In this work, we develop a methodology for determining the communication required to implement various two-party functionalities noninteractively. In the particular setting on which we focus, the protocols are based upon somewhat homomorphic encryption, and furthermore, they treat the homomorphic properties as a black box. In this setting, we develop lower bounds which give a smooth trade-off between the communication complexity and the “expressiveness” of the cryptosystem---the latter being measured in terms of the depth of the arithmetic circuits that can be evaluated on ciphertext. Given the current state of the art in homomorphic encryption, this trade-off may also be viewed as one between communication and computation, since at present, more expressive cryptosystems are markedly less efficient. We then apply this methodology to place lower bounds on a number of cryptographic protocols including private information retrieval writing and private keyword search. Our work provides a useful “litmus test” of feasibility for use by other cryptographic researchers attempting to develop new protocols that use somewhat homomorphic encryption in a black-box way and require certain levels of communication efficiency. We also answer an open question from the thesis of Doerte K. Rappe [Homomorphic Cryptosystems and Their Applications, Universität Dortmund, Germany, 2006] regarding the construction of fully homomorphic encryption from group homomorphic encryption.
In this work, we develop a methodology for determining the communication required to implement various two-party functionalities noninteractively. In the particular setting on which we focus, the protocols are based upon somewhat homomorphic encryption, and furthermore, they treat the homomorphic properties as a black box. In this setting, we develop lower bounds which give a smooth trade-off between the communication complexity and the “expressiveness” of the cryptosystem---the latter being measured in terms of the depth of the arithmetic circuits that can be evaluated on ciphertext. Given the current state of the art in homomorphic encryption, this trade-off may also be viewed as one between communication and computation, since at present, more expressive cryptosystems are markedly less efficient. We then apply this methodology to place lower bounds on a number of cryptographic protocols including private information retrieval writing and private keyword search. Our work provides a useful “litmus test” of feasibility for use by other cryptographic researchers attempting to develop new protocols that use somewhat homomorphic encryption in a black-box way and require certain levels of communication efficiency. We also answer an open question from the thesis of Doerte K. Rappe [Homomorphic Cryptosystems and Their Applications, Universität Dortmund, Germany, 2006] regarding the construction of fully homomorphic encryption from group homomorphic encryption.
Cryptography grew to be much more than "the study of secret writing". Modern cryptography is concerned with establishing properties such as privacy, integrity and authenticity in protocols for secure communication and computation. This comes at a price: Cryptographic tools usually introduce an overhead, both in terms of communication complexity (that is, number and size of messages transmitted) and computational efficiency (that is, time and memory required). As in many settings communication between the parties involved is the bottleneck, this thesis is concerned with improving communication complexity in cryptographic protocols. One direction towards this goal is scalable cryptography: In many cryptographic schemes currently deployed, the security degrades linearly with the number of instances (e.g. encrypted messages) in the system. As this number can be huge in contexts like cloud computing, the parameters of the scheme have to be chosen considerably larger - and in particular depending on the expected number of instances in the system - to maintain security guarantees. We advance the state-of-the-art regarding scalable cryptography by constructing schemes where the security guarantees are independent of the number of instances. This allows to choose smaller parameters, even when the expected number of instances is immense. - We construct the first scalable encryption scheme with security against active adversaries which has both compact public keys and ciphertexts. In particular, we significantly reduce the size of the public key to only about 3% of the key-size of the previously most efficient scalable encryption scheme. (Gay,Hofheinz, and Kohl, CRYPTO, 2017) - We present a scalable structure-preserving signature scheme which improves both in terms of public-key and signature size compared to the previously best construction to about 40% and 56% of the sizes, respectively. (Gay, Hofheinz, Kohl, and Pan, EUROCRYPT, 2018) Another important area of cryptography is secure multi-party computation, where the goal is to jointly evaluate some function while keeping each party’s input private. In traditional approaches towards secure multi-party computation either the communication complexity scales linearly in the size of the function, or the computational efficiency is poor. To overcome this issue, Boyle, Gilboa, and Ishai (CRYPTO, 2016) introduced the notion of homomorphic secret sharing. Here, inputs are shared between parties such that each party does not learn anything about the input, and such that the parties can locally evaluate functions on the shares. Homomorphic secret sharing implies secure computation where the communication complexity only depends on the size of the inputs, which is typically much smaller than the size of the function. A different approach towards efficient secure computation is to split the protocol into an input-independent preprocessing phase, where long correlated strings are generated, and a very efficient online phase. One example for a useful correlation are authenticated Beaver triples, which allow to perform efficient multiplications in the online phase such that privacy of the inputs is preserved and parties deviating the protocol can be detected. The currently most efficient protocols implementing the preprocessing phase require communication linear in the number of triples to be generated. This results typically in high communication costs, as the online phase requires at least one authenticated Beaver triple per multiplication. We advance the state-of-the art regarding efficient protocols for secure computation with low communication complexity as follows. - We construct the first homomorphic secret sharing scheme for computing arbitrary functions in NC 1 (that is, functions that are computably by circuits with logarithmic depth) which supports message spaces of arbitrary size, has only negligible correctness error, and does not require expensive multiplication on ciphertexts. (Boyle, Kohl, and Scholl, EUROCRYPT, 2019) - We introduce the notion of a pseudorandom correlation generator for general correlations. Pseudorandom correlation generators allow to locally extend short correlated seeds into long pseudorandom correlated strings. We show that pseudorandom correlation generators can replace the preprocessing phase in many protocols, leading to a preprocessing phase with sublinear communication complexity. We show connections to homomorphic secret sharing schemes and give the first instantiation of pseudorandom correlation generators for authenticated Beaver triples at reasonable computational efficiency. (Boyle, Couteau, Gilboa, Ishai, Kohl, and Scholl, CRYPTO, 2019)
Cramer, Damgard, and Nielsen [CDN01] show how to construct an efficient secure multiparty computation scheme using a threshold homomorphic encryption scheme that has four properties i) a honest-verifier zero-knowledge proof of knowledge of encrypted values, ii) proving multiplications correct iii) threshold decryption and iv) trusted shared key setup. Naor and Nissim [NN01a] show how to construct secure multi-party protocols for a function f whose communication is proportional to the communication required to evaluate f without security, albeit at the cost of computation that might be exponential in the description of f . Gentry [Gen09a] shows how to combine both ideas with fully homomorphic encryption in order to construct secure multi-party protocol that allows evaluation of a function f using communication that is independent of the circuit description of f and computation that is polynomial in | f |. This paper addresses the major drawback’s of Gentry’s approach: we eliminate the use of non-black box methods that are inherent in Naor and Nissim’s compiler. To do this we show how to modify the fully homomorphic encryption construction of van Dijk et al. [vDGHV10] to be threshold fully homomorphic encryption schemes. We directly construct (information theoretically) secure protocols for sharing the secret key for our threshold scheme (thereby removing the setup assumptions) and for jointly decrypting a bit. All of these constructions are constant round and we thoroughly analyze their complexity; they address requirements (iii) and (iv). The fact that the encryption scheme is fully homomorphic addresses requirement (ii). To address the need for an honest-verifier zero-knowledge proof of knowledge of encrypted values, we instead argue that a weaker solution suffices. We provide a 2-round blackbox protocol that allows us to prove knowledge of encrypted bits. Our protocol is not zeroknowledge, but it provably does not release any information about the bit being discussed, and this is sufficient to prove the correctness of a simulation in a method similar to Cramer et al. Altogether, we construct the first black-box secure multi-party computation protocol that allows evaluation of a function f using communication that is independent of the circuit description of f .
We study the complexity of securely evaluating arithmetic circuits over finite rings. This question is motivated by natural secure computation tasks. Focusing mainly on the case of two-party protocols with security against malicious parties, our main goals are to: (1) only make black-box calls to the ring operations and standard cryptographic primitives, and (2) minimize the number of such black-box calls as well as the communication overhead. We present several solutions which differ in their efficiency, generality, and underlying intractability assumptions. These include: 1. An unconditionally secure protocol in the OT-hybrid model which makes a black-box use of an arbitrary ring R, but where the number of ring operations grows linearly with (an upper bound on) log∣R∣. 2. Computationally secure protocols in the OT-hybrid model which make a black-box use of an underlying ring, and in which the number of ring operations does not grow with the ring size. These results extend a previous approach of Naor and Pinkas for secure polynomial evaluation (SIAM J. Comput., 35(5), 2006). 3. A protocol for the rings Zm=Z/mZ which only makes a black-box use of a homomorphic encryption scheme. When m is prime, the (amortized) number of calls to the encryption scheme for each gate of the circuit is constant. All of our protocols are in fact UC-secure in the OT-hybrid model and can be generalized to multiparty computation with an arbitrary number of malicious parties.
We study the complexity of securely evaluating arithmetic circuits over finite rings. This question is motivated by natural secure computation tasks. Focusing mainly on the case of two-party protocols with security against malicious parties, our main goals are to: (1) only make black-box calls to the ring operations and standard cryptographic primitives, and (2) minimize the number of such black-box calls as well as the communication overhead. We present several solutions which differ in their efficiency, generality, and underlying intractability assumptions. These include: • An unconditionally secure protocol in the OT-hybrid model which makes a black-box use of an arbitrary ring R, but where the number of ring operations grows linearly with (an upper bound on) log |R|. • Computationally secure protocols in the OT-hybrid model which make a black-box use of an underlying ring, and in which the number of ring operations does not grow with the ring size. The protocols rely on variants of previous intractability assumptions related to linear codes. In the most efficient instance of these protocols, applied to a suitable class of fields, the (amortized) communication cost is a constant number of field elements per multiplication gate and the computational cost is dominated by O(log k) field operations per gate, where k is a security parameter. These results extend a previous approach of Naor and Pinkas for secure polynomial evaluation (SIAM J. Comput., 35(5), 2006). • A protocol for the rings Zm = Z/mZ which only makes a black-box use of a homomorphic encryption scheme. When m is prime, the (amortized) number of calls to the encryption scheme for each gate of the circuit is constant. All of our protocols are in fact UC-secure in the OT-hybrid model and can be generalized to multiparty computation with an arbitrary number of malicious parties.
Since Gentry's breakthrough construction of fully homomorphic encryption from lattice-based assumptions (STOC 2009), homomorphic cryptography has attracted a lot of attention. In short, homomorphic cryptography schemes allow performing computation on encrypted data without knowing anything about the underlying plaintext. This branch of cryptography has become increasingly useful in building new protocols and schemes with intriguing security and functionality features. In this thesis, we continue to study the applications of homomorphic cryptography and the lattice-based techniques underlying them in realizing new and enhanced cryptographic primitives. We obtain the following results: -We construct the first noninteractive zero knowledge argument (and proof) system for all of NP from standard lattice assumptions. Noninteractive zero knowledge argument systems have found many applications in enhancing the functionality as well as the security of cryptographic schemes and protocols. Constructing noninteractive zero knowledge arguments from lattice assumption has been a long standing open question. We finally close this problem. -We consider multi-key fully homomorphic encryption (FHE) schemes. Traditional fully homomorphic encryption schemes allow computation on plaintext encrypted under a single key. The notion of multi-key fully homomorphic encryption allows homomorphic computation on data encrypted under different keys. We construct multi-key FHE schemes which are naturally dynamic: ciphertexts under new keys can join even during the homomorphic computation. -Finally, we focus on constrained pseudorandom functions (C-PRFs), which are pseudorandom functions (PRFs) with additional functional capabilities. We propose a new approach for building C-PRFs from lattices, and also significantly enhance the underlying lattice parameters.
Homomorphic encryption is a cryptographic primitive that enables information processing on encrypted data. Such primitives are useful in a delegated computing setting in which a client delegates processing to a server, but does not trust the server fully with her information. Here, I discuss a way of performing quantum homomorphic encryption. A homomorphic encryption protocol comprises of four algorithms: random key generation, encryption, evaluation, and decryption. Our technique requires that a pair of commuting operators be used to implement the encryption and evaluation. The client randomly selects the former, while the server implements the latter. Then post-evaluation, if the client decrypts using the inverse of the encryption, he retrieves the input state with the desired computation implemented. The code space has to be chosen carefully so that non-trivial evaluations can be performed on the logical qubits. Since the encryption key is not known to the server, the randomness introduced by key generation hides some information about the encoded data despite it being put into the hands of the server. This framework is powerful because it gives a general description for implementing quantum homomorphic encryption. For example, families of commuting groups of operators are known to exist via the Schur-Weyl duality. However, it is limited by a no-go theorem that states that an exponential overhead is needed if arbitrary computation and perfect security are desired. Nonetheless, our protocols are still interesting as an application for near-term quantum computers, especially when the computational tasks require only low-depth circuits.