Abstract:Learning with Errors (LWE) is a hard math problem underpinning many proposed post-quantum cryptographic (PQC) systems. The only PQC Key Exchange Mechanism (KEM) standardized by NIST is based on module~LWE, and current publicly available PQ Homomorphic Encryption (HE) libraries are based on ring LWE. The security of LWE-based PQ cryptosystems is critical, but certain implementation choices could weaken them. One such choice is sparse binary secrets, desirable for PQ HE schemes for efficiency reasons. Prior work, SALSA, demonstrated a machine learning-based attack on LWE with sparse binary secrets in small dimensions ($n \le 128$) and low Hamming weights ($h \le 4$). However, this attack assumes access to millions of eavesdropped LWE samples and fails at higher Hamming weights or dimensions. We present PICANTE, an enhanced machine learning attack on LWE with sparse binary secrets, which recovers secrets in much larger dimensions (up to $n=350$) and with larger Hamming weights (roughly $n/10$, and up to $h=60$ for $n=350$). We achieve this dramatic improvement via a novel preprocessing step, which allows us to generate training data from a linear number of eavesdropped LWE samples ($4n$) and changes the distribution of the data to improve transformer training. We also improve the secret recovery methods of SALSA and introduce a novel cross-attention recovery mechanism allowing us to read off the secret directly from the trained models. While PICANTE does not threaten NIST's proposed LWE standards, it demonstrates significant improvement over SALSA and could scale further, highlighting the need for future investigation into machine learning attacks on LWE with sparse binary secrets.

Enhancing the Key Recovery Attack on Round Reduced Salsa

Improved key recovery attacks on reduced-round Salsa20

A multi-step key recovery attack on reduced round Salsa and ChaCha

Analyzing the Probability of Key Recovery in the Differential Attacks Against ChaCha

Moving a Step of ChaCha in Syncopated Rhythm.

A practical forgery and state recovery attack on the authenticated cipher PANDA-s.

Snowball: Another View on Side-Channel Key Recovery Tools.

Fault-based guess-and-determine attack on SOSEMANUK

Enhanced Side-Channel Cube Attacks on PRESENT.

SALSA PICANTE: a machine learning attack on LWE with binary secrets

Boomeyong: Embedding Yoyo within Boomerang and its Applications to Key Recovery Attacks on AES and Pholkos

New Key Recovery Attack on the MICKEY Family of Stream Ciphers

SALSA VERDE: a machine learning attack on Learning With Errors with sparse small secrets

Improved Single-Key Attacks on 9-Round AES-192/256.

Improved related-key boomerang attacks on round-reduced threefish-512

Automated Search Oriented To Key Recovery On Ciphers With Linear Key Schedule Applications To Boomerangs In Skinny And Forkskinny

Automated Search Oriented to Key Recovery on Ciphers with Linear Key Schedule

A New Differential Fault Attack on SPN Structure, with Application to AES Cipher

Algebraic Attack on PRESENT Cipher

Deep round key recovery attacks and countermeasure in persistent fault model: a case study on GIFT and KLEIN

Near Collision Attack on the Grain V1 Stream Cipher