Worst-Case to Average-Case Reduction for SIS Vadim Lyubashevsky - - PowerPoint PPT Presentation

▶
worst case to average case reduction for sis
SMART_READER_LITE
LIVE PREVIEW

Worst-Case to Average-Case Reduction for SIS Vadim Lyubashevsky - - PowerPoint PPT Presentation

Sep 17, 2022 261 likes •910 views

Worst-Case to Average-Case Reduction for SIS Vadim Lyubashevsky INRIA / ENS, Paris Lattice-Based Crypto & Applications 1 Bar-Ilan University Israel 2012 Session Outline Average-Case Problems The Small Integer Solution (SIS)

slide-1
SLIDE 1

Worst-Case to Average-Case Reduction for SIS

Vadim Lyubashevsky INRIA / ENS, Paris

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 1

slide-2
SLIDE 2

Session Outline

  • Average-Case Problems

– The Small Integer Solution (SIS) problem

  • Gaussian Distributions and Lattices
  • Reducing a Worst-Case Lattice Problem to SIS

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 2

slide-3
SLIDE 3

THE AVERAGE-CASE PROBLEMS

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 3

slide-4
SLIDE 4

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 4

Lattice Problems Small Integer Solution Problem (SIS) Learning With Errors Problem (LWE) One-Way Functions Collision-Resistant Hash Functions Digital Signatures Identification Schemes (Minicrypt) Public Key Encryption … (Cryptomania) Worst-Case Average-Case

slide-5
SLIDE 5

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 5

Small Integer Solution Problem (SIS) Learning With Errors Problem (LWE) One-Way Functions Collision-Resistant Hash Functions Digital Signatures Identification Schemes (Minicrypt) Public Key Encryption … (Cryptomania) Worst-Case Average-Case

BDD SIVP quantum

slide-6
SLIDE 6

Small Integer Solution Problem

6 Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012

a1 a2 am

in Zq

n

Find: non-trivial solution z1,...,zm in {-1,0,1} such that z1 z2 zm + + … + = Given: Random vectors a1,...,am in Zq

n

Observations:

 If size of zi is not restricted, then the problem is trivial  Immediately implies a collision-resistant hash function  A relationship to lattices emerges …

slide-7
SLIDE 7

Relationship of SIS to Lattice Problems

7 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

a1 a2 am

in Zq

n

Find: non-trivial solution z1,...,zm in {-1,0,1} such that z1 z2 zm + + … + = Let S be the set of all integer z=(z1,…,zm), such that a1z1 + … + amzm=0 mod q S is a lattice! SIS problem asks to find a short vector in S.

slide-8
SLIDE 8

Representing Lattices

L(B) = {z: z=Bx for x in Zn} L⊥(A) = {z in Zm : Az = 0 mod q}

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

B x z = A z = 0 mod q

8

Worst-Case to Average-Case Reduction: Approximately solving SIVP in all lattices < Finding short vectors in these lattices (m ≈ nlog n)

slide-9
SLIDE 9

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 9

Small Integer Solution Problem (SIS) Learning With Errors Problem (LWE) One-Way Functions Collision-Resistant Hash Functions Digital Signatures Identification Schemes (Minicrypt) Public Key Encryption … (Cryptomania) Worst-Case Average-Case

BDD SIVP quantum

slide-10
SLIDE 10

Collision-Resistant Hash Functions

10 Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012

D H R

For a random h in H, It is hard to find: x1, x2 in D such that h(x1) = h(x2)

slide-11
SLIDE 11

Collision-Resistant Hash Function

11 Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012

a1 a2 am

in Zq

n

Find: non-trivial solution z1,...,zm in {-1,0,1} such that z1 z2 zm + + … + = Given: Random vectors a1,...,am in Zq

n

A=(a1,...,am) Define hA: {0,1}m → Zq

n where hA(z1,...,zm)=a1z1 + … + amzm

Domain of h = {0,1}m (size = 2m) Range of h = Zq

n (size = qn)

Set m>nlog q to get compression Collision: a1z1 + … + amzm = a1y1 + … + amym So, a1(z1-y1) + … + am(zm-ym) = 0 and zi-yi are in {-1,0,1}

slide-12
SLIDE 12

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 12

Small Integer Solution Problem (SIS) Learning With Errors Problem (LWE) One-Way Functions Collision-Resistant Hash Functions Digital Signatures Identification Schemes (Minicrypt) Public Key Encryption … (Cryptomania) Worst-Case Average-Case

BDD SIVP quantum

slide-13
SLIDE 13

THE GAUSSIAN (NORMAL) DISTRIBUTION

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 13

slide-14
SLIDE 14

Definition

1-dimensional Gaussian distribution:

ρs(x) = (1/s)e-πx2/s2

It’s a Normal distribution: Centered at 0 Standard deviation: s/√2π

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 14

slide-15
SLIDE 15

Example (s=1)

15 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

slide-16
SLIDE 16

Example (s=1 and 5)

16 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

slide-17
SLIDE 17

2-Dimensional Gaussian

1-dim gaussian on the x1 axis: ρs(x1) = (1/s)e-πx1

2/s2

1-dim gaussian on the x2 axis: ρs(x2) = (1/s)e-πx2

2/s2

ρs(x1,x2) = ρs(x1) ∙ ρs(x2)

= (1/s)e-πx1

2/s2 ∙ (1/s)e-πx2 2/s2

= (1/s)2 e-π(x1

2 + x2 2)/s2

ρs(x) = (1/s)2 e-π|

|x| |2/s2

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 17

slide-18
SLIDE 18

2-Dimensional Example

18 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

slide-19
SLIDE 19

n-Dimensional Gaussian

n-dimensional Gaussian distribution:

ρs(x) = (1/s)n e-π|

|x| |2/s2

It’s an n-dimensional Normal distribution: Centered at 0 Standard deviation: s/√ 2π

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 19

slide-20
SLIDE 20

Useful Properties of the Gaussian Distribution

  • 1. It is a Product Distribution
  • 2. It is Spherically-Symmetric
  • 3. It is “uniform” modulo parallelepipeds

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 20

slide-21
SLIDE 21

Product Distribution

ρs(x) = ρs(x1) ∙ … ∙ ρs(xn)

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 21

slide-22
SLIDE 22

Spherically Symmetric

ρs(x)= (1/s)n e-π|

|x| |2/s2

The probability of x only depends on its length The distribution is “axis-independent”

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 22

slide-23
SLIDE 23

Generating Uniform Elements on a Line Segment

ρs(x)= (1/s)e-πx2/s2 and s=5M, for some positive M if X ~ ρs, then for all m < M, Δ (X mod m , Uniform [0, m) ) < 2-110

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 23

slide-24
SLIDE 24

Example (s=1,m=1)

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 24

slide-25
SLIDE 25

Example (s=1,m=1, .9, .8)

25 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

slide-26
SLIDE 26

Example (s=2)

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 26

slide-27
SLIDE 27

Example (s=5, m=1)

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 27

slide-28
SLIDE 28

Generating Uniform Elements in an n-dimensional Parallelepiped

28 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

Reducing modulo a parallelepiped

slide-29
SLIDE 29

Generating Uniform Elements in an n-Dimensional Box

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 29

B m1 m2

Box B with dimensions (m1, … ,mn), all mi < M. Generate X1, … , Xn ~ ρs(x) = (1/s)e-πx2/s2 , where s=5M For each j, Δ(Xj mod m , Uniform [0, mj) ) < 2-110 Thus Δ((X1 mod m1, … , Xn mod mn) , Uniform(B)) < n2-110 So, if X ~ ρs(x) = (1/s)n e-π|

|x| |2/s2 for s=5M, Δ(X mod B, Uniform(B)) < n2-110 ≈ 0

slide-30
SLIDE 30

Generating Uniform Elements in a Rotated n-Dimensional Box

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 30

ρs(x) = (1/s)n e-π|

|x| |2/s2 is a spherical distribution

So rotating axes doesn’t affect it

slide-31
SLIDE 31

Generating Uniform Elements in a Rotated n-Dimensional Box

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 31

ρs(x) = (1/s)n e-π|

|x| |2/s2 is a spherical distribution

So rotating axes doesn’t affect it Thus, Δ(X mod B’, Uniform(B’)) ≈ 0

slide-32
SLIDE 32

Generating Uniform Elements in Parallelepipeds

32 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

Suppose we have X ~ ρs(x) = (1/s)n e-π|

|x| |2/s2

and X mod A is uniform Is X uniform modulo B?

slide-33
SLIDE 33

Generating Uniform Elements in Parallelepipeds

33 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

If B is much bigger than A (i.e. has a bigger determinant), then probably NO.

slide-34
SLIDE 34

Generating Uniform Elements in Parallelepipeds

34 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

A B

If B is much bigger than A (i.e. has a bigger determinant), then probably NO. But what if B=AU when det(U)=1? Still … not necessarily.

slide-35
SLIDE 35

Generating Uniform Elements in Parallelepipeds

If B=AU and det(U)=1, then X mod A is uniform  X mod B is uniform if: 1.) U is an integer matrix or 2.) U is an upper-triangular matrix with 1’s

  • n the diagonal

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 35

slide-36
SLIDE 36

Some Simplifying Assumptions

Pretend that the space Rn is divided into a very very fine grid. Any two parallelepipeds that have the same determinant have the same number of grid points inside them.

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 36

slide-37
SLIDE 37

1-to-1 Relationship Between Rn / A and Rn / B

B = AU By our assumption #(Rn / A ) = #(Rn / B ) We will now show that:

For every a=Az, where z in [0,1)n, a mod B is distinct

This implies that if X mod A is uniform, then X mod B is uniform too.

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 37

slide-38
SLIDE 38

1-to-1 Relationship Between Rn / A and Rn / B

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

A B

38

1-to-1 not 1-to-1

slide-39
SLIDE 39

1-to-1 Relationship Between Rn / A and Rn / B

If B=AU and det(U)=1, then X mod A is uniform  X mod B is uniform if: 1.) U is an integer matrix Then L(A) = L(B), thus … If Az1 mod B = Az2 mod B, then A(z1-z2)=0 mod B A(z1-z2) is in L(B) z1-z2 is an integer vector z1-z2 = 0 

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 39

slide-40
SLIDE 40

1-to-1 Relationship Between Rn / A and Rn / B

If B=AU and det(U)=1, then X mod A is uniform  X mod B is uniform if: 2.) U is an upper-triangular matrix with 1’s on the diagonal If Az1 mod B = Az2 mod B, then A(z1-z2)=0 mod B BU-1(z1-z2) is in L(B) U-1(z1-z2) is an integer vector z1-z2 = 0 

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 40

why?

slide-41
SLIDE 41

1-to-1 Relationship Between Rn / A and Rn / B

U is an upper-triangular matrix with 1’s on the diagonal Thus U-1 is also.

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 41

1 a b … c 1 d … e … 1 … f … … … … … … 1

U-1

…

z1-z2 =

integer vector

slide-42
SLIDE 42

The Gram-Schmidt Matrix

B is a basis for a lattice Then B = B̃U where B̃ is the Gram-Schmidt basis

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 42

1 μ2,1 μ3,1 … μn,1 1 μ3,2 … μn,2 … 1 … μn,3 … … … … … … 1 … …

b̃1 b̃2 b̃3 … b̃n

… …

B̃ U = B

slide-43
SLIDE 43

Generating Uniform Elements in Parallelepipeds

43 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

Suppose we have X ~ ρs(x) = (1/s)n e-π|

|x| |2/s2

and

X mod A is uniform Is X uniform modulo B? If A is the Gram-Schmidt basis of B, then YES! So s needs to be big enough to make X uniform mod A

slide-44
SLIDE 44

There is more …

44 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

X mod A is uniform Is X uniform modulo B? If A is the Gram-Schmidt basis of BU for any integer matrix U with determinant 1, then also YES!

slide-45
SLIDE 45

And still more …

45 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

X mod A is uniform Is X uniform modulo B? If A is the Gram-Schmidt basis of BU for any integer matrix U, then also YES! (This is because L(BU) is a sublattice of L(B), and so uniform modulo BU implies uniform modulo B.)

slide-46
SLIDE 46

And in particular …

46 Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012

B is a lattice basis C=BU is a (sub)-lattice basis such that all vectors of C are at most λn(B) Then all vectors of C̃ are of length at most λn(B) So if s> 5λn(B), and X ~ ρs(x) = (1/s)n e-π|

|x| |2/s2 ,then:

X is uniform mod C̃  uniform mod C  uniform mod B

slide-47
SLIDE 47

Uniform Distribution Over Lattices

Theorem [Micciancio and Regev 2004]: if s > 5λn(B), and X ~ ρs(x) = (1/s)n e-π|

|x| |2/s2 , then

Δ(X mod B, Uniform(B)) < n2-110

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 47

slide-48
SLIDE 48

Gaussians on Lattice Points

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 48

slide-49
SLIDE 49

Gaussians on Lattice Points

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 49

slide-50
SLIDE 50

Gaussians on Lattice Points

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 50

slide-51
SLIDE 51

Gaussians on Lattice Points

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 51

slide-52
SLIDE 52

THE REDUCTION

Lattice-Based Crypto & Applications Bar-Ilan University, Israel 2012 52

[Ajtai ‘96, Micciancio and Regev ‘04]

slide-53
SLIDE 53

Worst-Case to Average-Case Reduction

53 Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012

slide-54
SLIDE 54

Worst-Case to Average-Case Reduction

54 Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012

slide-55
SLIDE 55

Worst-Case to Average-Case Reduction

1 2 2 1 1 2 1 1 2 1 2 1 2

Important: All lattice points have label (0,0) and All points labeled (0,0) are lattice points (0n in n dimensional lattices)

55 Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012

slide-56
SLIDE 56

1 2 2 1 1 2 1 1 2 1 2 1 2

How to use the SIS oracle to find a short vector in any lattice:

Repeat m times: Pick a random lattice point

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 56

slide-57
SLIDE 57

1 2 2 1 1 2 1 1 2 1 2 1 2

How to use the SIS oracle to find a short vector in any lattice:

Repeat m times: Pick a random lattice point Gaussian sample a point around the lattice point

All the samples are uniform in Zq

n

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 57

slide-58
SLIDE 58

1 2 2 1 1 2 1 1 2 1 2 1 2

How to use the SIS oracle to find a short vector in any lattice:

Repeat m times: Pick a random lattice point Gaussian sample a point around the lattice point Give the m “Zq

n samples” a1,...,am to the SIS oracle

Oracle outputs z1,...,zm in {-1,0,1} such that: a1z1 + … + amzm = 0

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 58

slide-59
SLIDE 59

1 2 2 1 1 2 1 1 2 1 2 1 2

Give the m “Zq

n samples” a1,...,am to the SIS oracle

Get z1,...,zm in {-1,0,1} such that a1z1 + … + amzm = 0 = si = vi s1z1+...+smzm is a lattice vector, so (v1+r1)z1+...+(vm+rm)zm is too (v1z1+...+vmzm) + (r1z1+...+rmzm) is too So, r1z1+...+rmzm is also lattice vector vi + ri = si

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 59

slide-60
SLIDE 60

1 2 2 1 1 2 1 1 2 1 2 1 2

Give the m “Zq

n samples” a1,...,am to the SIS oracle

Get z1,...,zm in {-1,0,1} such that a1z1 + … + amzm = 0 = si = vi So, r1z1+...+rmzm is also lattice vector ri are short vectors, zi are in {-1,0,1} So r1z1+...+rmzm is a short lattice vector ||r1z1+...+rmzm|| ≈ Ō(√m)||ri|| vi + ri = si

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 60

slide-61
SLIDE 61

1 2 2 1 1 2 1 1 2 1 2 1 2

Give the m “Zq

n samples” a1,...,am to the SIS oracle

Get z1,...,zm in {-1,0,1} such that a1z1 + … + amzm = 0 = si = vi ||r1z1+...+rmzm|| ≈ Ō(√m)||ri|| Reduction works when ri ~ ρs(x) = (1/s)n e-π|

|x| |2/s2 for s>5λn

So ||ri|| ≈ 5λn√n vi + ri = si

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 61

slide-62
SLIDE 62

1 2 2 1 1 2 1 1 2 1 2 1 2

||r1z1+...+rmzm|| ≈ Ō(√m)||ri|| ≈ Ō(√mn) λn ≈ Ō(n) λn Can either guess λn using binary search or keep using s=length of the largest vector/Ō(n) to find a shorter vector, and this should keep working until the length of the largest vector < Ō(n) λn, which solves SIVPŌ(n)

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 62

slide-63
SLIDE 63

Some Technicalities

  • You can’t sample a “uniformly random” lattice point

– In the proofs we work with Rn / L

  • What if r1z1+...+rmzm is 0?

– Can show that with non-negligible it is in fact linearly independent

  • f the n-1 non-longest vectors.

– This is because given an si, there are many possible ri

  • Gaussian Sampling doesn’t give us points on the grid

– Can round to a grid point – Need to be mindful to bound the extra “rounding distance” – Alternatively, sample the grid point directly (using an algorithm you will see tomorrow)

Lattice-Based Crypto & Applications Bar-Ilan University Israel 2012 63