On the Weakness of Non-Dual Ring-LWE Mod Prime Ideal q by Trace Map

DOI Web Site 参考文献20件

抄録

<p>The recent decision by the National Institute of Standards and Technology (NIST) to standardize lattice-based cryptography has further increased the demand for security analysis. The Ring-Learning with Error (Ring-LWE) problem is a mathematical problem that constitutes such lattice cryptosystems. It has many algebraic properties because it is considered in the ring of integers, R, of a number field, K. These algebraic properties make the Ring-LWE based schemes efficient, although some of them are also used for attacks. When the modulus, q, is unramified in K, it is known that the Ring-LWE problem, to determine the secret information s ∈ R/qR, can be solved by determining s (mod q) ∈ 𝔽qf for all prime ideals q lying over q. The χ2-attack determines s (mod q) ∈𝔽qf using chi-square tests over R/q ≅ 𝔽qf. The χ2-attack is improved in the special case where the residue degree f is two, which is called the two-residue-degree χ2-attack. In this paper, we extend the two-residue-degree χ2-attack to the attack that works efficiently for any residue degree. As a result, the attack time against a vulnerable field using our proposed attack with parameter (q,f)=(67, 3) was 129 seconds on a standard PC. We also evaluate the vulnerability of the two-power cyclotomic fields.</p>

収録刊行物

参考文献 (20)*注記

もっと見る

キーワード

詳細情報 詳細情報について

問題の指摘

ページトップへ