Learning With Errors Research Articles

Leveled Multi-Hop Multi-Identity Fully Homomorphic Encryption

Gentry, Sahai, and Waters (CRYPTO 2013) proposed the notion of multi-identity fully homomorphic encryption (MIFHE), which allows homomorphic evaluation of data encrypted under multiple identities. Subsequently, Clear and McGoldrick (CANS 2014, CRYPTO 2015) proposed leveled MIFHE candidates. However, the proposed MIFHE is either based on iO, which is a nonstandard assumption or single hop; that is, an arbitrary “evaluated” ciphertext under a set of identities is difficult to further evaluate when new ciphertexts are encrypted under additional identities. To overcome these drawbacks, we propose a leveled multi-hop MIFHE scheme. In a multi-hop MIFHE scheme, one can evaluate a group of ciphertexts under a set of identities to obtain an “evaluated” ciphertext, which can be further evaluated with other ciphertexts encrypted under additional identities. We also show that the proposed MIFHE scheme is secure against selective identity and chosen-plaintext attacks (IND-sID-CPA) under the learning with errors (LWE) assumption.

Universal product learning with errors: A new variant of LWE for lattice-based cryptography

The middle product learning with errors problem (MP-LWE) is a variant of the learning with errors problem (LWE). The public-key cryptography under MP-LWE assumption gets an equilibrium between “efficiency” and “security”. However, the hardness of MP-LWE has not been sufficiently explored since its introduction. So in this paper, we focus on the hardness of MP-LWE.By the axiomatic method, we first investigate the essential attributes about the middle product in MP-LWE. Then we present the formal definition of universal product and the corresponding universal product learning with errors problem (UP-LWE). In this sense, MP-LWE can be viewed as an instance of UP-LWE. Then we proved that for more polynomials than those have been proved in the literature, PLWE(f) can be reduced to MP-LWE. In other words, we improve the result about the hardness of MP-LWE.Furthermore, we define the asymmetric middle product which can be viewed as a construction of universal product. The corresponding UP-LWE is discussed. It provides much more flexible parameter setting than MP-LWE.

Quantum Identity-Based Encryption from the Learning with Errors Problem

To prevent eavesdropping and tampering, network security protocols take advantage of asymmetric ciphers to establish session-specific shared keys with which further communication is encrypted using symmetric ciphers. Commonly used asymmetric algorithms include public key encryption, key exchange, and identity-based encryption (IBE). However, network security protocols based on classic identity-based encryption schemes do not have perfect forward secrecy. To solve this problem, we construct the first quantum IBE (QIBE) scheme based on the learning with errors (LWE) problem, which is also the first cryptographic scheme that applies the LWE problem to quantum encryption. We prove that our scheme is fully secure under the random oracle model and highlight the following advantages: (1) Network security protocols with our QIBE scheme provide perfect forward secrecy. The ciphertext is transmitted in the form of a quantum state unknown to the adversary and cannot be copied and stored. Thus, in network security protocols based on QIBE construction, the adversary does not have any previous quantum ciphertext to decrypt for obtaining the previous session key, even if the private identity key is threatened. (2) Classic key generation centre (KGC) systems can still be used in the QIBE scheme to generate and distribute private identity keys, reducing the cost when implementing this scheme. The classic KGC systems can be used because the master public and secret keys of our scheme are both in the form of classic bits. Finally, we present quantum circuits to implement this QIBE scheme and analyse its required quantum resources for given numbers of qubits, Hadamard gates, phase gates, T gates, and CNOT (controlled-NOT) gates. One of our main findings is that the quantum resources required by our scheme increase linearly with the number of plaintext bits to be encrypted.

Dual Fine-Grained Public-Key Searchable Encryption from Lattices

Fine-grained public key encryption with keyword search (PEKS), allowing users to search on encrypted data with flexible access control policy, has been widely studied recently due to its promising application to real-world scenarios such as cloud computing. However, most of the existing fine-grained PEKS schemes are either only able to support single access control (e.g., attribute-based access control) or susceptible to being attacked or compromised by quantum computers in or after a short time. In this paper, we propose a fine-grained PEKS scheme that o ers dual access control based on lattice. In particular, we first define a dual fine-grained PEKS primitive against chosen keyword attacks under selective security. Subsequently, we adapt the key homomorphic technique and noise rerandomization technique to design a concrete scheme. Particularly, the keyword space in our construction is unlimited. Then, we present a formal security proof against chosen keyword attacks on the learning with errors (LWE) problem in the standard model. Moreover, we demonstrate the theoretical performance and experimental result of our proposed scheme. Finally, we discuss that our scheme can be easily extended to support conjunctive keywords and delegation without incurring complex operations.

On Exploiting Message Leakage in (Few) NIST PQC Candidates for Practical Message Recovery Attacks

In this work, we propose generic and practical side-channel attacks for message recovery in post-quantum lattice-based public key encryption (PKE) and key encapsulation mechanisms (KEM). The targeted schemes are based on the well known Learning With Errors (LWE) and Learning With Rounding (LWR) problem and include three finalists and six semi-finalist candidates of the ongoing NIST’s standardization process for post-quantum cryptography. Notably, we propose to exploit inherent <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ciphertext malleability</i> properties of LWE/LWR-based PKEs as a powerful tool for side-channel assisted message recovery attacks. The use of ciphertext malleability widens the scope of previous attacks with the ability to target multiple operations for message recovery. Moreover, our attacks are adaptable to different implementation variants and are also applicable to implementations protected with concrete <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">shuffling</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">masking</i> side-channel countermeasures. Our work mainly highlights the presence of inherent algorithmic properties in LWE/LWR-based schemes that can aid side-channel attacks for message recovery, thereby stressing on the need for strong side-channel countermeasures against message recovery for LWE/LWR-based schemes.

A Certificateless Homomorphic Encryption Scheme for Protecting Transaction Data Privacy of Post-Quantum Blockchain

Blockchain has a profound impact on all areas of society by virtue of its immutability, decentralization and other characteristics. However, blockchain faces the problem of data privacy leakage during the application process, and the rapid development of quantum computing also brings the threat of quantum attack to blockchain. In this paper, we propose a lattice-based certificateless fully homomorphic encryption (LCFHE) algorithm based on approximate eigenvector firstly. And we use the lattice-based delegate algorithm and preimage sampling algorithm to extract part of the private key based on certificateless scheme, which is composed of the private key together with the secret value selected by the user, thus effectively avoiding the problems of certificate management and key escrow. Secondly, we propose a post-quantum blockchain transaction privacy protection scheme based on LCFHE algorithm, which uses the ciphertext calculation characteristic of homomorphic encryption to encrypt the account balance and transaction amount, effectively protecting the transaction privacy of users and having the ability to resist quantum attacks. Finally, we analyze the correctness and security of LCFHE algorithm, and the security of the algorithm reduces to the hardness of learning with errors (LWE) hypothesis.

Efficient Identity-Based Broadcast Encryption Scheme on Lattices for the Internet of Things

In an identity-based broadcast encryption (IBBE) scheme, the ciphertext is usually appended with a set of user identities to specify intended recipients. However, as IBBE is adopted in extensive industries, the demand of anonymity for specific scenarios such as military applications is urgent and ought no more to be ignored. On the contrary, how to optimize computation and communication is an unavoidable challenge in the IBBE scheme construction, especially in the large-scaled resource-limited wireless networks such as the Internet of Things (IoT), where the cost of computation and communication should be mitigated as much as possible since other functions including connectivity and privacy should be given the top priority. Thus, we present an IBBE scheme from the lattice, in which we employ the Chinese remainder theorem and lattice basis delegation in fixed dimensions to obtain several desirable characteristics, such as constant-size public parameter, private key, and ciphertext. In addition, our encryption and decryption algorithms are more efficient than broadcast encryption (BE) schemes based on number-theoretic problems. To be noticed, our scheme can simultaneously achieve confidentiality and outsider anonymity against the chosen-plaintext attack under the hardness of the learning with error (LWE) problem.

LWE from non-commutative group rings

The Learning-With-Errors (LWE) problem (and its variants including Ring-LWE and Module-LWE), whose security are based on hard ideal lattice problems, has proven to be a promising primitive with diverse applications in cryptography. For the sake of expanding sources for constructing LWE, we study the LWE problem on group rings in this work. One can regard the Ring-LWE on cyclotomic integers as a special case when the underlying group is cyclic, while our proposal utilizes non-commutative groups. In particular, we show how to build public key encryption schemes from dihedral group rings, while maintaining the efficiency of the Ring-LWE. We prove that the PKC system is semantically secure, by providing a reduction from the SIVP problem of group ring ideal lattice to the decisional group ring LWE problem. It turns out that irreducible representations of groups play important roles here. We believe that the introduction of the representation view point enriches the tool set for studying the Ring-LWE problem.

Improvements on Making BKW Practical for Solving LWE

The learning with errors (LWE) problem is one of the main mathematical foundations of post-quantum cryptography. One of the main groups of algorithms for solving LWE is the Blum–Kalai–Wasserman (BKW) algorithm. This paper presents new improvements of BKW-style algorithms for solving LWE instances. We target minimum concrete complexity, and we introduce a new reduction step where we partially reduce the last position in an iteration and finish the reduction in the next iteration, allowing non-integer step sizes. We also introduce a new procedure in the secret recovery by mapping the problem to binary problems and applying the fast Walsh Hadamard transform. The complexity of the resulting algorithm compares favorably with all other previous approaches, including lattice sieving. We additionally show the steps of implementing the approach for large LWE problem instances. We provide two implementations of the algorithm, one RAM-based approach that is optimized for speed, and one file-based approach which overcomes RAM limitations by using file-based storage.

Lattice-based public key searchable encryption with fine-grained access control for edge computing

As a bridge between cloud computing platforms and the Internet of Things (IoT) devices, edge computing provides various on-demand data services to reduce latency and network congestion. To ensure data security in edge computing, sensitive data should be encrypted before being outsourced to edge servers. Public key encryption with keyword search (PEKS) can provide search service for encrypted data. Nevertheless, most existing PEKS schemes are susceptible to quantum attacks because their security assumptions are based on traditional hardness assumptions. Moreover, many lattice-based PEKS schemes only apply to the single-user scenario, limiting the range of applications. In this paper, we present an efficient lattice-based public key searchable encryption with fine-grained access control for edge computing. Our scheme achieves post-quantum security and highly flexible access control policies for multi-user applications, by utilizing the learning with errors (LWE) assumption and subset predicate encryption. The security proof illustrates that our proposed scheme is secure under chosen plaintext attacks and chosen keyword attacks. Finally, extensive experiments on real-world datasets illustrate that our encryption algorithm is faster than existing approaches.

Approximating Closest Vector Problem in ℓ∞-Norm Revisited

Abstract The security of most lattice-based cryptography schemes are based on two computational hard problems which are the short integer solution (SIS) and learning with errors (LWE) problems. The computational complexity of SIS and LWE problems are related to approximating shortest vector problem and bounded distance decoding (BDD) problem. Approximating BDD is a special case of approximating closest vector problem (CVP). In this paper, we revisit the study for approximating CVP. We give a proof that approximating the CVP over $\ell _\infty $-norm (CVP$_\infty $) within any constant factor is NP-hard. The result is obtained by the gap-preserving reduction from Min Total Label Cover problem in $\ell _1$-norm to to CVP$_\infty $. This proof is simpler than known proofs [ 10].

Adaptive oblivious transfer with access control from lattice assumptions

Adaptive oblivious transfer (OT) is a protocol where a sender initially commits to a database {Mi}i=1N. Then, a receiver can query the sender up to k times with private indexes ρ1,…,ρk so as to obtain Mρ1,…,Mρk and nothing else. Moreover, for each i∈[k], the receiver's choice ρi may depend on previously obtained messages {Mρj}j<i. Oblivious transfer with access control (OT-AC) is a flavor of adaptive OT where database records are protected by distinct access control policies that specify which credentials a receiver should obtain in order to access each Mi. So far, all known OT-AC protocols only support access policies made of conjunctions or rely on ad hoc assumptions in pairing-friendly groups (or both). In this paper, we provide an OT-AC protocol where access policies may consist of any branching program of polynomial length, which is sufficient to realize any access policy in NC1. The security of our protocol is proved under the Learning-with-Errors (LWE) and Short-Integer-Solution (SIS) assumptions. As a result of independent interest, we provide protocols for proving the correct evaluation of a committed branching program on a committed input.

A Cryptographic Test of Quantumness and Certifiable Randomness from a Single Quantum Device

We consider a new model for the testing of untrusted quantum devices, consisting of a single polynomial time bounded quantum device interacting with a classical polynomial time verifier. In this model, we propose solutions to two tasks—a protocol for efficient classical verification that the untrusted device is “truly quantum” and a protocol for producing certifiable randomness from a single untrusted quantum device. Our solution relies on the existence of a new cryptographic primitive for constraining the power of an untrusted quantum device: post-quantum secure trapdoor claw-free functions that must satisfy an adaptive hardcore bit property. We show how to construct this primitive based on the hardness of the learning with errors (LWE) problem.

Extremal set theory and LWE based access structure hiding verifiable secret sharing with malicious-majority and free verification

Secret sharing allows a dealer to distribute a secret among a set of parties such that only authorized subsets, specified by an access structure, can reconstruct the secret. Sehrawat and Desmedt (COCOON 2020 [80]) introduced hidden access structures, that remain secret until some authorized subset of parties collaborate. However, their scheme assumes semi-honest parties and supports only restricted access structures. We address these shortcomings by constructing a novel access structure hiding verifiable secret sharing scheme that supports all monotone access structures. Our scheme is the first secret sharing solution to support malicious behavior identification and share verifiability in malicious-majority settings. Furthermore, the verification procedure of our scheme incurs no communication overhead, and is therefore “free”. As the building blocks of our scheme, we introduce and construct the following:•a set-system with greater than exp⁡(c2(log⁡h)2(log⁡log⁡h))+2exp⁡(c(log⁡h)2(log⁡log⁡h)) subsets of a set of h elements. Our set-system, H, is defined over Zm, where m is a non-prime-power. The size of each set in H is divisible by m while the sizes of the pairwise intersections of different sets are not divisible by m unless one set is a (proper) subset of the other,•a new variant of the learning with errors (LWE) problem, called PRIM-LWE, wherein the secret matrix is sampled such that its determinant is a generator of Zq⁎, where q is the LWE modulus. Our scheme arranges parties as nodes of a directed acyclic graph and employs modulus switching during share generation and secret reconstruction. For a setting with ℓ parties, our (non-linear) scheme supports all 22ℓ−O(log⁡ℓ) monotone access structures, and its security relies on the hardness of the LWE problem. Our scheme's maximum share size, for any access structure, is:(1+o(1))2ℓπℓ/2(2qϱ+0.5+q+Θ(h)), where ϱ≤1 is a constant. We provide directions for future work to reduce the maximum share size to:1l+1((1+o(1))2ℓπℓ/2(2qϱ+0.5+2q)), where l≥2. We also discuss three applications of our secret sharing scheme.

Lossless Data Hiding in LWE-Encrypted Domains Based on Key-Switching

This paper proposes a lossless data hiding scheme in learning with errors (LWE)-encrypted domain based on key-switching technique. Lossless data hiding and extraction could be realized by a third party without knowing the private key for decryption. Key-switching-based least-significant-bit (KSLSB) data hiding method has been designed during the lossless data hiding process. The owner of the plaintext first encrypts the plaintext by using LWE encryption and uploads ciphertext to a (trusted or untrusted) third server. Then the server performs KSLSB to obtain a marked ciphertext. To enable the third party to manage ciphertext flexibly and keep the plaintext secret, the embedded data can be extracted from the marked ciphertext without using the private key of LWE encryption in the proposed scheme. Experimental results demonstrate that data hiding would not compromise the security of LWE encryption, and the embedding rate is 1 bit per bit of plaintext without introducing any loss into the directly decrypted result.

Message Authentication Codes Against Related‐Key Attacks Under LPN and LWE

Message authentication code (MAC) guarantees the authenticity of messages and is one of the most important primitives in cryptography. We study related-key attacks with which the adversary is able to choose function f and observe the behavior of the MAC under the modified authenticated key f(k), and consider unforgeability of MAC under (selectively) chosen message attack with f(k). We focus on MAC schemes from the Learning parity with noise (LPN) and the Learning with errors (LWE) problem by Kiltz et al. in EUROCRYPT 2011. We first prove that the MAC schemes from LPN/ LWE can resist key-shift attacks and enlarge the key-shift function set to support a subclass of affine functions.

Lattice‐based revocable attribute‐based encryption with decryption key exposure resistance

Attribute-based encryption (ABE) is a promising management method that enables fine-grained access control in large-scale systems. Revocable ABE (RABE) can support a key revocation mechanism in an ABE system. With the advent of the Internet of Things, users may need to delegate their decryption capacity to other devices, which requires that RABE meet a necessary feature called decryption key exposure resistance (DKER). Although many constructions about RABE from bilinear maps have been proposed, the situation of lattice-based constructions with DKER is less satisfactory. In order to narrow this gap, this paper propose the first lattice-based RABE with DKER. First, a formal description of RABE with DKER and the corresponding security models is proposed. Subsequently, a lattice-based RABE scheme without DKER is constructed and it is proved to be selective indistinguishability under chosen-plaintext attack (IND-CPA) security based on Learning with Errors (LWE). To achieve DKER, this paper construct a RABE scheme by using the RABE scheme without DKER and a key extension mechanism as its building blocks. Finally, this paper show that this scheme is selective IND-CPA security, with the DKER based on LWE.

A public key encryption scheme based on a new variant of LWE with small cipher size

The lattice cryptosystem is considered to be able to resist the attacks of quantum computers. Lattice-based Public Key Encryption (PKE) schemes have attracted the interest of many researchers. In lattice-based cryptography, Learning With Errors (LWE) problem is a hard problem usually used to construct PKE scheme. To ensure the correctness of decryption, LWE-based schemes have a large ciphertext size. This makes these encryption schemes not practical enough when the communication bandwidth is limited. We propose a new variant of LWE, named Learning With Modulus (LWM) and prove that the new problem can be reduced from LWE problem. The proof idea of our reduction is similar to the reduction of LWR problem. We also construct a new PKE scheme based on the proposed LWM and LWE, which has small ciphertext size. For a 128 bits plaintext, the ciphertext size of our scheme is 53.57% of Lindner–Peikert’s (LP) scheme under the same security level. We use python to test the performance of our scheme. The results show that our scheme is only about 0.015 ms slower than LP in the decryption. The performance of our scheme for generating keys and encrypting messages is similar to LP.

Classical reduction of gap SVP to LWE: A concrete security analysis

Regev (2005) introduced the learning with errors (LWE) problem and showed a quantum reduction from a worst case lattice problem to LWE. Building on the work of Peikert (2009), a classical reduction from the gap shortest vector problem to LWE was obtained by Brakerski et al. (2013). A concrete security analysis of Regev's reduction by Chatterjee et al. (2016) identified a huge tightness gap. The present work performs a concrete analysis of the tightness gap in the classical reduction of Brakerski et al. It turns out that the tightness gap in the Brakerski et al. classical reduction is even larger than the tightness gap in the quantum reduction of Regev. This casts doubts on the implication of the reduction to security assurance of practical cryptosystems.

Research perspectives on fully homomorphic encryption models for cloud sector1

As there is a continuous delivery of big data, the researchers are showing interest in the applications of cloud computing concerning privacy, and security. On the other hand, many researchers and experts of cybersecurity have commenced on a quest for improving the data encryption to the models of big data and applications of cloud computing. Since many users of the cloud become public cloud services, confidentiality turns out to be a more compound problem. To solve the confidentiality problem, cloud clients maintain the data on the public cloud. Under this circumstance, Homomorphic Encryption (HE) appears as a probable solution, in which the information of the client is encrypted on the cloud in such a process that it permits few manipulation operations without decryption. The main intent of this paper is to present the systematic review of research papers published in the field of Fully Homomorphic Encryption (FHE) over the past 10 years. The encryption scheme is considered full when it consists of plaintext, a ciphertext, a keyspace, an encryption algorithm, and a decryption algorithm. Hence, the review mostly concentrates on reviewing more powerful and recent FHE. The contributions using different algorithms in FHE like Lattice-based, integer-based, Learning With Errors (LWE), Ring Learning With Errors (RLWE), and Nth degree Truncated polynomial Ring Units (NTRU) are also discussed. Finally, it highlights the challenges and gaps to be addressed in modeling and learning about competent, effectual, and vigorous FHE for the cloud sector and pays attention to directions for better future research.