Lattice Based Crypto: Answering Questions You Don't Understand

Transcription

1 Lattice Based Crypto: Answering Questions You Don't Understand Vadim Lyubashevsky INRIA / ENS, Paris

2 Cryptography Secure communication in the presence of adversaries

3 Symmetric-Key Cryptography Secret key = s

4 Symmetric-Key Cryptography Secret Key = s Secret Key = s

5 Symmetric-Key Cryptography

6

7

8

9 doing more interesting things

10

11

12

13

14 Public-Key Cryptography Diffie-Hellman Key Exchange (1976) RSA cryptosystem (1978)

15 Secret Key = s Public Key = p Public-Key Cryptography

16 Public-Key Cryptography Secret Key = s Public Key = p Public Key = p Public Key = p

17

18

19

20 public key cryptography revolutionized e-commerce but there is still more

21

22

23

24

25

26

27 Fully-Homomorphic Encryption Someone else can compute any function on your encrypted data First construction in 2009 by Craig Gentry Currently, very inefficient lots of exciting work left to be done!!!

28

29

30

31

32

33 Applications of Fully-Homomorphic Encryption Computation in the cloud Database retrieval Private searching

34 PUBLIC KEY ENCRYPTION

35 Public Key Encryption

36 Public Key Encryption (sk,pk) KeyGen(1 n )

37 Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m)

38 Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m) m = Dec(sk,c)

39 Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m) m = Dec(sk,c) Correctness: Dec(sk,Enc(pk,m))=m

40 Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m) m = Dec(sk,c) Correctness: Dec(sk,Enc(pk,m))=m CPA-Security: Enc(pk,m i ) are computationally indistinguishable from each other

41 Computationally Indistinguishable

42 Computationally Indistinguishable DX X 1 X 2 X k

43 Computationally Indistinguishable DX X 1 X 2 X k DY Y 1 Y 2 Y k

44 Computationally Indistinguishable DX X 1 X 2 X k DY Y 1 Y 2 Y k

45 Computationally Indistinguishable DX X 1 X 2 X k D? Z 1 Z 2 Z k DY Y 1 Y 2 Y k

46 Computationally Indistinguishable DX D? DY X 1 Z 1 Y 1 X 2? = Z 2? = Y 2 X k Z k Y k

47 (SLIGHTLY MODIFIED) NTRU CRYPTOSYSTEM

48 Polynomial Ring Z p [x]/(x n +1)

49 Polynomial Ring Z p [x]/(x n +1) Elements are polynomials of degree n-1

50 Polynomial Ring Z p [x]/(x n +1) Elements are polynomials of degree n-1 a=a 0 +a 1 x+ + a n-1 x n-1

51 Polynomial Ring Z p [x]/(x n +1) Elements are polynomials of degree n-1 a=a 0 +a 1 x+ + a n-1 x n-1 a i in the range [-(p-1)/2, (p-1)/2]

52 Polynomial Ring Z p [x]/(x n +1) Elements are polynomials of degree n-1 a=a 0 +a 1 x+ + a n-1 x n-1 a i in the range [-(p-1)/2, (p-1)/2] a, b in Z p [x]/(x n +1)

53 Polynomial Ring Z p [x]/(x n +1) Elements are polynomials of degree n-1 a=a 0 +a 1 x+ + a n-1 x n-1 a i in the range [-(p-1)/2, (p-1)/2] a, b in Z p [x]/(x n +1) 1. If a, b < k, then a+b < 2k

54 Polynomial Ring Z p [x]/(x n +1) Elements are polynomials of degree n-1 a=a 0 +a 1 x+ + a n-1 x n-1 a i in the range [-(p-1)/2, (p-1)/2] a, b in Z p [x]/(x n +1) 1. If a, b < k, then a+b < 2k 2. If a, b < k, then ab < nk 2

55 Computationally-Indistinguishable Distributions

56 Computationally-Indistinguishable D1 Distributions 1. Pick uniform a in Z p [x]/(x n +1)

57 Computationally-Indistinguishable D1 Distributions 1. Pick uniform a in Z p [x]/(x n +1) 2. Output a

58 Computationally-Indistinguishable D1 Distributions D2 1. Pick uniform a in Z p [x]/(x n +1) 2. Output a 1. Pick uniform f,g in Z p [x]/(x n +1) such that f, g = 1

59 Computationally-Indistinguishable D1 Distributions D2 1. Pick uniform a in Z p [x]/(x n +1) 2. Output a 1. Pick uniform f,g in Z p [x]/(x n +1) such that f, g = 1 2. Output a=f/g

60 Computationally-Indistinguishable D1 Distributions D2 1. Pick uniform a in Z p [x]/(x n +1) 2. Output a 1. Pick uniform f,g in Z p [x]/(x n +1) such that f, g = 1 2. Output a=f/g If p << 2 n, the distributions are computationally-indistinguishable

61 Computationally-Indistinguishable D1 Distributions D2 1. Pick uniform a in Z p [x]/(x n +1) 2. Output a 1. Pick uniform f,g in Z p [x]/(x n +1) such that f, g = 1 2. Output a=f/g If p << 2 n, the distributions are computationally-indistinguishable D1 1. Pick uniform (a,u) in Z p [x]/(x n +1) 2. Output (a,u)

62 Computationally-Indistinguishable D1 Distributions D2 1. Pick uniform a in Z p [x]/(x n +1) 2. Output a 1. Pick uniform f,g in Z p [x]/(x n +1) such that f, g = 1 2. Output a=f/g If p << 2 n, the distributions are computationally-indistinguishable D1 1. Pick uniform (a,u) in Z p [x]/(x n +1) 2. Output (a,u) D2 1. Pick uniform a in Z p [x]/(x n +1) and r,e such that r, e = 1 2. Output (a,ar+e)

63 NTRU Cryptosystem

64 NTRU Cryptosystem f g = a mod p Looks random

65 NTRU Cryptosystem f g = a -1,0,1 coefficients mod p Looks random

66 f g NTRU Cryptosystem -1,0,1 coefficients -1,0,1 coefficients = a mod p u = 2 a r + e + m Looks random Looks random mod p

67 f g NTRU Cryptosystem -1,0,1 coefficients -1,0,1 coefficients = a mod p u = 2 a r + e + m Looks random Looks random mod p u g mod p = 2 f r + e g + g m

68 f g NTRU Cryptosystem -1,0,1 coefficients -1,0,1 coefficients = a mod p u = 2 a r + e + m Looks random Looks random mod p u g mod p = 2 f r + e g + g m u g mod p mod 2 = g m

69 f g NTRU Cryptosystem -1,0,1 coefficients -1,0,1 coefficients = a mod p u = 2 a r + e + m Looks random Looks random mod p u g mod p = 2 f r + e g + g m u g mod p mod 2 = g m u g mod p mod 2 = g m

70 COMPUTING ON ENCRYPTED DATA

71 Homomorphic Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m) m = Dec(sk,c)

72 Homomorphic Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m) m = Dec(sk,c) Correctness: Dec(sk,Enc(pk,m))=m

73 Homomorphic Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m) m = Dec(sk,c) Correctness: Dec(sk,Enc(pk,m))=m c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i )

74 Homomorphic Public Key Encryption (sk,pk) KeyGen(1 n ) c = Enc (pk,m) m = Dec(sk,c) Correctness: Dec(sk,Enc(pk,m))=m c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i ) Homomorphic: Dec(sk,c F ) = F(m 1,m 2 )

75 Uninteresting Eval Function c F = Eval(F,c 1,c 2 ) = (F, c 1, c 2 ) Dec(sk, (F, c 1, c 2 )) = F(Dec(sk,c 1 ), Dec(sk,c 2 ))

76 Uninteresting Eval Function c F = Eval(F,c 1,c 2 ) = (F, c 1, c 2 ) Dec(sk, (F, c 1, c 2 )) = F(Dec(sk,c 1 ), Dec(sk,c 2 )) Want compactness: Output length of Eval is independent of F and the number of inputs

77 Functions as Arithmetic Circuits For bits a, b we can rewrite: a b a b a a + 1

78 Functions as Arithmetic Circuits For bits a, b we can rewrite: a b a b a a + 1 Use NTRU and define Eval for and + as:

79 Functions as Arithmetic Circuits For bits a, b we can rewrite: a b a b a a + 1 Use NTRU and define Eval for and + as: Eval (+, c 1, c 2 ) = c 1 + c 2

80 Functions as Arithmetic Circuits For bits a, b we can rewrite: a b a b a a + 1 Use NTRU and define Eval for and + as: Eval (+, c 1, c 2 ) = c 1 + c 2 Eval (, c 1, c 2 ) = c 1 c 2

81 Eval of + in the NTRU Cryptosystem f g - Very small f g = a mod p

82 Eval of + in the NTRU Cryptosystem f g f = g - Very small a u a r m 1 1 mod p = 2 u 2 mod p a r m 2 = 2 mod p

83 Eval of + in the NTRU Cryptosystem f g f = g - Very small a u a r m 1 1 mod p = 2 u 2 mod p a r m 2 = 2 mod p + = a r 1 + a r 2 + m m 2 u 1 u 2 2 mod p

84 Eval of + in the NTRU Cryptosystem f g f = g - Very small a u a r m 1 1 mod p = 2 u 2 mod p a r m 2 = 2 mod p + = a r 1 + a r 2 + m m 2 u 1 u 2 2 mod p + g = 2 f r 1 + f r 2 m + g + g 1 + m 2 u 1 u 2 mod p

85 Eval of + in the NTRU Cryptosystem f g f = g - Very small a u a r m 1 1 mod p = 2 u 2 mod p a r m 2 = 2 mod p + = a r 1 + a r 2 + m m 2 u 1 u 2 2 mod p + g = 2 f r 1 + f r 2 m + g + g 1 + m 2 u 1 u 2 mod p want coefficients of this to be less than p/2

86 Eval of in the NTRU Cryptosystem f g f = g - Very small a u a r m 1 1 mod p = 2 u 2 mod p a r m 2 = 2 mod p

87 Eval of in the NTRU Cryptosystem f g f = g - Very small a u a r m 1 1 mod p = 2 u 2 mod p a r m 2 = 2 mod p u 1 u 2 = a + m 1 a a + 4 mod p m 2

88 Eval of in the NTRU Cryptosystem f g f = g - Very small a u a r m 1 1 mod p = 2 u 2 mod p a r m 2 = 2 mod p u 1 u 2 = a + m 1 a a + 4 mod p u 1 u 2 g g = 4 f f f g + m 2 + g g m 1 m 2 mod p

89 NTRU and Eval for F in {+, } secret key: small f, g public key: a = f/g mod p

90 NTRU and Eval for F in {+, } secret key: small f, g public key: a = f/g mod p Enc(a,m) = 2(ar+e)+m mod p

91 NTRU and Eval for F in {+, } secret key: small f, g public key: a = f/g mod p Enc(a,m) = 2(ar+e)+m mod p Dec(g,c) = (g 2 c mod 2)/g 2 mod 2

92 NTRU and Eval for F in {+, } secret key: small f, g public key: a = f/g mod p Enc(a,m) = 2(ar+e)+m mod p Dec(g,c) = (g 2 c mod 2)/g 2 mod 2 Eval(F,c 1,c 2 ) = F(c 1,c 2 )

93 Extending to Higher Depths +

94 Extending to Higher Depths a + a 2 a 4 a 8

95 Extending to Higher Depths a g + a 2 g 2 a 4 g 4 a 8 g 8

96 Limitation Decrypting a d-level circuit requires g 2d < p (and similarly f)

97 Limitation Decrypting a d-level circuit requires g 2d < p (and similarly f) Problem: if 2 n g < p, then one can recover f and g from f/g mod p using LLL

98 Limitation Decrypting a d-level circuit requires g 2d < p (and similarly f) Problem: if 2 n g < p, then one can recover f and g from f/g mod p using LLL Thus d < log n

99 Limitation Decrypting a d-level circuit requires g 2d < p (and similarly f) Problem: if 2 n g < p, then one can recover f and g from f/g mod p using LLL Thus d < log n Still we can evaluate all low-depth functions Called somewhat-homomorphic encryption

100 BOOTSTRAPPING

101 Reducing the Noise + c

102 Reducing the Noise + problem: can t do any more operations on c (too much noise in it) c

103 Reducing the Noise + problem: can t do any more operations on c (too much noise in it) c idea: somehow re-encrypt c under a different key and hope the new encryption has less noise

104 Using the Somewhat-Homomorphism For all low-depth functions F: If c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i ), then Dec(sk,c F ) = F(m 1,m 2 )

105 Using the Somewhat-Homomorphism For all low-depth functions F: If c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i ), then Dec(sk,c F ) = F(m 1,m 2 ) - c is encrypted under pk 1

106 Using the Somewhat-Homomorphism For all low-depth functions F: If c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i ), then Dec(sk,c F ) = F(m 1,m 2 ) - c is encrypted under pk 1 - want to re-encrypt c under pk 2

107 Using the Somewhat-Homomorphism For all low-depth functions F: If c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i ), then Dec(sk,c F ) = F(m 1,m 2 ) - c is encrypted under pk 1 - want to re-encrypt c under pk 2 c F = Eval(Dec, Enc(pk 2,sk 1 ), Enc(pk 2,c))

108 Using the Somewhat-Homomorphism For all low-depth functions F: If c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i ), then Dec(sk,c F ) = F(m 1,m 2 ) - c is encrypted under pk 1 - want to re-encrypt c under pk 2 c F = Eval(Dec, Enc(pk 2,sk 1 ), Enc(pk 2,c)) And so Dec(sk 2,c F ) = Dec(sk 1,c)!!

109 Using the Somewhat-Homomorphism For all low-depth functions F: If c F = Eval (F, c 1, c 2 ) where c i = Enc(pk,m i ), then Dec(sk,c F ) = F(m 1,m 2 ) - c is encrypted under pk 1 provide as part of the public key - want to re-encrypt c under pk 2 c F = Eval(Dec, Enc(pk 2,sk 1 ), Enc(pk 2,c)) And so Dec(sk 2,c F ) = Dec(sk 1,c)!! noise in c F depends on the depth of Dec

110 NTRU with Bootstrapping?

111 NTRU with Bootstrapping? For bootstrapping to work need Dec to have depth < log n

112 NTRU with Bootstrapping? For bootstrapping to work need Dec to have depth < log n In NTRU, Dec(g d,c) = (cg d mod 2)/g d mod 2

113 NTRU with Bootstrapping? For bootstrapping to work need Dec to have depth < log n In NTRU, Dec(g d,c) = (cg d mod 2)/g d mod 2 Polynomial multiplication requires log n depth

114 NTRU with Bootstrapping? For bootstrapping to work need Dec to have depth < log n In NTRU, Dec(g d,c) = (cg d mod 2)/g d mod 2 Polynomial multiplication requires log n depth Overcoming this: [Gen 2009] Give the decryptor some hints, which makes the Dec algorithm shallower

115 NTRU with Bootstrapping? For bootstrapping to work need Dec to have depth < log n In NTRU, Dec(g d,c) = (cg d mod 2)/g d mod 2 Polynomial multiplication requires log n depth Overcoming this: [Gen 2009] Give the decryptor some hints, which makes the Dec algorithm shallower [Bra,Gen,Vai 2011] New technique (modulus switching) allows evaluation of deeper circuits ~ O(n)-depth

116 References Jeffrey Hoffstein, Jill Pipher, Joseph H. Silverman (1998): NTRU: A Ring-Based Public Key Cryptosystem Daniele Micciancio (2002): Generalized Compact Knapsacks, Cyclic Lattices, and Efficient One-Way Functions Chris Peikert, Alon Rosen (2006): Efficient Collision-Resistant Hashing from Worst- Case Assumptions on Cyclic Lattices. Vadim Lyubashevsky, Daniele Micciancio (2006): Generalized Compact Knapsacks Are Collision Resistant Craig Gentry (2009) Fully Homomorphic Encryption Using Ideal Lattices Vadim Lyubashevsky, Chris Peikert, Oded Regev (2010): On Ideal Lattices and Learning with Errors over Rings. Damien Stehlé, Ron Steinfeld (2011): Making NTRU as Secure as Worst-Case Problems over Ideal Lattices Zvika Brakerski, Craig Gentry, Vinod Vaikuntanathan (2012): (Leveled) Fully Homomorphic Encryption Without Bootstrapping Adriana Lopez-Alt, Eran Tromer, Vinod Vaikuntanathan (2012): On-the-fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption