Just How Hard Are Rotations of $$\mathbb {Z}^n$$? Algorithms and Cryptography with the Simplest Lattice

Bennett, Huck; Ganju, Atul; Peetathawatchai, Pura; Stephens-Davidowitz, Noah

doi:10.1007/978-3-031-30589-4_9

Cited by 7 publications

(4 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We note that the lattices we consider, which act as a counter-example, are not necessarily a natural choice for instantiating LIP for cryptographic application, but instead they warn that the hull attack can be relevant. This is fortunately inconsequential when instantiating LIP with the trivial lattice Z n as proposed in [BGPSD21,DPPW22]…”

Section: Contributionsmentioning

confidence: 99%

“…Such choices of lattice avoid the consideration discussed above. This is the case of the trivial lattice Z n , as used in [BGPSD21,DPPW22].…”

Section: Unimodular Latticesmentioning

confidence: 99%

“…The lattice isomorphism problem (LIP) is the problem of finding an isometry between two lattices, given that such an isometry exists. It has long been a problem of interest in the geometry of numbers [PP85, PS97, Sch09, SHVvW20], in complexity theory [HR14], and has recently been proposed as a foundation for cryptography [BGPSD21,DvW22,DPPW22].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Hull Attacks on the Lattice Isomorphism Problem

Ducas

Gibbons

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The lattice isomorphism problem (LIP) asks one to find an isometry between two lattices. It has recently been proposed as a foundation for cryptography in two independent works [Ducas & van Woerden, EUROCRYPT 2022, Bennett et al. preprint 2021. This problem is the lattice variant of the code equivalence problem, on which the notion of the hull of a code can lead to devastating attacks. In this work we study the cryptanalytic role of an adaptation of the hull to the lattice setting, namely, the s-hull. We first show that the s-hull is not helpful for creating an arithmetic distinguisher. More specifically, the genus of the s-hull can be efficiently predicted from s and the original genus and therefore carries no extra information. However, we also show that the hull can be helpful for geometric attacks: for certain lattices the minimal distance of the hull is relatively smaller than that of the original lattice, and this can be exploited. The attack cost remains exponential, but the constant in the exponent is halved. This second result gives a counterexample to the general hardness conjecture of LIP proposed by Ducas & van Woerden.Our results suggests that one should be very considerate about the geometry of hulls when instantiating LIP for cryptography. They also point to unimodular lattices as attractive options, as they are equal to their dual and their hulls, leaving only the original lattice to an attacker. Remarkably, this is already the case in proposed instantiations, namely the trivial lattice Z n and the Barnes-Wall lattices.

show abstract

Section: Contributionsmentioning

confidence: 99%

“…Such choices of lattice avoid the consideration discussed above. This is the case of the trivial lattice Z n , as used in [BGPSD21,DPPW22].…”

Section: Unimodular Latticesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Hull Attacks on the Lattice Isomorphism Problem

Ducas

Gibbons

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…In other words, for two lattices to be plausibly hard to distinguish up to isomorphism, the pair of input lattices must be in the same genus; otherwise, the lattices are obviously not isomorphic. The construction of pairs of lattices that are hard to distinguish up to isomorphism has recently become of cryptographic interest [DvW21,BGPSD21]. While [DvW21] proposes a suitable construction of pairs of lattices in the same genus, this construction is somewhat inefficient (involving the doubling of dimension and increasing geometric gaps).…”

Section: Introductionmentioning

confidence: 99%

Genus distribution of random $q$-ary lattices

Bruin,

Ducas,

Gibbons

2023

Banach Center Publ.

View full text Add to dashboard Cite

The genus is an efficiently computable arithmetic invariant for lattices up to isomorphism. Given the recent proposals of basing cryptography on the lattice isomorphism problem, it is of cryptographic interest to classify relevant families of lattices according to their genus.We propose such a classification for q-ary lattices, and also study their distribution. In particular, for an odd prime q, we show that random q-ary lattices are mostly concentrated on two genera.Because the genus is local, this also provides information on the distribution for general odd q. The case of q a power of 2 is also studied, although we only achieve a partial classification.

show abstract