Transcript

ON THE PROVABLE SECURITY OF

HOMOMORPHIC ENCRYPTION

Andrej BogdanovChinese University of Hong Kong

Bertinoro Summer School | July 2014

based on joint work with Chin Ho LeeNortheastern Unversity

Public-key bit encryption

SKPK

BobAliceb

EncPK(b) DecSK( )

b

EncPK(b)PK

message indistinguishability

(PK, EncPK(0)) and (PK, EncPK(1)) are computationally indistinguishable

El Gamal encryption

g, h in some large cyclic group

PK = ( g, h ) gSK = hsuch that

EncPK(b) = ( gr, 2bhr )where r random

DecSK(x, y) = b such that xSK = 2b y

Homomorphism of encryptions

EncPK(b) = ( gr, 2bhr )

EncPK(b) EncPK(b’) and EncPK(b + b’)are identically distributed

DecSK(EncPK(b) EncPK(b’)) = b + b’

strongly homomorphic

weakly homomorphic

Does P ≠ NP imply cryptography?

provided SAT is worst-case hard

requires average-case hardness

of distinguishing encryptions

Cryptography from lattices

Ajtaione-way functions

Ajtai-Dwork

public-key encryption

Regev, Peikert, Gentry, Brakerski and Vaikutanathan, ...“somewhat” homomorphic encryption

If short vectors in certain lattices are worst-case hard to find, then we have...

but we can find them

in NP ∩ coNP

Reductions

How to prove message indistinguishability?

distinguisher

(PK, EncPK(b))

biased towards b

x ∈ SAT?

q1

a1

q2

a2

YES/NO

From reductions to proof systems

L distinguisher

verifier prover

R

Brassard

randomness for R transcript

for every query (PK, C)answer b

randomness r s.t. EncPK(b, r) = C

is it correct?

are they correct?

OK

From reductions to proof systems

Conclusion

A reduction from L to distinguishing Encimplies that L is in NP ∩ coNP

Yes, but under implicit assumption thatqueries always have a unique answerGoldreich and Goldwasser

Brassard’s assumption

for every PKEncPK(0)

EncPK(1)query

what if

EncPK(0)

EncPK(1)

EncPK(0)

EncPK(1)

Restricting the reduction

If reduction is nonadaptive then L is in AM ∩ coAM

For general encryptions, best we can say

Feigenbaum and Fortnow, B. and Trevisan,Akavia Goldreich Goldwasser and Moshkovitz

Our result

If Enc has weak homomorphic evaluator for f, then L is in AM ∩ coAM

Reduction can be adaptive, queries arbitrary

If reduction has constant query complexity, then L is in statistical zero-knowledge

Let f be a “polynomially sensitive” function

Sensitivity of functions

f:0

0100

11000 1

01101

0101 sens0 f(0100) = 2

sens0 f = maxx sens0 f(x)

f: {0, 1}n → {0, 1} is polynomially sensitive if sens0 f, sens1 f are at least nW(1)

AM

SZK

P

coAM

Homomorphic encryptions,reductions of constantquery complexity

Homomorphic encryptions,arbitrary reductions

previous worksArbitrary encryptions,nonadaptive reductions

SAT

Rerandomization

The ability to map a ciphertext into an i.i.d ciphertext without knowing the secret key

C = ( gr, 2bhr )

PK = ( g, h ) gSK = hsuch that

RerPK(C) = C ∙ ( gr’, hr’ )

El Gamal example

is i.i.d with C

Rerandomization from evaluation

strong homomorphic evaluator for majority

HE

nc(0

)

Enc(b)

En

c(0

)

En

c(0

)

En

c(b

)

En

c(1

)

En

c(1

)

En

c(1

)

Rer

Rerandomization from evaluation

HE

nc(0

)

En

c(0

)

En

c(0

)

En

c(0

)

To H, Enc(0) indistinguishable from Enc(0)so output of H must forget most of Enc(0)

Rerandomization from evaluation

If H is a strong homomorphic evaluator for majority on k bits,

then (Enc(b), Rer(Enc(b)) is √c/k-close to a pair of independent encryptions of b.

Lemma

We prove a weaker version for weak homomorphic evaluators and any sensitive f.

Distinguishing rerandomizations

Encryption can be broken using rerandomization and an SZK oracle

Enc(b)Rer( ) Enc(0)

If b = 0, they are statistically close

vs.

If b = 1, they must be statistically far

so they can be distinguished in SZK

The rest of the proof

Since we can decrypt in SZK, L can be solved with reduction + SZK oracle

So L is in BPPSZK ⊆ AM coAM⋂Mahmoody and Xiao

For weak homomorphism and general f, not sure if true; we give new proof system

Quality of rerandomization

If H is a homomorphic evaluator for majority on k bits,then (Enc(b), Rer(Enc(b)) is √c/k-close to a pair of independent encryptions of b.

Lemma

For strong homomorphic evaluation, we can make this exponentially small.

Improving the rerandomization

En

c(b

)

En

c(0

)

En

c(1

)H

Enc(b)

H

Enc(1) Enc(0)

Enc(b)

Algorithm:Apply H iteratively t times.

Analysis

En

c(1

)

En

c(1

)

En

c(0

)

H

En

c(0

)

En

c(1

)

En

c(0

)

H

En

c(0

)

En

c(b

)

En

c(1

)H

H

Enc(b) Enc(1) Enc(0)

Enc(b)

Analysis

En

c(1

)

En

c(1

)

En

c(0

)

H

En

c(0

)

En

c(1

)

En

c(1

)H

H

Enc(1) Enc(1)

En

c(0

)

En

c(1

)

En

c(0

)

H

Enc(0)

Enc(1)

Analysis

If we recurse t times, original Enc(b) could be any one of 2t inputsApplying lemma, distinguishing advantage drops to O(√c/2t)

Value of t is determined by quality of HStatistical distance between output of H and

actual encryption

Rerandomization theorem

f : any function except for AND, OR, NOT

then there is a rerandomization with statistical error 2-W(h).

Assume f has strong homomorphic evaluator with quality 2-h


Top Related