??? Phong Q. Nguy

1
Learning a Parallelepiped Cryptanalysis of
GGH and NTRU Signatures

??? Phong Q. Nguyên (École normale
supérieure) ???? ???Oded Regev (Tel Aviv
University)
2
Outline
3
(No Transcript)
4
Lattices

• Basis
• v1,,vn vectors in Rn
• The lattice L is
• La1v1anvn ai integers

v1v2
2v2
2v1
2v2-v1
v1
v2
2v2-2v1
0
5
Basis is not unique
v2
v1
0
6
Closest Vector Problem (CVP)

• CVP Given a lattice and a target vector, find
  the closest lattice point
• Seems very difficult best algorithms take time
  2n
• However, checking if a point is in a lattice is
  easy

v2
v1
0
7
Babais CVP Algorithm

• Babais algorithm given a point u, write
• and output
• Works well for good bases

8
Babais CVP Algorithm
9
Babais CVP Algorithm
10
Lattice-based Cryptography

• One-way functions based on worst-case hardness
  Ajtai96, GoldreichGoldwasserHalevi96,
  CaiNerurkar97, MicciancioRegev04
• Public-key cryptosystems based on worst-case
  hardness AjtaiDwork97, GoldreichGoldwasserHalevi9
  7, Regev04, Regev06
• Other public-key cryptosystems GoldreichGoldwasse
  rHalevi97, HoffsteinPipherSilverman98
• Signature schemes
• GGH GoldreichGoldwasserHalevi97,
• NTRUsign HoffsteinHowgraveGrahamPipherSilvermanW
  hyte01

11
Signature Schemes

• Consists of
• Key generation algorithm produces a
  (public-key,private-key) pair
• Signing algorithm given a message and a
  private-key, produces a signature
• Verification algorithm given a messagesignature
  and a public key, verifies that the signature
  matches

12
The GGH Signature Scheme

• Idea CVP is hard, but easy with good basis
• The scheme
• Key generation algorithm choose a lattice with
  some good basis
• Private-key good basis
• Public-key bad basis
• Signing algorithm given a message and a private
  key,
• Map message to a point in space
• Apply Babais algorithm with good basis to obtain
  the signature
• Verification algorithm given messagesignature
  and a public key, verify that
• Signature is a lattice point, and
• Signature is close to the message

13
GGH Signature Scheme
Private-key
Public-key
14
GGH Signature Scheme
Public-key
Message
Signature
Verification 1. should be a lattice point
2. distance between and should be
small
15
(No Transcript)
16
The NTRUsign Signature Scheme

• Essentially a very efficient implementation of
  the GGH signature scheme
• Signature length only 1757 bits
• Signing and verification are faster than
  RSA-based methods
• Based on the NTRU lattices (bicyclic lattices
  generated from a polynomial ring)
• Developed by the company NTRU and currently under
  consideration by IEEE P1363.1
• Some flaws pointed out in GentrySzydlo02

17
Main Result

• An inherent security flaw in GGH-based signature
  schemes
• Demonstrated a practical attack on
• GGH
• Up to dimension 400
• NTRUsign
• Dimension 502
• Applies to half of the parameter sets in IEEE
  P1363.1
• Only 400 signatures needed!
• The attack recovers the
• private key
• Running time is a few
• minutes on a 2Ghz/2GB PC

18
Main Result

• Possible countermeasures
• Pertubations, as suggested by NTRU in several of
  the IEEE P1363.1 parameter sets
• Larger entries in private key
• It is not clear if the attack can be extended to
  deal with these extensions
• Public key encryption schemes and one-way
  functions are still secure!!
• This includes all schemes based on worst-case
  hardness and NTRUencrypt

19
The Attack
20
The Attack
21
Hidden Parallelepiped Problem
Given points sampled uniformly from an
n-dimensional centered parallelepiped, recover
the parallelepiped
22
Hidden Hypercube Problem
Given points sampled uniformly from an
n-dimensional centered unit hypercube, recover
the hypercube
23
HHP First Attempt
24
HHP Second Attempt
25
HHP The Algorithm
26
Back to HPP
27
Back to HPP
28
Were not alone

• The HPP has already been looked at
• In statistical analysis, and in particular
  Independent Component Analysis (ICA). The FastICA
  algorithm is very similar to ours
  HyvärinenOja97. Many applications in signal
  processing, neural networks, etc.
• In the computational learning community, by
  FriezeJerrumKannan96. A somewhat different
  algorithm.
• However, none gives a rigorous analysis. We
  analyze the algorithm rigorously, taking into
  account the effects of noise

29
Open questions


30
(No Transcript)