Fully Homomorphic Encryption from Ring-LWE and Security for Key Dependent Messages

Abstract

Abstract. We present a somewhat homomorphic encryption scheme that is both very simple to describe and analyze, and whose security (quantumly) reduces to the worst-case hardness of problems on ideal lattices. We then transform it into a fully homomorphic encryption scheme using standard "squashing" and "bootstrapping" techniques introduced by Gentry (STOC 2009).One of the obstacles in going from "somewhat" to full homomorphism is the requirement that the somewhat homomorphic scheme be circular secure, namely, the scheme can be used to securely encrypt its own secret key. For all known somewhat homomorphic encryption schemes, this requirement was not known to be achievable under any cryptographic assumption, and had to be explicitly assumed. We take a step forward towards removing this additional assumption by proving that our scheme is in fact secure when encrypting polynomial functions of the secret key.Our scheme is based on the ring learning with errors (RLWE) assumption that was recently introduced by Lyubashevsky, Peikert and Regev (Eurocrypt 2010). The RLWE assumption is reducible to worstcase problems on ideal lattices, and allows us to completely abstract out the lattice interpretation, resulting in an extremely simple scheme. For example, our secret key is s, and our public key is (a, b = as + 2e), where s, a, e are all degree (n − 1) integer polynomials whose coefficients are independently drawn from easy to sample distributions.

On Key Recovery Attacks Against Existing Somewhat Homomorphic Encryption Schemes

“…In this paper, we continue the line of work of [LMSV12,ZPS12] to present key recovery attacks for the schemes [BV11b,BV11a,GSW13,Bra12]. Our attacks can also be applied to the SHE scheme in [BGV12].…”

“…The SHE scheme from [BGV12] is closely related to the SHE schemes from [BV11a,BV11b]. This implies that the attacks from Section 5.2 and 4.2 can be directly applied against the SHE scheme from [BGV12].…”

“…In this section, we describe a key recovery attack against the symmetric-key SHE scheme from [BV11a]. The attack also applies to the asymmetric-key SHE scheme.…”

“…Depending on which instantiation is chosen (either LWE or RLWE), we can apply one of the key recovery attacks against [BV11b,BV11a] to the basic GLWE-based encryption scheme. which is (w− < v, s L > modq) mod 2.…”

SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers

“…Starting with Gentry's mathematical breakthrough constructing the first plausible FHE scheme [22], [23], we have seen rapid development in the theory and implementation of homomorphic encryption (HE) schemes. HE schemes can now be based on a variety of cryptographic assumptions -approximate greatest common divisors [16], [18], learning with errors (LWE) [9], [10], [12], [25], and Ring-LWE (RLWE) [11], [24], [32].…”