Increased efficiency and functionality through lattice-based - - PowerPoint PPT Presentation

▶
increased efficiency and functionality through lattice
SMART_READER_LITE
LIVE PREVIEW

Increased efficiency and functionality through lattice-based - - PowerPoint PPT Presentation

Dec 30, 2023 171 likes •851 views

Increased efficiency and functionality through lattice-based cryptography Michele Minelli ENS, CNRS, PSL Research University, INRIA (Internship at CryptoExperts, Paris) ECRYPT-NET School on Correct and Secure Implementation Crete, Greece 8

slide-1
SLIDE 1

Increased efficiency and functionality through lattice-based cryptography

Michele Minelli

ENS, CNRS, PSL Research University, INRIA (Internship at CryptoExperts, Paris)

ECRYPT-NET School on Correct and Secure Implementation – Crete, Greece 8 – 12 October 2017

slide-2
SLIDE 2

Why lattice-based cryptography?

slide-3
SLIDE 3

Why lattice-based cryptography?

Conjectured hardness against quantum attacks

slide-4
SLIDE 4

Why lattice-based cryptography?

Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc.

slide-5
SLIDE 5

Why lattice-based cryptography?

Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness

slide-6
SLIDE 6

Why lattice-based cryptography?

Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility

slide-7
SLIDE 7

Why lattice-based cryptography?

Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility We can build FHE

slide-8
SLIDE 8

Why lattice-based cryptography?

Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility We can build FHE!

slide-9
SLIDE 9

Why lattice-based cryptography?

Conjectured hardness against quantum attacks Simplicity, efficiency and parallelism: linear ops, rings, etc. Strong security guarantees from worst-case hardness Versatility We can build FHE!

But we can build FHE also from other assumptions...

slide-10
SLIDE 10

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers.

slide-11
SLIDE 11

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD

slide-12
SLIDE 12

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD Encryption: c = s · r1 + q · r2 + m

slide-13
SLIDE 13

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD Encryption: c = s · r1 + q · r2 + m Decryption: return (c mod s) mod q

slide-14
SLIDE 14

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD Encryption: c = s · r1 + q · r2 + m Decryption: return (c mod s) mod q

  • Hom. +:

c1 + c2 = s (r11 + r21) + q (r12 + r22) + (m1 + m2)

slide-15
SLIDE 15

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD Encryption: c = s · r1 + q · r2 + m Decryption: return (c mod s) mod q

  • Hom. +:

c1 + c2 = s (r11 + r21) + q (r12 + r22) + (m1 + m2)

  • Hom. ×:

c1 · c2 = s (· · · ) + q (· · · ) + (m1 · m2)

slide-16
SLIDE 16

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD Encryption: c = s · r1 + q · r2 + m Decryption: return (c mod s) mod q

  • Hom. +:

c1 + c2 = s (r11 + r21) + q (r12 + r22) + (m1 + m2)

  • Hom. ×:

c1 · c2 = s (· · · ) + q (· · · ) + (m1 · m2) Warning: huge numbers ahead

slide-17
SLIDE 17

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD Encryption: c = s · r1 + q · r2 + m Decryption: return (c mod s) mod q

  • Hom. +:

c1 + c2 = s (r11 + r21) + q (r12 + r22) + (m1 + m2)

  • Hom. ×:

c1 · c2 = s (· · · ) + q (· · · ) + (m1 · m2) Parameter selection for FHE: |s| ≈ 2700 bits, |r2| ≈ 70 bits, |c| ≈ 2 · 107 bits

slide-18
SLIDE 18

The DGHV scheme (extended to Zq)

Fully Homomorphic Encryption over the integers. Assumptions: approximate GCD Encryption: c = s · r1 + q · r2 + m Decryption: return (c mod s) mod q

  • Hom. +:

c1 + c2 = s (r11 + r21) + q (r12 + r22) + (m1 + m2)

  • Hom. ×:

c1 · c2 = s (· · · ) + q (· · · ) + (m1 · m2) Parameter selection for FHE: |s| ≈ 2700 bits, |r2| ≈ 70 bits, |c| ≈ 2 · 107 bits But we don’t really need this

slide-19
SLIDE 19

The use case

Final goal

Enabling cooperation between law enforcement agencies

slide-20
SLIDE 20

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data.

slide-21
SLIDE 21

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009)

slide-22
SLIDE 22

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009)

slide-23
SLIDE 23

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 June 18 November 25

slide-24
SLIDE 24

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 June 18 November 25

slide-25
SLIDE 25

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 June 18 November 25

slide-26
SLIDE 26

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 June 18 November 25 150 000 people intercepted!

slide-27
SLIDE 27

The use case

Final goal

Enabling cooperation between law enforcement agencies, while maintaining an adequate level of privacy for citizens’ personal data. Concrete example (2009) April 28 June 18 November 25 150 000 people intercepted! The intersection gives the criminals but... privacy?

slide-28
SLIDE 28

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain.

slide-29
SLIDE 29

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration

slide-30
SLIDE 30

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

slide-31
SLIDE 31

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

In practice

slide-32
SLIDE 32

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

In practice

Should use state-of-the-art but...

slide-33
SLIDE 33

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

In practice

Should use state-of-the-art but... AES-256 and RSA-1024

slide-34
SLIDE 34

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

In practice

Should use state-of-the-art but... AES-256 and RSA-1024 H : SHA-1

slide-35
SLIDE 35

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

In practice

Should use state-of-the-art but... AES-256 and RSA-1024 H : SHA-1

slide-36
SLIDE 36

Current situation

EU Council Decision 2008/615/JHA

Picks up a treaty signed in 2005 by Austria, Belgium, France, Germany, Luxembourg, the Netherlands and Spain. Goal: cross-border cooperation against terrorism, crime and illegal migration Tools: DNA, fingerprints and vehicle registration data

In practice

Should use state-of-the-art but... AES-256 and RSA-1024 H : SHA-1 Plus, there are other issues: fairness, privacy, . . .

slide-37
SLIDE 37

Improving the current situation

Let’s say. . .

France (FR) wants to query a DB with criminal records held by Germany (DE). Both countries recognize the authority of a Judge (JU).

slide-38
SLIDE 38

Improving the current situation

Let’s say. . .

France (FR) wants to query a DB with criminal records held by Germany (DE). Both countries recognize the authority of a Judge (JU). Our goals: DE does not learn FR’s query Even if authorized by JU, FR does not learn more than the records that match JU does not learn the result of the query

slide-39
SLIDE 39

Improving the current situation

Let’s say. . .

France (FR) wants to query a DB with criminal records held by Germany (DE). Both countries recognize the authority of a Judge (JU). Our goals: DE does not learn FR’s query Even if authorized by JU, FR does not learn more than the records that match JU does not learn the result of the query Supported queries: Simple match (c) Conjunction (c1 ∩ c2) Disjunction (c1 ∪ c2)

slide-40
SLIDE 40

Key concepts

From database to inverted database: Featurek : {i1, i2, . . . , in}

slide-41
SLIDE 41

Key concepts

From database to inverted database: Featurek : {i1, i2, . . . , in} Encode indices in a polynomial: p (x) =

  • i∈I

(x − i)

slide-42
SLIDE 42

Key concepts

From database to inverted database: Featurek : {i1, i2, . . . , in} Encode indices in a polynomial: p (x) =

  • i∈I

(x − i) Disjunction query: p1 (x) · p2 (x)

slide-43
SLIDE 43

Key concepts

From database to inverted database: Featurek : {i1, i2, . . . , in} Encode indices in a polynomial: p (x) =

  • i∈I

(x − i) Disjunction query: p1 (x) · p2 (x) Conjunction query: p1 (x) · r1 (x) + p2 (x) · r2 (x) , r{1,2} (x) ← $

slide-44
SLIDE 44

Key concepts

From database to inverted database: Featurek : {i1, i2, . . . , in} Encode indices in a polynomial: p (x) =

  • i∈I

(x − i) Disjunction query: p1 (x) · p2 (x) Conjunction query: p1 (x) · r1 (x) + p2 (x) · r2 (x) , r{1,2} (x) ← $ Possible parasitic roots → repeat and intersect

slide-45
SLIDE 45

Our protocol

slide-46
SLIDE 46

Our protocol

(0) one-time setup

slide-47
SLIDE 47

Our protocol

(0) one-time setup (1) compute search token

slide-48
SLIDE 48

Our protocol

(0) one-time setup (1) compute search token ( 2 ) h i t / n

  • h

i t

slide-49
SLIDE 49

Our protocol

(0) one-time setup (1) compute search token ( 2 ) h i t / n

  • h

i t (3) obtain judge’s signature

slide-50
SLIDE 50

Our protocol

(0) one-time setup (1) compute search token ( 2 ) h i t / n

  • h

i t (3) obtain judge’s signature (4) obtain information

slide-51
SLIDE 51

Demo

Library developed in C++

slide-52
SLIDE 52

Demo

Library developed in C++ 3 entities (FR, DE, JU) in Python + flask

slide-53
SLIDE 53

Demo

Library developed in C++ 3 entities (FR, DE, JU) in Python + flask Simulates 3 web interfaces: easy to “push” to the Cloud

slide-54
SLIDE 54

Demo

Library developed in C++ 3 entities (FR, DE, JU) in Python + flask Simulates 3 web interfaces: easy to “push” to the Cloud Respects and improves the EU’s constraints

slide-55
SLIDE 55

Demo

Library developed in C++ 3 entities (FR, DE, JU) in Python + flask Simulates 3 web interfaces: easy to “push” to the Cloud Respects and improves the EU’s constraints

slide-56
SLIDE 56

Demo

Library developed in C++ 3 entities (FR, DE, JU) in Python + flask Simulates 3 web interfaces: easy to “push” to the Cloud Respects and improves the EU’s constraints

slide-57
SLIDE 57

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input.

slide-58
SLIDE 58

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

slide-59
SLIDE 59

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

slide-60
SLIDE 60

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

x

slide-61
SLIDE 61

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

x f (x)

slide-62
SLIDE 62

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

x x

slide-63
SLIDE 63

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

x x f (x)

slide-64
SLIDE 64

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

slide-65
SLIDE 65

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

scores

with argmax (scores) = 7.

slide-66
SLIDE 66

Ongoing project: Homomorphic NNs

(with F. Bourse, M. Minihold, and P. Paillier)

Goal of the project

Applying Neural Networks homomorphically over encrypted data. More specifically, classifying an encrypted input. High level description:

scores

with argmax (scores) = 7.

More details in Matthias’s talk!

slide-67
SLIDE 67

Thank you! Questions?