Description
Finding a short non zero vector in an Euclidean lattice is a well-studied problem which has proven useful to construct many cryptographic primitives. The current best asymptotic algorithm to find a relatively short vector in an arbitrary lattice is the BKZ algorithm. This algorithm recovers a vector which is at most $2^{n^{\alpha}}$ times larger than the shortest non zero vector in time $2^{n^{1-\alpha}}$ for any $\alpha$ between 0 and 1.<br/> In order to gain in efficiency, it is sometimes interesting to use structured lattices instead of general lattices. An example of such structured lattices are ideal lattices. One may then wonder whether, on the security front, it is easier to find short vectors in a structured lattice or not. Until 2016, there was no known algorithm which would perform better on ideal lattices than the BKZ algorithm (either classically or quantumly). In 2016 and 2017, Cramer-Ducas-Peikert-Regev and Cramer-Ducas-Wesolowski proposed a quantum algorithm that finds a $2^{\sqrt n}$ approximation of the shortest non zero vector in polynomial time. However, the BKZ algorithm remained the best algorithm in the classical setting or for approximation factor smaller than $2^{\sqrt n}$ in the quantum setting.<br/> In this talk, I will present an algorithm that extends the one of Cramer et al. and improves upon the BKZ algorithm for ideal lattices, both quantumly and classically. This algorithm is heuristic and non uniform (i.e., it requires an exponential time pre-processing).<br/> lien: http://desktop.visio.renater.fr/scopia?ID=723420***3028&autojoin
Prochains exposés
-
Verification of Rust Cryptographic Implementations with Aeneas
Orateur : Aymeric Fromherz - Inria
From secure communications to online banking, cryptography is the cornerstone of most modern secure applications. Unfortunately, cryptographic design and implementation is notoriously error-prone, with a long history of design flaws, implementation bugs, and high-profile attacks. To address this issue, several projects proposed the use of formal verification techniques to statically ensure the[…] -
On the average hardness of SIVP for module lattices of fixed rank
Orateur : Radu Toma - Sorbonne Université
In joint work with Koen de Boer, Aurel Page, and Benjamin Wesolowski, we study the hardness of the approximate Shortest Independent Vectors Problem (SIVP) for random module lattices. We use here a natural notion of randomness as defined originally by Siegel through Haar measures. By proving a reduction, we show it is essentially as hard as the problem for arbitrary instances. While this was[…] -
Endomorphisms via Splittings
Orateur : Min-Yi Shen - No Affiliation
One of the fundamental hardness assumptions underlying isogeny-based cryptography is the problem of finding a non-trivial endomorphism of a given supersingular elliptic curve. In this talk, we show that the problem is related to the problem of finding a splitting of a principally polarised superspecial abelian surface. In particular, we provide formal security reductions and a proof-of-concept[…]-
Cryptography
-