In 1994, P. Shor discovered quantum algorithms that can break both the RSA cryptosystem and the ElGamal cryptosystem. In 2007, D-Wave demonstrated the first quantum computer. These events and further developments have brought a crisis to secret communication. In 2016, the National Institute of Standards and Technology (NIST) launched a global project to solicit and select a handful of encryption algorithms with the ability to resist quantum computer attacks. In 2022, it announced four candidates, CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and Sphincs+, for post-quantum cryptography standards. The first three are based on lattice theory and the last on a hash function. The security of lattice-based cryptosystems relies on the computational complexity of the shortest vector problem (SVP), the closest vector problem (CVP), and their generalizations. As we will explain, the SVP is a ball-packing problem, and the CVP is a ball-covering problem. Furthermore, both the SVP and CVP are equivalent to arithmetic problems for positive definite quadratic forms. This paper will briefly describe the mathematical problems on which lattice-based cryptography is built so that cryptographers can extend their views and learn something useful.
In 1994, P. Shor discovered quantum algorithms that can break both the RSA cryptosystem and the ElGamal cryptosystem. In 2007, D-Wave demonstrated the first quantum computer. These events and further developments have brought a crisis to secret communication. In 2016, the National Institute of Standards and Technology (NIST) launched a global project to solicit and select a handful of encryption algorithms with the ability to resist quantum computer attacks. In 2022, it announced four candidates, CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and Sphincs+, for post-quantum cryptography standards. The first three are based on lattice theory and the last on a hash function. The security of lattice-based cryptosystems relies on the computational complexity of the shortest vector problem (SVP), the closest vector problem (CVP), and their generalizations. As we will explain, the SVP is a ball-packing problem, and the CVP is a ball-covering problem. Furthermore, both the SVP and CVP are equivalent to arithmetic problems for positive definite quadratic forms. This paper will briefly describe the mathematical problems on which lattice-based cryptography is built so that cryptographers can extend their views and learn something useful.
In 1994, P. Shor discovered quantum algorithms that can break both the RSA cryptosystem and the ElGamal cryptosystem. In 2007, a Canadian company D-Wave demonstrated the first quantum computer. These events and quick further developments have brought a crisis to secret communication. In 2022, the National Institute of Standards and Technology (NIST) announced 4 candidates-CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and Sphincs+-for post-quantum cryptography standards. The first 3 are based on lattice theory and the last on Hash functions. In 2024, NIST announced 3 standards: FIPS 203 based on CRYSTALS-Kyber, FIPS 204 based on CRYSTALS-Dilithium, and FIPS 205 based on Sphincs+. The fourth standard based on Falcon is on the way. It is well known that the security of the lattice-based cryptosystems relies on the hardness of the shortest vector problem (SVP), the closest vector problem (CVP), and their generalizations. In fact, the SVP is a ball packing problem and the CVP is a ball covering problem. Furthermore, both SVP and CVP are equivalent to arithmetic problems for positive definite quadratic forms. There are several books and survey papers dealing with the computational complexity of the lattice-based cryptography for classical computers. However, there is no review article to demonstrate the mathematical foundation of the complexity theory. This paper will briefly introduce post-quantum cryptography and demonstrate its mathematical roots in ball packing, ball covering, and positive definite quadratic forms.
The advent of quantum computing poses a significant existential threat to the security foundations of current public-key cryptography, most notably the widely adopted RSA algorithm. Shor's algorithm, specifically, can efficiently break the mathematical problems underlying RSA and elliptic curve cryptography, necessitating a paradigm shift towards quantum-resistant solutions. This paper explores lattice-based cryptography as the leading candidate for this post-quantum era. We delve into the fundamental mathematical principles of lattices, including hard problems like the Shortest Vector Problem (SVP), Closest Vector Problem (CVP), Short Integer Solution (SIS), and Learning With Errors (LWE), which form the bedrock of their security. The paper reviews prominent lattice-based schemes such as NTRU, CRYSTALS-Kyber, CRYSTALS-Dilithium, and Falcon, highlighting their construction, security properties, and performance characteristics. We analyze their resilience against both classical and quantum attacks, discuss their progress in the NIST Post-Quantum Cryptography Standardization process, and evaluate their practical implications and implementation challenges. The discussion emphasizes the provable security, versatility, and efficiency of lattice-based methods, positioning them as the robust and essential successor to RSA for safeguarding digital communications and data in a quantum-enabled future.
The landscape of modern cryptography, traditionally anchored in the computational hardness of number-theoretic problems such as integer factorization and the discrete logarithm problem, faces an existential threat from the advent of quantum computing. Shor's algorithm, discovered in 1994, demonstrates the theoretical capability of a sufficiently powerful quantum computer to efficiently solve these problems, rendering widely used cryptographic schemes like RSA and Elliptic Curve Cryptography (ECC) insecure. This imminent threat necessitates a paradigm shift towards post-quantum cryptography (PQC), which aims to develop cryptographic algorithms resistant to both classical and quantum attacks. Among the various candidates for PQC, lattice-based cryptography has emerged as a particularly promising area. This paper provides a comprehensive overview of the transition from classical number theory-based cryptography to lattice-based schemes. We explore the fundamental mathematical principles underlying lattices, introduce key lattice problems such as the Shortest Vector Problem (SVP), Closest Vector Problem (CVP), Small Integer Solution (SIS), and Learning With Errors (LWE), and discuss their application in constructing quantum-resistant cryptographic primitives. Furthermore, we analyze the security, efficiency, and practical considerations of prominent lattice-based cryptosystems, highlighting their role in the ongoing NIST post-quantum cryptography standardization process. The paper concludes by discussing the challenges and future directions in the deployment and research of lattice-based cryptographic solutions.
The advent of large-scale quantum computers poses an existential threat to the security of current public-key cryptosystems, such as RSA and Elliptic Curve Cryptography (ECC), which rely on the computational intractability of integer factorization and discrete logarithms. This paper explores lattice-based cryptography as a promising candidate for post-quantum security. We delve into the mathematical foundations of lattices, specifically focusing on hard problems like the Shortest Vector Problem (SVP), Closest Vector Problem (CVP), Small Integer Solution (SIS), and Learning With Errors (LWE) problems, which are believed to remain intractable even for quantum computers. We provide a comprehensive review of prominent lattice-based constructions, including NTRU, Kyber, and Dilithium, highlighting their security proofs, efficiency considerations, and suitability for various cryptographic primitives such as public-key encryption, key-exchange mechanisms, and digital signatures. Furthermore, we discuss the challenges and opportunities associated with their deployment, including parameter selection, resistance to side-channel attacks, and integration into existing cryptographic infrastructures. By examining the theoretical underpinnings and practical implications, this work aims to solidify understanding of lattice-based methods as a robust and essential component of the cryptographic landscape in the quantum era, moving beyond the traditional RSA frontier.
The advent of quantum computing poses a significant existential threat to current public-key cryptographic systems, most notably RSA and Elliptic Curve Cryptography (ECC), which rely on the presumed hardness of integer factorization and discrete logarithm problems. Shor's algorithm, a quantum algorithm, can efficiently solve these problems, rendering classical asymmetric primitives insecure. This paper addresses the imperative need for post-quantum cryptography (PQC) by exploring lattice-based constructs as robust alternatives for asymmetric primitives. We provide a comprehensive overview of the fundamental mathematical problems underlying lattice-based cryptography, such as the Shortest Vector Problem (SVP), Closest Vector Problem (CVP), Learning With Errors (LWE), and Ring Learning With Errors (RLWE). The paper surveys prominent lattice-based schemes, including NTRU, CRYSTALS-Kyber, and CRYSTALS-Dilithium, analyzing their security foundations, performance characteristics, and the extent to which they offer a viable "post-quantum RSA." We delve into the methodology of constructing these primitives, discuss their resilience against both classical and quantum attacks, and evaluate their practical implications for key sizes, computational efficiency, and deployment challenges. Our analysis highlights that lattice-based cryptography, particularly the NIST-standardized schemes, presents a strong candidate for securing digital communications in the quantum era, offering provable security rooted in worst-case to average-case reductions for lattice problems.
Lattice-Based Cryptosystems and Quantum CryptanalysisQuantum computers are probably coming, though we don't know when-and when they arrive, they will, most likely, be able to break our standard public-key cryptography algorithms.In anticipation of this possibility, cryptographers have been working on quantum-resistant public-key algorithms.The National Institute for Standards and Technology (NIST) has been hosting a competition a since 2017, and there already are several proposed standards.b Most of these are based on lattice problems.The mathematics of lattice cryptography revolve around combining sets of vectors-that's the lattice-in a multi-dimensional space.These lattices are filled with multi-dimensional periodicities.The hard problem c that's used in cryptography is to find the shortest periodicity in a large, random-looking lattice.This can be turned into d a public-key cryptosystem in a variety of different ways.Research has been ongoing since 1996, and there has been some really great work since then-including many practical public-key algorithms.On April 10, Yilei Chen from Tsinghua University in Beijing posted a paper describing a new quantum attack on that shortest-path lattice problem.It's a very dense mathematical paper-63 pages long-and my guess is that only a few cryptographers are able to understand all of its details.(I was not one of them.)But the conclusion was pretty devastating, breaking essentially all of the lattice-based fully homomorphic encryption schemes and coming significantly closer to attacks against the recently proposed (and NIST-approved) lattice key-exchange and signature schemes.However, there was a small but critical mistake in the paper, on the bottom of page 37.It was independently discovered by Hongxun Wu from Berkeley and Thomas Vidick from the Weizmann Institute in Israel eight days later.The attack algorithm in its current form doesn't work.This was discussed last week at the Cryptographers' Panel e at the RSA Conference.Adi Shamir, the "S" in RSA and a 2002 recipient of ACM's A.M. Turing award, described the result as psychologically significant because it shows that there is still a lot to be discovered about quantum