Thomas Wunderer

On the Hardness of LWE with Binary Error: Revisiting the Hybrid Lattice-Reduction and Meet-in-the-Middle Attack

The security of many cryptographic schemes has been based on special instances of the Learning with Errors LWE problem, e.g., Ring-LWE, LWE with binary secret, or LWE with ternary error. However, recent results show that some subclasses are weaker than expected. In this work we show that LWE with binary error, introduced by Micciancio and Peikert, is one such subclass. We achieve this by applying the Howgrave-Graham attack on NTRU, which is a combination of lattice techniques and a Meet-in-the-Middle approach, to this setting. We show that the attack outperforms all other currently existing algorithms for several natural parameter sets. For instance, for the parameter set

Estimate All the {LWE, NTRU} Schemes!

n=256

Recovering Short Generators of Principal Fractional Ideals in Cyclotomic Fields of Conductor p^\alpha q^\beta

,

Revisiting the Hybrid Attack: Improved Analysis and Refined Security Estimates.

m=512

Estimate all the {LWE, NTRU} schemes!

,