Fast Reduction of Algebraic Lattices over Cyclotomic Fields

Kirchner, Paul; Espitau, Thomas; Fouque, Pierre-Alain

doi:10.1007/978-3-030-56880-1_6

Cited by 13 publications

(12 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There is a rich algebraic structure in BAT. While there are some results exploiting this algebraic structure [KEF20] to speed up lattice reduction, the gains with respect to their general lattice equivalent are no more than polynomial factors.…”

Section: Other Attacksmentioning

confidence: 99%

BAT: Small and Fast KEM over NTRU Lattices

Fouque

Kirchner

Pornin³

et al. 2022

TCHES

Self Cite

View full text Add to dashboard Cite

We present BAT – an IND-CCA secure key encapsulation mechanism (KEM) that is based on NTRU but follows an encryption/decryption paradigm distinct from classical NTRU KEMs. It demonstrates a new approach of decrypting NTRU ciphertext since its introduction 25 years ago. Instead of introducing an artificial masking parameter p to decrypt the ciphertext, we use 2 linear equations in 2 unknowns to recover the message and the error. The encryption process is therefore close to the GGH scheme. However, since the secret key is now a short basis (not a vector), we need to modify the decryption algorithm and we present a new NTRU decoder. Thanks to the improved decoder, our scheme works with a smaller modulus and yields shorter ciphertexts, smaller than RSA-4096 for 128-bit classical security with comparable public-key size and much faster than RSA or even ECC. Meanwhile, the encryption and decryption are still simple and fast in spite of the complicated key generation. Overall, our KEM has more compact parameters than all current lattice-based schemes and a practical efficiency. Moreover, due to the similar key pair structure, BAT can be of special interest in some applications using Falcon signature that is also the most compact signature in the round 3 of the NIST post-quantum cryptography standardization. However, different from Falcon, our KEM does not rely on floating-point arithmetic and can be fully implemented over the integers.

show abstract

Section: Other Attacksmentioning

confidence: 99%

BAT: Small and Fast KEM over NTRU Lattices

Fouque

Kirchner

Pornin³

et al. 2022

TCHES

Self Cite

View full text Add to dashboard Cite

show abstract

“…As remarked in the design of NTRU-based schemes (such as for instance FALCON or MODFALCON signatures), there exists a rich algebraic structure in the modules over the convolution ring R used in MITAKA. However, there is no known way to improve all the algorithms previously mentioned with respect to their general lattice equivalent by more than polynomial factors (see for instance the speedup on lattice reduction of [28]).…”

Section: G31 Algebraic Attacksmentioning

confidence: 99%

Mitaka: A Simpler, Parallelizable, Maskable Variant of Falcon

Espitau

Fouque

Gérard

et al. 2022

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

This work describes the MITAKA signature scheme: a new hash-and-sign signature scheme over NTRU lattices which can be seen as a variant of NIST finalist FALCON. It achieves comparable efficiency but is considerably simpler, online/offline, and easier to parallelize and protect against sidechannels, thus offering significant advantages from an implementation standpoint. It is also much more versatile in terms of parameter selection.We obtain this signature scheme by replacing the FFO lattice Gaussian sampler in FALCON by the "hybrid" sampler of Ducas and Prest, for which we carry out a detailed and corrected security analysis. In principle, such a change can result in a substantial security loss, but we show that this loss can be largely mitigated using new techniques in key generation that allow us to construct much higher quality lattice trapdoors for the hybrid sampler relatively cheaply. This new approach can also be instantiated on a wide variety of base fields, in contrast with FALCON's restriction to power-of-two cyclotomics.We also introduce a new lattice Gaussian sampler with the same quality and efficiency, but which is moreover compatible with the integral matrix Gram root technique of Ducas et al., allowing us to avoid floating point arithmetic. This makes it possible to realize the same signature scheme as MITAKA efficiently on platforms with poor support for floating point numbers.Finally, we describe a provably secure masking of MITAKA. More precisely, we introduce novel gadgets that allow provable masking at any order at much lower cost than previous masking techniques for Gaussian sampling-based signature schemes, for cheap and dependable side-channel protection.7 Sometimes, this is also seen as a bounded distance decoding problem, BDD, but with large enough decoding bound that there are exponentially many solutions, instead of a unique one as is typically the case in the traditional formulation of BDD. 8 Other techniques have been proposed that avoid Gaussian distributions, as in [34], but they tend not to be competitive. Authors Suppressed Due to Excessive LengthAlgorithm 5: Integer arithmetic ring Gaussian sampler Input: a matrix B ∈ R 2×2 such that BU û = B = BUu, where û = [u]p ∈ 1 p R, a center c ∈ R 2 , and parameters r, s > 0. Result: z with distribution negligibly far from D L (B),c,rs . 1 Precomputed: Σp = s 2 I − B B t and A ← IntGram(p 2 (Σp − I)) / * AA t = p 2 (Σp − I) * / 2 p ← Algorithm 6(p, A) / * p ∼ D R 2 ,r 2 Σp * / 3 ĉ ← B −1 (c − p) 4 z ← Algorithm 4(û, ĉ, s) / * z ∼ D L (U û),ĉ,s * / 5 return z = Bz Algorithm 6: Offline sampler Input: An integer p > 0, a matrix A ∈ R 2×m . Result: p ∈ R 2 with distribution negligibly far from D R 2 ,r 2 Σ , where Σ = 1 p 2 AA t + I.1 Precomputed: integers r > ηε(R 2 ) and L such that Lr ηε(Λ(A) ⊥ ). 2 x ← ( 0 Lr ) m 3 p ← 1 pL Ax 4 p ← p r 5 return p.

show abstract

“…Unlike NTRU-1998, which operates in a cyclotomic ring (Z/qZ)[x]/ x n − 1 , with n = 2 k , NTRU Prime operates in the field R q := Z q [x]/ x n − x − 1 , which is not cyclotomic. The choice is motivated by the need to protect against potential attacks, e.g., those discussed in [KEF20], that exploit the cyclotomic structure.…”

Section: Ntru Primementioning

confidence: 99%

Will You Cross the Threshold for Me?

Ravi

Ezerman

Bhasin

et al. 2021

TCHES

View full text Add to dashboard Cite

In this work, we propose generic and novel side-channel assisted chosenciphertext attacks on NTRU-based key encapsulation mechanisms (KEMs). These KEMs are IND-CCA secure, that is, they are secure in the chosen-ciphertext model. Our attacks involve the construction of malformed ciphertexts. When decapsulated by the target device, these ciphertexts ensure that a targeted intermediate variable becomes very closely related to the secret key. An attacker, who can obtain information about the secret-dependent variable through side-channels, can subsequently recover the full secret key. We propose several novel CCAs which can be carried through by using side-channel leakage from the decapsulation procedure. The attacks instantiate three different types of oracles, namely a plaintext-checking oracle, a decryptionfailure oracle, and a full-decryption oracle, and are applicable to two NTRU-based schemes, which are NTRU and NTRU Prime. The two schemes are candidates in the ongoing NIST standardization process for post-quantum cryptography. We perform experimental validation of the attacks on optimized and unprotected implementations of NTRU-based schemes, taken from the open-source pqm4 library, using the EM-based side-channel on the 32-bit ARM Cortex-M4 microcontroller. All of our proposed attacks are capable of recovering the full secret key in only a few thousand chosen ciphertext queries on all parameter sets of NTRU and NTRU Prime. Our attacks, therefore, stress on the need for concrete side-channel protection strategies for NTRUbased KEMs.

show abstract

Fast Reduction of Algebraic Lattices over Cyclotomic Fields

Cited by 13 publications

References 37 publications

BAT: Small and Fast KEM over NTRU Lattices

BAT: Small and Fast KEM over NTRU Lattices

Mitaka: A Simpler, Parallelizable, Maskable Variant of Falcon

Will You Cross the Threshold for Me?

Contact Info

Product

Resources

About