SALSA PICANTE：一种针对二元稀疏秘密 LWE 的机器学习攻击
SALSA PICANTE: a machine learning attack on LWE with binary secrets
AI总结：
本文提出 PICANTE，一种针对稀疏二元秘密 LWE 的增强型机器学习攻击，通过新颖预处理和交叉注意力恢复机制，将可恢复秘密的维度提升至 350、汉明重量提升至 60，显著超越 SALSA。
摘要：
带误差学习（LWE）是一个困难的数学问题，支撑着许多拟议的后量子密码（PQC）系统。NIST 标准化的唯一 PQC 密钥交换机制（KEM）基于模 LWE，而当前公开可用的后量子同态加密（HE）库基于环 LWE。基于 LWE 的后量子密码系统的安全性至关重要，但某些实现选择可能削弱其安全性。其中一个选择是稀疏二元秘密，出于效率原因，这对后量子同态加密方案具有吸引力。先前的工作 SALSA 展示了一种基于机器学习的攻击，针对小维度（$n \le 128$）和低汉明重量（$h \le 4$）的稀疏二元秘密 LWE。然而，该攻击假设能够访问数百万个被窃听的 LWE 样本，并且在更高的汉明重量或维度下失败。我们提出 PICANTE，一种针对稀疏二元秘密 LWE 的增强型机器学习攻击，它能在更大的维度（最高 $n=350$）和更大的汉明重量（约为 $n/10$，对于 $n=350$ 最高可达 $h=60$）下恢复秘密。我们通过一个新颖的预处理步骤实现了这一显著改进，该步骤使我们能够从线性数量的被窃听 LWE 样本（$4n$）中生成训练数据，并改变数据分布以改善 transformer 训练。我们还改进了 SALSA 的秘密恢复方法，并引入了一种新颖的交叉注意力恢复机制，使我们能够直接从训练好的模型中读出秘密。虽然 PICANTE 并未威胁到 NIST 提出的 LWE 标准，但它展示了相对于 SALSA 的显著改进，并可能进一步扩展，突显了未来研究针对稀疏二元秘密 LWE 的机器学习攻击的必要性。
英文摘要：
Learning with Errors (LWE) is a hard math problem underpinning many proposed post-quantum cryptographic (PQC) systems. The only PQC Key Exchange Mechanism (KEM) standardized by NIST is based on module~LWE, and current publicly available PQ Homomorphic Encryption (HE) libraries are based on ring LWE. The security of LWE-based PQ cryptosystems is critical, but certain implementation choices could weaken them. One such choice is sparse binary secrets, desirable for PQ HE schemes for efficiency reasons. Prior work, SALSA, demonstrated a machine learning-based attack on LWE with sparse binary secrets in small dimensions ($n \le 128$) and low Hamming weights ($h \le 4$). However, this attack assumes access to millions of eavesdropped LWE samples and fails at higher Hamming weights or dimensions. We present PICANTE, an enhanced machine learning attack on LWE with sparse binary secrets, which recovers secrets in much larger dimensions (up to $n=350$) and with larger Hamming weights (roughly $n/10$, and up to $h=60$ for $n=350$). We achieve this dramatic improvement via a novel preprocessing step, which allows us to generate training data from a linear number of eavesdropped LWE samples ($4n$) and changes the distribution of the data to improve transformer training. We also improve the secret recovery methods of SALSA and introduce a novel cross-attention recovery mechanism allowing us to read off the secret directly from the trained models. While PICANTE does not threaten NIST's proposed LWE standards, it demonstrates significant improvement over SALSA and could scale further, highlighting the need for future investigation into machine learning attacks on LWE with sparse binary secrets.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
