Lattice Reduction Algorithm Research Articles

Distributed Identity Authentication with Lenstra-Lenstra-Lovász Algorithm-Ciphertext Policy Attribute-Based Encryption from Lattices: An Efficient Approach Based on Ring Learning with Errors Problem.

In recent years, research on attribute-based encryption (ABE) has expanded into the quantum domain. Because a traditional single authority can cause the potential single point of failure, an improved lattice-based quantum-resistant identity authentication and policy attribute encryption scheme is proposed, in which the generation of random values is optimized by adjusting parameters in the Gaussian sampling algorithm to improve overall performance. Additionally, in the key generation phase, attributes are processed according to their shared nature, which reduces the computational overhead of the authorization authority. In the decryption phase, the basis transformation of the Lenstra-Lenstra-Lovász (LLL) lattice reduction algorithm is utilized to rapidly convert shared matrices into the shortest vector form, which can reduce the computational cost of linear space checks. The experimental results demonstrate that the proposed method not only improves efficiency but also enhances security compared with related schemes.

On the Concrete Security of LWE With Small Secret

Lattice-based cryptography is currently under consideration for standardization in the ongoing NIST PQC Post-Quantum Cryptography competition, and is used as the basis for Homomorphic Encryption schemes world-wide. Both applications rely specifically on the hardness of the Learning With Errors (LWE) problem. Most Homomorphic Encryption deployments use small secrets as an optimization, so it is important to understand the concrete security of LWE when sampling the secret from a non-uniform, small distribution. Although there are numerous heuristics used to estimate the running time and quality of lattice reduction algorithms such as BKZ2.0, more work is needed to validate and test these heuristics in practice to provide concrete security parameter recommendations, especially in the case of small secret. In this work, we introduce a new approach which uses concrete attacks on the LWE problem as a way to study the performance and quality of BKZ2.0 directly. We find that the security levels for certain values of the modulus q and dimension n are smaller than predicted by the online Lattice Estimator, due to the fact that the attacks succeed on these uSVP lattices for blocksizes which are smaller than expected based on current estimates. We also find that many instances of the TU Darmstadt LWE challenges can be solved significantly faster when the secret is chosen from the binary or ternary distributions.

Improved GNSS Ambiguity Fast Estimation Reduction Algorithm.

The fast and accurate solution of integer ambiguity is the key to achieve GNSS high-precision positioning. Based on the lattice theory of high-dimensional ambiguity solving, the reduction time consumption is much larger than the search time consumption, and it is especially important to improve the efficiency of the lattice basis reduction algorithm. The Householder QR decomposition with minimal column pivoting is utilized to pre-sort the basis vectors and reduce the number of basis vector exchanges during the reduction process by partial size reduction and relaxing the basis vector exchange condition to improve the reduction efficiency of the LLL algorithm. The improved algorithm is validated using simulated and measured data, respectively, and the performance advantages and disadvantages of the improved algorithm are evaluated from the perspectives of the extent of reduction basis orthogonality and the quality of reduction basis size reduction. The results show that the improved LLL algorithm can significantly reduce the number of basis vector exchanges and the reduction time consumption. The HSLLL and PSLLL algorithms with the Siegel condition as the basis vector exchange condition have a better reduction effect, but are slightly less stable. The PLLLR algorithm significantly improves the search ambiguity resolution efficiency, which is conducive to the rapid realization of ambiguity resolution.

A reduction from an LWE problem to maximum independent set problems

The learning with errors (LWE) problem is a problem derived from machine learning that is believed to be intractable for quantum computers. This paper proposes a method that can reduce an LWE problem to a set of maximum independent set (MIS) problems, which are graph problems that are suitable for a quantum annealing machine to solve. The reduction algorithm can reduce an n-dimensional LWE problem to several small MIS problems with at most 2^{O(sqrt{n})} nodes when the lattice-reduction algorithm used in the LWE-reduction method successfully finds short vectors. The algorithm is useful for solving LWE problems in a quantum-classical hybrid manner by using an existing quantum algorithm to solve the MIS problems. For example, the smallest LWE challenge problem is reduced to MIS problems with about 40,000 vertices. This result means that the smallest LWE challenge problem will be within the scope of a real quantum computer in the near future.

Development and analysis of massive parallelization of a lattice basis reduction algorithm

Development and analysis of massive parallelization of a lattice basis reduction algorithm

Improved Attacks on (EC)DSA with Nonce Leakage by Lattice Sieving with Predicate

Lattice reduction algorithms have been proved to be one of the most powerful and versatile tools in public key cryptanalysis. In this work, we primarily concentrate on lattice attacks against (EC)DSA with nonce leakage via some sidechannel analysis. Previous works relying on lattice reduction algorithms such as LLL and BKZ will finally lead to the “lattice barrier”: lattice algorithms become infeasible when only fewer nonce is known. Recently, Albrecht and Heninger introduced lattice algorithms augmented with a predicate and broke the lattice barrier (Eurocrypt 2021). We improve their work in several aspects.We first propose a more efficient predicate algorithm which aims to search for the target lattice vector in a large database. Then, we combine sieving with predicate algorithm with the “dimensions for free” and “progressive sieving” techniques to further improve the performance of our attacks. Furthermore, we give a theoretic analysis on how to choose the optimal Kannan embedding factor.As a result, our algorithm outperforms the state-of-the-art lattice attacks for existing records such as 3-bit nonce leakage for a 256-bit curve and 2-bit nonce leakage for a 160-bit curve in terms of running time, sample numbers and success probability. We also break the lattice records on the 384-bit curve with 3-bit nonce leakage and the 256-bit curve with 2-bit nonce leakage which are thought infeasible previously. Finally, we give the first lattice attack against ECDSA with a single-bit nonce leakage, which enables us to break a 112-bit curve with 1-bit nonce leakage in practical time.

Improving convergence and practicality of slide-type reductions

The best lattice reduction algorithm known in theory for approximating the Shortest Vector Problem (SVP) over lattices is the slide reduction algorithm (STOC '08 & CRYPTO '20). In this paper, we first improve the running time analysis of computing slide-reduced bases based on potential functions. This analysis applies to a generic slide reduction algorithm that includes (natural variants of) slide reduction and block-Rankin reduction (ANTS '14). We then present a rigorous dynamic analysis of generic slide reduction using techniques originally applied to a variant of BKZ (CRYPTO '11). This provides guarantees on the quality of the current lattice basis during execution. This dynamic analysis not only implies sharper convergence for these algorithms to find a short nonzero vector (rather than a fully reduced basis), but also allows to heuristically model/trace the practical behaviour of slide reduction. Interestingly, this dynamic analysis inspires us to introduce a new slide reduction variant with better time/quality trade-offs. This is confirmed by both our experiments and simulation, which also show that our variant is competitive with state-of-the-art reduction algorithms. To the best of our knowledge, this work is the first attempt of improving the practical performance of slide reduction beyond speeding up the SVP oracle.

Guassian Lattice Reduction Algorithm in Two-Dimensions

An approximation approach for the shortest vector problem, the Lenstra-Lenstra-Lovasz (LLL) Algorithm completes its computations in polynomial time and produces an estimate that is within an exponential factor of the true solution. It's a technique that can be used in practice and is accurate enough to crack cryptosystems, factor polynomials over integers, and solve integer linear programming problems. For the purpose of using the Gauss method "inside" We present a comprehensive examination of the LLL method in the context of a collection of realistic probabilistic models. The proofs focus on both the underlying dynamical systems and the transfer operators. Finding a lattice of Euclidean space with a short basis from a skewed starting point is known as the lattice reduction problem. Especially in cryptology, lattice reduction techniques offer remarkable use in mathematics and computer science.

Solving HNP with One Bit Leakage: An Asymmetric Lattice Sieving Algorithm

The Hidden Number Problem (HNP) was introduced by Boneh and Venkastesan to analyze the bit-security of the Diffie-Hellman key exchange scheme. It is often used to mount a side-channel attack on (EC)DSA. The hardness of HNP is mainly determined by the number of nonce leakage bits and the size of the modulus. With the development of lattice reduction algorithms and lattice sieving, the range of practically vulnerable parameters are extended further. However, 1-bit leakage is still believed to be challenging for lattice attacks. In this paper, we proposed an asymmetric lattice sieving algorithm that can solve HNP with 1-bit leakage. The algorithm is composed of a BKZ pre-processing and a sieving step. The novel part of our lattice sieving algorithm is that the lattice used in these two steps have different dimensions. In particular, in the BKZ step we use more samples to derive a better lattice basis, while we just use truncated lattice basis for the lattice sieving step. To verify our algorithm, we use it to solve HNP with 1-bit leakage and 116-bit modulus.

Improved Lattice Reduction Algorithms on Lattices of Small Determinants

Improved Lattice Reduction Algorithms on Lattices of Small Determinants

Guessing Bits: Improved Lattice Attacks on (EC)DSA with Nonce Leakage

The lattice reduction attack on (EC)DSA (and other Schnorr-like signature schemes) with partially known nonces, originally due to Howgrave-Graham and Smart, has been at the core of many concrete cryptanalytic works, side-channel based or otherwise, in the past 20 years. The attack itself has seen limited development, however: improved analyses have been carried out, and the use of stronger lattice reduction algorithms has pushed the range of practically vulnerable parameters further, but the lattice construction based on the signatures and known nonce bits remain the same.In this paper, we propose a new idea to improve the attack based on the same data in exchange for additional computation: carry out an exhaustive search on some bits of the secret key. This turns the problem from a single bounded distance decoding (BDD) instance in a certain lattice to multiple BDD instances in a fixed lattice of larger volume but with the same bound (making the BDD problem substantially easier). Furthermore, the fact that the lattice is fixed lets us use batch/preprocessing variants of BDD solvers that are far more efficient than repeated lattice reductions on non-preprocessed lattices of the same size. As a result, our analysis suggests that our technique is competitive or outperforms the state of the art for parameter ranges corresponding to the limit of what is achievable using lattice attacks so far (around 2-bit leakage on 160-bit groups, or 3-bit leakage on 256-bit groups).We also show that variants of this idea can also be applied to bits of the nonces (leading to a similar improvement) or to filtering signature data (leading to a data-time trade-off for the lattice attack). Finally, we use our technique to obtain an improved exploitation of the TPM–FAIL dataset similar to what was achieved in the Minerva attack.

Factoring the Modulus of Type N = p2q by Finding Small Solutions of the Equation er − (Ns + t) = αp2 + βq2

The modulus of type N=p2q is often used in many variants of factoring-based cryptosystems due to its ability to fasten the decryption process. Faster decryption is suitable for securing small devices in the Internet of Things (IoT) environment or securing fast-forwarding encryption services used in mobile applications. Taking this into account, the security analysis of such modulus is indeed paramount. This paper presents two cryptanalyses that use new enabling conditions to factor the modulus N=p2q of the factoring-based cryptosystem. The first cryptanalysis considers a single user with a public key pair (e,N) related via an arbitrary relation to equation er−(Ns+t)=αp2+βq2, where r,s,t are unknown parameters. The second cryptanalysis considers two distinct cases in the situation of k-users (i.e., multiple users) for k≥2, given the instances of (Ni,ei) where i=1,…,k. By using the lattice basis reduction algorithm for solving simultaneous Diophantine approximation, the k-instances of (Ni,ei) can be successfully factored in polynomial time.

Adaptive iterative error recovery detection algorithm for uplink massive multiple‐input multiple‐output systems

In this paper, an error recovery (ER) detection based on the lattice reduction (LR) algorithm with adaptive iteration is presented for uplink massive multiple-input multiple-output (MIMO) systems to obtain an improved bit error rate (BER) performance, especially when the number of active users increases. In the proposed algorithm, as the result of LR pre-processing, a larger diagonally dominant index (DDI) is used to measure the diagonal dominance of gram matrix for the initialisation of the ER detection. In addition, the larger DDI could be further used to realise adaptive iteration, which helps to strike a trade-off between the BER performance and the computational complexity. Moreover, two properties of the DDI are derived, and the simulation results show that the larger DDI leads to better detection performance, and it could be widely applied to linear elimination and MIMO detection algorithms.

Encryption and Decryption of Images using GGH Algorithm: Proposed

Images are considered as important data used in many fields such as military operations, medical imaging, and astronomy researches. For sending images through an insecure network, it is necessary to develop a secure encryption algorithm when transmitting the images. Three main properties of security services (i.e., confidentiality, integrity, and availability), the confidentiality is the most essential feature for exchanging images. The Goldreich Goldwasser Halevi (GGH) algorithm can be a good method for encrypting images as both the algorithm and sensitive data are represented in numeric matrices. Additionally, the GGH algorithm does not increase the size of the image. However, one of the disadvantages of using the GGH algorithm is the attacking of GGH cryptosystem mainly relied on special properties of the lattice generated. This shortcoming of GGH algorithm has been taken to proposed lattice reduction algorithms. A lattice basis reduction algorithm to get a better basis which is used into encryption and decryption approach.

Lattice Size and Generalized Basis Reduction in Dimension Three

The lattice size of a lattice polytope P was defined and studied by Schicho, and Castryck and Cools. They provided an “onion skins” algorithm for computing the lattice size of a lattice polygon P in $$\mathbb R^2$$ based on passing successively to the convex hull of the interior lattice points of P. We explain the connection of the lattice size to the successive minima of $$K=(P+(-P))^*$$ and to the lattice reduction with respect to the general norm that corresponds to K. It follows that the generalized Gauss algorithm of Kaib and Schnorr (which is faster than the “onion skins” algorithm) computes the lattice size of any convex body in $$\mathbb R^2$$ . We extend the work of Kaib and Schnorr to dimension three, providing a fast algorithm for lattice reduction with respect to the general norm defined by a convex origin-symmetric body $$K\subset \mathbb R^3$$ . We also explain how to recover the successive minima of K and the lattice size of P from the obtained reduced basis and therefore provide a fast algorithm for computing the lattice size of any convex body $$P\subset \mathbb R^3$$ .

Coppersmith's lattices and “focus groups”: An attack on small-exponent RSA

We present a principled technique for reducing the lattice and matrix size in some applications of Coppersmith's lattice method for finding roots of modular polynomial equations. It relies on extrapolating patterns from the actual behavior of Coppersmith's attack for smaller parameter sizes, which can be thought of as “focus group” testing. When applied to the small-exponent RSA problem, our technique reduces lattice dimensions and consequently running times, and hence can be applied to a wider range of exponents. Moreover, in many difficult examples our attack is not only faster but also more successful in recovering the RSA secret key. We include a discussion of subtleties concerning whether or not existing metrics (such as enabling condition bounds) are decisive in predicting the true efficacy of attacks based on Coppersmith's method. Finally, indications are given which suggest certain lattice basis reduction algorithms (such as Nguyen-Stehlé's L2) may be particularly well-suited for Coppersmith's method.

Ready-made short basis for GLV+GLS on high degree twisted curves

<abstract><p>The crucial step in elliptic curve scalar multiplication based on scalar decompositions using efficient endomorphisms—such as GLV, GLS or GLV+GLS—is to produce a short basis of a lattice involving the eigenvalues of the endomorphisms, which usually is obtained by lattice basis reduction algorithms or even more specialized algorithms. Recently, lattice basis reduction is found to be unnecessary. Benjamin Smith (AMS 2015) was able to immediately write down a short basis of the lattice for the GLV, GLS, GLV+GLS of quadratic twists using elementary facts about quadratic rings. Certainly it is always more convenient to use a ready-made short basis than to compute a new one by some algorithm. In this paper, we extend Smith's method on GLV+GLS for quadratic twists to quartic and sextic twists, and give ready-made short bases for $ 4 $-dimensional decompositions on these high degree twisted curves. In particular, our method gives a unified short basis compared with Hu et al.'s method (DCC 2012) for $ 4 $-dimensional decompositions on sextic twisted curves.</p></abstract>

Storage efficient algorithm for Hermite Normal Form using LLL

Computing HNF has a long history, but designing a storage efficient algorithm is a challenging issue for matrices of large sizes. One of the main challenges in the design of storage efficient HNF algorithm is to control the rank and the size of the intermediate input. In our proposed algorithm, we use a multiple extended gcd algorithm and show that the rank of the intermediate input matrix decreases as the number of iteration increases. The determinant of the intermediate input matrix of our algorithm is a factor of the determinant d of the input matrix and thus size reduction modulo d can be done in the computations of our algorithm. By using a lattice reduction algorithm and a proven quality of LLL reduced basis, we prove that the storage of the intermediate input matrix Bk of our algorithm is less than (n−k+1)((n−k+1)(n−k)4+log2⁡d) in bits. Therefore, it is expected that a smaller storage for kth iteration is required as k closes to n. We compare the intermediate computations of our algorithm to MW-type algorithm which has an optimal asymptotic space requirement. Our experimental example and results on intermediate size suggest that the intermediate storage of our HNF algorithm is comparable to MW-type algorithm and well controlled by the intermediate input size.

On Solving the Shortest Basis Problem Based on Sequential Reduction

Low-complexity lattice reduction algorithms are generally not optimized for solving the shortest basis problem (SBP). We fill this blank by tweaking the recently introduced sequential reduction (SR). In a quest for developing a provable and low-complexity reduction algorithm under the SR framework, we propose to employ successive interference cancellation (SIC) as a subroutine inside SR, and the whole algorithm is referred to as SR-SIC. On the theoretical front, we prove that the upper bound on the basis length of SR-SIC is better than those of major Lenstra, Lenstra, and Lovasz (LLL) based variants when the dimension of the lattice basis is no larger than 4. In practice, we show by simulations that SR-SIC yields higher information rate than LLL when designing integer-forcing linear receivers, in which SR-SIC also enjoys lower computational complexity.

Optimization of Integer-Forcing Precoding for Multi-User MIMO Downlink

Integer-forcing (IF) precoding is an alternative to linear precoding for multi-user (MU) multiple-input-multiple-output (MIMO) channels, with the potential to offer superior performance at a similar complexity. In this letter, a low-complexity suboptimal method is proposed to optimize the parameters of an IF scheme for any number of $K$ users. The proposed method involves solving a relaxation of the problem followed by the application of a lattice reduction algorithm and is shown to have an overall complexity of $\mathcal{O}(K^3)$. Simulation results show that the proposed method achieves a higher sum rate than a heuristic choice of parameters and significantly outperforms conventional linear precoding in all simulated scenarios.