JP2021081591A - Safety evaluation device, safety evaluation method, and safety evaluation program - Google Patents

Abstract

To provide a safety evaluation device, a safety evaluation method, and a safety evaluation program that are capable of accelerating even at a more general dimension, with respect to an ideal lattice in which a dimension capable of accelerating the solution of an SVP has been previously limited.SOLUTION: A safety evaluation device 1 comprises, with respect to the dimension n of an ideal lattice in lattice cryptography that is a safety evaluation target; a selection unit 11 for selecting an odd prime and a cyclotomic polynomial subscript m; and a solution unit 12 for repeating a predetermined number of vector generations and reductions with the use of a rotational operation of a vector derived from a relational expression of a cyclotomic polynomial term number t.SELECTED DRAWING: Figure 5

Description

The present invention relates to devices, methods and programs for evaluating the security of lattice-based cryptography.

Conventionally, in evaluating the security of lattice-based cryptography, the solution time of the shortest vector problem (SVP: Shortest Vector Problem) has been used as an index.
In Non-Patent Document 1, the Gauss Seeve algorithm, which is a high-speed solution algorithm for SVP, has been proposed. Non-Patent Document 2 shows a case where the dimension of a vector is a power of 2 as a condition that vector generation can be realized at high speed by a rotation operation with respect to a special lattice called an ideal lattice, and the cyclotomic polynomial is an irreducible binomial. It was proposed as an Anti-cyclolic lattice defined by the formula. Further, in Patent Documents 1 and 2 and Non-Patent Document 3, the Trinomial defined by the irreducible trinomial can speed up the algorithm when the dimension of the vector is the product of the power of 2 and the power of 3. A grid was proposed.

As one of the lattice-based cryptosystems using the ideal lattice, there is NTRU encryption (see Non-Patent Document 4), which is a candidate for next-generation public key cryptography. Cryptographic security assessments are performed by assessing the attacker's computational limits on cryptography using faster algorithms. The faster these algorithms are, the more detailed the evaluation of cryptographic security is possible.

Japanese Unexamined Patent Publication No. 2015-1555 Japanese Unexamined Patent Publication No. 2014-186097

D. Micciancio and P.M. Voulgaris. Faster exponental time algorithm algorithms for the shortest vector problem. In Proceedings of the Twenty-first Annual ACM-SIAM Symposium on Discrete Algorithms, SODA '10, pp. 1468-1480. Society for Industrial and Applied Mathematics, 2010. M. Schneider. Sieve for shortest vectors in ideal lattices. In Progress in Cryptography-AFRICACRYPT 2013, pp. 375-391. Springer, 2013. T. Ishiguro, S.M. Kiyomoto, Y. Miyake, and T.M. Takagi. Parallel gauss sieve algorithm: Solving the svp challenge over a 128-dimensional ideal algorithm. In Public-Key Cryptography-PKC 2014, pp. 411-428. Springer, 2014. J. Hoffstein, J.M. Piper, and J. et al. Silverman. NTRU: Ring-based public key cryptosystem. In Algorithmic Number Theory, pp. 267-288. Springer, 1998.

However, the dimension n of the vector that the algorithm of Non-Patent Document 2 can be accelerated by the rotation operation is n = 2 ^a or n = 2 ^a 3 in which the cyclotomic polynomial is defined by the irreducible binomial or the irreducible trinomial. ^It was limited to the case of b.

The present invention has a safety evaluation device, a safety evaluation method, and safety that can speed up the solution of SVP even in a more general dimension, as opposed to an ideal lattice that can speed up the solution of SVP. The purpose is to provide an evaluation program.

^{The security evaluation device according to the present invention has m = p b} (b ≧ 1) and n = p ^b-1 (p-1) with respect to the dimension n of the ideal lattice in the lattice code to be evaluated for security. , Or select an ideal number p that satisfies m = 2 ^a · p ^b (a ≧ 1, b ≧ 1) and n = 2 ^a-1 · p ^b-1 (p-1), and the subscript m of the cyclotomic polynomial. A selection unit to be used and a solution unit that repeats vector generation and contraction a predetermined number of times by using the rotation of the vector derived from the relation of the number of terms t = p of the cyclotomic polynomial.

^{The security evaluation device according to the present invention has m = p b} · q ^c (b ≧ 1, c ≧ 1) and n = p ^{b with} respect to the dimension n of the ideal lattice in the lattice code to be evaluated for security. ^-1 (p-1) · q ^c-1 (q-1), or m = 2 ^a · p ^b · q ^c (a ≧ 1, b ≧ 1, c ≧ 1) and n = 2 ^a-1 · Two odd prime numbers p and q that satisfy p ^b-1 (p-1) and q ^c-1 (q-1), a selection unit that selects the subscript m of the cyclotomic polynomial, and the number of terms of the cyclotomic polynomial. Using the integer k, t = 2k (p-1) + 1 and q = pk + 1, t = 2k (p-1) + 2p-3 and q = p (k + 1) -1, t = (1/2) k ^(p 2 -1) + p and q = pk + 2, or t = (1/2) (k + 1) since (p 2 -1) is any relationship between -p and q = p (k + 1) -2 It includes a solution unit that repeats vector generation and reduction a predetermined number of times by using the rotation of the derived vector.

^{The security evaluation method according to the present invention has m = p b} (b ≧ 1) and n = p ^b-1 (p-1) with respect to the dimension n of the ideal lattice in the lattice code to be evaluated for security. , Or select an ideal number p that satisfies m = 2 ^a · p ^b (a ≧ 1, b ≧ 1) and n = 2 ^a-1 · p ^b-1 (p-1), and the subscript m of the cyclotomic polynomial. The computer executes a selection step to be performed and a solution step in which vector generation and reduction are repeated a predetermined number of times by using the rotation of the vector derived from the relation of the number of terms t = p of the cyclotomic polynomial.

^{The security evaluation method according to the present invention has m = p b} · q ^c (b ≧ 1, c ≧ 1) and n = p ^{b with} respect to the dimension n of the ideal lattice in the lattice code to be evaluated for security. ^-1 (p-1) · q ^c-1 (q-1), or m = 2 ^a · p ^b · q ^c (a ≧ 1, b ≧ 1, c ≧ 1) and n = 2 ^a-1 · Two odd prime numbers p and q that satisfy p ^b-1 (p-1) and q ^c-1 (q-1), a selection step for selecting the subscript m of the cyclotomic polynomial, and the number of terms of the cyclotomic polynomial. Using the integer k, t = 2k (p-1) + 1 and q = pk + 1, t = 2k (p-1) + 2p-3 and q = p (k + 1) -1, t = (1/2) k ^(p 2 -1) + p and q = pk + 2, or t = (1/2) (k + 1) since (p 2 -1) is any relationship between -p and q = p (k + 1) -2 Using the rotation of the derived vector, the computer executes a solution step that repeats vector generation and reduction a predetermined number of times.

The safety evaluation program according to the present invention is for operating a computer as the safety evaluation device.

According to the present invention, it has become possible to speed up the solution of SVP even in a more general dimension, as opposed to the ideal lattice, which has been limited in the dimension in which the solution of SVP can be speeded up.

It is a figure which shows the solution algorithm. It is a figure which shows the algorithm of the contraction function Reduse. It is a figure which shows the algorithm of the contraction function ReduseRot. It is a figure which shows the algorithm of the contraction function ReduseRot2. It is a block diagram which shows the functional structure of a safety evaluation apparatus. It is a figure which shows the algorithm of the contraction function ReduseRotWise.

Hereinafter, an example of the embodiment of the present invention will be described.
In the security evaluation method in the present embodiment, in order to evaluate the security of the lattice-based cryptography using the ideal grid, conditions according to the dimension of the ideal grid for solving the SVP at high speed are selected and defined for each condition. The rotation operation is performed to speed up a process called contraction.

[Definition]
Let the Euclidean norm of the m-dimensional vector v = (v ₀ , ..., v _m-1 ) be ‖v‖ = √ (Σ _{i = 0} ^m-1 v _i ² ). The inner product of the vectors u = (u ₀ , ..., u _m-1 ) and v = (v ₀ , ..., v _m-1 ) is <u, v> = Σ _{i = 0} ^m-1 u _i v _i . Represent.
A matrix consisting of n first-order independent m-dimensional column vectors is written as B = (b ₀ , ..., b _n-1 ) ∈ R ^{m × n} . The lattice generated by B is the set of all integer coefficient linear combinations _{of the basis vectors b 0} , ..., b _{n-1 L (B) = L (b 0} , ..., b _n-1 ) = {Σ _{i = ^{0 n-1 x i b i}} | is that _{x i} ∈ Z}. B is called the basis of the lattice L. In this embodiment, the n = m and _{b i} ∈ Z ^n, referred to as n and dimension of the lattice. The Euclidean norm of the nonzero shortest vector on the lattice L _{is written as λ 1} (L).
The shortest vector problem (SVP) is to find the vector v ∈ L (B) such that ‖ v ‖ _{= λ 1} (L (B)) when the lattice L (B) is given.

The ideal I refers to a partial additive group of rings R = Z [x] / (g (x)). However, g (x) is an nth-order monic polynomial on Z. For v (x) = Σ _{i = 0} ^n-1 v _i x ^{i ∈ I} , the coefficient vector v = (v ₀ , ..., v _n-1 ) ∈ Z is made to correspond to v (x). At this time, the set {v = (v ₀ , ..., v _n-1 ) ∈ Z | v (x) = Σ _{i = 0} ^n-1 v _i x ⁱ ∈ I} is a lattice. Such a grid is called an ideal grid.

The ideal grid is congruent for rotation operations. That is, when the polynomial representation of the lattice vector v ∈ L is v (x), rot (v) = xv (x) mod g (x) is also a vector of L (B). The operation rot is called vector rotation. ^{The repetition of i} rotations is written as rot i (v) = rot (... rot (rot (v) ...)). However, rot ⁰ (v) = v.

For the nth-order monic polynomial g (x), the cyclotomic polynomial used in the R-LWE (Ring Learning with Player) problem or the like is used. The m-th cyclotomic polynomial Φ _m (x) is defined by the following equation.
Φ _m (x) = Π _{1 ≦ k ≦ m, gcd (k, m) = 1} (x-e ^{2πik / m} )
However, gcd (i, j) represents the greatest common divisor of the natural numbers i, j. For example, Φ ₈ (x) = x ⁴ + 1, Φ ₁₂ (x) = x ^4- x ² + 1, and so on.

[Gauss Sieve algorithm]
In order to output the shortest vector from the grid L (B), in the Gauss Sieve algorithm, when the difference between the two vectors u and v belonging to the grid L (B) becomes small, one vector is replaced with the vector difference. (Called contraction) is repeated recursively until the norm no longer decreases.
As a result, the two vectors u and v on the lattice L (B) satisfy ‖u ± v‖ ≧ max (‖u‖, ‖v‖), and the state becomes Gauss-reduced.

FIG. 1 is a diagram showing a conventional (Non-Patent Document 1) solution algorithm (Gauss Seeve).
FIG. 2 is a diagram showing an algorithm of the reduction function Reduce executed by the conventional (Non-Patent Document 1) solution algorithm.

In the contraction function Reduce, two vectors u and v belonging to the lattice L (B) are input, and ‖u-v‖ and ‖u‖ are compared. When ‖u-v‖ is small, the vector u is contracted. Is about.
If the two vectors are linearly dependent, the origin vector is always output. This is called a collision.

For the set A ⊂ L (B), when the combination of all vectors ∀u, v ∈ A, u ≠ v is Gauss-reduced, the set A is said to be Pairwise-reduced.

In the Gauss Sieve algorithm, the set L of lattice vectors that is Pairwise-reduced is gradually expanded. First, a new lattice vector v is generated by random sampling. Next, the contraction is performed so that the combination of v and all the elements of L is Gauss-reduced, and the norm of v is reduced. The reduced v is added to L in this way. At this time, L∪ {v} is also Pairwise-reduced.
After performing such an operation of expanding the set L until collisions occur a certain number of times, the grid L (B) outputs the shortest vector in L as the shortest vector.

Further, in the methods of Non-Patent Document 2 and Non-Patent Document 3 utilizing the properties of the ideal lattice, the Anti-cyclic lattice in which the cyclotomic polynomial as the monic polynomial g (x) is an irreducible binomial expression, and the irreducible trinomial 3 By defining a Trinomial lattice as a binary expression and performing a rotation operation derived from the definition expression, the generation of the vector v for trying the reduction is repeated.
As a result, the solution of SVP by the Gauss Seeve algorithm has been accelerated.

FIG. 3 is a diagram showing an algorithm of the reduction function ReduceRot executed by the conventional (Non-Patent Document 2) solution algorithm (Ideal Gauss Seeve).
In the contraction function ReduceRot, by rotating the duplicate v'of the vector v (step 3), a vector for trying the contraction is repeatedly generated. This improves the probability of generating a short vector.

FIG. 4 is a diagram showing an algorithm of the reduction function ReduceRot2 executed by the conventional (Non-Patent Document 3) solution algorithm.
In the reduction function ReduceRot2, the vector is simultaneously generated by the inverse rotation for the ReductionRot, the algorithm is parallelized, the number of rotations k at which the calculation time is the shortest is obtained, and the reduction trial is made k times. Was given.

In the present embodiment, a t-nomic lattice that generalizes the concepts of the Anti-cyclic lattice and the Trinomial lattice is further defined, and the safety evaluation device 1 further defines the dimension n of the ideal lattice and the subscript m and the term of the cyclotomic polynomial. The contraction process is executed by rotation and reverse rotation based on the condition associated with the number t.

[Functional configuration]
FIG. 5 is a block diagram showing a functional configuration of the safety evaluation device 1 in the present embodiment.
The safety evaluation device 1 is an information processing device (computer) such as a server or a personal computer, and includes a control unit 10 and a storage unit 20, as well as various data input / output devices and communication devices.

The control unit 10 is a part that controls the entire safety evaluation device 1, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs (safety evaluation programs, etc.) and various data for making the hardware group function as the safety evaluation device 1, and is a ROM, RAM, flash memory, or hard disk (HDD). And so on.

The control unit 10 includes a selection unit 11, a solution unit 12, and an initialization unit 13. The control unit 10 executes a contraction process for solving the SVP by these functional units.
At this time, the control unit 10 measures the processing time and outputs it as an index of the security of the lattice-based cryptography.

The t-nomic lattice is an ideal lattice generated from a cyclotomic polynomial having t in the number of terms. However, t ≧ 2. By using the t-nomic lattice, it is possible to increase the speed of the Gauss Sieve algorithm for the general dimension n.

The selection unit 11 selects the subscript m and the number of terms t of the cyclotomic polynomial that satisfies any of the conditions 1 to 3 described later for the dimension n of the ideal lattice in the lattice-based cryptography to be evaluated for security.
In addition, these conditional expressions include the case of the Anti-cyclic lattice having 2 terms and the case of the Trinomial lattice having 3 terms.

The solving unit 12 repeats vector generation and reduction a predetermined number of times by using the rotation of the vector derived from the relationship between the degree n and the subscript m and the number of terms t of the cyclotomic polynomial.

The initialization unit 13 initializes the vector v by repeating the rotation or reverse rotation operation until the rotation cycle is reached.
At this time, the initialization unit 13 may compare the number of rotations required for initialization with the number of reverse rotations, and initialize the vector v by a small number of operations.

なお、この条件は、モニック多項式が円分多項式Φ_ｍ（ｘ）＝ｘ^ｎ＋１となるイデアル格子、すなわちＡｎｔｉ−ｃｙｃｌｉｃ格子を示している。 [Condition 1]

This condition indicates an ideal lattice in which the monic polynomial is a cyclotomic polynomial Φ _m (x) = x ⁿ + 1, that is, an Anti-cyclic lattice.

である。すなわち、ベクトルｖの先頭及び末尾のみに、挿入又は削除の処理が行われる。 When the condition 1 is satisfied, the rotation rot (v) and the reverse rotation rot ^-1 _{(v) of the vector v = (v 0} , ..., v _n-1 ) have a relation of 0 ≦ i ≦ n-1.

Is. That is, the insertion or deletion process is performed only at the beginning and the end of the vector v.

[Condition 2]
For the odd prime number p

Here, for the odd prime number p, when m = 2 ^a · p ^b (a ≧ 0, b ≧ 1), t = p means that the cyclotomic polynomial Φ _m (x) = Σ _{i = 0.} It is clear from the fact that it is ^p-1 (-1) ⁱ x ^{i2 ^ (a-1) p ^ (b-1).} For example, when ^{m = 36 = 2 2 · 3} 2, t = 3 , and the case of ^{m = 121 = 2 0 · 11} 2, a t = 11.
When p = 3, the monic polynomial is a cyclotomic polynomial Φ _m (x) = {x ⁿ + x ^{n / 2} +1 (m = 3 ^a ), x ⁿ − x ^{n / 2} +1 (m = 2 ^a 3). ^The ideal lattice that becomes b), that is, the Trinomial lattice is shown.

Further, the conditional expression of n is proved as follows.
When x and y are natural numbers that are mutually exclusive, φ (xy) = φ (x) φ (y) holds. Note that φ is Euler's totient function, and it is known that n = φ (m) for the degree n of the m-th cyclotomic polynomial. Further, for the prime number p and the natural number k, φ ( ^pk ) = p ^k-1 (p-1). From the above, for a ≧ 1, φ (2 ^a p ^b ) = φ (2 ^a ) φ (p ^b ) = 2 ^a-1 · p ^b-1 (p-1). Further, for a = 0, φ (p ^b ) = p ^b-1 (p-1) ^{from m = p b.}

である。すなわち、ベクトルｖの先頭及び末尾に挿入又は削除の処理が行われ、ｔ−２の箇所において差又は和の演算が行われる。なお、上式の演算子「−／＋」は、ａ＝０のとき−、ａ≠０のとき＋となる。 When the condition 2 is satisfied, the rotation operation rot (v) of the vector v and the reverse rotation operation rot ^-1 (v) are performed with respect to 0 ≦ i ≦ n-1, 1 ≦ l ≦ t-2.

Is. That is, the process of inserting or deleting is performed at the beginning and the end of the vector v, and the difference or sum is calculated at the point t-2. The operator "− / +" in the above equation is − when a = 0 and + when a ≠ 0.

The equations for rotation and reverse rotation are proved as follows.
For the cyclotomic polynomial Φ _m (x) and its degree n, Φ _{p ^ b} (x) = Σ _{i = 0} ^p-1 x ^{ip ^ (b-1)} , Φ _{2 ^ a · p ^ b} (x) ) = Σ _{i = 0} ^p-1 (-1) ⁱ x ^{i2 ^ (a-1) p ^ (b-1)} . Therefore, the rotation equation can be obtained by calculating xv (x) mod Φ _{m (x) respectively.}
For the inverse rotation, the inverse element x ^-1 _{modulo Φ m} (x) is calculated. When a = 0, x ^-1 = −Σ _{i = 0} ^p-1 x ^{ip ^ (b-1) -1} , and when a ≠ 0, x ^-1 = Σ _{i = 0} ^p-1 (-1) ⁱ x ^{i2 ^ (a-1) p ^ (b-1) -1} . Therefore, the equation for inverse rotation can be obtained by substituting the above equation for ^{x -1} v (x) mod Φ _{m (x).}

[Condition 3]
If the two odd prime numbers p and q (p <q) are selected so as to have q≡1,2, p-1, p-2 mod p, and k = floor (q / p), then

Here, the _{numbers of terms of Φ 2 ^ ap ^ bq ^ c} (x) and Φ _pq (x) are equal. This is proved as follows.
For an odd number n> 1, Φ _2n (x) = Φ _n (−x). Further, for relatively prime numbers s and t, Φ ^s ^ _{mt (x) = Φ st} (x ^{s ^ (m-1)} ). Therefore, since 2 and p ^b q ^c are relatively prime, Φ _{2 ^ ap ^ bq ^ c} (x) = Φ 2 _{p ^ bq ^ c} (x ^{2 ^ (a-1)} ). If y = x ^{2 ^ (a-1)} , Φ _{2 ^ ap ^ bq ^ c} (x) and Φ _{2p ^ bq ^ c} (y) have the same number of terms. Next, since p ^b q ^c is an odd number, Φ _{2p ^ bq ^ c} (y) = Φ _{p ^ bq ^ c} (−y). If z = −y, Φ _{2p ^ bq ^ c} (y) and Φ _{p ^ bq ^ c} (z) have the same number of terms. Further, since p and q ^c are relatively prime, Φ _{p ^ bq ^ c} (z) = Φ _{pq ^ c} (z ^p ^ ^(b-1) ). If w = z ^p ^ ^(b-1) , the number of terms is the same for _{Φ p ^ bq ^ c} (z) = Φ _{pq ^ c (w).} Finally, since q and p are relatively prime, Φ _{pq ^ c} (w) = Φ _pq (w ^{q ^ (c-1)} ), and the number of terms does not change.

Further, the following document A indicates the number of terms of _{Φ pq (x).}
Reference A: L. Carlitz. The number of terms in the cyclotomic polynomial fpq (x). The American Mathematics Monthly, Vol. 73, pp. 979-981, 1966.

Therefore, the relational expression of the above-mentioned term number t is derived for the odd prime numbers p and q.
For example, considering m = 70 = 2.5.7 for p = 5, q = 7, t = 17 for k = 1. Further, as a set of m and t satisfying t <10, there are m = 2 ^a , 3 ^b , 5 ^c , and t = 7.

である。すなわち、ベクトルｖの先頭及び末尾に挿入又は削除の処理が行われ、ｔ−２の箇所において差又は和の演算が行われる。 When the condition 3 is satisfied, _{the coefficient of the cyclotomic polynomial Φ m} (x) is -1, 0, or 1, and the n-th order and zero-order coefficients are always 1. Therefore, using the coefficient vector c = (c ₁ , ..., c _n-1 ), c _i ∈ {-1, 0, 1}, Σ _{i = 1} ^n-1 | c _i | = t-2, Φ It can be expressed as _m (x) = 1 + c ₁ x + ... + c _n-1 x ^n-1 + x ^n. Note that term is _{c i} ≠ 0 is present only t-2 pieces.
At this time, the rotation rot (v) and the reverse rotation rot ^-1 (v) of the vector v are set with respect to 0 ≦ i ≦ n-1.

Is. That is, the process of inserting or deleting is performed at the beginning and the end of the vector v, and the difference or sum is calculated at the point t-2.

As a specific example of the t-nomic lattice, consider the case of t = 5,7.
When m = 2 ^a and 5 ^b , the ideal lattice becomes a 5-nomic lattice. At this time, when a ≠ 0, the rotation operation is rot (v) = (−v _n-1 , v0,…, v _{n / 4-1} + v _n-1 ,…, v _{n / 2-1} −v. _n-1 , ..., v _{3n / 4-1} + v _n-1 , ..., v _n-2 ).
Further, when m = 2 ^a・ 7 ^b or m = 2 ^a・ 3 ^b・ 5 ^c , the ideal lattice becomes a 7-normal lattice. When m = 2 ^a・ 3 ^b・ 5 ^c , the cyclotomic polynomial Φ _{2 ^ a3 ^ b5 ^ c} (x) = x ⁿ −x ^{7n / 8} + x ^{5n / 8} −x ^{n / 2} + x ^{3n / 8} − x ^{n / 8} + 1, or x ⁿ + x ^{7n / 8-} x ^{5n / 8-} x ^{n / 2-} x ^{3n / 8} + x ^{n / 8} + 1. At this time, the rotation operation is rot (v) = (-v _n-1 , v ₀ , ..., v _{n / 8-1} + v _n-1 , ..., v _{3n / 8-1} -v _n-1 , ... , V _{n / 2-1} + v _n-1 , ..., v _{5n / 8-1} -v _n-1 , ..., v _{7n / 8-1} + v _n-1 , ..., v _n-2 ), or (- v _n-1 , v ₀ , ..., v _{n / 8-1} -v _n-1 , ..., v _{3n / 8-1} + v _n-1 , ..., v _{n / 2-1} + v _n-1 , ..., v _{5n / 8-1} + v _n-1 , ..., v _{7n / 8-1} −v _n-1 , ..., v _n-2 ).

FIG. 6 is a diagram showing an algorithm of the reduction function ReduceRotWise in the present embodiment.
In the contraction functions ReduceRot (FIG. 3) and ReduceRot2 (FIG. 4), in order to reuse the vector v, duplication of the vector v (v'and v'') was required as preprocessing. In the Gauss Sieve algorithm, these reduction functions are repeatedly called until the shortest vector is found, so that the calculation time is increased by a large number of duplication processes.
On the other hand, in the reduction function ReduceRotWise, the calculation time is reduced by substituting the duplication process of the vector v by rotation or inverse rotation. Specifically, a speedup of about 1.5 times was experimentally realized as compared with the conventional method (Non-Patent Document 3).

In addition to the two initial vectors u and v belonging to the ideal lattice L (B), the number of trials for contraction, that is, the number of rotations k, is given as an input.
The number of rotations k is appropriately determined according to m and t.
Specifically, it is known that the norm of a vector increases stochastically by a rotation operation, and the larger the number of terms t, the greater the probability. Therefore, for example, k = m / 2 when t = 2, k = 13 when t = 3, k = 6 when t = 5, and k = 3 when t = 7, which are more appropriate for experiments and the like. The number of times is set.

In steps 1 to 3, first, reduction based on the vector u and the vector v is attempted, and the vector u is updated. Subsequently, the updated vector u and the reduction based on the vector v updated by the rotation operation are tried k times, and the vector u is updated.

In order to initialize the vector v updated by the processing up to this point, either rotation or reverse rotation, whichever is required less frequently, may be used, but it needs to be repeated for the number of rotation cycles.
Here, from the inductive relational expression Φ _m (x) = (x ^m -1) / (Π _{d | m, d ≠ m} Φ _d (x)) ^{obtained from the definition of the cyclotomic polynomial, x m} = Φ _m (X) Π _{d | m, d ≠ m} Φ _d (x) +1. Therefore, x ^m ≡ 1 mod Φ _m (x), and rot ^m (v) = x ^m v (x) ≡ v (x) mod Φ _m (x) = v.
Therefore, for the cyclotomic polynomial Φ _m (x), the rotation period is m. When m is an even number, m / 2 can be used instead of the period m.

In step 4, the initialization unit 13 compares the number of rotations k with the number of remaining times mk until the cycle. When k ≧ m−k, step 5 is executed, and when k <m−k, steps 7 to 11 are executed.

In step 5, the initialization unit 13 initializes the vector v by further repeating the forward rotation mk times.
In step 7, the initialization unit 13 initializes the vector v updated by k rotations by reverse rotating the same number of times.

In steps 8 to 10, the solution unit 12 attempts to reduce the vector v while updating the vector v by the reverse rotation in the reverse direction.
As a result, the solution unit 12 suppresses the increase in the norm of the vector v due to rotation or reverse rotation, and improves the success rate of contraction.
In step S11, the initialization unit 13 initializes the vector v updated by the reverse rotation k times by rotating the vector v the same number of times.

In step 12, the solution unit 12 outputs the vector u shortened by k + 1 or 2k + 1 reduction attempts.

Here, the operations of the rotation and the reverse rotation of the t-nomic lattice are executed with the amount of calculation of O (t), respectively. This is proved as follows.
From the above rotation and reverse rotation equations, it can be seen that the position of the vector to be updated is t. Of these, for the beginning and end of the vector, the deletion and insertion operations are performed with the calculation amount O (1), respectively. Further, at the other t-2 points, the difference or the sum is calculated with the calculation amount O (1), respectively. Therefore, the computational complexity of rotation and reverse rotation is O (t) in total.

The function ReduceRotWise requires a computational complexity of O (min (k, m−k) t) to return ^{the vector rot k (v) to v.} As described above, since it can be said that the value of min (k, m-k) is sufficiently small, in practice, O (min (k, m-k) is larger than the computational complexity O (n) required for vector duplication. ) T) is smaller and faster.

According to the present embodiment, the security evaluation device 1 is a subscript of an odd prime number and a cyclotomic polynomial satisfying any one of the conditions 1 to 3 with respect to the dimension n of the ideal lattice in the lattice code to be evaluated for security. m is selected, and the vector generation and reduction are repeated a predetermined number of times by using the rotation operation of the vector v derived from the relationship with the number t of the cyclotomic polynomial.
As a result, the safety evaluation device 1 has made it possible to speed up the solution of the SVP even in a more general dimension, as opposed to the ideal lattice, which has been limited in the dimension in which the solution of the SVP can be speeded up. For example, a speedup of about 10 times has been achieved as compared with Gauss Sieve with respect to n = 80 dimensions to which the ideal lattice has not been applied so far.
As a result, the security evaluation device 1 can perform a stricter security evaluation for the next-generation public key cryptography using an ideal lattice such as NTRU, and can contribute to an appropriate design such as a dimension.

Further, the safety evaluation device 1 initializes the vector v, which is updated in accordance with the contraction process, by repeating the rotation or reverse rotation operation until the cycle is reached.
As a result, the safety evaluation device 1 was able to reduce the processing time associated with the duplication of the vector v and further speed up the SVP solution algorithm. For example, in the n = 64 dimension, the solution time by Gauss Sieve was 7432 seconds, and the solution time by Ideal Gauss Sieve was 177 seconds, whereas in the algorithm of the present embodiment (FIG. 6), it was 122 seconds. Further, in the n = 80 dimension, the solution time by Gauss Sieve was 904,860 seconds, and the solution time by Ideal Gauss Sieve was 98581 seconds, whereas the algorithm of the present embodiment (FIG. 6) was 87473 seconds.
As a result, the security evaluation device 1 can perform a stricter security evaluation on the next-generation public key cryptography, and can contribute to an appropriate design such as a dimension.

The safety evaluation device 1 may compare the number of rotations required for vector initialization with the number of reverse rotations, and initialize the vector v by a small number of operations.
As a result, the safety evaluation device 1 can execute the SVP solution algorithm according to a more appropriate procedure and speed up the processing.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely a list of the most preferable effects arising from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

The safety evaluation method by the safety evaluation device 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 Safety evaluation device 10 Control unit 11 Selection unit 12 Solving unit 13 Initialization unit 20 Storage unit

Claims (5)

For the dimension n of the ideal lattice in the lattice-based cryptography that is the object of security evaluation
m = p ^b (b ≧ 1) and n = p ^b-1 (p-1),
Or m = 2 ^a · p ^b (a ≧ 1, b ≧ 1) and n = 2 ^a-1 · p ^b-1 (p-1)
A selection unit that selects the odd prime number p that satisfies the condition and the subscript m of the cyclotomic polynomial,
A safety evaluation device including a solution unit that repeats vector generation and contraction a predetermined number of times by using vector rotation derived from the relationship of the number of terms t = p of the cyclotomic polynomial. For the dimension n of the ideal lattice in the lattice-based cryptography that is the object of security evaluation
m = p ^b · q ^c (b ≧ 1, c ≧ 1) and n = p ^b-1 (p-1) · q ^c-1 (q-1),
Or m = 2 ^a · p ^b · q ^c (a ≧ 1, b ≧ 1, c ≧ 1) and n = 2 ^a-1 · p ^b-1 (p-1) · q ^c-1 (q-1) )
A selection unit that selects two odd prime numbers p and q that satisfy the conditions, and a subscript m of a cyclotomic polynomial,
Using an integer k for the number of terms t of the cyclotomic polynomial,
t = 2k (p-1) +1 and q = pk + 1,
t = 2k (p-1) + 2p-3 and q = p (k + 1) -1,
^{t = (1/2) k (p} 2 -1) + p and q = pk + 2,
t = (1/2) (k + 1) (p 2 -1) -p and q = p (k + 1) -2
A safety evaluation device including a solution unit that repeats vector generation and contraction a predetermined number of times using vector rotation derived from any of the above relationships. For the dimension n of the ideal lattice in the lattice-based cryptography that is the object of security evaluation
m = p ^b (b ≧ 1) and n = p ^b-1 (p-1),
Or m = 2 ^a · p ^b (a ≧ 1, b ≧ 1) and n = 2 ^a-1 · p ^b-1 (p-1)
A selection step to select the odd prime number p that satisfies the condition and the subscript m of the cyclotomic polynomial,
A safety evaluation method in which a computer executes a solution step in which vector generation and contraction are repeated a predetermined number of times using vector rotation derived from the relationship of the number of terms t = p of the cyclotomic polynomial. For the dimension n of the ideal lattice in the lattice-based cryptography that is the object of security evaluation
m = p ^b · q ^c (b ≧ 1, c ≧ 1) and n = p ^b-1 (p-1) · q ^c-1 (q-1),
Or m = 2 ^a · p ^b · q ^c (a ≧ 1, b ≧ 1, c ≧ 1) and n = 2 ^a-1 · p ^b-1 (p-1) · q ^c-1 (q-1) )
A selection step to select two odd prime numbers p and q that satisfy, and a cyclotomic polynomial subscript m,
Using an integer k for the number of terms t of the cyclotomic polynomial,
t = 2k (p-1) +1 and q = pk + 1,
t = 2k (p-1) + 2p-3 and q = p (k + 1) -1,
^{t = (1/2) k (p} 2 -1) + p and q = pk + 2,
t = (1/2) (k + 1) (p 2 -1) -p and q = p (k + 1) -2
A safety evaluation method in which a computer executes a solution step in which a predetermined number of vector generations and contractions are repeated using vector rotation derived from any of the above relationships. A safety evaluation program for operating a computer as the safety evaluation device according to claim 1 or 2.

Images