Learning Strikes Again: The Case of the DRS Signature Scheme

Abstract

Lattice signature schemes generally require particular care when it comes to preventing secret information from leaking through signature transcript. For example, the Goldreich-Goldwasser-Halevi (GGH) signature scheme and the NTRUSign scheme were completely broken by the parallelepiped-learning attack of Nguyen and Regev (Eurocrypt 2006). Several heuristic countermeasures were also shown vulnerable to similar statistical attacks.At PKC 2008, Plantard, Susilo and Win proposed a new variant of GGH, informally arguing resistance to such attacks. Based on this variant, Plantard, Sipasseuth, Dumondelle and Susilo proposed a concrete signature scheme, called DRS, that has been accepted in the round 1 of the NIST post-quantum cryptography project.In this work, we propose yet another statistical attack and demonstrate a weakness of the DRS scheme: one can recover some partial information of the secret key from sufficiently many signatures. One difficulty is that, due to the DRS reduction algorithm, the relation between the statistical leak and the secret seems more intricate. We work around this difficulty by training a statistical model, using a few features that we designed according to a simple heuristic analysis.While we only recover partial information on the secret key, this information is easily exploited by lattice attacks, significantly decreasing their complexity. Concretely, we claim that, provided that 100 000 signatures are available, the secret key may be recovered using BKZ-138 for the first set of DRS parameters submitted to the NIST. This puts the security level of this parameter set below 80-bits (maybe even 70-bits), to be compared to an original claim of 128-bits.

Improving the Security of the DRS Scheme with Uniformly Chosen Random Noise

“…where D is the signature bound (see Fig 1). We can see that the generated noise vectors follow a Gaussian distribution as far as their norms are concerned, and we believe it makes guessing values much harder for an attacker should they choose to focus on finding specific values or vectors (as it was the case in the original attack from Yu and Ducas [30]). We also conducted experiments, using BKZ20 from the fplll library [28] (see Fig 2).…”

“…For the first step, Yu and Ducas noticed that the coefficients B of the secret key and the 1 could be distinguished via machine learning techniques [30], noticing for one part that the non-diagonal coefficients follow an "absolute-circulant" structure, and the fact that only two types of non-zero values exist. Based on this information, a surprisingly small amount of selected "features" to specialize a "least-square fit" method allowed them to recover both positions and signs of all if not most coefficients B of a secret vector.…”

“…We demonstrate that our new approach is sufficient to improve DRS to be secure against machine learning attacks as reported earlier in the literature. However, the secret matrix is still diagonal dominant and it remains an open question whether there exists a tight security proof to a well-known problem or if there is any unforeseen weaknesses to diagonal dominant lattices as both Li, Liu, Nitaj and Pan's [11] and Yu and Ducas's attacks [30] could lead to. The open questions for improvement stated in the original DRS report are also still applicable to our proposed iteration.…”

“…The NIST submission however provides a more straight-forward way to generate the noise, using another proof and condition to ensure the functionality of the scheme. This new way to generate the noise, however, is shown to be insecure: soon after DRS was made public, Yu and Ducas used machine learning techniques to severely reduce the security parameters [30]. Although according to Ducas' comments on the NIST forum [17], the attack was not devastating as it still seems asymptotically secure, however its concrete security was significantly decreased.…”

Integral Matrix Gram Root and Lattice Gaussian Sampling Without Floats

“…Gaussian sampling is important to prevent leaking secret information. Indeed early lattice trapdoors have suffered from statistical attacks [NR06,DN12b,YD18]. In 2008, Gentry, Peikert and Vaikuntanathan first showed that Gaussian distributions [GPV08] can prevent such leaks, and that Klein's algorithm [Kle00] could sample efficiently from a negligibly close distribution.…”