Towards Stream Ciphers for Efficient FHE with Low-Noise Ciphertexts - - PowerPoint PPT Presentation

▶
towards stream ciphers for efficient fhe with low noise
SMART_READER_LITE
LIVE PREVIEW

Towards Stream Ciphers for Efficient FHE with Low-Noise Ciphertexts - - PowerPoint PPT Presentation

Oct 19, 2023 239 likes •959 views

Towards Stream Ciphers for Efficient FHE with Low-Noise Ciphertexts Pierrick M AUX cole normale suprieure, CNRS, INRIA, PSL Joint work with: Anthony J OURNAULT , Franois-Xavier S TANDAERT , and Claude C ARLET Eurocrypt 2016 Vienna,

slide-1
SLIDE 1

Towards Stream Ciphers for Efficient FHE with Low-Noise Ciphertexts

Pierrick MÉAUX

École normale supérieure, CNRS, INRIA, PSL Joint work with:

Anthony JOURNAULT, François-Xavier STANDAERT, and Claude CARLET

Eurocrypt 2016 — Vienna, Austria Monday May 9

1 / 14

slide-2
SLIDE 2

Outsourcing Computation

Alice

Limited storage Limited power Store Compute ? ?

2 / 14

slide-3
SLIDE 3

Outsourcing Computation

Alice

Limited storage Limited power Store Compute

  • Claude

Huge storage Huge power

2 / 14

slide-4
SLIDE 4

Outsourcing Computation

Alice

Limited storage Limited power Store Compute

  • Claude

Huge storage Huge power Privacy ?

2 / 14

slide-5
SLIDE 5

Outsourcing Computation

Alice

Limited storage Limited power Store Compute

  • Claude

Huge storage Huge power

  • Fully

Homomorphic

Encryption Privacy

2 / 14

slide-6
SLIDE 6

FHE Framework

Alice

Claude

m H.Enc

3 / 14

slide-7
SLIDE 7

FHE Framework

Alice

Claude

m H.Enc CH(m)

3 / 14

slide-8
SLIDE 8

FHE Framework

Alice

Claude

m H.Enc CH(m) H.Eval(f)

3 / 14

slide-9
SLIDE 9

FHE Framework

Alice

Claude

m H.Enc CH(m) H.Eval(f) Bootstrap

3 / 14

slide-10
SLIDE 10

FHE Framework

Alice

Claude

m H.Enc CH(m) H.Eval(f) Bootstrap H.Compact

3 / 14

slide-11
SLIDE 11

FHE Framework

Alice

Claude

m H.Enc CH(m) H.Eval(f) Bootstrap H.Compact cH(f(m))

3 / 14

slide-12
SLIDE 12

FHE Framework

Alice

Claude

m H.Enc CH(m) H.Eval(f) Bootstrap H.Compact cH(f(m)) H.Dec f(m)

3 / 14

slide-13
SLIDE 13

HE Framework

Alice

Claude

m H.Enc CH(m) H.Eval(f) Bootstrap H.Compact cH(f(m)) H.Dec f(m)

3 / 14

slide-14
SLIDE 14

SE-HE Hybrid Framework

Alice

Claude

m H.Eval(f) H.Compact cH(f(m)) H.Dec f(m) S.Enc

3 / 14

slide-15
SLIDE 15

SE-HE Hybrid Framework

Alice

Claude

m H.Eval(f) H.Compact cH(f(m)) H.Dec f(m) S.Enc CS(m)

3 / 14

slide-16
SLIDE 16

SE-HE Hybrid Framework

Alice

Claude

m H.Eval(f) H.Compact cH(f(m)) H.Dec f(m) S.Enc CS(m) H.Eval(S.Dec) (CH(skS))

3 / 14

slide-17
SLIDE 17

Performance Metric (Intuition) ⋄ Computational Cost ⋄ Noise Increase

4 / 14

slide-18
SLIDE 18

Performance Metric (Intuition) ⋄ Computational Cost ≈ number of multiplications ⋄ Noise Increase

4 / 14

slide-19
SLIDE 19

Performance Metric (Intuition) ⋄ Computational Cost ≈ number of multiplications ⋄ Noise Increase ciphertext noise

4 / 14

slide-20
SLIDE 20

Performance Metric (Intuition) ⋄ Computational Cost ≈ number of multiplications ⋄ Noise Increase ≈ multiplicative depth ciphertext noise

4 / 14

slide-21
SLIDE 21

State of the Art

Internal State

5 / 14

slide-22
SLIDE 22

State of the Art

Internal State Start Enc Final CT

5 / 14

slide-23
SLIDE 23

State of the Art: Block Ciphers

Internal State Start

5 / 14

slide-24
SLIDE 24

State of the Art: Block Ciphers

Start Round 1

5 / 14

slide-25
SLIDE 25

State of the Art: Block Ciphers

Start Round 1 Round r . . .

5 / 14

slide-26
SLIDE 26

State of the Art: Block Ciphers

Start Round 1 Round r . . . Final CT . . .

5 / 14

slide-27
SLIDE 27

State of the Art: Block Ciphers

Start Round 1 Round r . . . Final CT . . .

→ Constant but High Noise

AES[GHS12,CLT14], · · · , LowMC[ARS+15]

5 / 14

slide-28
SLIDE 28

State of the Art: Stream Ciphers

Internal State Start

5 / 14

slide-29
SLIDE 29

State of the Art: Stream Ciphers

Start Time 1

5 / 14

slide-30
SLIDE 30

State of the Art: Stream Ciphers

Start Time 1 Time f . . . Output

5 / 14

slide-31
SLIDE 31

State of the Art: Stream Ciphers

Start Time 1 Time f . . . Output Output Time f+r . . .

5 / 14

slide-32
SLIDE 32

State of the Art: Stream Ciphers

Start Time 1 Time f . . . Output Output Time f+r . . .

→ Slowly Increasing Noise, Limited Output

Trivium, Kreyvium[CCF+15]

5 / 14

slide-33
SLIDE 33

Our contributions ⋄ Best of both worlds: Constant and Low noise increase ⋄ Take advantage of 3rd generation FHE

6 / 14

slide-34
SLIDE 34

Our contributions ⋄ Best of both worlds: Constant and Low noise increase → Filter Permutator ⋄ Take advantage of 3rd generation FHE

6 / 14

slide-35
SLIDE 35

Our contributions ⋄ Best of both worlds: Constant and Low noise increase → Filter Permutator ⋄ Take advantage of 3rd generation FHE → FLIPF

6 / 14

slide-36
SLIDE 36

Filter Permutator Error Increase

Time 0

7 / 14

slide-37
SLIDE 37

Filter Permutator Error Increase

Time 0 Time 1 F Output

7 / 14

slide-38
SLIDE 38

Filter Permutator Error Increase

Time 0 Time 1 F Output F Time r . . .

7 / 14

slide-39
SLIDE 39

Filter Permutator Error Increase

Time 0 Time 1 F Output F Time r . . . F Time f . . .

7 / 14

slide-40
SLIDE 40

Filter Permutator Error Increase

Time 0 Time 1 F Output F Time r . . . F Time f . . .

→ Constant and Low Noise

7 / 14

slide-41
SLIDE 41

Filter Permutator Construction ⊲ Key Register K Pi

Filtering Function Plaintext Ciphertext PRNG Permutation Generator

8 / 14

slide-42
SLIDE 42

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

9 / 14

slide-43
SLIDE 43

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

n1 variables x1 ⊕ . . . ⊕ xn1

9 / 14

slide-44
SLIDE 44

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

x1 ⊕ . . . ⊕ xn1 n2 variables y1y2 ⊕ . . . ⊕ y n2

2 −1y n2 2 9 / 14

slide-45
SLIDE 45

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

x1 ⊕ . . . ⊕ xn1 y1y2 ⊕ . . . ⊕ y n2

2 −1y n2 2

z1 ⊕ z2z3 ⊕ z4z5z6 . . . ⊕ · · · z h(h+1)

2

⊕ · · · ⊕

9 / 14

slide-46
SLIDE 46

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

x1 ⊕ . . . ⊕ xn1 y1y2 ⊕ . . . ⊕ y n2

2 −1y n2 2

z1 ⊕ z2z3 ⊕ z4z5z6 . . . ⊕ · · · z h(h+1)

2

⊕ · · · ⊕

h

9 / 14

slide-47
SLIDE 47

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

x1 ⊕ . . . ⊕ xn1 y1y2 ⊕ . . . ⊕ y n2

2 −1y n2 2

z1 ⊕ z2z3 ⊕ z4z5z6 . . . ⊕ · · · z h(h+1)

2

⊕ · · · ⊕

h ℓ triangles

9 / 14

slide-48
SLIDE 48

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

x1 ⊕ . . . ⊕ xn1 y1y2 ⊕ . . . ⊕ y n2

2 −1y n2 2

z1 ⊕ z2z3 ⊕ z4z5z6 . . . ⊕ · · · z h(h+1)

2

⊕ · · · ⊕

h ℓ triangles

  • n1 + n2 + ℓ h(h+1)

2

variables

9 / 14

slide-49
SLIDE 49

FLIPF Construction

Components

◮ PRNG: forward secure PRNG based on AES-128 ◮ Permutation Generator: Knuth Shuffle ◮ Filtering function F = (n1, n2, ℓ∆h)

x1 ⊕ . . . ⊕ xn1 y1y2 ⊕ . . . ⊕ y n2

2 −1y n2 2

z1 ⊕ z2z3 ⊕ z4z5z6 . . . ⊕ · · · z h(h+1)

2

⊕ · · · ⊕

h ℓ triangles

  • n1 + n2 + ℓ h(h+1)

2

variables FLIP(42, 64, 8∆9) FLIP(82, 112, 8∆16)

9 / 14

slide-50
SLIDE 50

FLIPF Homomorphic Behavior

3rd generation FHE Ciphertexts (GSW)

sC = µs + e

10 / 14

slide-51
SLIDE 51

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth

sC = µs + e

ciphertext (small) error (small) secret key ≈ eigenvector plaintext ≈ eigenvalue

10 / 14

slide-52
SLIDE 52

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth

sC = µs + e

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci

10 / 14

slide-53
SLIDE 53

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth

sC = µs + e

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci → σ2

+ = k

  • i=1

σ2

i

10 / 14

slide-54
SLIDE 54

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth

sC = µs + e

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci → σ2

+ = k

  • i=1

σ2

i

C1 · · · Ck σ2

× ≈ ylog kσ2

10 / 14

slide-55
SLIDE 55

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth

sC = µs + e

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci → σ2

+ = k

  • i=1

σ2

i

→ σ2

× ≈ yσ2k

C1 · · · Ck σ2

× ≈ ylog kσ2

C1 ... Ck σ2

× ≈ yσ2k

10 / 14

slide-56
SLIDE 56

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth: H.Eval(F)

H.Eval(F) ≈ H.Mul

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci → σ2

+ = k

  • i=1

σ2

i

→ σ2

× ≈ yσ2k

10 / 14

slide-57
SLIDE 57

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth: H.Eval(F)

H.Eval(F) ≈ H.Mul

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci → σ2

+ = k

  • i=1

σ2

i

→ σ2

× ≈ yσ2k 1∆h

k variables k = h(h+1)

2

C1 + C2C3 + C4C5C6 . . . + Ck−h+1· · · Ck

10 / 14

slide-58
SLIDE 58

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth: H.Eval(F)

H.Eval(F) ≈ H.Mul

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci → σ2

+ = k

  • i=1

σ2

i

→ σ2

× ≈ yσ2k 1∆h

k variables k = h(h+1)

2

C1 + C2C3 + C4C5C6 . . . + Ck−h+1· · · Ck yσ2 × 1 yσ2 × 2 yσ2 × . . . yσ2 × h

10 / 14

slide-59
SLIDE 59

FLIPF Homomorphic Behavior

3rd generation FHE Noise Growth: H.Eval(F)

H.Eval(F) ≈ H.Mul

H.Add :

k

  • i=1

Ci H.Mul :

k

  • i=1

Ci → σ2

+ = k

  • i=1

σ2

i

→ σ2

× ≈ yσ2k 1∆h

k variables k = h(h+1)

2

C1 + C2C3 + C4C5C6 . . . + Ck−h+1· · · Ck yσ2 × 1 yσ2 × 2 yσ2 × . . . yσ2 × h yσ2 × h(h+1)

2

= yσ2k

H.Eval(1∆h)

≈

H.Mul

10 / 14

slide-60
SLIDE 60

FLIPF Symmetric Behavior

Cryptanalysis Angle

"good" PRNG + "good" Shuffle ≈ random Permutations; what about F?

11 / 14

slide-61
SLIDE 61

FLIPF Symmetric Behavior

Cryptanalysis Angle

"good" PRNG + "good" Shuffle ≈ random Permutations; what about F?

Attacks on Filtering Function

◮ Algebraic ◮ Fast Algebraic ◮ Correlation ◮ High Order Correlation ◮ G & D Attack [DLR16] ◮ etc

11 / 14

slide-62
SLIDE 62

FLIPF Symmetric Behavior

Cryptanalysis Angle

"good" PRNG + "good" Shuffle ≈ random Permutations; what about F?

Attacks on Filtering Function

◮ Algebraic ◮ Fast Algebraic ◮ Correlation ◮ High Order Correlation ◮ G & D Attack [DLR16] ◮ etc

Standard Criteria

◮ Algebraic Immunity ◮ Fast Algebraic Immunity ◮ Resiliency ◮ Non Linearity

11 / 14

slide-63
SLIDE 63

FLIPF Symmetric Behavior

Cryptanalysis Angle

"good" PRNG + "good" Shuffle ≈ random Permutations; what about F?

Attacks on Filtering Function

◮ Algebraic ◮ Fast Algebraic ◮ Correlation ◮ High Order Correlation ◮ G & D Attack [DLR16] ◮ etc

Standard Criteria

◮ Algebraic Immunity ◮ Fast Algebraic Immunity ◮ Resiliency ◮ Non Linearity

Theorem (Triangular function and Algebraic Immunity)

∀ℓ ∈ N∗, ∀k ∈ N∗ AI(ℓ∆k) = k

11 / 14

slide-64
SLIDE 64

Noise Increase Performances

⋄ Tests on Ring-GSW (efficiency) ⋄ Measure noise increase from fresh ciphertext to FLIP ciphertext: ⋄ Log of ciphertext error (log σ) ⋄ Homomorphic capacity already used (%).

12 / 14

slide-65
SLIDE 65

Noise Increase Performances

⋄ Tests on Ring-GSW (efficiency) ⋄ Measure noise increase from fresh ciphertext to FLIP ciphertext: ⋄ Log of ciphertext error (log σ) ⋄ Homomorphic capacity already used (%).

Experimental error growth

Ring (n, ℓ) FLIP Fresh H.Mul H.Eval(FLIP) log σ % log σ % log σ % 256 80 42, 128, 8∆9 13, 07 17 % 19, 82 25% 24, 71 31% 512 120 82, 224, 8∆16 14, 68 12 % 23, 27 20% 28, 77 24%

12 / 14

slide-66
SLIDE 66

Noise Increase Performances

⋄ Tests on Ring-GSW (efficiency) ⋄ Measure noise increase from fresh ciphertext to FLIP ciphertext: ⋄ Log of ciphertext error (log σ) ⋄ Homomorphic capacity already used (%).

Experimental error growth

Ring (n, ℓ) FLIP Fresh H.Mul H.Eval(FLIP) log σ % log σ % log σ % 256 80 42, 128, 8∆9 13, 07 17 % 19, 82 25% 24, 71 31% 512 120 82, 224, 8∆16 14, 68 12 % 23, 27 20% 28, 77 24%

→ FLIP evaluation ≈ multiplication → Practical SE-HE framework.

12 / 14

slide-67
SLIDE 67

Performances Comparisons

Error Increase Comparisons

Algorithm Reference Multiplicative Depth AES-128 [GHS12] 40 SIMON-64/128 [LN14] 44 Prince [DSE+14] 24 Kreyvium-12 [CCF+15] 12 LowMc-128 [ARS+15] 12 FLIP(82, 112, 8∆16) This work ⌈log 16⌉ = 4

13 / 14

slide-68
SLIDE 68

Performances Comparisons

Error Increase Comparisons

Algorithm Reference Multiplicative Depth AES-128 [GHS12] 40 SIMON-64/128 [LN14] 44 Prince [DSE+14] 24 Kreyvium-12 [CCF+15] 12 LowMc-128 [ARS+15] 12 FLIP(82, 112, 8∆16) This work ⌈log 16⌉ = 4

Timing Comparisons

λ Algorithm L+7 Latency Throughput (sec) (bits/min) 80 Trivium-13 20 11379.7 516.3 FLIP(42, 128, 8∆9) 12 17.39 2070.16 128 Kreyvium-12 19 4956.0 384.4 LowMC-128 20 9977.1 739.0 FLIP(82, 224, 8∆16) 13 124.97 345.68

13 / 14

slide-69
SLIDE 69

Conclusion and Open Problems Filter Permutator

⋄ New stream cipher family adapted to FHE ⋄ Security of reduced degree and increased key size construction? ⋄ Impact of design tweaks: ⋄ Whitening? ⋄ XOR of parallel Filter Permutator?

14 / 14

slide-70
SLIDE 70

Conclusion and Open Problems Filter Permutator

⋄ New stream cipher family adapted to FHE ⋄ Security of reduced degree and increased key size construction? ⋄ Impact of design tweaks: ⋄ Whitening? ⋄ XOR of parallel Filter Permutator?

FLIPF

⋄ Optimal noise increase for 3rd generation FHE ⋄ Efficient FHE framework ⋄ Optimization for 2nd generation FHE? ⋄ Refining security analysis: ⋄ Increasing/decreasing parameter sizes? ⋄ Boolean functions with fixed weight entries?

14 / 14

slide-71
SLIDE 71

Conclusion and Open Problems Filter Permutator

⋄ New stream cipher family adapted to FHE ⋄ Security of reduced degree and increased key size construction? ⋄ Impact of design tweaks: ⋄ Whitening? ⋄ XOR of parallel Filter Permutator?

FLIPF

⋄ Optimal noise increase for 3rd generation FHE ⋄ Efficient FHE framework ⋄ Optimization for 2nd generation FHE? ⋄ Refining security analysis: ⋄ Increasing/decreasing parameter sizes? ⋄ Boolean functions with fixed weight entries? Thanks for your attention!

14 / 14