Today’s digital world creates many security and privacy issues. But cryptography, a pillar of cybersecurity, is facing two major challenges.
The first challenge is the threat of quantum computers, fueled by massive investment worldwide, in both the public and private sector.
In 1994, Shor showed that a quantum computer can break the most prevalent forms of public-key cryptography,
namely those relying on the hardness of integer factoring or discrete logarithm:
this type of public-key cryptography is massively deployed,
it is for instance used by e-commerce, passports, downloads of software (such as installation of apps in mobile phones)
and bitcoins.
The second challenge is new requirements, such as in big data, IoT, or crypto-currencies. Because classical cryptographic primitives no longer suffice for these settings, novel cryptographic schemes and functionalities have been developed,
such as encryption schemes allowing to compute on encrypted data. But these benefits come at the cost of security uncertainty: most of these schemes require more risky hardness assumptions and make it more difficult to select parameters with confidence.
Lattices are mathematical objects which have emerged as a key technique to respond to these two challenges:
three of the four NIST post-quantum cryptography standards (selected recently in July 2022) are based on lattices, including the two main standards Kyber and Dilithium;
and all the proposals for fully-homomorphic encryption standardization rely on the hardness of lattice problems.
Furthermore, due to performance reasons, one often relies on special forms of lattices arising from algebraic number theory:
this creates additional security risks, because these special properties may make the underlying problems easier.
In fact, there are results showing that some special lattices are easier to attack than the general case.
This proposal aims at answering the main security questions surrounding lattice-based cryptography.
Are lattice problems really hard, even against quantum computers and massively-parallel computing platforms?
What are the best parallel and quantum algorithms for lattice problems? Can we estimate their cost?
How should we select parameters for lattice-based cryptography?
Several security estimates have been proposed in the past for lattice-based cryptography,
especially during the NIST standardization of post-quantum cryptography,
but the accuracy and the methodology of such estimates is debatable.
