COMPUTING ON ENCRYPTED DATA: HIGH-PRECISION ARITHMETIC IN HOMOMORPHIC ENCRYPTION

Transcription

1 #RSAC SESSION ID: CRYP-W02 COMPUTING ON ENCRYPTED DATA: HIGH-PRECISION ARITHMETIC IN HOMOMORPHIC ENCRYPTION Rachel Player PhD Student // Postdoc Royal Holloway, University of London, UK // LIP6, Sorbonne Université, Joint work with: Hao Chen, Kim Laine, and Yuhou Xia

2 MOTIVATION #RSAC

3 Homomorphic encryption # R S A C x x, F Eval( x, F) F(x) F(x) 3

4 Raw data must be encoded into plaintexts # R S A C Encode(y) = x y F(y) x F(x), F Eval( x, F) Decode(F(x)) 4

5 Need to ensure correctness of decoding # R S A C TYPICAL PLAINTEXT SPACE Underlying plaintext coefficients grow during evaluation If plaintext wraps modulo t in any coefficient, decoding will fail Typically have to choose large t to avoid this 5

6 Example: binary encoding To encode an integer: Express in binary Each bit is coefficient of the corresponding polynomial # R S A C To decode: Evaluate polynomial at x= x

7 Challenges with traditional approach # R S A C Various encoders to choose from Choosing large t means more noise growth Batching is supported 7

8 Hoffstein-Silverman: a different approach Replace t by a small polynomial x-b for b a positive integer e.g. b = 2 # R S A C Easy to encode integers Huge amount of room for computation J. Hoffstein and J. Silverman. Optimizations for NTRU. In Public Key Cryptography and Computational Number Theory,

9 Related work Geihs and Cabarcas applied in context of BV scheme Lauter et al. apply the idea to YASHE scheme No performance analysis presented Unpublished work of Lopez-Alt and Naehrig is cited for details # R S A C M. Geihs and D. Cabarcas. Efficient integer encoding for homomorphic encryption via ring isomorphisms. In LATINCRYPT, K. E. Lauter, A. Lopez-Alt, and M. Naehrig. Private computation on encrypted genomic data. In LATINCRYPT, A. Lopez-Alt and M. Naehrig. Large integer plaintexts in ring-based fully homomorphic encryption, Unpublished. 9

10 OUR CONTRIBUTION #RSAC

11 Adapting the work of Lopez-Alt and Naehrig, we: Apply the Hoffstein-Silverman trick on the FV scheme Analyze its noise growth using new definition of noise Extend rational number encoders to work with the trick Present a detailed performance comparison to FV scheme Analyze impact on practical use-cases # R S A C A. Lopez-Alt and M. Naehrig. Large integer plaintexts in ring-based fully homomorphic encryption, Unpublished. J. Fan and F. Vercauteren. Somewhat practical fully homomorphic encryption. Eprint 2012/

12 Adapting the work of Lopez-Alt and Naehrig, we: Apply the Hoffstein-Silverman trick on the FV scheme Analyze its noise growth using new definition of noise Extend rational number encoders to work with the trick Present a detailed performance comparison to FV scheme Analyze impact on practical use-cases # R S A C A. Lopez-Alt and M. Naehrig. Large integer plaintexts in ring-based fully homomorphic encryption, Unpublished. J. Fan and F. Vercauteren. Somewhat practical fully homomorphic encryption. Eprint 2012/

13 Regular circuits Security is the same so we can fix (n, q, σ) Compare evaluation of regular circuit as in Costache et al. Do A additions and one multiplication, iterated D times Inputs are integers of norm at most L # R S A C A Costache, N. P. Smart, S. Vivek and A. Waller. Fixed point arithmetic in SHE scheme. In SAC,

14 Choosing an encoder for FV Well-known encoders are NAF or balanced base-b Short B enables smaller t Large B enables shorter encodings Cheon et al. show NAF encoding outperforms balanced base-b encoding for B = 2 and B = 3 # R S A C J. H. Cheon, J. Jeong, J. Lee and K. Lee. Privacy-preserving computations of predictive medical models with minimax approximation and Non-Adjacent Form. In WAHC,

15 Noise and plaintext growth constraints # R S A C FV CONSTRAINTS HP-FV CONSTRAINT 15

16 FV vs. HP-FV: results # R S A C FV + NAF HP-FV 16

17 HP-FV enables much higher depth # R S A C FV + NAF HP-FV 17

18 HP-FV enables much higher depth # R S A C FV + NAF HP-FV 18

19 HP-FV enables much higher depth # R S A C FV + NAF HP-FV 19

20 Larger n in HP-FV gives much more capability # R S A C FV + NAF HP-FV 20

21 Larger n in HP-FV gives much more capability # R S A C FV + NAF HP-FV 21

22 Addition hurts FV more than HP-FV # R S A C FV + NAF HP-FV 22

23 Addition hurts FV more than HP-FV # R S A C FV + NAF HP-FV 23

24 Addition hurts FV more than HP-FV # R S A C FV + NAF HP-FV 24

25 SUMMARY #RSAC

26 In this talk we Discussed the need for good encoding in homomorphic encryption # R S A C Applied Hoffstein-Silverman trick to FV Showed performance improvements compared to FV 26

27 Thank you! Any questions? # R S A C haoche@microsoft.com kim.laine@microsoft.com rachel.player@lip6.fr yuhoux@math.princeton.edu 27

28 SESSION ID: CRYP-W02 THRESHOLD PROPERTIES OF PRIME POWER SUBGROUPS WITH APPLICATION TO SECURE INTEGER COMPARISONS Aleksander Essex Assistant professor Western University, Co-authors: Rhys Carlton and Krzysztof Kapulkin

29 Encryption in Z n General form: Enc(m) = g m h r mod n g generates subgroup G of Z n h generates a subgroup H of Z n 2

30 Additive Homomorphism A useful property: Adding under encryption c 1 c 2 = g m 1 h r1 g m 2 h r 2 3

31 Additive Homomorphism A useful property: Adding under encryption c 1 c 2 = g m 1 h r1 g m 2 h r 2 = g m 1+m 2 h r 1+r 2 3

32 Additive Homomorphism A useful property: Adding under encryption c 1 c 2 = g m 1 h r1 g m 2 h r 2 = g m 1+m 2 h r 1+r 2 = Enc(m 1 + m 2 ) 3

33 Additive Homomorphism A useful property: Adding under encryption c 1 c 2 = g m 1 h r1 g m 2 h r 2 = g m 1+m 2 h r 1+r 2 = Enc(m 1 + m 2 ) 3

34 Additive Homomorphism Enc(m 1 ) Enc(m 2 ) = Enc(m 1 + m 2 ) Interesting, but over 35 years of examples... 4

35 Encryption in Z n Goldwasser-Micali (1982) Enc(m) = g m h r mod n G = 2 mod p, G = 2 mod q H = p 1 2 mod p, H = q 1 2 mod q 5

36 Encryption in Z n Benaloh (1994) Enc(m) = g m h r mod n G = s mod p, G = (q 1) mod q, for small/smooth s H = (p 1) s mod p, H = (q 1) mod q 6

37 Encryption in Z n Naccache-Stern (1998) Enc(m) = g m h r mod n G = u mod p, G = v mod q, for smooth relatively prime u, v H = (p 1) u mod p, H = (q 1) v mod q 7

38 Encryption in Z n Okamoto-Uchiyama (1998) Enc(m) = g m h r mod n n = p 2 q G = p (p 1) mod p 2, G = (q 1) mod q H = (p 1) mod p 2, H = (q 1) mod q 8

39 Encryption in Z n Paillier (1999) Enc(m) = g m h r mod n 2 G = p mod p 2, G = q mod q 2 H = (p 1) mod p 2, H = (q 1) mod q 2 9

40 Encryption in Z n Groth (2003) Enc(m) = g m h r mod n G = p s mod p, G = q s mod q for large smooth p s, q s H = p t = (p 1) p s mod p, H = q t = (q 1) q s mod q for just big enough primes p t, q t 10

41 Encryption in Z n Damgård-Geisler-Krøigaard (2007) Enc(m) = g m h r mod n G = u mod p, G = u mod q for small prime u H = p s mod p, H = q s mod q for just big enough primes p s, q s 11

42 Encryption in Z n Joye-Libert (2013) Enc(m) = g m h r mod n G = 2 k mod p, G = 2 k mod q H = p t = (p 1) 2 k mod p, H = q t = (q 1) 2 k mod q for primes p t, q t 12

43 A Scalar Threshold Homomorphism Something new: Computing a threshold under encryption Enc(m 1 ) m 2 = { Enc(m 1 + m 2 ) Enc( ) m 1 + m 2 < t otherwise. Enc( ) is the encryption of a fixed value outside the defined plaintext space. 13

44 A Scalar Threshold Homomorphism Our proposal: Enc(m) = g bm h r mod n G = b d mod p, G = b d mod q for small prime base b, and threshold d H = p s mod p, H = q s mod q for just big enough primes p s, q s 14

45 A Scalar Threshold Homomorphism Enc(m 1 ) bm 2 = (g bm1 h r ) bm 2 15

46 A Scalar Threshold Homomorphism Enc(m 1 ) bm 2 = (g bm1 h r ) bm 2 = g bm 1 b m2 h r 15

47 A Scalar Threshold Homomorphism Enc(m 1 ) bm 2 = (g bm1 h r ) bm 2 = g bm 1 b m2 h r = g b(m 1 +m 2 ) h r 15

48 A Scalar Threshold Homomorphism Enc(m 1 ) bm 2 = (g bm1 h r ) bm 2 = g bm 1 b m2 h r = g b(m 1 +m 2 ) h r = Enc(m 1 + m 2 ) 15

49 A Scalar Threshold Homomorphism Enc(m 1 ) bm 2 = (g bm1 h r ) bm 2 = g bm 1 b m2 h r = g b(m 1 +m 2 ) h r = Enc(m 1 + m 2 ) 15

50 A Scalar Threshold Homomorphism Except... Enc(m 1 + m 2 ) g bm 1 +m 2 mod b d h r mod n 16

51 A Scalar Threshold Homomorphism Except... Enc(m 1 + m 2 ) g bm 1 +m 2 mod b d h r mod n So if m 1 + m 2 d, then b m 1+m 2 0 mod b d. Then: Enc(m 1 + m 2 ) g 0 h r h r Enc( ) 16

52 A Scalar Threshold Homomorphism Limitation: The threshold is one-sided. May be interesting for certain applications, but to do a secure comparison (i.e., Millionaire s), we need a protocol to homomorphically blind the sum. 17

53 Secure Integer Comparison Protocol P 1 P 2 C Enc(m 1 ) = g bm 1 h r1 C 18

54 Secure Integer Comparison Protocol P 1 P 2 C Enc(m 1 ) = g bm 1 h r1 C D (C) b(d m 2 ) g s h r2 s.t. s 0 mod b 19

55 Secure Integer Comparison Protocol P 1 P 2 C Enc(m 1 ) = g bm 1 h r1 C D D (C) b(d m 2 ) g s h r2 s.t. s 0 mod b g w (D) x w log g (g w ) 20

56 Secure Integer Comparison Protocol P 1 P 2 C Enc(m 1 ) = g bm 1 h r1 C g w (D) x w log g (g w ) D PET CS (w, s) D (C) b(d m 2 ) g s h r2 s.t. s 0 mod b Output True if (w = s), Output False otherwise 21

57 Performance Threshold d consumes d bits of p and q Implication: Current range of RSA key-lengths puts an upper bound of d

58 Performance Threshold d consumes d bits of p and q Implication: Current range of RSA key-lengths puts an upper bound of d 2 10 Performance comparison in paper was done on 8 bits per protocol instance Extensible to arbitrary precision comparisons with multiple parallel protocol invocations 22

59 Performance Threshold d consumes d bits of p and q Implication: Current range of RSA key-lengths puts an upper bound of d 2 10 Performance comparison in paper was done on 8 bits per protocol instance Extensible to arbitrary precision comparisons with multiple parallel protocol invocations Performance times faster than DGK, in about 7.5 times less data transmitted 22

60 Conclusion Thank-you, Questions? h r g m 23