a590003

More documents

Recommendations

Info

[16] M. T. Goodrich, M. Mitzenmacher, O. Ohrimenko, and R. Tamassia. Oblivious RAM simulation with efficient worst-case access overhead. In CCSW, pages 95–100, 2011. [17] M. T. Goodrich, M. Mitzenmacher, O. Ohrimenko, and R. Tamassia. Privacy-preserving group data access via stateless oblivious ram simulation. In SODA, pages 157–167, 2012. [18] W. Hoeffding. Probability inequalities for sums of bounded random variables. Journal of the American Statistical Association, 58(301):13–30, 1963. [19] A. Juels and B. S. Kaliski Jr. Pors: proofs of retrievability for large files. In P. Ning, S. D. C. di Vimercati, and P. F. Syverson, editors, ACM CCS 07, pages 584–597. ACM Press, Oct. 2007. [20] A. Kirsch, M. Mitzenmacher, and U. Wieder. More robust hashing: Cuckoo hashing with a stash. SIAM J. Comput., 39(4):1543–1561, 2009. [21] A. Küpçü. Efficient Cryptography for the Next Generation Secure Cloud. PhD thesis, Brown University, 2010. [22] A. Küpçü. Efficient Cryptography for the Next Generation Secure Cloud: Protocols, Proofs, and Implementation. Lambert Academic Publishing, 2010. [23] M. Naor and G. N. Rothblum. The complexity of online memory checking. In 46th FOCS, pages 573–584. IEEE Computer Society Press, Oct. 2005. [24] R. Ostrovsky and V. Shoup. Private information storage (extended abstract). In 29th ACM STOC, pages 294–303. ACM Press, May 1997. [25] R. Pagh and F. F. Rodler. Cuckoo hashing. J. Algorithms, 51(2):122–144, 2004. [26] B. Pinkas and T. Reinman. Oblivious RAM revisited. In T. Rabin, editor, CRYPTO 2010, volume 6223 of LNCS, pages 502–519. Springer, Aug. 2010. [27] H. Shacham and B. Waters. Compact proofs of retrievability. In J. Pieprzyk, editor, ASIACRYPT 2008, volume 5350 of LNCS, pages 90–107. Springer, Dec. 2008. [28] E. Shi, T.-H. H. Chan, E. Stefanov, and M. Li. Oblivious ram with o((logn)3) worst-case cost. In D. H. Lee and X. Wang, editors, ASIACRYPT, volume 7073 of Lecture Notes in Computer Science, pages 197–214. Springer, 2011. [29] E. Stefanov, M. van Dijk, A. Oprea, and A. Juels. Iris: A scalable cloud file system with efficient integrity checks. Cryptology ePrint Archive, Report 2011/585, 2011. http://eprint.iacr.org/. [30] Q. Wang, C. Wang, J. Li, K. Ren, and W. Lou. Enabling public verifiability and data dynamics for storage security in cloud computing. In M. Backes and P. Ning, editors, ESORICS 2009, volume 5789 of LNCS, pages 355–370. Springer, Sept. 2009. [31] P. Williams, R. Sion, and B. Carbunar. Building castles out of mud: practical access pattern privacy and correctness on untrusted storage. In P. Ning, P. F. Syverson, and S. Jha, editors, ACM CCS 08, pages 139–148. ACM Press, Oct. 2008. 24 9. Dynamic Proofs of Retrievability via Oblivious RAM
A Simple Dynamic PoR with Square-Root Complexity We sketch a very simple construction of dynamic PoR that achieves sub-linear complexity in its read, write and audit operations. Although the scheme is asymptotically significantly worst then our PORAM solution as described in the main body, it is significantly simpler and may be of interest for some practical parameter settings. The construction starts with the first dynamic PoR proposal from the introduction. To store a memory M ∈ Σ l on the server, the client divides it into L = √ l consecutive message blocks (m 1 , . . . , m L ), each containing L = √ l symbols. The client then encodes each of the message blocks m i using an (n = 2L, k = L, d = L + 1)-erasure code (e.g., Reed-Solomon tolerating L erasures), to form a codeword block c i , and concatenates the codeword blocks to form a string C = (c 1 , . . . , c L ) ∈ Σ 2l which it then stores on the server. We can assume the code is systematic so that the message block m i resides in the first L symbols of the corresponding codeword block c i . In addition, the client initializes a memory checking scheme [5, 23, 11], which it uses to authenticate each of the 2l codeword symbols within C. To read a location j ∈ [l] of memory, the client computes the index i ∈ [L] of the message block m i containing that location, and downloads the appropriate symbol of the codeword block c i which contains the value M[j] (here we use that the code is systematic), which it checks for authenticity via the memory checking scheme. To write to a location j ∈ [l] the client downloads the entire corresponding codeword block c i (checking for authenticity) decodes m i , changes the appropriate location to get an updated block m ′ i and finally re-encodes it to get c ′ i which it then writes to the server, updating the appropriate authentication information within the memory checking scheme. The audit protocol selects t = λ (security parameter) random positions within every codeword block c i and checks them for authenticity via the memory checking scheme. The read and write protocols of this scheme each execute the memory checking read protocol to read and write 1 and √ l symbols respectively. The audit protocol reads and checks λ √ l symbols. Assuming an efficient (poly-logarithmic) memory checking protocol, this means actual complexity of these protocols incurs another O(log l) factor and another constant factor increase in server storage. Therefore the complexity of the reads, writes, and audit is O(1), O( √ l), O( √ l) respectively, ignoring factors that depend on the security parameter or are polylogarithmic in l. Note that the above scheme actually gives us a natural trade-off between the complexity of the writes and the audit protocol. In particular, for any δ > 0, we can set the message block size to L 1 = l δ symbols, so that the client memory M now consists of L 2 = l 1−δ such blocks. In this case, the complexity of reads, writes, and audits becomes O(1), O(l δ ), O(l 1−δ ) respectively. B Standard Pattern Hiding for ORAM We recall an equivalent definition to the one introduced by Goldreich and Ostrovsky [13]. Informally, standard pattern hiding says that an (arbitrarily malicious and efficient) adversary cannot detect which sequence of instructions a client is executing via the ORAM protocols. Formally, for a bit b and an adversary A, we define the game ORAMGame b A (λ) as follows: • The attacker A(1 λ ) outputs two equal-length ORAM protocol sequences Q 0 = (op 0 , . . . , op q ), Q 1 = (op ′ 0 , . . . , op′ q). We require that for each index j, the operations op j and op ′ j only differ in the location they access and the values the are writing, but otherwise correspond to the same operation (read or write). • The challenger initializes an honest client C and server S, and sequentially executes the operations in Q b , between C and S. • Finally, A is given the complete transcript of all the protocol executions, and he outputs a bit ˜b, which is the output of the game. 25 9. Dynamic Proofs of Retrievability via Oblivious RAM
Page 1 and 2:
AFRL-RI-RS-TR-2013-191 ADVANCED HOM
Page 3 and 4:
REPORT DOCUMENTATION PAGE Form Appr
Page 5 and 6:
12. An Equational Approach to Secur
Page 7 and 8:
1.0 Executive Summary The ultimate
Page 9 and 10:
The PROCEED program efforts are bro
Page 11 and 12:
Towards the end of the project we i
Page 13 and 14:
feature of the framework is that it
Page 15 and 16:
4.3 Publications Figure 1: A block
Page 17 and 18:
encrypted data. We introduce a prec
Page 19 and 20:
present an attack showing that a pa
Page 21 and 22:
alternatives: mis (based on mutual
Page 23 and 24:
5.0 Conclusions and Recommendations
Page 25 and 26:
[14] Bogdanov, Andrej, and Lee, Chi
Page 27 and 28:
8.0 List of Symbols, Abbreviations,
Page 29 and 30:
Public Affairs Approvals for papers
Page 31 and 32:
Contents 1 Introduction 1 1.1 Our M
Page 33 and 34:
t j = P (a j ), and finally interpo
Page 35 and 36:
apparent problem by replacing the M
Page 37 and 38:
As noted above, there is a multilin
Page 39 and 40:
f(x 1 , . . . , x n ) ∈ F and eve
Page 41 and 42:
Translation. Pick up from the publi
Page 43 and 44:
Lemma 4. Let prime p = ω(N 2 ). Th
Page 45 and 46:
[vDGHV10] Marten van Dijk, Craig Ge
Page 47 and 48:
have u 2 − v 2 = 1 → (u − v)(
Page 49 and 50:
inary), and we want to compute g c
Page 51 and 52:
Fully Homomorphic Encryption withou
Page 53 and 54:
scheme have bit length Ω(D) to all
Page 55 and 56:
fast. Thus, the actual magnitude of
Page 57 and 58:
Definition 3 (B-bounded distributio
Page 59 and 60:
achieve 2 λ security against known
Page 61 and 62:
Proof. 〈c 2 , s 2 〉 = BitDecomp
Page 63 and 64:
• FHE.Add(pk, c 1 , c 2 ): Takes
Page 65 and 66:
The computation needed to compute t
Page 67 and 68:
If a and b are large enough, B domi
Page 69 and 70:
5.1.2 How Batching Works Deploying
Page 71 and 72:
We have the following lemma. Lemma
Page 73 and 74:
Unpack(c, {τ σi→1 (s 1 )→s 2
Page 75 and 76:
Since ‖e q1 ‖ < r q1 ,in, e q1
Page 77 and 78:
[22] Damien Stehlé and Ron Steinfe
Page 79 and 80:
1 Introduction Fully homomorphic en
Page 81 and 82:
encryptions of the same message usi
Page 83 and 84:
and Tromer [CT10] in a completely d
Page 85 and 86:
is negligible in k, where Expt CPA
Page 87 and 88:
2.3 Non-Interactive Simulation-Soun
Page 89 and 90:
is defined as (state 1 , m 1 , . .
Page 91 and 92:
scheme has almost-all-keys perfect
Page 93 and 94:
The algorithm S 1 . The algorithm S
Page 95 and 96:
The distribution D 6 . This distrib
Page 97 and 98:
We resolve this issue using the app
Page 99 and 100:
the number of common reference stri
Page 101 and 102:
• Homomorphic evaluation: The hom
Page 103 and 104:
The number of repeated homomorphic
Page 105 and 106:
[Gro04] [Gro10] J. Groth. Rerandomi
Page 107 and 108:
Trapdoors for Lattices: Simpler, Ti
Page 109 and 110:
mentioned, two central objects are
Page 111 and 112:
Dimension m Quality s Length β ≈
Page 113 and 114:
defined by G (or the semi-random ma
Page 115 and 116:
1.4 Other Related Work Concrete par
Page 117 and 118:
Cryptographic problems. For β > 0,
Page 119 and 120:
andom over G m s , for uniformly ra
Page 121 and 122:
3 Search to Decision Reduction Here
Page 123 and 124:
• Preimage sampling for f G (x) =
Page 125 and 126:
Note that for x ∈ {0, . . . , q
Page 127 and 128:
The offline ‘bucketing’ approac
Page 129 and 130:
G is primitive, the tag H in the ab
Page 131 and 132:
conditional distribution of R given
Page 133 and 134:
and parallelism of Algorithm 3 come
Page 135 and 136:
is a coset of the lattice Λ = L( [
Page 137 and 138:
scheme is su-scma-secure if Adv su-
Page 139 and 140:
a discrete Gaussian with parameter
Page 141 and 142:
• G ∈ Z n×nk q is a gadget mat
Page 143 and 144:
must return this e (but possibly di
Page 145 and 146:
[Gen09b] C. Gentry. Fully homomorph
Page 147 and 148:
[vGHV10] M. van Dijk, C. Gentry, S.
Page 149 and 150:
Contents 1 Introduction 1 2 Backgro
Page 151 and 152:
1 Introduction In his breakthrough
Page 153 and 154:
Then in Section 3 we describe our
Page 155 and 156:
In some more detail, the BGV key sw
Page 157 and 158:
itself has low norm. In BGV [5] thi
Page 159 and 160:
3.4 Randomized Multiplication by Co
Page 161 and 162:
One subtle implementation detail to
Page 163 and 164:
ciphertexts. Producing the encrypte
Page 165 and 166:
[24] Benny Pinkas, Thomas Schneider
Page 167 and 168:
A.4 Sampling From A q At various po
Page 169 and 170:
To maintain the noise estimate, the
Page 171 and 172:
variance σ 2 φ(m), so 2d 2 (ζ)ɛ
Page 173 and 174:
We stress that the only place where
Page 175 and 176:
C.1.1 LWE with Sparse Key The analy
Page 177 and 178:
The Smallest Modulus. After evaluat
Page 179 and 180:
down by a factor of p t . Let’s r
Page 181 and 182:
to apply a map κ i we express it a
Page 183 and 184:
1 Introduction Fully homomorphic en
Page 185 and 186:
4. No restrictions on the secret ke
Page 187 and 188:
We point out that an alternative so
Page 189 and 190:
Recall that GapSVP γ is the (promi
Page 191 and 192:
Proof. By definition ⟨c, (1, s)
Page 193 and 194:
• SI-HE.Enc pk (m): Identical to
Page 195 and 196:
Proof of Theorem 4.2. Consider the
Page 197 and 198:
We can now plug in what we know abo
Page 199 and 200:
In particular (recall that E < ⌊q
Page 201 and 202:
[Reg03] Oded Regev. New lattice bas
Page 203 and 204:
1 Introduction An encryption scheme
Page 205 and 206:
need to have errors. Since the expe
Page 207 and 208:
Again we allow some “slackness”
Page 209 and 210:
Learning Linear Functions. the clas
Page 211 and 212:
Let us first outline the proof of T
Page 213 and 214:
P ′ . 4 Namely H n ′ :n = P ′
Page 215 and 216:
In conclusion, we get a sub-scheme
Page 217 and 218:
[BV11b] [Gen09] [Gen10] [GH11] [GHS
Page 219 and 220: Quantum-Secure Message Authenticati
Page 221 and 222: the success probability away from 1
Page 223 and 224: Functions will be denoted by capito
Page 225 and 226: Quantum chosen message queries. In
Page 227 and 228: Since the w are the possible result
Page 229 and 230: number of distinct component values
Page 231 and 232: 4.1 A Tight Upper Bound Theorem 4.1
Page 233 and 234: The algorithm is similar to the alg
Page 235 and 236: As we have already seen, for expone
Page 237 and 238: where S i (m) = (R i (m), PRF(k, (R
Page 239 and 240: To prove this theorem, we treat Y a
Page 241 and 242: Now we use this attack to obtain an
Page 243 and 244: Using this lemma we show that (3q +
Page 245 and 246: [KK11] Daniel M. Kane and Samuel A.
Page 247 and 248: 1 Introduction Cloud storage system
Page 249 and 250: subset of the server’s storage, t
Page 251 and 252: security does not suffice. The main
Page 253 and 254: Static Data. PoR and PDP schemes fo
Page 255 and 256: For any efficient adversarial serve
Page 257 and 258: Overview of Construction. Let (Enc,
Page 259 and 260: means that one of the audit protoco
Page 261 and 262: Now we claim that an execution of E
Page 263 and 264: having higher capacity. The tables
Page 265 and 266: OWrite(i 1 , . . . , i t ; v 1 , .
Page 267 and 268: j-th level table again. With this o
Page 269: and distribute reprints for Governm
Page 273 and 274: from Section 6 that is NRPH secure.
Page 275 and 276: The LWE problem was introduced in t
Page 277 and 278: 1.2 Techniques and Comparison to Re
Page 279 and 280: (large) uniform errors as in [10],
Page 281 and 282: Proof. Let A be an algorithm runnin
Page 283 and 284: that 1 + ɛ = (1 + ɛ 1 )(1 + ɛ 2
Page 285 and 286: Because we are concerned with small
Page 287 and 288: For each i, since gcd(z i , q) = 1
Page 289 and 290: Proof. Let ω n = ω( √ log n) sa
Page 291 and 292: Theorem 3.8. Let m, n be integers,
Page 293 and 294: σ · O( √ m), except with probab
Page 295 and 296: k = n/2, and it suffices to set the
Page 297 and 298: [23] C. Peikert and B. Waters. Loss
Page 299 and 300: 1 Introduction Consider the followi
Page 301 and 302: In the online phase clients individ
Page 303 and 304: the clients jointly run a secure co
Page 305 and 306: to compute F from scratch. The work
Page 307 and 308: I. Pre-processing phase. In this ph
Page 309 and 310: Online Phase: 1. Each client D i ge
Page 311 and 312: 2n ciphertexts in order to be sure
Page 313 and 314: [KMR11] [KMR12] [Lip12] [LTV12] Sen
Page 315 and 316: For any set of adversarial parties
Page 317 and 318: C.5 Secure Computation We make use
Page 319 and 320: Experiment H 4 . This experiment is
Page 321 and 322:
of A only in the case when A guesse
Page 323 and 324:
leading to concrete implementations
Page 325 and 326:
y modeling each block by an interac
Page 327 and 328:
z i P 2 Q 1 y i P 1 s 1 r 1 x i w i
Page 329 and 330:
2 Distributed Systems, Composition,
Page 331 and 332:
[G | H](y) = (w, x): z = y w = y x[
Page 333 and 334:
infinite chains, such as (M ∗ ;
Page 335 and 336:
2.3 Multi-party computation, securi
Page 337 and 338:
BCast(x) = (y 1 , . . . , y n ): y
Page 339 and 340:
Sim(y A , s A ) = (y ′ A , r A):
Page 341 and 342:
WCast(x ′ , w) = (y 1 ′ , . . .
Page 343 and 344:
s ′ 0 s ′ A r ′ A y ′ H s
Page 345 and 346:
p r ′ A Net’ s ′ r ′ H r A
Page 347 and 348:
Notice that we have already underta
Page 349 and 350:
simpler protocol description. For t
Page 351 and 352:
[29] Andrew Chi-Chih Yao. Protocols
Page 353 and 354:
2 Mihir Bellare, Stefano Tessaro, a
Page 355 and 356:
Page 357 and 358:
Page 359 and 360:
Page 361 and 362:
10 Mihir Bellare, Stefano Tessaro,
Page 363 and 364:
Page 365 and 366:
Page 367 and 368:
Page 369 and 370:
Page 371 and 372:
Multi-Instance Security and its App
Page 373 and 374:
Multi-instance Security and Passwor
Page 375 and 376:
Page 377 and 378:
Page 379 and 380:
Page 381 and 382:
Page 383 and 384:
Page 385 and 386:
Page 387 and 388:
Page 389 and 390:
Page 391 and 392:
a hash-of-hash construction: H 2 (M
Page 393 and 394:
guisher queries (our lower bounds r
Page 395 and 396:
in so doing they accidentally intro
Page 397 and 398:
of D is defined as [ [ ] AdvH[P],R,
Page 399 and 400:
main POW H[P],n,l1 : P 1 P 2 X 2
Page 401 and 402:
now,thinkforconvenienceofw = l).The
Page 403 and 404:
aroundO(q 2 )queries.Ideally, wewou
Page 405 and 406:
HMAC l (K,Y 0) Y 0 F K Y 0 ′ G K
Page 407 and 408:
This material is based on research
Page 409 and 410:
24. Ari Juels and John G. Brainard.
Page 411 and 412:
Contents 1 The BGV Homomorphic Encr
Page 413 and 414:
‖a‖ canon 2 . The basic operati
Page 415 and 416:
EncryptedArray/EncrytedArrayMod2r R
Page 417 and 418:
g i ’s and h i ’s in one list,
Page 419 and 420:
2.6 IndexSet and IndexMap: Sets and
Page 421 and 422:
turn, are sometimes partitioned fur
Page 423 and 424:
DoubleCRT& operator-=(const ZZ &num
Page 425 and 426:
homomorphic automorphism operation
Page 427 and 428:
For reasons that will be discussed
Page 429 and 430:
where D i is the size of the i’th
Page 431 and 432:
When key-switching a ciphertext ⃗
Page 433 and 434:
constant (i.e. |poly(τ m )| 2 ), o
Page 435 and 436:
ool isCorrect() const; and double l
Page 437 and 438:
For the noise estimate in the new c
Page 439 and 440:
The first time that ImportSecKey is
Page 441 and 442:
EncryptedArray(const FHEcontext& co
Page 443 and 444:
The MUX operation is implemented by
Page 445 and 446:
5.1 Homomorphic Operations over GF
Page 447 and 448:
EncryptedArrayMod2r ea(context); lo
Page 449 and 450:
H/2m each and 0 with probability 1
Page 451 and 452:
So now consider the inner sum in (7
show all

a590003

Create successful ePaper yourself

Delete template?

Save as template?