Structural Lattice Reduction: Generalized Worst-Case to Average-Case Reductions and Homomorphic Cryptosystems

Abstract

International audienceIn lattice cryptography, worst-case to average-case reductions rely on two problems: Ajtai’s SIS and Regev’s LWE, which both refer to a very small class of random lattices related to the group G=Znq. We generalize worst-case to average-case reductions to all integer lattices of sufficiently large determinant, by allowing G to be any (sufficiently large) finite abelian group. Our main tool is a novel generalization of lattice reduction, which we call structural lattice reduction: given a finite abelian group G and a lattice L, it finds a short basis of some lattice L¯ such that L⊆L¯ and L¯/L≃G. Our group generalizations of SIS and LWE allow us to abstract lattice cryptography, yet preserve worst-case assumptions: as an illustration, we provide a somewhat conceptually simpler generalization of the Alperin-Sheriff-Peikert variant of the Gentry-Sahai-Waters homomorphic scheme. We introduce homomorphic mux gates, which allows us to homomorphically evaluate any boolean function with a noise overhead proportional to the square root of its number of variables, and bootstrap the full scheme using only a linear noise overhead

A sieve algorithm based on overlattices

“…These vectors would be too large for our purpose, since the bottom level of our decomposition algorithm needs a pool of vectors of length Θ( √ n n vol(L)). In the present paper, we prove that when the group G is large enough, the unbalanced reduction of [14] can in fact efficiently construct a basis C of L such that [c 1 /N k , c 2 , . .…”

“…For completeness, we recall in the Appendix the pseudocode of the unbalanced reduction from [14]. Here, we prove that it allows us to produce a quasi-orthonormal basis.…”

“…This problem is closely related to the structural reduction, introduced in [14], which aims to find a short basis B of an overlatticeL such thatL/L is isomorphic to some fixed abelian group G. However, the primary goal of [14] was to decrease the Gram-Schmidt norm ofB in order to sample a pool of Gaussian overlattice vectors of norm Θ( √ n log n B * ). These vectors would be too large for our purpose, since the bottom level of our decomposition algorithm needs a pool of vectors of length Θ( √ n n vol(L)).…”

“…Here, we prove that it allows us to produce a quasi-orthonormal basis. Compared to [14], we added the condition that σ min b * i on the input parameters, and consequently, one of the test cases in the main loop of the algorithm in [14] never occurs. Theorem 3.2 and its corollary below prove that running the unbalanced reduction with a smaller parameter σ than is considered in [14] allows us to construct a quasi-orthonormal overlattice basis in polynomial time.…”

“…These overlattices are found in polynomial time by an algorithm relying on the structural reduction introduced by [14], as described in § 3.2. Once we have an overlattice and its quasi-orthonormal basis, we may efficiently enumerate short vectors at a constant factor of the first minimum in the overlattice.…”