Memory-Efficient Attacks on Small LWE Keys

Combinatorial attacks on small max norm LWE keys suffer enormous memory requirements, which render them inefficient in realistic attack scenarios. Therefore, more memory-efficient substitutes for these algorithms are needed. In this work, we provide new combinatorial algorithms for recovering small max norm LWE secrets outperforming previous approaches whenever the available memory is limited. We provide analyses of our algorithms for secret key distributions of current NTRU, Kyber and Dilithium variants, showing that our new approach outperforms previous memory-efficient algorithms. For instance, considering uniformly random ternary secrets of length n we improve the best known time complexity for polynomial memory algorithms from \(2^{1.063n}\) $2^{1.063n}$ down-to \(2^{0.926n}\) $2^{0.926n}$ . We obtain even larger gains for LWE secrets in \(\{-m,\ldots ,m\}^n\) ${\{-m,\dots ,m\}}^n$ with \(m=2,3\) $m=2,3$ as found in Kyber and Dilithium. For example, for uniformly random keys in \(\{-2,\ldots ,2\}^n\) ${\{-2,\dots ,2\}}^n$ as is the case for Dilithium we improve the previously best time under polynomial memory restriction from \(2^{1.742n}\) $2^{1.742n}$ down-to \(2^{1.282n}\) $2^{1.282n}$ . Eventually, we provide novel time-memory trade-offs continuously interpolating between our polynomial memory algorithms and the best algorithms in the unlimited memory case (May, in: Malkin, Peikert (eds) CRYPTO 2021, Part II, Springer, Heidelberg 2021. https://doi.org/10.1007/978-3-030-84245-1_24).