a590003

More documents

Recommendations

Info

6.0 References [1] Gentry, Craig, "A fully homomorphic encryption scheme" PhD thesis, Stanford University, 2009. http://crypto.stanford.edu/craig. [2] Gentry, Craig, and Halevi, Shai, "Fully Homomorphic Encryption without Squashing Using Depth-3 Arithmetic Circuits," FOCS pps 107-109, 2011, http://eprint.iacr.org/2011/279 [3] Brakerski, Zvika; Gentry, Craig; and Vaikuntanathan, Vinod, "Fully Homomorphic Encryption without Bootstrapping," ITCS, pps 309-325, 2012, http://eprint.iacr.org/2011/277 [4] Gentry, Craig; Halevi, Shai; and Smart, Nigel, "Fully Homomorphic Encryption with Polylog Overhead," Eurocrypt pps 465-482, 2012, http://eprint.iacr.org/2011/566 [5] Gentry, Craig; Halevi, Shai; and Smart, Nigel, "Better Bootstrapping in Fully Homomorphic Encryption," PKC 2012. LNCS vol. 7293, pps 1-16, http://eprint.iacr.org/2011/680 [6] Brakerski, Zvika, "Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP," Crypto, pps 868-886, 2012, http://eprint.iacr.org/2012/078 [7] Gentry, Craig; Halevi, Shai; and Smart, Nigel, "Homomorphic Evaluation of the AES Circuit," CRYPTO pps 850-867, 2012, http://eprint.iacr.org/2012/099 [8] Brakerski, Zvika; Gentry, Craig; and Halevi, Shai, "Packed Ciphertexts in LWE-based Homomorphic Encryption," PKC 2012, http://eprint.iacr.org/2012/565 [9] Gentry, Craig, and Halevi, Shai, "Implementing Gentry's Fully-Homomorphic Encryption Scheme," EUROCRYPT LNCS vol. 6632, 2 pps 129-148, 011, http://eprint.iacr.org/2010/520 [10] Micciancio, Daniele, and Peikert, Chris, "Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller," Eurocrypt pps 700-718, 2012, http://link.springer.com/chapter/10.1007%2F978- 3-642-29011-4_41 [11] Micciancio, Daniele, and Peikert, Chris, "Hardness of SIS and LWE with Small Parameters," submitted to CCC 2013. http://eprint.iacr.org/2013/069.pdf [12] Micciancio, Daniele, and Tessaro, Stefano, "An Equational Approach to Secure Multi- Party Computation," ITCS pps 355-372, 2013, http://cseweb.ucsd.edu/~daniele/papers/ITCS13.pdf [13] Boneh, Dan; Segev, Gil; and Waters, Brent, "Targeted Malleability: Homomorphic Encryption for Restricted Computations", ITCS, pp 350-366, 2012, http://eprint.iacr.org/2011/311 Approved for Public Release; Distribution Unlimited. 18
[14] Bogdanov, Andrej, and Lee, Chin Ho, "Homomorphic encryption from codes" Cryptology ePrint Archive, Report 2011/622, 2011. http://eprint.iacr.org/2011/622 [15] Brakerski, Zvika, "When Homomorphism Becomes a Liability," TCC 2013, http://eprint.iacr.org/2012/225 [16] Boneh, Dan, and Zhandry, Mark, "Quantum-secure Message Authentication Codes," Eurocrypt, 2013, http://eprint.iacr.org/2012/606 [17] Wu, David; Haven, Jacob; and Boneh, Dan, "Using Homomorphic Encryption for Large Scale Statistical Analysis," CURIS 2012. www.stanford.edu/~dwu4/CURISPoster.pdf [18] Halevi, Shai, and Shoup, Victor, "Design and Implementation of a Homomorphic- Encryption Library," to be submitted. http://researcher.ibm.com/researcher/files/usshaih/he-library.pdf [19] Brakerski, Zvika, and Vaikuntanathan, Vinod, "Efficient fully homomorphic encryption from (standard) LWE" FOCS 2011, http://eprint.iacr.org/2011/344 [20] Dolev, D.; Dwork, C.; and Naor. M., "Non-malleable cryptography" SIAM Journal on Computing, 30(2), pps 391–437, 2000, http://noodle.cs.huji.ac.il/~dolev/pubs/nmc.pdf [21] Cash, David; Kupcu, Alptekin; and Wichs, Daniel, "Dynamic Proofs of Retrievability via Oblivious RAM," Eurocrypt 2013, http://eprint.iacr.org/2012/550 [22] Juels, A. and Kaliski, B., "PORs: Proofs of Retrievability for Large Files," ACM CCS, pp. 584—597. 2007 [23] Chandran, Nishanth; Gennaro, Rosario; Jain, Abhishek; and Sahai, Amit, "How to Delegate Secure Multiparty Computation to the Cloud," to be submitted. [24] Bellare, Mihir; Tessaro, Stephano; and Vardy, Alexander, “Semantic Security for the Wiretap Channel,” CRYPTO 2012, http://cseweb.ucsd.edu/~mihir/papers/wiretapcrypto12.pdf [25] Bellare, Mihir; Ristenpart, Thomas; and Tessaro, Stephano, “Multi-Instance Security and its Application to Password-Based Cryptography,” CRYPTO 2012, http://eprint.iacr.org/2012/196.pdf [26] Dodis, Yevgeniy; Ristenpart, Thomas; Steinberger, John, and Tessaro, Stephano, “To Hash or Not to Hash Again? (In)differentiability Results for H2 and HMAC,” CRYPTO 2012, http://people.csail.mit.edu/tessaro/papers/h2fullprelim.pdf Approved for Public Release; Distribution Unlimited. 19
Page 1 and 2: AFRL-RI-RS-TR-2013-191 ADVANCED HOM
Page 3 and 4: REPORT DOCUMENTATION PAGE Form Appr
Page 5 and 6: 12. An Equational Approach to Secur
Page 7 and 8: 1.0 Executive Summary The ultimate
Page 9 and 10: The PROCEED program efforts are bro
Page 11 and 12: Towards the end of the project we i
Page 13 and 14: feature of the framework is that it
Page 15 and 16: 4.3 Publications Figure 1: A block
Page 17 and 18: encrypted data. We introduce a prec
Page 19 and 20: present an attack showing that a pa
Page 21 and 22: alternatives: mis (based on mutual
Page 23: 5.0 Conclusions and Recommendations
Page 27 and 28: 8.0 List of Symbols, Abbreviations,
Page 29 and 30: Public Affairs Approvals for papers
Page 31 and 32: Contents 1 Introduction 1 1.1 Our M
Page 33 and 34: t j = P (a j ), and finally interpo
Page 35 and 36: apparent problem by replacing the M
Page 37 and 38: As noted above, there is a multilin
Page 39 and 40: f(x 1 , . . . , x n ) ∈ F and eve
Page 41 and 42: Translation. Pick up from the publi
Page 43 and 44: Lemma 4. Let prime p = ω(N 2 ). Th
Page 45 and 46: [vDGHV10] Marten van Dijk, Craig Ge
Page 47 and 48: have u 2 − v 2 = 1 → (u − v)(
Page 49 and 50: inary), and we want to compute g c
Page 51 and 52: Fully Homomorphic Encryption withou
Page 53 and 54: scheme have bit length Ω(D) to all
Page 55 and 56: fast. Thus, the actual magnitude of
Page 57 and 58: Definition 3 (B-bounded distributio
Page 59 and 60: achieve 2 λ security against known
Page 61 and 62: Proof. 〈c 2 , s 2 〉 = BitDecomp
Page 63 and 64: • FHE.Add(pk, c 1 , c 2 ): Takes
Page 65 and 66: The computation needed to compute t
Page 67 and 68: If a and b are large enough, B domi
Page 69 and 70: 5.1.2 How Batching Works Deploying
Page 71 and 72: We have the following lemma. Lemma
Page 73 and 74: Unpack(c, {τ σi→1 (s 1 )→s 2
Page 75 and 76:
Since ‖e q1 ‖ < r q1 ,in, e q1
Page 77 and 78:
[22] Damien Stehlé and Ron Steinfe
Page 79 and 80:
1 Introduction Fully homomorphic en
Page 81 and 82:
encryptions of the same message usi
Page 83 and 84:
and Tromer [CT10] in a completely d
Page 85 and 86:
is negligible in k, where Expt CPA
Page 87 and 88:
2.3 Non-Interactive Simulation-Soun
Page 89 and 90:
is defined as (state 1 , m 1 , . .
Page 91 and 92:
scheme has almost-all-keys perfect
Page 93 and 94:
The algorithm S 1 . The algorithm S
Page 95 and 96:
The distribution D 6 . This distrib
Page 97 and 98:
We resolve this issue using the app
Page 99 and 100:
the number of common reference stri
Page 101 and 102:
• Homomorphic evaluation: The hom
Page 103 and 104:
The number of repeated homomorphic
Page 105 and 106:
[Gro04] [Gro10] J. Groth. Rerandomi
Page 107 and 108:
Trapdoors for Lattices: Simpler, Ti
Page 109 and 110:
mentioned, two central objects are
Page 111 and 112:
Dimension m Quality s Length β ≈
Page 113 and 114:
defined by G (or the semi-random ma
Page 115 and 116:
1.4 Other Related Work Concrete par
Page 117 and 118:
Cryptographic problems. For β > 0,
Page 119 and 120:
andom over G m s , for uniformly ra
Page 121 and 122:
3 Search to Decision Reduction Here
Page 123 and 124:
• Preimage sampling for f G (x) =
Page 125 and 126:
Note that for x ∈ {0, . . . , q
Page 127 and 128:
The offline ‘bucketing’ approac
Page 129 and 130:
G is primitive, the tag H in the ab
Page 131 and 132:
conditional distribution of R given
Page 133 and 134:
and parallelism of Algorithm 3 come
Page 135 and 136:
is a coset of the lattice Λ = L( [
Page 137 and 138:
scheme is su-scma-secure if Adv su-
Page 139 and 140:
a discrete Gaussian with parameter
Page 141 and 142:
• G ∈ Z n×nk q is a gadget mat
Page 143 and 144:
must return this e (but possibly di
Page 145 and 146:
[Gen09b] C. Gentry. Fully homomorph
Page 147 and 148:
[vGHV10] M. van Dijk, C. Gentry, S.
Page 149 and 150:
Contents 1 Introduction 1 2 Backgro
Page 151 and 152:
1 Introduction In his breakthrough
Page 153 and 154:
Then in Section 3 we describe our
Page 155 and 156:
In some more detail, the BGV key sw
Page 157 and 158:
itself has low norm. In BGV [5] thi
Page 159 and 160:
3.4 Randomized Multiplication by Co
Page 161 and 162:
One subtle implementation detail to
Page 163 and 164:
ciphertexts. Producing the encrypte
Page 165 and 166:
[24] Benny Pinkas, Thomas Schneider
Page 167 and 168:
A.4 Sampling From A q At various po
Page 169 and 170:
To maintain the noise estimate, the
Page 171 and 172:
variance σ 2 φ(m), so 2d 2 (ζ)ɛ
Page 173 and 174:
We stress that the only place where
Page 175 and 176:
C.1.1 LWE with Sparse Key The analy
Page 177 and 178:
The Smallest Modulus. After evaluat
Page 179 and 180:
down by a factor of p t . Let’s r
Page 181 and 182:
to apply a map κ i we express it a
Page 183 and 184:
1 Introduction Fully homomorphic en
Page 185 and 186:
4. No restrictions on the secret ke
Page 187 and 188:
We point out that an alternative so
Page 189 and 190:
Recall that GapSVP γ is the (promi
Page 191 and 192:
Proof. By definition ⟨c, (1, s)
Page 193 and 194:
• SI-HE.Enc pk (m): Identical to
Page 195 and 196:
Proof of Theorem 4.2. Consider the
Page 197 and 198:
We can now plug in what we know abo
Page 199 and 200:
In particular (recall that E < ⌊q
Page 201 and 202:
[Reg03] Oded Regev. New lattice bas
Page 203 and 204:
1 Introduction An encryption scheme
Page 205 and 206:
need to have errors. Since the expe
Page 207 and 208:
Again we allow some “slackness”
Page 209 and 210:
Learning Linear Functions. the clas
Page 211 and 212:
Let us first outline the proof of T
Page 213 and 214:
P ′ . 4 Namely H n ′ :n = P ′
Page 215 and 216:
In conclusion, we get a sub-scheme
Page 217 and 218:
[BV11b] [Gen09] [Gen10] [GH11] [GHS
Page 219 and 220:
Quantum-Secure Message Authenticati
Page 221 and 222:
the success probability away from 1
Page 223 and 224:
Functions will be denoted by capito
Page 225 and 226:
Quantum chosen message queries. In
Page 227 and 228:
Since the w are the possible result
Page 229 and 230:
number of distinct component values
Page 231 and 232:
4.1 A Tight Upper Bound Theorem 4.1
Page 233 and 234:
The algorithm is similar to the alg
Page 235 and 236:
As we have already seen, for expone
Page 237 and 238:
where S i (m) = (R i (m), PRF(k, (R
Page 239 and 240:
To prove this theorem, we treat Y a
Page 241 and 242:
Now we use this attack to obtain an
Page 243 and 244:
Using this lemma we show that (3q +
Page 245 and 246:
[KK11] Daniel M. Kane and Samuel A.
Page 247 and 248:
1 Introduction Cloud storage system
Page 249 and 250:
subset of the server’s storage, t
Page 251 and 252:
security does not suffice. The main
Page 253 and 254:
Static Data. PoR and PDP schemes fo
Page 255 and 256:
For any efficient adversarial serve
Page 257 and 258:
Overview of Construction. Let (Enc,
Page 259 and 260:
means that one of the audit protoco
Page 261 and 262:
Now we claim that an execution of E
Page 263 and 264:
having higher capacity. The tables
Page 265 and 266:
OWrite(i 1 , . . . , i t ; v 1 , .
Page 267 and 268:
j-th level table again. With this o
Page 269 and 270:
and distribute reprints for Governm
Page 271 and 272:
A Simple Dynamic PoR with Square-Ro
Page 273 and 274:
from Section 6 that is NRPH secure.
Page 275 and 276:
The LWE problem was introduced in t
Page 277 and 278:
1.2 Techniques and Comparison to Re
Page 279 and 280:
(large) uniform errors as in [10],
Page 281 and 282:
Proof. Let A be an algorithm runnin
Page 283 and 284:
that 1 + ɛ = (1 + ɛ 1 )(1 + ɛ 2
Page 285 and 286:
Because we are concerned with small
Page 287 and 288:
For each i, since gcd(z i , q) = 1
Page 289 and 290:
Proof. Let ω n = ω( √ log n) sa
Page 291 and 292:
Theorem 3.8. Let m, n be integers,
Page 293 and 294:
σ · O( √ m), except with probab
Page 295 and 296:
k = n/2, and it suffices to set the
Page 297 and 298:
[23] C. Peikert and B. Waters. Loss
Page 299 and 300:
1 Introduction Consider the followi
Page 301 and 302:
In the online phase clients individ
Page 303 and 304:
the clients jointly run a secure co
Page 305 and 306:
to compute F from scratch. The work
Page 307 and 308:
I. Pre-processing phase. In this ph
Page 309 and 310:
Online Phase: 1. Each client D i ge
Page 311 and 312:
2n ciphertexts in order to be sure
Page 313 and 314:
[KMR11] [KMR12] [Lip12] [LTV12] Sen
Page 315 and 316:
For any set of adversarial parties
Page 317 and 318:
C.5 Secure Computation We make use
Page 319 and 320:
Experiment H 4 . This experiment is
Page 321 and 322:
of A only in the case when A guesse
Page 323 and 324:
leading to concrete implementations
Page 325 and 326:
y modeling each block by an interac
Page 327 and 328:
z i P 2 Q 1 y i P 1 s 1 r 1 x i w i
Page 329 and 330:
2 Distributed Systems, Composition,
Page 331 and 332:
[G | H](y) = (w, x): z = y w = y x[
Page 333 and 334:
infinite chains, such as (M ∗ ;
Page 335 and 336:
2.3 Multi-party computation, securi
Page 337 and 338:
BCast(x) = (y 1 , . . . , y n ): y
Page 339 and 340:
Sim(y A , s A ) = (y ′ A , r A):
Page 341 and 342:
WCast(x ′ , w) = (y 1 ′ , . . .
Page 343 and 344:
s ′ 0 s ′ A r ′ A y ′ H s
Page 345 and 346:
p r ′ A Net’ s ′ r ′ H r A
Page 347 and 348:
Notice that we have already underta
Page 349 and 350:
simpler protocol description. For t
Page 351 and 352:
[29] Andrew Chi-Chih Yao. Protocols
Page 353 and 354:
2 Mihir Bellare, Stefano Tessaro, a
Page 355 and 356:
Page 357 and 358:
Page 359 and 360:
Page 361 and 362:
10 Mihir Bellare, Stefano Tessaro,
Page 363 and 364:
Page 365 and 366:
Page 367 and 368:
Page 369 and 370:
Page 371 and 372:
Multi-Instance Security and its App
Page 373 and 374:
Multi-instance Security and Passwor
Page 375 and 376:
Page 377 and 378:
Page 379 and 380:
Page 381 and 382:
Page 383 and 384:
Page 385 and 386:
Page 387 and 388:
Page 389 and 390:
Page 391 and 392:
a hash-of-hash construction: H 2 (M
Page 393 and 394:
guisher queries (our lower bounds r
Page 395 and 396:
in so doing they accidentally intro
Page 397 and 398:
of D is defined as [ [ ] AdvH[P],R,
Page 399 and 400:
main POW H[P],n,l1 : P 1 P 2 X 2
Page 401 and 402:
now,thinkforconvenienceofw = l).The
Page 403 and 404:
aroundO(q 2 )queries.Ideally, wewou
Page 405 and 406:
HMAC l (K,Y 0) Y 0 F K Y 0 ′ G K
Page 407 and 408:
This material is based on research
Page 409 and 410:
24. Ari Juels and John G. Brainard.
Page 411 and 412:
Contents 1 The BGV Homomorphic Encr
Page 413 and 414:
‖a‖ canon 2 . The basic operati
Page 415 and 416:
EncryptedArray/EncrytedArrayMod2r R
Page 417 and 418:
g i ’s and h i ’s in one list,
Page 419 and 420:
2.6 IndexSet and IndexMap: Sets and
Page 421 and 422:
turn, are sometimes partitioned fur
Page 423 and 424:
DoubleCRT& operator-=(const ZZ &num
Page 425 and 426:
homomorphic automorphism operation
Page 427 and 428:
For reasons that will be discussed
Page 429 and 430:
where D i is the size of the i’th
Page 431 and 432:
When key-switching a ciphertext ⃗
Page 433 and 434:
constant (i.e. |poly(τ m )| 2 ), o
Page 435 and 436:
ool isCorrect() const; and double l
Page 437 and 438:
For the noise estimate in the new c
Page 439 and 440:
The first time that ImportSecKey is
Page 441 and 442:
EncryptedArray(const FHEcontext& co
Page 443 and 444:
The MUX operation is implemented by
Page 445 and 446:
5.1 Homomorphic Operations over GF
Page 447 and 448:
EncryptedArrayMod2r ea(context); lo
Page 449 and 450:
H/2m each and 0 with probability 1
Page 451 and 452:
So now consider the inner sum in (7
show all

a590003

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?