Abstract
Among many submissions to the NIST post-quantum cryptography (PQC) project, NewHope is a promising key encapsulation mechanism (KEM) based on the Ring-Learning with errors (Ring-LWE) problem. Since NewHope is an indistinguishability (IND)-chosen ciphertext attack secure KEM by applying the Fujisaki-Okamoto transform to an IND-chosen plaintext attack secure public key encryption, accurate calculation of decryption failure rate (DFR) is required to guarantee resilience against attacks that exploit decryption failures. However, the current upper bound of DFR on NewHope is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and the approximation effect of centered binomial distribution are not fully considered. Furthermore, since NewHope is a Ring-LWE based cryptosystem, there is a problem of error dependency among error coefficients, which makes accurate DFR calculation difficult. In this paper, we derive much tighter upper bound on DFR than the current upper bound using constraint relaxation and union bound. Especially, the above-mentioned factors are all considered in derivation of new upper bound and the centered binomial distribution is not approximated to subgaussian distribution. In addition, since the error dependency is considered, the new upper bound is much closer to the real DFR than the previous upper bound. Furthermore, the new upper bound is parameterized by using Chernoff-Cramer bound in order to facilitate calculation of new upper bound for the parameters of NewHope. Since the new upper bound is much lower than the DFR requirement of PQC, this DFR margin is used to improve the security and bandwidth efficiency of NewHope. As a result, the security level of NewHope is improved by 7.2 % or bandwidth efficiency is improved by 5.9 %.
Highlights
Current public-key algorithms based on integer decomposition, discrete logarithm, and elliptic curve discrete logarithm problems (e.g, RSA and elliptic curve cryptography) have been unlikely to be broken by currently available technology
In [4], [9], an upper bound on decryption failure rate (DFR) of NewHope is derived but this upper bound on DFR is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and approximation effect of centered binomial distribution are not fully considered
The new upper bound on DFR considers the error dependency among error coefficients by using the constraint relaxation, which is an approximation of a difficult problem to a nearby problem that is easier to solve, and union bound
Summary
Current public-key algorithms based on integer decomposition, discrete logarithm, and elliptic curve discrete logarithm problems (e.g, RSA and elliptic curve cryptography) have been unlikely to be broken by currently available technology. In [4], [9], an upper bound on DFR of NewHope is derived but this upper bound on DFR is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and approximation effect of centered binomial distribution are not fully considered. According to [20], [21], accurate calculation of DFR is difficult because there is a problem of error dependency in Ring-LWE based cryptosystems. (2) DFR Analysis of NewHope By Considering Error Dependency The previous upper bound on DFR of NewHope [4], [9] is rather loosely derived because the compression noise, effect of encoding/decoding of ATE in NewHope, effect of error dependency among error coefficients, and approximation effect of the centered binomial distribution are not fully considered. (3) Improvement of Security and Bandwidth Efficiency of NewHope By Using New DFR Margin Since the new upper bound on DFR of NewHope is much lower than the required 2−128, this DFR margin can be exploited to improve the security level by 7.2 % or bandwidth efficiency by 5.9 % without changing the procedures of NewHope
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
