May 1 (lattice-based crypto) scribe notes; first draft of merge #38

blueapple128 · 2019-05-14T06:07:38Z

No description provided.

This reverts commit 936a5dc.

blueapple128 · 2019-05-20T19:52:49Z

notes/lattice_cryptography.tex

-In previous sections, we have seen constructions for asymmetric cryptography based on hardness assumptions like the RSA factoring assumption and the discrete logarithm problem. While these problems are assumed to the hard for classical machines, fast quantum algorithms are known. At a high level, quantum computers use phenomenon from quantum mechanism such as superimposition and entanglement to perform computations. 
-In 1994, Peter Shor gave a quantum algorithm \cite{Shor1994} to factor composite number $N$ that runs in $\mathcal{O}\left( (\log N)^2(\log \log N) (\log \log \log N)\right)$. Variations of this algorithm can also be used to compute discrete logarithms even for elliptic curves. Contrast this with the fastest classical algorithm which runs in $O(e^{1.9 (\log N)^{1/3} (\log \log N)^{2/3}})$. Shor's quantum algorithm achieves an exponential speedup over classical algorithms allowing quantum computers to break all previously discussed asymmetric schemes in polynomial time. 
+In previous sections, we have seen constructions for asymmetric cryptography based on hardness assumptions like RSA's prime factorization assumption and the discrete logarithm problem. While these problems are assumed to be hard for classical machines, fast quantum algorithms are known. At a high level, quantum computers use phenomenon from quantum mechanisms such as superimposition and entanglement to perform computations. 
+In 1994, Peter Shor gave a quantum algorithm \cite{Shor1994} to factor an $n$-bit composite number that runs in $\mathcal{O}\left( n^2(\log n) (\log \log n)\right)$. Variations of this algorithm can also be used to compute discrete logarithms even for elliptic curves. Contrast this with the fastest classical algorithm which runs in $O(e^{1.9 n^{1/3} (\log n)^{2/3}})$. Shor's algorithm achieves an exponential speedup over classical algorithms allowing quantum computers to break all previously discussed asymmetric schemes in polynomial time. 


feel like describing the input as an n-bit number instead of a number of magnitude N makes the difference between exponential and polynomial more obvious; e.g. O(N) is exponential time (or technically psuedo-polynomial time) but this is less obvious than O(2^n).

blueapple128 · 2019-05-20T19:54:12Z

notes/lattice_cryptography.tex


-Although quantum computers are expensive and not readily available today, many consider their advent inevitable spawning new research into so called ``quantum-resistant'' or ``post-quantum'' cryptography. In this section, we introduce a new asymmetric encryption scheme based on lattice problems that are assumed to be hard even for quantum computers.  
+Although quantum computers are expensive and none available today have enough stable qubits to perform Shor's algorithm on a real-world sized input, many consider their advent inevitable, spawning new research into ``quantum-resistant'' or ``post-quantum'' cryptography. In this section, we introduce a new asymmetric encryption scheme based on lattice problems that are assumed to be hard even for quantum computers.


clarifying the extent of what's physically available and what isn't

blueapple128 · 2019-05-20T19:54:56Z

notes/lattice_cryptography.tex

@@ -105,8 +105,7 @@ \subsection{Introduction to Lattices}
    \caption{Lattice Problems}
 \end{figure}

-\noindent It is known that $\gapsvpy \Rightarrow \svpy$. To build cryptosystems, the strategy is to find constructions whose security reduces first to the $\gapsvpy$ problem rather than directly to $\svpy$. It is easy to see that $\gapsvpy$ and $\svpy$ both get easier as $\gamma$ increases. 
-Figure \ref{fig:SVP for Gamma} shows the complexity of the best known algorithms for $\gapsvpy$ for different values of $\gamma$.
+\noindent It is known that $\gapsvpy \Rightarrow \svpy$. It is also easy to see that $\gapsvpy$ and $\svpy$ both get easier as $\gamma$ increases. Figure \ref{fig:SVP for Gamma} shows the complexity of the best known algorithms for $\gapsvpy$ for different values of $\gamma$.


just reordering some sentences to make the section flow better to a reader

blueapple128 · 2019-05-20T19:56:14Z

notes/lattice_cryptography.tex

@@ -128,28 +127,29 @@ \subsection{Introduction to Lattices}
    \label{fig:SVP for Gamma}
 \end{figure}

+\noindent However, critically, the above hardness classifications are believed to apply to both classical computers and quantum computers. Thus to build a quantum-resistant cryptosystem, the strategy is to find constructions whose security can reduce to the $\gapsvpy$ problem.


should mention that the best known algorithm complexities for \gapsvpy apply to quantum computers as well

blueapple128 · 2019-05-20T19:56:58Z

notes/lattice_cryptography.tex


 \begin{problem}
-\textnormal{\textbf{(Search-Learning with Errors: $\searchlwe$)}} Suppose that $\varvect{s}$, called the secret vector is sampled uniformly at random from $\Z^n_q$. Let $\varvect{A} \getsr \Z^{m \times n}_q$ be a random $m \times n$ matrix and $\varvect{e} \getsr \chi^m$ be a ``noise vector'' containing $m$ samples from $\chi$. Compute the secret vector $\varvect{s}$ given $\left(\varvect{A}, \varvect{A}\varvect{s} + \varvect{e} \right)$
+\textnormal{\textbf{(Search-Learning with Errors: $\searchlwe$)}} Suppose that $\varvect{s}$, called the secret vector, is sampled uniformly at random from $\Z^n_q$. Let $\varvect{A} \getsr \Z^{m \times n}_q$ be a random $m \times n$ matrix and $\varvect{e} \getsr \chi^m$ be a ``noise vector'' containing $m$ independent samples from $\chi$. Compute the secret vector $\varvect{s}$ given $\left(\varvect{A}, \varvect{A}\varvect{s} + \varvect{e} \right)$. (Note that this is effectively a system of $m$ linear equations in $m+n$ unknowns.)


extra sentence at the end is really just there to be a hint for Exercise 3. Remove if you feel it's not necessary.

blueapple128 · 2019-05-20T19:57:36Z

notes/lattice_cryptography.tex

 \end{problem}

 \noindent It is easy to see how the decision version can be solved using the search version assuming $\chi$ is distinguishable from a uniform distribution over $\Z_q$. Intuitively, given a solver $\advA$ for $\searchlwe$, we can construct $\advA'$ that solves $\decisionlwe$ as follows: $\advA'$ feeds its input into $\advA$. Compute $\varvect{e} = \varvect{A}\varvect{s} - \varvect{D}_b$ using the $\varvect{s}$ returned by $\advA$. When $b=0$, $\varvect{e}$ will be a uniformly random vector from $\Z^m_q$ and when $b=1$, $\varvect{e}$ will be from $\chi^m$. Perhaps surprisingly, under some restrictions, the search variant can also be solved using the decision variant. Oded Regev showed in \cite{Regev2005} that the search and decision variants of the LWE problem are equivalent when $q$ is a prime that is polynomial in $n$. This result was extended in \cite{Peikert2009} for any $q$ that is a product of distinct primes that are polynomial in $n$.

 \begin{remark}
-If $\varvect{e}$ is uniform over $\Z^m_q$, then finding $\varvect{s}$ is impossible. At the other extreme, if the error is 0, then the problem reduces to $m$ equations in $n$ unknowns which can be solved using Gaussian elimination to obtain a unique solution when $m \geq n$
+If $\varvect{e}$ is uniform over $\Z^m_q$, then finding $\varvect{s}$ is impossible following the same intuition as the one-time pad. At the other extreme, if $\vece = \textbf{0}$, then the problem reduces to $m$ equations in $n$ unknowns which can be solved using Gaussian elimination to obtain a unique solution when $m \geq n$. In between, when the error is drawn from an uneven Discrete Gaussian distribution, the solution becomes computationally intractable to find. If one attempts to use row reduction anyway (despite the presence of a nonzero error), the linear combination operations performed repeatedly on every row causes the errors to accumulate.


Mention intuition for why row reduction becomes hard when errors are present

blueapple128 · 2019-05-20T19:58:58Z

notes/lattice_cryptography.tex

 \end{remark}

 \subsection{LWE as a lattice problem and Regev's construction}
-The connection between LWE and lattices stems from the fact that 
-the LWE problem can be viewed as a lattice problem. For certain range of parameters, worst-case hardness of $\gapsvpy$ implies LWE. Regev \cite{Regev2005} built a public key encryption scheme for single bit messages that tightly reduces to the $\decisionlwe$ problem. The details of Regev's construction are given below.
+As very briefly touched upon above, for certain ranges of parameters, worst-case hardness of $\gapsvpy$ implies LWE. This reduction applies for both quantum algorithms \cite{Regev2005} and classical algorithms (the latter as long as $q \ge 2^n$) [\textbf{Peikert '09}]. Regev \cite{Regev2005} built a public key encryption scheme for single bit messages that tightly reduces to the $\decisionlwe$ problem. The details of Regev's construction are given below.


from lecture: covering that the reduction/implication applies to both classical and quantum algorithms, which were shown in separate papers

blueapple128 changed the title ~~first draft scribe notes for May 1~~ first draft scribe notes for May 1 (lattice-based crypto) May 14, 2019

blueapple128 force-pushed the master branch 2 times, most recently from 936a5dc to 9433cf2 Compare May 20, 2019 19:41

blueapple128 and others added 4 commits May 20, 2019 15:43

first draft scribe notes for May 1

60ada38

Revert "first draft scribe notes for May 1"

0285a29

This reverts commit 936a5dc.

May 1: Lattice Cryptography Notes Draft

14ad6cc

merge ddr42 draft scribe notes

475dfa3

blueapple128 force-pushed the master branch from 9433cf2 to 475dfa3 Compare May 20, 2019 19:44

blueapple128 commented May 20, 2019

View reviewed changes

blueapple128 changed the title ~~first draft scribe notes for May 1 (lattice-based crypto)~~ May 1 (lattice-based crypto) scribe notes; first draft of merge May 20, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

May 1 (lattice-based crypto) scribe notes; first draft of merge #38

May 1 (lattice-based crypto) scribe notes; first draft of merge #38

blueapple128 commented May 14, 2019

blueapple128 May 20, 2019

blueapple128 May 20, 2019 •

edited

Loading

blueapple128 May 20, 2019

blueapple128 May 20, 2019

blueapple128 May 20, 2019 •

edited

Loading

blueapple128 May 20, 2019

blueapple128 May 20, 2019


		Although quantum computers are expensive and not readily available today, many consider their advent inevitable spawning new research into so called ``quantum-resistant'' or ``post-quantum'' cryptography. In this section, we introduce a new asymmetric encryption scheme based on lattice problems that are assumed to be hard even for quantum computers.
		Although quantum computers are expensive and none available today have enough stable qubits to perform Shor's algorithm on a real-world sized input, many consider their advent inevitable, spawning new research into ``quantum-resistant'' or ``post-quantum'' cryptography. In this section, we introduce a new asymmetric encryption scheme based on lattice problems that are assumed to be hard even for quantum computers.

May 1 (lattice-based crypto) scribe notes; first draft of merge #38

Are you sure you want to change the base?

May 1 (lattice-based crypto) scribe notes; first draft of merge #38

Conversation

blueapple128 commented May 14, 2019

blueapple128 May 20, 2019

Choose a reason for hiding this comment

blueapple128 May 20, 2019 • edited Loading

Choose a reason for hiding this comment

blueapple128 May 20, 2019

Choose a reason for hiding this comment

blueapple128 May 20, 2019

Choose a reason for hiding this comment

blueapple128 May 20, 2019 • edited Loading

Choose a reason for hiding this comment

blueapple128 May 20, 2019

Choose a reason for hiding this comment

blueapple128 May 20, 2019

Choose a reason for hiding this comment

blueapple128 May 20, 2019 •

edited

Loading

blueapple128 May 20, 2019 •

edited

Loading