Shai Halevi IBM August 2013

Transcription

1 Shai Halevi IBM August 2013

2 I want to delegate processing of my data, without giving away access to it.

3 I want to delegate the computation to the cloud, I want but the to delegate cloud the shouldn t computation see to my the input cloud Enc(x) f Enc[f(x)] Client Server/Cloud (Input: x) (Function: f)

4 Rivest-Adelman-Dertouzos 1978 Plaintext space P Ciphertext space C x 1 x 2 c i Enc(x i ) c 1 c 2 * # y y Dec(d) d Example: RSA_encrypt (e,n) (x) = x e mod N x 1 e x x 2 e = (x 1 x x 2 ) e mod N Somewhat Homomorphic : can compute some functions on encrypted data, but not all

5 Encryption for which we can compute arbitrary functions on the encrypted data Enc(x) Eval f Enc(f(x))

6 An encryption scheme: (KeyGen, Enc, Dec) Plaintext-space = {0,1} (pk,sk) KeyGen($), c Enc pk (b), b Dec sk (c) Semantic security [GM 84]: (pk, Enc pk (0)) (pk, Enc pk (1)) means indistinguishable by efficient algorithms 6

7 H = {KeyGen, Enc, Dec, Eval} c* Eval pk (f, c) Homomorphic: Dec sk (Eval pk ( f, Enc pk (x))) = f(x) c* may not look like a fresh ciphertext As long as it decrypts to f(x) Compact: Decrypting c* easier than computing f Otherwise we could use Eval pk (f, c)=(f, c) and Dec sk (f, c) = f(dec sk (c)) Technically, c* independent of the complexity of f c* 7

8 First plausible candidate in [Gen 09] Security from hard problems in ideal lattices Polynomially slower than computing in the clear Big polynomial though Many advances since Other hardness assumptions LWE, RLWE, NTRU, approximate-gcd More efficient Other Advanced properties Multi-key, Identity-based, 8

9 Regev-like somewhat-homomorphic encryption Adding homomorphism to [Reg 05] cryptosystem Security based on LWE, Ring-LWE Based on [BV 11, BGV 12, B 12] Bootstrapping to get FHE [Gen 09] Packed ciphertexts for efficiency Based on [SV 11, BGV 12, GHS 12] Not in this talk: a new LWE-based scheme [Gentry-Sahai-Waters CRYPTO 2013] 9

10 Many equivalent forms, this is one of them: Parameters: q (modulus), n (dimension) n Secret: a random short vector s Z q Input: many pairs (a i, b i ) a i Z q n is random, b i = s, a i e i (mod q) e i is short Goal: find the secret s Or distinguish (a i, b i ) from random in Z q n1 [Regev 05, Peikert 09]: As hard as some worst-case lattice problems in dim n (for certain range of params)

11 The shared-key variant (enough for us) Secret key: vector s, denote s = s, 1 Encrypt σ {0,1} c = (a, b) s.t. b = σ q 2 Convenient to write s, c = σ q 2 Decrypt(s, c) s, a e (mod q) e (mod q) Output 0 if s, c mod q q/4, else output 1 Correct decryption as long as error < q/4 Security: If LWE is hard, cipehrtext is pseudorandom

12 q If s, c i σ i (mod q) then 2 s, c 1 c 2 (σ 1 σ 2 ) q (mod q) 2 Error doubles on addition Correct decryption as long as the error < q/4 12

13 Step 1: Tensor Product q If s, c i σ i (mod q) and s is small ( s q) 2 q then s s, c 1 c 2 σ 1 σ 2 2 (mod 4 q2 ) Error has extra additive terms of size s q q 2 So c = round((c 1 c 2 )/ q 2 ) encrypts σ 1σ 2 relative to secret key s = (s s) Rounding adds another small additive error But the dimension squares on multiply

14 Step 2: Dimension Reduction Publish key-switching gadget to ranslate c wrt s c wrt s Essentially an encryption of s under s n n 2 rational matrix W s.t. s T W s (mod q) Given c, compute c Round W c (mod q) s, c s T W c s, c σ q 2 (mod q) Some extra work to keep error from growing too much Still secure under reasonable hardness assumptions

15 Error doubles on addition, grows by poly(n) factor on multiplication (e.g., n 2 factor) When computing a depth-d circuit we have output-error input-error n 2d Setting parameters: Start from input-error n d (say) Set q > 4n d n 2d = 4n 3d Set the dimension large enough to get security output-error < q/4, so no decryption errors 15

16 So far, circuits of pre-determined depth x 1 C x 2 C(x 1, x 2,, x t ) x t 16

17 So far, circuits of pre-determined depth x 1 C x 2 C(x 1, x 2,, x t ) x t Can eval y=c(x 1,x 2,x n ) when x i s are fresh But y is an evaluated ciphertext Can still be decrypted But eval C (y) will increase noise too much 17

18 So far, circuits of pre-determined depth x 1 C x 2 C(x 1, x 2,, x t ) x t Bootstrapping to handle deeper circuits We have a noisy evaluated ciphertext y Want to get another y with less noise 18

19 For ciphertext c, consider D c (sk) = Dec sk (c) Hope: D c (*) is a low-depth circuit (on input sk) Include in the public key also Enc pk (sk) sk 1 sk 2 sk n c y Dc Dc(sk) = Dec sk (c) = y Homomorphic computation applied only to the fresh encryption of sk 19 c Requires circular security

20 Similarly define Mc 1,c 2 (sk) = Dec sk (c 1 ) Dec sk (c 1 ) y 1 c 1 y 2 c 2 sk 1 sk 2 sk n Mc 1,c 2 c Mc 1,c 2 (sk) = Dec sk (c 1 ) x Dec sk (c 2 ) = y 1 x y 2 Homomorphic computation applied only to the fresh encryption of sk 20

21 The LWE-based somewhat-homomorphic scheme has depth-o(log qn) decryption circuit To get FHE need modulus q 2 polylog(k) and dimension n Ω(k) k is the security parameter The ciphertext-size is Ω(k) bits Key-switching matrix is of size Ω(k 3 ) bits Each multiplication takes at least Ω(k 3 ) times Ω(k 3 ) slowdown vs. computing in the clear 21

22 Replace Z by Z[X]/F(X) F is a degree-d polynomial with d = Θ(k) Can get security with lower dimension n = Θ k/d, as low as n = 2 The ciphertext-size still Ω(k) bits But key-switching matrix size only Θ(k) bits It includes n 2 n = 8 ring elements Θ(k) slowdown vs. computing in the clear 22

23 Cannot reduce ciphertext size below Θ(k) But we can pack more bits in each ciphertext Recall decryption: ptxt MSB( s, c mod q) ptxt is a polynomial in R 2 = Z X /(F X, 2) Use cyclotomic rings, F X = Φ m X Use CRT in R 2 to pack many bits inside m The cryptosystem remains unchanged Encoding/decoding of bits inside plaintext polys 23

24 Φ m (X) irreducible over Z, but not mod 2 l Φ m X j=1 F j X (mod 2) F j s are irreducible, all have the same degree d degree d is the order of 2 in Z m For some m s we can get l = φ m d = Ω( m log m ) R 2 = Z 2 X /Φ m is a direct sum, R 2 = j R 2,j R 2,j = Z 2 X /F j X GF(2 d ) 1-1 mapping a R 2 α 1,, α l GF 2 d l

25 Plaintext a R 2 encodes l values α j GF(2 d ) To embed plaintext bits, use a j GF 2 GF(2 d ) Ops, in R 2 work independently on the slots l-add: a a α 1 α 1,, α l α l l-mul: a a α 1 α 1,, α l α l If l = Ω(k) then our Θ(k)-bit ciphertext can hold Ω(k) plaintext bits Ciphertext-expansion ratio only polylog(k)

26 x x 1 x 2 x 3 x 4 x 5 x 6 x = x x 4 0 x 6 0 x x 8 x 9 x 10 x 11 x 12 x 13 x = 0 x 9 x 10 0 x 12 0 x 14 x 1 x 9 x 10 x 4 x 12 x 6 x 14 We will use this later

27 SIMD = Single Instruction Multiple Data Computing the same function on l inputs at the price of one computation Overhead only polylog(k) Pack the inputs into the slots Bit-slice, inputs to j th instance go in j th slots Compute the function once After decryption, decode the l output bits from the output plaintext polynomial

28 To reduce overhead for a single computation: Pack all input bits in just a few ciphertexts Compute while keeping everything packed How to do this? August 15,

29 x 1 x 2 x 3 x 4 x 5 x 7 x 8 x 9 x 10 x 11 x 12 x 14 x 15 x 16 x 17 x 18 x 19 x 21 x 22 x 23 x 24 x 25 x 26 Input bits

30 x 1 x 2 x 3 x 4 x 5 x 7 x 8 x 9 x 10 x 11 x 12 x 14 x 15 x 16 x 17 x 18 x 19 x 21 x 22 x 23 x 24 x 25 x 26 Input bits x 1 x 2 x 3 x 4 x 5 x 7 x 8 x 9 x 10 x 11 x 12 x 14 x 15 x 16 x 17 x 18 x 19 x 21 x 22 x 23 x 24 x 25 x 26

31 We need to map this x 1 x 2 x 3 x 4 x 5 0 x 7 x 8 x 9 x 10 x 11 x 12 1 x 14 x 15 x 16 x 17 x 18 x 19 1 x 21 Into that so we can use l-add x 22 x 23 x 24 x 25 x 26 x 1 x 3 x 5 x 7 x 9 x 11 1 x 15 x 17 x 19 x 21 x 23 x 25 x 2 x 4 0 x 8 x 10 x 12 x 14 x 16 x 18 1 x 22 x 24 x 26 Is there a natural operation on polynomials that moves values between slots?

32 The operation κ t : a X a X t R 2 Under some conditions on m, exists t Z m s.t., For any a R 2 encoding a α 1, α 2,, α l, κ t (a) α 2,, α l, α 1 t is a generator of Z m /(2) (if it exists) Once we have rotations, we can get every permutation on the plaintext slots Using only O(log l) shifts and SELECTs [GHS 12] How to implement κ t homomorphically? August 15,

33 Recall decryption via inner product s, c R q If a X = s(x), c(x) mod Φ m X, q then also a X t = s(x t ), c(x t ) mod Φ m X t, q Since Φ m X Φ m X t for any t Z m, then also a X t = s(x t ), c(x t ) mod Φ m X, q Therefore c = κ t (c) is an encryption of a = κ t (a) relative to key s = κ t (s) Can publish key-switching matrix W[s s] to get back an encryption relative to s August 15,

34 Native plaintext space R 2 = Z 2 X /Φ m a R 2 used to pack l values α j GF(2 d ) sk is s R q, ctxt is a pair c 0, c 1 2 R q Decryption is a: = MSB( c 0, c 1, s, 1 ) Inner product over R q Homomorphic addition, multiplication work element-size on the α j s Homomorphic automorphism to move α j s between the slots August 15,