对Galbraith二进制LWE密码体制的一种新的混合格攻击
A new Hybrid Lattice Attack on Galbraith's Binary LWE Cryptosystem
摘要：
基于LWE的密码系统是后量子时代传统密码系统的一个有吸引力的替代方案。为了最小化其公钥的一部分（$256 \times 640$整数矩阵，$\textbf{T}$）的存储成本，已经提出了$\textbf{T}$的二进制版本。其密文的一个组成部分$\textbf{c}_{1}$被计算为$\textbf{c}_{1} = \textbf{Tu}$，其中$\textbf{u}$是临时秘密。知道了$\textbf{u}$，就可以推导出明文。给定$\textbf{c}_{1}$和$\textbf{T}$，Galbraith的挑战是在1年内利用现有的计算资源计算出$\textbf{u}$。我们的混合方法猜测和删除一些位的解决方案向量和映射的问题，解决由此产生的子实例的最近向量问题格理论。基于格的方法减少了要猜测的比特的数量，而基于LP松弛的初始猜测将随后的猜测的数量减少到多项式，而不是猜测比特数量的指数。进一步的增强划分猜测位的集合，并使用LP的2步应用。在给定处理器核数和时间的约束条件下，一次训练算法学习最优的分区组合，在1年内使用1000 - 100，000个核数，成功率为9 - 23%.这与早期的工作相比是有利的，早期的工作在3000个核心上取得了2%的成功。
英文摘要：
LWE-based cryptosystems are an attractive alternative to traditional ones in the post-quantum era. To minimize the storage cost of part of its public key - a $256 \times 640$ integer matrix, $\textbf{T}$ - a binary version of $\textbf{T}$ has been proposed. One component of its ciphertext, $\textbf{c}_{1}$ is computed as $\textbf{c}_{1} = \textbf{Tu}$ where $\textbf{u}$ is an ephemeral secret. Knowing $\textbf{u}$, the plaintext can be deduced. Given $\textbf{c}_{1}$ and $\textbf{T}$, Galbraith's challenge is to compute $\textbf{u}$ with existing computing resources in 1 year. Our hybrid approach guesses and removes some bits of the solution vector and maps the problem of solving the resulting sub-instance to the Closest Vector Problem in Lattice Theory. The lattice-based approach reduces the number of bits to be guessed while the initial guess based on LP relaxation reduces the number of subsequent guesses to polynomial rather than exponential in the number of guessed bits. Further enhancements partition the set of guessed bits and use a 2-step application of LP. Given the constraint of processor cores and time, a one-time training algorithm learns the optimal combination of partitions yielding a success rate of 9\% - 23\% with 1000 - 100,000 cores in 1 year. This compares favourably with earlier work that yielded 2\% success with 3000 cores.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
