Ring-LWE Research Articles

Adaptively Secure Efficient (H)IBE over Ideal Lattice with Short Parameters.

Identity-based encryption (IBE), and its hierarchical extension (HIBE), are interesting cryptographic primitives that aim at the implicit authentication on the users’ public keys by using users’ identities directly. During the past several decades, numerous elegant pairing-based (H)IBE schemes were proposed. However, most pairing-related security assumptions suffer from known quantum algorithmic attacks. Therefore, the construction of lattice-based (H)IBE became one of the hot directions in recent years. In the setting of most existing lattice-based (H)IBE schemes, each bit of a user’s identity is always associated with a parameter matrix. This always leads to drastic but unfavorable increases in the sizes of the system public parameters. To overcome this issue, we propose a flexible trade-off mechanism between the size of the public parameters and the involved computational cost using the blocking technique. More specifically, we divide an identity into segments and associate each segment with a matrix, while increasing the lattice modulo slightly for maintaining the same security level. As a result, for the setting of 160-bit identities, we show that the size of the public parameters can be reduced by almost 89.7% (resp. 93.8%) while increasing the computational cost by merely 5.2% (resp. 12.25%) when is a set of 16 (resp. 8). Finally, our IBE scheme is extended to an HIBE scheme, and both of them are proved to achieve the indistinguishability of ciphertexts against adaptively chosen identity and chosen plaintext attack (IND-ID-CPA) in the standard model, assuming that the well-known ring learning with error (RLWE) problem over the involved ideal lattices is intractable, even in the post-quantum era.

Modified multi-key fully homomorphic encryption based on NTRU cryptosystem without key-switching

The Multi-Key Fully Homomorphic Encryption (MKFHE) based on the NTRU cryptosystem is an important alternative to the post-quantum cryptography due to its simple scheme form, high efficiency, and fewer ciphertexts and keys. In 2012, Lopez-Alt et al. proposed the first NTRU-type MKFHE scheme, the LTV12 scheme, using the key-switching and modulus-reduction techniques, whose security relies on two assumptions: the Ring Learning With Error (RLWE) assumption and the Decisional Small Polynomial Ratio (DSPR) assumption. However, the LTV12 and subsequent NTRU-type schemes are restricted to the family of power-of-2 cyclotomic rings, which may affect the security in the case of subfield attacks. Moreover, the key-switching technique of the LTV12 scheme requires a circular application of evaluation keys, which causes rapid growth of the error and thus affects the circuit depth. In this paper, an NTRU-type MKFHE scheme over prime cyclotomic rings without key-switching is proposed, which has the potential to resist the subfield attack and decrease the error exponentially during the homomorphic evaluating process. First, based on the RLWE and DSPR assumptions over the prime cyclotomic rings, a detailed analysis of the factors affecting the error during the homomorphic evaluations in the LTV12 scheme is provided. Next, a Low Bit Discarded & Dimension Expansion of Ciphertexts (LBD&DEC) technique is proposed, and the inherent homomorphic multiplication decryption structure of the NTRU is proposed, which can eliminate the key-switching operation in the LTV12 scheme. Finally, a leveled NTRU-type MKFHE scheme is developed using the LBD&DEC and modulus-reduction techniques. The analysis shows that the proposed scheme compared to the LTV12 scheme can decrease the magnitude of the error exponentially and minimize the dimension of ciphertexts.

Fault Detection Architectures for Inverted Binary Ring-LWE Construction Benchmarked on FPGA

Ring learning with errors (RLWE) is an efficient lattice-based cryptographic scheme that has worst-case reduction to lattice problem, conjectured to be quantum-hard. Ring-BinLWE is an optimized variant of RLWE problem using binary error distribution, resulting in highly-efficient hardware implementation. Efficient and low-complexity architectures in hardware, thwarting natural and malicious faults, are essential for lattice-based post-quantum cryptography (PQC) algorithms. In this brief, we explore efficient fault detection approaches for implementing the Ring-BinLWE problem. This brief, for the first time, investigates fault detection schemes for all three stages of RLWE encryption. Utilizing the stuck-at fault model, we employ recomputing with encoded operands schemes to achieve high error coverage. We simulate and implement our schemes on a field-programmable gate array (FPGA) platform. Our schemes provide low hardware overhead (area overhead of 15.74%, delay overhead of 7.74%, and power consumption overhead of 4.06%), with high error coverage, which can be suitable for resource-constrained as well as high-performance usage models.

An Efficient and Parallel R-LWE Cryptoprocessor

Lattice-based cryptography (LBC) is a promising and efficient public key cryptography scheme whose theoretical foundation usually lies in Learning with Error (LWE) problem and its variant such as Ring-LWE (R-LWE) is the most studied cryptosystem which allows for more efficient implementation while maintaining the hardness of an original problem. Polynomial multiplication is the bottleneck of R-LWE, that can either be done using Number Theoretic Transform (NTT) or schoolbook polynomial multiplication (SPM) algorithm. The use of SPM is wider and possible for all parameters of R-LWE schemes. This brief proposes an efficient and parallel strategy for SPM in R-LWE; by successfully reducing its time complexity from $n^{2}$ to $n^{2}/4$ (making it $1.8\times $ faster and $1.4\times $ hardware efficient). Furthermore, by adjusting the bit width for the error terms, the polynomial multiplication and addition blocks are reused for both encryption and decryption modules resulting in 14% reduced area and $1.7\times $ better throughput in comparison to state-of-art SPM based R-LWE designs.

Highly Efficient Architecture of NewHope-NIST on FPGA using Low-Complexity NTT/INTT

NewHope-NIST is a promising ring learning with errors (RLWE)-based postquantum cryptography (PQC) for key encapsulation mechanisms. The performance on the field-programmable gate array (FPGA) affects the applicability of NewHope-NIST. In RLWE-based PQC algorithms, the number theoretic transform (NTT) is one of the most time-consuming operations. In this paper, low-complexity NTT and inverse NTT (INTT) are used to implement highly efficient NewHope-NIST on FPGA. First, both the pre-processing of NTT and the post-processing of INTT are merged into the fast Fourier transform (FFT) algorithm, which reduces N and 2N modular multiplications for N-point NTT and INTT, respectively. Second, a compact butterfly unit and an efficient modular reduction on the modulus 12289 are proposed for the low-complexity NTT/INTT architecture, which achieves an improvement of approximately 3× in the area time product (ATP) compared with the results of the state-of-the-art designs. Finally, a highly efficient architecture with doubled bandwidth and timing hiding for NewHope-NIST is presented. The implementation results on an FPGA show that our design is at least 2.5× faster and has 4.9× smaller ATP compared with the results of the state-of-the-art designs of NewHope-NIST on similar platforms.

Provably secure two-party authenticated key agreement protocol for post-quantum environments

A two-party authenticated key agreement (2PAKA) protocol is a cryptographic tool employed widely to allow two users to generate a shared and fresh session key between them in each session over an insecure network. The authenticated version of a two-party key agreement protocol is popular because it can easily withstand the impersonation of the user. In the literature, many 2PAKA protocols have been put forward with the intractability assumptions of the discrete logarithm (DLP) problem and integer factorization problem (IFP). Some recent studies showed that the 2PAKA protocols based on these assumptions are insecure in post-quantum environments. To resolve this issue, we have designed a lattice-based 2PAKA (LB-2PAKA) protocol with the intractability of the ring-learning-with-errors (RLWE) problem. The proposed LB-2PAKA protocol is also analyzed in the random oracle model to measure provable security and to estimate the breaching time. To evaluate the performance, we used the LatticeCrypto Library and estimated the running time of our LB-2PAKA protocol. Besides, we analyzed the communication cost requirement of our LB-2PAKA protocol.

Efficient Lattice CP-ABE AC Scheme Supporting Reduced-OBDD Structure for CCN/NDN

In line with the proposed 5th Generation network, content centric network/named data networking (CCN/NDN) has been offered as one of the promising paradigms to cope with the communication needs of future realistic network communications. CCN/NDN allows network communication based on content names and also allows users to obtain information from any of the nearest intermediary caches on the network. Due to that, the ability of cached content to protect itself is essential since contents can be cached on any node everywhere, and publishers may not have total control over their own published data. The attribute based encryption (ABE) scheme is a preferable approach, identified to enable cached contents to be self-secured since it has a special property of encryption with policies. However, most of the proposed ABE schemes for CCN/NDN suffer from some loopholes. They are not flexible in the expression of access policy, they are inefficient, they are based on bilinear maps with pairings, and they are vulnerable to quantum cryptography algorithms. Hence, we propose the ciphertext policy attribute based encryption access control (CP-ABE AC) scheme from a lightweight ideal lattice based on ring learning with error (R-LWE) problem, and demonstrated its use in practical applications. The proposed scheme is proved to be secure and efficient under the decision ring LWE problem in the selective set model. To achieve an efficient scheme, we used an efficient trapdoor technique and the access tree representation of access structure describing the access policies was modified into a new structure, based on a reduced ordered binary decision diagram (reduce-OBDD). This access structure can support Boolean operations such as AND, NOT, OR, and threshold gates. The final result showed that the proposed scheme was secure and efficient for applications, thereby supporting CCN/NDN as a promising paradigm.

Design and Implementation of Constant-Round Dynamic Group Key Exchange from RLWE

Group Key Exchange (GKE) is required for secure group communication with high confidentiality. In particular, a trusted authority can handle issues that happen by the malicious actions of group members, but it is expensive to deploy and not suitable in a dynamic setting where the network requires frequent membership status changes. To overcome these issues, we designed yet another quantum-resistant constant-round GKE based on lattice without a trusted authority based on Apon et al.'s protocol (PQCrypto 2019) by modifying their key computation phase. Then, we describe the novel dynamic authenticated GKE (called DRAG) with membership addition/deletion procedures in Ring Learning with Errors (RLWE) setting, while the former ones are built from Diffie-Hellman problem. Under the specific adversary who can leak the long-term secret key from the party, we suggest a rigorous proof of DRAG in the random oracle model based on the hardness assumption of RLWE problem and the property of Renyi divergence. As a proof of concept, implementation details are described to meet level 1 NIST security. Our implementation is reasonable for practical use since the total runtime to get a group secret key takes about 3 msec and it can be considered as a reference implementation of other quantum-resistant GKEs.

FPGA-Based Hardware Accelerator for Leveled Ring-LWE Fully Homomorphic Encryption

Fully homomorphic encryption (FHE) allows arbitrary computation on encrypted data and has great potential in privacy-preserving cloud computing and securely outsource computational tasks. However, the excessive computation complexity is the key limitation that restricting the practical application of FHE. In this paper we proposed a FPGA-based high parallelism architecture to accelerate the FHE schemes based on the ring learning with errors (RLWE) problem, specifically, we presented a fast implementation of leveled fully homomorphic encryption scheme BGV. In order to reduce the computation latency and improve the performance, we applied both circuit-level and block-level pipeline strategies to improve clock frequency, and as a result, enhance the processing speed of polynomial multipliers and homomorphic evaluation functions. At the same time, multiple polynomial multipliers and modular reduction units were deployed in parallel to further improve the hardware performance. Finally, we implemented and tested our architecture on a Virtex UltraScale FPGA platform. Runing at 150MHz, our implementation achieved $4.60\times \sim 9.49\times $ speedup with respect to the optimized software implementation on Intel i7 processor running at 3.1GHz for homomorphic encryption and decryption, and the throughput was increased by $1.03\times \sim 4.64\times $ compared to the hardware implementation of BGV. While compared to the hardware implementation of FV, the throughput of our accelerator also achieved $5.05\times $ and $167.3\times $ speedup for homomorphic addition and homomorphic multiplication operation respectively.

Reduction From Module-SIS to Ring-SIS Under Norm Constraint of Ring-SIS

Lattice-based cryptographic scheme is constructed based on hard problems on a lattice such as the short integer solution (SIS) problem and the learning with error (LWE). However, the cryptographic scheme based on SIS or LWE is inefficient since the size of the key is too large. Thus, most cryptographic schemes use the variants of LWE and SIS with ring and module structures. Albrecht and Deo showed that there is a reduction from module-LWE (M-LWE) to ring-LWE (R-LWE) in the polynomial ring by handling the error rate and modulus. However, unlike the LWE problem, the SIS problem does not have an error rate, but there is the upper bound β on the norm of the solution of the SIS problem. In this paper, we propose the two novel reductions related to module-SIS (M-SIS) and ring-SIS (R-SIS) on a polynomial ring. We propose (i) the reduction from R-SIS q k ,m k ,β k to R-SIS q , m,β and (ii) the reduction from M-SIS to R-SIS under norm constraint of R-SIS. Combining these two results implies that R-SIS for a specified modulus and number samples is more difficult than M-SIS under norm constraints of R-SIS, which provides the range of possible module ranks for M-SIS. From the reduction we propose, contrary to the widely known belief, our result shows that there is a possibility that the security parameters of M-SIS may be less secure when it reduces to R-SIS for the theoretical reasons presented in this paper. Therefore, when generating parameters on an M-SIS structure, the theoretical security level over R-SIS also should also be checked at the same time.

An Efficient Implementation of the NewHope Key Exchange on FPGAs

Lattice based cryptography plays an important role in the construction of post-quantum cryptography, including key exchange, public key encryption as well as digital signature schemes. Dating back to 2016, a new key exchange scheme called NewHope was proposed by Alkim, Ducas, Poppelmann, and Schwabe that based security on the quantum hardness of Ring Learning with Errors (RLWE) problem, and was later submitted to the NIST public competition of standard post-quantum cryptography. The new scheme is attractive as it is designed to achieve high performance. In this work, we concentrate on its performance on hardware platforms and propose an efficient implementation of NewHope on Xilinx Artix-7 7020 FPGA platform that consumes 3158 slices, 10285 LUTs, 6623 registers in the server side, and 3042 slices, 10345 LUTs, 6704 registers in the client side, achieving a 45% reduction in LUT, 30% reduction in FF while the total time utilization also decreases by 16% compared with the up to date and directly related work. Specifically, we can accomplish three phases of the key exchange in 39.8/61.7/ $21.4~\mu \text{s}$ respectively, operating in 153/152 MHz in server/client side.

Fully homomorphic encryption based on the ring learning with rounding problem

Almost all existing well-known fully homomorphic encryption (FHE) schemes, which are based on either the learning with errors (LWE) or the ring LWE problem, require expensive Gaussian noise sampling. In this study, the authors propose an FHE scheme based on the ring learning with rounding (RLWR) problem. The learning with rounding (LWR) problem was proposed as a deterministic variant of LWE, while the RLWR is a variant of LWR. Sampling an LWR instance does not require Gaussian noise sampling process, and neither does an RLWR instance. Thus, our FHE scheme can be instantiated without the need for Gaussian noise sampling. To implement homomorphic operations, we devise a specific relinearisation method. Furthermore, we also prove that our RLWR-based FHE scheme is IND-CPA secure under RLWR assumption.

Universally composable oblivious transfer from ideal lattice

As a fundamental cryptographic primitive, oblivious transfer (OT) is developed for the sake of efficient usability and combinational feasibility. However, most OT protocols are built upon some quantum non-immune cryptosystems by assuming the hardness of discrete logarithm or factoring problem, whose security will break down directly in the quantum setting. Therefore, as a subarea of post-quantum cryptography, lattice-based cryptography is viewed as a promising alternative and cornerstone to support for building post-quantum protocols since it enjoys some attractive properties, such as provable security against quantum adversaries and lower asymptotic complexity. In this paper, we first build an efficient 1-out-of-2 OT protocol upon the hardness of ring learning with errors (RLWE) problem, which is at least as hard as some worst-case ideal lattice problems. We show that this 1-out-of-2 OT protocol can be universally composable and secure against static corruptions in the random oracle model. Then we extend it to a general case, i.e., 1-out-of-N OT with achieving the same level of security. Furthermore, on the basis of the above OT structure, we obtain two improved OT protocols using two improved lattice-based key exchange protocols (respectively relying on the RLWE problem and learning with errors (LWE) problem, and both achieving better efficiency by removing the Gaussian sampling for saving cost) as building blocks. To show that our proposed OT protocol indeed achieves comparable security and efficiency, we make a comparison with another two lattice-based OT protocols in the end of the paper. With concerning on the potential threat from quantum computing and expecting on the practical use of OT with high efficiency, an efficient post-quantum OT protocol is pressing needed. As shown in this paper, our proposed OT protocols may be considered as post-quantum OT candidates since they can both preserve provable security relying on lattice problems and enjoy practical efficiency.

Lattice-Based Public Key Cryptosystem for Internet of Things Environment: Challenges and Solutions

Due to its widespread popularity and usage in many applications (smart transport, energy management, ${e}$ -healthcare, smart ecosystem, and so on), the Internet of Things (IoT) has become popular among end users over the last few years. However, with an exponential increase in the usage of IoT technologies, we have been witnessing an increase in the number of cyber attacks on the IoT environment. An adversary can capture the private key shared between users and devices and can launch various attacks, such as IoT ransomware, Mirai botnet, man-in-the-middle, denial of service, chosen plaintext, and chosen ciphertext. To mitigate these security attacks on the IoT environment, the traditional public key cryptographic primitives are inadequate because of their high computational and communication costs. Therefore, lattice-based public-key cryptosystem (LB-PKC) is a promising technique for secure communication. We discuss the taxonomy of two major problems, namely, the shortest path and the closest path problems with respect to the applicability of lattice-based cryptographic primitives for IoT devices. Moreover, we also discuss various LB-PKC techniques, such as NTRU, learning with errors (LWEs), and ring-LWE (R-LWE) which are often used to solve shortest path and lattice NP-hard problems in a polynomial time. We further classify the R-LWE into three categories, namely identity-based encryption, homomorphic encryption, and secure authentication key exchange. We describe the operations and algorithms adopted in each of these encryption mechanisms. Finally, we discuss the challenges, open issues, and future directions for applying LB-PKC in the IoT environment.

RLWE-Oriented High-Speed Polynomial Multiplier Utilizing Multi-Lane Stockham NTT Algorithm

Cryptography based on ring learning with error (RLWE) problem has become increasingly popular due to its resistance against quantum analysis. The most time-consuming operation in RLWE cryptosystem is polynomial multiplication. This brief presents a novel polynomial multiplier based on Stockham fast Fourier transform (FFT) algorithm. We propose a multi-lane number theoretic transform (NTT) algorithm which can achieve ${n}$ -degree polynomial multiplication in ${(nlgn)/d+2n/d}$ clock cycles with ${d}$ lanes of butterfly units. In addition, we also customize a memory addressing strategy and a round constant managing scheme for the proposed multi-lane NTT algorithm. Based on our proposed algorithm, a high-speed polynomial multiplier is accomplished on FPGA platform. Implementation results on Spantan-6 FPGA show that our proposed algorithm can achieve a speed up factor of no less than 2.7 times compared with the state of art designs.

Practical Applications of Improved Gaussian Sampling for Trapdoor Lattices

Lattice trapdoors are an important primitive used in a wide range of cryptographic protocols, such as identity-based encryption (IBE), attribute-based encryption, functional encryption, and program obfuscation. In this paper, we present software implementations of the Gentry-Peikert-Vaikuntanathan (GPV) digital signature, IBE and ciphertext-policy attribute-based encryption (CP-ABE) schemes based on an efficient Gaussian sampling algorithm for trapdoor lattices, and demonstrate that these three important cryptographic protocols are practical. One important aspect of our implementation is that it supports prime moduli, which are required in many cryptographic schemes. Also, our implementation uses bases larger than two for the gadget matrix whereas most previous implementations use the binary base. We show that the use of higher bases significantly decreases execution times and storage requirements. We adapt IBE and CP-ABE schemes originally based on learning with errors (LWE) hardness assumptions to a more efficient Ring LWE (RLWE) construction. To the best of our knowledge, ours are the first implementations employing the Gaussian sampling for non-binary bases of the gadget matrix. The experimental results demonstrate that our lattice-based signature, IBE and CP-ABE implementations, which are based on standard assumptions with post-quantum security, provide a performance comparable to the recent state-of-the-art implementation works based on stronger/non-post-quantum assumptions.

Comparison analysis and efficient implementation of reconciliation-based RLWE key exchange protocol

Error reconciliation is an important technique for learning with error (LWE) and ring-LWE (RLWE)-based constructions. In this paper, we present a comparison analysis on two error reconciliation-based RLWE key exchange protocols: Ding et al. in 2012 (DING12) and Bos et al. in 2015 (BCNS15). We take them as examples to explain the core idea of error reconciliation, building key exchange over RLWE problem, implementation and real-world performance, and compare them comprehensively. We also analyse a LWE key exchange 'Frodo' that uses an improved error reconciliation mechanism in BCNS15. To the best of our knowledge, our work is the first to present at least 128-bit classic (80-bit quantum) and 256-bit classic (> 200-bit quantum) secure parameter choices for DING12 with efficient portable C/C++ implementations. Benchmark shows that our efficient implementation is 11× faster than BCNS15 and one key exchange execution only costs 0.07 ms on a four-year-old middle range CPU. Error reconciliation is 1.57× faster than BCNS15.

Improved Lattice-Based Signcryption in the Standard Model

Signcryption is a basic cryptographic primitive that simultaneously captures the functions of encryption and signature. To realize comprehensive information security against quantum computing attacks, lattice-based signcryption schemes have been successively proposed. However, the performance of signcryption schemes should be improved in the lattice setting. An efficient lattice-based signcryption scheme in the standard model is proposed in this paper. Under the ring learning with errors (RLWE) assumption and the ideal short integer solution (ISIS) assumption, the proposed signcryption scheme achieves indistinguishability against adaptive chosen ciphertext attacks (IND-CCA2) and existential unforgeability under an adaptive chosen-message attack (EUF-ACMA). Our scheme not only reduces the communication and computational overhead but also realizes a new design that combines the partitioning technique with the idea of tag-based key encapsulation. The performance analysis results show that our scheme is more efficient than previous lattice-based signcryption schemes in the standard model.

A Privacy-Preserving RLWE-Based Remote Biometric Authentication Scheme for Single and Multi-Server Environments

Lwamo et al. recently proposed a robust and efficient remote single and multi-server biometric authentication scheme using smart card and RSA. The scheme is vulnerable to the smart card lost attacks; therefore, the scheme cannot resist offline guessing attacks and user impersonation attacks, and cannot provide forward security and user anonymity. To address these issues, we propose a new privacy-preserving ring learning with errors (RLWE)-based remote biometric authentication scheme (RRBAS) for single and multi-server environments. RRBAS is the first lattice-based remote biometric authentication scheme for multi-server environments. Security analysis show that RRBAS can satisfy the authenticated key exchange (AKE) security in the random oracle model, resist known security attacks, and provide post-quantum security. The experimental evaluation and comparative analysis show that RRBAS's computational efficiency is better than that of Lwamo et al., while the communication efficiency is slightly lower than traditional schemes because of the large-size ciphertext of the lattice-based cryptosystem, but it is fully capable of session key agreement in single and multi-server environments.

Comparison analysis and efficient implementation of reconciliation-based RLWE key exchange protocol

Error reconciliation is an important technique for learning with error (LWE) and ring-LWE (RLWE)-based constructions. In this paper, we present a comparison analysis on two error reconciliation-based RLWE key exchange protocols: Ding et al. in 2012 (DING12) and Bos et al. in 2015 (BCNS15). We take them as examples to explain the core idea of error reconciliation, building key exchange over RLWE problem, implementation and real-world performance, and compare them comprehensively. We also analyse a LWE key exchange 'Frodo' that uses an improved error reconciliation mechanism in BCNS15. To the best of our knowledge, our work is the first to present at least 128-bit classic (80-bit quantum) and 256-bit classic (> 200-bit quantum) secure parameter choices for DING12 with efficient portable C/C++ implementations. Benchmark shows that our efficient implementation is 11× faster than BCNS15 and one key exchange execution only costs 0.07 ms on a four-year-old middle range CPU. Error reconciliation is 1.57× faster than BCNS15.