a590003

More documents

Recommendations

Info

[MG02] [Mic02] [MM11] [MR04] [MR09] [Pei09a] [Pei09b] D. Micciancio and S. Goldwasser. Complexity of Lattice Problems: a cryptographic perspective, volume 671 of The Kluwer International Series in Engineering and Computer Science. Kluwer Academic Publishers, Boston, Massachusetts, 2002. D. Micciancio. Generalized compact knapsacks, cyclic lattices, and efficient one-way functions. Computational Complexity, 16(4):365–411, 2007. Preliminary version in FOCS 2002. D. Micciancio and P. Mol. Pseudorandom knapsacks and the sample complexity of LWE search-to-decision reductions. In CRYPTO, pages 465–484. 2011. D. Micciancio and O. Regev. Worst-case to average-case reductions based on Gaussian measures. SIAM J. Comput., 37(1):267–302, 2007. Preliminary version in FOCS 2004. D. Micciancio and O. Regev. Lattice-based cryptography. In Post Quantum Cryptography, pages 147–191. Springer, February 2009. C. Peikert. Bonsai trees (or, arboriculture in lattice-based cryptography). Cryptology ePrint Archive, Report 2009/359, July 2009. http://eprint.iacr.org/. C. Peikert. Public-key cryptosystems from the worst-case shortest vector problem. In STOC, pages 333–342. 2009. [Pei10] C. Peikert. An efficient and parallel Gaussian sampler for lattices. In CRYPTO, pages 80–97. 2010. [PR06] [PV08] C. Peikert and A. Rosen. Efficient collision-resistant hashing from worst-case assumptions on cyclic lattices. In TCC, pages 145–166. 2006. C. Peikert and V. Vaikuntanathan. Noninteractive statistical zero-knowledge proofs for lattice problems. In CRYPTO, pages 536–553. 2008. [PVW08] C. Peikert, V. Vaikuntanathan, and B. Waters. A framework for efficient and composable oblivious transfer. In CRYPTO, pages 554–571. 2008. [PW08] [Reg05] [RS10] [Rüc10] [ST01] C. Peikert and B. Waters. Lossy trapdoor functions and their applications. In STOC, pages 187–196. 2008. O. Regev. On lattices, learning with errors, random linear codes, and cryptography. J. ACM, 56(6):1–40, 2009. Preliminary version in STOC 2005. M. Rückert and M. Schneider. Selecting secure parameters for lattice-based cryptography. Cryptology ePrint Archive, Report 2010/137, 2010. http://eprint.iacr.org/. M. Rückert. Strongly unforgeable signatures and hierarchical identity-based signatures from lattices without random oracles. In PQCrypto, pages 182–200. 2010. A. Shamir and Y. Tauman. Improved online/offline signature schemes. In CRYPTO, pages 355–367. 2001. [Ver11] R. Vershynin. Introduction to the non-asymptotic analysis of random matrices, January 2011. Available at http://www-personal.umich.edu/˜romanv/papers/ non-asymptotic-rmt-plain.pdf, last accessed 4 Feb 2011. 40 4. Trapdoors for Lattices
[vGHV10] M. van Dijk, C. Gentry, S. Halevi, and V. Vaikuntanathan. Fully homomorphic encryption over the integers. In EUROCRYPT, pages 24–43. 2010. [Wat05] B. Waters. Efficient identity-based encryption without random oracles. In EUROCRYPT, pages 114–127. 2005. 41 4. Trapdoors for Lattices
Page 1 and 2:
AFRL-RI-RS-TR-2013-191 ADVANCED HOM
Page 3 and 4:
REPORT DOCUMENTATION PAGE Form Appr
Page 5 and 6:
12. An Equational Approach to Secur
Page 7 and 8:
1.0 Executive Summary The ultimate
Page 9 and 10:
The PROCEED program efforts are bro
Page 11 and 12:
Towards the end of the project we i
Page 13 and 14:
feature of the framework is that it
Page 15 and 16:
4.3 Publications Figure 1: A block
Page 17 and 18:
encrypted data. We introduce a prec
Page 19 and 20:
present an attack showing that a pa
Page 21 and 22:
alternatives: mis (based on mutual
Page 23 and 24:
5.0 Conclusions and Recommendations
Page 25 and 26:
[14] Bogdanov, Andrej, and Lee, Chi
Page 27 and 28:
8.0 List of Symbols, Abbreviations,
Page 29 and 30:
Public Affairs Approvals for papers
Page 31 and 32:
Contents 1 Introduction 1 1.1 Our M
Page 33 and 34:
t j = P (a j ), and finally interpo
Page 35 and 36:
apparent problem by replacing the M
Page 37 and 38:
As noted above, there is a multilin
Page 39 and 40:
f(x 1 , . . . , x n ) ∈ F and eve
Page 41 and 42:
Translation. Pick up from the publi
Page 43 and 44:
Lemma 4. Let prime p = ω(N 2 ). Th
Page 45 and 46:
[vDGHV10] Marten van Dijk, Craig Ge
Page 47 and 48:
have u 2 − v 2 = 1 → (u − v)(
Page 49 and 50:
inary), and we want to compute g c
Page 51 and 52:
Fully Homomorphic Encryption withou
Page 53 and 54:
scheme have bit length Ω(D) to all
Page 55 and 56:
fast. Thus, the actual magnitude of
Page 57 and 58:
Definition 3 (B-bounded distributio
Page 59 and 60:
achieve 2 λ security against known
Page 61 and 62:
Proof. 〈c 2 , s 2 〉 = BitDecomp
Page 63 and 64:
• FHE.Add(pk, c 1 , c 2 ): Takes
Page 65 and 66:
The computation needed to compute t
Page 67 and 68:
If a and b are large enough, B domi
Page 69 and 70:
5.1.2 How Batching Works Deploying
Page 71 and 72:
We have the following lemma. Lemma
Page 73 and 74:
Unpack(c, {τ σi→1 (s 1 )→s 2
Page 75 and 76:
Since ‖e q1 ‖ < r q1 ,in, e q1
Page 77 and 78:
[22] Damien Stehlé and Ron Steinfe
Page 79 and 80:
1 Introduction Fully homomorphic en
Page 81 and 82:
encryptions of the same message usi
Page 83 and 84:
and Tromer [CT10] in a completely d
Page 85 and 86:
is negligible in k, where Expt CPA
Page 87 and 88:
2.3 Non-Interactive Simulation-Soun
Page 89 and 90:
is defined as (state 1 , m 1 , . .
Page 91 and 92:
scheme has almost-all-keys perfect
Page 93 and 94:
The algorithm S 1 . The algorithm S
Page 95 and 96: The distribution D 6 . This distrib
Page 97 and 98: We resolve this issue using the app
Page 99 and 100: the number of common reference stri
Page 101 and 102: • Homomorphic evaluation: The hom
Page 103 and 104: The number of repeated homomorphic
Page 105 and 106: [Gro04] [Gro10] J. Groth. Rerandomi
Page 107 and 108: Trapdoors for Lattices: Simpler, Ti
Page 109 and 110: mentioned, two central objects are
Page 111 and 112: Dimension m Quality s Length β ≈
Page 113 and 114: defined by G (or the semi-random ma
Page 115 and 116: 1.4 Other Related Work Concrete par
Page 117 and 118: Cryptographic problems. For β > 0,
Page 119 and 120: andom over G m s , for uniformly ra
Page 121 and 122: 3 Search to Decision Reduction Here
Page 123 and 124: • Preimage sampling for f G (x) =
Page 125 and 126: Note that for x ∈ {0, . . . , q
Page 127 and 128: The offline ‘bucketing’ approac
Page 129 and 130: G is primitive, the tag H in the ab
Page 131 and 132: conditional distribution of R given
Page 133 and 134: and parallelism of Algorithm 3 come
Page 135 and 136: is a coset of the lattice Λ = L( [
Page 137 and 138: scheme is su-scma-secure if Adv su-
Page 139 and 140: a discrete Gaussian with parameter
Page 141 and 142: • G ∈ Z n×nk q is a gadget mat
Page 143 and 144: must return this e (but possibly di
Page 145: [Gen09b] C. Gentry. Fully homomorph
Page 149 and 150: Contents 1 Introduction 1 2 Backgro
Page 151 and 152: 1 Introduction In his breakthrough
Page 153 and 154: Then in Section 3 we describe our
Page 155 and 156: In some more detail, the BGV key sw
Page 157 and 158: itself has low norm. In BGV [5] thi
Page 159 and 160: 3.4 Randomized Multiplication by Co
Page 161 and 162: One subtle implementation detail to
Page 163 and 164: ciphertexts. Producing the encrypte
Page 165 and 166: [24] Benny Pinkas, Thomas Schneider
Page 167 and 168: A.4 Sampling From A q At various po
Page 169 and 170: To maintain the noise estimate, the
Page 171 and 172: variance σ 2 φ(m), so 2d 2 (ζ)ɛ
Page 173 and 174: We stress that the only place where
Page 175 and 176: C.1.1 LWE with Sparse Key The analy
Page 177 and 178: The Smallest Modulus. After evaluat
Page 179 and 180: down by a factor of p t . Let’s r
Page 181 and 182: to apply a map κ i we express it a
Page 183 and 184: 1 Introduction Fully homomorphic en
Page 185 and 186: 4. No restrictions on the secret ke
Page 187 and 188: We point out that an alternative so
Page 189 and 190: Recall that GapSVP γ is the (promi
Page 191 and 192: Proof. By definition ⟨c, (1, s)
Page 193 and 194: • SI-HE.Enc pk (m): Identical to
Page 195 and 196: Proof of Theorem 4.2. Consider the
Page 197 and 198:
We can now plug in what we know abo
Page 199 and 200:
In particular (recall that E < ⌊q
Page 201 and 202:
[Reg03] Oded Regev. New lattice bas
Page 203 and 204:
1 Introduction An encryption scheme
Page 205 and 206:
need to have errors. Since the expe
Page 207 and 208:
Again we allow some “slackness”
Page 209 and 210:
Learning Linear Functions. the clas
Page 211 and 212:
Let us first outline the proof of T
Page 213 and 214:
P ′ . 4 Namely H n ′ :n = P ′
Page 215 and 216:
In conclusion, we get a sub-scheme
Page 217 and 218:
[BV11b] [Gen09] [Gen10] [GH11] [GHS
Page 219 and 220:
Quantum-Secure Message Authenticati
Page 221 and 222:
the success probability away from 1
Page 223 and 224:
Functions will be denoted by capito
Page 225 and 226:
Quantum chosen message queries. In
Page 227 and 228:
Since the w are the possible result
Page 229 and 230:
number of distinct component values
Page 231 and 232:
4.1 A Tight Upper Bound Theorem 4.1
Page 233 and 234:
The algorithm is similar to the alg
Page 235 and 236:
As we have already seen, for expone
Page 237 and 238:
where S i (m) = (R i (m), PRF(k, (R
Page 239 and 240:
To prove this theorem, we treat Y a
Page 241 and 242:
Now we use this attack to obtain an
Page 243 and 244:
Using this lemma we show that (3q +
Page 245 and 246:
[KK11] Daniel M. Kane and Samuel A.
Page 247 and 248:
1 Introduction Cloud storage system
Page 249 and 250:
subset of the server’s storage, t
Page 251 and 252:
security does not suffice. The main
Page 253 and 254:
Static Data. PoR and PDP schemes fo
Page 255 and 256:
For any efficient adversarial serve
Page 257 and 258:
Overview of Construction. Let (Enc,
Page 259 and 260:
means that one of the audit protoco
Page 261 and 262:
Now we claim that an execution of E
Page 263 and 264:
having higher capacity. The tables
Page 265 and 266:
OWrite(i 1 , . . . , i t ; v 1 , .
Page 267 and 268:
j-th level table again. With this o
Page 269 and 270:
and distribute reprints for Governm
Page 271 and 272:
A Simple Dynamic PoR with Square-Ro
Page 273 and 274:
from Section 6 that is NRPH secure.
Page 275 and 276:
The LWE problem was introduced in t
Page 277 and 278:
1.2 Techniques and Comparison to Re
Page 279 and 280:
(large) uniform errors as in [10],
Page 281 and 282:
Proof. Let A be an algorithm runnin
Page 283 and 284:
that 1 + ɛ = (1 + ɛ 1 )(1 + ɛ 2
Page 285 and 286:
Because we are concerned with small
Page 287 and 288:
For each i, since gcd(z i , q) = 1
Page 289 and 290:
Proof. Let ω n = ω( √ log n) sa
Page 291 and 292:
Theorem 3.8. Let m, n be integers,
Page 293 and 294:
σ · O( √ m), except with probab
Page 295 and 296:
k = n/2, and it suffices to set the
Page 297 and 298:
[23] C. Peikert and B. Waters. Loss
Page 299 and 300:
1 Introduction Consider the followi
Page 301 and 302:
In the online phase clients individ
Page 303 and 304:
the clients jointly run a secure co
Page 305 and 306:
to compute F from scratch. The work
Page 307 and 308:
I. Pre-processing phase. In this ph
Page 309 and 310:
Online Phase: 1. Each client D i ge
Page 311 and 312:
2n ciphertexts in order to be sure
Page 313 and 314:
[KMR11] [KMR12] [Lip12] [LTV12] Sen
Page 315 and 316:
For any set of adversarial parties
Page 317 and 318:
C.5 Secure Computation We make use
Page 319 and 320:
Experiment H 4 . This experiment is
Page 321 and 322:
of A only in the case when A guesse
Page 323 and 324:
leading to concrete implementations
Page 325 and 326:
y modeling each block by an interac
Page 327 and 328:
z i P 2 Q 1 y i P 1 s 1 r 1 x i w i
Page 329 and 330:
2 Distributed Systems, Composition,
Page 331 and 332:
[G | H](y) = (w, x): z = y w = y x[
Page 333 and 334:
infinite chains, such as (M ∗ ;
Page 335 and 336:
2.3 Multi-party computation, securi
Page 337 and 338:
BCast(x) = (y 1 , . . . , y n ): y
Page 339 and 340:
Sim(y A , s A ) = (y ′ A , r A):
Page 341 and 342:
WCast(x ′ , w) = (y 1 ′ , . . .
Page 343 and 344:
s ′ 0 s ′ A r ′ A y ′ H s
Page 345 and 346:
p r ′ A Net’ s ′ r ′ H r A
Page 347 and 348:
Notice that we have already underta
Page 349 and 350:
simpler protocol description. For t
Page 351 and 352:
[29] Andrew Chi-Chih Yao. Protocols
Page 353 and 354:
2 Mihir Bellare, Stefano Tessaro, a
Page 355 and 356:
Page 357 and 358:
Page 359 and 360:
Page 361 and 362:
10 Mihir Bellare, Stefano Tessaro,
Page 363 and 364:
Page 365 and 366:
Page 367 and 368:
Page 369 and 370:
Page 371 and 372:
Multi-Instance Security and its App
Page 373 and 374:
Multi-instance Security and Passwor
Page 375 and 376:
Page 377 and 378:
Page 379 and 380:
Page 381 and 382:
Page 383 and 384:
Page 385 and 386:
Page 387 and 388:
Page 389 and 390:
Page 391 and 392:
a hash-of-hash construction: H 2 (M
Page 393 and 394:
guisher queries (our lower bounds r
Page 395 and 396:
in so doing they accidentally intro
Page 397 and 398:
of D is defined as [ [ ] AdvH[P],R,
Page 399 and 400:
main POW H[P],n,l1 : P 1 P 2 X 2
Page 401 and 402:
now,thinkforconvenienceofw = l).The
Page 403 and 404:
aroundO(q 2 )queries.Ideally, wewou
Page 405 and 406:
HMAC l (K,Y 0) Y 0 F K Y 0 ′ G K
Page 407 and 408:
This material is based on research
Page 409 and 410:
24. Ari Juels and John G. Brainard.
Page 411 and 412:
Contents 1 The BGV Homomorphic Encr
Page 413 and 414:
‖a‖ canon 2 . The basic operati
Page 415 and 416:
EncryptedArray/EncrytedArrayMod2r R
Page 417 and 418:
g i ’s and h i ’s in one list,
Page 419 and 420:
2.6 IndexSet and IndexMap: Sets and
Page 421 and 422:
turn, are sometimes partitioned fur
Page 423 and 424:
DoubleCRT& operator-=(const ZZ &num
Page 425 and 426:
homomorphic automorphism operation
Page 427 and 428:
For reasons that will be discussed
Page 429 and 430:
where D i is the size of the i’th
Page 431 and 432:
When key-switching a ciphertext ⃗
Page 433 and 434:
constant (i.e. |poly(τ m )| 2 ), o
Page 435 and 436:
ool isCorrect() const; and double l
Page 437 and 438:
For the noise estimate in the new c
Page 439 and 440:
The first time that ImportSecKey is
Page 441 and 442:
EncryptedArray(const FHEcontext& co
Page 443 and 444:
The MUX operation is implemented by
Page 445 and 446:
5.1 Homomorphic Operations over GF
Page 447 and 448:
EncryptedArrayMod2r ea(context); lo
Page 449 and 450:
H/2m each and 0 with probability 1
Page 451 and 452:
So now consider the inner sum in (7
show all

a590003

Create successful ePaper yourself

Delete template?

Save as template?