Verifiable Rotation of Homomorphic Encryptions

Abstract

Abstract. Similar to verifiable shuffling (mixing), we consider the problem of verifiable rotating a given list of homomorphic encryptions. The offset by which the list is rotated (cyclic shift) should remain hidden. Basically, we will present zero-knowledge proofs of knowledge of a rotation offset and re-encryption exponents, which define how the input list is transformed into the output list. We also briefly address various applications of verifiable rotation, ranging from 'fragile mixing' as introduced by Reiter and Wang at CCS'04 to applications in protocols for secure multiparty computation and voting.We present two new, efficient protocols. Our first protocol is quite elegant and involves the use of the Discrete Fourier Transform (as well as the Fast Fourier Transform algorithm), and works under some reasonable conditions. We believe that this is the first time that Fourier Transforms are used to construct an efficient zero-knowledge proof of knowledge.Our second protocol is more general (requiring no further conditions) and only slightly less efficient than the DFT-based protocol. Unlike the previously best protocol by Reiter and Wang, however, which relies on extensive use of verifiable shuffling as a building block (invoking it four times as a sub-protocol), our construction is direct and its performance is comparable to the performance of a single run of the best protocol for verifiable shuffling.

Discrete logarithm based additively homomorphic encryption and secure data aggregation

“…Thus, encryption schemes with IND-CCA security are not flexible enough to be used in these scenarios. The primitive of homomorphic encryption enables blind transformations on plaintexts via (possibly different) algebraic operations on ciphertexts [16,6]. Depending upon the specific viewpoint, this is either a positive or a negative attribute of a cryptosystem.…”

Let’s Stride Blindfolded in a Forest: Sublinear Multi-Client Decision Trees Evaluation

“…12 in Appendix C. Efficient instantiations of the corresponding ZKPs are known. For example, one can use the technique of verifiable rotation of HE ciphertexts [18] to instantiate the second statement.…”

Efficiently Shuffling in Public

“…Furukawa and Sako [FS01] used a commitment to a permutation matrix and Neff [Nef01] used unique factorisation of polynomials to prove a shuffle of ElGamal ciphertexts with improved efficiency. Efficient arguments and proofs have also been devised in the case that the shuffle is restricted to a subset of permutations [RW04,dHSŠV09]. Generic techniques may be used to further optimise the above proofs, including pre-computation of re-encryption factors, fixed base and multi-exponentiation and batch proof techniques [BGR98] and PRGs for challenge generation.…”