**On Basing Search SIVP on NP-Hardness**

*Tianren Liu*

**Abstract: **The possibility of basing cryptography on the minimal assumption $\textbf{NP}\nsubseteq \textbf{BPP}$ is at the very heart of textbflexity-theoretic cryptography. The closest we have gotten so far is lattice-based cryptography whose average-case security is based on the worst-case hardness of approximate shortest vector problems on integer lattices. The state-of-the-art is the construction of a one-way function (and collision-resistant hash function) based on the hardness of the $\tilde{O}(n)$-approximate shortest independent vector problem $\textsf{SIVP}_{\tilde O(n)}$.

Although $\textsf{SIVP}$ is \textbf{NP}-hard in its exact version, Guruswami et al (CCC 2004) showed that $\textsf{gapSIVP}_{\sqrt{n/\log n}}$ is in $\textbf{NP} \cap \textbf{coAM}$ and thus unlikely to be $\textbf{NP}$-hard. Indeed, any textsfuage that can be reduced to $\textsf{gapSIVP}_{\tilde O(\sqrt n)}$ (under general probabilistic polynomial-time adaptive reductions) is in $\textbf{AM} \cap \textbf{coAM}$ by the results of Peikert and Vaikuntanathan (CRYPTO 2008) and Mahmoody and Xiao (CCC 2010). However, none of these results apply to reductions to {\em search problems}, still leaving open a ray of hope: {\em can $\textbf{NP}$ be reduced to solving search SIVP with approximation factor $\tilde O(n)$?}

We show that any textsfuage that can be reduced to solving search $\textsf{SIVP}$ with approximation factor $\tilde O(n)$ lies in \textbf{AM} intersect \textbf{coAM}, eliminating the possibility of basing current constructions on \textbf{NP}-hardness.

**Category / Keywords: **foundations, separation

**Date: **received 16 Sep 2016, last revised 1 Oct 2016

**Contact author: **liutr at mit edu

**Available format(s): **PDF | BibTeX Citation

**Note: **The intro is rewritten for eurocrypt

**Version: **20161001:074240 (All versions of this report)

**Short URL: **ia.cr/2016/906

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]