Latticebased Cryptography Oded Regev TelAviv University CRYPTO 2006

Lattice-based Cryptography Oded Regev Tel-Aviv University CRYPTO 2006, Santa Barbara, CA

Outline • Introduction to lattices • Survey of lattice-based cryptography • Hash functions [Ajtai 96, …] • Public-key cryptography [Ajtai. Dwork 97, …] • Construction of a simple lattice-based hash function • Open Problems

Lattice • For any vectors v 1, …, vn in Rn, the lattice spanned by v 1, …, vn is the set of points 2 v 1 v 1+v 2 L={a 1 v 1+…+anvn| ai integers} • These vectors form a basis of L v 1 2 v 2 -v 1 2 v 2 -2 v 1 0

History of Lattices • Geometric objects with rich structure • Investigated since 1800 by Lagrange, Gauss, Hermite, and Minkowski • More recent developments: – LLL algorithm: finds ‘somewhat short’ vectors in lattices [Lenstra. Lovàsz 82]. Applications include: • Factoring polynomials over the rationals • Solving integer programs in fixed dimension • Cryptanalysis: – Breaking knapsack cryptosystems [Lagarias. Odlyzko 85] – Breaking special cases of RSA [Coppersmith 01] – And more… – Ajtai’s lattice-based cryptographic construction [Ajtai 96]

Shortest Vector Problem (SVP) v 2 v 1 3 v 2 -4 v 1 0 • SVP: given a lattice, find a shortest (nonzero) vector • -approximate SVP: given a lattice, find a vector of length at most times the shortest • Other lattice problems: SIVP, SBP, etc.

Lattice Problems Seem Hard • We’ll be interested in -approximate SVP for =poly(n) – Best known algorithm runs in time 2 n [Ajtai. Kumar. Sivakumar 01] – On the other hand, not believed to be NP-hard [Goldreich. Goldwasser 00, Aharonov. R 04] • Best poly-time algorithm solves for =2 nloglogn/logn [LLL 82, Schnorr 85] • NP-hard for sub-polynomial [Khot 04] 1 2^(log 1 -en) NP-hard n NP∩co. NP n crypto 2 n loglogn/logn P

Survey of Lattice-based Cryptography

Why use lattice-based cryptography • ‘Standard’ cryptography K Based on hardness of factoring, discrete log, etc. K Based on an averagecase assumption K Broken by quantum algorithms K Require modular exponentiation etc. • Lattice-based cryptography J Based on hardness of lattice problems J Based on a worstcase assumption J (Still) Not broken by quantum algorithms J Very simple computations

Collision-Resistant Hash Functions • A CRHF is a function f: {0, 1}r {0, 1}s with r>s such that it is hard to find collisions, i. e. , x y s. t. f(x)=f(y) • First lattice-based CRHF given in [Ajtai 96] – Based on the worst-case hardness of -approximate SVP n 8 • Security improved in subsequent works [Goldreich. Goldwasser. Halevi 97, Cai. Nerurkar 97, Micciancio 02, Micciancio. R 04] • Current state-of-the-art is a CRHF based on n-approximate SVP [Micciancio. R 04]

The Modular Subset-Sum Function • Let N be a big integer, and m=2 log 2 N • Choose a 1, …, am uniformly in {0, …, N-1}. Then define fa 1, …, am: {0, 1}m {0, …, N-1} by fa 1, …, am(b 1, …, bm) = Σbiai mod N • Since m>log 2 N, (many) collisions exist • We will later see a proof of security: • Being able to find a collision in a randomly chosen f, even with probability n-100 implies a solution to any instance of approximate-SVP

Recent Work: More Efficient CRHFs • In the constructions above, for security based on n-dimensional lattices, O(n 2) bits are necessary to specify a hash function • More efficient constructions were given in [Micciancio 04, Lyubashevsky. Micciancio 06, Peikert. Rosen 06] – Only O(n) bits needed to specify a hash function – Based on worst-case hardness of approximate. SVP on a restricted class of lattices known as cyclic lattices

Public-key Cryptosystem • A PKC allows parties to communicate securely without having to agree on a secret key beforehand • First lattice-based PKC presented in [Ajtai. Dwork 97] – Some improvements [Goldreich. Goldwasser. Halevi 97, R 03] • Security based on the worst-case hardness of a special case of SVP known as unique-SVP • Some disadvantages: • Based only on unique-SVP • Impractical (think of n as 100): • Public key size O(n 4) • Encryption expands by O(n 2)

A Recent Public-key Cryptosystem [Ajtai 05] • Main advantages: • Practical (think of n as 100): • Public key size O(n) • Encryption expands by O(n) • Some disadvantages: • Not based on lattice problems • No worst-case hardness

Another Recent Public-key Cryptosystem [R 05] • Main advantages: • Practical (think of n as 100): • Public key size O(n) • Encryption expands by O(n) • Worst-case hardness • Based on the main lattice problems (SVP, SIVP) • One disadvantage: • Breaking the cryptosystem implies an efficient quantum algorithm for lattices

Example of a lattice-based PKC [R 05] • • • Everything modulo 4 Private key: 4 random numbers 1 2 0 3 Public key: a 6 x 4 matrix and approximate inner product 2 2·? 2· 1 + 0· 2 0·? 0 + 1· 0 1 1·? + 2· 3 2 2·? ≈ 0 = 1 1 1·? 1· 1 + 2· 2 2·? 2 + 2· 0 2 2·? + 3· 3 3 3·? ≈ 2 = 0 0·? 0· 1 + 2· 2 2·? 2 + 0· 0 0 0·? + 3· 3 3 3·? ≈ 1 = 1 1·? 1· 1 + 2· 2 2·? 2 + 0· 0 0 0·? + 2· 3 2 2·? ≈ 3 = 0 0 0·? 0· 1 + 3· 2 3·? 3 + 1· 0 1 1·? + 3· 3 3 3·? ≈ 3 = 3 3·? 3· 1 + 3· 2 3·? 3 + 0· 0 0 0·? + 2· 3 2 2·? ≈ 3 = 2 Encrypt the bit 0: 3·? + 2·? + 1·? + 0·? ≈ 1 Encrypt the bit 1: 3·? + 2·? + 1·? + 0·? ≈ 3

Construction of a Lattice-based Collision Resistant Hash Function

Blurring a Picture

Blurring a Lattice

The Smoothing Radius • Define the smoothing radius = (L)>0 as the smallest real such that adding Gaussian blur of radius to L yields an essentially uniform distribution • The radius was analyzed in [Micciancio. R 04] based on Fourier analysis and [Banaszczyk 93] • It was shown that is ‘small’ in the sense that finding vectors of length poly(n) (L) implies solution to poly(n)-approximate SVP

An Alternative Definition • Define h: Rn [0, 1)n that maps any x=Σ ivi to h(x)=( 1, …, n) mod 1. • E. g. , any x L has h(x)=(0, …, 0) • Then the alternative way to define is as: • The smallest real such that if x is sampled from a Gaussian distribution centered around 0 of radius , then h(x) is ‘essentially’ uniform on [0, 1)n

Rn [0, 1)n x 2 x 1 h(x 3) 0 x 4 x 3 (1, 1) (0, 1) h(x 4) (0, 0) h(x 2) h(x 1) (1, 0)

Our CRHF • Fix the dimension n, let q=22 n, and m=4 n 2 • Choose a 1, …, am uniformly in Zqn. Then define fa 1, …, am: {0, 1}m {0, 1}nlog q by 2 fa 1, …, am(b 1, …, bm) = Σbiai (mod q) • Since m>nlog 2 q, (many) collisions exist • We now prove security by showing that: • Being able to find a collision in a randomly chosen fa , …, a , even with probability n-100, implies a 1 m solution to any instance of poly(n)-approximate SVP

Security Proof • Assume there exists an algorithm Collision. Find that given a 1, …, am chosen uniformly in Zqn, finds with some nonnegligible probability b 1, …, bm {-1, 0, 1} (not all zero) such that Σbiai = 0 (mod q). • This implies an algorithm Collision. Find’ that given a 1, …, am chosen uniformly from [0, 1)n, finds with some non-negligible probability b 1, …, bm {-1, 0, 1} (not all zero) such that Σbiai (0, …, 0) (mod 1)

Collision. Find’ (1, 1) (0, 1) a 2 a 3 a 4 a 6 (0, 0) a 1 a 5 (1, 0) Output: “a 1+a 2 -a 4+a 5 (0, …, 0) (mod 1)”

Security Proof • Our goal is to show that using Collision. Find’ we can find a nonzero vector of length at most poly(n) (L) in any given lattice L • So let L be a given lattice with basis v 1, …, vn • By using the LLL algorithm, we can assume that v 1, …, vn are not ‘unreasonably’ long: say, of length at most 2 n (L)

Security Proof – Main Procedure • Sample m vectors x 1, …, xm from the Gaussian distribution around 0 of radius • Compute a 1: =h(x 1), …, am: =h(xm) • Each ai is uniformly distributed in [0, 1)n • Apply Collision. Find’ to obtain b 1, …, bm {-1, 0, 1} such that Σbih(xi) ( m/q, …, m/q) (mod 1) • Define y=Σbixi. Then, • y is short (of length m ) • y is extremely close to a lattice point since h(y)=Σbih(xi) ( m/q, …, m/q) (mod 1)

Security Proof – Main Procedure • Write y=Σ ivi for some reals 1, …, n • So each i is within m/q of an integer • Define the lattice vector y’=Σ i vi • The distance • So y’ is a lattice vector of length at most (m+1)

x 2 x 1 Y’ 0 y x 4 x 3 Collision. Find’(a 1, a 2, a 3, a 4) “-a 2 -a 3+a 4 0 (mod

Security Proof – One Last Issue • How to guarantee that y’ is nonzero? • Maybe Collision. Find’ acts in some ‘malicious’ way, trying to make y’ zero • It can be shown that ai does not contain enough information about xi • In other words, conditioned on any fixed ai, xi still has enough randomness to guarantee that y’ is nonzero with very high probability

Security Proof – Conclusion • By a single call to the collision finder, we can find in any lattice, a nonzero vector of length at most (m+1) with some nonnegligible probability • Obviously, by repeating this procedure we can obtain such a vector with very high probability • The essential idea: All lattices look the same after adding some small amount of blur

Open Problems • Cryptanalysis • Current attacks limited to low dimension [Nguyen. Stern 98] • New systems [Ajtai 05, R 05] are efficient and can be easily used with dimension 100+ • Improved cryptosystems • Construct the ‘ultimate’ lattice-based cryptosystem? (based on SVP, efficient) • Construct more efficient schemes based on special classes of lattices?

Open Problems • Comparison with number theoretic cryptography • E. g. , can one factor integers using an oracle for n-approximate SVP? • Signature schemes • Can one construct provably secure latticebased signature schemes? • Security against chosen-ciphertext attacks • Known lattice-based cryptosystems are not secure against CCA