Help in understanding exactly how lattices are used as one-way functions for hashing

Question

In my long-distance cryptography course, an assignment covers lattice-based cryptography. It is hard, and I am lost. There is no one to help me.

Thus far, I have understood that:

• Lattices are a collection of regularly ordered points in Euclidean space (its terms like this which have caused me to search for answers for days).

• A lattice may be defined through n vectors called a basis where n = the dimension (for now, I am working in dimension 2), and any other basis can be found by applying positive or negative multiples of each vector in the basis to another vector in the basis.

• Defining a lattice L1 as a set of points allows one to multiply the whole set by some co-efficient which will essentially transform it into a new lattice L2.

• The determinant of the vectors of the basis essentially tells us the volume (area in 2 dimensions) of the parallelpiped, which will be repeated to form the lattice, the lattice points being the vertices.

But now I am stuck: how do I move all of this to cryptography? I am on a question that asks me to compute the output for 3 inputs to a function:

We will see that q-ary lattices give provably collision-resistant hashing. We choose integers q; a and b. Our hash function (presented by Mikl´os Ajtai in a breakthrough paper in 1996) is a 2-variable function: h(x, y) = ax + by mod q. (a) For q = 5; a = 14; b = 13; compute h(17, 8), h(21, 16) and h((17, 8) - (21, 16))

Having found the answers…

h(17, 8) = 14*17 + 13*8 = 342 mod 5 = 2; 
h(21, 16) = 14*21 + 13*16 = 502 mod 5 = 2; 
h((17, 8)-(21, 16)) -> (h(-4, -8) = 14*-4 + 13*-8 = 160 mod 5 = 0

I believe this means that with the first two points the lattice has been moved by some multiple of 5 plus two, which has displaced it by two and thus formed a new lattice. While in the last case, the lattice has been moved by a multiple of its determinant and thus is the same lattice.

However, I cannot understand the link to hashing. In an application, would the points be the cleartext and the answer be modulo 5 of the output of the hash function? If so, wouldn't there be too many collisions? We have already seen two examples that resulted in an answer of 2. How exactly is this linked to the shortest vector problem or short integer solution if they are not the same thing? Are q-ary lattices only an attempt to store the basic pattern needed to reproduce the lattice? And if so, wouldn't the lattice itself be the cleartext and the basic pattern (given by the basis and the determinant) the answer from the hash function? How exactly would you encrypt a message using a lattice?

I wish I could find some text explaining this in English rather than symbols… like this . Hopefully, I have not been repetitive.

Answer 1

I'm also afraid you couldn't understand this as D.W., but let us start. I sometimes cannot understand your questions. Please restate them, if possible.

The definition of the Ajtai hash functions

Let $n$, $m$, and $q$ be positive integers. Let $R = \mathbb{Z}_q$ be the quotient ring of integers modulo $q$. Let us define a function, which maps a vector in $D^m \subset R^m$ to $R^n$ and is indexed by a matrix $\boldsymbol{A} \in R^{n \times m}$ as follows:

$f_\boldsymbol{A}(\vec{x}) = \boldsymbol{A} \vec{x} \bmod{q} = \sum_{i=1}^{m} x_i \vec{a}_i \bmod{q}$.

The Ajtai hash functions is defined as a family of the above hash functions;

$\mathcal{F}_{n,m,q,D} = \{f_{\boldsymbol{A}}:D^m \to R^n \mid \boldsymbol{A} \in R^{n \times m}\}$.

You can obtain your function by setting $n=1$, $m=2$, $q=5$, and $D = R$; then set $\vec{a}_1 = 14 \ (= 4)$ and $\vec{a}_2 = 13 \ (= 3)$.

For example, you can set $n = 256$, $q = 4097$, $m = 4096$, and $D = \{0,1\}$. The input of the function is a bit string of length $4096$ and the output of the function on such parameters is $256$-dimensional vectors whose coefficients are in $\mathbb{Z}_q$.

Is it shrinking?

Good parameters makes the above functions shrinking. Correctly speaking, if the size of domain is larger than the size of range, that is, $|D|^m > |R|^n$, the function is (obviously) shrinking.

A possible choice of parameters is $D = \{0,1\}$ and $m > n \log_2(q)$, which often appears in the context. Another possible choice is $D = \{-1,1\}$ or $D = \{-1,0,1\}$.

Is it hard to find a collision? What is the relation between a collision and a short vector?

How exactly is this linked to the shortest vector problem or short integer solution if they are not the same thing?

If $D = R$, it is too easy to find the collision is function by the power of the linear algebra. You can use Gauss's elimination if $R$ is a field. But, if $D \subset R$ and the size of $D$ is small, it becomes hard. Roughly speaking, the number of collisions depends on the ration $|D|^m/|R|^n$.

In 1996, Ajtai shows that, for good parameters, if there exists an inverter of his hash functions, then there exists an algorithm finding a short vector from any $n$-dimensional lattice. Goldreich, Goldwasser, and Halevi pointed out in the note you refer that, if there exists an algorithm finding a collision of the Ajtai hash functions, then there exists an algorithm finding a short vector from any $n$-dimensional lattice. The reductions are based on the fact that the sum of short vectors is (relatively) short.

How should we interpret the above in lattice words?

You would skip this part.

We define a lattice related to a matrix $\boldsymbol{A}\in R^{n \times m}$ as

$\Lambda = \Lambda_q^{\perp}(\boldsymbol{A}) = \{\vec{e} \in \mathbb{Z}^m \mid \boldsymbol{A} \vec{e} \equiv \vec{0} \bmod{q}\}$.

This $\Lambda$ is an $m$-dimensional lattice. (You can check this is a lattice by verifying that for any two vectors $\vec{e}, \vec{e}' \in \Lambda$, the sum of them lies in $\Lambda$ again. You can check this is $m$-dimensional by verifying that any $q \vec{u}_i$ is in $\Lambda$, where $\vec{u}_i$ is a unit vector).

This lattice defines a map from $\mathbb{Z}^m$ to a quotient group $\mathbb{Z}^m/\Lambda$, which is isomorphic to $R^n$. The map is a hash function.

Conversely, a collision $\vec{e} \neq \vec{e}'$ for $f_{\boldsymbol{A}}$ implies a short non-zero vector $\vec{e}-\vec{e}'$ in $\Lambda_q^{\perp}(\boldsymbol{A})$.