Phong Q. Nguyen

Learn More
Despite their popularity, lattice reduction algorithms remain mysterious cryptanalytical tools. Though it has been widely reported that they behave better than their proved worst-case theoretical bounds, no precise assessment has ever been given. Such an assessment would be very helpful to predict the behaviour of lattice-based attacks, as well as to select(More)
Lattice-based signature schemes following the Goldreich–Goldwasser–Halevi (GGH) design have the unusual property that each signature leaks information on the signer’s secret key, but this does not necessarily imply that such schemes are insecure. At Eurocrypt ’03, Szydlo proposed a potential attack by showing that the leakage reduces the key-recovery(More)
The most famous lattice problem is the Shortest Vector Problem (SVP), which has many applications in cryptology. The best approximation algorithms known for SVP in high dimension rely on a subroutine for exact SVP in low dimension. In this paper, we assess the practicality of the best (theoretical) algorithm known for exact SVP in low dimension: the sieve(More)
The Lenstra-Lenstra-Lovász lattice basis reduction algorithm (LLL or L) is a very popular tool in public-key cryptanalysis and in many other fields. Given an integer d-dimensional lattice basis with vectors of norm less than B in an n-dimensional space, L outputs a socalled L-reduced basis in polynomial time O(dn log B), using arithmetic operations on(More)
We re-examine Paillier's cryptosystem, and show that by choosing a particular discrete log base <i>g</i>, and by introducing an alternative decryption procedure, we can extend the scheme to allow an arbitrary exponent <i>e</i> instead of <i>N</i>. The use of low exponents substantially increases the efficiency of the scheme. The semantic security is now(More)
Bounded Distance Decoding (BDD) is a basic lattice problem used in cryptanalysis: the security of most lattice-based encryption schemes relies on the hardness of some BDD, such as LWE. We study how to solve BDD using a classical method for finding shortest vectors in lattices: enumeration with pruning speedup, such as Gama-NguyenRegev extreme pruning from(More)