Fast Fourier Orthogonalization

Abstract

The classical fast Fourier transform (FFT) allows to compute in quasi-linear time the product of two polynomials, in the circular convolution ring R[x]/(x d − 1) -a task that naively requires quadratic time. Equivalently, it allows to accelerate matrix-vector products when the matrix is circulant.In this work, we discover that the ideas of the FFT can be applied to speed up the orthogonalization process of matrices with circulant blocks of size d × d. We show that, when d is composite, it is possible to proceed to the orthogonalization in an inductive way -up to an appropriate re-indexation of rows and columns. This leads to a structured Gram-Schmidt decomposition. In turn, this structured Gram-Schmidt decomposition accelerates a cornerstone lattice algorithm: the nearest plane algorithm. The complexity of both algorithms may be brought down to Θ(d log d).Our results easily extend to cyclotomic rings, and can be adapted to Gaussian samplers. This finds applications in lattice-based cryptography, improving the performances of trapdoor functions.

Lattice-Based Public Key Searchable Encryption from Experimental Perspectives

“…However, due to costly Gaussian Sampling, the Trapdoor algorithm is approximately 8× slower than the one in BCOP scheme. We note that due to the latest advancements in Gaussian sampling techniques, one can instantiate the Test algorithm with more recent algorithms, for instance, using the method proposed in [59]. As for communication, sending one searchable ciphertext (for κ = 192 bits, equivalent to 52 Kb of data), with our moderate-speed network setting takes only 94 ms which is only 12 ms higher than that of BCOP.…”

Integral Matrix Gram Root and Lattice Gaussian Sampling Without Floats

“…This defeats the purpose of using rings in the first place. In this section, we propose an integral decomposition algorithm for the ring setting that exploits the inductive ring structure as in [DP16]. For simplicity we only discuss the case of power-of-2 cyclotomic rings, i.e.…”

“…, m = m +k and b is the gadget base, k = log b B , which projects the problem onto a subring. To build this reduction, we exploit projection techniques similar to [ABD16,DP16,GM18,PP19]. The resulting integral decomposition inherits the tower of rings structure and hence can be stored efficiently despite the output being wider by a factor of O(log w).…”

“…Furthermore in [DP16], Ducas and Prest applied FFT techniques to improve the Klein-GPV algorithm in the ring setting. Similarly, Genise and Micciancio exploited the Schur complement and developed a discrete perturbation algorithm in [GM18].…”

A Framework for Efficient Lattice-Based DAA

“…q consists of polynomials with random coefficients in {−1, 0, 1} and τ is some non-zero element in Z q . It was shown in [MP12,Lemma 5.3] that one can sample, again using [GPV08,DP16], elements from D ⊥ a,t, ξ , for any t ∈ R q , for ξ ≈ 2(s 1 (R) + 1)…”