The Lattice Isomorphism Problem (LIP) is an emerging foundation for post-quantum cryptography thanks to the pioneering work of Ducas and van Woerden (EUROCRYPT '22). That work lays the foundation for LIP in cryptography with a zero-knowledge proof of knowledge (ZKPoK), a key-encapsulation mechanism, and a digital signature scheme which is further developed into the efficient signature Hawk (ASIACRYPT '22) using structured lattices. However, as compared to the development of lattice-based cryptography from the Short Integer Solution (SIS) and Learning with Errors (LWE) problems, LIP-based cryptography is yet to cover a rich variety of functionalities beyond the two basic ones: encrypting and digitally signing messages. This work is an effort to extend the landscape of LIP-based cryptography from the above basic primitives to more advanced ones by adapting techniques used in SIS-based and LWE-based primitives to LIP. We provide a public-key encryption (PKE) which encrypts plaintexts of integral vectors, and it comes with a zero-knowledge proof of plaintext knowledge. We use this PKE as a commitment scheme in the construction of a ZKPoK for quadratic relations, so this ZKPoK has a straightline extractor naturally. Using the same ZKPoK in non-interactive mode by Fiat-Shamir transformation, we introduce the first LIP-based blind signature scheme which is the blinded version of the digital signatures of Ducas and van Woerden. The security of our scheme stems from a new one-more Close Vector Problem (omCVP) assumption. This assumption is arguably an analogue of the one-more-SIS assumption by Agrawal et al. (CCS '22) and the one-more Short Vector Problem in Hawk signatures. To ensure confidence in omCVP, we provide a cryptanalysis attempt and convince that our parameter choice is in the safe zone.
The Lattice Isomorphism Problem (LIP) is an emerging foundation for post-quantum cryptography thanks to the pioneering work of Ducas and van Woerden (EUROCRYPT '22). That work lays the foundation for LIP in cryptography with a zero-knowledge proof of knowledge (ZKPoK), a key-encapsulation mechanism, and a digital signature scheme which is further developed into the efficient signature Hawk (ASIACRYPT '22) using structured lattices. However, as compared to the development of lattice-based cryptography from the Short Integer Solution (SIS) and Learning with Errors (LWE) problems, LIP-based cryptography is yet to cover a rich variety of functionalities beyond the two basic ones: encrypting and digitally signing messages. This work is an effort to extend the landscape of LIP-based cryptography from the above basic primitives to more advanced ones by adapting techniques used in SIS-based and LWE-based primitives to LIP. We provide a public-key encryption (PKE) which encrypts plaintexts of integral vectors, and it comes with a zero-knowledge proof of plaintext knowledge. We use this PKE as a commitment scheme in the construction of a ZKPoK for quadratic relations, so this ZKPoK has a straightline extractor naturally. Using the same ZKPoK in non-interactive mode by Fiat-Shamir transformation, we introduce the first LIP-based blind signature scheme which is the blinded version of the digital signatures of Ducas and van Woerden. The security of our scheme stems from a new one-more Close Vector Problem (omCVP) assumption. This assumption is arguably an analogue of the one-more-SIS assumption by Agrawal et al. (CCS '22) and the one-more Short Vector Problem in Hawk signatures. To ensure confidence in omCVP, we provide a cryptanalysis attempt and convince that our parameter choice is in the safe zone.
Recent developments have been made in the construction of cryptosystems with security based on the hardness of the lattice isomorphism problem (LIP). Due to lattice conjectures, one may expect in the future that breaking such schemes is computationally harder than most current lattice-based cryptosystems. To the best of our knowledge, there have not been any attempts to concretely instantiate a key encapsulation mechanism (KEM) based on LIP. In this work, we propose the first instance of such a KEM, following the framework of Ducas and van Woerden (EUROCRYPT 2022), using simple lattices. We present a randomness extractor derived from a hash function based on the short integer solution problem; define a concrete set of parameters for instantiating the scheme; provide a rigorous security estimation of an attacker trying to decode an encapsulated key through reductions to hard lattice problems; and use well-known methods to convert the IND-CPA secure KEM into an IND-CCA2 secure KEM, comparing the latter with other modern lattice-based KEMs. The resulting security is estimated under the assumption that an adversary cannot efficiently solve related instances of LIP, which is a consequence of the lack of cryptanalysis towards identifying isomorphism between lattices.
The advent of large-scale quantum computers poses an existential threat to the security of current public-key cryptosystems, such as RSA and Elliptic Curve Cryptography (ECC), which rely on the computational intractability of integer factorization and discrete logarithms. This paper explores lattice-based cryptography as a promising candidate for post-quantum security. We delve into the mathematical foundations of lattices, specifically focusing on hard problems like the Shortest Vector Problem (SVP), Closest Vector Problem (CVP), Small Integer Solution (SIS), and Learning With Errors (LWE) problems, which are believed to remain intractable even for quantum computers. We provide a comprehensive review of prominent lattice-based constructions, including NTRU, Kyber, and Dilithium, highlighting their security proofs, efficiency considerations, and suitability for various cryptographic primitives such as public-key encryption, key-exchange mechanisms, and digital signatures. Furthermore, we discuss the challenges and opportunities associated with their deployment, including parameter selection, resistance to side-channel attacks, and integration into existing cryptographic infrastructures. By examining the theoretical underpinnings and practical implications, this work aims to solidify understanding of lattice-based methods as a robust and essential component of the cryptographic landscape in the quantum era, moving beyond the traditional RSA frontier.
The hardness of the lattice isomorphism problem (LIP) is a new lattice-based assumption used in asymmetric cryptography.However, there is yet to be a standard-model IND-CCA2secure public-key encryption scheme based on LIP.One promising candidate for such a scheme is the combination of an existing LIP-based IND-CPA-secure key encapsulation mechanism (KEM) by Ducas and van Woerden with the 𝑘-repetition framework by Rosen and Segev to construct an IND-CCA2-secure KEM.In this thesis, we provide strong evidence for our claim that this combination cannot be securely realized due to inherent qualities of LIP that prevent correlation across multiple ciphertexts of the KEM with independent public keys.We dub the sum of these qualities the Lattice Incompatibility Problem.Our analysis is extensive and provides insight into several fundamental properties of average-case LIP instances and their coefficient vectors.Additionally, we establish formal requirements for any other combination of an IND-CPA-secure asymmetric encryption scheme with 𝑘-repetition and demonstrate that this combination cannot be black-box for arbitrary IND-CPA-secure schemes.As part of our empirical evaluations, we also present a description, proof of correctness, and implementation of a sampling algorithm for the discrete Gaussian distribution on arbitrary quadratic forms that avoids taking the Cholesky decomposition for improved numerical stability.i Zusammenfassung Die Schwierigkeit des Gitterisomorphismusproblems (LIP) wird als neue gitterbasierte Annahme zur Konstruktion von asymmetrischer Kryptographie genutzt.Jedoch gibt es bis jetzt noch kein gegen adaptive aktive Angreifer sicheres asymmetrisches Verschlüsselungsverfahren, das auf der Schwierigkeit von LIP beruht.Ein möglicher Kandidat für ein solches Verfahren entsteht durch die Kombination aus einem existierenden LIP-basierten Schlüsselenkapsulierungsmechanismus (KEM) von Ducas und Woerden zusammen mit dem 𝑘-Wiederholungs-Rahmenwerk von Rosen und Segev, die zu einem entsprechend gegen solche Angreifer sicherem KEM führen könnte.In dieser Arbeit präsentieren wir starke Argumente dafür, dass diese Kombination durch inhärente Merkmale von LIP, die eine Korrelation über mehrere Chiffrate des KEMs mit unabhängigen öffentlichen Schlüsseln verhindern, nicht auf sichere Art realisierbar ist.Wir bezeichnen die Summe dieser Eigenschaften als das Gitterinkompatibilitätsproblem.Unsere Analyse ist umfänglich und zeigt einige grundlegende Eigenschaften durchschnittlicher LIP-Instanzen und ihrer Koeffizientenvektoren auf.Zusätzlich geben wir formale Anforderungen an, die für jede Kombination eines gegen passive Angreifer sicheren asymmetrischen Verschlüsselungsverfahrens mit der 𝑘-Wiederholung erforderlich sind.Wir demonstrieren zudem, dass diese Kombination nicht generisch für beliebige Verfahren umgesetzt werden kann.Weiter stellen wir als Teil unserer empirischen Evaluationen einen Algorithmus samt Beschreibung, Korrektheitsbeweis und Implementierung vor, der Stichproben der diskreten Gauß-Verteilung über beliebigen quadratischen Formen zieht, ohne dabei die Cholesky-Zerlegung der Form zu ermitteln, was zu verbesserter numerischer Stabilität führt.
Lattice-based cryptography is a branch of cryptography exploiting the presumed hardness of some well-known problems on lattices. Its main advantages are its simplicity, efficiency, and apparent security against quantum computers. The principle of the security proofs in lattice-based cryptography is to show that attacking a given scheme is at least as hard as solving a particular problem, as the Learning with Errors problem (LWE) or the Small Integer Solution problem (SIS). Then, by showing that those two problems are at least as hard to solve than a hard problem on lattices, presumed polynomial time intractable, we conclude that the constructed scheme is secure.In this thesis, we improve the foundation of the security proofs and build new cryptographic schemes. We study the hardness of the SIS and LWE problems, and of some of their variants on integer rings of cyclotomic fields and on modules on those rings. We show that there is a classical hardness proof for the LWE problem (Regev's prior reduction was quantum), and that the module variants of SIS and LWE are also hard to solve. We also give two new lattice-based group signature schemes, with security based on SIS and LWE. One is the first lattice-based group signature with logarithmic signature size in the number of users. And the other construction allows another functionality, verifier-local revocation. Finally, we improve the size of some parameters in the work on cryptographic multilinear maps of Garg, Gentry and Halevi in 2013.
The imminent threat posed by the advent of quantum computers to contemporary public-key cryptographic schemes, such as RSA and Elliptic Curve Cryptography (ECC), necessitates a fundamental shift in cryptographic paradigms. Shor's algorithm, specifically, presents a catastrophic vulnerability to these foundational security protocols, underpinning global digital communication and commerce. This paper provides a comprehensive exploration into lattice-based cryptography as a robust and promising candidate for a post-quantum cryptographic future. We delve into the mathematical underpinnings of lattices, elucidating the computational hardness of problems like the Shortest Vector Problem (SVP) and the Learning With Errors (LWE) problem, which form the bedrock of their security. The paper reviews the historical development of lattice-based schemes, their theoretical advantages, and their practical implications, particularly in the context of the ongoing NIST Post-Quantum Cryptography standardization process. We analyze the construction of key encapsulation mechanisms (KEMs) and digital signature schemes from lattice problems, comparing their performance characteristics and security guarantees against classical methods. The work argues that lattice-based cryptography offers a compelling alternative to RSA, providing not only quantum resistance but also presenting attractive features in terms of efficiency, design simplicity, and versatility for various cryptographic primitives. The discussion extends to implementation challenges, security analysis, and the broader implications for the global migration towards a quantum-secure cryptographic infrastructure.
Lattice-based cryptography is one of the most active research topics in cryptography in recent years. In many cryptographic constructions based on lattice assumptions, the building block is a proof of knowledge of a solution to an instance of the Inhomogeneous Small Integer Solution (ISIS) problem. However, all known such proof \n \nsystems have relatively weak security guarantees: Breaking each of these protocols is potentially easier than solving the underlying instance of the ISIS problem. As a consequence, cryptographic constructions relying on these proof systems typically inherit the sub-optimal security guarantees. Therefore, proof systems with stronger security guarantees are highly desirable. Such protocols are not only interesting from a theoretical point of view, but they also lead to lattice-based cryptographic constructions relying on weaker hardness assumptions than the contemporary schemes. \n \n \n \nIn this thesis, we construct a series of zero-knowledge proofs of knowledge with strong security guarantees and reasonable communication costs, that can find various applications in lattice-based cryptography. Our constructions rely on a simple, yet versatile and effective technique, called Decomposition-Extension. When adapting this technique to the Stern-KTX proof system (Stern ‘96 - Kawachi, Tanaka, Xagawa ‘08), we obtain a zero-knowledge proof of knowledge for the ISIS problem (in the infinity norm) with a very strong security guarantee: Breaking the protocol is as least as hard as solving the underlying ISIS instance. We then develop our technique to design the following lattice-based cryptographic constructions: \n \n \n \n- Efficient zero-knowledge proofs of plaintext knowledge with strong security guarantees \n \nfor 4 encryption schemes based on the Learning with Errors problem: Regev’s scheme (Regev ‘05); the Dual-Regev scheme (Gentry, Peikert, Vaikuntanathan ‘08); the PVW scheme (Peikert, Vaikuntanathan, Waters ‘08); and the GHV scheme (Gentry, Halevi, Vaikuntanathan ‘10). Our results immediately yield 4 lattice-based interactive encryption protocols that are secure under chosen ciphertext attacks. Previously, only zero-knowledge proofs of plaintext knowledge for Regev’s scheme were known, and they are relatively inefficient with rather weak security guarantees. \n \n \n \n- A lattice-based identity-based identification scheme relying on a weaker hardness assumption than in the previous works. Furthermore, we introduce an identity-based ring identification scheme based on the worst-case hardness of lattice problems. To the best of our knowledge, this is the first such scheme. \n \n \n \n- An improved lattice-based group signature scheme relying on relatively weak hardness assumptions, in which the signature size is logarithmic in the number of group users. Earlier lattice-based group signature schemes, which were published before 2013, rely on relatively weak hardness assumptions but have the undesirable property that the size of the signature is linear in the number of group users. A recent scheme (Laguillaumie, Langlois, Libert, Stehlé ‘13) achieves logarithmic signature size but it has to rely on relatively strong hardness assumptions. Our construction, thus, simultaneously achieves the good features of the existing schemes.