Short generators without quantum computers: the case of - - PowerPoint PPT Presentation

▶
short generators without quantum computers the case of
SMART_READER_LITE
LIVE PREVIEW

Short generators without quantum computers: the case of - - PowerPoint PPT Presentation

Feb 10, 2024 21 likes •465 views

Short generators without quantum computers: the case of multiquadratics Christine van Vredendaal Technische Universiteit Eindhoven 1 May 2017 Joint work with: Jens Bauch & Daniel J. Bernstein & Henry de Valence & Tanja Lange

slide-1
SLIDE 1

Short generators without quantum computers: the case of multiquadratics

Christine van Vredendaal

Technische Universiteit Eindhoven

1 May 2017

Joint work with: Jens Bauch & Daniel J. Bernstein & Henry de Valence & Tanja Lange

Christine van Vredendaal multiquad 1

slide-2
SLIDE 2

Part I: Introduction

Christine van Vredendaal multiquad 2

slide-3
SLIDE 3

“Lattice-based crypto is secure because lattice problems are hard.” — Everyone who works on lattice-based crypto

Christine van Vredendaal multiquad 3

slide-4
SLIDE 4

“Lattice-based crypto is secure because lattice problems are hard.” — Everyone who works on lattice-based crypto Really? How hard are they? Which cryptosystems are secure?

Christine van Vredendaal multiquad 3

slide-5
SLIDE 5

How secure?

Multiple attack avenues showing progress Sieving asymptotics for dimension-N SVP

◮ 2008 Nguyen–Vidick: 2(0.415+o(1))N ◮ 2015 Becker–Ducas–Gama–Laarhoven: 2(0.292+o(1))N ◮ 2014 Laarhoven–Mosca–van de Pol: Quantumly 2(0.268+o(1))N Christine van Vredendaal multiquad 4

slide-6
SLIDE 6

How secure?

Multiple attack avenues showing progress Sieving asymptotics for dimension-N SVP

◮ 2008 Nguyen–Vidick: 2(0.415+o(1))N ◮ 2015 Becker–Ducas–Gama–Laarhoven: 2(0.292+o(1))N ◮ 2014 Laarhoven–Mosca–van de Pol: Quantumly 2(0.268+o(1))N

Pre-quantum attacks against cyclotomic ideal lattice problems

◮ 2017 Biasse–Espitau–Fouque–G´

elin–Kirchner: L|∆|(1/2) (see next talk)

Christine van Vredendaal multiquad 4

slide-7
SLIDE 7

How secure?

Multiple attack avenues showing progress Sieving asymptotics for dimension-N SVP

◮ 2008 Nguyen–Vidick: 2(0.415+o(1))N ◮ 2015 Becker–Ducas–Gama–Laarhoven: 2(0.292+o(1))N ◮ 2014 Laarhoven–Mosca–van de Pol: Quantumly 2(0.268+o(1))N

Pre-quantum attacks against cyclotomic ideal lattice problems

◮ 2017 Biasse–Espitau–Fouque–G´

elin–Kirchner: L|∆|(1/2) (see next talk)

Quantum attacks against cyclotomic ideal lattice problems

◮ 2015 Biasse–Song (using 2014 Campbell–Groves–Shepherd): poly-time

quantum algorithm against short generators

◮ 2016 Cramer–Ducas–Peikert–Regev: general analysis for arbitrary

principal ideals (within an e ˜

O(n1/2) approximation factor)

◮ 2016 Cramer–Ducas–Wesolowski: generalize to any ideal Christine van Vredendaal multiquad 4

slide-8
SLIDE 8

Non-cyclotomic lattice-based cryptography

Cyclotomics are scary. Let’s explore alternatives: Eliminate the ideal structure. e.g., use LWE instead of Ring-LWE. But this limits the security achievable for key size K.

Christine van Vredendaal multiquad 5

slide-9
SLIDE 9

Non-cyclotomic lattice-based cryptography

Cyclotomics are scary. Let’s explore alternatives: Eliminate the ideal structure. e.g., use LWE instead of Ring-LWE. But this limits the security achievable for key size K. 2016 Bernstein–Chuengsatiansup–Lange–van Vredendaal “NTRU Prime”: eliminate unnecessary ring morphisms. Use prime degree, large Galois group: e.g., xp − x − 1.

Christine van Vredendaal multiquad 5

slide-10
SLIDE 10

Non-cyclotomic lattice-based cryptography

Cyclotomics are scary. Let’s explore alternatives: Eliminate the ideal structure. e.g., use LWE instead of Ring-LWE. But this limits the security achievable for key size K. 2016 Bernstein–Chuengsatiansup–Lange–van Vredendaal “NTRU Prime”: eliminate unnecessary ring morphisms. Use prime degree, large Galois group: e.g., xp − x − 1. This talk: Switch from cyclotomics to other Galois number fields. Another popular example in algebraic-number-theory textbooks: multiquadratics; e.g., Q( √ 2, √ 3, √ 5, √ 7, √ 11, √ 13, √ 17, √ 19, √ 23).

Christine van Vredendaal multiquad 5

slide-11
SLIDE 11

A reasonable multiquadratic cryptosystem

Case study of a lattice-based cryptosystem that was already defined in detail for arbitrary number fields: 2010 Smart–Vercauteren, optimized version of 2009 Gentry. Parameter: R = Z[α] for an algebraic integer α. Secret key: very short g ∈ R. Public key: gR.

Christine van Vredendaal multiquad 6

slide-12
SLIDE 12

A reasonable multiquadratic cryptosystem

Case study of a lattice-based cryptosystem that was already defined in detail for arbitrary number fields: 2010 Smart–Vercauteren, optimized version of 2009 Gentry. Parameter: R = Z[α] for an algebraic integer α. Secret key: very short g ∈ R. Public key: gR. Like Smart–Vercauteren, we took N ∈ λ2+o(1) for target security 2λ. Checked security against standard lattice attacks: nothing better than exponential time.

Christine van Vredendaal multiquad 6

slide-13
SLIDE 13

Part II: Some preliminaries

Christine van Vredendaal multiquad 7

slide-14
SLIDE 14

Definition

A number field is a field L containing Q with finite dimension as a Q-vector space. Its degree is this dimension.

Definition

The ring of integers OL of a number field L is the set of algebraic integers in L. The invertible elements of this ring form the unit group O×

L .

Problem

Recover a “small” g ∈ OL (modulo roots of unity) given gOL.

Definition (for this talk)

A multiquadratic field is a number field that can be written in the form L = Q(√d1, . . . , √dn), where (d1, . . . , dn) are distinct primes. The degree of the multiquadratic field is N = 2n.

Christine van Vredendaal multiquad 8

slide-15
SLIDE 15

General strategy to recover g

0 Compute the unit group O×

L

Christine van Vredendaal multiquad 9

slide-16
SLIDE 16

General strategy to recover g

0 Compute the unit group O×

L

1 Find some generator ug of principal ideal gOL ◮ subexponential time algorithm [1990 Buchmann, 2014 Biasse–Fieker,

2014 Biasse]

◮ quantum poly-time algorithm [2016 Biasse–Song] Christine van Vredendaal multiquad 9

slide-17
SLIDE 17

General strategy to recover g

0 Compute the unit group O×

L

1 Find some generator ug of principal ideal gOL ◮ subexponential time algorithm [1990 Buchmann, 2014 Biasse–Fieker,

2014 Biasse]

◮ quantum poly-time algorithm [2016 Biasse–Song] 2 Solve BDD for Log ug in the log-unit lattice to find Log u ◮ 2014 Campbell–Groves–Shepherd pointed out this was easy for

cyclotomic fields with h+ small

◮ 2015 Schanck confirmed experimentally ◮ 2015 Cramer–Ducas–Peikert–Regev proved pre-quantum polynomial

time for these fields

(BDD: bounded-distance decoding; i.e., finding a lattice vector close to an input point.)

Christine van Vredendaal multiquad 9

slide-18
SLIDE 18

Definition

Fix a number field L of degree N and fix distinct complex embeddings σ1, . . . , σN of L. The Dirichlet logarithm map is defined as Log : L× → RN x → (log |σ1(x)|, . . . , log |σN(x)|)

Christine van Vredendaal multiquad 10

slide-19
SLIDE 19

Definition

Fix a number field L of degree N and fix distinct complex embeddings σ1, . . . , σN of L. The Dirichlet logarithm map is defined as Log : L× → RN x → (log |σ1(x)|, . . . , log |σN(x)|)

Theorem (Dirichlet Unit Theorem)

The kernel of Log |OL−{0} is the cyclic group of roots of unity in OL. Let Λ = Log O×

L ⊂ RN. Λ is a lattice of rank r + c − 1, where r is the number

  • f real embeddings and c is the number of complex-conjugate pairs of

non-real embeddings of L.

Christine van Vredendaal multiquad 10

slide-20
SLIDE 20

Definition

Fix a number field L of degree N and fix distinct complex embeddings σ1, . . . , σN of L. The Dirichlet logarithm map is defined as Log : L× → RN x → (log |σ1(x)|, . . . , log |σN(x)|)

Theorem (Dirichlet Unit Theorem)

The kernel of Log |OL−{0} is the cyclic group of roots of unity in OL. Let Λ = Log O×

L ⊂ RN. Λ is a lattice of rank r + c − 1, where r is the number

  • f real embeddings and c is the number of complex-conjugate pairs of

non-real embeddings of L.

Fact

If hOL = gOL and g = 0 then h = ug for some u ∈ O×

L , and

Log g ∈ Log h + Λ.

Christine van Vredendaal multiquad 10

slide-21
SLIDE 21

Part III: The algorithm

https://starecat.com/algorithm-word-used-by-programmers-when-they-do-not-want-to-explain-what-they-did/ Christine van Vredendaal multiquad 11

slide-22
SLIDE 22

Algorithm idea 1: subfields

Multiquadratic fields have a huge number of subfields

Christine van Vredendaal multiquad 12

slide-23
SLIDE 23

Algorithm idea 1: subfields

Multiquadratic fields have a huge number of subfields

Q Q( √ 5) Q( √ 13) Q( √ 17) Q( √ 65) Q( √ 85) Q( √ 221) Q( √ 1105) Q( √ 5, √ 13) Q( √ 5, √ 17) Q( √ 13, √ 17) Q( √ 5, √ 221) Q( √ 13, √ 85) Q( √ 17, √ 65) Q( √ 65, √ 85) K = Q( √ 5, √ 13, √ 17)

Christine van Vredendaal multiquad 12

slide-24
SLIDE 24

Algorithm idea 1: subfields

Multiquadratic fields have a huge number of subfields We use 3 specific ones (plus recursion)

Q Q( √ 5) Q( √ 13) Q( √ 17) Q( √ 65) Q( √ 85) Q( √ 221) Q( √ 1105) Q( √ 5, √ 13) Q( √ 5, √ 17) Q( √ 5, √ 221) K = Q( √ 5, √ 13, √ 17)

Christine van Vredendaal multiquad 12

slide-25
SLIDE 25

Algorithm idea 1: subfields

Multiquadratic fields have a huge number of subfields We use 3 specific ones (plus recursion)

Q Q( √ 5)Q( √ 13)Q( √ 17)Q( √ 29)Q( √ 65)Q( √ 85)Q( √ 145)Q( √ 221)Q( √ 377)Q( √ 493) Q( √ 640)Q( √ 1105)Q( √ 1885)Q( √ 2465) Q( √ 6409)Q( √ 32045) Q( √ 5, √ 13) Q( √ 5, √ 17) Q( √ 5, √ 29) Q( √ 5, √ 221) Q( √ 5, √ 377) Q( √ 5, √ 493) Q( √ 5, √ 6409) Q( √ 5, √ 13, √ 17) Q( √ 5, √ 13, √ 29) Q( √ 5, √ 13, √ 493) K = Q( √ 5, √ 13, √ 17, √ 29)

Christine van Vredendaal multiquad 12

slide-26
SLIDE 26

Algorithm idea 2: the subfield relation

Let σ be the automorphism of L that negates √dn and fixes other

  • dj.

Define Kσ = {x ∈ L : σ(x) = x} as the field fixed by σ. The norm Nσ(x) of x ∈ L is defined as xσ(x). Then Nσ(x) ∈ Kσ.

Christine van Vredendaal multiquad 13

slide-27
SLIDE 27

Algorithm idea 2: the subfield relation

Let σ be the automorphism of L that negates √dn and fixes other

  • dj.

Define Kσ = {x ∈ L : σ(x) = x} as the field fixed by σ. The norm Nσ(x) of x ∈ L is defined as xσ(x). Then Nσ(x) ∈ Kσ. Let τ be the automorphism of L that negates

  • dn−1 and fixes other
  • dj.

Nσ(x) = xσ(x) Nτ(x) = xτ(x) σ(Nστ(x)) = σ(xσ(τ(x)))

Christine van Vredendaal multiquad 13

slide-28
SLIDE 28

Algorithm idea 2: the subfield relation

Let σ be the automorphism of L that negates √dn and fixes other

  • dj.

Define Kσ = {x ∈ L : σ(x) = x} as the field fixed by σ. The norm Nσ(x) of x ∈ L is defined as xσ(x). Then Nσ(x) ∈ Kσ. Let τ be the automorphism of L that negates

  • dn−1 and fixes other
  • dj.

Nσ(x) = xσ(x) Nτ(x) = xτ(x) σ(Nστ(x)) = σ(xσ(τ(x))) = σ(x)τ(x)

Christine van Vredendaal multiquad 13

slide-29
SLIDE 29

Algorithm idea 2: the subfield relation

Let σ be the automorphism of L that negates √dn and fixes other

  • dj.

Define Kσ = {x ∈ L : σ(x) = x} as the field fixed by σ. The norm Nσ(x) of x ∈ L is defined as xσ(x). Then Nσ(x) ∈ Kσ. Let τ be the automorphism of L that negates

  • dn−1 and fixes other
  • dj.

Nσ(x) = xσ(x) Nτ(x) = xτ(x) σ(Nστ(x)) = σ(xσ(τ(x))) = σ(x)τ(x) x2 = Nσ(x)Nτ(x)/σ(Nστ(x))

Christine van Vredendaal multiquad 13

slide-30
SLIDE 30

Algorithm idea 3: computing units via subfields

Can use the subfield relation to find the unit group O×

L

u2 = Nσ(u)Nτ(u)/σ(Nστ(u))

Christine van Vredendaal multiquad 14

slide-31
SLIDE 31

Algorithm idea 3: computing units via subfields

Can use the subfield relation to find the unit group O×

L

u2 = Nσ(u)Nτ(u)/σ(Nστ(u)) If UL = O×

Kσ · O× Kτ · σ(O× Kστ ), then

(O×

L )2 ⊆ UL ⊆ O× L

So if we can find a basis for (O×

L )2, taking square roots gives O× L .

Christine van Vredendaal multiquad 14

slide-32
SLIDE 32

Algorithm idea 3: computing units via subfields

Can use the subfield relation to find the unit group O×

L

u2 = Nσ(u)Nτ(u)/σ(Nστ(u)) If UL = O×

Kσ · O× Kτ · σ(O× Kστ ), then

(O×

L )2 ⊆ UL ⊆ O× L

So if we can find a basis for (O×

L )2, taking square roots gives O× L .

We can do this—in polynomial time!

Christine van Vredendaal multiquad 14

slide-33
SLIDE 33

Algorithm idea 3: computing units via subfields

Can use the subfield relation to find the unit group O×

L

u2 = Nσ(u)Nτ(u)/σ(Nστ(u)) If UL = O×

Kσ · O× Kτ · σ(O× Kστ ), then

(O×

L )2 ⊆ UL ⊆ O× L

So if we can find a basis for (O×

L )2, taking square roots gives O× L .

We can do this—in polynomial time! Adapting 1991 Adleman idea from NFS: Define many quadratic characters χi : O×

L → Z/2Z.

Almost certainly (O×

L )2 = UL ∩ ( i Ker χi). Compute by linear algebra.

Christine van Vredendaal multiquad 14

slide-34
SLIDE 34

Algorithm idea 4: recovering generators via subfields

Fact

Can compute Nσ(g)OKσ quickly from hOL. Apply algorithm recursively to find generator hσ of Nσ(g)OKσ. i.e. hσ = uσNσ(g) for some unit uσ.

Christine van Vredendaal multiquad 15

slide-35
SLIDE 35

Algorithm idea 4: recovering generators via subfields

Fact

Can compute Nσ(g)OKσ quickly from hOL. Apply algorithm recursively to find generator hσ of Nσ(g)OKσ. i.e. hσ = uσNσ(g) for some unit uσ. Similarly hτ, hστ. Compute h = hσhτ σ(hστ) = uσNσ(g)uτNτ(g) σ(uστ)σ(Nστ(g)). Subfield relation: h = ug2 for some u ∈ O×

L .

Christine van Vredendaal multiquad 15

slide-36
SLIDE 36

Algorithm idea 4: recovering generators via subfields

Fact

Can compute Nσ(g)OKσ quickly from hOL. Apply algorithm recursively to find generator hσ of Nσ(g)OKσ. i.e. hσ = uσNσ(g) for some unit uσ. Similarly hτ, hστ. Compute h = hσhτ σ(hστ) = uσNσ(g)uτNτ(g) σ(uστ)σ(Nστ(g)). Subfield relation: h = ug2 for some u ∈ O×

L .

Problem: This is not necessarily a square!

Christine van Vredendaal multiquad 15

slide-37
SLIDE 37

Algorithm idea 4: recovering generators via subfields

Fact

Can compute Nσ(g)OKσ quickly from hOL. Apply algorithm recursively to find generator hσ of Nσ(g)OKσ. i.e. hσ = uσNσ(g) for some unit uσ. Similarly hτ, hστ. Compute h = hσhτ σ(hστ) = uσNσ(g)uτNτ(g) σ(uστ)σ(Nστ(g)). Subfield relation: h = ug2 for some u ∈ O×

L .

Problem: This is not necessarily a square! Solution: Use quadratic characters to find v ∈ O×

L with square vh.

Christine van Vredendaal multiquad 15

slide-38
SLIDE 38

Algorithm idea 4: recovering generators via subfields

Fact

Can compute Nσ(g)OKσ quickly from hOL. Apply algorithm recursively to find generator hσ of Nσ(g)OKσ. i.e. hσ = uσNσ(g) for some unit uσ. Similarly hτ, hστ. Compute h = hσhτ σ(hστ) = uσNσ(g)uτNτ(g) σ(uστ)σ(Nστ(g)). Subfield relation: h = ug2 for some u ∈ O×

L .

Problem: This is not necessarily a square! Solution: Use quadratic characters to find v ∈ O×

L with square vh.

Last step is to shorten the generator u′g = √ vh by solving the BDD problem in the log-unit lattice.

Christine van Vredendaal multiquad 15

slide-39
SLIDE 39

Algorithm 1: MQPIP(L, I) Input: Real multiquadratic field L and a basis matrix for a principal ideal I of OL Result: A short generator g for I

1 if [L : Q] = 2 then 2

return QPIP(L, I)

3 σ, τ ← Gal(L/Q) 4 for ℓ ∈ {σ, τ, στ} do 5

Set Kℓ so that Gal(L/Kℓ) = ℓ

6

Iℓ ← (I · σℓ(I)) ∩ Kℓ = Nℓ(I)

7

gℓ, Uℓ ← MQPIP(Kℓ, Iℓ)

8 O× L , X ← UnitsGivenSubgroup(Uℓ) 9 h ← gσgτσ(g−1 στ ) 10 g′ ← IdealSqrt(h, O× L , X) 11 g ← ShortenGen(g′, O× L ) 12 return g, O× L

Christine van Vredendaal multiquad 16

slide-40
SLIDE 40

Algorithm 1: MQPIP(L, I) Input: Real multiquadratic field L and a basis matrix for a principal ideal I of OL Result: A short generator g for I

1 if [L : Q] = 2 then 2

return QPIP(L, I) ⊲ O(NB)

3 σ, τ ← Gal(L/Q) 4 for ℓ ∈ {σ, τ, στ} do 5

Set Kℓ so that Gal(L/Kℓ) = ℓ

6

Iℓ ← (I · σℓ(I)) ∩ Kℓ = Nℓ(I)

7

gℓ, Uℓ ← MQPIP(Kℓ, Iℓ)

8 O× L , X ← UnitsGivenSubgroup(Uℓ)

⊲ O(N7) (exp. O(N2+log2 3B))

9 h ← gσgτσ(g−1 στ )

⊲ O(N2B)

10 g′ ← IdealSqrt(h, O× L , X)

⊲ O(N3 + N2B)

11 g ← ShortenGen(g′, O× L )

⊲ O(N2B)

12 return g, O× L

Christine van Vredendaal multiquad 16

slide-41
SLIDE 41

Part IV: Results

Christine van Vredendaal multiquad 17

slide-42
SLIDE 42

Attack Speed Results (in seconds)

2n tower absolute new new2 attack attack2 8 0.05 0.03 0.90 0.91 0.07 0.07 16 0.48 0.24 2.33 2.39 0.20 0.19 32 6.75 4.73 6.61 7.36 0.56 0.51 64 >700000 >700000 23.30 37.51 1.51 1.51 128 93.02 1560.49 4.95 7.29 256 463.91 31469.23 27.95 100.65

Table : Observed time to compute (once) the unit group of Q(√d1, . . . , √dn); and to find a generator for the public key in the cryptosystem.

Christine van Vredendaal multiquad 18

slide-43
SLIDE 43

Attack Success Results

n 3 4 5 6 7 8 psuc(L1) 0.122 0.137 0.132 0.036 0.001 0.000 psuc(Ln) 0.203 0.490 0.648 0.936 0.631 0.423 psuc(Ln2) 0.784 0.981 1.000 1.000 1.000 1.000

Table : Observed attack success probabilities for various multiquadratic fields.

Christine van Vredendaal multiquad 19

slide-44
SLIDE 44

Figure : A multitude of quads.

Questions?

Christine van Vredendaal multiquad 20