Efficient module learning with errors‐based post‐quantum password‐authenticated key exchange

IET Information SecurityVolume 17, Issue 1 p. 3-17 ORIGINAL RESEARCHOpen Access Efficient module learning with errors-based post-quantum password-authenticated key exchange Peixin Ren, Peixin Ren orcid.org/0000-0002-3924-2141 Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this authorXiaozhuo Gu, Corresponding Author Xiaozhuo Gu [email protected] Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China Correspondence Xiaozhuo Gu, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China. Email: [email protected]Search for more papers by this authorZiliang Wang, Ziliang Wang JD.com, Inc, Shenzhen, ChinaSearch for more papers by this author Peixin Ren, Peixin Ren orcid.org/0000-0002-3924-2141 Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this authorXiaozhuo Gu, Corresponding Author Xiaozhuo Gu [email protected] Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China Correspondence Xiaozhuo Gu, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China. Email: [email protected]Search for more papers by this authorZiliang Wang, Ziliang Wang JD.com, Inc, Shenzhen, ChinaSearch for more papers by this author First published: 20 September 2022 https://doi.org/10.1049/ise2.12094 A preliminary version of this manuscript appeared at the 24th International Conference on Information Security and Cryptology (ICISC 2021). This is an extended version that provides a more detailed security proof, adds the discussion of the methodology for security estimation against classical and quantum attacks, and analyses the performance of standalone cryptographic operations used in the concrete implementation. AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Password-authenticated key exchange (PAKE) is a cryptographic primitive that can establish secure remote communications between the client and the server, especially with the advantage of amplifying memorable passwords into strong session keys. However, the arrival of the quantum computing era has brought new challenges to traditional PAKE protocols. Thus, designing an efficient post-quantum PAKE scheme becomes an open research question. In this paper, the authors construct a quantum-safe PAKE protocol, which is a horizontal extension of the password-authenticated key (PAK) protocol in the field of module lattices. Subsequently, the authors accompany the proposed protocol with a rigorous security proof in the random oracle model with two adaptions: applying the CDF-Zipf model to characterise the ability of the adversary and using the pairing with errors assumption to simplify the proof. Taking the flexibility of the module learning with errors (MLWE) problem, the authors elaborately select three parameter sets to meet different application scenarios. Specifically, the authors' Recommended-PAKE implementation achieves 177-bit post-quantum security with a generous margin to cope with later improvement in cryptanalysis. The performance results indicate that the authors' MLWE-PAKE is quite practical: compared with the latest Yang-PAK, the authors' Recommended-PAK reduces the communication cost and the running time by 36.8% and 13.8%, respectively. 1 INTRODUCTION Passwords have several advantages, such as being human-memorable, avoiding expensive computation of public key infrastructure to distribute client certificates, and preventing dedicated hardware for storing secret keys. Thus, passwords constitute the prevalent and irreplaceable authentication approach to identify human users [1, 2], especially in the proliferation of mobile devices. PAKE is an important cryptographic primitive that enables two parties (e.g. a client and a server) to utilise a simple password to negotiate a high-entropy session key in an insecure network. In 1992, Bellovin and Merritt [3] proposed a symmetric-PAKE protocol, encrypted key exchange, where two parties hold the same password and establish a shared session-key at the end. However, symmetric-PAKE protocols [4-6] only focus on the part of password-using and omit how to constrain the impact of password leakage. In reality, asymmetric-PAKE protocols [7] are widely deployed and standardised in the domain of existing client-to-server Internet or IoT. In asymmetric-PAKE schemes, the server only gets the knowledge of the hashed password with a random salt, not the actual password. In this case, even if the server is compromised, the adversary cannot obtain the password directly. Therefore, many asymmetric-PAKE protocols have been proposed and analysed, such as Refs. [8-11]. However, the security of these protocols depends on traditional number-theoretic problems (the integer factorisation problem, the discrete logarithm problem etc.) that are vulnerable to quantum attacks [12, 13]. With the advent of quantum computing, standards bodies and academia [14, 15] have triggered widespread interest in cryptographic algorithms that are believed to resist quantum computers. According to Ref. [14], lattice is one of the most promising and ideal competitive primitives for the construction of post-quantum schemes. However, the majority of lattice-based schemes focus on key exchange without authentication [16-18] and key encapsulation mechanisms [19, 20]. In 2017, Ding et al. [21] constructed a post-quantum asymmetric-PAKE protocol from ideal lattices and proved its security in the Bellare–Pointcheval–Rogaway (BPR) model. The primary problem is that this protocol emphasises the theoretical feasibility at the expense of efficient implementation in practice. Subsequently, following the work of Ref. [21], many studies [22-24] proposed or implemented quantum-safe PAKE protocols. More specifically, Gao et al. [22] utilised the NFLlib library to accelerate the optimisation of Ding's scheme [21] and gave a parameter set suitable for the use of the number theoretic transform (NTT) algorithm (for speeding up polynomial multiplication), but the proposed parameter set does not consider the communication burden. Yang et al. [24] further optimised Ding's solution but only provided one lightweight parameter set without considering multiple security requirements. Moreover, Liu et al. [23] presented a three-party ring learning with errors (RLWE)-based PAKE protocol, where two clients aim to agree on a session key with the help of a trusted server. As a compromise between learning with errors (LWE) and RLWE, module learning with errors (MLWE) [25] retains the matrix format and concurrently introduces the ring polynomials. Therefore, when designing a lattice-based scheme in multiple security scenarios, MLWE is more flexible and straightforward than other primitives [19]. Given the above, we try to solve the following question: Is it possible to construct an efficient and lightweight MLWE-based asymmetric PAKE protocol while resisting quantum computer attacks? Contributions In this work, we answer the above question in the affirmative. We construct a three-flow asymmetric PAKE protocol, which is a parallel extension of the class of Random Oracle Model (ROM)-based password-authenticated key protocol [26] but in the module lattice setting. We prove its security under the BPR model and implement three deployment schemes that are tailored to different security requirements of the potential applications. To construct the protocol efficiently, the majority of lattice-based schemes [16, 21, 22, 24] are based on the RLWE problem. However, in the light of our observation, the MLWE problem [25] with the advantage of a compromise between LWE and RLWE is more suitable for the construction of practical PAKEs. Using the feature of MLWE, by superimposing or reducing the number of ring polynomials, different deployment schemes can be realised. As a result, we propose a practical MLWE-based PAKE protocol in the random oracle model. By constructing the PAKE as a self-contained system, we demonstrate that our protocol is directly dependent on the hardness of MLWE and pairing with errors (PWE), which can be reduced to MLWE. The security of our proposed protocol is proved under the BPR model [4] with two adaptions: first, to simplify the proof, we introduce the PWE assumption; second, we use the CDF-Zipf model [27] to characterise the ability of the adversary to conduct an online dictionary attack. Finally, we establish a complete security proof of the protocol, reduce its security to online dictionary attacks, and demonstrate that it satisfies forward security. In terms of concrete implementation, we comprehensively consider indicators such as failure rate, post-quantum security, communication cost, and computational efficiency and select three high-quality parameter sets. To evaluate the performance of our proposals, we summarise the key technologies and the security level of state-of-the-art lattice-based PAKE schemes and our schemes, and compare the running time, the communication cost and the failure rate of these schemes. Particularly, our Recommended-PAK offers 177-bit post-quantum security with a generous margin to cope with later improvement in cryptanalysis. Compared with the latest RLWE-based Yang-PAK, the communication cost and the running time are reduced by 36.8% and 13.8%, respectively. Finally, in conjunction with the performance results, we discuss potential real-world applications for our MLWE-PAKE protocol: resource-constrained IoT devices and classical/post-quantum Transport Layer Security (TLS) etc. 2 PRELIMINARIES In this section, we provide both the notations of the parameters used in our construction and the description of some basic knowledge. Notations If A $\mathsf{A}$ is a probabilistic algorithm, a ← A ( b ) $a{\leftarrow}\mathsf{A}(b)$ represents the output of A $\mathsf{A}$ assigned to a. If χ is a probability distribution, a ← χ denotes sampling a following χ. We represent sampling a uniformly at random from a set S as a ← S. We denote R q = Z q [ X ] / X n + 1 ${R}_{q}={\mathbb{Z}}_{q}[X]/\left({X}^{n}+1\right)$ as the ring of integer polynomial modulo (Xn + 1) where each coefficient is reduced by modulus q. We define a centred binomial distribution with parameter η ∈ Z + $\eta \in {\mathbb{Z}}_{+}$ as βη. Throughout this paper, a normal font letter such as p represents a ring element in Rq. For the vector v including d elements, we denote it as v ∈ R q d $\mathbf{v}\in {R}_{q}^{d}$ using the bold lower-case letter; for the matrix A consisting of m × n entities, we denote it as A ∈ R q m × n $\mathbf{A}\in {R}_{q}^{m\times n}$ using the bold upper-case letter. By default, all vectors are column vectors. For a vector v (or a matrix A), vT (or AT) is used as its transpose. The decision module-LWE problem As a compromise between the LWE problem and the RLWE problem, the MLWE problem retains the matrix format and concurrently introduces the algebraic structure. Therefore, when designing a lattice-based scheme in multiple security scenarios, it is more flexible and simple than LWE and RLWE. Here, we define the decision version of the MLWE problem as follows. Definition 1.(The decision M L W E n , d , q , χ ${\mathsf{M}\mathsf{L}\mathsf{W}\mathsf{E}}_{n,d,q,\chi }$ problem). Let n, d1, d2 and q ≥ 2 be the degree of a polynomial, the dimension of an error vector, the dimension of a secret vector, and the modulus, respectively. Let χ be an error distribution and s ← χ d 2 $\mathbf{s}{\leftarrow}{\chi }^{{d}_{2}}$ . Define Oχ,s as the oracle which does the following: Sample A ← R q d 1 × d 2 $\mathbf{A}{\leftarrow}{R}_{q}^{{d}_{1}\times {d}_{2}}$ , e ← χ d 1 $\mathbf{e}{\leftarrow}{\chi }^{{d}_{1}}$ ; Return ( A , A s + e ) ∈ R q d 1 × d 2 × R q d 1 $(\mathbf{A},\mathbf{A}\mathbf{s}+\mathbf{e})\in {R}_{q}^{{d}_{1}\times {d}_{2}}\times {R}_{q}^{{d}_{1}}$ . The decision MLWE problem for n, m, d, q, χ is to distinguish between polynomial independent samples from Oχ,s and the same number of independent samples from an oracle U $\mathcal{U}$ that returns uniform random samples from R q d 1 × d 2 , R q d 1 $\left({R}_{q}^{{d}_{1}\times {d}_{2}},{R}_{q}^{{d}_{1}}\right)$ . Remark 1.We use the MLWE problem twice to construct the PAKE protocol. In the first phase, Alice computes (A, y1 = As1 + e1) ∈ R q d 1 × d 2 , R q d 1 $\left({R}_{q}^{{d}_{1}\times {d}_{2}},{R}_{q}^{{d}_{1}}\right)$ . Then, Bob needs to utilise y 1 ∈ R q d 1 ${\mathbf{y}}_{1}\in {R}_{q}^{{d}_{1}}$ and his secret s 2 ∈ R q d 2 ${\mathbf{s}}_{2}\in {R}_{q}^{{d}_{2}}$ to compute the approximate polynomial σ s = y 1 T s ${\sigma }_{s}={\mathbf{y}}_{1}^{T}\mathbf{s}$ . Notably, the prerequisite for Bob to complete the calculation of σs is d1 = d2 = d. Therefore, we replace d1 and d2 with d in subsequent description. Remark 2.The secret s is chosen from the error distribution instead of the uniform distribution since the literature [25] has shown that this problem is as hard as the one in which s is chosen uniformly at random. Bellare–Pointcheval–Rogaway security model Here we review the BPR model [4] that will be used in our security analysis. 2.3.1 Participants, passwords, and execution of the protocol A client is denoted as C ∈ C $C\in \mathcal{C}$ and a server is denoted as S ∈ S $S\in \mathcal{S}$ . Each client C holds a password pwc, which is independently sampled from the password space D $\mathcal{D}$ in accordance with Zipf's law [28], and each server S holds correlated hash value H(pwc). Moreover, in this model, each participant enables to execute the protocol with different partners multiple times. Thus, we denote instance i of participants U ∈ U = C ∪ S $U\in \mathcal{U}=C\cup S$ as Π U i ${{\Pi }}_{U}^{i}$ . Each Π U i ${{\Pi }}_{U}^{i}$ can be used only once. 2.3.2 Adversarial model We assume that an adversary A $\mathcal{A}$ completely controls the network and provides the input to the instance of principals. Formally, as a probabilistic algorithm with a distinguished query tape, A $\mathcal{A}$ launches attacks utilising random queries in the real world. Thus, we summarise the allowed queries defined in Ref. [4] here. Execute(C, i, S, j): causes protocol P $\mathsf{P}$ between Π C i ${{\Pi }}_{C}^{i}$ and Π S j ${{\Pi }}_{S}^{j}$ to be executed and outputs the transcript to A $\mathcal{A}$ . Send(U, i, M): causes message M to be sent to instance Π U i ${{\Pi }}_{U}^{i}$ . Π U i ${{\Pi }}_{U}^{i}$ computes what the protocol says, and sends it back to A $\mathcal{A}$ . Reveal(U, i): If the instance Π U i ${{\Pi }}_{U}^{i}$ has accepted and holds its session key sk, this query outputs sk to the adversary A $\mathcal{A}$ . Test(U, i): A coin b possessed by Π U i ${{\Pi }}_{U}^{i}$ is tossed, and then the following happens. If b = 0, Π U i ${{\Pi }}_{U}^{i}$ returns sk to A $\mathcal{A}$ ; otherwise, it returns a random string drawing from the space of session keys. Corrupt(U): If U ∈ Client, pwc is output; otherwise, H(pwc) is output. Definition 2.(Partnering). An instance Π C i ${{\Pi }}_{C}^{i}$ holding (pid, sid, sk) and an instance Π S j ${{\Pi }}_{S}^{j}$ holding (pid′, sid′, sk′) are partnered, if pid = S, pid′ = C, sid = sid′, sk = sk′, where pid, sid and sk denote the partner-id, the session-id and the session-key, respectively. In addition, no other instance accepts with its session-id equal to sid. Definition 3.(Freshness with forward secrecy). An instance Π U i ${{\Pi }}_{U}^{i}$ is fresh-fs if none of the events listed below occur: (1) a Reveal(U, i) query occurs, (2) a Reveal(U′, j) query occurs, where Π U ′ j ${{\Pi }}_{{U}^{\prime }}^{j}$ is Π U i ${{\Pi }}_{U}^{i}$ 's partner, or (3) a Corrupt(U′) query occurs before the Test(U, i) query and the Send(U, i, M) query. 2.3.3 Advantage of the adversary We now define the advantage of the adversary against the authenticated key exchange (AKE) protocol P. Let Succ P ake ( A ) ${\text{Succ}}_{\mathsf{P}}^{\mathit{ake}}(\mathcal{A})$ be the event that the adversary A $\mathcal{A}$ makes a Test(U, i) query to some fresh instances Π U i ${{\Pi }}_{U}^{i}$ and outputs a single bit b′, where b′ = b for the bit b which was chosen in the Test query. The advantage of A $\mathcal{A}$ is defined as follows Adv P ake ( A ) = 2 Pr Succ P ake ( A ) − 1 . ${\text{Adv}}_{\mathsf{P}}^{\mathit{ake}}(\mathcal{A})=2\mathrm{Pr}\left[{\text{Succ}}_{\mathsf{P}}^{\mathit{ake}}(\mathcal{A})\right]-1.$ Furthermore, if we have two protocols P and P′ which satisfy the following relationship Pr Succ P ake ( A ) = Pr Succ P ′ ake ( A ) + ϵ , $\mathrm{Pr}\left[{\text{Succ}}_{\mathsf{P}}^{\mathit{ake}}(\mathcal{A})\right]=\mathrm{Pr}\left[{\text{Succ}}_{{\mathsf{P}}^{\prime }}^{\mathit{ake}}(\mathcal{A})\right]+{\epsilon},$ then we have the fact that Adv P ake ( A ) = Adv P ′ ake ( A ) + 2 ϵ . ${\text{Adv}}_{\mathsf{P}}^{\mathit{ake}}(\mathcal{A})={\text{Adv}}_{{\mathsf{P}}^{\prime }}^{\mathit{ake}}(\mathcal{A})+2{\epsilon}.$ Error reconciliation mechanism In Ref. [29], Jin and Zhao formally formulated a universal and convenient error reconciliation mechanism referred to as optimally-balanced key consensus with noise (OKCN). The inherent upper-bound analysed in Jin's paper guides the parameter selection and balances between the accuracy and the bandwidth. Especially, OKCN is more suitable for incorporating into the existing Diffie-Hellman (DH)-based protocols such as TLS and Internet Key Exchange. Thus, it shows more advantages in choosing OKCN as the error reconciliation mechanism of our scheme. Before showing the description of the OKCN algorithm, we first give a function |a − b|q to represent the distance between two elements a , b ∈ Z q $a,b\in {\mathbb{Z}}_{q}$ . | a − b | q = min { ( a − b ) mod q , ( b − a ) mod q } . $\vert a-b{\vert }_{q}=\mathrm{min}\left\{(a-b)\,\mathrm{mod}\,\,q,(b-a)\,\mathrm{mod}\,\,q\right\}.$ Moreover, for two approximate polynomials w = ∑ i = 0 n − 1 w i X i , v = ∑ i = 0 n − 1 v i X i $w={\sum }_{i=0}^{n-1}{w}_{i}{X}^{i},v={\sum }_{i=0}^{n-1}{v}_{i}{X}^{i}$ , we define the distance between them as | w − v | q = max | w 1 − v 1 | q , | w 2 − v 2 | q , … , | w n − 1 − v n − 1 | q . $\vert w-v{\vert }_{q}=\mathrm{max}\left\{\vert {w}_{1}-{v}_{1}{\vert }_{q},\vert {w}_{2}-{v}_{2}{\vert }_{q},\text{\ldots },\vert {w}_{n-1}-{v}_{n-1}{\vert }_{q}\right\}.$ Algorithm 1. OKCN: Optimally-balanced key consensus with noise p a r a m s = ( q , m , g , l , a u x ) , a u x = q ′ = lcm ( q , m ) , α = q ′ / q , β = q ′ / m $\mathsf{p}\mathsf{a}\mathsf{r}\mathsf{a}\mathsf{m}\mathsf{s}=(q,m,g,l,aux),aux=\left\{{q}^{\prime }=\mathrm{lcm}(q,m),\alpha ={q}^{\prime }/q,\beta ={q}^{\prime }/m\right\}$ procedure Con ( σ s , p a r a m s ${\sigma }_{s},\mathsf{p}\mathsf{a}\mathsf{r}\mathsf{a}\mathsf{m}\mathsf{s}$ ) ▹ σs ∈ [0, q − 1] e ← [−⌊(α − 1)/2⌋, ⌊α/2]⌋ σA = (ασs + e) mod q′ k s = ⌊ σ A / β ⌋ ∈ Z m ${k}_{s}=\lfloor {\sigma }_{A}/\beta \rfloor \in {\mathbb{Z}}_{m}$ v′ = σA mod β v = ⌊v′g/β⌋ return (ks, v) end procedure procedure Rec ( σ c , v , p a r a m s ${\sigma }_{c},v,\mathsf{p}\mathsf{a}\mathsf{r}\mathsf{a}\mathsf{m}\mathsf{s}$ ) ▹ σc ∈ [0, q − 1] kc = ⌊ασc/β − (v + 1/2)/g⌉ mod m return kc end procedure Algorithm 1 describes the calculation process of the conciliate function C o n $\mathsf{C}\mathsf{o}\mathsf{n}$ and the reconcile function R e c $\mathsf{R}\mathsf{e}\mathsf{c}$ . The error reconciliation can be extended to Rq by applying OKCN to each coefficient of the ring. For any ring polynomial σ = {σ0, …, σn−1} ∈ Rq, we set C o n ( σ ) = C o n σ 0 , … , C o n σ n − 1 $\mathsf{C}\mathsf{o}\mathsf{n}(\sigma )=\left\{\mathsf{C}\mathsf{o}\mathsf{n}\left({\sigma }_{0}\right),\text{\ldots },\mathsf{C}\mathsf{o}\mathsf{n}\left({\sigma }_{n-1}\right)\right\}$ . Rec function does the same way. Definition 4.(Correctness of OKCN [29]). The OKCN mechanism is correct, if the system parameters p a r a m s = ( q , m , g , l , a u x ) $\mathsf{p}\mathsf{a}\mathsf{r}\mathsf{a}\mathsf{m}\mathsf{s}=(q,m,g,l,aux)$ satisfy ( 2 l + 1 ) m < q 1 − 1 g $(2l+1)m< q\left(1-\frac{1}{g}\right)$ where q is the modulus, m is the length of each negotiated value, g is the length of the hint signal, and l represents the distance between two approximate value σc and σs in Z q ${\mathbb{Z}}_{q}$ . Definition 5.(Security of OKCN [29]). The OKCN mechanism is secure when σ s ← Z q ${\sigma }_{s}{\leftarrow}{\mathbb{Z}}_{q}$ , ks and v are independent, and ks is uniform over Z m ${\mathbb{Z}}_{m}$ , where the probability is taken over the sampling of σs and the random coins used by C o n $\mathsf{C}\mathsf{o}\mathsf{n}$ . 3 MLWE-BASED PWE ASSUMPTION & SECURITY REDUCTION To expediently prove the security of our construction, we propose PWE assumption with the different versions of the MLWE problem. This assumption with the version of the RLWE problem first appeared in the literature [21] so as to provide the security proof of its RLWE-PAKE. Definition 6.(Pairing with Errors). We define a probabilistic, polynomial-time adversary A $\mathcal{A}$ taking (A, x, y, v) as its input, where A ← R q d × d $\mathbf{A}{\leftarrow}{R}_{q}^{d\times d}$ , x ← R q d $\mathbf{x}{\leftarrow}{R}_{q}^{d}$ , s , e ← β η d $\mathbf{s},\mathbf{e}{\leftarrow}{\beta }_{\eta }^{d}$ , eσ ← βη, y = ATs + e, ( v , k ) = C o n x T s + e σ $(v,k)=\mathsf{C}\mathsf{o}\mathsf{n}\left({\mathbf{x}}^{T}\mathbf{s}+{e}_{\sigma }\right)$ . The goal of A $\mathcal{A}$ is to obtain the value of string k from its output. Therefore, we define the advantage of A $\mathcal{A}$ as follows: Adv R q d PWE ( A ) = Pr [ k ∈ A ( A , x , y , v ) ] . ${\text{Adv}}_{{R}_{q}^{d}}^{\textit{\textsf{PWE}}}(\mathcal{A})=\mathrm{Pr}[k\in \mathcal{A}(\mathbf{A},\mathbf{x},\mathbf{y},v)].$ Let Adv R q d PWE ( t , N ) = max A Adv R q d PWE ( A ) ${\text{Adv}}_{{R}_{q}^{d}}^{\textit{\textsf{PWE}}}(t,N)={\mathrm{max}}_{\mathcal{A}}\left\{{\text{Adv}}_{{R}_{q}^{d}}^{\textit{\textsf{PWE}}}(\mathcal{A})\right\}$ , where the maximum is taken over all adversaries in running time t that output a list containing at most N elements of { 0 , 1 } k ${\left\{0,1\right\}}^{\mathsf{k}}$ . The PWE assumption states that Adv R q d PWE ( t , N ) ${\text{Adv}}_{{R}_{q}^{d}}^{\textit{\textsf{PWE}}}(t,N)$ is negligible for t and N, which are polynomial in security parameter λ. Now, we describe a reduction from the PWE assumption to the decision MLWE problem. We consider the following sequence of reductions: PWE → DPWE → Lemma 1 MLWE - DH → Lemma 2 D - MLWE $\text{PWE}\stackrel{\quad \quad }{\to }\text{DPWE}\stackrel{\text{Lemma}\,1}{\to }\text{MLWE}\mbox{-}\text{DH}\stackrel{\text{Lemma}\,2}{\to }\mathrm{D}\mbox{-}\text{MLWE}$ The decision version of the PWE problem can be defined as follows. Obviously, if decision pairing with errors (DPWE) is hard so is PWE. Definition 7.(DPWE). Given ( A , x , y , v , k ) ∈ R q d × d × R q d × R q d × { 0 , 1 } n × { 0 , 1 } k $(\mathbf{A},\mathbf{x},\mathbf{y},v,k)\in {R}_{q}^{d\times d}\times {R}_{q}^{d}\times {R}_{q}^{d}\times {\left\{0,1\right\}}^{n}\times {\left\{0,1\right\}}^{\mathsf{k}}$ where ( v , k ) = C o n ( σ ) $\,(v,k)=\mathsf{C}\mathsf{o}\mathsf{n}(\sigma )$ for some σ ∈ Rq. The DPWE problem is to decide whether σ = xTs + eσ and y = ATs + e for some s , e ← β η d , e σ ← β η $\mathbf{s},\mathbf{e}{\leftarrow}{\beta }_{\eta }^{d},{e}_{\sigma }{\leftarrow}{\beta }_{\eta }$ , or (σ, y) is uniformly random in R q × R q d ${R}_{q}\times {R}_{q}^{d}$ . Definition 8.(MLWE-DH). Given (A, x, y, σ), where (A, x) is uniformly random in R q d × d × R q d ${R}_{q}^{d\times d}\times {R}_{q}^{d}$ , the MLWE-DH problem is to figure out whether σ = xTs + eσ and y = ATs + e for some eσ ← βη and e ← β η d $\mathbf{e}{\leftarrow}{\beta }_{\eta }^{d}$ , or (σ, y) is uniformly random in R q × R q d × d ${R}_{q}\times {R}_{q}^{d\times d}$ . Lemma 1.The DPWE problem is hard if the MLWE-DH problem is hard.Proof: Suppose that the MLWE-DH problem is hard to solve, and there exists a polynomial-time algorithm D that can solve the DPWE problem with non-negligible probability. Using algorithm D as a subroutine call, we build a distinguisher D′ to solve the MLWE-DH problem. Input (A, x, y, σ) Compute ( v , k ) = C o n ( σ ) $(v,k)=\mathsf{C}\mathsf{o}\mathsf{n}(\sigma )$ Call D to solve DPWE problem using the input (A, x, y, v, k) If D outputs 1 then D′ outputs 1, and it means that σ = xTs + eσ and y = ATs + e; otherwise, (σ, y) is uniformly random in R q × R q d ${R}_{q}\times {R}_{q}^{d}$ . Since D solves the DPWE problem with a non-negligible advantage, D′ solves the MLWE-DH problem with a non-negligible advantage as well, which contradicts the hardness assumption of the MLWE-DH problem. □ Lemma 2.If the D-MLWE problem is hard, the MLWE-DH problem is hard as well.Proof: Suppose that there exists a probabilistic polynomial-time algorithm D that can solve the MLWE-DH problem with non-negligible advantage. Given two samples of an MLWE challenge (A1, b1) and (a2, b2), both share the same s ← β η d $\mathbf{s}{\leftarrow}{\beta }_{\eta }^{d}$ . We call algorithm D to build a distinguisher D′ to solve the MLWE problem as follows: Set (A, x, y, σ) = (A1, a2, b1, b2) Input (A, x, y, σ) to D If D outputs 1, then D′ outputs 1 in which D′ determines b 2 = a 2 T s + e σ ${b}_{2}={\mathbf{a}}_{2}^{T}\mathbf{s}+{e}_{\sigma }$ and b 1 = A 1 T s + e ${\mathbf{b}}_{1}={\mathbf{A}}_{1}^{T}\mathbf{s}+\mathbf{e}$ for some e σ ← β η , e ← β η d ${e}_{\sigma }{\leftarrow}{\beta }_{\eta },\mathbf{e}{\leftarrow}{\beta }_{\eta }^{d}$ ; otherwise, D outputs 0, then D′ outputs 0, and it means that b2, b1 is uniformly random in R q × R q d ${R}_{q}\times {R}_{q}^{d}$ . Obviously, D′ can solve the MLWE problem with non-negligible advantage as well, which contradicts the hardness of the MLWE problem. Hence, if the MLWE problem is hard to solve then the MLWE-DH problem is also hard to solve. □ 4 OUR MLWE-BASED PAKE SCHEME Here we describe our MLWE-PAKE protocol in detail and show its correctness. Protocol description Figure 1 describes the complete protocol. Let the rank n of a ring be a power of 2. Let q be an odd prime such that q ≡ 1 mod 2n. Function Sam(⋅) hashes a random seed into a public parameter A ∈ R q d × d $\mathbf{A}\in {R}_{q}^{d\times d}$ . Function H 1 : { 0 , 1 } ∗ → R q d ${H}_{1}:{\left\{0,1\right\}}^{\ast }\to {R}_{q}^{d}$ hashes a password into a vector in R q d ${R}_{q}^{d}$ ; H i : { 0 , 1 } ∗ → { 0 , 1 } k ( i = 2 , 3 ) ${H}_{i}:{\left\{0,1\right\}}^{\ast }\to {\left\{0,1\right\}}^{\mathsf{k}}\ (i=2,3)$ be hash functions for verification of communications; H 4 : { 0 , 1 } ∗ → { 0 , 1 } k ${H}_{4}:{\left\{0,1\right\}}^{\ast }\to {\left\{0,1\right\}}^{\mathsf{k}}$ , the Key Derivation Function (KDF), generates the session-key of length k $\mathsf{k}$ -bit. The comprehensive protocol is described as follows: Client Initiation A client C takes on the role of initiating the protocol by inputting its password and the server-id S. Then, C produces its ephemeral key pair (yc, sc) and uses the password to encapsulate yc as the message m. Finally, C finishes the initiation process by sending initialised message 〈C, m, ρ〉 to the server S, where ρ is a seed that generates the public matrix. Server Response Upon receiving 〈C, m, ρ〉, the server S checks the rationality of m. If m ∈ R q d $\mathbf{m}\in {R}_{q}^{d}$ , S first generates ephemeral public-key/secret-key pair (ys, ss). Then, S recovers yc from m. Then, S uses ss and yc to compute the coordination polynomial σs and the shared-key k σ , v = C o n σ s $\left({k}_{\sigma },v\right)=\mathsf{C}\m