Lapin: An Efficient Authentication Protocol Based on Ring-LPN

Abstract

Abstract. We propose a new authentication protocol that is provably secure based on a ring variant of the learning parity with noise (LPN) problem. The protocol follows the design principle of the LPN-based protocol from Eurocrypt'11 (Kiltz et al.), and like it, is a two round protocol secure against active attacks. Moreover, our protocol has small communication complexity and a very small footprint which makes it applicable in scenarios that involve low-cost, resourceconstrained devices.Performance-wise, our protocol is more efficient than previous LPN-based schemes, such as the many variants of the Hopper-Blum (HB) protocol and the aforementioned protocol from Eurocrypt'11. Our implementation results show that it is even comparable to the standard challenge-and-response protocols based on the AES block-cipher. Our basic protocol is roughly 20 times slower than AES, but with the advantage of having 10 times smaller code size. Furthermore, if a few hundred bytes of non-volatile memory are available to allow the storage of some off-line pre-computations, then the online phase of our protocols is only twice as slow as AES.

Two-Round Man-in-the-Middle Security from LPN

“…In contrast, this paper contributes to a line of work [16,18,13,19,20,10,15,22] on building provably-secure authentication protocols with security reductions to the learning parity with noise (LPN) and related problems that are as efficient as possible, meaning that key-size, communication, and rounds are minimized. LPN problem provides confidence in security due to the failure to find polynomial-time algorithms for it and its variants, despite wide interest [7,21,5], and finding constructions of cryptographic primitives based on LPN has given rise to a substantial body of works [6,14,2,17].…”

“…For instance, the parallel nature of LPN-based protocols seems difficult to achieve with factoring or discrete-log type assumption. The potential efficiency benefits of LPN-based implementations are a subject of ongoing research, which has identified some advantageous scenarios [15] but also invented faster attacks [21]. We thus focus on developing techniques for protocol design and theoretical analysis that beat previous asymptotic runtimes, key sizes, and round complexity of protocols with similar security reductions.…”

“…We are also going to consider a variant of the LPN problem, introduced and studied in [15], called Field LPN. The Field-LPN ,γ problem is very similar, however samples have the form (r i , r i • s + e i ) or (r i , r i ), where • denotes multiplication of -bit vectors interpreted as elements of the extension field F 2 , e i is a random vector where each component is 1 independently with probability γ, and r i is uniform.…”

“…The round complexity was then reduced to two rounds by a new protocol of Kiltz et al [20], and in contrast to HB + , this latter protocol enjoys a tight reduction to the hardness of LPN. Heyse et al [15] then proposed an even more efficient two-round protocol, called Lapin, based on the hardness of the field LPN problem. We stress that three-round protocols are less attractive than two-round ones since the prover needs to keep a state (beyond the secret key), which is problematic on lightweight devices like RFID tags.…”

“…On the one hand, researchers have attempted to design multiple HBlike protocols with MIM security [8,11,25,13] without or only partial security proofs. Otherwise, provably MIM-secure constructions all in fact provide a full message-authentication code (MAC) secure under LPN or Field LPN [20,10,15]. Unfortunately, these constructions are significantly less efficient than the existing actively secure protocols mentioned above.…”