Pseudorandom Functions and Lattices Abhishek Banerjee 1 Chris Peikert - PowerPoint PPT Presentation

Pseudorandom Functions and Lattices Abhishek Banerjee 1 Chris Peikert 1 Alon Rosen 2 1 Georgia Tech 2 IDC Herzliya Faces of Modern Cryptography 9 September 2011 1 / 14

2 / 14

Pseudorandom Functions [GGM’84] ◮ A family F = { F s : { 0 , 1 } k → D } s.t. given adaptive query access, c F s ← F random func U ≈ x i x i F s ( x i ) U ( x i ) ?? (The “seed” or “secret key” for F s is s .) (Images courtesy xkcd.org) 3 / 14

Pseudorandom Functions [GGM’84] ◮ A family F = { F s : { 0 , 1 } k → D } s.t. given adaptive query access, c F s ← F random func U ≈ x i x i F s ( x i ) U ( x i ) ?? (The “seed” or “secret key” for F s is s .) ◮ Oodles of applications in symmetric cryptography: (efficient) encryption, identification, authentication, . . . (Images courtesy xkcd.org) 3 / 14

How to Construct PRFs 1 Heuristically: AES, Blowfish. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) 4 / 14

How to Construct PRFs 1 Heuristically: AES, Blowfish. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 4 / 14

How to Construct PRFs 1 Heuristically: AES, Blowfish. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) 4 / 14

How to Construct PRFs 1 Heuristically: AES, Blowfish. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) ✗ Inherently sequential: ≥ k iterations (circuit depth) 4 / 14

How to Construct PRFs 1 Heuristically: AES, Blowfish. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) ✗ Inherently sequential: ≥ k iterations (circuit depth) 3 Naor-Reingold / Naor-Reingold-Rosen [NR’95,NR’97,NRR’00] ✔ Based on “synthesizers” or number theory (DDH, factoring) ✔ Low-depth: NC 2 , NC 1 or even TC 0 [ O ( 1 ) depth w/ threshold gates] 4 / 14

How to Construct PRFs 1 Heuristically: AES, Blowfish. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) ✗ Inherently sequential: ≥ k iterations (circuit depth) 3 Naor-Reingold / Naor-Reingold-Rosen [NR’95,NR’97,NRR’00] ✔ Based on “synthesizers” or number theory (DDH, factoring) ✔ Low-depth: NC 2 , NC 1 or even TC 0 [ O ( 1 ) depth w/ threshold gates] ✗ Huge circuits that need mucho preprocessing ✗ No “post-quantum” construction under standard assumptions 4 / 14

Why Not Try Lattices? ?? = ⇒ F s ← F 5 / 14

Why Not Try Lattices? ?? = ⇒ F s ← F Advantages of Lattice Crypto Schemes ◮ Simple & efficient: linear, highly parallel operations ◮ Resist quantum attacks (so far) ◮ Secure under worst-case hardness assumptions [Ajtai’96,. . . ] 5 / 14

Why Not Try Lattices? ?? = ⇒ F s ← F Advantages of Lattice Crypto Schemes ◮ Simple & efficient: linear, highly parallel operations ◮ Resist quantum attacks (so far) ◮ Secure under worst-case hardness assumptions [Ajtai’96,. . . ] Disadvantages ✗ Only known PRF is generic GGM (not parallel or efficient) 5 / 14

Why Not Try Lattices? ?? = ⇒ F s ← F Advantages of Lattice Crypto Schemes ◮ Simple & efficient: linear, highly parallel operations ◮ Resist quantum attacks (so far) ◮ Secure under worst-case hardness assumptions [Ajtai’96,. . . ] Disadvantages ✗ Only known PRF is generic GGM (not parallel or efficient) ✗✗ We don’t even have practical PRGs from lattices: biased errors 5 / 14

Our Results 1 Low-depth, relatively small-circuit PRFs from lattices / (ring-)LWE 6 / 14

Our Results 1 Low-depth, relatively small-circuit PRFs from lattices / (ring-)LWE ⋆ Synthesizer-based PRF in TC 1 ⊆ NC 2 a la [NR’95] ⋆ Direct construction in TC 0 ⊆ NC 1 analogous to [NR’97,NRR’00] 6 / 14

Our Results 1 Low-depth, relatively small-circuit PRFs from lattices / (ring-)LWE ⋆ Synthesizer-based PRF in TC 1 ⊆ NC 2 a la [NR’95] ⋆ Direct construction in TC 0 ⊆ NC 1 analogous to [NR’97,NRR’00] 2 Main technique: “derandomization” of LWE: deterministic errors 6 / 14

Our Results 1 Low-depth, relatively small-circuit PRFs from lattices / (ring-)LWE ⋆ Synthesizer-based PRF in TC 1 ⊆ NC 2 a la [NR’95] ⋆ Direct construction in TC 0 ⊆ NC 1 analogous to [NR’97,NRR’00] 2 Main technique: “derandomization” of LWE: deterministic errors Also gives more practical PRGs, GGM-type PRFs, encryption, . . . 6 / 14

Synthesizers and PRFs [NaorReingold’95] Synthesizer ◮ A deterministic function S : D × D → D s.t. for any m = poly: for a 1 , . . . , a m , b 1 , . . . , b m ← D , c ≈ Unif ( D m × m ) . { S ( a i , b j ) } 7 / 14

Synthesizers and PRFs [NaorReingold’95] Synthesizer ◮ A deterministic function S : D × D → D s.t. for any m = poly: for a 1 , . . . , a m , b 1 , . . . , b m ← D , c ≈ Unif ( D m × m ) . { S ( a i , b j ) } · · · b 1 b 2 a 1 S ( a 1 , b 1 ) S ( a 1 , b 2 ) · · · U 1 , 1 U 1 , 2 · · · vs. S ( a 2 , b 1 ) S ( a 2 , b 2 ) · · · · · · a 2 U 2 , 1 U 2 , 2 . ... ... . . 7 / 14

Synthesizers and PRFs [NaorReingold’95] Synthesizer ◮ A deterministic function S : D × D → D s.t. for any m = poly: for a 1 , . . . , a m , b 1 , . . . , b m ← D , c ≈ Unif ( D m × m ) . { S ( a i , b j ) } · · · b 1 b 2 a 1 S ( a 1 , b 1 ) S ( a 1 , b 2 ) · · · U 1 , 1 U 1 , 2 · · · vs. S ( a 2 , b 1 ) S ( a 2 , b 2 ) · · · · · · a 2 U 2 , 1 U 2 , 2 . ... ... . . ◮ Alternative view: an (almost) length-squaring PRG with locality: maps D 2 m → D m 2 , and each output depends on only 2 inputs. 7 / 14

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . 8 / 14

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . ◮ Base case: “one-bit” PRF F s 0 , s 1 ( x ) := s x ∈ D . ✔ 8 / 14

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . ◮ Base case: “one-bit” PRF F s 0 , s 1 ( x ) := s x ∈ D . ✔ ◮ Input doubling: given k -bit PRF family F = { F : { 0 , 1 } k → D } , define a { 0 , 1 } 2 k → D function: choose F ℓ , F r ← F and let � � F ( F ℓ , F r ) ( x ℓ , x r ) = S F ℓ ( x ℓ ) , F r ( x r ) . 8 / 14

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . ◮ Base case: “one-bit” PRF F s 0 , s 1 ( x ) := s x ∈ D . ✔ ◮ Input doubling: given k -bit PRF family F = { F : { 0 , 1 } k → D } , define a { 0 , 1 } 2 k → D function: choose F ℓ , F r ← F and let � � F ( F ℓ , F r ) ( x ℓ , x r ) = S F ℓ ( x ℓ ) , F r ( x r ) . s 1 , 0 , s 1 , 1 s 1 , x 1 S s 2 , 0 , s 2 , 1 s 2 , x 2 F { s i , b } ( x 1 · · · x 4 ) S s 3 , 0 , s 3 , 1 s 3 , x 3 S s 4 , 0 , s 4 , 1 s 4 , x 4 8 / 14

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . ◮ Base case: “one-bit” PRF F s 0 , s 1 ( x ) := s x ∈ D . ✔ ◮ Input doubling: given k -bit PRF family F = { F : { 0 , 1 } k → D } , define a { 0 , 1 } 2 k → D function: choose F ℓ , F r ← F and let � � F ( F ℓ , F r ) ( x ℓ , x r ) = S F ℓ ( x ℓ ) , F r ( x r ) . s 1 , 0 , s 1 , 1 s 1 , x 1 S s 2 , 0 , s 2 , 1 s 2 , x 2 F { s i , b } ( x 1 · · · x 4 ) S s 3 , 0 , s 3 , 1 s 3 , x 3 S s 4 , 0 , s 4 , 1 s 4 , x 4 ◮ Security: the queries F ℓ ( x ℓ ) and F r ( x r ) define (pseudo)random inputs a 1 , a 2 , . . . ∈ D and b 1 , b 2 , . . . ∈ D for synthesizer S . 8 / 14

(Ring) Learning With Errors (RLWE) [Regev’05,LPR’10] ◮ For (e.g.) n a power of 2 , define “cyclotomic” polynomial rings R := Z [ x ] / ( x n + 1 ) R q := R / qR = Z q [ x ] / ( x n + 1 ) . and 9 / 14

(Ring) Learning With Errors (RLWE) [Regev’05,LPR’10] ◮ For (e.g.) n a power of 2 , define “cyclotomic” polynomial rings R := Z [ x ] / ( x n + 1 ) R q := R / qR = Z q [ x ] / ( x n + 1 ) . and ◮ Hard to distinguish m pairs ( a i , a i · s + e i ) ∈ R q × R q from uniform, where a i , s ← R q uniform and e i “short.” 9 / 14