Parameter selection in Ring-LWE-based cryptography

Transcription

1 Parameter selection in Ring-LWE-based cryptography Rachel Player Information Security Group, Royal Holloway, University of London based on joint works with Martin R. Albrecht, Hao Chen, Kim Laine, and Sam Scott Final HEAT workshop Monday 27 November, 2017 Parameter selection in Ring-LWE Rachel Player 1/30

2 Table of Contents 1 Introduction 2 Hardness of (R)LWE 3 Choosing FHE parameters 4 Conclusion Rachel Player Parameter selection in Ring-LWE 2/30

3 Goal We will discuss RLWE parameter selection using FHE as an example application setting. Rachel Player Parameter selection in Ring-LWE 3/30

4 Goal We will discuss RLWE parameter selection using FHE as an example application setting. Rachel Player Parameter selection in Ring-LWE 3/30

5 Motivation: Standardisation post-quantum-cryptography Rachel Player Parameter selection in Ring-LWE 4/30

6 Motivation: Standardisation post-quantum-cryptography Reasons to standardise HE now The security properties of RLWE-based homomorphic encryption schemes can be hard to understand. The standard will present the security properties of the standardized scheme(s) in a clear and understandable form. Rachel Player Parameter selection in Ring-LWE 4/30

7 Table of Contents 1 Introduction 2 Hardness of (R)LWE 3 Choosing FHE parameters 4 Conclusion Rachel Player Parameter selection in Ring-LWE 5/30

8 LWE: Learning with Errors [R05] b = A s + e Search: given A and b, recover s Decision: distinguish whether (A, b) is chosen as LWE or uniformly at random Rachel Player Parameter selection in Ring-LWE 6/30

9 RLWE: Ring Learning with Errors [LPR10] The ring R q Let n be a power of 2 and define R q = Z q [x]/(x n + 1) Rachel Player Parameter selection in Ring-LWE 7/30

10 RLWE: Ring Learning with Errors [LPR10] The ring R q Let n be a power of 2 and define R q = Z q [x]/(x n + 1) Ring LWE (Decision) Let s R q be a secret. Let a R q be chosen uniformly at random. Let χ be a distribution over R q. Let e χ. Distinguish (a, b = as + e) R q R q from uniformly random (a, b) R q R q. Rachel Player Parameter selection in Ring-LWE 7/30

11 What are the parameters? A (Ring) LWE instance is specified by: n: dimension q: modulus α: characterises the error distribution The standard deviation σ of χ satisfies σ = αq 2π Rachel Player Parameter selection in Ring-LWE 8/30

12 Is my Ring-LWE-based scheme secure? Parameters n, q, α in the scheme imply an underlying Ring LWE instance Treat Ring LWE instance as an LWE instance Observe that LWE instance is hard to solve Rachel Player Parameter selection in Ring-LWE 9/30

13 So how hard is LWE, anyway? [APS15] Rachel Player Parameter selection in Ring-LWE 10/30

14 Solving Decision-LWE via solving SIS Short Integer Solutions (SIS) Let A Z n m q be a matrix. Let B R be a bound. Find a short vector v < B in the lattice L = {w Z m q wa 0 mod q}. Rachel Player Parameter selection in Ring-LWE 11/30

15 Solving Decision-LWE via solving SIS Short Integer Solutions (SIS) Let A Z n m q be a matrix. Let B R be a bound. Find a short vector v < B in the lattice L = {w Z m q wa 0 mod q}. Given samples (A, b) and such a v, compute v, b. Rachel Player Parameter selection in Ring-LWE 11/30

16 Solving Decision-LWE via solving SIS Short Integer Solutions (SIS) Let A Z n m q be a matrix. Let B R be a bound. Find a short vector v < B in the lattice L = {w Z m q wa 0 mod q}. Given samples (A, b) and such a v, compute v, b. If b = As + e, then v, b = va T, s + v, e v, e (mod q), so is small. Rachel Player Parameter selection in Ring-LWE 11/30

17 Solving Decision-LWE via solving SIS Short Integer Solutions (SIS) Let A Z n m q be a matrix. Let B R be a bound. Find a short vector v < B in the lattice L = {w Z m q wa 0 mod q}. Given samples (A, b) and such a v, compute v, b. If b = As + e, then v, b = va T, s + v, e v, e (mod q), so is small. If b is uniformly random, so is v, b. Rachel Player Parameter selection in Ring-LWE 11/30

18 Solving LWE via BDD w = As is a point in the lattice L generated by columns of A. b = As + e is a perturbed point. Solve this BDD instance in L to recover w. Rachel Player Parameter selection in Ring-LWE 12/30

19 Lattice reduction Many of the approaches to solve LWE rely on lattice reduction Rachel Player Parameter selection in Ring-LWE 13/30

20 Lattice reduction Many of the approaches to solve LWE rely on lattice reduction We do not agree on how to estimate the cost of lattice reduction How is the SVP oracle implemented? How many calls to the SVP oracle? Rachel Player Parameter selection in Ring-LWE 13/30

21 Estimator for hardness of LWE instances [APS15] input LWE instance n, q, α output estimates of runtime, memory, samples Can optionally specify: Limited samples [BBGS17] Secret distribution Lattice reduction cost method Rachel Player Parameter selection in Ring-LWE 14/30

22 Table of Contents 1 Introduction 2 Hardness of (R)LWE 3 Choosing FHE parameters 4 Conclusion Rachel Player Parameter selection in Ring-LWE 15/30

23 LWE based FHE parameters are atypical Typical LWE parameters [R05] q polynomial in n αq = n Rachel Player Parameter selection in Ring-LWE 16/30

24 LWE based FHE parameters are atypical Typical LWE parameters [R05] q polynomial in n αq = n FHE parameters huge q tiny error distribution e.g. αq = 8 small secret s = 1 possibly sparse secret Rachel Player Parameter selection in Ring-LWE 16/30

25 Is small or sparse secret a security issue? Theory LWE with binary secret in dimension n log q is as hard as general LWE in dimension n. [BLP+13,MP13] Rachel Player Parameter selection in Ring-LWE 17/30

26 Is small or sparse secret a security issue? Theory LWE with binary secret in dimension n log q is as hard as general LWE in dimension n. [BLP+13,MP13] More ways to solve Modulus switching Bai and Galbraith s algorithm [BG14] Guessing some components of secret Albrecht s variants of dual attack [Alb17]... Rachel Player Parameter selection in Ring-LWE 17/30

27 Why are FHE parameters so atypical? FHE ciphertexts all have noise Noise grows with homomorphic operations If noise too large, decryption will fail Rachel Player Parameter selection in Ring-LWE 18/30

28 Why are FHE parameters so atypical? FHE ciphertexts all have noise Noise grows with homomorphic operations If noise too large, decryption will fail Larger q gives larger noise limit Smaller error reduces noise Small / sparse secret reduces noise Rachel Player Parameter selection in Ring-LWE 18/30

29 The FV scheme [FV12] SecretKeyGen: Output s $ R 2 PublicKeyGen(s): Sample a $ R q, and e χ. Output (p 0, p 1 ) = ([ (as + e)] q, a) Encrypt((p 0, p 1 ),m): Sample u $ R 2, and e 1, e 2 χ. Output (c 0, c 1 ) = ([ m + p 0 u + e 1 ] q, [p 1 u + e 2 ] q ) Decrypt(s, (c 0, c 1 )): Output [ t q [c 0 + c 1 s] q ]t Rachel Player Parameter selection in Ring-LWE 19/30

30 Invariant noise [CLP17] Let (c 0, c 1 ) be an FV ciphertext encrypting m R t. The invariant noise v is the polynomial of smallest infinity norm such that for some integer polynomial a. t q (c 0 + c 1 s) = m + v + at, Rachel Player Parameter selection in Ring-LWE 20/30

31 Intuition for the definition of invariant noise Recall FV Decryption: m mod t = [ ] t q [c 0 + c 1 s] q t By definition of invariant noise: t q [c 0 + c 1 s] q = m + v + a t. So FV decryption succeeds, that is: [ ] t q [c 0 + c 1 s] q = m mod t, if v < 1 2. t. Rachel Player Parameter selection in Ring-LWE 21/30

32 Invariant noise in fresh ciphertext t q (c 0 + c 1 s) = t q ( m + p 0u + e 1 + k 0 q + p 1 us + e 2 s + k 1 qs) = q r t(q) m + t q q (p 0u + e 1 + p 1 us + e 2 s) + t(k 0 + k 1 s) = m + t ( ) rt (q)m + p 0 u + e 1 + p 1 us + e 2 s + At q t = m + t ( ) rt (q)m asu eu + e 1 + aus + e 2 s + At q t = m + t ( ) rt (q) m eu + e 1 + e 2 s + At. q t Rachel Player Parameter selection in Ring-LWE 22/30

33 Implementing FV SEAL SEAL ([DGBL+15],...) is a homomorphic encryption library developed by Microsoft Research Latest version v2.3 released Nov 2017 Implements [BEHZ16] variant of FV Available at sealcrypto.org We will talk about SEAL v2.2 [CLP17]. Rachel Player Parameter selection in Ring-LWE 23/30

34 Noise growth behaviour in SEAL v2.2 Homomorphic operation Initial Addition Multiplication Relinearization Multiply plain Add plain Invariant noise bound t q m + t q B(1 + 2δ) v 1 + v 2 t(δ J+1 1) 2q(δ 1) + ( + ( ) δt + δt(δj ) 2(δ 1) v 1 ) v 2 + 3δ v 1 v 2 δt + δt(δj ) 2(δ 1) v + t q (M N)(l + 1)δBw δt 2 v v + t2 q Rachel Player Parameter selection in Ring-LWE 24/30

35 Choosing SEAL v2.2 parameters for security Already fixed are n a power of two σ = 3.2 Rachel Player Parameter selection in Ring-LWE 25/30

36 Choosing SEAL v2.2 parameters for security Already fixed are n a power of two σ = 3.2 Find an acceptable bit length of q Rachel Player Parameter selection in Ring-LWE 25/30

37 Choosing SEAL v2.2 parameters for security Already fixed are n a power of two σ = 3.2 Find an acceptable bit length of q Choose some threshold λ and initial bit length K of q Rachel Player Parameter selection in Ring-LWE 25/30

38 Choosing SEAL v2.2 parameters for security Already fixed are n a power of two σ = 3.2 Find an acceptable bit length of q Choose some threshold λ and initial bit length K of q Use [APS15] estimator to determine best attack for n, q = 2 K, α = 8/q Rachel Player Parameter selection in Ring-LWE 25/30

39 Choosing SEAL v2.2 parameters for security Already fixed are n a power of two σ = 3.2 Find an acceptable bit length of q Choose some threshold λ and initial bit length K of q Use [APS15] estimator to determine best attack for n, q = 2 K, α = 8/q If best attack costs less than λ, decrement K and repeat Rachel Player Parameter selection in Ring-LWE 25/30

40 Choosing SEAL v2.2 parameters for security Already fixed are n a power of two σ = 3.2 Find an acceptable bit length of q Choose some threshold λ and initial bit length K of q Use [APS15] estimator to determine best attack for n, q = 2 K, α = 8/q If best attack costs less than λ, decrement K and repeat If best attack costs more than λ, stop Rachel Player Parameter selection in Ring-LWE 25/30

41 Estimate of SEAL v2.2 security [CLP17] n q α usvp dec dual /q /q /q /q /q Table: Estimates of the cost of solving LWE instances underlying SEAL v2.2 default parameters. Obtained using commit cc5f6e8 of the estimator in [APS15]. Rachel Player Parameter selection in Ring-LWE 26/30

42 Choosing SEAL v2.2 parameters for performance [CLP17] Once we know the desired size of q we can think about a good shape for performance. Default q in SEAL v2.2 Of the form 2 A B, where B is a small integer Of the form 2n (q 1) In particular 4q β, where β = 2 64 log(q)/64 Rachel Player Parameter selection in Ring-LWE 27/30

43 Table of Contents 1 Introduction 2 Hardness of (R)LWE 3 Choosing FHE parameters 4 Conclusion Rachel Player Parameter selection in Ring-LWE 28/30

44 More details CLP17 Hao Chen, Kim Laine and Rachel Player. Simple Encrypted Arithmetic Library - SEAL (v2.2). Technical report, simple-encrypted-arithmetic-library-seal-v2-2/ APS15 Martin R. Albrecht, Rachel Player and Sam Scott. On the concrete hardness of Learning with Errors. Journal of Mathematical Cryptology, 9(3): , ia.cr/2015/046 My (pre-viva) PhD thesis Parameter selection in lattice-based cryptography is available on request! Rachel Player Parameter selection in Ring-LWE 29/30

45 Bibliography / Thanks Thank you!... Questions? Alb17 M. R. Albrecht. On Dual Lattice Attacks Against Small-Secret LWE and Parameter Choices in HElib and SEAL. In Eurocrypt, BG14 S. Bai and S. D. Galbraith. Lattice Decoding Attacks on Binary LWE. In ACISP, BEHZ16 BBGS17 BLP+13 DGBL+15 J.-C. Bajard and J. Eynard and A. Hasan and V. Zucca. A Full RNS Variant of FV like Somewhat Homomorphic Encryption Schemes. In SAC, N. Bindel, J. Buchmann, F. Göpfert and M. Schmidt. Estimation of the hardness of the Learning with Errors problem with a restricted number of samples. Eprint 2017/140. Z. Brakerski, A. Langlois, C. Peikert, O. Regev and D. Stehlé. Classical hardness of Learning with Errors. In STOC, N. Dowlin, R. Gilad-Bachrach, K. Laine, K. Lauter, M. Naehrig and J. Wernsing. Manual for using homomorphic encryption for bioinformatics. Proceedings of the IEEE 105(3): , FV12 J. Fan and F. Vercauteren. Somewhat practical fully homomorphic encryption. Eprint 2012/144. LPR10 V. Lyubashevsky, C. Peikert and O. Regev. On ideal lattices and Learning with Errors over rings. In Eurocrypt, MP13 D. Micciancio and C. Peikert. Hardness of SIS and LWE with small parameters. In Crypto, R05 O. Regev. On lattices, learning with errors, random linear codes, and cryptography. In STOC, Rachel Player Parameter selection in Ring-LWE 30/30