SLIDE 4 Homomorphic Encryption
A Standard Cryptosystem S (symmetric or asymmetric) For a given security parameter λ, we have algorithms K(. . . ) for key generation E(. . . ) for encryption D(. . . ) for decryption These need to run in time poly(λ). A Homomorphic Cryptosystem S (symmetric or asymmetric) For a given security parameter λ, we have algorithms K, E, D, and Eval(key, f, c1, . . . , cn), where f is a program each ci = E(key, mi) for some mi c = Eval(key, f, c1, . . . , cn) is of size ≤ the size of the ci’s (compactness) D(key′, c) = f(m1, . . . , mn) Eval is “efficient” (details forthcoming)
2018-11-29
Fully Homomorphic Encryption 11 / 21[width=8cm] Homomorphic Encryption
- The compactness requirement avoids checking by moving the
computation off to D.
- If f’s output is a k-tuple (c′
1, . . . , c′ k),
then each c′
i is of size ≤ the sizes of the cj’s
D(key′, Eval(key, f, c1, . . . , cn)) = f(m1, . . . , mn)
the program f is a boolean or arithmetic circuit Why a circuit? It breaks the computation into simple steps. Eval is “efficient”, i.e., time ≤ (the size of the circuit f) × poly(λ) Eval cannot be very efficient in other regards. Example: Answering “Is x in table T?” by binary search What is the input? x and T Binary search runs in O((size of x) × log2(size of T)) time ... but not when Eval runs it!! Semantic security dictates that Eval’s output must be sensitive to all the input bits.
∴ O((size of x) × (size of T)) run time at best.
Now promote T to a big fat data base.
Jim Royer Fully Homomorphic Encryption 12 / 21
D(key′, Eval(key, f, c1, . . . , cn)) = f(m1, . . . , mn)
the program f is a boolean or arithmetic circuit Why a circuit? It breaks the computation into simple steps. Eval is “efficient”, i.e., time ≤ (the size of the circuit f) × poly(λ) Eval cannot be very efficient in other regards. Example: Answering “Is x in table T?” by binary search What is the input? x and T Binary search runs in O((size of x) × log2(size of T)) time ... but not when Eval runs it!! Semantic security dictates that Eval’s output must be sensitive to all the input bits.
∴ O((size of x) × (size of T)) run time at best.
Now promote T to a big fat data base.
2018-11-29
Fully Homomorphic Encryption 12 / 21[width=8cm] D(key′, Eval(key, f, c1, . . . , cn)) = f(m1, . . . , mn)
- “Binary search” is a bit of a red herring . . .
- Since your program is a circuit, it can be very parallel.
- So there are other reasonable techniques to use for a search.
A Somewhat Homomorphic Scheme, 1
A symmetric version.
(Don’t worry, there is a picture on the next slide.)
For security parameter λ:
K(λ) = p, a random λ2-bit odd integer > 0 E(p, b) = p · q + (2r + b) a near multiple of p where q = a random λ5-bit number r = a random (λ − 1)-bit number b ∈ { 0, 1 } the secret bit D(p, c) = (c mod ′ p) mod 2, where − p
2 < (c mod ′ p) < p 2
and (c − (c mod ′ p)) = p · u for some integer u. Eval(p, f, c1, . . . , cn) = f ‡(c1, . . . , cn) where f is a boolean circuit using XOR and AND gates f ‡ = f[XOR → +, AND → ∗] = a poly over c1, . . . , cn
Jim Royer Fully Homomorphic Encryption 13 / 21
