Making the BKW Algorithm Practical for LWE

Budroni, Alessandro; Guo, Qian; Johansson, Thomas; Mårtensson, Erik; Wagner, Paul Stankovski

doi:10.1007/978-3-030-65277-7_19

Cited by 9 publications

(4 citation statements)

References 30 publications

(55 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This section covers the simulations we ran, using the FBBL library [32] from [33], and the results they yielded. For all figures, each point corresponds to running plain BKW plus distinguishing at least 30 times.…”

Section: Simulations and Resultsmentioning

confidence: 99%

Modeling and simulating the sample complexity of solving LWE using BKW-style algorithms

2022

Self Cite

View full text Add to dashboard Cite

The Learning with Errors (LWE) problem receives much attention in cryptography, mainly due to its fundamental significance in post-quantum cryptography. Among its solving algorithms, the Blum-Kalai-Wasserman (BKW) algorithm, originally proposed for solving the Learning Parity with Noise (LPN) problem, performs well, especially for certain parameter settings with cryptographic importance. The BKW algorithm consists of two phases, the reduction phase and the solving phase. In this work, we study the performance of distinguishers used in the solving phase. We show that the Fast Fourier Transform (FFT) distinguisher from Eurocrypt’15 has the same sample complexity as the optimal distinguisher, when making the same number of hypotheses. We also show via simulation that it performs much better than previous theory predicts and develop a sample complexity model that matches the simulations better. We also introduce an improved, pruned version of the FFT distinguisher. Finally, we indicate, via extensive experiments, that the sample dependency due to both LF2 and sample amplification is limited.

show abstract

Section: Simulations and Resultsmentioning

confidence: 99%

Modeling and simulating the sample complexity of solving LWE using BKW-style algorithms

2022

Self Cite

View full text Add to dashboard Cite

show abstract

“…This section covers the simulations we ran, using the FBBL library [31] from [32], and the results they yielded. For all figures, each point corresponds to running plain BKW plus distinguishing at least 30 times.…”

Section: Simulations and Resultsmentioning

confidence: 99%

On the Sample Complexity of solving LWE using BKW-Style Algorithms

Guo¹,

Mårtensson²,

Wagner³

2021

Preprint

Self Cite

View full text Add to dashboard Cite

The Learning with Errors (LWE) problem receives much attention in cryptography, mainly due to its fundamental significance in post-quantum cryptography. Among its solving algorithms, the Blum-Kalai-Wasserman (BKW) algorithm, originally proposed for solving the Learning Parity with Noise (LPN) problem, performs well, especially for certain parameter settings with cryptographic importance. The BKW algorithm consists of two phases, the reduction phase and the solving phase.In this work, we study the performance of distinguishers used in the solving phase. We show that the Fast Fourier Transform (FFT) distinguisher from Eurocrypt'15 has the same sample complexity as the optimal distinguisher, when making the same number of hypotheses. We also show that it performs much better than theory predicts and introduce an improvement of it called the pruned FFT distinguisher. Finally, we indicate, via extensive experiments, that the sample dependency due to both LF2 and sample amplification is limited.

show abstract

“…With an implementation of the file-based algorithm, we managed to solve 6 challenges with Darmstadt challenge-type parameters, but with an unlimited number of samples, 3 more challenges than in the conference version of the paper [38]. For the 3 previously solved challenges, we made substantial improvements in runtime.…”

Section: Discussionmentioning

confidence: 99%

“…While we managed to substantially improve the implementation results of the conference version of the paper [38], we believe that significant improvements to the algorithm can still be made to reduce the gap compared to lattice-based techniques for solving LWE. For example, it remains to investigate the concrete improvement of employing the sieving aspect of coded-BKW with sieving [20].…”

Section: Discussionmentioning

confidence: 99%

Improvements on Making BKW Practical for Solving LWE

et al. 2021

Self Cite

View full text Add to dashboard Cite

The learning with errors (LWE) problem is one of the main mathematical foundations of post-quantum cryptography. One of the main groups of algorithms for solving LWE is the Blum–Kalai–Wasserman (BKW) algorithm. This paper presents new improvements of BKW-style algorithms for solving LWE instances. We target minimum concrete complexity, and we introduce a new reduction step where we partially reduce the last position in an iteration and finish the reduction in the next iteration, allowing non-integer step sizes. We also introduce a new procedure in the secret recovery by mapping the problem to binary problems and applying the fast Walsh Hadamard transform. The complexity of the resulting algorithm compares favorably with all other previous approaches, including lattice sieving. We additionally show the steps of implementing the approach for large LWE problem instances. We provide two implementations of the algorithm, one RAM-based approach that is optimized for speed, and one file-based approach which overcomes RAM limitations by using file-based storage.

show abstract

Making the BKW Algorithm Practical for LWE

Cited by 9 publications

References 30 publications

Modeling and simulating the sample complexity of solving LWE using BKW-style algorithms

Modeling and simulating the sample complexity of solving LWE using BKW-style algorithms

On the Sample Complexity of solving LWE using BKW-Style Algorithms

Improvements on Making BKW Practical for Solving LWE

Contact Info

Product

Resources

About