Abstract:Lattice cryptography schemes based on the learning with errors (LWE) hardness assumption have been standardized by NIST for use as post-quantum cryptosystems, and by <a class="link-external link-http" href="http://HomomorphicEncryption.org" rel="external noopener nofollow">this http URL</a> for encrypted compute on sensitive data. Thus, understanding their concrete security is critical. Most work on LWE security focuses on theoretical estimates of attack performance, which is important but may overlook attack nuances arising in real-world implementations. The sole existing concrete benchmarking effort, the Darmstadt Lattice Challenge, does not include benchmarks relevant to the standardized LWE parameter choices - such as small secret and small error distributions, and Ring-LWE (RLWE) and Module-LWE (MLWE) variants. To improve our understanding of concrete LWE security, we provide the first benchmarks for LWE secret recovery on standardized parameters, for small and low-weight (sparse) secrets. We evaluate four LWE attacks in these settings to serve as a baseline: the Search-LWE attacks uSVP, SALSA, and Cool & Cruel, and the Decision-LWE attack: Dual Hybrid Meet-in-the-Middle (MitM). We extend the SALSA and Cool & Cruel attacks in significant ways, and implement and scale up MitM attacks for the first time. For example, we recover hamming weight $9-11$ binomial secrets for KYBER ($\kappa=2$) parameters in $28-36$ hours with SALSA and Cool\&Cruel, while we find that MitM can solve Decision-LWE instances for hamming weights up to $4$ in under an hour for Kyber parameters, while uSVP attacks do not recover any secrets after running for more than $1100$ hours. We also compare concrete performance against theoretical estimates. Finally, we open source the code to enable future research.

On the provable security of BEAR and LION schemes

Security Analysis Of Block Cipher Bear

A practical forgery and state recovery attack on the authenticated cipher PANDA-s.

Persistence Wears down Resistance: Persistent Fault Analysis on Unprotected and Protected Block Cipher Implementations (Extended Abstract)

A First Step to Provable Security in Block Ciphers against Side Channel Attacks

Algebraic, Aida/Cube And Side Channel Analysis Of Katan Family Of Block Ciphers

When "Competency" in Reasoning Opens the Door to Vulnerability: Jailbreaking LLMs via Novel Complex Ciphers

Benchmarking Attacks on Learning with Errors

Security Analysis of PRINCE.

Mathematical Backdoors in Symmetric Encryption Systems - Proposal for a Backdoored AES-like Block Cipher

Cryptographic Reverse Firewalls for Identity-Based Encryption.

ZLR: a fast online authenticated encryption scheme achieving full security

Formal Analysis of CRT-RSA Vigilant's Countermeasure Against the BellCoRe Attack: A Pledge for Formal Methods in the Field of Implementation Security

Ciphertext Malleability in Lattice-Based KEMs as a Countermeasure to Side Channel Analysis

Linear Cryptanalysis Of Aria Block Cipher

Leakage-Resilient IBE/ABE with Optimal Leakage Rates from Lattices

RESAA: A Removal and Structural Analysis Attack Against Compound Logic Locking

Linear Cryptanalysis Against Block Ciphered System under Noisy Ciphertexts.

Impossibility of Indifferentiable Iterated Blockciphers from 3 or Less Primitive Calls.

Public Key Cryptosystems Secure Against Memory Leakage Attacks

EasyBC: A Cryptography-Specific Language for Security Analysis of Block Ciphers against Differential Cryptanalysis