Practical Analysis of Key Recovery Attack against Search-LWE Problem

Transcription

1 Practical Analysis of Key Recovery Attack against Search-LWE Problem Royal Holloway an Kyushu University Workshop on Lattice-base cryptography 7 th September, 2016 Momonari Kuo Grauate School of Mathematics, Kyushu University

2 Self-Introuction Momonari Kuo m-kuo@math.kyushu-u.ac.jp PhD stuent of Grauate School of Mathematics, Kyushu University, Japan My special fiel of stuy is Computer Algebra ; - Computational Algebraic Geometry e.g., Grӧbner bases, Sheaf cohomology, Mouli of curves using MAGMA, MAPLE, SAGE, SINGULAR, etc. - Analysis of Algorithms an their Complexity Not limite to pure mathematics, but incluing applie mathematics e.g., analyze solvability an complexity of computational problems in cryptography

3 Contents 1. Introuction This talk is base on the paper Momonari Kuo, Junpei Yamaguchi, Yan Guo, Masaya Yasua, Practical Analysis of Key Recovery Attack against Search-LWE Problem, accepte by the referee-international conference The 11 th International Workshop on Security (IWSEC 2016), an it will be publishe.

4 1-1. Lattice-base cryptography The security of the lattice-base cryptography relies on the computationallyharness of problems [MG02] in the lattice theory. (!) Such problems may be infeasible to solve even with quantum computers [MR09]. The lattice theory has many computationally-har problems such as - Shortest Vector Problem (SVP), - Closest Vector Problem (CVP), - Learning With Errors problem (LWE), etc. [MG02] D. Micciancio an S. Golwasser, Complexity of Lattice Problems: A Cryptographic Perspective, Kluwer (2002) [MR09] D. Micciancio an O. Regev, Lattice-base cryptography, In: Proce. of Post Quantum Cryptography (D. J. Bernstein, J. Buchmann, E. Dahmen es.), Springer, (2009)

5 1-2. Definition of lattice Definition (lattice an its basis). A lattice L R m is efine as a iscrete subgroup of R m. Every lattice L R m has a finite set B = {b 1,, b n } of orere vectors in L s.t. 1. b 1,, b n are linearly inepenent over Z. 2. B generates L over Z. Then B is sai to be a basis of L. m : the imension of L R m rank L n ; the rank of L Note: rank(l) is invariant.

6 1-3. Closest Vector Problem Definition (Closest Vector Problem). Given : B = {b 1,, b n } ; a basis of a lattice L R m, v R m Span{b 1,, b n } with v L ; a norm on R m (typically the Eucliean norm) CVP is to fin the closest lattice point u L to v w.r.t., i.e., u v w v for all w L. b 1 b 2 v u

7 1-4. LWE-base cryptography LWE was propose by Regev [Reg05] in 2005, an it is - a problem to solve (non-homogeneous) linear equations over a finite file, an - sai to be a computationally-har problem. Several encryption schemes base on LWE have been publishe, e.g., [BCV12], [GGH15]. In orer to construct PQC (Post Quantum Cryptosystems), It is crucial to analyze the security of LWE. [Reg05] O. Regev, On lattices, learning with errors, ranom linear coes, an cryptography, STOC 2005, ACM, (2005) [BCV12] Z. Brakerski, C. Gentry an V. Vaikuntanathan, (Levele) fully homomorphic encryption without bootstrapping, ITCS 2012, ACM, (2012) [GGH15] C. Gentry, S. Gorbunov an S. Halevi, Graph-inuce multilinear maps from lattices, TCC 2015, Springer LNCS 9015, (2015)

8 1-5. Example of the (search-)lwe problem The (search-)lwe problem essentially means to solve linear congruences, (a precise efinition is given later) e.g., 10s 1 s 2 + e 1 = 3 (mo 31) 7s 1 2s 2 + e 2 = 10 (mo 31) 3s 1 + s 2 + e 3 = 12 (mo 31) s 1 4s 2 + e 4 = 1 (mo 31) where s j 31 2, 31 2 Z an in this case suppose e i {0, ±1}. Then fin (s 1, s 2 ) (or (e 1, e 2, e 3, e 4 ) ).

9 1-6. Definition of the LWE istribution Definition (LWE istribution). q : o prime, Z q q, q Z, σ: the stanar eviation, 2 2 Given n, q, an σ, the LWE istribution is the istribution on M,n Z Z q by pairs (A, t) s.t. As + e = t (mo q), i.e., a 1,1 s a 1,n s n + e 1 = t 1 a 2,1 s a 2,n s n + e 2 = t 2 a,1 s a,n s 2 + e = t (mo q) (mo q) (mo q) where M,n Z { n matrix over Z}, each entry of A = a i,j i,j is uniformly chosen from Z q, s = s j j Z q n : fixe secret (column) vector, e = e i i Z : error (or noise) vector chosen by the Gaussian ist. D σ,z

10 1-7. Definition of the LWE problem Definition (LWE problem). Given n, q,, σ an A, t M,n Z Z, Decision-LWE (problem) : Decie whether A, t is sample from the LWE istribution efine by (n, q,, σ) or the uniform istribution on M,n Z Z. Search-LWE (problem ): If A, t is sample by the LWE istribution, recover s Z q n. Our Stuy

11 1-8. Known attack for LWE At present, there are three kin of attacks for the search-lwe [APS15] : 1. Lattice-base attack - Reuce the search-lwe to CVP 2. Combinatorial attack (Blum-Kalai-Wasserman s algorithm [BKW03]) - Apply the Gaussian elimination to obtain a sample with only one nonzero coorinate, an then execute brute-force 3. Algebraic attack (Arora-Ge s metho [AG11], [ACF14]) - Reuce the search-lwe to solving algebraic equations over a finite fiel (!) This talk is evote to the first type attack. [APS15] M. R. Albrecht, R. Player an S. Scott, On the concrete harness of learning with errors, J. Math. Cryptol. 9(3) (2015) [AG11] S. Arora an R. Ge, New algorithms for learning in presence of errors, In Automata, Languages an Programming, Springer LNCS 6755, (2011) [ACF14] M. A. Albrecht, C. Ci, J.-C. Faugere an L. Perret, Algebraic algorithms for LWE, IACR eprint 2014/1018 (2014) [BKW03] A. Blum, A. Kalai, an H. Wasserman, Noise-tolerant learning, the parity problem, an the statistical query moel, J. ACM, (2003)

12 1-9. Lattice-base attacks against search-lwe At present, there are three well-known attacks for the search-lwe [APS15] : 1. Boune Distance Decoing (BDD) - Reuce the search-lwe to CVP - Solve CVP with [Ba86] or [LP11] an enumeration algorithms 2. Lattice reuction on the kernel (Dual lattice reuction strategy), [MR09] - Apply lattice reuction to the ual lattice, which is the kernel lattice erive from sample matrices - Solve CVP by the obtaine short vector 3. Embeing approach (Kannan s embeing technique), [Ka87] - An LWE instance is transforme from a CVP instance to a SVP instances [Ba86] On Lovász' lattice reuction an the nearest lattice point problem, Combinatorica 6, Issue 1, 1-13 (1986) [Ka87] R. Kannan, Minkowski s convex boy theorem an integer programming, Math. Oper. Res. 12, (1987) [LP11] R. Linner an C. Peikert, Better key sizes (an attacks) for LWE-base encryption, CT-RSA 2011, Springer, LNCS 6558, (2011) [LL15] K. Laine an K. Lauter, Key recovery for LWE in polynomial time, IACR eprint 2015/176 (2015) [MR09] D. Micciancio an O. Regev, Lattice-base cryptography, In: Proce. of Post Quantum Cryptography, Springer, (2009)

13 1-10. Summary on Lattice-base attacks against search-lwe Consiering that we can completely solve CVP with enumeration algorithms, lattice-base attacks against search-lwe are schematize as follows : Attacks against Search-LWE (Our focus) Lattice-base attack (Our focus) BDD Lattice reuction + CVP algorithms - with CVP enumeration - without CVP enumeration Dual lattice reuction - with CVP enumeration - without CVP enumeration Embeing approach - with CVP enumeration - without CVP enumeration Combinatorial attack - BKW algorithm Algebraic attack - Arora-Ge s metho by solving algebraic equations Our stuy is concerne with BDD without enumeration.

14 1-11. Our aim of this stuy Our stuy is concerne with BDD without enumeration, which we call the key recovery attack in this talk. Our Motivation: Determine which LWE instances (n, q,, σ) can be solve by the key recovery attack.

15 Contents 1. Introuction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

16 2-1. Outline of the BDD metho (!) Assumption : t As + e mo q = As mo q + e It suffices to recover the vector As (mo q). The concept of BDD : reuce the search-lwe to CVP. Step 1. Construct a + n matrix A q : L(A q ) : the lattice in R generate by all the row vectors of A q. Note : rank L A q =, an As (mo q) L(A q ) A q = q q a 1,1 a,1 a 1,n a,n n Step 2. Execute a lattice basis reuction (e.g., LLL, bkz) to A q an obtain a goo basis matrix B of L(A q ). Step 3. Solve CVP for inputs B an t to fin As (mo q). (CVP metho : Babai nearest plane, Babai rouning, etc.)

17 2-2. Detail on Step 1 Step 1. Construct a + n matrix A q : L(A q ) : the lattice in R generate by all the row vectors of A q. Note: 1 rank L A q = an 2 As (mo q) L(A q ) 1 2 Since Z is a PID an L A q is a submoule of the free Z-moule Z, L A q is also free an rank L(A q ) rank Z =. Consiering qe 1,, qe Z L(A q ), we have rank L(A q ). As mo q = n i=1 = n i=1 A q = a 1,i s i,., n i=1 a,i s i mo q n a,i s i + y q ( y i Z) a 1,i s i + y 1 q,., i=1 = y 1 x y x + s 1 x s n x +n L(A q ) where each x i enotes the i-th row vector of A q. q q a 1,1 a,1 a 1,n a,n n

18 2-3. Detail on Step 2 Step 2. Execute a lattice basis reuction (e.g., LLL, bkz) to A q an obtain a goo basis matrix B of L(A q ) A q B Lattice basis reuction - The reuce basis matrix B has goo properties to solve CVP for inputs B an t.

19 2-4. Detail on Step 3 Step 3. Solve CVP for inputs B an t = As mo q + e to fin As (mo q). (CVP metho : Babai nearest plane, Babai rouning etc.) We have the inequality [KGY16] ( ) u t 1 q2 q e for all u L(A q ). Thus q : sufficiently large As (mo q) : expecte to be the closest lattice point of L(A q ) to t. Remark: ( ) oes not give the lower limit. [KGY16] M. Kuo, Y. Guo an M. Yasua, Comparison of Babai's nearst plane an rouning algorithms in Laine-Lauter's key recovery attack for LWE, In: Proce. of SCIS2016, 2D4-1 (2016)

20 2-5. Recent results on BDD Laine-Lauter s papaer [LL15] has many experimental results on BDD that give information about the effective approximation factor in the LLL an implies which parameters n, q, for search-lwe are solvable by BDD. Our analysis is to etermine conitions which the reuce basis shoul satisfy, also guarantees their experimental results. Motivation Characteristic Lattice reuction in Step 2 LLL CVP metho in Step 3 Table 1. Difference between Laine-Lauter s analysis an ours [LL15] Ours Estimate which parameters for search-lwe are solvable by BDD Much ata about the effective approximation factor in the LLL Focus on the quality of the reuce basis LLL, bkz-20 Babai nearest plane

21 Contents 1. Introuction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

22 3-1. BDD metho (Recall) (!) Assumption : t As + e mo q = As mo q + e It suffices to recover the vector As (mo q). Step 1. Construct a + n matrix A q : L(A q ) : the lattice in R generate by all the row vectors of A q. Note : rank L A q =, an As (mo q) L(A q ) A q = Step 2. Execute a lattice basis reuction (e.g., LLL, bkz) to A q an obtain a goo basis matrix B of L(A q ). Step 3. Solve CVP for inputs B an t to fin As (mo q). (CVP metho : Babai nearest plane, Babai rouning, etc.) q q a 1,1 a,1 a 1,n a,n n

23 3-2. Babai nearest plane alg. in Step 3 Step 3. Solve CVP for inputs B an t to fin As (mo q). B : the LLL reuce basis of L(A q ) obtaine in Step 2 b i : the i-th row vector of B (1 i ) Babai nearest plane alg. outputs a lattice point v L(A q ) s.t. (i) v t < 2 /2 u t for all u L(A q ), (ii) v t + P B t + i=1 x i b i 1 2 < x i 1 2, Moreover, (t + P B ) L A q = v, where b 1,, b : Gram-Schmit orthogonalization basis of b 1,, b.

24 3-3. Successful case of Step 3 Step 3. Solve CVP for inputs B an t to fin As (mo q). B : the LLL reuce basis of L(A q ) obtaine in Step 2 b i : the i-th row vector of B (1 i ) Babai nearest plane alg. outputs a lattice point v L(A q ) s.t. (i) v t < 2 /2 u t for all u L(A q ), (ii) v t + P B t + i=1 x i b i 1 2 < x i 1 2, Moreover, (t + P B ) L A q = v, Recall: BDD succees. i.e., the vector As (mo q) is recovere in Step 3 As (mo q) = v t + P(B ) t As mo q P(B ) e (error vector)

25 3-4. Our heuristic estimation Write e = i=1 y i b i (! y i R) e P(B ) y i 1 2 for all i e,b i b 2 < 1 2 i ( e, b i = y i b i 2 ) for all i Heuristically, e,b i b i 2 e b i b 2 = e b i i Since e 2σ < b i σ, it is estimate that Step 3 succees if an only if for all i 2σ < min 1 i b i

26 3-5. q-ary lattice in Step 2 Investigate min 1 i min b 1 i i = We set c LLL b i min 1 i b i q n / 1 i min b i q n / 1 q n min 1 i b i c LLL vol L A q 1, an note here vol L Aq q n. 1 By our experiments, we estimate that c LLL = at minimum, an c bkz20 = at minimum for q-ary lattices (cf. [GN08] estimates c LLL = on average for ranom lattices.) [GN08] N. Gama an P. Q. Nguyen, Preicting lattice reuction, In Avances in Cryptology-EUROCRYPT 2008, Springer LNCS 4965, (2008)

27 A piece of our experimental results (LLL) Frequency istribution of the values c LLL in 100 LWE samples : 1 i min b i q n / 1 / for LLL-reuce bases b 1,, b Case of n, r, = (80,50,255) Minimum: , Average: Case of n, r, = (100,50,300) Minimum: , Average:

28 3-7. Estimation of successful range for BBD To summarize, we estimate that BDD with LLL + Babai nearest plane succees if an only if 2σ < min 1 i b i 2σ < c LLL q n / log 2 σ < log 2 c LLL + r( n) r > where r: = log 2 q. n With c LLL = , the inequality (#) gives a bounary to etermine which LWE instance (n, q,, σ) can be solve by BDD with LLL + Babai nearest plane. log 2 2σ log 2 c LLL (#) e.g., when n,, σ = (200, 505, 8 / 2π), BDD with LLL (resp. bkz-20) succees for r > 32 (resp. r > 22).

29 Contents 1. Introuction 2. Overview of Key Recovery Attack 3. Our analysis on Key Recovery Attack 4. Conclusion

30 Conclusion The success of BDD for search-lwe eeply epens on the quality of the reuce basis for the q-ary lattice constructe from LWE samples. By our estimation an explicit inequality, one can investigate which the parameters (n, q,, σ) for search-lwe are solvable by BDD with LLL (or bkz-20) + Babai nearest plane algorithm. However, we have not analyze the complexity yet, an the other reuctions an CVP methos can be aopte to BDD.