Hidden Number Problems With Chosen Errors (HNP-CE)

Quick Summary

We introduce a variant of the Hidden Number Problem in which the unknown noise terms are drawn from a fixed finite set and generate a lattice solution.

This is part of our series on Practical Hidden Number Problems for Programmers:

*These links are paywalled. (It’s how I’ll afford grad school lol)

Part 1: Quantum Computing and Intro to Hidden Number Problems

Part 2: Increasing Lattice Volume for Improved HNP Attacks

Part 3: Hidden Number Problems with Multiple Noise Holes

Part 4: Hidden Number Problems with Chosen Multipliers

Part 5 (we are here): Hidden Number Problems with Chosen Errors

As usual, you can code alongside the Google Colab Notebook or the GitHub repo.

1.0 Introduction

The term hidden number problem refers to the challenge of recovering a secret hidden number given partial knowledge of its linear relations (Surin & Cohney, 2023)¹.

Linear Hidden Number Problem

(Boneh & Venkatesan, 1996)² introduce the linear hidden number problem and assert that lattice reduction recovers the unknown key (x) in polynomial time despite the noise term (β_i) when provided known multipliers (t_i) alongside known observations (a_i).

Hidden Number Problem with Chosen Errors (HNP-CE),

We introduce the Hidden Number Problem with Chosen Errors (HNP-CE), a variant of the linear hidden number problem where the exact noise terms (β_i) are unknown but shared across different relations with known weights(w).

HNP-CE arises when the Reduced Row Echelon Form of an integer matrix suffers from one or more free variables.

Free variable in RREF leads to HNP-CE

HNP-CE practically appears during password attacks, error-correction in satellite communications, solving Pell equations, and more generally in solving matrix systems over a finite field.

2.0 Lattice Construction and Target Vectors

First, we ‘lift’ our relation from a finite field to the ring of integers such that:

Relation lifted to integer

Next, we define an unknown vector x:

Unknown vector x holds lift information, the secret key and noise betas

and define the corresponding basis matrix (where D is an arbitrary constant):

Basis matrix

We see that the linear combination xB generates the lattice vector:

linear combination xB

where in the optimal setting:

Residual definition

So our target vector u becomes:

Target vector after lattice reduction

2.1 Numerical Example

We cement the idea via a step-by-step example modulo the prime number 13441.

Step 1: Define a secret key (x) alongside a set of 5 possible noise terms (β_i):

Secret key and beta noise terms. (we wouldn’t know this irl)

Step 2: Collect 10 relations of the form below:

HNP-CE relations where actual noise is unknown but can identify noise term occurence

Step 3: Construct the HNP-CE lattice with D = 1 (tweak D like a hyperparameter lol):

HNP-CE Lattice has 17 rows and 12 columns

Sanity Check: Observe that the matrix product xB, where B is the HNP-CE lattice from Step 3, generates these linear combinations, and we expect our secret x to appear at the 11th column:

Result of linear combination xB

Step 4: Perform LLL reduction on the HNP-CE lattice to obtain:

LLL reduced HNP-CE matrix

Step 5: Observe that the secret key (signs ignored) occurs in the row where D=1 occurs in the final column:

Our target secret key is revealed in the second last row element as expected

We found 6618. It worked lol.

3.0 Possible Improvements

One can borrow the ‘eliminate secret key’ trick from (Albrecht & Heninger, 2020)³ to reduce lattice dimension by 1:

Algorithm to eliminate secret key from basis. Taken from page 11 of (Albrecht & Heninger, 2020)

References

1. Surin, J., & Cohney, S. (2023). A Gentle Tutorial for Lattice-Based Cryptanalysis. University of Melbourne. Cryptology ePrint Archive. PDF Link.

2. Boneh, D., & Venkatesan, R. (1996). Hardness of Computing the Most Significant Bits of Secret Keys in Diffie-Hellman and Related Schemes. In: Koblitz, N. (eds) Advances in Cryptology — CRYPTO ’96. CRYPTO 1996. Lecture Notes in Computer Science, vol 1109. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-68697-5_11

3. Albrecht, M.R., & Heninger, N. (2020). On Bounded Distance Decoding with Predicate: Breaking the “Lattice Barrier” for the Hidden Number Problem. IACR Cryptology ePrint Archive.