Analysis of Error Dependencies on Newhope

Song, Minki; Lee, Seung Hwan; Shin, Dong Joon; Lee, Eunsang; Kim, Young Sik; No, Jong Seon

doi:10.1109/access.2020.2977607

Cited by 5 publications

(9 citation statements)

References 17 publications

(26 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the standardization process of PQC initialized by NIST, the target DFR at code rate 1/4 is 2 −128 . We targeted a more conservative benchmark DFR = 2 −140 as was used in [15,18]. Similar to NewHope, which employs a central binomial distribution with parameter k to approximate the discrete Gaussian distribution (The variance of central binomial distribution is k/2, and the variance of a discrete Gaussian distribution is r 2 .…”

Section: Results: Decoding Performance Analysismentioning

confidence: 99%

“…Therefore it almost preserves the communication overhead. In addition, the proposed polar coding scheme was designed to address the additive residue noise after decryption rather than the compression noise, and we did not improve the bandwidth efficiency compared to an improvement of 5.9% and 12.8% in [18] and [15], respectively.…”

Section: Complexity and Communication Overheadmentioning

confidence: 92%

“…In Table 1, we illustrate to what extent the security of RLWE-based PKE was improved for n = 1024, q = 12,289 compared to NewHope Round 2 if different error-correcting codes and schemes are employed. As in [15,18], a conservative target DFR was selected to be 2 −140 . The concrete security analysis of RLWEbased PKE, so far, has been based on the hardness of LWE [22].…”

Section: Security Improvementmentioning

confidence: 99%

“…Song et al interpreted NewHope as a digital communication system in [18]. At the transmitter's end, binary message m ∈ {0, 1} 256 is encoded as a codeword enc(m) by repeating m n/256 times.…”

Section: Introduction 1error-correcting For Ring-lwe-based Public Key Encryptionmentioning

confidence: 99%

“…To analyze the DFR, one needs to take into account two types of dependencies in the noise term: (a) the dependency between the coefficients of v conveying the same message bit of m, i.e., v i+256l for l = 0, 1, • • • , n/256 − 1; (b) the dependency between the n/4 coefficients of v . In [18], v i was elegantly written in the form of…”

Section: Introduction 1error-correcting For Ring-lwe-based Public Key Encryptionmentioning

confidence: 99%

See 4 more Smart Citations

How to Construct Polar Codes for Ring-LWE-Based Public Key Encryption

Wang

Ling

2021

Entropy

View full text Add to dashboard Cite

There exists a natural trade-off in public key encryption (PKE) schemes based on ring learning with errors (RLWE), namely: we would like a wider error distribution to increase the security, but it comes at the cost of an increased decryption failure rate (DFR). A straightforward solution to this problem is the error-correcting code, which is commonly used in communication systems and already appears in some RLWE-based proposals. However, applying error-correcting codes to those cryptographic schemes is far from simply installing an add-on. Firstly, the residue error term derived by decryption has correlated coefficients, whereas most prevalent error-correcting codes with remarkable error tolerance assume the channel noise to be independent and memoryless. This explains why only simple error-correcting methods are used in existing RLWE-based PKE schemes. Secondly, the residue error term has correlated coefficients leaving accurate DFR estimation challenging even for uncoded plaintext. It can be found in the literature that a tighter DFR estimation can effectively create a DFR margin. Thirdly, most error-correcting codes are not well designed for safety considerations, e.g., syndrome decoding has a nonconstant time nature. A code good at error correcting might be weak under a variety of attacks. In this work, we propose a polar coding scheme for RLWE-based PKE. A relaxed “independence” assumption is used to derive an uncorrelated residue noise term, and a wireless communication strategy, outage, is used to construct polar codes. Furthermore, some knowledge about the residue noise is exploited to improve the decoding performance. With the parameterization of NewHope Round 2, the proposed scheme creates a considerable DRF margin, which gives a competitive security improvement compared to state-of-the-art benchmarks. Specifically, the security is improved by 28.8%, while a DFR of 2−149 is achieved a for code rate pf 0.25, n=1024,q= 12,289, and binomial parameter k=55. Moreover, polar encoding and decoding have a quasilinear complexity O(Nlog2N) and intrinsically support constant-time implementations.

show abstract

Section: Results: Decoding Performance Analysismentioning

confidence: 99%

Section: Complexity and Communication Overheadmentioning

confidence: 92%

Section: Security Improvementmentioning

confidence: 99%

Section: Introduction 1error-correcting For Ring-lwe-based Public Key Encryptionmentioning

confidence: 99%

Section: Introduction 1error-correcting For Ring-lwe-based Public Key Encryptionmentioning

confidence: 99%

See 3 more Smart Citations

How to Construct Polar Codes for Ring-LWE-Based Public Key Encryption

Wang

Ling

2021

Entropy

View full text Add to dashboard Cite

show abstract

Polar coding for Ring-LWE-based public key encryption

Wang

Ling

2022

Cryptogr. Commun.

View full text Add to dashboard Cite

The ring learning with errors (RLWE) problem can be used to construct efficient post-quantum public key encryption schemes. An error distribution, normally a Gaussian-like distribution, is involved in the RLWE problem. In this work we focus on using polar codes to alleviate a natural trade-off present in RLWE public key encryption schemes; namely, we would like a wider error distribution to increase security, but a wider error distribution comes at the cost of an increased probability of decryption error. The motivation of this work is to improve the bit-security level by using wider error distribution while keeping the target decryption failure rate achievable. The approach we proposed in this work is twofold. Firstly, we formulate RLWE public key encryption as a channel model with some noise terms known by the decoder. This makes our approach distinguished from existing research of this kind in the literature which ignores these known terms. Secondly, we design polar codes for the derived channel model. Theoretically and numerically, we show the proposed modeling and polar coding scheme contributes to a considerable bit-security level improvement compared with NewHope, a submission to National Institute of Standards and Technology (NIST), with almost the same parameters. Moreover, polar encoding and decoding support isochronous implementations in the sense that the timings of associated operations are irrelevant to the sensitive information.

show abstract