-2
$\begingroup$

The two main advantages of lattice-based cryptography are

  1. resistance against quantum attacks

  2. Cryptosystems constructed using lattice are worst-case hardness. Are there are other advantages of lattice-based cryptography over ECC. Can we mention, cryptosystems based on lattices are simple to implement as it simpler operation(matrix multiplications) compared to ECC? How can we justify?

$\endgroup$
2
$\begingroup$

Cryptosystems constructed using lattice are worst-case hardness.

Actually, ECC also has the 'worse-case hardness' property; it is easy to blind an ECC DLog problem, converting an arbitrary case into a random case (and hence the average hardness of DLog problems is also the worse-case hardness).

Can we mention, cryptosystems based on lattices are simple to implement as it simpler operation(matrix multiplications) compared to ECC?

Well, to be efficient, lattice-based systems often use fancier matrix multiplication algorithms than the simple textbook algorithm; this cuts into the simplicity somewhat.

One advantage that you don't list for lattice-based systems: we know how to build somewhat homomorphic and fully homomorphic systems based on Lattice techniques; we don't know how to do that based on ECC.

On the other hand, I'm not exactly what you mean by "How can we justify"; diversity of hard problems isnt' a bad thing. It may be that we figure out how to efficiently compute discrete logs; actually, we're pretty certain that large scale Quantum Computers will be created at some point (even if we don't know if that's 10 years or 30 years down the road). To address that eventuality, looking at cryptosystems based on other hard problems (and believed to be quantum safe) is certainly justified.

$\endgroup$
  • $\begingroup$ But isn't the worst-case to average case reduction within the group as pointed out here. $\endgroup$ – Occams_Trimmer Oct 23 '17 at 12:28
  • 1
    $\begingroup$ @Occams_Trimmer: yes, just like the reduction in the Lattice case maintains the same dimension and field that the original Lattice was defined over... $\endgroup$ – poncho Oct 23 '17 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.