BKZ 2.0: Better Lattice Security Estimates

Abstract

Abstract. The best lattice reduction algorithm known in practice for high dimension is Schnorr-Euchner's BKZ: all security estimates of lattice cryptosystems are based on NTL's old implementation of BKZ. However, recent progress on lattice enumeration suggests that BKZ and its NTL implementation are no longer optimal, but the precise impact on security estimates was unclear. We assess this impact thanks to extensive experiments with BKZ 2.0, the first state-of-the-art implementation of BKZ incorporating recent improvements, such as Gama-Nguyen-Regev pruning. We propose an efficient simulation algorithm to model the behaviour of BKZ in high dimension with high blocksize ≥ 50, which can predict approximately both the output quality and the running time, thereby revising lattice security estimates. For instance, our simulation suggests that the smallest NTRUSign parameter set, which was claimed to provide at least 93-bit security against key-recovery lattice attacks, actually offers at most 65-bit security.

Tuning GaussSieve for Speed

“…Such bases, in some sense, allow easier and/or more accurate solutions of approximation variants of SVP or its related problem, the Closest Vector Problem (CVP). In practice, the most effective arbitrary-dimension lattice basis reduction algorithms are descendants of the LLL algorithm [14], with the Block-KorkineZolotarev (BKZ) family [22,5] (or framework) of algorithms being the most effective in practice. The LLL and BKZ algorithms rely on successive exact SVP solution in a number of projected lattices.…”

Using Bleichenbacher”s Solution to the Hidden Number Problem to Attack Nonce Leaks in 384-Bit ECDSA

“…Finding these points does not appear feasible with the lattice reduction software we used. However, it may be possible to find them using improved implementations such as BKZ 2.0 [9]. There is still a lot of room for improvement in our results, and we hope this paper spurs more research on Bleichenbacher's method.…”

Hardness of SIS and LWE with Small Parameters

“…This may be seen as the first theoretical evidence that, at least when using a small modulus q, restricting the ∞ norm of the solutions may make the SIS problem qualitatively harder than just restricting the 2 norm. There is already significant empirical evidence for this belief: the most practically efficient attacks on SIS, which use lattice basis reduction (e.g., [12,9]), only find solutions with bounded 2 norm, whereas combinatorial attacks such as [5,27] (see also [22]) or theoretical lattice attacks [10] that can guarantee an ∞ bound are much more costly in practice, and also require exponential space. Finally, we mention that setting β ∞ β is very natural in the usual formulations of one-way and collision-resistant hash functions based on SIS, where collisions correspond (for example) to vectors in {−1, 0, 1} m , and therefore have ∞ bound β ∞ = 1, but 2 bound β = √ m. Similar gaps between β ∞ and β can easily be enforced in other applications, e.g., digital signatures [13].…”

“…The evaluation of the concrete level of security/efficiency offered by SIS and LWE for specific small parameter values still requires careful cryptanalysis, and consideration of the best known attacks. (See, for example, [22,15,9]. )…”