Improved Reduction between SIS Problems over Structured Latticesopen access
- Authors
- Koo, Z.; Lee, Y.; Lee, J.-W.; No, J.-S.; Kim, Y.-S.
- Issue Date
- Nov-2021
- Publisher
- Institute of Electrical and Electronics Engineers Inc.
- Keywords
- Lattice-based cryptography; learning with error (LWE); module-short integer solution (M-SIS) problem; ring-short integer solution (R-SIS) problem; short integer solution (SIS) problem
- Citation
- IEEE Access, v.9, pp 157083 - 157092
- Pages
- 10
- Journal Title
- IEEE Access
- Volume
- 9
- Start Page
- 157083
- End Page
- 157092
- URI
- https://scholarworks.bwise.kr/cau/handle/2019.sw.cau/62055
- DOI
- 10.1109/ACCESS.2021.3128139
- ISSN
- 2169-3536
- Abstract
- Many lattice-based cryptographic schemes are constructed based on hard problems on an algebraic structured lattice, such as the short integer solution (SIS) problems. These problems are called ring-SIS (R-SIS) and its generalized version, module-SIS (M-SIS). Generally, it has been considered that problems defined on the module lattice are more difficult than the problems defined on the ideal lattice. However, Koo, No, and Kim showed that R-SIS is more difficult than M-SIS under some norm constraints of R-SIS. However, this reduction has problems in that the rank of the module is limited to about half of the instances of R-SIS, and the comparison is not performed through the same modulus of R-SIS and M-SIS. In this paper, we propose the three reductions. First, we show that R-SIS is more difficult than M-SIS with the same modulus and ring dimension under some constraints of R-SIS. Also, we show that through the reduction from M-SIS to R-SIS with the same modulus, the rank of the module is extended as much as the number of instances of R-SIS from half of the number of instances of R-SIS compared to the previous work. Second, we show that R-SIS is more difficult than M-SIS under some constraints, which is tighter than the M-SIS in the previous work. Finally, we propose that M-SIS with the modulus prime q k is more difficult than M-SIS with the composite modulus c, such that c is divided by q. Through the three reductions, we conclude that R-SIS with the modulus q is more difficult than M-SIS with the composite modulus c.
- Files in This Item
-
- Appears in
Collections - College of Software > School of Computer Science and Engineering > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.