SLIDE 1
How (Not) to Instantiate Ring-LWE Chris Peikert
University of Michigan Security and Cryptography for Networks 1 September 2016
1 / 12
Conclusions
2 / 12
How (Not) to Instantiate Ring-LWE Chris Peikert University of - - PowerPoint PPT Presentation
How (Not) to Instantiate Ring-LWE Chris Peikert University of - - PowerPoint PPT Presentation
How (Not) to Instantiate Ring-LWE Chris Peikert University of Michigan Security and Cryptography for Networks 1 September 2016 1 / 12 Conclusions 2 / 12 Conclusions 1 Prior insecure Ring-LWE instantiations turn out to use quite narrow error
SLIDE 2
SLIDE 3
Conclusions
1 Prior insecure Ring-LWE instantiations turn out to use quite narrow
error distributions that are incongruous to the ring geometry. This explains their vulnerability to attacks.
2 / 12
SLIDE 4
Conclusions
1 Prior insecure Ring-LWE instantiations turn out to use quite narrow
error distributions that are incongruous to the ring geometry. This explains their vulnerability to attacks.
2 ‘Peculiar’ aspects of the Ring-LWE definition and worst-case hardness
theorems—adopted for generality and tightness—also yield provable immunity to the attacks (and generalizations).
2 / 12
SLIDE 5
Conclusions
1 Prior insecure Ring-LWE instantiations turn out to use quite narrow
error distributions that are incongruous to the ring geometry. This explains their vulnerability to attacks.
2 ‘Peculiar’ aspects of the Ring-LWE definition and worst-case hardness
theorems—adopted for generality and tightness—also yield provable immunity to the attacks (and generalizations).
3 For Ring-LWE security, proper choice of error distribution is essential:
error should be ‘well spread’ relative to the ring and its small-norm ideals.
2 / 12
SLIDE 6
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually)
3 / 12
SLIDE 7
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 ≈ a1 , s mod q a2 ← Zn
q
, b2 ≈ a2 , s mod q . . .
3 / 12
SLIDE 8
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 = a1 , s + e1 ∈ Zq a2 ← Zn
q
, b2 = a2 , s + e2 ∈ Zq . . .
√n ≤ error ≪ q
3 / 12
SLIDE 9
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 = a1 , s + e1 ∈ Zq a2 ← Zn
q
, b2 = a2 , s + e2 ∈ Zq . . .
√n ≤ error ≪ q
◮ Decision: distinguish (ai , bi) from uniform (ai , bi)
3 / 12
SLIDE 10
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 = a1 , s + e1 ∈ Zq a2 ← Zn
q
, b2 = a2 , s + e2 ∈ Zq . . .
√n ≤ error ≪ q
◮ Decision: distinguish (ai , bi) from uniform (ai , bi)
LWE is Versatile and Hard (. . . maybe even for quantum!)
worst case lattice problems ≤
(quantum [R’05])
search-LWE ≤
[BFKL’93,R’05,. . . ]
decision-LWE ≤ much crypto
3 / 12
SLIDE 11
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 = a1 , s + e1 ∈ Zq a2 ← Zn
q
, b2 = a2 , s + e2 ∈ Zq . . .
√n ≤ error ≪ q
◮ Decision: distinguish (ai , bi) from uniform (ai , bi)
LWE is Versatile and Hard (. . . maybe even for quantum!)
worst case lattice problems ≤
(quantum [R’05])
search-LWE ≤
[BFKL’93,R’05,. . . ]
decision-LWE ≤ much crypto ◮ Also a classical reduction for search-LWE [P’09,BLPRS’13]
3 / 12
SLIDE 12
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 = a1 , s + e1 ∈ Zq a2 ← Zn
q
, b2 = a2 , s + e2 ∈ Zq . . .
√n ≤ error ≪ q
◮ Decision: distinguish (ai , bi) from uniform (ai , bi)
LWE is (sort of) Efficient
◮ Getting one pseudorandom Zq-scalar requires an n-dim inner product.
3 / 12
SLIDE 13
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 = a1 , s + e1 ∈ Zq a2 ← Zn
q
, b2 = a2 , s + e2 ∈ Zq . . .
√n ≤ error ≪ q
◮ Decision: distinguish (ai , bi) from uniform (ai , bi)
LWE is (sort of) Efficient
◮ Getting one pseudorandom Zq-scalar requires an n-dim inner product. ◮ Cryptosystems have large keys: Ω(n2 log2 q) bits.
3 / 12
SLIDE 14
Learning With Errors
[Regev’05]
◮ Parameters: dimension n, integer modulus q = poly(n) (usually) ◮ Search: find secret s ∈ Zn
q given many ‘noisy inner products’
a1 ← Zn
q
, b1 = a1 , s + e1 ∈ Zq a2 ← Zn
q
, b2 = a2 , s + e2 ∈ Zq . . .
√n ≤ error ≪ q
◮ Decision: distinguish (ai , bi) from uniform (ai , bi)
LWE is (sort of) Efficient
◮ Getting one pseudorandom Zq-scalar requires an n-dim inner product. ◮ Cryptosystems have large keys: Ω(n2 log2 q) bits. ◮ Inspired by NTRU [HPS’96], for efficiency we go to the ring setting. . .
3 / 12
SLIDE 15
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
4 / 12
SLIDE 16
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
◮ Error distribution χ over R
(usually Gaussian in ‘canonical’ geometry)
4 / 12
SLIDE 17
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
◮ Error distribution χ over R
(usually Gaussian in ‘canonical’ geometry)
◮ Modulus q ≥ 2 defining Rq := R/qR = Zq[X]/(f(X))
4 / 12
SLIDE 18
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
◮ Error distribution χ over R
(usually Gaussian in ‘canonical’ geometry)
◮ Modulus q ≥ 2 defining Rq := R/qR = Zq[X]/(f(X)) Search: find secret ring element s ∈ Rq, given independent samples a1 ← Rq , b1 = a1 · s + e1 ∈ Rq a2 ← Rq , b2 = a2 · s + e2 ∈ Rq (ei ← χ) . . .
4 / 12
SLIDE 19
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
◮ Error distribution χ over R
(usually Gaussian in ‘canonical’ geometry)
◮ Modulus q ≥ 2 defining Rq := R/qR = Zq[X]/(f(X)) Search: find secret ring element s ∈ Rq, given independent samples a1 ← Rq , b1 = a1 · s + e1 ∈ Rq a2 ← Rq , b2 = a2 · s + e2 ∈ Rq (ei ← χ) . . . Decision: distinguish (ai , bi) from uniform (ai , bi) ∈ Rq × Rq
4 / 12
SLIDE 20
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
◮ Error distribution χ over R∨
(usually Gaussian in ‘canonical’ geometry)
◮ Modulus q ≥ 2 defining Rq := R/qR = Zq[X]/(f(X)) Search: find secret ring element s ∈ R∨
q , given independent samples
a1 ← Rq , b1 = a1 · s + e1 ∈ R∨
q
a2 ← Rq , b2 = a2 · s + e2 ∈ R∨
q
(ei ← χ) . . . Decision: distinguish (ai , bi) from uniform (ai , bi) ∈ Rq × R∨
q
!!! [LPR’10] actually defines R-LWE using ‘dual’ ideal R∨ = t−1R.
4 / 12
SLIDE 21
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
◮ Error distribution χ over R∨
(usually Gaussian in ‘canonical’ geometry)
◮ Modulus q ≥ 2 defining Rq := R/qR = Zq[X]/(f(X)) Search: find secret ring element s ∈ R∨
q , given independent samples
a1 ← Rq , b1 = a1 · s + e1 ∈ R∨
q
a2 ← Rq , b2 = a2 · s + e2 ∈ R∨
q
(ei ← χ) . . . Decision: distinguish (ai , bi) from uniform (ai , bi) ∈ Rq × R∨
q
!!! [LPR’10] actually defines R-LWE using ‘dual’ ideal R∨ = t−1R. ‘(Non-)Dual’ forms are equivalent up to χ, via a ‘tweak:’ [AP’13]
4 / 12
SLIDE 22
Learning With Errors over Rings (Ring-LWE) [LPR’10]
◮ Ring R, often R = Z[X]/(f(X)) for irred. f of degree n
(or R = OK)
◮ Error distribution χ over R∨
(usually Gaussian in ‘canonical’ geometry)
◮ Modulus q ≥ 2 defining Rq := R/qR = Zq[X]/(f(X)) Search: find secret ring element s ∈ R∨
q , given independent samples
a1 ← Rq , b1 = a1 · s + e1 ∈ R∨
q
a2 ← Rq , b2 = a2 · s + e2 ∈ R∨
q
(ei ← χ) . . . Decision: distinguish (ai , bi) from uniform (ai , bi) ∈ Rq × R∨
q
!!! [LPR’10] actually defines R-LWE using ‘dual’ ideal R∨ = t−1R. ‘(Non-)Dual’ forms are equivalent up to χ, via a ‘tweak:’ [AP’13] b ↔ t · b induces s ↔ t · s, e ↔ t · e. Tweak may dramatically change width and shape of χ!
4 / 12
SLIDE 23
Ring-LWE Instantiations, Hard and Easy
◮ ‘Dual’ R-LWE with wide enough (near-)spherical error is hard: worst-case approx-SVP
- n ideal lattices in R
≤
(quantum, any R = OK)
search R-LWE ≤
(classical, any Galois R)
decision R-LWE
5 / 12
SLIDE 24
Ring-LWE Instantiations, Hard and Easy
◮ ‘Dual’ R-LWE with wide enough (near-)spherical error is hard: worst-case approx-SVP
- n ideal lattices in R
≤
(quantum, any R = OK)
search R-LWE ≤
(classical, any Galois R)
decision R-LWE ◮ But some other R-LWE instantiations are insecure:
5 / 12
SLIDE 25
Ring-LWE Instantiations, Hard and Easy
◮ ‘Dual’ R-LWE with wide enough (near-)spherical error is hard: worst-case approx-SVP
- n ideal lattices in R
≤
(quantum, any R = OK)
search R-LWE ≤
(classical, any Galois R)
decision R-LWE ◮ But some other R-LWE instantiations are insecure: [EHL’14] Solves decision-“Poly-LWE” for rings w/ certain properties
5 / 12
SLIDE 26
Ring-LWE Instantiations, Hard and Easy
◮ ‘Dual’ R-LWE with wide enough (near-)spherical error is hard: worst-case approx-SVP
- n ideal lattices in R
≤
(quantum, any R = OK)
search R-LWE ≤
(classical, any Galois R)
decision R-LWE ◮ But some other R-LWE instantiations are insecure: [EHL’14] Solves decision-“Poly-LWE” for rings w/ certain properties [ELOS’15] Solves decision for non-dual, spherical error in certain R = Z[X]/(Xn + aX + b)
5 / 12
SLIDE 27
Ring-LWE Instantiations, Hard and Easy
◮ ‘Dual’ R-LWE with wide enough (near-)spherical error is hard: worst-case approx-SVP
- n ideal lattices in R
≤
(quantum, any R = OK)
search R-LWE ≤
(classical, any Galois R)
decision R-LWE ◮ But some other R-LWE instantiations are insecure: [EHL’14] Solves decision-“Poly-LWE” for rings w/ certain properties [ELOS’15] Solves decision for non-dual, spherical error in certain R = Z[X]/(Xn + aX + b) [CIV’16] Solves search for [ELOS’15] instantiations, via errorless LWE
5 / 12
SLIDE 28
Ring-LWE Instantiations, Hard and Easy
◮ ‘Dual’ R-LWE with wide enough (near-)spherical error is hard: worst-case approx-SVP
- n ideal lattices in R
≤
(quantum, any R = OK)
search R-LWE ≤
(classical, any Galois R)
decision R-LWE ◮ But some other R-LWE instantiations are insecure: [EHL’14] Solves decision-“Poly-LWE” for rings w/ certain properties [ELOS’15] Solves decision for non-dual, spherical error in certain R = Z[X]/(Xn + aX + b) [CIV’16] Solves search for [ELOS’15] instantiations, via errorless LWE [CLS’15,’16] Solves search (via decision) for non-dual, spherical error in certain Galois fields.
(Not solvable via errorless LWE.)
5 / 12
SLIDE 29
What to Make of All This?
Glib answer: The insecure instantiations aren’t covered by the worst-case hardness theorems, so all bets are off.
6 / 12
SLIDE 30
What to Make of All This?
Glib answer: The insecure instantiations aren’t covered by the worst-case hardness theorems, so all bets are off. But in practice people often don’t use provably hard instantiations; e.g., narrower and/or non-Gaussian error.
6 / 12
SLIDE 31
What to Make of All This?
Glib answer: The insecure instantiations aren’t covered by the worst-case hardness theorems, so all bets are off. But in practice people often don’t use provably hard instantiations; e.g., narrower and/or non-Gaussian error. ◮ How “close” are the insecure instantiations to worst-case-hard ones,
- r those used in practice?
6 / 12
SLIDE 32
What to Make of All This?
Glib answer: The insecure instantiations aren’t covered by the worst-case hardness theorems, so all bets are off. But in practice people often don’t use provably hard instantiations; e.g., narrower and/or non-Gaussian error. ◮ How “close” are the insecure instantiations to worst-case-hard ones,
- r those used in practice?
◮ Are some kinds of rings inherently less secure for Ring-LWE?
6 / 12
SLIDE 33
What to Make of All This?
Glib answer: The insecure instantiations aren’t covered by the worst-case hardness theorems, so all bets are off. But in practice people often don’t use provably hard instantiations; e.g., narrower and/or non-Gaussian error. ◮ How “close” are the insecure instantiations to worst-case-hard ones,
- r those used in practice?
◮ Are some kinds of rings inherently less secure for Ring-LWE? ◮ How can we evaluate the security of Ring-LWE instantiations that aren’t supported by hardness theorems?
6 / 12
SLIDE 34
Contributions and Findings
1 A comprehensive review of prior attacks and insecure instantiations.
7 / 12
SLIDE 35
Contributions and Findings
1 A comprehensive review of prior attacks and insecure instantiations.
⋆ New, unified exposition in terms of short elements in dual ideals, and
formal analysis that explains prior experimental results.
7 / 12
SLIDE 36
Contributions and Findings
1 A comprehensive review of prior attacks and insecure instantiations.
⋆ New, unified exposition in terms of short elements in dual ideals, and
formal analysis that explains prior experimental results.
⋆ Insecurity is due to use of incongruous error distributions that are
insufficiently “well spread” relative to the ring and its ideals. In particular, error coeffs have Gaussian parameter ≈ 1 ≪ √n.
7 / 12
SLIDE 37
Contributions and Findings
1 A comprehensive review of prior attacks and insecure instantiations.
⋆ New, unified exposition in terms of short elements in dual ideals, and
formal analysis that explains prior experimental results.
⋆ Insecurity is due to use of incongruous error distributions that are
insufficiently “well spread” relative to the ring and its ideals. In particular, error coeffs have Gaussian parameter ≈ 1 ≪ √n.
2 On the positive side:
Theorem
Any instantiation supported by the “worst-case hardness of search” theorem [LPR’10] (or almost so) is immune to the above class of attacks.
7 / 12
SLIDE 38
Contributions and Findings
1 A comprehensive review of prior attacks and insecure instantiations.
⋆ New, unified exposition in terms of short elements in dual ideals, and
formal analysis that explains prior experimental results.
⋆ Insecurity is due to use of incongruous error distributions that are
insufficiently “well spread” relative to the ring and its ideals. In particular, error coeffs have Gaussian parameter ≈ 1 ≪ √n.
2 On the positive side:
Theorem
Any instantiation supported by the “worst-case hardness of search” theorem [LPR’10] (or almost so) is immune to the above class of attacks.
⋆ Theorem holds for any number ring, so the rings themselves are not the
source of weakness in the insecure instantiations.
7 / 12
SLIDE 39
Contributions and Findings
1 A comprehensive review of prior attacks and insecure instantiations.
⋆ New, unified exposition in terms of short elements in dual ideals, and
formal analysis that explains prior experimental results.
⋆ Insecurity is due to use of incongruous error distributions that are
insufficiently “well spread” relative to the ring and its ideals. In particular, error coeffs have Gaussian parameter ≈ 1 ≪ √n.
2 On the positive side:
Theorem
Any instantiation supported by the “worst-case hardness of search” theorem [LPR’10] (or almost so) is immune to the above class of attacks.
⋆ Theorem holds for any number ring, so the rings themselves are not the
source of weakness in the insecure instantiations.
⋆ Hard error distributions are much wider & differently shaped than the
insecure ones.
7 / 12
SLIDE 40
Attack Framework [EHL’14,. . . ]
To attack ‘non-dual’ decision:
1 Fix an ideal q|qR having small norm N(q) = |R/q| (possibly q = R).
8 / 12
SLIDE 41
Attack Framework [EHL’14,. . . ]
To attack ‘non-dual’ decision:
1 Fix an ideal q|qR having small norm N(q) = |R/q| (possibly q = R). 2 Given mod-qR samples (ai, bi), reduce modulo q:
(a′
i := ai mod q , b′ i := bi mod q)
8 / 12
SLIDE 42
Attack Framework [EHL’14,. . . ]
To attack ‘non-dual’ decision:
1 Fix an ideal q|qR having small norm N(q) = |R/q| (possibly q = R). 2 Given mod-qR samples (ai, bi), reduce modulo q:
(a′
i := ai mod q , b′ i := bi mod q) 3 For each s′ ∈ R/q, test if di := b′ i − a′ i · s′ mod q are non-uniform.
8 / 12
SLIDE 43
Attack Framework [EHL’14,. . . ]
To attack ‘non-dual’ decision:
1 Fix an ideal q|qR having small norm N(q) = |R/q| (possibly q = R). 2 Given mod-qR samples (ai, bi), reduce modulo q:
(a′
i := ai mod q , b′ i := bi mod q) 3 For each s′ ∈ R/q, test if di := b′ i − a′ i · s′ mod q are non-uniform.
Analysis: ◮ For R-LWE samples and s′ = s mod q, we have di = ei mod q.
8 / 12
SLIDE 44
Attack Framework [EHL’14,. . . ]
To attack ‘non-dual’ decision:
1 Fix an ideal q|qR having small norm N(q) = |R/q| (possibly q = R). 2 Given mod-qR samples (ai, bi), reduce modulo q:
(a′
i := ai mod q , b′ i := bi mod q) 3 For each s′ ∈ R/q, test if di := b′ i − a′ i · s′ mod q are non-uniform.
Analysis: ◮ For R-LWE samples and s′ = s mod q, we have di = ei mod q. ◮ For uniform samples, di is uniform.
8 / 12
SLIDE 45
Attack Framework [EHL’14,. . . ]
To attack ‘non-dual’ decision:
1 Fix an ideal q|qR having small norm N(q) = |R/q| (possibly q = R). 2 Given mod-qR samples (ai, bi), reduce modulo q:
(a′
i := ai mod q , b′ i := bi mod q) 3 For each s′ ∈ R/q, test if di := b′ i − a′ i · s′ mod q are non-uniform.
Analysis: ◮ For R-LWE samples and s′ = s mod q, we have di = ei mod q. ◮ For uniform samples, di is uniform. ◮ So attack succeeds iff χ mod q is detectably non-uniform.
8 / 12
SLIDE 46
Attack Framework [EHL’14,. . . ]
To attack ‘non-dual’ decision:
1 Fix an ideal q|qR having small norm N(q) = |R/q| (possibly q = R). 2 Given mod-qR samples (ai, bi), reduce modulo q:
(a′
i := ai mod q , b′ i := bi mod q) 3 For each s′ ∈ R/q, test if di := b′ i − a′ i · s′ mod q are non-uniform.
Analysis: ◮ For R-LWE samples and s′ = s mod q, we have di = ei mod q. ◮ For uniform samples, di is uniform. ◮ So attack succeeds iff χ mod q is detectably non-uniform. Prior works [EHL’14,ELOS’15,CLS’15,’16] use theory and computer search/experiments to find insecure instantiations. Some attacks are proven; many are only empirical.
8 / 12
SLIDE 47
Insecure Instantiations #1 [EHL’15,EHL’16]
◮ ‘Non-dual’ over R = Z[ζp, √ d], Gaussian error param r ≈ √pd. ‘Volume normalized’ param r0 ≈ d1/4 → ∞.
9 / 12
SLIDE 48
Insecure Instantiations #1 [EHL’15,EHL’16]
◮ ‘Non-dual’ over R = Z[ζp, √ d], Gaussian error param r ≈ √pd. ‘Volume normalized’ param r0 ≈ d1/4 → ∞.
Z[ √ d] (1, 1) ( √ d, − √ d)
9 / 12
SLIDE 49
Insecure Instantiations #1 [EHL’15,EHL’16]
◮ ‘Non-dual’ over R = Z[ζp, √ d], Gaussian error param r ≈ √pd. ‘Volume normalized’ param r0 ≈ d1/4 → ∞. ◮ R∨ has p − 1 elements of length 1/√pd, so error is narrow and non-uniform mod R: many coeffs have small param ≈ 1.
Z[ √ d] (1, 1) ( √ d, − √ d) Z[ √ d]∨ d0 d1
9 / 12
SLIDE 50
Insecure Instantiations #1 [EHL’15,EHL’16]
◮ ‘Non-dual’ over R = Z[ζp, √ d], Gaussian error param r ≈ √pd. ‘Volume normalized’ param r0 ≈ d1/4 → ∞. ◮ R∨ has p − 1 elements of length 1/√pd, so error is narrow and non-uniform mod R: many coeffs have small param ≈ 1. ◮ Similarly for error mod q ⊂ R (which is even sparser).
Z[ √ d] (1, 1) ( √ d, − √ d) Z[ √ d]∨ d0 d1
9 / 12
SLIDE 51
Insecure Instantiations #2
◮ Take R = Z[ζq] for prime modulus q; r ≈ √q. ‘Normalized’ r0 ≈ 1. σ(q) 1 ζ3
10 / 12
SLIDE 52
Insecure Instantiations #2
◮ Take R = Z[ζq] for prime modulus q; r ≈ √q. ‘Normalized’ r0 ≈ 1. ◮ Then q|qR where q = (1 − ζq)R, and N(q) = q. σ(q) 1 ζ3
10 / 12
SLIDE 53
Insecure Instantiations #2
◮ Take R = Z[ζq] for prime modulus q; r ≈ √q. ‘Normalized’ r0 ≈ 1. ◮ Then q|qR where q = (1 − ζq)R, and N(q) = q. ◮ q−1 ∈ q∨ = q−1R, has length ≈ 1/√q, so error is non-uniform mod q. σ(q) 1 ζ3
10 / 12
SLIDE 54
Insecure Instantiations #2
◮ Take R = Z[ζq] for prime modulus q; r ≈ √q. ‘Normalized’ r0 ≈ 1. ◮ Then q|qR where q = (1 − ζq)R, and N(q) = q. ◮ q−1 ∈ q∨ = q−1R, has length ≈ 1/√q, so error is non-uniform mod q. ◮ This formally substantiates empirical observations from [CLS’15]. σ(q) 1 ζ3
10 / 12
SLIDE 55
Invulnerability of Worst-Case-Hard Instantiations
◮ Recall that [LPR’10] defines ‘dual’ form: χ, s, bi are modulo qR∨.
11 / 12
SLIDE 56
Invulnerability of Worst-Case-Hard Instantiations
◮ Recall that [LPR’10] defines ‘dual’ form: χ, s, bi are modulo qR∨. ‘Worst-case hardness of search’ theorem applies to any R = OK, spherical error Dr where r ≫ 2.
11 / 12
SLIDE 57
Invulnerability of Worst-Case-Hard Instantiations
◮ Recall that [LPR’10] defines ‘dual’ form: χ, s, bi are modulo qR∨. ‘Worst-case hardness of search’ theorem applies to any R = OK, spherical error Dr where r ≫ 2. R = Z[ √ 11] R∨
11 / 12
SLIDE 58
Invulnerability of Worst-Case-Hard Instantiations
◮ Recall that [LPR’10] defines ‘dual’ form: χ, s, bi are modulo qR∨. ‘Worst-case hardness of search’ theorem applies to any R = OK, spherical error Dr where r ≫ 2. ◮ Analogue of attack on ‘non-dual’ decision is:
1 for each of the N(q) candidate s′ ∈ R∨/qR∨, 2 test for non-uniformity of bi − ai · s′ mod qR∨: should be Dr mod qR∨
R = Z[ √ 11] R∨ qR∨
11 / 12
SLIDE 59
Invulnerability of Worst-Case-Hard Instantiations
◮ Recall that [LPR’10] defines ‘dual’ form: χ, s, bi are modulo qR∨. ‘Worst-case hardness of search’ theorem applies to any R = OK, spherical error Dr where r ≫ 2. ◮ Analogue of attack on ‘non-dual’ decision is:
1 for each of the N(q) candidate s′ ∈ R∨/qR∨, 2 test for non-uniformity of bi − ai · s′ mod qR∨: should be Dr mod qR∨
Theorem
For N(q) ≤ 2n, reduced error Dr mod qR∨ is only 4−n-far from uniform.
11 / 12
SLIDE 60
Invulnerability of Worst-Case-Hard Instantiations
◮ Recall that [LPR’10] defines ‘dual’ form: χ, s, bi are modulo qR∨. ‘Worst-case hardness of search’ theorem applies to any R = OK, spherical error Dr where r ≫ 2. ◮ Analogue of attack on ‘non-dual’ decision is:
1 for each of the N(q) candidate s′ ∈ R∨/qR∨, 2 test for non-uniformity of bi − ai · s′ mod qR∨: should be Dr mod qR∨
Theorem
For N(q) ≤ 2n, reduced error Dr mod qR∨ is only 4−n-far from uniform.
Proof Idea
◮ Dual ideal of qR∨ is q−1, which has λ1(q−1) ≥ √n/2.
11 / 12
SLIDE 61
Invulnerability of Worst-Case-Hard Instantiations
◮ Recall that [LPR’10] defines ‘dual’ form: χ, s, bi are modulo qR∨. ‘Worst-case hardness of search’ theorem applies to any R = OK, spherical error Dr where r ≫ 2. ◮ Analogue of attack on ‘non-dual’ decision is:
1 for each of the N(q) candidate s′ ∈ R∨/qR∨, 2 test for non-uniformity of bi − ai · s′ mod qR∨: should be Dr mod qR∨
Theorem
For N(q) ≤ 2n, reduced error Dr mod qR∨ is only 4−n-far from uniform.
Proof Idea
◮ Dual ideal of qR∨ is q−1, which has λ1(q−1) ≥ √n/2. ◮ So ‘smoothing parameter’ of qR∨ is ≤ 2, so Dr mod qR∨ is uniform.
11 / 12
SLIDE 62
Conclusions and Parting Thoughts
◮ Choice of error distribution for Ring-LWE is subtler than for LWE: must account for geometry of ring and its ideals.
12 / 12
SLIDE 63
Conclusions and Parting Thoughts
◮ Choice of error distribution for Ring-LWE is subtler than for LWE: must account for geometry of ring and its ideals. ◮ Some attacks need qR to have small-norm divisors, but it seems prudent not to rely on (lack of) factorization for security. Can ‘ideal switching’ make factorization irrelevant?
12 / 12
SLIDE 64
Conclusions and Parting Thoughts
◮ Choice of error distribution for Ring-LWE is subtler than for LWE: must account for geometry of ring and its ideals. ◮ Some attacks need qR to have small-norm divisors, but it seems prudent not to rely on (lack of) factorization for security. Can ‘ideal switching’ make factorization irrelevant? ◮ Worst-case hardness theorems yield (nearly) minimal conditions for invulnerability to a new class of attacks.
12 / 12
SLIDE 65
Conclusions and Parting Thoughts
◮ Choice of error distribution for Ring-LWE is subtler than for LWE: must account for geometry of ring and its ideals. ◮ Some attacks need qR to have small-norm divisors, but it seems prudent not to rely on (lack of) factorization for security. Can ‘ideal switching’ make factorization irrelevant? ◮ Worst-case hardness theorems yield (nearly) minimal conditions for invulnerability to a new class of attacks.
Thanks!
http://eprint.iacr.org/2016/351
12 / 12