Discrete Gaussian Leftover Hash Lemma

of 29 /29
Discrete Gaussian Leftover Hash Lemma Shweta Agrawal IIT Delhi With Craig Gentry, Shai Halevi, Amit Sahai

Embed Size (px)

description

Discrete Gaussian Leftover Hash Lemma. Shweta Agrawal IIT Delhi. With Craig Gentry, Shai Halevi, Amit Sahai. Need Good Randomness. Crucially need ideal randomness in many areas, eg. cryptography However, often deal with imperfect randomness - PowerPoint PPT Presentation

Transcript of Discrete Gaussian Leftover Hash Lemma

  • Discrete Gaussian Leftover Hash Lemma Shweta AgrawalIIT DelhiWith Craig Gentry, Shai Halevi, Amit Sahai

  • *Need Good RandomnessCrucially need ideal randomness in many areas, eg. cryptography However, often deal with imperfect randomnessphysical sources, biometric data, partial knowledge about secretsCan we extract good randomness from ill-behaved random variables? EXTRACTORS (NZ96)Yes!

  • Classic Leftover Hash Lemma

    Universal Hash Family H = { h: X Y }For all x y Prh [ h(x) = h(y) ] = 1/|Y|

    Leftover Hash Lemma (HILL) :

    Universal hash functions yield good extractors

    ( h(x), h) (U, h)

  • Classic use of LHLUniversal Hash Function : Inner Product over finite field

    H = { ha: Zqm Zq }

    Pick a1..am uniformly over Zq

    Define ha(x) = ai xi mod q

    ha(x) uniform over Zq

    Simple, useful randomness extractor !

  • Discrete Gaussian LHL ?What if target distribution we need is discrete Gaussian instead of uniform? What if domain is infinite ring instead of finite field? When do generalized subset sums of lattice points yield nice discrete Gaussians ?

  • You ask What are discrete Gaussians ?Why do we care ?

  • Why do we care ?Because they help us build Multilinear Maps from lattices (GGH12)!

  • WHAT ARE DISCRETE GAUSSIANS?

  • LatticesA set of points with periodic arrangementDiscrete subgroup in Rn

  • What are discrete Gaussians ?D, r : Gaussian distribution with std deviation r but support restricted to points over lattice More formally ..D, r (x) exp(- ||x||2 / r2) if x in 0 otherwise

  • Why study discrete Gaussians ?

    Ubiquitous in lattice based crypto

    At the technical core of most proofs in the area, notably in the famous Learning with Errors assumption

    Not as well understood as their continuous counterparts

  • Our Results: Discrete Gaussian LHL over infinite domains

    Fix once and for all, vectors x1..xm We choose xi from discrete Gaussian D, s Let X = [x1|..|xm] Zn x m

    Choose vector z from discrete Gaussian DZm, s

    Then the distribution zi xi is statistically close to D, sX

    D, sX is a roughly spherical discrete Gaussian of moderate width (under certain conditions)

  • Oblivious Gaussian Sampler

    Our result yields an oblivious Gaussian sampler:

    Given enc(x1)..enc(xm) If enc is additively homomorphic, can compute enc(g) where g is discrete Gaussian. Just sample z and compute zi enc(xi)

    Previous Gaussian samplers [GPV08, Pei10] too complicated to use within additively homomorphic scheme.

  • Why is the Gaussian LHL true ?

  • Analyzing zi xi : Proof IdeaRecall our setup: Fix once and for all, vectors x1..xm We sample xi from discrete Gaussian D, s Let X = [x1|..|xm] Zn x m

    Sample vector z from discrete Gaussian DZm, sDefine A = {v Zm : X v = 0}Note, A is a lattice.

  • Analyzing zi xi :Broad Outline of ProofThm 1: zi xi D, sX if lattice A is smooth relative to s

    Thm 2:A is smooth if matrix X is regularly shaped Thm 3:X is regularly shaped if xi ~ D, s

    zi xi D, sX near spherical discrete Gaussian of moderate width

  • Analyzing zi xi :Broad Outline of ProofThm 1: zi xi D, sX if lattice A is smooth relative to s

    Thm 2:A is smooth if matrix X is regularly shaped Thm 3:X is regularly shaped if xi ~ D, s

    zi xi D, sX near spherical discrete Gaussian of moderate width

  • Analyzing zi xi :Broad Outline of ProofThm 1: zi xi D, sX if lattice A is smooth relative to s

    Thm 2:A is smooth if matrix X is regularly shaped Thm 3:X is regularly shaped if xi ~ D, s

    zi xi D, sX near spherical discrete Gaussian of moderate width

  • Smoothness of a LatticeWant to wipe out the structure of the latticeAdd noise to lattice points till we get the uniform distribution* Smoothness animation from Regevs slides

  • Smoothness of a LatticeWant to wipe out the structure of the latticeAdd noise to lattice points till we get the uniform distribution* Smoothness animation from Regevs slides

  • Smoothness of a LatticeWant to wipe out the structure of the latticeAdd noise to lattice points till we get the uniform distribution* Smoothness animation from Regevs slides

  • Smoothness of a LatticeWant to wipe out the structure of the latticeAdd noise to lattice points till we get the uniform distribution* Smoothness animation from Regevs slides

  • Smoothness of a Lattice How much noise is needed to blur the lattice depends on its structure

    Informally, if the noise magnitude needed is small, we may say that a lattice is smooth

    Measured by smoothing parameter smooth(L) [MR04]

    Smooth(L) is the smallest s s.t. adding Gaussian noise of radius s to L yields an essentially uniform distribution

  • X is regularly shaped if its singular values lie within small interval.

    Thm 3: If xi ~ D, s then X is regularly shaped

    Start with random matrix theory. Know that if matrix M has continuous Gaussian entries and m >2n, then all the singular values of M are within constant sized interval

    Can extend this to discrete Gaussians, Regularly shaped

  • Broad Outline of ProofThm 1:

    zi xi D, sX if s > smooth(A)

    Thm 2:If matrix X is regularly shaped then smooth(A) is small.Thm 3:If xi ~ D, s then X is regularly shaped zi xi D, sX near spherical discrete Gaussian of moderate width

  • Thm 2: smooth(A) is small if X is regularly shaped.

    Argue that n+1(Mq), the (n+1)st minima of Mq is large if X regularly shaped

    Convert to upper bound m-n(Aq) using thm by Banasczcyk

    Argue these m-n short vectors belong to A

    Relate m-n(A) to smooth(A) using bound by MR04

  • Typical application would use our LHL to drown out some value it wishes to hide, a la GGH12.Applicability Need the minimum width of the Gaussian to be wide enough to drown out the value it is hiding Our LHL can be seen as showing that this can be done in a frugal way, without wasting too many samples. Can be used within additively homomorphic scheme. Care needs to be taken if basis X has to be kept secret. Better use other samplers (GPV08, Pei10)

  • Discrete Gaussians are important and not as well understood. Our work makes progress towards understanding their behavior.Conclusions Provided a discrete Gaussian LHL over infinite rings. May be used as an oblivious Gaussian sampler within an additively homomorphic scheme.

  • Thank you!

    Questions?