Improved Low-Memory Subset Sum and LPN Algorithms via Multiple Collisions

Delaplace, Claire; Esser, Andre; May, Alexander

doi:10.1007/978-3-030-35199-1_9

Cited by 15 publications

(7 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In particular, finding multiple good input pairs at the offline phase is equivalent to the problem to find multiple collisions of a function G : F ℓ1 2 → F ℓ2 2 . Finding multiple collisions is a well-studied problem [vOW99,Din20] and it has some applications in cryptanalysis [vOW99,DEM19]. To find 2 ℓ3 collisions of G, a straightforward method is to consider 2…”

Section: Our Contributionsmentioning

confidence: 99%

Algebraic Attack on FHE-Friendly Cipher HERA Using Multiple Collisions

Liu,

Kalam,

Sarkar

et al. 2024

ToSC

View full text Add to dashboard Cite

Fully homomorphic encryption (FHE) is an advanced cryptography technique to allow computations (i.e., addition and multiplication) over encrypted data. After years of effort, the performance of FHE has been significantly improved and it has moved from theory to practice. The transciphering framework is another important technique in FHE to address the issue of ciphertext expansion and reduce the client-side computational overhead. To apply the transciphering framework to the CKKS FHE scheme, a new transciphering framework called the Real-to-Finite-Field (RtF) framework and a corresponding FHE-friendly symmetric-key primitive called HERA were proposed at ASIACRYPT 2021. Although HERA has a very similar structure to AES, it is considerably different in the following aspects: 1) the power map x → x3 is used as the S-box; 2) a randomized key schedule is used; 3) it is over a prime field Fp with p > 216. In this work, we perform the first third-party cryptanalysis of HERA, by showing how to mount new algebraic attacks with multiple collisions in the round keys. Specifically, according to the special way to randomize the round keys in HERA, we find it possible to peel off the last nonlinear layer by using collisions in the last-round key and a simple property of the power map. In this way, we could construct an overdefined system of equations of a much lower degree in the key, and efficiently solve the system via the linearization technique. As a esult, for HERA with 192 and 256 bits of security, respectively, we could break some parameters under the same assumption made by designers that the algebra constant ω for Gaussian elimination is ω = 2, i.e., Gaussian elimination on an n × n matrix takes O(nω) field operations. If using more conservative choices like ω ∈ {2.8, 3}, our attacks can also successfully reduce the security margins of some variants of HERA to only 1 round. However, the security of HERA with 80 and 128 bits of security is not affected by our attacks due to the high cost to find multiple collisions. In any case, our attacks reveal a weakness of HERA caused by the randomized key schedule and its small state size.

show abstract

Section: Our Contributionsmentioning

confidence: 99%

Algebraic Attack on FHE-Friendly Cipher HERA Using Multiple Collisions

Liu,

Kalam,

Sarkar

et al. 2024

ToSC

View full text Add to dashboard Cite

show abstract

“…This method has the same sample complexity as that of the exhaustive search approach but requires (q + 1) FFT operations rather than only one FFT in [11]. The BKW variants with memory constraints were recently studied in [26][27][28].…”

Section: Related Workmentioning

confidence: 99%

Modeling and simulating the sample complexity of solving LWE using BKW-style algorithms

2022

View full text Add to dashboard Cite

The Learning with Errors (LWE) problem receives much attention in cryptography, mainly due to its fundamental significance in post-quantum cryptography. Among its solving algorithms, the Blum-Kalai-Wasserman (BKW) algorithm, originally proposed for solving the Learning Parity with Noise (LPN) problem, performs well, especially for certain parameter settings with cryptographic importance. The BKW algorithm consists of two phases, the reduction phase and the solving phase. In this work, we study the performance of distinguishers used in the solving phase. We show that the Fast Fourier Transform (FFT) distinguisher from Eurocrypt’15 has the same sample complexity as the optimal distinguisher, when making the same number of hypotheses. We also show via simulation that it performs much better than previous theory predicts and develop a sample complexity model that matches the simulations better. We also introduce an improved, pruned version of the FFT distinguisher. Finally, we indicate, via extensive experiments, that the sample dependency due to both LF2 and sample amplification is limited.

show abstract

“…One drawback of BKW is its high memory-usage. To remedy this, time-memory trade-offs for the BKW algorithm were recently studied in [23][24][25]. A recent fast implementation of the BKW algorithm for solving LPN is in [26].…”

Section: Related Workmentioning

confidence: 99%

Improvements on Making BKW Practical for Solving LWE

et al. 2021

View full text Add to dashboard Cite

The learning with errors (LWE) problem is one of the main mathematical foundations of post-quantum cryptography. One of the main groups of algorithms for solving LWE is the Blum–Kalai–Wasserman (BKW) algorithm. This paper presents new improvements of BKW-style algorithms for solving LWE instances. We target minimum concrete complexity, and we introduce a new reduction step where we partially reduce the last position in an iteration and finish the reduction in the next iteration, allowing non-integer step sizes. We also introduce a new procedure in the secret recovery by mapping the problem to binary problems and applying the fast Walsh Hadamard transform. The complexity of the resulting algorithm compares favorably with all other previous approaches, including lattice sieving. We additionally show the steps of implementing the approach for large LWE problem instances. We provide two implementations of the algorithm, one RAM-based approach that is optimized for speed, and one file-based approach which overcomes RAM limitations by using file-based storage.

show abstract

Improved Low-Memory Subset Sum and LPN Algorithms via Multiple Collisions

Cited by 15 publications

References 27 publications

Algebraic Attack on FHE-Friendly Cipher HERA Using Multiple Collisions

Algebraic Attack on FHE-Friendly Cipher HERA Using Multiple Collisions

Modeling and simulating the sample complexity of solving LWE using BKW-style algorithms

Improvements on Making BKW Practical for Solving LWE

Contact Info

Product

Resources

About