© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

Ataques e vulnerabilidades no NewHope KEM e no problema Ring-LWE

Reynaldo Caceres Villena

Published Oct 18, 2024• 0 citations

Abstract

There are cryptographic systems that are secure against attacks by both classical and quantum computers. One of these systems is the NewHope key encapsulation mechanism (KEM) based on the Ring-learning with error problem (Ring-LWE problem). The Ring-LWE problem is presumed to be hard to solve even on a quantum computer. A KEM scheme allows sharing of a common key between two parts (Alice & Bob). This thesis presents original contributions to the security and analysis of key mismatch and information leakage attacks on NewHope KEM and some vulnerabilities on (small)-Ring-LWE problem (a variant of Ring-LWE problem). The first contribution contains some improvements on key mismatch attacks proposed by Bauer et al. and Qin et al. (Bauer et al., 2019; Qin et al., 2019). These key mismatch attacks retrieve Alices secret key. And, we propose two new methods named Fast Qin and Double Qin. The methods Fast Qin and Double Qin require around 240k and 34k oracle queries, respectively; instead of 840k queries of the Qin et al.s method. Moreover, these two new methods are adapted to retrieve Alices secret key on NewHope-512 (a variant of NewHope). The second contribution analyzes the information leakage of Bobs secret key on NewHope when it is reused. Our result corroborates that Bobs secret key must not be reused since with two communications to Bob, his secret key is leaked. In Ring-LWE problem, a polynomial a is selected randomly and a polynomial b is calculated as b = a.s+e where s is the secret polynomial (selected randomly) and the e is a noise polynomial. Our third contribution shows that in small-Ring-LWE, a variant where polynomials s and e are small, there are values of the public parameter a that leak a large percentage of the coefficients of the secret s. And, the last contribution shows that the secret s can be retrieved successfully if at least 50% of the random known coefficients of s and e are known.

Related papers

Analysis of Error Dependencies on Newhope

Minki Song, Seunghwan Lee, Dong‐Joon Shin +3 more

Among many submissions to NIST post-quantum cryptography (PQC) project, NewHope is a promising key encapsulation mechanism (KEM) based on the Ring-Learning with errors (Ring-LWE) problem. Since NewHope is an indistinguishability (IND)-chosen ciphertext attack secure KEM by applying the Fujisaki-Okamoto transform to an IND-chosen plaintext attack secure public-key encryption, accurate calculation of decryption failure rate (DFR) is required to guarantee resilience against attacks that exploit decryption failures. However, the current upper bound (UB) on DFR of NewHope is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and the approximation effect of centered binomial distribution are not fully considered. Furthermore, since NewHope is a Ring-LWE based cryptography, there is a problem of error dependency among error coefficients, which makes accurate DFR calculation difficult. In this paper, we derive much tighter UB on DFR than the current UB by using constraint relaxation and union bound. Especially, the above-mentioned factors are all considered in the derivation of new UB and the centered binomial distribution is not approximated. Since the error dependency is also considered, the new UB is much closer to the real DFR than the current UB. Furthermore, the new UB is parameterized by using Chernoff-Cramer bound to facilitate the calculation of new UB for the parameters of NewHope. Since the new UB is much lower than the DFR requirement of PQC, this DFR margin can be used to improve NewHope. As a result, the security level and bandwidth efficiency of NewHope are improved by 7.2 % and 5.9 %, respectively.

arXiv:1910.00432•IEEE Access•Jan 1, 2020•7 citations

The Importance of the Public Global Parameter on Ring-LWE problem-based Key Encapsulation Mechanims

Reynaldo Caceres Villena, Routo Terada

There are cryptographic systems that are secure against attacks by both quantum and classical computers. Some of these cryptographic systems are the Key Encapsulation Mechanisms (KEM) based on Ring-LWE problem. Some Ring-LWE problem-based KEMs include a public global parameter that is random and uniformly chosen. This parameter is used to generatea public key using in the process one secret key. In this work, we analyze some values of the public global parameter that leak information about the secret key.

Simpósio Brasileiro de Cibersegurança (SBSeg)•Sep 12, 2022•0 citations

Key exchange system - NewHope

Δέσποινα-Στυλιανή-Αρίστη Γεωργίου Χαμαλάκη

In this work, we initially present in Chapter 1 the theoretical background of the LWE problem. Chapter 2 describes in depth the NewHope post-quantum lattice-based cryptosystem, which is based on a variant of LWE called Ring Learning With Errors (RLWE). Chapter 3 analyses two key reuse attacks on NewHope as published in literature and our implementation of them.

•Jan 1, 2020•0 citations

Design and Analysis of Post Quantum Secure Ideal Lattice Based Key Encapsulation Mechanism for Mobile Communication System

Pradeep Kumar Dadsena, Madireddy H. V. S. P. Reddy, Saurabh Rana +3 more

Post Quantum Key Encapsulation Mechanism (PKEM) is used to securely exchange symmetric keys over an insecure channel. It allows two parties to establish a shared secret key, which can then be used for symmetric encryption, ensuring confidentiality against quantum attacks. By encapsulating the key, it reduces the need to directly encrypt large amounts of data with the public key, which is computationally expensive. Traditional cryptographic tools, while effective, are complex and susceptible to quantum attacks. This paper contains a robust and lightweight post-quantum security solution, and their performance analysis. The authentication scheme, based on Ring-Learning with Errors (Ring-LWE), uses Bernstein reconstruction in polynomial multiplication to significantly lower computational costs, enabling even resource-limited mobile devices to achieve secure mutual authentication. This paper also contains an analysis of post-quantum key encapsulation mechanism (PKEM), and it also covers design, security, and real-world implementation issues and provides a prospective outlook on PKEM, taking into account current investigations, possible innovations, and the changing field of quantum computing. The proposed work also offers a thorough investigation of the security features of post-quantum KEMs, together with theoretical and practical concerns.

International Conference on Innovative Sustainable Computational Technologies (CISCT)•Dec 27, 2024•0 citations

Analysis of BCNS and Newhope Key-exchange Protocols

Seyedamirhossein Hesamian

Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. Following increasing interest from both companies and government agencies in building quantum computers, a number of works have proposed instantiations of practical post-quantum key-exchange protocols based on hard problems in lattices, mainly based on the Ring Learning With Errors (R-LWE) problem.\nIn this work we present an analysis of Ring-LWE based key-exchange mechanisms and compare two implementations of Ring-LWE based key-exchange protocol: BCNS and NewHope. This is important as NewHope protocol implementation outperforms state-of-the art elliptic curve based Diffie-Hellman key-exchange X25519, thus showing that using quantum safe key-exchange is not only a viable option but also a faster one. Specifically, this thesis compares different reconciliation methods, parameter choices, noise sampling algorithms and performance.

•Jan 1, 2017•1 citation

Compact and Flexible KEM From Ideal Lattice

Zhengzhong Jin, Shiyu Shen, Yunlei Zhao

A remarkable breakthrough in mathematics in recent years is the proof of the long-standing conjecture: sphere packing in the$E_{8}$lattice is optimal in the sense of the best density for sphere packing in$\mathbb {R}^{8}$. In this work, we design a mechanism for asymmetric key consensus from noise (AKCN), referred to as AKCN-E8, for error correction and key consensus. As a direct application, we present a practical key encapsulation mechanism (KEM) from the ideal lattice based on the ring learning with errors (RLWE) problem. Compared with NewHope-KEM that was the second round candidate of the National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) standardization, our AKCN-E8 KEM scheme overcomes some limitations and shortcomings of NewHope-KEM. Compared with some other dominating KEM schemes based on the variants of LWE, specifically Kyber and Saber, AKCN-E8 has a comparable performance but enjoys much flexible shared-key sizes. Specifically, the key encapsulated by AKCN-E8-512 (resp., 768, 1024) has the size of 256 (resp., 384, 512) bits. Flexible key size renders us stronger security against quantum attacks, more powerful and economic ability of key transportation, and better matches the demand in interactive protocols like TLS where parties need to negotiate the security parameters including the shared key length.

IEEE Transactions on Information Theory•Feb 1, 2022•7 citations

There are cryptographic systems that are secure against attacks by both classical and quantum computers. One of these systems is the NewHope key encapsulation mechanism (KEM) based on the Ring-learning with error problem (Ring-LWE problem). The Ring-LWE problem is presumed to be hard to solve even on a quantum computer. A KEM scheme allows sharing of a common key between two parts (Alice & Bob). This thesis presents original contributions to the security and analysis of key mismatch and information leakage attacks on NewHope KEM and some vulnerabilities on (small)-Ring-LWE problem (a variant of Ring-LWE problem). The first contribution contains some improvements on key mismatch attacks proposed by Bauer et al. and Qin et al. (Bauer et al., 2019; Qin et al., 2019). These key mismatch attacks retrieve Alices secret key. And, we propose two new methods named Fast Qin and Double Qin. The methods Fast Qin and Double Qin require around 240k and 34k oracle queries, respectively; instead of 840k queries of the Qin et al.s method. Moreover, these two new methods are adapted to retrieve Alices secret key on NewHope-512 (a variant of NewHope). The second contribution analyzes the information leakage of Bobs secret key on NewHope when it is reused. Our result corroborates that Bobs secret key must not be reused since with two communications to Bob, his secret key is leaked. In Ring-LWE problem, a polynomial a is selected randomly and a polynomial b is calculated as b = a.s+e where s is the secret polynomial (selected randomly) and the e is a noise polynomial. Our third contribution shows that in small-Ring-LWE, a variant where polynomials s and e are small, there are values of the public parameter a that leak a large percentage of the coefficients of the secret s. And, the last contribution shows that the secret s can be retrieved successfully if at least 50% of the random known coefficients of s and e are known.

Among many submissions to NIST post-quantum cryptography (PQC) project, NewHope is a promising key encapsulation mechanism (KEM) based on the Ring-Learning with errors (Ring-LWE) problem. Since NewHope is an indistinguishability (IND)-chosen ciphertext attack secure KEM by applying the Fujisaki-Okamoto transform to an IND-chosen plaintext attack secure public-key encryption, accurate calculation of decryption failure rate (DFR) is required to guarantee resilience against attacks that exploit decryption failures. However, the current upper bound (UB) on DFR of NewHope is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and the approximation effect of centered binomial distribution are not fully considered. Furthermore, since NewHope is a Ring-LWE based cryptography, there is a problem of error dependency among error coefficients, which makes accurate DFR calculation difficult. In this paper, we derive much tighter UB on DFR than the current UB by using constraint relaxation and union bound. Especially, the above-mentioned factors are all considered in the derivation of new UB and the centered binomial distribution is not approximated. Since the error dependency is also considered, the new UB is much closer to the real DFR than the current UB. Furthermore, the new UB is parameterized by using Chernoff-Cramer bound to facilitate the calculation of new UB for the parameters of NewHope. Since the new UB is much lower than the DFR requirement of PQC, this DFR margin can be used to improve NewHope. As a result, the security level and bandwidth efficiency of NewHope are improved by 7.2 % and 5.9 %, respectively.

There are cryptographic systems that are secure against attacks by both quantum and classical computers. Some of these cryptographic systems are the Key Encapsulation Mechanisms (KEM) based on Ring-LWE problem. Some Ring-LWE problem-based KEMs include a public global parameter that is random and uniformly chosen. This parameter is used to generatea public key using in the process one secret key. In this work, we analyze some values of the public global parameter that leak information about the secret key.

Post Quantum Key Encapsulation Mechanism (PKEM) is used to securely exchange symmetric keys over an insecure channel. It allows two parties to establish a shared secret key, which can then be used for symmetric encryption, ensuring confidentiality against quantum attacks. By encapsulating the key, it reduces the need to directly encrypt large amounts of data with the public key, which is computationally expensive. Traditional cryptographic tools, while effective, are complex and susceptible to quantum attacks. This paper contains a robust and lightweight post-quantum security solution, and their performance analysis. The authentication scheme, based on Ring-Learning with Errors (Ring-LWE), uses Bernstein reconstruction in polynomial multiplication to significantly lower computational costs, enabling even resource-limited mobile devices to achieve secure mutual authentication. This paper also contains an analysis of post-quantum key encapsulation mechanism (PKEM), and it also covers design, security, and real-world implementation issues and provides a prospective outlook on PKEM, taking into account current investigations, possible innovations, and the changing field of quantum computing. The proposed work also offers a thorough investigation of the security features of post-quantum KEMs, together with theoretical and practical concerns.

Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. Following increasing interest from both companies and government agencies in building quantum computers, a number of works have proposed instantiations of practical post-quantum key-exchange protocols based on hard problems in lattices, mainly based on the Ring Learning With Errors (R-LWE) problem.\nIn this work we present an analysis of Ring-LWE based key-exchange mechanisms and compare two implementations of Ring-LWE based key-exchange protocol: BCNS and NewHope. This is important as NewHope protocol implementation outperforms state-of-the art elliptic curve based Diffie-Hellman key-exchange X25519, thus showing that using quantum safe key-exchange is not only a viable option but also a faster one. Specifically, this thesis compares different reconciliation methods, parameter choices, noise sampling algorithms and performance.

A remarkable breakthrough in mathematics in recent years is the proof of the long-standing conjecture: sphere packing in the

E_{8}

lattice is optimal in the sense of the best density for sphere packing in

\mathbb {R}^{8}

. In this work, we design a mechanism for asymmetric key consensus from noise (AKCN), referred to as AKCN-E8, for error correction and key consensus. As a direct application, we present a practical key encapsulation mechanism (KEM) from the ideal lattice based on the ring learning with errors (RLWE) problem. Compared with NewHope-KEM that was the second round candidate of the National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) standardization, our AKCN-E8 KEM scheme overcomes some limitations and shortcomings of NewHope-KEM. Compared with some other dominating KEM schemes based on the variants of LWE, specifically Kyber and Saber, AKCN-E8 has a comparable performance but enjoys much flexible shared-key sizes. Specifically, the key encapsulated by AKCN-E8-512 (resp., 768, 1024) has the size of 256 (resp., 384, 512) bits. Flexible key size renders us stronger security against quantum attacks, more powerful and economic ability of key transportation, and better matches the demand in interactive protocols like TLS where parties need to negotiate the security parameters including the shared key length.