A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. - PowerPoint PPT Presentation

A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. Göpfert, C. van Vredendaal, Thomas Wunderer 29.06.2017 | 1

Motivation Primal BKW Embedding LWE Hybrid … Dual Embedding Make it quantum! Faster More versatile 29.06.2017 | 2

Background and Notation 29.06.2017 | 3

Lattices 𝑜 -dimensional lattice Λ : a discrete additive subgroup of ℝ 𝑜 Basis of a lattice Λ : lin. ind. ′ 𝒄 1 𝑪 = 𝒄 1 , … , 𝒄 𝑜 such that ′ 𝒄 2 Λ = ℤ𝒄 1 + … + ℤ𝒄 𝑜 . 𝒄 1 𝒄 2 (good) basis 𝑪 Basis (bad) basis 𝑪 ′ reduction 29.06.2017 | 4

Shortest Vector Problem (SVP) 0 Find a shortest non- zero lattice vector 29.06.2017 | 5

Closest Vector Problem (CVP) Bounded Distance Decoding (BDD) 𝒇 𝒖 Given a target vector 𝒖 Find (short) difference vector 𝒇 29.06.2017 | 6

Learning with Errors (LWE) . 𝑩 b e = + mod q s short short 𝑛×𝑜 , 𝒄 ∈ ℤ 𝑟 𝑛 𝑜 Given: 𝑩 ∈ ℤ 𝑟 Find: 𝒕 ∈ ℤ 𝑟 29.06.2017 | 7

The (Quantum) Hybrid Attack on LWE 29.06.2017 | 8

Our approach We solve the LWE instance 𝒄 = 𝑩𝒕 + 𝒇 𝑛𝑝𝑒 𝑟 as follows: Transform LWE into SVP in some lattice Λ 1. Generate a basis 𝑪 ′ of Λ of the form 2. 𝑪 ′ = 𝑪 𝑫 𝟏 𝑱 𝑠 Solve SVP in Λ with our Quantum Hybrid Attack 3. 29.06.2017 | 9

Transforming LWE into SVP 𝒄 = 𝑩𝒕 + 𝒇 𝑛𝑝𝑒 𝑟 𝒕 ∈ Λ = 𝒚 ∈ ℤ 𝑜+𝑛+1 ∶ 𝑩 𝑱 𝑛 − 𝒄 𝒚 = 𝟏 𝑛𝑝𝑒 𝑟 𝒇 𝒘 = 1 short 29.06.2017 | 10

The Quantum Hybrid Attack (Idea) Setup : Find a shortest non-zero vector 𝒘 ∈ Λ 𝑪 ′ ⊂ ℤ 𝑒 , where 𝑪 ′ = 𝑪 𝑫 𝟏 𝑱 𝑠 𝑤 1 𝑤 1 Find 𝒘 1 ∈ ℤ 𝑒−𝑠 with lattice-based techniques: 𝑟𝐽 𝑜 𝐼 𝑏 • Basis reduction as precomputation 𝑤 = ∈ Λ ≔ Λ • BDD-algorithms (Nearest Plane [Babai86]) 0 𝑜 𝐽 𝑜 𝑔 𝑤 2 Quantum-search for 𝒘 2 ∈ ℤ 𝑠 (“Grover - like”) 29.06.2017 | 11

Quantum vs. Classical Hybrid Attack Quantum Classical Quantum search for 𝒘 2 Meet-in-the-middle search for 𝒘 2 + √ -speed-up over brute-force + √ -speed-up over brute-force + More versitile - Requires highly structured keys + Low memory consumption - Huge memory consumption + No collision-finding probability - Low collision-finding probability (might be ≈ 2 −90 ) 29.06.2017 | 12

The Attack 29.06.2017 | 13

Find 𝒘 𝟐 approach if 𝒘 𝟑 is known 𝒘 𝟐 𝒚 𝑪𝒚 + 𝑫𝒘 𝟑 = 𝑪 𝑫 𝒘 = = 𝟏 𝑱 𝑠 𝒘 𝟑 𝒘 𝟑 𝒘 𝟑 Lattice 𝚳 = 𝚳 𝑪 𝒘 𝟐 𝒎 = −𝑪𝒚 𝒖 = 𝑫𝒘 𝟑 0 Solve BDD problem: Given 𝒖 , find 𝒘 𝟐 29.06.2017 | 14

Solving BDD: Babai‘s Nearest Plane Requires sufficiently good basis 𝒖 ′ 𝒖 𝑂𝑄 𝑪 𝒖 𝑂𝑄 𝑪 𝒖′ 𝒬 ( 𝑪 ) 29.06.2017 | 15

The Algorithm (Simplified Idea) Task : find a shortest non-zero vector in a lattice Λ Input : a search space 𝑇 ⊂ ℤ 𝑠 , a basis 𝑪 ′ = 𝑪 𝑫 𝟏 𝑱 𝑠 Loop : ′ ∈ 𝑇 (black box for now) • “Quantum - guess” 𝒘 2 • Check if guess is correct: ′ = 𝑂𝑄 𝑪 𝑫𝒘 2 ′ • Calculate 𝒘 1 ′ 𝒘 1 • If 𝒘 = is sufficiently short ′ 𝒘 2 • Return 𝒘 29.06.2017 | 16

Quantum Search (simplified) • Let 𝑇 = 𝑡 1 , … , 𝑡 𝑙 be a finite search space and 𝐸 = 𝑞 1 , … , 𝑞 𝑙 be a probability distribution on 𝑇 . Let 𝑡 ∈ 𝑇 be a secret sampled from 𝐸 . Task: find it! • Choose a probability distribution 𝐵 = 𝑏 1 , … , 𝑏 𝑙 on 𝑇 . • • There exists a quantum algorithm (generalization of Grover’s search algorithm) that finds 𝑡 in roughly 𝑀 𝐵 = 𝑀 𝑏 1 , … , 𝑏 𝑙 = 𝑞 𝑗 𝑏 𝑗 loops (sampling from 𝐵 and testing). 29.06.2017 | 17

How to choose the distribution A Minimize the function 𝑀 𝑏 1 , … , 𝑏 𝑙 = 𝑞 𝑗 • 𝑏 𝑗 over all 𝑏 1 , … , 𝑏 𝑙 ∈ 0,1 with 𝑏 1 + ⋯ + 𝑏 𝑙 = 1 . • Optimization with constraints in 𝑙 variables (  Lagrange) 2/3 𝑞 𝑗 Optimal distribution a 1 , … , 𝑏 𝑙 with 𝑏 𝑗 = • 2/3 𝑞 𝑗 • Minimal number of loops : 3/2 2/3 𝑀 𝑛𝑗𝑜 = 𝑞 𝑗 29.06.2017 | 18

Example (New Hope) Take 𝑇 = −16, … , 16 200 and 𝐸 to be the distribution on 𝑇 given in the “New Hope” key exchange scheme [ADPS16] • Classical brute-force search: 𝑀 𝑑𝑚𝑏𝑡𝑡𝑗𝑑𝑏𝑚 ≈ 33 200 ≈ 2 1009 • Grover’s quantum search: 33 200 ≈ 2 504 𝑀 𝐻𝑠𝑝𝑤𝑓𝑠 ≈ • Our approach: 𝑀 𝑝𝑣𝑠 ≈ 2 1.85⋅200 ≈ 2 370 29.06.2017 | 19

Results 29.06.2017 | 20

Runtime Analysis Main result: Let all notations be as before and 𝐸 = 𝑞 1 , … , 𝑞 𝑙 be the distribution from which 𝑤 2 is sampled. Success probability: max −𝑠 𝑗 ,−1 𝑛−𝑠 2 1 − 𝑧 2 𝑛−𝑠−3 𝑞 𝑡𝑣𝑑𝑑 ≈ 1 − 𝑒𝑧 2 𝐶 𝑛 − 𝑠 − 1 , 1 𝑗=1 2 2 −1 𝑆 𝑗 where 𝐶 ⋅,⋅ denotes the Euler beta function, 𝑠 𝑗 = 2‖𝒘 1 ‖ and 𝑆 𝑗 is the length of the 𝑗 -th Gram-Schmidt vector in 𝑪 . 2/3 3/2 𝑛−𝑠 2 𝑞 𝑗 Number of operations if successful : T ℎ𝑧𝑐 ≈ 2 1.06 29.06.2017 | 21

Runtime Analysis Remarks: T ℎ𝑧𝑐 depends on the guessing-dimension 𝑠 and the „ quality “ 𝜀 • (Hermite factor) of the basis 𝑪 Use precomputation (basis reduction) to change 𝜀 • • Balance precomputation and actual attack costs: T 𝑢𝑝𝑢𝑏𝑚 𝑠, 𝜀 = T 𝑠𝑓𝑒 𝑠, 𝜀 + T ℎ𝑧𝑐 𝑠, 𝜀 𝑞 𝑡𝑣𝑑𝑑 𝑠, 𝜀 Non-trivial optimization process in 𝑠 and 𝜀 • • More details: see paper 29.06.2017 | 22

Results • Runtime depends on the cost of basis reduction (BKZ) How to model the SVP cost inside BKZ with block size 𝛾 ? • • Two (very) different ways in the literature: 𝑇𝑊𝑄 = 2 0.27𝛾 ln 𝛾 −1.019𝛾+16.1 T • Enumeration: 𝑇𝑊𝑄 = 2 0.265𝛾+16.4 T • Sieving: T 𝑠𝑓𝑒 ≈ 𝑒𝑗𝑛 ∗ #𝑢𝑝𝑣𝑠𝑡 ∗ T • 𝑇𝑊𝑄 •  We provide two different runtime estimates • Compare our results with the LWE estimator (not claimed security levels!) 29.06.2017 | 23

Results: New Hope and Frodo Attack New Hope Frodo-592 Frodo-752 Frodo-864 Dual 1346 446 485 618 Decoding 833 - - - Qu. Hybrid 725 254 310 377 Table 1: BKZ with enumeration Attack New Hope Frodo-592 Frodo-752 Frodo-864 Dual 389 173 184 219 Decoding 380 - - - Qu. Hybrid 384 171 189 221 Table 2: BKZ with sieving 29.06.2017 | 24

Results: Lindner-Peikert Figure 1: BKZ with enumeration 29.06.2017 | 25

Results: Lindner-Peikert Figure 1: BKZ with enumeration 29.06.2017 | 26

Conclusion • New improved Quantum Hybrid Attack • Detailed runtime analysis of the Quantum Hybrid • New possibilities: apply Quantum Hybrid to non-uniform search spaces (e.g., LWE with Gaussian distribution) • Outperforms other attacks in several instances Thank you! Questions? 29.06.2017 | 27

Literature [HG07] N. Howgrave-Graham. A Hybrid Lattice-Reduction and Meet-in-the-Middle Attack against NTRU . [BGPW16] J. A. Buchmann, F. Göpfert, R. Player, and T. Wunderer. On the Hardness of LWE with Binary Error. [Wun16] T. Wunderer. Revisiting the Hybrid Attack: Improved Analysis and Refined Security Estimates [GvVW16] F. Göpfert, C. van Vredendaal, T. Wunderer. The Quantum Hybrid Attack. [Babai86] L. Babai. On Lovász ’ Lattice Reduction and the Nearest Lattice Point Problem. [Schank15] J. Schanck. Practical Lattice Cryptosystems: NTRUencrypt and NTRUmls. [Grover96] L. K. Grover. A Fast Quantum Mechanical Algorithm for Database Search. [BHMT02] G. Brassard, P. Høyer, M. Mosca, A. Tapp. Quantum Amplitude Amplification and Estimation. [ADPS16] E. Alkim, L. Ducas, T. Pöppelmann, P. Schwabe. Post-quantum Key Exchange - A New Hope. 29.06.2017 | 28