Security and Communication Networks
Volume 2018 (2018), Article ID 4957045, 9 pages
https://doi.org/10.1155/2018/4957045

Research Article

Cryptanalysis of Compact-LWE and Related Lightweight Public Key Encryption

Dianyan Xiao¹ and Yang Yu²

¹Institute for Advanced Study, Tsinghua University, Beijing 100084, China
²Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China

Correspondence should be addressed to Yang Yu; y-y13@mails.tsinghua.edu.cn

Received 15 December 2017; Revised 14 January 2018; Accepted 28 January 2018; Published 11 March 2018

Academic Editor: Ilsun You

Copyright © 2018 Dianyan Xiao and Yang Yu. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Abstract.

In the emerging Internet of Things (IoT), lightweight public key cryptography plays an essential role in security and privacy protection. With the approach of quantum computing era, it is important to design and evaluate lightweight quantum-resistant cryptographic algorithms applicable to IoT. LWE-based cryptography is a widely used and well-studied family of postquantum cryptographic constructions whose hardness is based on worst-case lattice problems. To make LWE friendly to resource-constrained IoT devices, a variant of LWE, named Compact-LWE, was proposed and used to design lightweight cryptographic schemes. In this paper, we study the so-called Compact-LWE problem and clarify that under certain parameter settings it can be solved in polynomial time. As a consequence, our result leads to a practical attack against an instantiated scheme based on Compact-LWE proposed by Liu et al. in 2017.

1. Introduction

The Internet is changing from a network of conventional computers to a network of smart objects, that is, “things,” including vehicles, electronics, implantable medical devices, and sensors. The trend of Internet of Things (IoT) makes the Internet more ubiquitous, but it simultaneously brings a series of challenges, such as monitoring [1], communication [2], and management [3]. Among all these challenges, security [4–6] is currently listed as a top concern. As the theoretical basis, cryptographic algorithms play a key role in achieving data confidentiality and integrity, authentication, and other security needs in IoT.

Currently, RSA and ECC cryptosystems have been implemented efficiently on resource-constrained devices [7, 8], which provides desirable security for IoT applications. However, these public key schemes are based on integer factorization or discrete logarithms, which are fragile under quantum cryptanalysis. To defense quantum attacks, NIST has launched the postquantum cryptography standardization. Lattice-based cryptography is viewed as a very promising postquantum alternative to classical cryptography due to its strong security guarantee, great performance and powerful functionality. It is becoming increasingly important to design and evaluate practical schemes based on well-studied lattice problems.

The Learning With Errors (LWE) problem, introduced by Regev [9], is one of the most popular lattice problems for cryptographic applications [10–13]. An LWE instance consists of a random matrix and a vector , where the secret and the error are sampled from a certain distribution. The decision LWE problem is to distinguish the distribution of LWE instances from the uniform distribution over , while the search version is to recover the secret from LWE instances. In [9], the average-case LWE is proved as hard as certain worst-case lattice problems, which provides a solid theoretical grounding for LWE-based schemes.

However, LWE-based schemes are usually not efficient in practice. It seems infeasible to apply regular LWE-based cryptographic constructions to IoT directly, due to the constrained computing environments of smart devices. Thus it is critical to refine existing algorithms or develop new LWE-based cryptographic schemes for security protection using limited resources. So far, there are mainly two optimization strategies: (1) introducing extra algebraic structures and (2) reducing the sizes of matrix or vector elements. Following the first one, some LWE variants, such as Ring-LWE [14] and Module-LWE [15], were developed and led to many practical schemes [16–18] and efficient implementations [19, 20]. Following the second strategy, some variants were proposed as well, including LWE with short secret or error [21–23] and LWE with compact matrix [24, 25]. Then, related cryptanalyses [26–29] provided concrete security estimations for the schemes based on these variants.

A recent instantiation of LWE-based encryption scheme with particularly aggressive parameter was proposed by Liu et al. [25] and presented as an invited talk at ACISP 2017 conference. The scheme is based on the so-called Compact-LWE and designed especially for resource-constrained IoT devices. As shown by experimental results, the scheme indeed achieves an excellent performance on small IoT devices. Subsequently, Bootle and Tibouchi gave a cryptanalysis of this scheme [29] by recovering the nonce in the encryption process with the help of lattice embedding technique. They pointed out that the security level was much lower than [25] claimed.

We took an insight into the Compact-LWE problem, an LWE variant with the random selected from a small range, and discovered that two -ary lattices defined by have reduced bases of special patterns. We proved that the Compact-LWE problem can be solved in polynomial time under certain parameters, which is applied to analyze two concrete lightweight public key schemes proposed in [24, 25], respectively. We failed to attack the scheme of [24] due to its moderate parameters and successfully recovered plaintexts with 100% probability and within a very short time for the encryption scheme in [25]. Compared with the attack against the scheme of [25] in [29], our attack follows a different method and can be used to analyze general cryptographic constructions based on this kind of LWE variant.

The article is organized as follows. In Section 2, we recall some notations and basic facts used in our discussion. In Section 3, we introduce Compact-LWE and present our analysis. We describe a concrete attack against related Compact-LWE-based schemes in Section 4 and conclude in Section 5.

2. Preliminaries

2.1. Notations

For any positive integer , we identify with the set . We denote by the remainder of divided by in and by the remainder in . Let and be the Euclidean inner product and norm, respectively. The elements of are viewed as column vectors. For any point and , we denote by the -dimensional ball of radius centered at .

2.2. Probability and Statistics

Let be a distribution over a discrete domain . We write to represent the random variable that is sampled from the distribution . For a finite domain , we denote by the uniform distribution over .

A function is negligible, if for every fixed constant . We generally denote by as a negligible function with respect to . We say that a probability is overwhelming if it is , and a probability is nonnegligible if it is for some constant .

Definition 1. Given a distribution over , we say that is -confidence with respect to , if and for .

The parameter describes an overwhelming confidence interval for with respect to , while describes a nonnegligible confidence interval.

2.3. Lattices

A lattice is a discrete additive subgroup of and generated by a set of linearly independent vectors , that is, . We call a basis of and write as or . The integer is called the rank of . For any unimodular matrix , is also a basis of . The span of , denoted by , is the linear space spanned by its basis. The first minimum of a lattice is defined as .

We denote by the Gram-Schmidt orthogonalization of where and . The volume of is defined as that is an invariant of and independent of the choice of the basis.

The dual lattice of is . If is a basis of , it is known that is a basis of . Furthermore, we have the following relation between the Gram-Schmidt orthogonalization of a basis and its dual.

Lemma 2. Let be an ordered basis of lattice and be its dual basis in reverse order (i.e., where denotes Kronecker delta). Then for .

Given a lattice and a “reasonable” subset of , Gaussian heuristic says that the number of points in is approximately . From Gaussian heuristic, we would expect that where .

Lattice reduction is a powerful tool for cryptanalysis. LLL, invented by Lenstra et al. [30], is the first polynomial time lattice reduction algorithm. We now recall this classical reduction. For a detailed introduction, we refer to [31].

Definition 3 (LLL reduced basis). A basis is a -LLL reduced basis with if the following conditions hold:

(1)Size Reduced: for .(2)Lovász Condition: for .

Then we immediately get the following property of LLL reduced bases.

Lemma 4. Let be a -LLL reduced basis. For any , then

where .

3. Compact-LWE and Its Weak Instances

In this section, we will introduce an LWE variant named Compact-LWE and report on an attack against certain Compact-LWE instances. A formal definition of Compact-LWE is given as follows.

Definition 5. Let be positive integers and be a distribution over . Given , the Compact- problem is to recover from where and .

Compared with classical LWE, the sizes of elements of , namely , can be less than the modulus . Thanks to this modification, Compact-LWE-based schemes are of smaller public key sizes and better efficiency than original LWE-based schemes. Thus Compact-LWE seems friendly to lightweight cryptography and constrained devices.

3.1. Structures of -Ary Lattices in Compact-LWE

We introduce two -dimensional -ary lattices which are widely used in the cryptanalysis of LWE. The first lattice, denoted by , is generated by the columns of and and defined as

The second lattice is formed by all integer vectors “orthogonal” (modulo ) to the columns of , which is

As shown in [10], these two lattices are duals scaled by a factor:

By running LLL algorithm with input , one can obtain a basis of . For in the compact setting, the LLL reduced basis is of a special structure.

Lemma 6. Let where and . Let be the basis of obtained by running LLL with parameter on . Under Gaussian heuristic, then, for ,

(1) and   for ;(2) for .

Proof. Let be the homomorphism mapping to . It can be verified that is injective, then we have

Together with (4), it follows that

Let denote the projection to the orthogonal complement of . Considering the projected lattice generated by , the dimension of is . Combined with (6), we have

Since , it follows that

By Gaussian heuristic, we have that

A straightforward computation leads to that . It is known that the maximum of the Gram-Schmidt norms would never increase in LLL algorithm. Thus, Lovász condition always holds for the th and th vectors during LLL, which means that these two vectors would never be swapped. In other words, running LLL on is equivalent to running LLL on and , respectively. Consequently, we have and for .
For the second inequality, Lemma 4 yields that

because . We now complete the proof.

Remark 7. Experimental results coincide with Lemma 6. Under parameter settings , we generated instances for each ranging from to . Figure 1 illustrates the average profile of , where the first ’s are relatively short when is small. We notice that the slope of is less than the theoretical bound , which can be explained by the better performance of LLL in practice than the theoretical prediction. Figure 2 shows the gap between and , which is narrowing as increases. It is worth noting that when (the bound in Lemma 6 marked by the dashed line), the gap is quite significant.

Figure 1: Experimental measure of for different .

Figure 2: Experimental measure of the gap between and .

Lemma 8. Let and . Let and . There exists a basis of , denoted by , satisfying the following conditions under Gaussian heuristic:

(1),(2) for ,(3) for ,

where . This basis can be obtained in polynomial time.

Proof. Let be the LLL reduced basis of defined in Lemma 6 where . Let be a matrix such that . Then, from (4), is a basis of . Let where .
Let . We claim that . It is easy to observe that where . On one hand, we have since . On the other hand, for arbitrary , there exists a unique vector pair such that . Since , we have and then . Therefore, it holds that .
We run size reduction algorithm on (vectors of in reverse order) and obtain a new basis of , denoted by . Size reduction can be done within polynomial time; thus it suffices to prove the last two conditions hold for . From Lemmas 2 and 6, we have that, for ,

and then

Let where is the projection to the orthogonal complement of . Observing that and for , together with Lemma 6, we have

On the basis of Gaussian heuristic, we conclude that, for ,

We now complete the proof.

Remark 9. We ran experiments under parameters and tested instances for each ranging from to . Figure 3 provides a geometric intuition of . There also exists a large gap between and when is small. As illustrated in Figure 4, the gap between and is shrinking as grows. However, when (marked by the dashed line), the length of is far less than .

Figure 3: Experimental measure of for different .

Figure 4: Experimental measure of the gap between and .

3.2. Attack Against Weak Compact-LWE Instances

Figure 1 illustrates a staircase-shaped profile of the basis of . Exploiting this feature, we can prove that it is possible to efficiently recover a candidate error whose norm is close to that of the original error for certain parameters. The following lemma will be used in the later discussion.

Lemma 10. Let be a lattice of rank and be a basis of . Let and . If , then there exists a unique vector in .

Proof. We denote by the vector output by Babai’s nearest plane algorithm [32] on the lattice and target vector . Assume, by contradiction, that is another vector in and . Let be the largest index such that . According to the process of Babai’s algorithm, we conclude that

which implies a contradiction.

Next we demonstrate a class of provably weak instances of Compact-LWE and also an attack aiming at them.

Theorem 11. Let be positive integers satisfying and where for and a constant . Let be a -confidence distribution. Under Gaussian heuristic, there exists a probabilistic polynomial time algorithm solving Compact-.

Proof. Given a random sample , we can obtain a basis of , denoted by , by applying LLL algorithm with parameter on . Exploiting Babai’s algorithm on and target vector , we get a pair of solution . We are to prove that is legal for Compact-LWE, that is, , with nonnegligible probability.
From Lemma 6, we get that for . We denote by the projection to the orthogonal complement of . Let and . Lemma 10 shows that there exists a unique vector in , namely, . Then we have

Since is -confidence, it implies that with nonnegligible probability. Thus the probability of is nonnegligible.

Remark 12. In such weak instances, it can be verified that

and thus parameters are overstretched [33, 34]. The inequalities given in Lemma 6 follow the worst-case result of LLL, but LLL behaves much better in practice. Hence our attack may apply to more Compact-LWE instances. Moreover, note that, for usual LWE distribution such as discrete Gaussian, it is easy to set such that is -confidence.

4. Attack against Compact-LWE-Based Schemes

In this section, our analysis of Section 3 is applied to attack concrete Compact-LWE-based lightweight encryption schemes. We successfully recover the plaintexts in IoT-oriented public key encryption proposed by Liu et al. in [25] following a totally different way with [29]. However, we fail to give an effective cryptanalysis of the binary LWE-based lightweight encryption in [24].

4.1. Liu et al.’s Compact-LWE-Based Scheme

Firstly, we briefly recall the public key encryption in [25]. The scheme is specified by a tuple of public parameters satisfying

We list below three main algorithms: key generation , encryption , and decryption .

(i): sample , and choose from satisfying

and are pairwise coprime. Sample and . Let such that . Output as the secret key and as the public key.(ii): uniformly and independently sample , and calculate where is the th row of . Let , output as the ciphertext.(iii): calculate and then calculate . Let be the multiplicative inverse of modulo . Output the plaintext .

In [25], the authors also proposed concrete parameters to instantiate the scheme. The parameters are listed as follows:

(i)Public parameters: (ii)Secret parameters: where or .

4.2. Attack against Liu et al.’s Scheme

According to the average profile of bases shown in Lemmas 6 and 8 under the parameters (see Figures 5 and 6) as suggested in [25], it seems that Liu et al.’s scheme is fragile. We propose a new attack against Liu et al.’s scheme with the help of our analysis towards Compact-LWE in Section 3.

Figure 5: Experimental measure of .

Figure 6: Experimental measure of .

Our attack consists of two steps: guessing the mask coefficient and recovering the plaintext. In the first step, one can almost determine the pair (sometimes together with several possible candidate pairs) by enumerating and checking. In the second step, combined with , one can calculate a pair of legal solution to the Compact-LWE problem and recover the plaintext as well. Now we are to show the details of our attack.

Step 1 (guessing the mask coefficient ). Firstly, we prove that it is possible to recover efficiently the secret parameters and only from the public key .
Let be a basis of as described in Lemma 4 with . Let such that ; then we have that

Since and is also small when , a routine computation yields that under the parameter setting suggested in [25]. Then it holds that

for . We try all possible pairs and check inequality (21) for , respectively; then is viewed as a candidate when it holds for all .
Experiments indicate that this step can indeed determine the unique correct at most times, and output a few candidates (including the correct pair) of the form for small factor at other times. Therefore, by guessing and , we can actually remove the secret scaling factor and transform into a standard Compact-LWE sample.

Step 2 (recovering the plaintext). After the previous step, we obtain one or more pairs. Next, we are to show how to recover the plaintext combined with the ciphertext.
Let be the basis of described in Lemma 6. Given a candidate pair of the mask coefficient where is small, let . Running Babai’s algorithm on and target vector , we obtain and let . We observe that the distance from to is at most , and for . Following a similar argument of (16) in Theorem 11, we know that

Let such that , then where . Exploiting the substitute secret key , we can decrypt the ciphertext as follows:

(1)Calculate .(2)Calculate .(3)Return where .

We now explain why the ciphertext can be decrypted correctly by above algorithm. It can be checked that . Noticing that is well-bounded and some coordinates of could be negative, we may assert that with a high probability. Thus the term can be recovered (as ) correctly, which implies that is the plaintext.

Experiments show that the plaintext can indeed be recovered, even if for some . When is large, the norm of may exceed the upper bound , which implies that is a wrong guess. Therefore, we may eliminate some wrong guesses of further in this step. Moreover, one may also try more middle terms such as during the “decryption” to ensure that the correct value of is not missed. However, from our experimental results, we observe that trying only one is enough to recover the plaintext in practice.

Experimental Results. We implemented our attack using the NTL library [35]. All experiments were run on a single core of a 3.40 GHz Core i7-4930K PC.

We follow the parameter setting suggested in [25]: the public parameters and the secret parameters . We denote the cases and by and , respectively. For and , we respectively generated random instances and calculated the ciphertexts of random messages for each instance. Then we ran the attack on these ciphertexts. Experimental results are given in Table 1.

Table 1: Experimental results.

Parameter
Time for Step 1
Time for Step 2
Time for attack
Determining unique
Success rate

ParaA
0.61 s
1.94 s
2.55 s
67%
100%

ParaB
0.60 s
1.86 s
2.46 s
71%
100%

As mentioned before, we may obtain several pairs in Step 1. In fact, it suffices to take use of the pair with the minimal to recover the plaintext. This observation leads to an optimization of the attack: one may search in increasing (dictionary) order and move to Step 2 once a candidate is found. Experimental results for optimized attack are given in Table 2.

Table 2: Experimental results for optimized attack.

Parameter
Time for Step 1
Time for Step 2
Time for attack
Success rate

0.57 s
1.14 s
1.71 s
100%

0.57 s
1.14 s
1.71 s
100%

Comparison with Bootle and Tibouchi’s Attack. We note that Bootle and Tibouchi also proposed a practical attack [29] against Liu et al.’s encryption scheme. They deployed the technique of embedding lattices to compute the nonce sequence in encryption process Enc(), while we start from a different angle and recover a substitutable tuple of private keys . We hold the view that the insecurity of Liu et al.’s scheme is not only a result of the small value of as claimed in [29], but also the overstretched magnitude relation between the modulus and parameters , , and , which is clarified in Theorem 11.

4.3. Attack against Galbraith’s Scheme

In [24], Galbraith proposed a class of LWE-based encryption for constrained devices with more compact parameters; that is, the public matrix is binary. We tried to attack Galbraith’s scheme exploiting short vectors of as described before, but it was ineffective even for the parameters totally broken in [27]. That is because the modulus in Galbraith’s scheme is not so overstretched. However, the binary public matrix and encryption nonce may still be problematic as suggested in [27].

5. Conclusion

In this paper, we target the variant of LWE called Compact-LWE which may be applied to design IoT-oriented lightweight cryptography. We give an explicit analysis of Compact-LWE and point out some weak instances with extreme compactness and overstretched moduli. As an application of our results, we propose a practical attack against the lightweight public key scheme in [25]. Consequently, we claim that the security estimation in [25] is incorrect.

The fragility of the scheme in [25] comes not only from its small parameters but also from the weak hardness of Compact-LWE. It would be interesting to generally figure out a theoretical hardness relation between Compact-LWE and other lattice problems.

Compact-LWE may be still of some interest under refined parameters. We leave to future work the issues of tradeoff between efficiency and security, in particular the practical parameter selections achieving given security levels for IoT devices.

Conflicts of Interest

The authors declare that there are no conflicts of interest regarding the publication of this paper.

Acknowledgments

The authors thank Léo Ducas and Professor Xiaoyun Wang for helpful discussions and comments. This research was supported by the National Key Research and Development Program of China (Project no. 2017YFA0303903), 973 National Program on Key Basic Research Project of China (Project no. 2013CB834205), and National Natural Science Foundation of China (no. 61502269).

References

I. Kotenko, I. Saenko, and A. Kushnerevich, “Parallel big data processing system for security monitoring in internet of things networks,” Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 8, no. 4, pp. 60–74, 2017.

R. Sanchez-Iborra, J. S. Gómez, J. Santa et al., “Integrating LP-WAN communications within the vehicular ecosystem,” Journal of Internet Services and Information Security, vol. 7, no. 4, pp. 45–56, 2017.

G. Pau, M. Collotta, S. Tirrito, and R. Caponetto, “An innovative approach for the management of cross-coupling interference in street lighting networks,” Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 8, no. 2, pp. 44–63, 2017.

K. Zhang, X. Liang, R. Lu, and X. Shen, “Sybil attacks and their defenses in the internet of things,” IEEE Internet of Things Journal, vol. 1, no. 5, pp. 372–383, 2014.

V. Desnitsky, D. Levshun, A. Chechulin, and I. Kotenko, “Design technique for secure embedded devices: Application for creation of integrated cyber-physical security system,” Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 7, no. 2, pp. 60–80, 2016.

S. Aram, R. A. Shirvani, E. Pasero, and M. F. Chouikha, “Implantable medical devices; networking security survey,” Journal of Internet Services and Information Security, vol. 6, no. 3, pp. 40–60, 2016.

H. Seo, Z. Liu, J. Großschädl, and H. Kim, “Efficient arithmetic on ARM-NEON and its application for high-speed RSA implementation,” Security and Communication Networks, vol. 9, no. 18, pp. 5401–5411, 2016.

Z. Liu, X. Huang, Z. Hu, M. K. Khan, H. Seo, and L. Zhou, “On emerging family of elliptic curves to secure internet of things: ECC comes of age,” IEEE Transactions on Dependable and Secure Computing, vol. 14, no. 3, pp. 237–248, 2017.

O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” in Proceedings of the Thirty-Seventh Annual ACM Symposium on Theory of Computing, STOC 2005, pp. 84–93, Baltimore, MD, USA, 2005.

C. Gentry, C. Peikert, and V. Vaikuntanathan, “Trapdoors for hard lattices and new cryptographic constructions,” in Proceedings of the 40th Annual ACM Symposium on Theory of Computing, pp. 197–206, ACM, Victoria, British Columbia, Canada, 2008.

Z. Brakerski and V. Vaikuntanathan, “Efficient fully homomorphic encryption from (standard) LWE,” in Proceedings of the 2011 IEEE 52nd Annual Symposium on Foundations of Computer Science, FOCS 2011, pp. 97–106, USA, October 2011.

S. Gorbunov, V. Vaikuntanathan, and H. Wee, “Attribute-based encryption for circuits,” in Proceedings of the 45th Annual ACM Symposium on Theory of Computing, STOC 2013, pp. 545–554, June 2013.

M. S. Rahman, A. Basu, and S. Kiyomoto, “Decentralized ciphertext-policy attribute-based encryption: a post-quantum construction,” Journal of Internet Services and Information Security, vol. 7, no. 3, pp. 1–16, 2017.

V. Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,” in Proceedings of the Advances in Cryptology—EUROCRYPT 2010, vol. 6110 of Lecture Notes in Comput. Sci., pp. 1–23, Springer, French Riviera, France, 2010.

A. Langlois and D. Stehlé, “Worst-case to average-case reductions for module lattices,” Designs, Codes and Cryptography, vol. 75, no. 3, pp. 565–599, 2015.

L. Ducas, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehlé, “CRYSTALS – Dilithium: Digital signatures from module lattices,” in Cryptology ePrint Archive, 2017, Report 2017/633, http://eprint.iacr.org/2017/633.

J. Bos, L. Ducas, E. Kiltz et al., “CRYSTALS – Kyber: a cca-secure module-lattice-based kem,” in Cryptology ePrint Archive, 2017, Report 2017/634, http://eprint.iacr.org/2017/634.

E. Alkim, L. Ducas, T. P, P. Schwabe, and T. Pöppelmann, “Post-quantum key exchange—a new hope,” in Proceedings of the 25th USENIX Security Symposium, vol. 16, pp. 327–343, 2016, https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/alkim.

Z. Liu, H. Seo, S. S. Roy, J. Großschädl, H. Kim, and I. Verbauwhede, “Efficient ring-LWE encryption on 8-bit AVR processors,” CHES, vol. 9293, pp. 663–682, 2015.

Z. Liu, R. Azarderakhsh, H. Kim, and H. Seo, “Efficient Software Implementation of Ring-LWE Encryption on IoT Processors,” IEEE Transactions on Computers, 2017.

T. Güneysu, V. Lyubashevsky, and T. Pöppelmann, “Practical lattice-based cryptography: a signature scheme for embedded systems,” in Proceedings of the International Workshop on Cryptographic Hardware and Embedded Systems, CHES 2012, vol. 7428, pp. 530–547.

D. Micciancio and C. Peikert, “Hardness of SIS and LWE with small parameters,” in Proceedings of the Advances in Cryptology—CRYPTO 2013. Part I, vol. 8042 of Lecture Notes in Comput. Sci., pp. 21–39, Springer, Santa Barbara, CA, USA, 2013.

Z. Brakerski, A. Langlois, C. Peikert, O. Regev, and D. Stehlé, “Classical hardness of learning with errors,” in Proceedings of the 45th Annual ACM Symposium on Theory of Computing, STOC 2013, pp. 575–584, USA, June 2013.

S. D. Galbraith, “Space-efficient variants of cryptosystems based on learning with errors,” 2013, https://www.math.auckland.ac.nz/~sgal018/compact-LWE.pdf.

D. Liu, N. Li, J. Kim, and S. Nepal, “Compact-LWE: Enabling practically lightweight public key encryption for leveled IoT device authentication,” in Cryptology ePrint Archive, 2017, Report 2017/685, http://eprint.iacr.org/2017/685.

S. Bai and S. D. Galbraith, “Lattice decoding attacks on binary LWE,” ACISP, vol. 8544, pp. 322–337, 2014.

G. Herold and A. May, “LP solutions of vectorial integer subset sums - cryptanalysis of Galbraith’s binary matrix LWE,” in Proceedings of the Public-key cryptography—PKC 2017. PART I, vol. 10174 of Lecture Notes in Comput. Sci., pp. 3–15, Springer, Amsterdam, The Netherlands, 2017.

E. Kirshanova, A. May, and F. Wiemer, “Parallel implementation of BDD enumeration for LWE,” ACNS, vol. 9696, pp. 580–591, 2016.

J. Bootle and M. Tibouchi, “Cryptanalysis of Compact-LWE,” in Cryptology ePrint Archive, 2017, Report 2017/742, http://eprint.iacr.org/2017/742.

A. K. Lenstra, J. Lenstra, and L. Lovász, “Factoring polynomials with rational coefficients,” Mathematische Annalen, vol. 261, no. 4, pp. 515–534, 1982.

P. Q. Nguyen and B. Vallée, The LLL algorithm: Survey and applications, Springer, 2010.

L. Babai, “On Lovász’ lattice reduction and the nearest lattice point problem,” in STACS, vol. 182 of Lecture Notes in Comput. Sci., pp. 13–20, Springer, Saarbrücken, Germany, 1985.

M. Albrecht, S. Bai, and L. Ducas, “A subfield lattice attack on overstretched NTRU assumptions: cryptanalysis of some FHE and graded encoding schemes,” in Proceedings of the Advances in Cryptology—CRYPTO 2016. Part I, vol. 9814 of Lecture Notes in Comput. Sci., pp. 153–178, Springer, Santa Barbara, CA, USA, 2016.

P. Kirchner and P.-A. Fouque, “Revisiting lattice attacks on overstretched NTRU parameters,” in Proceedings of the Advances in Cryptology—EUROCRYPT 2017. Part I, vol. 10210 of Lecture Notes in Comput. Sci., pp. 3–26, Springer, Paris, France, 2017.

V. Shoup, “NTL: A library for doing number theory,” http://www.shoup.net.