Application of automorphic forms to lattice problems
-
Samed Düzlü
und
Juliane Krämer
Abstract
In this article, we propose a new approach to the study of lattice problems used in cryptography. We specifically focus on module lattices of a fixed rank over some number field. An essential question is the hardness of certain computational problems on such module lattices, as the additional structure may allow exploitation. The fundamental insight is the fact that the collection of those lattices are quotients of algebraic manifolds by arithmetic subgroups. Functions in these spaces are studied in mathematics as part of the number theory. In particular, those form a module over the Hecke algebra associated with the general linear group. We use results on these function spaces to define a class of distributions on the space of lattices. Using the Hecke algebra, we define Hecke operators associated with collections of prime ideals of the number field and show a criterion on distributions to converge to the uniform distribution, if the Hecke operators are applied to the chosen distribution. Our approach is motivated by the work of de Boer, Ducas, Pellet-Mary, and Wesolowski (CRYPTO’20) on self-reduction of ideal lattices via Arakelov divisors.
1 Introduction
In recent years, lattice-based cryptography is viewed as one of the most promising candidates for cryptographic schemes that are assumed to be secure against attacks by quantum computers. Lattice-based cryptography is built on hardness assumptions of lattice problems. The learning with errors (LWE) problem is the most prominent problem that is used directly to build cryptographic protocols. The well-studied shortest vector problem (SVP) is often used to relate the hardness of LWE to a lattice problem that is known to be hard. Indeed, SVP, the problem of finding nonzero vectors, which are shortest up to a constant, is NP hard [1,2]. For efficiency reasons, many schemes are based on structured lattices in the sense that the lattices admit the structure of a module over the ring of integers of specifically chosen number fields, e.g., refs [3,4,5, 6,7], and see ref. [8] for an unstructured version. The transition toward structured lattices appeared in two steps. First, the lattices have been chosen to be fractional ideals of a number field, viewed as lattice in a Euclidean space by means of the Minkowski embedding, so-called ideal lattices [9,10]. No efficient algorithms are known thus far that exploit this additional structure. Hence, it is assumed that schemes based on this construction are as secure as their unstructured counterparts [11,12]. See also refs [13,14,15] for potential weaknesses due to quantum computing. Despite the security assumptions for ideal lattices, in a second step, some schemes started to use higher rank versions of ideal lattices, i.e., module lattices [16]. These form a middle ground between ideal lattices and unstructured lattices as they are algebraically structured, but the structure is more complex than the structure of ideal lattices. Hence, cryptographic schemes based on module lattices are almost as efficient and at least as secure as the ideal lattice variants. As the use of structured lattices has become standard in lattice-based cryptography, their in-depth analysis is crucial.
This work is mainly motivated by ref. [17], which shows a worst-case to average-case reduction for ideal lattices. Below, we summarize their approach and describe how the steps are reproduced for module lattices of higher rank. Two major distinctions in our approach are that for higher rank module lattices, the notion of Arakelov divisors is replaced by adèles and Fourier analysis is substituted by the notion of automorphic forms.
Contribution. We show that for a fixed number field, the collection of module lattices of a fixed rank
Outline. In Section 1.1, we continue with a brief summary of the approach of ref. [17] to their worst-case to average-case reduction of ideal SVP. We introduce the motivation to our approach with a step-by-step analysis of the path we follow in Section 1.2. Specifically, we explain the ideas behind the choices we make. In Section 2, we introduce notations and the basic tools from algebraic number theory, which are used later. In particular, we introduce norms on number fields, completions, and the adèles of a number field. Section 3 establishes the connection between module lattices of a fixed rank and so-called adèlic points of
In Appendix A, we review the basic setup of ref. [17] from the viewpoint of adèles as taken in this work. After giving an adèlic description of the space of ideal lattices, we review their worst-case distribution in terms of Hecke characters. In Appendix B, we cover more details of representation theory that allows to construct certain cuspidal automorphic representations. We show how one can use these to construct a cuspidal distribution on lattices of rank 2 using the case of ideal lattices.
This article uses many results from algebraic number theory and representation theory. We recall many definitions and results that are necessary if they have not been used in the cryptographic literature, even if they are standard in the related fields of mathematics.
1.1 Summary of results for ideal lattices
We briefly recall the approach in ref. [17], which we follow in two main aspects with a shift of perspective. A transfer of their results to our framework is sketched in Appendix A.
Geometry of ideal lattices. Let
where
are lattices with norm 1, see Appendix A or [17] for a rigorous definition. This is the degree 0 subgroup of the Arakelov class group. By the fundamental fact that this space is a compact group, it admits a uniform distribution, which corresponds to choosing uniformly random ideal lattices.
Worst-case distribution. With the geometric perspective in hand, in ref. [17], a worst-case distribution is defined by means of the usual Gaussian distribution on
1.2 Summary of our framework
In this work, we attach a geometric structure to the set of module lattices of a fixed rank, which in rank 1 is equivalent to the approach in ref. [17]. Instead of the Arakelov theory, we use adèles, which are one of the basic constructions in algebraic number theory; see Remark 3.3.5 for a more detailed comparison. It turns out that the space of lattices of a fixed rank
where
The next step is to define a worst-case distribution as in our approach we want to mimic [17]. However, the goal of finding suitable worst-case distributions becomes nontrivial for two reasons. First, the space of module lattices for
Functions as distributions. We are looking for distributions in the space of functions on the space of lattices. From an abstract viewpoint, the space of distributions is strictly larger than the usual function spaces, e.g., Dirac’s
With this assumption, the functions we consider should satisfy certain properties. Namely, it should be square-integrable, smooth, symmetric, and decay quickly outside of a central point. This motivates the second assumption to look into the space of automorphic forms and more specifically, cusp forms.
Decomposition of automorphic forms and cusp forms. The space of
where
The space of cusp forms itself decomposes into a (Hilbert space) direct sum of cusp forms with the central character. Each of these terms again splits into irreducible components, which are the basic building blocks of the space of cusp forms, in the same manner as how characters are the basic functions in Fourier analysis. This is also a generalization of the classical theory of modular forms, which is the case of base field
Worst-case to average-case convergence. Keeping the previous ideas in mind, we define a class of cuspidal distributions in the space of automorphic forms. These contain the uniform distribution, and as described earlier, it can be seen as a source for worst-case distributions. For general cuspidal distributions, we give a criterion for the convergence to the uniform distribution. This is done in terms of the decomposition of cuspidal distributions into irreducible cusp forms plus a constant. As the cusp forms are eigenfunctions of Hecke operators, the condition is mainly a question of convergence of the coefficient series.
Lattices with
1.3 Related work
Since [16,20], module lattices are studied for their applications in cryptography. In ref. [16], a worst-case to average-case reduction was proven that reduced worst-case instances of module-LWE to average-case instances. This result opened the door for the application of module lattices to replace unstructured or ideal lattices. More recently, a different type of self-reduction of SVP on module lattices was shown in refs [21,22], where SVP of module lattices is reduced to module lattices of a smaller rank, where the rank of the latter divides the rank of the former. Both are generalizations of the LLL algorithm [23].
2 Preliminaries
Let
We will write
2.1 Norms on a number field
In this subsection, we briefly recall the notion of norms on a number field and state their characterization in terms of Ostrowski’s theorem. We exclude the trivial norm in the definition by requiring norms to be nonzero.
Definition 2.1.1
A norm on
We refer to ref. [24, II, Definition 3.2; Proposition 3.3] for a topological definition and their equivalence. There are two distinct classes of norms, which we will exemplify now.
Example 2.1.2
(Archimedean norms) Let
This differs from the usual norm on
Example 2.1.3
(Non-Archimedean norms) For any nonzero element
where for almost all
For any number
Extending this function to
of finite fields. Let
We want to note that the non-Archimedean norms are inherently different from the Archimedean norms, as they satisfy a strong triangle inequality.
Lemma 2.1.4
Let
for any
For a proof, we refer to ref. [24], although, this follows easily from the analogous statement for the valuation
Definition 2.1.5
A norm
Note that Archimedean is defined to be not non-Archimedean. A characterization can be given in terms of the norm restricted to
Theorem 2.1.6
(Ostrowski) Up to equivalence, the norms on
For a proof, see ref. [24, Chapter II].
The equivalence classes of norms on
Theorem 2.1.7
(Product formula) Let
The product formula is one motivation for the normalizations we chose. However, they are quite natural from a measure theoretic perspective as one can find in ref. [25]. Note that the possibly infinite product is finite. In fact,
2.1.1 Completions
It turns out that a norm
Example 2.1.8
(Archimedean case) Let us consider
Example 2.1.9
(Non-Archimedean case) We confine ourselves with the following fact. The
The process of completion deals with this failure. For any norm
2.1.2 Completion at Archimedean places
Let
Let us define
It carries a norm defined by
2.1.3 Completion at non-Archimedean places
As non-Archimedean norms are not used often in cryptography, we briefly recall the construction of the completions. Let us begin with
Example 2.1.10
Let
with componentwise addition and multiplication. It is a closed subset of
Returning to the case of
Then, the
where
and
The unit group
2.2 Adèles
The completions of
Definition 2.2.1
The adèle ring
This means that
Theorem 2.2.2
With the diagonal embedding,
This theorem has important consequences in the Fourier analysis of number fields, which dates back to the thesis of Tate [26]. Similar to the situation of lattices in Euclidean space, the Pontryagin dual of
Another important fact about the ring of adèles is that it satisfies an approximation theorem in the following sense. A proof can be found, for example, in ref. [27, Chapter 5].
Theorem 2.2.3
The subgroup
A variant for
Idèles. The idèles of
Similar to adèles, we regard
Theorem 2.2.4
The group
So far, the situation for the multiplicative group looks quite similar; however, the approximation theorem does not hold and the
Note that the condition that
and
The adèlic norm map is surjective, as it is so when restricting to any infinite place. As a consequence of the product formula 2.1.7, we have the following.
Corollary 2.2.5
For
Here, we regard
Theorem 2.2.6
The group
We do not go into the proof here. In the next section, we will consider the more general case, where
Proposition 2.2.7
The map
where
Proof
It is easy to see that the aforementioned map is well defined. Consider the map
where
3 The space of module lattices
In this section, we redefine module lattices over the base field
3.1 Module lattices
Our definition mimics the notion of ideal lattices as defined in ref. [17]. We proceed in two steps, first, we define rank
Definition 3.1.1
An
This notion corresponds to complete lattices. Given an
We define
Definition 3.1.2
A module lattice of rank
We denote the set of module lattices of rank
Proposition 3.1.3
There is a canonical bijection
We introduce the inverse for compatibility reasons, as will be seen later. Moreover,
Proof
It is easy to see that the association
As a consequence of the previous proposition, we will often write pairs
Let
The next theorem can be found in refs [28] and [25, Theorem V.2.2]. We will use this description to define the geometric structure on the set of module lattices over
Theorem 3.1.4
There exists a bijection
Here,
Proof
Let us first explain the components at each finite place
We need to ensure that with
So far we have shown that the map is well defined. For the remaining assertions, we refer to the sources mentioned earlier.□
3.2 Geometry on the space of module lattices
In this subsection, we will give a more precise description of the geometric structure of the space of lattices. It turns out that the space is disconnected with connected components naturally identified with the class group of
Lemma 3.2.1
The determinant
Proof
First note that the map is well defined as the determinant maps
Forgetting the infinite component extends the determinant to a surjective map
The connected components of
We define
Proposition 3.2.2
Let
Proof
Define the map
with image in the subspace of those elements in
For any
Norm 1 group. The space of lattices comes with a
Consider
Recall that
Proposition 3.2.3
There is a finite
Proof
The identification is an immediate consequence of Proposition 3.2.2 by noting that
Invariant measures are only unique up to scaling, but we will always work implicitly with the normalized measure, i.e., the unique invariant measure such that the measure of
The space
is 1. By the product formula 2.1.7,
Lemma 3.2.4
The composition
is a bijection.
Proof
Suppose
Let
On the level of module lattices Propositions 3.2.2 and 3.2.3 yield the following.
Corollary 3.2.5
There is a bijection
The lattices in
Determinant of modules. As in Lemma 3.2.4, we want to describe a subset of
Let
Proposition 3.2.6
Let
Recall from Theorem 3.1.4 that we associate with a pair
Corollary 3.2.7
Under the identification of
The norm of
Proof
Clearly, if the image of
Let
Concrete description. Finally, we want to give a more concrete description of the correspondence between module lattices and the space described earlier. Up to determining the class group, this gives a rather simple identification that does not use adèles. We recall from
Proposition 3.2.8
Any
from
Corollary 3.2.9
Let M and N be
With this result in hand, we can easily describe the association between the set of module lattices over
Proposition 3.2.10
Let
Proof
First, suppose
Hence, the pair
which implies that
Conversely, given
Remark 3.2.11
The determinant of an
3.3 Module lattices up to isometry
Often, questions about lattices are independent of its isometry class. For example, the minimal length of nonzero vectors coincide in
For
Definition 3.3.1
Let
Let
Corollary 3.3.2
There is a bijection
Further, Proposition 3.2.2 yields the following.
Corollary 3.3.3
There is bijection
where
It is easy to see that as a subgroup of
Corollary 3.3.4
There is a bijection
In this section, the reason to use adèles has not yet become apparent. In fact, the geometric description of isometry classes of module lattices can be done in terms of Arakelov theory as sketched in the next remark. The adèlic viewpoint will be used in the next sections, when we define and analyze certain spaces of functions on the space of lattices.
Remark 3.3.5
Another approach to module lattices can be adopted in terms of basic Arakelov theory or metrized
4 Automorphic forms and representation theory
In this section, we introduce the notion of automorphic forms and cuspidal automorphic forms for
This section is a recollection of the theory of automorphic forms, which is included for making this article accessible to nonexperts. Unless it makes definitions much easier, we will not restrict to
4.1 Automorphic forms
As mentioned earlier, let
Recall that
Definition 4.1.1
A function
The set of smooth
Before we can define automorphic forms, we need further notation. The Lie algebra of
Definition 4.1.2
A K-finite automorphic form is a smooth function
If
There exists an ideal
For any norm
The space of
Remark 4.1.3
The first condition is called automorphy. The second is
Remark 4.1.4
A special form of
i.e., a smooth function on the space of isometry classes of module lattices over
Let
whenever
Definition 4.1.5
An
The space of
Proposition 4.1.6
There is a decomposition
where the sum runs over characters of
We refer to ref. [30, Section 2.5] for a proof. Later, we will see further decompositions for the space of cusp forms.
Cusp forms. From now on, we restrict to the case
The integral is always defined as by Theorem 2.2.2 is the reason for the fact
Remark 4.1.7
Let
The aforementioned condition entails that the Fourier coefficient vanishes. The analogy to Fourier coefficients is inherent in Whittaker models, and see ref. [34]. The relationship between the classic and adèlic approaches is treated in refs [18,34].
The definition of
In fact,
The space of automorphic forms or cusp forms can be analyzed in terms of representation theory. In the following section, we will introduce the Hecke algebras, which are the basic tool for analyzing the space of automorphic forms and cusp forms. In particular, they contain the Hecke operators that will be part of our criterion for a worst-case to average-case convergence.
4.2 Representation theory
We introduce some backgrounds in representation theory of
Archimedean case. Let
As
Definition 4.2.1
A
For any
For any
In the definition, we write
Remark 4.2.2
Let
is defined for all
Definition 4.2.3
A
Let us recall the notion of
Non-Archimedean case. Now, let
Definition 4.2.4
A
For a compact open subgroup
For any isomorphism class
Theorem 4.2.5
Let
Schur’s lemma holds in the context of smooth representations so that we have the following consequence.
Corollary 4.2.6
Let
We refer to ref. [36, 2.6 Corollary 1] for a proof. See also ref. [35, Proposition 4.2.4] and the discussion thereafter. Again, we have a notion of admissibility, as follows.
Definition 4.2.7
A smooth representation
As in representation theory of finite groups, there is a
The group
for
Let
Theorem 4.2.8
There is a natural correspondence between G modules and
Again, we refer to ref. [36] for a proof. We finish with a final definition of modules which have
Definition 4.2.9
Let
For
4.3 Automorphic representations
In this section we use the tools introduced in the previous subsection to analyze the space of automorphic forms. The case of
Archimedean Hecke algebra. The space of
Theorem 4.3.1
Let
Non-Archimedean Hecke algebra. In the previous section, we defined Hecke algebras for each finite place
where a tensor belongs to
Example 4.3.2
A basic construction of admissible
The finite Hecke algebra acts on
It is easy to see that
Theorem 4.3.3
Let
Global Hecke algebra. We define
Definition 4.3.4
An automorphic representation is an
Most importantly, for automorphic forms, we have a decomposition result by Flath [41].
Theorem 4.3.5
Let
where
Together with Theorem 4.3.3, we conclude that from a theoretic perspective, the analysis of automorphic representations reduces to the analysis of admissible representations of
There is a further notion of automorphic representations related to
Definition 4.3.6
An
Theorem 4.3.7
Let
Here, the restricted tensor product is completed in the sense of tensor products of Hilbert spaces. As we do not need further details, we refer to ref. [42].
Cuspidal automorphic representations. It can be easily checked that the action of the Hecke algebra
Definition 4.3.8
A
We will use the term cuspidal representation for a
Theorem 4.3.9
The space
Here,
Theorem 4.3.10
Let
This theorem is called the strong multiplicity one theorem and is proved in refs [39,43]. Finally, we want to mention that the complement of the cusp forms in
Remark 4.3.11
The space
and see ref. [30]. The term
5 Worst-case to average-case convergence
In this section, we want to specify our general notion of cuspidal distributions on the space of lattices and define a collection of Hecke operators associated with ideals of
For a choice of a finite set
5.1 Worst-case distributions
Let
where
We expect a worst-case distribution to be a square-integrable map
whose support is concentrated about the identity lattice, which corresponds to
Here, we define the notion of cuspidal distributions. These are contained in the space of
Definition 5.1.1
A cuspidal distribution on the space of isometry classes of norm 1 module lattices of rank 2 over
Here,
Remark 5.1.2
In ref. [17], the worst-case distribution has been chosen as a Gaussian on the torus
Proposition 5.1.3
Let
where the sum runs over all spherical cuspidal automorphic representations
Proof
By definition
where the sum runs over spherical cuspidal representations and
Remark 5.1.4
The average-case distribution is merely the constant function 1, which corresponds to the normalized invariant measure we introduced earlier.
5.2 Hecke operators
In this section, we introduce specific Hecke operators associated with ideals of
Let
Lemma 5.2.1
Let
act via characters
Unramified for characters
Let
5.3 Convergence criterion
Let
Proposition 5.3.1
Let
be viewed as a sequence in
Proof
The proposition is a formal consequence of the results mentioned previously. The space of cuspidal automorphic forms decomposes into a Hilbert space direct sum. A sequence in that space converges, if and only if the sequence of coefficients converge, hence the result.□
Corollary 5.3.2
Let
We have not made any concrete qualitative analysis of the cuspidal distributions here, and we want make the following remark, which displays the difficulties in potential applications.
Remark 5.3.3
In practice, we can define worst-case distributions on the space of module lattices, which intuitively satisfy properties that one expects of worst-case distributions. However, even if such worst-case distributions are cuspidal distributions, it is hard to find the decomposition into irreducible cusp forms as in Proposition 5.1.3. In the rank 1 case, this is easier thanks to Fourier analysis, which is not available in the present case. The problem falls into the field of non-abelian harmonic analysis. Conversely, it is possible to construct spherical cuspidal representations, which can then be used to define a worst-case distribution, which comes in a decomposed form by its construction. However, then it is difficult to make assertions on its quality as a worst-case distribution. We have outlined a construction of cuspidal automorphic representations with spherical vectors in Appendix B.3 and reviewed their potential application in the context of this section in Appendix B.4.
6 Lattices with
G
structure
In this section, we define a new notion of structured lattices. The structure is given by the choice of an algebraic group over the ring of integers of a number field together with a representation. Intuitively, the algebraic group is the additional structure, while the representation entails how the group acts on lattices. We will give a series of examples to show how lattices previously considered for cryptographic applications fit into this notion. The motivation to consider this type of structured lattices is that the space of lattices with a fixed structure can be treated analogous to our approach in this article. This works particularly well, if the underlying group satisfies certain conditions.
We do not provide all mathematical details, as they would lead us to far astray. Specifically, we do not go into details on the theory of reductive groups, where the similarity to the case of
6.1 Affine algebraic groups
We begin with a brief introduction to the notion of affine algebraic groups. There are many sources on algebraic groups. We refer to ref. [44], where the general notion of affine group schemes over general base rings is introduced.
Let
The identity
For two morphisms
commutes.
Here, natural isomorphism has a rigorous meaning, namely, that the isomorphism is compatible with morphisms
Of course,
Example 6.1.1
The multiplicative group
Similarly, one can see that
Fibers of
Representations. Let
which again is assumed to be compatible in morphisms of
There are trivial examples for representations in the aforementioned sense. For
Example 6.1.2
Consider the algebraic group
We want to motivate the necessity of representations, which is also the key insight in the theory of module lattices.
Remark 6.1.3
Recall that any two lattices of a fixed rank are isomorphic as abstract groups, hence, in particular, so are their automorphism groups. The notion of module lattices is merely a systematic choice of lattices together with a subgroup of their automorphisms. This becomes apparent in Example 6.2.3 and with our description in Proposition 3.2.2 of the space of module lattices of rank
If we denote by
6.2 Lattices with
G
structure
Motivated by the previous remark we define
Definition 6.2.1
Let
Of course, an element in the image of the aforementioned map is viewed as a lattice by means of Proposition 3.2.2. In particular, as in Remark 6.1.3, each lattice with
Example 6.2.2
Let
For
The next example displays how module lattices over
Example 6.2.3
Let
for any
where we use the definition of restriction of scalars. The choice of basis, and with that
the space of
6.3 Symplectic lattices
In the theory of (reductive) affine algebraic groups, symplectic groups take an important role as one of the so-called classical groups, see ref. [45]. We introduce them as they form an interesting class with potential implications to cryptography. Lattice reduction for symplectic lattices has been studied in ref. [46]. Symplectic structures have been used in ref. [47] for lattice reduction by introducing a symplectic structure on number fields. To avoid complications, we consider the base field
Let
We define
Thus, points in
Definition 6.3.1
A symplectic lattice of rank
Symplectic lattices are related to polarized abelian varieties over
6.4 Lattices in central simple algebras
Finally, we want to show that the lattices constructed in ref. [19] are structured lattices in sense of Definition 6.2.1. As we do not need the notion of cyclic lattices, which is introduced for efficiency reasons in ref. [19], we consider arbitrary central simple algebras. Recall that unless trivial, central simple algebras are not commutative. More details on central simple algebras can be found in ref. [49, Chapter IV] on Brauer Groups. We refer to ref. [50] for quaternion algebras.
Let
with
Let us consider the case of quaternion algebras, i.e., a central simple algebra over
First, there is a well-understood notion of automorphic forms over quaternion algebras over number fields, cf. [39, Chapter III]. It is said that
Theorem 6.4.1
Let
Automorphic representations
Cuspidal automorphic representations
We do not explain discrete series representations here, and see refs [35,40,39]. Analogous to our approach in Section 5, we may look for worst-case distributions on
Reductive groups. The theory of automorphic forms and representations works particularly analogous to
6.5 LWE on
G
structured lattices
As a final remark, we want to mention two open questions regarding
First, our definition of
7 Conclusion
The present work builds up a theoretical roadmap toward a worst-case to average-case reduction of computational problems on module lattices. This roadmap relies on the geometric structure of module lattices, which is a consequence of the connection between module lattices and the general linear group. The description of the space of module lattices allows the study of functions on that space in terms of automorphic forms, which constitute our main technical tool for the analysis of distributions on the collection of module lattices. The space of automorphic forms admits a Hilbert space decomposition whose components can be understood in terms of basic building blocks. Our setup for a worst-case to average-case reduction is based on this insight; if the decomposition of a worst-case distribution into its basic building blocks has a specific form, then the convergence is only a question of convergence in terms of a coefficient sequence.
As a next step, it is necessary to find worst-case distributions according to our definition, which admit explicit descriptions as functions on the space of lattices, compare Appendix B. In fact, the problems here are twofold. Given a smooth function on the space of lattices, it is not known how to decompose it into irreducible components of the associated automorphic representation. On the other hand, a definition as in Appendix B does not yield an explicit function that can be used for applications. Both are mathematical problems that need effective versions of results in non-abelian harmonic analysis and representation theory. In the present work, we concentrated on the cuspidal part of functions on the space of lattices, though, in future work, one might consider Eisenstein series as well. Even further, we only touched upon the surface of the theory of automorphic forms, which offers much deeper insights that might have an impact on lattice-based cryptography.
The
Acknowledgments
This work was partially funded by the German Ministry of Education, Research and Technology in the context of the project Aquorypt (grant number 16KIS1022).
-
Conflict of interest: The authors state no conflict of interest.
Appendix
A Rank 1 from adèlic perspective
In this appendix section, we want to show how ref. [17] can be understood in the terms of our present approach. In the following two sections, we explain first how ideal lattices can be viewed as adèlevalued points of
The first section is closely related to Section 3 with the main distinction that the rank 1 case is less technical. We present the details for convenience. The reader who has not encountered the concept of adèles before can find a first impression how this terminology is applied. The second subsection is the rank 1 analog of what we have developed through Sections 4 and 5. Again, the discussion is less technical here, as in dimension 1 the representation theory is easier and the well-known theory of Fourier analysis can be applied. We outline how the worst-case distribution in ref. [17] can be viewed as a smooth function on the space of ideal lattices from the adèlic viewpoint and show how the Hecke operators in ref. [17] are related to Hecke operators in the sense of automorphic forms on
A.1 Ideal lattices over k
In this section, we define ideal lattices and relate them to idèles. We denote by
Definition A.1.1
(As in ref. [17]) An
The inverse of
Proposition A.1.2
There is a canonical surjective map
where
Proof
We define the map by
Thus,
Our goal is to relate
Lemma A.1.3
There is a canonical isomorphism
Let
is an inverse.
Proof
Note that
Note moreover that
Corollary A.1.4
The class group of
Proof
One just needs to show that the maps
Lemma A.1.5
The map
which is
Proof
The function
Corollary A.1.6
There is a canonical isomorphism
induced from
In Section 3, we have seen the analog for
Norm 1 ideal lattices. So far, we considered a quite general class of ideal lattices. However, this space is to large, in fact,
Definition A.1.7
The norm of
We remark that in ref. [17], there is a further condition that the infinite component consists of positive real entries.
Lemma A.1.8
The norm on
Proof
Suppose
We define the subgroup
Isometry classes of lattices.
Definition A.1.9
Two
Note that
Theorem A.1.10
There is a canonical identification
Together with the identification in ref. [17] of
Theorem A.1.11
There is a natural identification
Remark A.1.12
As
The
A.2 Worst-case to average-case reduction in rank 1
In this section, we recall the worst-case distribution in ref. [17], and translate their definition to the adèlic approach for
As mentioned earlier, let
Lemma A.2.1
The map
is an isomorphism.
Under
Lemma A.2.2
The map
is an isomorphism. In particular,
This gives a new description of ideal lattices as follows.
Corollary A.2.3
There is a natural one-to-one correspondence
In ref. [17], they defined worst-case distributions on the space of ideal lattices as follows. On the connected component of the identity, one sets
which is extended to
for certain
These are unramified Hecke characters trivial on the ray
where the sum runs over the unramified
Hecke algebra. For any finite place
Lemma A.2.4
Let
Proof
By definition,
where
Given a collection
We have described all the ingredients for the main result of ref. [17], written in the language of adèles. The proof of the main result in the current approach is a direct consequence of the result in ref. [17], as all parts transfer smoothly.
B Construction of cuspidal automorphic representations
In this section, we give a further outline of the notion of cuspidal representations. By Theorem 4.3.5, we know that a cuspidal representation is a tensor product of local representations. We describe the classes of representations that are interesting for the use in application as in Section 5. In particular, we will focus on the spherical representations at the non-Archimedean places. Afterward, we will briefly recall how one can use a general construction due to Weil to obtain cuspidal automorphic representations, which are spherical at all finite places. This is only possible under certain assumptions on the number field, namely, that it admits an unramified degree 2 field extension. These cuspidal representations depend on such a choice of field extension
B.1 Representations of
GL
2
over non-Archimedean fields
In this section, we present an overview of the characterization of irreducible admissible representations of
To begin with, all irreducible finite dimensional representations
We continue with infinite dimensional irreducible representations, which can be constructed as follows. First, we define certain subgroups of
and we set
The important fact in the representation theory of
which extends to
by ignoring
i.e.,
for any
Proposition B.1.1
If
We only discuss the last part as this is important for our applications later. Recall that a quasi-character
where
In the case when
The irreducible admissible representations of
B.2 Representations of
GL
2
over Archimedean fields
We continue with the classification of irreducible admissible representations of
We will denote by
The action of the center of
Real case. The real case seems less important for current cryptographic applications. Still, we recall the theory for completeness sake. Unfortunately, the real case comes with a slight complication in comparison to the complex case due to the fact that
Let
Define
Thus,
The
We consider the different cases for the choices of
with
Theorem B.2.1
Let
If
If
If
Complex case. The complex case is quite similar, except that we do not have the complication with connected components as
for
Proposition B.2.2
Let
The last assertion is different in the complex case than in the real case, where the nontrivial subrepresentations of
B.3 Weil representations
Finally, we want to give a construction of cuspidal automorphic representations. The construction due to Weil is particularly interesting for potential applications in lattice-based cryptography. In fact, Weil representations are constructed using characters of a degree two-field extension of the base field. In this way, we can relate pieces of a worst-case distribution for rank 2 lattices over
As we do not need the precise details of the construction, we will only give the results.
Non-Archimedean case Let
Proposition B.3.1
Let
In the second case, the representation
Archimedean case. In the Archimedean case, we only need to consider
for
Global Weil representation. In the global case let
where
If
If
The representation
The condition for
Theorem B.3.2
Let
This is stated as Theorem 7.11 in ref. [40]. The proof is done by comparing the respective
B.4 Constructing worst-case distributions in rank 2
In this section, we want to show how Weil representations can be used to construct cuspidal distributions for module lattices of rank 2. By Definition 5.1.1, to define a cuspidal distribution, we need to construct a collection of spherical cuspidal representations. Our basic idea is to use characters that appear in the Fourier decomposition of the worst-case distribution on ideal lattices over an extension field
Let us fix an extension
Lemma B.4.1
Let
Proof
The assertion is clear when
and hence,
One sees from the proof that at the finite nonsplit places, all characters necessarily factor through the norm. The same holds for infinite places, as we assume that
Lemma B.4.2
Let
Proof
The case of finite places is done in the proof of the previous lemma. We assume
The characters that do not factor through the norm are easily classified as follows.
Lemma B.4.3
Let
Proof
We have seen that at all nonsplit places, the characters necessarily factor through the norm. Hence, the existence of a split place is necessary. Let
using that multiplication is symmetric, which proves the claim.□
We finish with the following final remark.
Remark B.4.4
To construct a good class of characters, we consider the complex places only, as they are surely split in any extension. Among the unramified Hecke characters of
References
[1] Micciancio D. The shortest vector problem is NP-hard to approximate to within some constant. SIAM J Comput. 2001 Mar;30(6):2008–35. Preliminary version in FOCS 1998. 10.1137/S0097539700373039Suche in Google Scholar
[2] Micciancio D, Goldwasser S. Complexity of lattice problems. vol. 671 of The Kluwer International Series in Engineering and Computer Science. Boston, MA: Kluwer Academic Publishers; 2002. A cryptographic perspective. 10.1007/978-1-4615-0897-7. Suche in Google Scholar
[3] Bos J, Ducas L, Kiltz E, Lepoint T, Lyubashevsky V, Schanck JM, et al. CRYSTALS - Kyber: A CCA-Secure module-lattice-based KEM. In: 2018 IEEE European Symposium on Security and Privacy (EuroS P). 2018. p. 353–67. 10.1109/EuroSP.2018.00032Suche in Google Scholar
[4] Ducas L, Kiltz E, Lepoint T, Lyubashevsky V, Schwabe P, Seiler G, et al. CRYSTALS-Dilithium: A lattice-based digital signature scheme. IACR TCHES. 2018;2018(1):238–68. https://tches.iacr.org/index.php/TCHES/article/view/839. 10.46586/tches.v2018.i1.238-268Suche in Google Scholar
[5] Prest T, Fouque PA, Hoffstein J, Kirchner P, Lyubashevsky V, Pornin T, et al. FALCON. National Institute of Standards and Technology; 2020. Available at https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions. Suche in Google Scholar
[6] Alkim E, Ducas L, Pöppelmann T, Schwabe P. Post-quantum key exchange – a new hope. In: USENIX Security 2016. USENIX Association; 2016. p. 327–43. Suche in Google Scholar
[7] Alkim E, Barreto PSLM, Bindel N, Krämer J, Longa P, Ricardini JE. The lattice-based digital signature scheme qTESLA. In: ACNS 20, Part I. vol. 12146. Heidelberg: Springer; 2020. p. 441–60. 10.1007/978-3-030-57808-4_22Suche in Google Scholar
[8] Naehrig M, Alkim E, Bos J, Ducas L, Easterbrook K, LaMacchia B, et al. FrodoKEM. National Institute of Standards and Technology; 2020. Available at: https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions. Suche in Google Scholar
[9] Lyubashevsky V, Peikert C, Regev O. On ideal lattices and learning with errors over rings. In: Advances in cryptology–EUROCRYPT 2010. vol. 6110 of Lecture Notes in Computer Science. Berlin: Springer; 2010. p. 1–23. 10.1007/978-3-642-13190-5_1. Suche in Google Scholar
[10] Lyubashevsky V, Peikert C, Regev O. A toolkit for ring-LWE cryptography. In: Advances in cryptology–EUROCRYPT 2013. vol. 7881 of Lecture Notes in Computer Science. Heidelberg: Springer; 2013. p. 35–54. 10.1007/978-3-642-38348-9_3. Suche in Google Scholar
[11] Stehlé D, Steinfeld R. Making NTRU as secure as worst-case problems over ideal lattices. In: Advances in cryptology–EUROCRYPT 2011. vol. 6632 of Lecture Notes in Computer Science. Heidelberg: Springer; 2011. p. 27–47. 10.1007/978-3-642-20465-4_4. Suche in Google Scholar
[12] Peikert C. A decade of lattice cryptography. Found Trends Theor Comput Sci. 2014;10(4):i–iii, 283–424. 10.1561/0400000074. Suche in Google Scholar
[13] Cramer R, Ducas L, Wesolowski B. Short Stickelberger class relations and application to ideal-SVP. In: Advances in cryptology–EUROCRYPT 2017. Part I. vol. 10210 of Lecture Notes in Computer Science. Cham: Springer; 2017. p. 324–48. 10.1007/978-3-319-56620-7_12. Suche in Google Scholar
[14] Ducas L, Plançon M, Wesolowski B. On the shortness of vectors to be found by the ideal-SVP quantum algorithm. In: Advances in cryptology–CRYPTO 2019. Part I. vol. 11692 of Lecture Notes in Computer Science. Cham: Springer; 2019. p. 322–51. 10.1007/978-3-030-26948-7_12. Suche in Google Scholar
[15] Pellet-Mary A, Hanrot G, Stehlé D. Approx-SVP in ideal lattices with pre-processing. In: Advances in Cryptology–EUROCRYPT 2019. Part II. vol. 11477 of Lecture Notes in Computer Science. Cham: Springer; 2019. p. 685–716. 10.1007/978-3-030-17656-3_2. Suche in Google Scholar
[16] Langlois A, Stehlé D. Worst-case to average-case reductions for module lattices. Des Codes Cryptogr. 2015;75(3):565–99. 10.1007/s10623-014-9938-4. Suche in Google Scholar
[17] de Boer K, Ducas L, Pellet-Mary A, Wesolowski B. Random self-reducibility of ideal-SVP via Arakelov random walks. In: Advances in Cryptology–CRYPTO 2020. Part II. vol. 12171 of Lecture Notes in Computer Science. Cham: Springer; 2020. p. 243–73. 10.1007/978-3-030-56880-1_9. Suche in Google Scholar
[18] Kudla SS. From modular forms to automorphic representations. In: An introduction to the Langlands program (Jerusalem, 2001). Boston, Boston, MA: Birkhäuser; 2003. p. 133–51. 10.1007/978-0-8176-8226-2_7Suche in Google Scholar
[19] Grover C, Ling C, Vehkalahti R. Non-commutative ring learning with errors from cyclic algebras. 2019. https://ia.cr/2019/680. Cryptology ePrint Archive, Report 2019/680. Suche in Google Scholar
[20] Brakerski Z, Gentry C, Vaikuntanathan V. (Leveled) fully homomorphic encryption without bootstrapping. In: Proceedings of the 3rd Innovations in Theoretical Computer Science Conference. New York: ACM; 2012. p. 309–25. 10.1145/2090236.2090262Suche in Google Scholar
[21] Lee C, Pellet-Mary A, Stehlé D, Wallet A. An LLL algorithm for module lattices. In: Advances in Cryptology – ASIACRYPT 2019. Cham: Springer International Publishing; 2019. p. 59–90. 10.1007/978-3-030-34621-8_3Suche in Google Scholar
[22] Mukherjee T, Stephens-Davidowitz N. Lattice reduction for modules, or how to reduce moduleSVP to module SVP. In: Advances in Cryptology–CRYPTO 2020. Part II. vol. 12171 of Lecture Notes in Computer Science. Cham: Springer; 2020. p. 213–42. 10.1007/978-3-030-56880-1_8. Suche in Google Scholar
[23] Lenstra AK, Lenstra Jr HW, Lovász L. Factoring polynomials with rational coefficients. Math Ann. 1982;261(4):515–34. 10.1007/BF01457454. Suche in Google Scholar
[24] Neukirch J. Algebraic number theory. vol. 322 of Grundlehren der Mathematischen Wissenschaften [Fundamental Principles of Mathematical Sciences]. Berlin: Springer-Verlag; 1999. Translated from the 1992 German original and with a note by Norbert Schappacher, With a foreword by G. Harder. 10.1007/978-3-662-03983-0. Suche in Google Scholar
[25] Weil A. Basic number theory. Classics in mathematics. Berlin: Springer-Verlag; 1995. Reprint of the second (1973) edition. 10.1007/978-3-662-05978-4Suche in Google Scholar
[26] Tate JT. Fourier analysis in number fields, and Hecke’s zeta-functions. In: Algebraic Number Theory (Proceedings on Instructional Conference, Brighton, 1965). Washington, D.C.: Thompson; 1967. p. 305–47. Suche in Google Scholar
[27] Ramakrishnan D, Valenza RJ. Fourier analysis on number fields. vol. 186 of Graduate texts in mathematics. New York: Springer-Verlag; 1999. 10.1007/978-1-4757-3085-2. Suche in Google Scholar
[28] Borel A. Some finiteness properties of adele groups over number fields. Inst Hautes Études Sci Publ Math. 1963;16:5–30. http://www.numdam.org/item?id=PMIHES_1963__16__5_0. 10.1007/BF02684289Suche in Google Scholar
[29] Milne JS. Introduction to Shimura varieties. In: Harmonic analysis, the trace formula, and Shimura varieties. vol. 4 of Clay Mathematics. Proceedings of the American Mathematical Society. Providence, RI; 2005. p. 265–378. Suche in Google Scholar
[30] Garrett P. Modern analysis of automorphic forms by example. Vol. 1. vol. 173 of Cambridge Studies in Advanced Mathematics. Cambridge: Cambridge University Press; 2018. 10.1017/9781316650332Suche in Google Scholar
[31] Rosenberg J. Algebraic K-theory and its applications. vol. 147 of Graduate texts in mathematics. New York: Springer-Verlag; 1994. 10.1007/978-1-4612-4314-4. Suche in Google Scholar
[32] Cohen H. Advanced topics in computational number theory. vol. 193 of Graduate texts in mathematics. New York: Springer-Verlag; 2000. 10.1007/978-1-4419-8489-0. Suche in Google Scholar
[33] Biasse JF, Song F. Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields. In: Proceedings of the Twenty-Seventh Annual ACM-SIAM Symposium on Discrete Algorithms. New York: ACM; 2016. p. 893–902. 10.1137/1.9781611974331.ch64. Suche in Google Scholar
[34] Cogdell JW, Kim HH, Murty MR. Lectures on automorphic L-functions. vol. 20 of Fields Institute Monographs. Providence, RI: American Mathematical Society; 2004. 10.1090/fim/020Suche in Google Scholar
[35] Bump D. Automorphic forms and representations. vol. 55 of Cambridge studies in advanced mathematics. Cambridge: Cambridge University Press; 1997. 10.1017/CBO9780511609572. Suche in Google Scholar
[36] Bushnell CJ, Henniart G. The local Langlands conjecture for GL(2). vol. 335 of Grundlehren der Mathematischen Wissenschaften [Fundamental Principles of Mathematical Sciences]. Berlin: Springer-Verlag; 2006. 10.1007/3-540-31511-X. Suche in Google Scholar
[37] Borel A, Jacquet H. Automorphic forms and automorphic representations. In: Automorphic Forms, Representations and L-functions (Proceedings of Symposia in Pure Mathematics, Oregon State University, Corvallis, Ore., 1977), Part 1. Proceedings of Symposia in Pure Mathematics, XXXIII. Providence, R.I.: American Mathematical Society; 1979. p. 189–207. With a supplement “On the notion of an automorphic representation” by R. P. Langlands. 10.1090/pspum/033.1/546598Suche in Google Scholar
[38] Knapp AW. Lie groups beyond an introduction. In: vol. 140 of Progress in Mathematics. 2nd ed. Boston, MA: Birkhäuser Boston, Inc.; 2002. 10.1007/978-1-4757-2453-0Suche in Google Scholar
[39] Jacquet H, Langlands RP. Automorphic forms on GL(2). Lecture Notes in Mathematics. Vol. 114. Berlin-New York: Springer-Verlag; 1970. 10.1007/BFb0058988Suche in Google Scholar
[40] Gelbart SS. Automorphic forms on adèle groups. Princeton, N.J.: Princeton University Press; Tokyo: University of Tokyo Press; 1975. Annals of Mathematics Studies, No. 83. 10.1515/9781400881611Suche in Google Scholar
[41] Flath D. Decomposition of representations into tensor products. In: Automorphic Forms, Representations and L-functions (Proceedings of the Symposia in Pure Mathematics, Oregon State University, Corvallis, Ore., 1977), Part 1. Proceedings of the Symposia in Pure Mathematics, XXXIII. Providence, R.I.: American Mathematical Society; 1979. p. 179–83. 10.1090/pspum/033.1/546596Suche in Google Scholar
[42] Gel’fand IM, Graev MI, Pyatetskii-Shapiro II. Representation theory and automorphic functions. vol. 6 of Generalized Functions. Boston, MA: Academic Press, Inc.; 1990. Translated from the Russian by K. A. Hirsch, Reprint of the 1969 edition. 10.1007/978-3-642-61705-8_6Suche in Google Scholar
[43] Casselman W. On some results of Atkin and Lehner. Math Ann. 1973;201:301–14. 10.1007/BF01428197. Suche in Google Scholar
[44] Waterhouse WC. Introduction to affine group schemes. vol. 66 of Graduate Texts in Mathematics. New York-Berlin: Springer-Verlag; 1979. 10.1007/978-1-4612-6217-6Suche in Google Scholar
[45] Humphreys JE. Linear algebraic groups. Graduate texts in mathematics, No. 21. New York-Heidelberg: Springer-Verlag; 1975. 10.1007/978-1-4684-9443-3Suche in Google Scholar
[46] Gama N, Howgrave-Graham N, Nguyen PQ. Symplectic lattice reduction and NTRU. In: Advances in cryptology–EUROCRYPT 2006. vol. 4004 of Lecture Notes in Computer Science. Berlin: Springer; 2006. p. 233–53. 10.1007/11761679_15. Suche in Google Scholar
[47] Kirchner P, Espitau T, Fouque PA. Algebraic and Euclidean lattices: optimal lattice reduction and beyond; 2019. https://ia.cr/2019/1436. Cryptology ePrint Archive, Report 2019/1436. Suche in Google Scholar
[48] Bergé AM. Symplectic lattices. In: Quadratic forms and their applications (Dublin, 1999). vol. 272 of Contemproray Mathematics. Providence, RI: American Mathematical Society; 2000. p. 9–22. 10.1090/conm/272/04393. Suche in Google Scholar
[49] Milne JS. Class field theory (v4.03); 2020. Available at www.jmilne.org/math/. Suche in Google Scholar
[50] Voight J. Quaternion algebras. vol. 288 of Graduate texts in mathematics. Cham: Springer; 2021. 10.1007/978-3-030-56694-4. Suche in Google Scholar
[51] Regev O. On lattices, learning with errors, random linear codes, and cryptography. In: STOC’05: Proceedings of the 37th Annual ACM Symposium on Theory of Computing. New York: ACM; 2005. p. 84–93. 10.1145/1060590.1060603. Suche in Google Scholar
[52] Serre JP. Local fields. vol. 67 of Graduate texts in mathematics. New York-Berlin: Springer-Verlag; 1979. TranslatedFrench by Marvin Jay Greenberg. 10.1007/978-1-4757-5673-9Suche in Google Scholar
© 2022 Samed Düzlü and Juliane Krämer, published by De Gruyter
This work is licensed under the Creative Commons Attribution 4.0 International License.
Artikel in diesem Heft
- Regular Articles
- On the confusion coefficient of Boolean functions
- On the supersingular GPST attack
- Reproducible families of codes and cryptographic applications
- Evolution of group-theoretic cryptology attacks using hyper-heuristics
- MAKE: A matrix action key exchange
- The mF mode of authenticated encryption with associated data
- Cryptanalysis of “MAKE”
- An efficient post-quantum KEM from CSIDH
- Pseudo-free families and cryptographic primitives
- A deterministic algorithm for the discrete logarithm problem in a semigroup
- Application of automorphic forms to lattice problems
- On the algebraic immunity of multiplexer Boolean functions
- A Ring-LWE-based digital signature inspired by Lindner–Peikert scheme
- The polynomial learning with errors problem and the smearing condition
- Abelian sharing, common informations, and linear rank inequalities
- Integer polynomial recovery from outputs and its application to cryptanalysis of a protocol for secure sorting
- DLP in semigroups: Algorithms and lower bounds
- On the efficiency of a general attack against the MOBS cryptosystem
- The most efficient indifferentiable hashing to elliptic curves of j-invariant 1728
- Group codes over binary tetrahedral group
Artikel in diesem Heft
- Regular Articles
- On the confusion coefficient of Boolean functions
- On the supersingular GPST attack
- Reproducible families of codes and cryptographic applications
- Evolution of group-theoretic cryptology attacks using hyper-heuristics
- MAKE: A matrix action key exchange
- The mF mode of authenticated encryption with associated data
- Cryptanalysis of “MAKE”
- An efficient post-quantum KEM from CSIDH
- Pseudo-free families and cryptographic primitives
- A deterministic algorithm for the discrete logarithm problem in a semigroup
- Application of automorphic forms to lattice problems
- On the algebraic immunity of multiplexer Boolean functions
- A Ring-LWE-based digital signature inspired by Lindner–Peikert scheme
- The polynomial learning with errors problem and the smearing condition
- Abelian sharing, common informations, and linear rank inequalities
- Integer polynomial recovery from outputs and its application to cryptanalysis of a protocol for secure sorting
- DLP in semigroups: Algorithms and lower bounds
- On the efficiency of a general attack against the MOBS cryptosystem
- The most efficient indifferentiable hashing to elliptic curves of j-invariant 1728
- Group codes over binary tetrahedral group
