Revisiting the Expected Cost of Solving uSVP and Applications to LWE

Lattices lead to promising practical post-quantum digital signatures, combining asymptotic efficiency with strong theoretical security guarantees. However, tuning their parameters into practical instantiations is a delicate task. On the one hand, NIST round 2 candidates based on Lyubashevsky's design (such as DILITHIUM and qTESLA) allow several tradeoffs between security and efficiency, but at the expense of a large bandwidth consumption. On the other hand, the hash-and-sign Falcon signature is much more compact and is still very efficient, but it allows only two security levels, with large compactness and security gaps between them. We introduce a new family of signature schemes based on the Falcon design, which relies on module lattices. Our concrete instantiation enjoys the compactness and efficiency of Falcon, and allows an intermediate security level. It leads to the most compact lattice-based signature achieving a quantum security above 128 bits.

show abstract

“…The GSA has been backed-up by extensive experimental results [2,4,12,22,58], and it has been found to be very accurate for large block-sizes.…”

Section: Lattice Reduction Attacksmentioning

confidence: 99%

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

Chuengsatiansup

Prest²,

Stehlé

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Our method for solving LWE is via embedding e into a uSVP instance [Kan87,BG14] but using the success condition originally given in [ADPS16] and experimentally justified in [AGVW17]. We also use the embedding coefficient t = 1 following [ADPS16,AGVW17]. We choose the minimal β such that after BKZ-β reduction, 1h 23m S † : There was also a failed search after β = 90, with ν = 115.…”

Section: Lwementioning

confidence: 99%

“…For this, we adapted the strategy of [LN13], which consists of running one large enumeration after a BKZ tour of small enumerations, to G6K. This improves slightly upon the prediction of [ADPS16,AGVW17].…”

Section: Introductionmentioning

confidence: 99%

The General Sieve Kernel and New Records in Lattice Reduction

Albrecht

Ducas

Herold

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

We propose the General Sieve Kernel (G6K, pronounced /Ze.si.ka/), an abstract stateful machine supporting a wide variety of lattice reduction strategies based on sieving algorithms. Using the basic instruction set of this abstract stateful machine, we first give concise formulations of previous sieving strategies from the literature and then propose new ones. We then also give a light variant of BKZ exploiting the features of our abstract stateful machine. This encapsulates several recent suggestions (Ducas at Eurocrypt 2018; Laarhoven and Mariano at PQCrypto 2018) to move beyond treating sieving as a blackbox SVP oracle and to utilise strong lattice reduction as preprocessing for sieving. Furthermore, we propose new tricks to minimise the sieving computation required for a given reduction quality with mechanisms such as recycling vectors between sieves, on-the-fly lifting and flexible insertions akin to Deep LLL and recent variants of Random Sampling Reduction. Moreover, we provide a highly optimised, multi-threaded and tweakable implementation of this machine which we make open-source. We then illustrate the performance of this implementation of our sieving strategies by applying G6K to various lattice challenges. In particular, our approach allows us to solve previously unsolved instances of the Darmstadt SVP (151, 153, 155) and LWE (e.g. (75, 0.005)) challenges. Our solution for the SVP-151 challenge was found 400 times faster than the time reported for the SVP-150 challenge, the previous record. For exact SVP, we observe a performance crossover between G6K and FPLLL's state of the art implementation of enumeration at dimension 70.

show abstract

“…Moreover, according to the study of Albrecht et al [2] on the behavior of LLL for unique-SVP instances, this condition should be essentially tight. More precisely, we expect the attack to fail with overwhelming probability when AF(…”

Section: Lattice Reductionmentioning

confidence: 99%

Attacks on the AJPS Mersenne-Based Cryptosystem

Boer

Ducas

Jeffery

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Aggarwal, Joux, Prakash and Santha recently introduced a new potentially quantum-safe public-key cryptosystem, and suggested that a brute-force attack is essentially optimal against it. They consider but then dismiss both Meet-in-the-Middle attacks and LLL-based attacks. Very soon after their paper appeared, Beunardeau et al. proposed a practical LLL-based technique that seemed to significantly reduce the security of the AJPS system. In this paper we do two things. First, we show that a Meet-in-the-Middle attack can also be made to work against the AJPS system, using locality-sensitive hashing to overcome the difficulty that Aggarwal et al. saw for such attacks. We also present a quantum version of this attack. Second, we give a more precise analysis of the attack of Beunardeau et al., confirming and refining their results.

show abstract

Revisiting the Expected Cost of Solving uSVP and Applications to LWE

Cited by 87 publications

References 39 publications

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

The General Sieve Kernel and New Records in Lattice Reduction

Attacks on the AJPS Mersenne-Based Cryptosystem

Contact Info

Product

Resources

About