LWE dual attack method, system and equipment based on ellipsoid Gaussian sampling

Abstract

The invention discloses an ellipsoid Gaussian sampling-based LWE dual attack method. The method comprises the following steps of: constructing a provable dual attack framework based on ellipsoid Gaussian sampling; an ellipsoid Gaussian sampler is constructed for sampling, and a vector list W is generated; integrating a mode switching technology into an ellipsoid dual attack framework, guessing a secret vector s by using attack statistics, and recovering the secret vector s into complete sguess; and parameter selection and optimization are carried out, and the total attack complexity is minimized. By introducing the ellipsoid Gaussian sampling and mode switching technology, the attack complexity is reduced, and the attack efficiency is improved.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and specifically relates to an LWE dual attack method, system and device based on ellipsoidal Gaussian sampling. Background Technology

[0002] Lattice cryptography is a mainstream research area in post-quantum cryptography (PQC). The Least Perfect Echo (LWE) problem is a core mathematical problem in lattice-based cryptography, and its computational difficulty lays the foundation for the security of lattice cryptography. Among the many attack methods on the LWE problem, primal attacks and dual attacks are considered the two most effective methods targeting practical cryptographic parameters. Provable dual attacks, in particular, have attracted considerable attention because they do not rely on any heuristic statistical assumptions and can provide rigorous security analysis.

[0003] Existing provable duality attack frameworks, such as the work of Pouly and Shen (PS24) and Qu and Xu (QX25), all rely on the Discrete Gaussian Sampling (DGS) algorithm to generate short vectors on the dual lattice. In particular, the work of QX25, by introducing a modulus switching technique, reduces the attack complexity from... Down to (where p << q), which significantly improves attack efficiency.

[0004] Existing provable duality attack frameworks (such as PS24 and QX25) rely on the Discrete Gaussian Sampling (DGS) algorithm to generate short vectors on the dual lattice. In particular, the work on QX25 significantly reduces attack complexity by introducing a modulus switching technique. However, the DGS algorithm used in this framework generates samples with a spherical Gaussian distribution, which cannot fully utilize the geometry of the lattice basis. This results in the sampled vectors not being as short as possible, thus leading to inefficiency in this sampling method. Summary of the Invention

[0005] The main objective of this invention is to provide an LWE dual attack method, system, and device based on ellipsoidal Gaussian sampling. It constructs a novel, aspherical discrete high non-sampler and systematically integrates it into a provable dual attack framework, thereby significantly reducing the attack complexity.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] In a first aspect, this invention discloses an LWE dual attack method based on ellipsoidal Gaussian sampling, comprising the following steps:

[0008] Step 1: Construct a provable dual attack framework based on ellipsoidal Gaussian sampling;

[0009] Step 2: Construct an ellipsoidal Gaussian sampler to generate a vector list W;

[0010] Step 3: Integrate the mode switching technique into the ellipsoidal dual attack framework, use attack statistics to guess the secret vector s, and recover it as the complete s. guess ;

[0011] Step 4: Select and optimize parameters to minimize the overall attack complexity.

[0012] Furthermore, step 1 specifically includes the following steps:

[0013] Define attack statistics g W (x), where x is the input vector, and W = (w1, w2, ..., w N ) is from the distribution The list of vectors sampled from the middle, where: It is composed of matrix A dual The dual lattice is defined; q is the modulus; Σ is a positive definite covariance matrix used to define the Gaussian distribution on an ellipsoid.

[0014] Furthermore, step 2 specifically includes the following steps:

[0015] Step 2.1, input the BKZ-β reduced basis B and the covariance matrix. Where: β is the block size; It is a Gram-Schmidt orthogonalization basis of basis B; D = diag(r1, r2, ..., r m ) is a diagonal matrix, where r i It is the Gaussian width parameter (usually set to the zero vector in attacks);

[0016] Step 2.2, set the center vector c;

[0017] Step 2.3, perform the following sampling operation:

[0018] calculate

[0019] Initialize vector v←0, probability factor Δ←1;

[0020] The probability factor Δ is obtained by performing reverse loop calculations from i=m to i=1;

[0021] Output in probability factor Δ Otherwise, restart the entire sampling process;

[0022] Step 2.4, the output follows a distribution D L(B),Σ,c A list of vectors W, where L(B) is a lattice generated from the basis B.

[0023] Furthermore, in step 2.3, the probability factor Δ is obtained by performing a reverse cyclic calculation from i=m to i=1 as follows:

[0024] From Discrete Gaussian Distribution Medium sampling z i ,in It is the set of integers, r i It is a Gaussian parameter, t i It is the center;

[0025] Update t←tz i u i , where u i Let be the i-th vector of basis U, where U is a unit upper triangular matrix;

[0026] Update v←v+z i u i ;

[0027] Update probability factors in The center is at t i The probability mass function of the discrete Gaussian distribution, It is the probability mass function of a discrete Gaussian distribution centered at zero.

[0028] Furthermore, step 3 specifically includes the following steps:

[0029] Step 3.1, select a set of small prime numbers, p1, p2, ..., p k , making Where q is the LWE modulus;

[0030] Step 3.2, divide the secret vector s into two parts: s guess and s dual That is, s = [s guess ;s dual ];

[0031] Step 3.3, for each prime number p j Perform the following sub-steps:

[0032] For each candidate guess Calculate vectors

[0033] Using attack statistics g W,j (x) is used to evaluate the correctness of the guess, where g W,j(x) is an approximation based on the sample vector list W, defined as:

[0034]

[0035] Step 3.4, by comparing g W,j The value of (x) is used to identify the correct guess s. guess modp j ;

[0036] Step 3.5, use the Chinese Remainder Theorem to transform the module p j Combining the guesses, the complete s guess .

[0037] Furthermore, step 4 specifically includes the following steps:

[0038] Use the optimizer to find the optimal parameter combination {m,n} guess Let {, β, r} be the attack vectors to minimize the total attack complexity; the total attack complexity is expressed as:

[0039]

[0040] Wherein: T BKZ (m,β) is the cost of running the BKZ algorithm to obtain the reduced basis.

[0041] N is the required number of samples, derived from the formula... Calculate, where δ=

[0042]

[0043] T Ellipsoidal It is the average cost of each ellipsoidal Gaussian sampling.

[0044] It is the total number of guesses across all moduli;

[0045] m is the sample size, n guess Let β be the dimension of the guessed part, β be the size of the BKZ block, and r be the Gaussian parameter.

[0046] Secondly, this invention discloses an LWE dual attack system based on ellipsoidal Gaussian sampling, comprising:

[0047] Builder module: Used to build a provable dual attack framework based on ellipsoidal Gaussian sampling;

[0048] Sampling module: Used to construct an ellipsoidal Gaussian sampler and generate a vector list W;

[0049] Recovery Module: This module integrates the modulus switching technique into the ellipsoidal duality attack framework. It uses attack statistics to guess the secret vector s and recover it as the complete s.guess ;

[0050] Optimization module: Used for parameter selection and optimization to minimize the overall attack complexity.

[0051] Thirdly, the present invention discloses a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described above.

[0052] Fourthly, the present invention discloses a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the method described above.

[0053] Compared with existing technologies, the LWE dual attack method, system, and device based on ellipsoidal Gaussian sampling of the present invention reduces attack complexity and improves attack efficiency by introducing ellipsoidal Gaussian sampling and mode switching techniques. Specifically, it has at least the following beneficial effects:

[0054] I. Significant breakthrough in attack complexity

[0055] By utilizing ellipsoidal sampling to generate shorter vectors and combining this with precise parameter optimization, the total computational complexity required by this invention is significantly lower than that of existing best-practice solutions at the same security level. Experimental data show that, compared to the current state-of-the-art provable dual attack (QX25), this invention reduces the attack complexity against Cyber512 / 768 / 1024 by 10, 13, and 9 bits respectively, achieving a qualitative leap in attack efficiency.

[0056] II. Simultaneous Improvement of Sampling Efficiency and Quality

[0057] Compared to traditional spherical Gaussian sampling, the ellipsoidal sampler of this invention fully utilizes the geometric information of the BKZ reduced basis through the covariance matrix Σ. This results in sampled vectors with smaller variance in key directions, making them shorter and more discriminative. Although the complexity of a single sampling may increase slightly due to rejection sampling, the total number of samples N required for a successful attack is significantly reduced due to the improved sample quality (e.g., from 2^N to 2^N under Cyber512 parameters). 106 Reduced to 2 29 Overall, a net gain in sampling efficiency was achieved.

[0058] III. Greater freedom in parameter optimization, resulting in more precise attacks.

[0059] The precise complexity model and ellipsoidal parameter {η} employed in this invention provide attackers with unprecedented freedom in parameter adjustment. This allows attack strategies to break free from the rigid "one-size-fits-all" spherical assumption and perform more refined optimizations that better fit specific lattice instances, which is one of the key factors leading to a significant reduction in complexity.

[0060] IV. The theoretical rigor remains unchanged.

[0061] This invention extends the sampling distribution from a sphere to an ellipsoid, ensuring the provable security of the entire attack process. It inherits the core advantage of provable dual attacks that do not require heuristic assumptions, and the conclusions are reliable.

[0062] V. Possesses good versatility and scalability

[0063] The ellipsoidal DGS sampler proposed in this invention is a general-purpose tool, applicable not only to this attack framework but also to other lattice cryptographic scenarios requiring efficient short vectors. Furthermore, this framework lays the foundation for future research on problems such as anisotropic noise. Attached Figure Description

[0064] Figure 1 This is a flowchart illustrating the LWE dual attack method based on ellipsoidal Gaussian sampling of the present invention.

[0065] Figure 2 This is a circuit module connection diagram of the computer device of the present invention.

[0066] In the diagram: 300, bus; 301, receiver; 302, processor; 303, transmitter; 304, memory; 306, bus interface. Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] Example 1

[0069] This embodiment combines Figure 1 The flowchart illustrates the LWE dual attack method based on ellipsoidal Gaussian sampling, which specifically includes the following steps:

[0070] Including the following steps:

[0071] Step 1: Construct a provable dual attack framework based on ellipsoidal Gaussian sampling;

[0072] Step 2: Construct an ellipsoidal Gaussian sampler to generate a vector list W;

[0073] Step 3: Integrate the mode switching technique into the ellipsoidal dual attack framework, use attack statistics to guess the secret vector s, and recover it as the complete s. guess ;

[0074] Step 4: Select and optimize parameters to minimize the overall attack complexity.

[0075] Furthermore, step 1 specifically includes the following steps:

[0076] Define attack statistics g W (x), where x is the input vector, and W = (w1, w2, ..., w N ) is from the distribution The list of vectors sampled from the middle, where: It is composed of matrix A dual The dual lattice is defined; q is the modulus; Σ is a positive definite covariance matrix used to define the Gaussian distribution on an ellipsoid.

[0077] Existing provable dual attack frameworks (such as [PS24], [QX25]) are based on a spherical Gaussian distribution for their theoretical core. The calculation of the attack statistic g and subsequent proofs both assume that the sampling vector follows an isotropic spherical distribution. This invention, however, for the first time constructs a provable dual attack framework based on an ellipsoidal Gaussian distribution. It re-derives and proves the applicability of key lemmas (such as the Poisson Summation Formula and Pointwise Approximation Lemma) under the ellipsoidal Gaussian setting, extending the theoretical basis of the entire attack from the spherical to the more general ellipsoidal case. This makes the attack framework compatible with subsequently proposed sampling algorithms that generate shorter vectors, laying a theoretical foundation for performance improvement.

[0078] Furthermore, step 2 specifically includes the following steps:

[0079] Step 2.1, input the BKZ-β reduced basis B and the covariance matrix. Where: β is the block size; It is a Gram-Schmidt orthogonalization basis of basis B; D = diag(r1, r2, ..., r m ) is a diagonal matrix, where r i It is the Gaussian width parameter (usually set to the zero vector in attacks);

[0080] Step 2.2, set the center vector c;

[0081] Step 2.3, perform the following sampling operation:

[0082] calculate

[0083] Initialize vector v←0, probability factor Δ←1;

[0084] The probability factor Δ is obtained by performing reverse loop calculations from i=m to i=1;

[0085] Output in probability factor Δ Otherwise, restart the entire sampling process;

[0086] Step 2.4, the output follows a distribution D L(B),Σ,c A list of vectors W, where L(B) is a lattice generated from the basis B.

[0087] Furthermore, in step 2.3, the probability factor Δ is obtained by performing a reverse cyclic calculation from i=m to i=1 as follows:

[0088] From Discrete Gaussian Distribution Medium sampling z i ,in It is the set of integers, r i It is a Gaussian parameter, t i It is the center;

[0089] Update t←tz i u i , where u i Let be the i-th vector of basis U, where U is a unit upper triangular matrix;

[0090] Update v←v+z i u i ;

[0091] Update probability factors in The center is at t i The probability mass function of the discrete Gaussian distribution, It is the probability mass function of a discrete Gaussian distribution centered at zero.

[0092] Traditional DGS algorithms (such as GPV sampler, MHK) output vectors that follow a spherical Gaussian distribution, with a covariance matrix of s. 2 l. During the sampling process, the sampling parameters for each coordinate direction are fixed as follows: The scale differences of the lattice basis in different directions were ignored.

[0093] This invention designs a novel ellipsoidal DGS sampler, whose core innovations include:

[0094] 1. Input covariance matrix: The sampler uses a positive definite covariance matrix. As input, where It is a matrix composed of Gram-Schmidt vectors of the BKZ reduced basis, and D is a diagonal matrix. This design allows the shape of the sampling distribution to be aligned with the scale structure of the lattice.

[0095] 2. Rejection Sampling Technique: To ensure the correct distribution is output even when the sampling parameter is much smaller than the smoothing parameter, this invention introduces a rejection sampling step. By calculating the acceptance probability and accepting the output vector with that probability, otherwise restarting the process, this ensures that the output vector strictly follows the target ellipsoidal Gaussian distribution.

[0096] 3. Versatility and Flexibility: This sampler is a general framework. When D∝l is set, it degenerates into a traditional spherical GPV sampler. Therefore, this invention allows for fine-tuning of the sampling process by adjusting D, striking a balance between the output vector length and the sampling success rate, which is impossible with existing fixed-spherical sampling methods.

[0097] Furthermore, step 3 specifically includes the following steps:

[0098] Step 3.1, select a set of small prime numbers, p1, p2, ..., p k , making Where q is the LWE modulus;

[0099] Step 3.2, divide the secret vector s into two parts: s guess and s dual That is, s = [s guess ;s dual ];

[0100] Step 3.3, for each prime number p j Perform the following sub-steps:

[0101] For each candidate guess Calculate vectors

[0102] Using attack statistics g W,j (x) is used to evaluate the correctness of the guess, where g W,j (x) is an approximation based on the sample vector list W, defined as:

[0103]

[0104] Step 3.4, by comparing g W,j The value of (x) is used to identify the correct guess s. guess modp j ;

[0105] Step 3.5, use the Chinese Remainder Theorem to transform the module p jCombining the guesses, the complete s guess .

[0106] Furthermore, step 4 specifically includes the following steps:

[0107] Use the optimizer to find the optimal parameter combination {m,n} guess Let {, β, r} be the attack vectors to minimize the total attack complexity; the total attack complexity is expressed as:

[0108]

[0109] Wherein: T BKZ (m,β) is the cost of running the BKZ algorithm to obtain the reduced basis.

[0110] N is the required number of samples, derived from the formula... Calculate, where δ=

[0111]

[0112] T Ellipsoidal It is the average cost of each ellipsoidal Gaussian sampling.

[0113] It is the total number of guesses across all moduli;

[0114] m is the sample size, n guess Let β be the dimension of the guessed part, β be the size of the BKZ block, and r be the Gaussian parameter.

[0115] Methods such as [QX25] use relatively coarse approximations of sampling complexity when optimizing attack parameters. This limits the optimizer's search range for Gaussian parameters s (or r in this invention), failing to maximize the benefits of modulus switching. Within the framework of this invention, a precise approximation of sampling complexity from [QX25] is used for parameter optimization. This allows the optimizer to search in a wider parameter space, particularly finding an optimal set of {r} for the ellipsoidal sampler. i This significantly reduces the total number of samples N required without excessively increasing the complexity of a single sampling.

[0116] In summary, this invention systematically integrates the aforementioned ellipsoidal DGS sampler, optimized parameter selection strategy, and analog-to-digital switching technology to form a complete and provable attack flow with a total attack complexity T. total The cost is precisely quantified as the sum of the costs of BKZ reduction, sampling, and guessing. Through an experimental estimator, it is possible to automatically find the cost that makes T... total Minimize the optimal parameter combination {m,n guess ,β,r}.

[0117] The method of the present invention will be described in detail below through a practical example:

[0118] enter:

[0119] m: Number of samples (positive integer);

[0120] n = n guess +n dual : The total dimension of the secret vector, where n guess It is the dimension of the guessing part, n dual It is the dimension of the dual part;

[0121] q: Modulus (prime power);

[0122] LWE matrix;

[0123] LWE vectors satisfy b = As + e mod q, where s is the secret vector and e is the error vector.

[0124] Output: The guessed part s of the secret vector guess , or failure indicator ⊥.

[0125] The specific implementation steps are as follows:

[0126] 1. Parameter initialization phase

[0127] Choose parameters β (BKZ block size), n guess n dual ;

[0128] Choose small prime numbers p1, p2, ..., p k Make

[0129] Calculate the covariance matrix Where B is the BKZ-β reduction group. It is its Gram-Schmidt orthogonalization basis, D = diag(r1,…,r m ).

[0130] 2. Sampling stage

[0131] Using an ellipsoidal Gaussian sampler (see step 2 of this invention) from the distribution Sample N vectors to form a vector list W = (w1, w2, ..., w N ).

[0132] 2. Module switching attack phase

[0133] For each prime number p j (From j=1 to k);

[0134] Initialize maximum score S max ←0 and best guess

[0135] For each candidate guess

[0136] i. Calculate vectors

[0137] ii. Calculate the attack statistics g W,j (x) (as defined above);

[0138] iii. If g W,j (x)>S max Then update S max ←g W,j (x) and

[0139] iv. Record the best guesses As

[0140] 4. Secret Recovery

[0141] Using the Chinese Remainder Theorem, we can solve all of them. For combinations of j = 1 to k, the complete s is recovered. guess Output s guess If it cannot be recovered, output ⊥.

[0142] The symbols used in the above calculations are explained as follows:

[0143] A: LWE matrix (LWEMatrix), with a size of m×n;

[0144] b: LWE vector (SecretVector), with a size of m;

[0145] s: Secret Vector, with a size of n;

[0146] e: Error Vector, with a size of m;

[0147] q: Modulus;

[0148] A guess The guessing part of matrix A, with a size of m×n guess ;

[0149] A dual The dual part of matrix A, with a size of m×n dual ;

[0150] sguess The Guessing Part of Secret, with a size of n guess ;

[0151] s dual The secret's dual part (DualPartofSecret), of size n dual ;

[0152] p j Small prime numbers;

[0153] W: A list of sampled vectors, containing N vectors w i ;

[0154] Σ: Covariance matrix, positive definite;

[0155] B: BKZ-Reduced Basis;

[0156] Gram-Schmidt orthogonalized base of B;

[0157] D: Diagonal matrix;

[0158] r i Gaussian Width Parameter;

[0159] c: Center Vector;

[0160] v: Temporary Vector during the sampling process;

[0161] Δ: Probability Factor;

[0162] g W,j (x): Attack Statistics;

[0163] T total Total Attack Complexity;

[0164] T BKZ BKZ algorithm complexity;

[0165] T Ellipsoidal Ellipsoidal Sampling Complexity;

[0166] N: Number of Samples;

[0167] δ: Error parameter.

[0168] The LWE dual attack method based on ellipsoidal Gaussian sampling of this invention extends the provable dual attack framework from spherical Gaussian sampling to ellipsoidal Gaussian sampling by constructing a positive definite covariance matrix. An ellipsoidal discrete Gaussian sampler is used as the input, and a rejection sampling technique is introduced to generate short vectors that follow an ellipsoidal Gaussian distribution. This sampler adjusts the diagonal matrix D = diag(r1,…,r) to... m The parameters of the algorithm are optimized by balancing the output vector length and sampling success rate. This invention also integrates analog-to-digital switching technology into the ellipsoidal framework and uses a precise sampling complexity formula for parameter optimization. Experiments show that, compared with the prior art (QX25), this invention reduces the attack complexity of Cyber512 / 768 / 1024 by 10, 13, and 9 bits respectively, effectively improving attack efficiency.

[0169] Example 2

[0170] For Embodiment 1, this embodiment discloses an LWE dual attack system based on ellipsoidal Gaussian sampling, which includes the following modules:

[0171] Builder module: Used to build a provable dual attack framework based on ellipsoidal Gaussian sampling;

[0172] Sampling module: Used to construct an ellipsoidal Gaussian sampler and generate a vector list W;

[0173] Recovery Module: This module integrates the modulus switching technique into the ellipsoidal duality attack framework. It uses attack statistics to guess the secret vector s and recover it as the complete s. guess ;

[0174] Optimization module: Used for parameter selection and optimization to minimize the overall attack complexity.

[0175] The above four steps are used to execute the four implementation steps of Example 1, respectively.

[0176] The LWE dual attack system based on ellipsoidal Gaussian sampling in this embodiment is used to execute and implement the LWE dual attack method based on ellipsoidal Gaussian sampling in Embodiment 1, so this embodiment will not elaborate on it.

[0177] Example 3

[0178] See Figure 2 This embodiment discloses a computer device, which includes a memory 304, a processor 302, and a computer program stored in the memory and executable on the processor. When the processor 302 executes the program, it implements the steps of the method described in Embodiment 1.

[0179] Furthermore, in Figure 2 In this embodiment, a bus architecture (represented by bus 300) is also included. Bus 300 may include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 302 and memory represented by memory 304. Bus 300 may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 306 provides an interface between bus 300 and receiver 301 and transmitter 303. Receiver 301 and transmitter 303 may be the same element, i.e., a transceiver, providing a unit for communicating with various other devices over a transmission medium. Processor 302 is responsible for managing bus 300 and general processing, while memory 304 may be used to store data used by processor 302 during operation.

[0180] Example 4

[0181] This embodiment provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the method described in Embodiment 1.

[0182] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0183] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0184] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0185] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0186] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0187] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A dual attack method for LWE based on ellipsoidal Gaussian sampling, characterized in that, Including the following steps: Construct a provable dual attack framework based on ellipsoidal Gaussian sampling; Construct an ellipsoidal Gaussian sampler to generate a list of vectors W; Integrating the cut-and-paste technique into the ellipsoid dual attack framework, the attack statistic is used to guess the secret vector s and recover it to the full s guess ; Perform parameter selection and optimization to minimize the overall attack complexity.

2. The LWE dual attack method based on ellipsoidal Gaussian sampling as described in claim 1, characterized in that, The specific steps for constructing the provable duality attack framework based on ellipsoidal Gaussian sampling are as follows: Define attack statistics g W (x), where x is the input vector, and W = (w1, w2, ..., w N ) is from the distribution The list of vectors sampled from the middle, where: It is composed of matrix A dual The dual lattice is defined; q is the modulus; Σ is a positive definite covariance matrix used to define the Gaussian distribution on an ellipsoid.

3. The LWE dual attack method based on ellipsoidal Gaussian sampling as described in claim 1, characterized in that, The construction of the ellipsoidal Gaussian sampler for generating the vector list W specifically includes the following steps: Step 2.1, input the BKZ-β reduced basis B and the covariance matrix. Where: β is the block size; It is a Gram-Schmidt orthogonalization basis of basis B; D = diag(r1, r2, ..., r m ) is a diagonal matrix, where r i It is the Gaussian width parameter (usually set to the zero vector in attacks); Step 2.2, set the center vector c; Step 2.3, perform the following sampling operation: calculate Initialize vector v←0, probability factor Δ←1; The probability factor Δ is obtained by performing reverse loop calculations from i=m to i=1; Output in probability factor Δ Otherwise, restart the entire sampling process; Step 2.4, output a list of vectors W subject to distribution D L(B),Σ,c where L(B) is the lattice generated by the basis B.

4. The LWE dual attack method based on ellipsoidal Gaussian sampling as described in claim 3, characterized in that, In step 2.3, the probability factor Δ is obtained by performing a reverse cyclic calculation from i=m to i=1 as follows: From Discrete Gaussian Distribution Medium sampling z i ,in It is the set of integers, r i It is a Gaussian parameter, t i It is the center; Update t←tz i u i , where u i Let be the i-th vector of basis U, where U is a unit upper triangular matrix; Update v←v+z i u i ; Update probability factors in The center is at t i The probability mass function of a discrete Gaussian distribution. It is the probability mass function of a discrete Gaussian distribution centered at zero.

5. The LWE dual attack method based on ellipsoidal Gaussian sampling as described in claim 1, characterized in that, The modulus switching technique is integrated into the ellipsoidal duality attack framework, and attack statistics are used to guess the secret vector s, thus restoring it to the complete s. guess The specific steps include: Step 3.1, select a set of small prime numbers, p1, p2, ..., p k , making Where q is the LWE modulus; Step 3.2, divide the secret vector s into two parts: s guess and s dual That is, s = [s guess ;s dual ]; Step 3.3, for each prime number p j Perform the following sub-steps: For each candidate guess Calculate vectors Using attack statistics g W,j (x) is used to evaluate the correctness of the guess, where g W,j (x) is an approximation based on the sample vector list W, defined as: Step 3.4, by comparing g W,j The value of (x) is used to identify the correct guess s. guess modp j ; Step 3.5, use the Chinese Remainder Theorem to transform the module p j Combining the guesses, the complete s guess .

6. The LWE dual attack method based on ellipsoidal Gaussian sampling as described in claim 1, characterized in that, The parameter selection and optimization process to minimize the overall attack complexity includes the following steps: Use the optimizer to find the optimal parameter combination {m,n} guess Let {, β, r} be the attack vectors to minimize the total attack complexity; the total attack complexity is expressed as: Wherein: T BKZ (m,β) is the cost of running the BKZ algorithm to obtain the reduced basis. N is the required number of samples, derived from the formula... Calculation, where T Ellipsoidal It is the average cost of each ellipsoidal Gaussian sampling. It is the total number of guesses across all moduli; m is the sample size, n guess Let β be the dimension of the guessed part, β be the size of the BKZ block, and r be the Gaussian parameter.

7. A dual attack system for LWE based on ellipsoidal Gaussian sampling, characterized in that, include: Initial module: Used to construct a provable dual attack framework based on ellipsoidal Gaussian sampling; Sampling module: Used to construct an ellipsoidal Gaussian sampler and generate a vector list W; Recovery Module: This module integrates the modulus switching technique into the ellipsoidal duality attack framework. It uses attack statistics to guess the secret vector s and recover it as the complete s. guess ; Optimization module: Used for parameter selection and optimization to minimize the overall attack complexity.

8. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, It stores a computer program that is executed by a processor to implement the method as described in any one of claims 1-6.

Images