dissection bkw
play

Dissection-BKW CRYPTO 2018, Santa Barbara , August 20th 2018 Andre - PowerPoint PPT Presentation

Dissection-BKW CRYPTO 2018, Santa Barbara , August 20th 2018 Andre Esser , Felix Heuer, Robert Kbler, Alexander May, Christian Sohler Horst Grtz Institute for IT Security Ruhr University Bochum What is LPN? Learning Parity with Noise (LPN)


  1. Dissection-BKW CRYPTO 2018, Santa Barbara , August 20th 2018 Andre Esser , Felix Heuer, Robert Kübler, Alexander May, Christian Sohler Horst Görtz Institute for IT Security Ruhr University Bochum

  2. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  3. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 • Cryptographic applications [HB01, Ale03, HKL + 12, DV13] Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  4. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 • Cryptographic applications [HB01, Ale03, HKL + 12, DV13] • Solve LPN: BKW algorithm [BKW00] ◦ Time = Memory = Samples , slightly subexponential ◦ only small experiments [BTV16, EKM17] Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  5. What is LPN? Learning Parity with Noise (LPN) Problem $ ← F k 2 , Pr [ e i = 1] = τ < 1 Given: ( a i , � a i , s � + e i ) , a i 2 Find: s ∈ F k 2 • Cryptographic applications [HB01, Ale03, HKL + 12, DV13] • Solve LPN: BKW algorithm [BKW00] ◦ Time = Memory = Samples , slightly subexponential ◦ only small experiments [BTV16, EKM17] • Goal: BKW-variant applicable for any given memory Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 2/13

  6. Illustration of “BKW” ( a 1 , � a 1 , s � + e 1 ) ( a 2 , � a 2 , s � + e 2 ) Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  7. Illustration of “BKW” ( a 1 , � a 1 , s � + e 1 ) + ( a 2 , � a 2 , s � + e 2 ) = ( a 1 + a 2 , � a 1 + a 2 , s � + e 1 + e 2 ) a ′ � a ′ , s � e ′ ( , + ) Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  8. Illustration of “BKW” $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  9. Illustration of “BKW” $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  10. Illustration of “BKW” $ 0101 0101 $ stripe Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  11. Illustration of “BKW” 0000 $ $ 0101 + 0101 $ stripe Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  12. Illustration of “BKW” 0000 $ $ 0101 1111 $ 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  13. Illustration of “BKW” 0000 $ $ 0101 $ 0000 1111 $ + 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  14. Illustration of “BKW” 0000 $ $ 0101 $ 0000 $ 0000 1111 $ 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  15. Illustration of “BKW” 0000 $ $ 0101 $ 0000 $ 0000 1111 0000 $ $ 0101 $ $ 1111 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  16. Illustration of “BKW” 0000 $ $ 0101 $ 0000 $ 0000 1111 0000 $ $ 0101 $ . . . . . . . . . $ 1111 0000 $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  17. Illustration of “BKW” $ $ $ $ . . . . . . . . . $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  18. Illustration of “BKW” $ $ $ $ $ $ $ $ → . . . . . . . . . . . . . . . . . . $ $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  19. Illustration of “BKW” 1 $ $ $ $ 1 $ $ 1 1 $ $ → → . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 $ $ Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  20. Illustration of “BKW” 1 $ $ $ $ 1 $ $ 1 1 $ $ → → . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 $ $ • a i = (1 , 0 , 0 , . . . , 0) ⇒ ( a i , � a i , s � + e i ) = ( a i , s 1 + e i ) • Majority vote! BKW Theorem [BKW00, LF06] BKW solves LPN in time, memory and sample complexity 2 k/ log k . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 3/13

  21. c -sum Observation $ 0000 0101 $ + $ 0101 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  22. c -sum Observation $ 0000 0101 $ + $ 0000 $ 0101 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  23. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  24. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  25. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) ! � N � / 2 b ≥ N c c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  26. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) N ≥ 2 b/ ( c − 1) c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  27. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) N = 2 b/ ( c − 1) c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  28. c -sum Observation $ 0000 0101 $ + $ 0000 number of c -sums increases exponentially in c $ 0101 ⇒ much smaller list (save Memory & Samples) N = 2 b/ ( c − 1) Main Idea: solve c - SP repeatedly on stripes c -sum-Problem ( c - SP ) Given a list L of N uniformly distributed elements from F b 2 . Find N combinations of c elements from L that each add up to 0 b . Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 4/13

  29. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0101 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  30. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0101 → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  31. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0101 sum of A = 2 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  32. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0000 $ 0101 sum of A = 2 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  33. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0000 $ 0101 sum of A = 2 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  34. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 0101 $ + $ 0000 $ 0101 sum of B = 3 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  35. ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 sum of B = 3 # ■t❡r❛t✐♦♥s samples → → → $ $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  36. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  37. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 sum of A samples → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  38. ■t❡r❛t✐♦♥s ■t❡r❛t✐♦♥s Not just a memory reduction technique $ 1010101 $ + $ 1110000 $ 0100101 sum of A samples → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 5/13

  39. ❛♥❞ → → $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

  40. ❛♥❞ → → N $ $ 1 Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

  41. ❛♥❞ → → N $ $ 1 solve c - SP Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

  42. ❛♥❞ → → N $ $ 1 solve c - SP Memory Dissection-BKW|CRYPTO 2018, Santa Barbara|August 20th 2018 6/13

Recommend


More recommend