Syndrome decoding ( \(\textsf{SD}\) ), and equivalently Learning Parity with Noise ( \(\textsf{LPN}\) ), is a fundamental problem in cryptography, which states that for a field \(\mathbb {F}\) , some compressing public matrix \(\textbf{G} \in \mathbb {F} ^{k\times n}\) , and a secret sparse vector \({\boldsymbol{e}} \in \mathbb {F} ^{n}\) sampled from some noise distribution, \(\textbf{G} {\boldsymbol{e}} \) is indistinguishable from uniform. Recently, the \(\textsf{SD}\) has gained significant interest due to its use in pseudorandom correlation generators (PCGs). In pursuit of better efficiency, we propose a new assumption called Stationary Syndrome Decoding ( \(\textsf{SSD}\) ). In \(\textsf{SSD}\) , we consider q correlated noise vectors \({\boldsymbol{e}} _{1},\ldots ,{\boldsymbol{e}} _{q}\in \mathbb {F} ^n\) and associated instances \(\textbf{G} _{1}{\boldsymbol{e}} _{1},\ldots ,\textbf{G} _{q}{\boldsymbol{e}} _{q}\) where the noise vectors are restricted to having non-zeros in the same small subset of t positions \(L\subset [n]\) . That is, for all \(i\in L\) , \({\boldsymbol{e}} _{j,i}\) is uniformly random, while for all other i, \({\boldsymbol{e}} _{j,i} = 0\) . Although naively reusing the noise vector renders \(\textsf{SD}\) and \(\textsf{LPN}\) insecure via simple Gaussian elimination, we observe known attacks do not extend to our correlated noise. We show \(\textsf{SSD}\) is unconditionally secure against so-called linear attacks, e.g., advanced information set decoding and representation techniques (Esser and Santini, Crypto 2024). We further adapt the state-of-the-art nonlinear attack (Briaud and Øygarden, Eurocrypt 2023) to \(\textsf{SSD}\) and demonstrate both theoretically and experimentally resistance to the attack. We apply \(\textsf{SSD}\) to PCGs to amortize the cost of noise generation protocol. For OT and VOLE generation, each instance requires O(t) communication instead of \(O(t\log n)\) . For suggested parameters, we observe a \(1.5\times \) improvement in the running time or between 6 and \(18\times \) reduction in communication. For Beaver triple generation using Ring LPN, our techniques have the potential for substantial amortization due to the high concrete overhead of the Ring LPN noise generation.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Stationary Syndrome Decoding for Improved PCGs

  • Vladimir Kolesnikov,
  • Stanislav Peceny,
  • Srinivasan Raghuraman,
  • Peter Rindal

摘要

Syndrome decoding ( \(\textsf{SD}\) ), and equivalently Learning Parity with Noise ( \(\textsf{LPN}\) ), is a fundamental problem in cryptography, which states that for a field \(\mathbb {F}\) , some compressing public matrix \(\textbf{G} \in \mathbb {F} ^{k\times n}\) , and a secret sparse vector \({\boldsymbol{e}} \in \mathbb {F} ^{n}\) sampled from some noise distribution, \(\textbf{G} {\boldsymbol{e}} \) is indistinguishable from uniform. Recently, the \(\textsf{SD}\) has gained significant interest due to its use in pseudorandom correlation generators (PCGs). In pursuit of better efficiency, we propose a new assumption called Stationary Syndrome Decoding ( \(\textsf{SSD}\) ). In \(\textsf{SSD}\) , we consider q correlated noise vectors \({\boldsymbol{e}} _{1},\ldots ,{\boldsymbol{e}} _{q}\in \mathbb {F} ^n\) and associated instances \(\textbf{G} _{1}{\boldsymbol{e}} _{1},\ldots ,\textbf{G} _{q}{\boldsymbol{e}} _{q}\) where the noise vectors are restricted to having non-zeros in the same small subset of t positions \(L\subset [n]\) . That is, for all \(i\in L\) , \({\boldsymbol{e}} _{j,i}\) is uniformly random, while for all other i, \({\boldsymbol{e}} _{j,i} = 0\) . Although naively reusing the noise vector renders \(\textsf{SD}\) and \(\textsf{LPN}\) insecure via simple Gaussian elimination, we observe known attacks do not extend to our correlated noise. We show \(\textsf{SSD}\) is unconditionally secure against so-called linear attacks, e.g., advanced information set decoding and representation techniques (Esser and Santini, Crypto 2024). We further adapt the state-of-the-art nonlinear attack (Briaud and Øygarden, Eurocrypt 2023) to \(\textsf{SSD}\) and demonstrate both theoretically and experimentally resistance to the attack. We apply \(\textsf{SSD}\) to PCGs to amortize the cost of noise generation protocol. For OT and VOLE generation, each instance requires O(t) communication instead of \(O(t\log n)\) . For suggested parameters, we observe a \(1.5\times \) improvement in the running time or between 6 and \(18\times \) reduction in communication. For Beaver triple generation using Ring LPN, our techniques have the potential for substantial amortization due to the high concrete overhead of the Ring LPN noise generation.