Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Quantum Oblivious LWE Sampling and Insecurity of Standard Model Lattice-Based SNARKs

Thomas Debris-Alazard, Pouria Fallahpour, Damien Stehlé

TL;DR

The paper demonstrates a polynomial-time quantum sampler for LWE instances that operates obliviously to the hidden secret, under the assumption that LWE is hard and under mild parameter constraints. By formulating the problem as generating a C$|$LWE state and measuring, and by improving the measurement via a CB98 POVM and phase-augmented amplitude functions, the authors achieve efficient sampling for a broad range of LWE parametrizations, including MLWE variants used in SNARKs. This yields a quantum attack on witness-oblivious sampling assumptions frequently used to analyze lattice-based SNARKs, thereby undermining certain security analyses in the standard-model lattice setting while not attacking the constructions themselves. The work also develops a detailed algorithm for constructing and using C$|$LWE states, derives runtime guarantees, and discusses implications for knapsack-LWE and encoding-based SNARK frameworks. Overall, it highlights a potential quantum vulnerability in hardness assumptions underpinning several SNARK security proofs, emphasizing the need to reassess such assumptions in post-quantum contexts.

Abstract

The Learning With Errors ($\mathsf{LWE}$) problem asks to find $\mathbf{s}$ from an input of the form $(\mathbf{A}, \mathbf{b} = \mathbf{A}\mathbf{s}+\mathbf{e}) \in (\mathbb{Z}/q\mathbb{Z})^{m \times n} \times (\mathbb{Z}/q\mathbb{Z})^{m}$, for a vector $\mathbf{e}$ that has small-magnitude entries. In this work, we do not focus on solving $\mathsf{LWE}$ but on the task of sampling instances. As these are extremely sparse in their range, it may seem plausible that the only way to proceed is to first create $\mathbf{s}$ and $\mathbf{e}$ and then set $\mathbf{b} = \mathbf{A}\mathbf{s}+\mathbf{e}$. In particular, such an instance sampler knows the solution. This raises the question whether it is possible to obliviously sample $(\mathbf{A}, \mathbf{A}\mathbf{s}+\mathbf{e})$, namely, without knowing the underlying $\mathbf{s}$. A variant of the assumption that oblivious $\mathsf{LWE}$ sampling is hard has been used in a series of works to analyze the security of candidate constructions of Succinct Non interactive Arguments of Knowledge (SNARKs). As the assumption is related to $\mathsf{LWE}$, these SNARKs have been conjectured to be secure in the presence of quantum adversaries. Our main result is a quantum polynomial-time algorithm that samples well-distributed $\mathsf{LWE}$ instances while provably not knowing the solution, under the assumption that $\mathsf{LWE}$ is hard. Moreover, the approach works for a vast range of $\mathsf{LWE}$ parametrizations, including those used in the above-mentioned SNARKs. This invalidates the assumptions used in their security analyses, although it does not yield attacks against the constructions themselves.

Quantum Oblivious LWE Sampling and Insecurity of Standard Model Lattice-Based SNARKs

TL;DR

The paper demonstrates a polynomial-time quantum sampler for LWE instances that operates obliviously to the hidden secret, under the assumption that LWE is hard and under mild parameter constraints. By formulating the problem as generating a CLWE state and measuring, and by improving the measurement via a CB98 POVM and phase-augmented amplitude functions, the authors achieve efficient sampling for a broad range of LWE parametrizations, including MLWE variants used in SNARKs. This yields a quantum attack on witness-oblivious sampling assumptions frequently used to analyze lattice-based SNARKs, thereby undermining certain security analyses in the standard-model lattice setting while not attacking the constructions themselves. The work also develops a detailed algorithm for constructing and using CLWE states, derives runtime guarantees, and discusses implications for knapsack-LWE and encoding-based SNARK frameworks. Overall, it highlights a potential quantum vulnerability in hardness assumptions underpinning several SNARK security proofs, emphasizing the need to reassess such assumptions in post-quantum contexts.

Abstract

The Learning With Errors () problem asks to find from an input of the form , for a vector that has small-magnitude entries. In this work, we do not focus on solving but on the task of sampling instances. As these are extremely sparse in their range, it may seem plausible that the only way to proceed is to first create and and then set . In particular, such an instance sampler knows the solution. This raises the question whether it is possible to obliviously sample , namely, without knowing the underlying . A variant of the assumption that oblivious sampling is hard has been used in a series of works to analyze the security of candidate constructions of Succinct Non interactive Arguments of Knowledge (SNARKs). As the assumption is related to , these SNARKs have been conjectured to be secure in the presence of quantum adversaries. Our main result is a quantum polynomial-time algorithm that samples well-distributed instances while provably not knowing the solution, under the assumption that is hard. Moreover, the approach works for a vast range of parametrizations, including those used in the above-mentioned SNARKs. This invalidates the assumptions used in their security analyses, although it does not yield attacks against the constructions themselves.
Paper Structure (35 sections, 35 theorems, 177 equations, 2 figures, 2 algorithms)

This paper contains 35 sections, 35 theorems, 177 equations, 2 figures, 2 algorithms.

Table of Contents

  1. Introduction
  2. Technical overview
  3. Defining oblivious sampling for quantum algorithms.
  4. Reducing oblivious $\mathsf{LWE}$ sampling to $\mathsf{C}\ket{\mathsf{LWE}}$.
  5. Measuring with increased success probability.
  6. How to implement the measurement in time polynomial in $\log q$
  7. Increasing the Fourier coefficients
  8. Application to standard model lattice-based SNARKs.
  9. Related works
  10. Preliminaries
  11. Quantum computations
  12. Gaussian distributions
  13. Learning With Errors
  14. Witness Obliviousness
  15. Classical Setting
  16. ...and 20 more sections

Key Result

Theorem 1

Let $m \geq n\geq 1$ and $q \geq 3$ be integers and $\sigma \geq 2$ be a real number. The parameters $m,n,q,\sigma$ are functions of the security parameter $\lambda$ with $m,\log q \leq \mathsf{poly}(\lambda)$ and $q$ prime. Assume that the parameters satisfy the following conditions: Then there exists a $\mathsf{poly}(\lambda)$-time quantum oblivious $\mathsf{LWE}_{m,n,q,\vartheta_{\sigma,q}}$ i

Figures (2)

  • Figure 1: The execution of the sampler.
  • Figure 2: The execution of the extractor between Steps $i$ and $i+1$ of the sampler.

Theorems & Definitions (81)

  • Theorem 1
  • Lemma 1
  • proof
  • Lemma 2: Adapted from Ban93
  • Lemma 3
  • proof
  • Definition 1: Folded Discrete Gaussian Distribution
  • Lemma 4
  • proof
  • Definition 2: $\mathsf{LWE}$
  • ...and 71 more