Attacks on the Search-RLWE problem with small errors

The Ring Learning-With-Errors (RLWE) problem shows great promise for post-quantum cryptography and homomorphic encryption. We describe a new attack on the non-dual search RLWE problem with small error widths, using ring homomorphisms to finite fields and the chi-squared statistical test. In particular, we identify a "subfield vulnerability" (Section 5.2) and give a new attack which finds this vulnerability by mapping to a finite field extension and detecting non-uniformity with respect to the number of elements in the subfield. We use this attack to give examples of vulnerable RLWE instances in Galois number fields. We also extend the well-known search-to-decision reduction result to Galois fields with any unramified prime modulus q, regardless of the residue degree f of q, and we use this in our attacks. The time complexity of our attack is O(nq2f), where n is the degree of K and f is the residue degree of q in K. We also show an attack on the non-dual (resp. dual) RLWE problem with narrow error distributions in prime cyclotomic rings when the modulus is a ramified prime (resp. any integer). We demonstrate the attacks in practice by finding many vulnerable instances and successfully attacking them. We include the code for all attacks

On error distributions in ring-based LWE

Since its introduction in 2010 by Lyubashevsky, Peikert and Regev, the ring learning with errors problem (ring-LWE) has become a popular building block for cryptographic primitives, due to its great versatility and its hardness proof consisting of a (quantum) reduction from ideal lattice problems. But, for a given modulus q and degree n number field K, generating ring-LWE samples can be perceived as cumbersome, because the secret keys have to be taken from the reduction mod q of a certain fractional ideal O-K(V) subset of K called the codifferent or 'dual', rather than from the ring of integers O-K itself. This has led to various non-dual variants of ring-LWE, in which one compensates for the non-duality by scaling up the errors. We give a comparison of these versions, and revisit some unfortunate choices that have been made in the recent literature, one of which is scaling up by vertical bar Delta(K)vertical bar(1/2n) with Delta(K) the discriminant of K. As a main result, we provide, for any epsilon > 0, a family of number fields K for which this variant of ring-LWE can be broken easily as soon as the errors are scaled up by vertical bar Delta(K)vertical bar((1-epsilon)/n)

A Practical Post-Quantum Public-Key Cryptosystem Based on spLWE

The Learning with Errors (LWE) problem has been widely used as a hardness assumption to construct public-key primitives. In this paper, we propose an efficient instantiation of a PKE scheme based on LWE with a sparse secret, named as spLWE. We first construct an IND-CPA PKE and convert it to an IND-CCA scheme in the quantum random oracle model by applying a modified Fujisaki-Okamoto conversion of Unruh. In order to guarantee the security of our base problem suggested in this paper, we provide a polynomial time reduction from LWE with a uniformly chosen secret to spLWE. We modify the previous attacks for LWE to exploit the sparsity of a secret key and derive more suitable parameters. We can finally estimate performance of our scheme supporting 256-bit messages: our implementation shows that our IND-CCA scheme takes 313 micro seconds and 302 micro seconds respectively for encryption and decryption with the parameters that have 128-quantum bit security

LWE 문제 기반 공개키 암호 및 commitment 스킴의 효율적인 인스턴스화

학위논문 (박사)-- 서울대학교 대학원 : 자연과학대학 수리과학부, 2018. 2. 천정희.The Learning with Errors (LWE) problem has been used as a underlying problem of a variety of cryptographic schemes. It makes possible constructing advanced solutions like fully homomorphic encryption, multi linear map as well as basic primitives like key-exchange, public-key encryption, signature. Recently, developments in quantum computing have triggered interest in constructing practical cryptographic schemes. In this thesis, we propose efficient post-quantum public-key encryption and commitment schemes based on a variant LWE, named as spLWE. We also suggest related zero-knowledge proofs and LWE-based threshold cryptosystems as an application of the proposed schemes. In order to achieve these results, it is essential investigating the hardness about the variant LWE problem, spLWE. We describe its theoretical, and concrete hardness from a careful analysis.1.Introduction 1 2.Preliminaries 5 2.1 Notations 5 2.2 Cryptographic notions 5 2.2.1 Key Encapsulation Mechanism 5 2.2.2 Commitment Scheme 6 2.2.3 Zero-Knowledge Proofs and Sigma-Protocols 7 2.3 Lattices 9 2.4 Discrete Gaussian Distribution 11 2.5 Computational Problems 12 2.5.1 SVP 12 2.5.2 LWE and Its Variants 12 2.6 Known Attacks for LWE 13 2.6.1 The Distinguishing Attack 14 2.6.2 The Decoding Attack 15 3.LWE with Sparse Secret, spLWE 16 3.1 History 16 3.2 Theoratical Hardness 17 3.2.1 A Reduction from LWE to spLWE 18 3.3 Concrete Hardness 21 3.3.1 Dual Attack (distinguish version) 21 3.3.2 Dual Attack (search version) 23 3.3.3 Modifed Embedding Attack 25 3.3.4 Improving Lattice Attacks for spLWE 26 4.LWE-based Public-Key Encryptions 29 4.1 History 29 4.2 spLWE-based Instantiations 31 4.2.1 Our Key Encapsulation Mechanism 31 4.2.2 Our KEM-Based Encryption Scheme 33 4.2.3 Security 35 4.2.4 Correctness 36 4.3 Implementation 37 4.3.1 Parameter Selection 38 4.3.2 Implementation Result 39 5.LWE-based Commitments and Zero-Knowledge Proofs 41 5.1 History 42 5.2 spLWE-based Instantiations 43 5.2.1 Our spLWE-based Commitments 44 5.2.2 Proof for Opening Information 47 5.3 Application to LWE-based Threshold Crytosystems 50 5.3.1 Zero-Knowledge Proofs of Knowledge for Threshold Decryption 50 5.3.2 Actively Secure Threshold Cryptosystems 58 6.Conclusions 63Docto

Applying Fully Homomorphic Encryption: Practices and Problems

Fully homomorphic encryption (FHE) has been regarded as the "holy grail" of cryptography for its versatility as a cryptographic primitive and wide range of potential applications. Since Gentry published the first theoretically feasible FHE design in 2008, there has been a lot of new discoveries and inventions in this particular field. New schemes significantly reduce the computational cost of FHE and make practical deployment within reach. As a result, FHE schemes have come off the paper and been explored and tested extensively in practice. However, FHE is made possible with many new problems and assumptions that are not yet well studied. In this thesis we present a comprehensive and intuitive overview of the current applied FHE landscape, from design to implementation, and draw attention to potential vulnerabilities both in theory and in practice. In more detail, we show how to use currently available FHE libraries for aggregation and select parameters to avoid weak FHE instances