A Refined Analysis of the Cost for Solving LWE via uSVP

Abstract

The learning with errors (LWE) problem (STOC'05) introduced by Regev is one of the fundamental problems in lattice-based cryptography. One standard strategy to solve the LWE problem is to reduce it to a unique SVP (uSVP) problem via Kannan's embedding and then apply a lattice reduction to solve the uSVP problem. There are two methods for estimating the cost for solving LWE via this strategy: the first method considers the largeness of the gap in the uSVP problem (Gama-Nguyen, Eurocrypt'08) and the second method (Alkim et al., USENIX'16) considers the shortness of the projection of the shortest vector to the Gram-Schmidt vectors. These two estimates have been investigated by Albrecht et al. (Asiacrypt'16) who present a sound analysis and show that the lattice reduction experiments fit more consistently with the second estimate. They also observe that in some cases the lattice reduction even behaves better than the second estimate perhaps due to the second intersection of the projected vector with the Gram-Schmidt vectors. In this work, we revisit the work of Alkim et al. and Albrecht et al. We first report further experiments providing more comparisons and suggest that the second estimate leads to a more accurate prediction in practice. We also present empirical evidence confirming the assumptions used in the second estimate. Furthermore, we examine the gaps in uSVP derived from the embedded lattice and explain why it is preferable to use µ = 1 for the embedded lattice. This shows there is a coherent relation between the second estimate and the gaps in uSVP. Finally, it has been conjectured by Albrecht et al. that the second intersection will not happen for large parameters. We will show that this is indeed the case: there is no second intersection as β → ∞.

LWE with Side Information: Attacks and Concrete Security Estimation

“…namely, c = σ χ according to the arithmetic-geometric mean inequality. Some prior works [3,5] instead chose c = 1. While this is benign since σ χ is typically not too far from 1, it remains a sub-optimal choice.…”

Survey on Fully Homomorphic Encryption, Theory, and Applications

“…After that, Albrecht, Göpfert, Virdia and Wunderer [161] compared these two estimates and verified experimentally the prediction of [160] when the error vector was sampled coefficient-wise from a discrete Gaussian distribution. In 2019, Bai, Miller and Wen [162] revisited the previous analysis of [160], [161], and provided experiments on estimating the cost of solving LWE via the uSVP suggesting that the 2016 estimate has higher accuracy than the 2008 estimate. In a recent work, Dachman-Soled, Ducas, Gong and Rossi [163] generalized the uSVP attack and proved that the predictions of [160], [161] are not accurate for small block sizes (i.e.…”

SALSA PICANTE: a machine learning attack on LWE with binary secrets

“…Concrete running times for actual successful attacks can be found in a few places in the literature, e.g. in [4,8,12,28], and we find those useful for comparison here. In particular, for dimensions n ≤ 200, we chose values of log q strictly smaller than those used in [12]; for dimensions n = 256, 300 and 350, we use much smaller values of log q than [28]: for instance, for n = 350, we use log q = 32, much smaller than the value log q = 52 in [28].…”