NewHope cryptosystem is one of the second-round submissions of the National Institute of Standards and Technology post-quantum cryptography standardization process, which is a suite of two key encapsulation mechanisms based on the ring-learning with errors (LWE) problem. It has received much attention from the research community due to its small key size and high efficiency. Recently, three key mismatch attacks are proposed against NewHope under the condition of key reuse. They do not solve the ring-LWE instance directly but exploit the leakage of secret information. As far as we know, the best result is given by Okada et al. ((2020) Improving Key Mismatch Attack on NewHope with Fewer Queries. In Proc. of the 25th Australasian Conf. on Information Security and Privacy, Perth, WA, Australia, November 30–December 2, pp. 505–524. Springer Cham, Switzerland), which recovers the whole secret with a success probability of $97\%$ and $233,803$ average queries. In this paper, we further improve the key mismatch attack of NewHope by reducing the average queries to $106,577$ and raising the success probability to $100\%$. Moreover, we analyze the key mismatch attack without key reuse for the first time and we propose a combinatorial attack against NewHope1024. The total complexity of the combinatorial attack is $2^{253}$, which is lower than the complexity of primal attack and the claimed security strength of NewHope1024.

中文翻译：

---

对NewHope的密钥错配攻击的改进

NewHope密码系统是美国国家标准与技术研究院后量子密码标准化过程的第二轮提交之一，它是一套基于带错误的环学习（LWE）问题的两个关键封装机制。它由于密钥尺寸小、效率高而受到研究界的广泛关注。最近，针对NewHope提出了三种密钥重用条件下的密钥错配攻击。他们不直接解决环 LWE 实例，而是利用秘密信息的泄漏。据我们所知，最好的结果是由 Okada 等人给出的。（（2020 年）用更少的查询改进对 NewHope 的密钥不匹配攻击。在第 25 届澳大利亚信息安全和隐私会议上，珀斯，华盛顿州，澳大利亚，11 月 30 日至 12 月 2 日，第 505-524 页。Springer Cham，瑞士），它以 97 美元的成功概率和 233,803 美元的平均查询成功概率恢复了整个秘密。在本文中，我们进一步改进了 NewHope 的密钥不匹配攻击，将平均查询降低到 $106,577$，并将成功概率提高到 $100\%$。此外，我们首次分析了没有密钥重用的密钥不匹配攻击，并提出了针对 NewHope1024 的组合攻击。组合攻击的总复杂度为 $2^{253}$，低于原始攻击的复杂度和 NewHope1024 声称的安全强度。此外，我们首次分析了没有密钥重用的密钥不匹配攻击，并提出了针对 NewHope1024 的组合攻击。组合攻击的总复杂度为 $2^{253}$，低于原始攻击的复杂度和 NewHope1024 声称的安全强度。此外，我们首次分析了没有密钥重用的密钥不匹配攻击，并提出了针对 NewHope1024 的组合攻击。组合攻击的总复杂度为 $2^{253}$，低于原始攻击的复杂度和 NewHope1024 声称的安全强度。