Broadcast Attacks against Lattice-based Cryptosystems*

Broadcast Attacks against Lattice-based Cryptosystems 11Example 1. The initial proposition in [27] is obviously concerned by this attack.However, we will refer to Micciancio cryptosystems [31] as a non-broken cryptosystemthat will also be susceptible against this attack.4.2 A Broadcast Attack on GGH Type BProblem 5 (GGH B Challenge). Let B ∈ Z n,n a basis and c ∈ Z n a vector suchthat there exist two vectors m, r ∈ Z n with c = mB + r. Then, the GGH Bchallenge (B, c) is to find m.The idea here is a bit different. As we have mB 1 +r 1 = c 1 and mB 2 +r 2 = c 2 ,we construct a third challenge mB 3 +r 3 = c 3 with B 3 = B 1 +B 2 and c 3 = c 1 +c 2 .Practically, the fact that ‖r‖ grows will be less important than the growth of B.Algorithm 2: Broadcast Attack on GGH B ChallengesInput : (B i , c i ) k GGH B challenges.Output: m ∈ Z n .beginCompute B = ∑ ki=1 B i.Compute c = ∑ ki=1 c i.Find the closest vector v of c in L(B).Compute m = vB −1 .endAlgorithm 2 do not use Theorem 7 and cannot be proved to have a simplerproblem as the λ 1 (L(B 1 + B 2 )) can be bigger than λ 1 (L(B 1 )). However, we willsee than practically λ 1 (L(B 1 + B 2 )) will be bigger. Practically, we will also usethe embedding method for the third step of Algorithm 2.Example 2. Cryptosystems concerned with this attack include [30] and the morerecent work of [32].4.3 A First Broadcast Attack on Knapsack CryptosystemsProblem 6 (Knapsack Challenge). Let a ∈ N n a positive integer vector and s ∈ Nan integer such that there exists m ∈ [0, 1] n a boolean vector such ma T = s.Then, the Knapsack challenge (a, s) is to find m.The attack proposed here is an adaptation of Algorithm 1 to the knapsackchallenge as it has been already modelled by [10] in a lattice problem. Othermodellings can been also adapted with the same technique.