🤖 AI Summary
This work investigates the computational complexity of algebraic attacks on the Learning With Errors (LWE) problem, focusing on Gröbner basis solvability of the Arora–Ge polynomial system. Methodologically, we first establish—rigorously and for the first time—that this system satisfies the generic coordinate condition introduced by Caminata–Gorla, thereby embedding it within a general algebraic framework. Second, we extend the Semaev–Tenti algorithm to arbitrary finite-regularity polynomial systems and, leveraging Castelnuovo–Mumford regularity and the Macaulay bound, derive the first precise subexponential upper bound on Gröbner basis computation complexity under the degree-reverse-lexicographic (DRL) monomial order—applicable to both generic and binary-secret/binary-error LWE instances. Finally, we propose a novel framework for incorporating side information (“hints”) into algebraic LWE modeling, enabling quantitative complexity assessment of attacks exploiting prior knowledge. These contributions provide both theoretical foundations and practical tools for algebraic security analysis of LWE.
📝 Abstract
Arora&Ge introduced a noise-free polynomial system to compute the secret of a Learning With Errors (LWE) instance via linearization. Albrecht et al. later utilized the Arora-Ge polynomial model to study the complexity of Gr""obner basis computations on LWE polynomial systems under the assumption of semi-regularity. In this paper we revisit the Arora-Ge polynomial and prove that it satisfies a genericity condition recently introduced by Caminata&Gorla, called being in generic coordinates. For polynomial systems in generic coordinates one can always estimate the complexity of DRL Gr""obner basis computations in terms of the Castelnuovo-Mumford regularity and henceforth also via the Macaulay bound. Moreover, we generalize the Gr""obner basis algorithm of Semaev&Tenti to arbitrary polynomial systems with a finite degree of regularity. In particular, existence of this algorithm yields another approach to estimate the complexity of DRL Gr""obner basis computations in terms of the degree of regularity. In practice, the degree of regularity of LWE polynomial systems is not known, though one can always estimate the lowest achievable degree of regularity. Consequently, from a designer's worst case perspective this approach yields sub-exponential complexity estimates for general, binary secret and binary error LWE. In recent works by Dachman-Soled et al. the hardness of LWE in the presence of side information was analyzed. Utilizing their framework we discuss how hints can be incorporated into LWE polynomial systems and how they affect the complexity of Gr""obner basis computations.