Practical Analysis of Key Recovery Attack against Search-LWE Problem

Transcription

1 Practical Analysis of Key Recovery Attack against Search-LWE Problem The 11 th International Workshop on Security, Sep. 13 th 2016 Momonari Kudo, Junpei Yamaguchi, Yang Guo and Masaya Yasuda 1 Graduate School of Mathematics, Kyushu University , 3 Institute of Mathematics for Industry 3 JST, CREST

2 Contents 1. Introduction

3 1-1. Cryptography and (Computational) Mathematics The security of a number of modern cryptosystems relies on computational hardness of mathematical problems. Modern cryptography is roughly divided into: - Lattice-based cryptography (this study) - Code-based cryptography - Multivariate cryptography

4 1-2. Definition of lattice Definition (lattice and its basis). Given linearly independent vectors b 1,, b n R m, the lattice L R m generated by B: = {b 1,, b n } is defined as a set of all integral linear combinations of b 1,, b n, that is, L n i=1 x i b i x i Z for all 1 i n B : a basis of L. m : the dimension of L R m rank L n ; the rank of L Note : rank(l) is invariant, and the quality of bases is important for solving computational problems. Example of 2-dimensional and 2-rank lattices b 1 b 2 u = 3b 1 + b 2

5 1-3. Lattice-based cryptography The security of the lattice-based cryptography relies on the computational hardness of problems [MG02] in the lattice theory, e.g., - Shortest Vector Problem (SVP), - Closest Vector Problem (CVP), - Learning With Errors problem (LWE), etc. Note : The quality of bases of lattices is very important for solving the above problems. [MG02] D. Micciancio and S. Goldwasser, Complexity of Lattice Problems: A Cryptographic Perspective, Kluwer (2002)

6 1-4. Closest Vector Problem (CVP) Definition (Closest Vector Problem). Given : B = {b 1,, b n } ; a basis of a lattice L R m, v R m Span{b 1,, b n } with v L ; a norm on R m (typically the Euclidean norm) CVP is to find the closest lattice point u L to v w.r.t., i.e., u v w v for all w L. b 1 b 2 v u

7 1-5. Learning With Errors (LWE) The learning with errors (LWE) was proposed by Regev [Reg05] in 2005, and it is - a problem to solve (non-homogeneous) linear equations over a finite filed, and - said to be a computational-hard problem. Several encryption schemes based on LWE have been published, e.g., [BCV12], [GGH15]. In order to construct more secure cryptosystems, it is crucial to analyze the security of LWE. [Reg05] O. Regev, On lattices, learning with errors, random linear codes, and cryptography, STOC 2005, ACM, (2005) [BCV12] Z. Brakerski, C. Gentry and V. Vaikuntanathan, (Leveled) fully homomorphic encryption without bootstrapping, ITCS 2012, ACM, (2012) [GGH15] C. Gentry, S. Gorbunov and S. Halevi, Graph-induced multilinear maps from lattices, TCC 2015, Springer LNCS 9015, (2015)

8 1-6. Example of the (search-)lwe problem The (search-)lwe problem essentially means to solve linear congruences, (a precise definition is given later) e.g., 10s 1 s 2 + e 1 = 3 (mod 31) 7s 1 2s 2 + e 2 = 10 (mod 31) 3s 1 + s 2 + e 3 = 12 (mod 31) s 1 4s 2 + e 4 = 1 (mod 31) where s j 31 2, 31 2 Z and in this case suppose e i {0, ±1}. Then find (s 1, s 2 ) (or (e 1, e 2, e 3, e 4 ) ).

9 1-7. Definition of the LWE distribution Definition (LWE distribution). q : odd prime, Z q q, q Z, σ : the standard deviation, 2 2 Given n, q, d and σ, the LWE distribution is the distribution on M d,n Z Z d q by pairs (A, t) s.t. As + e = t (mod q), i.e., a 1,1 s a 1,n s n + e 1 = t 1 a 2,1 s a 2,n s n + e 2 = t 2 a d,1 s a d,n s 2 + e d = t d (mod q) (mod q) (mod q) where M d,n Z { d n matrix over Z}, each entry of A = a i,j i,j is uniformly chosen from Z q, s = s j j Z q n : fixed secret (column) vector, e = e i i Z d : error (or noise) vector chosen by the Gaussian dist. D σ,z

10 1-8. Definition of the LWE problem Definition (LWE problem). Given n, q, d, σ and A, t M d,n Z Z q d, Decision-LWE (problem) : Decide whether A, t is sampled from the LWE distribution defined by (n, q, d, σ) or the uniform distribution on M d,n Z Z q d. Search-LWE (problem ): If A, t is sampled by the LWE distribution, recover s Z n q. This study

11 1-9. Our study and motivation Our study : Key recovery attack without enumeration for LWE Our Motivation : Determine which LWE instances (n, q, d, σ) can be solved by the key recovery attack without enumeration. Our Technical Point : Investigate the quality of bases of special lattices in LWE.

12 Contents 1. Introduction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

13 2-1. Known attack for LWE At present, there are three kind of attacks for the search-lwe [APS15] : 1. Lattice-based attack - Reduce the search-lwe to CVP 2. Combinatorial attack (Blum-Kalai-Wasserman s algorithm [BKW03]) - Apply the Gaussian elimination to obtain a sample with only one nonzero coordinate, and then execute brute-force 3. Algebraic attack (Arora-Ge s method [AG11], [ACF14]) - Reduce the search-lwe to solving algebraic equations over a finite field (!) This talk is devoted to the first type attack. [APS15] M. R. Albrecht, R. Player and S. Scott, On the concrete hardness of learning with errors, J. Math. Cryptol. 9(3) (2015) [AG11] S. Arora and R. Ge, New algorithms for learning in presence of errors, In Automata, Languages and Programming, Springer LNCS 6755, (2011) [ACF14] M. A. Albrecht, C. Cid, J.-C. Faugere and L. Perret, Algebraic algorithms for LWE, IACR eprint 2014/1018 (2014) [BKW03] A. Blum, A. Kalai, and H. Wasserman, Noise-tolerant learning, the parity problem, and the statistical query model, J. ACM, (2003)

14 2-2. Lattice-based attacks against search-lwe At present, there are three well-known attacks for the search-lwe [APS15] : 1. Bounded Distance Decoding (BDD), or Key Recovery Attack - Reduce the search-lwe to CVP - Solve CVP with [Ba86] or [LP11] and enumeration algorithms 2. Lattice reduction on the kernel (Dual lattice reduction strategy), [MR09] - Apply lattice reduction to the dual lattice, which is the kernel lattice derived from sampled matrices - Solve CVP by the obtained short vector 3. Embedding approach (Kannan s embedding technique), [Ka87] - An LWE instance is transformed from a CVP instance to a SVP instances [Ba86] On Lovász' lattice reduction and the nearest lattice point problem, Combinatorica 6, Issue 1, 1-13 (1986) [Ka87] R. Kannan, Minkowski s convex body theorem and integer programming, Math. Oper. Res. 12, (1987) [LP11] R. Lindner and C. Peikert, Better key sizes (and attacks) for LWE-based encryption, CT-RSA 2011, Springer, LNCS 6558, (2011) [LL15] K. Laine and K. Lauter, Key recovery for LWE in polynomial time, IACR eprint 2015/176 (2015) [MR09] D. Micciancio and O. Regev, Lattice-based cryptography, In: Proce. of Post Quantum Cryptography, Springer, (2009)

15 2-3. Summary on Lattice-based attacks against search-lwe Considering that we can completely solve CVP with enumeration algorithms, lattice-based attacks against search-lwe are schematized as follows : Attacks against Search-LWE (Our focus) Lattice-based attack (Our focus) BDD, or Key recovery attack Lattice reduction + CVP algorithms - with CVP enumeration - without CVP enumeration Dual lattice reduction - with CVP enumeration - without CVP enumeration Embedding approach - with CVP enumeration - without CVP enumeration Combinatorial attack - BKW algorithm Algebraic attack - Arora-Ge s method by solving algebraic equations Our study is concerned with Key recovery attack without enumeration.

16 2-4. Outline of the key recovery attack (!) Assumption : t As + e mod q = As mod q + e It suffices to recover the vector As (mod q). The concept of this attack : reduce the search-lwe to CVP. Step 1. Construct a d + n d matrix A q : L(A q ) : the (q-ary) lattice in R d generated by all the row vectors of A q. Note : rank L A q = d, and As (mod q) L(A q ) A q = d q q a 1,1 a d,1 a 1,n a d,n d n Step 2. Execute a lattice basis reduction (e.g., LLL, bkz) to A q and obtain a good basis matrix B of L(A q ). Step 3. Solve CVP for inputs B and t to find As (mod q). (CVP method : Babai nearest plane, Babai rounding, etc.)

17 2-5. Detail on Step 2 : lattice basis reduction Step 2. Execute a lattice basis reduction (e.g., LLL, bkz) to A q and obtain a good basis matrix B of the q-ary lattice L(A q ) A q B Lattice basis reduction (LLL, bkz) - For a given basis of a lattice, lattice basis reduction computes another basis of the lattice. - The reduced basis matrix B has good properties to solve CVP for inputs B and t. - L(A q ) is a special lattice, called q-ary, and it has different properties from usual (or random) lattices.

18 2-6. Recent works on the key recovery attack Laine-Lauter s papar [LL15] has many experimental results on this attack that give information about the effective approximation factor in the LLL and implies which parameters n, q, d for search-lwe are solvable. Our analysis is to determine conditions which the reduced basis should satisfy, also guarantees their experimental results. Motivation Characteristic Lattice reduction in Step 2 LLL CVP method in Step 3 Table 1. Difference between Laine-Lauter s analysis and ours [LL15] Ours Estimate which parameters for search-lwe are solvable by BDD Much data about the effective approximation factor in the LLL Focus on the quality of the reduced bases of q-ary lattices LLL, bkz-20 Babai nearest plane

19 Contents 1. Introduction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

20 3-1. Babai nearest plane alg. in Step 3 Step 3. Solve CVP for inputs B and t to find As (mod q). B : the LLL reduced basis of L(A q ) obtained in Step 2 b i : the i-th row vector of B (1 i d) Babai nearest plane alg. outputs a lattice point v L(A q ) s.t. (i) v t < 2 d/2 u t for all u L(A q ), (ii) v t + P B d t + i=1 x i b i 1 2 < x i 1 2, Moreover, (t + P B ) L A q = v, where b 1,, b d : Gram-Schmidt orthogonalization basis of b 1,, b d.

21 3-2. Successful case of Step 3 Step 3. Solve CVP for inputs B and t to find As (mod q). B : the LLL reduced basis of L(A q ) obtained in Step 2 b i : the i-th row vector of B (1 i d) Babai nearest plane alg. outputs a lattice point v L(A q ) s.t. (i) v t < 2 d/2 u t for all u L(A q ), (ii) v t + P B d t + i=1 x i b i 1 2 < x i 1 2, Moreover, (t + P B ) L A q = v, Recall : The vector As (mod q) is recovered in Step 3 As (mod q) = v t + P(B ) t As mod q P(B ) e (error vector)

22 3-3. Our heuristic estimation d Write e = i=1 y i b i (! y i R) e P(B ) y i 1 2 for all i e,b i b 2 < 1 2 i ( e, b i = y i b i 2 ) for all i Heuristically, e,b i b i 2 e b i d b 2 = e d b i i Since e 2σ < b i σ d, it is estimated that Step 3 succeeds if and only if for all i 2σ < min 1 i d b i

23 3-4. q-ary lattice in Step 2 Investigate min 1 i d b i = Set c LLL 1 i d min b i q d n /d min 1 i d b i q d n /d q-ary lattices obtained from LWE samples. 1 d d q d n d 1 d, and experimentally investigate the values clll for By our experiments, we estimate that c LLL = at minimum, and c bkz20 = at minimum for q-ary lattices cf. By some calculations with experimental results in [GN08], we expected c LLL = on average for random lattices. [GN08] N. Gama and P. Q. Nguyen, Predicting lattice reduction, In Advances in Cryptology-EUROCRYPT 2008, Springer LNCS 4965, (2008)

24 A piece of our experimental results (LLL) Frequency distribution of the values c LLL of q-ary lattices in 100 LWE samples : Case of n, r, d = (80,50,255) Minimum: , Average: i d min b i q d n /d /d for LLL-reduced bases b 1,, b d Case of n, r, d = (100,50,300) Minimum: , Average: cf. c LLL = on average for random lattices.

25 3-6. Estimation of successful range We estimated that the key recovery attack with LLL + Babai nearest plane succeeds if and only if 2σ < min 1 i d b i 2σ < c LLL d q d n /d log 2 σ < d log 2 c LLL + r(d n) r > where r: = log 2 q. d d n With c LLL = , the inequality (#) gives a boundary to determine which LWE instance (n, q, d, σ) can be solved by the attack with LLL + Babai nearest plane. d log 2 2σ d log 2 c LLL (#) e.g., when n, d, σ = (200, 505, 8 / 2π), the attack with LLL (resp. bkz-20) succeeds for r > 32 (resp. r > 22).

26 Bit-size of modulus parameter r 3-7. Boundary of successful range Laine-Lauter's experimental data on a successful range by LLL Our estimation for LLL (c_lll=0.9775) Our estimation for BKZ-20 (c_bkz20=0.9863) Example parameters by Lindner-Peikert Solvable by LLL+Babai s nearest method Unsolvable by LLL+Babai s nearest method Solvable by BKZ-20+Babai s nearest method Unsolvable by BKZ-20+Babai s nearest method 10 medium toy low high (same as AES-128) Security parameter Our estimation allows one to investigate which the parameters (n, q, d, σ) for search-lwe are solvable by the attack. (Note that our estimation coincides with Laine-Lauter s experimental data on the attack ageinst their concrete LWE-samples) n

27 Contents 1. Introduction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

28 Conclusion The key recovery attack is a lattice-based attack against the LWE problem, which is one of computational-hard problems for constructing more secure cryptosystems. The success of the key recovery attack for search-lwe deeply depends on the quality of the reduced basis for the q-ary lattice constructed from LWE samples. By our estimation and explicit inequality, one can investigate which the parameters (n, q, d, σ) for search-lwe are solvable by the attack with LLL (or bkz-20) + Babai nearest plane algorithm.