Multilinear Maps over the Integers From Design to Security Tancrde - PowerPoint PPT Presentation

Simplifications for Zero-Testing − 1 / z k mod p i ) · p ∗ p j ) · q ′′ mod x 0 � � [ � g i r i · ( p ∗ 0 ] k = i + ( i i where p ∗ i = � j � = i p j The random value q ′′ makes di ffi cult to obtain something small... except if we are working modulo � p j In the following x 0 = � p j , and m ] j = c / z j mod x 0 = CRT p 1 ,..., p n ( r 1 · g 1 + m 1 , . . . , r n · g n + m n ) [ � mod x 0 z j 9 / 30

Zero-Testing Procedure Multiply by the public element (where h i ≪ p i ) z k mod p i ) · p ∗ � h i · ( g − 1 p zt = i mod x 0 i i 10 / 30

Zero-Testing Procedure Multiply by the public element (where h i ≪ p i ) z k mod p i ) · p ∗ � h i · ( g − 1 p zt = i mod x 0 i i m ] k = c / z k mod x 0 = CRT p 1 ,..., p n ( r 1 · g 1 + m 1 , . . . , r n · g n + m n ) [ � mod x 0 z k therefore � ( r i + m i g − 1 ) · h i · p ∗ [ � m ] k · p zt = i mod x 0 i i 10 / 30

Zero-Testing Procedure Multiply by the public element (where h i ≪ p i ) z k mod p i ) · p ∗ � h i · ( g − 1 p zt = i mod x 0 i i m ] k = c / z k mod x 0 = CRT p 1 ,..., p n ( r 1 · g 1 + m 1 , . . . , r n · g n + m n ) [ � mod x 0 z k therefore � ( r i + m i g − 1 ) · h i · p ∗ [ � m ] k · p zt = i mod x 0 i i We have (we prove equivalence whp when many p zt ’s are given) m = � � 0 ⇒ | [ � m ] k · p zt mod x 0 | ≪ x 0 10 / 30

Hardness Assumptions 11 / 30

Hardness Assumptions m i ] 1 and [ � GDDH: Given ( k + 1 ) elements [ � m ′ ] k , determine m ′ ≃ � k + 1 whether � i = 1 � m i . 11 / 30

Hardness Assumptions m i ] 1 and [ � GDDH: Given ( k + 1 ) elements [ � m ′ ] k , determine m ′ ≃ � k + 1 whether � i = 1 � m i . At the heart of the multipartite key echange protocol 11 / 30

Hardness Assumptions m i ] 1 and [ � GDDH: Given ( k + 1 ) elements [ � m ′ ] k , determine m ′ ≃ � k + 1 whether � i = 1 � m i . At the heart of the multipartite key echange protocol Assumed to be hard (no reduction to Approx.-GCD) 11 / 30

Hardness Assumptions m i ] 1 and [ � GDDH: Given ( k + 1 ) elements [ � m ′ ] k , determine m ′ ≃ � k + 1 whether � i = 1 � m i . At the heart of the multipartite key echange protocol Assumed to be hard (no reduction to Approx.-GCD) Asymptotic parameters obtained from numerous attacks orthogonal lattice attack on encodings GCD attack on zero-testing hidden subset sum attack on zero-testing attacks on the inverse zero-testing matrix brute-force on the noises, . . . 11 / 30

But... Zeroizing Attack Eurocrypt 2015 best paper [CHLRS15] 12 / 30

The Zeroizing Attack on CLT13 Exploiting the (bi)linearity of the zero-testing procedure 13 / 30

The Zeroizing Attack on CLT13 Exploiting the (bi)linearity of the zero-testing procedure [ � 0 ] k · p zt = � i r i · ( h i · p ∗ i ) ∈ Z 13 / 30

The Zeroizing Attack on CLT13 Exploiting the (bi)linearity of the zero-testing procedure 0 ] k − 2 · [ � i r i · ˆ [ � c ] 1 · p zt = � b i · ˆ c i · ( h i · p ∗ b ] 1 · [ � i ) ∈ Z 13 / 30

The Zeroizing Attack on CLT13 Exploiting the (bi)linearity of the zero-testing procedure 0 ] k − 2 · [ � i r i · ˆ [ � c ] 1 · p zt = � b i · ˆ c i · ( h i · p ∗ b ] 1 · [ � i ) ∈ Z r i ˆ c i ˆ b i · ( h i · p ∗ i ) 13 / 30

The Zeroizing Attack on CLT13 Exploiting the (bi)linearity of the zero-testing procedure 0 ] k − 2 · [ � i r i · ˆ [ � c ] 1 · p zt = � b i · ˆ c i · ( h i · p ∗ b ] 1 · [ � i ) ∈ Z r i ˆ c i ˆ b i · ( h i · p ∗ i ) 13 / 30

The Zeroizing Attack on CLT13 Inversion over Q c ] 1 and two targets [ � b ] 1 , [ � Let’s do it with many [ � b ′ ] 1 0 ] k − 2 , [ � 14 / 30

The Zeroizing Attack on CLT13 Inversion over Q c ] 1 and two targets [ � b ] 1 , [ � Let’s do it with many [ � b ′ ] 1 0 ] k − 2 , [ � r i r i ˆ ˆ c i c i ˆ ˆ b i · ( h i · p ∗ b ′ i · ( h i · p ∗ i ) i ) 14 / 30

The Zeroizing Attack on CLT13 Inversion over Q c ] 1 and two targets [ � b ] 1 , [ � Let’s do it with many [ � b ′ ] 1 0 ] k − 2 , [ � 1 ( r − 1 r i c i ) − 1 ˆ (ˆ ) c i ˆ b i · ( h i · p ∗ i i ) ˆ b ′ i · ( h i · p ∗ i ) 14 / 30

The Zeroizing Attack on CLT13 Inversion over Q c ] 1 and two targets [ � b ] 1 , [ � Let’s do it with many [ � b ′ ] 1 0 ] k − 2 , [ � 1 × ( r − 1 r i c i ) − 1 ˆ (ˆ ) c i ˆ b i · ( h i · p ∗ i i ) ˆ b ′ i · ( h i · p ∗ i ) = r i ( r i ) − 1 ˆ b i / ˆ b ′ i 14 / 30

The Zeroizing Attack on CLT13 Computing eigenvalues Consider the target encodings r i ( r i ) − 1 b i / ˆ ˆ b ′ [ � b ] 1 = CRT p i (ˆ [ � b ′ ] 1 = CRT p i (ˆ b ′ b i ) / z , i ) / z i 15 / 30

The Zeroizing Attack on CLT13 Computing eigenvalues Consider the target encodings r i ( r i ) − 1 b i / ˆ ˆ b ′ [ � b ] 1 = CRT p i (ˆ [ � b ′ ] 1 = CRT p i (ˆ b ′ b i ) / z , i ) / z i i = ˆ b i / ˆ Compute the eigenvalues β i /β ′ b ′ i 15 / 30

The Zeroizing Attack on CLT13 Computing eigenvalues Consider the target encodings r i ( r i ) − 1 b i / ˆ ˆ b ′ [ � b ] 1 = CRT p i (ˆ [ � b ′ ] 1 = CRT p i (ˆ b ′ b i ) / z , i ) / z i i = ˆ b i / ˆ Compute the eigenvalues β i /β ′ b ′ i We have that i · [ � b ] 1 − β i · [ � p i | ( β ′ b ′ ] 1 ) 15 / 30

The Zeroizing Attack on CLT13 Computing eigenvalues Consider the target encodings r i ( r i ) − 1 b i / ˆ ˆ b ′ [ � b ] 1 = CRT p i (ˆ [ � b ′ ] 1 = CRT p i (ˆ b ′ b i ) / z , i ) / z i i = ˆ b i / ˆ Compute the eigenvalues β i /β ′ b ′ i We have that i · [ � b ] 1 − β i · [ � p i | ( β ′ b ′ ] 1 ) Compute i · [ � b ] 1 − β i · [ � p i = gcd ( β ′ b ′ ] 1 , x 0 ) 15 / 30

Generalizing the Zeroizing Attack on CLT13 Zeroizing without low-level zeroes [CGHLMMRST15] 16 / 30

Generalizing the Zeroizing Attack on CLT13 Zeroizing without low-level zeroes [CGHLMMRST15] Breaks early tentative fixes [BWZ14,GGHZ14] using zero-testing as a black-box 16 / 30

Generalizing the Zeroizing Attack on CLT13 Zeroizing without low-level zeroes [CGHLMMRST15] Breaks early tentative fixes [BWZ14,GGHZ14] using zero-testing as a black-box Don’t need [ � 0 ] k − 2 · [ � a ] k − 2 · [ � c ] 1 ≃ [ � b ] 1 · [ � c ] 1 but [ � b ] 1 · [ � 0 ] k 16 / 30

Generalizing the Zeroizing Attack on CLT13 Zeroizing without low-level zeroes [CGHLMMRST15] Breaks early tentative fixes [BWZ14,GGHZ14] using zero-testing as a black-box Don’t need [ � 0 ] k − 2 · [ � a ] k − 2 · [ � c ] 1 ≃ [ � b ] 1 · [ � c ] 1 but [ � b ] 1 · [ � 0 ] k Can be diagonal per block. Instead of computing eigenvalues use characteristic polynomial . r i ˆ c i ˆ b i · ( h i · p ∗ i ) 16 / 30

Thwarting Cheon et al. Attack? Can we remove this linearity? [CLT15] 17 / 30

Thwarting Cheon et al. Attack? Can we remove this linearity? [CLT15] The encodings look like DGHV ciphertexts 17 / 30

Thwarting Cheon et al. Attack? Can we remove this linearity? [CLT15] The encodings look like DGHV ciphertexts Even without the randomness q , their form should not be an issue 17 / 30

Thwarting Cheon et al. Attack? Can we remove this linearity? [CLT15] The encodings look like DGHV ciphertexts Even without the randomness q , their form should not be an issue In [CoronL.Tibouchi15], we revisit the zero-testing procedure itself 17 / 30

Thwarting Cheon et al. Attack? Can we remove this linearity? [CLT15] The encodings look like DGHV ciphertexts Even without the randomness q , their form should not be an issue In [CoronL.Tibouchi15], we revisit the zero-testing procedure itself In a nutshell: ◮ the zero-testing is done modulo a new prime modulus N ; ◮ x 0 is no longer public. 17 / 30

Inherent randomness in current encodings 18 / 30

Inherent randomness in current encodings Current form of encodings m ] k = CRT p i ( m i + g i r i ) / z k mod x 0 [ � 18 / 30

Inherent randomness in current encodings Current form of encodings m ] k = CRT p i ( m i + g i r i ) / z k mod x 0 [ � � ( m i g − 1 [ � m ] k = + r i mod p i ) · u i + a · x 0 over Z i i − 1 z − k mod p i ) p ∗ with u i = ( g i p ∗ i . i 18 / 30

Inherent randomness in current encodings Current form of encodings m ] k = CRT p i ( m i + g i r i ) / z k mod x 0 [ � � ( m i g − 1 [ � m ] k = + r i mod p i ) · u i + a · x 0 over Z i i − 1 z − k mod p i ) p ∗ with u i = ( g i p ∗ i . i The element a is highly non-linear in the r i ’s The element a is different from the random q ′ we had before when adapting m = � DGHV ( � 0 ↔ a is small) 18 / 30

New Zero-Test Parameter Pick a random, large prime N ≫ x 0 . We want to generate a new zero-test value α zt such that | [ � m ] k · α zt mod N | ≪ N ⇐ ⇒ � m = 0 19 / 30

New Zero-Test Parameter Pick a random, large prime N ≫ x 0 . We want to generate a new zero-test value α zt such that | [ � m ] k · α zt mod N | ≪ N ⇐ ⇒ � m = 0 In particular, we have [ � m ] k · α zt mod N � ( m i g − 1 = + r i mod p i ) · ( u i · α zt ) + a · x 0 · α zt mod N i i 19 / 30

New Zero-Test Parameter Pick a random, large prime N ≫ x 0 . We want to generate a new zero-test value α zt such that | [ � m ] k · α zt mod N | ≪ N ⇐ ⇒ � m = 0 In particular, we have [ � m ] k · α zt mod N � ( m i g − 1 = + r i mod p i ) · ( u i · α zt ) + a · x 0 · α zt mod N i i so we want | α zt · u i mod N | ≪ N and | α zt · x 0 mod N | ≪ N 19 / 30

How To Generate α zt ? Given N , the generation of α zt ∈ Z N such that for all i , | u i α zt mod N | and | x 0 α zt mod N | are small is not obvious. 20 / 30

How To Generate α zt ? Given N , the generation of α zt ∈ Z N such that for all i , | u i α zt mod N | and | x 0 α zt mod N | are small is not obvious. The problem amounts to finding a relatively short vector in a lattice   1 · · · u 1 u n x 0 N     ...       N   N 20 / 30

How To Generate α zt ? Given N , the generation of α zt ∈ Z N such that for all i , | u i α zt mod N | and | x 0 α zt mod N | are small is not obvious. The problem amounts to finding a relatively short vector in a lattice   1 · · · u 1 u n x 0 N     ...       N   N Use LLL? (we can tolerate an exponential approx. factor over SVP), but typically n ≥ 10 5 20 / 30

How To Generate α zt ? Using the structure of the u i ’s 21 / 30

How To Generate α zt ? Using the structure of the u i ’s − 1 z k mod p i ) p ∗ Remember that N ≫ x 0 and u i = ( g i p ∗ i i 21 / 30

How To Generate α zt ? Using the structure of the u i ’s − 1 z k mod p i ) p ∗ Remember that N ≫ x 0 and u i = ( g i p ∗ i i First note that p − 1 u i mod N is small for all i � = j j 21 / 30

How To Generate α zt ? Using the structure of the u i ’s − 1 z k mod p i ) p ∗ Remember that N ≫ x 0 and u i = ( g i p ∗ i i First note that p − 1 u i mod N is small for all i � = j j Only p − 1 u j mod N is not a priori small j 21 / 30

How To Generate α zt ? Using the structure of the u i ’s − 1 z k mod p i ) p ∗ Remember that N ≫ x 0 and u i = ( g i p ∗ i i First note that p − 1 u i mod N is small for all i � = j j Only p − 1 u j mod N is not a priori small j Let us find α j such that α j · p − 1 u j mod N is small j As before it amounts to finding a short vector in p − 1 � ⌈ N / B ⌉ � u j j N 21 / 30

How To Generate α zt ? Using the structure of the u i ’s p − 1 � ⌈ N / B ⌉ � u j j N 22 / 30

How To Generate α zt ? Using the structure of the u i ’s p − 1 � ⌈ N / B ⌉ � u j j N We chose B such that LLL finds a short vector ( α j · ⌈ N / B ⌉ , β j ) where | α j | ≤ √ p j and | β j = α j · p − 1 u j mod N | ≤ N / √ p j . j 22 / 30

How To Generate α zt ? Using the structure of the u i ’s p − 1 � ⌈ N / B ⌉ � u j j N We chose B such that LLL finds a short vector ( α j · ⌈ N / B ⌉ , β j ) where | α j | ≤ √ p j and | β j = α j · p − 1 u j mod N | ≤ N / √ p j . j New zero-testing element: � h j · α j · p − 1 α zt = mod N j j 22 / 30

How To Generate α zt ? Using the structure of the u i ’s α j ≈ √ p j ): N ≈ x 0 · p j , New zero-testing element (sizes to keep in mind � h j · α j · p − 1 α zt = mod N j j When applied on an encoding [ � m ] k : [ � m ] k · α zt mod N � ( m i g − 1 = + r i mod p i ) · ( u i · α zt ) + a · x 0 · α zt mod N i i 23 / 30

How To Generate α zt ? Using the structure of the u i ’s α j ≈ √ p j ): N ≈ x 0 · p j , New zero-testing element (sizes to keep in mind � h j · α j · p − 1 α zt = mod N j j When applied on an encoding [ � m ] k : [ � m ] k · α zt mod N � � ( m i g − 1 = + r i mod p i ) · ( h i β i + h j α j · u i / p j ) i i j � = i + a · x 0 · α zt mod N 23 / 30

An Important Caveat Cannot work directly modulo x 0 24 / 30

An Important Caveat Cannot work directly modulo x 0 x 0 cannot be made public, contrary to [CLT13] 24 / 30

An Important Caveat Cannot work directly modulo x 0 x 0 cannot be made public, contrary to [CLT13] However, define v 0 = x 0 · α zt mod N , and ([ � 0 ] k · α zt mod N ) mod v 0 � � = ( r i · ( h i β i + h j α j · u i / p j ) + a · v 0 ∈ Z ) mod v 0 j � = i i � � = r i · ( h i β i + h j α j · u i / p j ) mod v 0 j � = i i 24 / 30

An Important Caveat Cannot work directly modulo x 0 x 0 cannot be made public, contrary to [CLT13] However, define v 0 = x 0 · α zt mod N , and ([ � 0 ] k · α zt mod N ) mod v 0 � � = ( r i · ( h i β i + h j α j · u i / p j ) + a · v 0 ∈ Z ) mod v 0 j � = i i � � = r i · ( h i β i + h j α j · u i / p j ) mod v 0 j � = i i We can apply Cheon et al. attack modulo v 0 24 / 30

An Important Caveat A Ladder of encodings 25 / 30

An Important Caveat A Ladder of encodings Making x 0 secret is somewhat inconvenient: when we add or multiply encodings, we cannot reduce them modulo x 0 anymore to keep them of the same size 25 / 30

An Important Caveat A Ladder of encodings Making x 0 secret is somewhat inconvenient: when we add or multiply encodings, we cannot reduce them modulo x 0 anymore to keep them of the same size Solution (taken from [DGHV10]): publish a ladder of encodings of 0 of increasing size ◮ encodings = ( CRT p i ( r i g i ) / z j mod x 0 ) + q i · x 0 X ( j ) i with q i ← [ 0 , 2 i ) for i = 1 , . . . , log ( x 0 ) ◮ do the operation over Z , and remove X ( j ) for decreasing i ’s i 25 / 30