Lattice-based cryptography II Constructions and implementation - PowerPoint PPT Presentation

Lattice-based cryptography II Constructions and implementation issues Leon Groot Bruinderink July 1st, 2019 July 1st, 2019 1 / 27

Lattice-based cryptography II In this talk: Introduction to (ring-)LWE Lattice-based key-exchange and encryption schemes Reaction attacks and countermeasures Lattice-based signature schemes Side-channel attacks and countermeasures July 1st, 2019 2 / 27

Lattice-based cryptography Some features of lattice-based cryptography: Key-exchange, encryption, digital signatures But also more exotic stuff, e.g. homomorphic encryption July 1st, 2019 3 / 27

Lattice-based cryptography Some features of lattice-based cryptography: Key-exchange, encryption, digital signatures But also more exotic stuff, e.g. homomorphic encryption Pro’s: The algorithms are quite fast The keys, cipher-texts, signatures are *quite small* July 1st, 2019 3 / 27

Lattice-based cryptography Some features of lattice-based cryptography: Key-exchange, encryption, digital signatures But also more exotic stuff, e.g. homomorphic encryption Pro’s: The algorithms are quite fast The keys, cipher-texts, signatures are *quite small* Con’s: Many design parameters to choose (and attacks to avoid) Asymptotic hardness results vs concrete security/cryptanalysis July 1st, 2019 3 / 27

Lattice-based cryptography Some features of lattice-based cryptography: Key-exchange, encryption, digital signatures But also more exotic stuff, e.g. homomorphic encryption Pro’s: The algorithms are quite fast The keys, cipher-texts, signatures are *quite small* Con’s: Many design parameters to choose (and attacks to avoid) Asymptotic hardness results vs concrete security/cryptanalysis Largest category of NIST post-quantum submissions Some real-life experiments (e.g. Google) July 1st, 2019 3 / 27

Learning With Errors July 1st, 2019 4 / 27

Learning with Errors (LWE) - Noisy inner product Let q be a prime, n > 0 (usually a power of 2), χ some narrow error distribution in Z q , � x , y � = � n i =1 x i y i mod q usual inner-product Let s ← χ n be a secret Given pairs of ( a , b = � a , s � + e ) with a ∈ Z n q sampled uniform at random e sampled from χ (plain-) LWE: find s July 1st, 2019 5 / 27

Learning with Errors (LWE) - Noisy inner product Let q be a prime, n > 0 (usually a power of 2), χ some narrow error distribution in Z q , � x , y � = � n i =1 x i y i mod q usual inner-product Let s ← χ n be a secret Given pairs of ( a , b = � a , s � + e ) with a ∈ Z n q sampled uniform at random e sampled from χ (plain-) LWE: find s a 0 a 1 a 2 “Random” = + “Small” a n − 1 s e A b n samples July 1st, 2019 5 / 27

Learning with Errors (LWE) - Noisy inner product Let q be a prime, n > 0 (usually a power of 2), χ some narrow error distribution in Z q , � x , y � = � n i =1 x i y i mod q usual inner-product Let s ← χ n be a secret Given pairs of ( a , b = � a , s � + e ) with a ∈ Z n q sampled uniform at random e sampled from χ (plain-) LWE: find s Common choice for χ : the discrete Gaussian distribution D σ Regev showed that a hard lattice problem can be reduced to LWE D σ ( x ) 0.04 : σ = 10 : σ = 20 : σ = 30 0.03 0.02 0.01 x -40 -20 20 40 July 1st, 2019 5 / 27

Learning with Errors (LWE) - Noisy inner product Let q be a prime, n > 0 (usually a power of 2), χ some narrow error distribution in Z q , � x , y � = � n i =1 x i y i mod q usual inner-product Let s ← χ n be a secret Given pairs of ( a , b = � a , s � + e ) with a ∈ Z n q sampled uniform at random e sampled from χ (plain-) LWE: find s Common choice for χ : the discrete Gaussian distribution D σ Regev showed that a hard lattice problem can be reduced to LWE First proposals for cryptosystems were quite big... July 1st, 2019 5 / 27

Ring-LWE: noisy polynomials Let q be a prime, n > 0 (usually a power of 2), Now define R = Z q [ x ] / ( x n ± 1). Can add/subtract and multiply f = f 0 + f 1 x + ... + f n − 1 x n − 1 ∈ R f i ∈ [0 , q ) f + g ∈ R fg ∈ R July 1st, 2019 6 / 27

Ring-LWE: noisy polynomials Let q be a prime, n > 0 (usually a power of 2), Now define R = Z q [ x ] / ( x n ± 1). Can add/subtract and multiply χ some narrow error distribution in R Let s ← χ be a secret Given pairs of ( a , b = as + e ) with a ∈ R sampled uniform at random e sampled from χ ring-LWE: find s July 1st, 2019 6 / 27

Ring-LWE: noisy polynomials Let q be a prime, n > 0 (usually a power of 2), Now define R = Z q [ x ] / ( x n ± 1). Can add/subtract and multiply χ some narrow error distribution in R Let s ← χ be a secret Given pairs of ( a , b = as + e ) with a ∈ R sampled uniform at random e sampled from χ ring-LWE: find s a a x a x 2 “Random” = + “Small” a x n − 1 s e A b 1 sample July 1st, 2019 6 / 27

Ring-LWE: noisy polynomials Let q be a prime, n > 0 (usually a power of 2), Now define R = Z q [ x ] / ( x n ± 1). Can add/subtract and multiply χ some narrow error distribution in R Let s ← χ be a secret Given pairs of ( a , b = as + e ) with a ∈ R sampled uniform at random e sampled from χ ring-LWE: find s Common choice for χ : the discrete Gaussian distribution D n σ Related to problems in ideal (or “cyclic”) lattices D σ ( x ) 0.04 : σ = 10 : σ = 20 : σ = 30 0.03 0.02 0.01 x -40 -20 20 40 July 1st, 2019 6 / 27

Ring-LWE: noisy polynomials Let q be a prime, n > 0 (usually a power of 2), Now define R = Z q [ x ] / ( x n ± 1). Can add/subtract and multiply χ some narrow error distribution in R Let s ← χ be a secret Given pairs of ( a , b = as + e ) with a ∈ R sampled uniform at random e sampled from χ ring-LWE: find s Common choice for χ : the discrete Gaussian distribution D n σ Related to problems in ideal (or “cyclic”) lattices Many design choices (e.g. NTRU: q = 2 ℓ ; n prime; χ sparse) July 1st, 2019 6 / 27

Lattice-based Key-Exchange July 1st, 2019 7 / 27

Mimic Diffie-Hellman key-exchange Recall Diffie-Hellman key-exchange Alice Public: G = � g � , | G | = n Bob a ← $ [1 , n ) b ← $ [1 , n ) pub A pub A = g a pub B = g b pub B K A = ( pub B ) a = g ab K B = ( pub A ) b = g ab July 1st, 2019 8 / 27

Mimic Diffie-Hellman key-exchange Recall Diffie-Hellman key-exchange Alice Public: G = � g � , | G | = n Bob a ← $ [1 , n ) b ← $ [1 , n ) pub A pub A = g a pub B = g b pub B K A = ( pub B ) a = g ab K B = ( pub A ) b = g ab Both parties end up with shared key K = g ab July 1st, 2019 8 / 27

LWE key-exchange: noisy Diffie-Hellman ring-LWE key-exchange Public: g ∈ R , distribution χ = D n Alice Bob σ b , e ′ ← $ χ a , e ← $ χ pub A pub A = ga + e pub B = gb + e ′ pub B S A = ( pub B ) a S B = ( pub A ) b = gab + e ′ a = gab + eb July 1st, 2019 9 / 27

LWE key-exchange: noisy Diffie-Hellman ring-LWE key-exchange Public: g ∈ R , distribution χ = D n Alice Bob σ b , e ′ ← $ χ a , e ← $ χ pub A pub A = ga + e pub B = gb + e ′ pub B S A = ( pub B ) a S B = ( pub A ) b = gab + e ′ a = gab + eb a , b , e , e ′ ← D n σ , so small! Keys are approximately equal: gab + e ′ a ≈ gab + eb July 1st, 2019 9 / 27

LWE key-exchange: noisy Diffie-Hellman ring-LWE key-exchange Public: g ∈ R , distribution χ = D n Alice Bob σ b , e ′ ← $ χ a , e ← $ χ pub A pub A = ga + e pub B = gb + e ′ pub B S A = ( pub B ) a S B = ( pub A ) b = gab + e ′ a = gab + eb a , b , e , e ′ ← D n σ , so small! Keys are approximately equal: gab + e ′ a ≈ gab + eb Need a way to get shared secret bits July 1st, 2019 9 / 27

LWE key-exchange: mapping coefficients How to map coefficients to bits Alice and Bob obtained close vectors S A , S B ∈ Z n q July 1st, 2019 10 / 27

LWE key-exchange: mapping coefficients How to map coefficients to bits Alice and Bob obtained close vectors S A , S B ∈ Z n q “the edge” 0 ≡ q 1 0 3 q/ 4 q/ 4 q/ 2 July 1st, 2019 10 / 27

LWE key-exchange: mapping coefficients How to map coefficients to bits Alice and Bob obtained close vectors S A , S B ∈ Z n q “the edge” 0 ≡ q 1 0 3 q/ 4 q/ 4 Alice : 0 Bob : 0 q/ 2 July 1st, 2019 10 / 27

LWE key-exchange: mapping coefficients How to map coefficients to bits Alice and Bob obtained close vectors S A , S B ∈ Z n q “the edge” 0 ≡ q 1 0 3 q/ 4 q/ 4 Alice : 1 Bob : 1 q/ 2 July 1st, 2019 10 / 27

LWE key-exchange: mapping coefficients How to map coefficients to bits Alice and Bob obtained close vectors S A , S B ∈ Z n q “the edge” 0 ≡ q 1 0 3 q/ 4 q/ 4 Alice : 0 Bob : 1 q/ 2 July 1st, 2019 10 / 27

LWE key-exchange: mapping coefficients How to map coefficients to bits Alice and Bob obtained close vectors S A , S B ∈ Z n q “the edge” 0 ≡ q 1 0 3 q/ 4 q/ 4 Error! Alice : 0 Bob : 1 q/ 2 July 1st, 2019 10 / 27

LWE key-exchange: reconciliation Mapping coefficients by fixed map induces many errors Better idea: use two mappings and let Bob decide on which map Choose map where S B is far from edge Map 0 0 ≡ q Map 1 0 ≡ q 0 1 0 3 q/ 4 q/ 4 3 q/ 4 q/ 4 1 q/ 2 q/ 2 July 1st, 2019 11 / 27