Lattices that admit logarithmic worst-case to average-case connection factors

Abstract

We demonstrate an average-case problem which is as hard as finding γ(n)-approximate shortest vectors in certain n-dimensional lattices in the worst case, where γ(n) = O( √ log n).The previously best known factor for any class of lattices was γ(n) =Õ(n).To obtain our results, we focus on families of lattices having special algebraic structure. Specifically, we consider lattices that correspond to ideals in the ring of integers of an algebraic number field. The worst-case assumption we rely on is that in some p length, it is hard to find approximate shortest vectors in these lattices, under an appropriate form of preprocessing of the number field. Our results build upon prior works by Micciancio (FOCS 2002), Peikert and Rosen (TCC 2006), and Lyubashevsky and Micciancio (ICALP 2006).For the connection factors γ(n) we achieve, the corresponding decisional promise problems on ideal lattices are not known to be NP-hard; in fact, they are in P. However, the search approximation problems still appear to be very hard. Indeed, ideal lattices are well-studied objects in computational number theory, and the best known algorithms for them seem to perform no better than the best known algorithms for general lattices.To obtain the best possible connection factor, we instantiate our constructions with infinite families of number fields having constant root discriminant. Such families are known to exist and are computable, though no efficient construction is yet known. Our work motivates the search for such constructions. Even constructions of number fields having root discriminant up to O(n 2/3− ) would yield connection factors better than the current best ofÕ(n).

Implementing Gentry’s Fully-Homomorphic Encryption Scheme

“…Namely, we can obtain bootstrappable schemes in any given dimension, but of course the schemes in low dimensions will not be secure. Our (rather crude) analysis suggests that the scheme may be practically secure at dimension n = 2 13 or n = 2 15 , and we put this analysis to the test by publishing a few challenges in dimensions from 512 up to 2 15 .…”

Candidate Multilinear Maps from Ideal Lattices

“…Peikert and Rosen [PR07] provided a reduction of an average-case lattice problem to the worstcase hardness of ideal lattice problem, where the lossiness of the reduction was only logarithmic over fields of small root discriminant. Gentry [Gen10] showed that ideal lattice problems are efficiently self-reducible (in some sense) in the quantum setting.…”

Worst-case to average-case reductions for module lattices

“…Note that all prior works on R-SIS except [32] used the polynomial embedding. However, the canonical embedding representation is mathematically sounder, and the unification leads to a more natural connection between R-SIS and R-LWE.…”

“…This problem is suspected to be extremely hard in the worst case for values of γ that are polynomial in the lattice dimension. But it is easy for ideal lattices, as Minkowski's bound on the lattice minimum is known to be essentially sharp in that case (see, e.g., [32,Se. 6]).…”

“…Peikert and Rosen [32] observed that solving R-SIS exactly consists in finding a short nonzero vector in a module lattice.…”