Subexponential class group and unit group computation in large degree number fields

Biasse, Jean‐François; Fieker, Claus

doi:10.1112/s1461157014000345

Cited by 36 publications

(67 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Combining our main contributions with known algorithms for PIP [BF14,Bia14,CGS14,BS15] (which are the computational bottleneck) yields the following two main implications:…”

Section: Introductionmentioning

confidence: 90%

“…In such a case, if we have a list of coset representatives of C in R * , we can enumerate over all of them and use the algorithm above to recover g, increasing the running time only by a factor of h + . In order to obtain such a list of representatives, we can use an algorithm for computing the unit group, either classical [BF14] or quantum [EHKS14]. These algorithms are no slower than the known PIP algorithms and moreover, need only be applied once for a given cyclotomic field (as opposed to once for each public key).…”

Section: Algorithmic Implicationsmentioning

confidence: 99%

“…For this task, which is known as the Principal Ideal Problem (PIP), the state of the art is an algorithm of Biasse and Fieker [BF14,Bia14], whose running time has only a subexponential 2 n 2/3+ dependence on n, the degree of the ring (over Z). In addition, building on the recent work of Eisenträger et al [EHKS14], polynomial-time quantum algorithms for PIP have recently been described in two independent works [CGS14,BS15], the latter of which provides a fully rigorous treatment.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Recovering Short Generators of Principal Ideals in Cyclotomic Rings

Cramer

Ducas

Peikert

et al. 2016

Lecture Notes in Computer Science

104

View full text Add to dashboard Cite

A handful of recent cryptographic proposals rely on the conjectured hardness of the following problem in the ring of integers of a cyclotomic number field: given a basis of a principal ideal that is guaranteed to have a "rather short" generator, find such a generator. Recently, Bernstein and Campbell-Groves-Shepherd sketched potential attacks against this problem; most notably, the latter authors claimed a polynomial-time quantum algorithm. (Alternatively, replacing the quantum component with an algorithm of Biasse and Fieker would yield a classical subexponential-time algorithm.) A key claim of Campbell et al. is that one step of their algorithm-namely, decoding the log-unit lattice of the ring to recover a short generator from an arbitrary one-is classically efficient (whereas the standard approach on general lattices takes exponential time). However, very few convincing details were provided to substantiate this claim.In this work, we clarify the situation by giving a rigorous proof that the log-unit lattice is indeed efficiently decodable, for any cyclotomic of prime-power index. Combining this with the quantum algorithm from a recent work of Biasse and Song confirms the main claim of Campbell et al. Our proof consists of two main technical contributions: the first is a geometrical analysis, using tools from analytic number theory, of the standard generators of the group of cyclotomic units. The second shows that for a wide class of typical distributions of the short generator, a standard lattice-decoding algorithm can recover it, given any generator.By extending our geometrical analysis, as a second main contribution we obtain an efficient algorithm that, given any generator of a principal ideal (in a prime-power cyclotomic), finds a 2Õ ( √ n) -approximate shortest vector in the ideal. Combining this with the result of Biasse and Song yields a quantum polynomial-time algorithm for the 2Õ ( √ n) -approximate Shortest Vector Problem on principal ideal lattices.

show abstract

“…Combining our main contributions with known algorithms for PIP [BF14,Bia14,CGS14,BS15] (which are the computational bottleneck) yields the following two main implications:…”

Section: Introductionmentioning

confidence: 90%

Section: Algorithmic Implicationsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Recovering Short Generators of Principal Ideals in Cyclotomic Rings

Cramer

Ducas

Peikert

et al. 2016

Lecture Notes in Computer Science

104

View full text Add to dashboard Cite

show abstract

“…By approximating the residue, it allows one to certify that tentative class and unit groups are in fact correct (see [5]). …”

Section: Residues Of Dedekind Zeta Functionsmentioning

confidence: 99%

Nemo/Hecke

Fieker

Hart

Hofmann

et al. 2017

Proceedings of the 2017 ACM International Symposium on Symbolic and Algebraic Computation

Self Cite

View full text Add to dashboard Cite

We introduce two new packages, Nemo and Hecke, written in the Julia programming language for computer algebra and number theory. We demonstrate that high performance generic algorithms can be implemented in Julia, without the need to resort to a lowlevel C implementation. For specialised algorithms, we use Julia's efficient native C interface to wrap existing C/C++ libraries such as Flint, Arb, Antic and Singular. We give examples of how to use Hecke and Nemo and discuss some algorithms that we have implemented to provide high performance basic arithmetic. ACM Reference format:

show abstract

“…Alternatively, when κ = O(λ c ) for any c < 1/2, -leading according to the previous best known attacks to a choice of dimension n =Θ(λ 1+c )-the 2Õ (n 2/3 ) algorithms of Biasse and Biasse and Fiecker [Bia14,BF14] combined lead to a classical attack in time sub-exponential in λ.…”

Section: Graded Encoding Schemesmentioning

confidence: 99%

A Subfield Lattice Attack on Overstretched NTRU Assumptions

Albrecht

Bai

Ducas

2016

Lecture Notes in Computer Science

134

View full text Add to dashboard Cite

Abstract. The subfield attack exploits the presence of a subfield to solve overstretched versions of the NTRU assumption: norming the public key h down to a subfield may lead to an easier lattice problem and any sufficiently good solution may be lifted to a short vector in the full NTRU-lattice. This approach was originally sketched in a paper of Gentry and Szydlo at Eurocrypt'02 and there also attributed to Jonsson, Nguyen and Stern. However, because it does not apply for small moduli and hence NTRUEncrypt, it seems to have been forgotten. In this work, we resurrect this approach, fill some gaps, analyze and generalize it to any subfields and apply it to more recent schemes. We show that for significantly larger moduli -a case we call overstretched-the subfield attack is applicable and asymptotically outperforms other known attacks. This directly affects the asymptotic security of the bootstrappable homomorphic encryption schemes LTV and YASHE which rely on a mildly overstretched NTRU assumption: the subfield lattice attack runs in sub-exponential time 2 O(λ/ log 1/3 λ) invalidating the security claim of 2 Θ(λ) . The effect is more dramatic on GGH-like Multilinear Maps: this attack can run in polynomial time without encodings of zero nor the zero-testing parameter, yet requiring an additional quantum step to recover the secret parameters exactly. We also report on practical experiments. Running LLL in dimension 512 we obtain vectors that would have otherwise required running BKZ with block-size 130 in dimension 8192. Finally, we discuss concrete aspects of this attack, the condition on the modulus q to guarantee full immunity, discuss countermeasures and propose open questions.

show abstract

Subexponential class group and unit group computation in large degree number fields

Cited by 36 publications

References 27 publications

Recovering Short Generators of Principal Ideals in Cyclotomic Rings

Recovering Short Generators of Principal Ideals in Cyclotomic Rings

Nemo/Hecke

A Subfield Lattice Attack on Overstretched NTRU Assumptions

Contact Info

Product

Resources

About