Last modifications
parent
1ef78ca088
commit
c2acf57040

@ 431,7 +431,7 @@ the equality


\mathbf{A}_{\tau^{(i^\dagger)}} \cdot \left[ \begin{array}{c}


\mathbf{v}_1^\star \\ \hline \mathbf{v}_2^\star


\end{array} \right]


&=& \mathbf{u} + \mathbf{D} \cdot \bit ( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


&=& \mathbf{u} + \mathbf{D} \cdot \textsf{bin}( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


+ \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } ) \quad \bmod q.


\end{eqnarray}





@ 442,13 +442,13 @@ such that


\mathbf{v}_1 \\ \hline \mathbf{v}_2


\end{array} \right] = \mathbf{u} + \mathbf{D} \cdot \textsf{bin}( \mathbf{c}_M ) \bmod q. \end{eqnarray}


Relation (\ref{sims}) implies that $ \mathbf{c}_M \neq \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


+ \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } \bmod q$ by hypothesis. It follows that $\textsf{bin}(\mathbf{c}_M)  \bit ( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


+ \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } \bmod q$ by hypothesis. It follows that $\textsf{bin}(\mathbf{c}_M)  \textsf{bin}( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


+ \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } ) $ is a nonzero vector in $\{1,0,1\}^m$. Subtracting (\ref{secondsol}) from (\ref{firstsol}), we get


\begin{eqnarray*}


\mathbf{A}_{\tau^{(i^\dagger)}} \cdot \left[\begin{array}{c}


\mathbf{v}_1^\star  \mathbf{v}_1 \\ \hline \mathbf{v}_2^\star  \mathbf{v}_1


\end{array} \right]


&=& \mathbf{D} \cdot \bigl( \textsf{bin}(\mathbf{c}_M)  \bit ( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


&=& \mathbf{D} \cdot \bigl( \textsf{bin}(\mathbf{c}_M)  \textsf{bin}( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


+ \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } ) \bigr) \mod q,


\end{eqnarray*}


which implies



@ 456,7 +456,7 @@ which implies


\left[


\begin{array}{cc} \mathbf{D} \cdot \mathbf{S} ~ &~ \mathbf{D} \cdot (\mathbf{S}_0 +


\sum_{j=1}^\ell \tau^{(i^\dagger)}[j] \cdot \mathbf{S}_j)


\end{array} \right] \cdot \left[ \begin{array}{c} {\mathbf{v}_1^\star \mathbf{v}_1 } \\ \hline {\mathbf{v}_2^\star  \mathbf{v}_2 } \end{array} \right] \\ = \mathbf{D} \cdot \bigl( \textsf{bin}(\mathbf{c}_M)  \bit ( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


\end{array} \right] \cdot \left[ \begin{array}{c} {\mathbf{v}_1^\star \mathbf{v}_1 } \\ \hline {\mathbf{v}_2^\star  \mathbf{v}_2 } \end{array} \right] \\ = \mathbf{D} \cdot \bigl( \textsf{bin}(\mathbf{c}_M)  \textsf{bin}( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


+ \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } ) \bigr) \mod q .


\end{multline}


The above implies that the vector



@ 466,7 +466,7 @@ which implies


\nonumber && \hspace{2.75cm} ~+ \bit \big( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} } + \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } \big)  \textsf{bin}(\mathbf{c}_M)


\end{eqnarray}


is a short integer vector of $\Lambda_q^{\perp}(\mathbf{D})$. Indeed, its norm can be bounded as $\ \mathbf{w} \ \leq \beta'' = \sqrt{2} (\ell+2) \sigma^2 m^{3/2} + m^{1/2} $. We argue that it is nonzero with overwhelming probability. We already observed that


$ \bit ( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


$ \textsf{bin}( \mathbf{D}_0 \cdot {\mathbf{s}^{\star} }


+ \sum_{k=1}^N \mathbf{D}_k \cdot {\mathfrak{m}_k^{\star} } )  \textsf{bin}(\mathbf{c}_M)$ is a nonzero vector of $\{1,0,1\}^m$, which rules out the event that


$({\mathbf{v}_1^\star}, {\mathbf{v}_2^\star} ) =({\mathbf{v}_1} , {\mathbf{v}_2}) $. Hence, we can only have $\mathbf{w}=\mathbf{0}^m$ when the equality


\begin{multline} \label{finaleq}



@ 716,7 +716,7 @@ probabilities during hybrid games where the two distributions are not close in t


Then, it computes $\mathbf{c}_M = \mathbf{D}_0 \cdot \mathbf{s}_0 \in \ZZ_q^{2n}$ for a short Gaussian vector


$\mathbf{s}_0 \sample D_{\ZZ^{2m},\sigma_0}$, which will be used in the $i^\dagger$th query.


Next, it samples short vectors $\mathbf{v}_1,\mathbf{v}_2 \sample D_{\ZZ^m,\sigma}$ to define


$$\mathbf{u}= \mathbf{A}_{\tau^{(i^\dagger)}} \cdot \begin{bmatrix} \mathbf{v}_1 \\ \mathbf{v}_2 \end{bmatrix}  \mathbf{D} \cdot \bit (\mathbf{c}_M) ~ \in \ZZ_q^n.$$


$$\mathbf{u}= \mathbf{A}_{\tau^{(i^\dagger)}} \cdot \begin{bmatrix} \mathbf{v}_1 \\ \mathbf{v}_2 \end{bmatrix}  \mathbf{D} \cdot \textsf{bin}(\mathbf{c}_M) ~ \in \ZZ_q^n.$$


In addition, $\bdv$ picks extra smallnorm matrices $\mathbf{R}_1,\ldots,\mathbf{R}_N \in \ZZ^{2m \times 2m}$ whose columns are sampled from $D_{\ZZ^m,\sigma}$, which


are used to define randomizations of $\mathbf{D}_0$ by computing $\mathbf{D}_k = \mathbf{D}_0 \cdot \mathbf{R}_k$ for each $k \in \{1,\ldots,N\}$.


The adversary is given public parameters $\mathsf{par}\coloneqq \{\mathbf{B},\mathbf{G}_0,\mathbf{G}_1,CK\}$, where $CK=\{\mathbf{D}_k\}_{k=0}^N$, and the public key $PK\coloneqq \big( \mathbf{A}, \{\mathbf{A}_j\}_{j=0}^\ell, \mathbf{D},\mathbf{u} \big)$.



@ 1070,18 +1070,18 @@ The scheme is secure against misidentification attacks under the $\SIS_{n,2m,q,\


The case $coin=1$ corresponds to $\bdv$'s expectation that the knowledge extractor will obtain the identifier $ \mathsf{id}^\star = \mathsf{id}^\dagger$ of a group member in


$ U^a$ (i.e., a group member that was legitimately introduced at the $i^\star$th $\mathcal{Q}_{\ajoin}$query, for some $i^\star \in \{1,\ldots,Q_a\}$, where the identifier


$\mathsf{id}^\dagger$ is used by $\mathcal{Q}_{\ajoin}$),


but $\bit ( \mathbf{v}^\star ) \in \{0,1\}^{2m}$ (which is encrypted in in $\mathbf{c}_{\mathbf{v}_i}^\star$ as part of the forgery $\Sigma^\star$) and the extracted $\mathbf{s}^\star \in \ZZ^{2m}$ are such that $ \bit \bigl( \mathbf{D}_0 \cdot \bit ( \mathbf{v}^\star ) + \mathbf{D}_1 \cdot \mathbf{s}^\star \bigr) \in \{0,1\}^m $


but $\textsf{bin}( \mathbf{v}^\star ) \in \{0,1\}^{2m}$ (which is encrypted in in $\mathbf{c}_{\mathbf{v}_i}^\star$ as part of the forgery $\Sigma^\star$) and the extracted $\mathbf{s}^\star \in \ZZ^{2m}$ are such that $ \bit \bigl( \mathbf{D}_0 \cdot \textsf{bin}( \mathbf{v}^\star ) + \mathbf{D}_1 \cdot \mathbf{s}^\star \bigr) \in \{0,1\}^m $


does not match


the string $ \bit \bigl( \mathbf{D}_0 \cdot \bit ( \mathbf{v}_{i^\star} ) + \mathbf{D}_1 \cdot \mathbf{s}_{i^\star} \bigr) \in \{0,1\}^{2m} $ for which


the string $ \bit \bigl( \mathbf{D}_0 \cdot \textsf{bin}( \mathbf{v}_{i^\star} ) + \mathbf{D}_1 \cdot \mathbf{s}_{i^\star} \bigr) \in \{0,1\}^{2m} $ for which


user $i^\star$ obtained a membership certificate at the $i^\star$th $\mathcal{Q}_{\ajoin}$query. When $coin=1$, the choice of $i^\star$ corresponds to a guess that the knowledge


extractor will reveal an $\ell$bit identifier that coincides with the identifier $\mathsf{id}^\dagger$ assigned to the user introduced at the $i^\star$th $\mathcal{Q}_{\ajoin}$query.


The last case $coin=2$ corresponds to $\bdv$'s expectation that decrypting $\mathbf{c}_{\mathbf{v}_i}^\star$ (which is part of $\Sigma^\star$) and running


the knowledge extractor on $\adv$ will uncover vectors $\bit ( \mathbf{v}^\star ) \in \{0,1\}^{2m}$, $\mathbf{w}^\star \in \{0,1\}^m$ and $\mathbf{s}^\star \in \ZZ^{2m}$


the knowledge extractor on $\adv$ will uncover vectors $\textsf{bin}( \mathbf{v}^\star ) \in \{0,1\}^{2m}$, $\mathbf{w}^\star \in \{0,1\}^m$ and $\mathbf{s}^\star \in \ZZ^{2m}$


such that $\mathbf{w}^\star= \textsf{bin}(\mathbf{D}_0 \cdot \textsf{bin}(\mathbf{v}^\star) + \mathbf{D}_1 \cdot \mathbf{s}^\star )$ and


\begin{eqnarray} \label{collide}


\bit \bigl( \mathbf{D}_0 \cdot \bit ( \mathbf{v}^\star ) + \mathbf{D}_1 \cdot \mathbf{s}^\star \bigr) = \bit \bigl( \mathbf{D}_0 \cdot \bit ( \mathbf{v}_{i^\star} ) + \mathbf{D}_1 \cdot \mathbf{s}_{i^\star} \bigr)


\bit \bigl( \mathbf{D}_0 \cdot \textsf{bin}( \mathbf{v}^\star ) + \mathbf{D}_1 \cdot \mathbf{s}^\star \bigr) = \bit \bigl( \mathbf{D}_0 \cdot \textsf{bin}( \mathbf{v}_{i^\star} ) + \mathbf{D}_1 \cdot \mathbf{s}_{i^\star} \bigr)


\end{eqnarray}


but $(\bit ( \mathbf{v}^\star ), \mathbf{s}^\star) \neq ( \bit ( \mathbf{v}_{i^\star} ), \mathbf{s}_{i^\star} ) $, where $ \mathbf{v}_{i^\star} \in \Zq^{4n}$ and $\mathbf{s}_{i^\star} \in \ZZ^{2m}$ are the vectors


but $(\textsf{bin}( \mathbf{v}^\star ), \mathbf{s}^\star) \neq ( \textsf{bin}( \mathbf{v}_{i^\star} ), \mathbf{s}_{i^\star} ) $, where $ \mathbf{v}_{i^\star} \in \Zq^{4n}$ and $\mathbf{s}_{i^\star} \in \ZZ^{2m}$ are the vectors


involved in the $i^\star$th $\mathcal{Q}_{\ajoin}$query.


\\


\indent





@ 38,6 +38,7 @@ In this section, we first present the general principles and basic tools to hand


\end{definition}




\begin{definition}[Proof of knowledge \cite{GMR85,BG92}]


\label{de:pok}


\index{Zero Knowledge!Proof of knowledge}


Let $\kappa$ be a function from $\bit^\star$ to $[0,1]$. A complete interactive proof system $(P,V)$ is said to be a \textit{proof of knowledge} for the relation $R$ with knowledge error $\kappa$ if it verifies the knowledge soundness property.


\begin{description}



@ 54,6 +55,7 @@ Another useful property that a proof system can have in the context of privacyp


This property states that if a proof system has multiple witnesses, it is impossible to tell apart which one has been used during the proof.




\begin{definition}[Witness indistinguishable proofs~\cite{FS90}]


\label{de:wi} \index{Zero Knowledge!Witness Indistinguishability}


Let $(P,V)$ be a complete interactive proof system for relation $R$. It is said to be \textit{witness indistinguishable} if, for every $\ppt$ algorithm $\hat{V}$ and every two sequences $\{w_x\}_{(x, w_x) \in R}$, $\{w'_x\}_{(x,w'_x) \in R}$, the following ensembles are computationally indistinguishable:


\begin{align*}


\{ \trans(P(x, w_x), \hat{V}(x) \}_x && \mbox{and} && \{ \trans( P(x, w'_x), \hat{V}(x) \}_x.





@ 5,74 +5,123 @@


In this thesis, we presented new cryptographic schemes that rely on lattice or pairing assumptions.


These contributions focus on the design and analysis of new cryptographic schemes that target privacypreserving applications.




In pairingbased cryptography, we proposed a practical dynamic group signature scheme, for which security is wellunderstood.


It relies on broadly used assumptions with simple and constantsize descriptions which exist for more than ten years.


In pairingbased cryptography, we proposed a practical dynamic group signature scheme, whose security relies on wellunderstood assumptions in the random oracle.


It relies on widely used assumptions with simple and constantsize descriptions which have been studied for more than ten years.


This work is also supported by an implementation in \texttt{C}.




The results in the lattice setting give rise to three fundamental schemes that were missing in the landscape of latticebased privacypreserving cryptography.


Even if these schemes suffer from some efficiency issues due to their novelty, we do believe that they are one step towards a quantumsecure privacyfriendly world.


The results in the lattice setting give rise to three realizations of fundamental primitives that were missing in the landscape of latticebased privacypreserving cryptography.


Even if these schemes suffer from a lack of efficiency due to their novelty, we do believe that they take one step towards a quantumsecure privacyfriendly world.




On the road, improvements have been made in the state of the art of zeroknowledge proofs in the lattice setting by providing building blocks that, we believe, are of independent interest.


As of our signature with efficient protocols, it has already been used to design a latticebased ecash system~\cite{LLNW17}.


For example, our signature with efficient protocols has already been used to design a privacypreserving latticebased ecash system~\cite{LLNW17}.




All these works are proven under strong security models under simple assumptions.


This provides a breeding ground for new theoretical constructions.




\section*{Open Problems}




The path of providing new cryptographic primitives and proving them is disseminated with pitfalls.


The most obvious questions that stem from this work are about how to tackle the tradeoffs we made in the design of those primitives.


The path of providing new cryptographic primitives and proving them secure is full of pitfalls.


The most obvious questions that stem from this work are how to tackle the tradeoffs we made in the design of those primitives.




\begin{question}


Is it possible to build a fullysimulatable adaptive oblivious transfer with access control secure under $\LWE$ with polynomially large modulus?


Is it possible to build a fullysimulatable adaptive oblivious transfer (even without access control) secure under $\LWE$ with polynomially large modulus?


\end{question}




In other words, is it possible to avoid the use of smudging to guarantee messageprivacy in the adaptive oblivious transfer scheme of~\cref{ch:otlwe}.


As is, this issue arises from the use of Regev's encryption scheme, which does not guarantee this index privacy.


However, while finer analysis on GSW ciphertexts~\cite{GSW13} seems promising to achieve this at reasonable cost~\cite{BDPMW16}, they do not suffice in our setting because they wold leak the norm of the noise vector of ciphertexts.


Then, the main difficulty is to have zeroknowledge proofs compatible with the access control and the encryption layers.


In other words, is it possible to avoid the use of noise flooding to guarantee receiversecurity in the adaptive oblivious transfer scheme of~\cref{ch:otlwe}.


In our current protocol, this issue arises from the use of Regev's encryption scheme, where we need to prevent the noise distribution from leaking the receiver's index.


However, while a finer analysis on GSW ciphertexts~\cite{GSW13} seems promising to achieve this at reasonable cost~\cite{BDPMW16}, it is not sufficient in our setting because it would leak the norm of the noise vector of ciphertexts.


Then, the main difficulty is to have zeroknowledge proofs compatible with the access control and the encryption components.




\begin{question}


Can we construct provablysecure adaptive oblivious transfer schemes in the universal composability model?


\end{question}




Our adaptive oblivious transfer scheme relies on zeroknowledge proofs to hedge against malicious adversaries.


The security proofs take advantage of the fact that the proofs can be rewound to extract a witness (as described in~\cref{de:pok}).


The PeikertVaikuntanathanWaters~\cite{PVW08} construction, based on dualmode encryption, achieves $1$outof$2$ composable oblivious transfer (which can be generalized to $1$outof$2^t$ OT), without relying on zeroknowledge proofs, but it does not implies OT with adaptive queries (i.e., where each index $\rho_i$ may depend on previous transfers $\rho_1, \ldots, \rho_{i1}$).


Actually, the use of $\ZK$ proofs is not impossible in this setting, as shown by the pairingbased construction of Green and Hohenberger~\cite{GH08}.


However, this protocol uses the trapdoor extractability of GrothSahai proofs~\cite{GS08} to achieve straightline extraction. It is not known to be possible in the lattice setting.




\begin{question}


Can we obtain a more efficient compact ecash system from lattice assumptions?


\end{question}




Another privacypreserving primitive is compact ecash~\cite{Cha82,Cha83,CHL05a}. As explained in the introduction, it is the digital equivalent of reallife money.


A body of research followed its introduction~\cite{CFN88,OO91,CP92,FY93,Oka95,Tsi97}, and the first compact realization was given by Camenisch, Hohenberger and Lysyanskaya~\cite{CHL05a} (``compact'' means that the complexity of coin transfers is at most logarithmic in the value of withdrawn wallets).


Before the work of Libert, Ling, Nguyen and Wang~\cite{LLNW17}, all compact construction were based on discretelogarithmbased technique.


This construction still suffers from efficiency issues akin to the problem we met in this thesis.


It is thus interesting to improve the efficiency of this scheme and obtain viable constructions of anonymous ecash from postquantum assumptions.




\subsection*{ZeroKnowledge Proofs}




\begin{question}


Can we provide NIZK proofs in the standard model for all $\NP$ languages relying on standard $\LWE$ assumption only?


Can we provide NIZK proofs in the standard model for all $\NP$ languages while relying on the standard $\LWE$ assumption only?


\end{question}




Extending the work of Groth, Ostrovsky and Sahai~\cite{GOS06} in the lattice setting would be a great improvement for latticebased privacypreserving cryptography.


This question remains open for more than $10$ years~\cite{KW18}.


Recent line of work makes steps forward in this direction~\cite{RSS18}, but rely on primitives that do not exist yet ($\NIZK$ proofs for a variant of the bounded decoding distance problem).


Extending the work of Groth, Ostrovsky and Sahai~\cite{GOS06} to the lattice setting would be a breakthrough result for latticebased cryptography in general.


This question remains open for more than $10$ years~\cite{PV08}.


A recent line of work makes steps forward in this direction~\cite{KW18,RSS18}, but rely on primitives that do not exist yet~\cite{RSS18} ($\NIZK$ proofs for a variant of the bounded decoding distance problem) or assume preprocessing~\cite{KW18}.




The Sternlike proof system we work on in during this thesis, despite being flexible enough to prove a large variety of statements, suffers from the stiffness of being combinatorial.


The choice of permutations used to ensure zeroknowledgeness (and thus witnessindistinguishability) is quite strict, and force the challenge space to be ternary.


This proves to be a real bottleneck in the efficiency of such proof systems.


The Sternlike proof systems we studied in this thesis, despite being flexible enough to prove a large variety of statements, suffer from the stiffness of being combinatorial.


The choice of permutations used to ensure the zeroknowledge property (and thus witnessindistinguishability) is quite strict, and force the challenge space to be ternary.


This turns out to be a real bottleneck in the efficiency of such proof systems.




\begin{question}


Is it possible to construct zeroknowledge protocols for averagecase problems that take advantage of the geometry of lattices?


%Is it possible to construct zeroknowledge protocols for averagecase problems that take advantage of the geometry of lattices?


Can we get negligible soundness error in one shot for expressive statements in the postquantum setting?


\end{question}




As explained in~\cref{ch:zka}, nowadays latticebased proof systems for $\SIS$/$\LWE$ rely either on the additional structure lying in special families of lattices, or on the combinatorial nature of representations of lattices in terms of matrices.


If the natural structure of a lattice is a group, additive noise or witnesslength restrictions forbid the use of standard groupbased cryptography to undertake this problem.


However, lattices naturally carry a strong geometrical structure, as exploited in~\cite{MV03,PV08} to construct (interactive and noninteractive) zeroknowledge proofs for some worstcase lattice problems.


It may be an interesting question to see if the restricted geometry of averagecase lattice problems can be exploited to provide such proofs.


%If these proof systems can be used after applying a transformation from averagecase to worstcase problem, this methodology is highly inefficient and does not close the question.


This question can be restated as ``can we combine the expressivity of Sternlike proofs with the efficiency of Schnorrlike proof with rejection sampling?''.


For Sternlike proofs, decreasing the soundness error from $2/3$ to $1/2$ would already be an interesting improvements with a direct impact on all latticebased schemes presented in this thesis.


Recall that \textit{soundness error} is the probability that a cheating prover convinces an honest verifier of a false statement. As long as it is noticeably different from $1$, it is possible to make the soundness negligible by repeating the protocol.


Likewise, isogenybased proof systems~\cite{JDF11,GPS17} suffer from similar issues as the challenge space is small (binary).


The $2/3$ soundness error is also present in~\cite{IKOS07},


which is a technique to obtain zeroknowledge proofs relying on secure multiparty computation.


With this technique, however, the size of the proof is proportional to the size of the circuit describing the relation we want to prove (which is not the case with Sternlike protocols).


On the other hand, the soundness error of one round of the protocol is at most $2/3$.


Thus, the question of having efficient postquantum zeroknowledge proofs for expressive statements is a difficult question and remains open as of today.




As we explained in the introduction, advanced cryptography from lattices often suffers from the use of lattice trapdoors.


Thus, a natural question may be:


%If these proof systems can be used after applying a transformation from averagecase to worstcase problem, this methodology is highly inefficient and does not close the question.




\subsection*{Cryptographic Constructions}




\begin{question}


Does an efficient trapdoorfree \textsf{(H)IBE} exists?


Can we construct more efficient latticebased signature schemes compatible with zeroknowledge proofs?


\end{question}




For instance, in the group encryption scheme of~\cref{ch:gelwe}, trapdoors are used in two places.


To have a secure public key encryption scheme under adaptive chosenciphertext attacks and for the signature scheme.


Both these primitives are induced by identitybased encryption: the CanettiHaleviKatz transform generically turns an \textsf{IBE} into a \textsf{INDCCA2} \PKE~\cite{CHK04}, and signatures are directly implied from \textsf{INDCPA}secure \textsf{IBE}~\cite{BF01,BLS01}.


%Actually, even the question of having a trapdoorless \textsf{INDCCA2} public key encryption scheme still remains an open question.


Actually, a recent construction from Brakerski, Lombardi, Segev and Vaikuntanathan~\cite{BLSV18} gives a candidate which relies on garble circuits, and is fairly inefficient compared to \textsf{IBE}s with trapdoors.


Even the question of an \textsf{INDCCA2} public key encryption still does not have a satisfactory response.


The construction of Peikert and Waters~\cite{PW08} is indeed trapdoorfree, but is still less efficient than trapdoorbased ones.


In the general lattice setting, the most efficient signature schemes require at least as many matrices as the length $\ell$ of the random tag used in the signature (like the scheme in~\cref{se:gslwesigep}).


This cost has direct impact on the efficiency and publickey size of schemes or protocols that use them, like in our group signatures of~\cref{ch:gslwe}, where $\ell$ is logarithmic in the maximal number of members the group can accept $\Ngs$.


In ideal lattices, it is possible to reduce this cost to a vector of size $\ell$~\cite{DM14}.


In the group signature scheme of~\cite{LNWX18}, which is based on ideal lattice problems, they use this property to allow an exponential number of group members to join the group, and thus propose a ``constantsize'' group signature scheme.


The method used to construct this group signature is essentially the same as in \cref{ch:gslwe}, where matrices are hidden in the ring structure of the ideal lattice~\cite{LS14}.


Hence, the dependency on $\log \Ngs$ is actually hidden in the dimension of the ring.


As these signatures are a fundamental building block for privacypreserving cryptography, any improvement on them has a direct impact on the primitives that use them as a building block.




\begin{question}


Can we obtain more efficient latticebased onetime signatures in general lattices?


\end{question}




In our group signature and group encryption schemes (in \cref{ch:gslwe} and \cref{ch:gelwe} respectively), the signature and the ciphertext contain a public key for a onetime signature scheme.


One efficiency issue is that, in latticebased onetime signatures~\cite{LM08,Moh11}, the publickey contains a full matrix, that is part of the signature/ciphertext.


Therefore, this matrix significantly increase the size of the signature/ciphertext.


As security requirements for onetime signature are weaker than fullfledged signatures (namely, the adversary has access to only one signature per public key), we can hope for constructions of onetime signatures based on general lattices where the publickey is smaller that a fullmatrix.




As we explained in the introduction, advanced cryptography from lattices often suffers from the use of lattice trapdoors.


Thus, a natural question may be:




\begin{question}


Does an efficient trapdoorfree \textsf{(H)IBE} exist?


\end{question}




In the group encryption scheme of~\cref{ch:gelwe}, for instance, trapdoors are used for two distinct purposes.


They are used to build a secure publickey encryption scheme under adaptive chosenciphertext attacks and a signature scheme.


These primitives are both induced by identitybased encryption: the CanettiHaleviKatz transform generically turns an \textsf{IBE} into a \textsf{INDCCA2} \PKE~\cite{CHK04}, and signatures are directly implied from \textsf{INDCPA}secure \textsf{IBE}~\cite{BF01,BLS01}.


%Actually, even the question of having a trapdoorless \textsf{INDCCA2} public key encryption scheme still remains an open question.


Actually, a recent construction from Brakerski, Lombardi, Segev and Vaikuntanathan~\cite{BLSV18} (inspired by~\cite{DG17a}) gives a candidate which relies on garbled circuits, and is fairly inefficient compared to \textsf{IBE} schemes with trapdoors.


Even the question of a trapdoorless \textsf{INDCCA2} public key encryption still does not have a satisfactory response.


The construction of Peikert and Waters~\cite{PW08} is trapdoorfree, but remains very expensive.




\begin{comment}


\begin{question}


Can we achieve better security proofs for cryptographic schemes?


\end{question}



@ 82,3 +131,5 @@ As explained in~\cref{ch:proofs}, it is important to rely on simple assumptions


Given recent advances in cryptographic proofs~\cite{Hof16,KMP16,Hof17}, it is now possible to attain stronger security notions than what was claimed before~\cite{DSYC18}.


Another line of work targets the quality of the reduction, aiming for \textit{tight security}~\cite{GHKW16,AHN+17,LJYP14,LPJY15,LSSS17}.


This improves the understanding of the links between cryptographic schemes and hardness assumptions, leading to more reliable constructions.


\end{comment}






113
these.bib
113
these.bib

@ 322,7 +322,7 @@




@InProceedings{CHL05,


author = {Camenisch, Jan and Hohenberger, Susan and Lysyanskaya, Anna},


title = {Balancing Accountability and Privacy Using ECash},


title = {{Balancing Accountability and Privacy Using ECash}},


booktitle = {{SCN}},


year = {2005},


number = {4116},



@ 506,7 +506,7 @@




@InProceedings{CP92,


author = {Chaum, D. and Pedersen, T.},


title = {Transferred Cash Grows in Size},


title = {{Transferred Cash Grows in Size}},


booktitle = {{Eurocrypt}},


year = {1992},


volume = {658},



@ 1743,7 +1743,7 @@




@InProceedings{GH08,


author = {Matthew Green and Susan Hohenberger},


title = {Universally Composable Adaptive Oblivious Transfer},


title = {{Universally Composable Adaptive Oblivious Transfer}},


booktitle = {{Asiacrypt}},


year = {2008},


number = {5350},



@ 3129,4 +3129,111 @@


publisher = {ACM},


}




@InProceedings{LNWX18,


author = {Ling, San and Nguyen, Khoa and Wang, Huaxiong and Xu, Yanhong},


title = {{ConstantSize Group Signatures from Lattices}},


booktitle = {PKC},


year = {2018},


series = {LNCS},


pages = {5888},


publisher = {Springer},


abstract = {Latticebased group signature is an active research topic in recent years. Since the pioneering work by Gordon, Katz and Vaikuntanathan (Asiacrypt 2010), ten other schemes have been proposed, providing various improvements in terms of security, efficiency and functionality. However, in all known constructions, one has to fix the number N of group users in the setup stage, and as a consequence, the signature sizes are dependent on N.},


isbn = {9783319765815},


}




@InProceedings{DM14,


author = {Ducas, L{\'e}o and Micciancio, Daniele},


title = {{Improved Short Lattice Signatures in the Standard Model}},


booktitle = {Crypto},


year = {2014},


series = {LNCS},


pages = {335352},


publisher = {Springer},


abstract = {We present a signature scheme provably secure in the standard model (no random oracles) based on the worstcase complexity of approximating the Shortest Vector Problem in ideal lattices within polynomial factors. The distinguishing feature of our scheme is that it achieves short signatures (consisting of a single lattice vector), and relatively short public keys (consisting of O(logn) vectors.) Previous lattice schemes in the standard model with similarly short signatures, due to Boyen (PKC 2010) and Micciancio and Peikert (Eurocrypt 2012), had substantially longer public keys consisting of $\Omega$(n) vectors (even when implemented with ideal lattices).},


isbn = {9783662443712},


}




@InProceedings{Moh11,


author = {Mohassel, Payman},


title = {{OneTime Signatures and Chameleon Hash Functions}},


booktitle = {SAC},


year = {2011},


series = {LCNS},


pages = {302319},


publisher = {Springer},


abstract = {In this work we show a general construction for transforming any chameleon hash function to a strongly unforgeable onetime signature scheme. Combined with the result of [Bellare and Ristov, PKC 2007], this also implies a general construction of strongly unforgeable onetime signatures from $\Sigma$protocols in the standard model.},


isbn = {9783642195747},


}




@InProceedings{LM08,


author = {Lyubashevsky, Vadim and Micciancio, Daniele},


title = {{Asymptotically Efficient LatticeBased Digital Signatures}},


booktitle = {TCC},


year = {2008},


series = {LNCS},


pages = {3754},


publisher = {Springer},


abstract = {We give a direct construction of digital signatures based on the complexity of approximating the shortest vector in ideal (e.g., cyclic) lattices. The construction is provably secure based on the worstcase hardness of approximating the shortest vector in such lattices within a polynomial factor, and it is also asymptotically efficient: the time complexity of the signing and verification algorithms, as well as key and signature size is almost linear (up to polylogarithmic factors) in the dimension n of the underlying lattice. Since no subexponential (in n) time algorithm is known to solve lattice problems in the worst case, even when restricted to cyclic lattices, our construction gives a digital signature scheme with an essentially optimal performance/security tradeoff.},


isbn = {9783540785248},


}




@Article{LS14,


author = {Langlois, Adeline and Stehlé, Damien},


title = {{Worstcase to averagecase reductions for module lattices}},


journal = {Designs, Codes and Cryptography},


year = {2014},


}




@InProceedings{DG17a,


author = {D{\"o}ttling, Nico and Garg, Sanjam},


title = {{From Selective IBE to Full IBE and Selective HIBE}},


booktitle = {TCC},


year = {2017},


series = {LNCS},


pages = {372408},


publisher = {Springer},


abstract = {Starting with any selectively secure identitybased encryption (IBE) scheme, we give generic constructions of fully secure IBE and selectively secure hierarchical IBE (HIBE) schemes. Our HIBE scheme allows for delegation arbitrarily many times.},


isbn = {9783319705002},


}




@InProceedings{IKOS07,


author = {Ishai, Yuval and Kushilevitz, Eyal and Ostrovsky, Rafail and Sahai, Amit},


title = {{Zeroknowledge from Secure Multiparty Computation}},


booktitle = {STOC},


year = {2007},


pages = {2130},


publisher = {ACM},


acmid = {1250794},


doi = {10.1145/1250790.1250794},


isbn = {9781595936318},


keywords = {blackbox reductions, cryptography, secure computation, zeroknowledge},


location = {San Diego, California, USA},


numpages = {10},


url = {http://doi.acm.org/10.1145/1250790.1250794},


}




@InProceedings{JDF11,


author = {Jao, David and De Feo, Luca},


title = {{Towards QuantumResistant Cryptosystems from Supersingular Elliptic Curve Isogenies}},


booktitle = {PQCrypto},


year = {2011},


series = {LNCS},


pages = {1934},


publisher = {Springer},


abstract = {We present new candidates for quantumresistant publickey cryptosystems based on the conjectured difficulty of finding isogenies between supersingular elliptic curves. The main technical idea in our scheme is that we transmit the images of torsion bases under the isogeny in order to allow the two parties to arrive at a common shared key despite the noncommutativity of the endomorphism ring. Our work is motivated by the recent development of a subexponentialtime quantum algorithm for constructing isogenies between ordinary elliptic curves. In the supersingular case, by contrast, the fastest known quantum attack remains exponential, since the noncommutativity of the endomorphism ring means that the approach used in the ordinary case does not apply. We give a precise formulation of the necessary computational assumption along with a discussion of its validity. In addition, we present implementation results showing that our protocols are multiple orders of magnitude faster than previous isogenybased cryptosystems over ordinary curves.},


isbn = {9783642254055},


}




@InProceedings{GPS17,


author = {Galbraith, Steven D. and Petit, Christophe and Silva, Javier},


title = {{Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems}},


booktitle = {Asiacrypt},


year = {2017},


series = {LNCS},


pages = {333},


publisher = {Springer},


abstract = {We provide a new identification protocol and new signature schemes based on isogeny problems. Our identification protocol relies on the hardness of the endomorphism ring computation problem, arguably the hardest of all problems in this area, whereas the only previous scheme based on isogenies (due to De Feo, Jao and Pl{\^u}t) relied on potentially easier problems. The protocol makes novel use of an algorithm of KohelLauterPetitTignol for the quaternion version of the {\$}{\$}{\backslash}ell {\$}{\$} ℓ isogeny problem, for which we provide a more complete description and analysis. Our new signature schemes are derived from the identification protocols using the FiatShamir (respectively, Unruh) transforms for classical (respectively, postquantum) security. We study their efficiency, highlighting very small key sizes and reasonably efficient signing and verification algorithms.},


isbn = {9783319706948},


}




@Comment{jabrefmeta: databaseType:bibtex;}




Loading…
Reference in New Issue