Volume 13, Issue 1

Over the past decade, the hybrid lattice-reduction and meet-in-the middle attack (called hybrid attack) has been used to evaluate the security of many lattice-based cryptographic schemes such as NTRU, NTRU Prime, BLISS and more. However, unfortunately, none of the previous analyses of the hybrid attack is entirely satisfactory: They are based on simplifying assumptions that may distort the security estimates. Such simplifying assumptions include setting probabilities equal to 1, which, for the parameter sets we analyze in this work, are in fact as small as 2-802^{-80}. Many of these assumptions lead to underestimating the scheme’s security. However, some lead to security overestimates, and without further analysis, it is not clear which is the case. Therefore, the current security estimates against the hybrid attack are not reliable, and the actual security levels of many lattice-based schemes are unclear. In this work, we present an improved runtime analysis of the hybrid attack that is based on more reasonable assumptions. In addition, we reevaluate the security against the hybrid attack for the NTRU, NTRU Prime and R-BinLWEEnc encryption schemes as well as for the BLISS and GLP signature schemes. Our results show that there exist both security over- and underestimates in the literature.

Let p≡3(mod4){p\equiv 3\pmod{4}} and l≡5(mod8){l\equiv 5\pmod{8}} be different primes such that pl=1{\frac{p}{l}=1} and 2p=pl4{\frac{2}{p}=\frac{p}{l}_{4}}. Put k=ℚ⁢(l){k=\mathbb{Q}(\sqrt{l})}, and denote by ϵ its fundamental unit. Set K=k⁢(-2⁢p⁢ϵ⁢l){K=k(\sqrt{-2p\epsilon\sqrt{l}})}, and let K2(1){K_{2}^{(1)}} be its Hilbert 2-class field, and let K2(2){K_{2}^{(2)}} be its second Hilbert 2-class field. The field K is a cyclic quartic number field, and its 2-class group is of type (2,2,2){(2,2,2)}. Our goal is to prove that the length of the 2-class field tower of K is 2, to determine the structure of the 2-group G=Gal⁡(K2(2)/K){G=\operatorname{Gal}(K_{2}^{(2)}/K)}, and thus to study the capitulation of the 2-ideal classes of K in all its unramified abelian extensions within K2(1){K_{2}^{(1)}}. Additionally, these extensions are constructed, and their abelian-type invariants are given.

The Learning With Errors (LWE) problem is one of the most important hardness assumptions lattice-based constructions base their security on. In 2015, Albrecht, Player and Scott presented the software tool LWE-Estimator to estimate the hardness of concrete LWE instances, making the choice of parameters for lattice-based primitives easier and better comparable. To give lower bounds on the hardness, it is assumed that each algorithm has given the corresponding optimal number of samples. However, this is not the case for many cryptographic applications. In this work we first analyze the hardness of LWE instances given a restricted number of samples. For this, we describe LWE solvers from the literature and estimate their runtime considering a limited number of samples. Based on our theoretical results we extend the LWE-Estimator. Furthermore, we evaluate LWE instances proposed for cryptographic schemes and show the impact of restricting the number of available samples.