Public-key encryption using LWE type ciphertext

Abstract

Some embodiments are directed towards generating a public key and / or encrypting a message () with the public key. Generating a public key may involve computing a vector in the public key, which involves applying the equations (I), (I) of a bivariate vector-valued function to a random vector and a private key. Encrypting a message may involve computing a vector (a), which includes applying the bivariate vector-valued function to the vector in the public key and the random vector to compute a scalar (b). The resulting ciphertext may be of type LWE. Noise may be added for security.

Claims

1. A method (510) for encrypting a message (m) with a public key, - Obtaining the public key ((A, B)) corresponding to the public / private key pair (511), wherein the key pair can be computed by the key pair generation method, and the key pair generation method is - Obtaining a private key containing a bounded random vector (s) (521), - To generate a public key containing a pair of vectors ((A, B)), and to generate it, - Randomly generate the first vector (A) of the vector pair (522), - Computing the second vector (B) of the vector pair from the first vector and the private key (s) (523), which is a bivariate vector-valued function [Math 1] Computation (523), which includes applying to a first vector (A) and a private key (s), Including generating and including obtaining (511), - Obtaining a scalar (m) representing the plaintext message (512), - Computing a public-key cryptographic algorithm involving a pair of vectors (a) and scalars (b) (513), and including the computation, - Generating a bounded random vector (r) (514), - Computation (515) of vector (a), which includes applying a bivariate vector-valued function to a first vector (A) and a random vector (r) in the public key, - Compute a scalar (b) (516), which involves calculating the inner product of a second vector (B) in the public key and a random vector (r), and encoding the plaintext message scalar. [Math 2] A method including the addition of (516) a calculation.

2. - Generating the public key includes randomly generating a noise vector (e), and computing the second vector (B) involves adding the noise vector (e). [Math 3] including and / or, - Computing public-key cryptography is the first noise vector (e １ ) and the second noise scalar (e ２ This includes generating the first noise vector (e １ Add ) [Math 4] This includes the calculation of the scalar (b), which is the second noise scalar (e). ２ Add ) [Math 5] A method for encryption according to claim 1, including the method described in claim 1.

3. The predetermined index (i) of the output of the bivariate vector-valued function applied to the first vector (u) and the second vector (v) is the inner product of the first vector (u) and the second vector (v). [Math 6] A method for encryption according to claim 1 or 2, which is equivalent to the method described in claim 1 or 2.

4. Bivariate vector-valued function [Number 7] However, convolution (*) and univariate functions [Number 8] Obtained from this, the bivariate function for the first vector (u) and the second vector (v) is applied to the first vector and the vector obtained from the univariate function applied to the second vector in a convolution. [Number 9] A method for encryption according to any one of claims 1 to 3, as defined as:

5. The method for encryption according to claim 4, wherein the univariate function is linear and is defined by a predetermined index and convolution.

6. The folding, A method for encryption according to claim 4 or 5, wherein a convolution derived from a quotient polynomial (p) and applied to a first vector and a second vector is obtained by mapping the first and second vectors to the first and second polynomials, multiplying the first polynomial and the second polynomial, calculating the remainder when the resulting polynomial is divided modulo the quotient polynomial (p), and mapping the result to a vector.

7. The quotient polynomial is X ｎ The method for encryption according to claim 6, wherein the value is +1.

8. The two-variable vector-valued function is given by two vectors u = (u １ , . . . , u ｎ ), v = (v １ ,..., v ｎ ) ∈ Z ｎ For..., [Number 10] A vector defined by [Math 11] A method of encryption according to any one of claims 1 to 7, as defined as:

9. - Multiple scalars (m) representing multiple plaintext messages ｋ ) to obtain, - Calculate the vector (a) of public key encryption once, - Bivariate vector-valued function [Math 12] The application of the formula to the second vector (B) and the random vector (r) such that one component of the resulting vector is the inner product of the second vector (B) and the random vector (r) in the public key, - Multiple scalars (m ｌ Encode each of the following [Number 13] This includes calculating and - Encrypting multiple scalars means adding different components of the resulting vector to different scalars among the encoded scalars. [Number 14] including, e ２，ｌ However, the possible noise values ​​are multiple messages (m ｋ The encryption method according to any one of claims 1 to 8 for encrypting ) with a public key.

10. A bounded vector has bounded elements, and the elements are, - It is binary, or - A method of encryption according to any one of claims 1 to 9, wherein the encryption is trivalent.

11. - The dimension of the vector is a power of 2, or - The dimension of the vector is the value obtained by multiplying 2 by 3, and / or - The method according to any one of claims 1 to 10, wherein the dimension of the vector is φ(M), and φ represents Euler's totient function for some integer M.

12. In public-key cryptography, the vector (a) and / or scalar (b) are - Defined on the ring Z / qZ, and public encryption is LWE ciphertext on Z / qZ, or - Discretized torus T ｑ As defined above, public encryption is T ｑ The above is an LWE ciphertext, or - The method according to any one of claims 1 to 11, wherein the public encryption is defined on a real torus T and the public encryption is an LWE ciphertext on T.

13. The encryption method according to any one of claims 1 to 12, wherein the bivariate vector-valued function satisfies the constraint that decrypting the encrypted message yields the original message.

14. The encryption method according to any one of claims 1 to 13, wherein the bivariate vector-valued function is linear for both inputs.

15. The encryption method according to any one of claims 1 to 14, wherein the first and second vectors (A, B) in the public key have elements in a set of integers modulo q(Z / qZ), the message scalar is selected from a set of integers modulo t, where q > t, and the encoding is either multiplying the plaintext message scalar (m) by the rounding of q / t, or rounding the multiplication of the plaintext message scalar (m) and q / t.

16. Homomorphism calculation method, - Receiving an encrypted message, wherein the encrypted message is obtained by encrypting a plaintext message with a public key according to the encryption method described in any of claims 1 to 15. - A homomorphic computation method, which includes performing homomorphic computation on encrypted input data on a server computer to obtain output data encrypted with a public key.

17. A method (530) for decrypting a message encrypted with a public key as described in any of claims 1 to 16 using a private key, - Receiving an encrypted message encrypted with a public key (531), wherein the encrypted message includes a vector (a) and a scalar (b), - Obtaining the private key(s) corresponding to the public key used in the encrypted message (532), A method comprising (533) calculating a decryption element by subtracting the inner product of a vector (a) in an encrypted message and a private key from a scalar (b) in an encrypted message, and obtaining a plaintext message scalar from the result of the subtraction.

18. A method for decrypting a plurality of messages encrypted with a public key as described in any of claims 9 to 15 using a private key, - Receiving an encrypted message encrypted with a public key, wherein the encrypted message is a vector (a) and a plurality of scalars (b) ｌ ) including receiving, - Vector (a) into multiple LWE type ciphertexts (Ψ ｊｌ (a), b ｌ This involves converting to a conversion map (Ψ ｊｌ ) including transformations, - A method comprising decrypting each LWE type ciphertext as described in claim 17.

19. A system comprising one or more processors and one or more memory devices storing instructions, wherein when an instruction is executed by one or more processors, the system causes one or more processors to perform an operation according to any one of claims 1 to 18.

20. A non-temporary computer storage medium encoded with instructions, wherein, when executed by one or more computers, the instructions cause one or more computers to perform an operation according to any one of claims 1 to 18.

Images