Abstract:Lattice cryptography schemes based on the learning with errors (LWE) hardness assumption have been standardized by NIST for use as post-quantum cryptosystems, and by <a class="link-external link-http" href="http://HomomorphicEncryption.org" rel="external noopener nofollow">this http URL</a> for encrypted compute on sensitive data. Thus, understanding their concrete security is critical. Most work on LWE security focuses on theoretical estimates of attack performance, which is important but may overlook attack nuances arising in real-world implementations. The sole existing concrete benchmarking effort, the Darmstadt Lattice Challenge, does not include benchmarks relevant to the standardized LWE parameter choices - such as small secret and small error distributions, and Ring-LWE (RLWE) and Module-LWE (MLWE) variants. To improve our understanding of concrete LWE security, we provide the first benchmarks for LWE secret recovery on standardized parameters, for small and low-weight (sparse) secrets. We evaluate four LWE attacks in these settings to serve as a baseline: the Search-LWE attacks uSVP, SALSA, and Cool & Cruel, and the Decision-LWE attack: Dual Hybrid Meet-in-the-Middle (MitM). We extend the SALSA and Cool & Cruel attacks in significant ways, and implement and scale up MitM attacks for the first time. For example, we recover hamming weight $9-11$ binomial secrets for KYBER ($\kappa=2$) parameters in $28-36$ hours with SALSA and Cool\&Cruel, while we find that MitM can solve Decision-LWE instances for hamming weights up to $4$ in under an hour for Kyber parameters, while uSVP attacks do not recover any secrets after running for more than $1100$ hours. We also compare concrete performance against theoretical estimates. Finally, we open source the code to enable future research.

Ring/Module Learning with Errors Under Linear Leakage - Hardness and Applications.

Ring/Module Learning with Errors under Linear Leakage - Hardness and Applications

On the Hardness of Learning Parity with Noise over Rings.

LWE from non-commutative group rings

A leakage-resilient zero knowledge proof for lattice problem

Algebraically Structured LWE, Revisited

On Lattices, Learning with Errors, Random Linear Codes, and Cryptography

Learning with Errors over Group Rings Constructed by Semi-direct Product

Error-Correction Performance of Regular Ring-Linear LDPC Codes over Lee Channels

How to Validate the Secret of a Ring Learning with Errors (RLWE) Key

Identity-Concealed Authenticated Encryption from Ring Learning with Errors

Lattice-Based Linkable Ring Signature in the Standard Model.

A Linkable Ring Signature Scheme on Lattice from DualRing

CNC: A lightweight architecture for Binary Ring-LWE based PQC

Lossy Cryptography from Code-Based Assumptions

Practical Randomized RLWE-Based Key Exchange Against Signal Leakage Attack.

A Novel Security Assessment Method Based on Linear Regression for Logic Locking

Learning with Errors and Extrapolated Dihedral Cosets

Efficient Hardware Arithmetic for Inverted Binary Ring-LWE Based Post-Quantum Cryptography

Benchmarking Attacks on Learning with Errors

Leakage of Signal Function with Reused Keys in RLWE Key Exchange