Computing Generator in Cyclotomic Integer Rings

Abstract

The Principal Ideal Problem (resp. Short Principal Ideal Problem), shorten as PIP (resp. SPIP), consists in finding a generator (resp. short generator) of a principal ideal in the ring of integers of a number field. Several lattice-based cryptosystems rely on the presumed hardness of these two problems. In practice, most of them do not use an arbitrary number field but a power-of-two cyclotomic field. The Smart and Vercauteren fully homomorphic encryption scheme and the multilinear map of Garg, Gentry, and Halevi epitomize this common restriction. Recently, Cramer, Ducas, Peikert, and Regev showed that solving the SPIP in such cyclotomic rings boiled down to solving the PIP. In this paper, we present a heuristic algorithm that solves the PIP in prime-power cyclotomic fields in subexponential time L |∆ K | (1/2), where ∆ K denotes the discriminant of the number field. This is achieved by descending to its totally real subfield. The implementation of our algorithm allows to recover in practice the secret key of the Smart and Vercauteren scheme, for the smallest proposed parameters (in dimension 256). solving lattice problems, such as signature, basic encryption, Identity Based Encryption (IBE) as well as Fully Homomorphic Encryption (FHE) [21]. Not all these schemes rely on the same lattice-based problem. For instance, the NTRU cryptosystem [24], which is one of the most efficient encryption scheme related to lattices, is based on the Shortest Vector Problem (SVP). Besides, the authors of NTRU were the first to consider specific kinds of lattices, namely those related to polynomial rings. This idea was followed by the definition of another lattice-based problem that is the topic of a large body of works [31,32,33,34,44]: the Ring Learning With Error Problem (RLWE). Cryptosystems based on RLWE present both an efficient key size reduction and improved performance (for instance decryption, encryption and signature are faster than with arbitrary lattices). Yet, RLWE belongs to the specific family of ideal-lattice problems, which stem from algebraic number theory. This raises a potential drawback, since those lattices carry more structure than classical lattices, as they are derived from ideals in integer rings of number fields. SPIP and PIP. Another presumably hard problem related to these ideals is called the Short Principal Ideal Problem (SPIP). It consists in finding a short 5 generator of an ideal, assuming it is principal. For instance, recovering the secret key from the public key in the Smart and Vercauteren FHE scheme [43] and in the Garg, Gentry, and Halevi multilinear map scheme [20], consists in solving an instance of the SPIP. This problem turns out to hinge on two distinct phases: on the one hand finding an arbitrary generator-known as the Principal Ideal Problem (PIP)-and on the other hand reducing such a generator to a short one. The problem of finding a generator of a principal ideal, which is the aim of this article, and even testing the principality of an ideal, are difficult problems in algorithmic n...

On the Statistical Leak of the GGH13 Multilinear Map and Some Variants

“…This ensures statistical closeness to the desired distribution up to exp(−n 2ε ). Considering that there are already classical attacks in time exp(Õ( √ n)) (namely, using [6,14] to recover h from the ideal hR), one may just choose ε = 1/4.…”

“…We call v the level of the encoding. 6 We abuse notation by saying that u is an encoding of a (instead of an encoding of the coset a + I).…”

“…Orthogonally, it has been discovered that solving over-stretched versions of the NTRU problem (whose intractability is necessary for the security of the GGH MMap) was significantly easier than previously thought, due to the presence of an unusually dense sublattice [1,12,26], yet this can be compensated at the cost of increasing parameters. Also, due to recent algorithms for the Principal Ideal Problem [6,7] and Short generator recovery [10,14], the GGH MMap can be broken 1 in quantum polynomial time, and classical subexponential time exp(Õ( √ n)), where n is the dimension of the used ring. Nevertheless, this candidate MMap was still considered in a weaker form, 2 to attempt realizing indistinguishability obfuscation (or, for short, iO).…”

Random Self-reducibility of Ideal-SVP via Arakelov Random Walks

“…One such application is the object of another work in progress. Namely, we note that many algorithms [5,4,8] rely on nding elements a in an ideal I such that aI −1 is easy to factor (e.g. prime, near-prime, or B-smooth).…”

Advances in Cryptology – EUROCRYPT 2017

“…This is the stage that uses quantum computation. The best known pre-quantum attacks (see, e.g., [11]) reuse ideas from NFS, the number-field sieve for integer factorization, and take time exponential in N c+o (1) for a real number c with 0 < c < 1 where N is the field degree. If N is chosen as an appropriate power of the target security level then the pre-quantum attacks take time exponential in the target security level, but the Biasse-Song attack takes time polynomial in the target security level.…”