Lattice-based cryptography relies on generating random bases which are difficult to fully reduce. Given a lattice basis (such as the private basis for a cryptosystem), all other bases are related by multiplication by matrices in $GL(n,\mathbb{Z})$. How can one sample random elements from $GL(n,\mathbb{Z})$? We consider various methods, finding some are stronger than others with respect to the problem of recognizing rotations of the $\mathbb{Z}^n$ lattice. In particular, the standard algorithm of multiplying unipotent generators together (as implemented in Magma's RandomSLnZ command) generates instances of this last problem which can be efficiently broken, even in dimensions nearing 1,500. Similar weaknesses for this problem are found with the random basis generation method in one of the NIST Post-Quantum Cryptography competition submissions (DRS). Other algorithms are described which appear to be much stronger.
翻译:以 Lattice 为基础的加密法依赖于生成难以完全缩小的随机基数。 以 lattice 为基础的随机基数( 如加密系统的私人基数) 。 以 $GL (n,\ mathbb ⁇ ) 来计算, 所有其他基数都通过基数的乘法( $GL (n,\ mathbb ⁇ ) 倍增而相关 。 我们如何从 $GL (n,\ mathbb ⁇ ) 中抽取随机元素? 我们考虑各种方法? 在确认 $\ mathbb ⁇ n lattice 的旋转问题时, 发现一些比其他方法更强。 特别是, 将单能发电机加在一起的标准算法( 在 Maggma 的 RamptomersLenZ 命令中实施) 生成了最后一个问题的例子, 即便在1 500 的维度上也可以有效打破。 在 NIST 后 加密竞争呈件中随机基生成方法也发现了类似的弱点 。 。 其他算法似乎更强得多 。