David Cash (UCSD) Dennis Hofheinz (KIT) Eike Kiltz (CWI) Chris Peikert (GA)

Slides:

Advertisements

Similar presentations

Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption Allison Lewko Tatsuaki Okamoto Amit Sahai The.

Advertisements

Efficient Lattice (H)IBE in the standard model Shweta Agrawal, Dan Boneh, Xavier Boyen.

Boneh-Franklin Identity-based Encryption. 2 Symmetric bilinear groups G = ágñ, g p = 1 e: G G G t Bilinear i.e. e(u a, v b ) = e(u, v) ab Non-degenerate:

Simulation-sound NIZK Proofs for a Practical Language and Constant Size Group Signatures Jens Groth University of California Los Angeles Presenter: Eike.

Adaptively Attribute-Hiding ( Hierarchical ) Inner Product Encryption

Fast Cryptographic Primitives & Circular-Secure Encryption Based on Hard Learning Problems Benny Applebaum, David Cash, Chris Peikert, Amit Sahai Princeton.

A Black-Box Construction of a CCA2 Encryption Scheme from a Plaintext Aware (sPA1) Encryption Scheme Dana Dachman-Soled University of Maryland.

Securing Critical Unattended Systems with Identity Based Cryptography A Case Study Johannes Blömer, Peter Günther University of Paderborn Volker Krummel.

An Introduction to Pairing Based Cryptography Dustin Moody October 31, 2008.

Lattices, Cryptography and Computing with Encrypted Data

Chosen-Ciphertext Security from Slightly Lossy Trapdoor Functions PKC 2010 May 27, 2010 Petros Mol, Scott Yilek 1 UC, San Diego.

See you at the next conference! Hope you like our slides Hello everybody!

BY JYH-HAW YEH COMPUTER SCIENCE DEPT. BOISE STATE UNIVERSITY Proxy Credential Forgery Attack to Two Proxy Signcryption Schemes.

Advanced Security Constructions and Key Management Class 16.

Enumerative Lattice Algorithms in any Norm via M-Ellipsoid Coverings Daniel Dadush (CWI) Joint with Chris Peikert and Santosh Vempala.

Dan Boneh Public key encryption from Diffie-Hellman ElGamal Variants With Better Security Online Cryptography Course Dan Boneh.

Requirements for a Secure Voting System  Only authorized voters can vote  No one can vote more than once  No one can determine for whom anyone else.

Dual System Encryption: Concept, History and Recent works Jongkil Kim.

The Learning With Errors Problem Oded Regev Tel Aviv University (for more details, see the survey paper in the proceedings) Cambridge, 2010/6/11.

Public-Key Encryption in the Bounded-Retrieval Model Joël Alwen, Yevgeniy Dodis, Moni Naor, Gil Segev, Shabsi Walfish, Daniel Wichs Earlier Today: Yevgeniy.

Dual System Encryption: Realizing IBE and HIBE from Simple Assumptions Brent Waters.

Dennis Hofheinz, Jessica Koch, Christoph Striecks

Lattice-Based Cryptography. Cryptographic Hardness Assumptions Factoring is hard Discrete Log Problem is hard  Diffie-Hellman problem is hard  Decisional.

Simple Lattice Trapdoor Sampling from a Broad Class of Distributions Vadim Lyubashevsky and Daniel Wichs.

Lattice-Based Cryptography

Identity Based Encryption

Oded Regev Tel-Aviv University On Lattices, Learning with Errors, Learning with Errors, Random Linear Codes, Random Linear Codes, and Cryptography and.

Strongly Secure Certificateless Encryption Alexander W. Dent Information Security Group

Lattice-Based Cryptography

Mid-term Review Network Security. Secure channel SSL (and many others:incl. IPSEC) Shared key establishing Trusted party (Kerberos, etc. - to be covered)

ON THE PROVABLE SECURITY OF HOMOMORPHIC ENCRYPTION Andrej Bogdanov Chinese University of Hong Kong Bertinoro Summer School | July 2014 based on joint work.

On Everlasting Security in the Hybrid Bounded Storage Model Danny Harnik Moni Naor.

A Brief History of Provable Security and PKE Alex Dent Information Security Group Royal Holloway, University of London.

Realizing Hash and Sign Signatures under Standard Assumptions Realizing Hash and Sign Signatures under Standard Assumptions Susan Hohenberger Johns Hopkins.

ElGamal Public Key Cryptography CS 303 Alg. Number Theory & Cryptography Jeremy Johnson Taher ElGamal, "A Public-Key Cryptosystem and a Signature Scheme.

Functional Encryption: An Introduction and Survey Brent Waters.

Identity Based Encryption Debdeep Mukhopadhyay Associate Professor Dept of Computer Sc and Engg, IIT Kharagpur.

ID-Based Encryption for Complex Hierarchies with Applications to Forward Security and Broadcast Encryption Danfeng Yao Nelly Fazio Brown University New.

1 Hierarchical Identity-Based Encryption with Constant Size Ciphertext Dan Boneh, Xavier Boyen and Eu-Jin Goh Eurocrypt 2005 投影片製作：張淑慧.

Cyrtographic Security Identity-based Encryption 1Dennis Kafura – CS5204 – Operating Systems.

A Linear Lower Bound on the Communication Complexity of Single-Server PIR Weizmann Institute of Science Israel Iftach HaitnerJonathan HochGil Segev.

Vadim Lyubashevsky INRIA / ENS, Paris

Lattice-Based Cryptography: From Practice to Theory to Practice Vadim Lyubashevsky INRIA / CNRS / ENS Paris (September 12, 2011)

Better Key Sizes (and Attacks) for LWE-Based Encryption Richard LindnerChris Peikert.

Definition and applications Lossy Trapdoor Functions 2.

Controlled Algebras and GII’s Ronald L. Rivest MIT CSAIL IPAM Workshop October 9, 2006.

Public Key Encryption with keyword Search Author: Dan Boneh Rafail Ostroversity Giovanni Di Crescenzo Giuseppe Persiano Presenter: 陳昱圻.

1 Lossy Trapdoor Functions and Their Applications Brent Waters SRI International Chris Peikert SRI International.

Polynomially Homomorphic Signatures Dan Boneh Stanford University Joint work with David Freeman.

Identity based signature schemes by using pairings Parshuram Budhathoki Department of Mathematical Science FAU 02/21/2013 Cyber Security Seminar, FAU.

Fall, Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Cryptographic Security Identity-Based Encryption.

Lattice-based cryptography and quantum Oded Regev Tel-Aviv University.

1 Efficient Ring Signatures Without Random Oracles Hovav Shacham and Brent Waters.

Based on work with: Sergey Gorbunov and Vinod Vaikuntanathan Homomorphic Commitments & Signatures Daniel Wichs Northeastern University.

1 Efficient Selective-ID IBE Without Random Oracle Dan Boneh Stanford University Xavier Boyen Voltage Security.

1/28 Chosen-Ciphertext Security from Identity- Based Encryption Jonathan Katz U. Maryland Ran Canetti, Shai Halevi IBM.

1 Lossy Trapdoor Functions and Their Applications Brent Waters SRI International Chris Peikert SRI International.

1 Compact Group Signatures Without Random Oracles Xavier Boyen and Brent Waters.

Ilya Mironov, Omkant Pandey, Omer Reingold, Gil Segev Microsoft Research.

Impossibility proofs for RSA signatures in the standard model Pascal Paillier Topics in Cryptology – CT-RSA 2007.

On Bounded Distance Decoding, Unique Shortest Vectors, and the

Background: Lattices and the Learning-with-Errors problem

Shorter Quasi-Adaptive NIZK Proofs for Linear Subspaces

Introduction to Symmetric-key and Public-key Cryptography

Pre-image Resistance: Given a, hard to find b such that ____

Masayuki Fukumitsu Hokkaido Information University, Japan

On the Efficiency of 2 Generic Cryptographic Constructions

Lossy Trapdoor Functions and Their Applications

The power of Pairings towards standard model security

Identity Based Encryption from the Diffie-Hellman Assumption

Presentation transcript:

David Cash (UCSD) Dennis Hofheinz (KIT) Eike Kiltz (CWI) Chris Peikert (GA)

This work: crypto from lattices 1.Bonsai trees for lattices/basis delegation 2.Applications: new lattice primitives – Hash-and-sign signatures (standard model) – IBE (standard model) – Hierarchical IBE (random oracle model) – Hierarchical IBE (standard model) Independently discovered by [AB09]!

PairingsLattices BF01: IBE ROM BF01: IBE ROM GS02: HIBE ROM GS02: HIBE ROM CHK03: HIBE Selective secure, bit-by-bit CHK03: HIBE Selective secure, bit-by-bit BB04: HIBE Selective secure, Identity at once BB04: HIBE Selective secure, Identity at once Waters05: HIBE Fully secure Waters09: HIBE Fully secure, poly depth Waters09: HIBE Fully secure, poly depth GPV08: IBE ROM GPV08: IBE ROM NEW: HIBE ROM NEW: HIBE ROM HEW: HIBE Selective secure, bit-by-bit HEW: HIBE Selective secure, bit-by-bit ABB10: HIBE Selective secure, Identity at once ABB10: HIBE Selective secure, Identity at once B10/ABB10 HIBE Fully secure You??? HIBE Fully secure, poly depth You??? HIBE Fully secure, poly depth Basis delegation Random oracle model Standard model

Integer lattices A A m  2n  lg(q) n (q,0) (0,q)

Random basis for A Integer lattices A A Non-short basis for L  (A)

Short basis for A Integer lattices A A Short basis for L  (A) [Ajtai96]

A A Encryption from lattices [Regev05, GPV08] A A Secret Key: Short basis for L  (A) Encrypt/decrypt: via “trapdoor function” f A associated to matrix A Security: Learning with errors Encrypt/decrypt: via “trapdoor function” f A associated to matrix A Security: Learning with errors

Bonsai Trees Ancient art of bonsai Techniques for selective control of a tree by arborist Cryptographic bonsai Tree = hierarchy of trapdoor functions Arborist= setup/simulator controls 2 types of growth 1.Undirected growth: no privileged information 2.Controlled growth: privileged information Property: extending control down hierarchy (not up) A A A A

Central new technique: lattice basis delegation A1A1 A1A1 A 1, A 2, short basis for L  (A 1 ) A2A2 A2A2 Basis delegation Short basis for (any) higher- dim. super-lattice L  (A 12 ) A 12 A2A2 A1A1 hard A3A3 A3A3 A2A2 A1A1 A3A3 A 312

Bonsai trees: hierarchy of trapdoor functions

f A 1256 fA1fA1 fA1fA1 f A 125 f A 1234 f A 12 f A 123 Hierarchy of trapdoor functions A1A1 A1A1 A 12 A 123 A 1234 m-dim lattice L  (A 1 ) 2m-dim lattice L  (A 12 ) 4m-dim lattice L  (A 1234 ) A1A1 A1A1 A2A2 A2A2 A3A3 A3A3 A5A5 A5A5 A4A4 A4A4 A6A6 A6A6 A m-dim lattice L  (A 113 ) A1A1 A1A1 4m-dim lattice L  (A 1256 )

f A 1256 fA1fA1 fA1fA1 f A 125 f A 1234 f A 12 f A 123 A1A1 A1A1 A2A2 A2A2 A3A3 A3A3 A5A5 A5A5 A4A4 A4A4 A6A6 A6A6 fA1fA1 fA1fA1 f A 12 f A 1256 f A 125 f A 1234 f A 123 f A 12 f A 1234 f A 123 A1A1 A1A1 A2A2 A2A2 A1A1 A1A1 A2A2 A2A2 A3A3 A3A3 A4A4 A4A4 A5A5 A5A5 Short basis delegation to any higher-dim super-lattice A1A1 A1A1 A 12 A 123 A 125 A 12 A 123 A 1234 A 125 A1A1 A1A1 no trapdoor trapdoor undirected growth controlled growth A 1256 A2A2 A5A5 Hierarchy of trapdoor functions

Application 1: Hierarchical IBE (random oracles)

A A Hierarchical ID-based encryption (ROM) Master Secret Key: Short basis for L  (A) … A ID A A H(ID 1 ) A A Encrypt to ID: Use TDF f A ID associated to matrix A ID A ID Secret Key for ID: Short basis for L  (A ID ) A ID’ H(ID 1,..,ID k ) H(ID 1,…,ID k ) Encrypt to hierarchical identities ID=(ID 1,…,ID k )  IDSpace k Secret key delegation ID’  ID: “controlled growth” A

Application 2: IBE (standard model)

ID-based encryption (standard model) Master Secret Key: Short basis for L  (A 10 ) and L  (A 11 ) A 10 A 11 A 20 A 21 A k1 A k0 … A 10 A 11 A 10 A 20 A k0 ID 0 =0 ID 1 =1 ID k =0 … … A 11 A 21 A k1 … Encrypt to ID  {0,1} k : Use TDF f A ID associated to matrix A ID Secret Key for ID’: Short basis for L  (A ID’ ) A ID A 10 A k0 A ID’ A 21 A 10 A 11 A 20 A 21 A k1 A k0 … Security reduction (selective-ID security) A 10 A 11 A 20 A 21 A k1 A k0 … Master Secret Key: all-but-one setup ID=challenge ID  ID Remarks: Extends to Hierarchical IBE (standard model) Full security (constant depth) using [BB04b] Remarks: Extends to Hierarchical IBE (standard model) Full security (constant depth) using [BB04b]

Hash and sign signatures (standard model) Master Secret Key: Short basis for L  (A 10 ) and L  (A 11 ) A 10 A 11 A 20 A 21 A k1 A k0 … A 10 A 11 Sign M  {0,1} k : Invert TDF f A M associated to matrix A M with short basis for L  (A M ) A 10 A k0 AMAM AMAM A 21 Full UF-CMA security: Add chameleon hash Proof adapts “prefix- simulation” technique [HW09] Full UF-CMA security: Add chameleon hash Proof adapts “prefix- simulation” technique [HW09]

Conclusions Bonsai trees/basis delegation Applications: HIBE/signatures Follow-up work: Improved efficiency of HIBE/sigs [ABB10, B10] Alternative basis delegation [ABB10b] More crypto primitives [R10, WB10, …]