Short Stickelberger Class Relations and Application to Ideal-SVP

Cramer, Ronald; Ducas, Léo; Wesolowski, Benjamin

doi:10.1007/978-3-319-56620-7_12

Cited by 76 publications

(62 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Remark 2. In particular, Theorem 1.2 implies that the relative class group of a cyclotomic field K of degree n and discriminant ∆ is generated by ideals of prime norm smaller than (2.71h K0 log ∆ + 4.13) 2 , where h K0 is the class number of the maximal real subfield of K. This is an important improvement for [6] over the previously known bound O((h K0 n log ∆) 2+ε ) derived from [10].…”

Section: 2mentioning

confidence: 96%

“…A recent result [6] shows how to extend the algorithm to find short vectors in arbitrary ideals of O K , by transferring the problem to a principal ideal. Let n be the degree of K, K 0 the maximal real subfield of K, and Cl − (K) the relative class group (i.e., the kernel of the norm map Cl(K) → Cl(K 0 )).…”

mentioning

confidence: 99%

“…Let n be the degree of K, K 0 the maximal real subfield of K, and Cl − (K) the relative class group (i.e., the kernel of the norm map Cl(K) → Cl(K 0 )). The transferring method of [6] crucially relies on the assumption that Cl − (K) is generated by a small number (polynomial in log n) of prime ideals of small norm (polynomial in n) and all their Galois conjugates. On one hand, very little is known about the structure of Cl − (K), and it seems difficult to prove that it can always be generated by such a small number of Galois orbits of ideals (yet there is convincing numerical evidence; see [19] for the case where K has prime conductor).…”

mentioning

confidence: 99%

See 2 more Smart Citations

Generating subgroups of ray class groups with small prime ideals

Wesolowski

2019

Open Book Series

Self Cite

View full text Add to dashboard Cite

Explicit bounds are given on the norms of prime ideals generating arbitrary subgroups of ray class groups of number fields, assuming the Extended Riemann Hypothesis. These are the first explicit bounds for this problem, and are significantly better than previously known asymptotic bounds. Applied to the integers, they express that any subgroup of index i of the multiplicative group of integers modulo m is generated by prime numbers smaller than 16(i log m) 2 , subject to the Riemann Hypothesis. Two particular consequences relate to mathematical cryptology. Applied to cyclotomic fields, they provide explicit bounds on generators of the relative class group, needed in some previous work on the shortest vector problem on ideal lattices. Applied to Jacobians of hyperelliptic curves, they allow one to derive bounds on the degrees of isogenies required to make their horizontal isogeny graphs connected. Such isogeny graphs are used to study the discrete logarithm problem on said Jacobians.

show abstract

Section: 2mentioning

confidence: 96%

mentioning

confidence: 99%

mentioning

confidence: 99%

See 1 more Smart Citation

Generating subgroups of ray class groups with small prime ideals

Wesolowski

2019

Open Book Series

Self Cite

View full text Add to dashboard Cite

show abstract

“…Due to their smaller space requirement and faster operation speed, ideal lattices have been a popular choice for most lattice-based cryptosystems. More importantly, the hardness of classical lattice problems, SVP (Shortest Vector Problem) and γ-SVP (Approximate Shortest Vector Problem with approximation factor γ), does not seem to substantially decrease (except maybe very large approximate factors [6]). Thus, it is believed that the worst-case hardness of γ-SVPover ideal lattices, denoted by γ-Ideal-SVP, is against subexponential quantum attacks, for any γ ≤ poly(n).…”

Section: Preliminariesmentioning

confidence: 99%

Provably Secure NTRU Instances over Prime Cyclotomic Rings

Wang

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Due to its remarkable performance and potential resistance to quantum attacks, NTRUEncrypt has drawn much attention recently; it also has been standardized by IEEE. However, classical NTRUEncrypt lacks a strong security guarantee and its security still relies on heuristic arguments. At Eurocrypt 2011, Stehlé and Steinfeld first proposed a variant of NTRUEncrypt with a security reduction from standard problems on ideal lattices. This variant is restricted to the family of rings Z[X]/(X n + 1) with n a power of 2 and its private keys are sampled by rejection from certain discrete Gaussian so that the public key is shown to be almost uniform. Despite the fact that partial operations, especially for RLWE, over Z[X]/(X n + 1) are simple and efficient, these rings are quite scarce and different from the classical NTRU setting. In this work, we consider a variant of NTRUEncrypt over prime cyclotomic rings, i.e. Z[X]/(X n−1 + · · · + X + 1) with n an odd prime, and obtain IND-CPA secure results in the standard model assuming the hardness of worst-case problems on ideal lattices. In our setting, the choice of the rings is much more flexible and the scheme is closer to the original NTRU, as Z[X]/(X n−1 + · · · + X + 1) is a large subring of the NTRU ring Z[X]/(X n −1). Some tools for prime cyclotomic rings are also developed.

show abstract

“…Also, according to [CDPR16], the size of a short generator of I resulting from the BDD algorithm on the log-unit lattice is within e O( √ n) of the first minima of the ideal lattice I. Moreover, it was recently conjectured [CDW16] that for most fields Q(ζ), any ideal of O Q(ζ) was within a short enough ideal multiple from a principal ideal. Therefore, solutions to the PIP in O Q(ζ) yields solution to γ-SVP in ideals of O Q(ζ) for γ ∈ e O( √ n) .…”

Section: But Given the Definition Of A We Havementioning

confidence: 99%

Approximate Short Vectors in Ideal Lattices of $$\mathbb {Q}(\zeta _{p^e})$$ with Precomputation of $${\text {Cl}}(\mathcal {O}_K)$$

Biasse

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper, we present a heuristic algorithm that computes the ideal class group and a generator of a principal ideal (PIP) in Q(ζps ) in time 2 O(n 1/2+ε ) for n := deg(Q(ζps )) and arbitrarily small ε > 0. We introduce practical improvements to enhance its run time, and we describe a variant that can compute a generator of a principal ideal I with N (I) ≤ 2 n b in time 2 O(n a+o(1) ) given a precomputation of the class group taking time 2 O(n 2−3a+ε ) for an arbitrarily small ε > 0 where b ≤ 7a−2 and 2 5 < a < 1 2 . In particular, this precomputation allows us to solve these instances of the PIP in with a run time lower than 2 O(n 1/2 ) . Relying on recent work from Cramer et al. [CDPR16], this yields an attack on all the cryptographic schemes relying on the hardness of finding a short generator of a principal ideal of Q(ζps ) such as the homomorphic encryption scheme of Vercauteren and Smart [SV10], and the multilinear maps of Garg, Gentry and Halevi [GGH13]. This attack (with and without precomputation) is asymptotically faster than the one relying on the work of Biasse and Fieker [Biab,BF14] which runs in time 2 O(n 2/3+ε ) for arbitrarily small ε > 0. In particular, the public keys of the multilinear maps of Garg, Gentry and Halevi [GGH13] satisfy the requirement on the input ideal to use our PIP algorithm with precomputation. By using a = 3/7, b = 1 + o(1), and given a precomputation of time 2 O(n 5/7+ε ) for arbitrarily small ε > 0 on Q(ζps ), our algorithm provides a key recovery attack in time 2 O(n 3/7+o(1) )

show abstract

Short Stickelberger Class Relations and Application to Ideal-SVP

Cited by 76 publications

References 39 publications

Generating subgroups of ray class groups with small prime ideals

Generating subgroups of ray class groups with small prime ideals

Provably Secure NTRU Instances over Prime Cyclotomic Rings

Approximate Short Vectors in Ideal Lattices of $$\mathbb {Q}(\zeta _{p^e})$$ with Precomputation of $${\text {Cl}}(\mathcal {O}_K)$$

Contact Info

Product

Resources

About