SLIDE 1
Never trust a bunny
- D. J. Bernstein
Never trust a bunny D. J. Bernstein University of Illinois at - - PDF document
Never trust a bunny D. J. Bernstein University of Illinois at - - PDF document
Never trust a bunny D. J. Bernstein University of Illinois at Chicago Tanja Lange Technische Universiteit Eindhoven The HB( ) protocol (2001 HopperBlum) Secret s F 2 . Reader sends random F
SLIDE 2
SLIDE 3
The LPN(♥❀ ✜) problem Computational LPN problem: compute s given random ❘1; ❘1s + ❡1; random ❘2; ❘2s + ❡2; ✿ ✿ ✿ Equivalently: Compute s given random r1 ✷ F♥
2 ; r1 ✁ s + ❡1;
random r2 ✷ F♥
2 ; r2 ✁ s + ❡2; ✿ ✿ ✿
Solving computational LPN breaks HB and all of the
- ther protocols in this talk.
(Warning: “The LPN problem” is normally defined as a decisional problem.)
SLIDE 4
Breaking HB without solving LPN Attacker sends to the tag: ❈ = ✵ ❇ ❇ ❇ ❇ ❅ 1 0 0 ✿ ✿ ✿ 0 1 0 0 ✿ ✿ ✿ 0 1 0 0 ✿ ✿ ✿ 0 . . . . . . . . . ... . . . 1 0 0 ✿ ✿ ✿ 0 ✶ ❈ ❈ ❈ ❈ ❆ . Majority vote of tag response is very likely to be first bit of s. Repeat for other bits. Many subsequent HB variants try to resist active attacks.
SLIDE 5
MatrixLapin(♥❀ ✜❀ ✜ ✵) Secrets s❀ s✵ ✷ F♥
2 .
Reader sends random ❈ ✷ F♥✂♥
2
. (Improvement: restrict to “nice” subspace; same in next protocol.) Tag sends random invertible ❘ ✷ F♥✂♥
2
and ❚ = ❘(❈s + s✵) + ❡ where each bit of ❡ is set with probability ✜. Reader checks that ❘ is invertible and that ❚ ❘(❈s+s✵) has ✔ ✜ ✵♥ bits set.
SLIDE 6
Lapin(♥❀ ❢❀ ✜❀ ✜ ✵) where deg ❢ = ♥ (FSE 2012 Heyse–Kiltz– Lyubashevsky–Paar–Pietrzak) Secrets s❀ s✵ ✷ F2[①]❂❢. Reader sends random ❝ ✷ F2[①]❂❢. Tag sends random invertible r ✷ F2[①]❂❢ and t = r(❝s + s✵) + ❡ where each bit of ❡ is set with probability ✜. Reader checks that r is invertible and that t r(❝s + s✵) has ✔ ✜ ✵♥ bits set.
SLIDE 7
Ring-LPN(♥❀ ❢❀ ✜) Lapin ❝ and r correspond to matrices ❈ and ❘. Highly non-random matrices! Saves space and time but maybe risks attacks. Computational Ring-LPN problem (FSE 2012): compute s given random r1; r1s + ❡1; random r2; r2s + ❡2; ✿ ✿ ✿ Feed ❝ repeatedly to Lapin tag, solve Ring-LPN ✮ ❝s + s✵. Repeat with ❝✵ where ❝ ❝✵ is invertible, obtain s and s✵.
SLIDE 8
Lapin features FSE 2012 paper says:
- 1. Lapin has “comparable”
efficiency to AES.
SLIDE 9
Lapin features FSE 2012 paper says:
- 1. Lapin has “comparable”
efficiency to AES.
- 2. Lapin is “provably secure”.
SLIDE 10
Lapin features FSE 2012 paper says:
- 1. Lapin has “comparable”
efficiency to AES.
- 2. Lapin is “provably secure”.
- 3. Ring-LPN with irreducible ❢
is as hard to break as LPN “to the best of our knowledge”.
SLIDE 11
Lapin features FSE 2012 paper says:
- 1. Lapin has “comparable”
efficiency to AES.
- 2. Lapin is “provably secure”.
- 3. Ring-LPN with irreducible ❢
is as hard to break as LPN “to the best of our knowledge”.
- 4. LPN(512❀ 1❂8) “would require
277 memory (and thus at least thus much time) to solve when given access to approximately as many samples”.
SLIDE 12
Interlude [Hoowdinked clip #1]
SLIDE 13
2000 Blum–Kalai–Wasserman Standard attack on LPN. Main idea: If r1 and r2 have the same starting bits then r1 + r2 has starting bits 0 and t1 + t2 = (r1 + r2) ✁ s + (❡1 + ❡2). Repeat: clear more bits,
- btain (0❀ 0❀ ✿ ✿ ✿ ❀ 0❀ 1) as a
combination of 2❛ values r✐. Corresponding t combination is last bit of s with noise. Use many combinations to eliminate noise.
SLIDE 14
2006 Levieil–Fouque Same main idea, but clear fewer bits. Obtain (0❀ 0❀ ✿ ✿ ✿ ❀ 0❀ ✄❀ ✿ ✿ ✿ ❀ ✄) for every pattern of ✄❀ ✿ ✿ ✿ ❀ ✄. Enumerate each possibility for bits of s at ✄ positions. Use fast Walsh transform. Advantage: smaller noise. Need fewer queries, less memory, less computation. Source of “277 memory”.
SLIDE 15
2006 Levieil–Fouque Same main idea, but clear fewer bits. Obtain (0❀ 0❀ ✿ ✿ ✿ ❀ 0❀ ✄❀ ✿ ✿ ✿ ❀ ✄) for every pattern of ✄❀ ✿ ✿ ✿ ❀ ✄. Enumerate each possibility for bits of s at ✄ positions. Use fast Walsh transform. Advantage: smaller noise. Need fewer queries, less memory, less computation. Source of “277 memory”. Actually needs ✙ 282 bytes.
SLIDE 16
2011 Kirchner Assume matrix ❘1 is invertible. Compute ❘1
1
and ❘2❘1
1 (❘1s + ❡1) + ❘2s + ❡2,
❘3❘1
1 (❘1s + ❡1) + ❘3s + ❡3,
❘4❘1
1 (❘1s + ❡1) + ❘4s + ❡4, ✿ ✿ ✿
SLIDE 17
2011 Kirchner Assume matrix ❘1 is invertible. Compute ❘1
1
and ❘2❘1
1 (❘1s + ❡1) + ❘2s + ❡2,
❘3❘1
1 (❘1s + ❡1) + ❘3s + ❡3,
❘4❘1
1 (❘1s + ❡1) + ❘4s + ❡4, ✿ ✿ ✿
Obtain new LPN(♥❀ ✜) problem ❘✵
2; ❘✵ 2❡1 + ❡2;
❘✵
3; ❘✵ 3❡1 + ❡3;
❘✵
4; ❘✵ 4❡1 + ❡4; ✿ ✿ ✿
SLIDE 18
2011 Kirchner Assume matrix ❘1 is invertible. Compute ❘1
1
and ❘2❘1
1 (❘1s + ❡1) + ❘2s + ❡2,
❘3❘1
1 (❘1s + ❡1) + ❘3s + ❡3,
❘4❘1
1 (❘1s + ❡1) + ❘4s + ❡4, ✿ ✿ ✿
Obtain new LPN(♥❀ ✜) problem ❘✵
2; ❘✵ 2❡1 + ❡2;
❘✵
3; ❘✵ 3❡1 + ❡3;
❘✵
4; ❘✵ 4❡1 + ❡4; ✿ ✿ ✿
with sparse secret ❡1. Guess some bits of ❡1, cancel fewer bits; less noise to deal with.
SLIDE 19
Our attack on Lapin Main improvements in paper: ✎ Use the ring structure to save time in computations. ✎ Better guessing strategy. We break Ring-LPN(512❀ 1❂8) in ❁256 bytes of memory, ❁238 queries, and ❁298 bit operations.
SLIDE 20
Our attack on Lapin Main improvements in paper: ✎ Use the ring structure to save time in computations. ✎ Better guessing strategy. We break Ring-LPN(512❀ 1❂8) in ❁256 bytes of memory, ❁238 queries, and ❁298 bit operations. Many tradeoffs possible: e.g., ❁278 bytes of memory, ❁263 queries, and ❁288 bit operations.
SLIDE 21
What about LPN? Better guessing strategy also helps for LPN. We break LPN(1024❀ 1❂20) in ❁221 bytes of memory, ❁264 queries, and ❁2100 bit operations (or ❁293 for Ring-LPN). Also have a new trick to reduce # queries. LPN(1024❀ 1❂20): 10 queries!
SLIDE 22
Coda [Hoowdinked clip #2]
SLIDE 23