On the Complexity of the LWR-Solving BKW Algorithm

Okada, Hiroki; Takayasu, Atsushi; Fukushima, Kazuhide; Kiyomoto, Shinsaku; Takagi, Tsuyoshi

doi:10.1007/978-3-030-12146-4_13

Cited by 1 publication

(3 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We explain how the output estimates the secret vector. We define the "rounding error" of the reduced samples {(a j , c j )} m j=1 by ξ j := p q a j , s (1,b) − c j , as like (1). Recall that the a j is produced by a − 1 times of the "treelike" addition of the original samples in the process of Stage 1, i.e.…”

Section: Duc Et Al's Bkw For Lwrmentioning

confidence: 99%

“…* A preliminary version of this paper was presented in [1] at ICISC 2018. This full version provides a technical contribution over [1] in Sect. 4. a) E-mail: ir-okada@kddi-research.jp DOI: 10.1587/transfun.2019CIP0022…”

Section: Introductionmentioning

confidence: 99%

“…Since the Lambert function W(x) has an asymptotic form as W(x) = ln(x) − ln(ln(x)) + o(1), we can evaluate a o(1). Furthermore, when we consider q to be at most exponential of n (this range of q includes most of q used in LWE cryptosystems), we obtain log q = O(n), and a = O(log n).…”

mentioning

confidence: 99%

See 2 more Smart Citations

On the Complexity of the LWR-Solving BKW Algorithm

Okada

Takayasu

Fukushima

et al. 2020

IEICE Trans. Fundamentals

Self Cite

View full text Add to dashboard Cite

The Blum-Kalai-Wasserman algorithm (BKW) is an algorithm for solving the learning parity with noise problem, which was then adapted for solving the learning with errors problem (LWE) by Albrecht et al. Duc et al. applied BKW also to the learning with rounding problem (LWR). The number of blocks is a parameter of BKW. By optimizing the number of blocks, we can minimize the time complexity of BKW. However, Duc et al. did not derive the optimal number of blocks theoretically, but they searched for it numerically. Duc et al. also showed that the required number of samples for BKW for solving LWE can be dramatically decreased using Lyubashevsky's idea. However, it is not shown that his idea is also applicable to LWR. In this paper, we theoretically derive the asymptotically optimal number of blocks, and then analyze the minimum asymptotic time complexity of the algorithm. We also show that Lyubashevsky's idea can be applied to LWR-solving BKW, under a heuristic assumption that is regularly used in the analysis of LPNsolving BKW. Furthermore, we derive an equation that relates the Gaussian parameter σ of LWE and the modulus p of LWR. When σ and p satisfy the equation, the asymptotic time complexity of BKW to solve LWE and LWR are the same.

show abstract

Section: Duc Et Al's Bkw For Lwrmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%