M slides/imgs-lattices/two_bases_lattice.png → slides/imgs-lattices/two_bases_lattice.png

M slides/slides_lattices-intro.pdf → slides/slides_lattices-intro.pdf

M slides/slides_lattices-intro.tex → slides/slides_lattices-intro.tex

@@ -22,6 +22,10 @@ \usepackage{changepage} % for adjustwidth
 \usepackage{xcolor}
 \usepackage[most]{tcolorbox}
 
+\usepackage{pgf-umlsd} % diagrams
+\usepackage{tikz}
+\usetikzlibrary{positioning,arrows.meta}
+
 \graphicspath{ {./imgs-lattices} }
 
 \setbeamertemplate{itemize}{$\circ$}
@@ -89,7 +93,8 @@ % - Lattices math
 % - lattice hard problems are based on the hardness of finding short vectors. SVP, CVP, SIS, etc
 
 % TODO: why lattices are post quantum
-% Lattices are already used in browsers: explain how, dual signautres, etc
+% [done] Lattices are already used in browsers: explain how, dual signautres, etc
+% clarify L^\perp notation, is it q-ary?
 
 \begin{frame}{Motivation}
   \begin{itemize}
@@ -318,6 +323,7 @@ % \includegraphics[width=9.5cm]{./sphere_packing} % TODO
 \end{frame}
 
 \begin{frame}{Lattice properties}
+  \vspace*{-0.2cm}
   \small{
   recall, a lattice:
   \vspace*{-0.7cm}
@@ -335,7 +341,7 @@ \pause
   
   \vspace*{-0.4cm}
 \begin{columns}[T]
-  \begin{column}{0.65\textwidth}
+  \begin{column}{0.60\textwidth}
 
   \small{
   \begin{itemize}
@@ -347,10 +353,6 @@ \end{itemize}
 
   \vspace*{-0.3cm}
   \pause
-  \item $B \in \Zz^{n \times n}$, $n$ vectors, each with $n$ coordinates $\Longrightarrow$ requires $\mathcal{O}(n^2)$ integers.
-    \begin{itemize}
-      \item only if we could have some better lattice structure to represent the lattice with fewer entries...
-    \end{itemize}
   \end{itemize}
   }
 
@@ -361,10 +363,19 @@ \centering
     \includegraphics[width=\linewidth]{./two_bases_lattice}
   \end{column}
 \end{columns}
+
+  \pause
+  \begin{itemize}
+    \item $B \in \Zz^{n \times n}$, $n$ vectors, each with $n$ coordinates $\Longrightarrow$ requires $\mathcal{O}(n^2)$ integers.
+    \begin{itemize}
+      \item only if we could have some better lattice structure to represent the lattice with fewer entries...
+    \end{itemize}
+  \end{itemize}
 \end{frame}
 
 
 \begin{frame}{q-ary lattice}
+  \vspace{-0.4cm}
   a full-rank lattice is q-ary if $q \Zz^d \subseteq \Ll \subseteq \Zz^d$
 
   $\Longrightarrow$ q-ary lattice is an infinite set of integer points, but membership depends only on the residue class modulo $q$
@@ -386,15 +397,23 @@ %
   % lattice generated by the rows of $A$.
   % \pause
 
+  \vspace*{-0.5cm}
   q-ary lattice:
   $$\Ll_q^{\perp}(A) = ker(\psi_A) = \{ z \in \Zz^m ~|~ Az = 0 \mod q \}$$
   contains all vectors that are orthogonal modulo $q$ to the rows of $A$.
 
-  \scriptsize{
-    The q-ary lattice generated by the rows of $A$:
-    $$\Ll_q(A) = \{ y \in \Zz^m ~|~ y=A^Tz \mod q ~\text{for some}~ z \in \Zz_q^n \}$$
+  % \scriptsize{
+  %   The q-ary lattice generated by the rows of $A$:
+  %   $$\Ll_q(A) = \{ y \in \Zz^m ~|~ y=A^Tz \mod q ~\text{for some}~ z \in \Zz_q^n \}$$
+  % }
+
+
+  \small{
+  \begin{tcolorbox}[colback=gray!15, colframe=gray!15] Intuition:
+    keep only the points that satisfy some modular rules. Since everything repeats every $q$ steps, the lattice has a structured and periodic shape, convenient in cryptography.
+    \\Linear algebra modulo $q$, but breaking it requires solving a hard lattice problem.
+  \end{tcolorbox}
   }
-
   % TODO why q-ary is better? prev.slide says O(n^2) without q-ary, how with q-ary?
 \end{frame}
 
@@ -727,65 +746,339 @@ \item FHE (BFV, BGV, CKKS, TFHE)
   \end{itemize}
 \end{frame}
 
-\begin{mayberm}
-\begin{frame}{ML-KEM (Kyber)}
-  \scriptsize{
-  \begin{itemize}
-    \item KEM = Key Encapsulation Mechanism
-    \begin{itemize}
-      \item Alice encapsulates a (symmetric) key using Bob's public key
-    \end{itemize}
-  \item based on Module-LWE
-  \end{itemize}
-  }
+% \begin{mayberm}
+% \begin{frame}{ML-KEM (Kyber)}
+%   \scriptsize{
+%   \begin{itemize}
+%     \item KEM = Key Encapsulation Mechanism
+%     \begin{itemize}
+%       \item Alice encapsulates a (symmetric) key using Bob's public key
+%     \end{itemize}
+%   \item based on Module-LWE
+%   \end{itemize}
+%   }
+% 
+% $$R_q=\mathbb{Z}_q[X]/(X^{256}+1),  A\in R_q^{k\times k}$$
+% 
+% \textbf{Key generation:}
+% $$
+% \mathbf{s},\mathbf{e}\leftarrow\chi^k,
+% \qquad
+% \mathbf{t}=A\mathbf{s}+\mathbf{e}
+% $$
+% 
+% $$
+% pk=(A,\mathbf{t}),\qquad sk=\mathbf{s}
+% $$
+% 
+% \textbf{Encapsulation:}
+% $$
+% \mathbf{u}=A^T\mathbf{r}+\mathbf{e}_1,
+% \qquad
+% v=\mathbf{t}^T\mathbf{r}+e_2+\operatorname{Encode}(m)
+% $$
+% 
+% $$
+% c=(\mathbf{u},v),
+% \qquad
+% K=\operatorname{KDF}(m,c)
+% $$
+% 
+% \textbf{Decapsulation:}
+% $$
+% m'=\operatorname{Decode}\!\left(v-\mathbf{s}^T\mathbf{u}\right)
+% $$
+% 
+% Since
+% $$
+% v-\mathbf{s}^T\mathbf{u}
+% =
+% \operatorname{Encode}(m)
+% +\mathbf{e}^T\mathbf{r}
+% +e_2-\mathbf{s}^T\mathbf{e}_1,
+% $$
+% the message is recovered up to small noise.
+% \end{frame}
+% \end{mayberm}
 
-$$R_q=\mathbb{Z}_q[X]/(X^{256}+1),  A\in R_q^{k\times k}$$
 
-\textbf{Key generation:}
-$$
-\mathbf{s},\mathbf{e}\leftarrow\chi^k,
-\qquad
-\mathbf{t}=A\mathbf{s}+\mathbf{e}
-$$
+% \begin{frame}{Recall: Sigma protocol over elliptic curve}
+% \begin{center}
+% \begin{sequencediagram}
+%     \newinst[1]{a}{Alice}
+%     \newinst[3]{b}{Bob}
+%     \mess[0]{a}{$R$}{b}
+%     \mess[2]{b}{$c$}{a}
+%     \mess[2]{a}{$z$}{b}
+%     \mess[0]{b}{$ok$}{a}
+% \end{sequencediagram}
+% \end{center}
+% \end{frame}
 
-$$
-pk=(A,\mathbf{t}),\qquad sk=\mathbf{s}
-$$
 
-\textbf{Encapsulation:}
-$$
-\mathbf{u}=A^T\mathbf{r}+\mathbf{e}_1,
-\qquad
-v=\mathbf{t}^T\mathbf{r}+e_2+\operatorname{Encode}(m)
-$$
+\begin{frame}{Recall: Sigma protocol over elliptic curve}
 
-$$
-c=(\mathbf{u},v),
-\qquad
-K=\operatorname{KDF}(m,c)
-$$
+\scriptsize
 
-\textbf{Decapsulation:}
+\vspace*{-1.0cm}
 $$
-m'=\operatorname{Decode}\!\left(v-\mathbf{s}^T\mathbf{u}\right)
+G \in E(\mathbb{F}_p),
+~~
+\operatorname{ord}(G)=q,
+~~
+\text{pub key}~ Y=xG
 $$
 
-Since
-$$
-v-\mathbf{s}^T\mathbf{u}
-=
-\operatorname{Encode}(m)
-+\mathbf{e}^T\mathbf{r}
-+e_2-\mathbf{s}^T\mathbf{e}_1,
-$$
-the message is recovered up to small noise.
+\begin{columns}[c,onlytextwidth]
+
+\begin{column}{0.27\textwidth}
+
+\vspace*{-1.8cm}
+$$x \in \mathbb{Z}_q, ~ Y=xG$$
+$$r \leftarrow \mathbb{Z}_q, ~~ R=rG$$
+
+$$z=r+cx \pmod q$$
+
+\end{column}
+
+
+\begin{column}{0.35\textwidth}
+
+\hspace*{-1.0cm}
+\scalebox{0.80}{
+\begin{sequencediagram}
+    \newinst[1]{a}{Prover}
+    \newinst[2]{b}{Verifier}
+
+    \mess[0]{a}{$R$}{b}
+    \mess[2]{b}{$c$}{a}
+    \mess[2]{a}{$z$}{b}
+    \mess[0]{b}{$ok$}{a}
+\end{sequencediagram}
+}
+
+\end{column}
+
+\begin{column}{0.33\textwidth}
+
+
+
+% Move only this equation down, without affecting the frame layout
+\raisebox{-1.4cm}[0pt][0pt]{%
+  \makebox[\linewidth][c]{$c \leftarrow \mathbb{Z}_q$}%
+}
+
+
+\vspace*{2.5cm}
+$$zG \stackrel{?}{=} R+cY$$
+
+indeed,
+\begin{align*}
+zG &= (r+cx)G \\
+   &= rG+c(xG) \\
+   &= R+cY
+\end{align*}
+
+\end{column}
+\end{columns}
 \end{frame}
-\end{mayberm}
+
+\begin{frame}{ML-DSA signatures}
+\scriptsize
+
+$$R_q = \mathbb{Z}_q[X]/(X^n+1)$$
 
+\begin{columns}[c,onlytextwidth]
 
-\begin{frame}{ML-DSA signatures}
+\begin{column}{0.27\textwidth}
+% \vspace*{-1.8cm}
+  $$s_1 \leftarrow S^\ell,~ s_2 \leftarrow S^k$$
+  $$\text{public:}~A \leftarrow R_q^{k\times\ell},~ t = As_1+s_2$$
+  $$y_1\leftarrow Y^\ell,~ y_2\leftarrow Y^k$$
+  $$w = Ay_1+y_2$$
+
+  $$z_1=y_1+cs_1,~ z_2=y_2+cs_2$$
+  Reject if $z_1,z_2$ are not short.
+\end{column}
+
+
+\begin{column}{0.35\textwidth}
+
+\hspace*{-1.0cm}
+\scalebox{0.80}{
+\begin{sequencediagram}
+    \newinst[1]{a}{Prover}
+    \newinst[2]{b}{Verifier}
+
+    \mess[0]{a}{$w$}{b}
+    \node[anchor=west] at (6.0,-1.5) {
+	$c\leftarrow C$
+	(in practice, $c = H(M ||w)$)
+    };
+    \mess[2]{b}{$c$}{a}
+    \mess[2]{a}{$z_1,z_2$}{b}
+    % \node[anchor=west] at (7.0,-5.0) {
+    %     $w' = Az_1 + z_2 - ct$
+    % };
+    \mess[0]{b}{$ok$}{a}
+\end{sequencediagram}
+}
+
+\end{column}
+
+\begin{column}{0.33\textwidth}
+
+% Move only this equation down, without affecting the frame layout
+% \raisebox{-1.4cm}[0pt][0pt]{%
+%   \makebox[\linewidth][c]{
+% \vspace*{2.5cm}
+  % $c\leftarrow C$\\
+  % \scriptsize{
+  %   (in practice, $c = H(M ||w)$)
+  % }
+%   }%
+% }
+
+
+\vspace*{2.5cm}
+  \begin{align*}
+    w &\stackrel{?}{=} Az_1+z_2-ct \\
+    &= A(y_1+cs_1)+(y_2+cs_2) \\
+    &~-c(As_1+s_2) \\
+    =A &y_1 +c A s_1 +y_2 +c s_2-cAs_1-cs_2\\
+    &= Ay_1+y_2 = w
+  \end{align*}
+  Accept if $z_1,z_2$ are short.
+
+\end{column}
+\end{columns}
 \end{frame}
 
+
+
+% \begin{frame}{ML-DSA signatures}
+% %%%
+% \vspace{-0.5cm}
+% 
+% 
+% \scriptsize
+% 
+% $$
+% R_q = \mathbb{Z}_q[X]/(X^n+1)
+% $$
+% 
+% \vspace{-0.4cm}
+% 
+% \hspace*{-0.7cm}
+% \begin{tikzpicture}[
+%     >=Latex,
+%     every node/.style={font=\scriptsize},
+% ]
+% 
+% % =========================================================
+% % Headers
+% 
+% \node[anchor=west] at (0,0)
+%   {\textbf{Signer / Prover}};
+% 
+% \node[anchor=west] at (8.3,0)
+%   {\textbf{Verifier}};
+% 
+% % =========================================================
+% % Keys
+% 
+% \node[anchor=west, align=left] at (0,-0.8) {
+%   $s_1 \leftarrow S^\ell,~ s_2 \leftarrow S^k$
+%   \\[1mm]
+%   Public:\\
+%   $A \leftarrow R_q^{k\times\ell},~ t = As_1+s_2$
+% };
+% 
+% \node[anchor=west, align=left] at (8.3,-1.4) {
+%   Public key:\\
+%   $(A,t)$
+% };
+% 
+% \draw[->]
+%   (4.9,-1.5)
+%   --
+%   node[above] {$pk=(A,t)$}
+%   (8.0,-1.5);
+% 
+% % =========================================================
+% % Commitment
+% 
+% \node[anchor=west, align=left] at (0,-2.35) {
+%   Sample short vectors:\\
+%   $y_1\leftarrow Y^\ell,~
+%    y_2\leftarrow Y^k$
+%   \\[1mm]
+%   Compute:\\
+%   $w = Ay_1+y_2$
+% };
+% 
+% \draw[->]
+%   (4.9,-3.05)
+%   --
+%   node[above] {$w$}
+%   (8.0,-3.05);
+% 
+% % =========================================================
+% % Challenge
+% 
+% \node[anchor=west, align=left] at (8.3,-3.25) {
+%   $c\leftarrow C$\\
+%   \scriptsize{
+%     (in practice, $c = H(M ||w)$)
+%   }
+% };
+% 
+% \draw[<-]
+%   (4.9,-3.9)
+%   --
+%   node[above] {$c$}
+%   (8.0,-3.9);
+% 
+% % =========================================================
+% % Response
+% 
+% \node[anchor=west, align=left] at (0,-4.45) {
+%   Compute:\\
+%   $z_1=y_1+cs_1,~
+%    z_2=y_2+cs_2$
+%   \\[1mm]
+%   Reject if $z_1,z_2$ are not short.
+% };
+% 
+% \draw[->]
+%   (4.9,-5.55)
+%   --
+%   node[above] {$z_1,z_2$}
+%   (8.0,-5.55);
+% 
+% % =========================================================
+% % Verification
+% 
+% \node[anchor=west, align=left] at (8.3,-6.0) {
+%   Reconstruct:\\[1mm]
+%   $\begin{aligned}
+%   w'
+%     &= Az_1+z_2-ct \\
+%     &= A(y_1+cs_1)+(y_2+cs_2) \\
+%     &\qquad-c(As_1+s_2) \\
+%     &= Ay_1+y_2 \stackrel{?}{=} w
+%   \end{aligned}$
+%   \\[1mm]
+%   Accept if $z_1,z_2$ are short.
+% };
+% 
+% \end{tikzpicture}
+% 
+% 
+% %%%
+% 
+% \end{frame}
+
 \begin{mayberm}
 \begin{frame}{Falcon signatures}
 \end{frame}
@@ -798,6 +1091,8 @@
 \section[Conclusions]{Conclusions}
 
 \begin{frame}{Benchmarks}
+  % TODO review benchmarks
+
   \centering
   % \small{
   \setlength{\tabcolsep}{4pt}
@@ -815,6 +1110,11 @@ \textbf{Public key size} &
     \textbf{Signature size} \\
     \midrule
 
+    ECDSA-secp256k1
+      & elliptic curves
+      & $33$ B
+      & $64$ B \\
+
     Falcon-512
       & NTRU lattice
       & $897$ B
@@ -834,11 +1134,6 @@ SLH-DSA-128s
       & hash based, stateless
       & $32$ B
       & $7.86$ KB \\
-
-    ECDSA-secp256k1
-      & elliptic curves
-      & $33$ B
-      & $64$ B \\
 
     \bottomrule
     \end{tabular}%