Integral Matrix Gram Root and Lattice Gaussian Sampling Without Floats
Integral Matrix Gram Root and Lattice Gaussian Sampling Without Floats
复制标题
无浮点数的积分矩阵革兰氏根和格子高斯采样
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Yang Yu
中科院分区：
文献类型：
--
作者：
L. Ducas;S. Galbraith;Thomas Prest;Yang Yu
许多先进的基于格的密码系统需要从高斯分布中采样格点。这项任务面临的一个挑战是，所有当前的算法都会在某些时候求助于浮点算术(FPA)，这在实践中有许多缺点：它需要数值稳定性分析，需要额外的存储来实现高精度，需要懒惰/回溯技术来提高效率，并且可能受到弱确定性的影响，从而可能完全破坏某些方案。在这篇文章中，我们给出了在一般格子上实现高斯采样而不使用FPA的方法。为此，我们回顾了Peikert的方法，使用了扰动抽样。Peikert的方法使用连续的高斯抽样和一些分解文档类[12pt]{minimum}usepackage{amsath}usepackage{amsFonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathsfs}usepackage{upgreek}setlong{oddsidemargin}{-69pt}例如{Document}$$mathbf{Sigma}=mathbf{A}mathbf{A}^t$End{Document}Σ=目标协方差文档类[12pt]的aat{usepackage{amsmam}usepackage{waysym}usepackage{amsfonts}usepackage{amssbsy}usepackage{A}mathbf{A}^t$end{Document}Σ=目标协方差文档类[12pt]中的Aat{-69pt}例如{Document}$$mathbf{sigma}$$End{Document}Σ。所建议的分解，例如Cholesky分解，产生方阵文档类[12pt]{minimum}usepackage{amsath}usepackage{wa ysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathsfs}usepackage{upgreek}setlong{oddsidemargin}{-69pt}例如在{Document}$$mathbf{A}$$end{Document}A中具有实数(非整数)条目。简而言之，我们的想法是用一个完整的分解来取代这种分解。虽然如果我们将DocumentClass[12pt]{Minimum}usepackage{amsath}usepackage{wa ysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathsfs}usepackage{upgreek}setlong{oddsidemargin}{-69pt}例如{Document}$$mathbf{A}$$end{Document}A限制为方阵，则通常没有整数解，我们证明了这样的分解可以通过允许DocumentClass[12pt]{minimum}usepackage{amsath}usepackage{wa ysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{matrsfs}usepackage{upgreek}setlong{oddsidemargin}{-69pt}如{DocumentClass$$mathbf{A}$$end{Document}A变得更宽(比如DocumentClass[12pt]{Minimum}usepackage{amssym}usesepackage{amssymsb}usepackage{amsssy}{mastrsfs}setepackage{greepackage{$$ododsidempt}in{$imn}$im9n}×n}。这可以看作是拉格朗日四方定理在矩阵上的推广。此外，我们将我们的积分分解算法应用于环的设置：对于2的幂割圆，我们可以利用环塔结构来改进复杂性和紧凑性。
Many advanced lattice based cryptosystems require to sample lattice points from Gaussian distributions. One challenge for this task is that all current algorithms resort to floating-point arithmetic (FPA) at some point, which has numerous drawbacks in practice: it requires numerical stability analysis, extra storage for high-precision, lazy/backtracking techniques for efficiency, and may suffer from weak determinism which can completely break certain schemes. In this paper, we give techniques to implement Gaussian sampling over general lattices without using FPA. To this end, we revisit the approach of Peikert, using perturbation sampling. Peikert’s approach uses continuous Gaussian sampling and some decomposition documentclass[12pt]{minimal} usepackage{amsmath} usepackage{wasysym} usepackage{amsfonts} usepackage{amssymb} usepackage{amsbsy} usepackage{mathrsfs} usepackage{upgreek} setlength{oddsidemargin}{-69pt} egin{document}$$mathbf {Sigma }= mathbf {A}mathbf {A}^t$$end{document}Σ=AAt of the target covariance matrix documentclass[12pt]{minimal} usepackage{amsmath} usepackage{wasysym} usepackage{amsfonts} usepackage{amssymb} usepackage{amsbsy} usepackage{mathrsfs} usepackage{upgreek} setlength{oddsidemargin}{-69pt} egin{document}$$mathbf {Sigma }$$end{document}Σ. The suggested decomposition, e.g. the Cholesky decomposition, gives rise to a square matrix documentclass[12pt]{minimal} usepackage{amsmath} usepackage{wasysym} usepackage{amsfonts} usepackage{amssymb} usepackage{amsbsy} usepackage{mathrsfs} usepackage{upgreek} setlength{oddsidemargin}{-69pt} egin{document}$$mathbf {A}$$end{document}A with real (not integer) entries. Our idea, in a nutshell, is to replace this decomposition by an integral one. While there is in general no integer solution if we restrict documentclass[12pt]{minimal} usepackage{amsmath} usepackage{wasysym} usepackage{amsfonts} usepackage{amssymb} usepackage{amsbsy} usepackage{mathrsfs} usepackage{upgreek} setlength{oddsidemargin}{-69pt} egin{document}$$mathbf {A}$$end{document}A to being a square matrix, we show that such a decomposition can be efficiently found by allowing documentclass[12pt]{minimal} usepackage{amsmath} usepackage{wasysym} usepackage{amsfonts} usepackage{amssymb} usepackage{amsbsy} usepackage{mathrsfs} usepackage{upgreek} setlength{oddsidemargin}{-69pt} egin{document}$$mathbf {A}$$end{document}A to be wider (say documentclass[12pt]{minimal} usepackage{amsmath} usepackage{wasysym} usepackage{amsfonts} usepackage{amssymb} usepackage{amsbsy} usepackage{mathrsfs} usepackage{upgreek} setlength{oddsidemargin}{-69pt} egin{document}$$n imes 9n$$end{document}n×9n). This can be viewed as an extension of Lagrange’s four-square theorem to matrices. In addition, we adapt our integral decomposition algorithm to the ring setting: for power-of-2 cyclotomics, we can exploit the tower of rings structure for improved complexity and compactness.
DOI：
10.1007/978-3-662-44709-3_20
发表时间：
2014-09
期刊：
IACR Cryptol. ePrint Arch.
影响因子：
--
作者：
T. Pöppelmann;L. Ducas;Tim Güneysu
通讯作者：
T. Pöppelmann;L. Ducas;Tim Güneysu