Lattice Cryptography for the Internet Chris Peikert Georgia - - PowerPoint PPT Presentation
Lattice Cryptography for the Internet Chris Peikert Georgia Institute of Technology Post-Quantum Cryptography 2 October 2014 1 / 12 Lattice-Based Cryptography p d o m x g = y N = = p m e mod N q e ( g a , g b ) (Images
1 / 12
(Images courtesy xkcd.org) 2 / 12
(Images courtesy xkcd.org) 2 / 12
(Images courtesy xkcd.org) 2 / 12
3 / 12
3 / 12
3 / 12
3 / 12
3 / 12
3 / 12
3 / 12
3 / 12
3 / 12
4 / 12
⋆ AKE from any passively secure KEM
4 / 12
⋆ AKE from any passively secure KEM
⋆ New, efficient KEMs from ring-LWE
4 / 12
⋆ AKE from any passively secure KEM
⋆ New, efficient KEMs from ring-LWE
4 / 12
⋆ AKE from any passively secure KEM
⋆ New, efficient KEMs from ring-LWE
⋆ Bit-for-bit encryption, plus fixed-size ‘prelude’ 4 / 12
⋆ AKE from any passively secure KEM
⋆ New, efficient KEMs from ring-LWE
⋆ Bit-for-bit encryption, plus fixed-size ‘prelude’ ⋆ Improves prior ciphertext sizes by up to 2x, at essentially no cost
4 / 12
⋆ AKE from any passively secure KEM
⋆ New, efficient KEMs from ring-LWE
⋆ Bit-for-bit encryption, plus fixed-size ‘prelude’ ⋆ Improves prior ciphertext sizes by up to 2x, at essentially no cost
⋆ Applies to all (ring-)LWE-based encryption schemes 4 / 12
⋆ AKE from any passively secure KEM
⋆ New, efficient KEMs from ring-LWE
⋆ Bit-for-bit encryption, plus fixed-size ‘prelude’ ⋆ Improves prior ciphertext sizes by up to 2x, at essentially no cost
⋆ Applies to all (ring-)LWE-based encryption schemes
4 / 12
⋆ AKE from any passively secure KEM
⋆ New, efficient KEMs from ring-LWE
⋆ Bit-for-bit encryption, plus fixed-size ‘prelude’ ⋆ Improves prior ciphertext sizes by up to 2x, at essentially no cost
⋆ Applies to all (ring-)LWE-based encryption schemes
⋆ Follow-up [BCNS’14]: TLS/SSL suite (in C) using these components,
4 / 12
5 / 12
5 / 12
5 / 12
⋆ Designed explicitly with Internet in mind ⋆ ‘Responder’ identity is discovered during protocol; can conceal identities 6 / 12
⋆ Designed explicitly with Internet in mind ⋆ ‘Responder’ identity is discovered during protocol; can conceal identities
6 / 12
⋆ Designed explicitly with Internet in mind ⋆ ‘Responder’ identity is discovered during protocol; can conceal identities
6 / 12
⋆ Designed explicitly with Internet in mind ⋆ ‘Responder’ identity is discovered during protocol; can conceal identities
6 / 12
⋆ Designed explicitly with Internet in mind ⋆ ‘Responder’ identity is discovered during protocol; can conceal identities
⋆ SIGMA has ‘initiator’ who speaks first: can send KEM public key ⋆ Security proof uses only ‘KEM-like’ properties of DH 6 / 12
⋆ Designed explicitly with Internet in mind ⋆ ‘Responder’ identity is discovered during protocol; can conceal identities
⋆ SIGMA has ‘initiator’ who speaks first: can send KEM public key ⋆ Security proof uses only ‘KEM-like’ properties of DH
6 / 12
7 / 12
7 / 12
7 / 12
7 / 12
7 / 12
7 / 12
7 / 12
7 / 12
8 / 12
8 / 12
8 / 12
8 / 12
8 / 12
8 / 12
8 / 12
9 / 12
⋆ Sender encodes each msg bit µ ∈ Z2 = {0, 1} as v = µ · ⌊ q
2⌋ ∈ Zq.
9 / 12
⋆ Sender encodes each msg bit µ ∈ Z2 = {0, 1} as v = µ · ⌊ q
2⌋ ∈ Zq.
⋆ Receiver recovers w ≈ µ · ⌊ q
2⌋, where ≈ comes from LWE error.
9 / 12
⋆ Sender encodes each msg bit µ ∈ Z2 = {0, 1} as v = µ · ⌊ q
2⌋ ∈ Zq.
⋆ Receiver recovers w ≈ µ · ⌊ q
2⌋, where ≈ comes from LWE error.
⋆ Receiver computes µ by ‘rounding:’ µ = ⌊v⌉2 := ⌊ 2
q · v⌉ ∈ Z2.
9 / 12
⋆ Sender encodes each msg bit µ ∈ Z2 = {0, 1} as v = µ · ⌊ q
2⌋ ∈ Zq.
⋆ Receiver recovers w ≈ µ · ⌊ q
2⌋, where ≈ comes from LWE error.
⋆ Receiver computes µ by ‘rounding:’ µ = ⌊v⌉2 := ⌊ 2
q · v⌉ ∈ Z2.
9 / 12
⋆ Sender encodes each msg bit µ ∈ Z2 = {0, 1} as v = µ · ⌊ q
2⌋ ∈ Zq.
⋆ Receiver recovers w ≈ µ · ⌊ q
2⌋, where ≈ comes from LWE error.
⋆ Receiver computes µ by ‘rounding:’ µ = ⌊v⌉2 := ⌊ 2
q · v⌉ ∈ Z2.
9 / 12
10 / 12
10 / 12
10 / 12
10 / 12
10 / 12
10 / 12
10 / 12
10 / 12
⋆ Elts of R (Rq) are deg < n polynomials with integer (mod q) coeffs. ⋆ ‘Errors’ in R are polynomials with small (Gaussian) integer coefficients. ⋆ Operations in Rq are very efficient using FFT-like algorithms. 11 / 12
⋆ Elts of R (Rq) are deg < n polynomials with integer (mod q) coeffs. ⋆ ‘Errors’ in R are polynomials with small (Gaussian) integer coefficients. ⋆ Operations in Rq are very efficient using FFT-like algorithms.
11 / 12
⋆ Elts of R (Rq) are deg < n polynomials with integer (mod q) coeffs. ⋆ ‘Errors’ in R are polynomials with small (Gaussian) integer coefficients. ⋆ Operations in Rq are very efficient using FFT-like algorithms.
11 / 12
⋆ Elts of R (Rq) are deg < n polynomials with integer (mod q) coeffs. ⋆ ‘Errors’ in R are polynomials with small (Gaussian) integer coefficients. ⋆ Operations in Rq are very efficient using FFT-like algorithms.
11 / 12
⋆ Elts of R (Rq) are deg < n polynomials with integer (mod q) coeffs. ⋆ ‘Errors’ in R are polynomials with small (Gaussian) integer coefficients. ⋆ Operations in Rq are very efficient using FFT-like algorithms.
11 / 12
⋆ Elts of R (Rq) are deg < n polynomials with integer (mod q) coeffs. ⋆ ‘Errors’ in R are polynomials with small (Gaussian) integer coefficients. ⋆ Operations in Rq are very efficient using FFT-like algorithms.
11 / 12
12 / 12
12 / 12
12 / 12
12 / 12