IEICE Transactions on Information and Systems
Online ISSN : 1745-1361
Print ISSN : 0916-8532
Special Section on Information and Communication System Security
On the Weakness of Non-Dual Ring-LWE Mod Prime Ideal q by Trace Map
Tomoka TAKAHASHIShinya OKUMURAAtsuko MIYAJI
Author information
JOURNAL FREE ACCESS

2023 Volume E106.D Issue 9 Pages 1423-1434

Details
Abstract

The recent decision by the National Institute of Standards and Technology (NIST) to standardize lattice-based cryptography has further increased the demand for security analysis. The Ring-Learning with Error (Ring-LWE) problem is a mathematical problem that constitutes such lattice cryptosystems. It has many algebraic properties because it is considered in the ring of integers, R, of a number field, K. These algebraic properties make the Ring-LWE based schemes efficient, although some of them are also used for attacks. When the modulus, q, is unramified in K, it is known that the Ring-LWE problem, to determine the secret information sR/qR, can be solved by determining s (mod q) ∈ 𝔽qf for all prime ideals q lying over q. The χ2-attack determines s (mod q) ∈𝔽qf using chi-square tests over R/q ≅ 𝔽qf. The χ2-attack is improved in the special case where the residue degree f is two, which is called the two-residue-degree χ2-attack. In this paper, we extend the two-residue-degree χ2-attack to the attack that works efficiently for any residue degree. As a result, the attack time against a vulnerable field using our proposed attack with parameter (q,f)=(67, 3) was 129 seconds on a standard PC. We also evaluate the vulnerability of the two-power cyclotomic fields.

Content from these authors
© 2023 The Institute of Electronics, Information and Communication Engineers
Previous article Next article
feedback
Top