# 数学代写|密码学代写cryptography theory代考|CS709

## 数学代写|密码学代写cryptography theory代考|DIFFIE-HELLMAN

We have used the Diffie-Hellman problem and its variants as examples. One question about reductions remain, however. Does there exist a reduction from the discrete logarithm problem to the Diffie-Hellman problem? Suprisingly, the answer is yes in some cases.

Let $G$ be a cyclic group of prime order $p$ with generator $g$. Define $\boxplus$ : $G \times G \rightarrow G$ by $x \boxplus y=x y$, and $\square: G \times G \rightarrow G$ by $x \square y=x^{\log _g y}$. Then $\mathbb{K}=(G, \boxplus, \square)$ is a finite field with $p$ elements, and hence isomorphic to $\mathbb{F}_p$.
Exercise 6.15. Show that the isomorphism $\mathbb{K} \rightarrow \mathbb{F}_p$ is given by $\log _g$, while its inverse is the map $a+\langle p\rangle \mapsto g^a$.

When we think of an element $x \in G$ as an element in $\mathbb{K}$, we shall denote it by $[x]$. Suppose we have an integer $k$ such that $[x]=[y]^k$ in $\mathbb{K}$. Then mapping the relation to $\mathbb{F}_p$, we get that
$$\log _g x \equiv\left(\log _g y\right)^k \quad(\bmod p) .$$
If we happen to know $\log _g y$, we can compute $\log _g x$.
So far, this is not actually interesting. However, suppose we have access to an oracle that on input of $(x, y)$ outputs $x^{\log _g y}$. This means that $\mathbb{K}$ is not just an imagined mathematical structure, but a mathematical structure we can actually compute in. We compute the addition as $[x] \boxplus[y]=[x y]$ and use the oracle to compute multiplications $[x] \longrightarrow[y]$.

So how would we find the relation $[x]=[y]^k$ ? Recall that $\mathbb{K}^$ is a cyclic group, so in particular any of the generic discrete logarithm algorithms we studied in Section $2.2$ could work. In particular, if $p-1$ has no large prime divisors, Pohlig-Hellman in combination with Shanks’ BSGS or Pollard’s rho method would work well. To find the relation, all we need to do is find a generator $[y]$ for $\mathbb{K}^$ and compute $\log _{[y]}[x]$.

Exercise 6.16. Let $G$ be a group of prime order $p$ with generator $g$, where $p \approx 2^{256}$. Suppose also that $p-1$ is square-free and has no prime divisor larger than $2^8$.

Estimate how many multiplications in $\mathbb{K}^$ are required to compute discrete logarithms in $\mathbb{K}^$.

Suppose we have a $2^{60}$-solver for $\mathrm{CDH}_{G, g}$ that always outputs the correct answer. Estimate the time cost of computing a discrete logarithm using the reduction from DLog to $\mathrm{CDH}$.

## 数学代写|密码学代写cryptography theory代考|LATTICE PROBLEMS

We defined a number of problems related to lattices in Sections $3.5$ and $3.6$. While these are fundamentally important, we shall only consider the problem we will actually use in the design and analysis of cryptosystems.

Learning With Errors We first introduced the learning with errors problem in Section 3.6.2, related to $q$-ary lattices. There is very strong evidence that this problem is hard, even against adversaries who can do large quantum computations. (Essentially, it is possible to turn a solver for learning with errors into a solver for fundamental problems related to lattices. We shall not explore these results.)

Example 6.13. Let $q$ be a prime, $\chi_s$ a probability space on $\mathbb{F}_q^l$ and $\chi$ a probability space on $\mathbb{F}_q^n$. The (search) learning with errors (LWE) problem has instance set $\mathbb{F}_q^{n \times l} \times \mathbb{F}_q^n$ and answer set $\mathbb{F}_q^l$. The sampling algorithm samples
There is a large number of parameters in the LWE problem, including the prime $q$, the two dimensions $n$ and $l$, and the exact shape of the two probability distributions. Their relationship with the difficulty of solving LWE is quite complicated. Also, there are sometimes functional requirements on the parameters as well.

As usual, there is also a decision variant of the learning problem. We shall phrase this in terms of a sampling oracle problem.

Example 6.14. Let $q$ be a prime, $\chi_s$ a probability space on $\mathbb{F}q^l$ and $\chi$ a probability space on $\mathbb{F}_q$. The decision learning with errors problem $\operatorname{LWE}{q, l, \chi}, \chi$ provides the solver with the following oracle: Initially, it samples $\beta \stackrel{r}{\leftarrow}{0,1}$ and $\mathrm{b} \stackrel{r}{\longleftarrow} \chi_s$. When it is asked for a sample, the oracle samples $\mathrm{g} \leftarrow \mathbb{F}_q^l, f \stackrel{ }{ }{ }^{\Gamma} \chi$ and $y_1 \leftarrow \mathbb{F}_q$, computes $y_0 \leftarrow \mathbf{g} \cdot \mathbf{b}+f$, and returns ( $\left(\mathrm{g}, y_b\right)$. The answer is $\beta$.
Observe that this sampling formulation reveals the rows of $\mathrm{G}$ and the coordinates of $\mathrm{y}$ one by one.

Under some circumstances, the decision LWE problem reduces to the search LWE problem. In particular, this means that variants of LWE that make decision oracles available are often easy.

One way to change the LWE problem is to add structure to the matrix $\mathrm{G}$. This has the advantage that the matrix description requires less space and some computational operations are faster. In principle, the added structure may make the problems easier, but this seems not to be the case when the problems are properly tuned.

We add structure by working over a ring $\mathbb{F}_q[X] /\langle f(X)\rangle$ for some polynomial of degree $n$. This polynomial need not be irreducible. The effect is that the lattice is not just a $q$-ary lattice but also an ideal lattice. We only define the decision variant of the LWE problem.

# 密码学代考

## 数学代写|密码学代写cryptography theory代考|LATTICE PROBLEMS

Learning With Errors 我们在 $3.6 .2$ 节中首先介绍了 learning with errors 问题，与 $q$-元格。有非常有力的 证据表明这个问题很难解决，即使是针对可以进行大型量子计算的对手也是如此。（从本质上讲，可以 将用于学习错误的求解器转变为与格相关的基本问题的求解器。我们不会探索这些结果。）

LWE问题中有大量的参数，包括嫊数 $q$, 两个维度 $n$ 和 $l$, 以及两个概率分布的确切形状。它们与 LWE 求解 难度的关系相当复杂。此外，有时对参数也有功能要求。

LWE $q, l, \chi, \chi$ 为求解器提供以下 oracle: 最初，它采样 $\beta \stackrel{r}{\leftarrow} 0,1$ 和 $\mathrm{b} \stackrel{r}{\longleftarrow} \chi_s$. 当被要求提供样本时， oracle 样本 $\mathrm{g} \leftarrow \mathbb{F}_q^l, f^{\Gamma} \chi$ 和 $y_1 \leftarrow \mathbb{F}_q$, 计算 $y_0 \leftarrow \mathbf{g} \cdot \mathbf{b}+f$ ，并返回 $\left(\left(\mathrm{g}, y_b\right)\right.$. 答案是 $\beta$.

myassignments-help数学代考价格说明

1、客户需提供物理代考的网址，相关账户，以及课程名称，Textbook等相关资料~客服会根据作业数量和持续时间给您定价~使收费透明，让您清楚的知道您的钱花在什么地方。

2、数学代写一般每篇报价约为600—1000rmb，费用根据持续时间、周作业量、成绩要求有所浮动(持续时间越长约便宜、周作业量越多约贵、成绩要求越高越贵)，报价后价格觉得合适，可以先付一周的款，我们帮你试做，满意后再继续，遇到Fail全额退款。

3、myassignments-help公司所有MATH作业代写服务支持付半款，全款，周付款，周付款一方面方便大家查阅自己的分数，一方面也方便大家资金周转，注意:每周固定周一时先预付下周的定金，不付定金不予继续做。物理代写一次性付清打9.5折。

Math作业代写、数学代写常见问题

myassignments-help擅长领域包含但不是全部: