Skip to main content Accessibility help
×
Home

On error distributions in ring-based LWE

  • Wouter Castryck (a1) (a2), Ilia Iliashenko (a3) and Frederik Vercauteren (a4) (a5)

Abstract

Since its introduction in 2010 by Lyubashevsky, Peikert and Regev, the ring learning with errors problem (ring-LWE) has become a popular building block for cryptographic primitives, due to its great versatility and its hardness proof consisting of a (quantum) reduction from ideal lattice problems. But, for a given modulus $q$ and degree $n$ number field $K$ , generating ring-LWE samples can be perceived as cumbersome, because the secret keys have to be taken from the reduction mod $q$ of a certain fractional ideal ${\mathcal{O}}_{K}^{\vee }\subset K$ called the codifferent or ‘dual’, rather than from the ring of integers ${\mathcal{O}}_{K}$ itself. This has led to various non-dual variants of ring-LWE, in which one compensates for the non-duality by scaling up the errors. We give a comparison of these versions, and revisit some unfortunate choices that have been made in the recent literature, one of which is scaling up by ${|\unicode[STIX]{x1D6E5}_{K}|}^{1/2n}$ with $\unicode[STIX]{x1D6E5}_{K}$ the discriminant of $K$ . As a main result, we provide, for any $\unicode[STIX]{x1D700}>0$ , a family of number fields $K$ for which this variant of ring-LWE can be broken easily as soon as the errors are scaled up by ${|\unicode[STIX]{x1D6E5}_{K}|}^{(1-\unicode[STIX]{x1D700})/n}$ .

    • Send article to Kindle

      To send this article to your Kindle, first ensure no-reply@cambridge.org is added to your Approved Personal Document E-mail List under your Personal Document Settings on the Manage Your Content and Devices page of your Amazon account. Then enter the ‘name’ part of your Kindle email address below. Find out more about sending to your Kindle. Find out more about sending to your Kindle.

      Note you can select to send to either the @free.kindle.com or @kindle.com variations. ‘@free.kindle.com’ emails are free but can only be sent to your device when it is connected to wi-fi. ‘@kindle.com’ emails can be delivered even when you are not connected to wi-fi, but note that service fees apply.

      Find out more about the Kindle Personal Document Service.

      On error distributions in ring-based LWE
      Available formats
      ×

      Send article to Dropbox

      To send this article to your Dropbox account, please select one or more formats and confirm that you agree to abide by our usage policies. If this is the first time you use this feature, you will be asked to authorise Cambridge Core to connect with your <service> account. Find out more about sending content to Dropbox.

      On error distributions in ring-based LWE
      Available formats
      ×

      Send article to Google Drive

      To send this article to your Google Drive account, please select one or more formats and confirm that you agree to abide by our usage policies. If this is the first time you use this feature, you will be asked to authorise Cambridge Core to connect with your <service> account. Find out more about sending content to Google Drive.

      On error distributions in ring-based LWE
      Available formats
      ×

Copyright

References

Hide All
1. Brakerski, Z., Gentry, C. and Vaikunthanathan, V., ‘(Leveled) Fully homomorphic encryption without bootstrapping’, Proceedings of the 3rd Innovations in Theoretical Computer Science Conference – ITCS ’12 (ACM, New York, NY, 2012) 309325.
2. Brakerski, Z., Langlois, A., Peikert, C., Regev, O. and Stehlé, D., ‘Classical hardness of learning with errors’, ACM Symposium on the Theory of Computing – STOC ’13 (ACM, New York, NY, 2013) 575584.
3. Brakerski, Z. and Vaikunthanathan, V., ‘Efficient fully homomorphic encryption from (standard) LWE’, Proceedings of the 2011 IEEE 52nd Annual Symposium on Foundations of Computer Science – FOCS ’11 (IEEE, Washington, DC, 2011) 97106.
4. Castryck, W., Iliashenko, I. and Vercauteren, F., ‘Provably weak instances of Ring-LWE revisited’, Advances in cryptology – EUROCRYPT 2016 , Lecture Notes in Computer Science 9665(1) (Springer, New York, NY, 2016) 147167.
5. Chen, H., Lauter, K. and Stange, K., ‘Attacks on search RLWE’, Cryptology ePreprint Archive, Report 2015/971 2015.
6. Chen, H., Lauter, K. and Stange, K., ‘Vulnerable Galois RLWE families and improved attacks’, Proceedings of Selected Areas in Cryptography (SAC 2016, St. John’s, Canada), Lecture Notes in Computer Science (Springer, New York, NY, to appear); Cryptology ePreprint Archive, Report 2016/193 2016.
7. Crockett, E. and Peikert, C., ‘ $\unicode[STIX]{x1D6EC}\circ \unicode[STIX]{x1D706}$ : A functional library for lattice cryptography’, Cryptology ePreprint Archive, Report 2015/1134 2015.
8. Davenport, H., Multiplicative number theory , 2nd edn, Graduate Texts in Mathematics 74 (Springer, New York, NY, 2000) (revised by H. Montgomery).
9. de Smit, B., ‘A differential criterion for complete intersections’, Journées Arithmétiques 1995, Collect. Math. 48 (1997) no. 1–2, 8596.
10. Eisenträger, K., Hallgren, S. and Lauter, K., ‘Weak instances of PLWE’, Selected areas in cryptography – SAC 2014 , Lecture Notes in Computer Science 8781 (Springer, New York, NY, 2014) 183194.
11. Elias, Y., Lauter, K., Ozman, E. and Stange, K., ‘Provably weak instances of Ring-LWE’, Advances in cryptology – CRYPTO ’15 , Lecture Notes in Computer Science 9215 (Springer, New York, NY, 2015) 6392.
12. Fröhlich, A. and Taylor, M., Algebraic number theory , Cambridge Studies in Advances Mathematics 27 (Cambridge University Press, Cambridge, 1991).
13. Gentry, C., ‘Key recovery and message attacks on NTRU-Composite’, EUROCRYPT ’01 , Lecture Notes in Computer Science 2045 (Springer, New York, NY, 2001) 182194.
14. Hoffstein, J., Pipher, J. and Silverman, J. H., ‘NTRU: a ring-based public key cryptosystem’, Proceedings of the Third International Symposium on Algorithmic Number Theory – ANTS-III , Lecture Notes in Computer Science 1423 (Springer, New York, NY, 1998) 267288.
15. Johnston, H., ‘Notes on Galois modules’, Notes accompanying the course ‘Galois Modules’ given in Cambridge (2011), https://www.dpmms.cam.ac.uk/∼hlj31/GM_CourseNotes101.pdf [accessed 22 July 2016].
16. Lyubashevsky, V., Peikert, C. and Regev, O., ‘On ideal lattices and learning with errors over rings’, J. ACM 60 (2013) no. 6, article 43, 35.
17. Peikert, C., ‘Public-key cryptosystems from the worst-case shortest vector problem’, ACM Symposium on the Theory of Computing – STOC ’09 (ACM, New York, NY, 2009) 333342.
18. Peikert, C., ‘How (not) to instantiate Ring-LWE’, Cryptology ePrint Archive, Report 2016/351 2016.
19. Regev, O., ‘On lattices, learning with errors, random linear codes, and cryptography’, J. ACM 56 (2009) no. 6, article 34, 40.
20. Shor, P., ‘Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer’, SIAM J. Comput. 26 (1997) no. 5, 14841509.
21. Washington, L., Introduction to cyclotomic fields , Graduate Texts in Mathematics 83 (Springer, New York, NY, 1982).
MathJax
MathJax is a JavaScript display engine for mathematics. For more information see http://www.mathjax.org.

MSC classification

Metrics

Full text views

Total number of HTML views: 0
Total number of PDF views: 0 *
Loading metrics...

Abstract views

Total abstract views: 0 *
Loading metrics...

* Views captured on Cambridge Core between <date>. This data will be updated every 24 hours.

Usage data cannot currently be displayed