Tensor-Based Trapdoors for CVP and Their Application to Public Key Cryptography (Extended Abstract)

Fischlin, Roger; Seifert, Jean-Pierre

doi:10.1007/3-540-46665-7_29

Cited by 19 publications

(13 citation statements)

References 24 publications

(21 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To this end, recall that a skewed lattice point belongs to a sphere of radius around the received vector iff where we denoted , and . Therefore, for any pair of points , where and are -dimensional and -dimensional vectors in and , respectively, we wish to calculate (13) where the vectors and are -dimensional and -dimensional, respectively, and the upper-triangular matrices and are and , respectively, and are defined by the following partitioning of the vector and the matrix : …”

Section: Variance Of Computational Complexity Of Sphere Decodingmentioning

confidence: 99%

See 1 more Smart Citation

On the sphere-decoding algorithm II. Generalizations, second-order statistics, and applications to communications

Vikalo

Hassibi

2005

IEEE Trans. Signal Process.

207

136

View full text Add to dashboard Cite

Abstract-In Part I, we found a closed-form expression for the expected complexity of the sphere-decoding algorithm, both for the infinite and finite lattice. We continue the discussion in this paper by generalizing the results to the complex version of the problem and using the expected complexity expressions to determine situations where sphere decoding is practically feasible. In particular, we consider applications of sphere decoding to detection in multiantenna systems. We show that, for a wide range of signal-to-noise ratios (SNRs), rates, and numbers of antennas, the expected complexity is polynomial, in fact, often roughly cubic. Since many communications systems operate at noise levels for which the expected complexity turns out to be polynomial, this suggests that maximum-likelihood decoding, which was hitherto thought to be computationally intractable, can, in fact, be implemented in real-time-a result with many practical implications. To provide complexity information beyond the mean, we derive a closed-form expression for the variance of the complexity of sphere-decoding algorithm in a finite lattice. Furthermore, we consider the expected complexity of sphere decoding for channels with memory, where the lattice-generating matrix has a special Toeplitz structure. Results indicate that the expected complexity in this case is, too, polynomial over a wide range of SNRs, rates, data blocks, and channel impulse response lengths.

show abstract

Section: Variance Of Computational Complexity Of Sphere Decodingmentioning

confidence: 99%

“…Other applications include global positioning systems (GPSs) [10] and cryptography. In fact, there is a whole family of public-key cryptosystems based on the NP-hardness of the integer least-squares problem [11]- [13].…”

mentioning

confidence: 99%

On the sphere-decoding algorithm II. Generalizations, second-order statistics, and applications to communications

Vikalo

Hassibi

2005

IEEE Trans. Signal Process.

207

136

View full text Add to dashboard Cite

show abstract

“…Nonetheless, the general idea is still viable. Until then, the other propositions were made using the same principle [27,44,59].…”

Section: Cvp-based Cryptosystemsmentioning

confidence: 99%

“…Consequently, the computation of the closest vector even with a "good basis" becomes very expensive. In 2000, Fischlin and Seifert [27] proposed a very intuitive way to build lattices with good basis which can solve the closest vector problem. They used a tensor product of lattice to obtain a divide and conquer approach to solve CVP.…”

Section: Cvp-based Cryptosystemsmentioning

confidence: 99%

Recursive Lattice Reduction

Plantard

Susilo

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Lattice reduction is known to be a very powerful tool in modern cryptanalysis. In the literature, there are many lattice reduction algorithms that have been proposed with various time complexity (from quadratic to subexponential). These algorithms can be utilized to find a short vector of a lattice with a small norm. Over time, shorter vector will be found by incorporating these methods. In this paper, we take a different approach by presenting a methodology that can be applied to any lattice reduction algorithms, with the implication that enables us to find a shorter vector (i.e. a smaller solution) while requiring shorter computation time. Instead of applying a lattice reduction algorithm to a complete lattice, we work on a sublattice with a smaller dimension chosen in the function of the lattice reduction algorithm that is being used. This way, the lattice reduction algorithm will be fully utilized and hence, it will produce a better solution. Furthermore, as the dimension of the lattice becomes smaller, the time complexity will be better. Hence, our methodology provides us with a new direction to build a lattice that is resistant to lattice reduction attacks. Moreover, based on this methodology, we also propose a recursive method for producing an optimal approach for lattice reduction with optimal computational time, regardless of the lattice reduction algorithm used. We evaluate our technique by applying it to break the lattice challenge 1 by producing the shortest vector known so far. Our results outperform the existing known results and hence, our results achieve the record in the lattice challenge problem.

show abstract

“…The original GGH cryptosystem was attacked and broken severely by Nguyen in 1999 [17], and Nguyen pointed out that for safety, one can choose the entries of the error vector r at random in [−σ, · · · , σ] instead of {±σ}. Afterwards the other propositions were made using the same principle [18,19,20].…”

Section: Gghmentioning

confidence: 99%

An efficient broadcast attack against NTRU

Li¹,

Pan²,

Liu³

et al. 2012

Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security

View full text Add to dashboard Cite

The NTRU cryptosystem is the most practical scheme known to date. In this paper, we first discuss the ergodic-linearization algorithm against GGH, then naturally deduce a new and uniform broadcast attack against several variants of NTRU: for every recipient's ciphertext, isolate out the blinding value vector, then do derandomization directly and entirety by using inner product, afterwards by using some properties of circular matrix together with linearization we obtain three linear congruence equations of the form a T Y = s mod q with N + [ ] − 2 can we work out these variables and recover the plaintext in O(N 3 ) arithmetic operations successfully. The experiment evidence indicates that our algorithm can efficiently broadcast attack against NTRU with the highest security parameters. To the best of our knowledge, this is the most efficient broadcast attack against NTRU. This is an algebraic broadcast attack, which is based on the special structure of the blinding value space L r .

show abstract

Tensor-Based Trapdoors for CVP and Their Application to Public Key Cryptography (Extended Abstract)

Abstract: We propose two trapdoors for the Closest-Vector-Problem in lattices (CVP) related to the lattice tensor product. Using these trapdoors we set up a lattice-based cryptosystem which resembles to the McEliece scheme. 1

Cited by 19 publications

References 24 publications

On the sphere-decoding algorithm II. Generalizations, second-order statistics, and applications to communications

On the sphere-decoding algorithm II. Generalizations, second-order statistics, and applications to communications

Recursive Lattice Reduction

An efficient broadcast attack against NTRU

Contact Info

Product

Resources

About