The Learning with Errors (LWE) problem is one of the main mathematical foundations of post-quantum cryptography. One of the main groups of algorithms for solving LWE is the Blum-Kalai-Wasserman (BKW) algorithm. This paper presents new improvements for BKW-style algorithms for solving LWE instances. We target minimum concrete complexity and we introduce a new reduction step where we partially reduce the last position in an iteration and finish the reduction in the next iteration, allowing non-integer step sizes. We also introduce a new procedure in the secret recovery by mapping the problem to binary problems and applying the Fast Walsh Hadamard Transform. The complexity of the resulting algorithm compares favourably to all other previous approaches, including lattice sieving. We additionally show the steps of implementing the approach for large LWE problem instances. The core idea here is to overcome RAM limitations by using large file-based memory.
In 2017, Aggarwal, Joux, Prakash, and Santha proposed an innovative NTRU-like public-key cryptosystem that was believed to be quantum resistant, based on Mersenne prime numbers q = 2 N − 1. After a successful attack designed by Beunardeau, Connolly, Géraud, and Naccache, the authors revised the protocol which was accepted for Round 1 of the Post-Quantum Cryptography Standardization Process organized by NIST. The security of this protocol is based on the assumption that a so-called Mersenne Low Hamming Combination Search Problem (ML-HCombSP) is hard to solve. In this work, we present a reduction of MLHCombSP to an instance of Integer Linear Programming (ILP). This opens new research directions that are necessary to be investigated in order to assess the concrete robustness of such cryptosystem. We propose different approaches to perform such reduction. Moreover, we uncover a new family of weak keys, for whose our reduction leads to an attack consisting in solving < N 3 ILP problems of dimension 3.
When a pairing e : G 1 × G 2 → G T , on an elliptic curve E defined over F q , is exploited in a cryptographic protocol, there is often the need to hash binary strings into G 1 and G 2. Traditionally, if E admits a twistẼ of order d, then G 1 = E(F q)∩E[r], where r is a prime integer, and G 2 =Ẽ(F q k/d)∩Ẽ[r], where k is the embedding degree of E w.r.t. r. The standard approach for hashing a binary string into G 1 and G 2 is to map it to general points P ∈ E(F q) and P ∈Ẽ(F q k/d), and then multiply them by the cofactors c = #E(F q)/r and c = #Ẽ(F q k/d)/r respectively. Usually, the multiplication by c is computationally expensive. In order to speed up such a computation, two different methods (by Scott et al. and by Fuentes et al.) have been proposed. In this poster we consider these two methods for BLS pairing-friendly curves having k ∈ {12, 24, 30, 42, 48}, providing efficiency comparisons. When k = 42, 48, the Fuentes et al. method requires an expensive one-off pre-computation which was infeasible for the computational power at our disposal. In these cases, we theoretically obtain hashing maps that follow Fuentes et al. idea.
The learning with errors (LWE) problem is one of the main mathematical foundations of post-quantum cryptography. One of the main groups of algorithms for solving LWE is the Blum–Kalai–Wasserman (BKW) algorithm. This paper presents new improvements of BKW-style algorithms for solving LWE instances. We target minimum concrete complexity, and we introduce a new reduction step where we partially reduce the last position in an iteration and finish the reduction in the next iteration, allowing non-integer step sizes. We also introduce a new procedure in the secret recovery by mapping the problem to binary problems and applying the fast Walsh Hadamard transform. The complexity of the resulting algorithm compares favorably with all other previous approaches, including lattice sieving. We additionally show the steps of implementing the approach for large LWE problem instances. We provide two implementations of the algorithm, one RAM-based approach that is optimized for speed, and one file-based approach which overcomes RAM limitations by using file-based storage.
When a pairing e ∶ 1 × 2 → T , on an elliptic curve E defined over a finite field q , is exploited for an identity-based protocol, there is often the need to hash binary strings into 1 and 2. Traditionally, if E admits a twist Ẽ of order d, then 1 = E(q) ∩ E[r] , where r is a prime integer, and 2 =Ẽ(q k∕d) ∩Ẽ[r] , where k is the embedding degree of E w.r.t. r. The standard approach for hashing into 2 is to map to a general point P ∈Ẽ(q k∕d) and then multiply it by the cofactor c = #Ẽ(q k∕d)∕r. Usually, the multiplication by c is computationally expensive. In order to speed up such a computation, two different methods-by Scott et al. (International conference on pairing-based cryptography. Springer, Berlin, pp 102-113, 2009) and by Fuentes-Castaneda et al. (International workshop on selected areas in cryptography)-have been proposed. In this paper we consider these two methods for BLS pairing-friendly curves having k ∈ {12, 24, 30, 42, 48} , providing efficiency comparisons. When k = 42, 48 , the application of Fuentes et al. method requires expensive computations which were infeasible for the computational power at our disposal. For these cases, we propose hashing maps that we obtained following Fuentes et al. idea.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.