Lazy Modulus Switching for the BKW Algorithm on LWE

Abstract

Abstract. Some recent constructions based on LWE do not sample the secret uniformly at random but rather from some distribution which produces small entries. The most prominent of these is the binary-LWE problem where the secret vector is sampled from {0, 1} * or {−1, 0, 1} * . We present a variant of the BKW algorithm for binary-LWE and other small secret variants and show that this variant reduces the complexity for solving binary-LWE. We also give estimates for the cost of solving binary-LWE instances in this setting and demonstrate the advantage of this BKW variant over standard BKW and lattice reduction techniques applied to the SIS problem. Our variant can be seen as a combination of the BKW algorithm with a lazy variant of modulus switching which might be of independent interest.

On the concrete hardness of Learning with Errors

“…This technique was initially introduced to speedup homomorphic encryption [BV11] but can also be employed to reduce the cost of solving LWE in certain cases [AFFP14]. Modulus switching can be thought of as analogous to the difference between computing with single instead of double precision floating point numbers, where switching refers to opting to compute in the lower precision of a machine float.…”

“…In this section we consider the small secret variant of BKW described in [AFFP14]. In this work ψ is not specified but it is assumed that the s (i) are chosen from {−1, 0, 1} or {0, 1}.…”

“…Using lazy modulus switching (Corollary 3 of [AFFP14]), the complexity of solving is O 2 n c+ log d− 1 2 log log n log n · n log 2 n , where in both cases 0 < d ≤ 1 is a constant.…”

Better Algorithms for LWE and LWR

“…This algorithm is the first LWR-solving algorithm. Further work includes the study of the Ring variants of LWE and LWR [38,8] and the study of variants of LWE, e.g., when the secret follows a non-uniform distribution (like in [2]) or when the noise follows a non Gaussian distribution. It would also be interesting to see if our LWR algorithm can be extended for q non prime.…”

“…Finally, Albercht et al presented in PKC 2014 an algorithm targeting LWE when the secret vector has small components (typically binary). Using BKW along with modulus switching techniques, they managed to reduce the complexity for solving the LWE problem in these cases [2].…”