a590003

More documents

Recommendations

Info

(since the plaintext values can be elements in an extension field F 2 n), whereas class EncryptedArrayMod2r uses type vector for the same purpose (since the plaintext values in this case are integers). The methods that are provided are the following: // Fill the array with random plaintext data void random(vector& array) const; // EncryptedArray void random(vector& array) const; // EncryptedArrayMod2r // Encode the given array in a polynomial void encode(ZZX& ptxt, const vector& array) const; void encode(ZZX& ptxt, const vector& array) const; // Decode the given polynomial into an array of plaintext values void decode(vector& array, const ZZX& ptxt) const void decode(vector& array, const ZZX& ptxt) const // Multiply by the ciphertext by a polynomial encoding the given array void multByConst(Ctxt& ctxt, const vector& array); void multByConst(Ctxt& ctxt, const vector& array); // Add to the ciphertext a polynomial encoding the given array void addConst(Ctxt& ctxt, const vector& array) void addConst(Ctxt& ctxt, const vector& array) // MUX: for p=encode(selector), set c1 = c1*p + c2*(1-p) void select(Ctxt& c1, const Ctxt& c2, const vector& selector) const; void select(Ctxt& c1, const Ctxt& c2, const vector& selector) const; // Encode the array in a polynomial, then encrypt it in the ciphertext c void encrypt(Ctxt& c, const FHEPubKey& pKey, const vector& array) const; void encrypt(Ctxt& c, const FHEPubKey& pKey, const vector& array) const; // Decrypt the ciphertext c, then decode the result into the array void decrypt(const Ctxt& c, const FHESecKey& sKey, vector& array) const; void decrypt(const Ctxt& c, const FHESecKey& sKey, vector& array) const; 5 Using the Library Below we provide two examples of how this library can be used by an application program. These examples compute a simple circuit with homomorphic arithmetic over either GF (2 8 ) (represented using the AES polynomial, G(X) = X 8 + X 4 + X 3 + X + 1), or over Z 2 5. 33 16. Design and Implementation of a Homomorphic-Encryption Library
5.1 Homomorphic Operations over GF (2 8 ) /*** Determine the parameters (cf. [5, Appendix C]) ***/ long ptxtSpace = 2; long nDigits = 2; // # of digits/# of columns in key-switching matrices long k = 80; // security parameter long weight = 64; // Hamming weight of secret keys long lvls = 3; // number of ciphertext-primes in the modulus chain long m = 11441; // the parameter m, defining Zm^* and Phi_m(X) /*** Setup the various tables, and choose the keys ***/ FHEcontext context(m); // initialize a new context for the parameter m buildModChain(context, lvls, nDigits); // build the modulus chain FHESecKey secretKey(context); const FHEPubKey& publicKey = secretKey; secretKey.GenSecKey(weight,ptxtSpace); // initialize a secret-key object // use the same object as a public-key // draw a random secret key addSome1DMatrices(secretKey); // compute some key-switching matrices // We could also use add1DMatrices instead of addSome1DMatrices GF2X G; // G is the AES polynomial, G(X)= X^8 +X^4 +X^3 +X +1 SetCoeff(G,8); SetCoeff(G,4); SetCoeff(G,3); SetCoeff(G,1); SetCoeff(G,0); EncryptedArray ea(context, G); // An EncryptedArray object, encoding wrt G long nslots = ea.size(); // number of plaintext slots /*** Encrypt random arrays over GF(2^8) ***/ vector p0, p1, p2, p3; ea.random(p0); ea.random(p1); ea.random(p2); ea.random(p3); vector const1, const2; ea.random(const1); ea.random(const2); // Choose random arrays // two more random "constants" ZZX const1_poly, const2_poly; // encode constants as polynomials ea.encode(const1_poly, const1); ea.encode(const2_poly, const2); // Encrypt the random arrays Ctxt c0(publicKey), c1(publicKey), c2(publicKey), c3(publicKey); ea.encrypt(c0, publicKey, p0); ea.encrypt(c1, publicKey, p1); ea.encrypt(c2, publicKey, p2); ea.encrypt(c3, publicKey, p3); 34 16. Design and Implementation of a Homomorphic-Encryption Library
Page 1 and 2:
AFRL-RI-RS-TR-2013-191 ADVANCED HOM
Page 3 and 4:
REPORT DOCUMENTATION PAGE Form Appr
Page 5 and 6:
12. An Equational Approach to Secur
Page 7 and 8:
1.0 Executive Summary The ultimate
Page 9 and 10:
The PROCEED program efforts are bro
Page 11 and 12:
Towards the end of the project we i
Page 13 and 14:
feature of the framework is that it
Page 15 and 16:
4.3 Publications Figure 1: A block
Page 17 and 18:
encrypted data. We introduce a prec
Page 19 and 20:
present an attack showing that a pa
Page 21 and 22:
alternatives: mis (based on mutual
Page 23 and 24:
5.0 Conclusions and Recommendations
Page 25 and 26:
[14] Bogdanov, Andrej, and Lee, Chi
Page 27 and 28:
8.0 List of Symbols, Abbreviations,
Page 29 and 30:
Public Affairs Approvals for papers
Page 31 and 32:
Contents 1 Introduction 1 1.1 Our M
Page 33 and 34:
t j = P (a j ), and finally interpo
Page 35 and 36:
apparent problem by replacing the M
Page 37 and 38:
As noted above, there is a multilin
Page 39 and 40:
f(x 1 , . . . , x n ) ∈ F and eve
Page 41 and 42:
Translation. Pick up from the publi
Page 43 and 44:
Lemma 4. Let prime p = ω(N 2 ). Th
Page 45 and 46:
[vDGHV10] Marten van Dijk, Craig Ge
Page 47 and 48:
have u 2 − v 2 = 1 → (u − v)(
Page 49 and 50:
inary), and we want to compute g c
Page 51 and 52:
Fully Homomorphic Encryption withou
Page 53 and 54:
scheme have bit length Ω(D) to all
Page 55 and 56:
fast. Thus, the actual magnitude of
Page 57 and 58:
Definition 3 (B-bounded distributio
Page 59 and 60:
achieve 2 λ security against known
Page 61 and 62:
Proof. 〈c 2 , s 2 〉 = BitDecomp
Page 63 and 64:
• FHE.Add(pk, c 1 , c 2 ): Takes
Page 65 and 66:
The computation needed to compute t
Page 67 and 68:
If a and b are large enough, B domi
Page 69 and 70:
5.1.2 How Batching Works Deploying
Page 71 and 72:
We have the following lemma. Lemma
Page 73 and 74:
Unpack(c, {τ σi→1 (s 1 )→s 2
Page 75 and 76:
Since ‖e q1 ‖ < r q1 ,in, e q1
Page 77 and 78:
[22] Damien Stehlé and Ron Steinfe
Page 79 and 80:
1 Introduction Fully homomorphic en
Page 81 and 82:
encryptions of the same message usi
Page 83 and 84:
and Tromer [CT10] in a completely d
Page 85 and 86:
is negligible in k, where Expt CPA
Page 87 and 88:
2.3 Non-Interactive Simulation-Soun
Page 89 and 90:
is defined as (state 1 , m 1 , . .
Page 91 and 92:
scheme has almost-all-keys perfect
Page 93 and 94:
The algorithm S 1 . The algorithm S
Page 95 and 96:
The distribution D 6 . This distrib
Page 97 and 98:
We resolve this issue using the app
Page 99 and 100:
the number of common reference stri
Page 101 and 102:
• Homomorphic evaluation: The hom
Page 103 and 104:
The number of repeated homomorphic
Page 105 and 106:
[Gro04] [Gro10] J. Groth. Rerandomi
Page 107 and 108:
Trapdoors for Lattices: Simpler, Ti
Page 109 and 110:
mentioned, two central objects are
Page 111 and 112:
Dimension m Quality s Length β ≈
Page 113 and 114:
defined by G (or the semi-random ma
Page 115 and 116:
1.4 Other Related Work Concrete par
Page 117 and 118:
Cryptographic problems. For β > 0,
Page 119 and 120:
andom over G m s , for uniformly ra
Page 121 and 122:
3 Search to Decision Reduction Here
Page 123 and 124:
• Preimage sampling for f G (x) =
Page 125 and 126:
Note that for x ∈ {0, . . . , q
Page 127 and 128:
The offline ‘bucketing’ approac
Page 129 and 130:
G is primitive, the tag H in the ab
Page 131 and 132:
conditional distribution of R given
Page 133 and 134:
and parallelism of Algorithm 3 come
Page 135 and 136:
is a coset of the lattice Λ = L( [
Page 137 and 138:
scheme is su-scma-secure if Adv su-
Page 139 and 140:
a discrete Gaussian with parameter
Page 141 and 142:
• G ∈ Z n×nk q is a gadget mat
Page 143 and 144:
must return this e (but possibly di
Page 145 and 146:
[Gen09b] C. Gentry. Fully homomorph
Page 147 and 148:
[vGHV10] M. van Dijk, C. Gentry, S.
Page 149 and 150:
Contents 1 Introduction 1 2 Backgro
Page 151 and 152:
1 Introduction In his breakthrough
Page 153 and 154:
Then in Section 3 we describe our
Page 155 and 156:
In some more detail, the BGV key sw
Page 157 and 158:
itself has low norm. In BGV [5] thi
Page 159 and 160:
3.4 Randomized Multiplication by Co
Page 161 and 162:
One subtle implementation detail to
Page 163 and 164:
ciphertexts. Producing the encrypte
Page 165 and 166:
[24] Benny Pinkas, Thomas Schneider
Page 167 and 168:
A.4 Sampling From A q At various po
Page 169 and 170:
To maintain the noise estimate, the
Page 171 and 172:
variance σ 2 φ(m), so 2d 2 (ζ)ɛ
Page 173 and 174:
We stress that the only place where
Page 175 and 176:
C.1.1 LWE with Sparse Key The analy
Page 177 and 178:
The Smallest Modulus. After evaluat
Page 179 and 180:
down by a factor of p t . Let’s r
Page 181 and 182:
to apply a map κ i we express it a
Page 183 and 184:
1 Introduction Fully homomorphic en
Page 185 and 186:
4. No restrictions on the secret ke
Page 187 and 188:
We point out that an alternative so
Page 189 and 190:
Recall that GapSVP γ is the (promi
Page 191 and 192:
Proof. By definition ⟨c, (1, s)
Page 193 and 194:
• SI-HE.Enc pk (m): Identical to
Page 195 and 196:
Proof of Theorem 4.2. Consider the
Page 197 and 198:
We can now plug in what we know abo
Page 199 and 200:
In particular (recall that E < ⌊q
Page 201 and 202:
[Reg03] Oded Regev. New lattice bas
Page 203 and 204:
1 Introduction An encryption scheme
Page 205 and 206:
need to have errors. Since the expe
Page 207 and 208:
Again we allow some “slackness”
Page 209 and 210:
Learning Linear Functions. the clas
Page 211 and 212:
Let us first outline the proof of T
Page 213 and 214:
P ′ . 4 Namely H n ′ :n = P ′
Page 215 and 216:
In conclusion, we get a sub-scheme
Page 217 and 218:
[BV11b] [Gen09] [Gen10] [GH11] [GHS
Page 219 and 220:
Quantum-Secure Message Authenticati
Page 221 and 222:
the success probability away from 1
Page 223 and 224:
Functions will be denoted by capito
Page 225 and 226:
Quantum chosen message queries. In
Page 227 and 228:
Since the w are the possible result
Page 229 and 230:
number of distinct component values
Page 231 and 232:
4.1 A Tight Upper Bound Theorem 4.1
Page 233 and 234:
The algorithm is similar to the alg
Page 235 and 236:
As we have already seen, for expone
Page 237 and 238:
where S i (m) = (R i (m), PRF(k, (R
Page 239 and 240:
To prove this theorem, we treat Y a
Page 241 and 242:
Now we use this attack to obtain an
Page 243 and 244:
Using this lemma we show that (3q +
Page 245 and 246:
[KK11] Daniel M. Kane and Samuel A.
Page 247 and 248:
1 Introduction Cloud storage system
Page 249 and 250:
subset of the server’s storage, t
Page 251 and 252:
security does not suffice. The main
Page 253 and 254:
Static Data. PoR and PDP schemes fo
Page 255 and 256:
For any efficient adversarial serve
Page 257 and 258:
Overview of Construction. Let (Enc,
Page 259 and 260:
means that one of the audit protoco
Page 261 and 262:
Now we claim that an execution of E
Page 263 and 264:
having higher capacity. The tables
Page 265 and 266:
OWrite(i 1 , . . . , i t ; v 1 , .
Page 267 and 268:
j-th level table again. With this o
Page 269 and 270:
and distribute reprints for Governm
Page 271 and 272:
A Simple Dynamic PoR with Square-Ro
Page 273 and 274:
from Section 6 that is NRPH secure.
Page 275 and 276:
The LWE problem was introduced in t
Page 277 and 278:
1.2 Techniques and Comparison to Re
Page 279 and 280:
(large) uniform errors as in [10],
Page 281 and 282:
Proof. Let A be an algorithm runnin
Page 283 and 284:
that 1 + ɛ = (1 + ɛ 1 )(1 + ɛ 2
Page 285 and 286:
Because we are concerned with small
Page 287 and 288:
For each i, since gcd(z i , q) = 1
Page 289 and 290:
Proof. Let ω n = ω( √ log n) sa
Page 291 and 292:
Theorem 3.8. Let m, n be integers,
Page 293 and 294:
σ · O( √ m), except with probab
Page 295 and 296:
k = n/2, and it suffices to set the
Page 297 and 298:
[23] C. Peikert and B. Waters. Loss
Page 299 and 300:
1 Introduction Consider the followi
Page 301 and 302:
In the online phase clients individ
Page 303 and 304:
the clients jointly run a secure co
Page 305 and 306:
to compute F from scratch. The work
Page 307 and 308:
I. Pre-processing phase. In this ph
Page 309 and 310:
Online Phase: 1. Each client D i ge
Page 311 and 312:
2n ciphertexts in order to be sure
Page 313 and 314:
[KMR11] [KMR12] [Lip12] [LTV12] Sen
Page 315 and 316:
For any set of adversarial parties
Page 317 and 318:
C.5 Secure Computation We make use
Page 319 and 320:
Experiment H 4 . This experiment is
Page 321 and 322:
of A only in the case when A guesse
Page 323 and 324:
leading to concrete implementations
Page 325 and 326:
y modeling each block by an interac
Page 327 and 328:
z i P 2 Q 1 y i P 1 s 1 r 1 x i w i
Page 329 and 330:
2 Distributed Systems, Composition,
Page 331 and 332:
[G | H](y) = (w, x): z = y w = y x[
Page 333 and 334:
infinite chains, such as (M ∗ ;
Page 335 and 336:
2.3 Multi-party computation, securi
Page 337 and 338:
BCast(x) = (y 1 , . . . , y n ): y
Page 339 and 340:
Sim(y A , s A ) = (y ′ A , r A):
Page 341 and 342:
WCast(x ′ , w) = (y 1 ′ , . . .
Page 343 and 344:
s ′ 0 s ′ A r ′ A y ′ H s
Page 345 and 346:
p r ′ A Net’ s ′ r ′ H r A
Page 347 and 348:
Notice that we have already underta
Page 349 and 350:
simpler protocol description. For t
Page 351 and 352:
[29] Andrew Chi-Chih Yao. Protocols
Page 353 and 354:
2 Mihir Bellare, Stefano Tessaro, a
Page 355 and 356:
Page 357 and 358:
Page 359 and 360:
Page 361 and 362:
10 Mihir Bellare, Stefano Tessaro,
Page 363 and 364:
Page 365 and 366:
Page 367 and 368:
Page 369 and 370:
Page 371 and 372:
Multi-Instance Security and its App
Page 373 and 374:
Multi-instance Security and Passwor
Page 375 and 376:
Page 377 and 378:
Page 379 and 380:
Page 381 and 382:
Page 383 and 384:
Page 385 and 386:
Page 387 and 388:
Page 389 and 390:
Page 391 and 392:
a hash-of-hash construction: H 2 (M
Page 393 and 394: guisher queries (our lower bounds r
Page 395 and 396: in so doing they accidentally intro
Page 397 and 398: of D is defined as [ [ ] AdvH[P],R,
Page 399 and 400: main POW H[P],n,l1 : P 1 P 2 X 2
Page 401 and 402: now,thinkforconvenienceofw = l).The
Page 403 and 404: aroundO(q 2 )queries.Ideally, wewou
Page 405 and 406: HMAC l (K,Y 0) Y 0 F K Y 0 ′ G K
Page 407 and 408: This material is based on research
Page 409 and 410: 24. Ari Juels and John G. Brainard.
Page 411 and 412: Contents 1 The BGV Homomorphic Encr
Page 413 and 414: ‖a‖ canon 2 . The basic operati
Page 415 and 416: EncryptedArray/EncrytedArrayMod2r R
Page 417 and 418: g i ’s and h i ’s in one list,
Page 419 and 420: 2.6 IndexSet and IndexMap: Sets and
Page 421 and 422: turn, are sometimes partitioned fur
Page 423 and 424: DoubleCRT& operator-=(const ZZ &num
Page 425 and 426: homomorphic automorphism operation
Page 427 and 428: For reasons that will be discussed
Page 429 and 430: where D i is the size of the i’th
Page 431 and 432: When key-switching a ciphertext ⃗
Page 433 and 434: constant (i.e. |poly(τ m )| 2 ), o
Page 435 and 436: ool isCorrect() const; and double l
Page 437 and 438: For the noise estimate in the new c
Page 439 and 440: The first time that ImportSecKey is
Page 441 and 442: EncryptedArray(const FHEcontext& co
Page 443: The MUX operation is implemented by
Page 447 and 448: EncryptedArrayMod2r ea(context); lo
Page 449 and 450: H/2m each and 0 with probability 1
Page 451 and 452: So now consider the inner sum in (7
show all

a590003

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?