Lattice Reduction Attacks on HE Schemes. Martin R. Albrecht 15/03/2018

Transcription

1 Lattice Reduction Attacks on HE Schemes Martin R. Albrecht 15/03/2018

2 Learning with Errors The Learning with Errors (LWE) problem was defined by Oded Regev. 1 Given (A, c) with uniform A Z m n q, uniform s Z n q and small e Z m is c $ U(Z m q ) or c = n A s + e. 1 Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. In: 37th ACM STOC. ed. by Harold N. Gabow and Ronald Fagin. ACM Press, May 2005, pp

3 Introduction Where it all began... Martin R. Albrecht, Carlos Cid, Jean-Charles Faugère, and Ludovic Perret. Algebraic Algorithms for LWE. Cryptology eprint Archive, Report 2014/ We were writing a paper on using Gröbner bases for solving LWE instances. Ludovic Perret asked me to write the related work section. Our paper on using Gröbner bases for solving LWE still has not been published. I am still working on that related work section.

4 Related Work Primal Attack (primal_usvp, primal_decode) Solve Bounded Distance Decoding problem (BDD), i.e. find s s.t. w c is minimised, with w = A s using usvp embedding or Babai s nearest planes resp. enumeration. Dual Attack (dual, dual_scale) Solve Short Integer Solutions problem (SIS) in the left kernel of A, i.e. find a short w such that w A = 0 and check if w, c = w (A s + e) = w, e is short.

5 Bounded Distance Decoding and unique SVP Given A, c with c = A s + e, we know that for some s we have that A s c (mod q) is rather small. we know there is an unusually short vector in the q-ary lattice ( ) A T 0 B = c T Z (n+1) (m+1) q t since (s 1) B = (e t) mod q and use lattice reduction to find it.

6 Success Condition (ADPS16) log 2 ( ) GSA for b i Average for b i Expectation for π i (v) 2 d β index i

7 Don t treat block-wise lattice reduction as a black box Erdem Alkim, Léo Ducas, Thomas Pöppelmann, and Peter Schwabe. Post-quantum Key Exchange - A New Hope. In: 25th USENIX Security Symposium, USENIX Security 16. Ed. by Thorsten Holz and Stefan Savage. USENIX Association, 2016, pp url: https: // Martin R. Albrecht, Florian Göpfert, Fernando Virdia, and Thomas Wunderer. Revisiting the Expected Cost of Solving usvp and Applications to LWE. In: ASIACRYPT 2017, Part I. ed. by Tsuyoshi Takagi and Thomas Peyrin. Vol LNCS. Springer, Heidelberg, Dec. 2017, pp

8 Dual Attack Given samples A, c: 1. Find a short y solving SIS on A. 2. Compute y, c. Either c = A s + e or c uniformly random: If c is uniformly random, so is y, c. If c = A s + e, then y, c = y A, s + y, e y, e (mod q). If y is sufficiently short, then y, e will also be short, since e is also small.

9 Algorithm Sketch ε d exp( π(exp[y i ] α) 2 ); m 2 log(2 2 ε t)/ log(1 4 ε 2 d) ; P $ n n permutation matrices; [A 0 A 1] A P with A 0 Z m (n k) q ; L basis for {(y, x/c) Z m (1/c Z) n : y A 0 x mod q}; L BKZ-β reduced basis for L; for i 0 to m 1 do U $ a sparse unimodular matrix with small entries; L i U L ; L i BKZ-β reduced basis for L i ; (w i, v i ) shortest row vector in L i; e i w i, c ; end if e i follow discrete Gaussian distribution then return ; return ;

10 Opening Black Boxes Lattice reduction returns more than one somewhat short vector Inner products have algebraic meaning beyond returning somewhat short elements Martin R. Albrecht. On Dual Lattice Attacks Against Small-Secret LWE and Parameter Choices in HElib and SEAL. In: EUROCRYPT 2017, Part II. ed. by Jean-Sébastien Coron and Jesper Buus Nielsen. Vol LNCS. Springer, Heidelberg, May 2017, pp

11 Sources for future refinements There are more black boxes to be opened, e.g.: enumeration/sieving inside BKZ 2 BDD enumeration and small/sparse secrets Cost of lattice reduction not fully understood Note Estimates in standards document are quite conservative and price some of these anticipated improvements in. 2 Léo Ducas. Shortest Vector from Lattice Sieving: a Few Dimensions for Free. Cryptology eprint Archive, Report 2017/

12 Code = Research relied upon NIST PQC submissions and HE standard security document one man show about 300 commits, mostly by me quality control tests, documentation but no peer review bugs there have been bugs leading to false security estimates and plenty of potential for more: numerical stability, heuristics for pruning branches in a search tree,...

13 Fin Thank You