Zero-Knowledge Interactive Proof Systems for New Lattice Problems Claude Cr´epeau? and Raza Ali Kazmi? McGiLL University [email protected], [email protected] Abstract. In this work we introduce a new hard problem in lattices called Isometric Lattice Problem (ILP) and reduce Linear Code Equivalence over prime fields and Graph Isomorphism to this prob- lem. We also show that this problem has an (efficient prover) perfect zero-knowledge interactive proof; this is the only hard problem in lattices that is known to have this property (with respect to malicious verifiers). Under the assumption that the polynomial hierarchy does not collapse, we also show that ILP cannot be NP-complete. We finally introduce a variant of ILP over the rationals radicands and provide similar results for this new problem. 1 Introduction Zero-Knowledge interactive proof systems ZKIP [6] have numerous applications in cryptography such as Identification Schemes, Authentication Schemes, Mul- tiparty Computations, etc. Appart from cryptographic applications these proof systems play an important part in the study of complexity theory. The first IP for lattice problems (coGapCVPγ ; coGapSVPγ ) was presented by Goldreich and Goldwasser [13]. However, these proofs are only honest-verifier Perfect Zero- Knowledge and known to have inefficient provers. Micciancio and Vadhan [10] presented Interactive Proofs for GapCVPγ and GapSVPγ . These proofs are Statistical Zero-Knowledge and have efficient provers1 as well. In this paper we introduce a new hard problem called ISOMETRIC LATTICE PROBLEM (ILP). We present IP systems for the ILP. These proof systems are Perfect Zero-Knowledge and have efficient provers. We show that a variant of ILP over the integers is at least as hard as Graph Isomorphism (GI) [4, 5] and Linear Code Equivalence (LCE) [7, 5]. This is the only hard problem problem known in lattices that have a (malicious-verifier) Perfect Zero-Knowledge IP system with an efficient prover. We also show that ILP is unlikely to be NP-complete. Finally we also introduce another variant of ILP over the rational-radicands and provide similar results for this problem. ? Supported in part by Qu´ebec's FRQNT, Canada's NSERC and CIFAR. 1 The Prover runs in probabilistic polynomial time given a certificate for the input string. 2 Notations For any matrix A; we denote its transpose by At. Let O(n; R) = fQ 2 Rn×n : t Q · Q = Ig denote the group of n × n orthogonal matrices over R. Let GLk(Z) denote the group of k × k invertible (unimodular) matrices over Z. Let GLk(Fq) denote the set of k × k invertible matrices over the finite field Fq. Let Pn denote the set of n × n permutation matrices. Let σn be the set of all permutations of f1; : : : ; ng. For π 2 σn; we denote Pπ the corresponding n × n permutation matrix. P(n; Fq) denotes the set of n × n monomial matrices (there is exactly one nonzero entry in each row and each column) over Fq. Dn is the set of diag- onal matrices D = diag(1; : : : ; n); i = ±1 for i = 1; : : : ; n. For a real vector p 2 2 v = (v1; : : : ; vn) we denote its Euclidean norm by kvk = v1 + ··· + vn and n n×k max-norm kvk1 = maxi=1jvij and for any matrix B = [b1jb2j ::: jbk] 2 R n we define its norm by kBk = maxi=1kbik. For any ordered set of linearly inde- pendent vectors fb1; b2;:::; bkg; we denote fb~1; b~2;:::; b~kg; its Gram-Schmidt orthogonalization. 2.1 Lattices Let Rn be an n-dimensional Euclidean space and let B 2 Rn×k be a matrix of rank k. A lattice L(B) is the set of all vectors k L(B) = Bx : x 2 Z : The integer n and k are called the dimension and rank of L(B). A lattice is called full dimensional if k = n. Two lattices L(B1) and L(B2) are equivalent if k×k and only if there exists a unimodular matrix U 2 Z such that B1 = UB2. 2.2 q-ary Lattices A lattice L is called q-ary, if it satisfies qZn ⊆ L ⊆ Zn for a positive integer q. In other words, the membership of a vector v 2 L is given by v mod q. Let n×k n×k G = [g1j ::: jgk] 2 Zq be a n × k matrix of rank k over Zq . We define below two important families of q-ary lattices used in cryptography n k Λq(G) = fy 2 Z : y ≡ G · s (mod q); for some vector s 2 Z g > n Λq (G) = fy 2 Z : y · G ≡ 0 (mod q)g: A basis B of Λq(G) is n×n B = [g1j ::: jgkjbk+1j ::: jbn] 2 Z n where bj = (0; :::; q; :::; 0) 2 Z is a vector with its j-th coordinate equal to q and > −1 t all other coordinates are 0; k + 1 ≤ j ≤ n. A basis of Λq is given by q · (B ) . 2 2.3 Discrete Gaussian distribution on Lattices For any s > 0; c 2 Rn; we define a Gaussian function on Rn centered at c with parameter s. −πkx−ck n 8x 2 R ; ρs;c(x) = e s2 . X Let L be any n dimensional lattice and ρs;c(L) = ρs;c(y). We define a y2L Discrete Gaussian distribution on L ρs;c(x) 8x 2 L;Ds;c;L(x) = : ρs;c(L) n×k Theorem 1 Given a basis pB = [b1j ::: jbk] 2 R of an n-dimensional lattice L, a parameter s ≥ kB~k·!( log n) and a center c 2 Rn; the algorithm SampleD ([2], section 4.2 page 14) outputs a sample from a distribution that is statistically close to Ds;c;L. Theorem 2 There is a deterministic polynomial-time algorithm that, given an arbitrary basis fb1;:::; bkg of an n-dimensional lattice L and a set of linearly independent lattice vectors S = [s1js2 ::: jsk] 2 L with ordering ks1k ≤ ks2k ≤ · · · ≤ kskk; outputs a basis fr1 ::: rkg of L such that k~rik ≤ k~sik for 1 ≤ i ≤ k. 2.4 Orthogonal Matrices and Givens Rotations A Givens rotation is an orthogonal n × n matrix of the form 21 ··· 0 ··· 0 ··· 03 6. .. .7 6. .7 6 7 60 ··· c · · · −s ··· 07 6 7 6. .. .7 G(i;j,θ) = 6. .7 ; i 6= j 6 7 60 ··· s ··· c ··· 07 6 7 6. .. .7 4. .5 0 ··· 0 ··· 0 ··· 1 The non-zero elements of a Givens matrix G(i;j,θ) are given by gk;k = 1 for k 6= i; j and gi;i = gj;j = c gi;j = s = −gj;i for i < j where c = cos(θ) and s = sin(θ). The product G(i;j,θ) · v represents a counter-clockwise rotation of the vector v in the (i; j) plane by angle θ. Moreover, only the i-th and j-th entries of v are affected and the rest remains unchanged. Any orthogonal matrix Q 2 Rn×n 3 n(n−1) can be written as a product of 2 Givens matrices and a diagonal matrix D 2 Dn Q = D G(1;2,θ1;2) ···· G(1,n,θ1;n) · G(2;3,θ2;3) ··· G(2,n,θ2;n) ··· G(n−1,n,θn−1;n) : The angles θi;j 2 [0; 2π]; 1 ≤ i < j ≤ n are called angles of rotation. 2.5 Properties of Givens Matrices 1. Additivity: For angles θ; φ 2 [0; 2π] and any vector v 2 Rn G(i;j,φ) · G(i;j,θ)v = G(i;j,φ+θ)v: 2. Commutativity: For angles θi;j; θj;i; θy;z 2 [0; 2π] and fi; jg \ fy; zg = ; or fi; jg = fy; zg. G(i;j,θi;j ) · G(j,i,θj;i)v = G(j,i,θj;i) · G(i;j,θi;j )v G(i;j,θi;j ) · G(y;z,θy;z )v = G(y;z,θy;z ) · G(i;j,θi;j )v: n 3. Linearity: For any Givens matrix G(i;j,θi;j ); any vector v 2 R and any permutation π 2 σn G Pπ · v = PπG(i;j,θ ) · v (π(i),π(j),θπ(i),π(j)) i;j Pπ is the corresponding permutation matrix of π. 2.6 The Set R Computationally it is not possible to work over arbitrary real numbers as they require infinite precision. However, there are reals that can be represented finitely and one can add and multiplyp themp without losing any precision. For example we can represent numbers 7 and 4 5 as < 2; 7 > and < 4; 5 >. In, general, a real number r that has the following form r r n q p n q p 11 n21 n 12 n22 n r = a1 x11 + x21 + ··· + k1 xk1 + a2 x12 + x22 + ··· + k2 xk2 r n q p 1l n2l n + ··· + al x1l + x2l + ··· + kl xkl: + where aj's; nij's 2 Q; xij 's 2 Q [ f0g and l; k1 ··· kl 2 N; can be represented as r = a1 < n11; x11+ < n21; x21 + ··· + < nk1; xk1 >> ··· > + a2 < n12; x12+ < n22; x22 + ··· + < nk2; xk2 >> ··· > + ··· + al < n1l; x1l+ < n2l; x2l + ··· + < nkl; xkl >> ··· > : We call such numbers rational radicands and denote the set of all rational radicands R. 2 2 In this notation any rational number x can be represented as ± < 1; x >. 4 2.7 The Set O(n; R) Let O(n; R) denote a set of n×n orthogonal matrices over R. In this sub-section we will define a subset O(n; R) ⊂ O(n; R) that has the following properties: { Any orthogonal matrix Q 2 O(n; R) has finite representation.