GGH may not be dead after all

Abstract

In 1997, Goldreich, Goldwasser and Halevi presented the GGH cryptosystem, which is based on hard lattice problems. Only two years later, Nguyen pointed out major flaws on the scheme. From that point on, the system was considered officially dead. However, in 2012, Yoshino and Kunihiro proposed some improvements on the GGH cryptosystem, claiming to have fixed the flaws pointed out by Nguyen. In this paper, we make a thorough analysis of this tweaked GGH scheme, showing that, in practice, it behaves mostly in the same way as the original scheme. We also propose some modifications that can effectively make the new GGH different from the original one.

Evaluation and Comparison of Lattice-Based Cryptosystems for a Secure Quantum Computing Era

“…de Barros and L.M. Schechter, in their paper "GGH may not be dead after all", proposed certain improvements for GGH and finally a variation of the GGH cryptographic scheme [70]. De Barros and Schecher, by reducing the public key in order to find a basis with the aid of Babai's algorithm, perform a direct way to attack to GGH.…”

Programmable RNS lattice-based parallel cryptographic decryption

“…In practice, the size of parameters depends on the complexity of best known attacks such as lattice reductions. In their first form, GGH signature and encryption schemes were severely broken [4], [5] and thwarting these attacks is still a current concern [6]- [8]. Recently, GGH has got many improvements [9]- [11] to make it competitive under secure parameters.…”

Métodos eficientes para criptografia baseada em reticulados.

“…The variant proposed by Barros and Schechter (BARROS;SCHECHTER, 2014) prevents all known attacks to the GGH family to date. The modifications ensure that the underlying problem is not CVP, as it is in the original scheme.…”

“…However, this variant does not allow for the construction of proper parameter sets, and therefore has no practical use. More recently, Barros and Schechter (BARROS;SCHECHTER, 2014) expanded this construction, proposing a modification called GGH-YK-M that effectively yields a suitable parametrization. The result is very promising, as it brings the simplicity of GGH and GGH-YK back to life.…”