Ciphers for MPC and FHE

Abstract

Designing an efficient cipher was always a delicate balance between linear and non-linear operations. This goes back to the design of DES, and in fact all the way back to the seminal work of Shannon. Here we focus, for the first time, on an extreme corner of the design space and initiate a study of symmetric-key primitives that minimize the multiplicative size and depth of their descriptions. This is motivated by recent progress in practical instantiations of secure multi-party computation (MPC), fully homomorphic encryption (FHE), and zero-knowledge proofs (ZK) where linear computations are, compared to non-linear operations, essentially "free". We focus on the case of a block cipher, and propose the family of block ciphers "LowMC", beating all existing proposals with respect to these metrics by far. We sketch several applications for such ciphers and give implementation comparisons suggesting that when encrypting larger amounts of data the new design strategy translates into improvements in computation and communication complexity by up to a factor of 5 compared to AES-128, which incidentally is one of the most competitive classical designs. Furthermore, we identify cases where "free XORs" can no longer be regarded as such but represent a bottleneck, hence refuting this commonly held belief with a practical example.

Stream Ciphers: A Practical Solution for Efficient Homomorphic-Ciphertext Compression

“…In all the previous works on the homomorphic evaluation of symmetric encryption schemes, the parameters of the underlying HE scheme were selected for the exact multiplicative depth required and not beyond [31,19,43,24,3]. This means that once the ciphertext is decompressed, no further homomorphic computation can actually be performed by Charlie -this makes the claimed timings considerably less meaningful in a real-world context.…”

“…Latency and throughput using HElib on a single core of a mid-end 48-core server (4 x AMD Opteron 6172 processors with 64GB of RAM). of [3] available at https://bitbucket.org/malb/lowmc-helib. Minor changes to this implementation were made in order to obtain an equivalent parametrization of HElib.…”

“…Therefore, only block ciphers with a large enough block size, like the LowMC instantiation with a 256-bit block proposed in [3], are suitable in applications which may require the encryption of more than 2 32 bits under the same key.…”

“…At Eurocrypt 2015, Albrecht, Rechberger, Schneider, Tiessen and Zohner observed that the usual criteria that rule the design of lightweight block ciphers are not appropriate when designing a symmetric encryption scheme with a low-cost homomorphic evaluation [3]. Indeed, both the number of rounds and the number of binary multiplications required to evaluate an Sbox have to be taken into account.…”

SePCAR: A Secure and Privacy-Enhancing Protocol for Car Access Provision

“…As it was previously stated, they consider the case where the MPC parties hold a secret shared key K and a secret shared message M . The product of the operation is a secret shared AES encrypted ciphertext [2,14,15,27]. Note that in this paper we assume the use of the methods proposed by Damgård and Keller [14] with some minor code optimisations.…”