New cryptographic constructions using generalized LWE

Jintai Ding

2012-01-01

Abstract:We present first a generalized LWE problem, which is essentially to extend the original LWE to the case of matrices. Then we use this new version of LWE problem, which we call matrix LWE problem to build new cryptographic schemes, which include a new key distribution scheme, a new key exchanges scheme and a new simple identity-based encryption scheme.

What problem does this paper attempt to address?

LWE from non-commutative group rings

Qi Cheng,Jun Zhang,Jincheng Zhuang

DOI: https://doi.org/10.1007/s10623-021-00973-6

2021-11-24

Abstract:The Learning-With-Errors (LWE) problem (and its variants including Ring-LWE and Module-LWE), whose security are based on hard ideal lattice problems, has proven to be a promising primitive with diverse applications in cryptography. For the sake of expanding sources for constructing LWE, we study the LWE problem on group rings in this work. One can regard the Ring-LWE on cyclotomic integers as a special case when the underlying group is cyclic, while our proposal utilizes non-commutative groups. In particular, we show how to build public key encryption schemes from dihedral group rings, while maintaining the efficiency of the Ring-LWE. We prove that the PKC system is semantically secure, by providing a reduction from the SIVP problem of group ring ideal lattice to the decisional group ring LWE problem. It turns out that irreducible representations of groups play important roles here. We believe that the introduction of the representation view point enriches the tool set for studying the Ring-LWE problem.
A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem.

Jintai Ding

2012-01-01

Abstract:We use the learning with errors (LWE) problem to build a new simple and provably secure key exchange scheme. The basic idea of the construction can be viewed as certain extension of DiffieHellman problem with errors. The mathematical structure behind comes from the commutativity of computing a bilinear form in two different ways due to the associativity of the matrix multiplications: (x ×A) × y = x × (A× y), where x,y are column vectors and A is a square matrix. We show that our new schemes are more efficient in terms of communication and computation complexity compared with key exchange schemes or key transport schemes via encryption schemes based on the LWE problem. Furthermore, we extend our scheme to the ring learning with errors (RLWE) problem, resulting in small key size and better efficiency.
A Public Key Encryption Scheme Based on a New Variant of LWE with Small Cipher Size.

Ziqing Wang,Dianhua Tang,Haomiao Yang,Fagen Li

DOI: https://doi.org/10.1016/j.sysarc.2021.102165

IF: 5.836

2021-01-01

Journal of Systems Architecture

Abstract:The lattice cryptosystem is considered to be able to resist the attacks of quantum computers. Lattice-based Public Key Encryption (PKE) schemes have attracted the interest of many researchers. In lattice-based cryptography, Learning With Errors (LWE) problem is a hard problem usually used to construct PKE scheme. To ensure the correctness of decryption, LWE-based schemes have a large ciphertext size. This makes these encryption schemes not practical enough when the communication bandwidth is limited. We propose a new variant of LWE, named Learning With Modulus (LWM) and prove that the new problem can be reduced from LWE problem. The proof idea of our reduction is similar to the reduction of LWR problem. We also construct a new PKE scheme based on the proposed LWM and LWE, which has small ciphertext size. For a 128 bits plaintext, the ciphertext size of our scheme is 53.57% of Lindner–Peikert’s (LP) scheme under the same security level. We use python to test the performance of our scheme. The results show that our scheme is only about 0.015 ms slower than LP in the decryption. The performance of our scheme for generating keys and encrypting messages is similar to LP.
A Key Exchange Based on the Short Integer Solution Problem and the Learning with Errors Problem

Jintai Ding,Kevin Schmitt,Zheng Zhang

DOI: https://doi.org/10.1007/978-3-030-16458-4_8

2019-01-01

Abstract:Short integer solution (SIS) and learning with errors (LWE) are two hard lattice problems. These two problems are believed having huge potential in application of cryptography. In 2012, Ding et al. [5] introduced the first provably secure key exchange based on LWE problem. On the other hand, we believe that it is very difficult to do key exchange on SIS problem only. In 2014, Wang et al. [6] did an attempt, but it was not successful. Mao et al. [7] broke the protocol by an attack based on CBi-SIS problem in 2016. However, their attack is not efficient. In this paper, we present a extremely straightforward and simple attack to Wang’s key exchange and then we will construct a key exchange based on SIS and LWE problems.
New Lattice Based Cryptographic Constructions

Oded Regev

DOI: https://doi.org/10.48550/arXiv.cs/0309051

2003-09-29

Abstract:We introduce the use of Fourier analysis on lattices as an integral part of a lattice based construction. The tools we develop provide an elegant description of certain Gaussian distributions around lattice points. Our results include two cryptographic constructions which are based on the worst-case hardness of the unique shortest vector problem. The main result is a new public key cryptosystem whose security guarantee is considerably stronger than previous results ($O(n^{1.5})$ instead of $O(n^7)$). This provides the first alternative to Ajtai and Dwork's original 1996 cryptosystem. Our second result is a family of collision resistant hash functions which, apart from improving the security in terms of the unique shortest vector problem, is also the first example of an analysis which is not based on Ajtai's iterative step. Surprisingly, both results are derived from one theorem which presents two indistinguishable distributions on the segment $[0,1)$. It seems that this theorem can have further applications and as an example we mention how it can be used to solve an open problem related to quantum computation.

Cryptography and Security
Perturbed Hidden Matrix Cryptosystems

WU Zhi-ping,Jíntai Ding,Jason E. Gower,Dingfeng Ye

DOI: https://doi.org/10.1007/11424826_63

2005-01-01

Abstract:We apply internal perturbation [3] to the matrix-type cryptosystems [C n ] and HM constructed in [9]. Using small instances of these variants, we investigate the existence of linearization equations and degree 2 equations that could be used in a XL attack. Our results indicate that these new variants may be suitable for use in practical implementations. We propose a specific instance for practical implementation, and estimate its performance and security.
Hardness of (M)LWE with Semi-Uniform Seeds

Wenjuan Jia,Jiang Zhang,Binwu Xiang,Baocang Wang

DOI: https://doi.org/10.1016/j.tcs.2024.114481

IF: 1.002

2024-03-02

Theoretical Computer Science

Abstract:Let (D,S,χ,m)-LWEn,q be the LWE problem in matrix form (A,y=As+emodq) , where A,s,e are randomly chosen respectively from the seed distribution D over Zqm×n , secret distribution S over Zqn and noise distribution χm over Zm (or Rm ), i.e., A←D,s←S,e←χm . For various secret-noise distributions (S,χ) , the (D,S,χ,m)-LWEn,q problem is shown to be as hard as some standard worst-case lattice problems, but most of the known results require D to be the uniform distribution over Zqm×n . In this paper, we show that under the standard LWE assumption, the problem (D,S,χ,m)-LWEn,q can still be hard for some distribution D that is not (even computationally indistinguishable from) the uniform distribution over Zqm×n . Specifically, we show that if D is a semi-uniform distribution over Zqm×n (namely, D can be publicly derived from and has a "small difference" to the uniform distribution over Zqm×n ), then for appropriate choices of (S,χ) , the problem (D,S,χ,m)-LWEn,q is hard under the standard LWE assumption. Moreover, we also show that the semi-uniform MLWE problem is hard under the standard MLWE assumption. As a direct application, our results pave the way to prove the security of public-key encryptions with rounded public keys under the standard (M)LWE assumption.

computer science, theory & methods
Compact Lossy and All-but-One Trapdoor Functions from Lattice

Leixiao Cheng,Quanshui Wu,Yunlei Zhao

DOI: https://doi.org/10.1007/978-3-319-72359-4_16

2017-01-01

Abstract:Lossy trapdoor functions (LTDF) and all-but-one trapdoor functions (ABO-TDF) are fundamental cryptographic primitives. And given the recent advances in quantum computing, it would be much desirable to develop new and improved lattice-based LTDF and ABO-TDF. In this work, we provide more compact constructions of LTDF and ABO-TDF based on the learning with errors (LWE) problem. In addition, our LWE-based ABO-TDF can allow smaller system parameters to support super-polynomially many injective branches in the construction of CCA secure public key encryption. As a core building tool, we provide a more compact homomorphic symmetric encryption schemes based on LWE, which might be of independent interest. To further optimize the ABO-TDF construction, we employ the full rank difference encoding technique. As a consequence, the results presented in this work can substantially improve the performance of all the previous LWE-based cryptographic constructions based upon LTDF and ABO-TDF.
Compact Inner Product Encryption From Lwe

Zhedong Wang,Xiong Fan,Mingsheng Wang

DOI: https://doi.org/10.1007/978-3-319-89500-0_12

2017-01-01

Abstract:Predicate encryption provides fine-grained access control and has attractive applications. In this paper, We construct an compact inner product encryption scheme from the standard Learning with Errors (LWE) assumption that has compact public-key and achieves weakly attribute-hiding in the standard model. In particular, our scheme only needs two public matrices to support inner product over vector space Z(q)(log) (lambda), and (lambda/log lambda) public matrices to support vector space Z(q)(lambda).Our construction is the first compact functional encryption scheme based on lattice that goes beyond the very recent optimizations of public parameters in identity-based encryption setting. The main technique in our compact IPE scheme is a novel combination of IPE scheme of Agrawal, Freeman and Vaikuntanathan (Asiacrypt 2011), fully homomorphic encryption of Gentry, Sahai and Waters (Crypto 2013) and vector encoding schemes of Apon, Fan and Liu (Eprint 2017).
Algebraically Structured LWE, Revisited

Chris Peikert,Zachary Pepin

DOI: https://doi.org/10.1007/s00145-024-09508-3

2024-06-15

Journal of Cryptology

Abstract:In recent years, there has been a proliferation of algebraically structured Learning With Errors (LWE) variants, including Ring-LWE, Module-LWE, Polynomial-LWE, Order-LWE, and Middle-Product LWE, and a web of reductions to support their hardness, both among these problems themselves and from related worst-case problems on structured lattices. However, these reductions are often difficult to interpret and use, due to the complexity of their parameters and analysis, and most especially their (frequently large) blowup and distortion of the error distributions. In this paper, we unify and simplify this line of work. First, we give a general framework that encompasses all proposed LWE variants (over commutative base rings) and in particular unifies all prior "algebraic" LWE variants defined over number fields. We then use this framework to give much simpler, more general, and tighter reductions from Ring-LWE to other algebraic LWE variants, including Module-LWE, Order-LWE, and Middle-Product LWE. In particular, all of our reductions have easy-to-analyze and frequently small error expansion; in most cases, they even leave the error unchanged. A main message of our work is that it is straightforward to use the hardness of the original Ring-LWE problem as a foundation for the hardness of all other algebraic LWE problems defined over number fields, via simple and rather tight reductions.

computer science, theory & methods,engineering, electrical & electronic,mathematics, applied
A Linear Attack on a Key Exchange Protocol Using Extensions of Matrix Semigroups.

Jintai Ding,Alexei Miasnikov,Alexander Ushakov

2015-01-01

Abstract:In this paper we analyze the Kahrobaei-Lam-Shpilrain (KLS) key exchange protocols that use extensions by endomorpisms of matrices over a Galois field proposed in [2]. We show that both protocols are vulnerable to a simple linear algebra attack.
Generic and Practical Key Establishment from Lattice.

Zhengzhong Jin,Yunlei Zhao

DOI: https://doi.org/10.1007/978-3-030-21568-2_15

2019-01-01

Abstract:In this work, we abstract some key ingredients in previous key establishment and public-key encryption schemes from LWE and its variants. Specifically, we explicitly formalize the building tool, referred to as key consensus (KC) and its asymmetric variant AKC. KC and AKC allow two communicating parties to reach consensus from close values, which plays the fundamental role in lattice-based cryptography. We then prove the upper bounds on parameters for any KC and AKC, which reveal the inherent constraints on the parameters among security, bandwidth, error probability, and consensus range. As a conceptual contribution, this simplifies the design and analysis of these cryptosystems in the future. Guided by the proved upper bounds, we design and analyze both generic and highly practical KC and AKC schemes, which are referred to as OKCN and AKCN respectively for presentation simplicity. We present a generic protocol structure for key establishment from learning with rounding (LWR), which can be instantiated with either KC or AKC. We then provide an analysis breaking the correlation between the rounded deterministic noise and the secret, and design an algorithm to calculate the error probability numerically. When applied to LWEbased key establishment, OKCN and AKCN can result in more practical or well-balanced schemes, compared to existing LWE-based protocols in the literature.
Almost tight security in lattices with polynomial moduli—PRF, IBE, all-but-many LTF, and more

Liu, Feng-Hao

DOI: https://doi.org/10.1007/s10623-024-01523-6

IF: 1.4

2024-11-25

Designs Codes and Cryptography

Abstract:Achieving tight security is a fundamental task in cryptography. While one of the most important purposes of this task is to improve the overall efficiency of a construction (by allowing smaller security parameters), many current lattice-based instantiations do not completely achieve the goal. Particularly, a super-polynomial modulus seems to be necessary in all prior work for (almost) tight schemes that allow the adversary to conduct queries, such as PRF, IBE, and Signatures. As the super-polynomial modulus would affect the noise-to-modulus ratio and thus increase the parameters, this might cancel out the advantages (in efficiency) brought from the tighter analysis. To determine the full power of tight security/analysis in lattices, it is necessary to determine whether the super-polynomial modulus restriction is inherent. In this work, we remove the super-polynomial modulus restriction for many important primitives—PRF, IBE, all-but-many Lossy Trapdoor Functions, and Signatures. The crux relies on an improvement over the framework of Boyen and Li (Asiacrypt 16), and an almost tight reduction from LWE to LWR, which improves prior work by Alwen et al. (Eurocrypt 13), Bogdanov et al. (TCC 16), and Bai et al. (Asiacrypt 15). By combining these two advances, we are able to derive these almost tight schemes under LWE with a polynomial modulus.

mathematics, applied,computer science, theory & methods
Deterministic Identity-Based Encryption from Lattices with More Compact Public Parameters.

Daode Zhang,Fuyang Fang,Bao Li,Xin Wang

DOI: https://doi.org/10.1007/978-3-319-64200-0_13

2017-01-01

Abstract:Xie et al. (SCN 2012) proposed the first deterministic identity-based encryption (DIBE) scheme with an adaptive security in the auxiliary-input setting, under the learning with errors (LWE) assumption. However, the master public key consists of O(lambda) number of basic matrices. In this paper, we consider to construct adaptively secure DIBE schemes from partitioning functions (IACR'17). By instantiating the DIBE construction with two partitioning functions, we get two DIBE schemes in which the master public key consists of O(log(3) lambda) (respectively, O(log(2) lambda)) number of basic matrices in the first (respectively, the second) DIBE scheme. We also change the identity-based encryption (IBE) scheme of Yamada16 (Eurocrypt'16) to construct DIBE scheme with the same security from the LWE problem. And the master public key consists of O(lambda(1/d)) number of basic matrices, where d >= 2 is a flexible integer.
The cool and the cruel: separating hard parts of LWE secrets

Niklas Nolte,Mohamed Malhou,Emily Wenger,Samuel Stevens,Cathy Li,François Charton,Kristin Lauter

2024-10-10

Abstract:Sparse binary LWE secrets are under consideration for standardization for Homomorphic Encryption and its applications to private computation. Known attacks on sparse binary LWE secrets include the sparse dual attack and the hybrid sparse dual-meet in the middle attack which requires significant memory. In this paper, we provide a new statistical attack with low memory requirement. The attack relies on some initial lattice reduction. The key observation is that, after lattice reduction is applied to the rows of a q-ary-like embedded random matrix $\mathbf A$, the entries with high variance are concentrated in the early columns of the extracted matrix. This allows us to separate out the "hard part" of the LWE secret. We can first solve the sub-problem of finding the "cruel" bits of the secret in the early columns, and then find the remaining "cool" bits in linear time. We use statistical techniques to distinguish distributions to identify both the cruel and the cool bits of the secret. We provide concrete attack timings for recovering secrets in dimensions $n=256$, $512$, and $768$. For the lattice reduction stage, we leverage recent improvements in lattice reduction (e.g. flatter) applied in parallel. We also apply our new attack in the RLWE setting for $2$-power cyclotomic rings, showing that these RLWE instances are much more vulnerable to this attack than LWE.

Cryptography and Security
Trapdoor Delegation and HIBE from Middle-Product LWE in Standard Model

Huy Quoc Le,Dung Hoang Duong,Willy Susilo,Josef Pieprzyk

DOI: https://doi.org/10.48550/arXiv.2007.06881

2020-07-14

Abstract:At CRYPTO 2017, Rosca, Sakzad, Stehle and Steinfeld introduced the Middle--Product LWE (MPLWE) assumption which is as secure as Polynomial-LWE for a large class of polynomials, making the corresponding cryptographic schemes more flexible in choosing the underlying polynomial ring in design while still keeping the equivalent efficiency. Recently at TCC 2019, Lombardi, Vaikuntanathan and Vuong introduced a variant of MPLWE assumption and constructed the first IBE scheme based on MPLWE. Their core technique is to construct lattice trapdoors compatible with MPLWE in the same paradigm of Gentry, Peikert and Vaikuntanathan at STOC 2008. However, their method cannot directly offer a Hierachical IBE construction. In this paper, we make a step further by proposing a novel trapdoor delegation mechanism for an extended family of polynomials from which we construct, for the first time, a Hierachical IBE scheme from MPLWE. Our Hierachy IBE scheme is provably secure in the standard model.

Cryptography and Security
On Double-One Matrices and Double-Zero Matrices

Hung-Min Sun,Tzonelih Hwang

DOI: https://doi.org/10.1080/03081089208818121

1992-01-01

Abstract:We investigate two special classes of matrices over GF(2) with certain interesting properties. These properties can be applied to construct nonsingular matrix pairs efficiently and thus provide a solution to the long-key problems of McEIiece's public-key cryptosystem.
Eliminating Decryption Failures from the Simple Matrix Encryption Scheme.

Albrecht Petzoldt,Jintai Ding,Lih-chung Wang

2016-01-01

Abstract:The SimpleMatrix encryption scheme as proposed by Tao et al. [16] is one of the very few existing approaches to create a secure and efficient encryption scheme on the basis of multivariate polynomials. However, in its basic version, decryption failures occur with non-negligible probability. Although this problem has been addressed in several papers [5,17], a general solution to it is still missing. In this paper we propose an improved version of the SimpleMatrix scheme, which eliminates decryption failures completely and therefore solves the biggest problem of the SimpleMatrix encryption scheme. Additionally, we propose a second version of the scheme, which reduces the blow-up factor between plain and ciphertext size to a value arbitrary close to 1.
Simple Matrix Scheme For Encryption

Chengdong Tao,Adama Diene,Shaohua Tang,Jintai Ding

DOI: https://doi.org/10.1007/978-3-642-38616-9_16

2013-01-01

Abstract:There are several attempts to build asymmetric pubic key encryption schemes based on multivariate polynomials of degree two over a finite field. However, most of them are insecure. The common defect in many of them comes from the fact that certain quadratic forms associated with their central maps have low rank, which makes them vulnerable to the MinRank attack. We propose a new simple and efficient multivariate pubic key encryption scheme based on matrix multiplication, which does not have such a low rank property. The new scheme will be called Simple Matrix Scheme or ABC in short. We also propose some parameters for practical and secure implementation.
Computational Aspects of Lattices and Their Cryptographic Applications

Guangwu Xu,Xiaoyun Wang

DOI: https://doi.org/10.1360/ssm-2020-0174

2020-01-01

Abstract:This paper surveys some fundamental computational lattice problems and several classical primitives of lattice based cryptography. The paper tries to re(cid:13)ect some mathematical insights of the related problems. The paper starts with basic concepts and basic tools for lattice theory, followed by more detailed description of several classes of lattice algorithms. Some important cryptographic constructions of lattice cryptography are described in the last part of the paper.

New cryptographic constructions using generalized LWE

LWE from non-commutative group rings

A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem.

A Public Key Encryption Scheme Based on a New Variant of LWE with Small Cipher Size.

A Key Exchange Based on the Short Integer Solution Problem and the Learning with Errors Problem

New Lattice Based Cryptographic Constructions

Perturbed Hidden Matrix Cryptosystems

Hardness of (M)LWE with Semi-Uniform Seeds

Compact Lossy and All-but-One Trapdoor Functions from Lattice

Compact Inner Product Encryption From Lwe

Algebraically Structured LWE, Revisited

A Linear Attack on a Key Exchange Protocol Using Extensions of Matrix Semigroups.

Generic and Practical Key Establishment from Lattice.

Almost tight security in lattices with polynomial moduli—PRF, IBE, all-but-many LTF, and more

Deterministic Identity-Based Encryption from Lattices with More Compact Public Parameters.

The cool and the cruel: separating hard parts of LWE secrets

Trapdoor Delegation and HIBE from Middle-Product LWE in Standard Model

On Double-One Matrices and Double-Zero Matrices

Eliminating Decryption Failures from the Simple Matrix Encryption Scheme.

Simple Matrix Scheme For Encryption

Computational Aspects of Lattices and Their Cryptographic Applications