Calculation device, calculation method, and calculation program

Abstract

To provide a computational device, computational method, and computational program that enable Gram root decomposition over a polynomial ring. [Solution] The arithmetic unit 1 includes an input unit 11 that accepts an n-th order covariance matrix as input, which is obtained by subtracting the Gram matrix coefficients of m polynomials from a diagonal matrix whose diagonal elements are constant; a first processing unit 12 that calculates four binomials to sequentially cancel out each value in the off-diagonal part of the covariance matrix by the sum of new Gram matrix coefficients; a second processing unit 13 that calculates at least four monomials to cancel out the values ​​in the diagonal part of the covariance matrix obtained by subtracting the new Gram matrix coefficients from the binomials calculated by the first processing unit; and an output unit 14 that outputs the set of binomials calculated by the first processing unit 12 and monomials calculated by the second processing unit 13 as the solution to Gram root decomposition.

Description

[Technical Field]

[0001] The present invention relates to an apparatus, method, and program for realizing the operations necessary for implementing lattice cryptography. [Background technology]

[0002] Lattice cryptography based on the LWE problem (see, for example, Non-Patent Document 1) and the Ring-LWE problem (see, for example, Non-Patent Document 2), and high-performance cryptography therein, requires algorithms for analyzing and generating variables that follow a discrete Gaussian distribution.

[0003] Here, each variable follows an independent standard normal distribution, which is a multidimensional normal distribution.

number

[0004] In contrast, in lattice-based cryptography, particularly LWE-based cryptography, the integer covariance matrix Σ∈Z n×n Given a Gram root T∈Z of that integer, n×m This requires integer Gram root decomposition to find (m>n), and an algorithm for this is proposed in Non-Patent Document 3, for example. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] O. Regev. "On Lattices, Learning with Errors, Random Linear Codes, and Cryptography". J. ACM 56.6 (2009). Preliminary version appeared in STOC '05. [Non-Patent Document 2] V. Lyubashevsky, C. Peikert, and O. Regev. "On Ideal Lattices and Learning with Errors over Rings". EUROCRYPT 2010. 2010, pp. 1-23. [Non-Patent Document 3] L. Ducas, S. Galbraith, T. Prest, and Y. Yu. "Integral Matrix Gram Root and Lattice Gaussian Sampling without Floats". EUROCRYPT 2020. 2020, pp. 608-637. [Non-Patent Document 4] MO Rabin and JO Shallit. "Randomized algorithms in number theory". Communications on Pure and Applied Mathematics 39.S1 (1986), S239-S256. [Non-Patent Document 5] RA Horn and CR Johnson. Matrix Analysis. Cambridge University Press, 1985. [Overview of the project] [Problems that the invention aims to solve]

[0006] However, high-performance cryptography based on Ring-LWE requires Gram root decomposition over polynomial rings, which has even stronger algebraic structure requirements than the aforementioned integer Gram root decomposition. Due to the strong restriction of the polynomial ring, the conventional algorithms could not be simply applied to the operation of Gram factorization.

[0007] An object of the present invention is to provide an arithmetic device, an arithmetic method, and an arithmetic program that enable Gram factorization on a polynomial ring.

Means for Solving the Problems

[0008] The arithmetic device according to the present invention includes an input unit that receives, as an input, an nth-order covariance matrix obtained by subtracting a coefficient Gram matrix of m polynomials from a diagonal matrix having constant diagonal elements, a first processing unit that calculates, for each value existing in the off-diagonal part of the covariance matrix, four binomials for canceling them in order with the sum of new coefficient Gram matrices, a second processing unit that calculates at least four monomials for canceling the value of the diagonal part of the covariance matrix subtracted by the new coefficient Gram matrix for the binomials calculated by the first processing unit, and an output unit that outputs a set of the binomials calculated by the first processing unit and the monomials calculated by the second processing unit as a solution of Gram factorization.

[0009] Each of the m polynomials has a norm of B or less, and the constant value is mnB 2 and the second processing unit may calculate the value of the diagonal part with one or more monomials having a coefficient of √(2m)·B and the four monomials for canceling the remainder by 2mB 2 of the value of the diagonal part.

[0010] The calculation method according to the present invention involves a computer receiving an n-th order covariance matrix as input, obtained by subtracting the Gram matrix coefficients of m polynomials from a diagonal matrix with constant diagonal elements, in an input unit; a first processing unit calculating four binomials to sequentially cancel out each value in the off-diagonal portion of the covariance matrix by the sum of new Gram matrix coefficients; a second processing unit calculating at least four monomials to cancel out the values ​​in the diagonal portion of the covariance matrix obtained by subtracting the new Gram matrix coefficients from the binomials calculated by the first processing unit; and an output unit outputting the set of binomials calculated by the first processing unit and monomials calculated by the second processing unit as the solution to Gram root decomposition.

[0011] The calculation program according to the present invention is for causing a computer to function as the calculation device. [Effects of the Invention]

[0012] According to the present invention, Gram root decomposition on a polynomial ring becomes possible. [Brief explanation of the drawing]

[0013] [Figure 1] This figure shows the functional configuration of the computing device in the embodiment. [Figure 2A] This is the first figure showing the algorithm of the arithmetic program in the embodiment. [Figure 2B] This is a second figure showing the algorithm of the arithmetic program in the embodiment. [Modes for carrying out the invention]

[0014] An example of an embodiment of the present invention will be described below. The arithmetic unit of this embodiment is an information processing device that performs Gram root decomposition operations for implementing an encryption scheme. For example, since a lattice cryptography based on Ring-LWE is constructed on a polynomial ring, the arithmetic unit performs Gram root decomposition on the polynomial ring. First, polynomial rings and their elements are defined as follows:

[0015] [Definition 1 (polynomial ring)] • Polynomials with integer coefficients (of arbitrary dimensions):

number

number

[0016] [Definition 2] Elements of the polynomial ring R

number

number

number

number

number

[0017] [Definition 3 (Norm on R)]

number

number

[0018] [Lemma 4 (Product over a polynomial ring)] any

number

number

number

[0019] Next, we will discuss Gram root decomposition over polynomial rings. The product over a polynomial ring can be expressed as a linear transformation using the coefficient matrix. That is,

number

number

number

number

number

number

number

[0020] Conversely, given Σ,

number

Number

Number

[0021] Also, in key generation and the like in the cryptographic method based on Ring-LWE, in addition to Gram root decomposition over the polynomial ring, for the solution polynomial r i the length ∥r i ∥ (Definition 3), or there may be cases where further conditions are to be set for the singular values of R i . Therefore, the arithmetic unit of the present embodiment executes Gram root decomposition over the polynomial ring and outputs a set of polynomials as a solution applicable also to cryptographic methods and the like based on Ring-LWE.

[0022] Here, the theorem and lemma that are the basis for the validity of the arithmetic method in the present embodiment, and their proofs, are shown.

[0023] [Theorem 5 (Rabin-Shallit (RS) algorithm)] (See Non-Patent Document 4) For any N∈natural numbers, a 2 +b 2 +c 2 [ +d 2 =N, there exists a probabilistic algorithm with an average computational complexity of O(log 2 N log log N) for finding a, b, c, d∈natural numbers that satisfy this equation]].

[0024] [[ID=​​​​​ In contrast,

number

[0025] [Lemma 7]

number

number

[0026] [Lemma 8 (Basic properties of Gram(e))]

number

number

number

[0027] (Proof) Definition 2,

number

number

number

number

number

[0028] [Lemma 9 (Upper bound of |σ i |)]

Number

Number

[0029] (Proof) From the Cauchy-Schwarz inequality,

Number

[0030] [Lemma 10 (Positive definiteness of the Gram matrix)] For each e1, …, e m ∈R, assume that ∥e i ∥ < B holds,

Number

Number

[0031] (Proof) From Lemma 9, the absolute value of each element of Σ ei is at most B 2 . Therefore,

Number

[0032] [Lemma 11] (See Non-Patent Document 5)

Number

number

[0033] [Lemma 12 (Properties of Gram(e) of Binomials / Monomials)] e∈R is a binomial

number

number

number

number

number

number

[0034] [Lemma 13 (Inverse of the coefficient matrix)]

number

number

number

number

[0035] (Proof)

number

number

number

[0036] [Lemma 14 (bounds concerning inverse matrices)]

number

number

number

number

number

[0037] (Proof) Without loss of generality, z = c + cX k Let's assume that z = c - cX kThe proof concerning this can be obtained similarly. From Lemma 13 and Lemma 4, the following holds:

number

number

number

number

number

[0038] In this embodiment, the arithmetic unit 1 is configured based on the theorems and lemmas described above. Figure 1 is a diagram showing the functional configuration of the arithmetic unit 1 in this embodiment. The arithmetic unit 1 is an information processing device (computer) equipped with a control unit 10 and a storage unit 20, as well as various input / output interfaces.

[0039] The control unit 10 is the part that controls the entire arithmetic unit 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the memory unit 20. The control unit 10 may be a CPU.

[0040] The storage unit 20 is a storage area for various programs and data that enable the hardware group to function as the arithmetic unit 1, and may be ROM, RAM, flash memory, or a hard disk drive (HDD).

[0041] The control unit 10 comprises an input unit 11, a first processing unit 12, a second processing unit 13, and an output unit 14. These functional units perform Gram root decomposition on a polynomial ring on the input covariance matrix and output a set of polynomials that are the solution.

[0042] The input unit 11 accepts an n-th order covariance matrix as input, which is obtained by subtracting the Gram matrix of the coefficients of m polynomials from a diagonal matrix whose diagonal elements are constant.

[0043] The first processing unit 12 calculates four binomials to sequentially cancel out each value in the off-diagonal portion of the covariance matrix by the sum of a new coefficient Gram matrix.

[0044] The second processing unit 13 calculates at least four monomials to cancel out the values ​​of the diagonal portion of the covariance matrix obtained by subtracting the new coefficient Gram matrix for the binomial calculated by the first processing unit 12.

[0045] Here, the m polynomials as input each have a norm of a predetermined value (B pk ) or less, and all diagonal elements are mnB 2 The covariance matrix obtained by subtracting the sum of the polynomial coefficients (Gram matrices) from the diagonal matrix is ​​a positive definite matrix. At this time, the second processing unit 13 determines the value of the diagonal part of the covariance matrix as one or more monomials whose coefficient is √(2m)·B and the value of the diagonal part as 2mB 2 We calculate four monomials to cancel out the remainder.

[0046] The output unit 14 outputs the set of binomials calculated by the first processing unit 12 and the set of monomials calculated by the second processing unit 13 as the solution to the Gram radical decomposition over the polynomial ring.

[0047] Figures 2A and 2B show the algorithm of the arithmetic program executed by the arithmetic unit 1 in this embodiment. This algorithm involves m polynomials e that constitute the covariance matrix Σ. iThe input is a Gram radical decomposition of a polynomial ring, resulting in l polynomials ζ i This outputs the following: Here, the covariance matrix Σ is given by Lemma 10,

number

[0048] In step 1, the arithmetic unit 1 outputs ζ1, ..., ζ l Initialize the list S to store the data. In steps 2-10, the arithmetic unit 1 finds a set of polynomials that can cancel out non-zero values ​​in the off-diagonal portion of the covariance matrix Σ by subtracting the corresponding coefficient Gram matrix. Here, the values ​​of the off-diagonal parts are

number

number

number

[0049] Specifically, in steps 3 to 9, the first processing unit 12 performs a loop to sequentially find polynomials that cancel out (n / 2-1) types of values ​​in the off-diagonal part of the covariance matrix Σ (the diagonal column from the top left to the bottom right, and the same value in symmetrical positions). In step 4, the first processing unit 12 uses the Rabin-Shallit algorithm (theorem 5) to cancel out the value σ by calculating the coefficients (natural numbers) of the four binomials c1~c4(c1 2 +c2 2 +c3 2 c42 Determine the value of σ. In steps 5-8, the first processing unit 12 uses each of the four determined coefficients to form a binomial z (j) This is stored in list S as part of the solution.

[0050] The norm of the resulting binomial is,

number

number

number

number

[0051] In step 10, the first processing unit 12 calculates the value γ that remains on the diagonal when the coefficient Gram matrix corresponding to the obtained binomial is subtracted from the covariance matrix Σ. At this point, from Lemma 9,

number

[0052] In steps 11 to 22, the arithmetic unit 1 finds a set of polynomials from which the γ remaining in the diagonal part of the covariance matrix Σ can be canceled out by subtracting the corresponding coefficient Gram matrix. Here, by subtracting the Gram matrix of coefficients corresponding to the set of polynomials obtained by the first processing unit 12 from the covariance matrix Σ,

number

[0053] Specifically, the value of β is in mB pk 2 Therefore (step 11), in steps 12 to 16, the second processing unit 13 prepares l' monomials z whose norms are equal to the upper bound and stores them in list S as part of the solution. These monomials z are

number

number

[0054] Next, the second processing unit 13, using the same method as the first processing unit 12, finds four binomials to cancel out the fractional part δ that could not be canceled out in steps 17-22, using the Rabin-Shallit algorithm (Theorem 5), and stores them in list S as part of the solution. The norm of the resulting binomial is,

number

[0055] In step 23, the output unit 14 outputs the list S obtained up to this point as the solution to the Gram root decomposition. The number of solutions l is,

number

[0056] According to this embodiment, the arithmetic unit 1 performs Gram root decomposition on a polynomial ring by a two-step process: first, decomposing the off-diagonal portion of a positive definite covariance matrix Σ, which is composed of Gram matrices of coefficients of multiple polynomials, using the characteristics of the arrangement of its values, and then decomposing the remaining diagonal portion.

[0057] Furthermore, the arithmetic unit 1 was able to ensure that the norm of each of the output solution polynomials was short, below the upper bound, and also to guarantee a lower bound on the smallest singular value of the coefficient matrix.

[0058] Furthermore, the aforementioned embodiment makes it possible to construct an efficient cryptographic scheme based on Ring-LWE in, for example, secure computing services, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0059] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0060] The calculation method performed by the arithmetic unit 1 is implemented by software. When implemented by software, the programs constituting this software are installed on the information processing device (computer). These programs may be distributed to users by being recorded on removable media such as a CD-ROM, or by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0061] 1 Computing device 10 Control Unit 11 Input section 12 First Processing Unit 13. Second Processing Unit 14 Output section 20 Memory section

Claims

1. An input unit that accepts an n-th order covariance matrix as input, which is obtained by subtracting the Gram matrix of the coefficients of m polynomials from a diagonal matrix whose diagonal elements are constant, A first processing unit calculates four binomials to sequentially cancel out each value in the off-diagonal portion of the aforementioned covariance matrix by the sum of new coefficient Gram matrices, A second processing unit calculates at least four monomials to cancel out the values ​​of the diagonal portion of the covariance matrix obtained by subtracting the new coefficient Gram matrix from the binomial calculated by the first processing unit, An arithmetic device comprising: an output unit that outputs a set of binomials calculated by the first processing unit and a set of monomials calculated by the second processing unit as a solution to Gram root decomposition.

2. Each of the aforementioned m polynomials has a norm less than or equal to B, The aforementioned constant value is mnB ２ And, The second processing unit calculates the value of the diagonal portion as one or more monomials with coefficients of √(2m)·B and the value of the diagonal portion as 2mB ２ The arithmetic device according to claim 1, which calculates the four monomials for canceling out the remainder due to

3. Computers The input unit accepts an n-th order covariance matrix as input, which is obtained by subtracting the Gram matrix of the coefficients of m polynomials from a diagonal matrix whose diagonal elements are constant. The first processing unit calculates four binomials to sequentially cancel out each value in the off-diagonal portion of the covariance matrix by the sum of a new coefficient Gram matrix. The second processing unit calculates at least four monomials to cancel out the values ​​in the diagonal portion of the covariance matrix obtained by subtracting the new coefficient Gram matrix from the binomial calculated by the first processing unit, A calculation method in which the output unit outputs a set of binomials calculated by the first processing unit and a set of monomials calculated by the second processing unit as the solution to a Gram root decomposition.

4. A calculation program for causing a computer to function as the calculation device described in claim 1 or claim 2.

Images