Conclusion

chap-conclusion.tex

@@ -7,7 +7,7 @@ These contributions focus on the design and analysis of new cryptographic scheme
 
 In pairing-related cryptography, we propose a practical dynamic group signature scheme, for which security is well understood.
 It relies on broadly used assumptions with simple statements that exists for more than ten years.
-This work is also supported by a practical implementation in C.
+This work is also supported by an implementation in C.
 
 Our work in the lattice work give rise of three fundamental schemes that were missing in the landscape of lattice-based privacy-preserving primitives.
 Even if these schemes suffer from some efficiency issues due to their novelty, we do believe that it's one step toward a quantum-secure privacy-friendly world.
@@ -20,15 +20,50 @@ This made a breeding ground for new theoretical constructions, as well as going
 
 \section*{Open Problems}
 
-The path of providing new cryptographic primitives and proving them is sometimes uneven.
+The path of providing new cryptographic primitives and proving them is disseminated with pitfalls.
 The most obvious questions that stem from this work are about how to tackle the compromises we made in the design of those primitives.
 
 \begin{question}
-  Is it possible to build an adaptive oblivious transfer with access control with polynomially-large approximation factor?
+  Is it possible to build an adaptive oblivious transfer with access control secure under $\LWE$ with polynomially large modulus?
 \end{question}
 
-In other words, is it possible to avoid smudging to keep message-privacy in the oblivious transfer scheme of~\cref{ch:ot-lwe}.
+In other words, is it possible to avoid the use of smudging to guarantee message-privacy in the oblivious transfer scheme of~\cref{ch:ot-lwe}.
+As is, this problem arises from the use of Regev's encryption scheme, which does not guarantee this message privacy.
+However, finer analysis on GSW ciphertexts~\cite{GSW13} seems promising to achieve this at reasonable cost~\cite{BDPMW16}.
+Then, the main difficulty is to have compatible zero-knowledge proof with the access control and the encryption layers.
+
+\begin{question}
+  Can we provide NIZK proofs in the standard model for all $\NP$ languages relying on standard $\LWE$ assumption only?
+\end{question}
+
+Extending the work of Groth, Ostrovsky and Sahai~\cite{GOS06} in the lattice setting would be a great improvement for lattice-based privacy-preserving cryptography.
+Recent line of work goes toward this direction~\cite{RSS18}, but relies on non-existing primitive yet ($\NIZK$ proofs for a variant of the bounded decoding distance problem).
+
+The Stern-like proof system we work on in during this thesis, despite being flexible enough to prove a large variety of statements, suffers from the stiffness of being combinatorial.
+The choice of permutations used to ensure zero-knowledgeness (and so witness-indistinguishability) is quite strict, and force the challenge space to be ternary.
+This proves to be a real bottleneck in the efficiency of such proof systems.
+
+\begin{question}
+  Is it possible to construct zero-knowledge protocols for average-case problems that take advantage of the geometry of lattices?
+\end{question}
+
+As explained in~\cref{ch:zka}, nowadays lattice-based proof systems for $\SIS$/$\LWE$ rely either on the additional structure lying in special families of lattices, or on the combinatorial nature of representations of lattices in terms of matrices.
+If the natural structure of a lattice is a group, additive noise or witness-length restrictions forbid the use of standard group-based cryptography to undertake this problem.
+However, lattices naturally carry a strong geometrical structure, as exploited in~\cite{MV03,PV08} to construct (interactive and non-interactive) zero-knowledge proofs for some worst-case lattice problems.
+It may be an interesting question to see if the restricted geometry of average-case lattice problems can be exploited to provide such proofs.
+If these proof systems can be used after applying a transformation from average-case to worst-case problem, this methodology is highly inefficient and does not close the question.
+
+As we explained in the introduction, advanced cryptography from lattices often suffers from the use of lattice trapdoors.
+Thus, a natural question may be:
+
+\begin{question}
+  Does a trapdoor-free (H)IBE exists?
+\end{question}
+
+For instance, in the group encryption scheme of~\cref{ch:ge-lwe}, trapdoors are used in two places.
+To have a secure public key encryption scheme under adaptive active attacks and for the signature scheme.
+Both these primitives are induced by identity-based encryption: the Canetti-Halevi-Katz transformations generically transform an IBE into a \textsf{IND-CCA2} \PKE~\cite{CHK04}, and signatures are directly implied from \textsf{IND-CPA-}secure IBE~\cite{BF01,BLS01}.
+Actually, even the question of having a trapdoorless \textsf{IND-CCA2} public key encryption scheme still remains an open question.
 
 \begin{question}
-
 \end{question}

these.bib

@@ -2991,4 +2991,22 @@
   publisher = {Springer},
 }
 
+@Misc{RSS18,
+  author       = {Ron D. Rothblum and Adam Sealfon and Katerina Sotiraki},
+  title        = {{Towards Non-Interactive Zero-Knowledge for NP from LWE}},
+  howpublished = {{iacr ePrint Report}},
+  year         = {2018},
+  note         = {\url{https://eprint.iacr.org/2018/240}},
+}
+
+@InProceedings{BLS01,
+  author    = {Boneh, Dan and Lynn, B. and Shacham, H.},
+  title     = {{Short signatures from the Weil pairing}},
+  booktitle = {Asiacrypt},
+  year      = {2001},
+  series    = {LNCS},
+  pages     = {514--532},
+  publisher = {Springer},
+}
+
 @Comment{jabref-meta: databaseType:bibtex;}