On Ideal Lattices and Learning with Errors over Rings

Lyubashevsky, Vadim; Peikert, Chris; Regev, Oded

doi:10.1007/978-3-642-13190-5_1

Cited by 1,195 publications

(703 citation statements)

References 28 publications

Supporting

Mentioning

591

Contrasting

Order By: Relevance

“…The first Product NTRU system, introduced by Lyubashevsky, Peikert, and Regev in [87] The ciphertext size here, two elements of R/q, can be improved in various ways. One can replace hr with fewer coefficients, for example by simply summing batches of three coefficients [100], before adding M and m. Rounded Product NTRU rounds hr + M to obtain m + hr + M , rounds Ar to obtain d + Ar, and (to similarly reduce key size) rounds Af to obtain e + Af .…”

Section: The Design Space Of Lattice-based Encryptionmentioning

confidence: 99%

“…The argument begins with statements from Lyubashevsky, Peikert, and Regev [87] that the Ring-LWE problem-with cyclotomic P , split q, and a wide errorhas "very strong hardness guarantees" and in turn provides a "truly practical lattice-based public-key cryptosystem with an efficient security reduction". These statements allude to a conversion -from any attack algorithm against the cryptosystem -into an algorithm to solve the worst case of a "hard" SVP-like ideal-lattice problem.…”

Section: Worst-case-to-average-case Reductionsmentioning

confidence: 99%

“…Unlike our paper, [5] follows the tradition from NTRU and Ring-LWE [87] of using cyclotomic rings. More precisely, [5] is an example of Product NTRU NTT, using the ring (Z/q)[x]/(x p + 1) with p = 1024 and q = 12289 = 12 · 1024 + 1.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

NTRU Prime: Reducing Attack Surface at Low Cost

Bernstein

Chuengsatiansup

Lange

et al. 2017

Lecture Notes in Computer Science

124

View full text Add to dashboard Cite

Abstract. Several ideal-lattice-based cryptosystems have been broken by recent attacks that exploit special structures of the rings used in those cryptosystems. The same structures are also used in the leading proposals for post-quantum lattice-based cryptography, including the classic NTRU cryptosystem and typical Ring-LWE-based cryptosystems. This paper (1) proposes NTRU Prime, which tweaks NTRU to use rings without these structures; (2) proposes Streamlined NTRU Prime, a public-key cryptosystem optimized from an implementation perspective, subject to the standard design goal of IND-CCA2 security; (3) finds high-security post-quantum parameters for Streamlined NTRU Prime; and (4) optimizes a constant-time implementation of those parameters. The resulting sizes and speeds show that reducing the attack surface has very low cost.

show abstract

Section: The Design Space Of Lattice-based Encryptionmentioning

confidence: 99%

Section: Worst-case-to-average-case Reductionsmentioning

confidence: 99%

See 1 more Smart Citation

NTRU Prime: Reducing Attack Surface at Low Cost

Bernstein

Chuengsatiansup

Lange

et al. 2017

Lecture Notes in Computer Science

124

View full text Add to dashboard Cite

show abstract

“…The ring learning with errors problem (RLWE) was introduced in [30]. It is the mapping of the LWE problem from the vectors over Z q to polynomial rings over R q .…”

Section: Ring Learning With Errorsmentioning

confidence: 99%

SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers

Khedr

Gulak

Vaikuntanathan

2016

IEEE Trans. Comput.

View full text Add to dashboard Cite

Abstract-Homomorphic encryption (HE) systems enable computations on encrypted data, without decrypting and without knowledge of the secret key. In this work, we describe an optimized Ring Learning With Errors (RLWE) based implementation of a variant of the HE system recently proposed by Gentry, Sahai and Waters (GSW). Although this system was widely believed to be less efficient than its contemporaries, we demonstrate quite the opposite behavior for a large class of applications. We first highlight and carefully exploit the algebraic features of the system to achieve significant speedup over the state-of-the-art HE implementation, namely the IBM homomorphic encryption library (HElib). We introduce several optimizations on top of our HE implementation, and use the resulting scheme to construct a homomorphic Bayesian spam filter, secure multiple keyword search, and a homomorphic evaluator for binary decision trees. Our results show a factor of 10× improvement in performance (under the same security settings and CPU platforms) compared to IBM HElib for these applications. Our system is built to be easily portable to GPUs (unlike IBM HElib) which results in an additional speedup of up to a factor of 103.5× to offer an overall speedup of 1035×.

show abstract

“…The ring variant of learning with errors problem (R-LWE) have been mostly used in new generation public key cryptosystems [5] and hash functions [6]. Ideal lattices with special properties are needed to construct R-LWE based schemes.…”

Section: Algorithm 1 Interleaved Montgomery Modular Multiplication Almentioning

confidence: 99%

Efficient interleaved Montgomery modular multiplication for lattice-based cryptography

Akleylek

Tok

2014

IEICE Electron. Express

View full text Add to dashboard Cite

In this paper, we give modified version of interleaved Montgomery modular multiplication method for lattice-based cryptography. With the proposed algorithms, we improve the multiplication complexity and embed the conversion operation into the algorithm with almost free cost. We implement the proposed methods for the quotient ring (Z/qZ)[x]/ (x n − 1) and (Z/pZ)[x]/(x n + 1) on the GPU (NVIDIA Quadro 600) using the CUDA platform. NTRUEncrypt is accelerated approximately 35% on the GPU by using the proposed method. We receive at least 19% improvement with the proposed method for the polynomial multiplication in (Z/pZ)[x]/ (x n + 1), where n ∈ f1024, 2048, 4096g.

show abstract

On Ideal Lattices and Learning with Errors over Rings

Cited by 1,195 publications

References 28 publications

NTRU Prime: Reducing Attack Surface at Low Cost

NTRU Prime: Reducing Attack Surface at Low Cost

SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers

Efficient interleaved Montgomery modular multiplication for lattice-based cryptography

Contact Info

Product

Resources

About