Provably Weak Instances of RingLWE
 20 Citations
 2.8k Downloads
Abstract
The ring and polynomial learning with errors problems (RingLWE and PolyLWE) have been proposed as hard problems to form the basis for cryptosystems, and various security reductions to hard lattice problems have been presented. So far these problems have been stated for general (number) rings but have only been closely examined for cyclotomic number rings. In this paper, we state and examine the RingLWE problem for general number rings and demonstrate provably weak instances of the Decision RingLWE problem. We construct an explicit family of number fields for which we have an efficient attack. We demonstrate the attack in both theory and practice, providing code and running times for the attack. The attack runs in time linear in q, where q is the modulus.
Our attack is based on the attack on PolyLWE which was presented in [EHL]. We extend the EHLattack to apply to a larger class of number fields, and show how it applies to attack RingLWE for a heuristically large class of fields. Certain RingLWE instances can be transformed into PolyLWE instances without distorting the error too much, and thus provide the first weak instances of the RingLWE problem. We also provide additional examples of fields which are vulnerable to our attacks on PolyLWE, including powerof2 cyclotomic fields, presented using the minimal polynomial of \(\zeta _{2^n} \pm 1\).
Keywords
Weak Instance Number Field Cyclotomic Field Cryptographic Size Spectral Norm1 Introduction
Latticebased cryptography has become a very hot research topic recently with the emergence of new applications to homomorphic encryption. The hardness of the RingLWE problem was related to various wellknown hard lattice problems [R, MR09, MR04, LPR, BL+], and the hardness of the PolyLWE problem was reduced to RingLWE in [LPR, DD]. The hardness of the PolyLWE problem is used as the basis of security for numerous cryptosystems, including [BV, BGV, GHS]. The hardness of RingLWE was also shown [SS] to form a basis for the proof of security of a variant of NTRU [HPS, IEEE].
In [EHL], the first weaknesses in the PolyLWE problem were discovered for classes of number fields satisfying certain properties. In addition, a list of properties of number fields were identified which are sufficient to guarantee a reduction between the RingLWE and the PolyLWE problems, and a searchtodecision reduction for RingLWE. Unfortunately, in [EHL], no number fields were found which satisfied both the conditions for the attack and for the reductions. Thus [EHL] produced only examples of number fields which were weak instances for PolyLWE.
The contributions of this paper at a high level are as follows: In Sect. 3 we strengthen and extend the attacks presented in [EHL] in several significant ways. In Sect. 4, most importantly, we show how the attacks can be applied also to the RingLWE problem. In Sect. 5, we construct an explicit family of number fields for which we have an efficient attack on the Decision RingLWE Problem. This represents the first successful attacks on the Decision RingLWE problem for number fields with special properties. For Galois number fields, we also know that an attack on the decision problem gives an attack on the search version of RingLWE [EHL]. In addition, in Sect. 9, we present the first successful implementation of the EHL attack at cryptographic sizes and attack both RingLWE and PolyLWE instances. For example for \(n=1024\) and \(q=2^{31}1\), the attack runs in about 13 hours. Code for the attack is given in Appendix A. In Sect. 6 we give a more general construction of number fields such that heuristically a large percentage of them will be vulnerable to the attacks on RingLWE.
In more detail, we consider rings of integers in number fields \(K=\mathbb {Q}[x]/(f(x))\) of degree n, modulo a large prime number q, and we give attacks on PolyLWE which work when f(x) has a root of small order modulo q. The possibility of such an attack was mentioned in [EHL] but not explored further. In Sects. 3.1 and 3.2, we give two algorithms for this attack, and in Sects. 7 and 7.3 we give many examples of number fields and moduli, some of cryptographic size, which are vulnerable to this attack. The most significant consequence of the attack is the construction of the number fields which are weak for the RingLWE problem (Sect. 6).
To understand the vulnerability of RingLWE to these attacks, we state and examine the RingLWE problem for general number rings and demonstrate provably weak instances of RingLWE. We demonstrate the attack in both theory and practice for an explicit family of number fields, providing code and running times for the attack. The attack runs in time linear in q, where q is the modulus. The essential point is that RingLWE instances can be mapped into PolyLWE instances, and if the map does not distort the error too much, then the instances may be vulnerable to attacks on PolyLWE. The distortion is governed by the spectral norm of the map, and we compute the spectral norm for the explicit family we construct in Sect. 5 and analyze when the attack will succeed. For the provably weak family which we construct, the feasibility of the attack depends on the ratio of \(\sqrt{q}/n\). We prove that the attack succeeds when \(\sqrt{q}/n\) is above a certain bound, but in practice we find that we can attack instances where the ratio is almost 100 times smaller than that bound. Even for RingLWE examples which are not taken from the provably weak family, we were able to attack in practice relatively generic instances of number fields where the spectral norm was small enough (see Sect. 9).
We investigate cyclotomic fields (even 2power cyclotomic fields) given by an alternate minimal polynomial, which are weak instances of PolyLWE for that choice of polynomial basis. Section 7.3 contains numerous examples of 2power cyclotomic fields which are vulnerable to attack when instantiated using an alternative polynomial basis, thus showing the heavy dependence in the hardness of these latticebased problems on the choice of polynomial basis. In addition, we analyze the case of cyclotomic fields to understand their potential vulnerability to these lines of attack and we explain why cyclotomic fields are immune to attacks based on roots of small order (Sect. 8). Finally, we provide code in the form of simple routines in SAGE to implement the attacks and algorithms given in this paper and demonstrate successful attacks with running times (Sect. 9).
As a consequence of our results, one can conclude that the hardness of RingLWE is both dependent on special properties of the number field and sensitive to the particular choice of q, and some choices may be significantly weaker than others. In addition, for applications to cryptography, since our attacks on PolyLWE run in time roughly O(q) and may be applicable to a wide range of fields, including even 2power cyclotomic fields with a bad choice of polynomial basis, these attacks should be taken into consideration when selecting parameters for PolyLWEbased systems such as [BV, BGV] and other variants. For many important applications to homomorphic encryption (see for example [GLN, BLN]), these attacks will not be relevant, since the modulus q is chosen large enough to allow for significant error growth in computation, and would typically be of size 128 bits up to 512 bits. For that range, the attacks presented in this paper would not run. However, in other applications of RingLWE to key exchange for the TLS protocol [BCNS], parameters for achieving 128bit security are suggested where \(n=2^{10}\) and \(q=2^{32}1\), with \(\sigma \approx 3\), and these parameters would certainly be vulnerable to our attacks for weak choices of fields and q.
2 Background on PolyLWE
Let f(x) be a monic irreducible polynomial in \(\mathbb {Z}[x]\) of degree n, and let q be a prime such that f(x) factors completely modulo q. Let \(P = \mathbb {Z}[x]/f(x)\) and let \(P_q = P/qP = \mathbb {F}_q[x]/f(x)\). Let \(\sigma \in \mathbb {R}^{>0}\). The uniform distribution on \(P \simeq \mathbb {Z}^n\) will be denoted \(\mathcal {U}\). By Gaussian distribution of parameter \(\sigma \) we refer to a discrete Gaussian distribution of mean 0 and variance \(\sigma ^2\) on P, spherical with respect to the power basis. This will be denoted \(\mathcal {G}_\sigma \). It is important to our analysis that we assume that in practice, elements are sampled from Gaussians of parameter \(\sigma \) truncated at width \(2 \sigma \).
There are two standard PolyLWE problems. Our attack solves the decision variant, but it also provides information about the secret.
Problem 1
(Decision PolyLWE Problem). Let \(s(x) \in P\) be a secret. The decision PolyLWE problem is to distinguish, with nonnegligible advantage, between the same number of independent samples in two distributions on \(P\times P\). The first consists of samples of the form \((a(x), b(x) := a(x) s(x) + e(x) )\) where e(x) is drawn from a discrete Gaussian distribution of parameter \(\sigma \), and a(x) is uniformly random. The second consists of uniformly random and independent samples from \(P \times P\).
Problem 2
(Search PolyLWE Problem). Let \(s(x) \in P\) be a secret. The search PolyLWE problem, is to discover s given access to arbitrarily many independent samples of the form \((a(x), b(x) := a(x)s(x) + e(x))\) where e(x) is drawn from a Discrete Gaussian of parameter \(\sigma \), and a(x) is uniformly random.
The polynomial s(x) is called the secret and the polynomials \(e_i(x)\) are called the errors.
2.1 Parameter Selection
 1.
\(P_{LP1} = (n,q,w) = (192, 4093, 8.87)\), \(P_{LP2} = (256, 4093, 8.35)\), \(P_{LP3} = (320, 4093, 8.00)\) for low, medium and high security, recommended by Lindner and Peikert in [LP];
 2.
\(P_{GF} = (n,q,w) = (512, 12289,12.18)\) for high security used in [GF+];
 3.
\(P_{BCNS} = (n,q,w) = (1024, 2^{31}1, 3.192)\) suggested in [BCNS] for the TLS protocol. Here, \(q = 2^{32}1\) was actually suggested but it is not prime. Here, the authors remark that q is taken to be large for correctness but could potentially be decreased.
3 Attacks on PolyLWE
 1.
Transfer the problem to \(\mathbb {F}_q\) via a ring homomorphism \(\phi : P_q \rightarrow \mathbb {F}_q\).
 2.
Loop through guesses for the possible images \(\phi (s(x))\) of the secret.
 3.
Obtain the values \(\phi (e_i(x))\) under the assumption that the guess at hand is correct.
 4.
Examine the distribution of the \(\phi (e_i(x))\) to determine if it is Gaussian or uniform.
If f is assumed to have a root \(\alpha \equiv 1 \mod q\) or \(\alpha \) of small order modulo q, then this attack is due to EisentraegerHallgrenLauter [EHL].
Therefore, after looping through all guesses, if all the distributions appeared uniform, then conclude that the samples were not LWE samples; whereas if one of the guesses worked for all samples and always yielded an error distribution which appeared Gaussian, assume that particular g was a correct guess. In the latter case this also yields one piece of information about the secret: \(g=s(\alpha ) \mod q\).
 1.
q is small enough to allow looping through \(\mathbb {F}_q\),
 2.
\(\phi (\mathcal {U})\) and \(\phi (\mathcal {G}_{\sigma })\) are distinguishable.
Our analysis hinges on the difficulty of distinguishing \(\phi (\mathcal {U})\) from \(\phi (\mathcal {G}_{\sigma })\), as a function of the parameters \(\sigma \), n, \(\ell \), q, and f. Distinguishability becomes easier when \(\sigma \) is smaller (so \(\mathcal {U}\) and \(\mathcal {G}_{\sigma }\) are farther apart to begin with), n is smaller and q is larger (since then less information is lost in the map \(\phi \)), and \(\ell \) is larger (since there are more samples to test the distributions). The dependence on f comes primarily as a function of its roots \(\alpha _i\) modulo q, which may have properties that make distinguishing easier.
Ideally, for higher security, one will choose parameters that make distinguishing nearly impossible, i.e. such that \(\phi (\mathcal {G}_{\sigma })\) appears very close to uniform modulo q.
Example
([EHL]). We illustrate the attack in the simplest case \(\alpha =1\). Assume \(f(1) \equiv 0 \hbox { mod } q\), and consider the distinguishability of the two distributions \(\phi ({\mathcal U})\) and \(\phi ({\mathcal G}_\sigma )\). Given \((a_i(x), b_i(x))\), make a guess \(g\in \mathbb {F}_q\) for the value of s(1) and compute \(b_i(1)g\cdot a_i(1)\). If \(b_i \) is uniform, then \(b_i(1)g \cdot a_i(1)\) is uniform for all g. If \(b_i=a_i s +e_i\), then there is a guess g for which \(b_i(1)ga_i(1)=e_i(1)\) where \(e_i(x)=\sum _{j=1}^n e_{ij}x^j\) and \(g=s(1)\). Since \(e_i(1) = \sum _{j=1}^n e_{ij}\), where \(e_{ij}\) are chosen from \(\mathcal {G}_{\sigma }\), it follows that \(e_i(1)\) are sampled from \({\mathcal G}_{\sqrt{n}\sigma }\) where \(n\sigma ^2<< q\). The attack can be described loosely as follows: for each sample, test each guess g in \(\mathbb {F}_q\) to see if \(b_i(1)g \cdot a_i(1)\) is small modulo q, and only keep those guesses which pass the test. Repeat with the next sample and continue to keep only the guesses which pass.
3.1 Attack Based on a Small Set of Error Values Modulo q
Let S be the set of possible values of \(e(\alpha )\) modulo q. We assume for simplicity that n is divisible by r. Then the coefficients \(e_j+e_{j+r}+\cdots + e_{nr+j}\) of (1) fall into a subset of \(\mathbb {Z}/q\mathbb {Z}\) of size at most \(4\sigma n/r\). We sum over r terms, hence, \(S = (4\sigma n/r )^r\) residues modulo q. For \(r=2\), this becomes \((2n\sigma )^2\).
Proposition 1
Proof
As discussed above, there are at most q possible values for the elements of S under the assumption (2). To compute each one takes n additions per coefficient (of which there are r), combined with an additional r multiplications and r additions. (Here we have assumed the \(\alpha ^i\) have been computed; this takes r multiplications.) Each addition or multiplication takes time at most \(\log q\). Therefore, computing S takes time at most \(\widetilde{O}(qnr)\). For sorting, it is best to sort as S is computed; placing each element correctly takes \(\log q\) time.
The principal double loop takes time at most \(\widetilde{O}(\ell q)\). If \(b(\alpha )\) and \(a(\alpha )\) are precomputed, then for each guess g, the computation of \(b(\alpha ) g a(\alpha )\) only costs one multiplication and one subtraction modulo q (i.e. \(2\log q\)) while it requires only \(\log q\) bit comparisons to decide whether this is in the set S.
In Step 4, for later samples, only guesses which were successful in the previous samples (i.e. gave a value which was in the set S) are considered. For a sample chosen uniformly at random, one expects the number of successful guesses to be roughly \(\frac{\#S}{q}\). Thus for the second sample, we repeat the above test for only \((\#S)\) guesses. At the \(\ell ^{th}\) sample, retaining only guesses which were successful for all previous samples, we expect to test only \((\frac{\#S}{q})^\ell q\) guesses, which very quickly goes to zero. Hence, if we examine \(\ell \) samples, our tolerance for false positives is proportional to \((\frac{\#S}{q})^\ell \).
3.2 Attack Based on the Size of the Error Values
In this section, we describe the most general \(\phi : P_q \rightarrow \mathbb {F}_q\) attack on the PolyLWE problem, one which can be carried out in any situation. The rub is that the probability of success will be vanishingly small unless we are in a very special situation. Therefore our analysis actually bolsters the security of PolyLWE.
 1.
\(\alpha = \pm 1\)
 2.
\(\alpha \ne \pm 1\) and \(\alpha \) has small order \(r\ge 3\) modulo q
Case 2 (\(\alpha \ne \pm 1\) and \(\alpha \) has small order \(r\ge 3\) modulo q).
In each of the two cases, we have given conditions on the size of \(\sigma \) under which \(\mathcal {U}\) and \(\mathcal {G}_\sigma \) are distinguishable and an attack is likely to succeed. We now elaborate on the algorithm that would be used.
We denote by \(\ell \) the number of samples observed. For each guess g mod q, we compute \(b_i  g a_i\) for \(i=1, \ldots , \ell \). If there is a guess g mod q for which the event \(E_i\) occurs for all \(i=1, \ldots ,\ell \), then the algorithm returns the guess if it is unique and INSUFFICIENT SAMPLES otherwise; the samples are likely valid PolyLWE samples. Otherwise, it reports that they are certainly not valid PolyLWE samples.
Proposition 2
 1.\(\alpha = \pm 1\) and$$\begin{aligned} 8\sigma \sqrt{n} < q. \end{aligned}$$
 2.\(\alpha \) has small order \(r\ge 3\) modulo q, and$$ 8 \sigma \dfrac{\sqrt{n}}{\sqrt{r}} \dfrac{\sqrt{\alpha ^{2r}1}}{\sqrt{\alpha ^21}} < q. $$
Then Algorithm 2 terminates in time at most \(\widetilde{O}(\ell q)\), where the implied constant is absolute. Furthermore, if the algorithm returns NOT PLWE, then the samples were not valid PolyLWE samples. If it outputs anything other than NOT PLWE, then the samples are valid PolyLWE samples with probability at least \(1(\frac{1}{2})^\ell \).
Proof
The proof is as in Proposition 1, without the first few steps.
We remark that Propositions and Algorithms 1 and 2 overlap in some cases. For \(\alpha =\pm 1\), Algorithm 2 is more applicable (i.e. more parameter choices are susceptible), while for \(\alpha \) of other small orders, Algorithm 1 is more applicable.
4 Moving the Attack from PolyLWE to RingLWE
We use the term PolyLWE to refer to LWE problems generated by working in a polynomial ring, and reserve the term RingLWE for LWE problems generated by working with the canonical embedding of a number field as in [LPR, LPR13]. In the previous sections we have expanded upon Eisenträger, Hallgren and Lauter’s observation that for certain distributions on certain lattices given by PolyLWE, the ring structure presents a weakness. We will now consider whether it is possible to expand that analysis to LWE instances created through RingLWE for number fields besides cyclotomic ones.
In particular, the necessary ingredient is that the distribution be such that under the ring homomorphisms of Sect. 3, the image of the errors is a ‘small’ subset of \(\mathbb {Z}/q\mathbb {Z}\), either the error values themselves are small, or they form a small, identifiable subset of \(\mathbb {Z}/q\mathbb {Z}\). Assuming a spherical Gaussian in the canonical embedding of R or \(R^\vee \), we describe a class of number fields for which this weakness occurs. A similar analysis would apply without the assumption that the distribution is spherical in the canonical embedding.
Here, we setup the key players (a number field and its canonical embedding, etc.) for general number fields so that these definitions specialize to those in [LPR13]. There are some choices inherent in our setup: it may be possible to generalize RingLWE to number fields in several different ways. We consider the two most natural ways.
4.1 The Canonical Embedding
Let K be a number field of degree n with ring of integers R whose dual is \(R^\vee \). We will embed the field K in \(\mathbb {R}^n\). Note that our setup is essentially that of [DD], rather than [LPR13], but the difference is notational.
Let \(\sigma _1, \ldots , \sigma _n\) be the n embeddings of K, ordered so that \(\sigma _1\) through \(\sigma _{s_1}\) are the \(s_1\) real embeddings, and the remaining \(ns_1 = 2s_2\) complex embeddings are paired in such a way that \(\overline{\sigma _{s_1+k}} = \sigma _{s_1+s_2+k}\) for \(k=1, \ldots , s_2\) (i.e. list \(s_2\) nonpairwiseconjugate embeddings and then list their conjugates following that).
Then R and \(R^\vee \) form lattices in \(\mathbb {R}^n\).
4.2 Spherical Gaussians and Error Distributions
From this distribution we can generate the RingLWE error distribution on R, respectively \(R^\vee \), by taking a valid discretization \(\lfloor \varPsi \rceil _{R}\), respectively \(\lfloor \varPsi \rceil _{R^\vee }\), in the sense of [LPR13]. Now we have at hand a lattice, R, respectively \(R^\vee \), and a distribution on that lattice. The parameters (particularly \(\sigma \)) are generally advised to be chosen so that this instance of LWE is secure against general attacks on LWE (which do not depend on the extra structure endowed by the number theory).
4.3 The RingLWE Problems
Write \(R_q := R/qR\) and \(R_q^\vee = R^\vee /qR^\vee \). The standard RingLWE problems are as follows, where K is taken to be a cyclotomic field [LPR, LPR13].
Definition 1
(RingLWE AverageCase Decision [LPR]). Let \(s \in R_q^\vee \) be a secret. The averagecase decision RingLWE problem, is to distinguish with nonnegligible advantage between the same number of independent samples in two distributions on \(R_q \times R_q^\vee \). The first consists of samples of the form \((a, b:=as +e )\) where e is drawn from \(\chi := \lfloor \varPsi \rceil _{R^\vee }\) and a is uniformly random, and the second consists of uniformly random and independent samples from \(R_q \times R_q^\vee \).
Definition 2
(RingLWE Search [LPR]). Let \(s \in R_q^\vee \) be a secret. The search RingLWE problem, is to discover s given access to arbitrarily many independent samples of the form \((a, b:=as +e )\) where e is drawn from \(\chi := \lfloor \varPsi \rceil _{R^\vee }\) and a is uniformly random.
 1.
preserve these definitions exactly as they are stated, or
 2.
eliminate the duals, i.e. replace every instance of \(R^\vee \) with R in the definitions above.
To distinguish these two possible definitions, we will refer to dual RingLWE and nondual RingLWE. Lyubashevsky, Peikert and Regev remark that for cyclotomic fields, dual and nondual RingLWE lead to computationally equivalent problems [LPR, Sect. 3.3]. They go on to say that over cyclotomics, for implementation and efficiency reasons, dual RingLWE is superior.
Generalising dual RingLWE to general number fields is the most naive approach, but it presents the problem that working with the dual in a general number field may be difficult. Still, it is possible there are families of accessible number fields for which this may be the desired avenue.
We will analyse the effect of the PolyLWE vulnerability on both of these candidate definitions. In fact, the analysis will highlight some potential differences in their security, already hinted at in the discussion in [LPR, Sect. 3.3].
4.4 Isomorphisms from \(\theta (R)\) to a Polynomial Ring
Suppose K is a monogenic number field, meaning that R is isomorphic to a polynomial ring \(P = \mathbb {Z}[X]/f(X)\) for some monic irreducible polynomial f (f is a monogenic polynomial). In this case, we obtain \(R = \gamma R^\vee \), for some \(\gamma \in R\) (here, \(\gamma \) is a generator of the different ideal), so that \(\theta (R^\vee )\) and \(\theta (R)\) are related by a linear transformation. Thus a (dual or nondual) RingLWE problem concerning the lattice \(\theta (R)\) or \(\theta (R^\vee )\) can be restated as a PolyLWE problem concerning P.
Let \(\alpha \) be a root of f. Then R is isomorphic to P, via \(\alpha \mapsto X\). An integral basis for R is \(1, \alpha , \alpha ^2, \ldots , \alpha ^{n1}\). An integral basis for \(R^\vee \) is \( \gamma ^{1}, \gamma ^{1}\alpha , \gamma ^{1}\alpha ^2, \ldots , \gamma ^{1}\alpha ^{n1}\). Let \(M_\alpha \) be the matrix whose columns are \(\{ \theta (\alpha ^i) \}\). Let \(M^\vee _\alpha \) be the matrix whose columns are \(\{ \theta (\gamma ^{1}\alpha ^i) \}\). If \({\mathbf v}\) is a vector of coefficients representing some \(\beta \in K\) in terms of the basis \(\{ \alpha ^i \}\) for \(K/\mathbb {Q}\), then \(\theta (\beta ) = M_\alpha {\mathbf v}\). In other words, \(M_\alpha : P \rightarrow \theta (R)\) is an isomorphism (where P is represented as vectors of coefficients). Similarly, \(M^\vee _\alpha : P \rightarrow \theta (R^\vee )\) is an isomorphism.
4.5 The Spectral Norm
Given an \(n \times n\) matrix M, its spectral norm \(\rho = M_2\) is the \(\ell _2\) norm on its \(n^2\) entries. This is equal to the largest singular value of M. This is also equal to the largest radius of the image of a unit ball under M. This last interpretation allows one to bound the image of a spherical Gaussian distribution of parameter \(\sigma \) on the domain of M by another of parameter \(\rho \sigma \) on the codomain of M (in the sense that the image of the ball of radius \(\sigma \) will map into a ball of radius \(\rho \sigma \) after application of M).
The normalized spectral norm of M is defined to be \(\rho ' = M_2/\det (M)^{1/n}\). The condition number of M is \(k(M) = M_2M^{1}_2\).
4.6 Moving the Attack from PolyLWE to RingLWE
Via the isomorphism \(M:=M_\alpha ^{1}\) (respectively \(M:=(M^\vee _\alpha )^{1}\)), an instance of the nondual (respectively dual) RingLWE problem gives an instance of the PolyLWE problem in which the error distribution is the image of the error distribution in \(\theta (R)\) (respectively \(\theta (R^\vee )\)). In general, this may be an elliptic Gaussian distorted by the isomorphism. If the distortion is not too large, then it may be bounded by a spherical Gaussian which is not too large. In that case, a solution to the PolyLWE problem with the new spherical Gaussian error distribution may be possible. If so, it will yield a solution to the original RingLWE problem.
This is essentially the same reduction described in [EHL]. However, those authors assume that the isomorphism is an orthogonal linear map; we are loosening this condition. The essential question in this loosening is how much the Gaussian distorts under the isomorphism. Our contribution is an analysis of the particular basis change.
 1.
K is monogenic.
 2.
f satisfies \(f(1) \equiv 0 \pmod q\).
 3.
\(\rho \) and \(\sigma \) are sufficiently small.
The first condition guarantees the existence of appropriate isomorphisms to a polynomial ring; the second and third are required for the PolyLWE attack to apply. The purpose of the third requirement is that the discrete Gaussian distribution in \(\mathbb {R}^n\) transfers to give vectors e(x) in the polynomial ring having the property that e(1) lies in the range \([q/4,q/4)\) except with negligible probability; this allows Algorithm 2 and the conclusions of Proposition 2 to apply.
Let us now state our main result.
Theorem 1
Proof
In what follows, we find a family of polynomials satisfying the conditions of the theorem, and give heuristic arguments that such families are in fact very common. The other cases (other than \(\alpha =1\)) appear outofreach for now, simply because the bounds on \(\rho \) are much more difficult to attain. We will not examine them closely.
4.7 Choice of \(\sigma \)
5 Provably Weak RingLWE Number Fields
Proposition 3
Let n be power of a prime \(\ell \). If \(q1\) is squarefree and \(\ell ^2 \not \mid ((1q)^n(1q))\) then the polynomials \(f_{n,q}\) are monogenic.
Proof
This is a result of Gassert in [G, Theorem 5.1.4]. As stated, Theorem 5.1.4 of [G] requires \(\ell \) to be an odd prime. However, for the monogenicity portion of the conclusion, the proof goes through for \(p=2\).
Proposition 4
Proof
Theorem 2
 1.
n is a power of the prime \(\ell \),
 2.
\(q1\) is squarefree,
 3.
\(\ell ^2 \not \mid ((1q)^n(1q))\),
 4.we have \(\tau > 1\), where$$ \tau := \frac{ q }{2\sqrt{2} w n(q1)^{\frac{1}{2}\frac{1}{2n}}}. $$
Then the nondual RingLWE decision problem for f and w (defined by (4)) can be solved in time \(\widetilde{O}(\ell q)\) with probability \(1  2^{\ell }\), using a dataset of \(\ell \) samples.
Proof
Under the stated conditions, f has a root 1 modulo q, and therefore PolyLWE is vulnerable to the attack specified in Algorithm 2. The other properties guarantee the applicability of Theorem 1 via Propositions 3 and 4.
Under the assumption that \(q1\) is infinitely often squarefree, this provides a family of examples which are susceptible to attack (taking, for example, n as an appropriate power of 2; note that in this case item (3) is automatic).
Interestingly, their susceptibility increases as q increases relative to n. It is the ratio \(\sqrt{q}/n\), rather than their overall size, which controls the vulnerability (at least as long as q is small enough to run a loop through the residues modulo q).
Parameters  \(P_{LP1}\)  \(P_{LP2}\)  \(P_{LP3}\)  \(P_{GF}\)  \(P_{BCNS}\) 

\(\tau \)  0.0136  0.0108  0.0090  0.0063  5.0654 
The bound on \(\tau \) in Theorem 1 is stronger than what is required in practice for the attack to succeed. In particular, the spectral norm of the transformation \(M_\alpha ^{1}\) does not accurately reflect the average behaviour; it is worst case. As n increases, it is increasingly unlikely that error samples happen to lie in just the right direction from the origin to be inflated by the full spectral norm. Furthermore, we assumed in the analysis of Theorem 1 an overly generous bound on the error vectors.
The proof is in the pudding: in Sect. 9 we have successfully attacked parameters for which \(\tau < 0.02\), including \(P_{LP1}\).
6 Heuristics on the Prevalence of Weak RingLWE Number Fields
In this section, we argue that many examples satisfying Theorem 1 are very likely to exist. In fact, each of the individual conditions is fairly easy to attain. We will see in what follows that given a random monogenic number field, there is with significant probability at least one prime q for which RingLWE is vulnerable (i.e. the bound (5) is attained) for parameters comparable to those of \(P_{BNCS}\). Note that in this parameter range, the spectral norm is expensive to compute directly.
6.1 Monogenicity
Monogenic fields are expected to be quite common in the following sense. If f of degree \(n \ge 4\) is taken to be a random polynomial (i.e. its coefficients are chosen randomly), then it is conjecturally expected that with probability \(\gtrsim 0.307\), P will be the ring of integers of a number field [K]. In particular, if f has squarefree discriminant, this will certainly happen. Furthermore, cyclotomic fields are monogenic, as are the families described in the last section.
However, at degrees \(n \sim 2^{10}\), the discriminant of f is too large to test for squarefreeness, so testing for monogenicity may not be feasible. Kedlaya has developed a method for constructing examples of arbitrary degree [K].
6.2 Examples, \(n = 2^{10}\), \(q \sim 2^{32}\)
In this size range, we were not able to compute the spectral norm of K directly in a reasonable amount of time. In the next few sections we will make persuasive heuristic arguments that it can be expected to have \(\rho '\) well within the required bound (5), i.e. \(\rho ' < 2^{17}\). That is, we expect these examples and others like them to be vulnerable.
6.3 Heuristics for the Spectral Norm
To find large q requires taking more complex polynomials f, which in turn may inflate the spectral norm, so the complexity of f must be balanced.
In conclusion, we expect to find that many f(x) will have \(\rho '\) quite small.
6.4 Experimental Evidence for the Spectral Norm
We only ran experiments in a small range due to limitations of our Sage implementation [S]. The polynomials \(x^{32}+ax+b\), \(60 \le a,b \le 60\) were plotted on a \(\max \{a,b\}\)by\(\rho '\) plane. The result is as follows:
There are some examples with quite high \(\rho '\), but the majority cluster low. The grey line is \(y=\sqrt{x}\). Therefore, we may conjecture based on this experiment, that we may expect to find plenty of f satisfying \(\rho ' < \sqrt{\max \{a,b\}}\).
Experimentally, we may guess that the examples of Sect. 6.2, for which \(n = 2^{10}\) and \(\max \{a,b\} \le 2^{30}\), will frequently satisfy \(\rho ' < 2^{15}\), which is the range required by Theorem 1. (Note that the coefficients cannot be taken smaller if f is to have root 1 modulo a prime \(q \sim 2^{31}\).)
7 Weak PolyLWE Number Fields
7.1 Finding f and q with Roots of Small Order
It is relatively easy to generate polynomials f and primes q for which f has a root of given order modulo q. There are two approaches: given f, find suitable q; and given q, find suitable f. Since there are other conditions one may require for other reasons (particularly on f), we focus on the first of these.
It is also possible to generate examples by first choosing q and searching for appropriate f. For example, taking \(f(x) = \varPhi _m(x)g(x) + q\) where g(x) is monic of degree \(mn\) suffices. Both methods can be adapted to find f having any specified root modulo q.
7.2 Examples, \(n \sim 2^{10}\), \(q \sim 2^{32}\)
For the range \(n \sim 2^{10}\), we hope to find \(q \sim 2^{32}\). Examples were found by applying Algorithm 3 to polynomials f(x) of the form \(x^n + ax + b\) for a, b chosen from a likely range. Examples are copious and not difficult to find (see Appendix A.2 for code).
7.3 Examples of Weak PolyLWE Number Fields with Additional Properties

R \(f(1) \equiv 0 \; \pmod q\).

R \(^{\varvec{\prime }}\) f has a root of small order modulo q.

Q The prime q can be chosen suitably large.

G K is Galois.

M K is monogenic.

S The ideal (q) splits completely in the ring of integers R of K, and \(q \not \mid [R:\mathbb Z[\beta ]]\).

O The transformation between the canonical embedding of K and the power basis representation of K is given by a scaled orthogonal matrix.
Conditions G and S are needed for the SearchtoDecision reduction and Conditions M and O are needed for the RingLWE to PolyLWE reduction in [EHL].
Note that checking the splitting condition for fields of cryptographic size is not computationally feasible in general. However, we are able to give a sufficient condition for certain splittings which is quite fast to check.
Proposition 5
Using the notation as above, if \(f(2) \equiv 0 \mod q\) then q splits in R.
Proof
Since \(2^{2^{k1}} \equiv 1 \pmod q,\) it follows that \((2^\alpha )^{2^{k1}}\equiv (1)^\alpha \equiv 1 \pmod q\) for all odd \(\alpha \) in \(\mathbb Z\). We’ll show that \(2,2^3, 2^5, \ldots , 2^m\) where \(m=2^k1\) are all distinct mod q, hence showing that f(x) has \(2^{k1}\) distinct roots mod q i.e. f(x) splits mod q. Assume that \(2^i \equiv 2^j \pmod q\) for some \(1\le i< j \le 2^k1\). Then \(2^{ji} \equiv 1 \pmod q\), which means that the order of 2 modulo q divides \(ji\). However, by the fact below (Lemma 1), the order of 2 mod q is \(2^k\), which is a contradiction since \(ji< 2^k.\)
Lemma 1
Let q be a prime such that \(2^{2^{k1}} \equiv 1 \pmod q\) for some integer k. Then the order of 2 modulo q is \(2^k\).
Proof
Let a be the order of 2 modulo q. By assumption \((2^{2^{k1}})^2 \equiv 2^{2^k} \equiv 1 \pmod q.\) Then \(a  2^k\) i.e. \(a=2^\alpha \) for some \(\alpha \le k.\) Say \(\alpha \le k1.\) Then \(1=(2^{2^\alpha })^{2^{k1\alpha }}= 2^{2^{k1}} \equiv 1 \pmod q\), a contradiction.
The converse of Proposition 5 does not hold. For instance, let K be the splitting field of the polynomial \(x^{8}+1\) and \(q=401\). Then q splits in R. However \(f(2)=257 \not \equiv 0 \pmod q\).
k  2  3  4  5  6  7  7  8  8 
q  5  17  257  65537\(\sim 2^{16}\)  6700417 \(\sim 2^{22}\)  274177 \(\sim 2^{18}\)  \(q_5\sim 2^{45}\)  \(q_6\sim 2^{55}\)  \(q_1\sim 2^{72}\) 
k  9  9  10  10  10  11  11  11  
q  \(q_7\sim 2^{50}\)  \(q_2 \sim 2^{205}\)  2424833\(\sim 2^{21}\)  \(q_3\sim 2^{162}\)  \(q_4 \sim 2^{328}\)  \(q_8\sim 2^{25} \)  \(q_9\sim 2^{32}\)  \(q_{10} \sim 2^{131}\) 
Several of these examples are of cryptographic size^{1}., i.e. the field has degree \(2^{10}\) and the prime is of size \(\sim 2^{32}\) or greater. These provide examples which are weak against our PolyLWE attack, by Proposition 2.
8 Cyclotomic (in)vulnerability
One of our principal observations is that the cyclotomic fields, used for RingLWE, are uniquely protected against the attacks presented in this paper. The next proposition states that the polynomial ring of the mth cyclotomic polynomial \(\varPhi _m\) will never be vulnerable to the attack based on a root of small order.
Proposition 6
The roots of \(\varPhi _m\) have order m modulo every split prime q.
Proof
Consider the field \(\mathbb {F}_q\), q prime. Since \(\mathbb {F}_q\) is perfect, the cyclotomic polynomial \(\varPhi _m(x)\) has \(\phi (m)\) roots in an extension of \(\mathbb {F}_q\). This polynomial has no common factor with \(x^k1\) for \(k < m\). However, it divides \(x^m1\). Therefore its roots have order dividing m, but not less than m. That is, its roots are all of order exactly m in the field in which they live. Now, if we further assume that \(\varPhi _m(x)\) splits modulo q, then its \(\phi (m)\) roots are all elements of order m modulo q, so in particular, \(m \mid q1\). The roots of \(\varPhi _m(x)\) are all elements of \(\mathbb {Z}/q\mathbb {Z}\) of order exactly m.
The question remains whether there is another polynomial representation for the ring of cyclotomic integers for which f does have a root of small order. This may in fact be the case, but the error distribution is transformed under the isomorphism to this new basis, so this does not guarantee a weakness in PolyLWE for \(\varPhi _m\).
However, it is not necessary to search for all such representations to rule out the possibility that this provides an attack. The ring \(R_q \cong \mathbb {F}_q^n\) has exactly \(n = \phi (m)\) homomorphisms to \(\mathbb {Z}/q\mathbb {Z}\). If \(R_q\) can be represented as \((\mathbb {Z}/q\mathbb {Z})[X]/f(X)\) with \(f(\alpha )=0\), then the map \(R_q \rightarrow \mathbb {Z}/q\mathbb {Z}\) is given by \(p \mapsto p(\alpha )\) is one of these n maps. It suffices to write down these n maps (in terms of any representation!) and verify that the errors map to all of \(\mathbb {Z}/q\mathbb {Z}\) instead of a small subset. It is a special property of the cyclotomics that these n homomorphisms coincide. Thus we are reduced to the case above.
9 Successfully Coded Attacks
Case  f  q  w  \(\tau \)  \(\begin{array}{c} \text {Samples per run} \end{array}\)  \(\begin{array}{c} \text {Successful runs} \end{array}\)  \(\begin{array}{c} \text {Time per run} \end{array}\) 

PolyLWE  \(x^{1024}+2^{31}2\)  \(2^{31}1\)  3.192  N/A  40  1 of 1  13.5 hrs 
RingLWE  \(\begin{array}{c} x^{128}+524288x +524285 \end{array}\)  524287  8.00  N/A  20  8 of 10  24 sec 
RingLWE  \(x^{192}+4092\)  4093  8.87  0.0136  20  1 of 10  25 sec 
RingLWE  \(x^{256}+8189\)  8190  8.35  0.0152  20  2 of 10  44 sec 
Footnotes
 1.
\(q_1= 5704689200685129054721, q_2= 9346163971535797776916355819960689658 4051237541638188580280321,\) \(q_3=7455602825647884208337395736200454918783366342657, q_5= 67280421310721, q_6= 59649589127497217\) \(q_4= 74164006262753080152478714190193747405994078109751902390582131614441 5759504705008092818711693940737\) \(q_7=1238926361552897, q_8=45592577, q_9=6487031809, q_{10}=46597757852200185 43264560743076778192897\)
Notes
Acknowledgments
The authors are indebted to the organizers of the research conference Women in Numbers 3 (Rachel Pries, Ling Long and the fourth author), as well as to the Banff International Research Station, for bringing together this collaboration. The authors would also like to thank Martin Albrecht for help with Sage.
References
 IEEE.P1363.1: Standard Specifications for PublicKey Cryptographic Techniques Based on Hard Problems over Lattices, December 2008. http://grouper.ieee.org/groups/1363/
 BCNS.Bos, J.W., Costello, C., Naehrig, M., Stebila, D.: Postquantum key exchange for the TLS protocol from the ring learning with errors problem. In: 36th IEEE Symposium on Security and Privacy 2015 (2015). http://eprint.iacr.org/2014/599.pdf
 BLN.Bos, J.W., Lauter, K., Naehrig, M.: Private predictive analysis on encrypted medical data. J. Biomed. Inform. 54, 234–243 (2014)CrossRefGoogle Scholar
 BL+.Brakerski, Z., Langlois, A., Peikert, C., Regev, O., Stehlé, D.: Classical hardness of learning with errors. In: STOC 2013 Proceedings of the 2013 ACM Symposium on Theory of Computing, pp. 575–584. ACM, New York (2013)Google Scholar
 BV.Brakerski, Z., Vaikuntanathan, V.: Fully homomorphic encryption from ringLWE and security for key dependent messages. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 505–524. Springer, Heidelberg (2011) CrossRefGoogle Scholar
 BGV.Brakerski, Z., Gentry, C., Vaikuntanathan, V.: Fully homomorphic encryption without bootstrapping. ACM Trans. Comput. Theor. 6(3), 36 (2014). Article No 13MathSciNetCrossRefGoogle Scholar
 DD.Ducas, L., Durmus, A.: RingLWE in polynomial rings. In: Fischlin, M., Buchmann, J., Manulis, M. (eds.) PKC 2012. LNCS, vol. 7293, pp. 34–51. Springer, Heidelberg (2012) CrossRefGoogle Scholar
 EHL.Eisenträger, K., Hallgren, S., Lauter, K.: Weak instances of PLWE. In: Joux, A., Youssef, A. (eds.) SAC 2014. LNCS, vol. 8781, pp. 183–194. Springer, Heidelberg (2014) Google Scholar
 G.Gassert, T.A.: Prime decomposition in iterated towers and discriminant formulae. Ph.D. thesis, University of Massachusetts, Amherst (2014)Google Scholar
 GF+.Göttert, N., Feller, T., Schneider, M., Buchmann, J., Huss, S.: On the design of hardware building blocks for modern latticebased encryption schemes. In: Prouff, E., Schaumont, P. (eds.) CHES 2012. LNCS, vol. 7428, pp. 512–529. Springer, Heidelberg (2012) CrossRefGoogle Scholar
 GHS.Gentry, C., Halevi, S., Smart, N.P.: Fully homomorphic encryption with polylog overhead. In: Pointcheval, D., Johansson, T. (eds.) EUROCRYPT 2012. LNCS, vol. 7237, pp. 465–482. Springer, Heidelberg (2012) CrossRefGoogle Scholar
 GLN.Graepel, T., Lauter, K., Naehrig, M.: ML confidential: machine learning on encrypted data. In: Kwon, T., Lee, M.K., Kwon, D. (eds.) ICISC 2012. LNCS, vol. 7839, pp. 1–21. Springer, Heidelberg (2013) CrossRefGoogle Scholar
 HPS.Hoffstein, J., Pipher, J., Silverman, J.H.: NTRU: a ringbased public key cryptosystem. In: Buhler, J.P. (ed.) ANTS 1998. LNCS, vol. 1423, pp. 267–288. Springer, Heidelberg (1998) CrossRefGoogle Scholar
 K.Kedlaya, K.: A construction of polynomials with squarefree discriminants. Proc. Am. Math. Soc. 140, 3025–3033 (2012)MathSciNetCrossRefzbMATHGoogle Scholar
 LP.Lindner, R., Peikert, C.: Better key sizes (and attacks) for LWEbased encryption. In: Kiayias, A. (ed.) CTRSA 2011. LNCS, vol. 6558, pp. 319–339. Springer, Heidelberg (2011) CrossRefGoogle Scholar
 LPR.Lyubashevsky, V., Peikert, C., Regev, O.: On ideal lattices and learning with errors over rings. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 1–23. Springer, Heidelberg (2010) CrossRefGoogle Scholar
 LPR13.Lyubashevsky, V., Peikert, C., Regev, O.: A toolkit for ringLWE cryptography. In: Johansson, T., Nguyen, P.Q. (eds.) EUROCRYPT 2013. LNCS, vol. 7881, pp. 35–54. Springer, Heidelberg (2013) CrossRefGoogle Scholar
 M.Masser, D.W.: 3136. The discriminants of special equations. Math. Gaz. 50(372), 158–160 (1966)CrossRefGoogle Scholar
 MR04.Micciancio, D., Regev, O.: Worstcase to averagecase reductions based on Gaussian measure. SIAM J. Comput. 37(1), 267–302 (2007). Preliminary version in FOCS 2004MathSciNetCrossRefzbMATHGoogle Scholar
 MR09.Micciancio, D., Regev, O.: Latticebased cryptography. In: Bernstein, D.J., Buchmann, J., Dahmen, E. (eds.) Post Quantum Cryptography, pp. 147–191. Springer, Heidelberg (2009)CrossRefGoogle Scholar
 PG.Pöppelmann, T., Güneysu, T.: Towards practical latticebased publickey encryption on reconfigurable hardware. In: Lange, T., Lauter, K., Lisoněk, P. (eds.) SAC 2013. LNCS, vol. 8282, pp. 68–86. Springer, Heidelberg (2014) CrossRefGoogle Scholar
 R.Regev, O.: On lattices, learning with errors, random linear codes, and cryptography. J. ACM 56(6), 1–40 (2009). Preliminary version STOC 2005MathSciNetCrossRefGoogle Scholar
 RV+.Roy, S.S., Vercauteren, F., Mentens, N., Chen, D.D., Verbauwhede, I.: Compact ringLWE cryptoprocessor. In: Batina, L., Robshaw, M. (eds.) CHES 2014. LNCS, vol. 8731, pp. 371–391. Springer, Heidelberg (2014) Google Scholar
 S.Stein, W.A., et al.: Sage Mathematics Software (Version 6.4.1), The Sage Development Team (2014). http://www.sagemath.org
 SS.Stehlé, D., Steinfeld, R.: Making \(\mathtt{{NTRU}}\)Encrypt and \(\mathtt{{NTRU}}\)Sign as secure as worstcase problems over ideal lattices. In: Paterson, K.G. (ed.) EUROCRYPT 2011. LNCS, vol. 6632, pp. 27–47. Springer, Heidelberg (2011)CrossRefGoogle Scholar
 TV.Tao, T., Vu, V.: Smooth analysis of the condition number and the least singular value. Math. Comput. 79(272), 2333–2352 (2010)MathSciNetCrossRefzbMATHGoogle Scholar