![](bg2.png)
plexity ciphertext packing techniques were studied.
For example, Peikert’s SIMD technique (Peikert et al.,
2008), Yasuda’s ideal lattice technique (Yasuda et al.,
2013), Cheon’s preprocessing of binary vector before
encryption technique (Cheon et al., 2013), Smart and
Vercuteren’s polynomial-CRT technique (Smart and
Vercauteren, 2014) etc. However, these schemes are
still not efficient enough to be acceptable in practice.
Somewhat Homomorphic Encryption (SHE)
schemes support a limited set of homomorphic
computations. One such SHE scheme was proposed
by Dyer et al. (Dyer et al., 2017). They presented
a suite of four symmetric key encryption schemes
- HE1 and HE2 are suitable for large entropy data
while their variants, HE1N and HE2N are appropriate
for small entropy data. The entropy represents the
number of bits present in the message. HE2N also
has the flexibility to be generalized to l-dimensions
with an increased level of security.
The encryption scheme is based on the hardness
of the Approximate Greatest Common Divisors prob-
lem (AGCD) (Howgrave-Graham, 2001). Given m
approximate multiples of p, c
i
= pq
i
+r
i
with small r
i
,
the approximate greatest common divisor p needs to
be recovered. The usual way to recover p is to guess
any two of r
1
, ··· , r
m
then compute greatest common
divisor of them as GCD(c
i
−r
i
,c
j
−r
j
). If the r
i
’s are
sufficiently small then the secret p can be recovered
easily using brute force search. However, if the per-
turbation r
i
is in the vicinity of p, then it is clearly
impossible to reconstruct p from the given informa-
tion.
The main contribution of this work is to demon-
strate that two of the four proposed schemes, HE1 and
HE1N are insecure. Even with a fairly small number
of ciphertexts, the plaintext and secret key can be de-
duced using the Orthogonal Lattice attack. The ex-
ecution time of the attack is a function of two main
parameters - the entropy of the message, ρ and the
maximum number of homomorphic operations, d that
can be performed on a given message before decryp-
tion fails. For small parameter settings, the execution
time is a few minutes and increases to a few hours for
larger parameter values.
Notations: In this paper, uppercase bold letters are
used to represent matrices, lowercase bold are for vec-
tors and regular lowercase are for constants.
x
$
←− Q denotes x is chosen uniformly at random
from space Q. lg denotes log base 2.
The paper is organized as follows. Section 2 con-
tains background material related to lattices. Section
3 summarizes the encryption schemes presented in
(Dyer et al., 2017) including the variants targeted in
our attack. In section 4, we present the cryptanalytic
attack on two of those schemes. We also include the
time to execute the attack. Section 5 concludes the
paper.
2 BACKGROUND
A lattice is a discrete (additive) subgroup of R
n
.
In particular, any subgroup of Z
n
is a special kind
of lattice referred to as an integer lattice. Let
b
1
, ··· , b
m
∈ Z
n
, n ≥ m be linearly independent. The
lattice, L , spanned by integer linear combinations of
b
1
, b
2
, ··· , b
m
is
L (b
1
, b
2
, ··· , b
m
) =
m
∑
i=0
x
i
b
i
: x
i
∈ Z
The set of vectors B = (b
1
, b
2
··· , b
m
) is called a basis
of lattice L, n, rank of lattice and m, dimension of
lattice. A full-rank lattice is one for which m = n.
The determinant of a lattice is n-dimensional vol-
ume of its fundamental parallelepiped, computed as
det(L)=
p
det(BB
T
), where B
T
is the transpose of B.
A lattice can have multiple bases spanning the same
lattice. The determinant of a lattice is independent of
the choice of basis.
Lattice reduction is often a key step in solving
problems based on lattices. It is used to find a basis
with short and nearly orthogonal vectors. The qual-
ity of the basis obtained from a reduction algorithm is
determined by the Hermite factor δ
n
0
where
||b
0
|| = δ
n
0
vol(L)
1
n
Here, b
0
represents the shortest non-zero vector after
lattice reduction. The smaller the Hermite factor, the
higher is the quality of the reduced basis.
The two main lattice reduction algorithms are
LLL and BKZ. BKZ2.0 is an optimized version of
BKZ. BKZ behaves differently based on block size k.
For k = 2 the algorithm runs in polynomial time and
outputs a basis equivalent to an LLL-reduced basis.
An increase in block size improves the quality of the
reduced basis but takes more time. In practice, the run
time of BKZ increases rapidly with block size and be-
comes practically infeasible for k > 30 or so. BKZ2.0
can handle a much larger block size and results in a
greatly reduced basis compared to BKZ.
Implementations of LLL, BKZ and BKZ 2.0 are
available in many software packages. In our imple-
mentations we have used SageMath and the fplll li-
braries.
SECRYPT 2019 - 16th International Conference on Security and Cryptography
518