\documentclass[10pt]{article}

\usepackage[margin=0.75in]{geometry}
\usepackage{upquote}
\input{latexdefs}

\begin{document}

\newlength{\boxwidth}
\setlength{\boxwidth}{\textwidth}
\addtolength{\boxwidth}{-1cm}
\noindent\framebox[\textwidth]{
\begin{minipage}[t]{\boxwidth}
  {\bf CS 395T: Topics in Cryptography \hfill Spring 2022}  \\ [-0.3cm]
  \begin{center} 
    {\Large Problem Set 1}
  \end{center}
  {\bf Due:} March 11, 2022 at 11:59pm (Submit on Gradescope) \hfill
  {\bf Instructor:} David Wu
\end{minipage}}

\paragraph{Instructions.} You {\bf must} typeset your
solution in LaTeX using the provided template:
\begin{center}
  \url{https://www.cs.utexas.edu/~dwu4/courses/sp22/static/homework.tex}
\end{center}
You must submit your problem set
via \href{https://gradescope.com/}{Gradescope} (accessible through 
\href{https://canvas.utexas.edu/}{Canvas}).

\paragraph{Collaboration Policy.} You may discuss your general approach
with other students, but you may not share written
documents. You should not search online for solutions to these problems.
If you do consult external sources, you must cite them in your submission.
You must include the names of all of your collaborators with your submission.
Refer to the \href{https://www.cs.utexas.edu/~dwu4/courses/sp22/info.html}{official course policies}
for the full details.

\paragraph{Instructions.} We will add problems to the problem set throughout the
semester (roughly 1 problem each week), with the last problem added at least a
week in advance of the due date. All problems are weighted equally. You
should submit solutions to at least 70\% of the problems (rounded down). If you
submit solutions to more than 70\% of the problems, we will drop the
lowest-scoring problems when computing your final homework score.

\problem{SIS and Inhomogeneous SIS}
Let $n, q, \beta$ be lattice parameters where $q$ is prime and $m, \beta = \poly(n)$.
Show that the $\SIS_{n, m + 1, q, \beta}$ assumption
implies the $\ISIS_{n, m, q, \beta'}$ assumption, where $\beta \ge \sqrt{1 + (\beta')^2}$.
You may treat the lattice
dimension $n$ as the security parameter. Both $\SIS$ and $\ISIS$ are defined
with respect to the $\ell_2$ norm.

\medskip

\noindent Alternatively, show that hardness of
$\ISIS_{n, m, q, \beta}$ implies hardness of $\SIS_{n, m + 1, q, \beta}$.

\medskip

\noindent For this problem,
you only need to show {\bf one} of the above statements. The second statement is
more interesting, but a bit more challenging to prove.

\problem{GPV Signatures}
Recall the general structure of the
Gentry-Peikert-Vaikuntanathan signature scheme from lecture:
\begin{itemize}[noitemsep]
  \item The verification key is a random matrix $\Am \getsr \Zq^{n \times m}$
  and the signing key is a short basis $\Bm$ for $\calL^{\perp}(\Am)$.

  \item To sign a message $\mu \in \zo^*$, compute $\yv \gets H(\mu) \in \Zq^n$,
  where $H \colon \zo^* \to \Zq^n$ is modeled as a random oracle. Using
  $\Bm$, sample $\xv \gets D_{\calL_{\yv}^{\perp}(\Am), s}$. Output the signature $\xv \in \Zq^m$.

  \item To verify a signature $\xv$ on the message $\mu$, check that $\norm{\xv} \le \beta$
  and $\Am \xv = H(\mu)$.
\end{itemize}
Here, $n$ is the lattice dimension (the security parameter), $q = \poly(n)$,
$m = \Theta(n \log q)$, $s = \| \tilde \Bm \| \cdot \omega(\sqrt{\log n})$,
and $\beta = s \cdot \poly(\log n)$. Here $\tilde \Bm$ is the Gram-Schmidt
basis associated with $\Bm$. You can also use the fact that $\norm{\tilde \bv_i} \le \norm{\bv_i}$
for all $i$.

\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Show that the above signature scheme is {\em insecure} as described. Specifically,
  sketch an efficient attack (with a high-level explanation) 
  that breaks unforgeability of the signature scheme. An {\em informal}
  sketch is sufficient, and you may assume that there is sufficient
  slack in the choice of the norm bound
  $\beta$ (as is often the case). You do {\em not} need to include a precise analysis of
  the parameters or of the adversary's advantage in your description.

  \item Describe {\em in one sentence} how to modify the scheme to prevent your attack above (and
  obtain a secure signature scheme).
  Justify your defense {\em in one sentence}. Your modification should be a simple modification to
  the above construction (there are multiple correct approaches).
\end{enumerate}

\problem{Trapdoor Extension}
Let $\Am \in \Zq^{n \times m}$ and let $\Rm \in \zo^{m \times k}$ such that
$\Am \Rm = \Gm$. We showed in lecture
(see also this \href{https://www.cs.utexas.edu/~dwu4/courses/sp22/static/sampling.pdf}{summary})
that we can use the trapdoor $\Rm$ to sample from a distribution that is statistically
close to the discrete Gaussian distribution
$D_{\calL^{\perp}_{\uv}(\Am), s}$ for sufficiently large $s = \poly(n, \log q)$
and any $\uv \in \Zq^n$. Take any matrix $\Am_f \in \Zq^{n \times m'}$, and let
$\bar \Am = [\Am ~|~ \Am_f]$. Show how to use $\Rm$ to efficiently
sample from a distribution that is statistically close to $D_{\calL^{\perp}_{\uv}(\bar \Am), s}$.
Prove the correctness of your algorithm (and that it samples from the correct distribution).
This type of trapdoor extension will be a very useful building block for constructing
advanced cryptographic primitives.

\problem{Regev Encryption}
In lecture, we described Regev encryption in the setting where the message is encoded in the
{\em most significant bits} of the ciphertext. Here, we will consider a variant
where the message is encoded in the {\em least significant bits} of the ciphertext. For simplicity,
we will just consider the symmetric setting (but everything generalizes to the public-key setting in the
manner described in lecture). Let the message space be $\Zp$, $n$ be the lattice dimension,
$q$ be the modulus, and $\chi$ be the error
distribution. Suppose that $\gcd(p, q) = 1$. Note that $p$ and $q$ need {\em not} be prime here.
\begin{itemize}[noitemsep]
  \item The secret key is a vector $\sv \getsr \Zq^n$.

  \item To encrypt a message $\mu \in \Zp$, sample $\av \getsr \Zq^n$ and $e \gets \chi$,
  and output the ciphertext
  $\ct = (\av, \sv^\TT \av + p e + \mu)$.
\end{itemize}
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Given a ciphertext $\ct$ and the secret key $\sv$, describe the decryption algorithm.
  Prove correctness of the encryption scheme with your choice of decryption algorithm.
  You may assume that $\Pr[e \gets \chi : |e| < q/(2p) - 1] = 1$.

  \item Show that under the $\mathsf{LWE}_{n, q, \chi}$ assumption, the above encryption scheme is
  semantically secure. (Technically, it is CPA-secure under the LWE assumption, but you do not
  have to show this.)
\end{enumerate}

\problem{Key Switching and FHE}
In this problem, we will develop another approach to extend Regev encryption to FHE.
The advantage of this scheme over GSW is that ciphertexts are {\em vectors} rather than matrices.
Let $n$ be the lattice dimension, $q$ be an {\em odd} modulus, and $\chi$ be a $B$-bounded
distribution over $\Z_q$ (where $B = \poly(n, \log q)$).
Let $\sv^\TT = [-\tilde \sv^\TT ~|~ 1] \in \Zq^{n + 1}$ be a secret
key for a Regev encryption scheme. Similar to the previous problem, we will encode the message
in the {\em least} significant bit of the ciphertext. Namely, we say that $\cv \in \Zq^{n + 1}$
is an encryption of $\mu \in \zo$ if $\sv^\TT \cv = \mu + 2 e$ for some small $e$.
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Let $\tv^\TT = [-\tilde \tv^\TT ~|~ 1] \in \Zq^{n' + 1}$ for some $n' = \poly(n)$.
  Your goal in this problem is to construct a method that {\em publicly} translates
  a ciphertext encrypted under $\sv$ to a ciphertext under $\tv$. We decompose this into
  two algorithms:
  \begin{itemize}
    \item $\Setup(\sv, \tv) \to \pp$: On input $\sv \in \Zq^{n + 1}$ and $\tv \in \Zq^{n' + 1}$, the setup
    algorithm outputs a set of ``key-switching'' parameters $\pp$.

    \item $\KeySwitch(\pp, \cv) \to \cv'$: On input the key-switching parameters
    $\pp$ and a ciphertext $\cv \in \Zq^{n + 1}$, the key-switching algorithm outputs a new ciphertext
    $\cv' \in \Zq^{n' + 1}$.
  \end{itemize}
  Construct efficient algorithms $(\Setup, \KeySwitch)$ that satisfy the following requirements:
  \begin{itemize}
    \item If $\cv$ is an encryption of $\mu$ with error $e$ under secret key $\sv$, then
    $\KeySwitch(\pp, \cv)$ outputs a new ciphertext $\cv'$ that is an encryption of
    $\mu$ under secret key $\tv$ with error $e'$ where $|e'| \le |e| + \poly(n, \log q)$.

    \item If $\sv, \tv$ are sampled uniformly, then
    the public parameters $\pp$ output by $\Setup$ are
    pseudorandom under the \ms{LWE} assumption (i.e., they are computationally indistinguishable
    from uniform).
  \end{itemize}
  Prove that your scheme satisfies {\em both} of the above properties. Taken together, the
  above properties allows one to transform a ciphertext $\cv$ under $\sv$ to one under $\tv$
  without compromising semantic security of $\cv$. {\bf Hint:} Try setting the
  key-switching parameter to be an encryption of a (carefully-chosen) function of $\sv$ under $\tv$.

  \item Suppose you have two Regev ciphertexts $\cv_1, \cv_2$ encrypting $\mu_1$ and $\mu_2$
  under $\sv \in \Zq^{n + 1}$ with error magnitude at most $e$.
  Using the key-switching procedure defined above, show how to publicly and efficiently
  compute a Regev encryption $\cv_\times$
  of the product $\mu_1 \mu_2$ under a suitably-chosen target key $\tv \in \Zq^{n + 1}$.
  Note that $\sv$ and $\tv$ have the {\em same} dimension. The error in $\cv_\times$ should
  be bounded by $O(e^2) + \poly(n, \log q)$. In this setting, the public parameters for the key-switching
  algorithm would be included as part of the public key. Semantic security of the encryption scheme
  should still reduce to the \ms{LWE} assumption. {\bf Hint:} You may use the identity
  that for all vectors $\uv_1, \vv_1, \uv_2, \vv_2 \in \Zq^n$,
  $(\uv_1 \otimes \uv_2)^\TT (\vv_1 \otimes \vv_2) = (\uv_1^\TT \vv_1)(\uv_2^\TT \vv_2)$.
  Here $\uv \otimes \vv \in \Zq^{n^2}$ denotes the vector that consists of all pairwise products
  $u_i v_j$ for $i, j \in [n]$.

  \item In {\em one} sentence, explain how you can extend the above procedure to support
  any (bounded) number of multiplications. You may make a circular security assumption.
\end{enumerate}

\problem{Homomorphic Signatures from SIS}
Recall the homomorphic signature scheme from lecture. The verification key $\vk$
consists of matrices $\Am, \Bm_1, \ldots, \Bm_\ell$ and the signing key is a trapdoor
$\td$ for $\Am$. A signature on $x \in \zo^\ell$ consists of short matrices
$\Rm_1, \ldots, \Rm_\ell$ where $\Am \Rm_i = \Bm_i - x_i \Gm$ for all $i \in [\ell]$. In lecture,
we showed that this scheme was (selectively) secure under the LWE assumption.
In this problem, show that it also suffices
to base hardness on $\SIS_{n, m, q, \beta}$, for some choice of
$m = \Theta(n \log q)$, $\beta = m^{O(d)}$, and $q = m^{O(d)}$. Here, $d$ is a bound
on the (multiplicative) depth of the circuits supported by the homomorphic signature scheme.

\problem{Adaptively-Secure Homomorphic Signatures}
The homomorphic signature scheme from lecture (see also the previous problem) was only proven to be
selectively secure. Show how to compose the homomorphic signature scheme with a {\em vanilla}
signature scheme to obtain a scheme that is {\em adaptively} secure under the {\em same} hardness
assumption as the base homomorphic signature scheme
(i.e., no complexity leveraging). Prove the adaptive single-message security of your scheme.

\paragraph{Optional Feedback.} Please answer the following
{\em optional} questions to help us design future problem sets.
You do not need to answer these questions.
However, we do encourage you to provide us feedback on how to improve the
course experience.
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item How long did you spend on this problem set?
  
  \item What was your favorite problem on this problem set? Why?

  \item What was your least favorite problem on this problem set? Why?

  \item Do you have any other feedback for this problem set?

  \item Do you have any other feedback on the course so far?

  \item Are there specific topics that you are interested in seeing in the second half of the course?
\end{enumerate}

\end{document}
