Fall 2016 Published by the Courant Institute of Mathematical Sciences at New York University Courant Newsletter Modeling the Unseen Earth with Georg Stadler Volume 13, Issue 1 p4 p12 p2 IN MEMORIAM: ENCRYPTION FOR A JOSEPH KELLER POST-QUANTUM WORLD WITH ODED REGEV p8 FOR THE LOVE OF MATH: CMT nurtures mathematically talented, underserved kids ALSO IN THIS ISSUE: AT THE BOUNDARY NEW FACULTY OF TWO FIELDS: p11 A COURANT STORY p6 PUZZLE: FIND ME QUICKLY CHANGING OF p13 THE GUARD p7 IN MEMORIAM: ELIEZER HAMEIRI p10 Encryption for a post-quantum world With Oded Regev by April Bacon assumed secure because the problem on which it is based — in this case, factoring very large numbers — is assumed very hard. “The key to almost all quantum algorithms is something called the quantum Fourier transform,” says Oded. “It allows quantum computers to easily identify periodicity [occurrences at regular intervals], which, as it turns out, allows to solve the integer factorization problem.” By using Shor’s algorithm, quantum computers will be able to break systems used today very quickly — it is thought in a matter of seconds. The speed is “not because the computer is fast – this is a common misconception,” says Oded. “It just does ©NYU Photo Bureau: Asselin things in different ways.” Whereas a regular computer has bits that alternate between (From left to right) Oded Regev with Ph.D. students Noah Stephens-Davidowitz and state “0” and “1,” a quantum computer – Alexander (Sasha) Golovnev. by putting photons, electrons, and other Oded Regev established a landmark lattice- Public-key encryption is “one of the quantum objects to work as “qubits” – can based encryption system, which could help main conceptual discoveries of the 20th take advantage of a quantum phenomenon keep the internet secure in a post-quantum century,” says Oded. Discovered in the 70s, called superposition. Superposition allows computing world. it allows information to be securely sent each qubit to be in state “0,” “1,” or a across the otherwise insecure internet and combination of both, a phenomenon that Oded Regev has been fascinated by phone lines. “Everyone is listening. Still, we “stacks” when multiple qubits operate lattices ever since they were first introduced can communicate securely.” How is that together, enabling “a huge superposition of to him in the final semester of his Ph.D. possible? “The key is that what’s in my brain all those qubits together, coherently doing program at Tel Aviv University, fifteen years is something only I know. I randomly choose calculations,” explains Oded. ago. A lattice is “a regular arrangement of a secret. I will tell you something about the Now in the prototype phase, fully points in space, as formed by atoms in a secret, and what I tell you will allow you to operable quantum computers would be crystal, when packing oranges in a crate, send me encrypted information,” he says. the scientific achievement of a lifetime. It’s or by a honeycomb in a beehive,” explains “We’ve gotten used to it perhaps — but that an advance that many experts say could be Oded, who has been a Professor of Computer this exists is amazing.” a reality within one to two decades and a Science at the Institute for four years. Lattices Cryptographic systems pave prospect that keeps cryptographers up at first became a subject of mathematical the way for many daily activities in our night. “We need alternatives,” says Oded. “If inquiry in some early work in number theory technologically advanced society. They verify in a year or two someone finally makes this in the 19th century. The real foundation, signatures on documents; secure our emails, breakthrough, chaos will ensue, because though, was built in the early 1900s by ATMs, and chip cards; block or allow access no one will have any way to encrypt. We Hermann Minkowski, who also gave the area to websites and cable TV; and authenticate a would have no way to communicate securely of study its name: geometry of numbers. business’s website. “Cryptography also offers anymore.” Cryptographic applications of lattices were us lots of advanced tools beyond encryption first proposed by Miklós Ajtai in the 90s, and authentication. E.g., it offers solutions Learning with Errors and it is within that context that Oded has for anonymity, deniability, and even online The answer, it turns out, is in error. found many deep questions regarding voting,” says Oded. The key to lattice-based cryptography their mathematical and computational But a breakthrough discovery made is in introducing error and thereby properties. One of his most foundational by Peter Shor (MIT) in the mid-90s showed disrupting periodicity, something not easily scientific contributions to the area is known that systems like RSA (which stands for accomplished with RSA and other number as Learning with Errors, a problem that Rivest-Shamir-Adleman), which are currently theoretic schemes. To show how it works, serves as the basis for a multitude of efficient securing these everyday activities, could Oded offers a simplified demonstration of lattice-based cryptographic constructions, be broken if quantum computers are built. Learning with Errors (LWE): and in particular public-key encryption. Like other systems of encryption, RSA is 2 — Courant Newsletter, Fall 2016 Bob wishes to send Alice a dimension of the lattice,” says Oded. primitive known as fully homomorphic secret yes or no message. To initiate the “One surprising and unique aspect encryption. Craig Gentry (IBM) discovered communication process, Alice chooses a of this security proof is that it requires “encryption in the cloud” – its trendier alias large, odd number, ideally over 100 digits. ideas from quantum computation,” he – which allows companies to work on users’ For sake of ease, we’ll use something smaller adds. “This is totally unexpected since the encrypted data without having to decrypt here: 1,001. This number itself remains cryptosystem itself has nothing quantum it. Inefficiencies are still being worked out, a secret. She sends Bob a list of numbers in it — just adding and dividing numbers.” but once it is ready for prime time, it will which are multiples of 1,001 with some allow a company to, for example, analyze small, even numbers (the “error”) added in: Encryption in the cloud someone’s DNA in encrypted form without 65,069 (1,001 times 65 plus 4), 17,023 (1,001 LWE is a landmark contribution the company being able to look inside the times 17 plus 6), 144,146 (1,001 times 144 which brought lattice-based encryption file. “It sounds like a contradiction,” says plus 2), and a couple dozen or so other such systems into the realm of the possible. Oded. “But it’s not, because the answer they numbers. Bob then randomly chooses some By now the most advanced and deeply- send is also encrypted – they can’t even numbers from this list. For simplicity, say researched scheme for encryption in a read the answer. Only you can later open he chooses the first and the last included post-quantum world, it could also prove the envelope. For many decades, people above. He adds these together to get 209,215 useful for other important cryptographic didn’t even know this exists. Now we know and if his message is “yes,” he sends that applications such as digital signatures. But these things can be constructed based on number as-is. If his message is “no,” he adds perhaps the most surprising application Learning with Errors.” n a one and sends 209,216 instead. Alice then of LWE is in constructing a cryptographic divides by her secret key – 1,001 – which will yield an even remainder (6) for “yes” or an odd remainder (7) for “no.” “If you don’t add the small, even A famous theorem in reverse numbers in the first step, it’s not secure because all these numbers will be divisible Hermann Minkowski’s 1910 paper “Geometry of Numbers” proved the most by 1,001. In this case, you could easily celebrated theorem of the area, known as Minkowski’s first fundamental theorem. determine the secret,” says Oded. “Euclid It proves that if you look at a lattice’s cloud of points from afar and there are a lot of knew that. It’s a 2,000-year-old technique.” points, and you then zoom in, “there will be a small area around the origin where Part of the beauty of LWE is in its you will also have a lot of points,” says Oded. In other words: Global density implies simplicity. “Learning with Errors is probably local density. the easiest encryption scheme you can While thinking about this classic paper, Daniel Dadush, a former postdoc imagine,” Oded says. “It’s mainly adding at the Institute who is now a researcher at the National Research Institute for numbers and dividing. There’s not more Mathematics and Computer Science (CWI) in the Netherlands, asked if the theorem to it than that. There’s no deep math in the would hold in reverse: Does local density also imply global density? system itself — the math appears in the “It’s a fantastic question that was waiting to be asked for over a century; I security proof.” know of very few researchers that can come up with such conjectures,” says Oded. Motivated by the beauty of the problem, Oded and Daniel began working about five Security without Q.E.D. years ago to prove that the reverse version of the famous theorem is true. The con- It is always possible that a brilliant jecture found some applications in cryptography, as well as in additive combina- mathematician or computer scientist will torics, in analysis of Brownian motions, and in the integer programming problem.