Computing with Encrypted Data Lecture 26

Transcription

1 Computing with Encrypted Data Lecture 26

2 Encryption for Secure Communication M Message M All-or-nothing Have Private Key, Can Decrypt No Private Key, No Go cf. Non-malleable Encryption

3 Encryption for Cloud Computing Data Analysis & Statistics, Classification, Search, Image Processing, Compute Function F Medical, Financial and other Personal Information Enc(Data) Enc(F(Data)) Cloud Need: Privacy + Functionality

4 Fully Homomorphic Encryption Compute arbitrary functions on encrypted data? Enc(data), F Enc(F(data))

5 Outline Homomorphic Encryption Multiplicative Homomorphism: El Gamal Additive Homomorphism: Goldwasser-Micali Fully Homomorphic Encryption: based on NTRU What Computing I didn t on tell Secret you (and Shares how to learn more) Secure Multiparty Computation: the BGW protocol [Ben Or-Goldwasser-Wigderson 88]

6 then we are done. FHE: The Big Picture Function Arithmetic Circuit x 1 x 2 + x 3 (x 1 +x 2 ) x 3 If we had: Enc(x 1 ), Enc(x 2 ) Enc(x 1 +x 2 ) Enc(x 1 ), Enc(x 2 ) Enc(x 1 x 2 )

7 Multiplicative Homomorphism El Gamal Encryption Setup: Group G of prime order p (e.g., set of quadratic residues mod q where q = 2p+1)

8 Multiplicative Homomorphism El Gamal Encryption Setup: Group G of prime order p (e.g., set of quadratic residues mod q where q = 2p+1) X is an encryption of the product m 1 m 2

9 Additive Homomorphism Goldwasser Micali Encryption Public key: N, y: non-square mod N Secret key: factorization of N Enc(0): r 2 mod N, Enc(1): y * r 2 mod N square (0) * square (0) = square (0) non-square (1) * square (0) = non-square (1) square (0) * non-square (1) = square (1) non-square (1) * non-square (1) = non-square (0) XOR-homomorphic: Just multiply the ciphertexts

10 Other HE Schemes Additively Homomorphic: Paillier Damgard-Jurik (both addition of large numbers) Additions + a single Multiplication: Boneh-Goh-Nissim (based on gap groups) Gentry-Halevi-V. (based on lattices) HE with Large ciphertext blowup: Sander-Young-Yung

11 How to Construct an FHE Scheme

12 The Big Picture STEP 1 Somewhat Homomorphic (SwHE) Encryption [Gen09,DGHV10,SV10,BV11a,BV11b,BGV12,LTV12,GHS 12] Evaluate arithmetic circuits of depth d = ε log n * C d = ε log n EVAL * (0 < ε < 1 is a constant, and n is the security parameter)

13 The Big Picture STEP 2 Bootstrapping Theorem [Gen09] (Qualitative) Homomorphic enough Encryption * FHE Homomorphic enough = Can evaluate its own Dec Circuit (plus some) msg Dec C CT sk Decryption Circuit EVAL

14 The Big Picture STEP 1 STEP 3 Somewhat Homomorphic (SwHE) Encryption [Gen09,DGHV10,SV10,BV11a,BV11b,BGV12,LTV12,GHS 12] Evaluate arithmetic circuits of depth d = ε log n Depth Boosting / Modulus Reduction [BV11b] Boost the SwHE to depth d = n ε STEP 2 Bootstrapping Method Homomorphic enough Encryption * FHE Homomorphic enough = Can evaluate its own Dec Circuit (plus some)

15 The NTRU Encryption Scheme [Hofstein-Pipher-Silverman 97] Central characters: Polynomials mod q Polynomials of degree less than n (think n = 256) Coefficients over Z q (think q = small prime) Addition: coefficient-wise (6x 2 +5x+10) + (5x 2 +x+2) = 6x+1 (mod 11) Multiplication: polynomial mult, modulo an irreducible (6x 2 +5x+10) X (5x 2 +x+2) = 9x 3 +x 2 +9x+9 (mod 11, x 4 +1) Ring (x n +1 cyclotomic, q = 1 mod 2n prime)

16 The NTRU Encryption Scheme KeyGen: Sample small polynomials f, g R q (s.t. f=1 mod 2) coefficients B Secret key SK=f and Public key PK=h=2g/f Encryption Enc pk (m), where Multiplying m {0,1} by f kills h Sample small polynomials s, e R q, output C = hs + 2e + m (mod q, x n +1) Decryption Dec sk (C): Output (fc (mod q,x n +1)) mod 2. Correctness: fc = f(hs+2e+m) = 2(gs+fe) + fm (mod q, x n +1) If 2(gs+fe) + fm < q/2, taking mod 2 gives m.

17 The NTRU Encryption Scheme The Small Polynomial Ratios (SPR) Assumption: Choose two polynomials f and g with small coefficients (of magnitude at most B). Then, g/f c uniform over R q The key security parameter: The signal-to-noise ratio q/b If q/b is too large (> 2 n ), we can break NTRU in poly time. Theorem: The encryption scheme is secure under the SPR assumption

18 Additive Homomorphism c 1 = hs 1 +2e 1 +m 1 c 2 = hs 2 +2e 2 +m 2 f.c 1 = 2E 1 + fm 1 f.c 2 = 2E 2 + fm 2 Add the ciphertexts: c add = c 1 + c 2 (over R q ) + f.c 1 = 2E 1 + fm 1 f.c 2 = 2E 2 + fm 2 f.(c 1 +c 2 ) = 2(E 1 +E 2 ) + f.(m 1 +m 2 ) E Dec f (c add ) = 2E + f.(m 1 +m 2 ) (mod 2) = f. (m 1 +m 2 ) (mod 2)

19 Multiplicative Homomorphism c 1 = hs 1 +2e 1 +m 1 c 2 = hs 2 +2e 2 +m 2 f.c 1 = 2E 1 + fm 1 f.c 2 = 2E 2 + fm 2 Multiply the ciphertexts: c mlt = c 1.c 2 (over R q ) X f.c 1 = 2E 1 + fm 1 f.c 2 = 2E 2 + fm 2 f 2.(c 1 c 2 ) = 2(E 1 m 2 +E 2 m 1 +2E 1 E 2 ) + f 2 (m 1 m 2 ) E Dec f^2 (c mlt ) = 2E + f 2 m 1 m 2 (mod 2) = f 2 m 1 m 2 (mod 2)

20 Noise Growth Assume the input ciphertext noise is at most B. Addition: norm of E 1 +E 2 is at most 2B Multiplication: noise E 1 E 2 Norm of E 1 E 2 is at most nb 2

21 How Homomorphic is this: The Reservoir Analogy noise=q/2 Additive Homomorphism: B 2B Multiplicative Homomorphism: B nb 2 nb 2 AFTER d LEVELS: noise B (worst case) 2B initial noise=b noise=0 Correctness SPR with q/b ratio 2 n^ε

22 How Homomorphic is this: The Reservoir Analogy noise=q/2 Additive Homomorphism: B 2B Multiplicative Homomorphism: B nb 2 nb 2 AFTER d LEVELS: noise B (worst case) initial noise=b noise=0

23 The Big Picture STEP 1 STEP 3 Somewhat Homomorphic (SwHE) Encryption [Gen09,DGHV10,SV10,BV11a,BV11b,BGV12,LTV12,GHS 12] Evaluate arithmetic circuits of depth d = ε log n Depth Boosting / Modulus Reduction [BV11b] Boost the SwHE to depth d = n ε STEP 2 Bootstrapping Method Homomorphic enough Encryption * FHE Homomorphic enough = Can evaluate its own Dec Circuit (plus some)

24 Bootstrapping Bootstrapping Theorem [Gen09] If you can homomorphically evaluate depth d circuits and the depth of your decryption cicuit < d * FHE

25 Bootstrapping Bootstrapping Theorem [Gen09] Homomorphic d-he with decryption enough depth Encryption < d * FHE FHE Bootstrapping = Valve at a fixed height noise=q/2 (that depends on decryption depth) Say n(b dec ) 2 < q/2 noise=b dec noise=0

26 Bootstrapping Bootstrapping Theorem [Gen09] Homomorphic d-he with decryption enough depth Encryption < d * FHE FHE Bootstrapping = Valve at a fixed height noise=q/2 (that depends on decryption depth) Say n(b dec ) 2 < q/2 noise=b dec noise=0

27 Bootstrapping: How But the evaluator (cloud) does not have SK! Best Possible Noise Reduction = Decryption! m Noiseless ciphertext Dec Very Noisy ciphertext CT SK Decryption Circuit

28 Bootstrapping, Concretely Next Best = Homomorphic Decryption! * Assume Enc(SK) is public. (OK assuming the scheme is circular secure ) Enc PK (m) Noise = B dec B dec Independent of B input Dec Noise = B input CT Enc PK (SK)

29 Wrap Up: Bootstrapping Assume Circular Security: Public key contains Enc SK (SK) Function f g

30 Wrap Up: Bootstrapping Assume Circular Security: Public key contains Enc SK (SK) Function f g Each Gate g Gadget G: g(a,b) g g(a,b) a b g Dec Dec a b c a sk c b sk

31 Wrap Up: Bootstrapping Assume Circular Security: Public key contains Enc SK (SK) Function f g Each Gate g Gadget G: g(a,b) g Enc(g(a,b)) g Dec Dec a b c a Enc(SK) c b Enc(SK)

32 Wrap-up: FHE STEP 1 STEP 3 Somewhat Homomorphic (SwHE) Encryption [Gen09,DGHV10,SV10,BV11a,BV11b,BGV12,LTV12,GHS 12] Evaluate arithmetic circuits of depth d = ε log n Depth Boosting / Modulus Reduction [BV11b] Boost the SwHE to depth d = n ε STEP 2 Bootstrapping Method Homomorphic enough Encryption * FHE Homomorphic enough = Can evaluate its own Dec Circuit (plus some)

33 Boosting Depth from log n to n ε (in one slide)

34 Wrap-up: FHE STEP 1 STEP 3 Somewhat Homomorphic (SwHE) Encryption [Gen09,DGHV10,SV10,BV11a,BV11b,BGV12,LTV12,GHS 12] Evaluate arithmetic circuits of depth d = ε log n Depth Boosting / Modulus Reduction [BV11b] Boost the SwHE to depth d = n ε STEP 2 Bootstrapping Method Homomorphic enough Encryption * FHE Homomorphic enough = Can evaluate its own Dec Circuit (plus some)

35 What We Didn t Do A Lot! Functional Encryption Software Obfuscation: how to encrypt programs Practical techniques for computing on encrypted data: searchable encryption, deterministic encryption, Secure Multiparty protocols, Come to 6.892!

36 Thanks! Good luck with the project write-ups!