On the Efficacy of Solving LWE by Reduction to Unique-SVP

Albrecht, M.; Fitzpatrick, Robert; Göpfert, Florian

doi:10.1007/978-3-319-12160-4_18

Cited by 55 publications

(34 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Lyubashevsky and Micciancio (Theorem 1 of [17]) argue that the best choice for M above is e , which is approximately √ mσ in our case. However, in our experiments M = 1 worked fine (and leads to a more powerful attack [2] in practice).…”

Section: Standard Lattice Attack On Lwementioning

confidence: 78%

Lattice Decoding Attacks on Binary LWE

Bai

Galbraith

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We consider the binary-LWE problem, which is the learning with errors problem when the entries of the secret vector are chosen from {0, 1} or {−1, 0, 1} (and the error vector is sampled from a discrete Gaussian distribution). Our main result is an improved lattice decoding algorithm for binary-LWE which first translates the problem to the inhomogeneous short integer solution (ISIS) problem, and then solves the closest vector problem using a re-scaling of the lattice. We also discuss modulus switching as an approach to the problem. Our conclusion is that binary-LWE is easier than general LWE. We give experimental results and theoretical estimates that can be used to choose parameters for binary-LWE to achieve certain security levels.

show abstract

Section: Standard Lattice Attack On Lwementioning

confidence: 78%

Lattice Decoding Attacks on Binary LWE

Bai

Galbraith

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…We stress that no data is publicly available on τ for smaller success probabilities. In [AFG14] it is shown that for a fixed δ 0 the optimal subdimension is m = n log q log δ0 as in Section 3.3. We may use this to determine δ 0 using the expression above (where for simplicity we assume equality).…”

Section: Reducing Bdd To Usvpmentioning

confidence: 94%

“…Albrecht, Fitzpatrick and Göpfert [AFG14] consider the complexity of solving LWE by reducing BDD to uSVP (unique Shortest Vector Problem). Formally, the γ-uSVP problem is as follows: given a lattice L such that λ 2 (L) > γλ 1 (L), find a shortest nonzero vector in L.…”

Section: Reducing Bdd To Usvpmentioning

confidence: 99%

See 1 more Smart Citation

On the concrete hardness of Learning with Errors

Albrecht

Player

Scott

2015

Journal of Mathematical Cryptology

Self Cite

511

302

View full text Add to dashboard Cite

Abstract. The Learning with Errors (LWE) problem has become a central building block of modern cryptographic constructions. This work collects and presents hardness results for concrete instances of LWE. In particular, we discuss algorithms proposed in the literature and give the expected resources required to run them. We consider both generic instances of LWE as well as small secret variants. Since for several methods of solving LWE we require a lattice reduction step, we also review lattice reduction algorithms and use a refined model for estimating their running times. We also give concrete estimates for various families of LWE instances, provide a Sage module for computing these estimates and highlight gaps in the knowledge about algorithms for solving the Learning with Errors problem.

show abstract

“…Another approach to solve LWE is the reduction of LWE to uSVP and the usage of an SVP solver. This so called "embedding approach" or "embedding attack" is analyzed in [AFG13]. However, still no attack has emerged that works best in all cases.…”

Section: Security Evaluation Of Lattice-based Cryptographymentioning

confidence: 99%

Efficient implementation of ideal lattice-based cryptography

Pöppelmann¹

2017

It - Information Technology

View full text Add to dashboard Cite

Digital signatures and public-key encryption are used to protect almost any secure communication channel on the Internet or between embedded devices. Currently, protocol designers and engineers usually rely on schemes that are either based on the factoring assumption (RSA) or on the hardness of the discrete logarithm problem (DSA/ECDSA). But in case of advances in classical cryptanalysis or progress on the development of quantum computers the hardness of these closely related problems might be seriously weakened. In order to prepare for such an event, research on alternatives is required to provide long-term security.In this thesis, we focus on the efficient implementation of such alternative public-key cryptosystems whose security is based on the intractability of certain computational problems on ideal lattices. While an extensive theoretical background exists for lattice-based and ideal latticebased cryptography, not much is known about the efficiency of practical instantiations, especially on constrained and cost-sensitive platforms. We thus investigate novel algorithms and implementation techniques for fast and flexible polynomial multiplication and Gaussian sampling and then use these building blocks to implement public-key encryption and signature schemes. The results provided in this thesis show that lattice-based schemes can be optimized for high performance or resource efficiency on embedded microcontrollers and reconfigurable hardware. Our implementations of a public-key encryption scheme based on the ring learning with errors problems (RLWE) or of the bimodal lattice signature scheme (BLISS) can even outperform classical ECC-and RSA-based implementations.Lattice-based cryptography can also be used to realize homomorphic cryptography that allows computation on encrypted data. However, due to the large parameter sets and complex operations required, even for simple homomorphic evaluation operations, the performance of these schemes is a major issue preventing practical usage. In this thesis we investigate options for acceleration of homomorphic cryptography in a cloud environment using reconfigurable hardware. We implement all evaluation operations of the YASHE homomorphic encryption scheme and propose methods to deal with large ciphertext and key sizes as well as limited memory bandwidth. KeywordsPost-quantum cryptography, public-key cryptosystem, embedded system, microcontroller, FPGA KurzfassungDigitale Signaturen und Public-Key-Verschlüsselung werden für den Schutz nahezu jeder sicheren Kommunikation über das Internet oder zwischen eingebetteten Systemen genutzt. Die Sicherheit basiert dabei entweder auf der Faktorisierungsannahme (RSA) oder der Annahme, dass es schwer ist, das diskrete Logarithmus-Problem (DSA/ECDSA) zu lösen. Durch Fortschritte in der klassischen Kryptoanalyse oder bei der Entwicklung von Quantencomputern könnten diese Probleme allerdings in Zukunft ernsthaft geschwächt oder gelöst werden. Daher ist Forschung zu alternativen Public-Key-Kryptosystemen erforderlich, die in ...

show abstract

On the Efficacy of Solving LWE by Reduction to Unique-SVP

Cited by 55 publications

References 22 publications

Lattice Decoding Attacks on Binary LWE

Lattice Decoding Attacks on Binary LWE

On the concrete hardness of Learning with Errors

Efficient implementation of ideal lattice-based cryptography

Contact Info

Product

Resources

About