Practical Analysis of Key Recovery Attack against Search-LWE Problem

Transcription

1 Practical Analysis of Key Recovery Attack against Search-LWE Problem IMI Cryptography Seminar 28 th June, 2016 Speaker* : Momonari Kuo Grauate School of Mathematics, Kyushu University * This work is a jointe work with Junpei Yamaguchi an Yang Guo, an Masaya Yasua

2 Contents 1. Introuction

3 1-1. What is the lattice-base cryptography? The security of the lattice-base cryptography relies on the computationallyharness of problems [MG02]. (!) Such problems may be infeasible to solve even with quantum computers [MR09]. The lattice theory has many computationally-har problems such as - Shortest Vector Problem (SVP), - Closest Vector Problem (CVP), - Learning With Errors (LWE) problem, etc.. [MG02] D. Micciancio an S. Golwasser, Complexity of Lattice Problems: A Cryptographic Perspective, Kluwer (2002) [MR09] D. Micciancio an O. Regev, Lattice-base cryptography, In: Proce. of Post Quantum Cryptography (D. J. Bernstein, J. Buchmann, E. Dahmen es.), Springer, (2009)

4 1-2. Definition of lattice Definition (lattice an its basis). A lattice L R m is efine as a iscrete subgroup of R m. Every lattice L R m has a finite set B = {b 1,, b n } of orere vectors in L s.t. 1. b 1,, b n are linearly inepenent. 2. B generates L. Then B is sai to be a basis of L. m : the imension of L rank L n ; the rank of L

5 1-3. Closest Vector Problem Definition (Closest Vector Problem). Given: B = {b 1,, b n } ; a basis of a lattice L R m v R m ; a vector in R m ; a norm on R m (typically the Eucliean norm is chosen) CVP is to fin the closest lattice point u L to v w.r.t., b 1 b 2 v u

6 1-4. LWE-base cryptography LWE was propose by Regev [Reg05] in 2005, an it is - a problem to solve linear equations over a finite file, an - sai to be a computationally-har. Several encryption schemes via LWE have been publishe, [BCV12], [GGH15], etc. In orer to construct PQC (Post Quantum Cryptosystems), It is crucial to analyze the security of LWE. [Reg05] O. Regev, On lattices, learning with errors, ranom linear coes, an cryptography, STOC 2005, ACM, (2005) [BCV12] Z. Brakerski, C. Gentry an V. Vaikuntanathan, (Levele) fully homomorphic encryption without bootstrapping, ITCS 2012, ACM, (2012) [GGH15] C. Gentry, S. Gorbunov an S. Halevi, Graph-inuce multilinear maps from lattices, TCC 2015, Springer LNCS 9015, (2015)

7 1-5. Example of the (search-)lwe problem The (search-)lwe problem essentially means to solve linear congruences, e.g., 10s 1 s 2 + e 1 = 3 (mo 31) 7s 1 2s 2 + e 2 = 10 (mo 31) 3s 1 + s 2 + e 3 = 12 (mo 31) s 1 4s 2 + e 4 = 1 (mo 31) where s j 31, Z an in this case suppose e i {0, ±1}. Then fin (s 1, s 2 ) (or (e 1, e 2, e 3, e 4 ) ).

8 1-6. Definition of the LWE istribution Definition (LWE istribution). q : o prime, Z q q 2, q 2 Z, σ: the stanar eviation Given the parameters n, q, an σ, the LWE istribution is the istribution on M,n Z Z q by pairs (A, t) s.t. As + e = t (mo q), where M,n (Z) : the abelian group of all ( n) matrices over Z, A = a i,j i,j : each entry is uniformly chosen from Z q, s = s j j Z q n : fixe secret (column) vector, e = e i i Z : error vector chosen by the Gaussian ist. D σ,z with mean 0

9 1-7. Definition of the LWE problem Definition (LWE problem). Given n, q,, σ an A, t M,n Z Z q, Decision-LWE (problem): Decie whether A, t is sample from the LWE ist. efine by (n, q,, σ) or the uniform ist. on M,n Z Z q. Search-LWE (problem): If A, t is sample by the LWE ist., recover s Z q n. Our Stuy

10 1-8. Known attacks for LWE [APS15] 1. Lattice-base attack - Reuce the search-lwe to CVP 2. Combinatorial attack (Blum-Kalai-Wasserman s algorithm [BKW03]) - Apply the Gaussian elimination to obtain a sample with only one nonzero coorinate, an then execute brute-force 3. Algebraic attack (Arora-Ge s metho [AG11], [ACF14]) - Reuce the search-lwe to solving algebraic equations over a finite fiel (!) This talk is evote to the first type attack. [APS15] M. R. Albrecht, R. Player an S. Scott, On the concrete harness of learning with errors, J. Math. Cryptol. 9(3) (2015) [AG11] S. Arora an R. Ge, New algorithms for learning in presence of errors, In Automata, Languages an Programming, Springer LNCS 6755, (2011) [ACF14] M. A. Albrecht, C. Ci, J.-C. Faugere an L. Perret, Algebraic algorithms for LWE, IACR eprint 2014/1018 (2014) [BKW03] A. Blum, A. Kalai, an H. Wasserman, Noise-tolerant learning, the parity problem, an the statistical query moel, J. ACM, (2003)

11 1-9. Lattice-base attacks against search-lwe 1. Boune Distance Decoing (BDD) - Reuce the search-lwe to CVP - Solve CVP with [Ba86] or [LP11] (an enumeration algorithms) 2. Lattice reuction on the kernel (Dual lattice reuction strategy), [MR09] - Apply lattice reuction to the ual lattice, which is the kernel lattice erive from sample matrices - Solve CVP by the obtaine short vector 3. Embeing approach (Kannan s embeing technique), [Ka87] - An LWE instance is transforme from a CVP instance to a SVP instances [Ba86] On Lovász' lattice reuction an the nearest lattice point problem, Combinatorica 6, Issue 1, 1-13 (1986) [Ka87] R. Kannan, Minkowski s convex boy theorem an integer programming, Math. Oper. Res. 12, (1987) [LP11] R. Linner an C. Peikert, Better key sizes (an attacks) for LWE-base encryption, CT-RSA 2011, Springer, LNCS 6558, (2011) [LL15] K. Laine an K. Lauter, Key recovery for LWE in polynomial time, IACR eprint 2015/176 (2015) [MR09] D. Micciancio an O. Regev, Lattice-base cryptography, In: Proce. of Post Quantum Cryptography, Springer, (2009)

12 1-10. Summary on Lattice-base attacks against search-lwe Lattice-base attacks against search-lwe are schematize as follows: Attacks against Search-LWE (Our focus) Lattice-base attack (Our focus) BDD Lattice reuction + CVP algorithms - with CVP enumeration - without CVP enumeration Dual lattice reuction - with CVP enumeration - without CVP enumeration Embeing approach - with CVP enumeration - without CVP enumeration Combinatorial attack - BKW algorithm Algebraic attack - Arora-Ge s metho by solving algebraic equations Our stuy is concerne with BDD without enumeration.

13 1-11. Our aim of this stuy Our stuy is concerne with BDD without enumeration, which we call the key recovery attack in this talk. Our Motivation: Then, our aim of this stuy is to etermine which LWE instances (n, q,, σ) can be solve by the key recovery attack.

14 1-12. Summary of our contribution 1 Estimate effects of basis reuction to q-ary lattices, which are special lattices appearing in BDD. (!) the output quality of basis reuction for ranom lattices is ifferent from that for q-ary lattices in general. 2 Our estimation coincies with known experimental results of BDD attack against search-lwe. 3 With our estimation, one can etermine which LWE instances (n, q,, σ) can be solve by the key recovery attack.

15 Contents 1. Introuction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

16 2-1. Outline of the BDD metho (!) Assumption: t As + e mo q = As mo q + e It suffice to recover the vector As (mo q). Step 1. Construct a + n matrix A q : Λ q (A): the lattice in R generate by all the row vectors of A q. Note: rank Λ q (A) =, an As (mo q) Λ q (A) A q = Step 2. Execute a lattice basis reuction (e.g., LLL, bkz) to A q an obtain a goo basis matrix B of Λ q (A). Step 3. Solve CVP for inputs B an t to fin As (mo q). q q a 1,1 a,1 a 1,n a,n n

17 2-3. Detail on Step 2 Step 2. Execute a lattice basis reuction (e.g., LLL, bkz) to A q an obtain a goo basis matrix B of Λ q (A) A q Hermite normal form computation HNF of A q ; ( ) upper triangle matrix B Lattice basis reuction - The reuce basis matrix B has goo properties to solve CVP for inputs B an t.

18 2-4. Detail on Step 3 Step 3. Solve CVP for inputs B an t = As mo q + e to fin As (mo q). (CVP metho : Babai s nearest plane, Babai s rouning, etc.) We have the inequality [KGY16] ( ) u t 1 q2 q e for all u Λ q (A). Thus if q is sufficiently large, then As (mo q) is expecte to be etermine as the closest lattice point of Λ q (A) to t. [KGY16] M. Kuo, Y. Guo an M. Yasua, Comparison of Babai's nearst plane an rouning algorithms in Laine-Lauter's key recovery attack for LWE, In: Proce. of SCIS2016, 2D4-1 (2016)

19 2-5. Recent results on BDD Laine-Lauter s paper [LL15] analyzes BDD. Their paper gives - Information about the effective approximation factor in the LLL - that BDD is successful with overwhelming probability when q 2 O(n) - Experimental results implies the successive range of BDD (LLL + Babai s nearest plane) for search-lwe. In our analysis, we focus on the output quality of basis reuction for q-ary lattices appearing in BDD, an we give an explicit bounary to etermine which LWE instance (n, q,, σ) can be solve by BDD strategy (LLL or bkz + Babai s nearest plane). [LL15] K. Laine an K. Lauter, Key recovery for LWE in polynomial time, IACR eprint 2015/176 (2015)

20 Contents 1. Introuction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

21 3-1. BDD metho (Recall) (!) Assumption: t As + e mo q = As mo q + e Step 1. Construct a + n matrix A q : Λ q (A): the lattice in R generate by all the row vectors of A q. Note: rank Λ q (A) =, an As (mo q) Λ q (A) A q = q q a 1,1 a,1 a 1,n a,n n Step 2. Execute a lattice basis reuction (e.g., LLL, bkz) to A q an obtain a goo basis matrix B of Λ q (A). Step 3. Solve CVP for inputs B an t to fin As (mo q).

22 3-2. Babai nearest plane alg. in Step 3 Step 3. Solve CVP for inputs B an t to fin As (mo q). B : the LLL reuce basis of Λ q (A) obtaine in Step 2 b i : the i-th row vector of B (1 i ) Babai nearest plane alg. outputs a lattice point v Λ q (A) s.t. (i) v t < 2 /2 u t for all u Λ q (A), (ii) v t + P B t + i=1 x i b i 1 2 < x i 1 2, Moreover, (t + P B ) Λ q (A) = v, where b 1,, b : the Gram-Schmit orthogonalization of b 1,, b.

23 3-3. Successful case of Step 3 Babai nearest plane alg. outputs a lattice point v Λ q (A) s.t. (ii) v t + P B t + i=1 x i b i 1 2 < x i 1 2, Moreover, (t + P B ) Λ q (A) = v, Recall: BDD succees. i.e., the vector As (mo q) is recovere in Step 3 As (mo q) = v t + P(B ) As mo q t P(B ) e (error vector) (!) Assumption: t As + e mo q = As mo q + e

24 3-4. Our heuristic estimation Write e = i=1 e P(B ) y i 1 2 Heuristically, y i b i (! y i R) for all i e,b i ( e, b i = y i b i 2 ) e,b i b i 2 e b i b i 2 < 1 2 i b 2 = e b i i Since e σ, we estimate that Step 3 succees 2σ < b i i 2σ < min 1 i b i

25 3-5. q-ary lattice in Step 2 Investigate min 1 i min b 1 i i = We set c LLL b i min 1 i b i q n / 1 i min b i q n / 1 q n min b 1 i i c LLL vol Λ q (A) 1, an note here vol Λq (A) q n. By our experiments, we estimate that c LLL = at minimum, an c bkz20 = at minimum for q-ary lattices (cf. [GN08] estimates c LLL = on average for ranom lattices.) [GN08] N. Gama an P. Q. Nguyen, Preicting lattice reuction, In Avances in Cryptology-EUROCRYPT 2008, Springer LNCS 4965, (2008) 1

26 A piece of our experimental results (LLL) with Sage (ver. 6.8) Frequency istribution of the values c LLL 1 i min b i q n / in 100 LWE samples (take σ = 8/ 2π as in [LL15]): Case of n, r, = (80,50,255) Minimum: , Average: / for LLL-reuce bases b 1,, b Case of n, r, = (100,50,300) Minimum: , Average:

27 3-7. Estimation of successful range for BBD To summarize, we estimate that BDD with LLL + Babai nearest plane succees if an only if 2σ < min 1 i b i 2σ < c LLL q n / log 2 σ < log 2 c LLL + r( n) r > where r: = log 2 q. n With c LLL = , the inequality (#) gives a bounary to etermine which LWE instance (n, q,, σ) can be solve by BDD with LLL + Babai nearest plane. log 2 2σ log 2 c LLL (#) e.g., when n,, σ = (200, 505, 8 / 2π), BDD with LLL (resp. bkz-20) succees for r > 32 (resp. r > 22).

28 Bit-size of moulus parameter r 3-8. Successful range for BBD Laine-Lauter's experimental ata on a successful range by LLL Our estimation for LLL (c_lll=0.9775) Our estimation for BKZ-20 (c_bkz20=0.9863) Example parameters by Linner-Peikert Solvable by LLL+Babai s nearest metho Unsolvable by LLL+Babai s nearest metho Solvable by BKZ-20+Babai s nearest metho Unsolvable by BKZ-20+Babai s nearest metho 10 toy low meium 0 (same as AES-128) high Security parameter Note: In Linner-Peikert s LWE-base encryption [LP11], σ is taken as 8. In such cases, our estimation lines slightly move up. n

29 Contents 1. Introuction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

30 Conclusion The success of BDD for search-lwe eeply epens on the quality of the reuce basis for the q-ary lattice constructe from LWE samples. The output quality of basis reuction for ranom lattices is ifferent from that for q-ary lattices in general, which can be examine by our explicit inequality an experimental results. By our estimation an explicit inequality, one can investigate which the parameters (n, q,, σ) for search-lwe are solvable by BDD with LLL (or bkz-20) + Babai nearest plane algorithm.

31 A-1. Detail on Step 1 Step 1. Construct a + n matrix A q : Λ q (A): the lattice in R generate by all the row vectors of A q. Note: 1 rank Λ q (A) = an 2 As (mo q) Λ q (A) 1 2 A q = a 1,n a,n Since Z is a PID an Λ q (A) is a submoule of the free Z-moule Z, Λ q (A) is also free an rank Λ q (A) rank Z =. Consiering qe 1,, qe Z Λ q (A), we have rank Λ q (A). As mo q = n n i=1 a 1,i s i,., i=1 a,i s i mo q n = i=1 a 1,i s i + y 1 q,., n i=1 a,i s i + y q ( y i Z) = y 1 x y x + s 1 x s n x +n Λ q (A) where each x i enotes the i-th row vector of A q. q q a 1,1 a,1 n