[Paper Review] Algorithms on Ideal over Complex Multiplication order

Paul Kirchner|arXiv (Cornell University)|Feb 29, 2016

Coding theory and cryptography25 references3 citations

TL;DR

This paper extends the Gentry-Szydlo algorithm to complex multiplication (CM) orders and more general algebraic structures, enabling polynomial-time solutions for ideal equality testing, generator finding, norm equations, and principal ideal reduction. The key contribution is a provably polynomial-time algorithm to recover a generator of a polarized ideal and to solve bounded distance decoding with approximation factor $ n^{O(\log \log n)} $, significantly generalizing prior results on cyclotomic orders.

ABSTRACT

We show in this paper that the Gentry-Szydlo algorithm for cyclotomic orders, previously revisited by Lenstra-Silverberg, can be extended to complex-multiplication (CM) orders, and even to a more general structure. This algorithm allows to test equality over the polarized ideal class group, and finds a generator of the polarized ideal in polynomial time. Also, the algorithm allows to solve the norm equation over CM orders and the recent reduction of principal ideals to the real suborder can also be performed in polynomial time. Furthermore, we can also compute in polynomial time a unit of an order of any number field given a (not very precise) approximation of it. Our description of the Gentry-Szydlo algorithm is different from the original and Lenstra- Silverberg's variant and we hope the simplifications made will allow a deeper understanding. Finally, we show that the well-known speed-up for enumeration and sieve algorithms for ideal lattices over power of two cyclotomics can be generalized to any number field with many roots of unity.

Motivation & Objective

• To generalize the Gentry-Szydlo algorithm from cyclotomic orders to complex multiplication (CM) orders and broader algebraic structures.
• To enable polynomial-time testing of equality in the polarized ideal class group and recovery of generators for such ideals.
• To solve the norm equation and reduce principal ideals to their real suborders in polynomial time.
• To compute units of any number field from a coarse approximation, using a novel approach to the Gentry-Szydlo framework.
• To accelerate shortest vector and sieve algorithms in ideal lattices by leveraging roots of unity in any number field.

Proposed method

• Adapts the Gentry-Szydlo algorithm to CM orders using a split CM order structure and norm-based reduction via $ x \mapsto x\overline{x} $.
• Employs LLL-based lattice reduction on the norm of ideal generators to recover $ v $ from $ v\overline{v} $, even with noisy approximations.
• Uses sampling from a distribution $ \mathcal{D} $ over a number field to recover $ v\mu(\mathcal{O}) $ via average norm estimation and Chebyshev concentration bounds.
• Applies Babai's nearest plane algorithm on truncated ideals to decode $ v^e $ and recover $ v $ using small prime ideals with $ p-1 \mid e $.
• Leverages the structure of the unit lattice and complex logarithm embeddings to bound approximation error to $ n^{-O(\log \log n)} $.
• Reduces the dimension of the lattice by half via real suborder reduction, enabling faster shortest vector search.

Experimental results

Research questions

• RQ1 Can the Gentry-Szydlo algorithm be extended beyond cyclotomic orders to CM orders and more general algebraic structures?
• RQ2 Is equality testing in the polarized ideal class group decidable in polynomial time for CM orders?
• RQ3 Can the norm equation be solved efficiently over CM orders using algebraic techniques?
• RQ4 Can units be recovered from coarse approximations in polynomial time across any number field?
• RQ5 Can the speed-up in ideal lattice algorithms (e.g., for shortest vector) be generalized to any number field with many roots of unity?

Key findings

• The paper proves that equality in the polarized ideal class group can be tested in polynomial time under GRH or with randomness, and a generator $ v $ can be recovered for any ideal $ (I, r) $ such that $ r = v\overline{v} $.
• The norm equation over CM orders can be solved in polynomial time using the extended Gentry-Szydlo framework.
• Principal ideals over CM orders can be reduced to their real suborders in polynomial time, enabling attacks on FHE and multilinear map schemes.
• A unit $ u $ can be recovered from a $ n^{-O(\log \log n)} $-approximation of $ u\overline{u} $ in polynomial time, using lattice reduction on the norm lattice.
• The Gentry-Szydlo algorithm is generalized to any number field with many roots of unity, accelerating shortest vector and sieve algorithms by a polynomial factor.
• Bounded distance decoding over the unit lattice can be solved in polynomial time with approximation factor $ n^{O(\log \log n)} $, under a heuristic assumption.