CPA/CCA2-secure PKE with squared-exponential DFR from low-noise LPN

Abstract

LPN (learning parity with noise) problem is a good candidate for post-quantum cryptography which enjoys simplicity and suitability for weak-power devices. Döttling et al. (ASIACRYPT 2012) initiated the first secure public key encryption (PKE) under the low-noise LPN assumption. Kiltz et al. (PKC 2014) proposed a simpler and more efficient scheme using double-trapdoor technique from the same assumption. Both schemes abide the decoding failure rate (DFR) 2−Θ(k) (k is the security parameter) and there exists CPA/CCA2-secure PKE with squared-exponential DFR 2−Θ(k2) from constant-noise LPN (Yu and Zhang, CRYPTO 2016). In this work, we give a positive answer with squared-exponential DFR in the low-noise setting.More precisely, we first introduce a variant (VxLPN) of the low-noise Exact LPN (xLPN, proposed by Jain et al. at ASIACRYPT 2012 and used as building block in commitments and zero-knowledge proofs), where the coefficient matrix A follows the uniform distribution over {0,1}q×n (n=Θ(k2),q=Θ(n)), the secret x is sampled from Bμn (Bμ is the Bernoulli distribution with noise rate μ=Θ(1q)), and the noise e follows a column vector distribution uniform over {z∈{0,1}q:|z|=qμ}. A series of reductions show that VxLPN is at least as hard as the standard LPN for the same noise rate μ. We then construct from the VxLPN CPA/CCA2 secure PKE schemes with squared-exponential DFR 2−Θ(k2) which share the common structure extrinsically with Kiltz et al. and Yu-Zhang schemes. The secret key(s) in our schemes are simply sampled from the Bernoulli distribution, and comparatively, the secret key(s) in Yu-Zhang schemes must be chosen from a tailored version of Bernoulli distribution (along with the coefficient matrix A that follows a distribution Dλn×n=Un×λ⋅Uλ×n induced by multiplying two random matrices in the public key, λ=Θ(log2⁡n)) in order to guarantee the correctness of their schemes. Consider the performance on 128-bit security level, our CCA2-secure scheme only holds 117.79 MB public keys, 67.31 MB secret keys and 10.15 KB ciphertexts, and thus is more efficient than the schemes of Döttling et al. and Kiltz et al. ((14.53 GB, 14.48 GB, 14.06 KB) and (161.78 MB, 92.45 MB, 13.60 KB) respectively).