"Lecture 14 – Short Integer Solutions, lattice" is the property of its rightful owner. Permission is granted to
download and print the materials on this website for personal, non-commercial use only, and to display it
on your personal computer provided you do not modify the materials and that you retain all copyright
notices contained in the materials. By downloading content from our website, you accept the terms of this
agreement.
Recap: linear algebra basics Matrix-vector multiplication 3<br>
04
Recap: Learning With Errors (LWE) 4 random in random in random in<br>
05
Recap: LWE-KEM Correctness: public 5<br>
06
Recap: computational aspects 6<br>
07
Recap: computational aspects 7<br>
08
Recap: computational aspects 8<br>
09
Making LWE more efficient – Ring-LWE only one LWE sample! 9 The dream: Solution: polynomials<br>
10
Plain-LWE vs. Module-LWE vs. Ring-LWE Each row is the cyclic shift of the row above; lots of structure 10 Completely random matrix;
no structure Plain-LWE Ring-LWE<br>
11
Plain-LWE vs. Module-LWE vs. Ring-LWE Plain-LWE Ring-LWE Module-LWE 11 "Hybrid" between plain LWE and Ring-LWE Each row is the cyclic shift of the row above; lots of structure Completely random matrix;
no structure Can extra structure be exploited? Ring-LWE assumption: no More structure than plain-LWE, less structure than Ring-LWE Can extra structure be exploited? Module-LWE assumption: no<br>
12
ML-KEM (Kyber) 12<br>
13
Signatures from lattices<br>
14
Linear algebra basics Matrix-matrix multiplication 14<br>
15
Short Integer Solutions (SIS) problem 15 Theorem: The SIS and ISIS problems are computationally equivalent<br>
ML-DSA (Dilithium) Standardized Lattice-based signature scheme
Selected as the winner of NIST-led competition that began in in 2017
Based on Module-LWE/SIS
Many optimizations over the previous signature scheme
Closer to Ring-LWE than Plain-LWE
Number Theoretic Transform (NTT) for faster (polynomial) multiplication
Compresses signing key, verification key, and signature 31<br>
32
End of Part II
(Asymmetric crypto)<br>
33
Summary of asymmetric cryptography 33<br>
34
Summary of asymmetric cryptography 34<br>
35
Summary of asymmetric cryptography 35<br>
36
Next week Guest lecture by Hagen Echzell
Topic: end-to-end encryption in group messaging protocols
Course recap
Mini-lecture summarizing the main topics covered this year
