On the complexity of the BKW algorithm on LWE

Abstract

Abstract. This work presents a study of the complexity of the Blum-Kalai-Wasserman (BKW) algorithm when applied to the Learning with Errors (LWE) problem, by providing refined estimates for the data and computational effort requirements for solving concrete instances of the LWE problem. We apply this refined analysis to suggested parameters for various LWE-based cryptographic schemes from the literature and compare with alternative approaches based on lattice reduction. As a result, we provide new upper bounds for the concrete hardness of these LWE-based schemes. Rather surprisingly, it appears that BKW algorithm outperforms known estimates for lattice reduction algorithms starting in dimension n ≈ 250 when LWE is reduced to SIS. However, this assumes access to an unbounded number of LWE samples.

Lazy Modulus Switching for the BKW Algorithm on LWE

“…For typical choices of parameters -i.e. q ≈ n c for some small constant c ≥ 1, a = log 2 n and b = n/ log 2 n -the complexity of BKW as analysed in [3] is O 2 cn · n log 2 2 n . For small secrets, a naive modulus switching technique allows reducing this complexity to O 2 n c+ log 2 d log 2 n · n log 2 2 n where 0 < d ≤ 1 is a small constant.…”

“…This algorithm allow us to solve LWE in sub-exponential time as soon as the Gaussian distribution is sufficiently narrow, i.e. α · q < √ n. Recall that the security reduction [20] for LWE requires to consider discrete Gaussian with standard deviation α · q strictly bigger than √ n. However, from a practical point of view, the constants involved in this algorithm are so large that it is much more costly than other approaches for the parameters typically considered in cryptographic applications [2].…”

“…The behaviour of the algorithm is relatively well understood and it was shown to outperform lattice reduction estimates when reducing LWE to SIS (when q is small), thus it provides a solid basis for analysing the concrete hardness of LWE instances [3].…”

“…Following [3], we consider BKW -applied to Decision-LWE -as consisting of two stages: sample reduction and hypothesis testing. In this work, we only modify the first stage.…”

“…We now explain how to produce samples (ã i ,c i ) i≥0 that satisfy condition (2). For simplicity, we assume from now on that p = 2 κ .…”