Designs, Codes and Cryptography

, Volume 74, Issue 2, pp 325–354

On the complexity of the BKW algorithm on LWE

  • Martin R. Albrecht
  • Carlos Cid
  • Jean-Charles Faugère
  • Robert Fitzpatrick
  • Ludovic Perret
Article

DOI: 10.1007/s10623-013-9864-x

Cite this article as:
Albrecht, M.R., Cid, C., Faugère, JC. et al. Des. Codes Cryptogr. (2015) 74: 325. doi:10.1007/s10623-013-9864-x

Abstract

This work presents a study of the complexity of the Blum–Kalai–Wasserman (BKW) algorithm when applied to the Learning with Errors (LWE) problem, by providing refined estimates for the data and computational effort requirements for solving concrete instances of the LWE problem. We apply this refined analysis to suggested parameters for various LWE-based cryptographic schemes from the literature and compare with alternative approaches based on lattice reduction. As a result, we provide new upper bounds for the concrete hardness of these LWE-based schemes. Rather surprisingly, it appears that BKW algorithm outperforms known estimates for lattice reduction algorithms starting in dimension \(n \approx 250\) when LWE is reduced to SIS. However, this assumes access to an unbounded number of LWE samples.

Keywords

Learning with errors BKW LPN FHE 

Mathematics Subject Classification

94A60 

Copyright information

© Springer Science+Business Media New York 2013

Authors and Affiliations

  • Martin R. Albrecht
    • 1
  • Carlos Cid
    • 2
  • Jean-Charles Faugère
    • 3
    • 4
    • 5
  • Robert Fitzpatrick
    • 2
  • Ludovic Perret
    • 3
    • 4
    • 5
  1. 1.Technical University of DenmarkLyngbyDenmark
  2. 2.Information Security GroupRoyal Holloway, University of LondonSurreyUK
  3. 3.POLSYS Project, Paris-Rocquencourt CenterINRIAParisFrance
  4. 4.LIP6, UMR 7606UPMC Univ Paris 06ParisFrance
  5. 5.LIP6, UMR 7606CNRSParisFrance

Personalised recommendations