Multikey Homomorphic Encryption from NTRU

Transcription

1 Multikey Homomorphic Encryption from NTRU Li Chen lichen.xd at gmail.com Xidian University January 12, 2014

2 Multikey Homomorphic Encryption from NTRU Outline 1 Variant of NTRU Encryption 2 Somewhat homomorphic from NTRU 3 Optimized Scheme 4 More Optimize & Application Scenario Li Chen Xidian University 2/13

3 Multikey Homomorphic Encryption from NTRU References [1] Damien Stehlé and Ron Steinfeld. Making ntru as secure as worst-case problems over ideal lattices. In Advances in Cryptology EUROCRYPT 2011, pages Springer, [2] Adriana López-Alt, Eran Tromer, and Vinod Vaikuntanathan. On-the-fly multiparty computation on the cloud via multikey fully homomorphic encryption. In Proceedings of the 44th symposium on Theory of Computing, pages ACM, [3] Vadim Lyubashevsky and Daniele Micciancio. Generalized compact knapsacks are collision resistant. In Automata, Languages and Programming, pages Springer, Claim: Our slides are based on reference [1], [2] Li Chen Xidian University 3/13

4 1 Variant of NTRU Encryption Notations & Public Parameters: security parameter κ. a prime q = q(κ). a ring R Z[x]/ x n + 1, and a ring R q R/qR = Z q[x]/ x n + 1. B-bounded polynomial, f R, if f B. a B-bounded distribution χ over the ring R, i.e. Pr[ f B : f χ] = 1 ε, where ε is negligible. Li Chen Xidian University 4/13

5 KenGen(1 κ ) : sample bounded polynomials f, g χ, and set f = 2f + 1 (so that f 1 (mod 2)). Set h = 2gf 1 R q, then public key pk={h}, secrete key sk={f} (if f is not invertible over R q, resample f ). Enc(m, pk) : Suppose the plaintext m {0, 1}, sample bounded polynomials s, e χ. Output ciphertext c hs + 2e + m R q. Dec(c, sk) : Let µ = cf R q, output m µ mod 2. Correctness: µ = cf = (hs + 2e + m)f = 2gf 1 sf + 2ef + mf = 2gs + 2ef + mf Since 2gs + 2ef + mf < q 2, µ mod 2 = mf mod 2 = m. Where µ means the L norm of µ mod x n + 1. Li Chen Xidian University 5/13

6 Lemma 1.1 ([3]) Let n N, φ(x) = x n +1, and R Z[x]/ φ(x). For arbitrary s, t R, s t (mod φ(x)) n s t s t (mod φ(x)) n s t Parameter Setting: Since g, s, f, e are all bounded by 2B + 1, then gs (mod ()x n + 1) and fe (mod ()x n + 1) are bounded by n(2b + 1) 2, thus 2gs + 2ef + mf (mod ()x n + 1) is bounded by 4n(2B + 1) 2 + 2B + 1 < 40nB 2. So, for a fresh ciphertext to be decrypted correctly, we only to set q > 80nB 2. Li Chen Xidian University 6/13

7 2 Somewhat homomorphic from NTRU Initiation: Let (h 1, f 1), (h 2, f 2) be two public-secret key pairs. Given two plaintext bits m 1, m 2, let c 1 = Enc(m 1, h 1), c 2 = Enc(m 2, h 2), i.e. c 1 = h 1s 1 + 2e 1 + m 1, c 2 = h 2s 2 + 2e 2 + m 2. f 1f 2(c 1 + c 2) = 2[gs(f 1 + f 2) + f 1f 2(e 1 + e 2)] + f 1f 2(m 1 + m 2) f 1f 2(c 1c 2) = 2[2g 1s 1g 2s 2 + 2g 1s 1f 2e 2 + 2g 2s 2f 1e 1 +g 1s 1f 2m 2 + g 2s 2f 1m 2 + e 1f 1f 2m 2 + e 2f 1f 2m 1] +f 1f 2m 1m 2 Thus by setting a proper q such that there is no wrap-around modulo q, then, m 1 + m 2 Dec(c 1 + c 2, f 1f 2)) m 1m 2 Dec(c 1c 2, f 1f 2) Li Chen Xidian University 7/13

8 Notation: Let (h i, f i ), i = 1,, N be N public-secret key pairs, m 1, m 2,, m N be N plaintext bits, c 1, c 2,, c N be the ciphertexts respectively encrypted using public key h 1, h 2,, h N, i.e. c i = h i s i + 2e i + m i, i = 1,, N. To decrypt c 1 + c c N and c 1c 2 c N, the minimum joint key need is N i=1 f i. Let c = c 1c 2 and c = c 2c 3, to decrypt c we need joint key f 1f 2, to decrypt c we need joint key f 2f 3. To decrypt c + c we need joint key f 1f 2f 3, to decrypt c c we need joint key f 1f 2 2 f 3. Let D be the degree of the evaluated circuit, N be the number of parties involved, The size of the joint key need to decrypt an evaluated ciphertext grows exponentially both with D and N. The exponential grow dependant on N can not be eliminate, but that dependant on D can be eliminate. Li Chen Xidian University 8/13

9 3 Optimized Scheme KenGen(1 κ ) : Sample bounded polynomials f, g χ, and set f = 2f + 1. Set pk h = 2gf 1 R q, sk f For all τ [0,, log q ], sample s τ, e τ χ, and compute γ τ = hs τ + 2e τ + 2 τ f R q. Set ek = (γ 0,, γ log q ) Enc(m, pk) : Suppose the plaintext m {0, 1}, sample bounded polynomials s, e χ. Output ciphertext c hs + 2e + m R q. Dec(c, sk 1,,, sk N ) : sk i = f i, compute µ = cf 1 f N R q, output m µ mod 2. Li Chen Xidian University 9/13

10 Add(c 1, K 1, c 2, K 2, ) : Output c add c 1 + c 2 and K add = K 1 K2. Mult(c 1, K 1, c 2, K 2, ) : Compute c 0 = c 1c 2 R q, and let K 1 K2 = {pk i1, pk i2,, pk ir }. If K 1 K2 =, c mult c 0. Otherwise, for j [r] and τ [0, log q ], define c j 1,τ, such that c j 1 = log q c j 1,τ 2 τ is the binary representation of c j 1. For each pk ij = f ij, let ek ij = (γ ij,0,, γ ij, log q ), where γ ij,τ = hs τ + 2e τ + 2 τ f ij. Then let c j = log q Finally, output c mult = c r, and K mult = K 1 K2. c j 1,τ γ ij,τ Li Chen Xidian University 10/13

11 Correctness: Let f K1 = f i K i, f K2 = 1 f i K i, and F 0 = f K1 f K2, F j = F j 1 f 1 2 i j, for j = 1, 2,, r. Obviously, F r = f i K i. Just need to show F mult r c r = F 0 c 0 (mod 2). F j c j = f ij F j (f ij ) 2 (f ij c j ) = F j 1 (f ij ) 2 (f ij c j ) = F j 1 (f ij ) 2 ( log q ) c j 1,τ (γ ij,τ f ij ) Since γ ij,τ f ij = 2(g ij s ij,τ + f ij e ij,τ ) + 2 τ f 2 i j = 2E τ + 2 τ f 2 i j, we have, F j c j = F j 1 (f ij ) 2 ( log q ) c j 1,τ (2E τ + 2 τ fi 2 j ) log q ) log q = 2 (F j 1 (f ij ) 2 c j 1,τ E τ + F j 1 c j 1,τ 2 τ log q ) = 2 (F j 1 (f ij ) 2 c j 1,τ E τ + F j 1 c j 1 Li Chen Xidian University 11/13

12 4 More Optimize & Application Scenario Internal Discussed... Li Chen Xidian University 12/13

13 Thanks! & Questions?