Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments NTRU Cryptosystem: Recent Developments Ron Steinfeld School of IT Monash University, Australia (partly based on joint work with Damien Stehl´ e, ENS Lyon, France) Johann Radon Institute (RICAM), Linz, Austria, December 2013 Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 1/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Outline of the talk 1- Introduction Background: Why study NTRU? 2- NTRU Cryptosystem: Review 3- Recent Developments on NTRU Security NTRU variant provably as secure as worst-case lattice problems Tools: Discrete Gaussians, Fourier analysis, Ring-LWE 4- Recent Developments on NTRU Applications Fully-Homomorphic Encryption (FHE) from NTRU Cryptographic Multilinear Maps from NTRU 5- Concluding Remarks Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 2/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments The NTRU Cryptosystem NTRUEncrypt : A public-key encryption scheme. 1996: Proposed by Hoffstein, Pipher & Silverman. 1997: Lattice attacks by Coppersmith & Shamir. 1998: Revised by Hoffstein et al. In the last 15 years: Several minor improvements to the lattice attacks. Attacks for isolated sets of parameters. But the design has proved very robust. In the last 3 years (this talk): Variants with a provable security foundation Variants with new functionality Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 3/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments The NTRU Cryptosystem NTRUEncrypt : A public-key encryption scheme. 1996: Proposed by Hoffstein, Pipher & Silverman. 1997: Lattice attacks by Coppersmith & Shamir. 1998: Revised by Hoffstein et al. In the last 15 years: Several minor improvements to the lattice attacks. Attacks for isolated sets of parameters. But the design has proved very robust. In the last 3 years (this talk): Variants with a provable security foundation Variants with new functionality Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 3/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments The NTRU Cryptosystem NTRUEncrypt : A public-key encryption scheme. 1996: Proposed by Hoffstein, Pipher & Silverman. 1997: Lattice attacks by Coppersmith & Shamir. 1998: Revised by Hoffstein et al. In the last 15 years: Several minor improvements to the lattice attacks. Attacks for isolated sets of parameters. But the design has proved very robust. In the last 3 years (this talk): Variants with a provable security foundation Variants with new functionality Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 3/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Why study NTRU Cryptosystem? Standardized: IEEE P1363. Commercialized: Security Innovation. Super-fast (comparison to 1024-bit RSA, based on an NTRU brochure) : Encryption ∼ 10 times faster Decryption ∼ 100 times faster Asymptotically: � O ( λ ) versus � O ( λ 6 ), for security 2 λ Interesting security features: No integer factoring nor discrete logs Seems to resist practical attacks Seems to resist quantum attacks Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 4/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Why study NTRU Cryptosystem? Standardized: IEEE P1363. Commercialized: Security Innovation. Super-fast (comparison to 1024-bit RSA, based on an NTRU brochure) : Encryption ∼ 10 times faster Decryption ∼ 100 times faster Asymptotically: � O ( λ ) versus � O ( λ 6 ), for security 2 λ Interesting security features: No integer factoring nor discrete logs Seems to resist practical attacks Seems to resist quantum attacks Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 4/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Why study NTRU Cryptosystem? Standardized: IEEE P1363. Commercialized: Security Innovation. Super-fast (comparison to 1024-bit RSA, based on an NTRU brochure) : Encryption ∼ 10 times faster Decryption ∼ 100 times faster Asymptotically: � O ( λ ) versus � O ( λ 6 ), for security 2 λ Interesting security features: No integer factoring nor discrete logs Seems to resist practical attacks Seems to resist quantum attacks Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 4/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Polynomial Rings Take φ ∈ Z [ x ] monic of degree n . � � R φ := Z [ x ] / ( φ ) , + , × . Interesting φ ’s: φ = x n − 1 → R − , φ = x n + 1 → R + . For n a power of 2, the ring R + is isomorphic to the ring of integers of K = Q [e i π/ n ]: Q [ x ] / ( x n + 1) K ≃ Z [ x ] / ( x n + 1) . O K ≃ ⇒ Rich algebraic structure (great for design and proofs). Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 5/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Polynomial Rings Take φ ∈ Z [ x ] monic of degree n . � � R φ := Z [ x ] / ( φ ) , + , × . Interesting φ ’s: φ = x n − 1 → R − , φ = x n + 1 → R + . For n a power of 2, the ring R + is isomorphic to the ring of integers of K = Q [e i π/ n ]: Q [ x ] / ( x n + 1) K ≃ Z [ x ] / ( x n + 1) . O K ≃ ⇒ Rich algebraic structure (great for design and proofs). Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 5/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Polynomial Rings Take φ ∈ Z [ x ] monic of degree n . � � R φ := Z [ x ] / ( φ ) , + , × . Interesting φ ’s: φ = x n − 1 → R − , φ = x n + 1 → R + . For n a power of 2, the ring R + is isomorphic to the ring of integers of K = Q [e i π/ n ]: Q [ x ] / ( x n + 1) K ≃ Z [ x ] / ( x n + 1) . O K ≃ ⇒ Rich algebraic structure (great for design and proofs). Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 5/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Polynomial Rings Let q ≥ 2 and Z q = Z / q Z . � � R φ := Z q [ x ] / ( φ ) , + , × . q Arithmetic in R φ q costs � O ( n log q ). R + q is isomorphic to O K / ( q ). The key to decryption correctness If f ∈ R φ is known to have coefficients in ( − q / 2 , q / 2), then f mod q uniquely determines f . Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 6/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Polynomial Rings Let q ≥ 2 and Z q = Z / q Z . � � R φ := Z q [ x ] / ( φ ) , + , × . q Arithmetic in R φ q costs � O ( n log q ). R + q is isomorphic to O K / ( q ). The key to decryption correctness If f ∈ R φ is known to have coefficients in ( − q / 2 , q / 2), then f mod q uniquely determines f . Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 6/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments Polynomial Rings Let q ≥ 2 and Z q = Z / q Z . � � R φ := Z q [ x ] / ( φ ) , + , × . q Arithmetic in R φ q costs � O ( n log q ). R + q is isomorphic to O K / ( q ). The key to decryption correctness If f ∈ R φ is known to have coefficients in ( − q / 2 , q / 2), then f mod q uniquely determines f . Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 6/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments NTRU Cryptosystem: Key Generation Parameters: n prime, q ≈ n a power of 2, p small, φ = x n − 1. (e.g. ( n , q , p ) = (503 , 256 , 3)) . Secret key sk : f , g ∈ R − sampled indep. from distrib. χ σ with: f is invertible mod q and mod p The coeffs of f and g are small Supp ( χ σ ) = {− 1 , 0 , 1 } n . Public key pk : h = g / f mod q . Security intuition q , finding g , f ∈ R − small s.t. h = g / f [ q ] is hard. Given h ∈ R − Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 7/40
Introduction NTRU Cryptosystem: Review NTRU Security: Recent Developments NTRU Applications: Recent Developments NTRU Cryptosystem: Key Generation Parameters: n prime, q ≈ n a power of 2, p small, φ = x n − 1. (e.g. ( n , q , p ) = (503 , 256 , 3)) . Secret key sk : f , g ∈ R − sampled indep. from distrib. χ σ with: f is invertible mod q and mod p The coeffs of f and g are small Supp ( χ σ ) = {− 1 , 0 , 1 } n . Public key pk : h = g / f mod q . Security intuition q , finding g , f ∈ R − small s.t. h = g / f [ q ] is hard. Given h ∈ R − Ron Steinfeld NTRU Cryptosystem: Recent Developments Dec 2013 7/40
Recommend
More recommend
