Algebraic algorithms for LWE problems

Abstract

Abstract. The Learning with Errors (LWE) problem, proposed by Regev in 2005, has become an ever-popular cryptographic primitive, due mainly to its simplicity, flexibility and convincing theoretical arguments regarding its hardness. Among the main proposed approaches to solving LWE instancesnamely, lattice algorithms, combinatorial algorithms, and algebraic algorithms -the last is the one that has received the least attention in the literature, and is the focus of this paper. We present a detailed and refined complexity analysis of the original Arora-Ge algorithm, which reduced LWE to solving a system of high-degree, error-free polynomials. Moreover, we generalise their method and establish the complexity of applying Gröbner basis techniques from computational commutative algebra to solving LWE. As a result, we show that the use of Gröbner basis algorithms yields an exponential speed-up over the basic Arora-Ge algorithm. On the other hand, our results show that such techniques do not yield a subexponential algorithm for the LWE problem. We also apply our algebraic algorithm to the BinaryError-LWE problem, which was recently introduced by Micciancio and Peikert. We show that BinaryError-LWE in dimension n can be solved in subexponential time given access to a quasi-linear number of samples m under a regularity assumption.We also give precise complexity bounds for BinaryError-LWE given access to linearly many samples. Our approach outperforms the best currently-known generic heuristic exact CVP solver as soon as m/n ≥ 6.6. The results in this work depend crucially on the assumption that the encountered systems have no special structure. We give experimental evidence that this assumption holds and also prove the assumption in some special cases. Therewith, we also make progress towards proving Fröberg's long-standing conjecture from algebraic geometry.

NTRU Prime: Reducing Attack Surface at Low Cost

“…The attack strategy of Ding [47], Arora-Ge [8], and Albrecht-Cid-Faugère-Fitzpatrick-Perret [4] takes subexponential time to break dimension-n LWE with noise width o( √ n), and polynomial time to break LWE with constant noise width. However, these attacks require many LWE samples, whereas typical cryptosystems such as NTRU and NTRU Prime provide far less data to the attacker.…”

“…Obviously these sizes are not competitive with 256-bit ECC key sizes, but they are small enough for many applications. 4 Streamlined NTRU Prime provides several implementation advantages and security-auditing advantages beyond the NTRU Prime choice of ring: for example, it eliminates the annoying possibility of "decryption failures" that appear in most lattice-based cryptosystems. Our security analysis indicates that Streamlined NTRU Prime 4591 761 actually provides a large security margin beyond our target security level, compensating for potential progress in estimating the actual cost of lattice attacks.…”

“…More precisely, [5] is an example of Product NTRU NTT, using the ring (Z/q)[x]/(x p + 1) with p = 1024 and q = 12289 = 12 · 1024 + 1. 4 For example, our ciphertexts fit into the 1500-byte Ethernet MTU for plaintexts up to a few hundred bytes, avoiding the implementation hassle of packet fragmentation. 5 If an operation takes 100000 cycles then one can imagine a typical quad-core 3GHz CPU completing 1 million operations in just 8 seconds.…”

The Asymptotic Complexity of Coded-BKW with Sieving Using Increasing Reduction Factors

“…The first type is the Arora-Ge algorithm, which was introduced in [6], and then improved in [7]. This type of algorithm is mostly applicable when the noise is too small for Regev's reduction proof to apply [2].…”

An Improved BKW Algorithm for LWE with Applications to Cryptography and Lattices

“…Arora and Ge describe a 2Õ (αq) 2 -time algorithm when q > n to solve the LWE problem [9]. This leads to a subexponential time algorithm when the error magnitude αq is less than √ n. The idea is to transform this system into a noise-free polynomial system and then use root finding algorithms for multivariate polynomials to solve it, using either relinearization in [9] or Gröbner basis in [3]. In this last work, Albrecht et al present an algorithm whose time complexity is 2 (ω+o(1))n log log log n 8 log log n Definition 3.…”