410 likes | 591 Views
Search to Decision Reductions for Knapsacks and LWE. Daniele Micciancio, Petros Mol. UCSD Theory Seminar. October 3, 2011. Number Theoretic Cryptography. Number theory: standard source of hard problems Factoring: given N = pq, find p (or q) (p, q: large primes)
E N D
Search to Decision Reductions for Knapsacks and LWE Daniele Micciancio, Petros Mol UCSD Theory Seminar October 3, 2011
Number Theoretic Cryptography • Number theory: standard source of hard problems • Factoring: given N = pq, find p (or q) (p, q: large primes) • Discrete Log: given g, gx (mod p), find x • Very influential over the years • Extensively studied (algorithms & constructions) • Two major concerns • How do we know that a “random” N is hard to factor ? • Algorithmic progress • subexponential (classical) algorithms • polynomial quantum algorithms
Cryptography from Learning Problems integers n, q (public) secret s Finding s easy just need ~ n samples …
New Problem: Learning With Errors (LWE) integers n, q (public) secret s small error from a known distribution … Finding s possibly much harder noise Compactly… secret b A e A S random = + m (mod q) , n small error vector
The many interpretations of LWE • Algebraic: Solving noisy random linear equations • Geometric: Bounded Distance Decoding in Lattices • Learning Theory: Learning linear functions over under random “classification” noise • Coding theory: Decoding random linear q-ary codes
LWE Background • Introduced by Regev [R05] • q = 2, Bernoulli noise -> Learning Parity with Noise (LPN) • Extremely successful in Cryptography • IND-CPA Public Key Encryption [Regev05] • Injective Trapdoor Functions/ IND-CCA encryption [PW08] • Strongly Unforgeable Signatures [GPV08, CHKP10] • (Hierarchical) Identity Based Encryption [GPV08, CHKP10, ABB10] • Circular- Secure Encryption [ACPS09] • Leakage-Resilient Cryptography [AGV09, DGK+10, GKPV10] • (Fully) Homomorphic Encryption [GHV10, BV11]
Why LWE ? • Rich and Intuitive structure • Linear operations over fields (or rings) • Certain homomorphic properties • Ability to embed a trapdoor • Wealth of Cryptographic applications • Worst-case/average-case reduction • Solving LWE* (average problem) at least as hard as solving certain hard lattice problems in the worst-case • High resistance to algorithmic attacks • no quantum attacks known • no subexponential algorithms known *for specific error distribution
LWE: Search & Decision n: size of the secret, m: #samples q: modulus, :error dis/ion Public parameters Find Given: Goal: find s (or e) Distinguish Given: Goal: decide if or
S-to-D: Worst-Case vs Average Case • Clique (search): Given graph G and integer k, find a clique of size k in G, or say none exists. • Clique (decision): Given graph G and integer k, output YES if G has a clique of size k and NO otherwise. Theorem:Search <= Decision • Proof: Assume decider D. • for v in V • if D((G \ v, k)) = YES then G G \ v • return G Crucial:D is a worst-case (perfect) decider
S-to-D: Worst-Case vs Average Case this talk D is an average (imperfect) decider Pr[D(A, As + e) = YES] - Pr[D(A, t) = YES] = δ > 1/poly() probability taken over sampling the instance and D’s randomness
Search-to-Decision reductions (S-to-D) Why do we care? decision problems search problems - all LWE-based constructions rely on decisional LWE - strong indistinguishabilityflavor of security definitions - their hardness is better understood
Search-to-Decision reductions (S-to-D) Why do we care? decision problems search problems - all LWE-based constructions rely on decisional LWE - strong indistinguishability flavor of security definitions - their hardness is better understood • S-to-D reductions: “Primitive Π is ABC-Secure assuming search problem P is hard”
Our results • Toolset for studying Search-to-Decision reductions for LWE with polynomiallybounded noise. • Subsume and extend previously known ones • Reductions are in addition sample-preserving • Powerful and usable criteria to establish Search-to-Decision equivalence for general classes of knapsack functions • Use known techniques from Fourier analysis in a new context. Ideas potentially useful elsewhere
Our results • Toolset for studying Search-to-Decision reductions for LWE with polynomiallybounded noise. • Subsume and extend previously known ones • Reductions are in addition sample-preserving • Powerful and usable criteria to establish Search-to-Decision equivalence for general classes of knapsack functions • Use known techniques from Fourier analysis in a new context. Ideas potentially useful elsewhere
Bounded knapsack functions over groups Parameters - integer m - finite abelian group G - set S = {0,…, s - 1} of integers, s: poly(m) (Random) Knapsack family Samplingwhere Evaluation Example (random) modular subset sum:
Knapsack functions: Computational problems distribution over public invert (search) Input: Goal: Find x Input: Samples from either: Goal: Label the samples Distinguish (decision) Notation: family of knapsacks over G with distribution Glossary: If decision problem is hard, function is pseudorandom (PsR) If search problem is hard, function is One-Way
Search-to-Decision: Known results Decision as hard as search when… [Impagliazzo, Naor 89] : (random) modular subset sum , cyclic group uniform over [Fischer, Stern 96]: syndrome decoding , vector group uniform over all m-bit vectors with Hamming weight w.
Our contribution:S-to-D for general knapsack One-Way s: poly(m) : knapsack family with range G and input distribution over PsR + PsR
Our contribution: S-to-D for general knapsack One-Way s: poly(m) : knapsack family with range G and input distribution over Main Theorem PsR + PsR
Our contribution: S-to-D for general knapsack One-Way Main Theorem ✔ PsR Much less restrictive than it seems + PsR PsR In most interesting cases holds in a strong information theoretic sense
S-to-D for general knapsack: Examples One-Way Subsumes [IN89,FS96] and more Any group G and any distribution over PsR Any groupG with prime exponent and any distribution And many more… using known information theoretical tools (LHL, entropy bounds etc)
Proof overview Inverter Distinguisher Input: Goal: Distinguish Input:g , g.x Goal: Find x Reminder
Proof overview Inverter Predictor Distinguisher <= • Approach not (entirely) new [GL89, IN89] <= Input: Goal: Distinguish Input:g , g.x Goal: Find x Input:g , g.x, r Goal: find x.r (mod t) • Making it work in a general setting requires more advanced machinery and new technical ideas
Proof Sketch: Step 1 Inverter Predictor <= Input:g , g.x Goal: Find x Input:g , g.x, r Goal: find x.r (mod t)
Proof Sketch: Step 1 Inverter Predictor <= Input: f , f(x) Goal: Find x Input: f , f(x), r Goal: find x.r (mod t) This step holds for any function with domain • General conditions for inverting given noisy predictions for x.r (mod t) for possibly composite t • Goldreich–Levin: t=2 • Goldreich, Rubinfeld, Sudan: t prime
Digression: Fourier Transform where Basis functions: Fourier Representation: Fourier Transform:
Digression: Learning heavy coefficients [AGS03] Energy: τ xi h(xi) LHFC • LHFC is given query access to h. It outputs a list L s.t: • if , then L will most likely include α • LHFC runs in poly(m, 1/τ)
Inverting <= Predicting (predictor) Inverter Predictor Input: f, f(x), r Goal: guess x.r (mod t) Input: f, f(x) Goal: Find x Quality of Predictor Error distribution e = guess – x.r (mod t) bias: Imperfect (but useful) Imperfect (and useless) perfect
Inverting <= Predicting (main idea) Predictor t >= s Inverter Theorem Run. time: TP Bias:ε Run. time: poly(m, 1/ε) TP Succes Prob.: c.ε inverter Pred. Red. f, f(x) LHFC Proof Idea
Inverting <= Predicting (main idea) Predictor t >= s Inverter Theorem Run. time: TP Bias:ε, Run. time: poly(m, 1/ε) TP Succes Prob.: c.ε h inverter Pred. Red. f, f(x) LHFC Proof Idea When the predictor’s bias is ε, the unknown x has energy
Proof Sketch: Step 2 Predictor Distinguisher <= Input:g , g.x, r Goal: find x.r (mod t) Input: Goal: Distinguish • Reduction specific to knapsack functions • Proof follows outline of [IN89] but technical details very different.
Predicting <= Distinguishing Predictor Dist/er Input: Goal: Distinguish Input:g , g.x, r Goal: Guess x.r (mod t) • Predictor makes an initial guess for x.r (mod t) • Uses guess to create some input to the distinguisher • If dist/er outputs “knapsack”, predictor outputs guess • Otherwise, it revises the guess Proof Idea Key Property • Correct guess • Incorrect guess “closer” to • [IN89] used same idea for subset sum • For arbitrary groups proof significantly more involved
Our results • Toolset for studying Search-to-Decision reductions for LWE with polynomiallybounded noise. • Subsume and extend previously known ones • Reductions are in addition sample-preserving • Powerful and usable criteria to establish Search-to-Decision equivalence for general classes of knapsack functions • Use known techniques from Fourier analysis in a new context. Ideas potentially useful elsewhere
What about LWE? A A s e g1 g2…gm g1 g2…gm e m + , , G n G is the parity check matrix for the code generated by A Error e from LWE unknown input of the knapsack If A is“random”, G is also “random”
What about LWE? A A s e g1 g2…gm g1 g2…gm e + , , G The transformation works in the other direction as well Putting all the pieces together… Search Search Decision Decision (A, As +e ) <= (G, Ge) <= (G’, G’e) <= (A’,A’s’ + e) S-to-D for knapsack
LWE Implications LWE reductions follow from knapsacks reductions over • All known Search-to-Decision results for LWE/LPNwith bounded error[BFKL93, R05, ACPS09, KSS10] follow as a direct corollary • Search-to-Decision for new instantiations of LWE
LWE: Sample Preserving S-to-D All reductions are in addition sample-preserving If we can distinguish m LWE samples from uniform with 1/poly(n) advantage, we can find s with 1/poly(n) probability given m LWEsamples Caveat: Inverting probability goes down (seems unavoidable) Previous reductions b A poly(m) <= decision A’ b’ m , search ,
Why care about #samples? • LWE-based schemes often expose a certain number of samples, say m • With sample-preserving S-to-D we can base their security on the hardness of search LWE with m samples • Concrete algorithmic attacks against LWE [MR09, AG11] are sensitive to the number of exposed samples • for some parameters, LWE is completely broken by [AG11] if number of given samples above a certain threshold
Open problems Sample preserving reductions for • 1. LWE with unbounded noise • - Used in various settings [Pei09, GKPV10, BV11b, BPR11] • - reductions are known [Pei09] but are not sample-preserving • 2. ring LWE • - Samples (a, a*s+e) where a, s, e drawn from R=Zq[x]/<f(x)> • - non sample-preserving reductions known [LPR10]