Collision-Free Hashing from Lattice Problems

In 1995, Ajtai described a construction of one-way functions whose security is equivalent to the difficulty of some well known approximation problems in lattices. We show that essentially the same construction can also be used to obtain collision-free hashing. This paper contains a self-contained proof sketch of Ajtai's result.


Introduction
In 1995, Ajtai described a problem that is hard on the average if some well-known lattice problems are hard to approximate in the worst case, and demonstrated how this problem can be used to construct one-way functions [1]. We show that Ajtai's method can also be used to construct families of collision-free hash functions. Furthermore, a slight modification of this construction yields families of functions which are both universal and collision-free.

The Construction
The construction is very simple. For security parameter n, we pick a random n×m matrix M with entries from Z q , where m and q are chosen so that n log q < m < q 2n 4 and q = O(n c ) for some constant c > 0 (e.g., m = n 2 , q = n 7 ). See Section 3 for a discussion of the choice of parameters. The hash function h M : {0, 1} m → Z n q is then defined, for s = s 1 s 2 · · · s m ∈ {0, 1} m , as where M i is the i th column of M . Notice that h M 's input is m-bit long, whereas its output is n log q bits long. Since we chose the parameters such that m > n log q, there are collisions in h M . As we will argue below, however, it is infeasible to find any of these collisions unless some well known lattice problems have good approximation in the worst case. It follows that, although it is easy to find solutions for the equations M s ≡ 0 (mod q), it seems hard to find binary solutions (i.e., a vector s ∈ {0, 1} m in the solution space). Remark. Using our notation, the candidate one-way function introduced by Ajtai is f (M, s) def = (M, h M (s)). We note that this function is regular (cf., [3]); that is, the number of preimage of any image is about the same. (Furthermore, for most M 's the number of pre-images under h M of almost all images is about the same.) To the best of our knowledge, it is easier (and more efficient) to construct a pseudo-random generator based on a regular one-way function than based on an arbitrary one-way function (cf., [3] and [4]).

A Modification
A family of hash functions is called universal if a function uniformly selected in the family maps every two images uniformly on its range in a pairwise indepedent manner [2]. To obtain a family of functions that is both universal and collisionfree, we slightly modify the foregoing construction. First we set q to be a prime of the desired size. Then, in addition to picking a random matrix M ∈ Z n×m q , we also pick a random vector r ∈ Z n q . The function h M,r : {0, 1} m → Z n q is then defined, for s = s 1 · · · s m ∈ {0, 1} m , as The modified construction resembles the standard construction of universal hash functions [2], with calculations done over Z q instead of over Z 2 .

Formal Setting
In this section we give a brief description of some well known lattice problems, outline Ajtai's reduction, and our version of it.

Lattices
Definition 1: Given a set of n linearly independent vectors in R n , denoted V = v 1 , · · · , v n , we define the lattice spanned by V as the set of all possible linear combinations of the v i 's with integral coefficients; that is, We call V the basis of the lattice L(V ). We say that a set of vectors, L ⊂ R n , is a lattice if there is a basis V such that L = L(V ).
It is convenient to view a lattice L in R n as a "tiling" of the space R n using small parallelepipeds, with the lattice points being the vertices of these parallelepipeds. The parallelepipeds themselves are spanned by some basis of L. We call the parallelepiped that are spanned by the "shortest basis of L" (the one whose vectors have the shortest Euclidean norm) the basic cells of the lattice L. See Figure 1 for an illustration of these terms in a simple lattice in R 2 .

R 2
A lattice in Tiling using the "basic-cells" Tiling using some other basis Computational problems regarding lattices. Finding "short vectors" (i.e., vectors with small Euclidean norm) in lattices is considered a hard problem. There are no known efficient algorithms to find, given an arbitrary basis of a lattice, either the shortest non-zero vector in the lattice, or another basis for the same lattice whose longest vector is as short as possible. No efficient algorithms are known for approximation versions of these problems as well. The approximation versions being considered here are the following: (W1) Given an arbitrary basis B of a lattice L in R n , approximate (up to a polynomial factor in n) the length of the shortest vector in L. (W2) Given an arbitrary basis B of a lattice L in R n , find another basis of L whose length is at most polynomially (in n) larger than that of the smallest basis of L (where the length of a basis is the length of its longest vector).
We choose 'W' for the foregoing notation to indicate that we will be interested in the worst-case complexity of these problems. The best known algorithms for these problems are the L 3 algorithm and Schnorr algorithm. The L 3 algorithm, due to Lenstra, Lenstra and Lovász [5] approximates these problems to within a ratio of 2 n/2 in the worst case, and Schnorr's algorithm [6] improves this to (1 + ε) n for any fixed ε > 0. Another problem, which can be shown to be equivalent to the above approximation problems (cf. [1]), is the following: (W3) Given an arbitrary basis B of a lattice L, find a set of n linearly independent lattice vectors, whose length is at most polynomially (in n) larger than the length of the smallest set of n linearly independent lattice vectors.
(Again, the length of a set of vectors is the length of its longest vector.) A few remarks about (W3) are in order: 1. Note that not every linearly independent set of n lattice points is a basis for that lattice. For example, if V = {v 1 , v 2 } span some lattice in R 2 , then the set {2v 1 , v 2 } is a linearly independent set of 2 vectors that does not span L(V ), since we cannot represent v 1 as an integral linear combination of 2v 1 and v 2 . 2. In the sequel we reduce the security of our construction to the difficulty of solving Problem (W3). It will be convenient to use the following notation: For a given polynomial Q(·), denote by (W3) Q the problem of approximating the smallest independent set in an n-dimensional lattice up to a factor of Q(n).

Ajtai's Reduction
In his paper Ajtai described the following problem: Problem (A1): For parameters n, m, q ∈ N such that n log q < m ≤ q 2n 4 and q = O(n c ), for some constant c > 0.
Here, we used 'A' (in the notation) to indicate that we will be interested in the average-case complexity of this problem. Ajtai proved the following theorem, reducing the worst-case complexity of (W3) to the average-case complexity of (A1).
Ajtai's Theorem [1]: Suppose that it is possible to solve a uniformly selected instance of Problem (A1) in expected T (n, m, q)-time, where the expectation is taken over the choice of the instance as well as the coin-tosses of the solving algorithm. Then, it is possible to solve Problem (W3) in expected poly(|I|) · T (n, poly(n), poly(n)) time on every n-dimensional instance I, where the expectation is taken over the coin-tosses of the solving algorithm.
Remark. Ajtai [1] has noted that the theorem remain valid also when Problem (A1) is relaxed so that the desired output is allowed to have Euclidean norm of up to poly(n) (i.e., one requires x ≤ poly(n) rather than x < n).

Our Version
We observe that one can use essentially the same proof to show that the following problem is also hard on the average. Problem (A2): For parameters n, m, q ∈ N as in (A1).
Theorem 1: Suppose that it is possible to solve a uniformly selected instance of Problem (A2) in expected T (n, m, q)-time, where the expectation is taken over the choice of the instance as well as the coin-tosses of the solving algorithm. Then, it is possible to solve Problem (W3) in expected poly(|I|) · T (n, poly(n), poly(n)) time on every n-dimensional instance I, where the expectation is taken over the coin-tosses of the solving algorithm.
Proof: By the foregoing Remark, Ajtai's Theorem holds also when modifying Problem (A1) such that the output is (only) required to have Euclidean norm of up to m. Once so modified, Problem (A1) becomes more relaxed than Problem (A2) and so the current theorem follows.
For the sake of self-containment we sketch the main ideas of the proof of Ajtai's Theorem (equivalently, of Theorem 1) in Section 4. The reader is referred to [1] for further details.

Constructing Collision-Free Hash Functions
The security of our proposed collision-free hash functions follows directly from Theorem 1. Below, we spell out the argument and discuss the parameters.

The functions and their security
Recall our construction of a family of collision-free hash functions:

Picking a hash-function
To pick a hash-function with security-parameters n, m, q (where n log q < m ≤ q 2n 4 and q = O(n c )), we pick a random matrix M ∈ Z n×m q . The collision-free property is easy to establish assuming that Problem (A2) is hard on the average. That is:

Evaluating the hash function
Theorem 2: Suppose that given a uniformly chosen matrix, M ∈ Z n×m q , it is possible to find in (expected) T (n, m, q)-time two vectors x = y ∈ {0, 1} m such that M x ≡ M y (mod q). Then, it is possible to solve a uniformly selected instance of Problem (A2) in (expected) T (n, m, q)-time.
Proof: If we can find two binary strings which constitutes a solution to Problem (A2) for the instance M .

The Parameters
The proof of Theorem 1 imposes restrictions on the relationship between the parameters n, m and q. First of all, we should think of n as the security parameter of the system, since we derive the difficulty of solving Problem (A2) by assuming the difficulty of approximating some problems over n-dimensional lattices.
The condition m > n log q is necessary for two reasons. The first is simply because we want the output of the hash function to be shorter than its input. The second is that when m < n log q, a random instance of problem (A2) typically does not have a solution at all, and the reduction procedure in the proof of Theorem 1 falls apart.
The conditions q = O(n c ) and m < q/2n 4 also come from the proof of Theorem 1. Their implications for the security of the system are as follows: -The larger q is, the stronger the assumption that needs to be made regarding the complexity of problem (W3). Namely, the security proof shows that (A2) with parameters n, m, q is hard to solve on the average, if the problem (W3) (qn 6 ) is hard in the worst case, where (W3) (qn 6 ) is the problem of approximating the shortest independent set of a lattice up to a factor of qn 6 . Thus, for example, if we worry (for a given n) that an approximation ratio of n 15 is feasible, then we better choose q < n 9 . Also, since we know that approximation within exponential factor is possible, we must always choose q to be sub-exponential in n. -By the above, the ratio R def = q/n 4 m must be strictly bigger than 1 (above, for simplicy, we stated R > 2). The larger R is, the better the reduction becomes: In the reduction from (W3) to (A2) we need to solve several random (A2) problems to obtain a solution to one (W3) problem. The number of instances of (A2) problem which need to be solved depends on R. Specifically, this number behaves roughly like n 2 / log R. This means that when q/n 4 = 2m we need to solve about n 2 instances of (A2) per any instance of (W3), which yields a ratio of O(n 2 ) between the time it takes to break the hashing scheme and the time it takes to solve a worst-case (W3) problem. On the other hand, when R approaches 1 the number of iterations (in the reduction) grows rapidly (and tends to infinity).
Notice also that the inequalities n log q < m < q n 4 implies a lower bound on q, namely q log q > n 5 , which means that q = Ω(n 5 log n).

Self-contained Sketch of the Proof of Theorem 1
At the heart of the proof is the following procedure for solving (W3): It takes as inputs a basis B = b 1 , · · · , b n for a lattice and a set of n linearly independent lattice vectors V = v 1 , · · · , v n , with |v 1 | ≤ |v 2 | ≤ · · · ≤ |v n |. The procedure produces another lattice vector w, such that |w| ≤ |v n |/2 and w is linearly independent of v 1 , · · · , v n−1 . We can then replace the vector v n with w and repeat this process until we get a "very short independent set". When invoking this procedure, we denote by S the length of the vector v n (which is the longest vector in V ).
In the sequel we describe this procedure and show that as long as S is more than n c times the size of the basic lattice-cell (for some constant c > 0), the procedure succeeds with high probability. Therefore we can repeat the process until the procedure fails, and then conclude that (with high probability) the length of the longest vector in V is not more that n c times the size of the basic lattice-cell. For the rest of this section we will assume that S is larger than n c times the size of the basic lattice-cell.
The procedure consists of five steps: We first construct an "almost cubic" parallelepiped of lattice vectors, which we call a pseudo-cube. Next, we divide this pseudo-cube into q n small parallelepipeds (not necessarily of lattice vectors), which we call sub-pseudo-cubes. We then pick some random lattice points in the pseudo-cube (see Step 3) and consider the location of each point with respect to the partition of the pseudo-cube into sub-pseudo-cubes (see Step 4). Each such location is represented as a vector in Z n q and the collection of these vectors forms an instance of Problem (A2). A solution to this instance yields a lattice point that is pretty close to a "corner" of the pseudo-cube. Thus, our final step consists of using the solution to this (A2) instance to compute the "short vector" w. Below we describe each of these steps in more details.
1. Constructing a "pseudo-cube". The procedure first constructs a parallelepiped of lattice vectors that is "almost a cube". This can be done by taking a sufficiently large cube (say, a cube with side length of n 3 S), expressing each of the cubes' basis vectors as a linear combination of the v i 's, and then rounding the coefficients in this combination to the nearest integers. Denote the vectors thus obtained by f 1 , · · · , f n and the parallelepiped that is spanned by them by C. The f i 's are all lattice vectors, and their distance from the basis vectors of the "real cube" is very small compared to the size of the cube. 1 Hence the parallelepiped C is very "cube-like". We call this parallelepiped a pseudo-cube.
2. Dividing the pseudo-cube into "sub-pseudo-cubes". We then divide C into q n equal sub-pseudo-cubes, each of which can be represented by a vector in Z n q as follows: For each sub-pseudo-cube C T , we call the vector o T = i ti q f i the origin of C T (i.e., o T is the vector in C T that is closest to the origin). We note that any vector in v ∈ C T can be written as v = o T + δ where δ is the location of v inside the The "real cube" The pseudo-cube sub-pseudo-cube C T . See Figure 2 for an illustration of that construction (with n = 2, q = 3). The parameter q was chosen such that each C T is "much smaller" than S. That is, the side-length of each sub-pseudo-cube C T is Sn 3 /q ≤ S/2nm. On the other hand, with this choice, each C T is still much larger than the basic lattice cell (since S is much bigger than the size of the basic cell). This, together with the fact that the C T 's are close to being cubes, implies that each C T contains approximately the same number of lattice points.
3. Choosing random lattice points in C. We then choose m random lattice points u 1 , · · · u m ∈ C. To do that, we use the basis B = {b 1 , · · · , b n } of the lattice. To choose each point, we take a linear combination of the basis vectors b i with large enough integer coefficients (say, in the range [0, 2 n c · max(S, |B|)] for some constant c). This gives us some lattice point p.
We then "reduce p mod C". By this we mean that we look at a tiling of the space R n with the pseudo-cube C, and we compute the location vector of p in its surrounding pseudo-cube. Formally, this is done by representing p as a linear combination of the f i 's, and taking the fractional part of the coefficients in this combination. The resulting vector is a lattice point, since it is obtained by subtracting integer combination of the f i 's from p, whereas the f i 's are lattice vectors. Also, this vector must lie inside C, since it is a linear combination of the f i 's with coefficients in [0, 1). It can be shown that if we choose the coefficients from a large enough range, then the distribution induced over the lattice points in C is statistically close to the uniform distribution.

4.
Constructing an instance of Problem (A2). After we have chosen m lattice points u 1 , · · · , u m , we compute for each u i the vector T i ∈ Z n q that represent the sub-pseudo-cube in which u i falls. That is, for each i we have u i ∈ C Ti .
Since, as we said above, each sub-pseudo-cube contains approximately the same number of points, and since the u i 's are distributed almost uniformly in C, then the distribution induced on the C Ti 's is close to the uniform distribution, and so the distribution over the T i 's is close to the uniform distribution over Z n q . We now consider the matrix whose columns are the vectors T i , that is, M = (T 1 |T 2 | · · · |T m ). By the foregoing argument, it is an "almost uniform" random matrix in Z n×m q , and so, it is an "almost uniform" random instance of Problem (A2).

5.
Computing a "short lattice vector". We now have a random instance M of Problem (A2), and so we can use the algorithm whose existence we assume in Theorem 1 to solve this instance in expected T (n, m, q) time. The solution is a vector x = {x 1 , · · · , x m } ∈ {−1, 0, 1} m such that M x = i x i T i is congruent to 0 mod q.
Once we found x, we compute the lattice vector w ′ = m i=1 x i u i . Let us examine the vector w ′ : Recall that we can represent each u i as the sum of o i def = o T i (the origin vector of C Ti ) and δ i (the location of u i inside C Ti ). Thus, A key observation is that since i x i T i ≡0 (mod q), "reducing the vector ( i x i o i ) mod C" yields the all-zeros vector; that is, ( i x i o i ) mod C =0. To see why this is the case, recall that each where all c j 's are integers. Since "reducing the vector i x i o T i mod C" means subtracting from it an integer linear combination of f j 's, the resulting vector is 0. Thus, "reducing w ′ mod C" we get m i=1 x i δ i ; that is, Since each δ i is just the location of some point inside the sub-pseudo-cube C Ti , the size of each δ i is at most n · S/2mn = S/2m. Moreover as x i ∈ {−1, 0, 1} for all i we get This means that the lattice vector w ′ mod C is close up to S 2 to one of the "corners" of C. Thus, all we need to do is to find the difference vector between the lattice vector w ′ mod C and that corner (which is also a lattice vector). Doing that is very similar to reducing w ′ mod C: We express w ′ as a linear combination of the f i 's, but instead of taking the fractional part of the coefficients, we take the difference between these coefficients and the closest integers. This gives us the "promised vector" w, a lattice vector whose length is at most S/2.
The only thing left to verify is that with high probability, w can replace the largest vector in V (i.e., it is linearly independent of the other vectors in V ). To see that, notice that the vector x does not depend on the exact choice of the u i 's, but only on the choice of their sub-pseudo-cubes C Ti 's. Thus, we can think of the process of choosing the u i 's as first choosing the C Ti 's, next computing the x i 's and only then choosing the δ i 's.
Assume (w.l.o.g.) that we have x 1 = 0. Let us now fix all the δ i 's except δ 1 and then pick δ 1 so as to get a random lattice point in C T1 . Thus, the probability that w falls in some fixed subspace of R n (such as the one spanned by the n − 1 smallest vectors in V ), equals the probability that a random point in C T1 falls in such subspace. Since C T1 is a pseudo-cube that is much larger than the basic cell of L, this probability is very small.