arXiv subjects

Yanbin Pan

Publications and source records attributed to Yanbin Pan.

11 recordsLinked to original sources

arXiv2026

SVP Is NP-Hard for Some Rank-2 Cyclotomic Modules

Let $q$ range over primes congruent to $3$ modulo $4$. Let $\zeta_q$ be a primitive $q$th root of unity, and put $K=\mathbb{Q}(\zeta_q)$, with ring of integers $\mathcal{O}_K=\mathbb{Z}[\zeta_q]$. We prove that the decision version of the Shortest Vector Problem ($\mathrm{SVP}$) in the $\ell_2$-norm is $\mathrm{NP}$-complete on full-rank free submodules of $\mathcal{O}_K^2$ by a deterministic polynomial-time many-one reduction from Exact Cover by 3-Sets (X3C). The module rank is fixed at two. As a $\mathbb{Z}$-lattice, the module has rank $2(q-1)$, which grows with $q$. The main obstacle is closure under the action of $\mathcal{O}_K$. A module containing a nonzero vector also contains every scalar multiple of that vector by a nonzero element of $\mathcal{O}_K$, and some of these multiples may be shorter. Three ideas overcome this obstacle. First, we map the Bennett--Peikert Reed--Solomon lattice to a principal cyclotomic ideal and use Wan's point-count estimates to prove that a coset of this ideal contains many binary coefficient representatives. Second, a checker based on a quadratic Gauss sum turns the X3C equations into a canonical squared norm. Third, the checker and a second module coordinate combine with a separation bound for ideal cosets to rule out every unintended vector created by the $\mathcal{O}_K$-action. Each constructed instance consists of a prime $q\equiv3\pmod4$, two integral generators whose $2\times2$ generator matrix has nonzero determinant, and an integer squared threshold. The construction also gives $\mathrm{NP}$-hardness of search-$\mathrm{SVP}$ under polynomial-time Turing reductions.

cs.CC↗

arXiv2026

Exact CVP Is NP-Complete for Principal Cyclotomic Ideals

We prove that exact Euclidean decision-CVP is $\mathsf{NP}$-complete on coefficient lattices of nonzero principal ideals in the power-of-two cyclotomic rings $R_d=\mathbb{Z}[y]/(y^d+1)$. A deterministic reduction from X3C produces an integral target and squared threshold $\Delta$ such that the closest squared distance is exactly $\Delta$ in YES instances and at least $\Delta+4$ in NO instances. The ideal elements within squared distance $\Delta$ are in bijection with exact covers, which also gives $\mathsf{NP}$-hardness of exact search-CVP under polynomial-time Turing reductions. We further lift these instances to full-rank principal ideals of $\mathbb{Z}[X]/(X^D-1)$, where $D=2d$. The lift preserves principality, doubles the dimension, and scales corresponding squared distances by eight. Hence exact decision-CVP is $\mathsf{NP}$-complete and exact search-CVP is $\mathsf{NP}$-hard on principal cyclic ideal lattices. Both results admit uniformly computable fixed-family forms: for each X3C universe size, the principal cyclotomic and cyclic ideals can be fixed before the triple collection is known, with only the targets and thresholds depending on the collection. If exact decision-CVPP were polynomial-time solvable on either family, then $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$; by Karp--Lipton, the polynomial hierarchy would collapse to $\Sigma_2^{\mathsf P}$. To our knowledge, the cyclic results resolve the exact decision versions of Micciancio's questions for cyclic lattices and fixed cyclic-lattice families.

cs.CC↗

arXiv2026

Subset Balancing and Generalized Subset Sum via Lattices

We study the Subset Balancing problem: given $x \in \mathbb{Z}^n$ and a coefficient set $C \subseteq \mathbb{Z}$, find a nonzero vector $c \in C^n$ such that $c\cdot x = 0$. The standard meet-in-the-middle algorithm runs in time $\tilde{O}(|C|^{n/2})$, and recent improvements (SODA 2022, Chen, Jin, Randolph, and Servedio; STOC 2026, Randolph and W\k{e}grzycki) beyond this barrier apply mainly when $d$ is constant. We give a reduction from Subset Balancing with $C = \{-d, \dots, d\}$ to a single instance of SVP$_{\infty}$ in dimension $n+1$. Instantiating this reduction with the best known $\ell_\infty$-SVP algorithms yields a deterministic $\tilde{O}((6\sqrt{2\pi e})^n)$-time algorithm and a randomized $\tilde{O}(2^{2.443n})$-time algorithm. The exponent depends only on $n$, improving on meet-in-the-middle for all $d\ge 15$. For sufficiently large $d$ we also obtain a polynomial-time algorithm. The reduction extends from the box constraint $[-d,d]^n$ to any centrally symmetric convex body $K\subseteq\mathbb{R}^n$, giving deterministic time $\tilde{O}(2^{c_K n})$ for a constant $c_K$ depending only on the shape of $K$. We further study the Generalized Subset Sum problem of finding $c \in C^n$ such that $c \cdot x = \tau$. For $C = \{-d, \dots, d\}$ or $C = \{-d,\dots,d\}\setminus\{0\}$, we reduce the worst-case problem to CVP$_{\infty}$ in dimension $n+1$. We observe that distances in our lattice take only integer values, so an approximate CVP$_{\infty}$ oracle still suffices, yielding a deterministic worst-case algorithm running in time $2^{O(n\log\log d)}$. In the average-case setting, we demonstrate that for both coefficient sets the embedded CVP$_{\infty}$ instance satisfies a bounded-distance promise with high probability, removing the $\log\log d$ factor altogether and obtaining a deterministic algorithm running in time $\tilde{O}((18\sqrt{2\pi e})^n)$.

cs.DS↗

arXiv2025

On Factoring and Power Divisor Problems via Rank-3 Lattices and the Second Vector

We propose a deterministic algorithm based on Coppersmith's method that employs a rank-3 lattice to address factoring-related problems. An interesting aspect of our approach is that we utilize the second vector in the LLL-reduced basis to avoid trivial collisions in the Baby-step Giant-step method, rather than the shortest vector as is commonly used in the literature. Our results are as follows: 1. Compared to the result by Harvey and Hittmeir (Math. Comp. 91 (2022), 1367 - 1379), who achieved a complexity of O( N^(1/5) log^(16/5) N / (log log N)^(3/5)) for factoring a semiprime N = pq, we demonstrate that in the balanced p and q case, the complexity can be improved to O( N^(1/5) log^(13/5) N / (log log N)^(3/5) ). 2. For factoring sums and differences of powers, that is, numbers of the form N = a^n plus or minus b^n, we improve Hittmeir's result (Math. Comp. 86 (2017), 2947 - 2954) from O( N^(1/4) log^(3/2) N ) to O( N^(1/5) log^(13/5) N ). 3. For the problem of finding r-power divisors, that is, finding all integers p such that p^r divides N, Harvey and Hittmeir (Proceedings of ANTS XV, Research in Number Theory 8 (2022), no. 4, Paper No. 94) recently directly applied Coppersmith's method and achieved a complexity of O( N^(1/(4r)) log^(10+epsilon) N / r^3 ). By using faster LLL-type algorithms and sieving on small primes, we improve their result to O( N^(1/(4r)) log^(7+3 epsilon) N / ((log log N minus log(4r)) r^(2+epsilon)) ). The worst-case running time for their algorithm occurs when N = p^r q with q on the order of N^(1/2). By focusing on this case and employing our rank-3 lattice approach, we achieve a complexity of O( r^(1/4) N^(1/(4r)) log^(5/2) N ). In conclusion, we offer a new perspective on these problems, which we hope will provide further insights.

math.NT↗

arXiv2025

A Provably Secure Network Protocol for Private Communication with Analysis and Tracing Resistance

Anonymous communication networks have emerged as crucial tools for obfuscating communication pathways and concealing user identities. However, their practical deployments face significant challenges, including susceptibility to artificial intelligence (AI)-powered metadata analysis, difficulties in decentralized architectures, and the absence of provable security guarantees. To address these issues, this paper proposes a novel decentralized anonymous routing protocol with resistance to tracing and traffic analysis. The protocol eliminates dependencies on the threshold model and trusted third-party setups, ensuring indistinguishable identity privacy even in highly adversarial environments. Different from traditional empirical security analysis of anonymous networks, this paper rigorously proves indistinguishable identity privacy for users even in extremely adversarial environments. Furthermore, simulations confirm its practical feasibility, demonstrating both security and efficiency. By achieving information sharing with privacy preservation, the proposed protocol offers a provably secure solution for privacy-preserving communication in digital environments.

cs.CR↗

arXiv2024

Infinite families of optimal and minimal codes over rings using simplicial complexes

In this paper, several infinite families of codes over the extension of non-unital non-commutative rings are constructed utilizing general simplicial complexes. Thanks to the special structure of the defining sets, the principal parameters of these codes are characterized. Specially, when the employed simplicial complexes are generated by a single maximal element, we determine their Lee weight distributions completely. Furthermore, by considering the Gray image codes and the corresponding subfield-like codes, numerous of linear codes over $\mathbb{F}_q$ are also obtained, where $q$ is a prime power. Certain conditions are given to ensure the above linear codes are (Hermitian) self-orthogonal in the case of $q=2,3,4$. It is noteworthy that most of the derived codes over $\mathbb{F}_q$ satisfy the Ashikhmin-Barg's condition for minimality. Besides, we obtain two infinite families of distance-optimal codes over $\mathbb{F}_q$ with respect to the Griesmer bound.

cs.IT↗

arXiv2023

Embedding Integer Lattices as Ideals into Polynomial Rings

Many lattice-based crypstosystems employ ideal lattices for high efficiency. However, the additional algebraic structure of ideal lattices usually makes us worry about the security, and it is widely believed that the algebraic structure will help us solve the hard problems in ideal lattices more efficiently. In this paper, we study the additional algebraic structure of ideal lattices further and find that a given ideal lattice in a polynomial ring can be embedded as an ideal into infinitely many different polynomial rings by the coefficient embedding. We design an algorithm to verify whether a given full-rank lattice in $\mathbb{Z}^n$ is an ideal lattice and output all the polynomial rings that the given lattice can be embedded into as an ideal with time complexity $\mathcal{O}(n^3B(B+\log n)$, where $n$ is the dimension of the lattice and $B$ is the upper bound of the bit length of the entries of the input lattice basis. We would like to point out that Ding and Lindner proposed an algorithm for identifying ideal lattices and outputting a single polynomial ring that the input lattice can be embedded into with time complexity $\mathcal{O}(n^5B^2)$ in 2007. However, we find a flaw in Ding and Lindner's algorithm that causes some ideal lattices can't be identified by their algorithm.

cs.CR↗

arXiv2023

Generalized Implicit Factorization Problem

The Implicit Factorization Problem was first introduced by May and Ritzenhofen at PKC'09. This problem aims to factorize two RSA moduli $N_1=p_1q_1$ and $N_2=p_2q_2$ when their prime factors share a certain number of least significant bits (LSBs). They proposed a lattice-based algorithm to tackle this problem and extended it to cover $k>2$ RSA moduli. Since then, several variations of the Implicit Factorization Problem have been studied, including the cases where $p_1$ and $p_2$ share some most significant bits (MSBs), middle bits, or both MSBs and LSBs at the same position. In this paper, we explore a more general case of the Implicit Factorization Problem, where the shared bits are located at different and unknown positions for different primes. We propose a lattice-based algorithm and analyze its efficiency under certain conditions. We also present experimental results to support our analysis.

cs.CR↗

arXiv2022

On Rangasamy's outsourcing algorithm for solving quadratic congruence equations

Outsourcing computation is a desired approach for IoT (Internet of Things) devices to transfer their burdens of heavy computations to those nearby, resource-abundant cloud servers. Recently, Rangasamy presented a passive attack against two outsourcing algorithms proposed by Zhang et al. for solving quadratic congruence equations, which is widely used in IoT applications. Furthermore, he also proposed a modified algorithm to fix these schemes and claimed that his algorithm was correct and enabled secure and verifiable delegation of solving quadratic congruence equations in IoTs. However, we show that Rangasamy's modified algorithm has a flaw which makes it incorrect and also propose some further attacks to break the security claim, even when the flaw has been corrected.

cs.CR↗

arXiv2020

On the ideal shortest vector problem over random rational primes

Any ideal in a number field can be factored into a product of prime ideals. In this paper we study the prime ideal shortest vector problem (SVP) in the ring $ \Z[x]/(x^{2^n} + 1) $, a popular choice in the design of ideal lattice based cryptosystems. We show that a majority of rational primes lie under prime ideals admitting a polynomial time algorithm for SVP. Although the shortest vector problem of ideal lattices underpins the security of Ring-LWE cryptosystem, this work does not break Ring-LWE, since the security reduction is from the worst case ideal SVP to the average case Ring-LWE, and it is one-way.

cs.CR↗

arXiv2012

A New Reduction from Search SVP to Optimization SVP

It is well known that search SVP is equivalent to optimization SVP. However, the former reduction from search SVP to optimization SVP by Kannan needs polynomial times calls to the oracle that solves the optimization SVP. In this paper, a new rank-preserving reduction is presented with only one call to the optimization SVP oracle. It is obvious that the new reduction needs the least calls, and improves Kannan's classical result. What's more, the idea also leads a similar direct reduction from search CVP to optimization CVP with only one call to the oracle.

cs.CC↗