a590003

feature of the framework is that it is fully asynchronous: local computations are independent of
the relative ordering of messages coming from different communication channels. This allows
for much simpler modeling and analysis of cryptographic protocols, which does not need a
sequential ordering of all events. Besides making the formal proof of secure computation
protocols more manageable, the framework has also potential efficiency benefits: as messages
can be transmitted as soon as they can be computed (without compromising the security of the
protocol), this may results in distributed protocols with lower latency. As a proof of concept, the
paper analyzes two simple protocols, one for secure broadcast, and one for verifiable secret
sharing, which demonstrate how the framework is capable to deal with probabilistic protocols,
still in a simple and equational way.
Stanford’s work has focused on different forms of homomorphic encryption and began with
introducing a concept called "targeted malleability" which is designed to limit the homomorphic
operations that can be done on encrypted data[13]. The primary motivation for this is to limit
what can be done on ciphertexts. For example, a spam filter operating on encrypted data should
only be allowed to run the spam predicate and nothing else. Several constructions for this
concept have been provided.
Next, Sanford turned to optimizing fully homomorphic encryption. They first developed a variant
of the BGV system that eliminates the need for the expensive modulus switching step[6]. This
variant also enables us to use any modulus, including a power of 2, which can result in more
efficient arithmetic. The resulting system has become known as Brakerski's FHE, named after
the post-doc who developed it as part of the PROCEED program. Along the same lines Stanford
also looked at a recent proposal for FHE due to Bogdanov and Lee which constructs an efficient
FHE from coding theoretic assumptions[14]. They showed that the Bogdanov-Lee proposal is
insecure, and in fact, any construction using their approach will be insecure[15].
Using these new FHE systems the team at Stanford built a prototype system that computes
statistics on encrypted data, such as mean, standard deviation, and linear regression. The
implementation is based on an optimized version of Brakerski's FHE that takes advantage of its
arithmetic properties. Stanford also used large-scale batching to speed-up much of the
computation. The resulting system can perform linear regression on moderate size encrypted data
sets within a few hours on a single laptop. Parallelism can bring this down to a few minutes.
Finally, since the underlying mechanism behind FHE is based on hard problems on lattices,
which are assumed to remain secure in the presence of quantum computers, Stanford looked at
secure cryptographic primitives in the age of quantum computation. In particular, they built
Message Authentication Codes that remains secure even when the devices using them are
quantum[16]. One of the team’s instantiations is a lattice-based MAC the presumably remains
secure in a post-quantum settings.
4.2 Technology Transitions and Deliverables
The Stanford team developed a prototype system for performing statistical analysis on encrypted
data. Their work focused on two tasks: computing the mean and variance of univariate and
multivariate data as well as performing linear regression on a multidimensional, encrypted
corpus. Due to the high overhead of homomorphic computation, previous implementations of
Approved for Public Release; Distribution Unlimited.
7