Solving LWE with BKW

Transcription

1 Martin R. Albrecht 1 Jean-Charles Faugére 2,3 1,4 Ludovic Perret 2,3 ISG, Royal Holloway, University of London INRIA CNRS IIS, Academia Sinica, Taipei, Taiwan PKC 2014, Buenos Aires, Argentina, 28th March 2014

2 with Small Secrets Contents 1 Introduction with Small Secrets A Heuristic Improvement 5

3 with Small Secrets Learning with Errors Definition (Learning with Errors) Let n 1, m > n, q modulus, χ be a probability distribution on Z q and s be a secret vector in Z n q. Let e $ χ m, A $ U(Z m n q ). We denote by L (n) s,χ the distribution on Z m n q Z m q produced as (A, As + e). Decision-LWE is the problem of deciding if (A, c) $ L (n) s,χ (i.e. c = As + e where e is small ) or (A, c) $ U(Z m n q Z m q )(i.e.c is sampled uniformly random).

4 with Small Secrets Learning with Errors Definition (Learning with Errors) Let n 1, m > n, q modulus, χ be a probability distribution on Z q and s be a secret vector in Z n q. Let e $ χ m, A $ U(Z m n q ). We denote by L (n) s,χ the distribution on Z m n q Z m q produced as (A, As + e). Decision-LWE is the problem of deciding if (A, c) $ L (n) s,χ (i.e. c = As + e where e is small ) or (A, c) $ U(Z m n q Z m q )(i.e.c is sampled uniformly random).

5 with Small Secrets Learning with Errors Definition (Learning with Errors) Let n 1, m > n, q modulus, χ be a probability distribution on Z q and s be a secret vector in Z n q. Let e $ χ m, A $ U(Z m n q ). We denote by L (n) s,χ the distribution on Z m n q Z m q produced as (A, As + e). Decision-LWE is the problem of deciding if (A, c) $ L (n) s,χ (i.e. c = As + e where e is small ) or (A, c) $ U(Z m n q Z m q )(i.e.c is sampled uniformly random).

6 with Small Secrets Small?? We represent elements in Z q as integers in [ q 2, q 2 ]. 0.1 By size we mean x for x Z q in this representation Typically, χ is a discrete Gaussian distribution over Z considered modulo q with small 0 standard deviation

7 with Small Secrets Small?? We represent elements in Z q as integers in [ q 2, q 2 ]. 0.1 By size we mean x for x Z q in this representation Typically, χ is a discrete Gaussian distribution over Z considered modulo q with small 0 standard deviation

8 with Small Secrets Learning with Errors with Matrices We can generalise this slightly. Given (A, C) withc Z m q, A Z m n q, S Z n q and E Z m q do we have n C = A S + E or C $ U(Z m q ).

9 with Small Secrets Applications Public-Key Encryption, Digital Signature Schemes Identity-based Encryption: encrypting to an identity ( address... ) instead of key Fully-homomorphic encryption: computing with encrypted data...

10 with Small Secrets Asymptotic Security Reduction of worst-case hard lattice problems such as Shortest Vector Problem (SVP) to average-case LWE. Z. Brakerski, A. Langlois, C. Peikert, O. Regev, and D. Stehlé. Classical hardness of Learning with Errors. In STOC 13, pages , New York, ACM. For cryptosystems we need the hardness of concrete instances: Given m, n, q and χ how many operations does it take to solve Decision-LWE?

11 with Small Secrets Asymptotic Security Reduction of worst-case hard lattice problems such as Shortest Vector Problem (SVP) to average-case LWE. Z. Brakerski, A. Langlois, C. Peikert, O. Regev, and D. Stehlé. Classical hardness of Learning with Errors. In STOC 13, pages , New York, ACM. For cryptosystems we need the hardness of concrete instances: Given m, n, q and χ how many operations does it take to solve Decision-LWE?

12 with Small Secrets Solving Strategies Given A, c with c = A s + e or c $ U(Z n q) solve the Bounded-Distance Decoding (BDD) problem in the primal lattice: Find s such that y c is minimised, for y = A s. Solve the Short-Integer-Solutions (SIS) problem in the scaled dual lattice. Find a short y such that y A =0andcheckif y, c = y (A s + e) =y, e is short. In this talk 1 we solve SIS 2 we use combinatorial techniques and 3 we put no bound on m.

13 with Small Secrets Solving Strategies Given A, c with c = A s + e or c $ U(Z n q) solve the Bounded-Distance Decoding (BDD) problem in the primal lattice: Find s such that y c is minimised, for y = A s. Solve the Short-Integer-Solutions (SIS) problem in the scaled dual lattice. Find a short y such that y A =0andcheckif y, c = y (A s + e) =y, e is short. In this talk 1 we solve SIS 2 we use combinatorial techniques and 3 we put no bound on m.

14 with Small Secrets Solving Strategies Given A, c with c = A s + e or c $ U(Z n q) solve the Bounded-Distance Decoding (BDD) problem in the primal lattice: Find s such that y c is minimised, for y = A s. Solve the Short-Integer-Solutions (SIS) problem in the scaled dual lattice. Find a short y such that y A =0andcheckif y, c = y (A s + e) =y, e is short. In this talk 1 we solve SIS 2 we use combinatorial techniques and 3 we put no bound on m.

15 with Small Secrets Contents 1 Introduction with Small Secrets A Heuristic Improvement 5

16 with Small Secrets Gaussian elimination I Assume there is no error, we hence want to decide whether there is a solution S such that C = A S. We may apply Gaussian elimination to the matrix: a 11 a a 1n c c 1 a 21 a a 2n c c 2 [A C] = a m1 a m2... a mn c m1... c m to recover a 11 a a 1n c c 1 0 ã ã 2n c c 2. [Ã C] = ã rn c r1... c r c m1... c m

17 with Small Secrets Gaussian elimination II If and only if c r+1,1,..., c m, are all zero, the system is consistent.

18 with Small Secrets Gaussian elimination III A C

19 with Small Secrets Gaussian elimination IV

20 with Small Secrets Gaussian elimination V

21 with Small Secrets Gaussian elimination VI zero?

22 with Small Secrets Contents 1 Introduction with Small Secrets A Heuristic Improvement 5

23 with Small Secrets BKW Algorithm I The BKW algorithm was first proposed for the Learning Parity with Noise (LPN) problem which can be viewed as a special case of LWE over Z 2. Avrim Blum, Adam Kalai, and Hal Wasserman. Noise-tolerant learning, the parity problem, and the statistical query model. J. ACM, 50(4): , 2003.

24 with Small Secrets BKW Algorithm II Goal in noise-free case: zero?

25 with Small Secrets BKW Algorithm III Goal over Z 2 (LPN): sparse?

26 with Small Secrets BKW Algorithm IV Goal over Z q (LWE): small?

27 with Small Secrets BKW Algorithm V We revisit Gaussian elimination: a 11 a 12 a 13 a 1n c 1 a 21 a 22 a 23 a 2n c a m1 a m2 a m3 a mn c m? = a 11 a 12 a 13 a 1n a 1, s + e 1 a 21 a 22 a 23 a 2n a 2, s + e a m1 a m2 a m3 a mn a m, s + e m

28 with Small Secrets BKW Algorithm VI a 11 a 12 a 13 a 1n a 1, s + e 1 0 ã 22 ã 23 ã 2n ã 2, s + e 2 a 21 a 11 e ã m2 ã m3 ã mn ã m, s + e m a m1 a 11 e 1 a i1 a 11 is essentially a random element in Z q,hence c i $ U(Z q ). Even if a i1 a 11 is 1 the variance of the noise doubles at every level because of the addition.

29 with Small Secrets BKW Algorithm VII The Problem and its Solution Problem: Noise of c ij values increases rapidly Strategy: exploit that we have many rows: m n.

30 with Small Secrets BKW Algorithm VIII We consider a log n blocks of b elements each. a 11 a 12 a 13 a 1n c 0 a 21 a 22 a 23 a 2n c a m1 a m2 a m3 a mn c m

31 with Small Secrets BKW Algorithm IX For each block we build a table of all q b possible values indexed by Z b q. q 2 q 2 t 13 t 1n c t,0 T 0 q 2 = q 2 +1 t 23 t 2n c t, q 2 q 2 t q 2 3 t q 2 n c t,q 2 For each z Z b q we try to find a row in A such that it contains z as a subvector at the target indices.

32 with Small Secrets BKW Algorithm X We use these tables to eliminate b entries in other rows. Assume (a 21, a 22 )=( q 2, q 2 + 1), then: + a 11 a 12 a 13 a 1n c 0 a 21 a 22 a 23 a 2n c a m1 a m2 a m3 a mn c m q 2 q 2 t 13 t 1n c t,0 q 2 q t 23 t 2n c t, q 2 q 2 t q 2 3 t q2 n c t,q 2 a 11 a 12 a 13 a 1n c ã 23 ã 2n c a m1 a m2 a m3 a mn c m

33 with Small Secrets BKW Algorithm XI T A C One addition and no multiplications for clearing b columns.

34 with Small Secrets BKW Algorithm XII This gives a memory requirement of and a time complexity of qb 2 a (n + 1) (a 2 n) qb 2. A detailed analysis of the algorithm for LWE is available as: Martin R. Albrecht, Carlos Cid, Jean-Charles Faugère, Robert Fitzpatrick and Ludovic Perret On the Complexity of the BKW Algorithm on LWE eprint Report 2012/636, to appear in Designs, Codes and Cryptography.

35 with Small Secrets BKW Algorithm XIII Problem: All treatments of BKW very slightly heuristic - we can lose perfect independence between processed samples. In general only a problem for small q - potential for problems if samples are inter-added. Inter-addition goes some way to resolving the memory requirements but concrete effects of losing independence not investigated.

36 Contents Introduction with Small Secrets A Heuristic Improvement 1 Introduction with Small Secrets A Heuristic Improvement 5

37 The Setting Introduction with Small Secrets A Heuristic Improvement Assume s $ U(Z n 2 ), i.e. all entries in secret s are very small. This is a common setting in cryptography for performance reasons and because this allows to realise some advanced schemes. In particular, a technique called modulus switching can be used to improve the performance of homomorphic encryption schemes. Zvika Brakerski and Vinod Vaikuntanathan. Efficient fully homomorphic encryption from (standard) LWE. In Rafail Ostrovsky, editor, IEEE 52nd Annual Symposium on Foundations of Computer Science, FOCS 2011, pages IEEE, 2011.

38 with Small Secrets Modulus Reduction I A Heuristic Improvement Given a sample (a, c) wherec = a, s + e and some p < q we may consider p p q a, q c with p q c = = = = p q a, s + pq e p p p q a, s + q a q a, s + pq e p p p q a, s + q a q a, s + p e ± [0, 0.5] q p q a, s + e.

39 with Small Secrets Modulus Reduction II A Heuristic Improvement Example p, q = 10, 20 a = (8, 2, 0, 4, 2, 7), s = (0, 1, 0, 0, 1, 1), a, s = 7, c = 6 p a = q a = (4, 1, 0, 2, 1, 4) a, s = 4, p q c = 4.

40 with Small Secrets Modulus Reduction III A Heuristic Improvement Typically, we would choose p q n Var(U([ 0.5, 0.5])) σ 2 s /σ = q n/12σ s /σ where σ s is the standard deviation of elements in s. If s is small then e is small and we may compute with the smaller precision p at the cost of a slight increase of the noise rate. The complexity hence drops to with a usually being unchanged. (a 2 n) pb 2

41 with Small Secrets Lazy Modulus Switching I A Heuristic Improvement For simplicity assume p =2 κ and consider the LWE matrix a 1,1 a 1,2... a 1,n c 1 a 2,1 a 2,2... a 2,n c 2 [A c] = a m,1 a m,2... a m,n c m as [A c] = a h 1,1 a l 1,1 a h 1,2 a l 1,2... a h 1,n a l 1,n c 1 a h 2,1 a l 2,1 a h 2,2 a l 2,2... a h 2,n a l 2,n c a h m,1 a l m,1 a h m,2 a l m,2... a h m,n a l m,n c m where a h i,j and a l i,j denote high and low order bits:

42 with Small Secrets Lazy Modulus Switching II A Heuristic Improvement a h i,j corresponds to p/q a i,j In order to clear the most significant bits in every component of the a i, we run the BKW algorithm on the matrix [A c] but only consider [A, c] h := a h 1,1 a h 1,2... a h 1,n c 1 a h 2,1 a h 2,2... a h 2,n c , a h m,1 a h m,2... a h m,n c m i.e. the higher order bits, when searching for collisions. We only manage elimination tables for the most significant κ bits. All arithmetic is performed in Z q but collisions are searched for in Z p.

43 with Small Secrets Lazy Modulus Switching III A Heuristic Improvement Example Let q, p = 16, 8 and let a =( 3, 2, 4) Z 3 q. Instead of searching for a vector v =(±3,, ) we ignore the least significant bit. Hence, both (±3,, ) and(±2,, ) will do. As a consequence we don t necessarily produce a vector (0,, ) after elimination, but one of (0,, ) or(1,, ), i.e. the first component is small.

44 with Small Secrets Lazy Modulus Switching IV A Heuristic Improvement Analogy An analogy would be linear algebra with floating point numbers, where we define a tolerance when a small number counts as zero. We don t check x == 0 but abs(x) < tolerance. The smaller p the bigger this tolerance.

45 with Small Secrets Lazy Modulus Switching V A Heuristic Improvement Difference with one-shot modulus reduction, i.e. rounding: We do not apply modulus reduction in one shot, but only when needed. We compute with high precision but compare with low precision. As a consequence rounding errors accumulate not as fast: they only start to accumulate when we branch on a component. We may reduce p by an additional factor of a/2.

46 with Small Secrets Complexity I A Heuristic Improvement BKW O 2 cn n log 2 2 n

47 with Small Secrets Complexity II A Heuristic Improvement BKW + naive modulus switching O 2 c+ log 2 d log 2 n n n log 2 2 n where 0 < d 1 is a small constant (so log d < 0).

48 with Small Secrets Complexity III A Heuristic Improvement BKW + lazy modulus switching O 2 c+ log 2 d 1 2 log 2 log 2 n log 2 n n n log 2 2 n where 0 < d 1 is a small constant.

49 Contents Introduction with Small Secrets A Heuristic Improvement 1 Introduction with Small Secrets A Heuristic Improvement 5

50 with Small Secrets The Problem I A Heuristic Improvement We use the entries in Table T 0 to make the first b components small. However, as the algorithm proceeds we add up vectors with those small first b components producing vectors where the first b components are not that small any more.

51 with Small Secrets The Problem II A Heuristic Improvement T 0 A C

52 with Small Secrets The Problem III A Heuristic Improvement T 0 A C

53 with Small Secrets The Problem IV A Heuristic Improvement T 1 A C

54 with Small Secrets The Problem V A Heuristic Improvement T 1 size increased A C

55 with Small Secrets The Problem VI A Heuristic Improvement Lemma Let n 1 be the dimension of the LWE secret vector, q be a modulus, b Z with 1 b n. Letalsoσ r be the standard deviation of uniformly random elements in Z q/p.assumingallsamplesareindependent,the components of ã = a a returned by B s,χ (b,, p) satisfy: and Var U(Z q ) for i/b >. Var(ã (i) )=2 i/b σ 2 r, for 0 i/b

56 with Small Secrets The Problem VII A Heuristic Improvement ã1... ã b ã b+1... ã 2b... ã ab b... ã n=ab c

57 with Small Secrets Unnatural Selection I A Heuristic Improvement T 1 pick vectors with this small A C

58 with Small Secrets Unnatural Selection II A Heuristic Improvement Finding vectors by chance with the first bi b components unusually small to populate T i is easier than finding vectors where the first i components are unusally small.

59 Impact I Introduction with Small Secrets A Heuristic Improvement We keep sampling and pick that candidate vector a for index z in T 1 where the first b components are unusually small. We need to establish how much we can expect the size to drop if we sample a given number of times.

60 Impact II Introduction with Small Secrets A Heuristic Improvement Assumption (Cowboy) Let the vectors x 0,...,x n 1 Z τ q be sampled from some distribution D such that σ 2 =Var(x i,(j) ) where D is any distribution on (sub-)vectors observable in our algorithm. Let x =min abs (x 0,...,x n 1 ) where min abs picks that vector x with b 1 j=0 x (j) minimal. The standard deviation σ n = Var(x (0) )= = Var(x (τ 1) ) of components in x satisfies σ/σ n c τ τ n +(1 c τ ) with c τ 1 1 τ

61 Impact III Introduction with Small Secrets A Heuristic Improvement τ =1 200 σ/σn observed data 0.41 x n

62 Impact IV Introduction with Small Secrets A Heuristic Improvement τ =2 15 σ/σn observed data 0.69 x n

63 Impact V Introduction with Small Secrets A Heuristic Improvement τ =3 6 σ/σn observed data n n

64 Impact VI Introduction with Small Secrets A Heuristic Improvement τ = σ/σn 1.05 observed data n n

65 with Small Secrets Contents 1 Introduction with Small Secrets A Heuristic Improvement 5

66 with Small Secrets BKW Variants I BKW +Mod.Switch n log Z 2 log mem log Z 2 log mem This Work (1) This Work (2) n log Z 2 log mem log Z 2 log mem Table : Cost for solving Decision-LWE with advantage 1 for BKW and BKZ variants where q and σ are chosen as in Regev s scheme and s $ U(Z n 2)

67 with Small Secrets BKW Variants II log Z 2 givesthenumberof bitoperations and logmem thememory requirement of Z q elements. All logarithms are base 2.

68 with Small Secrets BKW Variants III log 2 Z 2 for s $ U({0, 1}) n log 2 speedup wrt BKW BKW BKW w/ modulus switching this work w/o unnatural selection this work w/ unnatural selection log 2 n

69 with Small Secrets... and Previous Work I MITM guess the two halves of the secret and search for a collision BKZ solve SIS using the BKZ algorithm with log 2 T sec =1.8/ log 2 δ Yuanmi Chen and Phong Q. Nguyen. BKZ 2.0: better lattice security estimates. In Advances in Cryptology - ASIACRYPT 2011, volume 7073 of Lecture Notes in Computer Science, pages 1 20, Berlin, Heidelberg, Springer Verlag. Richard Lindner and Chris Peikert. Better key sizes (and attacks) for LWE-based encryption. In Topics in Cryptology CT-RSA 2011, volume 6558 of Lecture Notes in Computer Science, pages , Berlin, Heidelberg, New York, Springer Verlag.

70 with Small Secrets... and Previous Work II log 2 Z 2 for s $ U({0, 1}) n log 2 Z2(MITM)/ log 2 Z2(x) MITM BKZ w/ modulus switching BKZ 2.0 w/ modulus switching this work w/o unnatural selection this work w/ unnatural selection log 2 n

71 with Small Secrets... and Previous Work III log 2 Z 2 for s $ U({ 1, 0, 1}) n log 2 Z2(MITM)/ log 2 Z2(x) MITM BKZ w/ modulus switching BKZ 2.0 w/ modulus switching this work w/o unnatural selection this work w/ unnatural selection log 2 n

72 with Small Secrets Fun and Useful Problems 1 BKW (and the most effective lattice attacks) need more samples than what LWE-based cryptosystems offer. We can attempt to deal with this by forming new samples from old samples at the cost of increasing the noise slightly. However, this means our samples are not independent any more. What is the effect of this? 2 The main obstacle to running BKW in practice is its demand for memory. With modulus switching and unnatural selection we have a strategy to trade running time for memory to some extend. Can we find configurations where it becomes feasible to run BKW on instances other than very small toy instances?

73 with Small Secrets Conclusion Questions?