Abstract:Lattice cryptography schemes based on the learning with errors (LWE) hardness assumption have been standardized by NIST for use as post-quantum cryptosystems, and by <a class="link-external link-http" href="http://HomomorphicEncryption.org" rel="external noopener nofollow">this http URL</a> for encrypted compute on sensitive data. Thus, understanding their concrete security is critical. Most work on LWE security focuses on theoretical estimates of attack performance, which is important but may overlook attack nuances arising in real-world implementations. The sole existing concrete benchmarking effort, the Darmstadt Lattice Challenge, does not include benchmarks relevant to the standardized LWE parameter choices - such as small secret and small error distributions, and Ring-LWE (RLWE) and Module-LWE (MLWE) variants. To improve our understanding of concrete LWE security, we provide the first benchmarks for LWE secret recovery on standardized parameters, for small and low-weight (sparse) secrets. We evaluate four LWE attacks in these settings to serve as a baseline: the Search-LWE attacks uSVP, SALSA, and Cool & Cruel, and the Decision-LWE attack: Dual Hybrid Meet-in-the-Middle (MitM). We extend the SALSA and Cool & Cruel attacks in significant ways, and implement and scale up MitM attacks for the first time. For example, we recover hamming weight $9-11$ binomial secrets for KYBER ($\kappa=2$) parameters in $28-36$ hours with SALSA and Cool\&Cruel, while we find that MitM can solve Decision-LWE instances for hamming weights up to $4$ in under an hour for Kyber parameters, while uSVP attacks do not recover any secrets after running for more than $1100$ hours. We also compare concrete performance against theoretical estimates. Finally, we open source the code to enable future research.

The Nested Subset Differential Attack A Practical Direct Attack Against LUOV Which Forges a Signature Within 210 Minutes

Cryptanalysis of the Lifted Unbalanced Oil Vinegar Signature Scheme

New Attacks on Lifted Unbalanced Oil Vinegar

Improved Impossible Differential Attack on Reduced-Round LBlock.

Kipnis-Shamir Attack On Unbalanced Oil-Vinegar Scheme

Practical and Theoretical Cryptanalysis of VOX

Another Lattice Attack Against ECDSA with the wNAF to Recover More Bits per Signature

An Improved Practical Key Mismatch Attack Against NTRU

VDOO: A Short, Fast, Post-Quantum Multivariate Digital Signature Scheme

New Differential-Algebraic Attacks and Reparametrization of Rainbow

Breaking the Symmetry: a Way to Resist the New Differential Attack.

Cryptanalysis of a Multivariate Public Key Cryptosystem

Reveal the Invisible Secret: Chosen-Ciphertext Side-Channel Attacks on NTRU

Cryptanalysis of a Public Key Cryptosystem Based on Diophantine Equations Via Weighted LLL Reduction.

Quantum Differential Cryptanalysis

Exploiting Intermediate Value Leakage in Dilithium: A Template-Based Approach

Zero-Value Filtering for Accelerating Non-Profiled Side-Channel Attack on Incomplete NTT-Based Implementations of Lattice-Based Cryptography

Differential Invariant Subspace Cryptanalysis – A Realtime Attack against IoT-friendly Word-based Block Ciphers

Improved Conditional Differential Attacks on Lightweight Hash Family QUARK

Impossible Differential Attack On Reduced-Round Twine

Benchmarking Attacks on Learning with Errors