the weight of in another 4 2R(33) = 220 operations with Algorithm .

Table . shows the costs to determine the rst bit of the secret key, i.e., calling Algorithm with a random vector obtained by a passive attack in comparison to calling Algorithm rst and then Algorithm with its output. Note, that recovering successive bits is always cheaper.

4.5Thwarting the Attack: the Case of Vectors without False Rejections

To thwart the previous attacks without taking parameter sets with huge m or high false rejection rate, we could change the protocol so that the prover generates a vector of constant or bounded Hamming weight. In this section we will show that this leads to di erent attacks.

Assume that the prover accepts a protocol instance (a; b; z), in which an error vector was

m

=zi (t mod 2)

i=1

Using this equality, the adversary can ip two bits of z, i.e., she generates a random vector of Hamming weight . In other words, contains exactly two bits set to one, at position i and j, while all the other bits are set to . When the veri er accepts, the adversary deduces exactly

. :

and the prover does not generate error vectors with Hamming weight greater than t. is was suggested by Gilbert et al. for parameter set III.

Again, the attacker can replace the message z by z^ = z where is an m-bit vector of Hamming weight 2. In such scenario, authentication fails only when wt( ) 2 ft 1; tg and the attacker ipped two non-erroneous positions. When this event occurs, the attacker learns two error positions corresponding to the bits set to in , i.e.,

(aX bY )i = zi; i ≠ 0:

e success probability of this attack is related to the probability of getting a triplet with an error vector of Hamming weight equal to t 1 or t, and that the adversary picks a that has the e ect of ipping two correct positions. It can be computed as

Application to parameter vector III For the parameter vector III, the attacker learns two bits about the secret key every 1/q = 29:02 512 iterations. is is 16 times faster than an attack by Algorithm and needs only ℓ 2/q = 226 to recover a R -HB secret key (219 for HB ).

4.6Secure Parameters for Random-HB and HB

In this section, we investigate the lower bounds on the parameter sets for which our attack is not e ective. Before that, we need to clarify the notion of bit security in HB .

. ( ) - - -

m 2w

are insecure.

Computing the maximal w for which P (1w) is high, we have P (w) (u) so we expect to have a very small negative u and we can use the approximation P (w) φ(u)/u. Applying this reasoning to a very low P (w0), we obtain

R(w0) 4RoptP (w0)eu20

4Ropt φ(u0)eu20 ; u0

and we derive the complexity

e exponential terms only match when u = u0, leading to w = w0 which translates into

. -

Hence, any (m; ) satisfying this equation is insecure. Using this result, we can derive bounds for secure parameters for HB

–For = 1/8 and s = 80 we obtain m = 5 521 and t = 690. We conclude that any parameter with = 1/8, m 5 521, and t = m is insecure in the sense that there exists an attack with complexity within the order of magnitude of 280.

– Similarly, with = 1/4 and s = 80 we nd that m = 5 323 and so t = 1 331. Hence, when = 1/4 any parameter set with m 5 323 is insecure.

General applications require the false rejection rate to be very low, i.e., in the order of 2 s/2. is constraint induces a new equation for the parameters

On their own, these two equations are not su cient. Indeed, to satisfy both of tem, we could set a threshold t small enough such that false rejects are negligible and su ciently far from the expected value m such that the attack does not apply. However, we have also to take care of the most rudimental attack an adversary can perform: sending random vectors z. For this reason, we require the false acceptance rate, PFA to be smaller than 2 s, i.e.,

∑t (mi ) 2m s

i=0

. ( ) - - -