(One) Failure Is Not an Option: Bootstrapping the Search for Failures in Lattice-Based Encryption Schemes

Abstract

Lattice-based encryption schemes are often subject to the possibility of decryption failures, in which valid encryptions are decrypted incorrectly. Such failures, in large number, leak information about the secret key, enabling an attack strategy alternative to pure lattice reduction. Extending the "failure boosting" technique of D'Anvers et al. in PKC 2019, we propose an approach that we call "directional failure boosting" that uses previously found "failing ciphertexts" to accelerate the search for new ones. We analyse in detail the case where the lattice is defined over polynomial ring modules quotiented by X N + 1 and demonstrate it on a simple Mod-LWE-based scheme parametrizedà la Kyber768/Saber. We show that for a given secret key (single-target setting), the cost of searching for additional failing ciphertexts after one or more have already been found, can be sped up dramatically. We thus demonstrate that, in this single-target model, these schemes should be designed so that it is hard to even obtain one decryption failure. Besides, in a wider security model where there are many target secret keys (multi-target setting), our attack greatly improves over the state of the art.

Exploiting Decryption Failures in Mersenne Number Cryptosystems

“…Techniques such as failure boosting [9], which increase the failure probability of ciphertexts and which have been applied to encryption schemes based on the learning with errors problem, might reduce the number of required decryption queries. Moreover, recent results [11] for these schemes show that information about previous failures can be used to bootstrap the search for new failures. We did not investigate if these techniques are applicable to Mersenne prime schemes.…”

“…These attacks are countered by schemes that obtain IND-CCA security using an appropriate transformation. D'Anvers et al [9] provided a technique to increase the failure probability and subsequently recover the secret key of IND-CCA secure LWE based schemes, a technique which was extended in subsequent works [12] [17] [11]. Guo, Johansson and Stankovski [16] provided a similar attack on IND-CCA secure code based schemes.…”

High-order Table-based Conversion Algorithms and Masking Lattice-based Encryption

“…Therefore the attack remains completely unpractical. We refer to [ABD + 21] for a discussion on the more recent attacks based on decryption failure [BS20,DRV20]; their overall running time for Kyber are no better than the above attack. In particular, the multi-target attack considered in [DGJ + 19] is prevented in Kyber by hashing the public key pk into r and e 1 .…”

Lattice‐based cryptosystems in standardisation processes: A survey

“…Once a decryption failure occurs, the corresponding ciphertext would leak a little bit information of the secret. Therefore, a CCA attacker is able to exploit the leakage in the failing ciphertexts and mount more efficient attacks [26,76,77,144,145]. To prevent such attacks, lattice-based KEMs usually set the decryption failure probability sufficiently low even zero by using larger parameters.…”