Skip to content

Commit cedf8a2

Browse files
Update README.md
1 parent 67ebcb6 commit cedf8a2

File tree

1 file changed

+13
-13
lines changed

1 file changed

+13
-13
lines changed

README.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
# Understanding the parameters of Learning With Errors (LWE)
22

3-
In this notebook I will briefly explain the Learning with Errors (LWE) method, which is a post-quantum public-key cryptography algorithm. We provide the mathematical background then detail our implementation based on Python 3 and `numpy`, and finally our experiments, whose objective is to understand how changing the parameters of the algorithm affects the expected result. Our experiments are based on the encryption and decryption of a single bit message of value `1`, which are executed ten thousand times for each configuration tested. Graphs are created to visualise the results.
3+
In this report, I will briefly explain the Learning with Errors (LWE) method, which is a post-quantum public-key cryptography algorithm. We provide the mathematical background then detail our implementation based on Python 3 and `numpy`, and finally, our experiments, whose objective is to understand how changing the parameters of the algorithm affects the expected result. Our experiments are based on the encryption and decryption of a single bit message of value `1`, which are executed ten thousand times for each configuration tested. Graphs are created to visualize the results.
44

55
**Try live [here](https://mybinder.org/v2/gh/fredericoschardong/learning-with-errors-parameters/HEAD?filepath=Index.ipynb)**
66

7-
## LWE Description
7+
# LWE Description
88

99
LWE is a post-quantum publick-key algorithm, see [this presentation](https://summerschool-croatia.cs.ru.nl/2018/slides/Introduction%20to%20post-quantum%20cryptography%20and%20learning%20with%20errors.pdf) for more information and [the original paper](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.205.2622&rep=rep1&type=pdf). This method can be resumed to the computations described in this section. First, to create a public and private key:
1010

1111
![A_{m}^{n \times 1} \times S_{m}^{1 \times 1} + E_{m}^{n \times 1} = B_{m}^{n \times 1}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A_%7Bm%7D%5E%7Bn+%5Ctimes+1%7D+%5Ctimes+S_%7Bm%7D%5E%7B1+%5Ctimes+1%7D+%2B+E_%7Bm%7D%5E%7Bn+%5Ctimes+1%7D+%3D+B_%7Bm%7D%5E%7Bn+%5Ctimes+1%7D)
1212

13-
![A](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A) and ![B](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+B) are the public key, ![S](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+S) is the private key and ![E](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+E) is the random error, and ![A,B,S,E \in \mathbb{Z}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A%2CB%2CS%2CE+%5Cin+%5Cmathbb%7BZ%7D). The matrixes ![A,B,E](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A%2CB%2CE) have dimension ![n \times 1](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+n+%5Ctimes+1), that is, they are single column, because in this report we implement a single-bit encryption and decryption.
13+
![A](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A) and ![B](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+B) are the public keys, ![S](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+S) is the private key and ![E](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+E) is the random error, and ![A,B,S,E \in \mathbb{Z}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A%2CB%2CS%2CE+%5Cin+%5Cmathbb%7BZ%7D). The matrixes ![A,B,E](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A%2CB%2CE) have dimension ![n \times 1](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+n+%5Ctimes+1), that is, they are single column because in this report we implement single-bit encryption and decryption.
1414

1515
To encrypt a single-bit message ![x](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+x) using the public key ![A,B](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A%2CB) we obtain the encrypted message composed of ![(u,v)](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%28u%2Cv%29) with:
1616

@@ -24,12 +24,12 @@ Where ![samples](https://render.githubusercontent.com/render/math?math=%5Cdispla
2424
1 \text{, else}
2525
\end{cases}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+x%27+%3D+%0A%5Cbegin%7Bcases%7D%0A0+%5Ctext%7B%2C+if+%7D+%28v+-+su+%5Cbmod+m%29+%3C+%5Cfrac%7Bq%7D%7B2%7D+%5C%5C%0A1+%5Ctext%7B%2C+else%7D%0A%5Cend%7Bcases%7D)
2626

27-
## LWE Implementation
27+
# LWE Implementation
2828

2929
The following `run` function was based on [this material](https://medium.com/asecuritysite-when-bob-met-alice/learning-with-errors-and-ring-learning-with-errors-23516a502406), where LWE is implemented to encrypt and decrypt a single bit of value `1`. All parameters required by the algorithm are passed as parameters for this function. They are:
3030
+ `n` and `m`, where `n` is the number of rows of the single column matrixes ![A,B,E](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A%2CB%2CE), and `m` is the modulo for all the operations
3131
+ `err` sets the largest value of the interval ![[1,err] \in \mathbb{Z}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%5B1%2Cerr%5D+%5Cin+%5Cmathbb%7BZ%7D), from which error values are randomly drawn and then added to the result of ![A_{m}^{n \times 1} * S_{m}^{1 \times 1}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+A_%7Bm%7D%5E%7Bn+%5Ctimes+1%7D+%2A+S_%7Bm%7D%5E%7B1+%5Ctimes+1%7D), as described above
32-
+ `sample` sets the number of samples drawn from the public key ![(A,B)](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%28A%2CB%29) to encrypt the bit-message `1`
32+
+ `sample` sets the number of samples drawn from the public key ![(A,B)](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%28A%2CB%29) to encrypt the single-bit message `1`
3333
+ `times` sets how many times the experiment is reproduced to find a statistically relevant result
3434

3535
The returned value is in the range ![[0,1] \in \mathbb{R}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%5B0%2C1%5D+%5Cin+%5Cmathbb%7BR%7D) and represents how many experiments ran successfully, that is, correctly encrypted and decrypted the bit `1`.
@@ -62,11 +62,11 @@ def run(n = 20, m = 97, err = 4, sample = 5, times = 10000):
6262
return np.sum(((v - s * u) % m) > m / 2) / times
6363
```
6464

65-
## Experiments
65+
# Experiments
6666

6767
Having detailed the mathematical background and how our implementation of LWE works, we now proceed to perform some experiments and discuss their results.
6868

69-
### 1. Exploring how `n` affects the result
69+
## 1. Exploring how `n` affects the result
7070

7171

7272
```python
@@ -81,7 +81,7 @@ plt.show()
8181

8282
Increasing `n` doesn't affect the correctness of the encryption and decryption processes.
8383

84-
### 2. Exploring how `err` affects the result
84+
## 2. Exploring how `err` affects the result
8585

8686

8787
```python
@@ -94,7 +94,7 @@ plt.show()
9494
![png](output_13_0.png)
9595

9696

97-
Apparently running LWE with the error range uper bound greater than roughly 10% of the modulo `m` affects the correctness of the output. Next, we try a prime modulo of about 10x the current to verify if the 10% threshold holds.
97+
Apparently running LWE with the error range upper bound greater than roughly 10% of the modulo `m` affects the correctness of the output. Next, we try a prime modulo of about 10x the current to verify if the 10% threshold holds.
9898

9999

100100
```python
@@ -128,7 +128,7 @@ plt.show()
128128
![png](output_17_1.png)
129129

130130

131-
Same behaviour. Now let's change the sampling size.
131+
Same behavior. Now let's change the sampling size.
132132

133133

134134
```python
@@ -150,7 +150,7 @@ plt.show()
150150

151151

152152
Increasing the sample size has an impact! Apparently..
153-
Next, we try with modulo `m = 997` and double the sample on each test to see if the behaviour continues.
153+
Next, we try with modulo `m = 997` and double the sample on each test to see if the behavior continues.
154154

155155

156156
```python
@@ -171,9 +171,9 @@ plt.show()
171171
![png](output_21_1.png)
172172

173173

174-
Empircally testing LWE the parameters seem to have to respect the ratio of ![err \leq \frac{m}{2 \times sample}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+err+%5Cleq+%5Cfrac%7Bm%7D%7B2+%5Ctimes+sample%7D) to correctly encrypt and decrypt.
174+
Empircaly testing LWE the parameters seem to have to respect the ratio of ![err \leq \frac{m}{2 \times sample}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+err+%5Cleq+%5Cfrac%7Bm%7D%7B2+%5Ctimes+sample%7D) to correctly encrypt and decrypt.
175175

176-
Let's put this claim to the test. First we calculate all the prime numbers in the range ![[101,100000]](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%5B101%2C100000%5D) and select 1 for every 100 primes in the list. Then, for all these primes we select the number of samples at random (limiting at 1% of each prime) and calculate the uper bound value for the error range following the formula ![\frac{m}{2 \times sample}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%5Cfrac%7Bm%7D%7B2+%5Ctimes+sample%7D). Next, we run the LWE algorithm with the aforementioned parameters and plot the result. If our empirically found relation holds, then we shall see no point off the `1.0` value in the y axis.
176+
Let's put this claim to the test. First, we calculate all the prime numbers in the range ![[101,100000]](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%5B101%2C100000%5D) and select 1 for every 100 primes in the list. Then, for all these primes we select the number of samples at random (limiting at 1% of each prime) and calculate the upper bound value for the error range following the formula ![\frac{m}{2 \times sample}](https://render.githubusercontent.com/render/math?math=%5Cdisplaystyle+%5Cfrac%7Bm%7D%7B2+%5Ctimes+sample%7D). Next, we run the LWE algorithm with the aforementioned parameters and plot the result. If our empirically found relation holds, then we shall see no point off the `1.0` value in the y axis.
177177

178178

179179
```python

0 commit comments

Comments
 (0)