An Efficient LWE-Based Additively Homomorphic Encryption with Shorter Public Keys

Fully homomorphic encryption (FHE) is a "holy grail" of cryptography. However, it is not yet adopted in practice because no known scheme is efficient. In this paper, we mainly focus on how to reduce the public key sizes in FHE. Based on Dijk et al.'s FHE scheme (DGHV) and Gentry's fully homomorhpic technology, we propose two schemes with shorter public keys by encrypting with a combination of the public key elements to replace a linear form in DGHV scheme and a quadratic form in Coron et al.'s scheme. Compared with DGHV scheme and Coron et al.'s scheme, our schemes can greatly reduce the public key sizes, which make our schemes more efficient. Furthermore, we prove the security of our schemes based on difficulties of the approximate greatest common divisor (AGCD) problem and the sparse subset sum problem.

Multi-key Homomorphic Encryption (MKHE) scheme can homomorphically evaluate ciphertexts encrypted by different keys, which can effectively protect the privacy information of data holders in the joint computing of cloud services. Since the first full Homomorphic encryption scheme was proposed, bootstrapping is the only way to realize the arbitrary depth homomorphic computation of MKHE schemes. But bootstrap operation is quite expensive. In order to implement fast bootstrapping in MKHE schemes, previous works proposed multi-key TFHE schemes to implement low-latency bootstrapping and output a univariate function of messages after bootstrapping, called Programmable Bootstrapping (PBS). However, these schemes can only encrypt single-bit messages. PBS only outputs a function. And after a homomorphic operation, a bootstrap is required, which undoubtedly results in an increase in the cost of the whole multi-key homomorphic encryption operation. In this paper, we propose a MKHE scheme for multi-output PBS. For this purpose, we study the encryption method and homomorphic operation steps of MKHE, and add BFV homomorphic encryption multiplication and multi-key ciphertext relinearization. We separate the homomorphic operation from bootstrapping. We homomorphically evaluate test polynomials for multiple functions. In contrast to previous MKHE schemes, we support the output of multiple message-related functions with a single bootstrapping operation on the ciphertext. It is no longer limited to encrypting single-bit plaintext, and an effective ciphertext packaging technology is added. According to the analysis given in this paper, it is known that in the scenario of multi-party joint computation, the proposed scheme can be implemented with less bootstrapping when the same number of functions are homomorphically operated. This will effectively reduce the computational overhead.

This chapter discusses two popular homomorphic public key encryption (PKE) techniques, i.e., Paillier PKE and Boneh-Goh-Nissim (BGN) PKE, which serve as the preliminary for building most privacy-enhancing aggregation techniques in the rest chapters of this monograph. In addition, the Java source codes of the two homomorphic PKEs are also provided for the interested readers to better understand and implement them. In order to attain privacy-preserving data aggregation in smart grid communications, we need to first understand the homomorphic public key encryption (HPKE) techniques [1, 2, 3, 4, 5, 6, 7]. Different from the general public key encryption algorithms [8, 9], HPKE further holds an additional “homomorphic” property, which makes the privacy-preserving data aggregation possible. As shown in Fig. 2.1, when we directly operate over two encrypted data E(x) and E(y) with some operation “•”, we can gain E(x ∘ y) = E(x)•E(y). In most HPKE cases, the operations “•” and “∘” are respectively referred to the common multiplication “×” and addition “+” operations. Because most of privacy-enhancing aggregation techniques illustrated in this monograph are based on Paillier public key encryption [2] and Boneh-Goh-Nissim (BGN) public key encryption [6], in this chapter, we first take a close look at these two popular homomorphic encryption techniques. Note that, both of them are randomized encryption algorithms [1], i.e., in addition to the plaintext as the input of encryption, a random number is also input for achieving semantic security.

In homomorphic encryption schemes, anyone can perform homomorphic operations, and therefore, it is difficult to manage when, where and by whom they are performed. In addition, the property that anyone can ‘‘freely” perform the operation inevitably means that ciphertexts are malleable, and it is well-known that adaptive chosen ciphertext (CCA) security and the homomorphic property can never be achieved simultaneously. In this paper, we show that CCA security and the homomorphic property can be simultaneously handled in situations that the user(s) who can perform homomorphic operations on encrypted data should be controlled/limited, and propose a new concept of homomorphic public-key encryption, which we call keyed-homomorphic public-key encryption (KH-PKE). By introducing a secret key for homomorphic operations, we can control who is allowed to perform the homomorphic operation. To construct KH-PKE schemes, we introduce a new concept, a homomorphic transitional universal hash family, and present a number of KH-PKE schemes through hash proof systems. We also present a practical construction of KH-PKE from the DDH assumption. For ℓ-bit security, our DDH-based scheme yields only ℓ-bit longer ciphertext size than that of the Cramer-Shoup PKE scheme.Keywordshomomorphic public key encryptionCCA2 securityhash proof system

A public key encryption scheme based on a new variant of LWE with small cipher size

With the development of modern communication technology, an increasing number of people are choosing to communicate end-to-end over the network. However, the risk of information leakage and data tampering has also increased, and the issue of information confidentiality has become an increasing concern. Among the existing encryption algorithms, symmetric encryption algorithms cannot securely manage the key and share the key between communication parties; ECC and other public key encryption algorithms have problems such as slow encryption and decryption speed, low encryption strength, etc. In addition, key management is still not guaranteed to be very secure; conventional hybrid encryption algorithms need to manage two different types of keys, and key management may be very complicated and prone to key leakage or theft. Based on the problems of the above algorithms, this paper proposes RSA-Co-CP-ABE Architecture, which uses socket communication, encrypts the RSA public key passed from Client to Server with CP-ABE, encrypts the confidential message with the public key passed from Client at Server, and finally sends the encrypted message to Client. This scheme has higher flexibility than the traditional symmetric encryption and public key encryption schemes, and by using CP-ABE encryption, it can realize attribute-based access control. And RSA encryption can make the scheme make a better balance between encryption and decryption efficiency and encryption strength. In addition, because the communication is transmitted in full cipher text during the communication, the scheme can effectively resist tampering or stealing by man-in-the-middle attacks.

We propose a new and efficient scheme for broadcast encryption. A broadcast encryption system allows a broadcaster to send an encrypted message to a dynamically chosen subset RS, |RS|=n, of a given set of users, such that only users in this subset can decrypt the message. An important component of broadcast encryption schemes is revocation of users by the broadcaster, thereby updating the subset RS. Revocation may be either temporary, for a specific cipher text, or permanent. In the existing public key schemes which support temporary revocation of the users, the broadcaster is required to keep track of the revoked users. We present the first public key broadcast encryption scheme that supports permanent revocation of users. Unlike previous schemes, the broadcaster in our scheme should not keep track of the revoked users (saving memory and computation power). Our scheme is fully collusion-resistant. In other words, even if all the revoked users collude, the revoked user cannot encrypt messages without receiving new keys from the broadcaster. The procedure is based on Cipher-text Policy Attribute-Based Encryption (CP-ABE). The overhead of revocation in our system is constant in all major performance measures including length of private and public keys, computational complexity, user's storage space, and computational complexity of encryption and decryption. The scheme we construct improves on our original scheme in a poster presentation [7] by a factor of O(log n) in all major performance measures.

The increasing demand for Data Mining as a Service, using cloud storage, has raised data security concerns. Standard data encryption schemes are unsuitable because they do not support the mathematical operations that data mining requires. Homomorphic and Order Preserving Encryption provide a potential solution. Existing work, directed at data clustering, has demonstrated that using such schemes provides for secure data mining. However, to date, all proposed approaches have entailed some degree of data owner participation, in many cases the amount of participation is substantial. This paper proposes an approach to secure data clustering that does not require any data owner participation (once the data has been encrypted). The approach operates using the idea of an Encrypted Distance Matrix (EDM) which, for illustrative purposes, has been embedded in an approach to secure third-party data clustering - the Secure Nearest Neighbour Clustering (SNNC) approach, that uses order preserving and homomorphic encryption. Both the EDM concept and the SNNC approach are fully described.

In cryptography, there has been tremendous success in building various two-party protocols with small communication complexity out of homomorphic semantically-secure encryption schemes, using their homomorphic properties in a black-box way. A few notable examples of such primitives include items like single database Private Information Retrieval (PIR) schemes (introduced in [15]) and private database update with small communication (introduced in [5]). In this paper, we illustrate a general methodology for determining what types of protocols can and cannot be implemented with small communication by using homomorphic encryption in a black-box way. We hope that this work will provide a simple litmus test of feasibility for black-box use of known homomorphic encryption schemes by other cryptographic researchers attempting to develop new protocols with low communication. Additionally, a precise mathematical language for reasoning about such problems is developed in this work, which may be of independent interest. We stress that the class of algebraic structures for which we prove communication complexity lower bounds is large, and covers practically all known semantically-secure homomorphic cryptosystems (including those based upon bilinear maps). Finally, we show the following equivalence which relates group homomorphic encryption and a major open question of designing a so-called fully-homomorphic cryptosystem: a fully homomorphic encryption scheme (over a non-zero ring) exists if and only if there exists homomorphic encryption over any finite non-abelian simple group. This result somewhat generalizes results of Barrington [1] (to any group containing a finite non-abelian simple subgroup) and of Maurer and Rhodes [18], and in fact gives a constructiveproof of the 1974 result Werner [28]. (This also answers an open question posed by Rappe in [23], who in 2004 proved a special case of this result.)

RETRACTED: A public key size homomorphic encryption scheme based on the sum of sparse subsets and integers

When users store their data on a cloud, they may concern on whether their data is stored correctly and can be fully retrieved. Proofs of Retrivability (PoR) is a cryptographic concept that allows users to remotely check the integrity of their data without downloading. This check is usually done by attaching data with message authenticators that contain data integrity information. The existing PoR schemes consider only the retrievability of unencrypted data and their message authenticators are usually deterministic. In this paper, we propose a PoR scheme that is built over homomorphic encryption schemes. Our PoR scheme can prove the retrievability of homomorphically encrypted data by generating probabilistic and homomorphic message authenticators. Moreover, the homomorphically encrypted data can be processed by the cloud directly and our PoR scheme can verify the integrity of such outsourced computations over ciphertexts. A prototype of our scheme is implemented to evaluate its performance.

Code-based public key encryption (PKE) is a popular choice to achieve post-quantum security, partly due to its capability to achieve fast encryption/decryption. However, code-based PKE has larger ciphertext and public key sizes in comparison to conventional PKE schemes (e.g., those based on RSA). In 2018, Lau and Tan proposed a new rank metric code-based PKE scheme, which has smaller public key and ciphertext sizes compared to other code-based PKE schemes. They also proved that their scheme achieves IND-CPA security, assuming the intractability of the decisional rank syndrome decoding problem. It is known that IND-CCA2 security is the strongest and most popular security assurance for PKE schemes. Therefore, in this paper, we obtain a new code-based PKE scheme from Lau and Tan’s scheme, in order to inherit the underlying small public key and ciphertext sizes. However, our new scheme is shown to achieve IND-CCA2 security, instead of the weaker IND-CPA security. Specifically, the respective public key size and ciphertext size in our new scheme are 15.06 KB and 1.37 KB under 141-bit security level, and 16.76 KB and 1.76 KB under 154-bit security level. We then present a use case for the proposed scheme, that is for secure cloud storage.

The ring variant of learning with errors (Ring-LWE) problem has provided efficient post-quantum cryptographic schemes including homomorphic encryption (HE) schemes. Usually, cyclotomic fields are used as underlying number fields of Ring-LWE from the viewpoints of efficiency and security. However, especially in the case of HE schemes, improving the efficiency and ensuring the security are important tasks even now. Arita and Handa proposed to use decomposition fields as underlying number fields of Ring-LWE and successfully constructed a HE scheme which can encrypt many plaintexts efficiently at a time. However, there is no enough evidence that decomposition fields do not provide weak Ring-LWE instances.In this paper, we give an experimental analysis on lattice attacks against Ring-LWE over decomposition fields. More precisely, we conducted lattice attacks against Ring-LWE over decomposition fields and over the ℓ-th cyclotomic fields with some prime numbers ℓ, respectively, and compared each of the running-time, the success rate and the root hermite factor. We also compared the results of the same attacks on various decomposition fields to find decomposition fields providing weak Ring-LWE instances. As a result of our analysis, we expect that decomposition fields would provide more secure and efficient HE schemes based on Ring-LWE compared to the ℓ-th cyclotomic fields.

We have stepped into a world of undeniable data breach fatigues. Thus to ensure data security, encryption schemes come into action, one such highly talked about encryption nowadays is “Homomorphic Encryption” which is mainly used to compress data for their easy storage involving secure transmission and processing on cloud without compromising on privacy since special keys are needed for primary encryption and final decryption. Homomorphic encryption allows operation on two ciphertexts to give an encrypted (coded) result which when decrypted (decoded) maps to result of the operation, if it would have been on plaintext. It can be either multiplicative like the RSA or additive like the Pallier cryptosystem. Here we also focused on ideal lattice based public key encryption scheme which is almost bootstrappable. Multihop homomorphic encryption also has vital roles to play here. A strong homomorphic encryption is one which is resistant to all attacks using various algorithms. Thus our main objective is to allow encrypted computing on data, minimize memory usage and to save energy and time. Our presentation will try to focus on the researches done so far and also on the success rates of the scheme which is affecting the real world.

Recommender systems facilitate personalized service provision through the statistical analysis and model training of user historical data (e.g., browsing behavior, travel history, etc). To address the underpinning privacy implications associated with such systems, a number of privacy-preserving recommendation approaches have been presented. There are, however, limitations in many of these approaches. For example, approaches that apply public key (fully) homomorphic encryption (FHE) on different users. historical ratings under a unique public key of a target recommendation user incur significant computational overheads on resource-constrained local users and may not be scalable. On the other hand, approaches without utilizing public key FHE can neither resist chosen ciphertext attack (CCA), nor be straightforwardly applied to the setting of distributed servers. In this paper, a lightweight privacy-preserving distributed recommender system is proposed. Specifically, we present a new cryptographic primitive (i.e., tag-based multikey fully homomorphic data encapsulation mechanism; TMFH-DEM) designed to achieve CCA security for both input privacy and result privacy. TMFH-DEM enables a set of distributed servers to collaboratively execute efficient privacy-preserving outsourced computation on multiple inputs encrypted under different secret keys from different data owners, without using public key FHE. Building on TMFH-DEM, we propose a lightweight privacy-preserving distributed recommender system, which flexibly returns all the recommended items with certain predicted ratings for all target users. Formal security proof shows that our proposal achieves both user historical rating data privacy and recommendation result privacy. Findings from our evaluations demonstrate its practicability in terms of scalability, recommendation accuracy, computational and communication efficiency.