Dynamic Multi-Key FHE in Asymmetric Key Setting From LWE

Traditional fully homomorphic encryption FHE schemes only allow computation on data encrypted under a single key. Lopez-Alt, Tromer, and Vaikuntanathan STOC 2012 proposed the notion of multi-key FHE, which allows homomorphic computation on ciphertexts encrypted under different keys, and also gave a construction based on a somewhat nonstandard assumption related to NTRU. More recently, Clear and McGoldrick CRYPTO 2015, followed by Mukherjee and Wichs EUROCRYPT 2016, proposed a multi-key FHE that builds upon the LWE-based FHE of Gentry, Sahai, and Waters CRYPTO 2013. However, unlike the original construction of Lopez-Alt et al., these later LWE-based schemes have the somewhat undesirable property of being "single-hop for keys:" all relevant keys must be known at the start of the homomorphic computation, and the output cannot be usefully combined with ciphertexts encrypted under other keys unless an expensive "bootstrapping" step is performed. In this work we construct two multi-key FHE schemes, based on LWE assumptions, which are multi-hop for keys: the output of a homomorphic computation on ciphertexts encrypted under a set of keys can be used in further homomorphic computation involving additional keys, and so on. Moreover, incorporating ciphertexts associated with new keys is a relatively efficient "native" operation akini¾?to homomorphic multiplication, and does not require bootstrapping in contrast with all other LWE-based solutions. Our systems also have smaller ciphertexts than the previous LWE-based ones; in fact, ciphertexts in our second construction are simply GSW ciphertexts with no auxiliary data.

Functional Encryption denotes a form of encryption where a master secret key-holder can control which functions a user can evaluate on encrypted data. Learning With Errors (LWE) (Regev, STOC’05) is known to be a useful cryptographic hardness assumption which implies strong primitives such as, for example, fully homomorphic encryption (Brakerski-Vaikuntanathan, FOCS’11) and lockable obfuscation (Goyal et al., Wichs et al., FOCS’17). Despite its stre ngth, however, there is just a limited number of functional encryption schemes which can be based on LWE. In fact, there are functional encryption schemes which can be achieved by using pairings but for which no secure instantiations from lattice-based assumptions are known: function-hiding inner product encryption (Lin, Baltico et al., CRYPTO’17) and compact quadratic functional encryption (Abdalla et al., CRYPTO’18). This raises the question whether there are some mathematical barriers which hinder us from realizing function-hiding and compact functional encryption schemes from lattice-based assumptions as LWE. To study this problem, we prove an impossibility result for function-hiding functional encryption schemes which meet some algebraic restrictions at ciphertext encryption and decryption. Those restrictions are met by a lot of attribute-based, identity-based and functional encryption schemes whose security stems from LWE. Therefore, we see our results as important indications why it is hard to construct new functional encryption schemes from LWE and which mathematical restrictions have to be overcome to construct secure lattice-based functional encryption schemes for new functionalities.

Multi‐key fully homomorphic encryption (MKFHE) allows computations on ciphertexts encrypted by different users, which can be applied to implement secure multi‐party computing (MPC). The current NTRU‐based MKFHE has the following two drawbacks: One is that the relinearisation process during homomorphic evaluation is so complicated that the corresponding computation time is costly. The other is that a class of subfield attacks are proposed and affects the security of NTRU schemes over power‐of‐2 cyclotomic rings for large moduli q, especially for the NTRU‐based fully homomorphic encryption (FHE) schemes. In this work, an efficient MKFHE scheme is proposed over prime cyclotomic rings with fewer relinearisations, which seems a good choice because of its potential to resist a subfield attack. More specifically, the time of the relinearisation process is reduced by half in homomorphic evaluations by separating the homomorphic multiplication and the relinearisation process (implementing two homomorphic multiplication operations together before relinearisation), while in current NTRU‐type MKFHE schemes, these two processes are usually performed together. The error bound of the basic function components is re‐analysed over prime cyclotomic rings in the average case, which can be used in the error analysis of our scheme. We construct an efficient NTRU‐based single‐key FHE scheme and an efficient MKFHE scheme over prime cyclotomic rings through relinearisation and modulus‐switching techniques. The MKFHE scheme proposed has the on‐the‐fly property and has a tight ciphertext size compared with the GSW‐type and BGV‐type MKFHE schemes. An experiment shows that the homomorphic evaluation of the optimised single‐key FHE scheme proposed is 1.9 times faster than an efficient NTRU‐type MKFHE DHS16 proposed at DCC 2016.

Although the learning with errors(LWE)-based full homomorphic encryption scheme was the first example of deviation from the original Gentry’s blueprint, the scheme did not give detailed conversion process of circuit layer structure, and must rely on bootstrapping technique to achieve full homomorphism. Therefore, through modifying the re-linearization technique proposed by the above scheme, a technique called non-matrix key switching is presented, which includes key switching with re-linearization and pure key switching. The complex matrix operations of existing key switching technique are removed. Combining this technique with modulus switching, a (leveled) fully homomorphic encryption scheme without bootstrapping from LWE is constructed. In order to make circuit layer structure clear, the scheme gives detailed refresh door operation. Finally, we use bootstrapping to upgrade arithmetic circuit to any layer, and make the homomorphic computing capability of the scheme have nothing to circuit depth.

At CRYPTO 2017, Roşca et al. introduce a new variant of the Learning With Errors (LWE) problem, called the Middle-Product LWE ( $${\mathrm {MP}\text {-}\mathrm{LWE}}$$ ). The hardness of this new assumption is based on the hardness of the Polynomial LWE (P-LWE) problem parameterized by a set of polynomials, making it more secure against the possible weakness of a single defining polynomial. As a cryptographic application, they also provide an encryption scheme based on the $${\mathrm {MP}\text {-}\mathrm{LWE}}$$ problem. In this paper, we propose a deterministic variant of their encryption scheme, which does not need Gaussian sampling and is thus simpler than the original one. Still, it has the same quasi-optimal asymptotic key and ciphertext sizes. The main ingredient for this purpose is the Learning With Rounding (LWR) problem which has already been used to derandomize LWE type encryption. The hardness of our scheme is based on a new assumption called Middle-Product Computational Learning With Rounding, an adaption of the computational LWR problem over rings, introduced by Chen et al. at ASIACRYPT 2018. We prove that this new assumption is as hard as the decisional version of MP-LWE and thus benefits from worst-case to average-case hardness guarantees.

A public key encryption scheme based on a new variant of LWE with small cipher size

Fully Homomorphic Encryption (FHE) enables arbitrary computations on encrypted data, a paradigm that Multi-Key FHE (MKFHE) extends to the decentralized setting by supporting operations on ciphertexts encrypted under multiple, distinct keys. However, the high computational cost of bootstrapping remains a major bottleneck, especially in the multi-key scenario where blind rotation is the dominant overhead. To address this, we propose a novel and parallel-friendly blind rotation scheme based on the NTRU assumption for efficient MKFHE bootstrapping. Our core technical contribution is a grouped inner product algorithm optimized for automorphism-based blind rotation, which reorganizes hybrid product storage and extends the external product to be compatible with both NTRU and MK-RLWE ciphertexts. Our parallelized algorithm reduces the time complexity from O ( n ) to $$O(\sqrt{n})$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>O</mml:mi> <mml:mo>(</mml:mo> <mml:msqrt> <mml:mi>n</mml:mi> </mml:msqrt> <mml:mo>)</mml:mo> </mml:mrow> </mml:math> . Our scheme demonstrates significant improvements over prior MKFHE works in both computational efficiency and storage requirements. At a 100-bit security level with $$k=8$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>k</mml:mi> <mml:mo>=</mml:mo> <mml:mn>8</mml:mn> </mml:mrow> </mml:math> participants, our scheme achieves a ciphertext bootstrapping time of 0.048 seconds, representing a $$6.8 \times$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>6.8</mml:mn> <mml:mo>×</mml:mo> </mml:mrow> </mml:math> speedup compared to Kwak et al.’s state-of-the-art work. Furthermore, our scheme substantially reduces storage overhead, requiring only 81.5MB for evaluation keys ( $$1.7 \times$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>1.7</mml:mn> <mml:mo>×</mml:mo> </mml:mrow> </mml:math> smaller) and 64KB for re-linearization keys ( $$6.0 \times$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>6.0</mml:mn> <mml:mo>×</mml:mo> </mml:mrow> </mml:math> smaller) relative to Kwak et al.’s implementation.

Lossy trapdoor functions (LTDF) and all-but-one trapdoor functions (ABO-TDF) are fundamental cryptographic primitives. And given the recent advances in quantum computing, it would be much desirable to develop new and improved lattice-based LTDF and ABO-TDF. In this work, we provide more compact constructions of LTDF and ABO-TDF based on the learning with errors (LWE) problem. In addition, our LWE-based ABO-TDF can allow smaller system parameters to support super-polynomially many injective branches in the construction of CCA secure public key encryption. As a core building tool, we provide a more compact homomorphic symmetric encryption schemes based on LWE, which might be of independent interest. To further optimize the ABO-TDF construction, we employ the full rank difference encoding technique. As a consequence, the results presented in this work can substantially improve the performance of all the previous LWE-based cryptographic constructions based upon LTDF and ABO-TDF.

We present new constructions of multi-party homomorphic secret sharing (HSS) based on a new primitive that we call homomorphic encryption with decryption to shares (HEDS). Our first construction, which we call \(\mathsf {Scooby} \), is based on many popular fully homomorphic encryption (FHE) schemes with a linear decryption property. \(\mathsf {Scooby} \) achieves an n-party HSS for general circuits with complexity \(O(|F| + \log n)\), as opposed to \(O(n^2 \cdot |F|)\) for the prior best construction based on multi-key FHE. \(\mathsf {Scooby} \) can be based on (ring)-LWE with a super-polynomial modulus-to-noise ratio. In our second construction, \(\mathsf {Scrappy} \), assuming any generic FHE plus HSS for NC1-circuits, we obtain a HEDS scheme which does not require a super-polynomial modulus. While these schemes all require FHE, in another instantiation, \(\mathsf {Shaggy} \), we show how in some cases it is possible to obtain multi-party HSS without FHE, for a small number of parties and constant-degree polynomials. Finally, we show that our \(\mathsf {Scooby} \) scheme can be adapted to use multi-key fully homomorphic encryption, giving more efficient spooky encryption and setup-free HSS. This latter scheme, \(\mathsf {Casper} \), if concretely instantiated with a B/FV-style multi-key FHE scheme, for functions F which do not require bootstrapping, gives an HSS complexity of \(O(n \cdot |F| + n^2 \cdot \log n)\).

This study focuses on the vulnerabilities of classical matrix-based encryption and asymmetric padding schemes within hybrid cryptosystems for securing high-throughput enterprise data streams. The Hill cipher algorithm is highly vulnerable to known-plaintext attacks and frequency distribution analysis, whereas the standard Rivest-Shamir-Adleman (RSA) padding scheme of public-key cryptography standards (PKCS#1 v1.5) is vulnerable to padding oracle attacks. To overcome these issues, this study proposes a hybrid cryptographic model which integrates with the key matrix probabilistic scheme (KMPS) using multi-prime RSA architecture and learning with errors (LWE), alongside a modified padding scheme (PKCS #1 v1.5e) utilizing random noises. The feature of this method is the construction of a non-deterministic key matrix combining a random base matrix with a diagonal matrix derived from multi-prime RSA parameters and interjecting Gaussian probabilistic noise. This is followed by security validation using the National Institute of Standards and Technology (NIST) Statistical Test Suite. Experimental results demonstrate that for a 10 x 10 matrix, the ciphertext achieves a P-value of 0.788 in the frequency monobit test, significantly exceeding the NIST threshold of 0.01. This means that the output is statistically indistinguishable from random noise. An avalanche effect of 50.13% is observed, demonstrating strong compliance with the avalanche criterion and indicating substantial resistance to differential cryptanalytic attacks. The internal key entropy is enhanced to 6.28 bits. This model provides a robust solution for securing sensitive database records and transaction logs in enterprise environments, as well as ensuring confidentiality without compromising computational efficiency

The server-aided revocable attribute-based encryption (SR-ABE) scheme was developed to improve scalability and minimize user computational overhead. This approach utilizes an untrusted, computationally potent server to execute key conversion or partial decryption operations while safeguarding users' keys. While Dong et al.'s learning with errors (LWE)based SR-ABE scheme offers theoretical efficiency gains and supports arbitrary Boolean circuits, its key generation and server authorization logic present substantial security vulnerabilities. A thorough analysis confirms that these flaws severely compromise system stability, pinpointing a critical defect in their scheme's identity and access policy design. To rectify this, we developed an optimized solution which also achieves decryption key exposure resistance (DKER).

The security of public-key cryptography relies on well-studied hard problems, problems for which we do not have efficient algorithms. Factorization and discrete logarithm are the two most known and used hard problems. Unfortunately, they can be easily solved on a quantum computer by Shor's algorithm. Also, the research area of cryptography demands for crypto-diversity which says that we should offer a range of hard problems for public-key cryptography. If one hard problem proves to be easy, we should be able to provide alternative solutions. Some of the candidates for post-quantum hard problems, i.e. problems which are believed to be hard even on a quantum computer, are the Learning Parity with Noise (LPN), the Learning with Errors (LWE) and the Shortest Vector Problem (SVP). A thorough study of these problems is needed in order to assess their hardness. In this thesis we focus on the algorithmic study of LPN. LPN is a hard problem that is attractive, as it is believed to be post-quantum resistant and suitable for lightweight devices. In practice, it has been employed in several encryption schemes and authentication protocols. At the beginning of this thesis, we take a look at the existing LPN solving algorithms. We provide the theoretical analysis that assesses their complexity. We compare the theoretical results with practice by implementing these algorithms. We study the efficiency of all LPN solving algorithms which allow us to provide secure parameters that can be used in practice. We push further the state of the art by improving the existing algorithms with the help of two new frameworks. In the first framework, we split an LPN solving algorithm into atomic steps. We study their complexity, how they impact the other steps and we construct an algorithm that optimises their use. Given an LPN instance that is characterized by the noise level and the secret size, our algorithm provides the steps to follow in order to solve the instance with optimal complexity. In this way, we can assess if an LPN instance provides the security we require and we show what are the secure instances for the applications that rely on LPN. The second framework handles problems that can be decomposed into steps of equal complexity. Here, we assume that we have an adversary that has access to a finite or infinite number of instances of the same problem. The goal of the adversary is to succeed in just one instance as soon as possible. Our framework provides the strategy that achieves this. We characterize an LPN solving algorithm in this framework and show that we can improve its complexity in the scenario where the adversary is restricted. We show that other problems, like password guessing, can be modeled in the same framework.

Homomorphic encryption (HE) schemes enable computing functions on encrypted data, by means of a public Eval procedure that can be applied to ciphertexts. But the evaluated ciphertexts so generated may differ from freshly encrypted ones. This brings up the question of whether one can keep computing on evaluated ciphertexts. An i-hop homomorphic encryption scheme is one where Eval can be called on its own output up to i times, while still being able to decrypt the result. A multi-hop homomorphic encryption is a scheme which is i-hop for all i. In this work we study i-hop and multi-hop schemes in conjunction with the properties of function-privacy (i.e., Eval's output hides the function) and compactness (i.e., the output of Eval is short). We provide formal definitions and describe several constructions. First, we observe that bootstrapping techniques can be used to convert any (1-hop) homomorphic encryption scheme into an i-hop scheme for any i, and the result inherits the function-privacy and/or compactness of the underlying scheme. However, if the underlying scheme is not compact (such as schemes derived from Yao circuits) then the complexity of the resulting i-hop scheme can be as high as nO(i). We then describe a specific DDH-based multi-hop homomorphic encryption scheme that does not suffer from this exponential blowup. Although not compact, this scheme has complexity linear in the size of the composed function, independently of the number of hops. The main technical ingredient in this solution is a re-randomizable variant of the Yao circuits. Namely, given a garbled circuit, anyone can re-garble it in such a way that even the party that generated the original garbled circuit cannot recognize it. This construction may be of independent interest.

Reinforcement learning (RL) is a learning technique that enables state-dependent learning through feedback from an environment and makes an action decision for maximizing a reward without prior knowledge of the environment. If these RL techniques are used for data-centric services running on cloud computing, serious data privacy issues may occur because it is required to exchange privacy-related user data for RL-based services between the users and the cloud computing platform. We consider using homomorphic encryption (HE) scheme, which enables cloud computing platforms to perform arithmetic operations without decrypting ciphertexts. Using the HE scheme, users are allowed to deliver only ciphertexts to the cloud computing platform for using RL-based services. We propose a privacy-preserving reinforcement learning (PPRL) framework for the cloud computing platform. The proposed framework exploits a cryptosystem based on learning with errors (LWE) for fully homomorphic encryption (FHE). Performance analysis and evaluation for the proposed PPRL framework are conducted in a variety of cloud computing-based intelligent service scenarios.

We give new instantiations of the Fiat-Shamir transform using explicit, efficiently computable hash functions. We improve over prior work by reducing the security of these protocols to qualitatively simpler and weaker computational hardness assumptions. As a consequence of our framework, we obtain the following concrete results. 1) There exists a succinct publicly verifiable non-interactive argument system for log-space uniform computations, under the assumption that any one of a broad class of fully homomorphic encryption (FHE) schemes has almost optimal security against polynomial-time adversaries. The class includes all FHE schemes in the literature that are based on the learning with errors (LWE) problem. 2) There exists a non-interactive zero-knowledge argument system for in the common reference string model, under either of the following two assumptions: (i) Almost optimal hardness of search-LWE against polynomial-time adversaries, or (ii) The existence of a circular-secure FHE scheme with a standard (polynomial time, negligible advantage) level of security. 3) The classic quadratic residuosity protocol of [Goldwasser, Micali, and Rackoff, SICOMP ’89] is not zero knowledge when repeated in parallel, under any of the hardness assumptions above.