## Cryptology ePrint Archive: Report 2017/047

On dual lattice attacks against small-secret LWE and parameter choices in HElib and SEAL

Martin R. Albrecht

Abstract: We present novel variants of the dual-lattice attack against LWE in the presence of an unusually short secret. These variants are informed by recent progress in BKW-style algorithms for solving LWE. Applying them to parameter sets suggested by the homomorphic encryption libraries HElib and SEAL yields revised security estimates. Our techniques scale the exponent of the dual-lattice attack by a factor of $(2\,L)/(2\,L+1)$ when $\log q = \Theta{\left(L \log n\right)}$, when the secret has constant hamming weight $h$ and where $L$ is the maximum depth of supported circuits. They also allow to half the dimension of the lattice under consideration at a multiplicative cost of $2^{h}$ operations. Moreover, our techniques yield revised concrete security estimates. For example, both libraries promise 80 bits of security for LWE instances with $n=1024$ and $\log_2 q \approx {47}$, while the techniques described in this work lead to estimated costs of 68 bits (SEAL) and 62 bits (HElib).

Category / Keywords: public-key cryptography / learning with errors, cryptanalysis, homomorphic encryption

Original Publication (with minor differences): IACR-EUROCRYPT-2017

Date: received 20 Jan 2017, last revised 8 Feb 2017

Contact author: martin albrecht at royalholloway ac uk

Available format(s): PDF | BibTeX Citation

Note: minor corrections

Short URL: ia.cr/2017/047

[ Cryptology ePrint archive ]