Towards Stream Ciphers for Efficient FHE with Low-Noise Ciphertexts - PowerPoint PPT Presentation

Towards Stream Ciphers for Efficient FHE with Low-Noise Ciphertexts Pierrick M ÉAUX École normale supérieure, CNRS, INRIA, PSL Joint work with: Anthony J OURNAULT , François-Xavier S TANDAERT , and Claude C ARLET Eurocrypt 2016 — Vienna, Austria Monday May 9 1 / 14

Outsourcing Computation Alice Limited storage Limited power Store ? Compute ? 2 / 14

Outsourcing Computation Claude Alice Limited storage Huge storage Limited power Huge power Store � Compute � 2 / 14

Outsourcing Computation Claude Alice Limited storage Huge storage Limited power Huge power Store � Compute � Privacy ? 2 / 14

Outsourcing Computation Claude Alice Limited storage Huge storage Limited power Huge power Fully Store � Compute Homomorphic � Encryption Privacy � 2 / 14

FHE Framework Claude Alice m H . Enc 3 / 14

FHE Framework Claude Alice m H . Enc C H ( m ) 3 / 14

FHE Framework Claude Alice m H . Enc C H ( m ) H . Eval ( f ) 3 / 14

FHE Framework Claude Alice m H . Enc C H ( m ) Bootstrap H . Eval ( f ) 3 / 14

FHE Framework Claude Alice m H . Enc C H ( m ) Bootstrap H . Eval ( f ) H . Compact 3 / 14

FHE Framework Claude Alice m H . Enc C H ( m ) Bootstrap H . Eval ( f ) H . Compact c H ( f ( m )) 3 / 14

FHE Framework Claude Alice m H . Enc C H ( m ) Bootstrap H . Eval ( f ) H . Compact c H ( f ( m )) H . Dec f ( m ) 3 / 14

HE Framework Claude Alice m H . Enc C H ( m ) Bootstrap H . Eval ( f ) H . Compact c H ( f ( m )) H . Dec f ( m ) 3 / 14

SE-HE Hybrid Framework Claude Alice m S . Enc H . Eval ( f ) H . Compact c H ( f ( m )) H . Dec f ( m ) 3 / 14

SE-HE Hybrid Framework Claude Alice m S . Enc C S ( m ) H . Eval ( f ) H . Compact c H ( f ( m )) H . Dec f ( m ) 3 / 14

SE-HE Hybrid Framework Claude Alice ( C H ( sk S ) ) m S . Enc C S ( m ) H . Eval ( S . Dec ) H . Eval ( f ) H . Compact c H ( f ( m )) H . Dec f ( m ) 3 / 14

Performance Metric (Intuition) ⋄ Computational Cost ⋄ Noise Increase 4 / 14

Performance Metric (Intuition) ⋄ Computational Cost ≈ number of multiplications ⋄ Noise Increase 4 / 14

Performance Metric (Intuition) ⋄ Computational Cost ≈ number of multiplications ⋄ Noise Increase ciphertext noise 4 / 14

Performance Metric (Intuition) ⋄ Computational Cost ≈ number of multiplications ⋄ Noise Increase ≈ multiplicative depth ciphertext noise 4 / 14

State of the Art Internal State 5 / 14

State of the Art Start Internal State Enc Final CT 5 / 14

State of the Art: Block Ciphers Start Internal State 5 / 14

State of the Art: Block Ciphers Start Round 1 5 / 14

State of the Art: Block Ciphers Start Round 1 . . . Round r 5 / 14

State of the Art: Block Ciphers Start Round 1 . . . Round r . . . Final CT 5 / 14

State of the Art: Block Ciphers Start Round 1 . . . Round r . . . Final CT → Constant but High Noise AES[GHS12,CLT14], · · · , LowMC[ARS+15] 5 / 14

State of the Art: Stream Ciphers Start Internal State 5 / 14

State of the Art: Stream Ciphers Start Time 1 5 / 14

State of the Art: Stream Ciphers Start Time 1 . . Output . Time f 5 / 14

State of the Art: Stream Ciphers Start Time 1 . . Output . Time f . . Output . Time f+r 5 / 14

State of the Art: Stream Ciphers Start Time 1 . . Output . Time f . . Output . Time f+r → Slowly Increasing Noise, Limited Output Trivium, Kreyvium[CCF+15] 5 / 14

Our contributions ⋄ Best of both worlds: Constant and Low noise increase ⋄ Take advantage of 3 rd generation FHE 6 / 14

Our contributions ⋄ Best of both worlds: Constant and Low noise increase → Filter Permutator ⋄ Take advantage of 3 rd generation FHE 6 / 14

Our contributions ⋄ Best of both worlds: Constant and Low noise increase → Filter Permutator ⋄ Take advantage of 3 rd generation FHE → FLIP F 6 / 14

Filter Permutator Error Increase Time 0 7 / 14

Filter Permutator Error Increase Time 0 Output F Time 1 7 / 14

Filter Permutator Error Increase Time 0 Output F Time 1 . . . F Time r 7 / 14

Filter Permutator Error Increase Time 0 Output F Time 1 . . . F Time r . . . F Time f 7 / 14

Filter Permutator Error Increase Time 0 Output F Time 1 . . . F Time r . . . F Time f → Constant and Low Noise 7 / 14

Filter Permutator Construction ⊲ Key Register K PRNG Permutation P i Generator Filtering Function Plaintext Ciphertext 8 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) 9 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) n 1 variables x 1 ⊕ . . . ⊕ x n 1 9 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) n 2 variables y 1 y 2 x 1 ⊕ ⊕ . . . . . . ⊕ ⊕ y n 2 2 − 1 y n 2 x n 1 2 9 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) y 1 y 2 x 1 z 1 ⊕ ⊕ ⊕ z 2 z 3 . . ⊕ . . z 4 z 5 z 6 . . ⊕ · · · ⊕ . . . ⊕ ⊕ ⊕ y n 2 2 − 1 y n 2 z h ( h + 1 ) x n 1 · · · 2 2 9 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) y 1 y 2 x 1 z 1 ⊕ ⊕ ⊕ z 2 z 3 . . ⊕ . . h z 4 z 5 z 6 . . ⊕ · · · ⊕ . . . ⊕ ⊕ ⊕ y n 2 2 − 1 y n 2 z h ( h + 1 ) x n 1 · · · 2 2 9 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) y 1 y 2 x 1 z 1 ⊕ ⊕ ⊕ z 2 z 3 . . ⊕ . . h z 4 z 5 z 6 . . ⊕ · · · ⊕ . . . ⊕ ⊕ ⊕ y n 2 2 − 1 y n 2 z h ( h + 1 ) x n 1 · · · 2 2 ℓ triangles 9 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) y 1 y 2 x 1 z 1 ⊕ ⊕ ⊕ z 2 z 3 . . ⊕ . . h z 4 z 5 z 6 . � . � ⊕ · · · ⊕ . . . ⊕ ⊕ ⊕ y n 2 2 − 1 y n 2 z h ( h + 1 ) x n 1 · · · 2 2 ℓ triangles n 1 + n 2 + ℓ h ( h + 1 ) variables 2 9 / 14

FLIP F Construction Components ◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = ( n 1 , n 2 , ℓ ∆ h ) y 1 y 2 x 1 z 1 ⊕ ⊕ ⊕ z 2 z 3 . . ⊕ . . h z 4 z 5 z 6 . � . � ⊕ · · · ⊕ . . . ⊕ ⊕ ⊕ y n 2 2 − 1 y n 2 z h ( h + 1 ) x n 1 · · · 2 2 ℓ triangles n 1 + n 2 + ℓ h ( h + 1 ) variables 2 FLIP ( 42 , 64 , 8 ∆ 9 ) FLIP ( 82 , 112 , 8 ∆ 16 ) 9 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Ciphertexts (GSW) sC = µ s + e 10 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Noise Growth ciphertext (small) error (small) sC = µ s + e secret key plaintext ≈ eigenvector ≈ eigenvalue 10 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Noise Growth sC = µ s + e k k � � H . Add : H . Mul : C i C i i = 1 i = 1 10 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Noise Growth sC = µ s + e k k k σ 2 � → σ 2 � � H . Add : H . Mul : C i + = C i i i = 1 i = 1 i = 1 10 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Noise Growth sC = µ s + e k k k σ 2 � → σ 2 � � H . Add : H . Mul : C i + = C i i i = 1 i = 1 i = 1 σ 2 × ≈ y log k σ 2 · · · C 1 C k 10 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Noise Growth sC = µ s + e k k k σ 2 � → σ 2 � � → σ 2 × ≈ y σ 2 k H . Add : H . Mul : C i + = C i i i = 1 i = 1 i = 1 σ 2 × ≈ y log k σ 2 C 1 ... σ 2 × ≈ y σ 2 k · · · C 1 C k C k 10 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Noise Growth: H . Eval ( F ) H . Eval ( F ) ≈ H . Mul k k k σ 2 → σ 2 → σ 2 × ≈ y σ 2 k H . Add : � � H . Mul : � C i + = C i i i = 1 i = 1 i = 1 10 / 14

FLIP F Homomorphic Behavior 3 rd generation FHE Noise Growth: H . Eval ( F ) H . Eval ( F ) ≈ H . Mul k k k σ 2 → σ 2 → σ 2 × ≈ y σ 2 k H . Add : � � H . Mul : � C i + = C i i i = 1 i = 1 i = 1 1 ∆ h C 1 + C 2 C 3 + k variables C 4 C 5 C 6 . . . + k = h ( h + 1 ) C k − h + 1 · · · C k 2 10 / 14