Abstract:Lattice cryptography schemes based on the learning with errors (LWE) hardness assumption have been standardized by NIST for use as post-quantum cryptosystems, and by <a class="link-external link-http" href="http://HomomorphicEncryption.org" rel="external noopener nofollow">this http URL</a> for encrypted compute on sensitive data. Thus, understanding their concrete security is critical. Most work on LWE security focuses on theoretical estimates of attack performance, which is important but may overlook attack nuances arising in real-world implementations. The sole existing concrete benchmarking effort, the Darmstadt Lattice Challenge, does not include benchmarks relevant to the standardized LWE parameter choices - such as small secret and small error distributions, and Ring-LWE (RLWE) and Module-LWE (MLWE) variants. To improve our understanding of concrete LWE security, we provide the first benchmarks for LWE secret recovery on standardized parameters, for small and low-weight (sparse) secrets. We evaluate four LWE attacks in these settings to serve as a baseline: the Search-LWE attacks uSVP, SALSA, and Cool & Cruel, and the Decision-LWE attack: Dual Hybrid Meet-in-the-Middle (MitM). We extend the SALSA and Cool & Cruel attacks in significant ways, and implement and scale up MitM attacks for the first time. For example, we recover hamming weight $9-11$ binomial secrets for KYBER ($\kappa=2$) parameters in $28-36$ hours with SALSA and Cool\&Cruel, while we find that MitM can solve Decision-LWE instances for hamming weights up to $4$ in under an hour for Kyber parameters, while uSVP attacks do not recover any secrets after running for more than $1100$ hours. We also compare concrete performance against theoretical estimates. Finally, we open source the code to enable future research.

A Generalized Approach to Root-based Attacks against PLWE

Cryptanalysis of PLWE based on zero-trace quadratic roots

Lattice-based PKEs/KEMs

Trace-based cryptanalysis of cyclotomic $R_{q,0}\times R_q$-PLWE for the non-split case

Fast Multiplication and the PLWE-RLWE Equivalence for an Infinite Family of Cyclotomic Subextensions

Carry Your Fault: A Fault Propagation Attack on Side-Channel Protected LWE-based KEM

SALSA VERDE: a machine learning attack on Learning With Errors with sparse small secrets

Salsa Fresca: Angular Embeddings and Pre-Training for ML Attacks on Learning With Errors

Notes on Small Private Key Attacks on Common Prime RSA

SALSA PICANTE: a machine learning attack on LWE with binary secrets

Cryptanalysis of some Nonabelian Group-Based Key Exchange Protocols

Generalized Power Attacks against Crypto Hardware using Long-Range Deep Learning

Learning with Errors and Extrapolated Dihedral Cosets

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Differential Fault Attacks on Privacy Protocols Friendly Symmetric-Key Primitives: RAIN and HERA

Benchmarking Attacks on Learning with Errors

Trapdoor Delegation and HIBE from Middle-Product LWE in Standard Model

Further improvements of the estimation of key enumeration with applications to solving LWE

New Partial Key Exposure Attacks on CRT-RSA with Large Public Exponents.

A Systematic Approach and Analysis of Key Mismatch Attacks on Lattice-Based NIST Candidate KEMs

Practical Randomized RLWE-Based Key Exchange Against Signal Leakage Attack.