A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. - - PowerPoint PPT Presentation

β–Ά
a hybrid lattice reduction and quantum search attack on
SMART_READER_LITE
LIVE PREVIEW

A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. - - PowerPoint PPT Presentation

Apr 02, 2024 271 likes β€’554 views

A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. Gpfert, C. van Vredendaal, Thomas Wunderer 29.06.2017 | 1 Motivation Primal BKW Embedding LWE Hybrid Dual Embedding Make it quantum! Faster More versatile

slide-1
SLIDE 1

29.06.2017 | 1

  • F. GΓΆpfert, C. van Vredendaal, Thomas Wunderer

A Hybrid Lattice Reduction and Quantum Search Attack on LWE

slide-2
SLIDE 2

29.06.2017 | 2

Motivation

Hybrid … BKW Primal Embedding Dual Embedding LWE Make it quantum! Faster More versatile

slide-3
SLIDE 3

29.06.2017 | 3

Background and Notation

slide-4
SLIDE 4

29.06.2017 | 4

Lattices

𝒄1 𝒄2 𝒄1

β€²

𝒄2

β€²

(good) basis π‘ͺ (bad) basis π‘ͺβ€² π‘œ-dimensional lattice Ξ›: a discrete additive subgroup of β„π‘œ Basis of a lattice Ξ›: lin. ind. π‘ͺ = 𝒄1, … , π’„π‘œ such that Ξ› = ℀𝒄1 + … + β„€π’„π‘œ. Basis reduction

slide-5
SLIDE 5

29.06.2017 | 5

Shortest Vector Problem (SVP)

Find a shortest non- zero lattice vector

slide-6
SLIDE 6

29.06.2017 | 6

Closest Vector Problem (CVP)

𝒇 𝒖

Given a target vector 𝒖 Find (short) difference vector 𝒇 Bounded Distance Decoding (BDD)

slide-7
SLIDE 7

29.06.2017 | 7

Learning with Errors (LWE)

𝑩 s e . + b =

Given: 𝑩 ∈ β„€π‘Ÿ

π‘›Γ—π‘œ, 𝒄 ∈ β„€π‘Ÿ 𝑛

Find: 𝒕 ∈ β„€π‘Ÿ

π‘œ

mod q

short short

slide-8
SLIDE 8

29.06.2017 | 8

The (Quantum) Hybrid Attack

  • n LWE
slide-9
SLIDE 9

29.06.2017 | 9

Our approach

We solve the LWE instance 𝒄 = 𝑩𝒕 + 𝒇 𝑛𝑝𝑒 π‘Ÿ as follows: 1. Transform LWE into SVP in some lattice Ξ› 2. Generate a basis π‘ͺβ€² of Ξ› of the form π‘ͺβ€² = π‘ͺ 𝑫 𝟏 𝑱𝑠 3. Solve SVP in Ξ› with our Quantum Hybrid Attack

slide-10
SLIDE 10

29.06.2017 | 10

Transforming LWE into SVP

𝒄 = 𝑩𝒕 + 𝒇 𝑛𝑝𝑒 π‘Ÿ π’˜ = 𝒕 𝒇 1 ∈ Ξ› = π’š ∈ β„€π‘œ+𝑛+1 ∢ 𝑩 𝑱𝑛 βˆ’ 𝒄 π’š = 𝟏 𝑛𝑝𝑒 π‘Ÿ

short

slide-11
SLIDE 11

29.06.2017 | 11

The Quantum Hybrid Attack (Idea)

Setup: Find a shortest non-zero vector π’˜ ∈ Ξ› π‘ͺβ€² βŠ‚ ℀𝑒, where π‘ͺβ€² = π‘ͺ 𝑫 𝟏 𝑱𝑠

𝑀 = 𝑀1 𝑀1 𝑏 𝑔 𝑀2 ∈ Ξ› ≔ Ξ› π‘Ÿπ½π‘œ 𝐼 0π‘œ π½π‘œ

Quantum-search for π’˜2 ∈ ℀𝑠 (β€œGrover-like”) Find π’˜1 ∈ β„€π‘’βˆ’π‘  with lattice-based techniques:

  • Basis reduction as precomputation
  • BDD-algorithms (Nearest Plane [Babai86])
slide-12
SLIDE 12

29.06.2017 | 12

Quantum vs. Classical Hybrid Attack

Quantum Classical Quantum search for π’˜2 Meet-in-the-middle search for π’˜2 + √-speed-up over brute-force + √-speed-up over brute-force + More versitile

  • Requires highly structured keys

+ Low memory consumption

  • Huge memory consumption

+ No collision-finding probability

  • Low collision-finding probability

(might be β‰ˆ 2βˆ’90)

slide-13
SLIDE 13

29.06.2017 | 13

The Attack

slide-14
SLIDE 14

29.06.2017 | 14

π’˜ = π’˜πŸ π’˜πŸ‘ = π‘ͺ 𝑫 𝟏 𝑱𝑠 π’š π’˜πŸ‘ = π‘ͺπ’š + π‘«π’˜πŸ‘ π’˜πŸ‘

Find π’˜πŸ approach if π’˜πŸ‘ is known

𝒖 = π‘«π’˜πŸ‘

Lattice 𝚳 = 𝚳 π‘ͺ π’Ž = βˆ’π‘ͺπ’š π’˜πŸ

Solve BDD problem: Given 𝒖, find π’˜πŸ

slide-15
SLIDE 15

29.06.2017 | 15

Solving BDD: Babaiβ€˜s Nearest Plane

𝑂𝑄π‘ͺ 𝒖 𝒖 𝒖′ 𝑂𝑄π‘ͺ 𝒖′

𝒬( π‘ͺ) Requires sufficiently good basis

slide-16
SLIDE 16

29.06.2017 | 16

The Algorithm (Simplified Idea)

Loop:

  • β€œQuantum-guess” π’˜2

β€² ∈ 𝑇 (black box for now)

  • Check if guess is correct:
  • Calculate π’˜1

β€² = 𝑂𝑄π‘ͺ π‘«π’˜2 β€²

  • If π’˜ =

π’˜1

β€²

π’˜2

β€²

is sufficiently short

  • Return π’˜

Task: find a shortest non-zero vector in a lattice Ξ› Input: a search space 𝑇 βŠ‚ ℀𝑠, a basis π‘ͺβ€² = π‘ͺ 𝑫 𝟏 𝑱𝑠

slide-17
SLIDE 17

29.06.2017 | 17

Quantum Search (simplified)

  • Let 𝑇 = 𝑑1, … , 𝑑𝑙 be a finite search space and 𝐸 = π‘ž1, … , π‘žπ‘™ be a

probability distribution on 𝑇.

  • Let 𝑑 ∈ 𝑇 be a secret sampled from 𝐸. Task: find it!
  • Choose a probability distribution 𝐡 = 𝑏1, … , 𝑏𝑙 on 𝑇.
  • There exists a quantum algorithm (generalization of Grover’s

search algorithm) that finds 𝑑 in roughly 𝑀 𝐡 = 𝑀 𝑏1, … , 𝑏𝑙 = π‘žπ‘— 𝑏𝑗 loops (sampling from 𝐡 and testing).

slide-18
SLIDE 18

29.06.2017 | 18

How to choose the distribution A

  • Minimize the function 𝑀 𝑏1, … , 𝑏𝑙 = π‘žπ‘—

𝑏𝑗 over all

𝑏1, … , 𝑏𝑙 ∈ 0,1 with 𝑏1 + β‹― + 𝑏𝑙 = 1.

  • Optimization with constraints in 𝑙 variables (οƒ  Lagrange)
  • Optimal distribution a1, … , 𝑏𝑙

with 𝑏𝑗 =

π‘žπ‘—

2/3

π‘žπ‘—

2/3

  • Minimal number of loops:

π‘€π‘›π‘—π‘œ = π‘žπ‘—

2/3 3/2

slide-19
SLIDE 19

29.06.2017 | 19

Example (New Hope)

Take 𝑇 = βˆ’16, … , 16 200 and 𝐸 to be the distribution on 𝑇 given in the β€œNew Hope” key exchange scheme [ADPS16]

  • Classical brute-force search:

π‘€π‘‘π‘šπ‘π‘‘π‘‘π‘—π‘‘π‘π‘š β‰ˆ 33200 β‰ˆ 21009

  • Grover’s quantum search:

𝑀𝐻𝑠𝑝𝑀𝑓𝑠 β‰ˆ 33200 β‰ˆ 2504

  • Our approach:

𝑀𝑝𝑣𝑠 β‰ˆ 21.85β‹…200 β‰ˆ 2370

slide-20
SLIDE 20

29.06.2017 | 20

Results

slide-21
SLIDE 21

29.06.2017 | 21

Runtime Analysis

Main result: Let all notations be as before and 𝐸 = π‘ž1, … , π‘žπ‘™ be the distribution from which 𝑀2 is sampled. Success probability: π‘žπ‘‘π‘£π‘‘π‘‘ β‰ˆ

𝑗=1 π‘›βˆ’π‘ 

1 βˆ’ 2 𝐢 𝑛 βˆ’ 𝑠 βˆ’ 1 2 , 1 2

βˆ’1 max βˆ’π‘ π‘—,βˆ’1

1 βˆ’ 𝑧2 π‘›βˆ’π‘ βˆ’3

2

𝑒𝑧 where 𝐢 β‹…,β‹… denotes the Euler beta function, 𝑠

𝑗 = 𝑆𝑗 2β€–π’˜1β€– and 𝑆𝑗 is the

length of the 𝑗-th Gram-Schmidt vector in π‘ͺ. Number of operations if successful: Tβ„Žπ‘§π‘ β‰ˆ

π‘›βˆ’π‘  2 21.06

π‘žπ‘—

2/3 3/2

slide-22
SLIDE 22

29.06.2017 | 22

Runtime Analysis

Remarks:

  • Tβ„Žπ‘§π‘ depends on the guessing-dimension 𝑠 and the β€žqualityβ€œ πœ€

(Hermite factor) of the basis π‘ͺ

  • Use precomputation (basis reduction) to change πœ€
  • Balance precomputation and actual attack costs:

Tπ‘’π‘π‘’π‘π‘š 𝑠, πœ€ = T𝑠𝑓𝑒 𝑠, πœ€ + Tβ„Žπ‘§π‘ 𝑠, πœ€ π‘žπ‘‘π‘£π‘‘π‘‘ 𝑠, πœ€

  • Non-trivial optimization process in 𝑠 and πœ€
  • More details: see paper
slide-23
SLIDE 23

29.06.2017 | 23

Results

  • Runtime depends on the cost of basis reduction (BKZ)
  • How to model the SVP cost inside BKZ with block size 𝛾?
  • Two (very) different ways in the literature:
  • Enumeration:

T

π‘‡π‘Šπ‘„ = 20.27𝛾 ln 𝛾 βˆ’1.019𝛾+16.1

  • Sieving:

T

π‘‡π‘Šπ‘„ = 20.265𝛾+16.4

  • T𝑠𝑓𝑒 β‰ˆ 𝑒𝑗𝑛 βˆ— #𝑒𝑝𝑣𝑠𝑑 βˆ— T

π‘‡π‘Šπ‘„

  • οƒ  We provide two different runtime estimates
  • Compare our results with the LWE estimator (not claimed security levels!)
slide-24
SLIDE 24

29.06.2017 | 24

Results: New Hope and Frodo

Attack New Hope Frodo-592 Frodo-752 Frodo-864 Dual 1346 446 485 618 Decoding 833

  • Qu. Hybrid

725 254 310 377 Attack New Hope Frodo-592 Frodo-752 Frodo-864 Dual 389 173 184 219 Decoding 380

  • Qu. Hybrid

384 171 189 221

Table 1: BKZ with enumeration Table 2: BKZ with sieving

slide-25
SLIDE 25

29.06.2017 | 25

Results: Lindner-Peikert

Figure 1: BKZ with enumeration

slide-26
SLIDE 26

29.06.2017 | 26

Results: Lindner-Peikert

Figure 1: BKZ with enumeration

slide-27
SLIDE 27

29.06.2017 | 27

Conclusion

  • New improved Quantum Hybrid Attack
  • Detailed runtime analysis of the Quantum Hybrid
  • New possibilities: apply Quantum Hybrid to non-uniform

search spaces (e.g., LWE with Gaussian distribution)

  • Outperforms other attacks in several instances

Thank you! Questions?

slide-28
SLIDE 28

29.06.2017 | 28

Literature

[HG07] N. Howgrave-Graham. A Hybrid Lattice-Reduction and Meet-in-the-Middle Attack against NTRU. [BGPW16] J. A. Buchmann, F. GΓΆpfert, R. Player, and T. Wunderer. On the Hardness of LWE with Binary Error. [Wun16] T. Wunderer. Revisiting the Hybrid Attack: Improved Analysis and Refined Security Estimates [GvVW16] F. GΓΆpfert, C. van Vredendaal, T. Wunderer. The Quantum Hybrid Attack. [Babai86] L. Babai. On LovΓ‘sz’ Lattice Reduction and the Nearest Lattice Point Problem. [Schank15] J. Schanck. Practical Lattice Cryptosystems: NTRUencrypt and NTRUmls. [Grover96] L. K. Grover. A Fast Quantum Mechanical Algorithm for Database Search. [BHMT02] G. Brassard, P. HΓΈyer, M. Mosca, A. Tapp. Quantum Amplitude Amplification and Estimation. [ADPS16] E. Alkim, L. Ducas, T. PΓΆppelmann, P. Schwabe. Post-quantum Key Exchange - A New Hope.