Lattice-Based Cryptography: From Practice to Theory to Practice Vadim Lyubashevsky INRIA / CNRS / ENS Paris (September 12, 2011)

La Cryptographie Reposant sur les Réseaux: de la Pratique à la Théorie à la Pratique Vadim Lyubashevsky INRIA / CNRS / ENS Paris (Septembre 12, 2011)

Lattice-Based Encryption Schemes 1.NTRU [Hoffstein, Pipher, Silverman ‘98] 2.LWE-Based [Regev ‘05] 3.Ring-LWE Based [L, Peikert, Regev ’10] 4.“NTRU-like” with a proof of security [Stehle, Steinfeld ‘11]

Cryptosystèmes Reposant sur les Réseaux 1.NTRU [Hoffstein, Pipher, Silverman ‘98] 2.Reposant sur LWE [Regev ‘05] 3.Reposant sur Anneau-LWE [L, Peikert, Regev ’10] 4.“NTRU” avec une preuve de la sécurité [Stehle, Steinfeld ‘11]

Subset Sum Problem Subset-Sum Based [L, Palacio, Segev ‘10] LWE-Based [Regev ‘05] Ring-LWE Based [L, Peikert, Regev ’10] “NTRU-like” with a proof of security [Stehle, Steinfeld ‘11] NTRU [Hoffstein, Pipher, Silverman ‘98]

Part 0. The Subset Sum Problem

a i, T in Z M a i are chosen randomly T is a sum of a random subset of the a i a 1 a 2 a 3 … a n T Find a subset of a i 's that sums to T (mod M) Subset Sum Problem

a i, T in Z 49 a i are chosen randomly T is a sum of a random subset of the a i = 11 (mod 49) Subset Sum Problem

How Hard is Subset Sum? a i, T in Z M a 1 a 2 a 3 … a n T Find a subset of a i 's that sums to T (mod M) Hardness Depends on: Size of n and M Relationship between n and M

Complexity of Solving Subset Sum M run-time 2 log²(n) 2n2n 2 n log(n) 2 n² poly(n)2 Ω(n) poly(n) “generalized birthday attacks” [FlaPrz05,Lyu06,Sha08] “lattice reduction attacks” [LagOdl85,Fri86]

Subset Sum Crypto Why?  Simple operations  Exponential hardness  Seems very different from number theoretic assumptions  Seems to resist quantum attacks

Subset Sum is “Pseudorandom” [Impagliazzo-Naor 1989]: For random a 1,...,a n in Z M and random x 1,...,x n in {0,1} distinguishing the distribution (a 1,...,a n, a 1 x a n x n mod M) from the uniform distribution U(Z M n+1 ) is as hard as finding x 1,...,x n

Part 1. Cryptosystem Based on Subset Sum [L, Palacio, Segev 2010]

Public Key Encryption Allows for secure communication between parties who have previously never met

Public Key Encryption public key: p secret key: s Encrypt, Decrypt Decrypt(s,Encrypt(p,M))=M c=Encrypt(p,M) M=Decrypt(s,c)

Public Key Encryption c=Encrypt(p,M) What does “secure” mean? Intuitive answer: The adversary should not be able to read the message.

Public Key Encryption c=Encrypt(p,M), c=Encrypt(p,M) What does “secure” mean? Intuitive answer: The adversary should not be able to read the message. But what about other information about the message? E.g. If adversary can figure out that the same message was sent twice, is the scheme “secure”?

Public Key Encryption What does “secure” mean? Semantic Security: For every 2 messages M, M', it's impossible to distinguish Encrypt(p,M) from Encrypt(p,M') in polynomial time The Encrypt algorithm must be randomized!

Subset Sum Cryptosystem Semantically secure based on Subset Sum for M ≈ n n Main tools Subset sum is pseudo-random Addition in (Z q ) n is “kind of like” addition in Z M where M=q n The proof is very simple

Facts About Addition Want to add mod Adding n numbers (written in base q) modulo q m → carries < n If q>>n, then Adding with carries ≈ Adding without carries (i.e. in Z M ) (i.e. in (Z q ) n )

So = = NOT Pseudorandom! Pseudorandom based on Subset Sum!

Column Subset Sum Addition Is Also Pseudorandom =

“Hybrid” Subset Sum Addition Is Also Pseudorandom = pseudorandom

Encryption Scheme (for 1 bit) A st =+ A t r + uv = Public Key {0,1} n Z q n x n

Encryption Scheme A st =+ A t r + uv = Is pseudo-random based on the hardness of the subset sum problem

Encryption Scheme A st =+ A t r + uv = v As + r + As r As r + As = =

A st =+ A t r + uv = u s A r s = + A r s + = ≈ v

u s v - = A st =+ A t r + uv = Encryption of 0

u s - = Encryption Scheme A st =+ A t r + uv = Encryption of u = + q/2 v’

Part 2. Cryptosystem Based on Learning With Errors and Worst-Case Lattice Problems [Regev 2005]

Encryption Scheme (what we needed) A st =+ A t r + uv = Pseudorandom “small”

Picking the “Carries” In Subset Sum: carries were deterministic What if … we pick the “carries” at random from some distribution?

So = Pseudorandom based on Subset Sum! = Pseudorandom based on LWE and worst-case lattice problems [Reg ‘05] (with a lemma from [ACPS ‘09])

Given a i and + e i find s. (e i and s are “small”) (Once there are enough a i, the s is uniquely determined) Theorem [Regev '05] : There is a polynomial-time quantum reduction from solving certain lattice problems in the worst-case to solving LWE. Learning With Errors (LWE) Problem... a1a1 a2a2 amam s + e = b

Decision LWE Problem... a1a1 a2a2 s + e = b World 1... a2a2 a1a1 amam b uniformly random in Z p m World 2 Lemma[Reg ’05]: Search-LWE < Decision-LWE amam

LWE vs. Subset Sum The Subset Sum assumption has deterministic “noise” The LWE assumption is more “versatile”... a1a1 a2a2 amam s + e = b LWE Problem n2n2 n s += b Subset Sum Problem n2n2 n a2a2 a1a1 anan …

LWE / Subset Sum Encryption A st =+ A t r + uv = n-bit EncryptionHaveWant Public Key SizeÕ(n) / Õ(n 2 )O(n) Secret Key SizeÕ(n) / Õ (n 2 )O(n) Ciphertext ExpansionÕ(n) / Õ (1)O(1) Encryption TimeÕ(n 3 ) / Õ (n 2 )O(n) Decryption TimeÕ(n 2 )O(n)

Part 3. Cryptosystem Based on Learning With Errors over Rings and Worst-Case Ideal Lattice Problems [L, Peikert, Regev 2010]

Source of Inefficiency of LWE * += 1 Getting just one extra random-looking number requires n random numbers and a small error element. Wishful thinking: get n random numbers and produce n pseudo-random numbers in “one shot” * +=

Use Polynomials f(x) is a polynomial x n + a n-1 x n-1 + … + a 1 x + a 0 R = Z p [x]/(f(x)) is a polynomial ring with Addition mod p Polynomial multiplication mod p and f(x) Each element of R consists of n elements in Z p In R: small+small = small small*small = small (depending on f(x) )

Polynomial Interpretation of the LWE-based cryptosystem astrau rtv vus ++ + == = - rt + ra + s ras + + ra + s r + s =- - -= Public Key

Security astrau rtv ++ + == = Pseudorandom??

Learning With Errors over Rings a1a1 a2a2 a3a3 … amam s b1b1 b2b2 b3b3 … bmbm + = e1e1 e2e2 e3e3 … emem Theorem [LPR ‘10]: Finding s is as hard as solving lattice problems in all ideals of the ring Z[x]/(f(x))

Decision Learning With Errors over Rings a1a1 a2a2 a3a3 … amam s b1b1 b2b2 b3b3 … bmbm + = a1a1 a2a2 a3a3 … amam b1b1 b2b2 b3b3 … bmbm Theorem [LPR ‘10]: In cyclotomic rings, Search-RLWE < Decision-RLWE World 1World 2

Use Polynomials in Z p [x]/(f(x)) astrau rtv ++ + == = n-bit EncryptionFrom LWE / SSFrom Ring-LWE Public Key SizeÕ(n) / Õ(n 2 )Õ(n) Secret Key SizeÕ(n) / Õ (n 2 )Õ(n) Ciphertext ExpansionÕ(n) / Õ (1)Õ(1) Encryption TimeÕ(n 3 ) / Õ (n 2 )Õ(n) Decryption TimeÕ(n 2 )Õ(n)

Part 4. 1-Element Cryptosystem Based on Learning With Errors over Rings and Worst-Case Ideal Lattice Problems [Stehle, Steinfeld 2011]

Number of Ring Elements astrau rtv ++ + == = uv + m p 2, Can you have a ciphertext with just 1 ring element? Encryption of m:

Stehle, Steinfeld Cryptosystem f g aar ++ mu 2= ugr ++ m 2 fgg = ug mod 2= mg ug = g m = Uniformly random Pseudorandom based on Ring-LWE mod p “small” coefficients

Part 5. NTRU Cryptosystem [Hoffstein, Pipher, Silverman 1998]

NTRU Cryptosystem f g aar ++ mu 2== “looks” random If a is random, then pseudorandom based on Ring-LWE fg - Very small ugr ++ m 2 fgg = mod p Since f, g are smaller, p can be smaller as well

(Textbook) NTRU Cryptosystem / Trap-Door Function f g a = fg - Very small ugr + m 2 fg = mod p ar + mu 2 = ug mod 2= mg ug = g m

Thanks, eh!