生成密码学上强的随机格基和识别$\mathbb{Z}^n$的旋转
Generating cryptographically-strong random lattice bases and recognizing rotations of $\mathbb{Z}^n$
摘要：
基于格的密码学依赖于生成难以完全约简的随机基。给定一个格基（例如密码系统的私有基），所有其他基都通过与$GL(n,\mathbb{Z})$中的矩阵相乘而相关。我们比较了各种方法的优势，以采样的随机元素的$GL(n,\mathbb{Z})$，发现一些是强于其他方面的问题，识别旋转的$\mathbb{Z}^n$晶格。特别是，将幂等生成器相乘的标准算法（如Magma的RandomSLnZ命令中所实现的）生成了最后一个问题的实例，即使在接近1，500的维度上也可以有效地破解。同样，我们发现，在NIST的后量子密码学竞争提交（DRS）之一的随机基生成方法生成的实例，可以有效地打破，即使在其256位的安全设置。描述了其他随机基生成算法（一些较旧，一些较新），这些算法似乎更强大。
英文摘要：
Lattice-based cryptography relies on generating random bases which are difficult to fully reduce. Given a lattice basis (such as the private basis for a cryptosystem), all other bases are related by multiplication by matrices in $GL(n,\mathbb{Z})$. We compare the strengths of various methods to sample random elements of $GL(n,\mathbb{Z})$, finding some are stronger than others with respect to the problem of recognizing rotations of the $\mathbb{Z}^n$ lattice. In particular, the standard algorithm of multiplying unipotent generators together (as implemented in Magma's RandomSLnZ command) generates instances of this last problem which can be efficiently broken, even in dimensions nearing 1,500. Likewise, we find that the random basis generation method in one of the NIST Post-Quantum Cryptography competition submissions (DRS) generates instances which can be efficiently broken, even at its 256-bit security settings. Other random basis generation algorithms (some older, some newer) are described which appear to be much stronger.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
