One Sample Ring-LWE with Rounding and its Application to Key Exchange
One Sample Ring-LWE with Rounding and its Application to Key Exchange
复制标题
一种带舍入环的样本环LWE及其在密钥交换中的应用
DOI：
10.1007/978-3-030-21568-2_16
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Yuntao Wang
中科院分区：
文献类型：
--
作者：
Jintai Ding;Xinwei Gao;Tsuyoshi Takagi;Yuntao Wang
在本文中，我们介绍了一种新的可证明安全的基于临时 RLWE+Rounding 的密钥交换协议，以及一种仅使用一个样本即可更准确地估计 RLWE 问题的安全级别的正确方法。由于我们的方案是一种临时密钥交换，因此它从协议执行中仅生成一个 RLWE 样本。我们仔细分析了如何仅用一个样本来估计 RLWE 问题的实际安全性，我们将其称为单样本 RLWE 问题。我们的方法不同于基于多个 RLWE 样本估计的现有方法。尽管我们的分析是基于达姆施塔特最近开发的一些技术，但我们的实际安全评估类型以前从未进行过，并且它产生的安全评估与之前基于多个 RLWE 样本的评估有很大不同。我们表明，新设计通过使用一种 RLWE+Rounding 示例技术，同时提高了协议的安全性并降低了协议的通信成本。我们还提出了两个确保密钥交换失败概率的参数选择，其中涵盖了 AES-128/192/256 的安全性以及具体的安全性分析和实现。我们相信我们的施工安全、简单、高效、美观，具有广阔的应用前景。
In this paper, we introduce a new provably secure ephemeral-only RLWE+Rounding-based key exchange protocol and a proper approach to more accurately estimate the security level of the RLWE problem with only one sample. Since our scheme is an ephemeral-only key exchange, it generates only one RLWE sample from protocol execution. We carefully analyze how to estimate the practical security of the RLWE problem with only one sample, which we call the ONE-sample RLWE problem. Our approach is different from existing approaches that are based on estimation with multiple RLWE samples. Though our analysis is based on some recently developed techniques in Darmstadt, our type of practical security estimate was never done before and it produces security estimates substantial different from the estimates before based on multiple RLWE samples. We show that the new design improves the security and reduce the communication cost of the protocol simultaneously by using one RLWE+Rounding sample technique. We also present two parameter choices ensuringkey exchange failure probability which cover security of AES-128/192/256 with concrete security analysis and implementation. We believe that our construction is secure, simple, efficient and elegant with wide application prospects.