On the Sample Complexity of solving LWE using BKW-Style Algorithms

Guo, Qian; Mårtensson, Erik; Wagner, Paul Stankovski

doi:10.1109/isit45174.2021.9518190

Cited by 6 publications

(3 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We have developed new sample complexity model, which matches our simulatated complexities well. It also helps explain the gap between our simulated sample complexity originally reported in [1] and previous theory from [11]. Our pruned version of the FFT method improves the sample complexity of the FFT solver, at no cost.…”

Section: Discussionmentioning

confidence: 63%

“…For the error we use the rounded Gaussian distribution. 1 Let f(x|0,σ 2 ) denote the PDF of the normal ditribution with mean 0 and standard deviation σ, this distribution in turn being denoted as N(0, 2 ) . The rounded Gaussian distribution samples from N(0, 2 ) , rounds to the nearest integer and wraps to the interval [−(q − 1)/2,(q − 1)/2].…”

Section: Rounded Gaussian Distributionmentioning

confidence: 99%

“…The Learning with Errors (LWE) problem, introduced by Regev [4], is the major problem in lattice-based cryptography. Its average-case hardness can be based on the worst-case hardness Part of the material in this paper was presented at the 2021 IEEE International Symposium on Information Theory (ISIT 2021), Melbourne, Australia, July 12-20, 2021 [1].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Modeling and simulating the sample complexity of solving LWE using BKW-style algorithms

2022

Self Cite

View full text Add to dashboard Cite

The Learning with Errors (LWE) problem receives much attention in cryptography, mainly due to its fundamental significance in post-quantum cryptography. Among its solving algorithms, the Blum-Kalai-Wasserman (BKW) algorithm, originally proposed for solving the Learning Parity with Noise (LPN) problem, performs well, especially for certain parameter settings with cryptographic importance. The BKW algorithm consists of two phases, the reduction phase and the solving phase. In this work, we study the performance of distinguishers used in the solving phase. We show that the Fast Fourier Transform (FFT) distinguisher from Eurocrypt’15 has the same sample complexity as the optimal distinguisher, when making the same number of hypotheses. We also show via simulation that it performs much better than previous theory predicts and develop a sample complexity model that matches the simulations better. We also introduce an improved, pruned version of the FFT distinguisher. Finally, we indicate, via extensive experiments, that the sample dependency due to both LF2 and sample amplification is limited.

show abstract

Section: Discussionmentioning

confidence: 63%

Section: Rounded Gaussian Distributionmentioning

confidence: 99%