On error distributions in ring-based LWE

Transcription

1 On error distributions in ring-based LWE Wouter Castryck 1,2, Ilia Iliashenko 1, Frederik Vercauteren 1,3 1 COSIC, KU Leuven 2 Ghent University 3 Open Security Research ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 0/21

2 Motivation for LWE 1981 A basic concept of a quantum computer by Feynman 1994 Shor s algorithm Factorization and DLP are easy Broken: RSA, Diffie-Hellman, ECDLP etc. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 1/21

3 Motivation for LWE 1981 A basic concept of a quantum computer by Feynman 1994 Shor s algorithm Factorization and DLP are easy Broken: RSA, Diffie-Hellman, ECDLP etc First quantum logic gate by Monroe, Meekhof, King, Itano and Wineland Qubits Year ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 1/21

4 Motivation for LWE 2016 CNSA Suite and Quantum Computing FAQ by NSA Many experts predict a quantum computer capable of effectively breaking public key cryptography within a few decades, and therefore NSA believes it is important to address that concern. NIST report on post-quantum crypto We must begin now to prepare our information security systems to be able to resist quantum computing. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 2/21

5 Learning With Errors (LWE) The LWE problem (Regev, 05): solve a linear system with noise b 1 a 11 a a 1,n s 1 e 1 b 2. = a 21 a a 2,n s 2. + e 2. b m a m1 a m2... a m,n s n e m over a finite field F q for a secret (s 1, s 2,..., s n ) F n q where a modulus q = poly(n) the a ij F q are chosen uniformly randomly, an adversary can ask for new equations (m > n). ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 3/21

6 Learning With Errors (LWE) The LWE problem is easy when e i = 0. b 1 a 11 a a 1,n s 1 b 2. = a 21 a a 2,n s 2. b m a m1 a m2... a m,n s n Gaussian elimination solves the problem. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 4/21

7 Learning With Errors (LWE) The LWE problem is easy when e i = 0. b 1 a 11 a a 1,n s 1 b 2. = a 21 a a 2,n s 2. b m a m1 a m2... a m,n s n Gaussian elimination solves the problem. Otherwise, LWE might be hard. b 1 a 11 a a 1,n s 1 e 1 b 2. = a 21 a a 2,n s 2. + e 2. b m a m1 a m2... a m,n s n e m Gaussian elimination amplifies errors. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 4/21

8 Learning With Errors (LWE) The errors e i are sampled independently from a Gaussian with standard deviation σ > 2 n: n 0 n F p When viewed jointly, the error vector e 1. e m is sampled from a spherical Gaussian. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 5/21

9 Learning With Errors (LWE) LWE is tightly related to classical lattice problems. Bounded Distance Decoding (BDD) R m b A s + e Given b, find the closest point of the q-ary lattice {w Z m s Z n : w A s mod q} ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 6/21

10 Learning With Errors (LWE) LWE is tightly related to classical lattice problems. Shortest Vector Problem (SVP) R m Given a basis, find a shortest non-zero vector of the lattice. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 7/21

11 Learning With Errors (LWE) LWE is tightly related to classical lattice problems. Shortest Vector Problem (SVP) R m Given a basis, find a shortest non-zero vector of the lattice. LWE is at least as hard as worst-case SVP-type problems (Regev 05, Peikert 09). Not known to be broken by quantum computers. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 7/21

12 Learning With Errors (LWE) Known attacks for q = poly(n): Time Samples Trial and error 2 O(n log n) O(n) Blum, Kalai, Wasserman 03 2 O(n) 2 O(n) Arora, Ge 11 2 O(σ2 log n) 2 O(σ2 log n) ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 8/21

13 Learning With Errors (LWE) Known attacks for q = poly(n): Time Samples Trial and error 2 O(n log n) O(n) Blum, Kalai, Wasserman 03 2 O(n) 2 O(n) Arora, Ge 11 2 O(σ2 log n) 2 O(σ2 log n) Idea: if all errors (almost) certainly lie in { T,..., T }, then T (a 1 s 1 + a 2 s a n s n b + i) = 0. i= T View as linear system of equations in n 2T monomials. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 8/21

14 Learning With Errors (LWE) Known attacks for q = poly(n): Time Samples Trial and error 2 O(n log n) O(n) Blum, Kalai, Wasserman 03 2 O(n) 2 O(n) Arora, Ge 11 2 O(σ2 log n) 2 O(σ2 log n) Idea: if all errors (almost) certainly lie in { T,..., T }, then T (a 1 s 1 + a 2 s a n s n b + i) = 0. i= T View as linear system of equations in n 2T monomials. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 8/21

15 Learning With Errors (LWE) Application: public-key encryption of a bit (Regev 05). Private key: s F n q. Public key pair: (A, b = A s + e). ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 9/21

16 Learning With Errors (LWE) Application: public-key encryption of a bit (Regev 05). Private key: s F n q. Public key pair: (A, b = A s + e). Encrypt: pick random row vector r T {0, 1} m F m q. Output the pair { c T := r T rt b if the bit is 0, A and d := r T b + q/2 if the bit is 1. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 9/21

17 Learning With Errors (LWE) Application: public-key encryption of a bit (Regev 05). Private key: s F n q. Public key pair: (A, b = A s + e). Encrypt: pick random row vector r T {0, 1} m F m q. Output the pair { c T := r T rt b if the bit is 0, A and d := r T b + q/2 if the bit is 1. Decryption of pair c T, d: compute { d c T s = d r T A s = d r T b r T 0 if bit was 0, e q/2 if bit was 1. small enough ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 9/21

18 Learning With Errors (LWE) Features: Hardness reduction from classical lattice problems Linear operations simple and efficient implementation highly parallelizable Source of exciting applications FHE, attribute-based encryption for arbitrary access policies, general-purpose code obfuscation ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 10/21

19 Learning With Errors (LWE) Features: Hardness reduction from classical lattice problems Linear operations simple and efficient implementation highly parallelizable Source of exciting applications FHE, attribute-based encryption for arbitrary access policies, general-purpose code obfuscation Drawback: key size. To hide the secret one needs an entire linear system: b 1 a 11 a a 1,n s 1 e 1 b 2. = a 21 a a 2,n s 2. + e 2. b m a m1 a m2... a m,n s n e m m log p mn log p n log p ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 10/21

20 Ring-based LWE Identify vector space F n q with R q = Z[x]/(q, f (x)) for some irreducible monic f (x) Z[x] s.t. deg f = n, by viewing (s 1, s 2,..., s n ) as s 1 + s 2 x + + s n x n 1. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 11/21

21 Ring-based LWE Identify vector space F n q with R q = Z[x]/(q, f (x)) for some irreducible monic f (x) Z[x] s.t. deg f = n, by viewing (s 1, s 2,..., s n ) as s 1 + s 2 x + + s n x n 1. Use samples of the form b 1 s 1 e 1 b 2. = A s 2 a. + e 2. b n s n e n with A a the matrix of multiplication by some random a(x) = a 1 + a 2 x + + a n x n 1. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 11/21

22 Ring-based LWE Identify vector space F n q with R q = Z[x]/(q, f (x)) for some irreducible monic f (x) Z[x] s.t. deg f = n, by viewing (s 1, s 2,..., s n ) as s 1 + s 2 x + + s n x n 1. Use samples of the form b 1 s 1 e 1 b 2. = A s 2 a. + e 2. b n s n e n with A a the matrix of multiplication by some random a(x) = a 1 + a 2 x + + a n x n 1. Store a(x) rather than A a : saves factor n. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 11/21

23 Ring-based LWE Example: if f (x) = x n + 1, then A a is the anti-circulant matrix a 1 a n... a 3 a 2 a 2 a 1... a 4 a 3 a 3 a 2... a 5 a a n a n 1... a 2 a 1 of which it suffices to store the first column. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 12/21

24 Ring-based LWE Direct ring-based analogue of LWE-sample would read b 1 s 1 e 1 b 2. = A s 2 a. + e 2. b n s n e n with the e i sampled independently from N (0, σ) for some fixed small σ = σ(n). ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 13/21

25 Ring-based LWE Direct ring-based analogue of LWE-sample would read b 1 s 1 e 1 b 2. = A s 2 a. + e 2. b n s n e n with the e i sampled independently from N (0, σ) for some fixed small σ = σ(n). This is not Ring-LWE! ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 13/21

26 Ring-based LWE Direct ring-based analogue of LWE-sample would read b 1 s 1 e 1 b 2. = A s 2 a. + e 2. b n s n e n with the e i sampled independently from N (0, σ) for some fixed small σ = σ(n). This is not Ring-LWE! Not backed up by hardness statement. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 13/21

27 Ring-based LWE Direct ring-based analogue of LWE-sample would read b 1 s 1 e 1 b 2. = A s 2 a. + e 2. b n s n e n with the e i sampled independently from N (0, σ) for some fixed small σ = σ(n). This is not Ring-LWE! Not backed up by hardness statement. Sometimes called Poly-LWE. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 13/21

28 Ring-LWE So what is Ring-LWE according to [LPR10]? Samples look like b 1 s 1 e 1 b 2. = A s 2 a. + A f (x) B 1 e 2. b n s n e n ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 14/21

29 Ring-LWE So what is Ring-LWE according to [LPR10]? Samples look like where b 1 s 1 e 1 b 2. = A s 2 a. + A f (x) B 1 e 2. b n s n e n B is the canonical embedding matrix. A f (x) compensates for the fact that one actually picks secrets from the dual. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 14/21

30 Ring-LWE So what is Ring-LWE according to [LPR10]? Samples look like where b 1 s 1 e 1 b 2. = A s 2 a. + A f (x) B 1 e 2. b n s n e n B is the canonical embedding matrix. A f (x) compensates for the fact that one actually picks secrets from the dual. Hardness reduction from ideal lattice problems. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 14/21

31 Ring-LWE Note: factor A f (x) B 1 might skew the error distribution, A f (x) B 1 ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 15/21

32 Ring-LWE Note: factor A f (x) B 1 might skew the error distribution, A f (x) B 1 but also scales it! det Af (x) = with = disc f (x), could be huge det B 1 = 1/. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 15/21

33 Ring-LWE Note: factor A f (x) B 1 might skew the error distribution, A f (x) B 1 but also scales it! det Af (x) = with = disc f (x), could be huge det B 1 = 1/. So on average, each e i is scaled up by 1/n but remember: skewness. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 15/21

34 Scaled Canonical Gaussian ring-based LWE A f (x) is changed to a scalar λ b 1 s 1 e 1 b 2. = A s 2 a. + λ e 2 B 1.. b n s n e n The natural choice is λ = 1/n. So det A λ =. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 16/21

35 Scaled Canonical Gaussian ring-based LWE A f (x) is changed to a scalar λ b 1 s 1 e 1 b 2. = A s 2 a. + λ e 2 B 1.. b n s n e n The natural choice is λ = 1/n. So det A λ =. SCG-LWE = Ring-LWE for 2 m -cyclotomic fields: f (x) = 2 m 1 x 2m 1 1 = nx n 1, λ = 2 m 1 = n, So A f (x) = A x n 1 λ. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 16/21

36 Main result For SCG ring-based LWE with parameters: n = 2 l for some l N, a modulus q = poly(n), an error distribution with σ = poly(n), an underlying field K = Q( p 1, p 2,..., p l ), a square-free m = pi (2σ n log n) 2/ε for some ε > 0, i : p i 1 mod 4, so K = m n/2, a scaling parameter λ = λ/ K ε/n ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 17/21

37 Main result For SCG ring-based LWE with parameters: n = 2 l for some l N, a modulus q = poly(n), an error distribution with σ = poly(n), an underlying field K = Q( p 1, p 2,..., p l ), a square-free m = pi (2σ n log n) 2/ε for some ε > 0, i : p i 1 mod 4, so K = m n/2, a scaling parameter λ = λ/ K ε/n there exist an attack with Time: poly(n log(q)) Space: O(n) samples ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 17/21

38 Main result For SCG ring-based LWE with parameters: n = 2 l for some l N, a modulus q = poly(n), an error distribution with σ = poly(n), an underlying field K = Q( p 1, p 2,..., p l ), a square-free m = pi (2σ n log n) 2/ε for some ε > 0, i : p i 1 mod 4, so K = m n/2, a scaling parameter λ = λ/ K ε/n there exist an attack with Time: poly(n log(q)) Space: O(n) samples λ = λ/ K 1/2n appears in ELOS 15, CLS 15, CLS 16. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 17/21

39 Main result Tensor structure: K = K 1 Q K 2 Q Q K l, where K i = Q( p i ) The ring of integers R = R 1 Z R 2 Z Z R l, where Ri = Z[(1 + p i )/2] The dual R = 1 m R = R 1 Z R 2 Z Z R l ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 18/21

40 Main result Tensor structure: K = K 1 Q K 2 Q Q K l, where K i = Q( p i ) The ring of integers R = R 1 Z R 2 Z Z R l, where Ri = Z[(1 + p i )/2] The dual R = 1 m R = R 1 Z R 2 Z Z R l So λ B 1 is a Kronecker product of corresponding matrices in underlying quadratic fields K i ( ) 1+ pi 2 1+ p i ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 18/21

41 Main result Note ( 0 1 ) ( 1+ pi 2 1+ p i ) = ( 1 1 ) and through the Kronecker product ( ) λ B 1 = d {1, 1} n ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 19/21

42 Main result Note ( 0 1 ) ( 1+ pi 2 1+ p i ) = ( 1 1 ) and through the Kronecker product ( ) λ B 1 = d {1, 1} n Applying to an error term of b = A a s + λ B 1 e we have K ε/n d (e 1 e 2... e n ) T = ω. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 19/21

43 Main result ω is distributed by Gaussian with the standard deviation n σ K ε/n = n σ m ε 1 2 log n. Asymptotically P ( ω < 1 2) 1 as n. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 20/21

44 Main result ω is distributed by Gaussian with the standard deviation n σ K ε/n = n σ m ε 1 2 log n. Asymptotically P ( ω < 2) 1 1 as n. So a SCG-LWE sample b 1 s 1 e 1 b 2. = A s 2 a. + λ B 1 e 2. b n s n e n ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 20/21

45 Main result ω is distributed by Gaussian with the standard deviation n σ K ε/n = n σ m ε 1 2 log n. Asymptotically P ( ω < 1 2) 1 as n. So a SCG-LWE sample results in b n = the last row of A a, s + ω ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 20/21

46 Main result ω is distributed by Gaussian with the standard deviation n σ K ε/n = n σ m ε 1 2 log n. Asymptotically P ( ω < 1 2) 1 as n. So a SCG-LWE sample results in b n = the last row of A a, s + ω b n = the last row of A a, s ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 20/21

47 Main result ω is distributed by Gaussian with the standard deviation n σ K ε/n = n σ m ε 1 2 log n. Asymptotically P ( ω < 1 2) 1 as n. So a SCG-LWE sample results in b n = the last row of A a, s + ω b n = the last row of A a, s n exact equations reveal the secret vector s. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 20/21

48 Main result ω is distributed by Gaussian with the standard deviation n σ K ε/n = n σ m ε 1 2 log n. Asymptotically P ( ω < 1 2) 1 as n. So a SCG-LWE sample results in b n = the last row of A a, s + ω b n = the last row of A a, s n exact equations reveal the secret vector s. The attack works for the corresponding Ring-LWE problem with σ = σ ε/n. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 20/21

49 Conclusion No threat to the security proof of Ring-LWE. The standard deviation is far less than needed. σ = σ ε/n 1 2 n log n. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 21/21

50 Conclusion No threat to the security proof of Ring-LWE. The standard deviation is far less than needed. σ = σ ε/n 1 2 n log n. SCG-LWE can simplify Ring-LWE. Keep a scalar λ instead of f (x). ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 21/21

51 Conclusion No threat to the security proof of Ring-LWE. The standard deviation is far less than needed. σ = σ ε/n 1 2 n log n. SCG-LWE can simplify Ring-LWE. Keep a scalar λ instead of f (x). Inaccurate choice of a scalar leads to attacks. ELOS 15, CLS 15, CLS 16, unified overview in Peikert 16. ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 21/21

52 Conclusion No threat to the security proof of Ring-LWE. The standard deviation is far less than needed. σ = σ ε/n 1 2 n log n. SCG-LWE can simplify Ring-LWE. Keep a scalar λ instead of f (x). Inaccurate choice of a scalar leads to attacks. ELOS 15, CLS 15, CLS 16, unified overview in Peikert 16. Hardness proof for proper scalars? ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 21/21

53 Conclusion No threat to the security proof of Ring-LWE. The standard deviation is far less than needed. σ = σ ε/n 1 2 n log n. SCG-LWE can simplify Ring-LWE. Keep a scalar λ instead of f (x). Inaccurate choice of a scalar leads to attacks. ELOS 15, CLS 15, CLS 16, unified overview in Peikert 16. Hardness proof for proper scalars? Thank you for your attention! ANTS-XII, Kaiserslautern, August 29, 2016 On error distributions in ring-based LWE 21/21