On the Ring-LWE and Polynomial-LWE Problems

Léo Ducas, Alain Durmus

David Balbás

Madalina Bolboceanu, Zvika Brakerski, Renen Perlman +1 more

Liljana Babinkostova, Ariana Chin, Aaron Kirtland +2 more

Abstract As quantum computing advances rapidly, guaranteeing the security of cryptographic protocols resistant to quantum attacks is paramount. Some leading candidate cryptosystems use the learning with errors (LWE) problem, attractive for its simplicity and hardness guaranteed by reductions from hard computational lattice problems. Its algebraic variants, ring-learning with errors (RLWE) and polynomial learning with errors (PLWE), gain efficiency over standard LWE, but their security remains to be thoroughly investigated. In this work, we consider the “smearing” condition, a condition for attacks on PLWE and RLWE introduced in Elias et al. We expand upon some questions about smearing posed by Elias et al. and show how smearing is related to the coupon collector’s problem. Furthermore, we develop an algorithm for computing probabilities related to smearing. Finally, we present a smearing-based algorithm for solving the PLWE problem.

Chunsheng Gu

Reynaldo Caceres Villena

There are cryptographic systems that are secure against attacks by both classical and quantum computers. One of these systems is the NewHope key encapsulation mechanism (KEM) based on the Ring-learning with error problem (Ring-LWE problem). The Ring-LWE problem is presumed to be hard to solve even on a quantum computer. A KEM scheme allows sharing of a common key between two parts (Alice & Bob). This thesis presents original contributions to the security and analysis of key mismatch and information leakage attacks on NewHope KEM and some vulnerabilities on (small)-Ring-LWE problem (a variant of Ring-LWE problem). The first contribution contains some improvements on key mismatch attacks proposed by Bauer et al. and Qin et al. (Bauer et al., 2019; Qin et al., 2019). These key mismatch attacks retrieve Alices secret key. And, we propose two new methods named Fast Qin and Double Qin. The methods Fast Qin and Double Qin require around 240k and 34k oracle queries, respectively; instead of 840k queries of the Qin et al.s method. Moreover, these two new methods are adapted to retrieve Alices secret key on NewHope-512 (a variant of NewHope). The second contribution analyzes the information leakage of Bobs secret key on NewHope when it is reused. Our result corroborates that Bobs secret key must not be reused since with two communications to Bob, his secret key is leaked. In Ring-LWE problem, a polynomial a is selected randomly and a polynomial b is calculated as b = a.s+e where s is the secret polynomial (selected randomly) and the e is a noise polynomial. Our third contribution shows that in small-Ring-LWE, a variant where polynomials s and e are small, there are values of the public parameter a that leak a large percentage of the coefficients of the secret s. And, the last contribution shows that the secret s can be retrieved successfully if at least 50% of the random known coefficients of s and e are known.