Improved Reduction Between SIS Problems Over Structured Lattices

Abstract

Many lattice-based cryptographic schemes are constructed based on hard problems on an algebraic structured lattice, such as the short integer solution (SIS) problems. These problems are called ring-SIS (R-SIS) and its generalized version, module-SIS (M-SIS). Generally, it has been considered that problems defined on the module lattice are more difficult than the problems defined on the ideal lattice. However, Koo, No, and Kim showed that R-SIS is more difficult than M-SIS under some norm constraints of R-SIS. However, this reduction has problems in that the rank of the module is limited to about half of the instances of R-SIS, and the comparison is not performed through the same modulus of R-SIS and M-SIS. In this paper, we propose the three reductions. First, we show that R-SIS is more difficult than M-SIS with the same modulus and ring dimension under some constraints of R-SIS. Also, we show that through the reduction from M-SIS to R-SIS with the same modulus, the rank of the module is extended as much as the number of instances of R-SIS from half of the number of instances of R-SIS compared to the previous work. Second, we show that R-SIS is more difficult than M-SIS under some constraints, which is tighter than the M-SIS in the previous work. Finally, we propose that M-SIS with the modulus prime $q^{k}$ is more difficult than M-SIS with the composite modulus $c$ , such that $c$ is divided by $q$ . Through the three reductions, we conclude that R-SIS with the modulus $q$ is more difficult than M-SIS with the composite modulus $c$ .

Keywords

• Lattice-based cryptography
• learning with error (LWE)
• module-short integer solution (M-SIS) problem
• ring-short integer solution (R-SIS) problem
• short integer solution~(SIS) problem