On the independence heuristic in the dual attack
-
Kaveh Bashiri
und
Andreas Wiemers
Abstract
Post-quantum cryptography deals with the development and analysis of cryptographic schemes that are assumed to be secure even against attackers with access to a powerful quantum computer. Along the main candidates for quantum-safe solutions are cryptographic schemes, whose security is based on classic lattice problems such as the bounded-distance decoding (BDD) problem or the learning with error problem. In this work, we contribute to the analysis of an attack category against these problems called dual attack. In recent years, a lot of notable progress was achieved in this topic. Our first contribution is to provide theoretical counterarguments against a so-called independence assumption, which was used in earlier works on this attack, and which was shown in a previous work to be contradicting practical experiments. Then, we provide estimates on the success probability and the cost of the dual attack against the decisional version of the BDD problem. These estimates are derived both rigorously and heuristically. Finally, we also provide experimental evidence that confirms these results.
1 Introduction
In recent years, much research has been done on the lattice problems called decisional bounded-distance decoding (BDD) problem or the closely related learning with error (LWE) problem. This is due to the fact that many post-quantum crypto schemes rely on their security. As a result, many attacking schemes against the BDD and LWE problem have been established. For instance, there are the algebraic attacks [1], the combinatoric attacks [2], or the primal lattice attacks [3]. The latter is based on sampling short vectors in the primal lattice
either originated from a BDD-sample
or a uniformly distributed random-sample.
The main idea of the dual attack originated in coding theory. The first time these ideas appeared in lattice theory seems to be in the classic paper [4]. In recent years, many seminal results on the dual attack have then been established, where this idea is exploited see e.g. [5–9]). However, many recent advances in this direction rely on an independence assumption. Ducas and Pulles [7] especially reported on experiments they made comparing the distributions of scores for random-samples and BDD-samples. They discovered that the distribution of scores for BDD-samples deviates from the predictions made under this independence assumption.
1.1 Main results
In this paper we provide the following contributions.
We first theoretically show that the independence assumption cannot be true.
Then, under certain assumptions on the distribution of the dual vectors, we provide rigorous estimates for the success probability of the abovementioned strategy. Moreover, as a byproduct, we also obtain a cost estimate in terms of the number of dual vectors that are needed for such a successful distinction. In this part of the paper we make use of conditional expectations and rely on techniques that are inspired from the work by Pouly and Shen [9].
We then additionally provide a more intuitive approach to derive these results by relying on a central limit theorem heuristic. That is, here we again derive estimates for the success probability and the number of needed dual vectors for the dual attack; however, this time using an intuitive, heuristic approach. We believe that both approaches, the rigorous one and the intuitive one, are essential for a full understanding of the subject; the beginning of Section 5 gives a more detailed explanation on why we believe that both approaches are important.
Finally, we provide experimental evidence that the just mentioned central limit theorem heuristics indeed hold true. In this way, we verify experimentally our heuristically derived results, which in turn verify the rigorously derived results.
1.2 Outlook
This work is organized as follows. In Section 2, we introduce some preliminary notions that we will need. In Section 3, we compute certain covariances that reveal the incompleteness of the independence assumption. In Section 4, we provide rigorous estimates for the success probability and the cost of the dual attack. In Section 5, we show that these estimates also hold true under certain intuitively justified heuristics. Finally, in Section 6, we provide experimental evidence for our results.
2 Preliminaries
This section is organized as follows. First we provide a glimpse into lattice theory in Section 2.1. Then, we introduce the BDD problem in Section 2.2 and describe the main framework of the dual attack in Section 2.3.
2.1 Lattices
2.1.1 Main definitions
A lattice
where
and for full-rank lattices, we have that
where
2.1.2 Shortest vectors of a lattice
A very important object in lattice-based cryptography are its shortest nonzero vectors, i.e., elements of the lattice with length
It is a common strategy in lattice-based cryptography to rely on the so-called Gaussian Heuristic, which is given as follows.
Heuristic 1
The length of the shortest vector of a randomly generated lattice
2.1.3 Discrete Gaussian distribution
The discrete Gaussian distribution is an important probability distribution on a lattice
where we denote by
Then, the Gaussian distribution,
2.1.4 Poisson summation formula
A very useful tool to switch from a lattice to its dual lattice is given by the Poisson summation formula, which is already used in the classic and seminal papers in lattice-based cryptography by Regev [10].
Lemma 2.1
Let
where
In this work, we are very interested to apply this result for the function
Corollary 2.2
Let
2.2 BDD problem
The main object of investigation in this paper is the BDD problem on a lattice
Definition 2.3
Let
where the notion of “small” depends on the context.
Suppose that we are given
In the BDD-search-problem, we are asked to find
Suppose that we are given a sample
it is either a BDD-sample, i.e.,
or a random-sample, i.e.,
where
The BDD-problem is closely related to the LWE problem, which is the notion more commonly used in post-quantum cryptography. For a survey on the LWE-problem and its relation to the BDD problem, we refer to the excellent notes by Peikert [11]. Moreover, we refer to these notes for further references concerning the question on the equivalence of the search- and the decision-version.
2.3 Dual attack
In this paper, out of the attacks we listed in the introduction, we focus on the dual attack. This attack attracted a lot of interest in recent years (refer for instance [5–9]) and is still the object of ongoing research. In this section, we present the main ideas of this approach.
The dual attack is aimed at the BDD-decision-problem so that we are given a sample
if
if
A reasonable candidate for such a score is given by
as, for
The set
In this subsection we are, however, interested in an heuristic way to find a reasonable score. In order to do this, we heuristically assume that the output of the black box yields short dual vectors, which are all roughly of similar norm. This implies in particular that
As the prefactor
Combining (1), (2), and (3) intuitively justifies to choose the following function, which depends on a large enough subset
To sum up, the strategy for the dual attack against the BDD-decision-problem is to compute
The important remaining tasks are now
to compute the probabilities with which our strategy is successful,
and to find out how many dual vectors are needed so that the function
3 Computing the covariances
The score
However, for
Of course, this lack of independence remains true if we assume that
In this section, we aim to fully refute the independence assumption by explicitly computing the covariance between the random variables and showing that these are not equal to zero.
We proceed as follows. We first provide some preparatory steps such as the precise definitions of the distributions in the two cases. Then we compute the covariances in the random-sample-case in Section 3.2 and in the BDD-sample-case in Section 3.3. Finally in this section, we provide some heuristic estimates, which underline that covariances in the BDD-sample-case are indeed nonzero.
Remark 3.1
As we change the perspective at some point in this paper, it is useful to emphasize, when and where we consider the sample
Formally, we always consider the family
This is in contrast to this section. In this section, we consider (implicitly) the probability measure conditioned on W. That is, we consider informally the dual vectors in
3.1 Some preparation
We adopt the notation given in the paper by Ducas and Pulles [7] and repeat the approach described by them [7, Section 2.3]. Recall the definition of
3.1.1 BDD-sample-case
In the BDD-sample-case, we are given a sample
3.1.2 Random-sample-case
We now provide a more precise definition of a random-sample, which is taken from the paper by Laarhoven and Walter [5, Definition 1]. Let
For two fixed dual vectors
where the components of
3.1.3 Covariances
In the paper by Ducas and Pulles [7, Lemma 4], approximations of the expectation values and variances of a single
If the independence assumption (cf. [7, Heuristic 2]) is valid, the second sum over the single covariances is equal to 0. However, in the following, we want to derive approximations of this second sum in the BDD-sample-case, which contradicts this claim. In the end, this might explain that in the experiments in the paper by Ducas and Pulles [7, Table 1], the measured variance is much larger than predicted.
3.2 Computing the covariances for random-samples
We begin with the random-sample-case, where we will see that (at least pairwise) independence assumption holds. We obtain the following result.
Proposition 3.2
Let t be random-sample and
In particular, we have that
Proof
Recall the definition of
and its reduction
as a random variable in
We can compute this volume as sub-volume of the
where
This shows that the random variables
3.3 Computing the covariances for BDD-samples
We now assume that
Proposition 3.3
Let t be a BDD-sample and
where we set
Proof
We fix two dual vectors
as a random variable in
Since we assume that
The distribution of the reduced random variable
is equal to
We use the Poisson summation formula and obtain
We now start the computation by
It is easily seen that each univariate integral (in
The first integral on the right-hand side vanishes except for
Therefore, we obtain
Lemma 4 in the paper by Ducas and Pulles [7] states the equality for the expectation value
In the end, we derive for the covariance
Remark 3.4
Of course, the just computed covariances seem to be non-vanishing (when
4 Dual attack
In this section, we estimate the success probability of the above described dual attack and provide a quantification of the number of dual vectors that are needed in theory for a successful attack. The strategy is based on the application of the so-called Hoeffding’s inequality for
In order to do this, we proceed as follows. We first introduce some technical ingredients that we need in the proof. We then recall some known result on the (conditional) expectation of
4.1 Technical ingredients
4.1.1 Distribution of the dual vectors
In order to be able to quantify the distribution of the score, we need to make assumptions on the output of the lattice sieve algorithm, from which we obtain the dual vectors.
Heuristic 2
We make the following assumptions on the distribution of the family
For all
4.1.1.1 Justification of Heuristic 2
The first two bullet points are intuitively justified as the dual vectors are usually generated, via lattice reduction algorithms such as BKZ, independent of each other and also independently from the sample
We note that our assumption in Heuristic 2 aligns with the paper by Pouly and Shen [9], whereas in Ducas and Pulles [8] made the assumption that the dual vectors are uniformly distributed on a centered ball
4.1.2 Conditional expectation and conditional probability measure
In our proofs, we use the widely used concept in probability theory of conditional expectation. For an introduction into this topic we refer to any standard textbook in probability theory [12, Sections 33 and 34].
Here we only provide the intuitive description that the conditional expectation given
We recall some important facts of the conditional expectation that we will use:
Many properties of the conditional expectation and the associated conditional probability measure are harvested from the usual expectation and the probability measure. Examples are the linearity and monotonicity of the expectation; refer [12, Sections 33 and 34] for more information.
The conditional expectation is only defined almost surely, i.e., everywhere except of a null set, i.e., a set of measure 0 for the underlying probability space. In our case, this probability space is given as the underlying probability space, on which the random variables
The conditional probability measure is, as for the usual probability measure, defined as the conditional expectation of the indicator function
In the special case that a random variable
(5)where the notation indicates that the left-hand side is a random variable (as per definition of the conditional expectation) and the right-hand side is an expectation over
Lemma 4.1
Recall that
Write
In particular, we have that the sequence
Proof
We have that
where we defined the function
Now we use that, inside the last expectation,
This concludes the proof.□
4.1.3 Hoeffding’s inequality
Inspired by the impressive work of Pouly and Shen [9], we will make use of the classic Hoeffding’s inequality, which is given as follows.
Lemma 4.3
Let
However, in this work we apply this inequality not for
4.1.4 Threshold
Our threshold for the distinguishing between the random-sample- and the BDD-sample-case is given as follows:
for some arbitrarily chosen
4.1.5 Concentration of chi-squared-distribution
Another important result that we use is the following concentration inequalities for the chi-squared-distribution.
Lemma 4.4
Let e be distributed according to an n-dimensional, continuous Gaussian distribution with covariance matrix
Proof
A proof can be found in the paper by Laurent and Massart [13, Lemma 1].□
4.2 Estimating the conditional expectation of
f
W
(
t
)
A crucial step to successfully apply Hoeffding’s inequality for
4.2.1 BDD-sample-case
Lemma 4.5
Let
Proof
Using the linearity of the conditional expectation that all dual vectors are identically distributed as some
Applying now the Poisson summation formula, we obtain that
Moreover, using that
At this point, we can apply the following standard lower bound from the thesis by Stephens-Davidowitz [14, Lemma 1.3.10]
We finally obtain that
This concludes the proof.□
4.2.2 Random-sample-case – Approach 1
Lemma 4.6
Let t be a random-sample. Then, whenever
Proof
Using the same arguments as above, we have that
Now, we can proceed as in the paper by Pouly and Shen [9, Lemma 8] to bound the right-hand side and to conclude the proof.□
Remark 4.7
Note that the paper by Pouly and Shen [9, Lemma 8], which is the core of the proof of Lemma 4.6, relies heavily on the classic estimates from the paper by Banaszczyk [15]. In Section 5, where we heuristically reprove the statements of this section, we will directly apply the estimates from the paper by Banaszczyk [15]. In order to fully understand the parallels between the approach in this section and the one from Section 5, it is important to have this in mind.
4.2.3 Random-sample-case – Approach 2
Lemma 4.8
Let t be a random-sample. Let
Proof
Using the same arguments as above, we have that
We now estimate the numerator on the right-hand side. It consists of a sum of exponentials of the form
Let
Applying now the Peter–Paul inequality (
Due to our choice of
This yields that
Via this estimate, we obtain that
Via the Poisson summation formula and since
4.3 Estimating the success probabilities
We now have collected everything we need to formulate some of the main results of this paper in the following three theorems. We first consider the BDD-sample-case. Then, we consider two different approaches for the random-sample-case.
4.3.1 BDD-sample-case
Theorem 4.9
Let
Proof
We begin with some elementary reformulations of the desired probability.
where we have used Lemma 4.5 in the last step.
We then rewrite the right-hand side of (15) by using basic rules of probability theory to see that
where we applied Hoeffding’s inequality for conditional probability measures and the concentration inequality (8) in the last step. This concludes the proof.□
4.3.2 Random-sample-case – Approach 1
Theorem 4.10
Let t be a random-sample and
Then,
Proof
Let
where
where we have used Lemma 4.6 in the last step, which is applicable since
Estimation of the first term. In order to estimate the first term, note that
where
Moreover, by assumption (16),
Combining (18), (19), and (20) yields that
Estimation of the second term. For the second term, we observe that
As above, we can now apply Hoeffding’s inequality by invoking the probability measure conditioned on
4.3.3 Random-sample-case – Approach 2
Theorem 4.11
Let t be a random-sample and
Then,
Proof
Let
Then, we know that
We now use the same first step as in the proof of Theorem 4.10 but apply Lemma 4.8 instead of Lemma 4.6. Then, we obtain that
For the second term we can, as above, apply Hoeffding’s inequality. In order to estimate the first term, we again proceed similar to the proof of Theorem 4.10. That is, we have that
Moreover, by assumption (21),
Combining (23) and (24) yields that
This concludes the proof.□
4.4 Conclusion
In order for our strategy described in Section 2.3 to be successful we need that the probabilities on the left-hand side in (14) and (17) (or equivalently (22)) become small. This in turn is given if their respective upper bound, i.e., the respective right-hand sides in (14) and (17) (or equivalently (22)), become small.
In order to achieve this, we choose
More precisely, we now need to show that, for some suitable
For that to be true, we derive the condition that
Obviously, the maximum in (25) is realized for
This yields a lower bound on the necessary number of dual vectors for a successful dual attack.
Remark 4.12
Note that we can choose
Indeed, as for
A similar observation is also true for
We omit the details concerning these aspects as they are dependent on the concrete scenario, where the results of this paper are used and can be adjusted easily to this scenario.
4.5 Parameter selection
It is important to ask, for which sets of parameters
In this section, we investigate when these restrictions hold true. In doing so, we restrict our attention to the parameters
Finally in this section, we investigate if and how the lower bound on
4.5.1 Intuition for the parameter
τ
0
A very prominent role in this investigation will be played by the parameter
for all
since we expect the output of the lattice reduction algorithms to have the length of a multiple of the shortest vector. This translates the search for suitable
From our computations, we will find out that, in order for (16) or (21) to be fulfilled, we need a lower bound on
We interpret our results, where we demand a lower bound on
4.5.2 Intuition for the parameter
σ
0
Another important task is to appropriately choose the parameter
Similarly as in (28), this suggests to assume that
for some appropriate choice
4.5.3 Parameter choices for (16)
We first consider condition (16). We abbreviate
Note that
With our choices (28) and (29), this becomes (by using that
or equivalently,
We immediately see that if
with
4.5.4 Parameter choices for (21)
We proceed similarly as for (16). We abbreviate
where we used (28), (29), and that
or equivalently,
Then, one admissible choice that fulfills (33) (and thus also (21)) would be
with
A suitable choice of
which, for this particular choice of
4.5.5 Consequences of (26)
Recall that, following our findings in this section,
on the one hand, we need to sample at least a certain amount (given by the right-hand side of (26)) of dual vectors, and
From a mathematical point of view, this implies no further issues as we modeled the output of the lattice reduction algorithm (via Heuristic 2) as a sequence of independent random variables and, as such, repetitions of the realizations of these random variables are admissible; see for instance coin tossing.
However, from a practical point of view, we have to make sure that Heuristic 2 indeed resembles the behavior of lattice reduction algorithms. Therefore, we have to take into account that, in practice, repeated sample outputs are usually discarded. This, of course, has the negative effect that in such scenarios the joint independence of the sample gets lost. This in turn implies that the independence assumption in Heuristic 2 does not resemble reality in situations, where many repetitions happen.
This is why we now investigate informally under which parameter selections repetitions can be avoided. In other words, we want to find out, when the condition
is fulfilled, while at the same time
In order to quantify the right-hand side of (35), note that, according to Gaussian Heuristics,
In particular, using (28) and similar arguments as in the proof of Theorem 4.10, this implies that
As before, we now ignore the terms, which are (asymptotically in
Using (28) and (29), this becomes
which in turn, for large
This imposes additional conditions on
4.5.6 Provable regime
To sum up, we found the following two sets of parameters, where our attacks work and are practically justified
For Approach 1: By (32) we choose
(37)This inequality holds true for many possible choices for
which, to the best of our knowledge, is the first time that the provable regime is extended to the case where errors with norm larger than
For Approach 2: Now, by (34), we choose
so that (36) becomes
(38)Recall that, also here, we restrict to
5 Dual attack – approach based on the conditional central limit theorem
In Section 4, we provided rigorous results for a quantification of the success of the dual attack. However, such rigorous results are always accompanied with many technicalities. Moreover, in order to establish the rigorous results, conservative assumptions and estimates (such as (16), (21), or (26)) are required, which, in many cases, can be relaxed in practice.
We believe that in order to have a full understanding of the subject, to find new results or to even find interdisciplinary connections, it is necessary to also intuitively and more directly understand the behavior of the investigated mathematical objects. This yields the need for a simpler and more intuitive approach to understand this attack, and to benefit from the fact there is no need to worry about mathematical provability of certain statements that can intuitively be justified but not mathematically. This is the goal of this section.
Hence, in this section, we aim to reprove the results from Section 4 via some intuitively justified heuristics and approximations. The strategy is based on a central limit theorem heuristic, which was also used, e.g., in [8]. We emphasize again that we believe that both approaches, the rigorous one from Section 4 and the intuitive one from this section, are essential for a full understanding of the subject.
We proceed as follows. We first provide some preparatory steps. Then, we estimate an important quantity that we need and then we compute the success probabilities both in the BDD-sample-case and in the random-sample-case. The mentioned heuristics are then backed in Section 6 by experiments.
5.1 Some preparation
5.1.1 Conditional central limit theorem
Our computations in this section depend on the following heuristic, which is justified later.
Heuristic 3
Suppose that we are given a sample
5.1.1.1 Representation of
F
(
t
)
and the variance of
X
˜
Before we justify Heuristic 3, we note that we can simplify the expressions in this heuristic as follows. Using property (5), we have that
And for the variance of
5.1.1.2 Justification of Heuristic 3
First note that by combining (9) and (39), we obtain that
Therefore, for all
Then, by using the conditional central limit theorem formulated in the paper by Yuan et al. [17, Theorem 3.1], we have that
where
Then, by revoking the conditional probability measure, we have that
Combining (40) and (41) yields that
Another, maybe more elementary, way to understand the step from (40) to (41) is to note that the left-hand side of (41) is nothing but a double integral as in the situation of Fubini’s theorem, i.e.,
where
Moreover, from the representation in (42), it is visible that the right-hand side in (41) is equal to the same expression but by taking random variables
Another justification for Heuristic 3 is that the experiments in Section 6 confirm the soundness of this assumption. Moreover, we note that Heuristic 3 is also used in the paper by Ducas and Pulles [8], where it was also justified by experimental evidence.
5.2 Estimating
F
(
t
)
The expectation on the right-hand side of (39) is given by
The denominator and the numerator in the quotient (43) can be expressed as a sum over the lattice
In typical cases, we can expect that the value of
Lemma 5.1
Let
Proof
The smallest non-trivial vector of the stretched lattice
In the following, we simplify our computations by assuming the following heuristic.
Heuristic 4
We have that
That is,
5.2.1 Justification of Heuristic 4
Recall the Gaussian heuristic Heuristic 1. And recall the definition of
If
We continue the estimation of
5.2.2 Estimating
F
(
t
)
in the BDD-sample-case
We now rely on the paper by Banaszczyk [15, Lemma (1.5, (ii))] for a simplification of the numerator of
Lemma 5.2
Let
Proof
For every
This lemma leads us to the following heuristic.
Heuristic 5
Suppose that the BDD-sample
5.2.1.1 Justification of Heuristic 5
From Lemma 4.5, we already know that
We now show, by applying Lemma 5.2, that the second term on the right-hand side of (47) is negligible with respect to the first term. Let
For the corresponding parameter
By assuming that
where we used in the last step that, according to Heuristic 4, the term
We need to compare bound (48) to the first term on the right-hand side in (47). Using similar arguments as the ones that led to (48), we can show for the first term on the right-hand side in (47) that
To sum up, we need the following conditions to hold true in order to justify Heuristic 5:
Note that the second condition in (49) is equivalent to
which implicitly contains the condition that
We conclude that
with a certain real number
If
Furthermore, we can compute the expectation value and the variance of
5.2.3 Estimating
F
(
t
)
in the random-sample-case
In the random-sample-case, it is difficult to find a closed formula for
Lemma 5.3
Let t be a random-sample. Then,
and
Proof
Since
where we used the Poisson summation formula in the last step.
Note that
This property allows us to compute the second moment of
Again, we use the Poisson summation formula for the denominator and numerator of this quotient, which gives the claim.
This lemma leads us to the following heuristic.
Heuristic 6
Let
5.2.2.1 Justification of Heuristic 6
We assume as in Heuristic 4 that we can neglect terms
and
Again as above, we want to assume that the Gaussian Heuristic 1 is valid for both lattices
and the second moment is of size
5.3 Parameter selection for assuming the Heuristics
We want to assume that the previous heuristics are valid, i.e., Heuristic 3, Heuristic 4, and Heuristic 5. Recall the definition of
This stronger condition implies in particular that in the random sample case (cf. Heuristic 4),
Therefore, in the random-sample case, we can approximate
In the BDD-sample case, we expect (cf. Heuristic 5)
As an example, for
5.4 Success probabilities
We want to distinguish the cases “random-samples vs BDD-samples” with good probability by checking if the score is higher or lower than a certain value
Following the arguments of Section 5.3, if
We therefore choose for simplicity
with a certain number
On the other hand, in the BDD-sample-case, we want that
is notably larger than 0.5 (note that we tacitly used that
We know the distribution function of
we obtain a “good” probability for
Remark 5.4
Note the resemblance of condition (54) with condition (26) identified in the rigorous analysis. More precisely, the leading-order term on the right-hand side of (54) is given by
while the leading-order term on the right-hand side of (26) is given by
which only differs in the lower-order terms in the exponent. These differences are due to the fact that, in our rigorous approach, we needed to apply quite coarse concentration inequalities.
The conditions (26) or (54) are also very similar to the usual condition on
Recall the condition formulated in (52), so that we have to consider
For typical parameter sets as
6 Experiments
In order to check the reasonability of our heuristics we conducted a few experiments. In our experiments we chose the lattice
where
In our experiments, we did not consider concrete lattice reduction algorithms for generating the subset
We emphasize that we do not aim at an efficient implementation of our attacks here. Instead, we rather aim for a simple implementation, which resembles the theoretic setting of our paper, with the goal to practically verify the soundness of our heuristics.
6.1 Experiments for small
n
For small
Choose
Compute
We can expect that the average of the length
In Figure 1 (a), we computed the score function
Experiments for small
In Figure 1 (b), we compute the score function
6.2 Experiments for moderate
n
For moderate
Choose
Compute
We were able to conduct experiments in this way for
In our experiments, we observed that the average of the length
We computed the score function
we chose
Figure 2 (a) shows both score functions in one figure. The distributions are similar, but we note a slight difference in the probabilities for larger
Experiments for moderate
In Figure 2(b), we compute the score function
7 Discussion
7.1 Comparison with other recent works
As pointed out in Section 1 of this paper, there is a lot of recent progress and research on the dual attack for BDD or LWE. Most notably with respect to our results are the two interesting and impressive works by Pouly and Shen [9] and Ducas and Pulles [8]. We now briefly compare their results with our results in this work.
7.1.1 Results from the paper by Pouly and Shen [9]
The first obvious difference between our work and the work of [9] is that they studied LWE, while we studied BDD. However, it is possible to translate the results into the other respective framework by using the arguments from the paper by Pouly and Shen [9, Section 6]. The obvious similarity to our work is that they also assumed that the dual vectors are distributed according to the discrete Gaussian distribution.
Our approach in Section 4, which is based on a direct application of Hoeffding’s inequality, is inspired by the paper by Pouly and Shen [9]. However, we use their technique for the conditional probability measure, while they use it for the original probability measure. This is why they apply this strategy only in their “basic dual attack” where dual vectors are sampled afresh for many different samples (in order to obtain independence, which is required to apply Hoeffding’s inequality), while we use it for the case when there is only one sample and one family of dual vectors (i.e., the usual dual attack).
The main result in the paper by Pouly and Shen [9] is their “modern dual attack”. First note that via this attack, the authors solve the search version of LWE (where the secret is to be extracted directly) and not the decision version (as in our case). The main difference to our approach is that they do not choose the secret according to a single evaluation of the score function and checking whether it is above or below a threshold. What they do is that they evaluate many score functions and choose the candidate with the maximum score as the secret. We believe that this approach is more precise than ours, since in the approach by Pouly and Shen [9], they do not need to choose a threshold or rely on concentration inequalities. However, we did not rigorously translated our results into their setting in order to make a precise comparison. They also relied on geometric properties of the lattice in order to estimate the success probabilities of their attack, which is more involved than the strategy based on Hoeffding’s inequality.
7.1.2 Results from the paper by Ducas and Pulles [8]
In the other independent work by Ducas and Pulles [8], similar results as in the present paper were obtained. The work by Ducas and Pulles [8] is a follow-up of their previous paper [7] and builds upon the observations made there. Also, our work can be seen as being initiated by the observations from the paper by Ducas and Pulles [7], our setting and notation is very similar to that in the paper by Ducas and Pulles [8]. However, a key difference between their work and the results of this paper is the assumption on the output of the dual lattice sieve algorithm. While we assume that the obtained dual vectors are distributed according to a discrete Gaussian distribution on the dual lattice, Ducas and Pulles [8] assume that the dual vectors are uniformly distributed on a ball of a certain radius.
The strategy in the paper by Ducas and Pulles [8] is, as in Section 5, based on a central limit theorem-type argument. In this way, they derive estimates on the cumulative distribution function of the score function. Besides, in their justification of their central limit heuristic ([8, Heuristic 3]), they also implicitly apply conditional independence in their computations in the paper by Ducas and Pulles [8, Section 3.3] by changing from a spherical error distribution to a radial error distribution.
Their theoretic results are accompanied by impressive experimental results, which underline and substantiate the former.
7.2 Future work
There are a lot of directions for improvements and future research with respect to our results in this paper. In the following, we would like to emphasize some of them.
What happens in the asymptotic case, when
If we assume that the approximations in Section 5 are valid, we have different distributions for
A natural question arises: What are good weights in the formula for the total score taking into account the approach above? We therefore consider weights
We can adapt the formulas from Section 5 if we restrict ourselves by choosing
In this way, one can find an optimal
It is very interesting to see whether Heuristic 2 can be modified or generalized in order to be more suitable for modern lattice sieve algorithms. For instance, as we pointed out after Heuristic 2, we believe that the most realistic assumption, which resembles the behavior of the output of the lattice reduction algorithms most suitably, would be the case, where the dual vectors are uniformly distributed on
As outlined in Section 4.5, our theoretic results demand a lower bound on
The main purpose of our experiments from Section 6 is the verification of the soundness of Heuristic 3, which in turn (via the computations from Section 5) verifies the soundness of the results from Section 4. In that sense, the main focus of this work is the theoretical part. Hence, there are many possible ways to further conduct the experimental aspects related to this paper. In particular, it would be interesting
to see how good Heuristic 2 resembles the behavior of concrete lattice reduction algorithms, or
to check whether the choice, where the dual vectors are uniformly distributed on
Acknowledgment
We gratefully acknowledge helpful discussions with Léo Ducas, Stephan Ehlen, and Ludo N. Pulles. We moreover would like to express our gratitude toward the anonymous referees for numerous helpful suggestions and remarks.
-
Funding information: Authors state no funding involved.
-
Author contributions: All authors have accepted responsibility for the entire content of this manuscript and approved its submission.
-
Conflict of interest: The authors state no conflict of interest.
Appendix A Some approximations of the covariances in the BDD-sample-case
In this section, we provide some heuristic estimates, which underline that the covariances computed in Section 3.3 are indeed nonzero.
Our goal is to intuitively estimate the sum over all single covariances
Instead of computing this sum via (4) directly, we aim to find plausible approximations that give simple formulas. Recall that
can be interpreted as a computation of a mean value (by using that
By using again the techniques of conditional independence and other simple elementary techniques from probability theory, we can assume that (A1) is a sum of uncorrelated, square-integrable random variables so that we are in the setting of (a generalized form of) the law of large numbers. We omit the details here as they are similar to the detailed computations in Sections 4 and 5.
Consequently, we can expect that the expression (A1) is close to the expectation value of the
where
Hence, the expectation value of the
where
where
which has
which has
where
This yields heuristically the bias of the variance, which was observed experimentally in [7].
B Bound on the volume of a ball
Lemma B.1
For all
Proof
It is known that
where
which is proven in e.g. [18, Corollary 1.2]. Note that for all
References
[1] Arora S, Ge R. New algorithms for learning in presence of errors. In: International colloquium on automata, languages, and programming. Berlin, Heidelberg: Springer; 2011. p. 403–15. 10.1007/978-3-642-22006-7_34Suche in Google Scholar
[2] Kirchner P, Fouque PA. An improved BKW algorithm for LWE with applications to cryptography and lattices. In: Advances in Cryptology-CRYPTO 2015: 35th Annual Cryptology Conference, Santa Barbara, CA, USA, August 16-20, 2015, Proceedings, Part I 35. Berlin, Heidelberg: Springer; 2015. p. 43–62. 10.1007/978-3-662-47989-6_3Suche in Google Scholar
[3] Gama N, Nguyen PQ. Predicting lattice reduction. In: Advances in Cryptology-EUROCRYPT 2008: 27th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Istanbul, Turkey, April 13–17, 2008. Proceedings 27. Berlin, Heidelberg: Springer; 2008. p. 31–51. Suche in Google Scholar
[4] Aharonov D, Regev O. Lattice problems in NP ∩ coNP. JACM. 2005;52(5):749–65. 10.1145/1089023.1089025Suche in Google Scholar
[5] Laarhoven T, Walter M. Dual lattice attacks for closest vector problems (with preprocessing). In: Cryptographers Track at the RSA Conference. Cham: Springer; 2021. p. 478–502. 10.1007/978-3-030-75539-3_20Suche in Google Scholar
[6] Guo Q, Johansson T. Faster dual lattice attacks for solving LWE with applications to CRYSTALS. In: Advances in Cryptology-ASIACRYPT 2021: 27th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, December 6–10, 2021, Proceedings, Part IV 27. Cham: Springer; 2021. p. 33–62. 10.1007/978-3-030-92068-5_2Suche in Google Scholar
[7] Ducas L, Pulles LN. Does the dual-sieve attack on learning with errors even work? In: Annual International Cryptology Conference. Cham: Springer; 2023. p. 37–69. 10.1007/978-3-031-38548-3_2Suche in Google Scholar
[8] Ducas L, Pulles LN. Accurate score prediction for dual-sieve attacks. Cryptology ePrint Archive, Paper 2023/1850. https://eprint.iacr.org/2023/1850. Suche in Google Scholar
[9] Pouly A, Shen Y. Provable dual attacks on learning with errors. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer; 2024. p. 256–85. 10.1007/978-3-031-58754-2_10Suche in Google Scholar
[10] Regev O. New lattice-based cryptographic constructions. JACM. 2004;51(6):899–942. 10.1145/1039488.1039490Suche in Google Scholar
[11] Peikert C. A decade of lattice cryptography. Foundations Trends® Theoret Comp Sci. 2016;10(4):283–424. 10.1561/0400000074Suche in Google Scholar
[12] Billingsley P. Probability and Measure. New York: John Wiley & Sons Inc.; 2012. Suche in Google Scholar
[13] Laurent B, Massart P. Adaptive estimation of a quadratic functional by model selection. Ann Statist. 2000;28(5):1302–38. 10.1214/aos/1015957395Suche in Google Scholar
[14] Stephens-Davidowitz N. On the Gaussian measure over lattices. USA: New York University; 2017. Suche in Google Scholar
[15] Banaszczyk W. New bounds in some transference theorems in the geometry of numbers. Mathematische Annalen. 1993;296:625–35. 10.1007/BF01445125Suche in Google Scholar
[16] Chen Y, Hu Z, Liu Q, Luo H, Tu Y. LWE with quantum amplitudes: algorithm, hardness, and oblivious sampling; 2023. Cryptology ePrint Archive, Paper 2023/1498. https://eprint.iacr.org/2023/1498. Suche in Google Scholar
[17] Yuan DM, Wei LR, Lei L. Conditional central limit theorems for a sequence of conditional independent random variables. J Korean Math Soc. 2014;51(1):1–15. 10.4134/JKMS.2014.51.1.001Suche in Google Scholar
[18] Batir N. Inequalities for the gamma function. Archiv der Math. 2008;91(6):554–63. 10.1007/s00013-008-2856-9Suche in Google Scholar
© 2025 the author(s), published by De Gruyter
This work is licensed under the Creative Commons Attribution 4.0 International License.
Artikel in diesem Heft
- A McEliece cryptosystem using permutation codes
- Research Articles
- The condition number associated with ideal lattices from odd prime degree cyclic number fields
- A small serving of mash: (Quantum) algorithms for SPDH-Sign with small parameters
- The least primitive roots mod p
- On the independence heuristic in the dual attack
- Sherlock Holmes zero-knowledge protocols secure against active attackers
- Inner product functional encryption based on the UOV scheme
- Review Article
- Leveled homomorphic encryption schemes for homomorphic encryption standard
- Special Issue based on CIFRIS24
- Modern techniques in somewhat homomorphic encryption
- Investigation of metabelian platform groups for protocols based on (simultaneous) conjugacy search problem
- Smaller public keys for MinRank-based schemes
- Application of Mordell–Weil lattices with large kissing numbers to acceleration of multiscalar multiplication on elliptic curves
- First-degree prime ideals of composite extensions
- Dynamic-FROST: Schnorr threshold signatures with a flexible committee
- BTLE: Atomic swaps with time-lock puzzles
- Security analysis of ZKPoK based on MQ problem in the multi-instance setting
Artikel in diesem Heft
- A McEliece cryptosystem using permutation codes
- Research Articles
- The condition number associated with ideal lattices from odd prime degree cyclic number fields
- A small serving of mash: (Quantum) algorithms for SPDH-Sign with small parameters
- The least primitive roots mod p
- On the independence heuristic in the dual attack
- Sherlock Holmes zero-knowledge protocols secure against active attackers
- Inner product functional encryption based on the UOV scheme
- Review Article
- Leveled homomorphic encryption schemes for homomorphic encryption standard
- Special Issue based on CIFRIS24
- Modern techniques in somewhat homomorphic encryption
- Investigation of metabelian platform groups for protocols based on (simultaneous) conjugacy search problem
- Smaller public keys for MinRank-based schemes
- Application of Mordell–Weil lattices with large kissing numbers to acceleration of multiscalar multiplication on elliptic curves
- First-degree prime ideals of composite extensions
- Dynamic-FROST: Schnorr threshold signatures with a flexible committee
- BTLE: Atomic swaps with time-lock puzzles
- Security analysis of ZKPoK based on MQ problem in the multi-instance setting
