dissection bkw
play

Dissection-BKW CRYPTO 2018, Santa Barbara , August 20th 2018 Andre - PowerPoint PPT Presentation

Dissection-BKW CRYPTO 2018, Santa Barbara , August 20th 2018 Andre Esser , Felix Heuer, Robert Kbler, Alexander May, Christian Sohler Horst Grtz Institute for IT Security Ruhr University Bochum What is LPN? Learning Parity with Noise (LPN)


  1. Dissection-BKW CRYPTO 2018, Santa Barbara , August 20th 2018 Andre Esser , Felix Heuer, Robert Kübler, Alexander May, Christian Sohler Horst Görtz Institute for IT Security Ruhr University Bochum

  2. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  3. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 • Cryptographic applications [HB01, Ale03, HKL + 12, DV13] Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  4. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 • Cryptographic applications [HB01, Ale03, HKL + 12, DV13] • Solve LPN: BKW algorithm [BKW00] ◦ Time = Memory = Samples , slightly subexponential ◦ only small experiments [BTV16, EKM17] Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  5. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 • Cryptographic applications [HB01, Ale03, HKL + 12, DV13] • Solve LPN: BKW algorithm [BKW00] ◦ Time = Memory = Samples , slightly subexponential ◦ only small experiments [BTV16, EKM17] • Goal: BKW-variant applicable for any given memory Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  6. Illustration of “BKW” ( a 1 , � a 1 , s � + e 1 ) ( a 2 , � a 2 , s � + e 2 ) Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  7. Illustration of “BKW” ( a 1 , � a 1 , s � + e 1 ) + ( a 2 , � a 2 , s � + e 2 ) = ( a 1 + a 2 , � a 1 + a 2 , s � + e 1 + e 2 ) a ′ � a ′ , s � e ′ ( , + ) Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  8. Illustration of “BKW” $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  9. Illustration of “BKW” $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  10. Illustration of “BKW” $ 0101 0101 $ stripe Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  11. Illustration of “BKW” 0000 $ $ 0101 + 0101 $ stripe Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  12. Illustration of “BKW” 0000 $ $ 0101 1111 $ 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  13. Illustration of “BKW” 0000 $ $ 0101 $ 0000 1111 $ + 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  14. Illustration of “BKW” 0000 $ $ 0101 $ 0000 $ 0000 1111 $ 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  15. Illustration of “BKW” 0000 $ $ 0101 $ 0000 $ 0000 1111 0000 $ $ 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  16. Illustration of “BKW” 0000 $ $ 0101 $ 0000 $ 0000 1111 0000 $ $ 0101 $ . . . . . . . . . $ 1111 0000 $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  17. Illustration of “BKW” $ $ $ $ . . . . . . . . . $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  18. Illustration of “BKW” $ $ $ $ $ $ $ $ → . . . . . . . . . . . . . . . . . . $ $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  19. Illustration of “BKW” 1 $ $ $ $ 1 $ $ 1 1 $ $ → → . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 $ $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  20. Illustration of “BKW” 1 $ $ $ $ 1 $ $ 1 1 $ $ → → . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 $ $ • a i = (1 , 0 , 0 , . . . , 0) ⇒ ( a i , � a i , s � + e i ) = ( a i , s 1 + e i ) • Majority vote! BKW Theorem [BKW00, LF06] BKW solves LPN in time, memory and sample complexity 2 k/ log k . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  21. c -sum Observation $ 0000 0101 $ + $ 0101 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  22. c -sum Observation $ 0000 0101 $ + $ 0000 $ 0101 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  23. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  24. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  25. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) ! � N � / 2 b ≥ N c c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  26. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) N ≥ 2 b/ ( c − 1) c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  27. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) N = 2 b/ ( c − 1) c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  28. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) N = 2 b/ ( c − 1) Main Idea: solve c - SP repeatedly on stripes c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  29. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0101 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  30. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0101 → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  31. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0101 sum of A = 2 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  32. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0000 $ 0101 sum of A = 2 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  33. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0000 $ 0101 sum of A = 2 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  34. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0000 $ 0101 sum of B = 3 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  35. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 sum of B = 3 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  36. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  37. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 sum of A samples → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  38. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 sum of A samples → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  39. ❛♥❞ → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

  40. ❛♥❞ → → N $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

  41. ❛♥❞ → → N $ $ 1 solve c - SP Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

  42. ❛♥❞ → → N $ $ 1 solve c - SP Memory Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend