a new perturbation strategy for ntrusign - icerm

A new perturbation strategy for NTRUSign

John M. Schanck

Security Innovation

January 12, 2012

John M. Schanck Security Innovation

Outline

Brief description of NTRUSign

How it has been broken

Recent advances in similar (but provably secure!) schemes

Barriers to adapting these techniques to NTRUSign


Background

Introduced in 2001

Efficient instantiation of Goldreich-Goldwasser-Halevi (GGH)signatures

Private key (B): Good basis.

Short, nearly orthogonal, vectors

Public key (H): Bad basis.

Hermite Normal Form of B


Background

Signing

Hash document to a point m ∈ Z2Nq

Use private basis to find nearby lattice pointBabai’s round-off CVP approximation algorithm

s = bmB−1eBb·e rounds each component to the nearest integer.


Background

The NTRU ringR = Zq[X ]/(XN − 1)

Polynomials of degree ≤ N − 1; coefficients in Zq

Ring operations: component-wise addition and cyclicconvolutionN prime; q power of two

Isomorphism between R and circulant matricesFor a ∈ R:

C (a) =

a0 a1 a2 . . . aN−1

aN−1 a0 a1 . . . aN−2

aN−2 aN−1 a0 . . . aN−3

. . .

a1 a2 a3 . . . a0


Background

NTRU Lattice

B =

(f Fg G

)∼=(C (f ) C (F )C (g) C (G )

)f and g are chosen randomlyF and G are found which satisfy f ∗ G − F ∗ g = q

B−1 = 1q

(G −F−g f

)h = f ∗ g−1

H =

(1 h0 q

)


Background

NTRU Lattice

B =

(f Fg G

)∼=(C (f ) C (F )C (g) C (G )


B−1 = 1q

(G −F−g f

)

h = f ∗ g−1

H =

(1 h0 q

)


Background

NTRU Lattice

B =

(f Fg G

)∼=(C (f ) C (F )C (g) C (G )


B−1 = 1q

(G −F−g f

)h = f ∗ g−1

H =

(1 h0 q

)


Nguyen Regev ’06

Very effective attack on vanilla NTRUSign

Transcript of (signature −message) yields points in U(P(B))


Nguyen Regev ’06

Cov[transcript] ≈ Cov[U(P(B))] = 13G

Gram matrix: G = BtB =

(f f + gg f F + gGF f + Gg FF + GG

)

G−1 = LtL

L−−−−→


Nguyen Regev ’06

Cov[transcript] ≈ Cov[U(P(B))] = 13G

Gram matrix: G = BtB =


)G−1 = LtL

L−−−−→


Nguyen Regev ‘06

Independent Component Analysis (ICA) on orthogonalizedtranscript can reveal the private basis

Gradient descent on kurtosis

L−1

−−−−−−→


Countermeasures: Perturbations

Signing with perturbations

Additional perturbation keys are created during keygen andkept private

The message, m0, is signed with the first perturbation key,yielding m1, which is signed with the second perturbation keyyielding m2...

mk is signed with the private key, yielding s.


Countermeasures: Perturbations

Transcript points lie in Minkowski sum of parallelepipeds


Discrete Gaussian Sampling

Gentry, Peikert and Vaikuntanathan (STOC 2008)

Samples directly from a discrete Gaussian distributionRandomized variant of Babai’s nearest plane algorithmRejection samplingInherently sequential and cubic in n

Ultimately impractical

Peikert (CRYPTO 2010)

Removes dependence on nearest plane algorithmStill requires O(n2 log q) bits of storage as well as operationson nxn matrices.


Discrete Gaussian Sampling

Gentry, Peikert and Vaikuntanathan (STOC 2008)

Samples directly from a discrete Gaussian distributionRandomized variant of Babai’s nearest plane algorithmRejection samplingInherently sequential and cubic in nUltimately impractical


Removes dependence on nearest plane algorithmStill requires O(n2 log q) bits of storage as well as operationson nxn matrices.



Offline phase:

Input:

Basis BRounding parameter r = ω(

√log n)

Target distribution Σtarget > B tB

Compute:

Σbasis =Σnoise = Σtarget − Σbasis

Bnoise =√

Σnoise − r2IOutput:

Bnoise



Offline phase:

Input:


√log n)

Target distribution Σtarget ≥ r2(4B tB + I) > B tB

Compute:

Σbasis =Σnoise = Σtarget − Σbasis

Bnoise =√


Bnoise



Offline phase:

Input:


√log n)


Compute:

Σbasis = B tB

Σnoise = Σtarget − Σbasis

Bnoise =√


Bnoise



Offline phase:

Input:


√log n)


Compute:

Σbasis = 2r2B tB

Σnoise = Σtarget − Σbasis

Bnoise =√


Bnoise



Offline phase:

Input:


√log n)


Compute:

Σbasis = 2r2B tBΣnoise = Σtarget − Σbasis

Bnoise =√

Σnoise − r2I

Output:

Bnoise



Offline phase:

Input:


√log n)


Compute:

Σbasis = 2r2B tBΣnoise = Σtarget − Σbasis

Bnoise =√


Bnoise



Online phase:

Input:

A vector c ∈ Zn

Draw noise vector, x , from discrete Gaussian over Zn withcovariance Σnoise . x ← bBnoise · D1erAdd noise to c and sign. s = b(c − x)B−1erB


Adapting Peikert ‘10 to NTRUSign

Problems:

Operations on 2Nx2N matrices, and storage of a 2Nx2NmatrixProbably forces parameters too largeToo many standard Gaussian samples


A tiny step forward

We can find sets of vectors in the NTRU ring that take the placeof Bnoise


Circulant Eigendecomposition

N-Point DFT Matrix

W =1√N

1 1 1 1 . . . 11 ω ω2 ω3 . . . ωN−1

1 ω2 ω4 ω6 . . . ω2(N−1)

1 ω3 ω6 ω9 . . . ω3(N−1)

......

......

. . ....

1 ω(N−1) ω2(N−1) ω3(N−1) . . . ω(N−1)2

All circulant matrices C(p) = W ∗ΛWJust a restatement of convolution theorem:

f ∗ g = F−1{F{f } · F{g}}


Block-wise Diagonalization of an NTRU Lattice

(I2 ⊗W )

(C (f ) C (F )C (g) C (G )

)(I2 ⊗W )∗ =

(Λf ΛF

Λg ΛG

)

Permutation yields block-diagonal matrix:λf 1 λF1λg1 λG1

0

. . .

0λfN λFNλgN λGN



(I2 ⊗W )

(C (f ) C (F )C (g) C (G )

)(I2 ⊗W )∗ =

(Λf ΛF

Λg ΛG

)Permutation yields block-diagonal matrix:

λf 1 λF1λg1 λG1

0

. . .

0λfN λFNλgN λGN



Applications:

Fast eigenvalue computation; Solve N 2x2 eigensystemsinstead of one 2Nx2N eigensystem.

Generate noise distributions for use with Peikert’s sampler.


Finding Bnoise in NTRU module

Given B, construct C such that (ignoring scaling factors)

BtB + C tC = s ∗ I2N



Block-wise diagonalize Gram matrix:

BtB =


)(I2⊗W )−−−−−→

(Λa Λb

Λ∗b Λc

)Permute to block diagonal form

Blocks are Hermitian; positive semi-definite(λa λbλ∗b λc

)So is (

s − λa λbλ∗b s − λc

)



Perform cholesky decomposition(s1 − λa λbλ∗b s1 − λc

)=

(L11 0L21 L22

)(L11 L210 L22

)on each block

(L11 0L21 L22

)0(

L33 0L43 L44

). . .

0

(L(N−1)(N−1)

0

LN(N−1)

LNN

)



Invert permutation step

Invert Fourier transform

Result is a set of 4 polynomials in Qq[X ]/(XN − 1)

Computation doesn’t actually involve any 2Nx2N matrices!All operations can be performed on polynomials and 2x2matrices.


Once more with polynomials

f1 f2 f3 f4 F1 F2 F3 F4g1 g2 g3 g4 G1 G2 G3 G4

DFT


Shuffle




DFT


Shuffle

f1 F1 f2 F2 f3 F3 f4 F4g1 G1 g2 G2 g3 G3 g4 G4




DFT


Shuffle (f1 F1g1 G1

) (f2 F2g2 G2

) (f3 F3g3 G3

) (f4 F4g4 G4

)



Cholesky factorize each 2x2 matrix(a1 0

b1 c1

) (a2 0

b2 c2

) (a3 0

b3 c3

) (a4 0

b4 c4

)Invert permutation

a1 a2 a3 a4 0 0 0 0

b1 b2 b3 b4 c1 c2 c3 c4

Apply inverse DFT√BtB =

(a 0b c

)


Going forward

Parameters

Analyze options w.r.t sampling from other distributions


a new perturbation strategy for ntrusign - icerm

Documents