Abstract:The worst-case hardness of finding short vectors in ideals of cyclotomic number fields (Ideal-SVP) is a central matter in lattice based cryptography. Assuming the worst-case hardness of Ideal-SVP allows to prove the Ring-LWE and Ring-SIS assumptions, and therefore to prove the security of numerous cryptographic schemes and protocols — including key-exchange, digital signatures, public-key encryption and fully-homomorphic encryption.A series of recent works has shown that Principal Ideal-SVP is not always as hard as finding short vectors in general lattices, and some schemes were broken using quantum algorithms — the Soliloquy encryption scheme, Smart-Vercauteren fully homomorphic encryption scheme from PKC 2010, and Gentry-Garg-Halevi cryptographic multilinear-maps from Eurocrypt 2013.Those broken schemes were using a special class of principal ideals, but these works also showed how to solve SVP for principal ideals in the worst-case in quantum polynomial time for an approximation factor of \documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$\exp (\tilde{O}(\sqrt{n}))$$\end{document}. This exposed an unexpected hardness gap between general lattices and some structured ones, and called into question the hardness of various problems over structured lattices, such as Ideal-SVP and Ring-LWE.In this work, we generalize the previous result to general ideals. Precisely, we show how to solve the close principal multiple problem (CPM) by exploiting the classical theorem that the class-group is annihilated by the (Galois-module action of) the so-called Stickelberger ideal. Under some plausible number-theoretical hypothesis, our approach provides a close principal multiple in quantum polynomial time. Combined with the previous results, this solves Ideal-SVP in the worst case in quantum polynomial time for an approximation factor of \documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$\exp (\tilde{O}(\sqrt{n}))$$\end{document}.Although it does not seem that the security of Ring-LWE based cryptosystems is directly affected, we contribute novel ideas to the cryptanalysis of schemes based on structured lattices. Moreover, our result shows a deepening of the gap between general lattices and structured ones.

An Attack on $p$-adic Lattice Public-key Cryptosystems and Signature Schemes

On the Closest Vector Problem for Lattices Constructed from Polynomials and Their Cryptographic Applications

New Lattice Based Cryptographic Constructions

Almost tight security in lattices with polynomial moduli—PRF, IBE, all-but-many LTF, and more

Linearly Homomorphic Signature with Tight Security on Lattice

A Method of Constructing Orthogonal Basis in $p$-adic Fields

Identity-based Signatures from Lattices

An efficient certificateless signature scheme on lattice

Attribute-based Signature on Lattices

Improved Attacks on (EC)DSA with Nonce Leakage by Lattice Sieving with Predicate.

Short Stickelberger Class Relations and Application to Ideal-SVP

Cryptanalysis of a Lattice-based Multi-signature Scheme

Cryptanalysis of a Public Key Cryptosystem Based on Diophantine Equations Via Weighted LLL Reduction.

On the Bounded Distance Decoding Problem for Lattices Constructed and Their Cryptographic Applications

URDP: General Framework for Direct CCA2 Security from any Lattice-Based PKE Scheme

Lattice-based message recovery signature schemes

Distributed Identity Authentication with Lenstra–Lenstra–Lovász Algorithm–Ciphertext Policy Attribute-Based Encryption from Lattices: An Efficient Approach Based on Ring Learning with Errors Problem

Identity-Based Signatures From Lattices: Simpler, Faster, Shorter

A survey on lattice-based digital signature

A Lattice-Based Key-Insulated and Privacy-Preserving Signature Scheme with Publicly Derived Public Key

Norm Orthogonal Bases and Invariants of $p$-adic Lattices