Abstract
One family of candidates to build a post-quantum cryptosystem upon relies on euclidean lattices. In order to make such cryptosystems more efficient, one can consider special lattices with an additional algebraic structure such as ideal lattices. Ideal lattices can be seen as ideals in a number field. However recent progress in both quantum and classical computing showed that such cryptosystems can be cryptanalysed efficiently over some number fields. It is therefore important to study the security of such cryptosystems for other number fields in order to have a better understanding of the complexity of the underlying mathematical problems. We study in this paper the case of multicubic fields.
1 Introduction
Given a number field K, an ideal lattice over K is simply an ideal I of 𝓞K considered as a ℤ–module in ℝn, where 𝓞K is the ring of integers of K. It can be represented by an integral basis. In the simplest version of encryption using ideal lattices, such as in [15, 16, 20], we can consider a number field K and I = g𝓞K a principal ideal with a short g when I is considered as a lattice. Short means that the euclidean norm of g is small compared to the determinant of I. Then K and I are public – with I which can be given by the Hermite Normal Form of a basis matrix of I for example – and g is the private key. The security of the cryptosystem relies on the hardness of finding g or another short generator. Finding a generator is called the Principal Ideal Problem (PIP) and is referred as one of the main tasks of Computational Number Theory by Cohen in [11]. Finding a short generator is referred as the Short Principal Ideal Problem (SPIP). The first advantage of such a system compared to a general lattice based system is that instead of storing a n2 matrix to designate the lattice we can use a more compact representation. We therefore need less space to store the public and private keys. Moreover the algebraic structure of the fields we are working with allows faster computations. Because of this efficiency, ideal lattices – and more generally structured lattices – are under a lot of investigation to evaluate the security of lattice-based cryptosystems. By default an attack to recover the generator g is done in two steps:
recover a generator h of I;
find a short generator given h.
The first step corresponds to the PIP which is considered a hard problem in classical computational number theory. However it is shown that it can be efficiently done by using quantum computing as in [6]. The second is a reduction phase which is the kind of tasks that seem difficult even for quantum computers. In order to solve it, one may use the structure of the set of generators of I and the Log-unit lattice. This strategy was mentioned in [9] where it was claimed that in the case of cyclotomic fields the group of cyclotomic units has a good enough geometry in the Log-unit lattice to help recovering a short secret vector. A proper analysis of this situation has been done in [13] where the authors gave a bound for the norm of the vectors of the dual basis. More precisely they analysed a subgroup of the unit group which is easily computable and whose index is small i.e. close to 1. They showed that one can shorten a generator with respect to this subgroup and that an enumeration process allows to retrieve a short generator with respect to the full unit group. In [4] the authors studied another family of fields, namely the multiquadratic fields, and were able to recover a short generator of an ideal in classical polynomial time for a wide range of fields.
Objectives and results
In this paper we study the case of real multicubic fields i.e. fields generated by real cube roots of integers. We aim to show that such fields should not be used for cryptography in a post-quantum setting i.e. that one can retrieve a short generator using the Log-unit lattice. For this purpose we prove that their algebraic structure is similar to the one of multiquadratic fields so that the framework of the attack in [4] can be adapted to multicubic fields. We are able to compute units of degree 3n number fields for n up to 5. Experiments on the PIP show a success rate similar to the ones presented in [4].
Future work
Further work can consist in improving the results on multicubic fields and generalise the approach to number fields generated by p-root of integers for bigger primes p. This could lead to a better understanding on what can be done regarding ideal lattices. Moreover it would be interesting to work on other important tasks of computational number theory over these fields such as computing the class group. Another direction would be to study number fields with more complicated structures in order to look whether we can again find a good basis for the Log-unit lattice or not.
2 Background
Notations : The inner product is denoted by (⋅ | ⋅). When we consider a tuple (λ1, …, λn) we can designate it by λ. An interval in the integers will be written ⟦a, b⟧. Given a rational number a we will write
Lattices
A lattice is a discrete subgroup of ℝn where n is a positive integer. A basis of a lattice 𝓛 is a basis of 𝓛 when considered as a ℤ-module. One way of representing a lattice is then to consider the matrix of a basis of the lattice. Let us denote by λ1(𝓛) the norm of the shortest non zero vector of 𝓛. There is an approximation of λ1(𝓛) called the Gaussian heuristic which tells that the expected value of λ1(𝓛) is in
the Shortest Vector Problem (SVP) : «Given a a lattice 𝓛 of dimension n, find u ∈ 𝓛 ∖ {0} such that ∥u∥ = λ1(𝓛)»;
the Closest Vector Problem (CVP) : «Given a lattice 𝓛 of dimension n and t ∈ ℝn, find u ∈ 𝓛 such that ∀v ∈ 𝓛, ∥t – u∥ ⩽ ∥t – v∥;»;
the Bounded Distance Decoding (BDD) : «Given a basis B of a lattice 𝓛, a target vector t such that d(t, 𝓛) < λ1(𝓛)/2, find the lattice vector v ∈ 𝓛 closest to t.».
In practice we can consider relaxed versions of these problems with respect to an approximation factor. For general lattices these problems are NP-hard thus at least as hard as factorising for example. Moreover we do not have any result showing that quantum computers can solve these problems for general lattices. These problems are easier to solve if we have a good basis at our disposal i.e. a basis built with relatively short vectors which are nearly orthogonal to each other.
Despite the hardness of these problems over random lattices, high-dimensional lattices are large objects and slow to handle. A way of copping with that is to work with lattices with extra algebraic structure such as ideal lattices. However this can introduce a security weakness as it may be easier to find good basis related to such lattices or to use the algebraic structure to solve lattice problems.
Number Fields
We will quickly recall some facts about number fields. A number fieldK is a field which is a finite extension of ℚ. It can always be described as a polynomial quotient ring
where P(X) is irreducible in ℚ[X]. Equivalently if we choose θ to be any root of P(X) we can see K as ℚ(θ) the smallest field containing ℚ and θ. If we write n the degree of P(X) then the dimension of K over ℚ – written [K : ℚ] – is n.
There are n distinct complex field embeddingsK ↪ ℂ denoted by σ1, …, σn. They map θ to the other complex roots of P(X). We will write Hom(K, ℂ) for this set. Among them we have r1 real embeddings and r2 pairs of complex embeddings. The two elements of a given pair are conjugates one from each other. It is the usage to denote by σ1, …, σr1 the real embeddings and to consider that σj+r2 = σj for all j ∈ ⟦r1 + 1, r1 + r2⟧. Given a complex embedding σ ∈ Hom(K, ℂ) the set {x ∈ K | σ(x) = x} is a subfield of K. We will denote it by Inv(σ) or Kσ to follow notations used in [4].
The Galois Group of a field extension L/K denoted by Gal(L/K) is the group of field automorphisms of L which are congruent to the identity when restricted to K. It is a subset of Hom(L, ℂ). An extension L/K is called a Galois extension when the cardinality of Gal(L/K) equals the dimension [L : K]. Moreover the Galois correspondence states that given a Galois extension L/K there is a one-to-one correspondence between the subgroups of Gal(L/K) and the subfields of L containing K. Given a subgroup H of Gal(L/K) we will write Inv(H) the corresponding subfield of L. In the case of a number field K we say it is a Galois field if it is Galois as an extension of ℚ. For example the cyclotomic fields are Galois number fields as well as the multiquadratic fields. However this property is not verified by a general number field K and we have to consider the Galois closure of K, denoted by K͠, which is in fact the smallest extension containing all the roots of the irreducible polynomial P(X).
One ring of particular importance is the ring of integers ofKdenoted by 𝓞K. It consists of the elements of K which are roots of a monic polynomial of ℤ[X]. This ring as well as its ideals are full rank sub-ℤ-module of K. The images of 𝓞K and of any ideal I of 𝓞K under the action of any embedding of K into ℝn are lattices. The usual embedding corresponds to view a number field K as a quotient
The group of units of 𝓞K written
This isomorphism which allows to see the units of
The set LogK(
Given a family (x1, …, xn) of a number field K the discriminant D(x1, …, xn) is the rational number det((σj(xi))i,j)2. Given 𝓞 a full-rank subring of 𝓞K the discriminant of 𝓞 is D(x1, …, xn) where (x1, …, xn) is an integral basis of 𝓞. The discriminant of K – written D(K) – is the discriminant of its integer ring.
Ideal lattice cryptosystem
Recall that ideal based cryptosystems such as presented in [15, 16, 20] have in general a private key which is a short generator of a public ideal I. The security of such cryptosystems relies on the supposed hardness of finding such a generator given an ideal, problem called the Short Principal Ideal Problem. The Principal Ideal Problem consists in finding any generator of the principal ideal i.e. given an ideal I = g 𝓞K, find some h such that I = h𝓞K. As mentioned the process done to solve the SPIP relies essentially in two steps : solve the PIP and then shorten the retrieved generator. The set of generators of I is {gu | u ∈
solve the PIP : this is considered hard classically and can be done in quantum polynomial time;
compute
shorten a generator h by solving the BDD with respect to LogK(
Multiquadratic fields
Multiquadratic fields are fields which are generated by a sequence of square roots of integers
Lemma 2.1
LetKbe a multiquadratic field of dimension 2n. Then for allx ∈ K
whereK1, K2andK3are multiquadratic subfields ofKof dimension 2n–1. Moreover ifxis a unit then the fields can be replaced by their unit group.
We see that if it is possible to compute the unit group of multiquadratic fields of degree 2n–1 then we can compute a subgroup G of
3 Multicubic fields
In this section we will study multicubic fields i.e. number fields generated by cube roots of integers. Cubic fields have been well studied and one can find several results in textbooks or papers. See for instance [2, 11]. We still present some facts useful to our presentation. However we could not find papers on multicubic fields dealing with the results we are interested in. We prove that the structure of multicubic fields is similar to {the one of} multiquadratic fields so that the attack of Bauch and al. can be adapted. The facts that are needed for the algorithms to work are the following:
every subfield of a multicubic field is a multicubic field;
there is a structural result similar to Lemma 2.1 so that we can work recursively on subfieds.
Moreover we show that the situation in the Log-unit lattice is also similar because the fundamental units of the cubic subfields form an orthogonal basis of a full-rank sublattice.
3.1 First structural results
First we will present several facts concerning multicubic fields useful for our study. Let us start with a lemma on cubic fields that we will use later.
Lemma 3.1
Considerpandqtwo rational numbers which are not rational cubes. Then the cubic fields ℚ(
Definition 3.2
Consider n distinct integers d1, …, dn which are not rational cubes. We will call (real) multicubic field generated by d1, …, dn the number field
Remark 3.3
The sequence elements not being cubes forbids ℚ to be a multicubic field. {Moreover we consider only real cube roots.} We have not supposed anything more about the defining sequence. For example several elements could be equal to each other. However we can always find a minimal sequence whose length will be proved to be equivalent to the dimension of the corresponding multicubic field.
Proposition 3.4
Every multicubic field
Proof
We will proceed by induction on m. If m = 1 then there is nothing to prove. Now suppose that the property is true for a fixed integer m ⩾ 1 and consider a multicubic field
for some (α1, …, αn, α) ∈ ⟦0, 2⟧n+1 ∖ {0} and a ∈ ℤ. By induction hypothesis the product
meaning that we have K = L and that K verifies the desired property.□
Definition 3.5
A sequence of integers defining a multicubic field K will be called reduced if it verifies the property of Proposition 3.4.
Proposition 3.6
Consider
withα = (α1, …, αn) ∈ ⟦0, 2⟧n ∖ {0}. Moreover if we seeαandβas elements of (𝔽3)nwe have
Proof
Consider α ∈ ⟦0, 2⟧n ∖ {0}. There is i ∈ ⟦1, n⟧ such that α ≠ 0. Then the product
By Lemma 3.1, this is equivalent to the existence of a rational a such that one of the three following possibilities is true:
Now consider μ and ν two non-zero elements of (𝔽3)n. Write in ℤ the equality μi = νi + ri + 3qi with 0 ⩽ ri < 3 for all i ∈ ⟦0, n⟧. Then we have
since no product of di’s with corresponding exponents less than 2 can be a rational cube except for the trivial one, for we suppose the sequence d1, …, dn to be reduced. Combining this with the three previous possibilities we indeed obtain the searched equivalence relation. The claimed number of such cubic subfields is directly deduced by counting the possible α modulo this relation.□
Remark 3.7
Given
When considering these subfields we will therefore identify ⟦0, 2⟧n with
In fact we will see that all cubic subfields of a multicubic field are pure cubic fields of the previous form.
In order to study multicubic fields further we need to examine the set of the complex embeddings Hom(K, ℂ).
3.2 Set of complex embeddings and other results
Fix a set of n distinct integers {d1, …, dn} supposed to constitute a reduced sequence as before and let K be the multicubic field associated to it. The degree of K over ℚ is at most 3n. Given an embedding of K into ℂ, its action can be fully described by its action on each
We suppose di to be cube-free so X3 – di is irreducible over ℚ. We then have the following isomorphism
and the three embeddings of ℚ (
Given such a decomposition, the corresponding embedding will be written σ(β).
Remark 3.8
We can see that in this situation too the sets ⟦0, 2⟧n and (𝔽3)n can be identified. Then the data of an embedding of K into ℂ is equivalent to the data of a point in (𝔽3)n. We do not know yet if all such points can be obtained, which is equivalent to proving that the dimension of K is 3n.
We will see that the duality of complex embeddings of K relatively to cubic subfields Kα can be expressed as a duality situation in (𝔽3)n thanks to their geometric interpretation as points and hyperplanes. This will help in proving the following.
Theorem 3.9
ConsiderKdefined by a reduced sequenced1, …, dn. Then we have
[K : ℚ] = 3nand
the set Hom (K, ℂ) is exactly {σ(β) | β ∈ (𝔽3)n}.
We will study the action of an element σ(β) of Hom(K, ℂ) on a cubic subfield Kα. Recall that the three possibilities for
We will relate the action of a morphism σ(β) on a field Kα to a geometric relation between α and β as said earlier. Recall that we can think of α as an hyperplane and β as a point in the vector space (𝔽3)n. Let us fix some notation. Given α ∈ (𝔽3)n ∖ {0} and t ∈ 𝔽3 we will write Hα(t) the affine hyperplane of (𝔽3)n defined by the equation α1X1 + ⋯ + αnXn = t.
Proposition 3.10
Let
Proof
We need to evaluate σ(β) on
Thus we have (σ(β))|Kα =
Remark 3.11
We see that in order to analyse how the action of the embeddings of K are distributed among the different cubic subfields we have to do some affine geometry. First, the data of a cubic subfield is the same as the data of α modulo multiplication by a non-zero element of 𝔽3 or equivalently the vectorial hyperplane Hα(0). One can verify that the relation of the previous Proposition is coherent with the equality of Kα and K2α by making the observation that Hα(2t) = H2α(t)
Now we will describe more precisely the action of the morphisms σi for i ∈ ⟦0, n⟧.
Lemma 3.12
LetKbe a multicubic field defined by a reduced sequenced1, …, dn. Then for allα ∈ (𝔽3)n, i ∈ ⟦0, n⟧ andk ∈ ⟦0, 2⟧ we have
Proof
This is applying the above Proposition and remarking that this is true for a null α.□
Lemma 3.13
LetKbe a multicubic field defined by a reduced sequence of integersd1, …, dn. Suppose thatKverifies the properties of Theorem 3.9. Then for allx ∈ Kthe following assertions are equivalent:
∀σ ∈ Hom(K, ℂ), ∃k ∈ ⟦0, 2⟧, σ(x) =
∃α ∈ (𝔽3)n, ∃a ∈ ℚ, x =
Proof
Consider x ∈ K. We already know that the second assertion implies the first one. Suppose now the first condition to be true. Since we assumed K to verify the properties of Theorem 3.9, x can be written as
with xα ∈ ℚ for every α ∈ (𝔽3)n and write Supp(x) = {α ∈ (𝔽3)n | xα ≠ 0}. There is nothing to prove if Supp(x) is the void space so we assume it is not trivial. The property being true for all morphisms is equivalent to be true for σi for all i ∈ ⟦1, n⟧. Fix such an integer. We can write x = x0 + x1 + x2 with
for all t ∈ ⟦0, 2⟧. By Lemma 3.12 we have σi(x) = x0 + ζ3 × x1 +
which is the point k = (k1, …, kn). But Supp(x) is not trivial so it is equal to this point and we can finally write
Now that we have these results we can prove Theorem 3.9.
Proof
We will proceed by induction on the length n of the sequence d1, …, dn. We proved the case n = 1 during the discussion at the beginning of the subsection. Now fix some integer n ⩾ 1 and suppose the searched results to be true for this n. Let K be a multicubic field defined by a reduced sequence d1, …, dn+1. Consider L the multicubic field defined the reduced sequence d1, …, dn. Then K = L(
which implies the equality
This is impossible because the sequence d1, …, dn+1 is reduced. Therefore we have
We will pursue the study of complex embeddings of multicubic fields by considering its Galois closure. We will be able to deduce from this other structural results on the field considered. Let us fix K a multicubic field generated by a reduced sequence d1, …, dn. We will see that K̃ is K(ζ3). Given σ ∈ Hom(K, ℂ) a complex embedding of K we will write σ̃ the field morphism of K(ζ3) obtained as
and τ the morphism which acts as the complex conjugation.
Proposition 3.14
The Galois closure ofKis thenK(ζ3) and its Galois group is generated by the set {τ} × {σ̃i | i ∈ ⟦1, n⟧}. Moreover it is isomorphic to the group
Proof
The field K(ζ3) has dimension 2 × 3n over ℚ. Therefore in order to prove that it is Galois with the claimed Galois group it suffices to prove that the last has cardinality 2 × 3n. Denote it by G for the sake of the proof. By the previous study on complex embeddings of K we already know that the group generated by the σ̃i has order 3n which divides the order of G. Moreover the complex conjugation has order 2 which again divides the order of G. Therefore 2 × 3n divides the order of G which is smaller than the dimension of K(ζ3) and we have the desired result. Now let us prove that G has the announced structure. We already stated that the complex conjugation has order 2. Clearly the σ̃i commute and we have
and
which means that τσ̃iτσ̃i is indeed the identity morphism on K̃.□
Remark 3.15
We can see that any element of Gal(K͠ / ℚ) can be written uniquely as
As said before we will use the Galois group to study the structure of the multicubic field K. Recall that given a Galois extension M/N there is a correspondence between subgroups of the Galois group Gal(M/N) and subfields of the extension, which is given by invertible decreasing maps.
Remark 3.16
Let F be a subfield of K͠. Then F is a subfield of K = Inv(τ) if, and only if, the group associated to F contains τ.
One of the first properties that we can deduce from the structure of the Galois group is that the cubic subfields of the form Kα considered previously are all of the cubic subfield.
Proof
Consider F a cubic subfield of K. The associated subgroup H of the Galois group Gal(K͠/ℚ) is generated by a set
with r ⩾ 1. Since F is real we know that τ belongs to H and we can consider that we have
and therefore we can see that the data of H is the same as the data of the subgroup generated by S ∖ {τ} which is a subgroup of
We saw in Proposition 3.6 that there are
The cubic subfields are of particular interest for us because as in the multiquadratic case, we will compute their units and construct from these the units of K. As we will see later their number is the one we need.
Lemma 3.17
Any subfieldFofKof degree 3n–1is of the form Inv(σ̃(β), τ) and is a multicubic field.
Proof
We have [K͠ : F] = 6 therefore the associated subgroup H of Gal(K͠ / ℚ) has order 6. Since F ⊂ K we know that τ is in H and by using the orders we can conclude that H is generated by τ and only one σ̃(β) with β ≠ 0. Let fix these notations for the proof. We write I = {i1, i2, …, ir} the set of indexes of the non-zero coefficients of β. We can suppose i1 < … < ir. Now consider the sets
and
Then the cardinal of T is r – 1 and any element of T is invariant under the action of σ̃β. The field L = ℚ(S ∪ T) is therefore a field defined by n – r + r – 1 = n – 1 cube roots of integers and its elements are invariant under the action of σ̃(β). Recall that we assumed the sequence d1, …, dn to be reduced. This implies that neither the elements dj nor the elements
– where α1 =
is a cube. But (r, α2, …, αn) ∈ 𝔽3 and the sequence (d1, …, dn) is reduced therefore r = α2 = … = αn = 0. Consequently the sequence defined by S ∪ T is reduced too. Now L is a multicubic field defined by a reduced sequence of length n – 1 so by Theorem 3.9 it has degree 3n–1. Finally L ⊂ F and they have the same degree so they are identical which means that F is indeed a multicubic field.□
Theorem 3.18
LetKbe a multicubic field. Any subfieldFofKis a multicubic field.
Proof
We will proceed by induction on [K : F]. The previous Lemma states that it is true for [K : F] = 31. Consider the result to be true for [K : F] = 3r for some r ⩾ 1 and suppose [K : F] = 3r+1. As usual write H the subgroup of Gal(K͠/ℚ) such that F = Inv(H). Just as before we can write H = 〈τ, σ̃(β1), …, σ̃(βr+1)〉. Denote by L the field fixed by the group 〈τ, σ̃(β1), …, σ̃(βr)〉 < H. By the Galois correspondence we know that [K : L] = 3r and that F is subfield of L with [L : F] = 3. The induction hypothesis states that L is multicubic field and we can apply again the previous Lemma to the extension L/F to conclude that F is a multicubic field too.□
We see that the structure of multicubic fields is similar to the one of multiquadratic fields even if they are not Galois. This structure will allow us to work recursively and fasten considerably our computations. The following result is similar to Lemma 5.1 in [4] and is a generalisation of a result over bicubic fields proved by Charles Parry in [18].
Notation : For now on if σ̃ is an element of Gal(K͠/ℚ) we will denote by Kσ̃ the field Inv(τ, σ̃) = K̃σ̃ ∩ ℝ, and by H(K̃) the subgroup {σ̃ | σ ∈ Hom(K, ℂ)}.
Proposition 3.19
LetKbe a multicubic fieldwith [K : ℚ] > 3. Consideruandvtwo elements ofH(K̃) which are independent. Then for anyx ∈ Kwe have
wherexw ∈ Kwfor everyw ∈ {u, v, uv, u2v}. Moreover ifxis a unit ofKthenxwis a unit ofKwfor allw ∈ {u, v, uv, u2v}.
Proof
As mentioned before the proof relies exactly on the same idea that appears in [4, 18]. For every element x ∈ K we can rewrite the cube as
Then for all w ∈ {u, v, uv, u2v} we write xw the relative norm element corresponding to w in the previous expression. Since x is an element of K any of the norm in the numerator NK̃/K̃w(x) is in the fact the same as the relative norm NK/Kw(x) which is an element of Kw. The relative norm NK̃/K̃u2v(u(x) ⋅ uv(x)) is in K̃u2v. However x3 is in ℝ as well as the numerator therefore NK̃/K̃u2v(u(x) ⋅ uv(x)) is in K̃u2v ∩ ℝ = Ku2v. The statement concerning units is clear given the algebraic expression of the elements as relative norms.□
3.3 Unit Group
The structure of the unit group of a number field is related to its complex embeddings. Consider a multicubic field K defined by a reduced sequence d1, …, dn. We can see that a multicubic field K has only one real embedding – the identity – and 3n – 1 complex ones. Therefore we know that the group of units
In the special case of the cubic subfields Kα we have
Then for every α we can write
Definition 3.20
Consider a multicubic field
Just as in the multiquadratic case we will see that MCU is a full-rank subgroup of
Notation : Given an integer k and a subset S of a field F we will denote by Sk the set {xk | x ∈ S}.
Proposition 3.21
LetKbe a multicubic field of degree 3n. Then we have
Moreover MCU is a full-rank subgroup of
Proof
The result is trivial for n = 1. Now assume it is true for some fixed n ⩾ 1 and let K be a multicubic field of degree 3n+1. As stated in Proposition 3.19 we have
with u, v being two elements of H(K̃). Then for every w ∈ {u, v, uv, u2v} the field Kw is a subfield of K of dimension 3n. Since it is a multicubic field too it verifies the recursion hypothesis. Therefore
We have proven the first result. The property on the index follows immediately from
In order to study the geometry of the lattice LogK(MCU) we need to evaluate the action of each embedding σ(β) on the units ϵα which is induced by the action of the embedding on the cubic field Kα and thus on
Notation : Given a vector space V and a family (f1, …, fr) in V we will write Vect(f1, …, fr) the subvector space generated by this family.
Proposition 3.22
Considerrelementsα1, …, αrlinearly independent in (𝔽3)n. We have the following geometric facts:
For every r-tuple (t1, …, tr) of elements of 𝔽3, the intersection
For everyr-tuple (t1, …, tr) and everyγ ∉ Vect(α1, …, αr) we have
If we transfer this in the setting of number fields and embeddings, we can tell that the actions of the embeddings of a multicubic field K into ℂ are uniformly distributed among the cubic subfields of the form Kα. This well distributed duality will give rise to a nice geometric situation in the Log-unit lattice. Here we consider the Log map as follow
Proposition 3.23
Consider a multicubic field
Proof
Consider α and γ two elements of (𝔽3)n independent over 𝔽3. We will evaluate the scalar product of LogK(ϵα) and LogK(ϵγ).
Now we will use the geometric properties described before to rewrite the sum over well distributed subsets. First recall that (𝔽3)n = ⨆t∈𝔽3Hα(t) which allows us to write
We can decompose the hyperplanes Hα(t) as Hα(t) = ⨆s∈𝔽3Hα(t) ∩ Hγ(s) and we can write
In the right-hand side of the previous equality, every term of the second sum have the same value. Moreover the set we are summing over has 3n–2 elements since it is a (n – 2)– dimensional affine variety of (𝔽3)n. This gives us
and the scalar product can be rewritten
The elements ϵα and ϵγ are units thus their algebraic norm is ±1 and the scalar product is
□
The orthogonality of the vectors LogK(ϵα) assures that we are in the best situation possible to solve problems in the lattice LogK(MCU). However in order to use this sublattice to decode in the Log-unit lattice it would need to be close from LogK(
Lemma 3.24
Consider a multicubic field
Proof
By following the same arguments as in previous calculations we can write
which is
but Hα(t) has 3n–1 elements so
□
Now we will be able to express the norm of LogK(ϵα) in function of the value of ϵα.
Proposition 3.25
Consider a multicubic field
Proof
We will use the expression found in the previous lemma and express the quantity ∥LogKα(ϵα)∥2. First recall some facts. We have ϵα > 1 therefore log(|ϵα|) = log(ϵα) > 0. Moreover the quantity σα(ϵα) and
Then we know that we have
which gives
By using this equality we obtain
and by consequence
The searched equality is found by taking the square root of the previous equation.□
3.4 Discriminant
We will now establish a formula for the discriminant of multicubic fields. The proofs are left in Appendix. See [11] for cubic fields and [10] for bicubic fields.
Lemma 3.26
Consider a bicubic field
Lemma 3.27
Consider a multicubic field
Lemma 3.28
Consider a bicubic field
Proposition 3.29
Consider a multicubic fieldK = ℚ
∀i ∈ ⟦1, n⟧, di = ± 1 (mod 9);
d1 = 2, 4, 5, 7 (mod 9) and ∀i ∈ ⟦2, n⟧, di = ± 1 (mod 9);
d1 = 0 (mod 3) and ∀i ∈ ⟦2, n⟧, di = ± 1 (mod 9);
d1 = 0 (mod 3), d2 = 2, 4, 5, 7 (mod 9) and ∀i ∈ ⟦3, n⟧, di = ± 1 (mod 9).
Theorem 3.30
(Discriminant of a multicubic field). Consider a multicubic fieldK = ℚ
withαbeing:
One can deduce from Theorem 3.30 the following result.
Proposition 3.31
Consider a multicubic fieldK = ℚ
Proof
Remark that D(ℤ[B]) | D(3n𝓞K).□
4 Algorithms and experiments
In all the following we will consider multicubic fields defined by reduced sequence. Fix the field K = ℚ
with α ∈ ⟦0, 2⟧n form a basis of K/ℚ. In fact we can consider the cube-free part of each of these elements which we will do in all the following. Therefore elements of K are represented as vectors of length 3n with rational coefficients. Moreover we can see K as a relative extension of degree 3 over a multicubic subfield of dimension 3n–1 over ℚ. The most natural is to write K as L
As we saw already one important tool for us is the Log-embedding. As in [4] we will not compute the exact Log-embedding but an approximate version of it, very much like the authors did. This leads us to represent any non zero element x ∈ K by the pair (x, ApproxLogK(x)) where x is a vector with rational coefficients as described before and ApproxLogK(x) will be a vector as described later.
In the following we make an extensive use of the LLL algorithm presented in [17] to solve multivariate linear systems.
General procedure
In [4] the authors compute units of a multiquadratic field K as follow:
Recursively compute the units of three subfields K1, K2, K3 which verify
Find non trivial squares of U;
Calculate their square roots.
For multicubic fields this general procedure can be followed : only replace “squares” by “cubes” and consider four subfields in the first step as in Proposition 3.19. The step (ii) can be directly adapted and is described in Subsections 4.1 and 4.2 however computing cube roots is more complicated as seen in Subsection 4.3.
4.1 Finding Good Primes
As in [4] we will need to be able to find primes verifying fixed cubic conditions with respect to the di’s. Consider (d1, …, dn) a reduced sequence and C = (c1, …, cn) ∈ {0, 1}n. A good prime for d and C is a prime p such that di is a cube modulo p if, and only if, ci is 1.
In particular we need to find good primes p for the condition sequence (1, …, 1) in order to construct morphisms from K* into finite fields 𝔽p. Remark that the primes should not divide any of the di. Now if we fix a prime p > 3 we have the following situation:
if p ≡ 1 (mod 3) then 𝔽p contains a fundamental cube root of unity and
if p ≡ 2 (mod 3) then 𝔽p does not contain a fundamental cube root of unity and
Therefore we can have different strategies depending on our goal. If we want the condition (1, …, 1) to be verified we might consider primes only congruent to 2 modulo 3 as long as we do not need a non-trivial cube root of 1 to be in the field 𝔽p. Otherwise we have to consider primes which are congruent to 1 modulo 3.
Let us now describe how the algorithm operates in this case. First we have to draw a prime p and verify that it is not congruent to 2 modulo 3. This happens with probability
Algorithm 1
Finding a good prime for a sequence d and a condition sequence C.
| Require: A reduced sequence (d1, …, dn) and C = (c1, …, cn) ∈ {0, 1}n |
| Ensure: A prime p which does not divide any of the di’s and such that for all i ∈ {0, n} we have : (di is a cube modulo p) = ci. |
| 1: b ← false |
| 2: Whileb = false do |
| 3: p ← DrawPrime |
| 4: whilep (mod 3) ≡ 2 do |
| 5: p ← DrawPrime |
| 6: end while |
| 7: b ← |
| 8: end while |
| 9: returnp |
For a random prime p ≡1 (mod 3) the probability that the ith cube condition is true is equal to
In average the algorithm will try
Complexity : We obtain a complexity essentially in O(N).
4.2 Detecting cubes
One important procedure in [4] consists in finding non trivial products of a given family of K* which are squares. In the case of multicubic fields we need to detect cubes. We consider U = 〈u1, …, um〉 a subgroup of K*. We need to compute non trivial “cubic characters” from U to 𝔽3. To do so we will use several primes p to create non trivial morphisms from
In order to create morphisms from
Now suppose a prime p has been selected. Write ϕp the morphism it induces as explained before. We want to create a character i.e. a group morphism U ⟶ 𝔽3 in order to detect non trivial cubes in U. Similarly to [4] we use the cubic character
As a cubic character induced by p we will therefore consider
Remark that if u is a cube in
The group
Complexity : Generating a cubic character consists in applying Algorithm 1 to find a prime p and reducing the elements u1, …, um modulo p to verify that the morphism ϕp is defined and non zero on U = 〈u1, …, um〉. In order to calculate ϕp(ui) we need to compute the cube roots of d1, …, dn, reduce the coefficients of ui and compute a sum modulo p. All of this can be done in O(NB) with B an upper bound on the number of bits of the coefficients of any of the ui. This is mainly due to reduction of ui modulo p. The computation of m + s characters is therefore in O((m + s)NB). We will consider m + s to be equivalent to N asymptotically so we obtain O(N2B). Finally the computation of the kernel of a matrix of size N over 𝔽3 has complexity N3 so the complexity of Algorithm 2 is O(N3 + N2B).
Algorithm 2
Compute non trivial cubes of a subgroup of K* – CubeKernel
| Require: U = 〈u1, …, um〉 a subgroup of K* |
| Ensure: λ1, …, λr ∈ ⟦0, 2⟧m such that |
| 1: Generate sufficiently enough cubic characters χp1, …, χpm+s |
| 2: M ← [χpj(ui)]i,j ∈ Mm,m+s(𝔽3) |
| 3: N ← ker(M) ⊳ Left Kernel in 𝔽3 |
| 4: returnN as a matrix in ℤ |
4.3 Computing cube roots
Consider the following problem : «Given an elementyin a multicubic fieldK = ℚ
There is no straightforward way of transforming these equations into a cube that we could take advantage of. Therefore we choose to use a real embedding and a LLL reduction. This allows to progressively increase the needed precision and save the real lattice used to recover the coefficients. Let us now describe the procedures composing this algorithm. We use a function called RealBasisEmbedding which creates the vector of the basis elements of the multicubic field K computed in ℝ to a given precision. Then we can create the matrix representing the basis as a lattice. Write v the column vector RealBasisEmbedding((d1, …, dn), l). We choose as a “real basis matrix” the following
where C is a coefficient chosen to avoid errors due to the precision. We typically used
with U being a unitary matrix. If we save this unitary operator we can then first calculate
then apply the LLL algorithm to finally reduce the lattice. This reduction is done by multiplying by a unitary operator V and the full reduction can be written
Therefore we can now save V × U and use the same process if we need to actualise again the precision. Now recall that we want to compute cube roots. Given L a real lattice matrix for K here how we can expect to do so. Consider y ∈ K as before. First compute x up to precision l in ℝ. Write RealEmbedding this procedure and the returned value xl. Then create the row vector x = [xl | 0 | B] with B being a coefficient larger than the maximum euclidean norm of the rows of L. We can then build the matrix
Algorithm 3
Compute a matrix representing the real embedding of the matrix of a multicubic field – RealLattice
| Require: A LLL-reduced real lattice matrix of (d1, …, dn), a unitary operator U, a precision l |
| Ensure: A LLL-reduced real lattice matrix of (d1, …, dn) at precision l and the corresponding unitary operator |
| 1: v ← RealBasisEmbedding(d, l) |
| 2: M ← U × ([v | C ⋅ Id]) |
| 3: L, V ← LLL(M) ⊳ L = LLL(M) = VM |
| 4: returnL, V × U |
and apply a LLL algorithm to it. This can be seen as the overall reduction of
which would reduce the last vector with respect to the real basis lattice. Considering the shape of the last matrix we expect the central part of the last row vector to be the vector of coefficients of Cx in K. We denote by CubeRootCandidate this procedure. Once we have this candidate we can check its validity by computing its cube and looking whether it is y or not. If not we can increase the precision and find another candidate. We can evaluate the needed precision with a function PrecisionEvaluation. This function takes y and n the number of primes defining K in argument. Experiments suggest that for a given degree the precision is linear in log(∥y∥2). However the slope increases with n and seems to be multiplied by a coefficient between 2 and 3. We choose to use 3 so the slope for K of dimension 3n is 3n–1.
Remark 4.1
In fact as in [4] Algorithm 5 is valid only in ℤ[B] where B is the chosen basis. But an element y = x3 with integral coefficient can have a cube root with rational ones. Therefore, to ensure that the algorithm will finish, one has to compute the cube root of D3y with D ∈ ℤ such that Dx has integral coefficients. The dimension of the field 3n is a valid choice, ensured by Proposition 3.31.
Complexity : The algorithm consists essentially in applying several LLL with coefficients of size given by PrecisionEvaluation. Denote by B an upper bound on the bit size of coefficients of y. Then the complexity of CubeRootCandidate would be O(N5B2). We might have to increase the precision but experimentally it is only done a few times. We expect the complexity to stay in O(N5B2).
4.4 Computing units
We will describe in this section the algorithm used to compute the units of a multicubic field. As mentioned before we will mainly proceed as in the multiquadratic case. We will recursively compute the units of chosen subfields and then retrieve the whole group by detecting cubes and computing their cube root. Therefore the algorithm can be seen as computing the subgroup MCU(K) and then deduce
CubicUnitGroup;
BasisFromGeneratingSet;
UnitsFromCubes.
Algorithm 4
Compute a candidate for a cube root in a multicubic field – CubeRootCandidate
| Require: An cube element y = x3 in a multicubic field K of dimension N, a precision l and a real basis lattice of K for precision l |
| Ensure: x′ a candidate for x |
| 1: xl ← RealEmbedding(y, l) |
| 2: x ← [xl | 0 | B] |
| 3: |
| 4: |
| 5: returnx′ |
The first one is the classical unit group algorithm implemented in Magma. We apply it only to compute the multicubic units. The last two algorithms are adapted from [4] in the multicubic case. BasisFromGeneratingSet takes into argument a generating set of a subgroup of
to reduce the matrix of the ApproxLogK(ui, l) and recover as well V the unitary transform. We therefore obtain a basis of ApproxLogK(U) and can compute the corresponding elements of K by using V. The stretched Identity matrix allows to recover a matrix V with relatively small relations in a way similar to what did the authors of [4]. The function UnitsFromCubes computes a generating set of
Algorithm 5
Computing a cube root in a multicubic field – MC_CubeRoot
| Require: An cube element y = x3 in a multicubic field K = ℚ |
| Ensure: The cube root x of y |
| 1: l ← PrecisionEvaluation(y, n) |
| 2: L, U ← RealLattice(d, l) |
| 3: x′ ← CubeRootCandidate(y, l, L) |
| 4: while(x′)3 ≠ ydo |
| 5: l ← 2l |
| 6: L, U ← RealLattice(d, l, L, U) |
| 7: x′ ← CubeRootCandidate(y, l, L) |
| 8: end while |
| 9: returnx′ |
Algorithm 6
Compute the unit group of a multicubic field – MC_Units
| Require: A reduced sequence (d1, …, dn) defining a multicubic field, a precision factor l. |
| Ensure: A basis {u1, …, ur} of the torsion-free part of unit group |
| 1: ifn = 1 then |
| 2: u ← CubicUnitGroup(K) |
| 3: return (u, CubicApproxLog(u, l)) |
| 4: else |
| 5: Choose v, w two independent elements of H(K͠) and recursively compute a basis of U = |
| 6: V ← UnitsFromCubes(U) ⊳ Algorithm 2 and Algorithm 5 |
| 7: U ← BasisFromGeneratingSet(〈U, V〉) |
| 8: returnU |
| 9: end if |
Complexity : The complexity of the algorithm is Poly(N, B) where B is an upper-bound on the bit-size of the elements we are computing.
4.5 Principal Ideal Problem
Our main goal is to find a short generator for a given principal ideal of K. This problem can be solved by finding a generator first and finding a short vector using the Log-unit lattice. Since we can compute the unit group we “only” need to find a generator of an ideal. An ideal I can be described by several representations, for example:
an integral basis;
We consider the more basic situation which is the first one. It has the advantage of being more general. However it is a much bigger representation and operations may be much slower. For example one fundamental operation on ideals for the PIP algorithm in multiquadratic fields and multicubic fields is the relative norm computation. Given an ideal I of a number field K and L a subfield of K the relative norm of I with respect to K/L is the ideal of L generated by the norms NK/L(x) for x ∈ I. If K/L is a Galois extension then we have
This is for example the case if K and L are multiquadratic fields. Multicubic fields are not Galois however the situation is pretty similar. Instead of computing the product over Gal(K/L) we compute it over the complex embeddings which are the identity when restricted to L and the product is done in K͠. Then one way of computing NK/L(I) given an integral basis (b1, …, bn) is to calculate all of the products ∏σσ(bσ) with bσ ∈ {b1, …, bn}, express them in basis of 𝓞K, then reduce the matrix obtained by calculating its Hermite Normal Form (HNF) for example and finally intersect with F. We can see that this requires to compute [K : L]–1 product of ideals of K. The complexity of the HNF is polynomial in the degree of K however it is still quite slow. In Algorithm 7 the fields considered are K a multicubic field of dimension 3n and L a multicubic field of dimension 3n–1. Therefore K/L is a degree 3 extension and the embeddings in Hom(K, ℂ) which are the identity on L are {1, σ(β), σ(2β)} for a given β. Therefore we need to compute two ideal products which are done by reducing matrices of 32n vectors in a HNF with 3n rows.
The PIP algorithm in multicubic fields is similar to the one for multiquadratic fields as their algebraic structure are almost the same. Given an ideal I we compute recursively a generator for each of four norm ideals in subfields, combine them to yield a generator h of I3 and finally find ϵ ∈
for any independent u, v in H(K͠). For clarity write N1, N2, N3, N4 the four considered relative norm operators and g1, g2, g3, g4 the four relative norm elements such that
Then for all i ∈ ⟦1, 4⟧, gi is a generator of the principal ideal Ni(I). If hi is a generator of Ni(I) then we have hi = giϵi with ϵi a unit of the fixed subfield so of K. Then we have
Finally if we find a unit ϵ such that hϵ is a cube we can retrieve gη by computing
Remark that to solve the PIP in the cubic subfields in Algorithm 7, we use a classical algorithm named CubicPrincipalIdeal as we used CubicUnitGroup in Algorithm 6. Moreover it is not precised but we compute the approximate logarithm of the retrieved generators of cubic fields. Then we compute the logarithm of the final generator of I only doing sums and division by three.
Algorithm 7
Solve the PIP – MC_PIP
| Require: A principal ideal I of a multicubic field K |
| Ensure: A generator g of I |
| 1: ifn = 1 then |
| 2: g ← CubicPrincipalIdeal(K) |
| 3: returng |
| 4: else |
| 5: Choose u, v two indepedent elements of H(K͠) and recursively compute generators h1, h2, h3, h4 of NKu(I), NKv(I), NKuv(I), NKu2v(I) |
| 6: g ← GeneratorFromCube |
| 7: returng |
| 8: end if |
4.6 Shortening of the generator
Now the problem that we want to solve is the SPIP. Assume that we know that I has a short generator.
Once a generator h of the ideal I is found, one can choose from several techniques to try to recover the secret g or a short enough generator. In [13] the authors used the dual lattice. They considered a subgroup C of
In [4] the shortening procedure is a rounding. The authors considered the vector Log(h) = Log(g) + Log(u) expressed in the basis Log(
and reduce it with a LLL algorithm. If LogK(g) is short respectively to the Log-unit lattice this is expected to reduce the last row to the Log-embedding of the closest generator. If we compute the unitary operator corresponding to this LLL reduction we can retrieve u and g.
Algorithm 8
Shorten a given generator of an ideal – ShortGen
| Require: A generator h of a principal ideal I, |
| Ensure: A candidate g for a short generator. |
| 1: L ← [ApproxLogK(ui)]i∈⟦1,m⟧ |
| 2: B ← max{∥L[i]∥2 | i ∈ ⟦1, m⟧} |
| 3: |
| 4: return |
4.7 Experiments and Results
We present here the data we collected from computations. We considered multicubic fields defined by prime sequences (p1, …, pn). We did computations essentially for multicubic fields defined by n primes with n equal to 2, 3 and 4. These correspond to fields of dimension 9, 27 and 81. We did some computations for fields defined by 5 primes i.e. with dimension 243.
Computing
Recall that we compute units of a multicubic field K recursively and at each step the main procedure is CubeRoot presented in Algorithm 5. The efficiency of the overall algorithm is strongly related to the efficiency of CubeRoot and tends to be dominated by it. This is illustrated by the times computed in Table 1. In Figure 1 we can find the times for n = 2 printed. It illustrates well the correlation between the time taken to compute the units and the time taken to compute cube roots. If we analyse the function CubeRoot we can see that it depends on the dimension, the sequence defining the field K and the norm of the elements it is given. Therefore together with the times we computed the number of cube roots computed by the last call to CubeRoot in Algorithm 6 and the average of the logarithm of their norms. We can understand from these data why the algorithm does not scale as the algorithm in [4]. The norm of the elements from which we compute cube root seems to scale poorly and we have to compute more cube roots when the degree increases. Moreover the efficiency seems to decrease quickly with increasing primes.
Times to compute
Times and data for Algorithm 5 and 6 for number fields defined by consecutive primes for n = 2, 3, 4 and 5
| (a) n = 2 | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| First prime | 2 | 3 | 5 | 7 | 11 | 13 | 17 | 19 | 23 | 29 |
| 0.260 | 0.260 | 0.260 | 0.270 | 0.290 | 0.350 | 0.330 | 0.360 | 0.480 | 0.320 | |
| CubeRoot (times in s) | 0.010 | 0.010 | 0.010 | 0.010 | 0.000 | 0.050 | 0.060 | 0.070 | 0.180 | 0.010 |
| # cube roots | 3 | 3 | 1 | 1 | 1 | 1 | 1 | 2 | 3 | 1 |
| Average logarithm of the Norm of cubes | 3 | 18 | 31 | 45 | 24 | 215 | 270 | 175 | 162 | 70 |
| (b) n = 3 | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| First prime | 2 | 3 | 5 | 7 | 11 | 13 | 17 | 19 | 23 | 29 |
| 2.110 | 2.250 | 2.490 | 4.500 | 2.780 | 18.780 | 4.060 | 24.810 | 9.230 | 24.420 | |
| CubeRoot (times in s) | 0.060 | 0.180 | 0.350 | 2.310 | 0.350 | 15.980 | 1.020 | 16.540 | 5.950 | 16.490 |
| # cube roots | 3 | 4 | 3 | 4 | 2 | 5 | 4 | 5 | 4 | 3 |
| Average logarithm of the Norm of cubes | 13 | 29 | 46 | 127 | 83 | 404 | 112 | 398 | 313 | 781 |
| (c) n = 4 | |||||||
|---|---|---|---|---|---|---|---|
| First prime | 2 | 3 | 5 | 7 | 11 | 13 | 17 |
| 39.670 | 71.160 | 157.460 | 873.670 | 7479.250 | 9862.540 | 29308.850 | |
| CubeRoot (times in s) | 19.220 | 47.270 | 130.240 | 832.780 | 7370.470 | 9271.600 | 28425.140 |
| # cube roots | 14 | 12 | 10 | 11 | 11 | 11 | 13 |
| Average logarithm of the Norm of cubes | 29 | 75 | 168 | 533 | 1090 | 2178 | 3295 |
| (d) n = 5 | |||
|---|---|---|---|
| First prime | 2 | 3 | 5 |
| 16026.410 | 87701.680 | 566029.130 | |
| CubeRoot (times in s) | 15246.560 | 85036.150 | 562127.470 |
| # cube roots | 36 | 36 | 48 |
| Average logarithm of the Norm of cubes | 63 | 199 | 531 |
Complexity : An analysis of the norm of the units that the algorithm compute cube roots of can be found in Appendix and gives a bound essentially polynomial in
We obtained better results that the standard algorithm implemented in Magma. For example we can see in Table 2 the times to compute units for consecutive primes and n = 2. We can see that the size of primes has a strong impact. It took 2540.490 seconds to compute the units of the field defined by (2, 3, 5) and did not retrieve the units of the field defined by (3, 5, 7) after 34 hours.
Times to compute
| First prime | 2 | 3 | 5 | 7 | 11 | 13 | 17 | 19 | 23 | 29 |
|---|---|---|---|---|---|---|---|---|---|---|
| 0.190 | 0.200 | 0.240 | 0.520 | 2.190 | 8.510 | 0.700 | 61.480 | 200.540 | 503.640 |
Retrieving a short generator
For each given size of keys (except 243) we chose two sequences. The first is the n consecutive primes and the second follows an arithmetic progression i.e. p1 is fixed and the pk+1 is NextPrime(pk + 4) for each k. We considered keys as vectors of coefficients drawn uniformly at random in {–1, 0, 1}. This type of keys are indeed “short vectors” in the ideal lattice they generate. The data are presented in Table 3. For each n and each progression the first row is the percentage of exact decoding and the second is the percentage of shorter generators – exact of strictly shorter generators – retrieved.
Percentages of keys recovered for n = 2, 3 and 4
| (a) n = 2 | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| First prime | 2 | 3 | 5 | 7 | 11 | 13 | 17 | 19 | 23 | 29 |
| Consecutive | 35.20 | 90.80 | 98.40 | 98.20 | 100.0 | 100.0 | 99.70 | 99.80 | 100.0 | 100.0 |
| 46.20 | 91.50 | 98.40 | 98.20 | 100.0 | 100.0 | 99.70 | 99.80 | 100.0 | 100.0 | |
| Arithmetic | 69.90 | 95.10 | 98.60 | 97.40 | 100.0 | 99.80 | 100.0 | 99.80 | 100.0 | 100.0 |
| 75.20 | 95.10 | 98.60 | 97.40 | 100.0 | 99.80 | 100.0 | 99.80 | 100.0 | 100.0 | |
| (b) n = 3 | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| First prime | 2 | 3 | 5 | 7 | 11 | 13 | 17 | 19 | 23 | 29 |
| Consecutive | 46.00 | 93.30 | 100.0 | 99.91 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| 46.40 | 93.30 | 100.0 | 99.91 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | |
| Arithmetic | 84.10 | 99.59 | 100.0 | 99.50 | 100.0 | n/a | n/a | n/a | n/a | n/a |
| 84.10 | 99.59 | 100.0 | 99.50 | 100.0 | n/a | n/a | n/a | n/a | n/a | |
| (c) n = 4 | ||||||||
|---|---|---|---|---|---|---|---|---|
| First prime | 2 | 3 | 5 | 7 | 11 | 13 | 17 | 19 |
| Consecutive | 64.20 | 99.91 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| 64.20 | 99.91 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | |
| Arithmetic | 95.00 | 100.0 | 100.0 | 100.0 | 100.0 | n/a | n/a | n/a |
| 95.00 | 100.0 | 100.0 | 100.0 | 100.0 | n/a | n/a | n/a | |
We can remark that the probability of success seems to converge to 1 as the primes of the defining sequence increase. The probability of failure is particularly big when the smaller primes are in the sequence, especially two. The same phenomenon were noticed in [4]. Moreover we can see that the rate of generators retrieved which were strictly shorter than the key follow the inverse pattern. It is quite high compared to the rate of retrieved key when the latest is low and n = 2 and tends to 0 otherwise. For the multicubic field defined by the sequence (2, 3, 5, 7, 11) we retrieved exactly 74.02 % of the keys and no shorter generator and for the field defined by (3, 5, 7, 11, 13) we retrieved exactly all of the keys.
These results tend to show that multicubic fields should not be used to build cryptosystems. Even if we are still too slow to attack dimensions of cryptographic interest the results we obtained suggest that the we can easily recover short vectors using the Log-unit lattice. Finally in post-quantum perspective we have to think that computing
References
[1] L. Babai, On Lovász’ lattice reduction and the nearest lattice point problem, Combinatorica 6(1), (1986).10.1007/BFb0023990Search in Google Scholar
[2] P. Barrucand, Quelques aspects de la théorie des corps cubiques, Séminaire Delange-Pisot-Poitou. Théorie des nombres 16, (1974-1975), 1–10.Search in Google Scholar
[3] P. Barrucand, J. Loxton, H. C. Williams, Some explicit upper bounds on the class number and regulator of a cubic field with negative discriminant, Pacific Journal of Mathematics, 128(2), (1987), 209–222.10.2140/pjm.1987.128.209Search in Google Scholar
[4] J. Bauch, Daniel J. Bernstein, H. de Valence, T. Lange, C. Van Vredendaal, Short generators without quantum computers : The case of multiquadratics, in: Advances in Cryptology, EUROCRYPT 2017 - 36th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Proceedings., Lecture Notes in Computer Science 10210, LNCS Springer Verlag (2017), 27–59.10.1007/978-3-319-56620-7_2Search in Google Scholar
[5] K. Belabas, Topics in computational algebraic number theory, in: Journal de théorie des nombres de Bordeaux, 16(1), (2004), 19–63.10.5802/jtnb.433Search in Google Scholar
[6] J.-F. Biasse, F. Song, Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields, in: Proceedings of the Twenty-Seventh Annual ACM-SIAM Symposium on Discrete Algorithms, 893-902.10.1137/1.9781611974331.ch64Search in Google Scholar
[7] W. Bosma, J. Cannon, and C. Playoust, The Magma algebra system. I. The user language, J. Symbolic Comput., 24 (1997), 235–265.10.1006/jsco.1996.0125Search in Google Scholar
[8] J. P. Buhler, H. W. Lenstra, Jr., C. Pomerance, Factoring integers with the number field sieve, in: The development of the number field sieve, Lecture Notes in Math., 1554, Springer, Berlin (1993), 50-94.10.1007/BFb0091539Search in Google Scholar
[9] P. Campbell, M. Groves, D. Shepherd, Soliloquy : a cautionary tale, ETSI 2nd Quantum-Safe Crypto Workshop, 2014, http://docbox.etsi.org/Workshop/2014/201410_CRYPTO/S07_Systems_and_Attacks/S07_Groves_Annex.pdf.Search in Google Scholar
[10] A. P. Chalmeta, On the Units and the Structure of the 3-Sylow Subgroups of the Ideal Class Groups of Pure Bicubic Fields and their Normal Closures, Ph.D. thesis, Virginia Polytechnic Institute and State University, 2006.Search in Google Scholar
[11] H. Cohen, A Course in computational algebraic number theory, Springer-Verlag, Berlin, Heidelberg, 1995.Search in Google Scholar
[12] H. Cohen, Advanced Topics in Computational Number Theory, Graduate Texts in Mathematics, Springer, New York, 1999.10.1007/978-1-4419-8489-0Search in Google Scholar
[13] R. Cramer, L. Ducas, C. Peikert, O. Regev, Recovering Short Generators of Principal Ideals in Cyclotomic Rings, in: Fischlin M., Coron JS. (eds) Advances in Cryptology, Lecture Notes in Computer Science, vol 9666. Springer, Berlin, Heidelberg (2016).Search in Google Scholar
[14] K. Eisenträger, S. Hallgren, A. Kitaev and F. Song, A Quantum Algorithm for Computing the Unit Group of an Arbitrary Degree Number Field, in: Proceedings of the Forty-sixth Annual ACM Symposium on Theory of Computing, ACM, New York (2014).Search in Google Scholar
[15] C. Gentry, A fully homomorphic encryption scheme, Ph.D. thesis, Stanford University, 2009, https://crypto.stanford.edu/craig.Search in Google Scholar
[16] C. Gentry and S. Halevi, Implementing Gentry’s fully-homomorphic encryption scheme, in: Kenneth G. Paterson, editor, Advances in Cryptology - EUROCRYPT 2011 - 30th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Tallinn, Estonia, May 15-19, 2011. Proceedings, Lecture Notes in Computer Science, 6632, Springer (2011), 129–148.10.1007/978-3-642-20465-4_9Search in Google Scholar
[17] A. K. Lenstra, H. W. Lenstra, L. Lovász, Factoring polynomials with rational coefficients, Mathematische Annalen, 261(4), (1982), 515–534.10.1007/BF01457454Search in Google Scholar
[18] C. J. Parry, Class number formulae for bicubic fields, Illinois J. Math., 1, (1977), 148–163.10.1215/ijm/1256049510Search in Google Scholar
[19] P. Samuel, Algebraic theory of numbers, Paris, Hermann; Boston, Houghton Mifflin Co., 1970.Search in Google Scholar
[20] N. P. Smart, F. Vercauteren, Fully homomorphic encryption with relatively small key and ciphertext sizes, in: Phong Q. Nguyen and David Pointcheval, editors, Public Key Cryptography - PKC 2010, 13th International Conference on Practice and Theory in Public Key Cryptography, Paris, France, May 26-28, 2010. Proceedings, Lecture Notes in Computer Science, 6056, Springer (2010), 420–443.10.1007/978-3-642-13013-7_25Search in Google Scholar
Appendix : An upper bound on the norm of cubes
We will give an upper bound for the norm of the units that we compute the cube root of in Algorithm 6 depending on the degree and the sequence defining the multicubic field K. Write (d1, …, dn) this sequence. We assume that they are prime numbers. Let us fix v is a unit in K found by CubeKernel in Algorithm 6. As stated before MC_CubeRoot consists essentially in several LLL procedures applied to matrices of size approximately N with coefficients of size evaluated by PrecisionEvaluation. In order to find the complexity of the LLL used to compute the cube root of u we need to bound PrecisionEvaluation(v) = 3n × log(∥v∥). We therefore need to evaluate ∥v∥. We will consider here the infinity norm. For x, y ∈ K we have
Consider C(k, d) = sup{∥v∥∞ | v ∈
If we designate by P(1 + 2d) the product we have
If we assume that ∥x∥∞ ⩽ ∥x3∥∞ ⩽ for any x ∈ K we can write
Then if we write ck = 3k – 1 we have
which gives rise to
and therefore
Thus we can bound log(∥v∥∞) by N ×
and by using an upper bound for the regulator of pure cubic fields and the discriminant of a pure cubic field we have
where P(d) =
If we compare this bound to the experimental results the subexponential part seems reasonable. However the norm of the elements that we work with during the algorithm seem to be lower in general.
Appendix B: Discriminant of multicubic fields
In this section we will study the discriminant of multicubic fields i.e. number fields of the form ℚ
Notations
𝔇(L/K) relative discriminant of L/K
𝔡(L/K) relative different of L/K
NL/K relative norm of L/K
D(K) aabsolute discriminant of K
Proof of Lemma 3.26
Assume p | d1 and p | d2. Without loss of generality one can assume p2 ∤ d1 and p2 | d2. Then fix
Proof of Lemma 3.27
Let p ∈ ℙ(d). There is i0 ∈ ⟦1, n⟧ such that p | di0. Without loss of generality one can assume i0 = 1. Then apply Lemma 3.26 to every (d1, di) with i > 1.□
Proof of Lemma 3.28
Assume d1 ≠ ± 1 (mod 9) and d2 ≠ ± 1 (mod 9). One can replace
Proof of Proposition 3.29
First assume that 3 does not appear in the prime decomposition of any of the di, i ∈ ⟦1, n⟧. Then two cases arise. Either di = ± 1 (mod 9) for all i ∈ ⟦1, n⟧ and nothing need to be done, either there is i0 ∈ ⟦1, n⟧ such that di0 = 2, 4, 5, 7 (mod 9). Without loss of generality one can assume that i0 = 1, and for all j > 1 such that dj ≠ ± 1 (mod 9) one can apply Lemma 3.28 to (d1, dj) and assume that dj = ± 1 (mod 9). This corresponds to (ii). Now assume that 3 divides di0 for some i0 ∈ ⟦1, n⟧. Again one can assume i0 = 1 and – by applying Lemma 3.27 – that 3 ∤ di for all i ∈ ⟦2, n⟧. Finally we can apply the first case to the sequence (d2, …, dn) which gives rise to the two last possibilities of the proposition.□
We will now prove Theorem 3.30. Remark that the formulae can be extended to pure cubic fields – see for instance [11] – and were proven by Chalmeta in [10] for bicubic fields. In order to determine the discriminant of multicubic fields we will study the splitting of primes in such fields. A prime p divides D(K) if, and only if, it ramifies in K. Moreover given two linearly disjoint fields K1 and K2 the discriminant of their compositum D(K1K2) divides the product D(K1)[K2:ℚ]D(K2)[K1:ℚ]. If we apply this to a multicubic field we obtain that a prime p divides D(K) if, and only if, it divides one of the discriminant of the pure cubic fields ℚ(
Proposition 4.2
ConsiderK = ℚ
Proof
The result is true for n = 1, see for instance [11]. Suppose now that n ⩾ 2. By using Lemma 3.27 one can assume p | d1 and p ∤ di for any i in ⟦2, n⟧. Let K1 = ℚ(
We will now study the splitting of 3 in K in function of the four types of multicubic fields established in Proposition 3.29.
Proposition 4.3
Consider a multicubic fieldK = ℚ
with
Proof
We will prove the result by induction on n. The result is true for n = 1, see [11] for instance. Consider n ⩾ 2 and suppose the result to be true for n – 1. Write K1 = ℚ
First we consider the splitting of (3) in the Galois closure
Then for all i ∈ ⟦1, s⟧ the ideal 𝔭i splits totally in K͠ therefore it splits totally in K too. On the contrary 𝔭̃ is not totally split in K̃ so 𝔭 is not totally split in K. We have
and we know that f(𝔓j|𝔭) for all j ∈ ⟦1, g⟧ so
We stated above that g = 3 and e(𝔓j|𝔭) = 1 for all j ∈ ⟦1, g⟧ is not possible. Clearly g = 1 and e(𝔓1|𝔭) = 3 is not possible either. Finally we have
which gives
and
Corollary 4.1
Under the same conditions for the sequencedone has
Proof
The part of the different 𝔡(K/ℚ) above 3 is
because 3 is coprime to 1 and 2. Therefore one has
□
Now we will consider the second type of multicubic fields.
Proposition 4.4
Consider a multicubic fieldK = ℚ
and consequently
Proof
As in the proof of the previous proposition, consider K1 = ℚ(
Now consider 𝔓 dividing 𝔮i in K for a given i ∈ ⟦1, s + 1⟧. By the multiplicativity of the ramification index 3 | e(𝔓|𝔮i) and we know that e(𝔓 | 𝔮i) ⩽ [K : K2] = 3 so e(𝔓 | 𝔮i) = 3. We obtain the claimed splitting of 3 in K. For any i ∈ ⟦1, s +1⟧ let us denote by 𝔓i the ideal of K such that 𝔓i | 𝔮i. In order to study the discriminant consider the splitting of 𝔭 in K which is
□
We will consider the third type of multicubic fields. The proof is very similar.
Proposition 4.5
Consider a multicubic fieldK = ℚ
and consequently
Proof
Fix K1 = ℚ(
Finally we will consider the last type of multicubic field. The proof is similar to the last two cases.
Proposition 4.6
Consider a multicubic fieldK = ℚ
and consequently
Proof
Fix K1 = ℚ(
© 2020 A. Lesavourey et al., published by De Gruyter
This work is licensed under the Creative Commons Attribution 4.0 International License.
