Saber: Module-LWR Based Key Exchange, CPA-Secure Encryption and CCA-Secure KEM

Abstract

In this paper, we introduce Saber, a package of cryptographic primitives whose security relies on the hardness of the Module Learning With Rounding problem (Mod-LWR). We first describe a secure Diffie-Hellman type key exchange protocol, which is then transformed into an IND-CPA encryption scheme and finally into an IND-CCA secure key encapsulation mechanism using a post-quantum version of the Fujisaki-Okamoto transform. The design goals of this package were simplicity, efficiency and flexibility resulting in the following choices: all integer moduli are powers of 2 avoiding modular reduction and rejection sampling entirely; the use of LWR halves the amount of randomness required compared to LWE-based schemes and reduces bandwidth; the module structure provides flexibility by reusing one core component for multiple security levels. A constant-time AVX2 optimized software implementation of the KEM with parameters providing more than 128 bits of post-quantum security, requires only 101K, 125K and 129K cycles for key generation, encapsulation and decapsulation respectively on a Dell laptop with an Intel i7-Haswell processor.

On the Complexity of the LWR-Solving BKW Algorithm

“…Note that we also ignored the constraint on the number of samples m as Duc et al did. We set a = 1 ln 2 W n ln q ln 2 πα 2 lwr and calculate m LWR and C LWR in (5) and (10), respectively. We also set = 0.01 in Table 1, † Letã satisfies e πα 2 lwr 2ã = q n/ã , and Let tã be the time complexity with a =ã, namely tã = O(e πα 2 lwr 2ã ( n a ) ln q).…”

“…Subsequently, NIST announced 26 second-round candidates selected from the 69 first-round candidates in January 2019. LWE-based [3]- [5] and LWR-based [10], [12] schemes still remain on the second-round candidate list. Therefore, studies on the algorithms for solving LWE and LWR are important for design and security analysis of post-quantum cryptosystems.…”

“…Compared with LWEbased cryptographic schemes, LWR-based schemes can be simply implemented because they replace the rich Gaussian error sampling process of the LWE-based schemes with the rounding operations (which can be simply implemented by rounding off the lower-order bits). LWR was initially applied to low-depth pseudorandom functions [23], [24], and there have been a number of applications, e.g., lossy trapdoor functions [25], public-key cryptosystems [10], [12] and key exchange protocol [9].…”

“…Albrecht et al [17] estimate the cost of running primal and dual lattice attacks, which is based on lattice reduction techniques, against lattice-based schemes including LWEbased and LWR-based schemes in the list of the first-round submissions for the NIST PQC. They consider that the cost of lattice attacks for LWE and LWR are the same when the equation σ = q 2 √ 3p holds, as considered in [8], [10]. This equation is simply derived by comparing the variance of the Gaussian noise of LWE and the "rounding error" of LWR.…”

The Impact of Error Dependencies on Ring/Mod-LWE/LWR Based Schemes

“…These are frequently combined with the usage of polynomial matrix elements, resulting in Ring-LWE or Mod-LWE schemes such as New Hope [1], LAC [14], LIMA [16], R.Emblem [15] and Kyber [2]. Some schemes further reduce their communication bandwidth by replacing the pseudorandomly generated errors terms with rounding errors, resulting in Ring-LWR and Mod-LWR schemes as in Round2 [8] and Saber [3] respectively.…”