Some Notes on Post-Quantum Cryptanalysis Mårtensson, Erik 2020 Document Version: Publisher's PDF, also known as Version of record Link to publication Citation for published version (APA): Mårtensson, E. (2020). Some Notes on Post-Quantum Cryptanalysis. Department of Electroscience, Lund University. Total number of authors: 1 General rights Unless other specific re-use rights are stated the following general rights apply: Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal Read more about Creative commons licenses: https://creativecommons.org/licenses/ Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. LUND UNIVERSITY PO Box 117 221 00 Lund +46 46-222 00 00 Some Notes on Post-Quantum Cryptanalysis Doctoral Dissertation Erik Mårtensson Department of Electrical and Information Technology Lund University, Lund, Sweden December, 2020 Department of Electrical and Information Technology Lund University Box 118, SE-221 00 LUND SWEDEN This thesis is set in Computer Modern 10pt with the LATEX Documentation System Series of licentiate and doctoral theses ISSN 1654-790X; No. 135 ISBN: 978-91-7895-711-8 (print) ISBN: 978-91-7895-712-5 (pdf) c Erik Mårtensson 2020 Printed in Sweden by Tryckeriet i E-huset, Lund. December 2020. Published articles have been reprinted with the permission from the respective copyright holder. ...To my father... Abstract ryptography as it is used today relies on a foundational level on the as- C sumption that either the Integer Factoring Problem (IFP) or the Discrete Logarithm Problem (DLP) is computationally intractable. In the 1990s Peter Shor developed a quantum algorithm that solves both problems in polynomial time. Since then alternative foundational mathematical problems to replace IFP and DLP have been suggested. This area of research is called post-quantum cryptology. To remedy the threat of quantum computers the National Institute of Stan- dards and Technology (NIST) has organized a competition to develop schemes for post-quantum encryption and digital signatures. For both categories lattice- based cryptography candidates dominate. The second most promising type of candidate for encryption is code-based cryptography. The lattice-based candidates are based on the difficulty of either the Learning With Errors problem (LWE) or the Nth Degree Truncated Polynomial problem (NTRU), of which LWE is the focus of this thesis. The difficulty of both these problems in turn relies on the difficulty of variations of the Shortest Vector Problem (SVP). Code-based cryptography is based on the difficulty of decoding random linear codes. The main focus of this thesis is on solving the LWE problem using the Blum- Kalai-Wasserman algorithm (BKW). We have the following improvements of the algorithm. 1. We combined BKW with state-of-the-art lattice sieving methods to im- prove the complexity of the algorithm. We also elaborate on the simi- larities and differences between BKW and lattice sieving, two approaches that on a shallow level look very different. 2. We developed a new binary approach for the distinguishing phase of the BKW algorithm and showed that it performs favorably compared to pre- vious distinguishers. 3. We investigated the Fast Fourier Transform (FFT) approach for the dis- tinguishing part of BKW showing that it performs better than theory predicts and identically with the optimal distinguisher. We showed that we could improve its performance by limiting the number of hypotheses being tested. 4. We introduced practical improvements of the algorithm such as non- integral step sizes, a file-based sample storage solution and an implemen- tation of the algorithm. v vi Abstract We also improved the classical state-of-the-art approaches for k-sieving - lattice sieving where k vectors are combined at a time - by using quantum algorithms. At the cost of a small increase in time complexity we managed to drastically decrease the space requirement compared to the state-of-the-art quantum algorithm for solving the SVP. Finally, we developed an algorithm for decoding linear codes where the noise is Gaussian instead of binary. We showed how code-based schemes with Gaus- sian noise are easily broken. We also found other applications for the algorithm in side-channel attacks and in coding theory. Contribution Statement This doctoral thesis concludes my work as a Ph.D. student, and is comprised of two main parts. The first part gives an overview of the research field in which I have been working during my Ph.D. studies and a brief summary of my work. The second part is composed of the six following papers: 1. Q. Guo, E. Mårtensson and P. Stankovski Wagner, On the Sample Com- plexity of solving LWE using BKW-Style Algorithms, under submission, 2020. 2. A. Budroni, Q. Guo, T. Johansson, E. Mårtensson and P. Stankovski Wag- ner, Making the BKW Algorithm Practical for LWE, in 21st International Conference on Cryptology in India (INDOCRYPT 2020), pp. 417-439, 2020, Bangalore, India. 3. E. Kirshanova, E. Mårtensson, E. Postlethwaite and S. Roy Moulik, Quan- tum Algorithms for the Approximate k-List Problem and their Applica- tion to Lattice Sieving, in Advances in Cryptology–ASIACRYPT 2019, the 25th Annual International Conference on Theory and Application of Cryptology and Information Security, pp. 521-551, 2019, Kobe, Japan. 4. Q. Guo, T. Johansson, E. Mårtensson and P. Stankovski, Some Crypt- analytic and Coding-Theoretic Applications of a Soft Stern Algorithm, in Advances in Mathematics of Communications, vol. 13, no. 4, pp. 559-578, 2019. 5. Q. Guo, T. Johansson, E. Mårtensson and P. Stankovski, On the Asymp- totics of Solving the LWE Problem Using Coded-BKW with Sieving, in IEEE Transactions on Information Theory, vol. 65, no. 8, pp. 5243-5259, 2019. 6. E. Mårtensson, The Asymptotic Complexity of Coded-BKW with Sieving Using Increasing Reduction Factors, in 2019 IEEE International Sympo- sium on Information Theory (ISIT), pp. 2579-2583, 2019, Paris, France. The papers are slightly reformatted to fit within the overall thesis structure. The thesis is concluded with a popular science summary in Swedish. vii viii Contribution Statement For all papers in this list and the list of other contributions, the authors are listed in alphabetical order, which is common in mathematically oriented research areas1. In Paper 1 I developed the pruned FFT approach together with the first au- thor. I showed why the FFT distinguisher is optimal. I did the implementation work by modifying code developed for Paper 2. I developed the ideas for what implementations to run together with the first author and I ran the simulations. I did the main part of writing the paper. In Paper 2 I did the implementation work together with the first and fifth author. I ran the simulations together with the first author. I developed the file-based solution algorithm together with the fifth author. I wrote the paper together with all the other authors. In Paper 3 I developed the graph-based algorithms, derived their complexi- ties and wrote the paper together with all the other authors. In Paper 4 I developed the implementation, the numerical examples and parts of the applications. I did the complexity analysis together with the other authors. I ran the simulations together with the first author, which helped a lot in estimating the complexity of the algorithm. I wrote the paper together with all the other authors. In Paper 5 I did the numerical optimizations to calculate the time complex- ities. I made the illustrations that increased the readability of the paper and greatly helped in generalizing the ideas for Paper 6. I wrote the paper together with all the other authors. In Paper 6 I was the only author. The papers’ contributions to the research area are covered throughout Part I of the thesis. Paper 1 to 3, 5 and 6 are summarized in Chapter 9. Paper 4 is covered in Chapter 4. 1http://www.ams.org/profession/leaders/CultureStatement04.pdf ix Other Contributions The following peer-reviewed publications have also been published during my PhD studies, but are not included in this dissertation. • S. Gunnarsson, P. Larsson, S. Månsson, E. Mårtensson and J. Sönnerup, Enhancing Student Engagement Using GitHub as an Educational Tool, In Introduction to Teaching and Learning in Higher Education, Centre for Engineering Education, Faculty of Engineering, Lund University, 2017. • S. Gunnarsson, P. Larsson, S. Månsson, E. Mårtensson and J. Sönnerup, Engaging Students using GitHub as a Learning Management System, In Lund University’s Teaching and Learning Conference 2017, 2017, Lund, Sweden. The following publications were the conference versions of Paper 4 and Pa- per 5 respectively. • Q. Guo, T. Johansson, E. Mårtensson and P. Stankovski, Information Set Decoding with Soft Information and some cryptographic applications, In 2017 IEEE International Symposium on Information Theory (ISIT), pp. 1793-1797, Aachen, Germany, 2017. • Q. Guo, T. Johansson, E. Mårtensson and P. Stankovski, Coded-BKW with Sieving, In Advances in Cryptology–ASIACRYPT 2017, the 23rd An- nual International Conference on Theory and Application of Cryptology and Information Security, pp. 323-346, 2017, Hong Kong, China. The work done during this PhD has been supported by the Swedish Research Counsel (grant 2015-04528) and the Swedish Foundation for Strategic Research (grant RIT17-0005).