On the concrete hardness of Learning with Errors

Albrecht, M.; Player, Rachel; Scott, Sam

doi:10.1515/jmc-2015-0016

Cited by 514 publications

(351 citation statements)

References 34 publications

(74 reference statements)

Supporting

Mentioning

302

Contrasting

Unclassified

Order By: Relevance

“…Hence, both small-secret and error-secret Ring-LWE variants can be used without any major difference in program size or runtimes (none of the performance metrics increase by more than 15% for the error-secret case according to our experimental analysis), achieving approximately the same level of security according to LWE estimator [67].…”

Section: ) Small-secret Ring-lwe Vs Error-secret Ring-lwe Formentioning

confidence: 76%

“…According to our estimates using [67], error-secret and small-secret Ring-LWE require almost the same bitwidth for q to achieve the same level of security for practical ring dimensions (the modulus q is at most 4 bits larger for smallsecret Ring-LWE). Hence, both small-secret and error-secret Ring-LWE variants can be used without any major difference in program size or runtimes (none of the performance metrics increase by more than 15% for the error-secret case according to our experimental analysis), achieving approximately the same level of security according to LWE estimator [67].…”

Section: ) Small-secret Ring-lwe Vs Error-secret Ring-lwe Formentioning

confidence: 92%

“…We run the LWE security estimator 2 (commit 9302d42) [67] to find the lowest security levels for the uSVP, decoding, and dual attacks following the standard homomorphic encryption security recommendations [68]. We choose the least value of λ for all 3 attacks on classical computers based on the estimates for the BKZ sieve reduction cost model.…”

Section: Security 1) Ring Dimension Nmentioning

confidence: 99%

“…Note that our implementation is based on the entropic Ring-LWE problem with a small-secret (ternary) distribution, which is a stronger assumption than Ring-LWE. While our work factor estimates already incorporate the effect of small-secret distribution (using the LWE estimator [67]), the effect of the entropic variant of Ring-LWE on the work factor is currently unknown and is thus ignored in our estimates.…”

Section: Experiments For the Word Size Of One Bytementioning

confidence: 99%

See 3 more Smart Citations

Implementing Conjunction Obfuscation Under Entropic Ring LWE

Cousins

Crescenzo

Gür

et al. 2018

2018 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Abstract-We address the practicality challenges of secure program obfuscation by implementing, optimizing, and experimentally assessing an approach to securely obfuscate conjunction programs proposed in [1]. Conjunction programs evaluate functions f (x1, . . . , xL) = i∈I yi, where yi is either xi or ¬xi and I ⊆ [L], and can be used as classifiers. Our obfuscation approach satisfies distributional Virtual Black Box (VBB) security based on reasonable hardness assumptions, namely an entropic variant of the Ring Learning with Errors (Ring-LWE) assumption. Prior implementations of secure program obfuscation techniques support either trivial programs like point functions, or support the obfuscation of more general but less efficient branching programs to satisfy Indistinguishability Obfuscation (IO), a weaker security model. Further, the more general implemented techniques, rather than relying on standard assumptions, base their security on conjectures that have been shown to be theoretically vulnerable.Our work is the first implementation of non-trivial program obfuscation based on polynomial rings. Our contributions include multiple design and implementation advances resulting in reduced program size, obfuscation runtime, and evaluation runtime by many orders of magnitude. We implement our design in software and experimentally assess performance in a commercially available multi-core computing environment. Our implementation achieves runtimes of 6.7 hours to securely obfuscate a 64-bit conjunction program and 2.5 seconds to evaluate this program over an arbitrary input. We are also able to obfuscate a 32-bit conjunction program with 53 bits of security in 7 minutes and evaluate the obfuscated program in 43 milliseconds on a commodity desktop computer, which implies that 32-bit conjunction obfuscation is already practical. Our graph-induced (directed) encoding implementation runs up to 25 levels, which is higher than previously reported in the literature for this encoding. Our design and implementation advances are applicable to obfuscating more general compute-and-compare programs and can also be used for many cryptographic schemes based on lattice trapdoors.

show abstract

Section: ) Small-secret Ring-lwe Vs Error-secret Ring-lwe Formentioning

confidence: 76%

Section: ) Small-secret Ring-lwe Vs Error-secret Ring-lwe Formentioning

confidence: 92%

Section: Security 1) Ring Dimension Nmentioning

confidence: 99%

Section: Experiments For the Word Size Of One Bytementioning

confidence: 99%

See 2 more Smart Citations

Implementing Conjunction Obfuscation Under Entropic Ring LWE

Cousins

Crescenzo

Gür

et al. 2018

2018 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…For these computations we have taken parameters B key = 1, σ err = 2 √ n and a number k of 62-bits moduli to get the largest size for q ensuring at least 80-bits of security according to [2].…”

Section: Overall Impact On Noise Growthmentioning

confidence: 99%