Efficient Authentication from Hard Learning Problems

Abstract

Abstract. We construct efficient authentication protocols and messageauthentication codes (MACs) whose security can be reduced to the learning parity with noise (LPN) problem.Despite a large body of work -starting with the HB protocol of Hopper and Blum in 2001 -until now it was not even known how to construct an efficient authentication protocol from LPN which is secure against man-in-the-middle (MIM) attacks. A MAC implies such a (two-round) protocol.

Two-Round Man-in-the-Middle Security from LPN

“…Let n = O( ) denote the number of repetitions, γ the parameter of the Bernoulli distribution, and γ := 1/4 + γ/2 controls the correctness error. The following authentication protocol Auth LPN = {Gen , P , V } originates from [20]. It has associated key space…”

“…In contrast, this paper contributes to a line of work [16,18,13,19,20,10,15,22] on building provably-secure authentication protocols with security reductions to the learning parity with noise (LPN) and related problems that are as efficient as possible, meaning that key-size, communication, and rounds are minimized. LPN problem provides confidence in security due to the failure to find polynomial-time algorithms for it and its variants, despite wide interest [7,21,5], and finding constructions of cryptographic primitives based on LPN has given rise to a substantial body of works [6,14,2,17].…”

“…Also in [18], they proposed a further three-round protocol, called HB + , which was proven actively secure in its sequential version under the LPN assumption, and later the proof was extended to its parallel version by Katz et al [19]. The round complexity was then reduced to two rounds by a new protocol of Kiltz et al [20], and in contrast to HB + , this latter protocol enjoys a tight reduction to the hardness of LPN. Heyse et al [15] then proposed an even more efficient two-round protocol, called Lapin, based on the hardness of the field LPN problem.…”

“…On the one hand, researchers have attempted to design multiple HBlike protocols with MIM security [8,11,25,13] without or only partial security proofs. Otherwise, provably MIM-secure constructions all in fact provide a full message-authentication code (MAC) secure under LPN or Field LPN [20,10,15]. Unfortunately, these constructions are significantly less efficient than the existing actively secure protocols mentioned above.…”

“…One may consider looser reductions via so-called complexity leveraging where the reduction loses an exponential factor, with the view that one can enlarge the security parameter to compensate for the loss. Indeed one can prove (say) the AUTH 2 protocol from [20] as a fully-secure MAC with an exponential loss of security. A concrete instantiation of the result (assuming the BKW attack complexity is optimal [7]) will be more efficient than the other approaches we have outlined.…”