Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Lattice-cryptography is the study and use of lattice problems applied to cryptography.

4
votes
1answer
47 views

Hash and sign via trapdoors for lattices

Both the papers GPV'08 and MP'11 present trapdoors for lattices that allow to recover $s\in\mathbb{Z}_q^n$ and the error vector $e\in\mathbb{Z}_q^m$ when given $y=As+e$, for $A\in\mathbb{Z}_q^{m\times ...
2
votes
1answer
53 views

Adapting LWE Trapdoors for Ring-LWE

In the paper Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller by Micciancio and Peikert, they present the following theorem about the existence of trapdoor for LWE. Theorem 5.1: There is an ...
0
votes
0answers
20 views

lattice-based key encryption scheme

I would like to ask that is there a lattice-based encryption scheme like the following scenario: There are three users (user1, user2, and user3) own their pk ($pk1,pk2$,and $pk3$) and sk ($sk1,sk2$, ...
0
votes
0answers
28 views

How to pick parameters in a lattice-based signature sheme?

I have been reading the paper Practical Lattice-Based Cryptography:A Signature Scheme for Embedded Systems (PDF). I have some questions about that paper. I do not know the reasons that the author ...
0
votes
1answer
52 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
7
votes
1answer
186 views

Why is Approximate GCD a hard problem?

There are many Fully Homomorphic Encryption over the Integers schemes whose security is based on the intractability of the Approximate GCD (AGCD) problem. The paper Algorithms for the Approximate ...
2
votes
0answers
32 views

IND-CCA2 post-quantum key exchange

QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems. I am looking for a post-quantum key exchange algorithm with the following ...
1
vote
1answer
29 views

How does forking lemma work in regard to Digital signatures produced by GPV hash and sign algorithm based on lattices?

I am working on understanding the concepts and approach behind digital signatures that are based on lattices specifically the GPV algorithm. During the security reduction of this method, the forking ...
2
votes
1answer
56 views

Original NTRU : How to calculate the size of private key?

In the original NTRU paper:NTRU: A Ring-Based Public Key Cryptosystem,1996, the author proposes 3 choices of implementation parameters: moderate, high and highest. Let's take moderate security level ...
1
vote
1answer
40 views

Counting the number of binary solutions of quadratic system

I have a quadratic system of equations related to a balanced RSA modulus $n=pq$ (i.e. $\log p\approx\log q$), and I want to give an upper bound on the number of solutions. Indeed, let $p_i,q_i$ be ...
1
vote
0answers
23 views

Extending the basis

Suppose I have $A \in \mathbb{Z}_q^{n \times m},A_1 \in \mathbb{Z}_q^{n \times m},A_2 \in \mathbb{Z}_q^{n \times m}$. I am following the $\textbf{ExtBasis}$ algorithm of this (Page No. 13). I ...
3
votes
1answer
54 views

Encoding of the message in Regev encryption

In public key encryption from LWE, we do the following steps $\textbf{PKE.KeyGen($1^n$)}$ takes as input the security parameter n, samples $A \leftarrow \mathbb{Z}_p^{n \times m}$ and $\textbf{e} \...
2
votes
1answer
110 views

LLL - Lattice Reduced Basis Algorithm question?

I have two related questions: Version 1: Let $B=\{b_1,b_2,\dots,b_n\}$ be an orthogonal basis for $R^n$. What is the associated reduced basis obtained by applying LLL algorithm to $B$? I know how ...
3
votes
1answer
91 views

Cryptanalysis on affine like matrix based strange cryptographic scheme [closed]

This is a garage made encryption scheme provided as cryptanalysis practice during 34C3 CTF. The challenge is done under the following assumptions All Mersenne twister instances are MT19937 64bit ...
8
votes
1answer
552 views

Lattice-based cryptography

How viable is lattice-based cryptography in a "practical" setting? It has been said that lattice-based cryptography would be a "post-quantum" cryptography scheme, but is it feasibly implementable?
2
votes
0answers
39 views

SampleLeft function in lattice trapdoors

We have SampleLeft function in lattice trapdoors as Algorithm $\textbf{SampleLeft}(A,M_1,T_A,u,\sigma)$: $\textbf{Input}$: a rank $n$ matrix $A$ in $\mathbb{Z}^{n×m}_q$ and a matrix $M_1$ in $\...
2
votes
1answer
86 views

A query on Learning with errors(LWE) problem

In generating an LWE sample, we do $s\xleftarrow{$}\mathbb{Z}_q^{n}, A \xleftarrow{$}\mathbb{Z}_q^{n \times m}~$and $e\xleftarrow{$}\mathbb{{\chi}^{m}}$ Then we compute $b^T$ = $s^TA$ + $e^T$ and ...
0
votes
0answers
39 views

Multi-party Key Exchange protocol from lattice

There are many two-party or three-party key exchange protocols from lattice. But, it seems that there is no famous multi-party key exchange protocol. Does anyone know the relevant knowledge? Or ...
2
votes
2answers
73 views

Lattice generation from basis?

This might be a very short very obvious answer, because I've yet to come across a question similar to mine in my searches. Given a lattice L, with a good base B1 and a bad base B2, what stops an ...
1
vote
1answer
49 views

Can i use Babai algorithm in q-ary lattice

Let's assume we have the q-ary lattice $$ \mathcal{L}_q({\bf A})=\{ {\bf z}\in \mathbb{Z}^{n} : \exists {\bf s}\in \mathbb{Z}^{n}_{q} \ , \ {\bf z}={\bf A s}^{T} \mod q \},$$ where ${\bf A}\in \...
0
votes
0answers
50 views

About practical implementation of Ring-SIS/LWE Based Signature and IBE

In paper: Practical Implementation of Ring-SIS/LWE Based Signature and IBE, authors provided the source code for IBE. In the Extract algorithm, they said: $a \cdot x = u \bmod p$ but I can not ...
1
vote
0answers
41 views

Effitiently sampling the error (noise) distribution in ring-LWE

In LPR12, page 4 is described a ring-LWE encryption in which we are working in a ring $R = \mathbb{Z}[x]/(x^n + 1)$ for a $n$ a power of 2. The public key is of the form $(a, b= a\cdot s + e)$ where $...
0
votes
0answers
53 views

Discrete Gaussian Sampling in Authenticated key exchange from ideal lattices

I am implementing the key exchange scheme proposed by zhang et al. on Sage. In the implementation of the scheme, they have used the two distributions $\chi_{\alpha}, \chi_{\beta}$. How to choose $\...
4
votes
1answer
86 views

Decision-LWE to Search-LWE

Regev requires $q$ to be prime on lemma 4.2 of his paper for LWE. Why does he require that and how this effect the proof of lemma 4.2?
3
votes
1answer
127 views

Discrete Gaussian Sampling role in Lattice-Based Crypto?

I'm reading up on how post-quantum cryptography works, and stumbled upon the notion of discrete Gaussian sampling. However, I can't understand where it fits in the greater picture - currently it feels ...
2
votes
0answers
28 views

determinant of intersection of two lattices

Say $L_1,L_2$ are contained in $\mathbb Z^r$ with \begin{gather*} \operatorname{rank}(L_1) = \operatorname{rank}(L_2) = r, \\ \gcd(\det(L_1), \det(L_2)) = 1. \end{gather*} How do I prove $\...
2
votes
0answers
23 views

Size of $q$ in reductions from lattice problems to R-SIS

The Short integer solution problem is parameterized by four values: $n$, the dimension of the vectors that must be added $m$, the number of samples (dimension of the solution) $\beta$, upper-bound ...
4
votes
1answer
99 views

Hardness of Short Interger Solution in lattices

Short Integer Solution ($SIS_{n,m,q,\beta}$) is defined as Given a matrix $A \in \mathbb{Z}_{q}^{n \times m}$, find a non-zero vector $x \in \mathbb{Z}^{m}$ such that $A \cdot x = 0\mod q$ and $||x|| ...
2
votes
1answer
30 views

Dividing elements in $R_q$ by $z$ in Grag-Gentry-Halevi (GGH) Graded Encoding Scheme

I'm trying to understand the GGH graded encoding scheme, but something there leaves me very confused and I can not figure out how to explain it: Let $R := \mathbb{Z}[X]/(X^n+1)$, where $n$ is a power ...
2
votes
1answer
188 views

Breaking Truncated Linear Congruential Generator with known parameters

There is an elaborate discussion on the breaking of TLCG on the link below, where they show how to break the generator with known parameters given the most significant bits. Problem with LLL reduction ...
1
vote
1answer
66 views

Function families from lattices

On this course, Micciancio talks about function families (functions parametrized by some value) that can be used in cryptography. On page 2, he presents the following function family parametrized by ...
3
votes
1answer
71 views

Effect of tail cutting and precision of discrete Gaussian sampling on LWE / Ring-LWE security

How does tail cutting and precision of discrete Gaussian sampling implementations affect LWE / Ring-LWE security? Is there a rule of thumb or guideline for choosing the tail cut and the precision for ...
3
votes
1answer
127 views

Is there any course video for lattice cryptography? [closed]

Recently, I started doing research about Lattice Based Cryptography. and searched on YouTube a lot of public talks or seminars about it. But is there any course video (graduated course) related to ...
1
vote
1answer
67 views

Is it secure using LWE-based cryptosystem under RLWE-based parameters?

I'm computer guy having trouble with cryptography. I recently read the BGV Homomorphic encryption paper which was constructed under both LWE and RLWE assumptions. I was implementing Threshold ...
0
votes
0answers
47 views

Lattice Reduction Method to solve multivariate equation

I have seen very small work in multivariate RSA polynomial modular equation solutions using Coppersmith's based lattice reduction algorithm (LLL). Is there any mechanism to solve the following type ...
1
vote
1answer
54 views

Practical Key exchange for Internet

In section 3.2 (page 10) of Vikram Singh's paper A practical Key Exchange for the internet using Lattice Cryptography, he gives the number of elements in each set for odd $q$. However, the results do ...
0
votes
0answers
83 views

Lattice cryptography, key size of public and private key?

An answer to this question what are the NTRU keysize and application in industry? mentions that lattice cryptography has public keys and private keys of the same size. That seems like a property that ...
1
vote
0answers
29 views

Why do the game-hops in Kyber and related papers contain 2 steps at a time?

In the Kyber paper in section 3 about the Kyber IND-CPA Encryption there is a proof by sequence of games containing three games. I understand that in the first game hop the M-LWE advantage is used to ...
4
votes
0answers
33 views

Relation between k-th shortest vector of a lattice and (n-k+1)-th shortest of its dual

Let $\Lambda$ be an $n$-dimensional lattice and $\Lambda^*$ be its dual lattice. For any $k \in \{1, 2, ..., n\}$, let $\lambda_k(\Lambda)$ be the $k$-th successive minima of $\Lambda$ (analogously ...
3
votes
0answers
51 views

How does error distribution affect security in lattices?

It's easy to see that the crucial part of any lattice scheme is the added error. And different schemes seem to use different error distributions, some use Gaussian some use centered Binomial. Though, ...
-1
votes
2answers
116 views

A good book on lattices [closed]

I have recently started studying lattices. The book that I am following is "Complexity of lattice problem by Shafi Goldwasser and Daniele micciancio" but it is too much inclined towards computational ...
1
vote
0answers
62 views

Hardness of $SIS$ and its reduction to an NP-complete problem

Short Integer Solution ($ SIS_\gamma^{(q,n,m,\beta)}$): Given a matrix $A\in Z_{q}^{n×m}$, find $x \in Z^m $, such that $Ax=0\mod q$ and $||x|| \le \beta$ Is $SIS\in NP$ ? If $SIS \in NP$, then it ...
3
votes
1answer
147 views

Minkowski's theorem in lattice-based cryptography

I am studying basic lattice-based cryptography. In the course given by O. Regev, on page number 7, there is Claim 1 and Corollary 2 (Minkowski's First Theorem), both of which are difficult for me to ...
4
votes
1answer
128 views

Lattice-based cryptography prone to side channel attacks?

Are Lattice-based cryptography still prone to side channel attacks? What are some mitigration strategies, if any.
-1
votes
2answers
370 views

Lattice-based cryptosystems for blockchain/ledger?

Are there lattice-based cryptosystems based i.e., SIS (Short Integer Solutions) and LWE (Learning with Errors) blockchain solutions for a post quantum world? Has the Unique Shortest Vector Problem (...
0
votes
0answers
26 views

XORing bitstrings to get small hamming weight using lattice SVP algo

I have a list of bit vectors of same length, and I want to find the combination of them which bitwise-XOR sum have the smallest (non-zero) hamming weight (or just a "rather small" hamming weight). ...
2
votes
0answers
59 views

Lattices with hidden short vectors and an algorithm for a special case of the SVP

For the purpose of testing algorithms for lattice basis reduction or finding short vectors, it would be useful to have examples of lattices where short vectors are hidden, that is, a nontrivial ...
9
votes
0answers
243 views

Potential Flaws With Lattice Based Cryptography?

From researching post-quantum cryptographic schemes it seems hash-based and lattice-based algorithms are the most promising (MQ-based seem to be covered by patents and have more potential unknowns ...
4
votes
1answer
228 views

What is the difference between Module-LWE and Ring-LWE?

Recently, the CRYSTALS lattice-based cryptographic suite has been published, which is based on "module lattices". What is Module-LWE? How is it different from Ring-LWE?
0
votes
0answers
62 views

Is there a connection between lattice based cryptography and random walk on a lattice?

What is the connection between lattice based cryptograph and random walk?