The Ring-LWE Problem in Lattice-Based Cryptography: The Case of Twisted Embeddings

Abstract

Several works have characterized weak instances of the Ring-LWE problem by exploring vulnerabilities arising from the use of algebraic structures. Although these weak instances are not addressed by worst-case hardness theorems, enabling other ring instantiations enlarges the scope of possible applications and favors the diversification of security assumptions. In this work, we extend the Ring-LWE problem in lattice-based cryptography to include algebraic lattices, realized through twisted embeddings. We define the class of problems Twisted Ring-LWE, which replaces the canonical embedding by an extended form. By doing so, we allow the Ring-LWE problem to be used over maximal real subfields of cyclotomic number fields. We prove that Twisted Ring-LWE is secure by providing a security reduction from Ring-LWE to Twisted Ring-LWE in both search and decision forms. It is also shown that the twist factor does not affect the asymptotic approximation factors in the worst-case to average-case reductions. Thus, Twisted Ring-LWE maintains the consolidated hardness guarantee of Ring-LWE and increases the existing scope of algebraic lattices that can be considered for cryptographic applications. Additionally, we expand on the results of Ducas and Durmus (Public-Key Cryptography, 2012) on spherical Gaussian distributions to the proposed class of lattices under certain restrictions. As a result, sampling from a spherical Gaussian distribution can be done directly in the respective number field while maintaining its format and standard deviation when seen in Zn via twisted embeddings.

On Advances of Lattice-Based Cryptographic Schemes and Their Implementations

“…Recently, there have been some attempts to introduce more secure versions of the ring-LWE problem such as twisted ring-LWE [30]. There are new algorithms to increase the computational efficiency and reduce the bandwidth of the LWE operations: discrete trigonometric transform (DTT) and generalized discrete Fourier transform (GDFT) algorithms [31], calculating inner products as a branching program [32], and "decompose-and-reduce" modular multiplication algorithm (DARM) [33] to improve modular multiplication with NTT.…”

“…2 Elias et al [29] presents an attack on ring-LWE. Twisted ring-LWE [30] is a secure version of ring-LWE. key : n is the size of the secret key.…”

Quantum Cryptography for Securing Personal Health Information in Hospitals

“…[97][98][99] Active research is going on developing lattice cryptography, multivariate cryptography, code-based cryptography, supersingular isogeny key exchange protocol, and symmetric key systems like AES and SNOW-3G. [100][101][102][103][104] Campagna recently postulated that there will be three main questions about the number of years needed to fulfill our health sector needs: (a) Our encryption to be secure; (b) to make our IT infrastructure quantum-safe; and (c) before a large-scale quantum computer will be built. 105 The physical hardware required to build qubits includes transmons and superconductivity traps, and we will also need insights into cavity quantum electrodynamics.…”

Theoretical and practical contributions to Ring-LWE cryptography

“…Most of the content described in Part I was published in the open-access journal Entropy [109] as a result of collaborative work with Robson R. de Araujo, Diego F. Aranha, Sueli I. R. Costa, and Ricardo Dahab. Early versions of this work [109] were presented at LAWCI 2018 [111] and CrossFyre 2019 [108], and posted online at the IACR Cryptology ePrint Archive [110]. Moreover, the results in Section 4.2, and 5.3 are contemporary to these publications.…”