This is a corrected version of Pro c of Cryptography and Lattices Conference March Providence Rho de Island USA J Silverman Ed vol of Lecture Notes in Computer Science pages c SpringerVerlag httpwwwspringerdecomplncsindexhtml The Two Faces of Lattices in Cryptology Phong Q Nguyen and Jacques Stern Ecole Normale Superieure Departement dInformatique rue dUlm Paris France pnguyenensfr and httpwwwdiensfr pngu yen sterndiensfr and httpwwwdiensfr ster n Abstract Lattices are regular arrangements of p oints in ndimensional space whose study app eared in the th century in b oth numb er the ory and crystallography Since the app earance of the celebrated Lenstra LenstraLovasz lattice basis reduction algorithm twenty years ago lat tices have had surprising applications in cryptology Until recently the applications of lattices to cryptology were only negative as lattices were used to break various cryptographic schemes Paradoxically several p os itive cryptographic applications of lattices have emerged in the past ve years there now exist publickey cryptosystems based on the hardness of lattice problems and lattices play a crucial role in a few security pro ofs We survey the main examples of the two faces of lattices in cryptology Intro duction n Lattices are discrete subgroups of R A lattice has innitely many Zbases but some are more useful than others The goal of lattice reduction is to nd interesting lattice bases such as bases consisting of reasonably short and al most orthogonal vectors From the mathematical p oint of view the history of lattice reduction go es back to the reduction theory of quadratic forms devel op ed by Lagrange Gauss Hermite Korkine and Zolotarev among others and to Minkowskis geometry of numb ers With the advent of algorithmic numb er theory the sub ject had a revival in with Lenstras celebrated work on integer programming see which was among others based on a novel lattice reduction technique which can b e found in the prelimi nary version of Lenstras reduction technique was only p olynomialtime for xed dimension which was however enough in That inspired Lovasz to develop a p olynomialtime variant of the algorithm which computes a socalled reduced basis of a lattice The algorithm reached a nal form in the seminal pap er where Lenstra Lenstra and Lovasz applied it to factor rational p oly nomials in p olynomial time back then a famous problem from which the name LLL comes Further renements of the LLL algorithm were later prop osed no tably by Schnorr Those algorithms have proved invaluable in many areas of mathematics and computer science see In particular their relevance to cryptology was immediately understo o d and they were used to break schemes based on the knapsack problem see which were early alternatives to the RSA cryptosystem The success of reduction algorithms at breaking var ious cryptographic schemes over the past twenty years see have arguably established lattice reduction techniques as the most p opular to ol in publickey cryptanalysis As a matter of fact applications of lattices to cryptology have b een mainly negative Interestingly it was noticed in many cryptanalytic ex p eriments that LLL as well as other lattice reduction algorithms b ehave much more nicely than what was exp ected from the worstcase proved b ounds This led to a common b elief among cryptographers that lattice reduction is an easy problem at least in practice That b elief has recently b een challenged by some exciting progress on the complexity of lattice problems which originated in large part in two seminal pap ers written by Ajtai in and in resp ectively Prior to little was known on the complexity of lattice problems In his pap er Ajtai discovered a fascinating connection b etween the worstcase complexity and the averagecase complexity of some wellknown lattice problems Such a connection is not known to hold for any other problem in NP b elieved to b e outside P In his pap er building on previous work by Adleman Ajtai further proved the NPhardness under randomized reductions of the most famous lat tice problem the shortest vector problem SVP The NPhardness of SVP has b een a long standing op en problem Ajtais breakthroughs initiated a series of new results on the complexity of lattice problems which are nicely surveyed by Cai Those complexity results op ened the do or to p ositive applications in cryp tology Indeed several cryptographic schemes based on the hardness of lattice problems were prop osed shortly after Ajtais discoveries see Some have b een broken while others seem to resist stateoftheart at tacks for now Those schemes attracted interest for at least two reasons on the one hand there are very few publickey cryptosystems based on problems dif ferent from integer factorization or the discrete logarithm problem and on the other hand some of those schemes oered encryptiondecryption rates asymp totically higher than classical schemes Besides one of those schemes by Ajtai and Dwork enjoyed a surprising security pro of based on worstcase instead of averagecase hardness assumptions Indep endently of those developments there has b een renewed cryptographic interest in lattice reduction following a b eautiful work by Copp ersmith in Copp ersmith showed by means of lattice reduction how to solve rigor ously certain problems apparently nonlinear related to the question of nding small ro ots of lowdegree p olynomial equations In particular this has led to surprising attacks on the RSA cryptosystem in sp ecial settings such as low public or private exp onent but curiously also to new security pro ofs Copp ersmiths results dier from traditional applications of lattice reduction in cryptanalysis where the underlying problem is already linear and the attack often heuristic by requiring at least that current lattice reduction algorithms b ehave ideally as opp osed to what is theoretically guaranteed The use of lattice reduction techniques to solve p olynomial equations go es back to the eighties The rst result of that kind the broadcast attack on lowexp onent RSA due to Hastad can b e viewed as a weaker version of Copp ersmiths theorem on univariate mo dular p olynomial equations A shorter version of this survey previously app eared in The rest of the pap er is organized as follows In Section we give basic denitions and results on lattices and their algorithmic problems In Section we survey an old appli cation of lattice reduction in cryptology nding small solutions of multivariate linear equations which includes the wellknown subset sum or knapsack problem as a sp ecial case In Section we review a related problem the hidden numb er problem In Section we discuss latticebased cryptography somehow a revival for knapsackbased cryptography In Section we discuss developments on the problem of nding small ro ots of p olynomial equations inspired by Copp er smiths discoveries in In Section we survey the surprising links b etween lattice reduction the RSA cryptosystem and integer factorization Lattice problems Denitions n Recall that a lattice is a discrete additive subgroup of R In particular any n subgroup of Z is a lattice and such lattices are called integer lattices An equivalent denition is that a lattice consists of all integral linear combinations of a set of linearly indep endent vectors that is d X n b j n Z L i i i i where the b s are linearly indep endent over R Such a set of vectors b s is i i called a lattice basis All the bases have the same numb er dim L of elements called the dimension or rank of the lattice since it matches the dimension of the vector subspace spanL spanned by L There are innitely many lattice bases when dimL Any two bases are related to each other by some unimo dular matrix integral matrix of deter minant and therefore all the bases share the same Gramian determinant det hb b i The volume volL or determinant of the lattice is by de ij d i j nition the square ro ot of that Gramian determinant thus corresp onding to the ddimensional volume of the parallelepip ed spanned by the b s In the imp or i tant case of fulldimensional lattices where dimL n the volume is equal to the absolute value of the determinant of any lattice basis hence the name determinant If the lattice is further an integer lattice then the volume is also n n equal to the index Z L of L in Z Since a lattice is discrete it has a shortest nonzero vector the Euclidean norm of such a vector is called the lattice rst minimum denoted by L or kLk Of course one can use other norms as well we will use kLk to denote the rst minimum for the innity norm More generally for all i dim L Minkowskis ith minimum L is dened as the minimum of max kv k i j i j over all i linearly indep endent lattice vectors v v L There always ex i ist linearly indep endent lattice vectors v v reaching the minima that is d kv k L However surprisingly as so on as dim L such vectors do not i i necessarily form a lattice basis and when dimL there may not even exist a lattice basis reaching the minima This is one of the reasons why there exist several notions of basis reduction in high dimension without any optimal one It will b e convenient to dene the lattice gap as the ratio L L b etween the rst two minima Minkowskis Convex Bo dy Theorem guarantees the existence of short vec tors in lattices a careful application shows that any ddimensional lattice L d satises kLk volL which is obviously the b est p ossible b ound It fol p d d volL which is not optimal