Improved Security Proofs in Lattice-Based Cryptography: Using the Rényi Divergence Rather Than the Statistical Distance

Bai, Shi; Langlois, Adeline; Lepoint, Tancrède; Stehlé, Damien; Steinfeld, Ron

doi:10.1007/978-3-662-48797-6_1

Cited by 58 publications

(26 citation statements)

References 25 publications

(34 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We use Rényi Divergence (RD) in our analysis, relying on techniques developed in [41,38,9]. For any two probability distributions P and Q such that the support of P is a subset of the support of Q over a countable domain X, we de ne the RD (of order 2) by R(P Q) = x∈X P (x) 2 Q(x) , with the convention that the fraction is zero when both the numerator and denominator are zero.…”

Section: Rényi Divergencementioning

confidence: 99%

Hardness of k-LWE and Applications in Traitor Tracing

et al. 2016

Self Cite

View full text Add to dashboard Cite

Abstract. We introduce the k-LWE problem, a Learning With Errors variant of the k-SIS problem. The Boneh-Freeman reduction from SIS to k-SIS su ers from an exponential loss in k. We improve and extend it to an LWE to k-LWE reduction with a polynomial loss in k, by relying on a new technique involving trapdoors for random integer kernel lattices. Based on this hardness result, we present the rst algebraic construction of a traitor tracing scheme whose security relies on the worst-case hardness of standard lattice problems. The proposed LWE traitor tracing is almost as e cient as the LWE encryption. Further, it achieves public traceability, i.e., allows the authority to delegate the tracing capability to untrusted parties. To this aim, we introduce the notion of projective sampling family in which each sampling function is keyed and, with a projection of the key on a well chosen space, one can simulate the sampling function in a computationally indistinguishable way. The construction of a projective sampling family from k-LWE allows us to achieve public traceability, by publishing the projected keys of the users. We believe that the new lattice tools and the projective sampling family are quite general that they may have applications in other areas. so that a master can generate a large number of secret keys for the same public key. As a result, the latter encryption scheme, called dual-Regev, can be naturally extended into a multi-receiver encryption scheme. In the present work, we build traitor tracing schemes from this dual-Regev LWE-based encryption scheme.Traitor tracing. A traitor tracing scheme is a multi-receiver encryption scheme where malicious receiver coalitions aiming at building pirate decryption devices are deterred by the existence of a tracing algorithm: Using the pirate decryption device, the tracing algorithm can recover at least one member of the malicious coalition. Such schemes are particularly well suited for ghting copyright infringement in the context of

show abstract

Section: Rényi Divergencementioning

confidence: 99%

Hardness of k-LWE and Applications in Traitor Tracing

et al. 2016

Self Cite

View full text Add to dashboard Cite

show abstract

“…These fundamental limits are indexed by the Rényi parameter. Our work is also partly motivated by Shikata [18] who quantified lengths of secret keys in terms of Rényi entropies of general orders and Bai et al [19] who showed that the Rényi divergence is particularly suited for simplifying some security proofs. Furthermore, it is worth noting that it is quite natural to use various divergences to measure the discrepancy between two distributions.…”

Section: Introductionmentioning

confidence: 99%

Rényi Resolvability and Its Applications to the Wiretap Channel

Tan

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The conventional channel resolvability problem refers to the determination of the minimum rate required for an input process so that the output distribution approximates a target distribution in either the total variation distance or the relative entropy. In contrast to previous works, in this paper, we use the (normalized or unnormalized) Rényi divergence (with the Rényi parameter in [0, 2] ∪ {∞}) to measure the level of approximation. We also provide asymptotic expressions for normalized Rényi divergence when the Rényi parameter is larger than or equal to 1 as well as (lower and upper) bounds for the case when the same parameter is smaller than 1. We characterize the Rényi resolvability, which is defined as the minimum rate required to ensure that the Rényi divergence vanishes asymptotically. The Rényi resolvabilities are the same for both the normalized and unnormalized divergence cases. In addition, when the Rényi parameter smaller than 1, consistent with the traditional case where the Rényi parameter is equal to 1, the Rényi resolvability equals the minimum mutual information over all input distributions that induce the target output distribution. When the Rényi parameter is larger than 1 the Rényi resolvability is, in general, larger than the mutual information. The optimal Rényi divergence is proven to vanish at least exponentially fast for both of these two cases, as long as the code rate is larger than the Rényi resolvability. The optimal exponential rate of decay for i.i.d. random codes is also characterized exactly. We apply these results to the wiretap channel, and completely characterize the optimal tradeoff between the rates of the secret and non-secret messages when the leakage measure is given by the (unnormalized) Rényi divergence. This tradeoff differs from the conventional setting when the leakage is measured by the traditional mutual information.

show abstract

“…The closeness of two distribution can be measured through many methods. Among them, Rényi divergence is a well-known method, which is parameterized by a real a > 1 and defined for two distributions P and Q as follows [23], [24]. where sup(P ) represents the support of P and Q(x) = 0 for x ∈ sup(P ).…”

Section: Closeness Of Centered Binomial Distribution and The Correspomentioning

confidence: 99%

Analysis of Error Dependencies on Newhope

et al. 2020

View full text Add to dashboard Cite

Among many submissions to the NIST post-quantum cryptography (PQC) project, NewHope is a promising key encapsulation mechanism (KEM) based on the Ring-Learning with errors (Ring-LWE) problem. Since NewHope is an indistinguishability (IND)-chosen ciphertext attack secure KEM by applying the Fujisaki-Okamoto transform to an IND-chosen plaintext attack secure public key encryption, accurate calculation of decryption failure rate (DFR) is required to guarantee resilience against attacks that exploit decryption failures. However, the current upper bound on DFR of NewHope is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and the approximation effect of centered binomial distribution are not fully considered. Furthermore, since NewHope is a Ring-LWE based cryptosystem, there is a problem of error dependency among error coefficients, which makes accurate DFR calculation difficult. In this paper, we derive much tighter upper bound on DFR than the current upper bound using constraint relaxation and union bound. Especially, the above-mentioned factors are all considered in derivation of new upper bound and the centered binomial distribution is not approximated to subgaussian distribution. In addition, since the error dependency is considered, the new upper bound is much closer to the real DFR than the previous upper bound. Furthermore, the new upper bound is parameterized by using Chernoff-Cramer bound in order to facilitate calculation of new upper bound for the parameters of NewHope. Since the new upper bound is much lower than the DFR requirement of PQC, this DFR margin is used to improve the security and bandwidth efficiency of NewHope. As a result, the security level of NewHope is improved by 7.2 % or bandwidth efficiency is improved by 5.9 %. This improvement in the security and bandwidth efficiency can be easily achieved because there is little change in time/space complexity of NewHope.

show abstract

Improved Security Proofs in Lattice-Based Cryptography: Using the Rényi Divergence Rather Than the Statistical Distance

Cited by 58 publications

References 25 publications

Hardness of k-LWE and Applications in Traitor Tracing

Hardness of k-LWE and Applications in Traitor Tracing

Rényi Resolvability and Its Applications to the Wiretap Channel

Analysis of Error Dependencies on Newhope

Contact Info

Product

Resources

About