Coded-BKW with Sieving

Guo, Qian; Johansson, Thomas; Mårtensson, Erik; Stankovski, Paul

doi:10.1007/978-3-319-70694-8_12

Cited by 16 publications

(18 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Actually, with the help of this alternative collision idea, a series of recent papers [1,18,19,26] have greatly reduced the solving complexity of the LWE problem, the qary counterpart of LPN, both asymptotically and concretely. But we failed to find better attacks when applying this idea to the LPN instances of cryptographic interests in the proposed authentication protocols and LPN-C, since the noise rates are high.…”

Section: Alternative Collision Proceduresmentioning

confidence: 99%

Solving LPN Using Covering Codes

2019

Self Cite

View full text Add to dashboard Cite

We present a new algorithm for solving the LPN problem. The algorithm has a similar form as some previous methods, but includes a new key step that makes use of approximations of random words to a nearest codeword in a linear code. It outperforms previous methods for many parameter choices. In particular, we can now solve the (512, 1 8) LPN instance with complexity less than 2 80 operations in expectation, indicating that cryptographic schemes like HB variants and LPN-C should increase their parameter size for 80-bit security.

show abstract

Section: Alternative Collision Proceduresmentioning

confidence: 99%

Solving LPN Using Covering Codes

2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…The original coded-BKW with sieving algorithm from [13] is the special case where γ = 1 and coded-BKW is the special case where γ = √ 2. For an illustration of how the different BKW algorithms reduce the a vector, see Figure 2.…”

Section: Coded-bkw With Sievingmentioning

confidence: 99%

“…By setting γ = 1 we get (a restatement of) the complexity of the original coded-BKW with sieving algorithm [13].…”

Section: Coded-bkw With Sievingmentioning

confidence: 99%

“…Further improvements were made in [11], [12] by using a varying step size and a varying degree of reduction. In [13] coded-BKW with sieving was introduced, where lattice sieving techniques were used to improve the BKW algorithm. The full version in [14] improved the coded-BKW with sieving algorithm by finding the optimal reduction factor used for lattice sieving.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

The Asymptotic Complexity of Coded-BKW with Sieving Using Increasing Reduction Factors

Mårtensson

2019

2019 IEEE International Symposium on Information Theory (ISIT)

View full text Add to dashboard Cite

The Learning with Errors problem (LWE) is one of the main candidates for post-quantum cryptography. At Asiacrypt 2017, coded-BKW with sieving, an algorithm combining the Blum-Kalai-Wasserman algorithm (BKW) with lattice sieving techniques, was proposed. In this paper, we improve that algorithm by using different reduction factors in different steps of the sieving part of the algorithm. In the Regev setting, where q = n 2 and σ = n 1.5 /( √ 2π log 2 2 n), the asymptotic complexity is 2 0.8917n , improving the previously best complexity of 2 0.8927n . When a quantum computer is assumed or the number of samples is limited, we get a similar level of improvement.

show abstract

“…After BKW proposed by Albrecht et al, new variants of BKW [20], [21], [29], [30] for solving the small-secret LWE, whose secret vector s is extremely small (e.g. s ∈ {0, 1} n ), have been proposed.…”

Section: Introductionmentioning

confidence: 99%

On the Complexity of the LWR-Solving BKW Algorithm

Okada

Takayasu

Fukushima

et al. 2020

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

The Blum-Kalai-Wasserman algorithm (BKW) is an algorithm for solving the learning parity with noise problem, which was then adapted for solving the learning with errors problem (LWE) by Albrecht et al. Duc et al. applied BKW also to the learning with rounding problem (LWR). The number of blocks is a parameter of BKW. By optimizing the number of blocks, we can minimize the time complexity of BKW. However, Duc et al. did not derive the optimal number of blocks theoretically, but they searched for it numerically. Duc et al. also showed that the required number of samples for BKW for solving LWE can be dramatically decreased using Lyubashevsky's idea. However, it is not shown that his idea is also applicable to LWR. In this paper, we theoretically derive the asymptotically optimal number of blocks, and then analyze the minimum asymptotic time complexity of the algorithm. We also show that Lyubashevsky's idea can be applied to LWR-solving BKW, under a heuristic assumption that is regularly used in the analysis of LPNsolving BKW. Furthermore, we derive an equation that relates the Gaussian parameter σ of LWE and the modulus p of LWR. When σ and p satisfy the equation, the asymptotic time complexity of BKW to solve LWE and LWR are the same.

show abstract

Coded-BKW with Sieving

Cited by 16 publications

References 42 publications

Solving LPN Using Covering Codes

Solving LPN Using Covering Codes

The Asymptotic Complexity of Coded-BKW with Sieving Using Increasing Reduction Factors

On the Complexity of the LWR-Solving BKW Algorithm

Contact Info

Product

Resources

About