Design device, design method, and design program

Abstract

To provide a design device, a design method and a design program with which it is possible to design the LWR encryption type of parameters on the basis of a more feasible assumption than conventional assumptions.SOLUTION: A design device 1 comprises: an input unit 11 for accepting a first parameter regarding the difficulty of an LWE problem; a calculation unit 12 for calculating a second parameter regarding the difficulty of an LWR problem that corresponds to the first parameter, using a relational expression between a parameter in the LWE problem and a parameter in the LWR problem, for maximizing a similarity between the distribution of uniform random numbers equivalent to noise when the LWR problem is deformed into the LWE problem and the normal distribution of noise in the LWE problem; and an output unit 13 for outputting the second parameter.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a parameter design method for a Learning with Rounding (LWR) type encryption method. [Background technology]

[0002] Conventionally, various cryptographic methods have been proposed to realize security functions such as encryption, authentication, key sharing, etc. Furthermore, many of these cryptographic methods utilize the computational difficulty of solving problems, and parameters are set to ensure appropriate security according to the application.

[0003] For example, in relation to the design of next-generation public key cryptography that is resistant to quantum computers, Non-Patent Document 1 proposes a method for evaluating the security of an LWR-type cryptography, that is, a method for evaluating the difficulty of the LWR problem. In addition, in Non-Patent Documents 2 and 3, cryptographic methods based on the LWR problem are constructed using the evaluation method of Non-Patent Document 1. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Martin R. Albrecht, Benjamin R. Curtis, Amit Deo, Alex Davidson, Rachel Player, Eamonn W. Postlethwaite, Fernando Virdia, and Thomas Wunderer. Estimate all the {LWE, NTRU} schemes! In SCN 2018, pp. 351-367, 2018. [Non-Patent Document 2] Hiroki Okada, Atsushi Takayasu, Kazuhide Fukushima, Shinsaku Kiyomoto, and Tsuyoshi Takagi. A compact digital signature scheme based on the Module-LWR problem. In ICICS, pp. 73-90, 2020. [Non-Patent Document 3] Jan-Pieter D'Anvers, Angshuman Karmakar, Sujoy Sinha Roy, and Frederik Vercauteren. Saber: Module-LWR based key exchange, CPA-secure encryption and CCA-secure KEM. In AFRICACRYPT 2018, pp. 282-305, 2018. [Non-Patent Document 4] Joel Alwen, Stephan Krenn, Krzysztof Pietrzak, and Daniel Wichs. Learning with rounding, revisited. In CRYPTO 2013, pp. 57-74, 2013. Summary of the Invention [Problem to be solved by the invention]

[0005] The evaluation method in Non-Patent Document 1 was based on the hypothesis that the difficulty of the LWR problem is equivalent to that of a Learning with Errors (LWE) problem with the same noise variance. A proof of the difficulty of the strict LWR problem is given in, for example, Non-Patent Document 4, but if parameter design is performed based on this proof, the values ​​become too large and the efficiency of the encryption cannot be maintained. Therefore, in the configuration of encryption methods such as Non-Patent Documents 2 and 3 based on the LWR problem, the evaluation method in Non-Patent Document 1 has generally been used.

[0006] An object of the present invention is to provide a design device, a design method, and a design program that are capable of designing parameters for an LWR encryption scheme based on a more plausible hypothesis that differs from conventional hypotheses. [Means for solving the problem]

[0007] The design device according to the present invention includes an input unit that accepts a first parameter related to the difficulty of an LWE problem, a calculation unit that calculates a second parameter related to the difficulty of an LWR problem corresponding to the first parameter using a relational equation between parameters in the LWE problem and parameters in the LWR problem in order to maximize the similarity between a distribution of uniform random numbers equivalent to noise when an LWR problem is transformed into an LWE problem and a normal distribution of noise in the LWE problem, and an output unit that outputs the second parameter.

[0008] The relational expression may define a modulus p in an LWR problem with respect to a modulus q and a standard deviation σ in an LWE problem.

[0009] The relational expression may minimize a statistical distance between the distribution of the uniform random numbers and the normal distribution.

[0010] The relational expression may be one that minimizes the Renyi divergence between the distribution of the uniform random numbers and the normal distribution.

[0011] The above relationship may be defined with the order of the Renyi divergence being ∞.

[0012] The design method according to the present invention includes an input step of accepting a first parameter related to the difficulty of an LWE problem, a calculation step of calculating a second parameter related to the difficulty of an LWR problem corresponding to the first parameter using a relational equation between parameters in the LWE problem and parameters in the LWR problem in order to maximize the similarity between a distribution of uniform random numbers equivalent to noise when the LWR problem is transformed into an LWE problem and a normal distribution of noise in the LWE problem, and an output step of outputting the second parameter, which are executed by a computer.

[0013] A design program according to the present invention causes a computer to function as the design device. Effect of the Invention

[0014] According to the present invention, parameters of an LWR encryption scheme can be designed based on a more plausible hypothesis that differs from conventional hypotheses. [Brief description of the drawings]

[0015] [Figure 1] FIG. 2 is a diagram illustrating a functional configuration of a design apparatus according to the first embodiment. [Diagram 2] 4 is a graph showing a probability density function of a normal distribution and a probability density function of a uniform distribution in the first embodiment. [Diagram 3] 13 is a graph showing a probability density function of a normal distribution and a probability density function of a uniform distribution in the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] [First embodiment] A first embodiment of the present invention will now be described. FIG. 1 is a diagram showing the functional configuration of a design apparatus 1 according to this embodiment. The design apparatus 1 is an information processing apparatus (computer) such as a server apparatus or a personal computer, and includes a control unit 10, a storage unit 20, and various input / output devices.

[0017] The control unit 10 is a part that controls the entire design apparatus 1, and realizes the functions of this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0018] The storage unit 20 is a storage area for various software including a design program for causing the hardware group to function as the design apparatus 1, various data, and the like, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like. In this embodiment, in addition to the design program, the storage unit 20 stores a relational expression for mutual conversion between parameters in an LWE problem and parameters in an LWR problem.

[0019] The control unit 10 includes an input unit 11, a calculation unit 12, and an output unit 13, and uses a relational equation stored in a memory unit 20 to derive parameters for an LWR problem having the same difficulty as the input LWE problem.

[0020] The input unit 11 accepts an input of a first parameter related to the difficulty of the LWE problem. The first parameter is the modulus q and the variance σ of the normal distribution. 2 (or standard deviation σ).

[0021] The calculation unit 12 calculates a second parameter related to the difficulty of the LWR problem corresponding to the first parameter in the LWE problem input to the input unit 11, using a relational expression between the parameters in the LWE problem and the parameters in the LWR problem. The output unit 13 outputs the second parameter calculated by the calculation unit 12.

[0022] Here, in the relationship between the first parameter and the second parameter, the modulus p in the LWR problem is determined relative to the modulus q and standard deviation σ in the LWE problem so as to maximize the similarity between the distribution of uniform random numbers corresponding to noise when the LWR problem is transformed into the LWE problem and the normal distribution of noise in the LWE problem.

[0023] First, the LWE problem and the LWR problem are defined as follows. LWE problem:LWE n,q,σ is a secret vector chosen uniformly at random, where q is an integer.

number

number

number

[0024] LWR problem:LWR n,q,p Let q and p be integers, and a secret value chosen uniformly at random is

number

number

[0025] The rounding error of the LWR sample is

number

number

[0026] The difficulty of the LWE problem depends on the modulus q, the dimension n, and the distribution of the noise, i.e., the variance σ 2 On the other hand, the difficulty of the LWR problem can be estimated by transforming it into LWE as mentioned above. In the conventional method (Non-Patent Document 1), Variance of uniform random number (q / p)ξ=σ 2 …(1) When LWE n,q,σ and LWR n,q,p The estimates are based on the assumption that the difficulties involved are equal.

[0027] The variance of a uniform random number (q / p)ξ is (q / p) 2 / 12, so

number

[0028] In this embodiment, unlike the hypothesis (1), (distribution of (q / p)ξ) and (N(0,σ 2 ) distribution) the statistical distance is the smallest … (2) When the condition based on the similarity of the probability distribution as a whole is satisfied, LWE n,q,σ and LWR n,q,p We use the more plausible assumption that the difficulties of In addition, R n The statistical distance between the above probability density functions φ1 and φ2 is defined as follows:

number

[0029] In this case, the relationship between the parameters of the LWE problem and the parameters of the LWR problem to minimize the statistical distance between the distribution of uniform random numbers and the normal distribution is γ>π / 2, and

number

number

[0030] The procedure for deriving this relational expression is shown below. Mean 0, variance σ 2 Normal distribution of N(0,σ 2 ) is the probability density function:

number

[0031] The probability density function of the uniform distribution U(-β,β) on the interval [-β,β) is

number

[0032] FIG. 2 shows the normal distribution N(0, σ 2 ) and the probability density function of the uniform distribution U(-β,β).

[0033] For convenience,

number

number

number

number

[0034] Also, the probability density function p N and the probability density function p of the uniform distribution U Regarding the intersection point on the graph with

number

[0035] The statistical distance between distributions as a function of γ is

number

number

[0036] Differentiating f(γ), we get

number

number

number

[0037] According to the above-described embodiment, the design apparatus 1 converts parameters in the LWE problem into parameters in the LWR problem by using a relational expression that maximizes the similarity between the distribution of uniform random numbers corresponding to noise when the LWR problem is transformed into the LWE problem and the normal distribution of noise in the LWE problem. Therefore, whereas conventional techniques focus only on partial information, such as the variance of noise, the design device 1 enables parameter design of an LWR cryptography scheme based on a more plausible hypothesis using an evaluation method based on the similarity of the entire probability distribution.

[0038] The design device 1 determines the modulus p in the LWR problem as a relational expression for the modulus q and standard deviation σ in the LWE problem, and therefore can easily design an LWR cryptosystem that has the same computational difficulty as an LWE cryptosystem.

[0039] As a hypothesis regarding the similarity of probability distributions as a whole, the design device 1 considers that when the statistical distance between the distribution of uniform random numbers and the normal distribution is minimized, the similarity of the distributions is maximized, i.e., the computational difficulty of the LWE problem and the LWR problem is equivalent. This enables the design device 1 to theoretically derive parameters with higher reliability than ever before, and to appropriately design an LWR cryptosystem.

[0040] In addition, the conventional hypothesis is that LWR q,p is the standard deviation of the noise

number

number

[0041] [Second embodiment] A second embodiment of the present invention will now be described. In this embodiment, the functional configuration of the design device 1 is common to the first embodiment, but the relational expressions of the parameters stored in the storage unit 20 are different.

[0042] However, as in the first embodiment, in the relational expression between the first parameter and the second parameter, the modulus p in the LWR problem is determined with respect to the modulus q and standard deviation σ in the LWE problem so as to maximize the similarity between the distribution of uniform random numbers corresponding to noise when the LWR problem is transformed into an LWE problem and the normal distribution of noise in the LWE problem.

[0043] In this embodiment, unlike the hypothesis (1), (distribution of (q / p)ξ) and (N(0,σ 2 ) the ∞-Renyi divergence of the distribution of ...(3) When the condition based on the similarity of the probability distribution as a whole is satisfied, LWE n,q,σ and LWR n,q,p We use the more plausible assumption that the difficulties of

[0044] Note that the Renyi divergence of order a∈(1,+∞) between any two probability density functions P and Q such that Supp(P)⊆Supp(Q) is defined as follows:

number

[0045] where the Renyi divergence of order 1 and +∞ is

number

[0046] In this case, the relationship between the parameters of the LWE problem and the LWR problem to minimize the ∞-Renyi divergence between the uniform random distribution and the normal distribution is

number

[0047] The procedure for deriving this relational expression is shown below. Mean 0, variance σ 2 Normal distribution of N(0,σ 2 ) is the probability density function:

number

[0048] Uniform distribution U on the interval [-β,β) β The probability density function of is:

number

[0049] FIG. 3 shows the normal distribution N(0, σ 2 ) probability density function and the uniform distribution U β 4 is a graph showing a probability density function of

[0050] Here, for convenience,

number

number

[0051] The ∞-Renyi divergence between distributions as a function of γ

number

number

number

[0052] Differentiating f(γ), we get

number

number

[0053] According to the above-described embodiment, the design device 1 considers that when the Renyi divergence between the distribution of uniform random numbers and the normal distribution is minimized as a hypothesis regarding the similarity of the probability distributions as a whole, the similarity of the distributions is maximized, that is, the computational difficulty of the LWE problem and the LWR problem is equivalent. This enables the design device 1 to theoretically derive parameters with higher reliability than ever before, and to appropriately design an LWR cryptosystem.

[0054] Furthermore, the design apparatus 1 can simplify the calculations and reduce the processing load of the parameter design by defining the relational expressions with the order of the Renyi divergence set to ∞.

[0055] In addition, the conventional hypothesis is that LWR q,p is the standard deviation of the noise

number

number

[0056] In addition, the above-mentioned embodiment makes it possible to easily design a secure encryption method, which can contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0057] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0058] In the above embodiment, the parameters of the LWR cryptosystem are designed from the parameters of the LWE cryptosystem. However, since the parameters can be converted into each other using a relational expression, it is also possible to design parameters of an LWE cryptosystem with equivalent security from parameters of the LWR cryptosystem.

[0059] The design method by the design apparatus 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing apparatus (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0060] 1 Design equipment 10 Control section 11 Input section 12 Calculation section 13 Output section 20 Memory section

Claims

1. An input unit for receiving a first parameter related to the difficulty of the LWE problem; a calculation unit that calculates a second parameter related to the difficulty of the LWR problem corresponding to the first parameter by using a relational expression between parameters in the LWE problem and parameters in the LWR problem in order to maximize an overall similarity between a distribution of uniform random numbers corresponding to noise when the LWR problem is transformed into an LWE problem and a normal distribution of noise in the LWE problem; an output unit that outputs the second parameter, The above-mentioned relational expression is derived when minimizing the statistical distance between the distribution of the uniform random numbers and the normal distribution in order to determine the modulus p in the LWR problem with respect to the modulus q and standard deviation σ in the LWE problem. [0010] (where γ* satisfies γ>π / 2, and [0025] A design device in which a value satisfying the above is used.

2. An input unit for receiving a first parameter related to the difficulty of the LWE problem; a calculation unit that calculates a second parameter related to the difficulty of the LWR problem corresponding to the first parameter by using a relational expression between parameters in the LWE problem and parameters in the LWR problem in order to maximize an overall similarity between a distribution of uniform random numbers corresponding to noise when the LWR problem is transformed into an LWE problem and a normal distribution of noise in the LWE problem; an output unit that outputs the second parameter, A design device, wherein the relational expression minimizes the Renyi divergence between the distribution of the uniform random numbers and the normal distribution.

3. 3. The design device according to claim 2, wherein the relational expression uses p=q / 2σ derived when the order of Renyi divergence is set to ∞ in order to determine the modulus p in the LWR problem with respect to the modulus q and standard deviation σ in the LWE problem.

4. The computer The input unit accepts a first parameter related to the difficulty of the LWE problem; a calculation unit calculates a second parameter related to the difficulty of the LWR problem corresponding to the first parameter by using a relational expression between parameters in the LWE problem and parameters in the LWR problem, the second parameter being used to maximize an overall similarity between a distribution of uniform random numbers corresponding to noise when the LWR problem is transformed into an LWE problem and a normal distribution of noise in the LWE problem; An output unit outputs the second parameter; A design method in which the relational expression minimizes the Renyi divergence between the distribution of the uniform random numbers and the normal distribution.

5. A design program for causing a computer to function as the design device according to any one of claims 1 to 3.

Images