On Homomorphic Encryption and Secure Computation challenge response Shai Halevi June 16, 2011

2 Computing on Encrypted Data Wouldn’t it be nice to be able to… oEncrypt my data in the cloud oWhile still allowing the cloud to search/sort/edit/… this data on my behalf oKeeping the data in the cloud in encrypted form  Without needing to ship it back and forth to be decrypted

June 16, Computing on Encrypted Data Wouldn’t it be nice to be able to… oEncrypt my queries to the cloud oWhile still allowing the cloud to process them oCloud returns encrypted answers  that I can decrypt

June 16, … Computing on Encrypted Data Directions From: Tel-Aviv University, Tel-Aviv, Israel To: Technion, Haifa, Israel

June 16, Computing on Encrypted Data &maXxjq02bflx m^00a2nm5,A4. pE.abxp3m58bsa (3saM%w,snanba nq~mD=3akm2,A Z,ltnhde83|3mz{n dewiunb4]gnbTa* kjew^bwJ^mdns0

Constructing Homomorphic Encryption

June 16, Privacy Homomorphisms [RAD78] Some examples: o“Raw RSA”: c  x e mod N ( x  c d mod N )  x 1 e x x 2 e = ( x 1 x x 2 ) e mod N oGM84: Enc( 0 )  R QR, Enc( 1 )  R QNR (in Z N * )  Enc( x 1 ) x Enc( x 2 ) = Enc( x 1  x 2 ) mod N Plaintext space P Ciphertext space C x 1 x 2 c i  Enc( x i ) c 1 c 2  yd y  Dec( d )

June 16, More Privacy Homomorphisms oMult-mod-p [ElGamal’84] oAdd-mod-N [Pallier’98] oQuadratic-polys mod p [BGN’06] oBranching programs [IP’07] oLater, a “different type of solution” for any circuit [Yao’82,…]  Also NC1 circuits [SYY’00]

June 16, (x,+)-Homomorphic Encryption It will be really nice to have… oPlaintext space Z 2 (w/ ops +,x) oCiphertexts live in an algebraic ring R (w/ ops +,x) oHomomorphic for both + and x  Enc( x 1 ) + Enc( x 2 ) in R = Enc( x 1 + x 2 mod 2)  Enc( x 1 ) x Enc( x 2 ) in R = Enc( x 1 x x 2 mod 2) oThen we can compute any function on the encryptions  Since every binary function is a polynomial oWe won’t get exactly this, but it’s a good motivation

June 16, Some Notations oAn encryption scheme: (KeyGen, Enc, Dec)  Plaintext-space = {0,1}  ( pk,sk)  KeyGen($), c  Enc pk ( b ), b  Dec sk ( c ) oSemantic security [GM’84]: ( pk, Enc pk ( 0 ))  ( pk, Enc pk ( 1 ))  means indistinguishable by efficient algorithms

June 16, oH = { KeyGen, Enc, Dec, Eval } c*  Eval pk ( f, c ) oHomomorphic: Dec sk (Eval pk ( f, Enc pk ( x ))) = f ( x )  c* may not look like a “fresh” ciphertext  As long as it decrypts to f(x) oFunction-private: c* hides f oCompact: Decrypting c* easier than computing f  | c* | independent of the complexity of f Homomorphic Encryption c*c*

June 16, (x,+)-Homomorphic Encryption, the [Gentry09] blueprint Evaluate any function in four “easy” steps oStep 1: Encryption from linear ECCs  Additive homomorphism oStep 2: ECC lives inside a ring  Also multiplicative homomorphism  But only for a few operations (i.e., low-degree poly’s) oStep 3: Bootstrapping  Few ops (but not too few)  any number of ops oStep 4: Everything else

June 16, Step One: Encryption from Linear ECCs oFor “random looking” codes, hard to distinguish close/far from code oMany cryptosystems built on this hardness  E.g., [McEliece’78, AD’97, GGH’97, R’03,…]

June 16, Encryption from linear ECCs oKeyGen: choose a “random” code C  Secret key: “good representation” of C  Allows correction of “large” errors  Public key: “bad representation” of C oEnc(0): a word close to C oEnc(1): a random word  Far from C (with high probability)

June 16, An Example: Integers mod p (similar to [Regev’03]) oCode determined by an integer p  Codewords: multiples of p oGood representation: p itself oBad representation:  N = pq, and also many many x i = pq i + r i oEnc(0): subset-sum( x i ’s)+ r mod N oEnc(1): random integer mod N r i << p p N

A Different Input Encoding oBoth Enc(0), Enc(1) close to the code  Enc(0): distance to code is even  Enc(1): distance to code is odd oIn our example of integers mod p :  Enc( b ) = 2(subset-sum( x i ’s )+ r ) + b mod N  Dec( c ) = ( c mod p ) mod 2 June 16,

June 16, Additive Homomorphism oc 1 +c 2 = (codeword 1 + codeword 2 ) +2(r 1 +r 2 )+b 1 +b 2  codeword 1 + codeword 2  Code  If 2(r 1 +r 2 )+b 1 +b 2 < min-dist/2, then it is the dist( c 1 +c 2, Code ) = 2(r 1 +r 2 )+b 1 +b 2  dist( c 1 +c 2, Code ) mod 2 = b 1 +b 2 oAdditively-homomorphic while close to Code

June 16, Step 2: ECC Lives in a Ring R oWhat happens when multiplying in R :  c 1 c 2 = (codeword 1 +2r 1 +b 1 ) x (codeword 2 +2r 2 +b 2 ) = codeword 1 X + Y codeword 2 + ( 2r 1 +b 1 )( 2r 2 +b 2 ) oIf:  codeword 1 X + Y codeword 2  Code  ( 2r 1 +b 1 )( 2r 2 +b 2 ) < min-dist/2 oThen  dist( c 1 c 2, Code ) = ( 2r 1 +b 1 )( 2r 2 +b 2 ) = b 1 b 2 mod 2 Code is an ideal Product in R of small elements is small

Instantiations o[Gentry ‘09] Polynomial Rings  Security based on hardness of “Bounded-Distance Decoding” in ideal lattices o[vDGHV ‘10] Integer Ring  Security based on hardness of the “approximate- GCD” problem o[GHV ‘10] Matrix Rings*  Only degree-2 polynomials, security based on hardness of “Learning with Errors” o[BV ‘11a] Polynomial Rings  Security based on “ring LWE” June 16,

June 16, Integers Rings [vDGHV’10] oRecall mod- p scheme: c i = q i p + 2r i +b i (mod N = qp )  Parameters: |r i |=n, |p|=n 2, |q|=|q i |=n 5 oc 1 +c 2 mod N = ( q 1 +q 2 ) p + 2( r 1 +r 2 )+( b 1 +b 2 )  N  sum mod p = 2( r 1 +r 2 ) + ( b 1 +b 2 ) oc 1 x c 2 mod N = ( c 1 q 2 +q 1 c 2  q 1 q 2 )p  N + 2 ( 2r 1 r 2 +r 1 m 2 +m 1 r 2 ) + b 1 b 2  product mod p = 2 ( 2r 1 r 2 + …) + b 1 b 2 oCan evaluate polynomials of degree ~ n before the distance from Code exceeds p /2

June 16, Integers Rings [vDGHV’10] Thm: “Approximate GCD” is hard  Enc(0), Enc(1) are indistinguishable oApprixmate-GCD: Given N = qp and many x i = pq i + r i, hard to recover p

June 16, Polynomial Rings [G’09] oR = polynomial ring modulo some f(x)  E.g., f(x) = x n +1 o Code is an ideal in R  E.g., random g(x), Code g = { g x h mod f : h  R }  Code is also a lattice  Good representation: g itself  Bad representation: Hermite-Normal-Form oIf g has t -bit coefficients, can evaluate polynomials of degree O( t/log n )

June 16, Polynomial Rings [G’09, G’10] Thm: If Bounded-Distance Decoding in ideal lattices is hard, then Enc(0), Enc(1) are indistinguishable oBounded-Distance-Decoding: Given x close to the lattice, find dist( x, lattice)

June 16, Matrix Rings* [GHV’10] o R = ring of m x m matrices over Z q  q = poly( n ), m > n log q ( n security-parameter) o C has low-rank matrices mod q (rank= n )  A is a random n x m matrix, C A = { AX : X  R }  Bad representation: A itself  Good representation: full rank T m x m (over Z ), small entries, TA = 0 mod q Problem: C A is left-ideal, but not right-ideal Can still evaluate quadratic formulas, no more *Doesn’t quite fit the mold

June 16, Matrix Rings* [GHV’10] Thm: Learning with Errors hard  Enc(0), Enc(1) are indistinguishable oLearning with Errors: Given A, Ax + e (random A,x, small error e ), find x *Doesn’t quite fit the mold

June 16, Step 3: Bootstrapping [G’09] oSo far, can evaluate low-degree polynomials P(x 1, x 2, …, x t ) x1x1 … x2x2 xtxt P

June 16, Step 3: Bootstrapping [G’09] oSo far, can evaluate low-degree polynomials oCan eval y = P(x 1,x 2 …,x n ) when x i ’s are “fresh” oBut y is an “evaluated ciphertext”  Can still be decrypted  But eval Q(y) will increase noise too much P(x 1, x 2, …, x t ) x1x1 … x2x2 xtxt P

June 16, Step 3: Bootstrapping [G’09] oSo far, can evaluate low-degree polynomials oBootstrapping to handle higher degrees: oFor ciphertext c, consider D c (sk) = Dec sk ( c )  Hope: D c (  ) is a low-degree polynomial in sk  Then so are A c 1,c 2 (sk) = Dec sk ( c 1 ) + Dec sk ( c 2 ) and M c 1,c 2 (sk) = Dec sk ( c 1 ) x Dec sk ( c 2 ) x1x1 … x2x2 xtxt P P(x 1, x 2, …, x t )

June 16, M c 1,c 2 Step 3: Bootstrapping [G’09] oInclude in the public key also Enc pk ( sk ) x1x1 x2x2 sk 1 sk 2 sk n … c1c1 c2c2 M c 1,c 2 (sk) = Dec sk (c 1 ) x Dec sk (c 2 ) = x 1 x x 2 c Requires “ circular security ”

June 16, M c 1,c 2 Step 3: Bootstrapping [G’09] oInclude in the public key also Enc pk ( sk ) oHomomorphic computation applied only to the “fresh” encryption of sk x1x1 x2x2 sk 1 sk 2 sk n … c1c1 c2c2 M c 1,c 2 (sk) = Dec sk (c 1 ) x Dec sk (c 2 ) = x 1 x x 2 c Requires “ circular security ”

June 16, Step 4: Everything Else oCryptosystems from [G’09, vDGHV’10, BG’11a] cannot handle their own decryption oTricks to “squash” the decryption procedure, making it low-degree

Performance oEvaluating only low-degree polynomials may be reasonable oBut bootstrapping is inherently inefficient  Homomorphic decryption for each multiplication oBest implementation so far is [GH’11a]  Public key size ~ 2GB  Evaluating a multiplication takes 30 minutes June 16,

Beyond the [G’09] Blueprint o[GH’11b] no “squashing”, still very inefficient o[BV’11b] no underlying ring, only vectors  Also no “squashing”, but still inefficient o[G’11] no bootstrapping  Builds heavily on [BV’11b]  Reduces noise “cheaply” after each multiplication  Should be at least 2-3 orders of magnitude better than [GV’11a] June 16,

Homomorphic Encryption vs. Secure Computation

June 16, Client Alice has data x Server Bob has function f Alice wants to learn f(x) 1.Without telling Bob what x is 2.Bob may not want Alice to know f 3.Client Alice may also want server Bob to do most of the work computing f(x) Secure Function Evaluation (SFE)

June 16, Two-Message SFE [Yao’82,…] oMany different instantiations are available  Based on hardness of factoring/DL/lattices/… oAlice’s x and Bob’s f are kept private oBut Alice does as much work as Bob  Bob’s reply of size poly( n ) x (| f |+| x |) ( c,s )  SFE1( x ) r  SFE2( f,c ) r y  SFE3( s,r ) c Alice( x )Bob( f )

June 16, oH = { KeyGen, Enc, Dec, Eval } oSemantic security: ( pk, Enc pk (0))  ( pk, Enc pk (1)) oHomomorphic: Dec sk (Eval pk ( f, Enc pk ( x ))) = f ( x )  c* may not look like a “fresh” ciphertext  As long as it decrypts to f(x) oFunction-private: c* hides f oCompact: Decrypting c* easier than computing f  | c* | independent of the complexity of f Recall: Homomorphic Encryption c*c*

June 16, Aside: a Trivial Solution oEval( f,c ) =, Dec*( ) = f (Dec( c )) oNeither function-private, nor compact oNot very useful in applications

June 16, HE  Two-Message SFE oAlice encrypts data x  sends to Bob c  Enc( x ) oBob computes on encrypted data  sets c*  Eval( f, c )  c* is supposed to be an encryption of f ( x )  Hopefully it hides f (function-private scheme) oAlice decrypts, recovers y  Dec( c* )

June 16, Two-Message SFE  HE oRoughly:  Alice ’ s message c  SFE1( x ) is Enc( x )  Bob’s reply r  SFE2( f, c ) is Eval( f, c ) oNot quite public-key encryption yet  Where are ( pk, sk )?  Can be fixed with an auxiliary PKE scheme

June 16, Alice( x ) Two-Message SFE  HE oAdd an auxiliary encryption scheme  with ( pk,sk ) Alice( pk, x )Bob( f ) ( c,s )  SFE1( x ) r  SFE2( f,c ) r y  SFE3( s,r ) c Dora( sk )

June 16, Two-Message SFE  HE oRecall: | r | could be as large as poly( n )(| f |+| x |)  Not compact Alice( pk, x )Bob( f )Dora( sk ) Dec sk ( r,c ’) Eval pk ( f, c,c ’) Enc’ pk ( x ) c, c ’ r, c ’ ( c,s )  SFE1( x ) c ’  Enc pk ( s ) r  SFE2( f,c ) s  Dec sk ( c ’) y  SFE3( s,r )

June 16, A More Complex Setting: i-Hop HE [GHV’10b] oc 1 is not a fresh ciphertext  May look completely different oCan Charlie process it at all?  What about security? Alice( x )Bob( f )Charlie( g )Dora( sk ) c 0  Enc( x ) c 1  Eval( f,c 0 ) c 2  Eval( g,c 1 ) y  Dec( c 2 ) c0c0 c1c1 c2c2 2-Hop Homomorphic Encryption

June 16, Multi-Hop Homomorphic Encryption oH = { KeyGen, Enc, Eval, Dec } as before oi -Hop Homomorphic ( i is a parameter)  y = f j (f j  1 (… f 1 (x) …)) for any x, f 1,…,f j oSimilarly for i -Hop function-privacy, compactness oMulti-Hop: i -Hop for any i Eval pk ( f 1,c 0 )Enc pk ( x )Eval pk ( f 2,c 1 )Dec sk ( x ) c0c0 c1c1 c2c2 cjcj yx … Any number j  i hops

June 16, Hop  multi-Hop HE o(KeyGen,Enc,Eval,Dec) is 1-Hop HE  Can evaluate any single function on ctxt oWe have c 1 =Eval pk (f 1,c 0 ), and some other f 2 Bootstrapping: oInclude with pk also c*= Enc pk ( sk ) oConsider F c 1, f 2 (sk) = f 2 ( Dec sk (c 1 ) )  Let c 2 =Eval pk (F c 1, f 2, c*)

June 16, F c i-1, f i 1-Hop  multi-Hop HE oDrawback: | c i | grows exponentially with i :  | F c i  1, f i |  | c i  1 |+| f i |  | c i |= |Eval pk ( F c i  1, f i, c* )|  poly(n)(| c i  1 |+| f i |) oDoes not happen if underlying scheme is compact Or even |Eval pk ( F c i  1, f i, c* )| = | c i  1 |+poly(n)| f i | x i-1 sk ci1ci1 fifi F c i-1, f i (sk) c i+1 = f i ( Dec sk (c i  1 ) ) = f i (x i  1 ) c*c*

June 16, Other Constructions oPrivate 1-hop HE + Compact 1-hop HE  Compact, Private 1-hop HE  Compact, Private multi-hop HE oA direct construction of multi-hop HE from Yao’s protocol

June 16, Summary oHomomorphic Encryption is useful  Especially multi-hop HE oA method for constructing HE schemes from linear ECCs in rings  Two (+  ) known instances so far oConnection to two-message protocols for secure computation

Thank You