Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Lattice Codes for CRYSTALS-Kyber

Shuiyin Liu, Amin Sakzad

TL;DR

The paper tackles Kyber's high ciphertext expansion and nontrivial decryption-failure risk by modeling the decoding noise as bounded by a hypersphere and replacing the original integer-lattice encoder with denser lattice codes such as Barnes–Wall BW16 and Leech24, all in a constant-time implementation. It develops a two-pronged approach: first, a CLT-based analysis bounds Kyber decoding noise and motivates sphere packing in a hypercube; second, a lattice-encoded scheme with hypercube shaping achieves lower CER and DFR, including a BICM extension with BCH codes that further reduce both metrics while preserving security. Key contributions include explicit variance expressions for the decoding noise, constant-time lattice encoding/decoding, and substantial CER and DFR reductions up to 32.6% and 2^{85} respectively, with additional gains under fixed plaintext when using BICM. The practical impact is improved efficiency and security for post-quantum key exchange using Kyber, enabling smaller ciphertexts and more reliable key establishment on resource-constrained devices.

Abstract

This paper describes a constant-time lattice encoder for the National Institute of Standards and Technology (NIST) recommended post-quantum encryption algorithm: Kyber. The first main contribution of this paper is to refine the analysis of Kyber decoding noise and prove that Kyber decoding noise can be bounded by a sphere. This result shows that the Kyber encoding problem is essentially a sphere packing in a hypercube. The original Kyber encoder uses the integer lattice for sphere packing purposes, which is far from optimal. Our second main contribution is to construct optimal lattice codes to ensure denser packing and a lower decryption failure rate (DFR). Given the same ciphertext size as the original Kyber, the proposed lattice encoder enjoys a larger decoding radius, and is able to encode much more information bits. This way we achieve a decrease of the communication cost by up to 32.6%, and a reduction of the DFR by a factor of up to 2^{85}. Given the same plaintext size as the original Kyber, e.g., 256 bits, we propose a bit-interleaved coded modulation (BICM) approach, which combines a BCH code and the proposed lattice encoder. The proposed BICM scheme significantly reduces the DFR of Kyber, thus enabling further compression of the ciphertext. Compared with the original Kyber encoder, the communication cost is reduced by 24.49%, while the DFR is decreased by a factor of 2^{39}. The proposed encoding scheme is a constant-time algorithm, thus resistant against the timing side-channel attacks.

Lattice Codes for CRYSTALS-Kyber

TL;DR

The paper tackles Kyber's high ciphertext expansion and nontrivial decryption-failure risk by modeling the decoding noise as bounded by a hypersphere and replacing the original integer-lattice encoder with denser lattice codes such as Barnes–Wall BW16 and Leech24, all in a constant-time implementation. It develops a two-pronged approach: first, a CLT-based analysis bounds Kyber decoding noise and motivates sphere packing in a hypercube; second, a lattice-encoded scheme with hypercube shaping achieves lower CER and DFR, including a BICM extension with BCH codes that further reduce both metrics while preserving security. Key contributions include explicit variance expressions for the decoding noise, constant-time lattice encoding/decoding, and substantial CER and DFR reductions up to 32.6% and 2^{85} respectively, with additional gains under fixed plaintext when using BICM. The practical impact is improved efficiency and security for post-quantum key exchange using Kyber, enabling smaller ciphertexts and more reliable key establishment on resource-constrained devices.

Abstract

This paper describes a constant-time lattice encoder for the National Institute of Standards and Technology (NIST) recommended post-quantum encryption algorithm: Kyber. The first main contribution of this paper is to refine the analysis of Kyber decoding noise and prove that Kyber decoding noise can be bounded by a sphere. This result shows that the Kyber encoding problem is essentially a sphere packing in a hypercube. The original Kyber encoder uses the integer lattice for sphere packing purposes, which is far from optimal. Our second main contribution is to construct optimal lattice codes to ensure denser packing and a lower decryption failure rate (DFR). Given the same ciphertext size as the original Kyber, the proposed lattice encoder enjoys a larger decoding radius, and is able to encode much more information bits. This way we achieve a decrease of the communication cost by up to 32.6%, and a reduction of the DFR by a factor of up to 2^{85}. Given the same plaintext size as the original Kyber, e.g., 256 bits, we propose a bit-interleaved coded modulation (BICM) approach, which combines a BCH code and the proposed lattice encoder. The proposed BICM scheme significantly reduces the DFR of Kyber, thus enabling further compression of the ciphertext. Compared with the original Kyber encoder, the communication cost is reduced by 24.49%, while the DFR is decreased by a factor of 2^{39}. The proposed encoding scheme is a constant-time algorithm, thus resistant against the timing side-channel attacks.
Paper Structure (19 sections, 3 theorems, 49 equations, 3 figures, 4 tables, 7 algorithms)

This paper contains 19 sections, 3 theorems, 49 equations, 3 figures, 4 tables, 7 algorithms.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Notation
  4. Kyber: Key Generation, Encryption, and Decryption
  5. Kyber Decoding Noise
  6. Decryption Failure Rate and Ciphertext Expansion Rate
  7. The Analysis on Kyber Decoding Noise
  8. The Distribution of TEXT
  9. Tail Bound, DFR, and Sphere Packing
  10. Lattice Codes for Kyber
  11. Lattice Codes, Hypercube Shaping, and CVP Decoding
  12. Lattice Encoder and Decoder for Kyber
  13. CER and DFR Reduction
  14. Decoding Complexity, Security, and Observation
  15. Reducing CER and DFR with a Fixed Plaintext Size
  16. ...and 4 more sections

Key Result

Lemma 1

Suppose that $Z\leftarrow \beta_{\eta }$ and $Z^{\prime }\leftarrow \beta_{\eta ^{\prime }}$ are independent, then the polynomial product $ZZ^{\prime }$ (modulo $X^{n}+1$) asymptotically approaches a multivariate normal distribution for large $n$, i.e.,

Figures (3)

  • Figure 1: KYBER 768: Comparing the distribution of $n_{e,1}$ to the normal distribution with $100,000$ samples.
  • Figure 2: Uncompressed KYBER 768: Comparing the distribution of $\hat{n}_{e,1}$ to the normal distribution with $100,000$ samples.
  • Figure 3: Block diagram of the proposed bit-interleaved coded modulation.

Theorems & Definitions (21)

  • Lemma 1
  • proof
  • Remark 1
  • Theorem 1
  • proof
  • Remark 2
  • Lemma 2
  • proof
  • Remark 3
  • Definition 1: Lattice
  • ...and 11 more