Learning Parity With Noise Problem Research Articles

A method for recovering linear block codes over an arbitrary finite field from sets of distorted code words

The article is devoted to one of the practically important problems of information security and cryptanalysis, which consists in recovering an unknown linear block code over an arbitrary field from a set of distorted code words. This is a hard computational problem, and the known problem-solving methods are proposed only for codes over the field of two elements and are based on the algorithms for searching words of small weight in (undistorted) linear block codes.
 The main result of the article is a method for solving the problem posed, which differs in essence from the known ones and consists in recovering the desired code by solving the LPN (Learning Parity with Noise) problem, namely, recovering the solutions of systems of linear equations with distorted right-hand sides and a random equally probable matrix of coefficients over specified field. The LPN problem is well known from the Theory of Computational Algorithms and Cryptanalysis. It is equivalent to the problem of random linear block code decoding, and the security of many modern post-quantum cryptosystems are based on its hardness.
 The proposed method provides an opportunity to apply a wider class of algorithms for recovering linear block codes in comparison with the previously known methods, in particular, algorithms like BKW and also the low weight words search algorithms in co-sets of linear block codes. Moreover, in contrast to previously known ones, the complexity of the proposed method depends linearly on the length of the required code (and increases with increasing of its dimension according to which algorithm for the LPN problem-solving is applied). Thus, the basic parameter determined the complexity of recovering a linear block code is its dimension (not its length), which, in principle, makes it possible to speed up known algorithms for recovering linear block codes from a set of corrupted code words.

LPN-based Attacks in the White-box Setting

In white-box cryptography, early protection techniques have fallen to the automated Differential Computation Analysis attack (DCA), leading to new countermeasures and attacks. A standard side-channel countermeasure, Ishai-Sahai-Wagner’s masking scheme (ISW, CRYPTO 2003) prevents Differential Computation Analysis but was shown to be vulnerable in the white-box context to the Linear Decoding Analysis attack (LDA). However, recent quadratic and cubic masking schemes by Biryukov-Udovenko (ASIACRYPT 2018) and Seker-Eisenbarth-Liskiewicz (CHES 2021) prevent LDA and force to use its higher-degree generalizations with much higher complexity.In this work, we study the relationship between the security of these and related schemes to the Learning Parity with Noise (LPN) problem and propose a new automated attack by applying an LPN-solving algorithm to white-box implementations. The attack effectively exploits strong linear approximations of the masking scheme and thus can be seen as a combination of the DCA and LDA techniques. Different from previous attacks, the complexity of this algorithm depends on the approximation error, henceforth allowing new practical attacks on masking schemes which previously resisted automated analysis. We demonstrate it theoretically and experimentally, exposing multiple cases where the LPN-based method significantly outperforms LDA and DCA methods, including their higher-order variants.This work applies the LPN problem beyond its usual post-quantum cryptography boundary, strengthening its interest for the cryptographic community, while expanding the range of automated attacks by presenting a new direction for breaking masking schemes in the white-box model.

CPA/CCA2-secure PKE with squared-exponential DFR from low-noise LPN

LPN (learning parity with noise) problem is a good candidate for post-quantum cryptography which enjoys simplicity and suitability for weak-power devices. Döttling et al. (ASIACRYPT 2012) initiated the first secure public key encryption (PKE) under the low-noise LPN assumption. Kiltz et al. (PKC 2014) proposed a simpler and more efficient scheme using double-trapdoor technique from the same assumption. Both schemes abide the decoding failure rate (DFR) 2−Θ(k) (k is the security parameter) and there exists CPA/CCA2-secure PKE with squared-exponential DFR 2−Θ(k2) from constant-noise LPN (Yu and Zhang, CRYPTO 2016). In this work, we give a positive answer with squared-exponential DFR in the low-noise setting.More precisely, we first introduce a variant (VxLPN) of the low-noise Exact LPN (xLPN, proposed by Jain et al. at ASIACRYPT 2012 and used as building block in commitments and zero-knowledge proofs), where the coefficient matrix A follows the uniform distribution over {0,1}q×n (n=Θ(k2),q=Θ(n)), the secret x is sampled from Bμn (Bμ is the Bernoulli distribution with noise rate μ=Θ(1q)), and the noise e follows a column vector distribution uniform over {z∈{0,1}q:|z|=qμ}. A series of reductions show that VxLPN is at least as hard as the standard LPN for the same noise rate μ. We then construct from the VxLPN CPA/CCA2 secure PKE schemes with squared-exponential DFR 2−Θ(k2) which share the common structure extrinsically with Kiltz et al. and Yu-Zhang schemes. The secret key(s) in our schemes are simply sampled from the Bernoulli distribution, and comparatively, the secret key(s) in Yu-Zhang schemes must be chosen from a tailored version of Bernoulli distribution (along with the coefficient matrix A that follows a distribution Dλn×n=Un×λ⋅Uλ×n induced by multiplying two random matrices in the public key, λ=Θ(log2⁡n)) in order to guarantee the correctness of their schemes. Consider the performance on 128-bit security level, our CCA2-secure scheme only holds 117.79 MB public keys, 67.31 MB secret keys and 10.15 KB ciphertexts, and thus is more efficient than the schemes of Döttling et al. and Kiltz et al. ((14.53 GB, 14.48 GB, 14.06 KB) and (161.78 MB, 92.45 MB, 13.60 KB) respectively).

Chosen-Ciphertext Secure Key Encapsulation Mechanism in the Standard Model

Key Encapsulation Mechanism (KEM) is a foundational cryptography primitive, which can provide secure symmetric cryptographic key material for transmission by using public key algorithms. Until now, many Chosen-Ciphertext (IND-CCA) secure KEM schemes are constructed from Chosen-Plaintext (IND-CPA) or One-Way (OW-CPA) secure PKE via the generic Fujisaki-Okamoto (FO) transformations (TCC 2017). However, the security relies on the Random Oracle Model (ROM). To the best of our knowledge, there are no IND-CCA secure KEM schemes based on Learning Parity with Noise (LPN) assumption that can against post quantum attacks in the standard model. In this work, we propose the first direct construction of LPN-based KEM, which is secure in the standard model. In particular, we use double-trapdoor technique to answer adversary’s decryption queries correctly and a Target Collision Resistant (TCR) hash function to check the validity of the ciphertext. The encapsulated key is determined by a special LPN problem (with no random oracle required). The scheme is IND-CCA secure against post-quantum attacks under the low-noise LPN assumptions by a series of games and the security reduction is tight. Compared with previous schemes on 128-bit security level, our CCA-secure scheme only holds 50.78MB public keys, 62.50MB secret keys and 4.54KB ciphertexts, which is more efficient than the schemes of Döttling <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> (ASIACRYPT 2012), Kiltz <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> (PKC 2014) and Yu <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> (CRYPTO 2016) ((7.27GB, 7.24GB, 7.03KB), (80.89MB, 46.23MB, 6.80KB) and (70.95MB, 70.65MB, 86.50KB) respectively).

Quantum-classical reinforcement learning for decoding noisy classical parity information

Learning a hidden parity function from noisy data, known as learning parity with noise (LPN), is an example of intelligent behavior that aims to generalize a concept based on noisy examples. The solution to LPN immediately leads to decoding a random binary linear code in the presence of classification noise. This problem is thought to be intractable classically, but can be solved efficiently if a quantum oracle can be queried. However, in practice, a learner is likely to obtain classical data. In this work, we show that a naive application of the quantum LPN algorithm to classical data encoded in an equal superposition state requires an exponential sample complexity. We then propose a quantum-classical reinforcement learning algorithm to solve the LPN problem for classical data and demonstrate a significant reduction in the sample complexity compared with the naive approach. Simulations with a hidden bit string of length up to 12 show that the quantum-classical reinforcement learning performs better than known classical algorithms when the sample complexity, run time, and robustness to classical noise are collectively considered. Our algorithm is robust to any noise in the quantum circuit that effectively appears as Pauli errors on the final state.

A Post-Quantum Biometric Template Protection Scheme Based on Learning Parity With Noise (LPN) Commitments

Biometric recognition has the potential to authenticate individuals by an intrinsic link between the individual and their physical, physiological and/or behavioral characteristics. This leads a higher security level than the authentication solely based on knowledge or possession. One of the reasons why biometrics is not completely accepted is the lack of trust in the storage of biometric templates in external servers. Biometric data are sensitive data which should be protected as is contemplated in the data protection regulation of many countries. In this work, we propose the use of biometric Learning Parity With Noise (LPN) commitments as template protection scheme. To the best of our knowledge, this is the first proposal for biometric template protection based on the LPN problem (that is, the difficulty of decoding random linear codes), which offers post-quantum security. Biometric features are compared in the protected domain. Irreversibility, revocability, and unlinkability properties are satisfied as well as resistance to False Acceptance Rate (FAR), cross-matching, Stolen Token, and similarity-based attacks. A recognition accuracy with a 0% FAR is achieved, because user-specific secret keys are employed, and the False Rejection Ratio (FRR) can be adjusted depending on a threshold to preserve the accuracy of the unprotected scheme in the Stolen Token scenario. A good performance in terms of execution time, template storage and operation complexity is obtained for security levels at least of 80 bits. The proposed scheme is employed in a dual-factor authentication protocol from the literature to illustrate how it provides security using authentication and database (cloud) servers that can be malicious. The proposed LPN-based protected scheme can be applied to any biometric trait represented by binary features and any matching score based on Hamming or Jaccard distances. In particular, experimental results are included of a practical finger vein-based recognition system implemented in Matlab.

Low Noise LPN: Key dependent message secure public key encryption an sample amplification

Cryptographic schemes based on the learning parity with noise (LPN) problem have several very desirable aspects: low computational overhead, simple implementation and conjectured post-quantum hardness. Choosing the LPN noise parameter sufficiently low allows for public key cryptography. In this study, the authors construct the first standard model public key encryption scheme with key dependent message security based solely on the low-noise LPN problem. Additionally, they establish a new connection between LPN with a bounded number of samples and LPN with an unbounded number of samples. In essence, they show that if LPN with a small error and a small number of samples is hard, then LPN with a slightly larger error and an unbounded number of samples is also hard. The key technical ingredient to establish both results is a variant of the LPN problem called the extended LPN problem.

A New Algorithm for Solving Ring-LPN With a Reducible Polynomial

The LPN (Learning Parity with Noise) problem has recently proved to be of great importance in cryptology. A special and very useful case is the RING-LPN problem, which typically provides improved efficiency in the constructed cryptographic primitive. We present a new algorithm for solving the RING-LPN problem in the case when the polynomial used is reducible. It greatly outperforms previous algorithms for solving this problem. Using the algorithm, we can break the Lapin authentication protocol for the proposed instance using a reducible polynomial, in about 2^70 bit operations.

MPI-based implementation of an enhanced algorithm to solve the LPN problem in a memory-constrained environment

Abstract In recent years, several lightweight cryptographic protocols whose security lies in the assumed intractability of the learning parity with noise (LPN) problem have been proposed. The LPN problem has been shown to be solvable in subexponential time by algorithms that have very large (subexponential) memory requirements, which limits their practical applicability. When the memory resources are constrained, a brute-force search is the only known way of solving the LPN problem. In this paper, we propose a new parallel implementation, called Parallel-LPN, of an enhanced algorithm to solve the LPN problem. We implemented the Parallel-LPN in C and MPI (Message Passing Interface), and it was tested on a cluster system, where we obtained a quasi-linear speedup of approximately 90%. We also proposed a new algorithm by using combinatorial objects that enhances the Parallel-LPN performance and its serial version.