security analysis

[p0mvn]

Summary

• Conduct an independent security and correctness analysis of the YPIR+SimplePIR lattice parameters used in the Nullifier PIR ZIP, targeting Zcash's 125-bit classical security requirement.
• Resolve the cost-model ambiguity (Core-SVP vs. MATZOV) that produces a 28-bit gap in security estimates, and anchor the claim using the NIST Kyber-512 FAQ methodology as precedent.
• Derive a stage-by-stage noise budget proving decryption correctness with failure probability $\leq 2^{-40}$.

Motivation

The ZIP's LWE parameters ($n = 2048$, $q \approx 2^{56}$, $\sigma_{\text{stddev}} = 6.4$) yield 104 bits under Core-SVP but 132.6 bits under the MATZOV cost model. Without a principled choice of cost model and an end-to-end noise analysis, the security claim is incomplete. This work closes that gap before the ZIP advances to Proposed status.

Methodology

1. Enumerate hardness instances

Catalog every distinct LWE/RLWE instance an adversary can target:

Instance	Description	Samples
A — Selector LWE	Tier 2 Regev encryption (negacyclic structure)	262,144
B — Packing-key RLWE	Key-switching keys (fresh per query)	33
C — Circular/KDM	Packing key encrypts functions of its own secret	33

2. Lattice-estimator hardness estimates

Run lattice-estimator on each instance under both RC.ADPS16 (Core-SVP) and RC.MATZOV, recording block size $\beta$ and bit-security for primal-uSVP and dual-hybrid attacks.

3. Kyber-512 calibration

Benchmark the PIR parameters against Kyber-512 ($\beta = 356$ vs. $\beta \approx 404$) under the same estimator, following the NIST FAQ's cost-model ladder (Core-SVP → MATZOV → hidden overheads → memory-access costs) to produce realistic gate-count estimates.

4. Sensitivity analysis

Sweep the noise standard deviation across ${3.2, 6.4, \ldots, 100}$ under both cost models to quantify margin and identify the minimum stddev that meets 125-bit security under each model.

5. Stage-by-stage noise budget

Track noise variance through the full decryption pipeline:

1. Regev encryption — initial noise from $d^{-1} e$
2. SimplePIR database scan — noise amplified by database entries ($m$ inner products)
3. CDKS packing (11 levels) — recursive key-switching noise ($V_\ell = 2V_{\ell-1} + V_{\text{ks}}$)
4. Split modulus switching — rounding errors amplified by secret-key multiplication
5. Final decryption — union bound over all $d \times m_{\text{packed}}$ plaintext slots

Verify total noise stays below $\Delta/2 \approx 2^{41}$ with failure probability $\leq 2^{-40}$.

6. Circular security assumption

State the precise KDM assumption (33 RLWE encryptions of automorphism-scaled copies of $s^\star$ under $s^\star$) and quantify the sample-count margin before security degrades below the target.

Decision gate

After the security analysis, one of three outcomes:

1. Accept — parameters meet 125-bit under MATZOV with adequate margin; proceed to noise budget and ZIP write-up.
2. Re-parameterize — if an unaccounted attack surface is found, sweep alternative parameters before computing the noise budget.
3. Escalate — if Core-SVP $\geq$ 125 is required (not MATZOV), the current parameters cannot meet this; document the constraint for ZIP editors.

Deliverables

• LWE/RLWE instance table with estimator results (both cost models)
• Kyber-512 comparison table with cost-model ladder
• Sensitivity table (stddev × cost model)
• Symbolic + numerical noise budget through all decryption stages
• Correctness error probability bound
• New "Noise and Security Analysis" section in the ZIP specification
• Updated Rationale section explaining cost-model and parameter choices