1. Better Key Sizes (and Attacks) for LWE-Based Encryption Richard LindnerChris Peikert

2. Motivation Learning with Errors (LWE) is ■ Lattice-based ■ Similar to well-known coding problems [McE78, Nie86] ■ Secure assuming worst-case hardness [Reg05, Pei09] ■ Extremely versatile ■ Encryption secure against CPA [Reg05, KTX07, PVW08] ■ Encryption secure against CCA [PW08, Pei09] ■ Oblivious Transfer [PVW08] ■ (Hierarchical) Identity-based encryption [GPV08, CHKP10, ABB10] ■ Leakage-resilient encryption [AGV09, ACPS09, DGK+10, GKPV10] ■…■… 18 February 2011 2 CT-RSA 2011 Encryption secure against CPA [Reg05, KTX07, PVW08]

3. Agenda New Scheme New Attack New Parameters 18 February 2011 3 CT-RSA 2011

4. Agenda New Scheme New Attack New Parameters 18 February 2011 4 CT-RSA 2011

5. Learning with Errors[Reg05, Pei09] Given random A in Z q n x m p t = s t A + r t (mod q) s secret r small Gaussian (0,σ 2 ) 18 February 2011 5 CT-RSA 2011 Hardness If σ 2 ≥ 4n then O(nq/σ)-SIVP ≤ Search-LWE Equivalence If q small prime then Search-LWE ≤ Decision-LWE Decision-LWE Distinguish (A, p) from uniform Search-LWE Find r (or s) = p r A s +

6. Encryption Scheme Given random A in Z q n x m p t = s t A + r t (mod q) s secret r small Gaussian (0,σ 2 ) 18 February 2011 6 CT-RSA 2011 Encryption ■ A, p is the public key ■ LWE hides secret key ■ Leftover Hash Lemma hides ciphertext = p r A s + 0 m = e c + A p

7. New Scheme 18 February 2011 7 CT-RSA 2011 = e2e2 + A p e1e1 + c 0 m p = r A + s 0 m = e c + A p = p r A s +

8. New Scheme New Encryption ■ LWE hides secret key and ciphertext ■ Technique similar to [LPS10, Mic10] Advantages ■ Save lg(q) factor on public key A, per-user key p ■ Adaptable to rings 18 February 2011 8 CT-RSA 2011 = e2e2 + A p e1e1 + c 0 m p = r A + s

9. Agenda New Scheme ■ Save lg(q) factor on public and per-user key ■ Adaptable to rings New Attack New Parameters 18 February 2011 9 CT-RSA 2011

10. Agenda New Scheme ■ Save lg(q) factor on public and per-user key ■ Adaptable to rings New Attack New Parameters 18 February 2011 10 CT-RSA 2011

11. LWE Attacks Attack on Decision ■ Find short z in L dual (Az = 0) ■ p t z = s t Az + r t z = r t z small iff p is LWE Given random A in Z q n x m p t = s t A + r t (mod q) s secret r small Gaussian (0, σ 2 ) 18 February 2011 11 CT-RSA 2011 New Attack on Search ■ Find short basis of L ■ Solve bounded distance decoding on p to recover r ■ T Total = T Reduce + T BDD Lattice ■ Set of all s t A (mod q) forms lattice L ■ p is lattice point perturbed by r

12. BDD - Nearest Plane[Bab86] 18 February 2011 12 CT-RSA 2011 b1b1 b2b2 stAstA ptpt

13. BDD - Nearest Planes 18 February 2011 13 CT-RSA 2011 b1b1 b2b2 Recurse twice on b 2 stAstA ptpt

14. Summary Can recurse many times to improve success prob Get many candidate e and check which works Attack tweaks ■ Optimal plane selection for known error distribution ■ Recursions parallelizable Advantages ■ Effective with less reduced basis 18 February 2011 14 CT-RSA 2011

15. Agenda New Scheme ■ Save lg(q) factor on public and per-user key ■ Adaptable to rings New Attack ■ Effective with less reduced bases New Parameters 18 February 2011 15 CT-RSA 2011

16. Agenda New Scheme ■ Save lg(q) factor on public and per-user key ■ Adaptable to rings New Attack ■ Effective with less reduced bases New Parameters 18 February 2011 16 CT-RSA 2011

17. New Parameters 18 February 2011 17 CT-RSA 2011 ParametersSuccessAttack [MR09] New (Planes) Keysize:regular / ringProbabilitylog(secs) Previous [MR09] Per-User key: 2736/ 20 KBits ¼ 1 2 -32 219 33 68 27 New (medium security) Per-User key: 392 / 2 KBits ¼ 1 2 -32 258 96 132 90 Advantages ■ Major improvement for high advantage attack ■ Save 90% on keysize and provide better security

18. Contributions New Scheme ■ Save lg(q) factor on public and per-user key ■ Adaptable to rings New Attack ■ Effective with less reduced bases ■ Major improvement for high advantage attack New Parameters ■ Save 90% on keysize and provide better security 18 February 2011 18 CT-RSA 2011

19. Thank you Further Questions? 18 February 2011 19 CT-RSA 2011