Compared to the classical cryptography, lattice-based cryptography is more secure, flexible and simple, and it is believed to be secure against quantum computers.In this paper, an efficient signature scheme is proposed from the ring learning with errors (R-LWE), which avoids sampling from discrete Gaussians and has the characteristics of the much simpler description etc.Then, the scheme is implemented in C/C++ and makes a comparison with the RSA signature scheme in detail.Additionally, a linearly homomorphic signature scheme without trapdoor is proposed from the R-LWE assumption.The security of the above two schemes are reducible to the worst-case hardness of shortest vectors on ideal lattices.The security analyses indicate the proposed schemes are unforgeable under chosen message attack model, and the efficiency analyses also show that the above schemes are much more efficient than other correlative signature schemes.
Compared to the classical cryptography, lattice-based cryptography is more secure, flexible and simple, and it is believed to be secure against quantum computers.In this paper, an efficient signature scheme is proposed from the ring learning with errors (R-LWE), which avoids sampling from discrete Gaussians and has the characteristics of the much simpler description etc.Then, the scheme is implemented in C/C++ and makes a comparison with the RSA signature scheme in detail.Additionally, a linearly homomorphic signature scheme without trapdoor is proposed from the R-LWE assumption.The security of the above two schemes are reducible to the worst-case hardness of shortest vectors on ideal lattices.The security analyses indicate the proposed schemes are unforgeable under chosen message attack model, and the efficiency analyses also show that the above schemes are much more efficient than other correlative signature schemes.
We propose a variant version of ring learning with errors (R-LWE) assumption. Under the modified slightly assumption which is reducible to the worst-case problems on ideal lattice, we present a construction of digital signatures. So the scheme is provably secure based on the hardness of lattice problems (such as approximating the length of the shortest vector within a fixed poly(n) factor). Compared with some existing typical lattice-based signature schemes, the construction enjoys many advantages, including simple and efficient key generation algorithm, signing algorithm and verification algorithm to improve the efficiency of the scheme as well as to reduce the overhead. The sizes of the secret and public keys and the signature are almost linear O(n log n) (up to poly-logarithmic factors) in the dimension n of the lattice.
Since the introduction of the ring learning with errors (R-LWE) by Lyubashevsky, Peikert and Regev, many efficient and secure applications were founded in cryptography. In this paper, we mainly present an efficient public-key encryption scheme based on the R-LWE assumption. It is very simple to describe and analyze. As well as it can achieve security against certain key-dependent message (KDM) attacks. Namely, this efficient encryption scheme can securely encrypt its own secret key. The security of this scheme follows from the already proven hardness of the R-LWE problem since the R-LWE assumption is reducible to worst-case problems on the ideal lattice. Besides, the scheme enjoys a high level efficiency and low cost since the operations of the scheme are very simple and fast. The cost of both the encryption and decryption is only polylog(n) bit per message symbol.
Attribute-based encryption (ABE) has been an active research area in cryptography due to its attractive applications. But almost all attribute-based encryption schemes are based on bilinear maps, which leave them vulnerable to quantum cryptanalysis. The lattice-based ABE schemes from the Learning with errors (LWE) have appeared, but they are not efficient enough for practical applications. Thus we propose an efficient attribute-based encryption based on the Learning with errors over Rings (R-LWE), which is called ABER-LWE. The security analysis shows that ABER-LWEscheme is secure in the selective-set model under the R-LWE assumption, whose security can reduce to the hardness of the shortest vector problem in the worst case on ideal lattices. The efficiency analysis indicates that ABER-LWEis more efficient than previous ABE cryptosystems on lattices.
Digital signatures and encryption schemes constitute arguably an integral part of cryptographic schemes with the goal to meet the security needs of present and future private and business applications. However, almost all public key cryptosystems applied in practice are put at risk due to its vulnerability to quantum attacks as a result of Shor's quantum algorithm. The magnitude of economic and social impact is tremendous inherently asking for alternatives replacing classical schemes in case large-scale quantum computers are built. Lattice-based cryptography emerged as a powerful candidate attracting lots of attention not only due to its conjectured resistance against quantum attacks, but also because of its unique security guarantee to provide worst-case hardness of average-case instances. Hence, the requirement of imposing further assumptions on the hardness of randomly chosen instances disappears, resulting in more efficient instantiations of cryptographic schemes. The best known lattice attack algorithms run in exponential time. \nIn this thesis we contribute to a smooth transition into a world with practically efficient lattice-based cryptographic schemes. This is indeed accomplished by designing new algorithms and cryptographic schemes as well as improving existing ones. Our contributions are threefold. \nFirst, we construct new encryption schemes that fully exploit the error term in LWE instances. To this end, we introduce a novel computational problem that we call Augmented LWE (A-LWE), differing from the original LWE problem only in the way the error term is produced. In fact, we embed arbitrary data into the error term without changing the target distributions. Following this, we prove that A-LWE instances are indistinguishable from LWE samples. This allows to build powerful encryption schemes on top of the A-LWE problem that are simple in its representations and efficient in practice while encrypting huge amounts of data realizing message expansion factors close to 1. This improves, to our knowledge, upon all existing encryption schemes. Due to the versatility of the error term, we further add various security features such as CCA and RCCA security or even plug lattice-based signatures into parts of the error term, thus providing an additional mechanism to authenticate encrypted data. Based on the methodology to embed arbitrary data into the error term while keeping the target distributions, we realize a novel CDT-like discrete Gaussian sampler that beats the best known samplers such as Knuth-Yao or the standard CDT sampler in terms of running time. At run time the table size amounting to 44 elements is constant for every discrete Gaussian parameter and the total space requirements are exactly as large as for the standard CDT sampler. Further results include a very efficient inversion algorithm for ring elements in special classes of cyclotomic rings. In fact, by use of the NTT it is possible to efficiently check for invertibility and deduce a representation of the corresponding unit group. Moreover, we generalize the LWE inversion algorithm for the trapdoor candidate of Micciancio and Peikert from power of two moduli to arbitrary composed integers using a different approach. \nIn the second part of this thesis, we present an efficient trapdoor construction for ideal lattices and an associated description of the GPV signature scheme. Furthermore, we improve the signing step using a different representation of the involved perturbation matrix leading to enhanced memory usage and running times. Subsequently, we introduce an advanced compression algorithm for GPV signatures, which previously suffered from huge signature sizes as a result of the construction or due to the requirement of the security proof. We circumvent this problem by introducing the notion of public and secret randomness for signatures. In particular, we generate the public portion of a signature from a short uniform random seed without violating the previous conditions. This concept is subsequently transferred to the multi-signer setting which increases the efficiency of the compression scheme in presence of multiple signers. Finally in this part, we propose the first lattice-based sequential aggregate signature scheme that enables a group of signers to sequentially generate an aggregate signature of reduced storage size such that the verifier is still able to check that each signer indeed signed a message. This approach is realized based on lattice-based trapdoor functions and has many application areas such as wireless sensor networks. \nIn the final part of this thesis, we extend the theoretical foundations of lattices and propose new representations of lattice problems by use of Cauchy integrals. Considering lattice points as simple poles of some complex functions allows to operate on lattice points via Cauchy integrals and its generalizations. For instance, we can deduce for the one-dimensional and two-dimensional case simple expressions for the number of lattice points inside a domain using trigonometric or elliptic functions.
In order to solve the problem of large key size and low efficiency in the linkable ring signature scheme on lattice, this paper reconstructs the linkable ring signature scheme from lattice based on the ring learning with errors (RLWE) problem, according to the technical route of “homomorphic commitment→∑-protocol→Fiat-Shamir transformation”. This paper first constructs a homomorphic commitment scheme over a polynomial ring based on the RLWE problem, and then designs a ∑-protocol based on the commitment scheme, and transforms the ∑-protocol into a linkable ring signature scheme using the Fiat-Shamir transformation methods. Finally, this paper proposes a simple digital currency model based on the linkable ring signature scheme. Security analysis shows since the proposed scheme is constructed based on the problem of RLWE, its security can reduce to the lattice-based difficult problem and resist the quantum computer attack. Efficiency analysis shows compared with the previous linkable ring signature schemes on lattice, since the ring elements in the scheme are taken from small polynomials, the proposed scheme has shorter key size and higher computational efficiency, and the description of the scheme is simpler.
So far, most ring signature schemes rely on hard number theory problems, such as discrete logarithm, bilinear pairings and so on. Unfortunately, the above underlying number theory problems will be solvable in the post quantum era. Lattice-based cryptography is a hotspot of research recently, due to its implementation simplicity and provable security reductions. When the hash-and-sign signature scheme was constructed based on the hardness of worst-case lattice problems, provably secure lattice-based ring signature schemes were finally constructed. However, the hash-and-sign ring signatures were rather inefficient (with megabytes long signatures). In this paper, we propose an alternative method for constructing lattice-based and identity-based ring signature scheme which does not use the hash-and-sign methodology. In the random oracle model, the proposed signature scheme based on the problem in general lattices is unforgeable and holds anonymity. Compared with the previous instantiations of the hash-and-sign ring signature schemes, the lengths of secret key, public key and signatures in the proposed scheme are much shorter. The signing algorithm is quite simple, with matrix-vector multiplications and rejection samplings.