On the complexity of the Arora-Ge Algorithm against LWE

Transcription

1 On the complexity of the Arora-Ge Algorithm against LWE Martin Albrecht, Carlos Cid, Jean-Charles Faugère, Robert Fitzpatrick, Ludovic Perret To cite this version: Martin Albrecht, Carlos Cid, Jean-Charles Faugère, Robert Fitzpatrick, Ludovic Perret. On the complexity of the Arora-Ge Algorithm against LWE. SCC 2012 Third international conference on Symbolic Computation and Cryptography, Jul 2012, Castro Urdiales, Spain. pp.93-99, 2012, < <hal > HAL Id: hal Submitted on 15 Jan 2013 HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

2 On the complexity of the Arora-Ge Algorithm against LWE Martin R. Albrecht, Carlos Cid, Jean-Charles Faugère, Robert Fitzpatrick, and Ludovic Perret Abstract Arora&Ge[5]recentlyshowedthatsolvingLWEcanbereducedtosolveahigh-degree non-linear system of equations. They used a linearization to solve the systems. We investigate here the possibility of using Gröbner bases to improve Arora& Ge approach. Introduction TheLearningWithErrors(LWE)ProblemwasintroducedbyRegevin[27,26]. Itisageneralisation for large primes of the well-known LPN(Learning Parity with Noise) problem. Since its introduction, LWE has become a source of many innovative cryptosystems, such as the oblivious transferprotocolbypeikertetal.[25],acryptosystembyakaviaetal.[1]thatissecureevenif almosttheentiresecretkeyisleaked,homomorphicencryption[21,10,4],etc...reasonsoflwe s success in cryptography include its simplicity as well as convincing theoretical arguments regarding its hardness, i.e. a reduction from(worst-case) assumed hard lattice problems to(average-case) LWE. The purpose of this paper is to investigate whether algebraic techniques(e.g.[16, 17, 18, 19, 3, 2,20])canbeusedinthecontextofLWE.ThisismotivatedbyarecentresultArora&Ge[5]who showed that solving LWE can be reduced to solve a high-degree non-linear system of equations. Learning With Errors WereproducebelowthedefinitionoftheLWEproblemfrom[27,26]. Definition1(LWE). Letn 1bethenumberofvariables,qbeanoddprimeinteger, χbea probabilitydistributionon Z q andsbeasecretvectorin Z n q. WedenotebyL s,χthe (n) probability distributionon Z n q Z qobtainedbychoosinga Z n q atrandom,choosinge Z qaccordingto χ, andreturning (a,c) = (a, a,s +e) Z n q Z q.lweistheproblemoffindings Z n qgivenpairs Z n q Z q sampledaccordingtol (n) s,χ. Themodulusqistypicallytakentobepolynomialinn,and χisthediscretegaussiandistributionon Z q withmean0andstandarddeviation σ = α q,forsome α. TodiscretizetheGaussian distribution N0,σ 2 moduloq,wesampleaccordingto N0,σ 2 androundtothenearestintegermod q.inwhatfollows, χ α,q willthendenotethisdiscretizeddistribution. Atypicalsettingforthestandarddeviation(std)is σ=n ε,with ε,0 ε 1.Forexample,[27] suggestsq n 2 and α=1/( n log 2 n).indeed,assoonas ε 1/2(worst-case)GAPSVP Õ(n/α) reducesto(average-case)lwe 1.Thus,anyalgorithmsolvingLWE(when ε 1/2)canbeusedfor GAPSVP Õ(n/α). We emphasize that it is widely believed that only exponential algorithm exists forsolvinggapsvp Õ(n/α). Recently, Arora& Ge[5] introduced a variant of LWE with structured errors. In this setting, you have given an oracle such that given LWE samples returns polynomials which vanish on the errors. 1 Thereductionisquantumifqispolynomialbutcanbemade[24]classicalifqissuperpolynomial. 93

3 94 WMC&SCC2012 They showed that the(discretized) Gaussian intrinsically induced a structure on the errors. This featurecanbeusedtoreducelwetotheproblemofsolvinganon-linearsystemofmultivariateof equations. Thetotalcomplexity(timeandspace)oftheirapproachis2Õ(n2ε). Itisthensubexponential when ε<1/2,butremainsexponentialwhen ε 1/2.ItisinterestingthatArora&Gereachwitha completely different approach the ε = 1/2 hardness limit advised by Regev[27, 26]. Note that an improvement on Arora&Ge could allow to challenge the subexponetiality of GAPSVP Õ(n/α). Remarkthat[5]useslinearizationtosolvethenon-linearsystem. Itisthen natural to investigate whether more advanced tools, such as Gröbner bases[11, 12, 13], could improve the algorithm of Arora&Ge. Inthisnote,wewillshowthatGröbnerbasescanbringapracticalimprovementonthecomplexityof[5].WealsobrieflydiscusswhetherGröbnerbasescan(orcannot)allowtochangethe complexity class of Arora&Ge. Before that, we need to recall some basic complexity results about Gröbner bases. Gröbner bases Complexity Results Gröbner basis is probably the main tool allowing to solve non-linear system of finite fields. From an algorithmic point of view, Lazard[22] showed that computing the Gröbner basis for a system of polynomialsisequivalenttoperformagaussianeliminationonthemacaulaymatrices[23]m acaulay d,m ford,1 d DforsomeintegerD.Moreover,themostefficientknownalgorithmssuchasF 5 [15] reduce Gröbner basis computations to a series of Gaussian eliminations on matrices of increasing sizes. Definition2(MacaulayMatrix[23]).Letf 1,...,f m Z q [x 1,...,x n ].TheMacaulaymatrixM acaulay d,m (f 1,...,f m ) of degree d is defined as follows: list horizontally all the degree d monomials from smallest to largest sorted by some fixed admissible monomial ordering. The smallest monomial comes last. Multiplyeachf i byallmonomialst i,j ofdegreed d i whered i =deg(f i ). Finally,constructthe coefficient matrix for the resulting system: M acaulay d,m (f 1,...,f m ):= (t 1,1,f 1 ) (t 1,2,f 1 ). (t m,1,f m ) (t m,2,f m ).. monomialsofdegree dsortedfor < Theorem3([22]). Letf =(f 1,...,f m ) (Z q [x 1,...,x n ]) m and <beamonomialordering.there existsapositiveintegerdforwhichgaussianeliminationonallm acaulay d,m = (f 1,...,f m )matrices ford,1 d DcomputesaGröbnerbasisof f 1,...,f m w.r.t.to <.ThedegreeDwillbecalled degreeofregularityoff 1,...,f m. Consequently, the complexity of computing a Gröbner basis is bounded by the complexity of performing Gaussian elimination on the Macaulay matrix in some degree D. Roughly, the complexityofcomputingagröbnerbasiswithanalgorithmbasedonthedegreeofregularity(suchas but notlimitedtoo Buchberger salgorithm,f 4,F 5 [15,11,12,14])is: (( ) n+d ω ) O, (1) D where2 ω<3isthelinearalgebraconstant,anddisthedegreeofsemi-regularityofthesystem. Ingeneral,computingthedegreeofregularityofasystemisadifficultproblem.However,itis knownforaspecificfamilyofpolynomialsystems[6,8,7,9].

4 On the complexity of the Arora-Ge Algorithm against LWE 95 Definition4(Semi-regularSequence[8]). Letm >n,andf 1,...,f m Z q [x 1,...,x n ]behomogeneouspolynomialsofdegreesd 1,...,d m respectivelyanditheidealgeneratedbythesepolynomials.thesystemissaidtobeasemi-regularsequenceifthehilbertseries[13]ofiw.r.t.thegrevlex order is: [ m H I (z)= i=1 (1 z d ] i) (1 z) n, (2) + where [S] + denotestheseriesobtainedbytruncatingsbeforetheindexofitsfirstnon-positive coefficient. Thus, the degree of regularity D involved in Theorem 3 for a semi-regular sequence is: Improving Arora-Ge Approach 1+deg(H I ). We briefly detail below the linearization approach of Arora-Ge. We then discuss whether Gröbner basescanbeusedinthiscontext. Basic Arora-Ge Algorithm A Linerization Approach The idea of[5] is to generate a non-linear noise-free system of equations from LWE samples. This is due to the following well-known feature of a Gaussian noise: Lemma5.LetC>0beaconstant.Itholdsthat: Pr[e $ χ α,q : e >C σ] e O( C2). As a consequence, elements sampled from a Gaussian distribution only takes values on a(small) subset [ C σ,...,c σ]of Z q withhighprobability. Fromnowon,wesett=C σ. Wecanreinterpret Lemma 5 algebraically by considering the polynomial: P(X)=X t i=1 (X+i)(X i). ClearlyPisofdegree2t+1 O(σ). Thus,ife $ χ α,q,thenp(e) =0withprobabilityatleast 1 e O( C2). Fori 1,let (a i, a i,s +e i )=(a i,b i ) Z n $ q Z q.ife i χ α,q,then P ( a i, a i,s b i ) =0, (3) withprobabilityatleast1 e O( C2). Asaconsequence,eachsample (a i, a i,s +e i ) = (a i,b i ) Z n q Z q allowstogenerateanon-linearequationofdegree2t+1inthencomponentsofthesecret s. TheideaofArora&Geisthentogeneratesufficientlymanyequationsasin(3)toperforma linearization.however,onehastochoosetheconstant denotedbyc AG occurringinlemma5 sufficientlybigsothatallerrorsgeneratedlieswithhighprobabilityin[ C AG σ,...,c AG σ] Z q, i.e.thesecretsisindeedacommonsolutionofthem AG equationsconstructedasin(3).tothisend, we set: p f = M AG e O(C2 AG ). Thisistheprobablythatthesecrets Z n qisnotsolutionofthesystems AG generatedfromm AG equationsasin(3),i.e.theprobabilityoffailureofarora-geapproach.letalsod AG =2C AG σ+1 bethedegreeoftheequationsoccuringins AG.Accordingto[5],takingC AG Õ(σ)allowstomake the probability of failure negligible. Tosummarize,Arora-GeapproachreducestolinearizeatsystemofM AG equationsofdegree D AG =2C AG σ+1 Õ(σ 2 ).Moreover,correctnessofthisapproachcanbeproven:

5 96 WMC&SCC2012 Theorem6.[5]LetD AG <q.thesystemobtainedbylinearizingm AG =O ( q log(q) ( n+d AG D AG ) σ )= n O(D AG) =2Õ(D AG) equationsasin(3)hasatmostonesolutionwithhighprobability. The time complexity of the basic Arora-Ge approach is then C plx AG =no(d AG) =2Õ(σ2) =2Õ(n2ε). Notealsothisalgorithmalsorequires2Õ(n2ε) LWEsamplesforperformingthelinearization. From Linerization to Gröbner Bases ThequestionwetrytoaddresshereiswhetherthecomplexityC plx AG canbeimprovedbyusing Gröbnerbasesinsteadoflinearization.TherationalisthatyoucandecreasetheconstantC AG (and sothedegreeoftheequations)toavaluesmallerthanõ(n 2 ε )byconsideringlessequations(whilst keepingtheprobabilityp f offailuresimilarinbotherapproaches).however,thecostofthesolving stepincreasesinceonehastocomputeagröbnerbasis. Thequestionisthentofind ifany a tradeoff allowing to improve upon linearization. Todoso,wewillconsideranumberofequationsoftheform θ M AG,with θ >1(θ=1isthe basic Arora-Ge). We want to keep the probability of failure similar for the linearization and Gröbner basisapproaches.asaconsequence,weneedtotakeaconstantc θ suchthat: p f = θ MAG e O(C2 θ ). AneasycalculationleadstoC θ Õ ( C θ AG ).Thus,decreasingthenumberofequationsfromM AG to θ MAG allowstodividetheconstantc AG byafactor θ.thedegreeoftheequationswearedoing toconsideristhenequalto2σ C θ +1 Õ ( σ 2 θ ). Thequestionisnowtofindagoodcandidatefor θ.typically,if θistoobigthenyouwillgreatly decrease the number of equations, but the cost of the solving step will become prohibitive and the total complexity will be worth than for a linearization. Wehaveconsideredaθoftheform: θ=n 2 β,forsome β 0(notethatwegetthebasicArora- Gebytaking β =0). Inthisnewsetting,wegetaconstantC β =n ε β. Wehavethentosolvea systemhavingm β = n2 β MAG 2Õ(n2(ε β)) equationsofdegreed β =Õ(n 2 ε β ). Wedenotesuch systembys GB (β). ThequestionistodeterminethecomplexityC plx GB AG (β)ofsolvings AG(β).Thisreducestostudy itsdegreeofregularityd β reg.givencurrentalgorithms,thespecificstructureofthesystemdoesnot allowtosolveitfasterthanrandomsystems.asaconsequence,weassumethatd β regisnotbigger thanthedegreeofregularityofasemi-regularsystemofthesamesize 2,namely: where: D β reg 1+deg(H β), H β (z)= [ ] (1 z D β) M β (1 z) n, + where [.] + denotestheseriesobtainedbytruncatingbeforetheindexofitsfirstnon-positivecoefficient. We present below some experiments performed for β = 1/5. We have computed explicitly the complexities for both approaches: linearization and Gröbner bases. As suggested in[27], 2 Wehaveperformedfewexperimentsforsmallparameters.Theexperimentsseemtoconfirmthishypothesis.

6 On the complexity of the Arora-Ge Algorithm against LWE 97 weconsideredq n 2 and α =1/( ( ) n log 2 n)weplottedbelowthespeed-upweobtained,i.e. C plx GB AG log (β) 2 (y-axis)forn,0 n WecanseethatGröbnerbasesallowtoimprove C plx AG the complexity of the basic Arora-Ge when n 5000(x-axis). Note that further experiments are requiredtoconfirmthisbehaviorwhenntendstoinfinity 3 However,theformofthespeed-upalsotendstosuggestthatweonlyimprovefromaconstantC plx AG. change the asymptotical behavior of the Arora&Ge approach. we mention that we are currently consideringseveralformsforthe β.inparticular, βwhichisnotaconstantbutafunctionofn.asa conclusion, we also emphasize that Arora-Ge needs exponential(or subexponetial) number of LWE samples. For most cryptosystems based on LWE, you have access to much less samples, typically polynomially-many. In this situation, you have then not enough samples to perform the linearization andtheonlyoptiontomountthearora&geapproachistosolvethesystembyusinggröbnerbases. References [1] A. Akavia, S. Goldwasser, and V. Vaikuntanathan. Simultaneous hardcore bits and cryptography against memory attacks. In O. Reingold, editor, TCC, volume 5444 of Lecture Notes in Computer Science, pages Springer Verlag, [2]M.R.AlbrechtandC.Cid.Coldbootkeyrecoverybysolvingpolynomialsystemswithnoise. In J. Lopez and G. Tsudik, editors, ACNS, volume 6715 of Lecture Notes in Computer Science, pages 57 72, [3] M. R. Albrecht and K. G. Paterson. Breaking an identity-based encryption scheme based on dhies. In L. Chen, editor, IMA Int. Conf., volume 7089 of Lecture Notes in Computer Science, pages Springer Verlag, [4] M. R. Albrecht, P. Farshim, J.-C. Faugère, and L. Perret. Polly Cracker, revisited. In Advances in Cryptology ASIACRYPT 2011, volume 7073 of Lecture Notes in Computer Science, pages , Berlin, Heidelberg, New York, Springer Verlag. full version available as Cryptology eprint Archive, Report 2011/289, Notethatthedegreeoftheequationsinvolvedbeinghuge,itbecomesrathercostlytojustexpandtheHilbertseriesfor the systems considered.

7 98 WMC&SCC2012 [5]S.AroraandR.Ge.Newalgorithmsforlearninginpresenceoferrors.InL.Aceto,M.Henzinger, and J. Sgall, editors, ICALP, volume 6755 of Lecture Notes in Computer Science, pages Springer Verlag, [6] M. Bardet. Étude des systèmes algébriques surdéterminés. Applications aux codes correcteurs et à la cryptographie. PhD thesis, Université de Paris VI, [7] M. Bardet, J.-C. Faugère, and B. Salvy. Complexity study of Gröbner basis computation. Technical report, INRIA, [8] M. Bardet, J.-C. Faugère, and B. Salvy. On the complexity of Gröbner basis computation of semi-regular overdetermined algebraic equations. In Proc. International Conference on Polynomial System Solving(ICPSS), pages 71 75, [9] M. Bardet, J.-C. Faugère, B. Salvy, and B.-Y. Yang. Asymptotic behaviour of the degree of regularity of semi-regular polynomial systems. In Proc. of MEGA 2005, Eighth International Symposium on Effective Methods in Algebraic Geometry, [10] Z. Brakerski and V. Vaikuntanathan. Efficient fully homomorphic encryption from(standard) LWE. In R. Ostrovsky, editor, IEEE 52nd Annual Symposium on Foundations of Computer Science, FOCS 2011, pages IEEE, [11] B. Buchberger. Ein Algorithmus zum Auffinden der Basiselemente des Restklassenringes nach einem nulldimensionalen Polynomideal. PhD thesis, University of Innsbruck, [12]B.Buchberger,G.E.Collins,R.G.K.Loos,andR.Albrecht.Computeralgebrasymbolicand algebraic computation. SIGSAM Bull., 16(4):5 5, [13] D. A. Cox, J. B. Little, and D. O Shea. Ideals, Varieties and Algorithms. Springer Verlag, [14] J.-C. Faugère. A new efficient algorithm for computing Gröbner bases(f4). Journal of Pure and Applied Algebra, 139:61 88, June [15] J.-C. Faugère. A new efficient algorithm for computing Gröbner bases without reduction to zero(f5). In T. Mora, editor, Proceedings of the 2002 International Symposium on Symbolic and Algebraic Computation ISSAC, pages ACM Press, July isbn: [16] J.-C. Faugère and A. Joux. Algebraic cryptanalysis of hidden field equation(hfe) cryptosystems using gröbner bases. In D. Boneh, editor, CRYPTO, volume 2729 of Lecture Notes in Computer Science, pages Springer Verlag, [17] J.-C. Faugère and L. Perret. Polynomial equivalence problems: Algorithmic and theoretical aspects. In S. Vaudenay, editor, Advances in Cryptology EUROCRYPT 2006, volume 4004 of Lecture Notes in Computer Science, pages Springer Verlag, [18] J.-C. Faugère, F. L. dit Vehel, and L. Perret. Cryptanalysis of minrank. In Wagner[28], pages [19] J.-C. Faugère, A. Otmani, L. Perret, and J.-P. Tillich. In Advances in Cryptology EURO- CRYPT 2010, volume 6110 of Lecture Notes in Computer Science, pages Springer Verlag, [20] J.-C. Faugère, L. Perret, C. Petit, and G. Renault. Improving the complexity of index calculus algorithms in elliptic curves over binary fields. In D. Pointcheval and T. Johansson, editors, Advances in Cryptology- EUROCRYPT 2012, volume 7237 of Lecture Notes in Computer Science, pages Springer Verlag, 2012.

8 On the complexity of the Arora-Ge Algorithm against LWE 99 [21] C. Gentry. A fully homomorphic encryption scheme. PhD thesis, Stanford University, Available at [22] D. Lazard. Gröbner-bases, Gaussian elimination and resolution of systems of algebraic equations. In Proceedings of the European Computer Algebra Conference on Computer Algebra, volume 162 of Lecture Notes in Computer Science, Berlin, Heidelberg, New York, Springer Verlag. [23] F. S. Macaulay. On some formula in elimination. London Mathematical Society, 1(33):3 27, [24] C. Peikert. Public-key cryptosystems from the worst-case shortest vector problem: extended abstract. In M. Mitzenmacher, editor, Proceedings of the 41st Annual ACM Symposium on Theory of Computing, STOC 2009, pages ACM, [25] C. Peikert, V. Vaikuntanathan, and B. Waters. A framework for efficient and composable oblivious transfer. In Wagner[28], pages [26] O. Regev. On lattices, learning with errors, random linear codes, and cryptography. In H. N. Gabow and R. Fagin, editors, STOC, pages ACM, [27] O. Regev. On lattices, learning with errors, random linear codes, and cryptography. J. ACM, 56(6), [28] D. Wagner, editor. Advances in Cryptology- CRYPTO 2008, 28th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 17-21, Proceedings, volume 5157 of Lecture Notes in Computer Science, Springer Verlag. M. R. Albrecht INRIA, LIP6, CNRS malb@lip6.fr C. Cid Royal Holloway, University of London carlos.cid@rhul.ac.uk J.-C. Faugère INRIA, LIP6, CNRS jean-charles.faugere@inria.fr R. Fitzpatrick Royal Holloway, University of London robert.fitzpatrick.2010@live.rhul.ac.uk L. Perret INRIA, LIP6, CNRS ludovic.perret@lip6.fr