a590003

More documents

Recommendations

Info

References [1] L. I. Bluestein. A linear filtering approach to the computation of the discrete fourier transform. Northeast Electronics Research and Engineering Meeting Record 10, 1968. [2] Z. Brakerski, C. Gentry, and V. Vaikuntanathan. Fully homomorphic encryption without bootstrapping. In Innovations in Theoretical Computer Science (ITCS’12), 2012. Available at http://eprint.iacr.org/2011/277. [3] C. Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the 41st ACM Symposium on Theory of Computing – STOC 2009, pages 169–178. ACM, 2009. [4] C. Gentry, S. Halevi, and N. Smart. Fully homomorphic encryption with polylog overhead. In ”Advances in Cryptology - EUROCRYPT 2012”, volume 7237 of Lecture Notes in Computer Science, pages 465–482. Springer, 2012. Full version at http://eprint.iacr.org/2011/566. [5] C. Gentry, S. Halevi, and N. Smart. Homomorphic evaluation of the AES circuit. In ”Advances in Cryptology - CRYPTO 2012”, volume 7417 of Lecture Notes in Computer Science, pages 850–867. Springer, 2012. Full version at http://eprint.iacr.org/2012/099. [6] C. Gentry, S. Halevi, and N. P. Smart. Better bootstrapping in fully homomorphic encryption. In Public Key Cryptography - PKC 2012, volume 7293 of Lecture Notes in Computer Science, pages 1–16. Springer, 2012. [7] V. Lyubashevsky, C. Peikert, and O. Regev. On ideal lattices and learning with errors over rings. In H. Gilbert, editor, Advances in Cryptology - EUROCRYPT’10, volume 6110 of Lecture Notes in Computer Science, pages 1–23. Springer, 2010. [8] R. Rivest, L. Adleman, and M. Dertouzos. On data banks and privacy homomorphisms. In Foundations of Secure Computation, pages 169–177. Academic Press, 1978. [9] V. Shoup. NTL: A Library for doing Number Theory. http://shoup.net/ntl/, Version 5.5.2, 2010. [10] N. P. Smart and F. Vercauteren. Fully homomorphic SIMD operations. Manuscript at http://eprint.iacr.org/2011/133, 2011. A Proof of noise-estimate Recall that we observed empirically that for a random Hamming-weight-H polynomial s with coefficients −1/0/1 and an integral power r we have E[|s r (τ)| 2r ] ≈ r! · H r , where τ is the principal complex m-th root of unity, τ = e 2πi/m . To simplify the proof, we analyze the case that each coefficient of s is chosen uniformly at random from −1/0/1, so that the expected Hamming weight is H. Also, we assume that s is chosen as a degree-(m − 1) polynomial (rather than degree φ(m) − 1). Theorem 1. Suppose m, r, H are positive integers, with H ≤ m, and let τ = e 2πi/m ∈ C. Suppose that we choose f 0 , . . . , f m−1 independently, where for i = 0, . . . , m − 1, f i is ±1 with probability 37 16. Design and Implementation of a Homomorphic-Encryption Library
H/2m each and 0 with probability 1 − H/m. Let f(X) = ∑ m−1 i=0 f iX i . Then for fixed r and H, m → ∞, we have E[|f(τ)| 2r ] ∼ r!H r . In particular, for H ≥ 2r 2 , we have E[|f(τ)| 2r ] ∣ r!H r − 1 ∣ ≤ 2r2 H + 2r+1 r 2 m . Before proving Theorem 1, we introduce some notation and prove some technical results that will be useful. Recall the “falling factorial” notation: for integers n, k with 0 ≤ k ≤ n, we define n k = ∏ k−1 j=0 (n − j). Lemma 1. For n ≥ k 2 > 0, we have n k − n k ≤ k 2 n k−1 . Proof. We have n k ≥ (n − k) k = n k − ( ( ( k k k kn 1) k−1 + k 2) 2 n k−2 − k 3) 3 n k−3 + − · · · . The lemma follows by verifying that when n ≥ k 2 , in the above binomial expansion, the sum of every consecutive positive/negative pair of terms in non-negative. Lemma 2. For n ≥ 2k 2 > 0, we have n k ≤ 2n k . Proof. This follows immediately from the previous lemma. Next, we recall the notion of the Stirling number of the second kind, which is the number of ways to partition a set of l objects into k non-empty subsets, and is denoted { l k} . We use the following standard result: l∑ { l n k} k = n l . (1) k=1 Finally, we define M 2n to be the number of perfect matchings in the complete graph on 2n vertices, and M n,n to be the number of perfect matchings on the complete bipartite graph on two sets of n vertices. The following facts are easy to establish: and M n,n = n! (2) M 2n ≤ 2 n n!. (3) We now turn to the proof of the theorem. We have f(τ) 2r = f(τ) r f(¯τ) r = ∑ f i1 · · · f i2r · τ i1 · · · τ ir · τ −i r+1 · · · τ −i 2r . i 1 ,...,i 2r We will extend the usual notion of expected values to complex-valued random variables: if U and V are real-valued random variables, then E[U + V i] = E[U] + E[V ]i. The usual rules for sums and products of expectations work equally well. By linearity of expectation, we have E[f(τ) 2r ] = ∑ E[f i1 · · · f i2r ] · τ i1 · · · τ ir · τ −i r+1 · · · τ −i 2r . (4) i 1 ,...,i 2r 38 16. Design and Implementation of a Homomorphic-Encryption Library
Page 1 and 2:
AFRL-RI-RS-TR-2013-191 ADVANCED HOM
Page 3 and 4:
REPORT DOCUMENTATION PAGE Form Appr
Page 5 and 6:
12. An Equational Approach to Secur
Page 7 and 8:
1.0 Executive Summary The ultimate
Page 9 and 10:
The PROCEED program efforts are bro
Page 11 and 12:
Towards the end of the project we i
Page 13 and 14:
feature of the framework is that it
Page 15 and 16:
4.3 Publications Figure 1: A block
Page 17 and 18:
encrypted data. We introduce a prec
Page 19 and 20:
present an attack showing that a pa
Page 21 and 22:
alternatives: mis (based on mutual
Page 23 and 24:
5.0 Conclusions and Recommendations
Page 25 and 26:
[14] Bogdanov, Andrej, and Lee, Chi
Page 27 and 28:
8.0 List of Symbols, Abbreviations,
Page 29 and 30:
Public Affairs Approvals for papers
Page 31 and 32:
Contents 1 Introduction 1 1.1 Our M
Page 33 and 34:
t j = P (a j ), and finally interpo
Page 35 and 36:
apparent problem by replacing the M
Page 37 and 38:
As noted above, there is a multilin
Page 39 and 40:
f(x 1 , . . . , x n ) ∈ F and eve
Page 41 and 42:
Translation. Pick up from the publi
Page 43 and 44:
Lemma 4. Let prime p = ω(N 2 ). Th
Page 45 and 46:
[vDGHV10] Marten van Dijk, Craig Ge
Page 47 and 48:
have u 2 − v 2 = 1 → (u − v)(
Page 49 and 50:
inary), and we want to compute g c
Page 51 and 52:
Fully Homomorphic Encryption withou
Page 53 and 54:
scheme have bit length Ω(D) to all
Page 55 and 56:
fast. Thus, the actual magnitude of
Page 57 and 58:
Definition 3 (B-bounded distributio
Page 59 and 60:
achieve 2 λ security against known
Page 61 and 62:
Proof. 〈c 2 , s 2 〉 = BitDecomp
Page 63 and 64:
• FHE.Add(pk, c 1 , c 2 ): Takes
Page 65 and 66:
The computation needed to compute t
Page 67 and 68:
If a and b are large enough, B domi
Page 69 and 70:
5.1.2 How Batching Works Deploying
Page 71 and 72:
We have the following lemma. Lemma
Page 73 and 74:
Unpack(c, {τ σi→1 (s 1 )→s 2
Page 75 and 76:
Since ‖e q1 ‖ < r q1 ,in, e q1
Page 77 and 78:
[22] Damien Stehlé and Ron Steinfe
Page 79 and 80:
1 Introduction Fully homomorphic en
Page 81 and 82:
encryptions of the same message usi
Page 83 and 84:
and Tromer [CT10] in a completely d
Page 85 and 86:
is negligible in k, where Expt CPA
Page 87 and 88:
2.3 Non-Interactive Simulation-Soun
Page 89 and 90:
is defined as (state 1 , m 1 , . .
Page 91 and 92:
scheme has almost-all-keys perfect
Page 93 and 94:
The algorithm S 1 . The algorithm S
Page 95 and 96:
The distribution D 6 . This distrib
Page 97 and 98:
We resolve this issue using the app
Page 99 and 100:
the number of common reference stri
Page 101 and 102:
• Homomorphic evaluation: The hom
Page 103 and 104:
The number of repeated homomorphic
Page 105 and 106:
[Gro04] [Gro10] J. Groth. Rerandomi
Page 107 and 108:
Trapdoors for Lattices: Simpler, Ti
Page 109 and 110:
mentioned, two central objects are
Page 111 and 112:
Dimension m Quality s Length β ≈
Page 113 and 114:
defined by G (or the semi-random ma
Page 115 and 116:
1.4 Other Related Work Concrete par
Page 117 and 118:
Cryptographic problems. For β > 0,
Page 119 and 120:
andom over G m s , for uniformly ra
Page 121 and 122:
3 Search to Decision Reduction Here
Page 123 and 124:
• Preimage sampling for f G (x) =
Page 125 and 126:
Note that for x ∈ {0, . . . , q
Page 127 and 128:
The offline ‘bucketing’ approac
Page 129 and 130:
G is primitive, the tag H in the ab
Page 131 and 132:
conditional distribution of R given
Page 133 and 134:
and parallelism of Algorithm 3 come
Page 135 and 136:
is a coset of the lattice Λ = L( [
Page 137 and 138:
scheme is su-scma-secure if Adv su-
Page 139 and 140:
a discrete Gaussian with parameter
Page 141 and 142:
• G ∈ Z n×nk q is a gadget mat
Page 143 and 144:
must return this e (but possibly di
Page 145 and 146:
[Gen09b] C. Gentry. Fully homomorph
Page 147 and 148:
[vGHV10] M. van Dijk, C. Gentry, S.
Page 149 and 150:
Contents 1 Introduction 1 2 Backgro
Page 151 and 152:
1 Introduction In his breakthrough
Page 153 and 154:
Then in Section 3 we describe our
Page 155 and 156:
In some more detail, the BGV key sw
Page 157 and 158:
itself has low norm. In BGV [5] thi
Page 159 and 160:
3.4 Randomized Multiplication by Co
Page 161 and 162:
One subtle implementation detail to
Page 163 and 164:
ciphertexts. Producing the encrypte
Page 165 and 166:
[24] Benny Pinkas, Thomas Schneider
Page 167 and 168:
A.4 Sampling From A q At various po
Page 169 and 170:
To maintain the noise estimate, the
Page 171 and 172:
variance σ 2 φ(m), so 2d 2 (ζ)ɛ
Page 173 and 174:
We stress that the only place where
Page 175 and 176:
C.1.1 LWE with Sparse Key The analy
Page 177 and 178:
The Smallest Modulus. After evaluat
Page 179 and 180:
down by a factor of p t . Let’s r
Page 181 and 182:
to apply a map κ i we express it a
Page 183 and 184:
1 Introduction Fully homomorphic en
Page 185 and 186:
4. No restrictions on the secret ke
Page 187 and 188:
We point out that an alternative so
Page 189 and 190:
Recall that GapSVP γ is the (promi
Page 191 and 192:
Proof. By definition ⟨c, (1, s)
Page 193 and 194:
• SI-HE.Enc pk (m): Identical to
Page 195 and 196:
Proof of Theorem 4.2. Consider the
Page 197 and 198:
We can now plug in what we know abo
Page 199 and 200:
In particular (recall that E < ⌊q
Page 201 and 202:
[Reg03] Oded Regev. New lattice bas
Page 203 and 204:
1 Introduction An encryption scheme
Page 205 and 206:
need to have errors. Since the expe
Page 207 and 208:
Again we allow some “slackness”
Page 209 and 210:
Learning Linear Functions. the clas
Page 211 and 212:
Let us first outline the proof of T
Page 213 and 214:
P ′ . 4 Namely H n ′ :n = P ′
Page 215 and 216:
In conclusion, we get a sub-scheme
Page 217 and 218:
[BV11b] [Gen09] [Gen10] [GH11] [GHS
Page 219 and 220:
Quantum-Secure Message Authenticati
Page 221 and 222:
the success probability away from 1
Page 223 and 224:
Functions will be denoted by capito
Page 225 and 226:
Quantum chosen message queries. In
Page 227 and 228:
Since the w are the possible result
Page 229 and 230:
number of distinct component values
Page 231 and 232:
4.1 A Tight Upper Bound Theorem 4.1
Page 233 and 234:
The algorithm is similar to the alg
Page 235 and 236:
As we have already seen, for expone
Page 237 and 238:
where S i (m) = (R i (m), PRF(k, (R
Page 239 and 240:
To prove this theorem, we treat Y a
Page 241 and 242:
Now we use this attack to obtain an
Page 243 and 244:
Using this lemma we show that (3q +
Page 245 and 246:
[KK11] Daniel M. Kane and Samuel A.
Page 247 and 248:
1 Introduction Cloud storage system
Page 249 and 250:
subset of the server’s storage, t
Page 251 and 252:
security does not suffice. The main
Page 253 and 254:
Static Data. PoR and PDP schemes fo
Page 255 and 256:
For any efficient adversarial serve
Page 257 and 258:
Overview of Construction. Let (Enc,
Page 259 and 260:
means that one of the audit protoco
Page 261 and 262:
Now we claim that an execution of E
Page 263 and 264:
having higher capacity. The tables
Page 265 and 266:
OWrite(i 1 , . . . , i t ; v 1 , .
Page 267 and 268:
j-th level table again. With this o
Page 269 and 270:
and distribute reprints for Governm
Page 271 and 272:
A Simple Dynamic PoR with Square-Ro
Page 273 and 274:
from Section 6 that is NRPH secure.
Page 275 and 276:
The LWE problem was introduced in t
Page 277 and 278:
1.2 Techniques and Comparison to Re
Page 279 and 280:
(large) uniform errors as in [10],
Page 281 and 282:
Proof. Let A be an algorithm runnin
Page 283 and 284:
that 1 + ɛ = (1 + ɛ 1 )(1 + ɛ 2
Page 285 and 286:
Because we are concerned with small
Page 287 and 288:
For each i, since gcd(z i , q) = 1
Page 289 and 290:
Proof. Let ω n = ω( √ log n) sa
Page 291 and 292:
Theorem 3.8. Let m, n be integers,
Page 293 and 294:
σ · O( √ m), except with probab
Page 295 and 296:
k = n/2, and it suffices to set the
Page 297 and 298:
[23] C. Peikert and B. Waters. Loss
Page 299 and 300:
1 Introduction Consider the followi
Page 301 and 302:
In the online phase clients individ
Page 303 and 304:
the clients jointly run a secure co
Page 305 and 306:
to compute F from scratch. The work
Page 307 and 308:
I. Pre-processing phase. In this ph
Page 309 and 310:
Online Phase: 1. Each client D i ge
Page 311 and 312:
2n ciphertexts in order to be sure
Page 313 and 314:
[KMR11] [KMR12] [Lip12] [LTV12] Sen
Page 315 and 316:
For any set of adversarial parties
Page 317 and 318:
C.5 Secure Computation We make use
Page 319 and 320:
Experiment H 4 . This experiment is
Page 321 and 322:
of A only in the case when A guesse
Page 323 and 324:
leading to concrete implementations
Page 325 and 326:
y modeling each block by an interac
Page 327 and 328:
z i P 2 Q 1 y i P 1 s 1 r 1 x i w i
Page 329 and 330:
2 Distributed Systems, Composition,
Page 331 and 332:
[G | H](y) = (w, x): z = y w = y x[
Page 333 and 334:
infinite chains, such as (M ∗ ;
Page 335 and 336:
2.3 Multi-party computation, securi
Page 337 and 338:
BCast(x) = (y 1 , . . . , y n ): y
Page 339 and 340:
Sim(y A , s A ) = (y ′ A , r A):
Page 341 and 342:
WCast(x ′ , w) = (y 1 ′ , . . .
Page 343 and 344:
s ′ 0 s ′ A r ′ A y ′ H s
Page 345 and 346:
p r ′ A Net’ s ′ r ′ H r A
Page 347 and 348:
Notice that we have already underta
Page 349 and 350:
simpler protocol description. For t
Page 351 and 352:
[29] Andrew Chi-Chih Yao. Protocols
Page 353 and 354:
2 Mihir Bellare, Stefano Tessaro, a
Page 355 and 356:
Page 357 and 358:
Page 359 and 360:
Page 361 and 362:
10 Mihir Bellare, Stefano Tessaro,
Page 363 and 364:
Page 365 and 366:
Page 367 and 368:
Page 369 and 370:
Page 371 and 372:
Multi-Instance Security and its App
Page 373 and 374:
Multi-instance Security and Passwor
Page 375 and 376:
Page 377 and 378:
Page 379 and 380:
Page 381 and 382:
Page 383 and 384:
Page 385 and 386:
Page 387 and 388:
Page 389 and 390:
Page 391 and 392:
a hash-of-hash construction: H 2 (M
Page 393 and 394:
guisher queries (our lower bounds r
Page 395 and 396:
in so doing they accidentally intro
Page 397 and 398: of D is defined as [ [ ] AdvH[P],R,
Page 399 and 400: main POW H[P],n,l1 : P 1 P 2 X 2
Page 401 and 402: now,thinkforconvenienceofw = l).The
Page 403 and 404: aroundO(q 2 )queries.Ideally, wewou
Page 405 and 406: HMAC l (K,Y 0) Y 0 F K Y 0 ′ G K
Page 407 and 408: This material is based on research
Page 409 and 410: 24. Ari Juels and John G. Brainard.
Page 411 and 412: Contents 1 The BGV Homomorphic Encr
Page 413 and 414: ‖a‖ canon 2 . The basic operati
Page 415 and 416: EncryptedArray/EncrytedArrayMod2r R
Page 417 and 418: g i ’s and h i ’s in one list,
Page 419 and 420: 2.6 IndexSet and IndexMap: Sets and
Page 421 and 422: turn, are sometimes partitioned fur
Page 423 and 424: DoubleCRT& operator-=(const ZZ &num
Page 425 and 426: homomorphic automorphism operation
Page 427 and 428: For reasons that will be discussed
Page 429 and 430: where D i is the size of the i’th
Page 431 and 432: When key-switching a ciphertext ⃗
Page 433 and 434: constant (i.e. |poly(τ m )| 2 ), o
Page 435 and 436: ool isCorrect() const; and double l
Page 437 and 438: For the noise estimate in the new c
Page 439 and 440: The first time that ImportSecKey is
Page 441 and 442: EncryptedArray(const FHEcontext& co
Page 443 and 444: The MUX operation is implemented by
Page 445 and 446: 5.1 Homomorphic Operations over GF
Page 447: EncryptedArrayMod2r ea(context); lo
Page 451 and 452: So now consider the inner sum in (7
show all

a590003

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?