Cryptology ePrint Archive: Report 2016/906

On Basing Search SIVP on NP-Hardness

Tianren Liu

Abstract: The possibility of basing cryptography on the minimal assumption $\textbf{NP}\nsubseteq \textbf{BPP}$ is at the very heart of textbflexity-theoretic cryptography. The closest we have gotten so far is lattice-based cryptography whose average-case security is based on the worst-case hardness of approximate shortest vector problems on integer lattices. The state-of-the-art is the construction of a one-way function (and collision-resistant hash function) based on the hardness of the $\tilde{O}(n)$-approximate shortest independent vector problem $\textsf{SIVP}_{\tilde O(n)}$.

Although $\textsf{SIVP}$ is \textbf{NP}-hard in its exact version, Guruswami et al (CCC 2004) showed that $\textsf{gapSIVP}_{\sqrt{n/\log n}}$ is in $\textbf{NP} \cap \textbf{coAM}$ and thus unlikely to be $\textbf{NP}$-hard. Indeed, any textsfuage that can be reduced to $\textsf{gapSIVP}_{\tilde O(\sqrt n)}$ (under general probabilistic polynomial-time adaptive reductions) is in $\textbf{AM} \cap \textbf{coAM}$ by the results of Peikert and Vaikuntanathan (CRYPTO 2008) and Mahmoody and Xiao (CCC 2010). However, none of these results apply to reductions to {\em search problems}, still leaving open a ray of hope: {\em can $\textbf{NP}$ be reduced to solving search SIVP with approximation factor $\tilde O(n)$?}

We show that any textsfuage that can be reduced to solving search $\textsf{SIVP}$ with approximation factor $\tilde O(n)$ lies in \textbf{AM} intersect \textbf{coAM}, eliminating the possibility of basing current constructions on \textbf{NP}-hardness.

Category / Keywords: foundations, separation

Date: received 16 Sep 2016, last revised 1 Oct 2016

Contact author: liutr at mit edu

Available format(s): PDF | BibTeX Citation

Note: The intro is rewritten for eurocrypt

Short URL: ia.cr/2016/906

[ Cryptology ePrint archive ]