Cryptography from Rings Chris Peikert University of Michigan HEAT - PowerPoint PPT Presentation

Cryptography from Rings Chris Peikert University of Michigan HEAT Summer School 13 Oct 2015 1 / 13

Agenda 1 Polynomial rings, ideal lattices and Ring-LWE 2 Basic Ring-LWE encryption 3 Fully homomorphic encryption Selected bibliography: LPR’10 and ’13 V. Lyubashevsky, C. Peikert, O. Regev. “On Ideal Lattices and Learning with Errors Over Rings,” Eurocrypt’10 and JACM’13. “A Toolkit for Ring-LWE Cryptography,” Eurocrypt’13. BV’11 Z. Brakerski and V. Vaikuntanathan. “Fully Homomorphic Encryption from Ring-LWE. . . ” CRYPTO’11. 2 / 13

Rings in Lattice Cryptography (A Selective History) 1996-97 Ajtai(-Dwork) worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 3 / 13

Rings in Lattice Cryptography (A Selective History) 1996-97 Ajtai(-Dwork) worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient “ring-based” encryption (heuristic security) 3 / 13

Rings in Lattice Cryptography (A Selective History) 1996-97 Ajtai(-Dwork) worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient “ring-based” encryption (heuristic security) 2002 Micciancio’s ring-based one-way function with worst-case hardness from ideal lattices (no encryption) 3 / 13

Rings in Lattice Cryptography (A Selective History) 1996-97 Ajtai(-Dwork) worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient “ring-based” encryption (heuristic security) 2002 Micciancio’s ring-based one-way function with worst-case hardness from ideal lattices (no encryption) 2005 Regev’s LWE: encryption with worst-case hardness (inefficient) 3 / 13

Rings in Lattice Cryptography (A Selective History) 1996-97 Ajtai(-Dwork) worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient “ring-based” encryption (heuristic security) 2002 Micciancio’s ring-based one-way function with worst-case hardness from ideal lattices (no encryption) 2005 Regev’s LWE: encryption with worst-case hardness (inefficient) 2008– Countless applications of LWE (still inefficient) 3 / 13

Rings in Lattice Cryptography (A Selective History) 1996-97 Ajtai(-Dwork) worst-case/average-case reduction, one-way function & public-key encryption (very inefficient) 1996 NTRU efficient “ring-based” encryption (heuristic security) 2002 Micciancio’s ring-based one-way function with worst-case hardness from ideal lattices (no encryption) 2005 Regev’s LWE: encryption with worst-case hardness (inefficient) 2008– Countless applications of LWE (still inefficient) 2010 Ring-LWE: very efficient encryption, worst-case hardness () 3 / 13

Cyclotomic Rings ◮ The m th cyclotomic ring is R = Z [ ζ ] where ζ = ζ m has order m . I.e., ζ m = 1 and ζ j � = 1 for 1 < j < m . 4 / 13

Cyclotomic Rings ◮ The m th cyclotomic ring is R = Z [ ζ ] where ζ = ζ m has order m . I.e., ζ m = 1 and ζ j � = 1 for 1 < j < m . ◮ Fact: X m − 1 = � d | m Φ d ( X ) for irreducible √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C . i ∈ Z ∗ m 4 / 13

Cyclotomic Rings ◮ The m th cyclotomic ring is R = Z [ ζ ] where ζ = ζ m has order m . I.e., ζ m = 1 and ζ j � = 1 for 1 < j < m . ◮ Fact: X m − 1 = � d | m Φ d ( X ) for irreducible √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C . i ∈ Z ∗ m ω 2 ω 3 ω 1 ω 1 ω 4 ω 5 ω 8 ω 5 ω 7 ω 7 Φ 9 ( X ) = 1 + X 3 + X 6 Φ 8 ( X ) = 1 + X 4 4 / 13

Cyclotomic Rings ◮ The m th cyclotomic ring is R = Z [ ζ ] where ζ = ζ m has order m . I.e., ζ m = 1 and ζ j � = 1 for 1 < j < m . ◮ Fact: X m − 1 = � d | m Φ d ( X ) for irreducible √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C . i ∈ Z ∗ m Therefore, Z [ ζ ] ∼ = Z [ X ] / Φ m ( X ) via ζ ↔ X . ω 2 ω 3 ω 1 ω 1 ω 4 ω 5 ω 8 ω 5 ω 7 ω 7 Φ 9 ( X ) = 1 + X 3 + X 6 Φ 8 ( X ) = 1 + X 4 4 / 13

Cyclotomic Rings ◮ The m th cyclotomic ring is R = Z [ ζ ] where ζ = ζ m has order m . I.e., ζ m = 1 and ζ j � = 1 for 1 < j < m . ◮ Fact: X m − 1 = � d | m Φ d ( X ) for irreducible √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C . i ∈ Z ∗ m Therefore, Z [ ζ ] ∼ = Z [ X ] / Φ m ( X ) via ζ ↔ X . ◮ We have deg( R ) = deg(Φ m ) = n := ϕ ( m ) , and R has a Z -basis { ζ 0 , ζ 1 , . . . , ζ n − 1 } : the power basis. This corresponds to Z [ X ] / Φ m ( X ) representation. 4 / 13

Cyclotomic Rings ◮ The m th cyclotomic ring is R = Z [ ζ ] where ζ = ζ m has order m . I.e., ζ m = 1 and ζ j � = 1 for 1 < j < m . ◮ Fact: X m − 1 = � d | m Φ d ( X ) for irreducible √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C . i ∈ Z ∗ m Therefore, Z [ ζ ] ∼ = Z [ X ] / Φ m ( X ) via ζ ↔ X . ◮ We have deg( R ) = deg(Φ m ) = n := ϕ ( m ) , and R has a Z -basis { ζ 0 , ζ 1 , . . . , ζ n − 1 } : the power basis. This corresponds to Z [ X ] / Φ m ( X ) representation. , . . . , ζ p − 1 ◮ There are other Z -bases, e.g., { ζ 0 p , . . . ζ k − 1 , ζ k +1 } . p p p 4 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 5 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 2 For m = p e : Φ m ( X ) = Φ p ( X m/p ) = 1 + X m/p + · · · + X m − m/p . 5 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 2 For m = p e : Φ m ( X ) = Φ p ( X m/p ) = 1 + X m/p + · · · + X m − m/p . ✗ Otherwise, Φ m ( X ) is less “regular” and more “dense.” So it can be cumbersome to work with Z [ X ] / Φ m ( X ) . 5 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 2 For m = p e : Φ m ( X ) = Φ p ( X m/p ) = 1 + X m/p + · · · + X m − m/p . ✗ Otherwise, Φ m ( X ) is less “regular” and more “dense.” So it can be cumbersome to work with Z [ X ] / Φ m ( X ) . Reduction to the Prime-Power Case ◮ Say m has prime-power factorization m 1 · · · m ℓ . 5 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 2 For m = p e : Φ m ( X ) = Φ p ( X m/p ) = 1 + X m/p + · · · + X m − m/p . ✗ Otherwise, Φ m ( X ) is less “regular” and more “dense.” So it can be cumbersome to work with Z [ X ] / Φ m ( X ) . Reduction to the Prime-Power Case ◮ Say m has prime-power factorization m 1 · · · m ℓ . By ζ m i ↔ ζ m/m i , m R = Z [ ζ m ] ∼ = Z [ ζ m 1 , . . . , ζ m ℓ ] . 5 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 2 For m = p e : Φ m ( X ) = Φ p ( X m/p ) = 1 + X m/p + · · · + X m − m/p . ✗ Otherwise, Φ m ( X ) is less “regular” and more “dense.” So it can be cumbersome to work with Z [ X ] / Φ m ( X ) . Reduction to the Prime-Power Case ◮ Say m has prime-power factorization m 1 · · · m ℓ . By ζ m i ↔ ζ m/m i , m R = Z [ ζ m ] ∼ = Z [ ζ m 1 , . . . , ζ m ℓ ] . ◮ R has powerful Z -basis { ζ j 1 m 1 · · · ζ j ℓ { ζ j i � m ℓ } = m i } , 0 ≤ j i < ϕ ( m i ) . 5 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 2 For m = p e : Φ m ( X ) = Φ p ( X m/p ) = 1 + X m/p + · · · + X m − m/p . ✗ Otherwise, Φ m ( X ) is less “regular” and more “dense.” So it can be cumbersome to work with Z [ X ] / Φ m ( X ) . Reduction to the Prime-Power Case ◮ Say m has prime-power factorization m 1 · · · m ℓ . By ζ m i ↔ ζ m/m i , m R = Z [ ζ m ] ∼ = Z [ ζ m 1 , . . . , ζ m ℓ ] . ◮ R has powerful Z -basis { ζ j 1 m 1 · · · ζ j ℓ { ζ j i � m ℓ } = m i } , 0 ≤ j i < ϕ ( m i ) . In general, powerful basis � = power basis { ζ j m } , 0 ≤ j < ϕ ( m ) . 5 / 13

Cyclotomic Rings Key Facts 1 For prime p : Φ p ( X ) = 1 + X + X 2 + · · · + X p − 1 . 2 For m = p e : Φ m ( X ) = Φ p ( X m/p ) = 1 + X m/p + · · · + X m − m/p . ✗ Otherwise, Φ m ( X ) is less “regular” and more “dense.” So it can be cumbersome to work with Z [ X ] / Φ m ( X ) . Reduction to the Prime-Power Case ◮ Say m has prime-power factorization m 1 · · · m ℓ . By ζ m i ↔ ζ m/m i , m R = Z [ ζ m ] ∼ = Z [ ζ m 1 , . . . , ζ m ℓ ] . ◮ R has powerful Z -basis { ζ j 1 m 1 · · · ζ j ℓ { ζ j i � m ℓ } = m i } , 0 ≤ j i < ϕ ( m i ) . In general, powerful basis � = power basis { ζ j m } , 0 ≤ j < ϕ ( m ) . ◮ Bottom line: we can efficiently reduce operations in R to independent operations in prime-power cyclotomics Z [ ζ m i ] . 5 / 13

Canonical Geometry of R ◮ Need a geometry and notion of “short” for ring elements. Use coefficient vector w.r.t. a Z -basis? Which basis to use? 6 / 13

Canonical Geometry of R ◮ Need a geometry and notion of “short” for ring elements. Use coefficient vector w.r.t. a Z -basis? Which basis to use? None! 6 / 13