LWE 评估器

源码:https://github.com/malb/lattice-estimator

文档:https://lattice-estimator.readthedocs.io/en/latest/readme_link.html#

作者:Martin Albrecht、Léo Ducas 等人

文章目录

  • 源文件分析
    • estimator 文件树
    • nd.py
    • lwe_parameters.py
    • schemes.py
    • lwe.py
  • 简单使用

源文件分析

estimator 文件树

.
├── __init__.py
├── __pycache__
│   ├── __init__.cpython-310.pyc
│   ├── conf.cpython-310.pyc
│   ├── cost.cpython-310.pyc
│   ├── errors.cpython-310.pyc
│   ├── gb.cpython-310.pyc
│   ├── io.cpython-310.pyc
│   ├── lwe.cpython-310.pyc
│   ├── lwe_bkw.cpython-310.pyc
│   ├── lwe_dual.cpython-310.pyc
│   ├── lwe_guess.cpython-310.pyc
│   ├── lwe_parameters.cpython-310.pyc
│   ├── lwe_primal.cpython-310.pyc
│   ├── nd.cpython-310.pyc
│   ├── prob.cpython-310.pyc
│   ├── reduction.cpython-310.pyc
│   ├── schemes.cpython-310.pyc
│   ├── simulator.cpython-310.pyc
│   └── util.cpython-310.pyc
├── conf.py
├── cost.py
├── errors.py
├── gb.py
├── io.py
├── lwe.py
├── lwe_bkw.py
├── lwe_dual.py
├── lwe_guess.py
├── lwe_parameters.py
├── lwe_primal.py
├── nd.py
├── prob.py
├── reduction.py
├── schemes.py
├── simulator.py
└── util.py

nd.py

from .nd import NoiseDistribution as ND

离散高斯分布

  • DiscreteGaussian(stddev, mean=0, n=None),均值为 m e a n mean mean,标准差为 s t d d e v stddev stddev

  • DiscreteGaussianAlpha(alpha, q, mean=0, n=None),均值为 m e a n mean mean,标准差为 s t d d e v = a l p h a ⋅ q 2 π stddev=\dfrac{alpha \cdot q}{\sqrt{2 \pi}} stddev=2π alphaq

中心二项分布CenteredBinomial(eta, n=None),均值为 m e a n = 0 mean=0 mean=0,标准差为 s t d d e v = e t a 2 stddev=\sqrt{\dfrac{eta}{2}} stddev=2eta

均匀分布

  • Uniform(a, b, n=None),均值为 m e a n = a + b 2 mean=\dfrac{a+b}{2} mean=2a+b,标准差为 s t d d e v = ( b − a ) 2 12 stddev=\sqrt{\dfrac{(b-a)^2}{12}} stddev=12(ba)2

  • UniformMod(q, n=None),均值为 m e a n = 0 mean=0 mean=0,标准差为 s t d d e v = q 2 12 stddev=\sqrt{\dfrac{q^2}{12}} stddev=12q2

稀疏三元分布ND.SparseTernary(n,p,m),均值为 m e a n = p − m n mean=\dfrac{p-m}{n} mean=npm,标准差为 s t d d e v = p ⋅ ( 1 − m e a n ) 2 + m ⋅ ( − 1 − m e a n ) 2 + ( n − p − m ) ⋅ m e a n 2 n stddev=\sqrt{\dfrac{p\cdot(1-mean)^2 + m\cdot(-1-mean)^2 + (n-p-m)\cdot mean^2}{n}} stddev=np(1mean)2+m(1mean)2+(npm)mean2

lwe_parameters.py

from .lwe_parameters import LWEParameters as Parameters

设置参数LWE.Parameters(n, q, Xs, Xe)

  • (标准)LWE 的维度为 n n n,模数为 q q q
  • 秘密的分布为 X s Xs Xs
  • 噪声的分布为 X e Xe Xe

schemes.py

定义了一些知名密码方案的参数:

  • Kyber、Saber、NTRU、Frodo、TFHE、FHEW
  • SEAL、HElib

lwe.py

from . import lwe as LWE

包含的攻击方案有:Coded-BKWPrimal-uSVPPrimal-BDDPrimal-BDD-HybridPrimal-BDD-MITM-HybridDualDual-HybridDual-MITM-HybridArora-Ge

from .lwe_primal import primal_usvp, primal_bdd, primal_hybrid
from .lwe_bkw import coded_bkw
from .lwe_guess import exhaustive_search, mitm, distinguish, guess_composition
from .lwe_dual import dual, dual_hybrid
from .gb import arora_gb

粗略估计(较快)rough(self, params, jobs=1, catch_exceptions=True)

完全估计(很慢)__call__(self,params,jobs=1,catch_exceptions=True)

简单使用

在工作目录 /lattice-estimator-main 下启动 wsl,并进入 sage 环境

  1. 导入 estimator 模块,
>>> from estimator import *
  1. 设置 LWE 的参数(玩具),
>>> params = LWE.Parameters(n=128, q=12289, Xs=ND.CenteredBinomial(2), Xe=ND.CenteredBinomial(1))
LWEParameters(n=128, q=12289, Xs=D(σ=1.00), Xe=D(σ=0.71), m=+Infinity, tag=None)
  1. 启动评估器,
>>> LWE.estimate(params, jobs=16) #执行全部评估,启用多线程
>>> LWE.estimate.rough(params) #遵从某些假设和启发式,粗略估计
  1. 查看评估结果,
arora-gb             :: rop:2^38.5, dreg: 3, mem:2^36.9, t: 1, m:2^20.0, tag: arora-gb,: 3, ζ: 1
bkw                  :: rop:2^53.0, m:2^43.3, mem:2^44.3, b: 3, t1: 0, t2: 12,: 2, #cod: 111, #top: 0, #test: 17, tag: coded-bkw
usvp                 :: rop:2^62.4, red:2^62.4, δ: 1.007602, β: 145, d: 146, tag: usvp
bdd                  :: rop:2^41.0, red:2^41.0, svp:2^21.1, β: 40, η: 2, d: 267, tag: bdd
bdd_hybrid           :: rop:2^41.2, red:2^41.2, svp:2^32.1, β: 40, η: 2, ζ: 7, |S|:2^11.0, d: 301, prob: 0.993,: 1, tag: hybrid
bdd_mitm_hybrid      :: rop:2^41.2, red:2^41.2, svp:2^16.5, β: 40, η: 2, ζ: 0, |S|: 1, d: 308, prob: 0.996,: 1, tag: hybrid
dual                 :: rop:2^42.2, mem: 19, m: 179, β: 40, d: 307,: 1, tag: dual
dual_hybrid          :: rop:2^42.1, mem:2^31.8, m: 175, β: 40, d: 288,: 1, ζ: 15, tag: dual_hybrid
{'arora-gb': rop:2^38.5, dreg: 3, mem:2^36.9, t: 1, m:2^20.0, tag: arora-gb,: 3, ζ: 1,
 'bkw': rop:2^53.0, m:2^43.3, mem:2^44.3, b: 3, t1: 0, t2: 12,: 2, #cod: 111, #top: 0, #test: 17, tag: coded-bkw,
 'usvp': rop:2^62.4, red:2^62.4, δ: 1.007602, β: 145, d: 146, tag: usvp,
 'bdd': rop:2^41.0, red:2^41.0, svp:2^21.1, β: 40, η: 2, d: 267, tag: bdd,
 'bdd_hybrid': rop:2^41.2, red:2^41.2, svp:2^32.1, β: 40, η: 2, ζ: 7, |S|:2^11.0, d: 301, prob: 0.993,: 1, tag: hybrid,
 'bdd_mitm_hybrid': rop:2^41.2, red:2^41.2, svp:2^16.5, β: 40, η: 2, ζ: 0, |S|: 1, d: 308, prob: 0.996,: 1, tag: hybrid,
 'dual': rop:2^42.2, mem: 19, m: 179, β: 40, d: 307,: 1, tag: dual,
 'dual_hybrid': rop:2^42.1, mem:2^31.8, m: 175, β: 40, d: 288,: 1, ζ: 15, tag: dual_hybrid,
 'dual_mitm_hybrid': rop:2^47.5, mem:2^45.1, m: 187, k: 25,: 1, β: 58, d: 288, ζ: 27, tag: dual_mitm_hybrid}
  1. 计算安全强度(以 uSVP 的 β = 145 \beta=145 β=145 为例),
>>> class = 145 * 0.292 #经典安全性(bits)
42.3400

>>> quantum = 145 * 0.265 #量子安全性(bits)
38.4250

你可能感兴趣的:(代码,#,后量子密码学,python,github,人工智能,信息安全,密码学)