Increased efficiency and functionality through lattice-based - PowerPoint PPT Presentation

Increased efficiency and functionality through lattice-based cryptography Michele Minelli ENS, CNRS, PSL Research University, INRIA (Internship at CryptoExperts, Paris) ECRYPT-NET School on Correct and Secure Implementation – Crete, Greece 8 – 12 October 2017

Why lattice-based cryptography?

Why lattice-based cryptography? Conjectured hardness against quantum attacks

Why lattice-based cryptography? Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc.

Why lattice-based cryptography? Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness

Why lattice-based cryptography? Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility

Why lattice-based cryptography? Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility We can build FHE

Why lattice-based cryptography? Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility We can build FHE!

Why lattice-based cryptography? Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility We can build FHE! But we can build FHE also from other assumptions...

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers .

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD Encryption: c = s · r 1 + q · r 2 + m

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD Encryption: c = s · r 1 + q · r 2 + m return ( c mod s ) mod q Decryption:

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD Encryption: c = s · r 1 + q · r 2 + m return ( c mod s ) mod q Decryption: Hom. + : c 1 + c 2 = s ( r 11 + r 21 ) + q ( r 12 + r 22 ) + ( m 1 + m 2 )

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD Encryption: c = s · r 1 + q · r 2 + m return ( c mod s ) mod q Decryption: Hom. + : c 1 + c 2 = s ( r 11 + r 21 ) + q ( r 12 + r 22 ) + ( m 1 + m 2 ) Hom. × : c 1 · c 2 = s ( · · · ) + q ( · · · ) + ( m 1 · m 2 )

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD Encryption: c = s · r 1 + q · r 2 + m return ( c mod s ) mod q Decryption: Hom. + : c 1 + c 2 = s ( r 11 + r 21 ) + q ( r 12 + r 22 ) + ( m 1 + m 2 ) Hom. × : c 1 · c 2 = s ( · · · ) + q ( · · · ) + ( m 1 · m 2 ) Warning: huge numbers ahead

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD Encryption: c = s · r 1 + q · r 2 + m return ( c mod s ) mod q Decryption: Hom. + : c 1 + c 2 = s ( r 11 + r 21 ) + q ( r 12 + r 22 ) + ( m 1 + m 2 ) Hom. × : c 1 · c 2 = s ( · · · ) + q ( · · · ) + ( m 1 · m 2 ) Parameter selection for FHE: | c | ≈ 2 · 10 7 bits | s | ≈ 2700 bits , | r 2 | ≈ 70 bits ,

The DGHV scheme (extended to Z q ) Fully Homomorphic Encryption over the integers . Assumptions: approximate GCD Encryption: c = s · r 1 + q · r 2 + m return ( c mod s ) mod q Decryption: Hom. + : c 1 + c 2 = s ( r 11 + r 21 ) + q ( r 12 + r 22 ) + ( m 1 + m 2 ) Hom. × : c 1 · c 2 = s ( · · · ) + q ( · · · ) + ( m 1 · m 2 ) Parameter selection for FHE: | c | ≈ 2 · 10 7 bits | s | ≈ 2700 bits , | r 2 | ≈ 70 bits , But we don’t really need this

The use case Final goal Enabling cooperation between law enforcement agencies

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data.

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009)

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009)

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 November 25 June 18

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 November 25 June 18

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 November 25 June 18

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) 150 000 people intercepted! April 28 November 25 June 18

The use case Final goal Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) 150 000 people intercepted! April 28 November 25 June 18 The intersection gives the criminals but... privacy?

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain.

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data In practice

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data In practice Should use state-of-the-art but...

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data In practice Should use state-of-the-art but... AES-256 and RSA-1024

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data In practice Should use state-of-the-art but... AES-256 and RSA-1024 H : SHA-1

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data In practice Should use state-of-the-art but... AES-256 and RSA-1024 H : SHA-1

Current situation EU Council Decision 2008/615/JHA Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data In practice Should use state-of-the-art but... AES-256 and RSA-1024 H : SHA-1 Plus, there are other issues: fairness , privacy , . . .

Improving the current situation Let’s say. . . France (FR) wants to query a DB with criminal records held by Germany (DE). Both countries recognize the authority of a Judge (JU).

Improving the current situation Let’s say. . . France (FR) wants to query a DB with criminal records held by Germany (DE). Both countries recognize the authority of a Judge (JU). Our goals: DE does not learn FR’s query Even if authorized by JU, FR does not learn more than the records that match JU does not learn the result of the query