|
|
| Line 1: |
Line 1: |
| '''Ideal lattices''' are a special class of lattices and a generalization of [[cyclic lattice]]s.<ref name="Lyubattacks2008">
| | The many mistake people make in the club is not following outstanding workout regime. It is the single most essential aspect that determines if you will get weight and make muscle or maybe you simply train hard and can't locate any [http://t-rexmuscle.net/ T Rex Muscle Review] outcomes. If you are going to position the time in at pounds room and work hard, T Rex Muscle Review you should probably see the fruits of the labor. Selecting a workout routine designed for your health type will no doubt allow you to view the results you ought.<br><br>A meal replacement powder can amount you up to $3.00 PER PACKET, while it would probably cost you $1.00 or less if you eat you shouldn'[http://t-rexmuscle.net/ T Rex Muscle] amount of calories from real regular food.<br><br>The truth is, bodybuilding is really an art and science, and as well as more more experts are attempting to figure out its exact nature day to day. Sure there are specific routines and practices which you can follow that will allow you to find the greatest success as possible, a person should recognise that this process is being tested on a T Rex Muscle day by day basis.<br><br>Multivitamins. Fish oil. These two supplements are probably the best supplements that a person are take. They're natural, and although they normally are not authorized by the FDA, these types of extremely essential your body to get larger. Unless [http://t-rexmuscle.net/ T Rex Muscle] you believe your body is receiving proper nutrients via food intake, multivitamins and omega-3 fatty acids can be extremely very theraputic for muscle improve.<br><br>The last type of cardio is a better option for weight training lifters searching to integrate cardio without having affected their Muscle Building. It is referred to as recovery education. Recovery training involves light cardio that truly is completed improve circulation and to burn unsightly fat. It is done for about ten to twenty minutes and will definitely be done the instant as doing exercises. If you are doing carry on your workout muscle building routine then stick with recovery heart.<br><br>Yet, many are still confused if the supplements that sold as "Meal Replacements", "Weight Gainers", "natural supplements", and "amino acids" a few good use within substituting for some WHOLE Foods.<br><br>The most important technique in gaining muscle tissue quickly will be always to start every weight lifting cycle with extremely light weights greater reps. From there, will certainly increase the you use each body building session while decreasing quantity of of reps over the weeks. |
| Vadim Lyubashevsky. [http://cseweb.ucsd.edu/users/vlyubash/papers/idlatticeconf.pdf Lattice-Based Identification Schemes Secure Under Active Attacks]. In ''Proceedings of the Practice and theory in [[Public-key cryptography|public key cryptography]] , 11th international conference on Public key cryptography'', 2008.</ref> Ideal lattices naturally occur in many parts of [[number theory]], but also in other areas. In particular, they have a significant place in [[cryptography]]. Micciancio defined a generalization of cyclic lattices as ideal lattices. They can be used in cryptosystems to decrease by a square root the number of parameters necessary to describe a lattice, making them more efficient. Ideal lattices are a new concept, but similar lattice classes have been used for a long time. For example cyclic lattices, a special case of ideal lattices, are used in [[NTRUEncrypt]] and [[NTRUSign]].
| |
| | |
| ==Introduction==
| |
| In general terms, ideal lattices are lattices corresponding to [[Ideal (ring theory)|ideals]] in [[Ring (mathematics)|rings]] of the form <math> \mathbb{Z}[x]/\langle f \rangle </math> for some [[irreducible polynomial]] <math> f </math> of degree <math> n </math>.<ref name="Lyubattacks2008"/> All of the definitions of ''ideal lattices'' from prior work are instances of the following general notion: let <math> R </math> be a [[Ring (mathematics)|ring]] whose [[Ring (mathematics)|additive group]] is [[Group isomorphism|isomorphic]] to <math> \mathbb{Z}^n </math> (i.e., it is a free <math> \mathbb{Z} </math>-module of rank <math> n </math>), and let <math> \sigma </math> be an additive [[isomorphism]] mapping <math> R </math> to some lattice <math> \sigma(R) </math> in an <math> n</math>-dimensional real [[vector space]] (e.g., <math> R^n </math>). The family of ''ideal lattices'' for the ring <math> R </math> under the embedding <math> \sigma </math> is the set of all lattices <math> \sigma(I) </math>, where <math> I </math> is an [[Ideal (ring theory)|ideal]] in <math> R. </math><ref name="LyubPeiReg2010">Vadim Lyubashevsky, Chris Peikert and Oded Regev. [http://www.springerlink.com/content/p0k0124216567122/ On Ideal Lattices and Learning with Errors over Rings]. In Eurocrypt 2010, ''Lecture Notes in Computer Science'', 2010.</ref>
| |
| | |
| ==Definition==
| |
| | |
| ===Notation===
| |
| Let <math> f \in \mathbb{Z}[x]</math> be a [[monic polynomial]] of degree <math> n </math>, and consider the [[quotient ring]] <math> \mathbb{Z}[x]/\langle f \rangle </math>.
| |
| | |
| Using the standard set of representatives <math> \lbrace(g\ \bmod\ \ f) : g \in \mathbb{Z}[x] \rbrace </math>, and identification of polynomials with vectors, the [[quotient ring]] <math> \mathbb{Z}[x]/\langle f \rangle </math> is [[Group isomorphism|isomorphic]] (as an [[Ring (mathematics)|additive group]] ) to the [[integer lattice]] <math> \mathbb{Z}^n</math>, and any [[Ideal (ring theory)|ideal]] <math> I \subseteq \mathbb{Z}[x]/\langle f \rangle </math> defines a corresponding integer sublattice <math> \mathcal{L}(I)\subseteq \mathbb{Z}^n</math>.
| |
| | |
| An '''ideal lattice''' is an [[integer lattice]] <math> \mathcal{L}(B)\subseteq \mathbb{Z}^n</math> such that <math>B = \lbrace g \ \bmod\ f : g \in I \rbrace </math> for some monic polynomial <math> f </math> of degree <math> n </math> and [[Ideal (ring theory)|ideal]] <math> I \subseteq \mathbb{Z}[x]/\langle f \rangle </math>.
| |
| | |
| ===Related properties===
| |
| It turns out that the relevant properties of <math>f</math> for the resulting function to be collision resistant are: | |
| * <math>f</math> should be [[Irreducible polynomial|irreducible]].
| |
| * the ring norm <math>\lVert g \rVert_f</math> is not much bigger than <math>\lVert g \rVert_\infty</math> for any polynomial <math>g</math>, in a quantitative sense.
| |
| | |
| The first property implies that every ideal of the [[Ring (mathematics)|ring]] <math> \mathbb{Z}[x]/\langle f \rangle </math> defines a full-rank lattice in <math> \mathbb{Z}^n </math> and plays a fundamental role in proofs.
| |
| | |
| '''Lemma:''' Every [[Ideal (ring theory)|ideal]] <math> I </math> of <math> \mathbb{Z}[x]/\langle f \rangle </math>, where <math> f </math> is a monic, [[Irreducible polynomial|irreducible]] integer polynomial of degree <math> n </math>, is isomorphic to a full-rank lattice in <math> \mathbb{Z}^n </math>.
| |
| | |
| Ding and Lindner<ref name="DinLin2007">Jintai Ding and Richard Lindner. [http://eprint.iacr.org/2007/322.pdf Identifying Ideal Lattices]. In ''Cryptology ePrint Archive, Report 2007/322'', 2007.</ref> gave evidence that distinguishing ''ideal lattices'' from general ones can be done in polynomial time and showed that in practice randomly chosen lattices are never ideal. They only considered the case where the lattice has full rank, i.e. the basis consists of <math> n </math> [[Linear independence|linear independent vectors]]. This is not a fundamental restriction because Lyubashevsky and Micciancio have shown that if a lattice is ideal with respect to an irreducible monic polynomial, then it has full rank, as given in the above lemma.
| |
| | |
| '''Algorithm:''' Identifying ideal lattices with full rank bases
| |
| | |
| ''Data:'' A full-rank basis <math> B \in \mathbb{Z}^{(n,n)}</math> <br />
| |
| ''Result:'' '''true''' and <math> \textbf{q} </math>, if <math> B </math> spans an ideal lattice with respect to <math> \textbf{q} </math>, otherwise '''false'''.
| |
| | |
| # Transform <math> B </math> into [[Hermite normal form|HNF]]
| |
| # Calculate <math> A = {\rm adj}(B) </math>, <math> d = \det(B) </math>, and <math> z = B_{(n,n)} </math>
| |
| # Calculate the product <math> P = AMB \bmod \ d </math>
| |
| # '''if''' ''only the last column of P is non-zero'' '''then'''
| |
| # set <math> c = P_{(\centerdot,n)} </math> to equal this column
| |
| # '''else return false'''
| |
| # '''if''' <math> z \mid c_i </math> for <math> i = 1, \dots , n </math> '''then'''
| |
| # use [[Chinese remainder theorem|CRT]] to find <math> q^ \ast \equiv \ (c/z) \bmod \ (d/z) </math> and <math> q^ \ast \equiv 0 \bmod \ z </math>
| |
| # '''else return false'''
| |
| # '''if''' <math> Bq^ \ast \equiv 0 \bmod \ (d/z) </math> '''then'''
| |
| # '''return true''', <math> q = Bq^ \ast /d </math>
| |
| # '''else return false'''
| |
| | |
| where the matrix M is
| |
| | |
| :<math> M = \begin{pmatrix}
| |
| 0 & . & . & . & 0 \\
| |
| & & & & . \\
| |
| & & & & . \\
| |
| I_{n-1} & & & & . \\
| |
| & & & & 0
| |
| \end{pmatrix}</math>
| |
| | |
| Using this algorithm, it can be seen that many lattices are not ''ideal lattices''. For example let <math> n = 2 </math> and <math> k \in \mathbb{Z} \setminus \lbrace 0, \pm 1 \rbrace </math>, then
| |
| :<math> B_1 = \begin{pmatrix}
| |
| k & 0 \\
| |
| 0 & 1
| |
| \end{pmatrix}</math>
| |
| is ideal, but
| |
| :<math> B_2 = \begin{pmatrix}
| |
| 1 & 0 \\
| |
| 0 & k
| |
| \end{pmatrix}</math>
| |
| is not. <math> B_2 </math> with <math> k = 2 </math> is an example given by Lyubashevsky and Micciancio.<ref name="LyubMic2006">Lyubashevsky, V., Micciancio, D. [http://cseweb.ucsd.edu/users/vlyubash/papers/generalknapsackfull.pdf Generalized compact knapsacks are collision resistant.]. In ''CBugliesi, M., Preneel, B., Sassone, V., Wegener, I. (eds.) ICALP 2006. LNCS, vol. 4052, pp. 144–155. Springer, Heidelberg (2006)''.</ref>
| |
| | |
| Performing the algorithm on it and referring to the basis as B, matrix B is already in [[Hermite normal form|Hermite Normal Form]] so the first step is not needed. The determinant is <math> d = 2 </math>, the [[adjugate matrix]]
| |
| :<math> A = \begin{pmatrix}
| |
| 2 & 0 \\
| |
| 0 & 1
| |
| \end{pmatrix},</math>
| |
| :<math> M = \begin{pmatrix}
| |
| 0 & 0 \\
| |
| 1 & 0
| |
| \end{pmatrix}</math>
| |
| and finally, the product <math> P = AMB \bmod d </math> is | |
| :<math> P = \begin{pmatrix}
| |
| 0 & 0 \\
| |
| 1 & 0
| |
| \end{pmatrix}.</math>
| |
| | |
| At this point the algorithm stops, because all but the last column of <math> P </math> have to be zero if <math> B </math> would span an ''ideal lattice''.
| |
| | |
| ==Use in cryptography==
| |
| Micciancio<ref name="Mic2007">Micciancio, D. [http://www.springerlink.com/content/g11573q628x12970/fulltext.pdf Generalized compact knapsacks, cyclic lattices, and efficient oneway functions.]. In ''Computational Complexity 16(4), 365–411 (2007)''.</ref> introduced the class of structured cyclic lattices, which correspond to ideals in [[polynomial ring]]s <math> \mathbb{Z}[x]/(x^n-1)</math>, and presented the first provably secure one-way function based on the worst-case [[Hardness of approximation|hardness]] of the restriction of ''Poly(n)''-SVP to cyclic lattices. (The problem ''γ''-SVP consists in computing a non-zero vector of a given lattice, whose norm is no more than ''γ'' times larger than the norm of a shortest non-zero lattice vector.) At the same time, thanks to its algebraic structure, this one-way function enjoys high efficiency comparable to the [[NTRUEncrypt|NTRU]] scheme <math> \tilde{O}(n) </math> evaluation time and storage cost). Subsequently, Lyubashevsky and Micciancio<ref name="LyubMic2006"/> and independently Peikert and Rosen<ref name="PeiRos2006">Peikert, C., Rosen, A. [http://www.cc.gatech.edu/~cpeikert/pubs/cyclic-crh.pdf Efficient collision-resistant hashing from worst-case assumptions on cyclic lattices.]. In ''Halevi, S., Rabin, T. (eds.) TCC 2006. LNCS, vol. 3876, pp. 145–166. Springer, Heidelberg (2006)''.</ref> showed how to modify Micciancio’s function to construct an efficient and provably secure [[Collision resistance|collision resistant]] [[Cryptographic hash function|hash function]]. For this, they introduced the more general class of ''ideal lattices'', which correspond to [[Ideal (ring theory)|ideals]] in [[polynomial ring]]s <math> \mathbb{Z}[x]/f(x)</math>. The [[collision resistance]] relies on the hardness of the restriction of Poly(n)-SVP to ''ideal lattices'' (called ''Poly(n)''-Ideal-SVP). The average-case collision-finding problem is a natural computational problem called Ideal-SIS, which has been shown to be as hard as the worst-case instances of Ideal-SVP. Provably secure efficient signature schemes from ''ideal lattices'' have also been proposed,<ref name="Lyubattacks2008"/><ref name="MicLyubAsympt2008">Vadim Lyubashevsky and Daniele Micciancio. [http://www.iacr.org/archive/tcc2008/49480032/49480032.pdf Asymptotically efficient lattice-based digital signatures]. In ''Proceedings of the 5th conference on Theory of cryptography'', 2008.</ref> but constructing efficient provably secure [[Public-key cryptography|public key encryption]] from ''ideal lattices'' was an interesting [[open problem]].
| |
| | |
| ===Efficient collision resistant hash functions===
| |
| The main usefulness of the ''ideal lattices'' in [[cryptography]] stems from the fact that very efficient and practical [[Collision resistance|collision resistant]] [[Cryptographic hash function|hash functions]] can be built based on the hardness of finding an approximate [[Lattice problem|shortest vector]] in such lattices.<ref name="Lyubattacks2008"/>
| |
| Independently constructed [[Collision resistance|collision resistant]] [[Cryptographic hash function|hash functions]] by Peikert and Rosen,<ref name="PeiRos2006"/> and Lyubashevsky and Micciancio based on ''ideal lattices'' (a generalization of cyclic lattices), and provided a fast and practical implementation.<ref name="LyubPeiReg2010"/> These results paved the way for other efficient cryptographic constructions including identification schemes and signatures.
| |
| | |
| Lyubashevsky and Micciancio<ref name="LyubMic2006"/> gave constructions of efficient [[Collision resistance|collision resistant]] [[Cryptographic hash function|hash functions]] that can be proven secure based on worst case hardness of the [[Lattice problem|shortest vector problem]] for ''ideal lattices''. They defined [[Cryptographic hash function|hash function]] families as: Given a [[Ring (mathematics)|ring]] <math>R = \mathbb{Z}_p[x]/\langle f \rangle </math>, where <math> f \in \mathbb{Z}_p[x] </math> is a monic, [[irreducible polynomial]] of degree <math> n </math> and <math> p </math> is an integer of order roughly <math> n^2 </math>, generate <math> m </math> random elements <math> a_1, \dots , a_m \in R </math>, where <math> m </math> is a constant. The ordered <math> m </math>-tuple <math> h = (a_1, \ldots, a_m) \in R^m </math> determines the hash function. It will map elements in <math> D^m </math>, where <math> D </math> is a strategically chosen subset of <math> R </math>, to <math> R </math>. For an element <math> b = (b_1, . . . , b_m) \in D^m </math>, the hash is <math> h(b) = \sum_{i=1}^{m}\alpha_i \centerdot b_i</math>. Here the size of the key (the [[Cryptographic hash function|hash function]]) is <math> O(mn \log p) = O(n \log n)</math>, and the operation <math> \alpha_i \centerdot b_i </math> can be done in time <math> O(n \log n \log \log n) </math> by using the [[Fast Fourier transform|Fast Fourier Transform (FFT)]], for appropriate choice of the polynomial <math> f </math>. Since <math> m </math> is a constant,
| |
| hashing requires time <math> O(n \log n \log \log n)</math>. They proved that the [[Cryptographic hash function|hash function]] family is [[Collision resistance|collision resistant]] by showing that there is a [[Polynomial time|polynomial-time algorithm]] that succeeds with non-negligible probability in finding <math> b \neq b' \in D^m </math> such that
| |
| <math> h(b) = h(b') </math>, for a randomly chosen [[Cryptographic hash function|hash function]] <math> h \in R^m </math>, then a certain
| |
| problem called the “[[Lattice problem|shortest vector problem]]” is solvable in [[polynomial time]] for every [[Ideal (ring theory)|ideal]] of the [[Ring (mathematics)|ring]] <math> \mathbb{Z}[x]/\langle f \rangle </math>.
| |
| | |
| Based on the work of Lyubashevsky and Micciancio in 2006, Micciancio and Regev<ref name="MicRegLBC2009">Daniele Micciancio, Oded Regev [http://www.cs.tau.ac.il/~odedr/papers/pqc.pdf Lattice-based Cryptography]. In ''POST-QUANTUM CRYPTOGRAPHY'', 2009.</ref> defined the following algorithm of [[Cryptographic hash function|hash functions]] based on ''ideal lattices'':
| |
| | |
| * '''Parameters:''' Integers <math> q, n, m, d </math> with <math> n \mid m </math>, and vector '''f''' <math> \in \mathbb{Z}^n </math>.
| |
| * '''Key:''' <math> m/n </math> vectors <math> a_1, ... , a_{m/n} </math> chosen independently and uniformly at random in <math> \mathbb{Z}_q^n </math>.
| |
| * '''Hash function:''' <math> f_A : \lbrace 0, ... , d-1 \rbrace ^m \longrightarrow \mathbb{Z}_q^n </math> given by <math> f_A(y)= [F \ast a_1 | . . . | F \ast a_{m/n}]y \bmod \ q </math>.
| |
| | |
| Here <math> n,m,q,d </math> are parameters, '''f''' is a vector in <math> \mathbb{Z}^n </math> and <math> A </math> is a block-matrix with structured blocks <math> A^{(i)} = F \ast a^{(i)}</math>.
| |
| | |
| Finding short vectors in <math> \Lambda_q^{\perp} ([F \ast a_1 | . . . | F \ast a_{m/n}])</math> on the average (even with just inverse polynomial
| |
| probability) is as hard as solving various lattice problems (such as approximate [[Lattice problem|SVP]] and SIVP) in the worst
| |
| case over ''ideal lattices'', provided the vector '''f''' satisfies the following two properties:
| |
| * For any two unit vectors '''u''', '''v''', the vector '''[F∗u]v''' has small (say, polynomial in <math> n </math>, typically <math> O(\sqrt{n}))</math> norm.
| |
| * The polynomial <math> f(x) = x^n+f_n x^{n-1}+...+f_1 \in \mathbb{Z}[x] </math> is [[Irreducible polynomial|irreducible]] over the integers, i.e., it does not factor into the product of integer polynomials of smaller degree.
| |
| | |
| The first property is satisfied by the vector '''f''' = <math> (-1,0, . . . ,0) </math> corresponding to [[Circulant matrix|circulant matrices]],
| |
| because all the coordinates of '''[F∗u]v''' are bounded by 1, and hence <math> \lVert [\textbf{F} \ast \textbf{u}]\textbf{v} \rVert \leq{\sqrt{n}} </math>. However, the polynomial <math> x^n-1 </math> corresponding to '''f''' = <math> (-1,0, . . . ,0) </math> is not [[Irreducible polynomial|irreducible]] because it factors into <math> (x-1)(x^{n-1}+x^{n-2}+\cdots+ x + 1)</math>, and this is why collisions can be efficiently found. So, '''f''' = <math> (-1,0, . . . ,0) </math> is not a good choice to get [[Collision resistance|collision resistant]] [[Cryptographic hash function|hash functions]], but many other choices are possible. For example, some choices of '''f''' for which both properties are satisfied (and therefore, result in [[Collision resistance|collision resistant]] [[Cryptographic hash function|hash functions]] with worst-case security guarantees) are
| |
| * '''f''' = <math> (1, . . . ,1) \in \mathbb{Z}^n </math> where <math> n + 1 </math> is prime, and
| |
| * '''f''' = <math> (1,0, . . . ,0) \in \mathbb{Z}^n </math> for <math> n </math> equal to a power of 2.
| |
| | |
| ===Digital signatures===
| |
| [[Digital signature]]s schemes are among the most important cryptographic primitives. They can be obtained by using the one-way functions based on the worst-case [[Hardness of approximation|hardness]] of lattice problems. However, they are impractical. The most recent efficient scheme was provided by Lyubashevsky and Micciancio.<ref name="MicRegLBC2009"/>
| |
| | |
| Their direct construction of [[digital signature]]s based on the complexity of approximating the shortest vector in ideal (e.g., cyclic) lattices.<ref name="MicLyubAsympt2008"/> The scheme of Lyubashevsky and Micciancio<ref name="MicLyubAsympt2008"/> has worst-case security guarantees based on ideal lattices and it is the most asymptotically efficient construction known to date, yielding signature generation and verification algorithms that run in almost [[linear time]].<ref name="MicRegLBC2009"/>
| |
| | |
| One of the main open problems that was raised by their work is constructing a one-time signature with similar efficiency, but based on a weaker [[Hardness of approximation|hardness]] assumption. For instance, it would be great to provide a one-time signature with security based on the [[Hardness of approximation|hardness]] of approximating the [[Lattice problem|Shortest Vector Problem (SVP)]] (in ''ideal lattices'') to within a factor of <math> \tilde{O}(n) </math>.<ref name="MicLyubAsympt2008"/>
| |
| | |
| Their construction is based on a standard transformation from one-time signatures (i.e. signatures that allow to securely sign a single message) to general signature schemes, together with a novel construction of a lattice based one-time signature whose security is ultimately based on the worst-case [[Hardness of approximation|hardness]] of approximating the [[Lattice problem|shortest vector]] in all lattices corresponding to [[Ideal (ring theory)|ideals]] in the [[Ring (mathematics)|ring]] <math> \mathbb{Z}[x]/\langle f \rangle </math> for any [[irreducible polynomial]] <math> f </math>.
| |
| | |
| '''Key-Generation Algorithm:'''
| |
| ''Input'': <math> 1^n</math>, [[irreducible polynomial]] <math> f \in \mathbb{Z} </math> of degree <math> n</math>.
| |
| # Set <math> p \longleftarrow (\phi n)^3 </math>, <math> m \longleftarrow \lceil \log n \rceil </math>, <math> R \longleftarrow \mathbb{Z}_p[x]/\langle f \rangle </math>
| |
| # For all positive <math> i </math>, let the sets <math> DK_i </math> and <math> DL_i </math> be defined as:
| |
| :<math> DK_i = \lbrace \hat{y} \in R^m </math> such that <math> \lVert \hat{y} \rVert_\infty \leq 5ip^{1/m} \rbrace </math>
| |
| :<math> DL_i = \lbrace \hat{y} \in R^m </math> such that <math>\lVert \hat{y} \rVert_\infty \leq 5in \phi p^{1/m} \rbrace </math>
| |
| # Choose uniformly random <math> h \in \mathcal{H}_{R,m} </math>
| |
| # Pick a uniformly random string <math> r \in \lbrace 0, 1 \rbrace^{\lfloor \log^2n \rfloor} </math>
| |
| # '''If''' <math> r = 0^{\lfloor \log^2n \rfloor} </math> '''then'''
| |
| # Set <math> j = \lfloor \log^2n \rfloor </math>
| |
| # '''else'''
| |
| # Set <math> j </math> to the position of the first 1 in the string <math> r </math>
| |
| # '''end if'''
| |
| # Pick <math> \hat{k} , \hat{l}</math> independently and uniformly at random from <math> DK_j </math> and <math> DL_j </math> respectively
| |
| # Signing Key: <math> (\hat{k} , \hat{l})</math>. Verification Key: <math> (h,h(\hat{k}) , h(\hat{l})) </math>
| |
| | |
| '''Signing Algorithm:'''
| |
| | |
| ''Input:'' Message <math> z \in R </math> such that <math> \lVert z \rVert_\infty \leq 1 </math>; signing key <math> (\hat{k} , \hat{l})</math>
| |
| | |
| ''Output:'' <math> \hat{s} \longleftarrow \hat{k}z + \hat{l} </math>
| |
| | |
| '''Verification Algorithm:'''
| |
| | |
| ''Input:'' Message <math> z </math>; signature <math> \hat{s} </math>; verification key <math> (h,h(\hat{k}) , h(\hat{l})) </math>
| |
| | |
| ''Output:'' “ACCEPT”, if <math> \lVert \hat{s} \rVert_\infty \leq 10 \phi p^{1/m}n \log^2n </math> and <math> \hat{s} = \hat{k}z + \hat{l} </math>
| |
| | |
| “REJECT”, otherwise.
| |
| | |
| ===The SWIFFT hash function===
| |
| The [[Cryptographic hash function|hash function]] is quite efficient and can be computed asymptotically in <math> \tilde{O}(m) </math> time using the [[Fast Fourier transform|Fast Fourier Transform (FFT)]] over the [[complex number]]s. However, in practice, this carries a substantial overhead. The [[SWIFFT]] family of [[Cryptographic hash function|hash functions]] defined by Micciancio and Regev<ref name="MicRegLBC2009"/> is essentially a highly optimized variant of the [[Cryptographic hash function|hash function]] above using the [[Fast Fourier transform|(FFT)]] in <math> \mathbb{Z}_q</math>. The vector '''f''' is set to <math> (1, 0,\dots , 0) \in \mathbb{Z}^n </math> for <math> n </math> equal to a power of 2, so that the corresponding polynomial <math> x^n + 1 </math> is [[Irreducible polynomial|irreducible]].
| |
| Let <math> q </math> be a [[prime number]] such that <math>2n</math> divides <math> q-1 </math>, and let <math> \textbf{W} \in \mathbb{Z}^{n \times n}_{q}</math> be an [[invertible matrix]] over <math> \mathbb{Z}_q </math> to be chosen later. The [[SWIFFT]] [[Cryptographic hash function|hash function]] maps a key <math>\tilde{a}^{(1)} , ... , \tilde{a}^{(m/n)}</math> consisting of <math> m/n </math> vectors chosen uniformly from <math> \mathbb{Z}^{n}_{q} </math> and an input <math> y \in \lbrace 0, . . . , d-1 \rbrace^m </math> to <math> \textbf{W}^{\centerdot} f_A(y) \bmod \ q </math> where <math> \textbf{A} = [ \textbf{F} \ast \alpha^{(1)}, \ldots, \textbf{F} \ast \alpha^{(m/n)} ] </math> is as before and <math> \alpha^{(i)} = \textbf{W}^{-1} \tilde{a}^{(i)} \ mod \ q </math>.
| |
| Multiplication by the [[invertible matrix]] <math> \textbf{W}^{-1} </math> maps a uniformly chosen <math> \tilde{a} \in \mathbb{Z}^{n}_{q} </math> to a uniformly chosen <math> \alpha \in \mathbb{Z}^{n}_{q} </math>. Moreover, <math> \textbf{W}^{\centerdot} f_A(y)=\textbf{W}^{\centerdot} f_A(y') \ (mod \ q) </math> if and only if <math> f_A(y)= f_A(y') \ (mod \ q) </math>.
| |
| Together, these two facts establish that finding collisions in [[SWIFFT]] is equivalent to finding [[Collision (computer science)|collisions]] in the underlying ''ideal lattice'' function <math> f_A </math>, and the claimed [[collision resistance]] property of [[SWIFFT]] is supported by the connection to worst case [[lattice problem]]s on ''ideal lattices''.
| |
| | |
| The algorithm of the SWIFFT hash function is:
| |
| * '''Parameters:''' Integers <math> n, m, q, d </math> such that <math> n </math> is a power of 2, <math> q </math> is prime, <math> 2n \mid (q-1)</math> and <math> n \mid m </math>.
| |
| * '''Key:''' <math> m/n </math> vectors <math> \tilde{a}_1, ... , \tilde{a}_{m/n} </math> chosen independently and uniformly at random in <math> \mathbb{Z}_q^n </math>.
| |
| * '''Input:''' <math> m/n </math> vectors <math> y^{(1)}, \dots , y^{(m/n)} \in \lbrace 0, \dots , d-1 \rbrace ^n </math>.
| |
| * '''Output:''' the vector <math> \sum_{i=1}^{m/n} \tilde{a}^{(i)} \odot (\textbf{W}y^{(i)}) \in \mathbb{Z}_q^n </math>, where <math> \odot </math> is the component-wise vector product.
| |
| | |
| ===Learning with errors (LWE)===
| |
| | |
| ====Ring-LWE====
| |
| [[Learning with errors|Learning with errors (LWE) ]] problem has been shown to be as hard as worst-case lattice problems and has served as the foundation for plenty of cryptographic applications. However, these applications are inefficient because of an inherent quadratic overhead in the use of [[Learning with errors|LWE]]. To get truly efficient [[Learning with errors|LWE]] applications, Lyubashevsky, Peikert and Regev<ref name="LyubPeiReg2010"/> defined an appropriate version of the [[Learning with errors|LWE]] problem in a wide class of rings and proved its hardness under worst-case assumptions on ideal lattices in these rings. They called their [[Learning with errors|LWE]] version ring-LWE.
| |
| | |
| Let <math> f(x)= x^n+1 \in \mathbb{Z}[x] </math>, where the security parameter <math> n </math> is a power of 2, making <math> f(x) </math> irreducible over the rationals. (This particular <math> f(x) </math> comes from the family of [[cyclotomic polynomial]]s, which play a special role in this work).
| |
| | |
| Let <math> R= \mathbb{Z}[x]/\langle f(x) \rangle </math> be the ring of integer polynomials modulo <math> f(x) </math>. Elements of <math> R </math> (i.e., residues modulo <math> f(x) </math>) are typically represented by integer polynomials of degree less than <math> n </math>. Let <math> q \equiv 1 \bmod 2n </math> be a sufficiently large public prime modulus (bounded by a polynomial in <math> n </math>), and let <math> R_q = R/\langle q \rangle = \mathbb{Z}_q[x]/\langle f(x) \rangle </math> be the ring of integer polynomials modulo both <math> f(x) </math> and <math> q </math>. Elements of <math> R_q </math> may be represented by polynomials of degree less than <math> n </math>-whose coefficients are from <math> \lbrace 0 , \dots , q-1 \rbrace </math>.
| |
| | |
| In the above-described ring, the R-LWE problem may be described as follows.
| |
| Let <math> s = s(x) \in R_q </math> be a uniformly random ring element, which is kept secret. Analogously to standard LWE, the goal of the attacker is to distinguish arbitrarily many (independent) ‘random noisy ring equations’ from truly uniform ones. More specifically, the noisy equations are of the form <math> (a, b \approx a \centerdot s) \in R_q \times R_q </math>, where a is uniformly random and the product <math> a \centerdot s </math> is perturbed by some ‘small’ random error term, chosen from a certain distribution over <math> R </math>.
| |
| | |
| They gave a quantum reduction from approximate [[Lattice problem|SVP]] (in the worst case) on ideal lattices in <math> R </math> to the search version of ring-LWE, where the goal is to recover the secret <math> s \in R_q </math> (with high probability, for any <math> s </math>) from arbitrarily many noisy products. This result follows the general outline of Regev’s iterative quantum reduction for general lattices,<ref name="Reg2010">
| |
| Oded Regev. [http://www.cs.tau.ac.il/~odedr/papers/qcrypto.pdf On lattices, learning with errors, random linear codes, and cryptography ]. In ''Journal of the ACM'', 2009.</ref> but ideal lattices introduce several new technical roadblocks in both the ‘algebraic’ and ‘geometric’ components of the reduction. They<ref name="LyubPeiReg2010"/> used algebraic number theory, in particular, the canonical embedding of a number field and the [[Chinese remainder theorem|Chinese Remainder Theorem]] to overcome these obstacles. They got the following theorem:
| |
| | |
| '''Theorem''' Let <math> K </math> be an arbitrary number field of degree <math> n </math>. Let <math> \alpha = \alpha (n) \in (0, 1) </math> be arbitrary, and let the (rational) integer modulus <math> q = q(n) \geq 2 </math> be such that <math> \alpha \centerdot q \geq \omega (\sqrt{log n}) </math>. There is a probabilistic polynomial-time quantum reduction from <math> K </math>-<math> DGS_\gamma </math> to <math> \mathcal{O}_K </math>- <math> LWE_{q, \Psi \leq \alpha} </math>, where <math> \gamma = \eta_\epsilon(I) \centerdot \omega(\sqrt{log n})/\alpha </math>.
| |
| | |
| ====Ideal-LWE====
| |
| Stehle, Steinfeld, Tanaka and Xagawa<ref name="stehle2009">
| |
| Damien Stehlé, Ron Steinfeld, Keisuke Tanaka and Keita Xagawa. [http://eprint.iacr.org/2009/285.pdf Efficient public key encryption based on ideal lattices]. In ''Lecture Notes in Computer Science'', 2009.</ref> defined a structured variant of LWE problem (Ideal-LWE) to describe an efficient public key encryption scheme based on the worst case hardness of the approximate [[Lattice problem|SVP]] in ideal lattices. This is the first CPA-secure public key encryption scheme whose security relies on the hardness of the worst-case instances of <math> \tilde{O}(n^2) </math>-Ideal-SVP against subexponential quantum attacks. It achieves asymptotically optimal efficiency: the public/private key length is <math> \tilde{O}(n) </math> bits and the amortized encryption/decryption cost is <math> \tilde{O}(1) </math> bit operations per message bit (encrypting <math> \tilde{\Omega}(n) </math> bits at once, at a <math> \tilde{O}(n) </math> cost). The security assumption here is that <math> \tilde{O}(n^2) </math>-Ideal-SVP cannot be solved by any subexponential time quantum algorithm. It is noteworthy that this is stronger than standard [[Public-key cryptography|public key cryptography]] security assumptions. On the other hand, contrary to the most of [[Public-key cryptography|public key cryptography]], [[lattice-based cryptography]] allows security against subexponential quantum attacks.
| |
| | |
| Most of the cryptosystems based on general lattices rely on the average-case hardness of the [[Learning with errors|Learning with errors (LWE)]]. Their scheme is based on a structured variant of LWE, that they call Ideal-LWE. They needed to introduce some techniques to circumvent two main difficulties that arise from the restriction to ideal lattices. Firstly, the previous cryptosystems based on unstructured lattices all make use of Regev’s worst-case to average-case classical reduction from Bounded Distance Deconding problem (BDD) to [[Learning with errors|LWE]] (this is the classical step in the quantum reduction from [[Lattice problem|SVP]] to [[Learning with errors|LWE]]). This reduction exploits the unstructured-ness of the considered lattices, and does not seem to carry over to the structured lattices involved in Ideal-LWE. In particular, the probabilistic independence of the rows of the LWE matrices allows to consider a single row. Secondly, the other ingredient used in previous cryptosystems, namely Regev’s reduction from the computational variant of [[Learning with errors|LWE]] to its decisional variant, also seems to fail for Ideal-LWE: it relies on the probabilistic independence of the columns of the [[Learning with errors|LWE]] matrices.
| |
| | |
| To overcome these difficulties, they avoided the classical step of the reduction. Instead, they used the quantum step to construct a new quantum average-case reduction from SIS (average-case collision-finding problem) to [[Learning with errors|LWE]]. It also works from Ideal-SIS to Ideal-LWE. Combined with the reduction from worst-case Ideal-SVP to average-case Ideal-SIS, they obtained the a quantum reduction from Ideal-SVP to Ideal-LWE. This shows the hardness of the computational variant of Ideal-LWE. Because they did not obtain the hardness of the decisional variant, they used a generic hardcore function to derive pseudorandom bits for encryption. This is why they needed to assume the exponential hardness of [[Lattice problem|SVP]].
| |
| | |
| ===Fully homomorphic encryption===
| |
| An encryption <math> \varepsilon </math> is homomorphic for circuits in <math> \mathcal{C}_\varepsilon </math> if <math> \varepsilon </math> is correct for <math> \mathcal{C}_\varepsilon </math> and <math> Decrypt_\varepsilon </math> can be expressed as a circuit <math> Decrypt_\varepsilon </math> of size <math> poly( \lambda ) </math>. <math> \varepsilon </math> is fully homomorphic if it is homomorphic for all circuits. A fully [[Homomorphic Encryption|homomorphic encryption]] scheme is the one which allows one to evaluate circuits over encrypted data without being able to decrypt. Gentry<ref>Craig Gentry. [http://portal.acm.org/citation.cfm?id=1536414.1536440 Fully Homomorphic Encryption Using Ideal Lattices]. In ''the 41st ACM Symposium on Theory of Computing (STOC)'', 2009.</ref> proposed a solution to the problem of constructing a fully [[Homomorphic Encryption|homomorphic encryption]] scheme, which was introduced by Rivest, Adleman and Dertouzos<ref>R. Rivest, L. Adleman, and M. Dertouzos. [On data banks and privacy homomorphisms.]. In ''In Foundations of Secure Computation,'' pp. 169–180, 1978.</ref> shortly after the invention of [[RSA (algorithm)|RSA]] by Rivest, Adleman and Shamir<ref>R. Rivest, A. Shamir, and L. Adleman. [A method for obtaining digital signatures and public-key cryptosystems.]. In ''Comm. of the ACM,''21:2, pages 120–126, 1978.</ref> in 1978. His scheme was based on ideal lattices.
| |
| | |
| ==See also==
| |
| *[[Lattice-based cryptography]]
| |
| *[[Homomorphic Encryption]]
| |
| | |
| == References ==
| |
| <references/>
| |
| | |
| [[Category:Number theory]]
| |
| [[Category:Lattice-based cryptography]]
| |