The Geometry of Rings Chris Peikert Georgia Institute of Technology - PowerPoint PPT Presentation

The Geometry of Rings Chris Peikert Georgia Institute of Technology ECRYPT II Summer School on Lattices Porto, Portugal 2 Oct 2012 1 / 13

LWE Over Rings (Over-Simplified) [LPR’10] Ring R := Z [ X ] / (1 + X n ) for some n = 2 k , R q := R/qR. 2 / 13

LWE Over Rings (Over-Simplified) [LPR’10] Ring R := Z [ X ] / (1 + X n ) for some n = 2 k , R q := R/qR. ◮ Problem: for s ← R q , distinguish { ( a i , b i ) } from uniform { ( a i , b i ) } . a 1 ← R q , b 1 = a 1 · s + e 1 ∈ R q a 2 ← R q , b 2 = a 2 · s + e 2 ∈ R q . . . 2 / 13

LWE Over Rings (Over-Simplified) [LPR’10] Ring R := Z [ X ] / (1 + X n ) for some n = 2 k , R q := R/qR. ◮ Problem: for s ← R q , distinguish { ( a i , b i ) } from uniform { ( a i , b i ) } . a 1 ← R q , b 1 = a 1 · s + e 1 ∈ R q a 2 ← R q , b 2 = a 2 · s + e 2 ∈ R q . . . ◮ Errors e ( X ) ∈ R are “short.” What could this mean? 2 / 13

LWE Over Rings (Over-Simplified) [LPR’10] Ring R := Z [ X ] / (1 + X n ) for some n = 2 k , R q := R/qR. ◮ Problem: for s ← R q , distinguish { ( a i , b i ) } from uniform { ( a i , b i ) } . a 1 ← R q , b 1 = a 1 · s + e 1 ∈ R q a 2 ← R q , b 2 = a 2 · s + e 2 ∈ R q . . . ◮ Errors e ( X ) ∈ R are “short.” What could this mean? Identify n − 1 (?) � e j X j ( e 0 , e 1 , . . . e n − 1 ) ∈ Z n . e ( X ) = ← → j =0 2 / 13

LWE Over Rings (Over-Simplified) [LPR’10] Ring R := Z [ X ] / (1 + X n ) for some n = 2 k , R q := R/qR. ◮ Problem: for s ← R q , distinguish { ( a i , b i ) } from uniform { ( a i , b i ) } . a 1 ← R q , b 1 = a 1 · s + e 1 ∈ R q a 2 ← R q , b 2 = a 2 · s + e 2 ∈ R q . . . ◮ Errors e ( X ) ∈ R are “short.” What could this mean? Identify n − 1 (?) � e j X j ( e 0 , e 1 , . . . e n − 1 ) ∈ Z n . e ( X ) = ← → j =0 ◮ Applications need (+ , · ) -combinations of errors to remain short. 2 / 13

LWE Over Rings (Over-Simplified) [LPR’10] Ring R := Z [ X ] / (1 + X n ) for some n = 2 k , R q := R/qR. ◮ Problem: for s ← R q , distinguish { ( a i , b i ) } from uniform { ( a i , b i ) } . a 1 ← R q , b 1 = a 1 · s + e 1 ∈ R q a 2 ← R q , b 2 = a 2 · s + e 2 ∈ R q . . . ◮ Errors e ( X ) ∈ R are “short.” What could this mean? Identify n − 1 (?) � e j X j ( e 0 , e 1 , . . . e n − 1 ) ∈ Z n . e ( X ) = ← → j =0 ◮ Applications need (+ , · ) -combinations of errors to remain short. Yes! � e · f � ≤ √ n · � e � · � f � . � e + f � ≤ � e � + � f � “Expansion factor” √ n is worst-case. (“On average,” ≈ √ log n .) 2 / 13

Example Application: Homomorphic Encryption [BV’11a] ◮ R = Z [ X ] / (1 + X 2 k ) , R q = R/qR . Symmetric key s ← R q . 3 / 13

Example Application: Homomorphic Encryption [BV’11a] ◮ R = Z [ X ] / (1 + X 2 k ) , R q = R/qR . Symmetric key s ← R q . ◮ Enc s ( m ∈ R 2 ) : choose a “short” e ∈ R s.t. e = m mod 2 . Let c 1 ← R q and c 0 = − c 1 · s + e ∈ R q and output c ( S ) = c 0 + c 1 S ∈ R q [ S ] . (Notice: c ( s ) = e mod q .) 3 / 13

Example Application: Homomorphic Encryption [BV’11a] ◮ R = Z [ X ] / (1 + X 2 k ) , R q = R/qR . Symmetric key s ← R q . ◮ Enc s ( m ∈ R 2 ) : choose a “short” e ∈ R s.t. e = m mod 2 . Let c 1 ← R q and c 0 = − c 1 · s + e ∈ R q and output c ( S ) = c 0 + c 1 S ∈ R q [ S ] . (Notice: c ( s ) = e mod q .) Security: ( c 1 , c 0 ) is an RLWE sample (essentially). 3 / 13

Example Application: Homomorphic Encryption [BV’11a] ◮ R = Z [ X ] / (1 + X 2 k ) , R q = R/qR . Symmetric key s ← R q . ◮ Enc s ( m ∈ R 2 ) : choose a “short” e ∈ R s.t. e = m mod 2 . Let c 1 ← R q and c 0 = − c 1 · s + e ∈ R q and output c ( S ) = c 0 + c 1 S ∈ R q [ S ] . (Notice: c ( s ) = e mod q .) Security: ( c 1 , c 0 ) is an RLWE sample (essentially). ◮ Dec s ( c ( S )) : get short d ∈ R s.t. d = c ( s ) mod q . Output d mod 2 . Correctness: d = e , as long as e has Z -coeffs ∈ ( − q/ 2 , q/ 2) . 3 / 13

Example Application: Homomorphic Encryption [BV’11a] ◮ R = Z [ X ] / (1 + X 2 k ) , R q = R/qR . Symmetric key s ← R q . ◮ Enc s ( m ∈ R 2 ) : choose a “short” e ∈ R s.t. e = m mod 2 . Let c 1 ← R q and c 0 = − c 1 · s + e ∈ R q and output c ( S ) = c 0 + c 1 S ∈ R q [ S ] . (Notice: c ( s ) = e mod q .) Security: ( c 1 , c 0 ) is an RLWE sample (essentially). ◮ Dec s ( c ( S )) : get short d ∈ R s.t. d = c ( s ) mod q . Output d mod 2 . Correctness: d = e , as long as e has Z -coeffs ∈ ( − q/ 2 , q/ 2) . ◮ EvalAdd ( c, c ′ ) = ( c + c ′ )( S ) , EvalMul ( c, c ′ ) = ( c · c ′ )( S ) . 3 / 13

Example Application: Homomorphic Encryption [BV’11a] ◮ R = Z [ X ] / (1 + X 2 k ) , R q = R/qR . Symmetric key s ← R q . ◮ Enc s ( m ∈ R 2 ) : choose a “short” e ∈ R s.t. e = m mod 2 . Let c 1 ← R q and c 0 = − c 1 · s + e ∈ R q and output c ( S ) = c 0 + c 1 S ∈ R q [ S ] . (Notice: c ( s ) = e mod q .) Security: ( c 1 , c 0 ) is an RLWE sample (essentially). ◮ Dec s ( c ( S )) : get short d ∈ R s.t. d = c ( s ) mod q . Output d mod 2 . Correctness: d = e , as long as e has Z -coeffs ∈ ( − q/ 2 , q/ 2) . ◮ EvalAdd ( c, c ′ ) = ( c + c ′ )( S ) , EvalMul ( c, c ′ ) = ( c · c ′ )( S ) . Decryption works if e + e ′ , e · e ′ “short enough.” 3 / 13

Example Application: Homomorphic Encryption [BV’11a] ◮ R = Z [ X ] / (1 + X 2 k ) , R q = R/qR . Symmetric key s ← R q . ◮ Enc s ( m ∈ R 2 ) : choose a “short” e ∈ R s.t. e = m mod 2 . Let c 1 ← R q and c 0 = − c 1 · s + e ∈ R q and output c ( S ) = c 0 + c 1 S ∈ R q [ S ] . (Notice: c ( s ) = e mod q .) Security: ( c 1 , c 0 ) is an RLWE sample (essentially). ◮ Dec s ( c ( S )) : get short d ∈ R s.t. d = c ( s ) mod q . Output d mod 2 . Correctness: d = e , as long as e has Z -coeffs ∈ ( − q/ 2 , q/ 2) . ◮ EvalAdd ( c, c ′ ) = ( c + c ′ )( S ) , EvalMul ( c, c ′ ) = ( c · c ′ )( S ) . Decryption works if e + e ′ , e · e ′ “short enough.” Many mults ⇒ large power of expansion factor ⇒ tiny error rate α ⇒ big parameters! 3 / 13

Other Rings: Cyclotomics ◮ Used in faster bootstrapping [GHS’12a] , homomorphic AES [GHS’12b] . 4 / 13

Other Rings: Cyclotomics ◮ Used in faster bootstrapping [GHS’12a] , homomorphic AES [GHS’12b] . R = Z [ X ] / Φ m ( X ) for m th cyclotomic polynomial Φ m ( X ) . √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C i ∈ Z ∗ m 4 / 13

Other Rings: Cyclotomics ◮ Used in faster bootstrapping [GHS’12a] , homomorphic AES [GHS’12b] . R = Z [ X ] / Φ m ( X ) for m th cyclotomic polynomial Φ m ( X ) . √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C i ∈ Z ∗ m ◮ Roots ω i run over all n = ϕ ( m ) primitive m th roots of unity. “Power” Z -basis of R is { 1 , X, X 2 , . . . , X n − 1 } . 4 / 13

Other Rings: Cyclotomics ◮ Used in faster bootstrapping [GHS’12a] , homomorphic AES [GHS’12b] . R = Z [ X ] / Φ m ( X ) for m th cyclotomic polynomial Φ m ( X ) . √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C i ∈ Z ∗ m ◮ Roots ω i run over all n = ϕ ( m ) primitive m th roots of unity. “Power” Z -basis of R is { 1 , X, X 2 , . . . , X n − 1 } . ω 2 ω 3 ω 1 ω 1 ω 4 ω 5 ω 8 ω 5 ω 7 ω 7 Φ 9 ( X ) = 1 + X 3 + X 6 Φ 8 ( X ) = 1 + X 4 4 / 13

Other Rings: Cyclotomics ◮ Used in faster bootstrapping [GHS’12a] , homomorphic AES [GHS’12b] . R = Z [ X ] / Φ m ( X ) for m th cyclotomic polynomial Φ m ( X ) . √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C i ∈ Z ∗ m ◮ Roots ω i run over all n = ϕ ( m ) primitive m th roots of unity. “Power” Z -basis of R is { 1 , X, X 2 , . . . , X n − 1 } . Non-prime power m ? ✗ Φ 21 ( X ) = 1 − X + X 3 − X 4 + X 6 − X 8 + X 9 − X 11 + X 12 4 / 13

Other Rings: Cyclotomics ◮ Used in faster bootstrapping [GHS’12a] , homomorphic AES [GHS’12b] . R = Z [ X ] / Φ m ( X ) for m th cyclotomic polynomial Φ m ( X ) . √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C i ∈ Z ∗ m ◮ Roots ω i run over all n = ϕ ( m ) primitive m th roots of unity. “Power” Z -basis of R is { 1 , X, X 2 , . . . , X n − 1 } . Non-prime power m ? ✗ Φ 21 ( X ) = 1 − X + X 3 − X 4 + X 6 − X 8 + X 9 − X 11 + X 12 ✗✗ Φ 105 ( X ) = [degree 48; 33 monomials with {− 2 , − 1 , 1 } -coefficients] 4 / 13

Other Rings: Cyclotomics ◮ Used in faster bootstrapping [GHS’12a] , homomorphic AES [GHS’12b] . R = Z [ X ] / Φ m ( X ) for m th cyclotomic polynomial Φ m ( X ) . √ � ( X − ω i ) ∈ Z [ X ] , Φ m ( X ) = ω = exp(2 π − 1 /m ) ∈ C i ∈ Z ∗ m ◮ Roots ω i run over all n = ϕ ( m ) primitive m th roots of unity. “Power” Z -basis of R is { 1 , X, X 2 , . . . , X n − 1 } . Non-prime power m ? ✗ Φ 21 ( X ) = 1 − X + X 3 − X 4 + X 6 − X 8 + X 9 − X 11 + X 12 ✗✗ Φ 105 ( X ) = [degree 48; 33 monomials with {− 2 , − 1 , 1 } -coefficients] Annoyances ✗ Irregular Φ m ( X ) ⇒ slower, more complex operations 4 / 13