© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

Zero-Knowledge Proof for Knowledge of RLWE (Ring-Learning with Errors) Secret Keys

Saraswathy Rv

Published Jan 1, 2018• 0 citations

Abstract

Key Exchange is an essential primitive in cryptography that originated from the breakthrough idea of Diffie Hellman (DH) protocol presented in 1976.Following this work, there are many successful variants of DH using Elliptic curves, Isogeny and RLWE (Ring Learning with Errors).The Ring-Leaning with Errors (RLWE), Search and Decision version are hard problems in mathematics and it has been shown that solving worst case hard problems in ideal lattices can be reduced to solving RLWE in the average case.The reduction forms the basis of provable security for RLWE based key exchange against passive adversaries.The hardness of the decision version of RLWE, which means indistinguishability of RLWE samples from Uniform, makes it challenging to validate a RLWE form public key.This proves to be an advantage for malicious users to create public keys that deviate from a protocol to recover the secret of reused keys in Key Exchange (KE) protocols.In this thesis, we provide a cryptanalysis of RLWE key exchange, presenting two polynomial time strategies to exploit key reuse.Then we propose a defense against such exploits by presenting a Zero Knowledge authentication protocol to verify the prover's knowledge of a secret corresponding to his public key.The protocol is Statistical Zero Knowledge with negligible soundness and completeness errors so that the prover does not reveal any information about the secret in the proof.This is to ensure that a malicious verifier cannot impersonate the prover after the proof.The authentication protocol uses the signal function defined in RLWE key exchange to perform the verification.Firstly, I would like to express my gratitude to my advisor Prof.Ding for his expert advice, strong encouragement and support throughout my PhD study

Related papers

Post-Quantum Key Exchange From Learning With Errors Over Rings

Rohit Khera

This note describes a key exchange method based on the ring-LWE (RLWE) assumption. It builds upon several results, including Regev's landmark quantum reduction from certain worst case lattice problems (approx. GapSVP and SIVP) to random instances of the search variant of a particular learning problem (LWE). It also builds on the follow on work of Lyubashevsky, Peikert and Regev on the average case hardness of the RLWE search variant for polynomially bounded numbers of RLWE samples, along with novel applications of automorphism groups in number fields for a RLWE search to decision reduction (thereby demonstrating pseudorandomness of RLWE in these number fields). Subsequently, these results were adopted for the construction of Diffie-Hellman like key exchange methods by Peikert, and then by Lindner and Peikert followed by Ding and then by Ding, Xie and Lin who proposed efficient variants of such protocols. Subsequent work by Peikert proposed another efficient variant, phrased as a key encapsulation method, incorporating a low bandwidth reconciliation technique allowing two parties to exactly agree on a uniformly distributed secret value from noisy RLWE instances. This was followed by a concrete instantiation with parameter sets by Bos, Costello, Naehrig, Stebila, followed by another instantiation by Alkim, Ducas, Poppelmann and Schwabe with the same ring polynomial but a smaller modulus and a different reconciliation method. Unlike most other public key cryptography based key exchange methods, it is believed that RLWE based key exchange would remain secure in the event that an adversary is able to build a quantum computer. This document is a product of the Crypto Forum Research Group (CFRG).

•Oct 24, 2017•0 citations

Leakage of signal function with reused keys in RLWE key exchange

Jíntai Ding, Saed Alsayigh, Saraswathy Rv +2 more

In this paper, we show that the signal function used in Ring-Learning with Errors (RLWE) key exchange could leak information to find the secret s of a reused public key p = as+2e. This work is motivated by an attack proposed in [1] and gives an insight into how public keys reused for long term in RLWE key exchange protocols can be exploited. This work specifically focuses on the attack on the KE protocol in [2] by initiating multiple sessions with the honest party and analyze the output of the signal function. Experiments have confirmed the success of our attack in recovering the secret.

International Conference on Communications•May 1, 2017•81 citations

A Certificateless Authenticated Key Exchange Protocol Based on Ring Learning with Errors

Luyao Ma, Li Li, Hongfei Yang

Ring learning with errors (RLWE) is used to construct anti-quantum key exchange protocols cryptography algorithms, which is hard to solve for quantum computers. In this work, we provide a certificateless authenticated key exchange protocol based on RLWE problem. This proposed protocol implements user identity authentication by certificateless public key cryptosystem, and uses Ding error reconciled function to eliminate the error caused by the introduction of interference term in RLWE problem. We analyzed the correctness of the protocol in detail, and proved the security of the protocol under the improved extended Canetti-Krawczyk (eCK) security model.

IEEE Joint International Information Technology and Artificial Intelligence Conference (ITAIC)•Jun 17, 2022•2 citations

Practical Randomized RLWE-Based Key Exchange Against Signal Leakage Attack

Xinwei Gao, Jíntai Ding, Lin Li +1 more

Ring Learning With Errors (RLWE)-based key exchange is one of the most efficient and secure primitive for post-quantum cryptography. One common approach to achieve key exchange over RLWE is error reconciliation. Recently, an efficient attack against reconciliation-based RLWE key exchange protocols with reused keys was proposed. This attack can recover a long-term private key if a key pair is reused. We also know that in the real world, key reuse is commonly adopted in applications like the Transport Layer Security (TLS) protocol to improve performance. Directly motivated by this attack, we construct a new randomized RLWE-based key exchange protocol against this attack. Our lightweight approach incorporates an additional ephemeral public error term into key exchange materials, so that this attack no longer works. With the same attack, we practically show that the signal value of our protocol is indistinguishable from uniform random, therefore, this attack no longer works. We explain how the attack fails, present 200-bit classic and 80-bit quantum secure parameter choice, efficient implementations, comparisons and discussion. Benchmark shows our protocol is truly efficient and even faster than related vulnerable protocols.

IEEE Transactions on Computers•Feb 22, 2018•32 citations

Supersingular Isogeny and Ring Learning With Errors-Based Diffie-Hellman Cryptosystems: A Performance and Security Comparison

Claudio Téllez, Diogo Augusto Barros Pereira, Fábio Borges

The purpose of this work is to provide a complexity analysis of the trade-off between performance and security for two post-quantum cryptosystems: isogeny cryptosystems based on supersingular elliptic curves (SSI) and the lattice-based ring learning with errors key exchange (RLWE), considered to be secure against quantum attacks.The intractability of the Computational Supersingular Isogeny Problem (CSSIP) and of the Decisional Supersingular Product Problem (DSSPP) form the basis of the security for cryptosystems based on isogenies between supersingular elliptic curves.As for the RLWE cryptosystem, its security rests on the hardness of the Learning With Errors problem, proven to be as hard as the Shortest Vector Problem (SVP).We analyze the tradeoff between performance and security for both SSI and RLWE cryptosystems in comparison with Discrete Logarithm Problem (DLP) and Integer Factorization Problem (IFP).As complexities increase for the attack algorithms when the key lengths become longer, RLWE outperforms all the other algorithms (including SSI) regarding key sizes at practical security levels.

•Jan 1, 2018•3 citations

Post-quantum key exchange for the TLS protocol from the ring learning with errors problem.

Joppe W. Bos, Craig Costello, Michael Naehrig +1 more

Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. We demonstrate the practicality of post-quantum key exchange by constructing cipher suites for the Transport Layer Security (TLS) protocol that provide key exchange based on the ring learning with errors (R-LWE) problem, we accompany these cipher suites with a rigorous proof of security. Our approach ties lattice-based key exchange together with traditional authentication using RSA or elliptic curve digital signatures: the post-quantum key exchange provides forward secrecy against future quantum attackers, while authentication can be provided using RSA keys that are issued by today's commercial certificate authorities, smoothing the path to adoption. Our cryptographically secure implementation, aimed at the 128-bit security level, reveals that the performance price when switching from non-quantum-safe key exchange is not too high. With our R-LWE cipher suites integrated into the Open SSL library and using the Apache web server on a 2-core desktop computer, we could serve 506 RLWE-ECDSA-AES128-GCM-SHA256 HTTPS connections per second for a 10 KiB payload. Compared to elliptic curve Diffie-Hellman, this means an 8 KiB increased handshake size and a reduction in throughput of only 21%. This demonstrates that provably secure post-quantum key-exchange can already be considered practical.

•Jan 1, 2014•8 citations

Key Exchange is an essential primitive in cryptography that originated from the breakthrough idea of Diffie Hellman (DH) protocol presented in 1976.Following this work, there are many successful variants of DH using Elliptic curves, Isogeny and RLWE (Ring Learning with Errors).The Ring-Leaning with Errors (RLWE), Search and Decision version are hard problems in mathematics and it has been shown that solving worst case hard problems in ideal lattices can be reduced to solving RLWE in the average case.The reduction forms the basis of provable security for RLWE based key exchange against passive adversaries.The hardness of the decision version of RLWE, which means indistinguishability of RLWE samples from Uniform, makes it challenging to validate a RLWE form public key.This proves to be an advantage for malicious users to create public keys that deviate from a protocol to recover the secret of reused keys in Key Exchange (KE) protocols.In this thesis, we provide a cryptanalysis of RLWE key exchange, presenting two polynomial time strategies to exploit key reuse.Then we propose a defense against such exploits by presenting a Zero Knowledge authentication protocol to verify the prover's knowledge of a secret corresponding to his public key.The protocol is Statistical Zero Knowledge with negligible soundness and completeness errors so that the prover does not reveal any information about the secret in the proof.This is to ensure that a malicious verifier cannot impersonate the prover after the proof.The authentication protocol uses the signal function defined in RLWE key exchange to perform the verification.Firstly, I would like to express my gratitude to my advisor Prof.Ding for his expert advice, strong encouragement and support throughout my PhD study

This note describes a key exchange method based on the ring-LWE (RLWE) assumption. It builds upon several results, including Regev's landmark quantum reduction from certain worst case lattice problems (approx. GapSVP and SIVP) to random instances of the search variant of a particular learning problem (LWE). It also builds on the follow on work of Lyubashevsky, Peikert and Regev on the average case hardness of the RLWE search variant for polynomially bounded numbers of RLWE samples, along with novel applications of automorphism groups in number fields for a RLWE search to decision reduction (thereby demonstrating pseudorandomness of RLWE in these number fields). Subsequently, these results were adopted for the construction of Diffie-Hellman like key exchange methods by Peikert, and then by Lindner and Peikert followed by Ding and then by Ding, Xie and Lin who proposed efficient variants of such protocols. Subsequent work by Peikert proposed another efficient variant, phrased as a key encapsulation method, incorporating a low bandwidth reconciliation technique allowing two parties to exactly agree on a uniformly distributed secret value from noisy RLWE instances. This was followed by a concrete instantiation with parameter sets by Bos, Costello, Naehrig, Stebila, followed by another instantiation by Alkim, Ducas, Poppelmann and Schwabe with the same ring polynomial but a smaller modulus and a different reconciliation method. Unlike most other public key cryptography based key exchange methods, it is believed that RLWE based key exchange would remain secure in the event that an adversary is able to build a quantum computer. This document is a product of the Crypto Forum Research Group (CFRG).

In this paper, we show that the signal function used in Ring-Learning with Errors (RLWE) key exchange could leak information to find the secret s of a reused public key p = as+2e. This work is motivated by an attack proposed in [1] and gives an insight into how public keys reused for long term in RLWE key exchange protocols can be exploited. This work specifically focuses on the attack on the KE protocol in [2] by initiating multiple sessions with the honest party and analyze the output of the signal function. Experiments have confirmed the success of our attack in recovering the secret.

Ring learning with errors (RLWE) is used to construct anti-quantum key exchange protocols cryptography algorithms, which is hard to solve for quantum computers. In this work, we provide a certificateless authenticated key exchange protocol based on RLWE problem. This proposed protocol implements user identity authentication by certificateless public key cryptosystem, and uses Ding error reconciled function to eliminate the error caused by the introduction of interference term in RLWE problem. We analyzed the correctness of the protocol in detail, and proved the security of the protocol under the improved extended Canetti-Krawczyk (eCK) security model.

Ring Learning With Errors (RLWE)-based key exchange is one of the most efficient and secure primitive for post-quantum cryptography. One common approach to achieve key exchange over RLWE is error reconciliation. Recently, an efficient attack against reconciliation-based RLWE key exchange protocols with reused keys was proposed. This attack can recover a long-term private key if a key pair is reused. We also know that in the real world, key reuse is commonly adopted in applications like the Transport Layer Security (TLS) protocol to improve performance. Directly motivated by this attack, we construct a new randomized RLWE-based key exchange protocol against this attack. Our lightweight approach incorporates an additional ephemeral public error term into key exchange materials, so that this attack no longer works. With the same attack, we practically show that the signal value of our protocol is indistinguishable from uniform random, therefore, this attack no longer works. We explain how the attack fails, present 200-bit classic and 80-bit quantum secure parameter choice, efficient implementations, comparisons and discussion. Benchmark shows our protocol is truly efficient and even faster than related vulnerable protocols.

The purpose of this work is to provide a complexity analysis of the trade-off between performance and security for two post-quantum cryptosystems: isogeny cryptosystems based on supersingular elliptic curves (SSI) and the lattice-based ring learning with errors key exchange (RLWE), considered to be secure against quantum attacks.The intractability of the Computational Supersingular Isogeny Problem (CSSIP) and of the Decisional Supersingular Product Problem (DSSPP) form the basis of the security for cryptosystems based on isogenies between supersingular elliptic curves.As for the RLWE cryptosystem, its security rests on the hardness of the Learning With Errors problem, proven to be as hard as the Shortest Vector Problem (SVP).We analyze the tradeoff between performance and security for both SSI and RLWE cryptosystems in comparison with Discrete Logarithm Problem (DLP) and Integer Factorization Problem (IFP).As complexities increase for the attack algorithms when the key lengths become longer, RLWE outperforms all the other algorithms (including SSI) regarding key sizes at practical security levels.

Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. We demonstrate the practicality of post-quantum key exchange by constructing cipher suites for the Transport Layer Security (TLS) protocol that provide key exchange based on the ring learning with errors (R-LWE) problem, we accompany these cipher suites with a rigorous proof of security. Our approach ties lattice-based key exchange together with traditional authentication using RSA or elliptic curve digital signatures: the post-quantum key exchange provides forward secrecy against future quantum attackers, while authentication can be provided using RSA keys that are issued by today's commercial certificate authorities, smoothing the path to adoption. Our cryptographically secure implementation, aimed at the 128-bit security level, reveals that the performance price when switching from non-quantum-safe key exchange is not too high. With our R-LWE cipher suites integrated into the Open SSL library and using the Apache web server on a 2-core desktop computer, we could serve 506 RLWE-ECDSA-AES128-GCM-SHA256 HTTPS connections per second for a 10 KiB payload. Compared to elliptic curve Diffie-Hellman, this means an 8 KiB increased handshake size and a reduction in throughput of only 21%. This demonstrates that provably secure post-quantum key-exchange can already be considered practical.