dual attack LWE
198146580
A Hybrid of Dual and Meet in the Middle Attack on Sparse and Ternary Secret LWE
The dual attack is one of the most efficient attack algorithms for learning with errors (LWE) problem. Recently, an efficient variant of the dual attack for sparse and small secret LWE was reported by Albrecht (Eurocrypt 2017) which forces some LWE based cryptosystems, especially fully homomorphic encryptions (FHE) to change parameters. In this paper, we propose a new hybrid of dual and meet in the middle (MITM) attack, which outperforms the improved variant on the same LWE parameter regime. To this end, we adapt the MITM attack for NTRU due to Odlyzko to LWE and give a rigorous analysis for it. The performance of our MITM attack depends on the relative size of error and modulus, and hence, for a large modulus LWE samples, our MITM attack works well for quite large error. We then combine our MITM attack with Albrecht's observation that understands the dual attack as a dimension error tradeoff, which finally yields our hybrid attack. We also implement a sage module that estimates the attack complexity of our algorithm upon <italic>LWE estimator</italic> and our attack shows significant performance improvement for the LWE parameter for FHE. For example, for the LWE problem with dimension <inline formula> <tex math notation="LaTeX"$n=2^{15} /tex math>/inline formula> modulus <inline formula> <tex math notation="LaTeX"$q=2^{628} /tex math>/inline formula> and ternary secret key with Hamming weight 64 which is one parameter set used for <italic>HEAAN</italic> bootstrapping (Eurocrypt 2018) our attack takes 2<sup>112.5</sup> operations and 2<sup>70.6</sup> bit memory, while the previous best attack requires 2<sup>127.2</sup> operations as reported by the <italic>LWE estimator</italic>
IEEE Access
Jung Hee Cheon Minki Hhan Seungwan Hong Yongha Son
34678552
On Dual Lattice Attacks Against Small Secret LWE and Parameter Choices in HElib and SEAL
We present novel variants of the dual lattice attack against LWE in the presence of an unusually short secret. These variants are informed by recent progress in BKW style algorithms for solving LWE. Applying them to parameter sets suggested by the homomorphic encryption libraries HElib and SEAL yields revised security estimates. Our techniques scale the exponent of the dual lattice attack by a factor of (2\,L)(2\,L+1) when \log q \varTheta \left( L \log n\right) when the secret has constant hamming weight (h\ and where (L\ is the maximum depth of supported circuits. They also allow to half the dimension of the lattice under consideration at a multiplicative cost of (2^{h} operations. Moreover, our techniques yield revised concrete security estimates. For example, both libraries promise 80 bits of security for LWE instances with (n=1024\ and \log _2 q \approx {47} while the techniques described in this work lead to estimated costs of 68 bits (SEAL) and 62 bits (HElib)
EUROCRYPT
Martin R Albrecht
219332962
On a Dual/Hybrid Approach to Small Secret LWE A Dual/Enumeration Technique for Learning with Errors and Application to Security Estimates of FHE Schemes
In this paper, we investigate the security of the Learning With Error (LWE) problem with small secrets by refining and improv ing the so called dual lattice attack. More precisely, we use the dual attack on a projected sublattice, which allows generating instances of the LWE problem with a slightly bigger noise that correspond to a frac tion of the secret key. Then, we search for the fraction of the secret key by computing the corresponding noise for each candidate using the newly constructed LWE samples. As secrets are small, we can perform the search step very efficiently by exploiting the recursive structure of the search space. This approach offers a trade off between the cost of lattice reduction and the complexity of the search part which allows to speed up the attack. Besides, we aim at providing a sound and non asymptotic analysis of the techniques to enable its use for practical selection of se curity parameters. As an application, we revisit the security estimates of some fully homomorphic encryption schemes, including the Fast Fully Homomorphic Encryption scheme over the Torus (TFHE) which is one of the fastest homomorphic encryption schemes based on the (Ring )LWE problem. We provide an estimate of the complexity of our method for various parameters under three different cost models for lattice reduc tion and show that the security level of the TFHE scheme should be re evaluated according to the proposed improvement (for at least 7 bits for the most recent update of the parameters that are used in the imple mentation)
INDOCRYPT
Thomas Espitau Antoine Joux Natalia Kharchenko
19233697
Estimate all the {LWE, NTRU} schemes!
We consider all LWE and NTRU based encryption, key encapsulation, and digital signature schemes proposed for standardisation as part of the Post Quantum Cryptography process run by the US National Institute of Standards and Technology (NIST) In particular, we investigate the impact that different estimates for the asymptotic runtime of (block wise) lattice reduction have on the predicted security of these schemes. Relying on the "LWE estimator" of Albrecht et al. we estimate the cost of running primal and dual lattice attacks against every LWE based scheme, using every cost model proposed as part of a submission. Furthermore, we estimate the security of the proposed NTRU based schemes against the primal attack under all cost models for lattice reduction.
IACR Cryptol. ePrint Arch.
Martin R Albrecht Benjamin R Curtis Amit Deo Alex Davidson Rachel Player Eamonn W Postlethwaite Fernando Virdia Thomas Wunderer
218515865
On a hybrid approach to solve binary LWE
In this paper, we investigate the security of binary secret Learning With Error (LWE) To do so, we improve the classical dual lattice attack. More precisely, we use the dual attack on a projected sublattice, which allows to generate instances of the LWE problem with a slightly bigger noise that correspond to a fraction of the secret key. Then, we search for the fraction of the secret key by computing the corresponding noise for each candidate using the constructed LWE samples. As secrets are binary vectors, we can perform the search step very efficiently by exploiting the recursive structure of the search space. This approach offers a trade off between the cost of lattice reduction and the complexity of the search part which allows to speed up the attack. As an application we revisit the security estimates of the Fast Fully Homomorphic Encryption scheme over the Torus (TFHE) which is one of the fastest homomorphic encryption schemes based on the LWE problem. We provide an estimate of the complexity of our method for various parameters under three different cost models for lattice reduction and show that security level of the TFHE scheme should be re evaluated according to the proposed improvement. Our estimates show that the current security level of the TFHE scheme should be reduced by 10 bits for the parameters proposed in the latest version of the scheme and by 7 bits for the recent update of the parameters that are used in the implementation, available online.
IACR Cryptol. ePrint Arch.
Thomas Espitau Antoine Joux Natalia Kharchenko
49643347
Lattice Based Dual Receiver Encryption and More
Dual receiver encryption (DRE) proposed by Diament et al. at ACM CCS 2004, is a special extension notion of public key encryption, which enables two independent receivers to decrypt a ciphertext into a same plaintext. This primitive is quite useful in designing combined public key cryptosystems and denial of service attack resilient protocols. Up till now, a series of DRE schemes are constructed with bilinear pairing groups. In this work, we introduce the first construction of lattice based DRE. Our scheme is secure against chosen ciphertext attacks from the standard Learning with Errors (LWE) assumption with a public key of bit size about (2nm\log q\ where m and q are small polynomials in n. Additionally, for the DRE notion in the identity based setting, identity based DRE (ID DRE) we also give a lattice based ID DRE scheme that achieves chosen plaintext and adaptively chosen identity security based on the LWE assumption with public parameter size about (2\ell +1)nm\log q\ where \ell is the bit size of the identity in the scheme.
ACISP
Daode Zhang Kai Zhang Bao Li Xianhui Lu Haiyang Xue Jie Li
15985986
Provably Weak Instances of Ring LWE Revisited
In CRYPTO 2015, Elias, Lauter, Ozman and Stange described an attack on the non dual decision version of the ring learning with errors problem RLWE for two special families of defining polynomials, whose construction depends on the modulusq that is being used. For particularly chosen error parameters, they managed to solve non dual decision RLWE given 20 samples, with a success rate ranging from 10i 3/4 to 80i 3/4 In this paper we show how to solve the search version for the same families and error parameters, using only 7 samples with a success rate of 100i 3/4 Moreover our attack works for every modulus$$q'$q' instead of the q that was used to construct the defining polynomial. The attack is based on the observation that the RLWE error distribution for these families of polynomials is very skewed in the directions of the polynomial basis. For the parameters chosen by Elias et al. the smallest errors are negligible and simple linear algebra suffices to recover the secret. But enlarging the error paremeters makes the largest errors wrap around, thereby turning the RLWE problem unsuitable for cryptographic applications. These observations also apply to dual RLWE, but do not contradict the seminal work by Lyubashevsky, Peikert and Regev.
EUROCRYPT
Wouter Castryck Ilia Iliashenko Frederik Vercauteren
209048495
Impact of the modulus switching technique on some attacks against learning problems
The modulus switching technique has been used in some cryptographic applications as well as in cryptanalysis. For cryptanalysis against the learning with errors (LWE) problem and the learning with rounding (LWR) problem, it seems that one does not know whether the technique is really useful or not. This work supplies a complete view of the impact of this technique on the decoding attack, the dual attack and the primal attack against both LWE and LWR. For each attack, the authors give the optimal formula for the switching modulus. The formulas get involved the number of LWE/LWR samples, which differs from the known formula in the literature. They also attain the corresponding sufficient conditions saying when one should utilise the technique. Surprisingly, restricted to the LWE/LWR problem that the secret vector is much shorter than the error vector, they also show that performing the modulus switching before using the so called rescaling technique in the dual attack and the primal attack make these attacks worse than only exploiting the rescaling technique as reported by Bai and Galbraith at the Australasian conference on information security and privacy (ACISP) 2014 conference. As an application, they theoretically assess the influence of the modulus switching on the LWE/LWR based second round NIST PQC submissions.
IET Inf. Secur.
Huy Quoc Le Pradeep Kumar Mishra Satoshi Nakamura Koha Kinjo Dung Hoang Duong Masaya Yasuda
211478449
SCloud: Public Key Encryption and Key Encapsulation Mechanism Based on Learning with Errors
We propose a new family of public key encryption (PKE) and key encapsulation mechanism (KEM) schemes based on the plain learning with errors (LWE) problem. Two new design techniques are adopted in the proposed scheme named SCloud: the sampling method and the error reconciliation mechanism. The new sampling method is obtained by studying the property of the convolution of central binomial distribution and bounded uniform distribution which can achieve higher efficiency and more flexibility w.r.t the parameter choice. Besides, it is shown to be more secure against the dual attack due to its advantage in distinguish property. The new error reconciliation mechanism is constructed by combining the binary linear codes and Gray codes. It can reduce the size of parameters, and then improve the encryption/decryption efficiency as well as communication efficiency, by making full use of the encryption space. Based on these two techniques, SCloud can provide various sets of parameters for refined security level.
IACR Cryptol. ePrint Arch.
Zhongxiang Zheng A Wang Haining Fan Chunhuan Zhao Chao Liu Xue Zhang
65311508
New variant for Learning with Errors Problem
Abstract The Learning with Errors (LWE) problem is a special average case lattice problem, which has proved to be as hard as worst case lattice problems. By this property, it has become the cornerstones for a series of cryptographic applications under the security assumption of worst case lattice problems. However, the efficiency of these applications are not high. Therefore, how to improve the efficiency of cryptographic applications based on LWE is an urgent problem to be solved. In this paper, a new variant of LWE is proposed. By using trapdoor composed by lattice based matrix and its dual orthogonal matrix, we construct a more efficient public key encryption (PKE) scheme based on the variant. Furthermore, by the hardness of the variant problem, we prove the new PKE scheme is chosen plaintext attack (CPA) secure. At last, we analyze the homomorphism property of the new PKE scheme.
Xuyang Wang Aiqun Hu Hao Fang