numerical example ◮ p = 541 , q 0 = 809 ⇒ x 0 = 437669 ◮ noise size: ρ = 4 Encryption : ◮ c 1 = 737 · 541 + 2 · 6 + 1 = 398730 ◮ c 2 = 368 · 541 + 2 · 9 + 0 = 199106 Addition and Multiplication : ◮ c 3 = c 1 + c 2 mod x 0 = ( 398730 + 199106 ) mod 437669 = 160167 ◮ c 4 = c 1 · c 2 mod x 0 = ( 398730 · 199106 ) mod 437669 = 317801 18 / 68
numerical example ◮ p = 541 , q 0 = 809 ⇒ x 0 = 437669 ◮ noise size: ρ = 4 Encryption : ◮ c 1 = 737 · 541 + 2 · 6 + 1 = 398730 ◮ c 2 = 368 · 541 + 2 · 9 + 0 = 199106 Addition and Multiplication : ◮ c 3 = c 1 + c 2 mod x 0 = ( 398730 + 199106 ) mod 437669 = 160167 ◮ c 4 = c 1 · c 2 mod x 0 = ( 398730 · 199106 ) mod 437669 = 317801 Decryption : ◮ c 3 mod p = 160167 mod 541 = 31 = 2 · 15 + 1 = 2 · 15 + ( 1 XOR 0 ) ◮ c 4 mod p = 317801 mod 541 = 234 = 2 · 117 + 0 = 2 · 117 + ( 1 AND 0 ) 18 / 68
semantic security Consider D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } Security of the scheme based on: (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D , decide whether z is uniformly generated in [ 0 , x 0 ) or in D 19 / 68
semantic security Consider D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } Security of the scheme based on: (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Semantic security of the scheme: ◮ Recall that c = q · p + 2 r + m ◮ Assume gcd ( 2 , q 0 ) = 1 , � � c = 2 · ( q / 2 mod q 0 ) · p + r + m mod ( q 0 · p ) � �� � indistinguishable from uniform mod x 0 19 / 68
semantic security Consider D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } Security of the scheme based on: (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Semantic security of the scheme: ◮ Recall that c = q · p + 2 r + m ◮ Assume gcd ( 2 , q 0 ) = 1 , � � c = 2 · ( q / 2 mod q 0 ) · p + r + m mod ( q 0 · p ) � �� � indistinguishable from uniform mod x 0 ◮ Therefore ciphertext of m indistinguishable from uniform 19 / 68
batching (1) ◮ In one ciphertext, encode ℓ plaintexts u 1 u 2 u 3 · · · u ℓ ◮ Addition and Multiplication: in parallel over the ℓ slots + × v 1 v 2 v 3 · · · v ℓ w 1 w 2 w 3 · · · w ℓ 20 / 68
batching (1) ◮ In one ciphertext, encode ℓ plaintexts ◮ Addition and Multiplication: in parallel u 1 u 2 u 3 u 1 u 2 u 3 u 4 · · · · · · u ℓ u ℓ over the ℓ slots π u 2 u ℓ · · · u 3 · · · u 1 u 4 · · · ◮ Permutations between the slots (algebraic structure) 20 / 68
batching (1) ◮ In one ciphertext, encode ℓ plaintexts u 1 u 2 u 3 · · · u ℓ ◮ Addition and Multiplication: in parallel over the ℓ slots + × v 1 v 2 v 3 · · · v ℓ ◮ Permutations between the slots (algebraic w 1 w 2 w 3 · · · w ℓ structure) 20 / 68
batching (1) ◮ In one ciphertext, encode ℓ plaintexts u 1 u 2 u 3 · · · u ℓ ◮ Addition and Multiplication: in parallel over the ℓ slots + × v 1 v 2 v 3 · · · v ℓ ◮ Permutations between the slots (algebraic w 1 w 2 w 3 · · · w ℓ structure) ◮ Public element x 0 = q 0 · p ◮ Ciphertext of m ∈ { 0 , 1 } : c = q · p + 2 r + m 20 / 68
batching (1) ◮ In one ciphertext, encode ℓ plaintexts u 1 u 2 u 3 · · · u ℓ ◮ Addition and Multiplication: in parallel over the ℓ slots + × v 1 v 2 v 3 · · · v ℓ ◮ Permutations between the slots (algebraic w 1 w 2 w 3 · · · w ℓ structure) ◮ Public element x 0 = q 0 · p ◮ Ciphertext of m ∈ { 0 , 1 } : c = q · p + 2 r + m ◮ c mod p = 2 r + m c mod q 0 = · p + 2 r + m mod q 0 q ; ���� uniform in [ 0 , q 0 ) 20 / 68
batching (1) ◮ In one ciphertext, encode ℓ plaintexts u 1 u 2 u 3 · · · u ℓ ◮ Addition and Multiplication: in parallel over the ℓ slots + × v 1 v 2 v 3 · · · v ℓ ◮ Permutations between the slots (algebraic w 1 w 2 w 3 · · · w ℓ structure) ◮ Public element x 0 = q 0 · p ◮ Ciphertext of m ∈ { 0 , 1 } : c = q · p + 2 r + m ◮ c mod p = 2 r + m c mod q 0 = · p + 2 r + m mod q 0 q ; ���� uniform in [ 0 , q 0 ) ◮ We can write � � q ′ , 2 r + m c = CRT q 0 , p 20 / 68
batching (2): extend using the Chinese Remainder Theorem � � q ′ , 2 r + m c = CRT q 0 , p ◮ Gener alization to several slots is easy! m = ( m 1 , . . . , m n ) ∈ { 0 , 1 } n : ◮ Ciphertext of � � � q ′ , 2 r 1 + m 1 , . . . , 2 r n + m n c = CRT q 0 , p 1 ,..., p n 21 / 68
batching (2): extend using the Chinese Remainder Theorem � � q ′ , 2 r + m c = CRT q 0 , p ◮ Gener alization to several slots is easy! m = ( m 1 , . . . , m n ) ∈ { 0 , 1 } n : ◮ Ciphertext of � � � q ′ , 2 r 1 + m 1 , . . . , 2 r n + m n c = CRT q 0 , p 1 ,..., p n ◮ Decryption: m i = ( c mod p i ) mod 2 21 / 68
batching (2): extend using the Chinese Remainder Theorem � � q ′ , 2 r + m c = CRT q 0 , p ◮ Gener alization to several slots is easy! m = ( m 1 , . . . , m n ) ∈ { 0 , 1 } n : ◮ Ciphertext of � � � q ′ , 2 r 1 + m 1 , . . . , 2 r n + m n c = CRT q 0 , p 1 ,..., p n ◮ Decryption: m i = ( c mod p i ) mod 2 ◮ Thanks to the structure of the CRT : ◮ Addition : the addition is performed modulo each p i similarly to DGHV ◮ Multiplication : the multiplication is performed modulo each p i similarly to DGHV 21 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D 22 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Sketch: (Error-Free) ℓ -Decisional Approximate-GCD Given x 0 = q 0 · p 1 · · · p n and polynomially many x i ∈ D n = { CRT q 0 , p i ( q , . . . , r i , . . . ) : q ← [ 0 , q 0 ) , r i ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D n 22 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Sketch: (Error-Free) ℓ -Decisional Approximate-GCD Given x 0 = q 0 · p 1 · · · p n and polynomially many x i ∈ D n = { CRT q 0 , p i ( q , . . . , r i , . . . ) : q ← [ 0 , q 0 ) , r i ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D n ◮ For n = 1 , the above problem is the (Error-Free) Decisional Approximate-GCD 22 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Sketch: (Error-Free) ℓ -Decisional Approximate-GCD Given x 0 = q 0 · p 1 · · · p n and polynomially many x i ∈ D n = { CRT q 0 , p i ( q , . . . , r i , . . . ) : q ← [ 0 , q 0 ) , r i ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D n ◮ For n = 1 , the above problem is the (Error-Free) Decisional Approximate-GCD ◮ Let A be an adversary having adv. ǫ to solve this latter problem 22 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Sketch: (Error-Free) ℓ -Decisional Approximate-GCD Given x 0 = q 0 · p 1 · · · p n and polynomially many x i ∈ D n = { CRT q 0 , p i ( q , . . . , r i , . . . ) : q ← [ 0 , q 0 ) , r i ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D n ◮ For n = 1 , the above problem is the (Error-Free) Decisional Approximate-GCD ◮ Let A be an adversary having adv. ǫ to solve this latter problem ◮ Denote D i the distribution of elements of the form CRT q 0 , p 1 ,..., p n ( q , ∗ , . . . , ∗ , r i , . . . , r n ) � �� � n − i random 22 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Sketch: (Error-Free) ℓ -Decisional Approximate-GCD Given x 0 = q 0 · p 1 · · · p n and polynomially many x i ∈ D n = { CRT q 0 , p i ( q , . . . , r i , . . . ) : q ← [ 0 , q 0 ) , r i ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D n ◮ For n = 1 , the above problem is the (Error-Free) Decisional Approximate-GCD ◮ Let A be an adversary having adv. ǫ to solve this latter problem ◮ Denote D i the distribution of elements of the form CRT q 0 , p 1 ,..., p n ( q , ∗ , . . . , ∗ , r i , . . . , r n ) � �� � n − i random ◮ ∃ j 0 s.t. A has advantage ≥ ǫ/ n to distinguish D j 0 − 1 and D j 0 22 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Sketch: (Error-Free) ℓ -Decisional Approximate-GCD Given x 0 = q 0 · p 1 · · · p n and polynomially many x i ∈ D n = { CRT q 0 , p i ( q , . . . , r i , . . . ) : q ← [ 0 , q 0 ) , r i ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D n ◮ For n = 1 , the above problem is the (Error-Free) Decisional Approximate-GCD ◮ Let A be an adversary having adv. ǫ to solve this latter problem ◮ Denote D i the distribution of elements of the form CRT q 0 , p 1 ,..., p n ( q , ∗ , . . . , ∗ , r i , . . . , r n ) � �� � n − i random ◮ ∃ j 0 s.t. A has advantage ≥ ǫ/ n to distinguish D j 0 − 1 and D j 0 ◮ With proba 1 / n , you can place p at the position j 0 (generate the n − 1 other p i ’s yourself), and you use the challenge z for this slot 22 / 68
security of the batch scheme (Error-Free) Decisional Approximate-GCD Given x 0 = q 0 · p and polynomially many x i ∈ D = { q · p + r : q ← [ 0 , q 0 ) , r ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D Sketch: (Error-Free) ℓ -Decisional Approximate-GCD Given x 0 = q 0 · p 1 · · · p n and polynomially many x i ∈ D n = { CRT q 0 , p i ( q , . . . , r i , . . . ) : q ← [ 0 , q 0 ) , r i ← [ 0 , 2 ρ ) } , decide whether z is uniformly generated in [ 0 , x 0 ) or in D n ◮ For n = 1 , the above problem is the (Error-Free) Decisional Approximate-GCD ◮ Let A be an adversary having adv. ǫ to solve this latter problem Security based on same problem as before! ◮ Denote D i the distribution of elements of the form CRT q 0 , p 1 ,..., p n ( q , ∗ , . . . , ∗ , r i , . . . , r n ) � �� � n − i random ◮ ∃ j 0 s.t. A has advantage ≥ ǫ/ n to distinguish D j 0 − 1 and D j 0 ◮ With proba 1 / n , you can place p at the position j 0 (generate the n − 1 other p i ’s yourself), and you use the challenge z for this slot 22 / 68
advantages of the batch variant ◮ Par allelization: u 1 u 2 u 3 · · · u ℓ + × v 1 v 2 v 3 · · · v ℓ w 1 w 2 w 3 w ℓ · · · ◮ Use the fact that q ≫ p to pack elements ◮ (Also asymptotic reduction of overhead per gate with permutations) [CCKLLTY13] With essentially same complexity costs and same security , operations over ℓ ≥ 1 bits! 23 / 68
outline ◮ Introduction & timeline ◮ Syntax of MMAPs ◮ Interlude: HE over Z ◮ The CLT13 Candidate ◮ “Zer oizing”, again and again ◮ Conclusion & open problems 24 / 68
from HE to MMAPs ◮ Large plaintext space ◮ Add the “tags ” ◮ We will get it via some multiplicative masks ◮ Add a zero-testing procedure ◮ The secret key will be the p i ’s and the secret mask: we will mix them together 25 / 68
extend to larger plaintext ring m = ( m 1 , . . . , m n ) ∈ { 0 , 1 } n : ◮ Ciphertext of � � � q ′ , 2 r 1 + m 1 , . . . , 2 r n + m n c = CRT q 0 , p 1 ,..., p n ◮ what is the problem? (hint: multiplication) 26 / 68
extend to larger plaintext ring m = ( m 1 , . . . , m n ) ∈ { 0 , 1 } n : ◮ Ciphertext of � � � q ′ , 2 r 1 + m 1 , . . . , 2 r n + m n c = CRT q 0 , p 1 ,..., p n ◮ what is the problem? (hint: multiplication) ◮ Ciphertext of � m = ( m 1 , . . . , m n ) ∈ Z g 1 × · · · × Z g n : � � q ′ , g 1 · r 1 + m 1 , . . . , g n · r n + m n c = CRT q 0 , p 1 ,..., p n 26 / 68
tags=levels using a random mask ◮ Let z ← [ 0 , x 0 ) be a random (invertible) multiplicative mask 27 / 68
tags=levels using a random mask ◮ Let z ← [ 0 , x 0 ) be a random (invertible) multiplicative mask ◮ Encoding of � m ∈ Z g 1 × · · · × Z g n at level j : m ] j = c / z j mod x 0 [ � = CRT q , p 1 ,..., p n ( q ′ , r 1 · g 1 + m 1 , . . . , r n · g n + m n ) mod x 0 z j 27 / 68
tags=levels using a random mask ◮ Let z ← [ 0 , x 0 ) be a random (invertible) multiplicative mask ◮ Encoding of � m ∈ Z g 1 × · · · × Z g n at level j : m ] j = c / z j mod x 0 [ � = CRT q , p 1 ,..., p n ( q ′ , r 1 · g 1 + m 1 , . . . , r n · g n + m n ) mod x 0 z j ◮ Operations over Z x 0 : m ′ ] j m ′ ] j [ � m ] j + [ � ≃ [ � m + � Addition m ′ ] j 2 m ′ ] j 1 + j 2 [ � m ] j 1 × [ � ≃ [ � m · � Multiplication 27 / 68
main ingredient: zero testing ◮ How to test whether two degree- κ encodings are equal? m ] κ ≃ [ � m = � m − � ℓ ] κ ≃ [ � [ � ℓ ] κ (i.e. � ℓ ) ⇐ ⇒ [ � 0 ] κ 28 / 68
main ingredient: zero testing ◮ How to test whether two degree- κ encodings are equal? m ] κ ≃ [ � m = � m − � ℓ ] κ ≃ [ � [ � ℓ ] κ (i.e. � ℓ ) ⇐ ⇒ [ � 0 ] κ m = � ◮ What is an encoding of � 0 at the top-level? 0 ] κ = CRT q , p 1 ,..., p n ( q ′ , r 1 · g 1 , . . . , r n · g n ) [ � mod x 0 z κ 28 / 68
main ingredient: zero testing ◮ How to test whether two degree- κ encodings are equal? m ] κ ≃ [ � m = � m − � ℓ ] κ ≃ [ � [ � ℓ ] κ (i.e. � ℓ ) ⇐ ⇒ [ � 0 ] κ m = � ◮ What is an encoding of � 0 at the top-level? 0 ] κ = CRT q , p 1 ,..., p n ( q ′ , r 1 · g 1 , . . . , r n · g n ) [ � mod x 0 z κ ◮ Idea of [GGH13]: multiply by an element which will cancel z κ and when the r i ’s are small ( r i g i ≪ p i ), yield something small compared to x 0 . 28 / 68
main ingredient: zero testing (ctnd.) ◮ let’s rewrite [ � 0 ] κ : � � − 1 / z κ mod p i ) · p ∗ p j ) · q ′′ mod x 0 [ � g i r i · ( p ∗ 0 ] κ = i + ( i i i = � where p ∗ j � = i p j 29 / 68
main ingredient: zero testing (ctnd.) ◮ let’s rewrite [ � 0 ] κ : � � − 1 / z κ mod p i ) · p ∗ p j ) · q ′′ mod x 0 [ � g i r i · ( p ∗ 0 ] κ = i + ( i i i = � where p ∗ j � = i p j ◮ The random value q ′′ makes difficult to obtain something small... except if we are working modulo � p j 29 / 68
main ingredient: zero testing (ctnd.) ◮ let’s rewrite [ � 0 ] κ : � � − 1 / z κ mod p i ) · p ∗ p j ) · q ′′ mod x 0 [ � g i r i · ( p ∗ 0 ] κ = i + ( i i i = � where p ∗ j � = i p j ◮ The random value q ′′ makes difficult to obtain something small... except if we are working modulo � p j ◮ In the following x 0 = � p j , and m ] j = CRT p 1 ,..., p n ( r 1 · g 1 + m 1 , . . . , r n · g n + m n ) [ � mod x 0 z j 29 / 68
main ingredient: zero testing (ctnd.) ◮ now � − 1 / z κ mod p i ) · p ∗ [ � g i r i · ( p ∗ 0 ] κ = i mod x 0 i i i = � where p ∗ j � = i p j 30 / 68
main ingredient: zero testing (ctnd.) ◮ now � − 1 / z κ mod p i ) · p ∗ [ � g i r i · ( p ∗ 0 ] κ = i mod x 0 i i i = � where p ∗ j � = i p j ◮ Multiply by the public element (where h i ≪ p i ) � z κ mod p i ) · p ∗ h i · ( g − 1 p zt = i mod x 0 i i 30 / 68
main ingredient: zero testing (ctnd.) ◮ now � − 1 / z κ mod p i ) · p ∗ [ � g i r i · ( p ∗ 0 ] κ = i mod x 0 i i i = � where p ∗ j � = i p j ◮ Multiply by the public element (where h i ≪ p i ) � z κ mod p i ) · p ∗ h i · ( g − 1 p zt = i mod x 0 i i ◮ We have (we prove equivalence whp when many p zt ’s are given) � m = � r i · ( h i p ∗ � 0 ⇒ | [ � m ] κ · p zt mod x 0 | = | i ) | ≪ x 0 i 30 / 68
Partial Conclusion ◮ Second candidate multilinear map ◮ Hardness assumptions: ◮ GDDH ◮ but also DLIN, SubM, etc. ◮ Composite-order multilinear maps ◮ Used in multiple schemes and obfuscation candidates 31 / 68
outline ◮ Introduction & timeline ◮ Syntax of MMAPs ◮ Interlude: HE over Z ◮ The CLT13 Candidate ◮ “Zer oizing”, again and again ◮ Conclusion & open problems 32 / 68
CLT13 properties ◮ Encoding is related to a numerator u ∼ ( e 1 , . . . , e n ) ◮ e i = g i · r i + m i ◮ Finding the e i ’s means breaking the scheme ◮ An encoding of 0 is u ∼ ( g 1 r 1 , . . . , g n r n ) ◮ Adding / multiplying encodings operate on the numerators over Z (not modulo x 0 ) u 1 + u 2 ∼ ( e 1 i + e 2 i ) i , u 1 · u 2 ∼ ( e 1 i · e 2 i ) i ◮ Zero-testing top-level encodings u ∼ ( g 1 r 1 , . . . , g n r n ) we get ztst ( u ) = � i r i · ( h i p ∗ i ) over Z (no mod q ) 33 / 68
public procedures ◮ Sample : subset-sum of publicly available random level- 0 encodings � [ u i ] 0 = [ u ] 0 i ∈ S 34 / 68
public procedures ◮ Sample : subset-sum of publicly available random level- 0 encodings � [ u i ] 0 = [ u ] 0 i ∈ S ◮ Encode at level 1 : multiply by a level- 1 encoding of � 1 [ u ] 0 · [ � 1 ] 1 = [ u ] 1 34 / 68
public procedures ◮ Sample : subset-sum of publicly available random level- 0 encodings � [ u i ] 0 = [ u ] 0 i ∈ S ◮ Encode at level 1 : multiply by a level- 1 encoding of � 1 [ u ] 0 · [ � 1 ] 1 = [ u ] 1 ◮ reRandomization : add a subset-sum of level- 1 encodings of 0 to drown the noise obtained by sampling/encoding � [ u ] 1 + [ 0 i ] 1 i ∈ S 34 / 68
public extraction ◮ Extraction : extract the λ most significant bits of ext ([ � m ] κ ) = MSB λ ( p zt · [ � m ] κ mod x 0 ) � n � � ( r i + m i · g − 1 mod p i ) · ( h i p ∗ = MSB λ i ) i i = 1 � n � � ( m i · g − 1 mod p i ) · ( h i p ∗ = MSB λ i ) i i = 1 ◮ for � m 1 = � m 2 , we will have ext ([ � m 1 ] κ ) == ext ([ � m 2 ] κ ) 35 / 68
Diffie-Hellman Key Exchange ◮ Setup : For N participants, initialization of a N − 1 -multilinear map 36 / 68
Diffie-Hellman Key Exchange ◮ Setup : For N participants, initialization of a N − 1 -multilinear map ◮ Publish : Use the public params, sample a level- 0 encoding c i , and publish c ′ i = reRand ( enc ( c i , 1 )) 36 / 68
Diffie-Hellman Key Exchange ◮ Setup : For N participants, initialization of a N − 1 -multilinear map ◮ Publish : Use the public params, sample a level- 0 encoding c i , and publish c ′ i = reRand ( enc ( c i , 1 )) c i = c i · � j � = i c ′ ◮ KeyGen : Compute ˜ j , and get the shared key s = ext (˜ c i ) 36 / 68
main security assumption m i ] 1 and [ � m ′ ] κ , de- GDDH: Given ( κ + 1 ) elements [ � m ′ ≃ � κ + 1 termine whether � i = 1 � m i . 37 / 68
main security assumption m i ] 1 and [ � m ′ ] κ , de- GDDH: Given ( κ + 1 ) elements [ � m ′ ≃ � κ + 1 termine whether � i = 1 � m i . ◮ At the heart of the multipartite key echange protocol 37 / 68
main security assumption m i ] 1 and [ � m ′ ] κ , de- GDDH: Given ( κ + 1 ) elements [ � m ′ ≃ � κ + 1 termine whether � i = 1 � m i . ◮ At the heart of the multipartite key echange protocol ◮ Assumed to be hard (but no reduction to Approx.-GCD) 37 / 68
main security assumption m i ] 1 and [ � m ′ ] κ , de- GDDH: Given ( κ + 1 ) elements [ � m ′ ≃ � κ + 1 termine whether � i = 1 � m i . ◮ At the heart of the multipartite key echange protocol ◮ Assumed to be hard (but no reduction to Approx.-GCD) ◮ Asymptotic parameters determined from several attacks: ◮ orthogonal lattice attack on encodings ◮ GCD attack on zero-testing ◮ hidden subset sum attack on zero-testing ◮ attacks on the inverse zero-testing matrix ◮ brute-force on the noises, . . . 37 / 68
zeroizing attack [CheonHanLeeRyuStehlé’15] 38 / 68
exploiting the linearity of the zero-testing 39 / 68
exploiting the linearity of the zero-testing 0 ] κ · p zt = � i r i · ( h i · p ∗ [ � i ) ∈ Z 39 / 68
exploiting the linearity of the zero-testing c ] 1 · p zt = � i r i · ˆ [ � 0 ] κ − 2 · [ � c i · ( h i · p ∗ b i · ˆ b ] 1 · [ � i ) ∈ Z 39 / 68
exploiting the linearity of the zero-testing c ] 1 · p zt = � i r i · ˆ [ � 0 ] κ − 2 · [ � c i · ( h i · p ∗ b i · ˆ b ] 1 · [ � i ) ∈ Z r i ˆ c i ˆ b i · ( h i · p ∗ i ) 39 / 68
exploiting the linearity of the zero-testing c ] 1 · p zt = � i r i · ˆ [ � 0 ] κ − 2 · [ � c i · ( h i · p ∗ b i · ˆ b ] 1 · [ � i ) ∈ Z r i ˆ c i ˆ b i · ( h i · p ∗ i ) 39 / 68
inversion over Q c ] 1 and two targets [ � b ] 1 , [ � ◮ Let’s do it with many [ � b ′ ] 1 0 ] κ − 2 , [ � 40 / 68
inversion over Q c ] 1 and two targets [ � b ] 1 , [ � ◮ Let’s do it with many [ � b ′ ] 1 0 ] κ − 2 , [ � r i r i ˆ ˆ c i c i ˆ ˆ b i · ( h i · p ∗ b ′ i · ( h i · p ∗ i ) i ) 40 / 68
inversion over Q c ] 1 and two targets [ � b ] 1 , [ � ◮ Let’s do it with many [ � b ′ ] 1 0 ] κ − 2 , [ � 1 c i ) − 1 ( r − 1 r i ˆ (ˆ ) c i ˆ b i · ( h i · p ∗ i i ) ˆ b ′ i · ( h i · p ∗ i ) 40 / 68
Recommend
More recommend
