[PPT] - Session #9: Trapdoors and Applications Chris Peikert Georgia PowerPoint Presentation

SLIDE 1

Session #9: Trapdoors and Applications Chris Peikert

Georgia Institute of Technology Winter School on Lattice-Based Cryptography and Applications Bar-Ilan University, Israel 19 Feb 2012 – 22 Feb 2012

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 1/19

SLIDE 2

Agenda

1 Lattices and short ‘trapdoor’ bases 2 Lattice-based ‘preimage sampleable’ functions 3 Applications: signatures, ID-based encryption (in RO model)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 2/19

SLIDE 3

Digital Signatures

(Images courtesy xkcd.org)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/19

SLIDE 4

Digital Signatures

(secret) (public)

(Images courtesy xkcd.org)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/19

SLIDE 5

Digital Signatures

(secret) (public) “I love you” ✔

(Images courtesy xkcd.org)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/19

SLIDE 6

Digital Signatures

(secret) (public) “It’s over” ✗

(Images courtesy xkcd.org)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/19

SLIDE 7

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 8

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ Trapdoor permutation [DH’76,RSA’77,. . . ] (PSF) D D x y f

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 9

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ Trapdoor permutation [DH’76,RSA’77,. . . ] (PSF) D D x y

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 10

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ Trapdoor permutation [DH’76,RSA’77,. . . ] (PSF) D D x y f−1

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 11

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ Trapdoor permutation [DH’76,RSA’77,. . . ] (PSF) D D x y f−1 ◮ ‘Hash and sign:’ pk = f, sk = f−1. Sign(msg) = f−1(H(msg)).

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 12

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ Trapdoor permutation [DH’76,RSA’77,. . . ] (PSF) D D x y f−1 ◮ ‘Hash and sign:’ pk = f, sk = f−1. Sign(msg) = f−1(H(msg)). ◮ Candidate TDPs: [RSA’78,Rabin’79,Paillier’99] (‘general assumption’) All rely on hardness of factoring:

✗ Complex: 2048-bit exponentiation ✗ Broken by quantum algorithms [Shor’97]

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 13

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ New twist [GPV’08]: preimage sampleable trapdoor function (PSF) D R x y f

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 14

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ New twist [GPV’08]: preimage sampleable trapdoor function (PSF) D R x y f

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 15

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ New twist [GPV’08]: preimage sampleable trapdoor function (PSF) D R x y f−1

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 16

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ New twist [GPV’08]: preimage sampleable trapdoor function (PSF) D R x y f−1 ◮ ‘Hash and sign:’ pk = f, sk = f−1. Sign(msg) = f−1(H(msg)).

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 17

Central Tool: Trapdoor Functions

◮ Public function f generated with secret ‘trapdoor’ f−1 ◮ New twist [GPV’08]: preimage sampleable trapdoor function (PSF) D R x y f−1 ◮ ‘Hash and sign:’ pk = f, sk = f−1. Sign(msg) = f−1(H(msg)). ◮ Still secure! Can generate (x, y) in two equivalent ways: REALITY PROOF R y x

f −1

D x y

f

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/19

SLIDE 18

Part 1: Constructing Preimage Sampleable Trapdoor Functions (PSFs)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 5/19

SLIDE 19

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S

s1 s2 b1 b2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 20

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 21

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 22

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 23

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 24

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 25

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 26

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 27

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

b1 b2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 28

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2 b1 b2

Technical Issues

1 Generating ‘hard’ lattice together with short basis (later)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 29

Heuristic TDF & Signature Scheme [GGH’96]

◮ Key idea: pk = ‘bad’ basis B for L, sk = ‘short’ trapdoor basis S ◮ Sign H(msg) ∈ Rn with “nearest-plane” algorithm [Babai’86]

s1 s2

Technical Issues

1 Generating ‘hard’ lattice together with short basis (later) 2 Signing algorithm leaks secret basis!

⋆ Total break after several signatures [NguyenRegev’06]

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/19

SLIDE 30

Blurring a Lattice

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 7/19

SLIDE 31

Blurring a Lattice

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 7/19

SLIDE 32

Blurring a Lattice

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 7/19

SLIDE 33

Blurring a Lattice

‘Uniform’ in Rn when std dev ≥ max length of some basis

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 7/19

SLIDE 34

Blurring a Lattice

Gaussian mod L is uniform when std dev ≥ max length of some basis

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 7/19

SLIDE 35

Blurring a Lattice

Gaussian mod L is uniform when std dev ≥ max length of some basis ◮ First used in worst/average-case reductions [Regev’03,MR’04,. . . ]

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 7/19

SLIDE 36

Blurring a Lattice

Gaussian mod L is uniform when std dev ≥ max length of some basis ◮ First used in worst/average-case reductions [Regev’03,MR’04,. . . ] ◮ Now an essential ingredient in many crypto schemes [GPV’08,. . . ]

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 7/19

SLIDE 37

Preimage Sampleable TDF: Evaluation

f

◮ ‘Hard’ description of L specifies f. Concretely: SIS matrix A defines fA.

O (0, q) (q, 0)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 8/19

SLIDE 38

Preimage Sampleable TDF: Evaluation

f

◮ ‘Hard’ description of L specifies f. Concretely: SIS matrix A defines fA. ◮ f(x) = x mod L for Gaussian x. Concretely: fA(x) = Ax = u ∈ Zn

q .

O (0, q) (q, 0) x

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 8/19

SLIDE 39

Preimage Sampleable TDF: Evaluation

f

◮ ‘Hard’ description of L specifies f. Concretely: SIS matrix A defines fA. ◮ f(x) = x mod L for Gaussian x. Concretely: fA(x) = Ax = u ∈ Zn

q .

◮ Inverting ⇔ decoding syndrome u ⇔ solving SIS.

O (0, q) (q, 0) x

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 8/19

SLIDE 40

Preimage Sampleable TDF: Evaluation

f

◮ ‘Hard’ description of L specifies f. Concretely: SIS matrix A defines fA. ◮ f(x) = x mod L for Gaussian x. Concretely: fA(x) = Ax = u ∈ Zn

q .

◮ Inverting ⇔ decoding syndrome u ⇔ solving SIS.

O (0, q) (q, 0) x

◮ Given u, conditional distrib. of x is the discrete Gaussian DLu.

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 8/19

SLIDE 41

Preimage Sampling: Method #1

f −1

◮ Sample DLu given any ‘short enough’ basis S: maxsi ≤ std dev

⋆ Unlike [GGH’96], output distribution leaks no information about S !

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 9/19

SLIDE 42

Preimage Sampling: Method #1

f −1

◮ Sample DLu given any ‘short enough’ basis S: maxsi ≤ std dev

⋆ Unlike [GGH’96], output distribution leaks no information about S !

◮ “Nearest-plane” algorithm with randomized rounding [Klein’00,GPV’08]

coset Lu

s1 s2 O

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 9/19

SLIDE 43

Preimage Sampling: Method #1

f −1

◮ Sample DLu given any ‘short enough’ basis S: maxsi ≤ std dev

⋆ Unlike [GGH’96], output distribution leaks no information about S !

◮ “Nearest-plane” algorithm with randomized rounding [Klein’00,GPV’08]

coset Lu

s1 s2 O

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 9/19

SLIDE 44

Preimage Sampling: Method #1

f −1

◮ Sample DLu given any ‘short enough’ basis S: maxsi ≤ std dev

⋆ Unlike [GGH’96], output distribution leaks no information about S !

◮ “Nearest-plane” algorithm with randomized rounding [Klein’00,GPV’08]

coset Lu

s1 s2 O

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 9/19

SLIDE 45

Preimage Sampling: Method #1

f −1

◮ Sample DLu given any ‘short enough’ basis S: maxsi ≤ std dev

⋆ Unlike [GGH’96], output distribution leaks no information about S !

◮ “Nearest-plane” algorithm with randomized rounding [Klein’00,GPV’08]

coset Lu

s1 s2 O x

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 9/19

SLIDE 46

Preimage Sampling: Method #1

f −1

◮ Sample DLu given any ‘short enough’ basis S: maxsi ≤ std dev

⋆ Unlike [GGH’96], output distribution leaks no information about S !

◮ “Nearest-plane” algorithm with randomized rounding [Klein’00,GPV’08]

coset Lu

s1 s2 O x

◮ Proof idea: DLu(plane) depends only on dist(0, plane); not affected by shift within plane

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 9/19

SLIDE 47

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 48

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes ✗ Not efficient: runtime = Ω(n3), high-precision arithmetic

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 49

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes ✗ Not efficient: runtime = Ω(n3), high-precision arithmetic ✗ Inherently sequential: n adaptive iterations

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 50

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes ✗ Not efficient: runtime = Ω(n3), high-precision arithmetic ✗ Inherently sequential: n adaptive iterations ✗ No efficiency improvement in the ring setting [NTRU’98,M’02,. . . ]

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 51

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes ✗ Not efficient: runtime = Ω(n3), high-precision arithmetic ✗ Inherently sequential: n adaptive iterations ✗ No efficiency improvement in the ring setting [NTRU’98,M’02,. . . ]

A Different Sampling Algorithm [P’10]

◮ Simple & efficient: n2 online adds and mults (mod q)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 52

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes ✗ Not efficient: runtime = Ω(n3), high-precision arithmetic ✗ Inherently sequential: n adaptive iterations ✗ No efficiency improvement in the ring setting [NTRU’98,M’02,. . . ]

A Different Sampling Algorithm [P’10]

◮ Simple & efficient: n2 online adds and mults (mod q) Even better: ˜ O(n) time in the ring setting

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 53

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes ✗ Not efficient: runtime = Ω(n3), high-precision arithmetic ✗ Inherently sequential: n adaptive iterations ✗ No efficiency improvement in the ring setting [NTRU’98,M’02,. . . ]

A Different Sampling Algorithm [P’10]

◮ Simple & efficient: n2 online adds and mults (mod q) Even better: ˜ O(n) time in the ring setting ◮ Fully parallel: n2/P operations on any P ≤ n2 processors

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 54

Performance of Nearest-Plane Method?

Good News, and Bad News. . .

✔ Tight: std dev ≈ max˜ si = max dist between adjacent planes ✗ Not efficient: runtime = Ω(n3), high-precision arithmetic ✗ Inherently sequential: n adaptive iterations ✗ No efficiency improvement in the ring setting [NTRU’98,M’02,. . . ]

A Different Sampling Algorithm [P’10]

◮ Simple & efficient: n2 online adds and mults (mod q) Even better: ˜ O(n) time in the ring setting ◮ Fully parallel: n2/P operations on any P ≤ n2 processors ◮ High quality: same∗ Gaussian std dev as nearest-plane alg

∗in cryptographic applications

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 10/19

SLIDE 55

A First Attempt

◮ [Babai’86] ‘simple rounding:’ c → S · frac(S−1 · c) . (Fast & parallel!)

s1 s2 O

coset L + c

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 11/19

SLIDE 56

A First Attempt

◮ [Babai’86] ‘simple rounding:’ c → S · frac(S−1 · c) . (Fast & parallel!) ◮ Deterministic rounding is insecure [NR’06] . . .

s1 s2 O

coset L + c

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 11/19

SLIDE 57

A First Attempt

◮ [Babai’86] ‘simple rounding:’ c → S · frac(S−1 · c)$. (Fast & parallel!) ◮ Deterministic rounding is insecure [NR’06] . . . . . . but what about randomized rounding?

s1 s2 O

coset L + c

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 11/19

SLIDE 58

A First Attempt

◮ [Babai’86] ‘simple rounding:’ c → S · frac(S−1 · c)$. (Fast & parallel!) ◮ Deterministic rounding is insecure [NR’06] . . . . . . but what about randomized rounding?

s1 s2 O

coset L + c

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 11/19

SLIDE 59

A First Attempt

◮ [Babai’86] ‘simple rounding:’ c → S · frac(S−1 · c)$. (Fast & parallel!) ◮ Deterministic rounding is insecure [NR’06] . . . . . . but what about randomized rounding?

s1 s2 O

coset L + c

◮ Non-spherical discrete Gaussian: has covariance Σ := Ex

x · xt

≈ S · St.

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 11/19

SLIDE 60

A First Attempt

◮ [Babai’86] ‘simple rounding:’ c → S · frac(S−1 · c)$. (Fast & parallel!) ◮ Deterministic rounding is insecure [NR’06] . . . . . . but what about randomized rounding?

s1 s2 O

coset L + c

◮ Non-spherical discrete Gaussian: has covariance Σ := Ex

x · xt

≈ S · St. Covariance can be measured — and it leaks S! (up to rotation)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 11/19

SLIDE 61

Inspiration: Some Facts About Gaussians

1 Continuous Gaussian ↔ positive definite covariance matrix Σ.

(pos def means: ut Σ u > 0 for all unit u.)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 12/19

SLIDE 62

Inspiration: Some Facts About Gaussians

1 Continuous Gaussian ↔ positive definite covariance matrix Σ.

(pos def means: ut Σ u > 0 for all unit u.)

Spherical Gaussian ↔ covariance s2 I.

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 12/19

SLIDE 63

Inspiration: Some Facts About Gaussians

1 Continuous Gaussian ↔ positive definite covariance matrix Σ.

(pos def means: ut Σ u > 0 for all unit u.)

Spherical Gaussian ↔ covariance s2 I.

2 Convolution of Gaussians:

+ = Σ1 + Σ2 = Σ = s2 I

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 12/19

SLIDE 64

Inspiration: Some Facts About Gaussians

1 Continuous Gaussian ↔ positive definite covariance matrix Σ.

(pos def means: ut Σ u > 0 for all unit u.)

Spherical Gaussian ↔ covariance s2 I.

2 Convolution of Gaussians:

+ = Σ1 + Σ2 = Σ = s2 I

3 Given Σ1, how small can s be? For Σ2 := s2 I − Σ1,

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 12/19

SLIDE 65

Inspiration: Some Facts About Gaussians

1 Continuous Gaussian ↔ positive definite covariance matrix Σ.

(pos def means: ut Σ u > 0 for all unit u.)

Spherical Gaussian ↔ covariance s2 I.

2 Convolution of Gaussians:

+ = Σ1 + Σ2 = Σ = s2 I

3 Given Σ1, how small can s be? For Σ2 := s2 I − Σ1,

ut Σ2 u = s2 − ut Σ1 u > 0 ⇐ ⇒ s2 > max λi(Σ1)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 12/19

SLIDE 66

Inspiration: Some Facts About Gaussians

1 Continuous Gaussian ↔ positive definite covariance matrix Σ.

(pos def means: ut Σ u > 0 for all unit u.)

Spherical Gaussian ↔ covariance s2 I.

2 Convolution of Gaussians:

+ = Σ1 + Σ2 = Σ = s2 I

3 Given Σ1, how small can s be? For Σ2 := s2 I − Σ1,

ut Σ2 u = s2 − ut Σ1 u > 0 ⇐ ⇒ s2 > max λi(Σ1) For Σ1 = S St, can use any s > s1(S) := max singular val of S.

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 12/19

SLIDE 67

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S), Σ1 = S St

s1 s2

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 68

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S),

1 Generate perturbation p with covariance Σ2 := s2 I − Σ1 > 0

Σ1 = S St Σ2

s1 s2 p

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 69

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S),

1 Generate perturbation p with covariance Σ2 := s2 I − Σ1 > 0 2 Randomly simple-round p to L + c

Σ1 = S St Σ2

s1 s2 p

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 70

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S),

1 Generate perturbation p with covariance Σ2 := s2 I − Σ1 > 0 2 Randomly simple-round p to L + c

Σ1 = S St Σ2

s1 s2 p

Convolution∗ Theorem

Algorithm generates a spherical discrete Gaussian over L + c.

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 71

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S),

1 Generate perturbation p with covariance Σ2 := s2 I − Σ1 > 0 2 Randomly simple-round p to L + c

Σ1 = S St Σ2

s1 s2 p

Convolution∗ Theorem

Algorithm generates a spherical discrete Gaussian over L + c.

(∗technically not a convolution, since step 2 depends on step 1.)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 72

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S),

1 Generate perturbation p with covariance Σ2 := s2 I − Σ1 > 0 2 Randomly simple-round p to L + c

Σ1 = S St Σ2

s1 s2 p

Optimizations

1 Precompute perturbations offline

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 73

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S),

1 Generate perturbation p with covariance Σ2 := s2 I − Σ1 > 0 2 Randomly simple-round p to L + c

Σ1 = S St Σ2

s1 s2 p

Optimizations

1 Precompute perturbations offline 2 Batch multi-sample using fast matrix multiplication

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 74

‘Convolution’ Sampling Algorithm [P’10]

◮ Given basis S, coset L + c, and std dev s > s1(S),

1 Generate perturbation p with covariance Σ2 := s2 I − Σ1 > 0 2 Randomly simple-round p to L + c

Σ1 = S St Σ2

s1 s2 p

Optimizations

1 Precompute perturbations offline 2 Batch multi-sample using fast matrix multiplication 3 More tricks & simplifications for SIS lattices (next talk)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 13/19

SLIDE 75

Part 2: Identity-Based Encryption

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 14/19

SLIDE 76

Identity-Based Encryption

◮ Proposed by [Shamir’84]: could this exist? mpk (msk)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 15/19

SLIDE 77

Identity-Based Encryption

◮ Proposed by [Shamir’84]: could this exist? mpk (msk)

skAlice skBobbi s k

Carol

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 15/19

SLIDE 78

Identity-Based Encryption

◮ Proposed by [Shamir’84]: could this exist? mpk (msk) Enc(mpk, “Alice”, msg)

skAlice skBobbi s k

Carol

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 15/19

SLIDE 79

Identity-Based Encryption

◮ Proposed by [Shamir’84]: could this exist? mpk (msk) ?? ?? Enc(mpk, “Alice”, msg)

skAlice skBobbi s k

Carol

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 15/19

SLIDE 80

Fast-Forward 17 Years. . .

1 [BonehFranklin’01,. . . ]: first IBE construction, using “new math”

(elliptic curves w/ bilinear pairings)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 16/19

SLIDE 81

Fast-Forward 17 Years. . .

1 [BonehFranklin’01,. . . ]: first IBE construction, using “new math”

(elliptic curves w/ bilinear pairings)

2 [Cocks’01,BGH’07]: quadratic residuosity mod N = pq [GM’82]

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 16/19

SLIDE 82

Fast-Forward 17 Years. . .

1 [BonehFranklin’01,. . . ]: first IBE construction, using “new math”

(elliptic curves w/ bilinear pairings)

2 [Cocks’01,BGH’07]: quadratic residuosity mod N = pq [GM’82] 3 [GPV’08]: lattices!

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 16/19

SLIDE 83

Recall: ‘Dual’ LWE Cryptosystem

A x ← Gauss

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 17/19

SLIDE 84

Recall: ‘Dual’ LWE Cryptosystem

A x ← Gauss u = Ax = fA(x)

(public key)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 17/19

SLIDE 85

Recall: ‘Dual’ LWE Cryptosystem

A x ← Gauss s, e u = Ax = fA(x)

(public key)

bt = stA + et

(ciphertext ‘preamble’)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 17/19

SLIDE 86

Recall: ‘Dual’ LWE Cryptosystem

A x ← Gauss s, e u = Ax = fA(x)

(public key)

bt = stA + et

(ciphertext ‘preamble’)

b′ = st u + e′ + bit · q

2

(‘payload’)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 17/19

SLIDE 87

Recall: ‘Dual’ LWE Cryptosystem

A x ← Gauss s, e u = Ax = fA(x)

(public key)

bt = stA + et

(ciphertext ‘preamble’)

b′ −bt x ≈ bit· q

2

b′ = st u + e′ + bit · q

2

(‘payload’)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 17/19

SLIDE 88

Recall: ‘Dual’ LWE Cryptosystem

A x ← Gauss s, e u = Ax = fA(x)

(public key)

bt = stA + et

(ciphertext ‘preamble’)

b′ −bt x ≈ bit· q

2

b′ = st u + e′ + bit · q

2

(‘payload’)

? (A, u, b, b′)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 17/19

SLIDE 89

Recall: ‘Dual’ LWE Cryptosystem

A x ← Gauss s, e u = Ax = fA(x)

(public key)

bt = stA + et

(ciphertext ‘preamble’)

b′ −bt x ≈ bit· q

2

b′ = st u + e′ + bit · q

2

(‘payload’)

? (A, u, b, b′)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 17/19

SLIDE 90

ID-Based Encryption

mpk = A s, e u = H(“Alice”)

(‘identity’ public key)

b = stA + et

(ciphertext preamble)

b′ − bt x ≈ bit · q

2

b′ = st u + e′ + bit · q

2

(‘payload’)

x ← f−1

A (u)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 18/19

SLIDE 91

When We Come Back. . .

◮ Generating trapdoors (A with short basis)

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 19/19

SLIDE 92

When We Come Back. . .

◮ Generating trapdoors (A with short basis) ◮ Removing the random oracle from signatures & IBE

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 19/19

SLIDE 93

When We Come Back. . .

◮ Generating trapdoors (A with short basis) ◮ Removing the random oracle from signatures & IBE ◮ More surprising applications

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 19/19

SLIDE 94

When We Come Back. . .

◮ Generating trapdoors (A with short basis) ◮ Removing the random oracle from signatures & IBE ◮ More surprising applications Selected bibliography for this talk:

MR’04 D. Micciancio and O. Regev, “Worst-Case to Average-Case Reductions Based on Gaussian Measures,” FOCS’04 / SICOMP’07. GPV’08 C. Gentry, C. Peikert, V. Vaikuntanathan, “Trapdoors for Hard Lattices and New Cryptographic Constructions,” STOC’08. P’10 C. Peikert, “An Efficient and Parallel Gaussian Sampler for Lattices,” Crypto’10.

Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 19/19