Encryption in the Plain Model Giulio Malavolta Abhishek Jain - PowerPoint PPT Presentation

Multi-key Fully-Homomorphic Encryption in the Plain Model Giulio Malavolta Abhishek Jain Zhengzhong Jin Prabhanjan Ananth Carnegie Mellon University Johns Hopkins University of California, Johns Hopkins University of California, University Santa Barbara University Berkeley

Multi-key Fully-Homomorphic Encryption [LTV12]

Multi-key Fully-Homomorphic Encryption [LTV12]

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption Protocol:

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption Protocol:

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption ⋯ Protocol:

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption ⋯ Protocol:

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption ⋯ Protocol: Recovery: 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 )

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 (Compact) 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption ⋯ Protocol: Recovery: 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 )

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 (Compact) 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption ⋯ Protocol: Recovery: 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) • Security: adversary can learn nothing beyond 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) .

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷 Decryption ⋯ Protocol: Recovery: 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) • (Implicit) Reusability : decryption can run for different , 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) without re-generating the public keys/ciphertexts.

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷′(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷′ ⋯ • (Implicit) Reusability : decryption can run for different , 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) without re-generating the public keys/ciphertexts.

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷′(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷′ Decryption ⋯ Protocol: • (Implicit) Reusability : decryption can run for different , 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) without re-generating the public keys/ciphertexts.

Multi-key Fully-Homomorphic Encryption [LTV12] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 Ciphertexts: 𝑛 1 𝐷′(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 𝐷′ Decryption ⋯ Protocol: Recovery: 𝐷′(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) • (Implicit) Reusability : decryption can run for different , 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) without re-generating the public keys/ciphertexts.

MK-FHE with 1-Round Decryption [MW16] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 𝑛 1 Ciphertexts: 𝐷 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) Decryption ⋯ Protocol

MK-FHE with 1-Round Decryption [MW16] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 𝑛 1 Ciphertexts: 𝐷 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 1-round ⋯ Decryption:

MK-FHE with 1-Round Decryption [MW16] 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 𝑂 𝑛 2 𝑛 1 Ciphertexts: 𝐷 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) 1-round ⋯ Decryption: Public Recovery: 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 )

Applications

Applications • 2-round multiparty computation [MW16] • Spooky encryption [DHRW16] • Homomorphic secret sharing [BGI16, BGI17] • obfuscation & functional encryption combiners [AJNSY16, AJS17] • Multiparty obfuscation [HIJKSY17] • Homomorphic time-lock puzzles [MT19,BDGM19] • Ad-hoc multi-input functional encryption [ACFGOT20] • ……

Applications • 2-round multiparty computation [MW16] • Spooky encryption [DHRW16] • Homomorphic secret sharing [BGI16, BGI17] • obfuscation & functional encryption combiners [AJNSY16, AJS17] • Multiparty obfuscation [HIJKSY17] • Homomorphic time-lock puzzles [MT19,BDGM19] • Ad-hoc multi-input functional encryption [ACFGOT20] • ……

Prior works on Multi-key FHE with 1-round decryption • [CM15, MW16, BP16, PS16] need a trusted setup. • [DHRW16] sub-exponentially secure indistinguishable obfuscation.

In In th the e pl plain in mode del, l, do does es Mu Mult lti-key key FHE HE wi with h 1-rou ound nd de decrypti yption on ex exis ist?

Our Results

Our Results 1. 1. Mu Mult lti-key key FH FHE wi with th 1-ro roun und d dec ecry ryption ption in in th the e pla lain in mo model el from m Learn arning ing wit ith Err rror or (LWE) WE), , Rin ing-LWE, LWE, and De Decisio isiona nal l Sm Small ll Pol olyn ynomial omial Ratio tio prob oblem lem. • O(1)-party arty Multi lti-key ey FH FHE from m only ly LWE. E.

Our Results 1. 1. Mu Mult lti-key key FH FHE wi with th 1-ro roun und d dec ecry ryption ption in in th the e pla lain in mo model el from m Learn arning ing wit ith Err rror or (LWE) WE), , Rin ing-LWE, LWE, and De Decisio isiona nal l Sm Small ll Pol olyn ynomial omial Ratio tio prob oblem lem. • O(1)-party arty Multi lti-key ey FH FHE from m only ly LWE. E. 2. Mult 2. ltipar iparty ty Homo momor morphic hic Encryp ryptio tion (a weaker er notio ion n of MK MK-FH FHE) E) from om LWE. E.

Multiparty Homomorphic Encryption: A weakening of MK-FHE 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 2 𝑛 𝑂 Ciphertexts: 𝑛 1 𝐷 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) Partial ⋯ Decryption: Partial Decryptions Public Recovery: → 𝐷 𝑛 1 , 𝑛 2 , … , 𝑛 𝑂

Multiparty Homomorphic Encryption: A weakening of MK-FHE 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 2 𝑛 𝑂 Ciphertexts: 𝑛 1 𝐷 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) Partial ⋯ Decryption: 𝐷, Partial Decryptions → 𝐷 𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 Public Recovery:

Multiparty Homomorphic Encryption: A weakening of MK-FHE 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 2 𝑛 𝑂 Ciphertexts: 𝑛 1 𝐷 𝐷(𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 ) Partial ⋯ Decryption: 𝐷, Partial Decryptions → 𝐷 𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 Public Recovery: • It implies 2-round reusable multiparty computation with compact communication complexity.

Multiparty Homomorphic Encryption: A weakening of MK-FHE 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 2 𝑛 𝑂 Ciphertexts: 𝑛 1

Multiparty Homomorphic Encryption: A weakening of MK-FHE 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 2 𝑛 𝑂 Ciphertexts: 𝑛 1 𝐷 𝐷 𝐷 Partial ⋯ Decryption:

Multiparty Homomorphic Encryption: A weakening of MK-FHE 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 2 𝑛 𝑂 Ciphertexts: 𝑛 1 𝐷 𝐷 𝐷 Partial ⋯ Decryption:

Multiparty Homomorphic Encryption: A weakening of MK-FHE 𝐪𝐥 𝑶 𝐪𝐥 𝟐 𝐪𝐥 2 Public Keys: ⋯ 𝑛 2 𝑛 𝑂 Ciphertexts: 𝑛 1 𝐷 𝐷 𝐷 Partial ⋯ Decryption: 𝐷, Partial Decryptions → 𝐷 𝑛 1 , 𝑛 2 , … , 𝑛 𝑂 Public Recovery: