Improved Reduction Between SIS Problems Over Structured Lattices

• Published in: IEEE access 2021, Vol.9, p.157083-157092
• Main Authors: Koo, Zahyun, Lee, Yongwoo, Lee, Joon-Woo, No, Jong-Seon, Kim, Young-Sik
• Format: Article
• Language: English
• Subjects: Cryptography; Elliptic curve cryptography; Lattice-based cryptography; Lattices; learning with error (LWE); module-short integer solution (M-SIS) problem; Modules; Reduction; ring-short integer solution (R-SIS) problem; short integer solution~(SIS) problem; Standardization; Structural rings; Upper bound
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2021.3128139

Many lattice-based cryptographic schemes are constructed based on hard problems on an algebraic structured lattice, such as the short integer solution (SIS) problems. These problems are called ring-SIS (R-SIS) and its generalized version, module-SIS (M-SIS). Generally, it has been considered that problems defined on the module lattice are more difficult than the problems defined on the ideal lattice. However, Koo, No, and Kim showed that R-SIS is more difficult than M-SIS under some norm constraints of R-SIS. However, this reduction has problems in that the rank of the module is limited to about half of the instances of R-SIS, and the comparison is not performed through the same modulus of R-SIS and M-SIS. In this paper, we propose the three reductions. First, we show that R-SIS is more difficult than M-SIS with the same modulus and ring dimension under some constraints of R-SIS. Also, we show that through the reduction from M-SIS to R-SIS with the same modulus, the rank of the module is extended as much as the number of instances of R-SIS from half of the number of instances of R-SIS compared to the previous work. Second, we show that R-SIS is more difficult than M-SIS under some constraints, which is tighter than the M-SIS in the previous work. Finally, we propose that M-SIS with the modulus prime q^{k} is more difficult than M-SIS with the composite modulus c , such that c is divided by q . Through the three reductions, we conclude that R-SIS with the modulus q is more difficult than M-SIS with the composite modulus c .