DOCSLIB.ORG

Discrete Logarithms in Finite Fields and Their Cryptographic Significance

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Discrete Logarithms in Finite Fields and Their Cryptographic Significance Discrete logarithms in ®nite ®elds and their cryptographic signi®cance A. M. Odlyzko AT&T Bell Laboratories Murray Hill, New Jersey 07974 ABSTRACT Given a primitive element g of a ®nite ®eld GF(q), the discrete logarithm of a nonzero element u ∈ GF(q) is that integer k, 1 ≤ k ≤ q − 1, for which u = g k. The well-known problem of computing discrete logarithms in ®nite ®elds has acquired additional importance in recent years due to its applicability in cryptography. Several cryptographic systems would become insecure if an ef®cient discrete logarithm algorithm were discovered. This paper surveys and analyzes known algorithms in this area, with special attention devoted to algorithms for the ®elds GF( 2n ). It appears that in order to be safe from attacks using these algorithms, the value of n for which GF( 2n ) is used in a cryptosystem has to be very large and carefully chosen. Due in large part to recent discoveries, discrete logarithms in ®elds GF( 2n ) are much easier to compute than in ®elds GF(p) with p prime. Hence the ®elds GF( 2n ) ought to be avoided in all cryptographic applications. On the other hand, the ®elds GF(p) with p prime appear to offer relatively high levels of security. Discrete logarithms in ®nite ®elds and their cryptographic signi®cance A. M. Odlyzko AT&T Bell Laboratories Murray Hill, New Jersey 07974 1. Introduction The multiplicative subgroup of any ®nite ®eld GF(q), q a prime power, is cyclic, and the elements g ∈ GF(q) that generate this subgroup are referred to as primitive elements. Given a primitive element g ∈ GF(q) and any u ∈ GF(q) * = GF(q) − {0}, the discrete logarithm of u with respect to g is that integer k, 0 ≤ k ≤ q − 1, for which u = g k . = We will write k log g u. The discrete logarithm of u is sometimes referred to as the index of u. Aside from the intrinsic interest that the problem of computing discrete logarithms has, it is of considerable importance in cryptography. An ef®cient algorithm for discrete logarithms would make several authentication and key-exchange systems insecure. This paper brie¯y surveys (in Section 2) these cryptosystems, and then analyzes the known algorithms for computing discrete logarithms. As it turns out, some of them, including the most powerful general purpose algorithm in this area, have not been analyzed in complete detail before. Moreover, some of the analyses in the literature deal only with ®elds GF(p), where p is a prime. In cryptographic applications, on the other hand, attention has been focused on the ®elds GF( 2n ), since arithmetic in them is much easier to implement, with respect to both software and hardware. Therefore we concentrate on the ®elds GF( 2n ). Several proposed algorithms for computing discrete logarithms are known. We brie¯y discuss most of them (including some unsuccessful ones) in Section 3. In Section 4 we present the most powerful general purpose algorithm that is known today, called the index-calculus algorithm, and analyze its asymptotic performance. Recently a dramatic improvement in its performance in ®elds GF( 2n ) was made by Coppersmith [18,19], and we discuss it in detail. In Section 5 we discuss several technical issues that are important to the performance of the index-calculus algorithm, such as rapid methods to solve the systems of - 2 - linear equations that arise in it. In that section we also present several suggested modi®cations to the Coppersmith algorithm which appear to be unimportant asymptotically, but are of substantial importance in practice. We discuss them in order to obtain a reasonable estimate of how fast this algorithm could be made to run in practice. In Section 6 we estimate the running time of that algorithm for ®elds GF( 2n ) that might actually be used in cryptography. In Section 7 we brie¯y discuss the performance of the index- calculus algorithms in ®elds GF(p) for p a prime. Finally, we discuss the implications of these algorithms for cryptography in Section 8. It turns out, for example, that the MITRE scheme [38,59] and the Hewlett- Packard chip [69], both of which use the ®eld GF( 2127 ), are very insecure. Depending on the level of security that is desired, it seems that ®elds GF( 2n ) to be used ought to have n large, no smaller than 800 and preferably at least 1500. Furthermore, these values of n have to be very carefully chosen. On the other hand, it appears at this moment that the ®elds GF(p), where p is a prime, offer a much higher level of security, with p ∼> 2500 adequate for many applications and p ∼> 21000 being suf®cient even for extreme situations. The ®elds GF(p) appear at this moment to offer security comparable to that of the RSA scheme with modulus of size p. It has to be stressed that this survey presents the current state of the art of computing discrete logarithms. Since the state of the art has been advancing very rapidly recently, this paper has already gone through several revisions. The most important of the new developments has certainly been the Coppersmith breakthrough in ®elds GF( 2n ). Even more recently, there has been much less spectacular but still important progress in ®elds GF(p), which is brie¯y described in Section 7, and in methods for dealing with sparse systems of equations, which are discussed in Section 5, and which are crucial for the index- calculus algorithms. It is quite likely that further progress will take place in discrete logarithm algorithms and so the cryptographic schemes described below will require the use of even larger ®elds than are being recommended right now. 2. Cryptographic systems related to discrete logarithms One of the ®rst published cryptosystems whose security depends on discrete logarithms being dif®cult to compute appears to be an authentication scheme. In many computer systems, users' passwords are stored in a special ®le, which has the disadvantage that anyone who gets access to that ®le is able to freely - 3 - impersonate any legitimate user. Therefore that ®le has to be specially protected by the operating system. It has been known for a long time (cf. [54]) that one can eliminate the need for any secrecy by eliminating the storage of passwords themselves. Instead, one utilizes a function f that is hard to invert (i.e., such that given a y in the range of f, it is hard to ®nd an x in the domain of f such that f (x) = y) and creates a ®le containing pairs (i, f (p i ) ), where i denotes a user's login name and p i the password of that user. This ®le can then be made public. The security of this scheme clearly depends on the function f being hard to invert. One early candidate for such a function was discrete exponentiation; a ®eld GF(q) and a primitive element g ∈ GF(q) are chosen (and made public), and for x an integer, one de®nes f (x) = g x . Anyone trying to get access to a computer while pretending to be user i would have to ®nd p i knowing only p the value of g i ; i.e., he would have to solve the discrete logarithm problem in the ®eld GF(q). Public key cryptography suffers from the defect that the systems that seem safe are rather slow. This disadvantage can be overcome to a large extent by using a public key cryptosystem only to distribute keys for a classical cryptosystem, which can then be used to transmit data at high speeds. Dif®e and Hellman [23] have invented a key-exchange system based on exponentiation in ®nite ®elds. (This apparently was the very ®rst public key cryptosystem that was proposed.) In it, a ®nite ®eld GF(q) and a primitive element g ∈ GF(q) are chosen and made public. Users A and B, who wish to communicate using some standard encryption method, such as DES, but who do not have a common key for that system, choose random integers a and b, respectively, with 2 ≤ a, b ≤ q − 2. Then user A transmits g a to B over a public channel, while user B transmits g b to A. The common key is then taken to be g ab, which A can compute by raising the received g b to the a power (which only he knows), and which B forms by raising g a to the b power. It is clear that an ef®cient discrete logarithm algorithm would make this scheme insecure, since the publicly transmitted g a would enable the cryptanalyst to determine a, and he could then determine the key used by A and B. Dif®e and Hellman [23] have even conjectured that breaking their scheme is equivalent in dif®culty to computing discrete logarithms. This conjecture remains unproved, and so we cannot exclude the possibility that there might be some way to generate g ab from knowledge of g a and g b only, without computing either a or b, although it seems unlikely that such a method exists. - 4 - The Dif®e-Hellman key-exchange scheme seems very attractive, and it has actually been implemented in several systems, such as a MITRE Corp. system [38,59]. Moreover, Hewlett-Packard has built a special purpose VLSI chip which implements this scheme [69]. However, these implementations have turned out to be easily breakable. It appears possible, though, to build a Dif®e - Hellman scheme that is about as secure as an RSA scheme of comparable key size.
Load more

Recommended publications
  • APPLICATIONS of GALOIS THEORY 1. Finite Fields Let F Be a Finite Field
    CHAPTER IX APPLICATIONS OF GALOIS THEORY 1. Finite Fields Let F be a finite field. It is necessarily of nonzero characteristic p and its prime field is the field with p r elements Fp.SinceFis a vector space over Fp,itmusthaveq=p elements where r =[F :Fp]. More generally, if E ⊇ F are both finite, then E has qd elements where d =[E:F]. As we mentioned earlier, the multiplicative group F ∗ of F is cyclic (because it is a finite subgroup of the multiplicative group of a field), and clearly its order is q − 1. Hence each non-zero element of F is a root of the polynomial Xq−1 − 1. Since 0 is the only root of the polynomial X, it follows that the q elements of F are roots of the polynomial Xq − X = X(Xq−1 − 1). Hence, that polynomial is separable and F consists of the set of its roots. (You can also see that it must be separable by finding its derivative which is −1.) We q may now conclude that the finite field F is the splitting field over Fp of the separable polynomial X − X where q = |F |. In particular, it is unique up to isomorphism. We have proved the first part of the following result. Proposition. Let p be a prime. For each q = pr, there is a unique (up to isomorphism) finite field F with |F | = q. Proof. We have already proved the uniqueness. Suppose q = pr, and consider the polynomial Xq − X ∈ Fp[X]. As mentioned above Df(X)=−1sof(X) cannot have any repeated roots in any extension, i.e.
    [Show full text]
  • A Note on Presentation of General Linear Groups Over a Finite Field
    Southeast Asian Bulletin of Mathematics (2019) 43: 217–224 Southeast Asian Bulletin of Mathematics c SEAMS. 2019 A Note on Presentation of General Linear Groups over a Finite Field Swati Maheshwari and R. K. Sharma Department of Mathematics, Indian Institute of Technology Delhi, New Delhi, India Email: [email protected]; [email protected] Received 22 September 2016 Accepted 20 June 2018 Communicated by J.M.P. Balmaceda AMS Mathematics Subject Classification(2000): 20F05, 16U60, 20H25 Abstract. In this article we have given Lie regular generators of linear group GL(2, Fq), n where Fq is a finite field with q = p elements. Using these generators we have obtained presentations of the linear groups GL(2, F2n ) and GL(2, Fpn ) for each positive integer n. Keywords: Lie regular units; General linear group; Presentation of a group; Finite field. 1. Introduction Suppose F is a finite field and GL(n, F) is the general linear the group of n × n invertible matrices and SL(n, F) is special linear group of n × n matrices with determinant 1. We know that GL(n, F) can be written as a semidirect product, GL(n, F)= SL(n, F) oF∗, where F∗ denotes the multiplicative group of F. Let H and K be two groups having presentations H = hX | Ri and K = hY | Si, then a presentation of semidirect product of H and K is given by, −1 H oη K = hX, Y | R,S,xyx = η(y)(x) ∀x ∈ X,y ∈ Y i, where η : K → Aut(H) is a group homomorphism. Now we summarize some literature survey related to the presentation of groups.
    [Show full text]
  • The General Linear Group
    18.704 Gabe Cunningham 2/18/05 [email protected] The General Linear Group Definition: Let F be a field. Then the general linear group GLn(F ) is the group of invert- ible n × n matrices with entries in F under matrix multiplication. It is easy to see that GLn(F ) is, in fact, a group: matrix multiplication is associative; the identity element is In, the n × n matrix with 1’s along the main diagonal and 0’s everywhere else; and the matrices are invertible by choice. It’s not immediately clear whether GLn(F ) has infinitely many elements when F does. However, such is the case. Let a ∈ F , a 6= 0. −1 Then a · In is an invertible n × n matrix with inverse a · In. In fact, the set of all such × matrices forms a subgroup of GLn(F ) that is isomorphic to F = F \{0}. It is clear that if F is a finite field, then GLn(F ) has only finitely many elements. An interesting question to ask is how many elements it has. Before addressing that question fully, let’s look at some examples. ∼ × Example 1: Let n = 1. Then GLn(Fq) = Fq , which has q − 1 elements. a b Example 2: Let n = 2; let M = ( c d ). Then for M to be invertible, it is necessary and sufficient that ad 6= bc. If a, b, c, and d are all nonzero, then we can fix a, b, and c arbitrarily, and d can be anything but a−1bc. This gives us (q − 1)3(q − 2) matrices.
    [Show full text]
  • Primality Testing and Integer Factorisation
    Primality Testing and Integer Factorisation Richard P. Brent, FAA Computer Sciences Laboratory Australian National University Canberra, ACT 2601 Abstract The problem of finding the prime factors of large composite numbers has always been of mathematical interest. With the advent of public key cryptosystems it is also of practical importance, because the security of some of these cryptosystems, such as the Rivest-Shamir-Adelman (RSA) system, depends on the difficulty of factoring the public keys. In recent years the best known integer factorisation algorithms have improved greatly, to the point where it is now easy to factor a 60-decimal digit number, and possible to factor numbers larger than 120 decimal digits, given the availability of enough computing power. We describe several recent algorithms for primality testing and factorisation, give examples of their use and outline some applications. 1. Introduction It has been known since Euclid’s time (though first clearly stated and proved by Gauss in 1801) that any natural number N has a unique prime power decomposition α1 α2 αk N = p1 p2 ··· pk (1.1) αj (p1 < p2 < ··· < pk rational primes, αj > 0). The prime powers pj are called αj components of N, and we write pj kN. To compute the prime power decomposition we need – 1. An algorithm to test if an integer N is prime. 2. An algorithm to find a nontrivial factor f of a composite integer N. Given these there is a simple recursive algorithm to compute (1.1): if N is prime then stop, otherwise 1. find a nontrivial factor f of N; 2.
    [Show full text]
  • Computing Prime Divisors in an Interval
    MATHEMATICS OF COMPUTATION Volume 84, Number 291, January 2015, Pages 339–354 S 0025-5718(2014)02840-8 Article electronically published on May 28, 2014 COMPUTING PRIME DIVISORS IN AN INTERVAL MINKYU KIM AND JUNG HEE CHEON Abstract. We address the problem of finding a nontrivial divisor of a com- posite integer when it has a prime divisor in an interval. We show that this problem can be solved in time of the square root of the interval length with a similar amount of storage, by presenting two algorithms; one is probabilistic and the other is its derandomized version. 1. Introduction Integer factorization is one of the most challenging problems in computational number theory. It has been studied for centuries, and it has been intensively in- vestigated after introducing the RSA cryptosystem [18]. The difficulty of integer factorization has been examined not only in pure factoring situations but also in various modified situations. One such approach is to find a nontrivial divisor of a composite integer when it has prime divisors of special form. These include Pol- lard’s p − 1 algorithm [15], Williams’ p + 1 algorithm [20], and others. On the other hand, owing to the importance and the usage of integer factorization in cryptog- raphy, one needs to examine this problem when some partial information about divisors is revealed. This side information might be exposed through the proce- dures of generating prime numbers or through some attacks against crypto devices or protocols. This paper deals with integer factorization given the approximation of divisors, and it is motivated by the above mentioned research.
    [Show full text]
  • On the Discrete Logarithm Problem in Finite Fields of Fixed Characteristic
    On the discrete logarithm problem in finite fields of fixed characteristic Robert Granger1⋆, Thorsten Kleinjung2⋆⋆, and Jens Zumbr¨agel1⋆ ⋆ ⋆ 1 Laboratory for Cryptologic Algorithms School of Computer and Communication Sciences Ecole´ polytechnique f´ed´erale de Lausanne, Switzerland 2 Institute of Mathematics, Universit¨at Leipzig, Germany {robert.granger,thorsten.kleinjung,jens.zumbragel}@epfl.ch Abstract. × For q a prime power, the discrete logarithm problem (DLP) in Fq consists in finding, for × x any g ∈ Fq and h ∈hgi, an integer x such that g = h. For each prime p we exhibit infinitely many n × extension fields Fp for which the DLP in Fpn can be solved in expected quasi-polynomial time. 1 Introduction In this paper we prove the following result. Theorem 1. For every prime p there exist infinitely many explicit extension fields Fpn for which × the DLP in Fpn can be solved in expected quasi-polynomial time exp (1/ log2+ o(1))(log n)2 . (1) Theorem 1 is an easy corollary of the following much stronger result, which we prove by presenting a randomised algorithm for solving any such DLP. Theorem 2. Given a prime power q > 61 that is not a power of 4, an integer k ≥ 18, polyno- q mials h0, h1 ∈ Fqk [X] of degree at most two and an irreducible degree l factor I of h1X − h0, × ∼ the DLP in Fqkl where Fqkl = Fqk [X]/(I) can be solved in expected time qlog2 l+O(k). (2) To deduce Theorem 1 from Theorem 2, note that thanks to Kummer theory, when l = q − 1 q−1 such h0, h1 are known to exist; indeed, for all k there exists an a ∈ Fqk such that I = X −a ∈ q i Fqk [X] is irreducible and therefore I | X − aX.
    [Show full text]
  • Improvements in Computing Discrete Logarithms in Finite Fields
    ISSN (Print): 2476-8316 ISSN (Online): 2635-3490 Dutse Journal of Pure and Applied Sciences (DUJOPAS), Vol. 5 No. 1a June 2019 Improvements in Computing Discrete Logarithms in Finite Fields 1*Ali Maianguwa Shuaibu, 2Sunday Babuba & 3James Andrawus 1, 2,3 Department of Mathematics, Federal University Dutse, Jigawa State Email: [email protected] Abstract The discrete logarithm problem forms the basis of numerous cryptographic systems. The most efficient attack on the discrete logarithm problem in the multiplicative group of a finite field is via the index calculus. In this paper, we examined a non-generic algorithm that uses index calculus. If α is a generator × × for 퐹푝 then the discrete logarithm of 훽 ∈ 퐹푝 with respect to 훼 is also called the index of 훽 (with respect to 훼), whence the term index calculus. This algorithm depends critically on the distribution of smooth numbers (integers with small prime factors), which naturally leads to a discussion of two algorithms for factoring integers that also depend on smooth numbers: the Pollard 푝 − 1method and the elliptic curve method. In conclusion, we suggest improved elliptic curve as well as hyperelliptic curve cryptography methods as fertile ground for further research. Keywords: Elliptic curve, Index calculus, Multiplicative group, Smooth numbers Introduction 푥 It is known that the logarithm 푙표푔푏 푎 is a number x such that 푏 = 푎, for given numbers a and b. Similarly, in any group G, powers 푏푘 can be defined for all integers 푘, and 푘 the discrete logarithm푙표푔푏 푎 is an integer k such that 푏 = 푎. In number theory,푥 = 푥 푖푛푑푟푎(푚표푑 푚) is read as the index of 푎 to the base r modulo m which is equivalent to 푟 = 푎(푚표푑 푚) if r is the primitive root of m and greatest common divisor, 푔푐푑( 푎, 푚) = 1.
    [Show full text]
  • The Index Calculus Method Using Non-Smooth Polynomials
    MATHEMATICS OF COMPUTATION Volume 70, Number 235, Pages 1253{1264 S 0025-5718(01)01298-4 Article electronically published on March 7, 2001 THE INDEX CALCULUS METHOD USING NON-SMOOTH POLYNOMIALS THEODOULOS GAREFALAKIS AND DANIEL PANARIO Abstract. We study a generalized version of the index calculus method for n the discrete logarithm problem in Fq ,whenq = p , p is a small prime and n !1. The database consists of the logarithms of all irreducible polynomials of degree between given bounds; the original version of the algorithm uses lower bound equal to one. We show theoretically that the algorithm has the same asymptotic running time as the original version. The analysis shows that the best upper limit for the interval coincides with the one for the original version. The lower limit for the interval remains a free variable of the process. We provide experimental results that indicate practical values for that bound. We also give heuristic arguments for the running time of the Waterloo variant and of the Coppersmith method with our generalized database. 1. Introduction Let G denote a group written multiplicatively and hgi the cyclic subgroup gen- erated by g 2 G.Giveng and y 2hgi,thediscrete logarithm problem for G is to find the smallest integer x such that y = gx.Theintegerx is called the discrete logarithm of y in the base g, and is written x =logg y. The main reason for the intense current interest on the discrete logarithm prob- lem (apart from being interesting on a purely mathematical level) is that the se- curity of many public-key cryptosystems depends on the assumption that finding discrete logarithms is hard, at least for certain groups.
    [Show full text]
  • A Public-Key Cryptosystem Based on Discrete Logarithm Problem Over Finite Fields 퐅퐩퐧
    IOSR Journal of Mathematics (IOSR-JM) e-ISSN: 2278-5728, p-ISSN: 2319-765X. Volume 11, Issue 1 Ver. III (Jan - Feb. 2015), PP 01-03 www.iosrjournals.org A Public-Key Cryptosystem Based On Discrete Logarithm Problem over Finite Fields 퐅퐩퐧 Saju M I1, Lilly P L2 1Assistant Professor, Department of Mathematics, St. Thomas’ College, Thrissur, India 2Associate professor, Department of Mathematics, St. Joseph’s College, Irinjalakuda, India Abstract: One of the classical problems in mathematics is the Discrete Logarithm Problem (DLP).The difficulty and complexity for solving DLP is used in most of the cryptosystems. In this paper we design a public key system based on the ring of polynomials over the field 퐹푝 is developed. The security of the system is based on the difficulty of finding discrete logarithms over the function field 퐹푝푛 with suitable prime p and sufficiently large n. The presented system has all features of ordinary public key cryptosystem. Keywords: Discrete logarithm problem, Function Field, Polynomials over finite fields, Primitive polynomial, Public key cryptosystem. I. Introduction For the construction of a public key cryptosystem, we need a finite extension field Fpn overFp. In our paper [1] we design a public key cryptosystem based on discrete logarithm problem over the field F2. Here, for increasing the complexity and difficulty for solving DLP, we made a proper additional modification in the system. A cryptosystem for message transmission means a map from units of ordinary text called plaintext message units to units of coded text called cipher text message units. The face of cryptography was radically altered when Diffie and Hellman invented an entirely new type of cryptography, called public key [Diffie and Hellman 1976][2].
    [Show full text]
  • 2.3 Diffie–Hellman Key Exchange
    2.3. Di±e{Hellman key exchange 65 q q q q q q 6 q qq q q q q q q 900 q q q q q q q qq q q q q q q q q q q q q q q q q 800 q q q qq q q q q q q q q q qq q q q q q q q q q q q 700 q q q q q q q q q q q q q q q q q q q q q q q q q q qq q 600 q q q q q q q q q q q q qq q q q q q q q q q q q q q q q q q qq q q q q q q q q 500 q qq q q q q q qq q q q q q qqq q q q q q q q q q q q q q qq q q q 400 q q q q q q q q q q q q q q q q q q q q q q q q q 300 q q q q q q q q q q q q q q q q q q qqqq qqq q q q q q q q q q q q 200 q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q qq q q qq q q 100 q q q q q q q q q q q q q q q q q q q q q q q q q 0 q - 0 30 60 90 120 150 180 210 240 270 Figure 2.2: Powers 627i mod 941 for i = 1; 2; 3;::: any group and use the group law instead of multiplication.
    [Show full text]
  • A Second Course in Algebraic Number Theory
    A second course in Algebraic Number Theory Vlad Dockchitser Prerequisites: • Galois Theory • Representation Theory Overview: ∗ 1. Number Fields (Review, K; OK ; O ; ClK ; etc) 2. Decomposition of primes (how primes behave in eld extensions and what does Galois's do) 3. L-series (Dirichlet's Theorem on primes in arithmetic progression, Artin L-functions, Cheboterev's density theorem) 1 Number Fields 1.1 Rings of integers Denition 1.1. A number eld is a nite extension of Q Denition 1.2. An algebraic integer α is an algebraic number that satises a monic polynomial with integer coecients Denition 1.3. Let K be a number eld. It's ring of integer OK consists of the elements of K which are algebraic integers Proposition 1.4. 1. OK is a (Noetherian) Ring 2. , i.e., ∼ [K:Q] as an abelian group rkZ OK = [K : Q] OK = Z 3. Each can be written as with and α 2 K α = β=n β 2 OK n 2 Z Example. K OK Q Z ( p p [ a] a ≡ 2; 3 mod 4 ( , square free) Z p Q( a) a 2 Z n f0; 1g a 1+ a Z[ 2 ] a ≡ 1 mod 4 where is a primitive th root of unity Q(ζn) ζn n Z[ζn] Proposition 1.5. 1. OK is the maximal subring of K which is nitely generated as an abelian group 2. O`K is integrally closed - if f 2 OK [x] is monic and f(α) = 0 for some α 2 K, then α 2 OK . Example (Of Factorisation).
    [Show full text]
  • Making NTRU As Secure As Worst-Case Problems Over Ideal Lattices
    Making NTRU as Secure as Worst-Case Problems over Ideal Lattices Damien Stehlé1 and Ron Steinfeld2 1 CNRS, Laboratoire LIP (U. Lyon, CNRS, ENS Lyon, INRIA, UCBL), 46 Allée d’Italie, 69364 Lyon Cedex 07, France. [email protected] – http://perso.ens-lyon.fr/damien.stehle 2 Centre for Advanced Computing - Algorithms and Cryptography, Department of Computing, Macquarie University, NSW 2109, Australia [email protected] – http://web.science.mq.edu.au/~rons Abstract. NTRUEncrypt, proposed in 1996 by Hoffstein, Pipher and Sil- verman, is the fastest known lattice-based encryption scheme. Its mod- erate key-sizes, excellent asymptotic performance and conjectured resis- tance to quantum computers could make it a desirable alternative to fac- torisation and discrete-log based encryption schemes. However, since its introduction, doubts have regularly arisen on its security. In the present work, we show how to modify NTRUEncrypt to make it provably secure in the standard model, under the assumed quantum hardness of standard worst-case lattice problems, restricted to a family of lattices related to some cyclotomic fields. Our main contribution is to show that if the se- cret key polynomials are selected by rejection from discrete Gaussians, then the public key, which is their ratio, is statistically indistinguishable from uniform over its domain. The security then follows from the already proven hardness of the R-LWE problem. Keywords. Lattice-based cryptography, NTRU, provable security. 1 Introduction NTRUEncrypt, devised by Hoffstein, Pipher and Silverman, was first presented at the Crypto’96 rump session [14]. Although its description relies on arithmetic n over the polynomial ring Zq[x]=(x − 1) for n prime and q a small integer, it was quickly observed that breaking it could be expressed as a problem over Euclidean lattices [6].
    [Show full text]