In conclusion, if A makes a forgery, then B can solve the SISn,k,q,βSIS problem except for negligible probability. Therefore, we may write
AdvMDHAT,A (λ) =AdvGameA 0(λ)
≤AdvGameA 0,Game1(λ) +AdvGameA 1(λ)
≤AdvF(λ) +AdvSISB (λ) +negl(λ).
!
bitwisely described programP¯j′for all j′∈[n], then sinceπi,1, . . . ,πi,nare projection circuits such thatπi,j#
(bi′,j′)(i′,j′)∈[l]×[n]$
=bi,jfor j∈[n], we see thatT¯.Eval(ek,∆,π¯i,(m¯1,σ¯1), . . . ,(m¯l,σ¯l)) = σ¯ifrom the projection preservation of T .
Remark 11 If T supports efficient verification, then Construction 3 also supports efficient verification with followingT¯.PrepandT¯.EffVerify.
• T¯.Prep#sk,¯ P¯$
: parseP¯=#f¯,τ1, . . . ,τl$
andf¯= (f1, . . . ,fn). Let Pi:=+
fi,((τs,t))(s,t)∈[l]×[n], for i∈[n]. Compute skPi ←T.Prep(sk,Pi)for i∈[n]. Outputsk¯P¯:=skP1+. . .+skPn.
• T¯.EffVerify#sk¯P¯,∆,m,¯ σ¯$
: parse given inputs sk¯P¯:=skP1+. . .+skPn, m¯ =〈m1, . . . ,mn〉andσ¯ = σ1+. . .+σn. If1←T.EffVerify(skPi,∆,mi,σi)for all i∈[n], then output 1. Otherwise, output 0.
Note thatT¯.EffVerify#
T.Prep#sk,¯ P¯$
,∆,m,¯ σ¯$
=T¯.Verify#sk,¯ P,¯ ∆,m,¯ σ¯$
where#ek,¯ sk¯$
←T¯.KeyGen(1λ).
Also, from the amortized efficiency of T , the complexity ofT¯.EffVerifyis independent of the time com- plexity of computing input P. In other words,¯ T supports efficient verification if T supports efficient¯ verification.
Theorem 3 If T is a selectively secure MDHA, thenT is a selectively secure BE-MDHA.¯
Proof 3 Let A be any PPT adversary ofT in¯ GameMDHAT,A¯ that makes at most q queries. Then there is a PPT algorithm B that makes nq queries such that
AdvMDHAT¯,A (λ)≤AdvMDHAT,B (λ)
We construct such algorithm B that runs A internally as follows (written in A’s perspective):
Selective Queries
A makes selective queries((∆i,τi,m¯i))i∈[q]. If (∆i,τi) = (∆i′,τi′) for distinct i,i′∈[q], then B rejects the queries. Otherwise, B parses m¯i =〈mi,1, . . . ,mi,n〉 for i∈[q] and makes selective queries ((∆i,(τi,j),mi,j))(i,j)∈[q]×[n]to the challenger.
Initialization and Response
The challenger generates a key pair(ek,sk)←T.KeyGen(1λ), computesσi,j←T.Auth(sk,∆i,(τi,j),mi,j) for all(i,j)∈[q]×[n]and sends(ek,ST)to B where ST:=0(∆i,(τi,j),mi,j,σi,j)1
(i,j)∈[q]×[n]. Then, B letsek¯ :=ek,σ¯i:= (σi,1, . . . ,σi,n)for i∈[q]and sends(ek,S)¯ to A where S:={(∆i,τi,m¯i,σ¯i)}i∈[q]. Finalization
A outputs a forgery attempt (∆∗,P¯∗,m¯∗,σ¯∗) such thatm¯∗=〈m∗1, . . . ,m∗n〉, σ¯∗= (σ1∗, . . . ,σn∗) and for the fully bound bitwisely described sub-programP¯∗′=#f¯∗= (f1∗, . . . ,fn∗),τ1∗, . . . ,τl∗$
ofP¯∗, there is(∆∗,τi∗,m¯∗i,σ¯i∗)∈S for some (unique)m¯∗i ∈M¯andσ¯i∗∈Σ¯ for all i∈[l]. B then computesm¯∗∗:=
〈m∗∗1 , . . . ,m∗∗n 〉=P¯∗′(m¯∗1, . . . ,m¯∗l)andσ¯∗∗:= (σ1∗∗, . . . ,σn∗∗)←T¯.Eval#ek,¯ f¯∗,(m¯∗1,σ¯1∗), . . . ,#
¯ m∗l,σ¯l∗$$
.
If the calculated message-tag pair is different from the forgery attempt,(m¯∗,σ¯∗)∕= (m¯∗∗,σ¯∗∗), then B outputs
#∆∗,#
fi∗∗,((τs,t))(s,t)∈[l]×[n]$
,m∗i∗,σi∗∗$
as a forgery attempt where i∗is the smallest number of the nonempty set{j|(m∗j,σ∗j)∕= (m∗∗j ,σ∗∗j )}.
Otherwise, B outputs nothing and halts.
Note that in A’s perspective, B acts exactly the same as the adversary ofGameMDHAT,A¯ (λ). Also, if the forgery attempt(∆∗,P¯∗,m¯∗,σ¯∗)that A made is a forgery, then since 1←T¯.Verify(sk¯,∆∗,P¯∗,m¯∗,σ¯∗), we have1←T.Verify(sk,∆∗,Pi∗∗,m∗i∗,σi∗∗)where Pi∗∗ :=#
fi∗∗,((τs,t))(s,t)∈[l]×[n]$
for i∗defined as above.
Therefore,(∆∗,Pi∗∗,m∗i∗,σi∗∗)becomes a forgery of T . In other words, B wins if A outputs a forgery, and we may write
AdvMDHAT,A¯ (λ)≤AdvMDHAT,B (λ).
!
VIII Conclusion
In this work, we have proposed a new security notion for HAEs that implies privacy and authenticity at the same time. Our new security notion satisfies all the previous security notions for HAEs. To make an FHAE that satisfies the new security notion, we have designed a generic construction that combines FHE and MDFHA.
Our construction is essentially an homomorphic version of the encrypt-then-authenticate construc- tion, while we added another authentication independent of the message for our stronger security defi- nition.
Fully homomorphic encryptions and fully homomorphic authenticators typically have very large ci- phertext expansion, and their real-life, practical performance is sometimes not so satisfactory. Since our construction follows the ‘encrypt-then-authenticate’ paradigm, our construction has large cipher- text expansion and less-than-ideal performances, while it is true that existing FHA schemes supporting amortized efficiency and satisfying adaptive security have similar imperfections. Our FHAE gives extra data privacy for free, with asymptotically comparable performance as those FHA schemes.
It would be a very interesting open problem to construct more efficient FHAE schemes than our current generic composition.
References
[1] R. L. Rivest, L. Adleman, and M. L. Dertouzos, “On data banks and privacy homomorphisms,”
Proc. FOCS, vol. 4, pp. 169–180, 1978.
[2] C. Gentry, “Fully homomorphic encryption using ideal lattices,” in Proc. STOC, 2009, pp. 169–
178.
[3] R. Gennaro and D. Wichs, “Fully homomorphic message authenticators,” inProc. ASIACRYPT, Part II, 2013, pp. 301–320.
[4] S. Gorbunov, V. Vaikuntanathan, and D. Wichs, “Leveled fully homomorphic signatures from stan- dard lattices,” inProc. STOC, 2015, pp. 469–477.
[5] C. Joo and A. Yun, “Homomorphic authenticated encryption secure against chosen-ciphertext at- tack,” inProc. ASIACRYPT, Part II, 2014, pp. 173–192.
[6] C. Gentry, A. Sahai, and B. Waters, “Homomorphic encryption from learning with errors:
conceptually-simpler, asymptotically-faster, attribute-based,” inProc. CRYPTO, Part I, 2013, pp.
75–92.
[7] X. Boyen, X. Fan, and E. Shi, “Adaptively secure fully homomorphic signatures based on lattices,”
Cryptology ePrint Archive, Report 2014/916, 2014, https://eprint.iacr.org/2014/916.
[8] F. Luo, F. Wang, K. Wang, and K. Chen, “A more efficient leveled strongly-unforgeable fully homomorphic signature scheme,”Information Sciences, vol. 480, pp. 70–89, 2019.
[9] C. Wang, B. Wu, and H. Yao, “Leveled adaptively strong-unforgeable identity-based fully homo- morphic signatures,”IEEE Access, vol. 8, pp. 119 431–119 447, 2020.
[10] D. Catalano, D. Fiore, and L. Nizzardo, “On the security notions for homomorphic signatures,” in Proc. ACNS, 2018, pp. 183–201.
[11] P. Rogaway and T. Shrimpton, “A provable-security treatment of the key-wrap problem,” inProc.
EUROCRYPT, 2006, pp. 373–390.
[12] H. KRAWCZYK and T. Rabin, “Chameleon signatures,” inProc. NDSS, 2000, pp. 143–154.
[13] M. Ajtai, “Generating hard instances of lattice problems,” inProc. STOC, 1996, pp. 99–108.
[14] D. Micciancio, “Almost perfect lattices, the covering radius problem, and applications to Ajtai’s connection factor,”SIAM Journal on Computing, vol. 34, no. 1, pp. 118–169, 2004.
[15] D. Micciancio and O. Regev, “Worst-case to average-case reductions based on Gaussian measures,”
inProc. FOCS, 2004, pp. 372–381.
[16] D. Micciancio and C. Peikert, “Hardness of SIS and LWE with small parameters,” in Proc.
CRYPTO, Part I, 2013, pp. 21–39.
[17] M. Ajtai, “Generating hard instances of the short basis problem,” inProc. ICALP, 1999, pp. 1–9.
[18] C. Gentry, C. Peikert, and V. Vaikuntanathan, “Trapdoors for hard lattices and new cryptographic constructions,” inProc. STOC, 2008, pp. 197–206.
[19] J. Alwen and C. Peikert, “Generating shorter bases for hard random lattices,”Theory of Computing Systems, vol. 48, no. 3, pp. 535–553, 2011.
[20] D. Micciancio and C. Peikert, “Trapdoors for lattices: simpler, tighter, faster, smaller,” in Proc.
EUROCRYPT, 2012, pp. 700–718.
[21] S. Agrawal, D. Boneh, and X. Boyen, “Efficient lattice (H)IBE in the standard model,” in Proc.
EUROCRYPT, 2010, pp. 553–572.
Acknowledgements
I want to express my appreciation to my committees, Prof. Hyungon Moon, Prof. Antoine Vigneron, Prof. Miran Kim, Prof. Sang-Geun Hahn and Prof. Aaram Yun. I especially thank Prof. Aaram Yun who guided me through my graduate years and taught everything on this paper.
I also thank my family and friends for all the support and love they have given to me. Thanks to them, I could be a better person and researcher. With their help, I could overcome countless obstacles.
Without them, I could never finish this work. I will try my best to do the same for them.