On Basing Search SIVP on NP-Hardness Tianren Liu MIT liutr@mit.edu - PowerPoint PPT Presentation

On Basing Search SIVP on NP-Hardness Tianren Liu MIT liutr@mit.edu Sixteenth IACR Theory of Cryptography Conference Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 1 / 18

Assumptions and Primitives in Cryptography Add-Homomorphic Enc Trapdoor PIR Permutation Pub-key Enc CRHF OWP OWF Avg-NP � BPP NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 2 / 18

Assumptions and Primitives in Cryptography Add-Homomorphic Enc Trapdoor PIR Permutation Pub-key Enc CRHF OWP OWF Avg-NP � BPP NP � BPP Can we prove the security of a cryptographic primitive from the minimal assumption NP � BPP ? (Brassard 1979) Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 2 / 18

(Black-box) Security Proofs To prove the security of X based on NP � BPP , find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X ”, R A solves SAT R Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 3 / 18

(Black-box) Security Proofs To prove the security of X based on NP � BPP , find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X ”, R A solves SAT A R Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 3 / 18

(Black-box) Security Proofs To prove the security of X based on NP � BPP , find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X ”, R A solves SAT A � � accepts w.p. ≥ 2 / 3 , if x ∈ SAT � x accepts w.p. ≤ 1 / 3 , if x / ∈ SAT R Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 3 / 18

Impossibility Results Add-Homomorphic Enc No known cryptographic scheme based on NP � BPP . Trapdoor PIR Several negative results* Permutation [Brassard’79, . . . ] Pub-key Enc CRHF OWP OWF Avg-NP � BPP NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

Impossibility Results Add-Homomorphic Enc Trapdoor PIR Permutation Pub-key Enc CRHF OWP One-way Permutations [Brassard’79] OWF Avg-NP � BPP NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

Impossibility Results Add-Homomorphic Enc Trapdoor PIR Permutation Pub-key Enc CRHF OWP One-way Permutations OWF ∗ [Brassard’79] OWF Size-Verifiable One-way Functions Avg-NP � BPP [Akavia-Goldreich-Goldwasser- Moshkovitz’06, NP � BPP Bogdanov-Brzuska’14] Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

Impossibility Results Add-Homomorphic Enc Add-Homomorphic Encryption [Bogdanov-Lee’13] Trapdoor PIR Permutation Pub-key Enc CRHF OWP One-way Permutations OWF ∗ [Brassard’79] OWF Size-Verifiable One-way Functions Avg-NP � BPP [Akavia-Goldreich-Goldwasser- Moshkovitz’06, NP � BPP Bogdanov-Brzuska’14] Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

Impossibility Results Add-Homomorphic Enc Add-Homomorphic Encryption [Bogdanov-Lee’13] Trapdoor PIR Permutation Private Information Retrieval [Liu-Vaikuntanathan’16] Pub-key Enc CRHF OWP One-way Permutations OWF ∗ [Brassard’79] OWF Size-Verifiable One-way Functions Avg-NP � BPP [Akavia-Goldreich-Goldwasser- Moshkovitz’06, NP � BPP Bogdanov-Brzuska’14] Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

Impossibility Results (restricting the reductions) Add-Homomorphic Enc Public-key Encryption Scheme, via “smart” reduction Trapdoor PIR [Goldreich-Goldwasser’98] Permutation Collision-resistant Hash Functions, Pub-key Enc CRHF OWP via constant-adaptive reduction [Haitner-Mahmoody-Xiao’09] OWF Average-case NP, via non-adaptive reduction Avg-NP � BPP [Bogdanov-Trevisan’06] NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 4 / 18

A New Hope Hardness of Add-Homomorphic Enc Lattice Problems Trapdoor PIR Permutation Pub-key Enc CRHF OWP OWF Avg-NP � BPP NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

A New Hope Hardness of Add-Homomorphic Enc A successful history of Lattice Problems lattice-based cryptography Trapdoor LWE PIR SIS [GGH’97, Regev’05, GPV’08, Permutation Gentry’09, BV’11, . . . ] Pub-key Enc CRHF OWP OWF Avg-NP � BPP NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

A New Hope gapSVP , gapSIVP � BPP Hardness of Add-Homomorphic Enc A successful history of SIVP � BPP Lattice Problems lattice-based cryptography Trapdoor LWE PIR SIS [GGH’97, Regev’05, GPV’08, Permutation Gentry’09, BV’11, . . . ] Pub-key Enc CRHF OWP Based on worst-case hardness of lattice problems OWF such as SIVP, gapSVP [Ajtai’96, MR’04, Regev’05, Avg-NP � BPP Peikert’09, LPR’10, MP’12, . . . ] NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

A New Hope gapSVP , gapSIVP � BPP Hardness of Add-Homomorphic Enc Impossibility Results [GG’00, SIVP � BPP Lattice Problems Trapdoor MV’03,AR’04,GMR’04,PV’08] LWE PIR SIS Permutation gapSVP ˜ O ( √ n ) , gapSIVP ˜ O ( √ n ) are not NP -hard unless Pub-key Enc CRHF OWP polynomial hierarchy collapses. OWF Avg-NP � BPP NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

A New Hope gapSVP , gapSIVP � BPP Hardness of Add-Homomorphic Enc Impossibility Results [GG’00, SIVP � BPP Lattice Problems Trapdoor MV’03,AR’04,GMR’04,PV’08] LWE PIR SIS Permutation gapSVP ˜ O ( √ n ) , gapSIVP ˜ O ( √ n ) are not NP -hard unless Pub-key Enc CRHF OWP polynomial hierarchy collapses. OWF Our Result Search problem SIVP ˜ O ( n ) is not Avg-NP � BPP NP -hard unless polynomial hierarchy collapses. NP � BPP Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 5 / 18

Lattice Full-rank discrete additive subgroup in R n Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Full-rank discrete additive subgroup in R n Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Full-rank discrete additive subgroup in R n Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice b ′ Full-rank discrete additive 1 subgroup in R n b ′ 2 Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Problems b ′ Full-rank discrete additive 1 subgroup in R n b ′ 2 Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Shortest Independent Vector Problem (SIVP) Search Find shortest basis in lattice L ( B ). Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Problems b ′ Full-rank discrete additive 1 subgroup in R n b ′ 2 Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Shortest Independent Vector Problem (SIVP) Search Find shortest basis in lattice L ( B ). Decision Given a real d , distinguish between λ n ( B ) ≤ d and λ n ( B ) > d . λ n ( B ) := length of the shortest basis in lattice L ( B ). Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Problems b ′ Full-rank discrete additive 1 subgroup in R n b ′ 2 Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Shortest Independent Vector Problem (SIVP), γ -Approx. Search Find shortest basis in lattice L ( B ). Decision Given a real d , distinguish between λ n ( B ) ≤ d and λ n ( B ) > d . λ n ( B ) := length of the shortest basis in lattice L ( B ). Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Problems b ′ Full-rank discrete additive 1 subgroup in R n b ′ 2 Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Shortest Independent Vector Problem (SIVP), γ -Approx. SIVP γ Find short basis whose length ≤ γ · λ n ( B ). Decision Given a real d , distinguish between λ n ( B ) ≤ d and λ n ( B ) > d . λ n ( B ) := length of the shortest basis in lattice L ( B ). Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Problems b ′ Full-rank discrete additive 1 subgroup in R n b ′ 2 Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Shortest Independent Vector Problem (SIVP), γ -Approx. SIVP γ Find short basis whose length ≤ γ · λ n ( B ). GapSIVP γ Given a real d , distinguish between λ n ( B ) ≤ d and λ n ( B ) > γ · d . λ n ( B ) := length of the shortest basis in lattice L ( B ). Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18

Lattice Problems b ′ Full-rank discrete additive 1 subgroup in R n b ′ 2 Basis B = ( b 1 , . . . , b n ) ∈ R n × n b 1 L ( B ) := { B z | z ∈ Z n } b 2 Shortest Vector Problem (SVP), γ -Approx. SVP γ Find short non-zero vector whose length ≤ γ · λ 1 ( B ). GapSVP γ Given a real d , distinguish between λ 1 ( B ) ≤ d and λ 1 ( B ) > γ · d . λ 1 ( B ) := length of the shortest non-zero vector in lattice L ( B ). Tianren LIU (MIT) Basing Search SIVP on NP-Hardness TCC 2018 6 / 18