A Reduction Theory for Codes and Lattices in Cryptography

Informazioni relative al progetto

ARTICULATE

ID dell’accordo di sovvenzione: 947821

DOI

10.3030/947821

Progetto chiuso

Data della firma CE 14 Ottobre 2020

Data di avvio 1 Gennaio 2021

Data di completamento 31 Dicembre 2025

Finanziato da

• EXCELLENT SCIENCE - European Research Council (ERC)

Costo totale

€ 1 497 888,00

Contributo UE

€ 1 497 888,00

Coordinato da

STICHTING NEDERLANDSE WETENSCHAPPELIJK ONDERZOEK INSTITUTEN
Netherlands

Periodic Reporting for period 4 - ARTICULATE (A Reduction Theory for Codes and Lattices in Cryptography)

Periodo di rendicontazione: 2025-07-01 al 2025-12-31

Sintesi del contesto e degli obiettivi generali del progetto

Cryptography secures digital communications and data authentication, underpinning systems such as online payments and website connections. Current cryptographic protocols rely on mathematical problems that could eventually be broken by quantum computers, motivating the ongoing transition toward quantum-safe cryptography.

This project studies two mathematical structures suitable for post-quantum cryptography: linear codes and Euclidean lattices. It investigates their security through cryptanalysis, develops methods to better estimate attack costs, and explores foundational hardness questions from both mathematical and complexity-theoretic perspectives. The project also designs improved cryptographic constructions based on these objects.

A central aspect of the project is the joint study of codes and lattices, which share strong geometric similarities and are both used for error correction. By transferring ideas between the two fields, the project aims both to strengthen confidence in existing schemes and to discover new cryptographic constructions.

The bulk of research executed in this project has lead to many qualitative and quantitative conclusion regarding the concrete security of various post-quantum cryptographic schemes. This include discovery of further weaknesses in NTRU-overstreched lattices, cyclotomic module-lattices of non power-of-two conductors, SIS lattices with small modulus, etc... One of our last contribution is a proof-of-concept implementation of lattice reduction based on Linear Algebra subroutine, severely outperforming existing software in ranges of interest. This demonstrated that the lattice software inherited from the 90's deserve a complete re-design to better fit modern computer architecture.

The project also took an unexpected direction, with the invention of the Lattice Isomorphism Problem (LIP) framework for designing better lattice-based schemes. Our conclusion is that, paired with algebraic structure, LIP offers a very efficient and convenient design for lattice-based signature, resolving implementation difficulty of prior designs.

Lavoro eseguito dall’inizio del progetto fino alla fine del periodo coperto dalla relazione e principali risultati finora ottenuti

A first major result was a practical breakthrough in lattice cryptanalysis through the adaptation of leading algorithms to modern GPUs and tensor cores. By reformulating core attack routines as low-precision linear algebra operations, we solved lattice challenges up to dimension 180, improving previous records by roughly a factor of 100 in time and energy efficiency.

The project also advanced exchanges between code- and lattice-based techniques. We developed an adaptation of the LLL algorithm for linear codes, providing new geometric insight into code attacks. In parallel, we conducted a systematic comparison of smoothing techniques for codes and lattices, leading to improved and in some cases optimal smoothing bounds for random instances.

A major unforeseen direction emerged from comparing code- and lattice-based cryptosystems. Unlike code-based cryptography, lattices lacked a robust analogue of the McEliece cryptosystem. We identified the Lattice Isomorphism Problem (LIP) as the appropriate foundation and proposed a general framework enabling the use of highly structured lattices for efficient cryptography. This led to the design of the HAWK signature scheme, notable for its simplicity and strong performance among post-quantum signatures.

The above result was the opportunity of exploitation at a global scale: we submitted HAWK to the NIST on-ramp standardization call and it was selected for the second evaluation round. This involves writing a detailed specification document, and providing a high-quality optimized implementation. Shall HAWK be eventually selected as a standard, it would then become a critical piece of software for billions of connected devices worldwide.

As for dissemination, beyond many publication at top conferences we also publicly released several open-source software as research artifact, that successfully spurred follow-up research. For example our GPU-tensor-core implementation has been re-used and extended by other teams to reach further records, up to dimension 200. Our estimator for NTRU-overstretched was also used to design NTRU-based Fully Homomorphic Encryption schemes.

Progressi oltre lo stato dell’arte e potenziale impatto previsto (incluso l’impatto socioeconomico e le implicazioni sociali più ampie del progetto fino ad ora)

The project significantly advanced the state of the art in several directions.

Regarding cryptanalytic implementation, we showed early how to exploit the full potential of tensor-core hardware present in modern GPU to perform a core cryptanalytic task (lattice sieving), although future gains are now limited by memory constraints. At the end of the project we also demonstrated significant gains on a lesser optimized part, namely LLL itself, whose precise performance matter little in theory but a lot in practice.

The transfer of techniques between lattices and codes also produced important progress, notably through the adaptation of LLL and the exchange of smoothing methods. While no major cryptanalytic breakthroughs have yet emerged for codes, ongoing work aims either to improve attacks or to confirm the completeness of current approaches.

The new smoothing bounds also clarified recent claims of improved attacks against standardized schemes such as KYBER and DILITHIUM. Our results showed that the heuristic assumptions underlying these dual-sieve attacks fail in the relevant regime, a conclusion also supported experimentally. We followed-up on this work to provide a sound methodology to study and predict the success probability of these dual-sieve attacks. While still heuristic, this new methodology is this time experimentally validated.

The project has also lead to better understanding of many "corner cases" lattice in cryptanalysis, including the NTRU-overstrechted lattices, SIS lattices with small modulus, SIS lattices with the max-norm. The most surprising result of this class may be the cryptanalytic study of cyclotomic module-lattices of non power-of-two conductors, where we showed a sub-exponential security gap with unstructured lattices; while non-devastating this result should question the concrete security of the Korean lattice-based PQC standard NTRU+, and other concrete FHE schemes.

Another significant achievement -- this time regarding cryptographic design rather than cryptanalysis -- is the successful foundation of cryptographic scheme on the Lattice Isomorphism Problem (LIP), and the concrete proposal HAWK that followed. HAWK has been submitted to the NIST on-ramp PQC standardization process, and has passed the first round of selection.

lip.png