Ulaanbaatar (Mongolia) School of Mathematic and Computer Science, National University of Mongolia.

(1)

September 14-20, 2015

Ulaanbaatar (Mongolia)

School of Mathematic and Computer Science, National University of Mongolia.

Lattice Cryptography

Michel Waldschmidt

Institut de Math´ematiques de Jussieu — Paris VI http://webusers.imj-prg.fr/~michel.waldschmidt/

(2)

SEAMS School 2015

”Number Theory and Applications in Cryptography and Coding Theory”

University of Science, Ho Chi Minh, Vietnam August 31 - September 08, 2015

Course on Lattices and Applicationsby Dung Duong, University of Bielefeld, Khuong A. Nguyen, HCMUT, VNU-HCM Ha Tran, Aalto University

Slides :

http://www.math.uni-bielefeld.de/~dhoang/seams15/

(3)

CIMPA-ICTP School 2016

Lattices and application to cryptography and coding theory

CIMPA-ICTP-VIETNAM

Research School co-sponsored with ICTP Ho Chi Minh, August 1-12, 2016

http://www.cimpa-icpam.org/

http://ricerca.mat.uniroma3.it/users/valerio/hochiminh16.html

Applications :http://students.cimpa.info/login

(4)

Main references

• Jeffrey Hoffstein, Jill Pipher and Joseph H. Silverman : An introduction to mathematical cryptography. Springer

Undergraduate Texts in Mathematics, 2008. Second ed. 2014.

• Wade Trappe and Lawrence C. Washington : Introduction to Cryptography with Coding Theory. Pearson Prentice Hall, 2006.

http://en.bookfi.org/book/1470907

(5)

Further references

• A. K. Lenstra, H. W. Lenstra, Jr., and L. Lovacz :Factoring Polynomials with Rational Coefficients. Math Annalen261 (1982) 515–534.

• Daniele Micciancio & Oded Regev : Lattice-based Cryptography(2008).

http://www.cims.nyu.edu/~regev/papers/pqc.pdf

• Joachim von zur Gathen & J¨urgen Gerhard.Modern Computer Algebra. Cambridge University Press, Cambridge, UK, Third edition (2013).

https://cosec.bit.uni-bonn.de/science/mca/

• Abderrahmane Nitaj : Applications de l’algorithme LLL en cryptographie. Informal notes.

http://math.unicaen.fr/~nitaj/LLLapplic.pdf

(6)

Subgroups of Rⁿ

Examples

Finitely generated or not, finite rank or not

discrete or not, dense or not, closed or not

Classification of closed subgroups of R

Classification of closed subgroups of R², ofRⁿ

(7)

Subgroups of Rⁿ

Examples

(8)

Subgroups of Rⁿ

Examples

(9)

Subgroups of Rⁿ

Examples

(10)

Subgroups of Rⁿ

Examples

(11)

Quotient of Rⁿ by a discrete subgroup

Additive group : C Multiplicative group :C^×

R/Z 'U R−→U t7−→e^2iπt C/Z'C^× C−→C^× z 7−→e^2iπz

Elliptic curve : C/L L=Zω₁+Zω₂ lattice in C'R² Abelian variety :C^g/L L lattice inC^g 'R^2g

Commutative algebraic groups over C.

(12)

(13)

(14)

(15)

(16)

(17)

(18)

Some acronymes

DES : Data Encryption Standard (1977) AES : Advanced Encryption Standard (2000) RSA : Rivest, Shamir, Adelman (1978) LLL : Lenstra, Lenstra, Lovacz (1982)

SVP : Shortest Vector Problem (and approximate versions) CVP : Closest Vector Problem (and approximate versions) SBP : Shortest Basis Problem (and approximate versions)

(19)

Some acronymes

(20)

Some acronymes

(21)

Some acronymes

(22)

Some acronymes

(23)

Some acronymes

(24)

Some acronymes

(25)

Lattice based cryptosystems (∼ 1995)

Ajtai - Dwork

GGH : Goldreich, Goldwasser, Halevi

NTRU : Number Theorists Are Us (Are Useful) Hoffstein, Pipher and Silverman

(26)

Ajtai - Dwork

(27)

Ajtai - Dwork

(28)

An argument of Paul Turan

Theorem (Fermat). An odd prime pis the sum of two squares if and only ifp is congruent to 1 modulo 4.

Proof.

Step 1. For an odd primep, the following conditions are equivalent.

(i)p≡1 (mod 4).

(ii)−1 is a square in the finite field F_p. (iii)−1 is a quadratic residue modulo p

(iv) There exists an integerr such that pdivides r²+ 1.

(29)

Theorem (Fermat). An odd prime pis the sum of two squares if and only ifp is congruent to 1 modulo 4.

Proof.

Step 1. For an odd primep, the following conditions are equivalent.

(i)p≡1 (mod 4).

(ii)−1 is a square in the finite field F_p. (iii)−1 is a quadratic residue modulo p

(iv) There exists an integerr such that pdivides r²+ 1.

(30)

Step 2. If pis a sum of two squares, then pis congruent to 1 modulo4.

(31)

Step 3. Assumep divides r²+ 1. Let L be the lattice with basis(1, r)^T,(0, p)^T. The determinant of L is p.Using Minkowski’s Theorem with the disk of radiusR, we deduce thatL contains a vector(a, b)^T of norm √

a²+b² ≤R as soon asπR² >4p. Take

R = 2√

√p

3 so that πR² >4p and R² <2p.

Hence there exists such a vector with a²+b² <2p.

Since(a, b)^T ∈ L, there existsc∈Z with b=ar+cp. Since p dividesr²+ 1, it follows that a²+b² is a multiple of p. The only nonzero multiple ofp of absolute value less than 2p isp.

Hencep=a²+b².

(32)

Step 3. Assumep divides r²+ 1. Let L be the lattice with basis(1, r)^T,(0, p)^T. The determinant of L is p. Using Minkowski’s Theorem with the disk of radiusR, we deduce thatL contains a vector(a, b)^T of norm √

R = 2√

√p

Hencep=a²+b².

(33)

R = 2√

√p

Hencep=a²+b².

(34)

R = 2√

√p

Since(a, b)^T ∈ L, there existsc∈Z with b=ar+cp. Sincep dividesr²+ 1, it follows that a²+b² is a multiple of p. The only nonzero multiple ofp of absolute value less than 2p isp.

Hencep=a²+b².

(35)

R = 2√

√p

Hencep=a²+b².

(36)

R = 2√

√p

Hencep=a²+b².

(37)

R = 2√

√p

Hencep=a²+b².

(38)

Minkowski’s first Theorem

LetK be a compact convex set in Rⁿ symmetric about 0such that0lies in the interior ofK. Letλ₁ =λ₁(K) be the infimum of the real numbersλ such that λK contains an integer point inZⁿ distinct from0. Let V =V(K)be the volume of K. Set

˜λ= 2V^−1/n. Then ˜λK is a convex body with volume 2ⁿ. By Minkowski’s convex body theoremλK˜ contains an integer point6= 0. Thereforeλ₁ ≤2V^−1/n, which means

λⁿ₁V <2ⁿ. This is Minkowski’s first Theorem.

(39)

Minkowski’s second theorem

For each integer j with 1≤j ≤n, let λ_j =λ_j(K)be the infimum of allλ >0 such that λK contains j linearly independent integer points. Then

0< λ₁ ≤λ₂· · · ≤λ_n <∞.

The numbersλ₁, λ₂, . . . , λ_n are the successive minima of K.

Theorem[Minkowski’s second convex body theorem, 1907].

2ⁿ

n! ≤λ₁· · ·λ_nV ≤2ⁿ.

(40)

Minkowski’s second theorem

For each integer j with 1≤j ≤n, let λ_j =λ_j(K)be the infimum of allλ >0 such that λK contains j linearly independent integer points. Then

0< λ₁ ≤λ₂· · · ≤λ_n <∞.

The numbersλ₁, λ₂, . . . , λ_n are the successive minima of K.

Theorem[Minkowski’s second convex body theorem, 1907].

2ⁿ

n! ≤λ₁· · ·λ_nV ≤2ⁿ.

(41)

Examples

Examples :

•for the cube |x_i| ≤1, the volume V is2ⁿ and the successive minima are all1.

•for the octahedron |x₁|+· · ·+|x_n| ≤1, the volume V is 2ⁿ/n! and the successive minima are all 1.

Remark : Minkowski’s Theorems extend to any full rank latticeL ⊂ Rⁿ : if b₁, . . . , b_n is a basis of L, taking b₁, . . . , b_n as a basis of Rⁿ overR amounts to replace L by Zⁿ.

Reference :

W.M. Schmidt. Diophantine Approximation. Lecture Notes in Mathematics785, Chap. 4, Springer Verlag, 1980.

(42)

Examples

Examples :

Reference :

(43)

Examples

Examples :

Reference :

(44)

Simultaneous approximation

Proposition(A.K. Lenstra, H.W. Lenstra, L. Lovasz, 1982).

There exists a polynomial-time algorithm that, given a positive integern and rational numbers α₁, . . . , α_n, satisfying

0< < 1, finds integers p₁, . . . , p_n, q for which

|pi−qαi| ≤ for 1≤i≤n and 1≤q≤2^n(n+1)/4⁻ⁿ. Proof. Let L be the lattice of rank n+ 1 spanned by the columns of the (n+ 1)×(n+ 1) matrix







1 · · · 0 −α₁ ... . .. ... ... 0 · · · 1 −α_n 0 · · · 0 η







with η= 2^−n(n+1)/4ⁿ⁺¹. The inner product of any two columns is rational. By the LLL algorithm, there is a

polynomial-time algorithm to find a reduced basis b₁, . . . , b_n+1 forL.

(45)

Proposition(A.K. Lenstra, H.W. Lenstra, L. Lovasz, 1982).

There exists a polynomial-time algorithm that, given a positive integern and rational numbers α₁, . . . , α_n, satisfying

0< < 1, finds integers p₁, . . . , p_n, q for which

|pi−qαi| ≤ for 1≤i≤n and 1≤q≤2^n(n+1)/4⁻ⁿ. Proof. Let L be the lattice of rank n+ 1 spanned by the columns of the (n+ 1)×(n+ 1) matrix







1 · · · 0 −α₁ ... . .. ... ... 0 · · · 1 −α_n 0 · · · 0 η







with η= 2^−n(n+1)/4ⁿ⁺¹. The inner product of any two columns is rational. By the LLL algorithm, there is a

polynomial-time algorithm to find a reduced basis b₁, . . . , b_n+1 forL.

(46)

Sincedet(L) =η, we have

2^n/4det(L)^1/(n+1) = and

|b₁| ≤. Sinceb₁ ∈ L, we can write

b₁ = (p₁−qα₁, p₂−qα₂, . . . , p_n−qα_n, qη)^T

with p₁, . . . , p_n, q ∈Z. Hence

|pi−qαi| ≤ for 1≤i≤n and |q| ≤2^n(n+1)/4⁻ⁿ. From <1 and b₁ 6= 0 we deduceq 6= 0. Replacing b₁ by−b₁ if necessary we may assume q >0.

(47)

Dirichlet’s theorems on simultaneous approximation

Letα₁, . . . , α_n be real numbers and Q >1 an integer.

(i) There exists integers p₁, . . . , p_n, q with

1≤q < Q and |α_iq−p_i| ≤ 1 Q^1/n· (ii) There exists integers q₁, . . . , q_n, p with

1≤max{|q1|, . . . ,|qn|}< Q and |α1q1+· · ·+αnqn−p| ≤ 1 Qⁿ·

The proofs are easy applications of Dirichlet Box Principle (see Chap. II of Schmidt LN 785).

(48)

Connection with SVP - (i)

Let >0. Define η=/Q. Consider the L be the lattice of rankn+ 1 spanned by the columns vectors v₁, . . . , v_n+1 of the (n+ 1)×(n+ 1) matrix







1 · · · 0 −α₁ ... . .. ... ... 0 · · · 1 −α_n 0 · · · 0 η





 .

If v =p₁v₁+· · ·+p_nv_n+qv_n+1 is an element of L which satisfies 0<max{|v₁|, . . . ,|v_n+1|}< , then we have

1≤q < Q and |α_iq−p_i| ≤·

The determinant of L is η. From Minkowski’s first Theorem, we deduce that there exists such a vector withⁿ⁺¹ = 2ⁿ⁺¹η.

Withη =/Q we obtain ⁿ= 2ⁿ⁺¹/Q

(49)

Connection with SVP - (ii)

Let >0. Define η=/Q. Consider the L be the lattice of rankn+ 1 spanned by the columns vectors v₁, . . . , v_n+1 of the (n+ 1)×(n+ 1) matrix







η · · · 0 0 ... . .. ... ... 0 · · · η 0 α1 · · · αn −1





 .

If v =q₁v₁+· · ·+q_nv_n+pv_n+1 is an element ofL which satisfies 0<max{|v₁|, . . . ,|v_n+1|}< , then we have

1≤q_i < /η =Q and |α₁q₁+· · ·+α_nq_n−p|< · The determinant of L is −ηⁿ. From Minkowski’s first Theorem, we deduce that there exists such a vector with ⁿ⁺¹ = 2ⁿ⁺¹ηⁿ. With η=/Qwe obtain = 2ⁿ⁺¹/Qⁿ.