Léo Ducas 🇺🇦 ∀,≡,⊂

Dad of two. Prof of Mathematical Cryptology at Leiden University and researcher at the Centrum Wiskunde & Informatica. Loves lattices and algorithms. Toots in FR/EN.

webpage: https://homepages.cwi.nl/~ducas/
github: https://github.com/lducas/

Last Notes

2025-04-29 05:05:05 UTC

- reply

I'm guessing "not really". I interpret the quote as a complaint that such a proof not providing enough insight as to "why" the two quantities should be equal. But I'd love access to the full text, I am pretty sure she has a more articulate point.

2025-04-13 03:20:41 UTC

- reply

One of the major conference in cryptography issued the following statement:
https://crypto.iacr.org/2025/
"Given recent instances of US visa holders and residents being detained or deported by US immigration authorities, we understand that some members of our community may not feel safe traveling to the US for Crypto this year. We want to assure everyone that we will provide the option to present remotely. "

2025-02-12 03:41:31 UTC

- reply

it is as if, each time I wake up, I've switched to a dumber timeline. No more naps !

2025-01-13 06:34:00 UTC

- reply

shouldn't we be surprised that a system of 3 stars manager to keep it's planets ? #3body

2025-01-11 02:45:01 UTC

- reply

I use that quote (a bit too often) to reassure my students and mentees when they struggle at the first exposure to a new topic. For me it just mean: it takes time, but at some point you'll get it.

2024-12-10 19:39:31 UTC

- reply

Voilà !
https://mathstodon.xyz/@ducasleo/113629418126414648
Let's see if this commitment survives the holiday season. I've got all sort of excuse, including a baby and a young child to justify my laziness.

2024-12-10 03:42:21 UTC

- reply

well, I'm considering comiting to a weekly post of mathy side of lattice-based cryptography. I feel I am underusing this social media by mostly meming and ranting. Thanks for your question ;)

2024-12-09 21:01:18 UTC

- reply

There are two many exemple to list, so here is my favorite one: the digital signature switcharoo.
A good basis $G$ of a lattice $L$ serves as secret key, a bad as public key. Using the good basis we can find close lattice point $s$ to arbitrary targets. This is how we sign a message $m$. The bad basis suffices to verify that $s \in L$ and $\|s-m\|$ is small.
WLOG (thanks to hash functions) we can assume that $m$ is uniform in the $\mathbb R^n / L$.
There is a catch. Do that naively, and signing to many messages leaks the secret key. The naive approach simply tile the space according to the parallelipiped $P = B \cdot [0,1]^n\). Every message signature pair gives a uniform point in $P$, and $P$ can be learned given enough such samples.
The fix is to resort to a careful rerandomization, using discrete gaussian. The tiling is replaced by an algorithm that select a lattice point according to a discrete gaussian centered at $m$: i.e. with probability proportional to $-\exp(\|s-m\|^2 / 2\sigma^2 )$.
Using the smoothness argument, we can show that this process, producing $m$ uniform and then $s$ is statistically close to something that does not depend on the Secret key. Namely, choose $s$ first, and set $m=s + e$ for $e$ a continuous gaussian. $e \bmod L$ is close to uniform, and so is $m \bmod L$.

2024-12-09 19:14:11 UTC

- reply

These fast convergences play a key role for security proofs in lattice-based cryptography. There, they are rephrased as Gaussian distribution modulo a lattice $L$ quickly converging to the uniform distribution over the torus $\mathbb R^n/L$ as the variance increases (a property called smoothness).

2024-11-19 06:45:35 UTC

- reply

But that's just 0, you don't even need unicode for that 🤔