = 2n ∈ P γ = ˜ Ω(√n) ∈ SZK γ = ω(n log n)

AM ∩ coAM Main Theorem

Any language that can be efficiently reduced to SIVP ˜

O(n) is in AM ∩ coAM.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 41

Lattice

Hardness of gapSIVPγ Hardness of SIVPγ Crypto γ = O(1) NP-hard γ = 2n ∈ P γ = ˜ Ω(√n) ∈ SZK γ = ω(n log n)

AM ∩ coAM Main Theorem

Any language that can be efficiently reduced to SIVP ˜

O(n) is in AM ∩ coAM.

Thus it’s not NP-hard unless polynomial hierarchy collapses.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 7 / 18

SLIDE 42

Discrete Gaussian Sampling

DGSL,s is distribution on a lattice L s.t. for all v ∈ L Pr

v ← DGSL,s
∝ e− v2

s2 Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 8 / 18

SLIDE 43

Discrete Gaussian Sampling

DGSL,s is distribution on a lattice L s.t. for all v ∈ L Pr

v ← DGSL,s
∝ e− v2

s2

Center: origin point 0 Parameter s: “standard deviation”

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 8 / 18

SLIDE 44

Discrete Gaussian Sampling

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 8 / 18

SLIDE 45

Discrete Gaussian Sampling

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 8 / 18

SLIDE 46

Discrete Gaussian Sampling

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 8 / 18

SLIDE 47

Discrete Gaussian Sampling

Hardness of SIVPγ Hardness of DGSL,s γ s =

γ √nλn (when s ≥ λn)

A small basis can be sampled form DGSL,s

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 9 / 18

SLIDE 48

Discrete Gaussian Sampling

Hardness of SIVPγ Hardness of DGSL,s γ s =

γ √nλn (when s ≥ λn)

s = √log n · γλn A small basis can be sampled form DGSL,s A small basis allows sampling from DGSL,s [BLPRS’13]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 9 / 18

SLIDE 49

Discrete Gaussian Sampling

Hardness of SIVPγ Hardness of DGSL,s s =

γ √nλn (when s ≥ λn)

s = √log n · γλn any γ = ω(n log n) not NP-hard

Main Theorem

Any language that can be efficiently reduced to SIVP ˜

O(n)

is in AM ∩ coAM.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 9 / 18

SLIDE 50

Discrete Gaussian Sampling

Hardness of SIVPγ Hardness of DGSL,s s =

γ √nλn (when s ≥ λn)

any γ = ω(n log n) not NP-hard s = ˜ Ω(n)λn not NP-hard

Main Theorem

Any language that can be efficiently reduced to SIVP ˜

O(n)

is in AM ∩ coAM.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 9 / 18

SLIDE 51

Discrete Gaussian Sampling

Hardness of SIVPγ Hardness of DGSL,s any γ = ω(n log n) not NP-hard s = ˜ Ω(n)λn not NP-hard any s = ω(√n log n)λn not NP-hard

Stronger Theorem

Any language that can be efficiently reduced to DGS ˜

O(√n)λn

is in AM ∩ coAM.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 9 / 18

SLIDE 52

Proof Outline

BPP

DGSs= ˜

O(√n)λn

∈ AM ∩ coAM

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 10 / 18

SLIDE 53

Proof Outline

BPP

DGSs= ˜

O(√n)λn

∈ AM ∩ coAM

BPP

Probability-Verifiable ∈ AM ∩ coAM

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 10 / 18

SLIDE 54

Proof Outline

BPP

DGSs= ˜

O(√n)λn

∈ AM ∩ coAM

BPP

Probability-Verifiable ∈ AM ∩ coAM DGSs= ˜

O(√n)λn

is Probability-Verifiable

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 10 / 18

SLIDE 55

Proof Outline

BPP

DGSs= ˜

O(√n)λn

∈ AM ∩ coAM

BPP

Probability-Verifiable ∈ AM ∩ coAM DGSs= ˜

O(√n)λn

is Probability-Verifiable

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 10 / 18

SLIDE 56

Proof Outline

BPP

DGSs= ˜

O(√n)λn

∈ AM ∩ coAM

BPP

Probability-Verifiable ∈ AM ∩ coAM DGSs= ˜

O(√n)λn

is Probability-Verifiable BPPinvert size-vrf. OWF ∈ AM ∩ coAM

[Bogdanov-Brzuska’15]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 10 / 18

SLIDE 57

Proof Outline

BPP

DGSs= ˜

O(√n)λn

∈ AM ∩ coAM

BPP

Probability-Verifiable ∈ AM ∩ coAM DGSs= ˜

O(√n)λn

is Probability-Verifiable BPPinvert size-vrf. OWF ∈ AM ∩ coAM

[Bogdanov-Brzuska’15]

Sample DGS given a small basis [BLPRS’13] gapSIVP ˜

O(√n)

∈ SZK [PV’08]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 10 / 18

SLIDE 58

Probability Verifiability

A sample problem: Given the description of a distribution, sample from the distribution.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 11 / 18

SLIDE 59

Probability Verifiability

A sample problem: Given the description of a distribution, sample from the distribution. E.g. a lattice basis B specifies the distribution DGSL(B),λn(B)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 11 / 18

SLIDE 60

Probability Verifiability

A sample problem: Given the description of a distribution, sample from the distribution. E.g. a lattice basis B specifies the distribution DGSL(B),λn(B) A sample problem is probability verifiable if and only if Given a description of distribution D, and a point v in the domain, there is an Arthur-Merlin protocol to (lower) bound Pr[v ← D].

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 11 / 18

SLIDE 61

Probability Verifiability

A sample problem: Given the description of a distribution, sample from the distribution. E.g. a lattice basis B specifies the distribution DGSL(B),λn(B) A sample problem is probability verifiable if and only if Given a description of distribution D, and a point v in the domain, there is an Arthur-Merlin protocol to (lower) bound Pr[v ← D]. I.e. the following promise problem is in AM YES instance (D, v, ˆ p) such that ˆ p = Pr[v ← D] NO instance (D, v, ˆ p) such that ˆ p > Pr[v ← D] + “small”

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 11 / 18

SLIDE 62

BPP

Probability-Verifiable

∈ AM ∩ coAM

BPP

(x)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 63

BPP

Probability-Verifiable

∈ AM ∩ coAM

BPP

(x) sampling

racle

D

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 64

BPP

Probability-Verifiable

∈ AM ∩ coAM

BPP

(x) sampling

racle

D v1

w.p. PD(v1)

v2

w.p. PD(v2)

vn

w.p. PD(vn)

. . .

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 65

BPP

Probability-Verifiable

∈ AM ∩ coAM

states

BPP

(x) sampling

racle

D v1

w.p. PD(v1)

v2

w.p. PD(v2)

vn

w.p. PD(vn)

. . .

BPP

(x)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 66

BPP

Probability-Verifiable

∈ AM ∩ coAM

states

BPP

(x) sampling

racle

D v1

w.p. PD(v1)

v2

w.p. PD(v2)

vn

w.p. PD(vn)

. . .

BPP

(x) sampling

racle

D′

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 67

BPP

Probability-Verifiable

∈ AM ∩ coAM

states

BPP

(x) sampling

racle

D v1

w.p. PD(v1)

v2

w.p. PD(v2)

vn

w.p. PD(vn)

. . .

BPP

(x) sampling

racle

D′ v′

1 w.p. PD′(v′

1)

v′

2 w.p. PD′(v′

2)

v′

n w.p. PD′(v′

n)

. . .

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 68

BPP

Probability-Verifiable

∈ AM ∩ coAM

states states

BPP

(x) sampling

racle

D v1

w.p. PD(v1)

v2

w.p. PD(v2)

vn

w.p. PD(vn)

. . .

BPP

(x) sampling

racle

D′ v′

1 w.p. PD′(v′

1)

v′

2 w.p. PD′(v′

2)

v′

n w.p. PD′(v′

n)

. . .

BPP

(x)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 69

BPP

Probability-Verifiable

∈ AM ∩ coAM

states states

BPP

(x) sampling

racle

D v1

w.p. PD(v1)

v2

w.p. PD(v2)

vn

w.p. PD(vn)

. . .

BPP

(x) sampling

racle

D′ v′

1 w.p. PD′(v′

1)

v′

2 w.p. PD′(v′

2)

v′

n w.p. PD′(v′

n)

. . .

BPP

(x) Accept

r

Reject

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 12 / 18

SLIDE 70

BPP

Probability-Verifiable

∈ AM ∩ coAM

Every execution is determined by a valid transcript (reduction’s randomness, D1, v1, . . . , Dt, vt).

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 13 / 18

SLIDE 71

BPP

Probability-Verifiable

∈ AM ∩ coAM

Every execution is determined by a valid transcript (reduction’s randomness, D1, v1, . . . , Dt, vt). Its probability is

1 2randomness tape length · i PDi(vi)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 13 / 18

SLIDE 72

BPP

Probability-Verifiable

∈ AM ∩ coAM

Every execution is determined by a valid transcript (reduction’s randomness, D1, v1, . . . , Dt, vt). Its probability is

1 2randomness tape length · i PDi(vi)

which can be (lower) bounded by an Arthur-Merlin protocol.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 13 / 18

SLIDE 73

BPP

Probability-Verifiable

∈ AM ∩ coAM

Every execution is determined by a valid transcript (reduction’s randomness, D1, v1, . . . , Dt, vt). Its probability is

1 2randomness tape length · i PDi(vi)

which can be (lower) bounded by an Arthur-Merlin protocol. The probability that

BPP sampling oracle

(x) →‘accept’ =

valid transcript

s.t. x is accepted

[Probablity of the transcript]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 13 / 18

SLIDE 74

BPP

Probability-Verifiable

∈ AM ∩ coAM

Every execution is determined by a valid transcript (reduction’s randomness, D1, v1, . . . , Dt, vt). Its probability is

1 2randomness tape length · i PDi(vi)

which can be (lower) bounded by an Arthur-Merlin protocol. The probability that

BPP sampling oracle

(x) →‘accept’ =

valid transcript

s.t. x is accepted

[Probablity of the transcript] which can be (lower) bounded by an Arthur-Merlin protocol. [GS’86]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 13 / 18

SLIDE 75

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 76

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 77

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 78

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B Arthur: Estimate λn(B) for me You can’t cheat as gapSIVP

n

log n ∈ NP∩coAM [BS’99, GMR’04] Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 79

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s Arthur: Estimate λn(B) for me You can’t cheat as gapSIVP

n

log n ∈ NP∩coAM [BS’99, GMR’04]

Merlin: Here it is λn(B) ≤ ˆ s <

n

log n · λn(B)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 80

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s Arthur: Give me a small basis of L(B) I already knew λn(B) ≤ ˆ s

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 81

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ Arthur: Give me a small basis of L(B) I already knew λn(B) ≤ ˆ s Merlin: Here it is length of B′ ≤ ˆ s

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 82

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ Arthur: I can sample from DGSL(B),√log n·ˆ

s by myself [BLPRS’13]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 83

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ v Arthur: I can sample from DGSL(B),√log n·ˆ

s by myself [BLPRS’13]

What’s the prob. that v is sampled? [GS’86]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 84

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ v ˆ p Arthur: I can sample from DGSL(B),√log n·ˆ

s by myself [BLPRS’13]

What’s the prob. that v is sampled? [GS’86] Merlin: The prob. is at least 0.000017653 . . .

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 85

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ v ˆ p Arthur learns Pr

v ← DGSL(B),√log n·ˆ

s

≥ ˆ
p. Problem Solved?

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 86

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ v ˆ p Arthur learns Pr

v ← DGSL(B),√log n·ˆ

s

≥ ˆ
p. Problem Solved?

NO!! Merlin can change the distribution by the choice of ˆ

s.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 87

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ v ˆ p Arthur: Compute s(B) for me s(·) is an ad-hoc fucntion s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 88

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol.

Arthur

B, v

Merlin

B ˆ s B′ v ˆ p Arthur: Compute s(B) for me s(·) is an ad-hoc fucntion s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM. Merlin: Sure . . . . . . Here it is. ˆ s ≈ s(B)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 14 / 18

SLIDE 89

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol. Need: function s(·) s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 15 / 18

SLIDE 90

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol. Need: function s(·) s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM. gapSIVP ˜

O(√n) ∈ SZK [PV’08]:

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 15 / 18

SLIDE 91

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol. Need: function s(·) s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM. gapSIVP ˜

O(√n) ∈ SZK [PV’08]:

A function f (B, x) ∈ [0, 1],

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 15 / 18

SLIDE 92

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol. Need: function s(·) s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM. gapSIVP ˜

O(√n) ∈ SZK [PV’08]:

A function f (B, x) ∈ [0, 1], that “can be computed” in AM

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 15 / 18

SLIDE 93

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol. Need: function s(·) s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM. gapSIVP ˜

O(√n) ∈ SZK [PV’08]:

A function f (B, x) ∈ [0, 1], that “can be computed” in AM decreasing on x x f (B, x)

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 15 / 18

SLIDE 94

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol. Need: function s(·) s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM. gapSIVP ˜

O(√n) ∈ SZK [PV’08]:

A function f (B, x) ∈ [0, 1], that “can be computed” in AM decreasing on x f (B, λn(B)) > 2/3 f (B, ˜ O(√n) · λn(B)) < 1/3 x f (B, x) λn ˜ O(√n)λn

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 15 / 18

SLIDE 95

DGSs= ˜

O(√n)λn is Probability-Verifiable

Goal: Given B, v, (lower) bound the probablity that v ← DGSL(B),s= ˜

O(√n)λn(B)

in an Arthur-Merlin protocol. Need: function s(·) s.t. λn(B) ≤ s(B) < ˜ O(√n) · λn(B) and “can be computed” in AM. gapSIVP ˜

O(√n) ∈ SZK [PV’08]:

A function f (B, x) ∈ [0, 1], that “can be computed” in AM decreasing on x f (B, λn(B)) > 2/3 f (B, ˜ O(√n) · λn(B)) < 1/3 x f (B, x) λn ˜ O(√n)λn Define s(B) := 3 × [yellow area].

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 15 / 18

SLIDE 96

Summary

BPP

DGSs= ˜

O(√n)λn

∈ AM ∩ coAM

BPP

Probability-Verifiable ∈ AM ∩ coAM DGSs= ˜

O(√n)λn

is Probability-Verifiable BPPinvert size-vrf. OWF ∈ AM ∩ coAM

[Bogdanov-Brzuska’15]

Sample DGS given a small basis [BLPRS’13] gapSIVP ˜

O(√n)

∈ SZK [PV’08]

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 16 / 18

SLIDE 97

Next Impossibility Result?

SIVP unique SVP PIR gapSVP/gapSIVP additive HE Not NP-hard

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 17 / 18

SLIDE 98

Next Impossibility Result?

SIVP unique SVP PIR gapSVP/gapSIVP additive HE Not NP-hard SVP CRHF ? NP-hard

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 17 / 18

SLIDE 99

Thank you!

The slides can be found on liutianren.com.

Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 18 / 18