Measuring, Simulating and Exploiting the Head Concavity Phenomenon in BKZ

Bai, Shi; Stehlé, Damien; Wen, Weiqiang

doi:10.1007/978-3-030-03326-2_13

Cited by 21 publications

(16 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Observe that if n − 1 entries of h and a hash of h are known, then this is enough to recover h entirely. Indeed, the public key h satisfies the linear equation (4). Hence, upon reception of a signature, one can recompute a candidate h * from this equation and check whether its hash matches the one in the public key.…”

Section: Signature and Verificationmentioning

confidence: 99%

See 1 more Smart Citation

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

Chuengsatiansup

Prest²,

Stehlé

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Lattices lead to promising practical post-quantum digital signatures, combining asymptotic efficiency with strong theoretical security guarantees. However, tuning their parameters into practical instantiations is a delicate task. On the one hand, NIST round 2 candidates based on Lyubashevsky's design (such as DILITHIUM and qTESLA) allow several tradeoffs between security and efficiency, but at the expense of a large bandwidth consumption. On the other hand, the hash-and-sign Falcon signature is much more compact and is still very efficient, but it allows only two security levels, with large compactness and security gaps between them. We introduce a new family of signature schemes based on the Falcon design, which relies on module lattices. Our concrete instantiation enjoys the compactness and efficiency of Falcon, and allows an intermediate security level. It leads to the most compact lattice-based signature achieving a quantum security above 128 bits.

show abstract

Section: Signature and Verificationmentioning

confidence: 99%

“…The GSA has been backed-up by extensive experimental results [2,4,12,22,58], and it has been found to be very accurate for large block-sizes.…”

Section: Lattice Reduction Attacksmentioning

confidence: 99%

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

Chuengsatiansup

Prest²,

Stehlé

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…We also provide the predictions for progressive tours given by the BKZ simulator of [CN11,Wal16]. We note that the simulator is optimistic compared to even the most "textbook" variants, BKZ2.0 and NaiveTour, a phenomenon already documented in [YD17,BSW18].…”

Section: Bkzmentioning

confidence: 99%

The General Sieve Kernel and New Records in Lattice Reduction

Albrecht

Ducas

Herold

et al. 2019

Lecture Notes in Computer Science

103

View full text Add to dashboard Cite

We propose the General Sieve Kernel (G6K, pronounced /Ze.si.ka/), an abstract stateful machine supporting a wide variety of lattice reduction strategies based on sieving algorithms. Using the basic instruction set of this abstract stateful machine, we first give concise formulations of previous sieving strategies from the literature and then propose new ones. We then also give a light variant of BKZ exploiting the features of our abstract stateful machine. This encapsulates several recent suggestions (Ducas at Eurocrypt 2018; Laarhoven and Mariano at PQCrypto 2018) to move beyond treating sieving as a blackbox SVP oracle and to utilise strong lattice reduction as preprocessing for sieving. Furthermore, we propose new tricks to minimise the sieving computation required for a given reduction quality with mechanisms such as recycling vectors between sieves, on-the-fly lifting and flexible insertions akin to Deep LLL and recent variants of Random Sampling Reduction. Moreover, we provide a highly optimised, multi-threaded and tweakable implementation of this machine which we make open-source. We then illustrate the performance of this implementation of our sieving strategies by applying G6K to various lattice challenges. In particular, our approach allows us to solve previously unsolved instances of the Darmstadt SVP (151, 153, 155) and LWE (e.g. (75, 0.005)) challenges. Our solution for the SVP-151 challenge was found 400 times faster than the time reported for the SVP-150 challenge, the previous record. For exact SVP, we observe a performance crossover between G6K and FPLLL's state of the art implementation of enumeration at dimension 70.

show abstract

“…Note that for tiny blocksizes (e.g. β ≤ 30), it has been observed in [14] that the Gaussian heuristic in local blocks is not accurate in BKZ; nor such blocksize matter the running-time of BKZ too much. Thus we do not consider these tiny blocksizes.…”

Section: Smaller Dimensionmentioning

confidence: 99%

“…In practice, it is known [23,14] that the GSA assumption does not quite fit the BKZ experiments. However, the GSA assumption is optimistic from an attacker's point of view, which leads to a more conservative estimate.…”

Section: Further Experiments On the Projection Lengthmentioning

confidence: 99%

A Refined Analysis of the Cost for Solving LWE via uSVP

Bai

Miller

Wen

2019

Progress in Cryptology – AFRICACRYPT 2019

Self Cite

View full text Add to dashboard Cite

The learning with errors (LWE) problem (STOC'05) introduced by Regev is one of the fundamental problems in lattice-based cryptography. One standard strategy to solve the LWE problem is to reduce it to a unique SVP (uSVP) problem via Kannan's embedding and then apply a lattice reduction to solve the uSVP problem. There are two methods for estimating the cost for solving LWE via this strategy: the first method considers the largeness of the gap in the uSVP problem (Gama-Nguyen, Eurocrypt'08) and the second method (Alkim et al., USENIX'16) considers the shortness of the projection of the shortest vector to the Gram-Schmidt vectors. These two estimates have been investigated by Albrecht et al. (Asiacrypt'16) who present a sound analysis and show that the lattice reduction experiments fit more consistently with the second estimate. They also observe that in some cases the lattice reduction even behaves better than the second estimate perhaps due to the second intersection of the projected vector with the Gram-Schmidt vectors. In this work, we revisit the work of Alkim et al. and Albrecht et al. We first report further experiments providing more comparisons and suggest that the second estimate leads to a more accurate prediction in practice. We also present empirical evidence confirming the assumptions used in the second estimate. Furthermore, we examine the gaps in uSVP derived from the embedded lattice and explain why it is preferable to use µ = 1 for the embedded lattice. This shows there is a coherent relation between the second estimate and the gaps in uSVP. Finally, it has been conjectured by Albrecht et al. that the second intersection will not happen for large parameters. We will show that this is indeed the case: there is no second intersection as β → ∞.

show abstract

Measuring, Simulating and Exploiting the Head Concavity Phenomenon in BKZ

Cited by 21 publications

References 21 publications

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

The General Sieve Kernel and New Records in Lattice Reduction

A Refined Analysis of the Cost for Solving LWE via uSVP

Contact Info

Product

Resources

About