Klepto for Ring-LWE Encryption

Abstract

Due to its great efficiency and quantum resistance, public key cryptography based on Ring-LWE problem has drawn much attention in recent years. A batch of cryptanalysis works provided ever-improved security estimations for various Ring-LWE schemes, but few works discussed the security of Ring-LWE cryptography from kleptographic aspect. In this paper, we show how to embed a backdoor into a classic Ring-LWE encryption scheme so that partial bits of the plaintext are leaked to the owner of the backdoor. By theoretical analysis and experimental observations, we argue that the klepto Ring-LWE encryption scheme with such backdoor is feasible and practical.

Lattice‐based cryptosystems in standardisation processes: A survey

“…In kleptographic attacks, attackers can steal information securely and subliminally through a backdoor embedded in the cryptosystems. There have been a few works [24,150,151] discussing kleptographic attacks against lattice-based schemes.…”

Lattice Klepto Revisited

“…Since the size of a is much larger, another RLWE encryption with suitable parameters (say, with a halved n) can be chosen as the secret encryption. The strength of this choice is that it makes the backdoor follow a post-quantum setting, as what Xiao and Yu achieved in [19].…”

“…Recently, some kleptographic attacks on lattice-based public-key cryptographic schemes have appeared, such as [8,19]. At SAC'17, Kwant et al [8] proposed a kleptographic backdoor on NTRU encryption scheme, in which the session key for the symmetric part of the user is first encrypted by the attacker's public key with ECC (Elliptic Curve Cryptography) and the ciphertext is then embedded into the legal NTRU ciphertext in some special way.…”