New Results of Breaking the CLS Scheme from ACM-CCS 2014

Abstract

At ACM-CCS 2014, Cheon, Lee and Seo introduced a particularly fast additively homomorphic encryption scheme (CLS scheme) based on a new number theoretic assumption, the co-Approximate Common Divisor (co-ACD) assumption. However, at Crypto 2015, Fouque et al. presented several lattice-based attacks that effectively devastated this scheme. They proved that a few known plaintexts are sufficient to break both the symmetric-key and the public-key variants, and they gave a heuristic lattice method for solving the search co-ACD problem.

In this paper, we mainly improve in terms of the number of samples, and propose a new key-retrieval attack. We first give an effective attack by Coppersmith’s method to break the co-ACD problem with $N=p_1\cdots p_n$ is known. If n is within a certain range, our work is theoretically valid for a wider range of parameters. When $n=2$, we can successfully solve it with only two samples, that is the smallest number of needed samples to the best of our knowledge. A known plaintext attack on the CLS scheme can be simply converted to solving the co-ACD problem with a known N, again requiring fewer samples than before to retrieve the private key. Finally, we show a ciphertext-only attack with a hybrid approach of direct lattice and Coppersmith’s method that can recover the key with a smaller number of ciphertexts and without any restriction on the plaintext size, but N is needed. All of our attacks are heuristic, but we have experimentally verified that these attacks work efficiently for the parameters proposed in the CLS scheme, which can be broken in seconds by experiments.

The work of this paper was supported in part by the National Natural Science Foundation of China (No.61732021).

A Calculation of \(w_N\) and \(w_X\)

First, we compute $w_X$:

$$\begin{aligned} \begin{aligned} w_X&=\sum \limits _{0\le s_1+\ldots +s_m\le t}\sum \limits _{k=1}^ms_k=\sum \limits _{0\le s_1+\ldots +s_m\le t}(s_1+\cdots +s_m)\\&=\sum \limits ^t_{l=0}\sum \limits _{s_1+\cdots +s_m=l}l=\sum \limits ^t_{l=0}l\left( {\begin{array}{c}m+l-1\\ m-1\end{array}}\right) \\&=m\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) .\\ \end{aligned} \end{aligned}$$

Since that $s_1, \cdots , s_m$ are identical in terms of value and weight, then$\sum _{0\le s_1+\ldots +s_m\le t}s_1=\cdots =\sum _{0\le s_1+\cdots +s_m\le t}s_m.$ This way, we can get

$$ \sum _{0\le s_1+\ldots +s_m\le t}s_i=\frac{1}{m}\sum \limits _{0\le s_1+\ldots +s_m\le t}\sum \limits _{k=1}^ms_k=\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) $$

Next, we compute $w_N=\sum \limits _{0\le s_1+\ldots +s_m\le t}(t-\sum \limits ^{n-1}_{j=1}\lfloor \frac{s_j}{n}\rfloor -\sum \limits ^m_{k=n}s_k)$. Clearly,

$$\sum \limits _{0\le s_1+\cdots +s_m\le t}t=t\sum \limits _{0\le s_1+\cdots +s_m\le t}1=t\left( {\begin{array}{c}m+t\\ m\end{array}}\right) .$$

Denote $\lfloor \frac{s_j}{n}\rfloor =\frac{s_j}{n}-\delta _j$ where $0 \le \delta _j <1$, then

$$\begin{aligned} \begin{aligned} -\sum \limits _{0\le s_1+\ldots +s_m\le t}\sum ^{n-1}_{j=1}\lfloor \frac{s_j}{n}\rfloor&=\sum \limits _{0\le s_1+\ldots +s_m\le t}\left( -\frac{s_1+\cdots +s_{n-1}}{n}+\delta _1+\cdots +\delta _{n-1}\right) \\&=-\frac{n-1}{n}\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) +\sum \limits _{0\le s_1+\ldots +s_m\le t}(\delta _1+\cdots +\delta _{n-1})\\&<-\frac{n-1}{n}\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) +(n-1)\left( {\begin{array}{c}m+t\\ m\end{array}}\right) .\\ \end{aligned} \end{aligned}$$

Moreover,

$$ -\sum _{0\le s_1+\ldots +s_m\le t}\sum \limits ^m_{k=n}s_k=-(m-n+1)\sum _{0\le s_1+\ldots +s_m\le t}s_k=-(m-n+1)\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) . $$

Summarizing the above analysis, we find

$$\begin{aligned} \begin{aligned} w_N&<t\left( {\begin{array}{c}m+t\\ m\end{array}}\right) -\frac{n-1}{n}\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) +(n-1)\left( {\begin{array}{c}m+t\\ m\end{array}}\right) -(m-n+1)\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) \\&=\frac{-mn-2n+n^2+1}{n}\left( {\begin{array}{c}m+t\\ m+1\end{array}}\right) +(t+n-1)\left( {\begin{array}{c}m+t\\ m\end{array}}\right) .\\ \end{aligned} \end{aligned}$$