Session #6: Another Application of LWE: Pseudorandom Functions - PowerPoint PPT Presentation

Session #6: Another Application of LWE: Pseudorandom Functions Chris Peikert Georgia Institute of Technology Winter School on Lattice-Based Cryptography and Applications Bar-Ilan University, Israel 19 Feb 2012 – 22 Feb 2012 Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 1/12

Pseudorandom Functions [GGM’84] ◮ A family F = { F s : { 0 , 1 } k → D } s.t. given adaptive query access, c F s ← F random fct U ≈ x i x i F s ( x i ) U ( x i ) ?? (The “seed” or “secret key” for F s is s .) (Images courtesy xkcd.org) Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 2/12

Pseudorandom Functions [GGM’84] ◮ A family F = { F s : { 0 , 1 } k → D } s.t. given adaptive query access, c F s ← F random fct U ≈ x i x i F s ( x i ) U ( x i ) ?? (The “seed” or “secret key” for F s is s .) ◮ Countless applications in symmetric cryptography: (efficient) encryption, authentication, friend-or-foe . . . (Images courtesy xkcd.org) Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 2/12

How to Construct PRFs 1 Heuristically: AES etc. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/12

How to Construct PRFs 1 Heuristically: AES etc. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/12

How to Construct PRFs 1 Heuristically: AES etc. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/12

How to Construct PRFs 1 Heuristically: AES etc. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) ✗ Inherently sequential: ≥ k iterations (circuit depth) Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/12

How to Construct PRFs 1 Heuristically: AES etc. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) ✗ Inherently sequential: ≥ k iterations (circuit depth) 3 Naor-Reingold(-Rosen) [NR’95,NR’97,NRR’00] ✔ Based on “synthesizers” or number theory (DDH, factoring) ✔ Low-depth: NC 2 , NC 1 or even TC 0 [ O (1) depth w/ threshold gates] Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/12

How to Construct PRFs 1 Heuristically: AES etc. ✔ Fast! ✔ Withstand known cryptanalytic techniques (linear, differential, . . . ) ✗ PRF security is subtle: want provable (reductionist) guarantees 2 Goldreich-Goldwasser-Micali [GGM’84] ✔ Based on any (doubling) PRG. F s ( x 1 · · · x k ) = G x k ( · · · G x 1 ( s ) · · · ) ✗ Inherently sequential: ≥ k iterations (circuit depth) 3 Naor-Reingold(-Rosen) [NR’95,NR’97,NRR’00] ✔ Based on “synthesizers” or number theory (DDH, factoring) ✔ Low-depth: NC 2 , NC 1 or even TC 0 [ O (1) depth w/ threshold gates] ✗ Huge circuits that need much preprocessing ✗ No “post-quantum” construction under standard assumptions Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 3/12

PRFs from Lattices? The Hope ◮ Lattices ⇒ simple, highly parallel, practically efficient . . . PRFs? Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/12

PRFs from Lattices? The Hope ◮ Lattices ⇒ simple, highly parallel, practically efficient . . . PRFs? The Reality ✗ Only known PRF is generic GGM (not parallel or very efficient) Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/12

PRFs from Lattices? The Hope ◮ Lattices ⇒ simple, highly parallel, practically efficient . . . PRFs? The Reality ✗ Only known PRF is generic GGM (not parallel or very efficient) ✗✗ We don’t even have practical PRGs from lattices: biased errors Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/12

PRFs from Lattices? The Hope ◮ Lattices ⇒ simple, highly parallel, practically efficient . . . PRFs? The Reality ✗ Only known PRF is generic GGM (not parallel or very efficient) ✗✗ We don’t even have practical PRGs from lattices: biased errors New Results [BPR’12] 1 Low-depth, relatively small-circuit PRFs from lattices / (ring-)LWE Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/12

PRFs from Lattices? The Hope ◮ Lattices ⇒ simple, highly parallel, practically efficient . . . PRFs? The Reality ✗ Only known PRF is generic GGM (not parallel or very efficient) ✗✗ We don’t even have practical PRGs from lattices: biased errors New Results [BPR’12] 1 Low-depth, relatively small-circuit PRFs from lattices / (ring-)LWE ⋆ Synthesizer-based PRF in TC 1 ⊆ NC 2 a la [NR’95] ⋆ Direct construction in TC 0 ⊆ NC 1 analogous to [NR’97,NRR’00] Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/12

PRFs from Lattices? The Hope ◮ Lattices ⇒ simple, highly parallel, practically efficient . . . PRFs? The Reality ✗ Only known PRF is generic GGM (not parallel or very efficient) ✗✗ We don’t even have practical PRGs from lattices: biased errors New Results [BPR’12] 1 Low-depth, relatively small-circuit PRFs from lattices / (ring-)LWE ⋆ Synthesizer-based PRF in TC 1 ⊆ NC 2 a la [NR’95] ⋆ Direct construction in TC 0 ⊆ NC 1 analogous to [NR’97,NRR’00] 2 Main technique: “derandomization” of LWE: deterministic errors Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 4/12

Synthesizers and PRFs [NaorReingold’95] Synthesizer ◮ A deterministic function S : D × D → D s.t. for any m = poly: for uniform a 1 , . . . , a m , b 1 , . . . , b m ← D , c ≈ Unif ( D m × m ) . { S ( a i , b j ) } Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 5/12

Synthesizers and PRFs [NaorReingold’95] Synthesizer ◮ A deterministic function S : D × D → D s.t. for any m = poly: for uniform a 1 , . . . , a m , b 1 , . . . , b m ← D , c ≈ Unif ( D m × m ) . { S ( a i , b j ) } b 1 b 2 · · · a 1 S ( a 1 , b 1 ) S ( a 1 , b 2 ) · · · U 1 , 1 U 1 , 2 · · · vs. a 2 S ( a 2 , b 1 ) S ( a 2 , b 2 ) · · · U 2 , 1 U 2 , 2 · · · . ... ... . . Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 5/12

Synthesizers and PRFs [NaorReingold’95] Synthesizer ◮ A deterministic function S : D × D → D s.t. for any m = poly: for uniform a 1 , . . . , a m , b 1 , . . . , b m ← D , c ≈ Unif ( D m × m ) . { S ( a i , b j ) } b 1 b 2 · · · a 1 S ( a 1 , b 1 ) S ( a 1 , b 2 ) · · · U 1 , 1 U 1 , 2 · · · vs. a 2 S ( a 2 , b 1 ) S ( a 2 , b 2 ) · · · U 2 , 1 U 2 , 2 · · · . ... ... . . ◮ Alternative view: an (almost) length-squaring PRG with locality: maps D 2 m → D m 2 , and each output depends on only 2 inputs. Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 5/12

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/12

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . ◮ Base case: “one-bit” PRF F s 0 ,s 1 ( x ) := s x ∈ D . ✔ Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/12

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . ◮ Base case: “one-bit” PRF F s 0 ,s 1 ( x ) := s x ∈ D . ✔ ◮ Input doubling: given k -bit PRF family F = { F : { 0 , 1 } k → D } , define a { 0 , 1 } 2 k → D function with seed F ℓ , F r ← F : � � F ( F ℓ ,F r ) ( x ℓ , x r ) = S F ℓ ( x ℓ ) , F r ( x r ) . Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/12

Synthesizers and PRFs [NaorReingold’95] PRF from Synthesizer, Recursively c ◮ Synthesizer S : D × D → D , where { S ( a i , b j ) } ≈ Unif ( D m × m ) . ◮ Base case: “one-bit” PRF F s 0 ,s 1 ( x ) := s x ∈ D . ✔ ◮ Input doubling: given k -bit PRF family F = { F : { 0 , 1 } k → D } , define a { 0 , 1 } 2 k → D function with seed F ℓ , F r ← F : � � F ( F ℓ ,F r ) ( x ℓ , x r ) = S F ℓ ( x ℓ ) , F r ( x r ) . s 1 , 0 , s 1 , 1 s 1 ,x 1 S s 2 , 0 , s 2 , 1 s 2 ,x 2 F { s i,b } ( x 1 · · · x 4 ) S s 3 , 0 , s 3 , 1 s 3 ,x 3 S s 4 , 0 , s 4 , 1 s 4 ,x 4 Lattice-Based Crypto & Applications, Bar-Ilan University, Israel 2012 6/12