Lattices: …to Cryptography - CSE-IITM

Trick #2: Inverting an Easy Function

I A special parity-check matrix: letg^t= [1 2 4 · · · 2^{k 1} ₂^q]and

G= 2 66 64

· · ·g^t· · ·

· · ·g^t· · · . ..

· · ·g^t· · · 3 77

752Z^n⇥nkq .

8 / 12

Define

Put G in Ciphertext ) FHE

^[GSW’13]

I Secret key s2Zⁿ, public keyA satisfiess^tA⇡0.

I Encrypt µ2{0,1} asC=AR+µG. Decryption relation is s^tC⇡µ·s^tG.

I Homomorphic mult: C_⇥=C₁·G ¹(C₂).

s^tC_⇥=s^tC1·G ¹(C2)

⇡µ₁·s^tG·G ¹(C₂)

⇡µ₁µ₂·s^tG

Error in C_⇥ is e^t₁·G ¹(C₂) +µ₁·e^t₂.

Asymmetry allows homom mult with additive noise growth. [BV’13]

11 / 12

Put G in Ciphertext ) FHE

^[GSW’13]

I Secret key s2Zⁿ, public keyA satisfiess^tA⇡0.

I Encrypt µ2{0,1} asC=AR+µG. Decryption relation is s^tC⇡µ·s^tG.

I Homomorphic mult: C_⇥=C₁·G ¹(C₂).

s^tC_⇥=s^tC1·G ¹(C2)

⇡µ₁·s^tG·G ¹(C₂)

⇡µ₁µ₂·s^tG

Error in C_⇥ is e^t₁·G ¹(C₂) +µ₁·e^t₂.

Asymmetry allows homom mult with additive noise growth. [BV’13]

11 / 12

Put G in Ciphertext ) FHE

^[GSW’13]

I Secret key s2Zⁿ, public keyA satisfiess^tA⇡0.

I Encrypt µ2{0,1} asC=AR+µG. Decryption relation is s^tC⇡µ·s^tG.

I Homomorphic mult: C_⇥=C₁·G ¹(C₂).

s^tC_⇥=s^tC₁·G ¹(C₂)

⇡µ₁·s^tG·G ¹(C₂)

⇡µ₁µ₂·s^tG

Error in C_⇥ is e^t₁·G ¹(C₂) +µ₁·e^t₂.

Asymmetry allows homom mult with additive noise growth. [BV’13]

11 / 12

Put G in Ciphertext ) FHE

^[GSW’13]

I Secret key s2Zⁿ, public keyA satisfiess^tA⇡0.

I Encrypt µ2{0,1} asC=AR+µG. Decryption relation is s^tC⇡µ·s^tG.

I Homomorphic mult: C_⇥=C₁·G ¹(C₂).

s^tC_⇥=s^tC₁·G ¹(C₂)

⇡µ₁·s^tG·G ¹(C₂)

⇡µ₁µ₂·s^tG

Error in C_⇥ is e^t₁·G ¹(C₂) +µ₁·e^t₂.

Asymmetry allows homom mult with additive noise growth. [BV’13]

11 / 12

Put G in Ciphertext ) FHE

^[GSW’13]

I Secret key s2Zⁿ, public keyA satisfiess^tA⇡0.

I Encrypt µ2{0,1} asC=AR+µG. Decryption relation is s^tC⇡µ·s^tG.

I Homomorphic mult: C_⇥=C₁·G ¹(C₂).

s^tC_⇥=s^tC₁·G ¹(C₂)

⇡µ₁·s^tG·G ¹(C₂)

⇡µ₁µ₂·s^tG

Error in C_⇥ is e^t₁·G ¹(C₂) +µ₁·e^t₂.

Asymmetry allows homom mult with additive noise growth. [BV’13]

11 / 12