[PPT] - On Error Correction in the Exponent Chris Peikert MIT Computer PowerPoint Presentation

SLIDE 1

On Error Correction in the Exponent

Chris Peikert

MIT Computer Science and AI Laboratory

Theory of Cryptography Conference 5 March 2006

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 1 / 9

SLIDE 2

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd. P1 P2 P3 P4 P5 P6 P7

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 3

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Reconstruction

Pi announces xi.

P1 P2 P3 P4 P5 P6 P7 x1

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 4

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Reconstruction

Pi announces xi.

P1 P2 P3 P4 P5 P6 P7 x2

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 5

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Reconstruction

Pi announces xi.

Interpolation: p(α) = xiλi for any α. P1 P2 P3 P4 P5 P6 P7 xi

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 6

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Reconstruction

Pi announces xi.

Interpolation: p(α) = xiλi for any α. Error correction: [BeWe86, GuSu98] P1 P2 P3 P4 P5 P6 P7 P4 P7

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 7

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Placing Shares “in the Exponent”

[CJKR96, PK96, RG03, NPR99, D03, CD04, CG99, BF99,. . . ]

Cyclic group G = g, order q

Pi announces gxi.

P1 P2 P3 P4 P5 P6 P7 gx1

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 8

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Placing Shares “in the Exponent”

[CJKR96, PK96, RG03, NPR99, D03, CD04, CG99, BF99,. . . ]

Cyclic group G = g, order q

Pi announces gxi.

P1 P2 P3 P4 P5 P6 P7 gx2

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 9

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Placing Shares “in the Exponent”

[CJKR96, PK96, RG03, NPR99, D03, CD04, CG99, BF99,. . . ]

Cyclic group G = g, order q

Pi announces gxi.

Interpolation: gp(α) =

(gxi)λi

P1 P2 P3 P4 P5 P6 P7 gxi

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 10

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Placing Shares “in the Exponent”

[CJKR96, PK96, RG03, NPR99, D03, CD04, CG99, BF99,. . . ]

Cyclic group G = g, order q

Pi announces gxi.

Interpolation: gp(α) =

(gxi)λi

P1 P2 P3 P4 P5 P6 P7 P4 P7 ✔

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 11

Error Correction (in the Exponent)

Sharing Secrets (mod q)

Random p(·),

deg(p) < k, s.t. p(0) = secret.

Pi gets share xi = p(i).

(x1, . . . , xn) is Reed-Solomon codewd.

Placing Shares “in the Exponent”

[CJKR96, PK96, RG03, NPR99, D03, CD04, CG99, BF99,. . . ]

Cyclic group G = g, order q

Pi announces gxi.

Interpolation: gp(α) =

(gxi)λi

ERROR CORRECTION: ???

Guess-and-check: n log n

k

errors P1 P2 P3 P4 P5 P6 P7 P4 P7 g ?

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 2 / 9

SLIDE 12

Our Contributions

☞ The first detailed study of the complexity of ECE.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 3 / 9

SLIDE 13

Our Contributions

☞ The first detailed study of the complexity of ECE.

Unconditional Results

Errors Complexity n − √ nk EASY AS DH n − k − k1−ǫ HARD AS DLOG

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 3 / 9

SLIDE 14

Our Contributions

☞ The first detailed study of the complexity of ECE.

Unconditional Results

Errors Complexity Gap ≈ δ · k n − √ nk EASY AS DH n − k − k1−ǫ HARD AS DLOG

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 3 / 9

SLIDE 15

Our Contributions

☞ The first detailed study of the complexity of ECE.

Unconditional Results

Errors Complexity Gap ≈ δ · k n − √ nk EASY AS DH link DH to DLOG? n − k − k1−ǫ HARD AS DLOG

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 3 / 9

SLIDE 16

Our Contributions

☞ The first detailed study of the complexity of ECE.

Unconditional Results

Errors Complexity Gap ≈ δ · k n − √ nk EASY AS DH link DH to DLOG? n − k − k1−ǫ HARD AS DLOG

Results for Generic Algorithms

Guess-and-check is optimal — even if DDH is easy.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 3 / 9

SLIDE 17

Our Contributions

☞ The first detailed study of the complexity of ECE.

Unconditional Results

Errors Complexity Gap ≈ δ · k n − √ nk EASY AS DH link DH to DLOG? n − k − k1−ǫ HARD AS DLOG

Results for Generic Algorithms

Guess-and-check is optimal — even if DDH is easy.

Evidence for: DDH ECE DH < ≤ A new approach for: DDH ECE DLOG DH < = = =

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 3 / 9

SLIDE 18

Relation to Discrete Log

Theorem

Decoding (in the exponent) to distance n − k − k1−ǫ is as hard as computing discrete logs in G.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 4 / 9

SLIDE 19

Relation to Discrete Log

Theorem

Decoding (in the exponent) to distance n − k − k1−ǫ is as hard as computing discrete logs in G.

Proof Sketch

1 Finding a representation on uniform w ∈ Gn is as hard as dlog. 2 Uniform w is close (in the exponent) to some codeword. 3 Decoding w yields a representation on w.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 4 / 9

SLIDE 20

Relation to Discrete Log

Theorem

Decoding (in the exponent) to distance n − k − k1−ǫ is as hard as computing discrete logs in G.

Proof Sketch

1 Finding a representation on uniform w ∈ Gn is as hard as dlog. 2 Uniform w is close (in the exponent) to some codeword. 3 Decoding w yields a representation on w.

Representation on w: nonzero a = (a1, . . . , an) ∈ Zn

q s.t.

i

wai

i = 1.

[Bra93] showed hardness.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 4 / 9

SLIDE 21

Relation to Discrete Log

Theorem

Decoding (in the exponent) to distance n − k − k1−ǫ is as hard as computing discrete logs in G.

Proof Sketch

1 Finding a representation on uniform w ∈ Gn is as hard as dlog. 2 Uniform w is close (in the exponent) to some codeword. 3 Decoding w yields a representation on w.

We show ∃ ℓ = k + k1−ǫ points wi = gxi, with xi on poly of deg < k.

There are

n

ℓ

distinct events (each very rare).
These events have limited dependence.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 4 / 9

SLIDE 22

Relation to Discrete Log

Theorem

Decoding (in the exponent) to distance n − k − k1−ǫ is as hard as computing discrete logs in G.

Proof Sketch

1 Finding a representation on uniform w ∈ Gn is as hard as dlog. 2 Uniform w is close (in the exponent) to some codeword. 3 Decoding w yields a representation on w.

We show ∃ ℓ = k + k1−ǫ points wi = gxi, with xi on poly of deg < k.

There are

n

ℓ

distinct events (each very rare).
These events have limited dependence.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 4 / 9

SLIDE 23

Relation to Discrete Log

Theorem

Decoding (in the exponent) to distance n − k − k1−ǫ is as hard as computing discrete logs in G.

Proof Sketch

1 Finding a representation on uniform w ∈ Gn is as hard as dlog. 2 Uniform w is close (in the exponent) to some codeword. 3 Decoding w yields a representation on w.

Decode w to (gx1, . . . , gxn), where xi lie on poly of deg < k.
There are ≫ k points wi = gxi. wlog: w1, . . . , wk+1.
Interpolate in the exponent:

wk+1 =

k

i=1

wλi

i

⇒ representation!

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 4 / 9

SLIDE 24

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 25

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)]

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 26

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 27

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 28

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg σ(x2) x2 = x0 + x1

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 29

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg σ(x2)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 30

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg σ(x2) σ(x3) x3 = x0 + x2

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 31

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg σ(x2) σ(x3) σ(x4)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 32

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg σ(x2) σ(x3) σ(x4) σ(x5)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 33

Generic Algorithms [Sho97]

Intuition

Treat group as “black-box” — don’t use element representations

Formalization

Random encoding σ : G → {0, 1}∗
Oracle for group operation

[wlog G = (Zq, +)] · · · σ(x0) σ(x1) Alg σ(x2) σ(x3) σ(x4) σ(x5) 0/1, σ(x), . . .

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 5 / 9

SLIDE 34

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 35

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 36

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms. Guess-and-check is optimal!

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 37

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Ideal Game

Leave p and e as indeterminants; encode polynomials F(p, e)

· · · · · · σ(F1) σ(Fn) Alg

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 38

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Ideal Game

Leave p and e as indeterminants; encode polynomials F(p, e)

· · · · · · σ(F1) σ(Fn) Alg

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 39

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Ideal Game

Leave p and e as indeterminants; encode polynomials F(p, e)

· · · · · · σ(F1) σ(Fn) Alg σ(Fn+1) Fn+1 = Fi + Fj

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 40

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Ideal Game

Leave p and e as indeterminants; encode polynomials F(p, e)

· · · · · · σ(F1) σ(Fn) Alg σ(Fn+1) σ(Fn+2)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 41

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Ideal Game

Leave p and e as indeterminants; encode polynomials F(p, e)

· · · · · · σ(F1) σ(Fn) Alg σ(Fn+1) σ(Fn+2) σ(Fn+3)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 42

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Ideal Game

Leave p and e as indeterminants; encode polynomials F(p, e)

· · · · · · σ(F1) σ(Fn) Alg σ(Fn+1) σ(Fn+2) σ(Fn+3) = σ(F0)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 43

Generic Interpolation with Errors

☞ Interpolation w/ Errors: (p(1), . . . , p(n)) + e − → p(0)

Theorem

Interpolation under ≫ n log n

k

errors is hard for generic algorithms.

Ideal Game

Leave p and e as indeterminants; encode polynomials F(p, e)

· · · · · · σ(F1) σ(Fn) Alg σ(Fn+1) σ(Fn+2) σ(Fn+3) = σ(F0)

Differs from real game only if ∃ Fi ≡ Fj, but (Fi − Fj)(p, e) = 0.

Analyze event for “strange” distribution of p, e.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 6 / 9

SLIDE 44

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 45

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Sketch

1 F is linear in p, e (because inputs F1, . . . , Fn are).

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 46

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Sketch

1 F is linear in p, e (because inputs F1, . . . , Fn are). 2 e variables in e are uniform (others are zero).

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 47

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Sketch

1 F is linear in p, e (because inputs F1, . . . , Fn are). 2 e variables in e are uniform (others are zero). 3 F depends on some uniform variable (either in p or e).

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 48

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Sketch

1 F is linear in p, e (because inputs F1, . . . , Fn are). 2 e variables in e are uniform (others are zero). 3 F depends on some uniform variable (either in p or e).

Suppose F doesn’t depend on any variables in p.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 49

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Sketch

1 F is linear in p, e (because inputs F1, . . . , Fn are). 2 e variables in e are uniform (others are zero). 3 F depends on some uniform variable (either in p or e).

Suppose F doesn’t depend on any variables in p. Then F depends on ≥ n − k positions of e. (Dual of Reed-Solomon code.)

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 50

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Sketch

1 F is linear in p, e (because inputs F1, . . . , Fn are). 2 e variables in e are uniform (others are zero). 3 F depends on some uniform variable (either in p or e).

Suppose F doesn’t depend on any variables in p. Then F depends on ≥ n − k positions of e. (Dual of Reed-Solomon code.) With overwhelming prob, F depends on some uniform ei.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 51

Analysis of Ideal Game

To Show

For all F = Fi − Fj ≡ 0, Pr[F(p, e) = 0] is small.

Sketch

1 F is linear in p, e (because inputs F1, . . . , Fn are). 2 e variables in e are uniform (others are zero). 3 F depends on some uniform variable (either in p or e).

Suppose F doesn’t depend on any variables in p. Then F depends on ≥ n − k positions of e. (Dual of Reed-Solomon code.) With overwhelming prob, F depends on some uniform ei.

4 By Schwartz’s Lemma, Pr[F(p, e) = 0] small.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 7 / 9

SLIDE 52

Relation to Decisional DH

Question

Recall: error correction is easy, given DH oracle.
What about DDH?

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 8 / 9

SLIDE 53

Relation to Decisional DH

Question

Recall: error correction is easy, given DH oracle.
What about DDH?

Our Proposal

Augment generic algorithms with a DDH oracle. Models “gap” groups: DDH is easy, but DH believed hard.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 8 / 9

SLIDE 54

Relation to Decisional DH

Question

Recall: error correction is easy, given DH oracle.
What about DDH?

Our Proposal

Augment generic algorithms with a DDH oracle. Models “gap” groups: DDH is easy, but DH believed hard.

Theorem

For e · k = ω(n log n), there is no efficient DDH-augmented generic algorithm for interpolating noisy polynomials.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 8 / 9

SLIDE 55

Relation to Decisional DH

Question

Recall: error correction is easy, given DH oracle.
What about DDH?

Our Proposal

Augment generic algorithms with a DDH oracle. Models “gap” groups: DDH is easy, but DH believed hard.

Theorem

For e · k = ω(n log n), there is no efficient DDH-augmented generic algorithm for interpolating noisy polynomials. ☞ Converse does not appear to hold. I.e., error correction seems strictly harder than DDH.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 8 / 9

SLIDE 56

Conclusions and Open Problems

Conclusions

Characterized hardness of ECE for a spectrum of errors.
Given evidence for DDH < ECE.
Suggested a new approach for linking DH and DLOG.

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 9 / 9

SLIDE 57

Conclusions and Open Problems

Conclusions

Characterized hardness of ECE for a spectrum of errors.
Given evidence for DDH < ECE.
Suggested a new approach for linking DH and DLOG.

Questions

Construct crypto schemes based on hardness of ECE?
Tighten gap between # errors for DLOG and DH reductions?
Non-generic ECE algorithms (index calculus)?

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 9 / 9

SLIDE 58

Conclusions and Open Problems

Conclusions

Characterized hardness of ECE for a spectrum of errors.
Given evidence for DDH < ECE.
Suggested a new approach for linking DH and DLOG.

Questions

Construct crypto schemes based on hardness of ECE?
Tighten gap between # errors for DLOG and DH reductions?
Non-generic ECE algorithms (index calculus)?

Thank you!

Chris Peikert (MIT) On Error Correction in the Exponent TCC 2006 9 / 9