Hypercubic lattice reduction and analysis of GGH and NTRU signatures

  • Authors:
  • Michael Szydlo

  • Affiliations:
  • RSA Laboratories, Bedford, MA

  • Venue:
  • EUROCRYPT'03 Proceedings of the 22nd international conference on Theory and applications of cryptographic techniques
  • Year:
  • 2003

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper, we introduce a new lattice reduction technique applicable to the narrow, but important class of Hypercubic lattices, (L ≅ ZN). Hypercubic lattices arise during transcript analysis of certain GGH, and NTRUSign signature schemes. After a few thousand signatures, key recovery amounts to discovering a hidden unitary matrix U, from its Gram matrix G = UUT. This case of the Gram Matrix Factorization Problem is equivalent to finding the shortest vectors in the hypercubic lattice, LG, defined by the quadratic form G. Our main result is a polynomial-time reduction to a conjecturally easier problem: the Lattice Distinguishing Problem. Additionally, we propose a heuristic solution to this distinguishing problem with a distributed computation of many "relatively short" vectors.