Fully homomorphic encryption scheme using ideal...

Fully homomorphic encryption scheme using ideal lattices

Gentry’s STOC’09 paper - Part I

( ) : On input 1 , outputs a pair of keys, , .

: On input a public key and a plaintext ,

outputs a ciphertext . We write ( , ). T

Homomorphic encryption

pk Mpk

ψ ψ π

KeyGen

Encrypt

Encrypthe plaintext space may depend on .)

: On input a secret key and a ciphertext , outputs a plaintext . We write ( , ).

: On input a circuit , public key

pkM pk

ψπ π ψ

←Decrypt

Decrypt

Evaluate

, ciphertexts ( , , ), outputs a ciphertext. We write , , , , .

tpk Cψ ψ

ψ ψ ψ…

← …Evaluate

( )1 1

, , . The scheme is if for ancorrect for circuit y

plaintexts , , and any ciphertexts ( , , ) with ( , ), it holds th

Correctness

pkπ π ψ ψ

… …

KeyGen Encrypt, Decrypt Evaluate

Encrypt

( )( ) ( )

: , , , ,

, , , t

ψ ψ ψ

π π ψ

… =⇒

…Evaluate

Decrypt

( ) , , .

The scheme is if the output ciphertext of is independent (in le

compactngth) of the input circuit ; more specificly,

Compactness

Evaluate

Decrypt

( )( )

n be expressed as a circuit of size poly( ).

This is to avoid trivial solutions such as: , , , , simply returns

: , , , as the ciphertext.

, decrypts

ψ ψ ψ

Evaluate

Decrypt

each to and computes

, , .i i

π π…

( ) , , .

: a class of circuits (including the identity circuit).

is if is correct and compact for every circu

-homomorphiit i

Fully homomorphic encryption

somewhat homomorphic

fully h

is if it is -homomorphic for set of circuits .

is if it is homomorphic for circuits (i.e., -homomorphic for the set of all circui

omomorphic

C s ).C

( ) ( ) ( ) ( ) ( )

A family of schemes : is said to be

iff: all

leveled fully homo schemes u

se hie

Leveled fully homomorphic encryptiond d d d d

Σ ∈

KeyGen Encrypt , Decrypt Evaluate

ame decryption circuit, is homomorphic for all circuits of depth up to (that use some specified set of gates), the computational complexity of 's algorithms is polynomia

( )l in , , and (in the case of ) the size of .

λ Evaluate

The concept of fully homomorphic encryption, originally called was proposed by Rivest, Adleman and Dertouzos in 1978 (one yea

r after vacy homomorph

Homomorphic encryption before Gentry•

RSA was published).

Homomorphic encryption schemes before 2009: Multiplicatively homomorphic:

AdditivelRSA, ElGammal, etc.

Goldwasser-Micali, Paillier, etc.y homo

morphic:Quadratic p

Boneh-Goh-Nissim but with "Polly Craker" by Fellows and Koblit

olynomials:Arbitrary circuits exponential ciph

z (poly-size, depth

ertext-size:

NC (log ), using bounded fan circu iits -O n

n AND, OR, and NOT gates): Sanders-Young-Yung

In 2009, Gentry proposed the first FHE scheme.

Three steps: Building a somewhat homomorphic encry

ption scheme using ideal lattices a

Gentry's fully homomorphic encryption scheme•

shing the Decryption Circuit Bootstrapping

Bootstrapping

{ } { }

AND, XOR , i.e., , , is a complete set of gates, from which any Boo

Fa If an encryption scheme is -homomorphic, then

lean function can be constructed.

Why does SH not imply FH?

• + ×

t is fully homomorphic.

Ciphertexts typically contain an "error" or "noise". When operations are performed on ciphertexts, errors grow. When the error becomes too large, the c

t cannot be correctly decrypted.

Key: a large odd integer .

Encryp( , ): To encrypt a bit wh

0,1 , let 2 ,2 . 2 is the no

ere , are random with 0

Decryp( , ): let mod mod 2.

Examplep

c pq r mr p

p m mq r

• ∈

1 1 2 2 2 2

1 2 1 2 1 2

1 2 1 2 1 2 1 2 1 2

2 2 , then is a ciphertext of , with noise 2( ), and

is a ciphertext of , with n

What if the no

oise 2(2 ).

The no ise gro

c s be e

r m c pq r mc c m m r rc c m m r r r m m r

+ = + ++ + +

omes too large, say 2 ?r p>11

{ } Can we have a -homomorphic encryption scheme ?

That is, the ciphertexts output by is a

without noises growin

fresh as those output by (in terms of amount o

Challenge

EvaluateEncrypt noise).

Such a scheme will automatically be fully homomorphic.

Gentry proposed a simple yet powerful strategy to achieve that (no noise gro Boot

wi sng tr): ap

In a nut shell, bootstrapping is to perform (augmented) homomorph y

icall .

Bootstrapping•

Decrypt

EvaluateDecrypt

Pink box: encrypted under pkA. Blue box: encrypted under pkB.

We can allow anyone to convert a ciphertext under key pk into a ciphertext under key pk w/o revealing the message.

If we can evaluate homomorphically•

decrypt

fresh May use WeakEncrypt

Decrypt

skA c1 skA c2

m1 NAND m2

c1, c2 are ciphertexts of m1, m2 under key pkA

: a gate (with input and output in the plaintext space). -augmented decryption circuit: illustrated below.

-augumented decryption circuitgg

g••

NAND-augmented Decrypt:

Decrypt

skA c1 skA c2

m1 NAND m2

Encrypt all input using pk (figuratively, put them

in a blue box). Evaluat AND-Decrye We obtain a "fresh" ciphertext of NAND under key

If we can evaluate NAND-Decrypt homomorphically

••• Bk .

Evaluate

then from the ciphertexts of and under , we can obtain a "fresh" ciphertext of under key , provided that the encryptio

If we can evaluate NAND-Decrypt homomorphically...

m m pkm m pk

under is given.

That is, we can perform homomorphically without increasing the noi e

1 2 3 4

with , , , encrypted under pk , pk , , .. , ,

Suppose we want to evaluate this circuit homomorphically, m m m

ψ ψ ψ ψEvaluate

skA m1 m2

Evaluate D

ecrypt-NA

skA m3 m4

Evaluate D

ecrypt-NA

Evaluate D

ecrypt-NA

D m2 ) N

D (m3 N

D m4 )

( ) , , .

: a set of gates (with input/output in the plaintext

space).

( ) : the set of -augmented , .

: a class of circuit

Bootstrappable encryption

D g gΣ

Γ ∈Γ

Decrypt

bootstrappable with respect to

s (including the identity circuit).

Suppose is -homomorphic.

is said to be if ( ) .

If is bootstrappable w.r.t. a complete

set of gates (including th

• Σ

{ }( )

e identity gate), then we can construct a leveled fully homomorphic

family of schemes : (for circuits with gates in ).d d +Σ ∈ Γ20

( ) ( ) ( ) ( )

Assume , , is bootstrappable w.r.t. a set of gates . We construct from

: homomorphic for circuits of depth

d d d d

Σ ≤

KeyGen Encrypt , Decrypt E( )( )

//The same algorithm for all .// Use to generate 1 key pairs ( , ), 0 . Represent as a sequence o

f plaintexts: ( , , ).

i i i i

dd sk pk i d

sk s k sk

+ ≤ ≤=

( )0 1

Encrypt (each element of) , .

Secret key: .

Public key: , .

i i i i

di ii d i d

sk sk pk sk

pk pk sk

≤ ≤ ≤ ≤

: Encrypt

d pk pkpk

k k sks

Decryption key

Encryption key

The rest are the evaluation key

Input: a public key and a plaintext . Output: cipher

text , .

Input: a secret key and a ciphertext . Output: cip e

πψ π

Encrypt

Decrypt

ext , .

Remark: is assumed to be an output of What if was pr

.od ?uced by

skπ ψ

Decryp

Evaluate

Encrypt

( ) ( )

Recursive procudure:

has exactly levels; gates at level are connected to gates at level 1. (

Any circui

f d pth

d dd d

δ δδ

Evaluate

( )( ) ( )

can be converted to such a circuit by inserting identity gates.)

is a tuple of ciphertexts under

Initial call: , , .

d dd d

Evaluate

… under

δΨ ⇒

( )( ) ( ) , , pk Cδ δδ δΨEvaluate

level δ level 1

encryptedunder

Ψ ⇒

augmented with decryption circuits Cδ

Decrypt circuits

level δ level 1

underencrypted under

, skpk

Ψ ⇒ ⇒Ψ

Decrypt circuits

1Cδ −

level 1 level 1δ −

1Cδ −

( )( 1) ( 1)1 1Call , , pk Cδ δ

δ δ− −

− −Ψ Evaluate

level 1 level 1δ −

−Ψ ⇒

( )( )

(0) (0)0 0

When simply return

which is under and can be dec

rypted w .

dpk sk sk

pk Cδ = Ψ

ΨEvaluate

δ δΨ ⇒ ⇒Ψ

{ }( )

Theorem. If is bootstrappable w.r.t. a complete set of gates (including the identity gate), then the family

: constructed above is leveled fully homomorphic

Correctness

Σ ∈

circuits with gates in ).

That is, correctly evaluate any circuit (composed of gates in ) of depth at most

Γ• Decrypt

Theorem. For a circuit of and (the number of wires), the time complexity of evaluating is dominated by ( ) applications of

depth si

and ( ) applications

ze Complexity

O s l O s

d s•

⋅ Encryptof to ( )-augmented decryption circuits,

where ( ) is the number of "bits" of each ciphertext and sk.

Remark: If the given circuit has depth and size s, it can be converted

∈Γ=

Evaluate

into a circuit of depth and size at most .

Theorem. For a circuit of and (the number of wires), the time complexity of evaluating is dominated by

depth si

( ) applica

O s l d

⋅ ⋅

≤•

ns of and ( ) applications of to ( )-augmented decryption circuits.

O s dg

⋅∈Γ

EncryptEvaluate

Theorem. If is semantically secure, then is semantically secure for each .

Two questions:

What's the meaning of semantic security fo

r homomorphic

Security

d d• Σ

encryption schemes?

How to prove the theorem

Challenger: on input the security parameter , generates a key pair ( , ),

sends to the adversary.

Adversary: produces two me

Semantic security game for public-key encryption

pk skpk

0 1ssages , , and sends them to the challenger.

Challenger: chooses a random bit {0, 1} and sends Enc ( ) to the adversary.

Adversary: determines whether 0 o

Question:

←←

this model apply to homomorphic encryption?

Is it different from that for ordinary public-key encryption? We will argue that it is the same.

Since ciphertexts may be produced by

Semantic security for homomorphic encryption •

• Evaluate

0 01 0

1 11 1

a natural modification to the model is to let the adversary provide a circuit and two inputs ( , , ), ( , , ).

The challenger chooses {0,1}, encrypts as , r ns u

C m mm m

…= …

←←

m ψEva , and gives to the

adversary as the challenge ciphertext.

The challenger may simply give as the challenge ciphertext, since the adversary can

(pk, , )

(pk, run

t, ) i s

•←

Evaluate elf.34

So, the semantic security game for homomorphic encryption is the same as the semantic security game for ordinary pub

lic-key encryption.

It has been shown t

multi-ciph

hat an alg

• A that breaks the semantic security of the game with multiple ciphertexts can be used to construct an algorithm B that breaks the semantic security of the ordinry game. That is, break ing s

Therefore, to prove semantic se

ingle-ciphertext semantic secu

curity of a homomorphic encry

rity breaking mult

ption scheme, we c

i-cipher

an just

text semantic s

use the semanti

ordinary public-key encryption.

Theorem. If is semantically secure (and bootstrappable), then is semantically secure for each .

These encrypted

Why is it not trivial?

pk pkpk

sksk sk

• Σ

keys might leak information about the ciphertext (under ), unless we prove otherwise.

( ) Game is the same as the game for except that each ,

1, is replaced by some unrelated to :

( , ) (1 )

Semantic Security Game , 0.d

d i sk pksk pk

′≥ ≥

′ ′ ←

≥ ≥

KeyGen

tion of under

Game game for . Game 0 game for .

pk pkpk

sk kk s

−′

= Σ = Σ

To prove the theorem, assume the existence of an adversary that has a non-negligible advantage against (Game 0). We construct an algorithm that breaks (Game ) with a non-negligib

le advantage. ( will use as a "subroutine".) Let ( ) 's advantage in Game .

Apparently, ( ) ( ) ( ). Two cases:

( ) is non-negligible ( breaks and we are d

B AA k

ε λε λ ε λ ε λ

=≤ ≤ ≤

). ( ) is negligible.

Assume ( ) is negligible. There must exist a 0 such that ( ) is non-negligible and ( ) is negligible.

Fix this and con

sider Games an d 1.

ε λε λε λ ε λ+

( ) is non-negligible and ( ) is negligible.

insecure against , but

pk pk pk pk

sk skA

ε λ ε λ+

Game against

So, can help us distinguish betw

Three players, tw

secure if is

o games:

een and .

hallenger)

replaced b

ersary) (cha

( )Game against

llenger) (adversary)

Remark: between and is a multi-ciphertext game.

( ) is non-negligible and ( ) is negligible.

insecur e if

secure

pk pk pk

sk sk sk

1 1 can help us distinguish betw

een and .

k kA sk sk

skψ +

0 1 1 1

Game against

(challenger) 1. generate , ; send , to ;2. send to ; ( is t

(adversary)5.8. o

Cpk sk sk sk C

B Bπ π+ +

′= =

Game aga

guess , with 's help);6. choose ; if then 0 else 1;7. sen

(challenger)

d ( ) to ; . send to .

(adversary)

b Ab b b

E B b C

β βψ π

′ ′ ′= = =′←

set up the game with ; 11. send plaintexts , to ; replace by ; 13. send its guess to ;

rep. lace by ; s0 1 .

A Bpk pk B

π πβ

′ ′

end the "keys" to ; choose and send ( ) to ;12.

AE Aββ ψ π′ ′← 41

( )In summary, if has a non-negligible advantage against , then has a non-negligible advantage against the multi-ciphertext version of , from which one can construct an algorithm ' a

ainst (the single-ciphertext version of) with a non-negligible advantage. This proves the theorem.

Theorem. If is semantically secure (and bootstrappable), then is semantically secu

re for each .d

( ) The public key of (including the evaluation key) contains 1 -public keys and a chain of encrypted -secre

Question: why don't w

t keys.

e use j

Can we use just one pair of keys? d

d dΣ•

+ ΣΣ

1 0 0 0 01

1 1 0 0 0

one pair o

d pk pk pk pk pkpk

sk sksk sksk sk

{ } ( )

( )0 0 0 0 0

Theorem. If is KDM-secure, then we can shorten to

, , with , . Then, all

are the same and we have

FHE schan

Leveled FHE becomes FHE if is KDM-secured

pk sk sk pk sk

← Σ

Encrypt

1 0 0 0 00

1 1 0 0 0

pk pk pk pk pkpk

sk sk sk sk kk sks sk

KDM-Security

(KDM: Key-Dependent Message)

[ ] ( )

In the IND-CPA game,

1 , , , ( ) : Pr wins Pr .

(1 ), {0,1}, ,

Define the to be Pr wins 1 2 .

An enc

y's advantag

Recall: IND- CPA (semantic security)

EbA m m E

Ak G b m

= ← ← ←

negligibleyption scheme is IND-CPA if all polynomial-time

adversaries have advantages.

Remark: The game for asymmetric encryption is sim . ilar•

Semantic security assumes that the messages to be encrypted are independent of the secret key.

Suppose ( , , ) is semantically secure (IND-CPA). Suppose we modify the encryption algorit

• Σ =hm such that

0 ( ) if ( )

1 otherwise

Q: Is ( , , ) semantically sec

is apparently insecure if it is used to encrypt the

, and potentially in

key is

E m m kE m

≠′ =

′ ′Σ =•

• ′Σ

ecure if used to encrypt key-dependent messages.

This suggests the notion of KDM security.•47

Parameters: security parameter , an integer 0, a class of functions that map secret keys to a message.

Setup. The challenger chooses a ran

KDM-security game (for asymmetric encryption)n

C nλ•

dom bit {0, 1}, generates key pairs ( , ), , ( , ), and sends public keys ( , , ) to the adversary.

Queries. The adversary issues queries of the form ( , ) with

bn pk sk pk sk

i fi n

←…

≤ ≤

nd . The challenger responds with( , ) if 0

where ( , , ).( , 0 ) f 1

Finish. The adv ersary guesses whether 0 or 1.

f CE pk m b

c m f sk skE pk i b

b b•

=← =

A public-key encryption scheme is if all polynomial-time adversaries have negligible advantages in

-way KDM-securewith re

the KDM-security gamespect

oneh et al (Crypto'

KDM-securityn

08) proposed a KDM-secure encryption scheme w.r.t. the following class of functions: all constant functions: ( , , ) for . all selector functions ( , , ) for 1 .

f x x m m Mf x x x i n

= ∈= ≤ ≤

KDM-security for this class of functions implies semantic security as well as circular security. (In circular security, we have a cycle of key pairs, and we are allowed to encrypt ch

( mod ) 1 , 1 , under ). i i nsk i n pk +≤ ≤

The KDM-security needed to convert leveled FHE to FHE is circular security for some 0.

Since the underlying SHE is bootstra

ppable, using multiple key-pairs

The KDM-security needed for FHE

( 1) does not seem to be more secure than using just one pair ( 1). Why?

Fully homomorphic encryption scheme using ideal...

Documents

Transcript of Fully homomorphic encryption scheme using ideal...

WRF exercise 1 Kessler μ-physics scheme vs Thompson μ-physics scheme Isaac Hankes Joseph Ching.

Dynamic-Content Web Caching with Cooperative Proxy Scheme

A Tour of Scheme in Gambit

RSA Encryption Packet 2

Homomorphic Encryption with Graph Reductions Achieving ......Optimizing 2-Input Graphs Given a graph with two input nodes and some desired outputs, ﬁnd the best graph to compute

1 A Scheme Interpreter on a Microcontrollerprog.vub.ac.be/~cderoove/project/armpit_scheme.pdfoject I 1 A Scheme Interpreter on a Microcontroller runs Armpit Scheme interpreter +/-

Approximation schemes Scheduling problems. Polynomial Time Approximation Scheme (PTAS) Let Π be a minimization problem. An approximation scheme for problem.

l PAPER Advanced Subsidiary C Mark Scheme Paper 1: Pure ...

C09-10 AUTOMATIZARI Scheme Instalatii Automatizate [Compatibility Mode]

Relax, Program in Scheme

Chapter 16 Speech Synthesis Algorithms 16.1 Synthesis based on LPC 16.2 Synthesis based on formants 16.3 Synthesis based on homomorphic processing 16.4.

Optimal Broadcast Encryption from Pairings and LWE - AIST

GFS Vertical Turbulent Mixing Scheme

R.S.A Encryption

The Grothendieck-Riemann-Roch Theorem for Group Scheme ...The Grothendieck-Riemann-Roch Theorem for Group Scheme Actions BERNHARD KOCK˜ Mathematisches Institut II der Universit˜at

GCE MARKING SCHEME - Physics & Maths Tutorpmt.physicsandmathstutor.com/download/Chemistry/A-level...GCE MARKING SCHEME CHEMISTRY AS/Advanced SUMMER 2011 PMT 18 CHEMISTRY - CH5 Q.1

Key-Homomorphic Signatures - and Applications to ... · Key-Homomorphic Signatures Example 1 • Given two signatures ˙1 and ˙2 on m • Valid under pk1 and pk2)Publicly compute

Λ => Scheme for Rubyists. Scheme History Authors: Guy Steele and Gerald Sussman Structure and Interpretation of Computer Programs (SICP) by Abelson &

SCHEME - G Fifth Semester (PG, PT)brlmpolytechnic.edu.in/Downloads/SCHEME - G Fifth Semester (PG, PT... · 5 Metrology and Quality Control β MQC 17530 03 -- 02 03 100 40 25# 10 ...

White-Box Security Notions for Symmetric Encryption Schemessac2013.irmacs.sfu.ca/slides/s14.pdf · 2013. 8. 24. · White-box compilers Let E= (K;E;D) be a symmetric encryption scheme.