LPN in Cryptography

Modern cryptography pushed forward the need of having provable security. Whereas ancient cryptography was only relying on heuristic assumptions and the secrecy of the designs, nowadays researchers try to make the security of schemes to rely on mathematical problems which are believed hard to solve. When doing these proofs, the capabilities of potential adversaries are modeled formally. For instance, the black-box model assumes that an adversary does not learn anything from the inner-state of a construction. While this assumption makes sense in some practical scenarios, it was shown that one can sometimes learn some information by other means, e.g., by timing how long the computation take. In this thesis, we focus on two different areas of cryptography. In both parts, we take first a theoretical point of view to obtain a result. We try then to adapt our results so that they are easily usable for implementers and for researchers working in practical cryptography. In the first part of this thesis, we take a look at post-quantum cryptography, i.e., at cryptographic primitives that are believed secure even in the case (reasonably big) quantum computers are built. We introduce HELEN, a new public-key cryptosystem based on the hardness of the learning from parity with noise problem (LPN). To make our results more concrete, we suggest some practical instances which make the system easily implementable. As stated above, the design of cryptographic primitives usually relies on some well-studied hard problems. However, to suggest concrete parameters for these primitives, one needs to know the precise complexity of algorithms solving the underlying hard problem. In this thesis, we focus on two recent hard-problems that became very popular in post-quantum cryptography: the learning with error (LWE) and the learning with rounding problem (LWR). We introduce a new algorithm that solves both problems and provide a careful complexity analysis so that these problems can be used to construct practical cryptographic primitives. In the second part, we look at leakage-resilient cryptography which studies adversaries able to get some side-channel information from a cryptographic primitive. In the past, two main disjoint models were considered. The first one, the threshold probing model, assumes that the adversary can put a limited number of probes in a circuit. He then learns all the values going through these probes. This model was used mostly by theoreticians as it allows very elegant and convenient proofs. The second model, the noisy-leakage model, assumes that every component of the circuit leaks but that the observed signal is noisy. Typically, some Gaussian noise is added to it. According to experiments, this model depicts closely the real behaviour of circuits. Hence, this model is cherished by the practical cryptographic community. In this thesis, we show that making a proof in the first model implies a proof in the second model which unifies the two models and reconciles both communities. We then look at this result with a more practical point-of-view. We show how it can help in the process of evaluating the security of a chip based solely on the more standard mutual information metric.

We construct a two-message oblivious transfer protocol with statistical sender privacy (SSP OT) based on the Learning Parity with Noise (LPN) Assumption and a standard Nisan-Wigderson style derandomization assumption. Beyond being of interest on their own, SSP OT protocols have proven to be a powerful tool toward minimizing the round complexity in a wide array of cryptographic applications from proofs systems, through secure computation protocols, to hard problems in statistical zero knowledge (SZK).The protocol is plausibly post-quantum secure. The only other constructions with plausible post quantum security are based on the Learning with Errors (LWE) Assumption. Lacking the geometric structure of LWE, our construction and analysis rely on a different set of techniques.Technically, we first construct an SSP OT protocol in the common random string model from LPN alone, and then derandomize the common random string. Most of the technical difficulty lies in the first step. Here we prove a robustness property of the inner product randomness extractor to a certain type of linear splitting attacks. A caveat of our construction is that it relies on the so called low noise regime of LPN. This aligns with our current complexity-theoretic understanding of LPN, which only in the low noise regime is known to imply hardness in SZK.

The rapid proliferation of Radio Frequency Identification (RFID) tags in the past decade has made tremendous impact on our daily lives. As part of Internet of Things (IoT), RFID technology ensures an efficient, secure and reliable system to identify tagged objects in supply chain environment such as manufacturing, automotive and healthcare. Several lightweight authentication solutions have been proposed to satisfy optimal security and privacy features of RFID communication. Hopper-Blum (HB) family of protocols that rely on the hard problem of Learning Parity with Noise (LPN) is a series of lightweight authentication protocol used to identify RFID tags. Our study shows that recent RFID authentication protocols from HB family that mostly focus on two party authentication such as tag-reader authentication, in general, cannot be applied directly to a three party authentication such as tag-reader-server authentication. In contrast to typical RFID authentication system, we consider the channel between the reader and back-end server insecure. We focus HB protocol and its variants and propose a modified protocol where the entire system is authenticated under LPN-based scheme.

We construct efficient authentication protocols and message authentication codes (MACs) whose security can be reduced to the learning parity with noise (LPN) problem. Despite a large body of work—starting with the $${\mathsf {HB}}$$ protocol of Hopper and Blum in 2001—until now it was not even known how to construct an efficient authentication protocol from LPN which is secure against man-in-the-middle attacks. A MAC implies such a (two-round) protocol.

Physically unclonable functions (PUFs) have been widely proposed as hardware primitives for device identification and cryptographic key generation. While strong PUFs provide an exponential number of challenge–response pairs (CRPs) for device authentication, most are vulnerable to machine-learning (ML)-based modeling attacks. Regarding the inherent hard learning problem, adversarial-based PUFs pseudo-randomly switch between several predefined internal states to poison the ML algorithms. However, existing adversarial-based PUFs sacrifice reliability or security against ML attacks. Furthermore, most works only evaluated the ML resistance by empirical experiments, which provides limited evidence for ML resistance. This work explored a novel adversarial-based PUF, Configurable Poisoning PUF (CP PUF), that simultaneously maintains reliability and protects the internal state by a reliability trapdoor. We then connect the proposed CP PUF with the learning parity with noise (LPN) problem to provide a theoretical security guarantee. Experiments show that the reliability of our proposed CP PUF keeps at least 88.9% and outperforms the existing adversarial-based PUFs under different levels of noisy environments. Moreover, the proposed CP PUF achieved a 50.16% accuracy under empirical ML attacks, a near-optimal performance.

Quantum computing furnishes exponential speed up over classical computing in specific areas. For example, Shor’s algorithm can factor two numbers in a polynomial time complexity. Thus, many encryption algorithms that rely on large number factorization are potentially vulnerable to quantum computers. In order to address this, the National Institute of Standard and Test (NIST) has organized a competition to evaluate several post quantum cryptography (PQC) algorithms, that are secure from the attacks from quantum computers. Several of these lattice-based PQC encryption algorithms are based on Learning With Errors (LWE) computation. Conversely, LWE is the heaviest computation in a classical computer, which incurs significant portion of the latency overhead for the entire encryption algorithm. In this paper, we design an optimized quantum circuit for LWE computation. The proposed quantum circuit does not need any ancillary qubits and scales efficiently and easily if there are more qubits available on a higher qubit quantum computer.

Certificateless public key cryptography (CL-PKC) can solve the problems of certificate management in a public key infrastructure (PKI) and of key escrows in identity-based public key cryptography (ID-PKC). In CL-PKC, the key generation center (KGC) does not know the private keys of all users, and their public keys need not be certificated by certification authority (CA). At present, however, most certificateless encryption schemes are based on large integer factorization and discrete logarithms that are not secure in a quantum environment and the computation complexity is high. To solve these problems, we propose a new certificate-less encryption scheme based on lattices, more precisely, using the hardness of the learning with errors (LWE) problem. Compared with schemes based on large integer factorization and discrete logarithms, the most operations are matrixvector multiplication and inner products in our scheme, our approach has lower computation complexity. Our scheme can be proven to be indistinguishability chosen ciphertext attacks (IND-CPA) secure in the random oracle model.

Quantum computing represents a transformative advancement in computational power, with profound implications for cryptographic systems. This paper explores the intersection of quantum computing and cryptography, examining the potential for quantum computers to both break traditional cryptographic algorithms and enable new forms of secure communication. Classical cryptographic systems, such as RSA and ECC, rely on the computational difficulty of problems like integer factorization and discrete logarithms. However, quantum algorithms, notably Shor's algorithm, can solve these problems exponentially faster than the best-known classical algorithms, posing a significant threat to the security of current cryptographic practices. This vulnerability necessitates the development and implementation of quantum-resistant algorithms to ensure data security in a post-quantum world. The paper reviews the state-of-the-art in quantum-resistant cryptographic algorithms, including lattice-based, hash-based, code-based, and multivariate polynomial cryptography. These algorithms are analyzed for their security properties, efficiency, and practicality for real-world deployment. Additionally, the paper discusses the ongoing standardization efforts led by organizations such as NIST, which are crucial for establishing widely accepted quantum-safe cryptographic protocols. Beyond the threat posed by quantum computing, this paper also highlights the potential benefits quantum computing can bring to cryptographic systems. Quantum Key Distribution (QKD) is one such advancement, offering theoretically unbreakable encryption by leveraging the principles of quantum mechanics. QKD enables secure communication channels that are immune to any computational advances, including those of quantum computers, by ensuring that any attempt at eavesdropping can be detected. The practical implementation challenges of QKD and other quantum cryptographic protocols are also addressed, including issues related to transmission distance, error rates, and integration with existing communication infrastructures. Experimental results from recent QKD trials are presented, showcasing significant progress in extending the viability of quantum-secure communication over long distances. Furthermore, the paper delves into the hybrid approaches combining classical and quantum cryptographic techniques. These approaches aim to leverage the strengths of both paradigms to enhance security and performance. For instance, hybrid protocols might use classical encryption for bulk data transfer, supplemented by quantum techniques for key exchange, thereby ensuring robust security even against future quantum adversaries. In conclusion, while quantum computing poses substantial risks to existing cryptographic systems, it also offers novel opportunities for creating highly secure communication protocols. The transition to quantum-safe cryptography is imperative to protect sensitive information in the quantum era. This paper underscores the urgency of advancing quantum-resistant cryptographic research, promoting international collaboration for standardization, and exploring innovative applications of quantum technologies in cryptography. Continued research and development in these areas are essential to stay ahead of the evolving threat landscape and harness the full potential of quantum computing for secure communications.

This paper introduces a new public key cryptosystem based on two hard problems : the cube root extraction modulo a composite moduli (which is equivalent to the factorisation of the moduli) and the discrete logarithm problem. These two hard problems are combined during the key generation, encryption and decryption phases. By combining the IFP and the DLP we introduce a secure and efficient public key cryptosystem. To break the scheme, an adversary may solve the IFP and the DLP separately which is computationally infeasible. The key generation is a simple operation based on the discrete logarithm modulo a composite moduli. The encryption phase is based both on the cube root computation and the DLP. These operations are computationally efficient.

In white-box cryptography, early protection techniques have fallen to the automated Differential Computation Analysis attack (DCA), leading to new countermeasures and attacks. A standard side-channel countermeasure, Ishai-Sahai-Wagner’s masking scheme (ISW, CRYPTO 2003) prevents Differential Computation Analysis but was shown to be vulnerable in the white-box context to the Linear Decoding Analysis attack (LDA). However, recent quadratic and cubic masking schemes by Biryukov-Udovenko (ASIACRYPT 2018) and Seker-Eisenbarth-Liskiewicz (CHES 2021) prevent LDA and force to use its higher-degree generalizations with much higher complexity.In this work, we study the relationship between the security of these and related schemes to the Learning Parity with Noise (LPN) problem and propose a new automated attack by applying an LPN-solving algorithm to white-box implementations. The attack effectively exploits strong linear approximations of the masking scheme and thus can be seen as a combination of the DCA and LDA techniques. Different from previous attacks, the complexity of this algorithm depends on the approximation error, henceforth allowing new practical attacks on masking schemes which previously resisted automated analysis. We demonstrate it theoretically and experimentally, exposing multiple cases where the LPN-based method significantly outperforms LDA and DCA methods, including their higher-order variants.This work applies the LPN problem beyond its usual post-quantum cryptography boundary, strengthening its interest for the cryptographic community, while expanding the range of automated attacks by presenting a new direction for breaking masking schemes in the white-box model.

A public-key encryption algorithm and a practical hybrid scheme are proposed in this paper. This algorithm uses the advanced transform techniques, i.e. the Number Theoretic Transforms (NTTs) to diffuse data, and uses a non-linear technique based on the Elliptic Curve Discrete Logarithm Problem (ECDLP) to confuse data. The main advantage of the proposed algorithm is its high efficiency and capability. The plaintext can be encrypted in blocks in parallel, thus saves computational time. The proposed algorithm also can be easily applied in a hybrid scheme for practical applications.

The discrete logarithm problem (DLP) plays an important role in modern cryptography since it cannot be efficiently solved on a classical computer. Currently, the DLP based on the hyperelliptic curve of genus 2 (HCDLP) is widely used in industry and also a research field of hot interest. At the same time, quantum computing, a new paradigm for computing based on quantum mechanics, provides the ability to solve certain hard problems that cannot be efficiently solved on classical computers. In this paper, we consider the problem of solving the HCDLP in the paradigm of quantum computing. We propose a quantum algorithm for solving the HCDLP by applying the framework of quantum algorithm designed by Shor. The key of the algorithm is the realization of divisor addition. We solve the key problem and get analytical results for divisor addition by geometric meaning of the group addition. Therefore, the procedure can be efficiently realized on a quantum computer using the basic modular arithmetic operations. Finally, we conclude that the HCDLP defined over an n-bit prime field $$\mathbb {F}_{p}$$ can be computed on a quantum computer with at most $$13n+2\lfloor \log _{2}n\rfloor +10$$ qubits using $$2624n^{3} \log _{2}n-2209.2n^{3} + 1792n^{2} \log _{2}n-3012.8n^{2}$$ Toffoli gates. For current parameters at comparable classical security levels, there are fewer qubits and Toffoli gates to solve the HCDLP than the ones to solve the DLP based on elliptic curves.

A public key encryption scheme based on a new variant of LWE with small cipher size

Lattice-based cryptographic scheme is constructed based on hard problems on a lattice such as the short integer solution (SIS) problem and the learning with error (LWE). However, the cryptographic scheme based on SIS or LWE is inefficient since the size of the key is too large. Thus, most cryptographic schemes use the variants of LWE and SIS with ring and module structures. Albrecht and Deo showed that there is a reduction from module-LWE (M-LWE) to ring-LWE (R-LWE) in the polynomial ring by handling the error rate and modulus. However, unlike the LWE problem, the SIS problem does not have an error rate, but there is the upper bound β on the norm of the solution of the SIS problem. In this paper, we propose the two novel reductions related to module-SIS (M-SIS) and ring-SIS (R-SIS) on a polynomial ring. We propose (i) the reduction from R-SIS q k ,m k ,β k to R-SIS q , m,β and (ii) the reduction from M-SIS to R-SIS under norm constraint of R-SIS. Combining these two results implies that R-SIS for a specified modulus and number samples is more difficult than M-SIS under norm constraints of R-SIS, which provides the range of possible module ranks for M-SIS. From the reduction we propose, contrary to the widely known belief, our result shows that there is a possibility that the security parameters of M-SIS may be less secure when it reduces to R-SIS for the theoretical reasons presented in this paper. Therefore, when generating parameters on an M-SIS structure, the theoretical security level over R-SIS also should also be checked at the same time.

Research in the field of public key cryptography in general and digital signatures in particular is often considered and evaluated at two levels: The first level is considering the mathematical basis for constructing cryptographic and digital signature algorithms, especially these difficult problems: factorizing a large integer into prime factors, finding root problem, discrete logarithm problem, discrete logarithm problem on elliptic curve... The second level is constructing cryptographic and digital signatures algorithms on these hard problems including RSA, DSA, Schnorr, GOST R34.10-94. At the first level, research focuses mainly on improving algorithms for finding large primes, structures for strong primes and algorithms to attack these problems efficiently. At the second level, the research concentrates on improving the existing algorithms to enhance the safety or effective performance of the algorithm. In this article, the authors propose a solution to improve the security of digital signature schemes, implemented in both levels of digital signatures. At the first level, the authors propose a new hard problem - different from the hard problems used before and hasn’t been solved by anyone so far (except by "brute force attack" method). At the second level, the authors propose a method to construct new digital signature algorithms that can help create not only one but also a family of new digital signature algorithms with high security level for practical applications.