Reaction attacks against BGV and BFV

Investigate whether reaction attacks analogous to the CKKS attack threaten the widely deployed RLWE-based BGV and BFV schemes.

Background

The paper develops its attack for CKKS by combining a public encryption-key shift, a coefficient-to-slot transform, and an observable validity reaction. It explicitly leaves unresolved whether comparable attacks apply to other widely deployed RLWE schemes, specifically BGV and BFV.

References

We highlight four directions for future work: (i) Detection Models: Formalizing detector models to determine which aggregate heuristics (e.g., query volume, rejection rates) provably prevent key recovery; (ii) Closing Theoretical Gaps: Reducing the minimal query gap between our theoretical bound and the experimental average for sparse secrets (close to the $\approx 1.05$ gap in uniform ternary); (iii) Scheme Generality: Investigating whether similar reaction attacks threaten other widely deployed RLWE schemes, such as BGV and BFV; and (iv) Safe Validation: Designing output-validation mechanisms that support legitimate retries without leaking externally exploitable accept/reject bits.

— Reaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity  (2610.21127 - Bian et al., 15 Oct 2026) in Section 7, Conclusion and Open Questions