Laconic encryption scheme for compressed public keys

Abstract

The present disclosure provides a method for laconic encryption, comprising: generating a public key and a secret key; computing a digest based on the public key; generating a ciphertext by combining the digest with a message; and decrypting the ciphertext using the secret key and non-secret decryption material. The method enables cryptographic primitives with sublinear communication complexity in two messages, where communication and computation complexity are essentially independent of the size of an input. The laconic encryption scheme is secure under the Learning With Errors assumption with polynomial modulus-to-noise ratio. The method can be used to construct laconic oblivious transfer, registration-based encryption, and laconic private-set intersection protocols with optimal parameters and practical efficiency. Additionally, the laconic encryption can be preprocessed for more efficient online encryption.

Description

[0001]LACONIC ENCRYPTION SCHEME FOR COMPRESSED PUBLIC KEYSCROSS-REFERENCE TO RELATED APPLICATIONThis application claims the benefit of U.S. Provisional Application Ser. No. 63 / 572,354filed March 31, 2024, the content of which is incorporated by reference herein in its en-tirety.STATEMENT OF GOVERNMENT SUPPORTThis invention was made with government support under NSF Grant Nos. CNS-1750795 and CNS-2055510. The government has certain rights in the invention.FIELD OF THE INVENTIONThe present disclosure generally relates to the field of cryptographic systems, andmore specifically, to methods for compressing public keys of multiple users into asingle digest for efficient encryption and decryption processes.BACKGROUND OF THE INVENTIONIn the field of cryptography, public-key encryption schemes are widely used tosecure communication over untrusted networks. In such schemes, each user has a pairof keys: a public one, which is openly shared and used by others to encrypt messages,and a private one, which is kept secret and used to decrypt received messages.One of the challenges in public-key encryption systems is the management of pub-lic keys, especially in scenarios involving a large number of users. Transmitting, stor-ing, and verifying these keys can be resource-intensive, particularly in systems withlimited bandwidth or storage capacity.A common approach to address this issue is to compress multiple public keys intoa single digest. This process involves using a cryptographic scheme to combine thekeys into a shorter representation, which can then be used for encryption. The cor-responding decryption process requires additional information, often referred to as adecryption hint, which is typically associated with each user’s private secret.The efficiency of such compression schemes is often measured in terms of the sizeof the resulting digest and the ciphertexts produced by the encryption process. Ideally,these sizes would be as small as possible to minimize the resources used for transmis-sion and storage.Compressing the public cryptographic keys of multiple users into a short publicdigest offers several advantages, particularly in systems where efficiency, security, andverifiability are crucial. Some key reasons why this approach can be useful are:Efficiency in Transmission: A short public digest can significantly reduce the amountof data that needs to be transmitted over the network. This is particularly beneficial inenvironments with bandwidth constraints or where quick communication is essential,such as in IoT (Internet of Things) devices or mobile applications.Storage Optimization: By compressing multiple keys into a single digest, the amountof storage required to hold cryptographic keys can be greatly reduced. This is espe-cially useful for systems with limited storage capacity or for applications that needto store a large number of public keys, like blockchain networks or large-scale securemessaging platforms.Simplified Key Management: Managing a large number of public keys can be com-plex and error-prone. A single digest simplifies this process, as only one key (the di-gest) needs to be verified or updated, rather than managing and verifying each keyindividually. This can streamline operations in systems where user management is asignificant overhead.Enhanced Privacy: Compressing keys into a digest can obscure individual users’keys, offering an additional layer of privacy. While the digest itself doesn’t revealthe specific keys, it still allows for the verification of a user’s identity through crypto-graphic means. This can be particularly useful in applications where user privacy isparamount. Scalability: As the number of users in a system grows, the ability to compress theirpublic keys into a digest helps maintain scalability. It ensures that the system canaccommodate more users without a linear increase in the overhead associated withkey management, storage, and transmission.Faster Verification Processes: In some cryptographic schemes, it might be possibleto verify a signature or authenticate a message against the public digest rather thanneeding to access each user’s individual public key. This can lead to faster and moreefficient verification processes, beneficial in time-sensitive applications.Aggregate Signatures: In certain cryptographic systems, a digest of multiple keyscan facilitate aggregate signatures, where a single signature can prove that a messagehas been signed by multiple users. This is particularly useful in consensus mecha-nisms or when collective authorization is required.However, it’s important to note that the practicality and security of compressingpublic keys into a digest depend on the cryptographic scheme used and the specificrequirements of the system. The approach must be designed to prevent security vul-nerabilities, such as collisions, where two different sets of keys could produce the samedigest. With respect to compressing the public keys of multiple users into a single digestand considering the size of the ciphertext made using the digest, the current state ofthe art primarily focuses on using multi-key homomorphic encryption and aggregatesignatures. The specific ciphertext size and the efficiency of these approaches dependon various factors, such as the chosen cryptographic scheme, security parameters, andthe number of users involved.Given the overall utility of these approaches, it would be beneficial to have theciphertexts produced by the digest to be relatively more compact.BRIEF SUMMARY OF THE INVENTIONThis summary is provided to introduce a selection of concepts in a simplified formthat are further described below in the detailed description. This summary is notintended to identify key features or essential features of the claimed subject matter,nor is it intended to be used as an aid in determining the scope of the claimed subjectmatter. According to an aspect of the present disclosure, a method for compressing publickey material for multiple users in a single digest is provided. The method includesexecuting, by a computerized processor, a setup procedure for a user i to generate apublic and secret key pair. The setup procedure comprises sampling, by a random bitgenerator module, vi from {0, 1}m, such that vi is a random set of bits for the user i,wherein {0, 1}m represents the set of binary vectors of length m. The setup procedurefurther comprises computing, by a public key computation module, pi is defined asA v , wherein A n×m0 i 0 is a public random parameter matrix in Zq , where denotesthe ring of integers modulo q. The setup procedure also includes locally storing, ina non-transitory computer-readable storage medium, the public and secret keys as(pki, ski) is defined as (pi,vi). The method further includes generating, by a digestgeneration module, a single digest from L public keys. This generation comprises re-ceiving, via a network interface, pk1, ... , pkL, where L represents a total number ofusers. For i ∈ [L], parsing, by a data processing unit, pki is pi and setting Pi is definedas [pi | 0 | · · · | 0] ∈ Zn×mq , where [L] denotes the set {1, 2, ... , L}. The method alsoincludes setting, by the data processing unit, P is (P1, ... ,PL), where P represents acollection of all public key matrices. The method further comprises establishing, by amatrix function module, a matrix-valued function mReadP(i) is Pi, where mReadP isa function that returns the matrix Pi when given index i. The method also includescomputing, by a homomorphic evaluation module, an EvalPK homomorphic evalua-tion of mRead over a public rando n×ℓm ∗P m parameter A ∈ Zq to obtain (A , {Hi}i∈[L]),where Hi are corresponding coefficient matrices and A∗ is a resulting evaluation ma-trix. The method further comprises setting, by the data processing unit, witi is (i,hi)where hi is a first column of Hi to be non-secret decryption material for the user i,and storing witi in the non-transitory computer-readable storage medium. Finally, themethod includes setting, by the data processing unit, dig is defined as A∗ to be thesingle digest, and storing the single digest in the non-transitory computer-readablestorage medium.According to other aspects of the present disclosure, the method may include oneor more of the following features. The method may further comprise generating a ci-phertext for an individual user by receiving the public parameters A0,A, the singledigest A∗, an index i and a message µ for encryption; sampling a learning with errorssecret vector s; computing a learning with errors sample c0 based on the learning witherrors secret vector s and the public random parameter matrix A0; computing a learn-ing with errors sample c1 based on the learning with errors secret vector s and a matrixA − i ⊗ G; computing c2 to be the sum of µ · ⌈q / 2⌋ and a learning with errors samplebased on the learning with errors secret vector s and the single digest A∗, wherein q isa modulus of the method; and forming a ciphertext as a combination ct is (c0, c1, c2).The method may also include decrypting the ciphertext ct for the individual user iwho has a secret key sk and non-secret decryption material witi by parsing the cipher-text ct is (c0, c1, c2), the secret key sk is vi and the non-secret decryption material witiis (i,hi); and computing the message µ as µ is defined as roundq(c2 − c⊤ ⊤1 hi − c0 vi),wherein roundq(x) is ⌈2x / q⌋. The method may further comprise receiving, via the net-work interface, a request to update a public key for a user with index j, where j ∈ [L]or to add a new public key for a user with index L+1; executing, by the comput-erized processor, the setup procedure to generate a new public and secret key pair(pk′j, sk′ j) for the user j; updating, by the digest generation module, the single digestdig and the non-secret decryption materials {witi}i∈[L] by recomputing Pj using thenew public key pk′j , recomputing the EvalPK homomorphic evaluation of mReadP withthe updated Pj , and updating dig and {witi}i∈[L] based on the recomputed evaluation;and storing the updated dig and {witi}i∈[L] in the non-transitory computer-readablestorage medium. The EvalPK homomorphic evaluation may be performed using abootstrapped preprocessing system of homomorphic operations, and the method mayfurther comprise generating, by the computerized processor, a data structure DS dur-ing the EvalPK evaluation; storing DS in the non-transitory computer-readable storagemedium; and using DS in subsequent homomorphic evaluations to reduce computa-tional complexity to polylog L.According to another aspect of the present disclosure, a system for compressingpublic key material for multiple users in a single digest is provided. The system in-cludes a computerized processor configured to execute a setup procedure for a useri to generate a public and secret key pair. The setup procedure comprises a randombit generator module configured to sample vi from {0, 1}m, such that vi is a randomset of bits for the user i, wherein {0, 1}m represents the set of binary vectors of lengthm; a public key computation module configured to compute pi is defined as A0vi,wherein A is a public random p n×m0 arameter matrix in Zq , where denotes the ringof integers modulo q; and a non-transitory computer-readable storage medium con-figured to locally store the public and secret keys as (pki, ski) is defined as (pi,vi).The system also includes a digest generation module configured to generate a singledigest from L public keys. The digest generation module comprises a network inter-face configured to receive pk1, ... , pkL, where L represents a total number of users; adata processing unit configured to, for i ∈ [L], parse pki is pi and set Pi is defined as[pi | 0 | · · · | 0] ∈ Zn×mq , where [L] denotes the set {1, 2, ... , L}; the data processing unitfurther configured to set P is (P1, ... ,PL), where P represents a collection of all publickey matrices; a matrix function module configured to establish a matrix-valued func-tion mReadP(i) is Pi, where mReadP is a function that returns the matrix Pi when givenindex i; a homomorphic evaluation module configured to compute an EvalPK homo-morphic evaluation of mReadP over a public random parameter A ∈ Zn×ℓmq to obtain(A∗, {H } ), where H are corresponding coefficient matrices a ∗i i∈[L] i nd A is a resultingevaluation matrix; the data processing unit further configured to set witi is (i,hi) wherehi is a first column of Hi to be non-secret decryption material for the user i, and storewiti in the non-transitory computer-readable storage medium; and the data processingunit further configured to set dig is defined as A∗ to be the single digest, and store thesingle digest in the non-transitory computer-readable storage medium.According to other aspects of the present disclosure, the system may include one ormore of the following features. The system may further comprise a ciphertext genera-tion module configured to generate a ciphertext for an individual user by receiving thepublic parameters A0,A, the single digest A∗, an index i and a message µ for encryp-tion; sampling a learning with errors secret vector s; computing a learning with errorssample c0 based on the learning with errors secret vector s and the public random pa-rameter matrix A0; computing a learning with errors sample c1 based on the learningwith errors secret vector s and a matrix A−i⊗G; computing c2 to be the sum of µ·⌈q / 2⌋and a learning with errors sample based on the learning with errors secret vector s andthe single digest A∗, wherein q is a modulus of the system; and forming a ciphertextas a combination ct is (c0, c1, c2). The system may also include a decryption moduleconfigured to decrypt the ciphertext ct for the individual user i who has a secret keysk and non-secret decryption material witi by parsing the ciphertext ct is (c0, c1, c2), thesecret key sk is vi and the non-secret decryption material witi is (i,hi); and computingthe message µ as µ is defined as round ⊤ ⊤q(c2 − c1 hi − c0 vi), wherein roundq(x) is ⌈2x / q⌋.The network interface may be further configured to receive a request to update a pub-lic key for a user with index j, where j ∈ [L] or to add a new public key for a userwith index L+1; the computerized processor may be further configured to execute thesetup procedure to generate a new public and secret key pair (pk′′ j, sk j) for the user j;the digest generation module may be further configured to update the single digest digand the non-secret decryption materials {witi}i∈[L] by recomputing Pj using the newpublic key pk′j , recomputing the EvalPK homomorphic evaluation of mReadP with theupdated Pj , and updating dig and {witi}i∈[L] based on the recomputed evaluation; andthe non-transitory computer-readable storage medium may be further configured tostore the updated dig and {witi}i∈[L]. The EvalPK homomorphic evaluation may be per-formed using a bootstrapped preprocessing system of homomorphic operations, andthe computerized processor may be further configured to generate a data structure DSduring the EvalPK evaluation; the non-transitory computer-readable storage mediummay be further configured to store DS; and the homomorphic evaluation module maybe further configured to use DS in subsequent homomorphic evaluations to reducecomputational complexity to polylog L.According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing instructions that, when executed by a processor,cause the processor to perform a method for compressing public key material formultiple users in a single digest is provided. The method includes executing a setupprocedure for a user i to generate a public and secret key pair. The setup procedurecomprises sampling vi from {0, 1}m, such that vi is a random set of bits for the useri, wherein {0, 1}m represents the set of binary vectors of length m; computing pi isdefined as A v , wherein A is a public random p n×m0 i 0 arameter matrix in Zq , where denotes the ring of integers modulo q; and locally storing the public and secret keys as(pki, ski) is defined as (pi,vi). The method further includes generating a single digestfrom L public keys. This generation comprises receiving pk1, ... , pkL, where L repre-sents a total number of users; for i ∈ [L], parsing pki is pi and setting Pi is defined as[pi | 0 | · · · | 0] ∈ Zn×mq , where [L] denotes the set {1, 2, ... , L}; setting P is (P1, ... ,PL),where P represents a collection of all public key matrices; establishing a matrix-valuedfunction mReadP(i) is Pi, where mReadP is a function that returns the matrix Pi whengiven index i; computing an EvalPK homomorphic evaluation of mReadP over a publicrandom parameter A ∈ Zn×ℓm ∗q to obtain (A , {Hi}i∈[L]), where Hi are correspondingcoefficient matrices and A∗ is a resulting evaluation matrix; setting witi is (i,hi) wherehi is a first column of Hi to be non-secret decryption material for the user i, and stor-ing witi; and setting dig is defined as A∗ to be the single digest, and storing the singledigest. According to other aspects of the present disclosure, the method stored on thenon-transitory computer-readable storage medium may include one or more of thefollowing features. The method may further comprise generating a ciphertext for anindividual user by receiving the public parameters A ∗0,A, the single digest A , an in-dex i and a message µ for encryption; sampling a learning with errors secret vector s;computing a learning with errors sample c0 based on the learning with errors secretvector s and the public random parameter matrix A0; computing a learning with er-rors sample c1 based on the learning with errors secret vector s and a matrix A− i⊗G;computing c2 to be the sum of µ · ⌈q / 2⌋ and a learning with errors sample based on thelearning with errors secret vector s and the single digest A∗, wherein q is a modulusof the method; and forming a ciphertext as a combination ct is (c0, c1, c2). The methodmay also include decrypting the ciphertext ct for the individual user i who has a secretkey sk and non-secret decryption material witi by parsing the ciphertext ct is (c0, c1, c2),the secret key sk is vi and the non-secret decryption material witi is (i,hi); and com-puting the message µ as µ is defined as roundq(c2 − c⊤1 hi − c⊤0 vi), wherein roundq(x) is⌈2x / q⌋. The method may further comprise receiving a request to update a public keyfor a user with index j, where j ∈ [L] or to add a new public key for a user with in-dex L+1; executing the setup procedure to generate a new public and secret key pair(pk′′ j, sk j) for the user j; updating the single digest dig and the non-secret decryptionmaterials {wit } by recomputing Pj usin ′i i∈[L] g the new public key pkj , recomputingthe EvalPK homomorphic evaluation of mReadP with the updated Pj , and updatingdig and {witi}i∈[L] based on the recomputed evaluation; and storing the updated digand {witi}i∈[L]. The EvalPK homomorphic evaluation may be performed using a boot-strapped preprocessing system of homomorphic operations, and the method may fur-ther comprise generating a data structure DS during the EvalPK evaluation; storingDS; and using DS in subsequent homomorphic evaluations to reduce computationalcomplexity to polylog L.The foregoing general description of the illustrative embodiments and the follow-ing detailed description thereof are merely exemplary aspects of the teachings of thisdisclosure and are not restrictive.BRIEF DESCRIPTION OF THE DRAWINGSNon-limiting and non-exhaustive examples are described with reference to the fol-lowing figures.Fig. 1 illustrates an example setup, encrypt, and decrypt routine for a distributedencryption system, according to aspects of the present disclosure.Fig. 2 depicts a block diagram of an exemplary computer system, in accordancewith example embodiments.Fig. 3 illustrates another block diagram of an exemplary computer system, accord-ing to an embodiment.Fig. 4 depicts a block diagram of a laconic encryption system, according to aspectsof the present disclosure.Fig. 5 illustrates a block diagram of a decryption system, in accordance with exam-ple embodiments.Fig. 6 depicts a block diagram of a public key compression system, according to anaspect of the present disclosure.DETAILED DESCRIPTIONThe following description sets forth exemplary aspects of the present disclosure.It should be recognized, however, that such description is not intended as a limita-tion on the scope of the present disclosure. Rather, the description also encompassescombinations and modifications to those exemplary aspects described herein.A detailed description of systems, devices, and methods consistent with embodi-ments of the present disclosure is provided below. While several embodiments are de-scribed, it should be understood that disclosure is not limited to any one embodiment,but instead encompasses numerous alternatives, modifications, and equivalents. Inaddition, while numerous specific details are set forth in the following descriptionin order to provide a thorough understanding of the embodiments disclosed herein,some embodiments can be practiced without some or all of these details. Moreover,for the purpose of clarity, certain technical material that is known in the related art hasnot been described in detail in order to avoid unnecessarily obscuring the disclosure.With reference to Fig. 1, exemplary setup, encryption, and decryption routines aredepicted. Local device 1 101, local device 2 102, and up to an arbitrary local device n103, perform respective setup procedures 104, 105, and 106. During the setup proce-dures at each local device, a random set of bits is sampled to serve as the secret keys.Subsequently, the public keys are computed based on the sampled private materialand a public random parameter. The public keys, denoted as pk1 107, pk2 108, andup to pkn 109, are then transmitted across a network to a centralized key store 110. Atthe centralized location, the public keys are aggregated to form a single digest, whichis represented in Fig. 1 as digest A 111.A ciphertext generation module 114 retrieves digest A 111 from the centralized keystore 110 and acquires a message 113. The message 113 may encompass any form ofdata that is representable in a computer-readable format, which includes, but is notlimited to, plaintext or data that has been encrypted previously. Utilizing digest A 111and message 113, the ciphertext generation module 114 proceeds to produce ciphertext116. In an alternative embodiment, the ciphertext generation module 114 may employdifferent cryptographic algorithms or parameters to generate ciphertext 116, whichcould provide varying levels of security or efficiency. For instance, the module 114may use alternative public random parameters or different methods of combining thepublic keys into digest A 111, such as through the use of hash functions or other cryp-tographic transformations.A ciphertext decryption module 117 is configured to receive secret key and non-secret decryption material. For example, secret key 118 from local device 1 101 andnon-secret decryption material wit1 119 are used to reconstruct a decrypted mes-sage 119. The decryption process may vary depending on the specific cryptographicscheme employed. For instance, alternative decryption algorithms or parameters maybe used to accommodate different security requirements or to optimize for perfor-mance in various computing environments.In some embodiments, the ciphertext decryption module 117 may utilize addi-tional or alternative non-secret decryption material to facilitate the decryption pro-cess. This could include, for example, auxiliary data derived from the public keys orthe digest, which may be used to enhance the security or efficiency of the decryptionprocess. Additionally, the module 117 may be adapted to support decryption by mul-tiple local devices, each using their respective secret keys and non-secret decryptionmaterial to access the encrypted message.Various embodiments and details regarding implementation are disclosed below.1 PreliminariesDefine N = {0, 1, 2, ...} to be the set of natural numbers. For any integer n ≥ 1, define[n] = {1, ... , n}. For an array A ∈ {0, 1}n, we index the array from 1, and A[i] denotesthe bit in position i ∈ [n]. By default, all our logarithms are base 2 and log n stands forlog2 n. A function ν : N → N is said to be negligible, denoted ν(n) = negl(n), if for everypositive polynomial p(·) and all sufficiently large n it holds that ν(n) < 1 / p(n). We usethe abbreviation PPT for probabilistic polynomial time. For a finite set S, we writea ← S to mean a is sampled uniformly randomly from S. For a randomized algorithmA, we let a ← A(·) denote the process of running A(·) and assigning the outcometo a; when A is deterministic, we write a := A(·) instead. We denote the securityparameter by λ. For two distributions X, Y parameterized by λ we say that they arecomputationally indistinguishable, denoted by X ≈c Y if for every PPT distinguisherD we have = negl(λ). We say X and Y are statisticallyindistinguishable instead if the same holds for every unbounded distinguisher D.For any integer q ≥ 1, let Zq be the ring Z / qZ. We adhere to the convention thatvectors u ∈ Znq are column vectors and we define the ℓ∞-norm over vectors over Zq byfirst lifting each coordinate to its representative in the set [−q / 2, q / 2). That is, for anyu = (u1, ... ,un)⊤ we define ∥u∥∞ = maxi |ui|. For a matrix A ∈ Zn×mq , we define∥A∥ as the operator norm of A with respect to the ℓ∞-norm, that is, where (Aij) are the entries of A. We define the function roundq : 1}via roundq(x) = ⌈2x / q⌋ where x ∈ Zq is identified with its representative in the set[−q / 2, q / 2). Note that for any µ ∈ {0, 1} and e ∈ Z with |e| < q / 4, we have roundq(µ ⌈q / 2⌋+e) = µ.1.1 Learning with Errors and Lattice ToolsLearning with Errors. denote the discrete Gaussian distribution over Z withwidth σ ≥ 0. The truncated discrete Gaussian DZ,σ,≤B over Z with width σ and boundB ≥ 0 is the distribution that√samples x ← DZ,σ and outputs x if |x| ≤ B and 0otherwise. Setting B = σ · Ω( λ), we have that DZ,σ,≤B. Throughout thispaper, we use the shorthand χB to denote the truncated discrete Gaussian over Z withwidth σ = B / λ and bound B.Definition 1.1 ((Decision) LWE). Let n, q, B ∈ N be functions of the security parameter.The learning with errors (LWE) assumption LWEn,q,B states that for all m = poly(λ),(A, s⊤A + e⊤) ≈c (A,u),where A ← Zn×m , s ← Zn mq q , e ← χB .We write simply that LWE holds to mean the statement that for any p = poly(λ)there exists some n = poly(λ), q = 2poly(λ) and B = B(λ) such that B ≤ q / 2p andLWEn,p,Bholds.The Gadget Matrix. Let n, q ∈ N and let m = n ⌈log q⌉. Define the vector The gadget matrix is the block diagonal matrix g⊤⊗I ∈ Zn×mq . We also define the gadgetmatrix for m ≥ n ⌈log q⌉ by appropriately padding with zeros.There is an efficient algorithm G−1(·) that, on input a vector u ∈ Znq , outputs abinary vector t = G−1(u) ∈ {0, 1}m such that Gt = u.Lattice Trapdoors. Let n, q ∈ N. For a matrix A ∈ Zn×mq , a trapdoor for A is a matrixT ∈ Zm×mq such that AT = G. There exists some m0 = O(n log q) and a PPT algorithm(A,T) ← TGen(1n, 1m, q) that, as long as m ≥ m0, samples a matrix along with anassociated trapdoor such that A is statistically close to a uniform matrix over Zn×mqand T ∈ {0, 1}m×m and hence ∥T∥ ≤ m. Choosing (e.g.) m0 = 3n ⌈log q⌉ suffices.Given a trapdoor for A it is possible to efficiently compute one for [A | B] or [B | A]for any matrix B ∈ Zn×m′q .More there exists a PPT algorithm t ← TSamp(A,T,u, B) that, as long asB = samples a vector t such that the distribution on t is statisticallyindistinguishable from the distribution conditioned on At = u.Noise Smudging. We use the following fact.Lemma 1.2 (Noise smudging). Let B,B′ ∈ Z be functions of the security parameter. Lete ∈ [−B,B] be arbitrary and let e ← [−B′ ′1 2 , B ] be chosen uniformly at random. Then thedistribution of e ′2 is statistically close to e1 + e2 as long as B / B = negl(λ).1.2 The GSW FHE SchemeIn this section we briefly recall the (leveled) fully homomorphic encryption schemefrom prior work. We only describe the details of the scheme that will be relevant forour purposes. Let n, q, B be such that LWEn,q,B holds. The scheme works as follows:• Key Generation: GSW.Gen(1λ, B) samples a public key / secret key pair (pk, sk)where sk = s ∈ Zn ⊤ n×mq is of the form s = (r,−1) and pk = A ∈ Zq is of the form •Encryption and Decryption: For a message x ∈ {0, 1}ℓ, GSW.Enc(A, x) outputsa ciphertext Cx ∈ Zn×mℓq that satisfies the correctness propertys⊤Cx = s⊤(x ⊗ G) + ex,where ex is a short error vector with ∥ex∥∞ ≤ mB. The message x can then beefficiently recovered from s⊤Cx.• Evaluation: For any boolean circuit C : {0, 1}, and any ciphertext Csatisfying s⊤Cx = xs⊤G + ect, GSW.Eval(C,Cx) outputs a new ciphertext CC(x)such that ∥where e satis ∥ ∥∥ dC(x) fies eC(x) ∞ ≤ (m + 1) · ∥ex∥∞ where d is the depth of C.The scheme satisfies standard semantic security. As was observed in prior work, GSWevaluation can be extended to handle vector-valued circuits C : {0, Forsuch circuits CC(x) := GSW.Eval(C,Cx) satisfies the alternate correctness property that ∥where now eC(x) satisfies ∥ ∥eC(x)∥ d∞ ≤ (m + 1) ⌈log q⌉ · ∥ex∥∞.Circular Security. The circular security assumption for the GSW scheme states thatLWE still holds with respect to the GSW secret key in the presence of an encryption ofthe secret key. That is, for all m′ = poly(λ) the following distributions are computa-tionally indistinguishable where on the left hand side (A, s) ← GSW.Gen(1λ, B), S ← GSW.Enc(A, bits(s)), B ←Zn×m′q and e ← χm′ B, and on the right hand side all the entries are uniform over theappropriate sets.2 Homomorphic Operations for Database and Matrix ReadsDefinition 2.1 (Homomorphic Operations). Let n, q ∈ N and m ≥ n · ⌈log q⌉. A systemof homomorphic operations with error growth γ and circuit class C is a pair of deterministicalgorithms (EvalPK,EvalCT) with the following syntax:• A := EvalPKmatrices A1, ... •bC := EvalCT(C,A1, ... ,Aℓ, x,b1, ... ,bℓ): On input a circuit C ∈ C, matricesA1, ... ,Aℓ ∈ Zn×mq , an input x ∈ {0, 1}ℓ and vectors bx ∈ Zℓmq , output a vectorbC ∈ Zmq that encodes the evaluation C(x). for some ei, then AC := EvalPK(C, {Ai}i≤ℓ), bC = EvalCT(C, {Ai}i≤ℓ , x, {bi}i≤ℓ) satisfyb⊤ = ⊤ ⊤C s (AC − C(x)G) + eC , (2)where eC is another short error vector with ∥eC∥∞ ≤ γ(C) · (maxi ∥ei∥∞).For the sake of convenience, we sometimes write A = [A1, | · · · | Aℓ] ∈ and similarly b⊤ = [b⊤1 | · · · | b⊤ℓ ] ∈ In this case, equation (1) can be writtenas b⊤ = s⊤(A − x ⊗ G) + e⊤. We also define the following notion of homomorphicoperations that satisfy an additional linearity property.Definition 2.2 (Linearity). Let n, q ∈ N and m ≥ n · ⌈log q⌉. A linear system of ho-momorphic operations with error growth γ and circuit class C is a pair of deterministicalgorithms (EvalPK,EvalCTCoeffs) where EvalPK has the same syntax as in Definition 2.1and EvalCTCoeffs has syntax:• HC,x := EvalCTCoeffs → {0, 1}, matrixA ∈ Zn×mℓq , an input x The algorithms satisfy the following correctness property: For all circuits C ∈∥ C, mat∥rices A ∈Zn×mℓq and inputs x ∈ {0, 1}ℓ, the matrix HC,x = EvalCTCoeffs(C,A, x) has ∥H⊤C,x∥ ≤ γ(C)and satisfies(A − x ⊗ G) · HC,x = AC − C(x)G, (3)where AC = EvalPK(C,A).It is easy to see a linear system of homomorphic operations immediately implies asystem in the sense of Definition 2.1 because one can simply define EvalCT(C,A, x,b) =b⊤ · HC,x for HC,x := EvalCTCoeffs(C,A, x) in which case (3) ⇒ (2): with the same error growth e⊤ ⊤C = e HC,x having Theorem 2.3. There is a linear system of homomorphic operations (EvalPK,EvalCTCoeffs)for the class of boolean circuits composed of NAND gates. The system has error growthγ(C, n, q) ≤ (m + 1)d where d is the depth of the circuit C. The algorithms EvalPK andEvalCTCoeffs each run in time |C| · poly(n, log q).We briefly recall the core construction of the BGG+ homomorphic operations belowas it will serve as inspiration for our constructions throughout this section. Let x1, x2 ∈{0, 1} and let b1,b2 ∈ Zmq be their vector encodings with respect to matrices A1,A2 ∈Zn×mq . For addition gates, the algorithms EvalPK and EvalCT are defined asEvalPK(+,AEvalCTCoeffs EvalCT(+,A1,A2, x1, x2,b1,b2) = b+ = b1 + b2.And for multiplication gates, the algorithms are defined as Lastly, for NAND gate, the algorithms are defined as Composition. Note that the operations EvalPK,EvalCT,EvalCTCoeffs compose nicely.Assume we have these procedures for some functions C , ℓ1 ... , Ck : {0, 1} → {0, 1}and C : {0, 1}k → {0, 1}. Then we can define these procedures forC∗(x) = C(C1(x), ... , Ck(x)) by computing:EvalPK(C∗,A1, ... ,Aℓ) = EvalPK(C,AC1 , ... ,ACk)where ACi = EvalPK(Ci,A1, ... ,Aℓ)EvalCTCoeffs where HCi,x = EvalCTCoeffs(Ci,A1, ... ,Aℓ, x)and H = EvalCTCoeffs(C,A , ... ,A , y) for y = (C (x) kC,y 1 ℓ 1 , ... , Ck(x)) ∈ {0, 1}EvalCT(C∗,A1, ... ,Aℓ, x,b1, ... ,bℓ) = EvalCT(C,AC1 , ... ,ACℓ , y,bC1 , ... ,bCℓ)where bCi = EvalCT(Ci,A1, ... ,Aℓ, x,b1, ... ,bℓ)The correctness property in (3) holds since: =AC∗ − C(y)G = AC∗ − C∗(x)GMoreover the error growth follows γ(C∗) ≤ γ(C)maxi γ(Ci)The above works when the circuits Ci all operate over the entire input. We canalso apply it to circuits Ci that operate on different subsets of the input bits. The onlydifference is that we need to pad the matrices HCi,xi with appropriate 0’s for the bitsthat aren’t touched.Preprocessing. In the remainder of this section we construct a linear system of homo-morphic operations for RAM circuits by extending the BGG+ construction to handledatabase read and wire read gates. The core idea behind our construction is to pre-process the work of computing the matrices HC,x in advance during the run time ofEvalPK, before we know the value of x. In that pursuit we also define an alternatenotion of homomorphic operations where we allow EvalPK to output a data structurefor EvalCT to use during it’s computation.Definition 2.4 (Preprocessing Homomorphic Operations). A preprocessing system ofhomomorphic operations is a pair of algorithms (EvalPK,EvalCT) as in Definition 2.1 ex-cept with the modified syntax:• (AC ,DS) := EvalPK(C,A) additionally generates a data structure DS.• bC := EvalCT(C,DS,A, x,b): additionally takes a data structure DS as input.The algorithms must satisfy the same correctness property as in Definition 2.1 where the datastructure DS generated by EvalPK is passed to EvalCT. Similarly, a preprocessing linearsystem of homomorphic operations is a pair of algorithms (EvalPK, EvalCTCoeffs) as inDefinition 2.2 but where EvalPK additionally generates DS and EvalCTCoeffs additionallytakes DS as input. The algorithms must satisfy the same correctness property as in Definition2.2, where the data structure DS generated by EvalPK is passed to is passed to EvalCTCoeffs.2.1 Database Read GatesTheorem 2.5. There exists a preprocessing linear system of homomorphic operations(EvalPK,EvalCTCoeffs) for the class of database read gates {dReadDB : DB ∈ {0, 1}2ℓ ,ℓ ∈ N}.The system has error growth γ(dReadDB) = ℓm for a database DB ∈ {0, 1}2ℓ, and it hasefficiency properties:• The size of the data structure DS and run time of EvalPK(dReadDB,A) are both boundedby O(ℓ · 2ℓ) · poly(n, log q).• EvalCTCoeffs(dReadDB,DS,A, x) runs in time poly(ℓ, n, log q).Proof. Let select : {0, 1}3 → {0, 1} be the function select(y0, y1, x) = (1−x) ·y0+x ·y1 =yx. We can write dReadDB recursively asdReadDB(x1, ... , xℓ) = select(dReadDBL(x1, ... , xℓ−1), dReadDBR(x1, ... , xℓ−1), xℓ)are the “left”and “right” halves of DB = (DB0, ... ,DBL−1) respectively. We abbreviate dReadDB asg and dRead L , dRead R as gL, gR respectivel L −DB DB y so that g(x) = select(g (x ), xℓ)for x− = (x1, ... , xℓ−1). Our construction recursively computes the matrices and datastructures for the left and right sub-instances gL, gR, and then composes them with theconstant-size circuit for select. Formally, we define EvalPK and EvalCTCoeffs as follows:EvalPK(g,A): Let L = 2ℓ be the length of DB.1. If ℓ = 1, parse DB = (DB 20,DB1) ∈ {0, 1} . Let selectDB0,DB1 : {0, 1} → {0, 1} bethe function selectDB0,DB1(x) = (1− x)DB0 + x · DB1 = DBx. Set: and output (Ag,DSg = {Hg,x}x∈{0,1}). (In this case it turns out that Hg,0 = Hg,1,but we do not rely on this fact.)2. Recursively call (A L ,DSL) := EvalPK(gL − R R R −g g ,A ) and (Ag ,DSg ) := EvalPK(g ,A )where A− = [A1 | · · · | Aℓ−1].3. Set Ag := EvalPK 4. For all (y0, y1, xℓ) ∈ {0, 1}3 compute (the matrices are independent of y0, so itsuffices to compute only 2 rather than 8 of them.)Hselect,y0,y1,xℓ := EvalCTCoeffs(select,AgL ,AgR ,Aℓ, y0, y1, xℓ)^(1− xℓ)I^=^^ x ^ℓI ^G−1(AgR)−G−1(AgL) For each x ∈ {0, 1}ℓ, look Then computeHg,x by composing H ,Hselect,gL(x−),gR(x−),xℓ , resulting in: 5. Output EvalCTCoeffs(dReadDB,DS,A, x): Look up ∈ DS and output it.In the base case where ℓ = 1, correctness follows via the correctness of EvalPK,EvalCTCoeffsfor select 2DB0,DB1. In detail, for x ∈ {0, 1} and DB = (DB0,DB1) ∈ {0, 1} , we have =Ag − (1 − x)DB0 · G − xDB1 · G= Ag − DBx · Gis an m × m matrix with entries in {−1, 0, 1}, hence it has For the inductive case, assume that correctness holds for ℓ − 1. First we verify thecorrectness of EvalPK,EvalCTCoeffs for the select function. For any y0, y1, xℓ: Now, by composing select with gL, gR, we get that for any x ∈ {0, 1}ℓ and DB ∈{0, 1}2ℓ: =Ag − DBx · GAdditionally we can inductively assume that HgL,x− ,HgR,x− both have entries in{−1, 0, 1}∥, hence Hg,x does too because only one of xℓ and (1 − xℓ) are nonzero. Thuse have ∥H⊤ ∥w g,x∥ ≤ ℓm.It remains to show efficiency. First it is clear that EvalCTCoeffs runs in the desiredtime. Let T (ℓ) denote the run time of EvalPK when run on a database of size L =2ℓ. After recursively computing (AgL ,DSgL) and (AgR ,DSgR), the matrix Ag and eachmatrix g,x can be computed as a linear combination of entries in the outputs of therecursive calls. Since there are 2ℓ coefficient matrices to compute, we can see that therun time of EvalPK satisfies the recurrenceT (ℓ) = 2T (ℓ − 1) + O(2ℓ) · poly(n, log q),which implies T (ℓ) = O(ℓ2ℓ) · poly(n, log q) as desired.2.2 Matrix Read GatesAs a stepping stone towards constructing our system of homomorphic operations forwire read gates wRead, we generalize the theorem from the previous section to handlereading from “matrix-valued databases”. That is, for a database M = (M0, ... ,ML−1) ∈(Zn×m )L, we define the matrix read function As was observedprior work, it is possible to extend the notion of homomorphic operations to capturematrix valued functions by slightly modifying the correctness property.Definition 2.6 (Matrix-valued Homomorphic Operations). A system of homomorphic op- b⊤ = s⊤(A − C( ⊤C C x)) + eC,pair of algorithms (EvalPK,EvalCTCoeffs) with syntax as in Definition 2.2 and the following (A − x ⊗ G) · HC,x = AC − C(x),where AC = EvalPK(C,A).We also define the preprocessing variant of matrix-value homomorphic operations with thecorrectness property as above and syntax as in Definition 2.4.Theorem 2.7. There is a linear system of homomorphic operations (EvalPK,EvalCTCoeffs)for the class of matrix-valued boolean circuits composed of NAND gates. The system has errorgrowth γ(C) ≤ (m + 1)d · log q where d is the depth of the circuit C. The algorithms EvalPKand EvalCTCoeffs run in time poly(|C|, n, log q).We now show how to use the homomorphic operations of prior work to createa preprocessing system for matrix-read gates mRead in the same manner as we con-structed homomorphic operations for data-read gates.Theorem 2.8. There exists(EvalPK,EvalCTCoeffs) forThe system has error •The size of the data structure DS and run time of EvalPK(mReadM,A) are both boundedby O(ℓ · 2ℓ) · poly(n, log q).• EvalCTCoeffs(mReadM,DS,A, x) runs in time poly(ℓ, n, log q).Proof. We proceed by an almost identical argument to as in the proof of Theorem 2.5.Define the function select : × {0, 1} n×m → Zq similarly to as in Sectiononly with matrix-valued inputs / outputs select(Y0,Y1, x) = (1 − x)Y0 + xY1 = Yx.Recursively writemRead (x) = selec L−−M t(mReadM (x),mReadMR(x), xℓ), are respectively the “left”“right” halves of M and we think of xℓ as the most significant bit in x. We abbrevi-ate mReadM as h and mReadML ,mReadMR as hL, hR respectively. We define EvalPK andEvalCTCoeffs as follows:EvalPK(mReadM,A): Let L = 2ℓ be the length of M.1. If ℓ = 1, parse M0+xM1 =Mx. Set: Hh,x := EvalCTCoeffs(selectM0,M1 ,A, x)= G−1(M1)−G−1(M0) for x ∈ {0, 1}and output (Ah,DSh = {Hh,x}x∈{0,1}).2. Recursively call (A L ,DS L) := EvalPK(hL,A−) an R R R −h h d (Ah ,DSh ) := EvalPK(h ,A )where A− = [A1 | · · · | Aℓ−1].3. Set A Lh = EvalPK(select,Ah,AR h,A −1 −1ℓ) = AhL +Aℓ · (G (AhR)−G (AhL)).4. For all (Y0,Y1, ∈ (Zn×mq )2 × {0, 1} compute (as in the data-read case, thesematrices are independent of Y0,Y1 so it suffices to compute only 2 matrices intotal.) H:= EvalCTCoeffL R select,Y0,Y1,xℓ s(select,Ah,Ah ,Aℓ,Y0,Y1, xℓ)^ ^ For each x ∈ {0, 1}ℓ, look up HhL,x− ∈ DShL and HhR,x− ∈ DShR , then composewith Hselect,hL(x−),hR(x−),xℓ to compute 5. Output (Ah,DS = {Hh,x}x∈{0,1}ℓ)EvalCTCoeffs(mReadM,DS,A, x): Look up Hh,x ∈ DS and output it.In the base case, correctness follows from correctness of EvalPK and EvalCTCoeffs forselectM0,M1. In more detail, for any x ∈ {0, 1} and M = (M0,M1) ∈ (Zn×m 2q ) , we have that ∥dditionally noting that has entries in {−1, 0, 1}, we get that ∥ ∥A ≤ m.In the inductive case, for any x ∈ {0, 1}ℓ, we inductively assumeEvalPK(hL,A−) and EvalPK(hR,A−) are correct. Choosing yields As before, we inductiv∥ely as∥sume that HhL,x− , have entries in {−1, 0, 1}, henceso does Hh,x, and thus ∥H⊤h,x∥ ≤ ℓm.The proof of efficiency is the same as that in the proof of Theorem 2.5. The runtime of EvalPK on a matrix database M of length 2ℓ satisfies the recurrence T (ℓ) =2T (ℓ − 1) + O(2ℓ) · poly(n, log q), thus T (ℓ) = O(ℓ2ℓ) · poly(n, log q).3 Laconic EncryptionIn this section, we sketch how to use our techniques to derive a laconic encryptionscheme, as defined in prior work. While prior work gave a construction using LWE,our techniques yield an alternate construction that is conceptually different and achievesa smaller ciphertext size (ℓ vs. 2ℓ LWE matrices). We start with a simpler definitionthat does not allow updates, but then discuss how to also enable efficient updates aswell. Our construction essentially uses homomorphic computation for matrix readgates from Section 2.2 to get a simple laconic encryption.Syntax. A laconic encryption scheme allows a group of users to individually selectpublic / secret key pairs (pki, ski) ← KeyGen(pp) derived using some public parame-ters pp. A server Alice gets all the public keys pk1, ... , pkL and can deterministicallyconstruct a short digest dig = Hash(pp, pk1, ... , pkL). In addition, Alice deterministi-cally computes decryption hints wit1, ... ,witL for each of the users respectively. Givendig along with an index ind ∈ [L] and a message µ, anyone can compute a ciphertextct ← Enc(dig, ind, µ) encrypting the message µ to user ind. Correctness requires that thedesignated user can decrypt given the corresponding secret key and decryption hint,namely: Dec(skind,witind,Enc(dig, ind, µ)) = µSecurity stipulates that µ is hidden even given all other secret keys except for skind. Theefficiency requirement is that the digest and the hints have size poly(λ, logL) and thatencryption and decryption run in time poly(λ, log L).Construction. We write L = 2ℓ and identify [L] with {0, 1}ℓ. Let n,m, q, B, β be pa-rameters and let be the truncated discrete Gaussian distribution. We useEvalPK,EvalCTCoeffs from Section 2.2.• pp ← Setup(1λ, 1ℓ): Sample set pp = (A0,A).• compute pi := A0vi and output •(dig, {witi}i∈[L]) := Hash(pp, pk1, ... , pkL): For i ∈ [L], parse pki = pi, and set Pi :=[pi | 0 | · · · | 0] ∈ Zn×mq . Set P = (P1, ... ,PL), and compute (Amr, {Hmr,i}i∈[L]) :=EvalPK(mReadP,A). Set dig := Amr,witi = (i,hmr,i) where hmr,i is the first columnof Hmr,i.• ct ← Enc(pp, dig, ind, µ): Sample output ct := (s⊤A0 + e⊤ 0, s⊤(A−ind where amr ∈ Znq denotes the first column of Amr.• µ := Dec(sk,witind, ct): Parse ct = (c0, c1, c2), sk = vind,witind = (ind,hmr,ind) andoutput Enc(pp, dig, ind, µ), then Dec(sk,witind, ct) = µ with probability 1.Proof. Let ct = (c0, c1, c2), sk = vind,witind = (ind,hmr,ind) where hmr,iind is the first col-umn of Hmr,ind be generated as in the lemma with: By the correctness of the homomorphic operation for matrix-read gates (Theorem 2.8)we have: with ∥e∗∥∞ ≤ B + ℓmβ + mβ < q / 4 and therefore roundq(d) = µ.Lemma 3.2 (Security). Consider the following security game LESec λA,b(1 ) with a statefuladversary A:1. The adversary chooses 1ℓ and ind ∈ [L = 2ℓ].2. The challenger chooses (pkind, skind) ← KeyGen(pp) and gives pkind to the adversary.3. The adversary chooses {pki}i∈[L]\{ind} and sends these to the challenger.4. The challenger computes (dig, {wit }i∈[L]) := Hashcan compute these values on its own as well.) The Enc(pp, dig, ind, µ) and sends ct to the adversary.5. The adversary outputs a bit which is the output of the game.We define a laconic encryption scheme to be secure if for all PPT A we have |Pr[LESec λA,0(1 ) =1] − Pr[LESecA,1(1λ) = 1]| = negl(λ). Then the above construction is secure under theLWEn,q,β assumption, as long as B ≥ (ℓm + 1)βλω(1).Proof. The proof is similar to that of the AB-LFE scheme.First, we consider a modified game LESec′ where the last component of the cipher-text ct = (c , c , c ) is modified by repla ′ ⊤ ′0 1 2 cing c2 with c2 = s pind + e2 + e2 + µ ⌈q / 2⌋where e′2 ← χβ . Note that in the modified game the ciphertext does not depend onthe digest at all. First we claim that if a PPT adversary A can break the security ofthe original game LESec with non-negligible probability then we can construct a PPTadversary A′ that breaks the security or the modified game LESec′ with non-negligibleprobability. The adversary A′ simply runs A until the last step of the game. In the laststep it receives a ciphertext ct′ = (c ′0, c1, c2). It computes with |e′2 + emr| ≤ β + ℓmβ by the same argument used to analyze correctness. It sendsct = (c0, c1, c2) to A and outputs what it outputs. The resulting view of A is essentiallythe same as in the original game LESec′ except that the error c ′2 is (e2+ e2+ emr) insteadof just e2, but this is statistically close by noise smudging (Lemma 1.2). Therefore theadvantage of A′ in the game LESec′ is negligibly close to that of A in the game LESec.Secondly, we argue that any PPT adversary A′ has at most a negligible advantagein the modified game LESec′. This is because (a) we can replace the vector pind = A0vindby a uniformly random vector by the leftover hash lemma, and (b) the ciphertextct = (c , c , c′) = s⊤ [A | A − ind ⊤⊤ ′ 01 2 ︸ 0 ︷︷⊗ G | pind︸] + [e0 , e1 , e 2] +[0,0, e2 + µ ⌈q / 2⌋]′︸ ︷︷′︸=A =eis then computationally indistinguishable from uniform by the LWE assumption withthe uniformly random coefficient matrix A′ Efficiency Optimization. Instead of choosing e2 ← [−B,B] for a super-polynomialB = λω(1) we can choose e2 from a smaller polynomially-bounded discrete Gaussiandistribution by utilizing the same “LWE with error-leakage” analysis from prior workto argue security. This allows us to use a smaller polynomial-size modulus q, whichimproves efficiency.Exponential Index Space. We can extend the above construction to a scenario wherethe bit-length ℓ of an index ind is an arbitrary polynomial in the security parameter,meaning that the index-space L = 2ℓ is exponential. In this case, only some poly-nomial set of public keys {pk } i ℓind ind∈S s defined for some subset S ⊆ {0, 1} and wecan think of pkind = 0 for all ind S. Alternately, we can think of this as corre-sponding to an exponentially large vector of L = 2ℓ public keys, which is sparse withonly polynomially many non-zero entries. We show that it is possible to compute(dig, {witind}ind∈S) := Hash(pp, {pkind}ind∈S) efficiently in time |S|poly(ℓ, λ).The construction is the same but now we need to compute:(Amr, {Hmr,ind}ind∈S) := EvalPK(mReadP,A)where the database of matrices P = (P1, ... ,PL) is an exponentially large with only|S| non-zero entries {Pind}ind∈S . We can do this efficiently by going under the hoodof the recursive construction of EvalPK form mRead gates in the proof of Theorem 2.8.Recall that we compute (A , = EvalPK(mReadP,A) by recursively(A L , {H L }) = EvalPK(mRead L ,A−) and (A R , {H R }) = EvalPK(m R −mr mr ,i P mr mr ,i ReadP ,A )where PL,PR denote the first / last L / 2 matrices in P respectively. We observe thefollowing: •Whenever P only has 0 matrices, then Amr = 0 and {Hmr,i = 0} for all i ∈ [L].• Therefore, we can compute EvalPK(mReadP,A) recursively as before, but we stopthe recursion whenever the value PL or PR in one of the recursive calls is empty,in which case we return AmrL = 0 or AmrR = 0 respectively. This results in arecursion tree with only O(|S|) leafs and a total of |S| · poly(ℓ, λ) total run-time.The security of the scheme is the same as before, but now in the security game de-scribed in Lemma 3.2, we modify step 3 to let the adversary chooses some set S con-taining ind and all the public keys {pki}i∈S\{ind} except for pkind which is chosen by thechallenger. In step 4 the challenger computes (dig, {witi}i∈[L]) := Hash(pp, {pki}i∈S).The proof of security is identical.Updates. We can further extend the above construction to allow for updates, wherewe can add or replace a public key pkind at index ind and efficiently update the digestdig and the decryption hints witi accordingly. Note that all the decryption hints witichange when a new public is pkind is added at any index ind. Therefore, our modelallows the server Alice to keep an auxiliary data structure aux. Every time the set ofpublic keys {pkind}ind∈S is updated, Alice can update the digest dig as well as the datastructure aux in poly(ℓ, λ) time via some procedure dig′ := Updateaux(pp, ind, pkind) thatread / writes to the data structure aux, independent of the current number of keys |S|.Alice can use the data structure to compute a decryption hint wit auxind := WGen (ind) forany user in poly(ℓ, λ) time.The data structure aux consists of an incomplete binary tree with all the matricesAmr := EvalPK(mReadP,A) computed during the recursive evaluation, where the re-cursion is cut off when it reaches a node that has no public keys in its sub-tree. Toupdate the tree by adding / modifying a public key pkind at index ind, the proceduredig′ := Updateaux(pp, ind, pkind) just needs to update the matrices along one path in therecursion tree going to the leaf ind. In other words, it redoes the recursive computationof EvalPK(mReadP,A) with the updated set P, but it uses the cached results stored inaux for all the recursive calls that are not on the path to ind. We do not keep track of thematrices Hmr,ind during this process. Instead, looking at step 3 in the proof of Theorem2.8, we notice that these matrices are defined recursively via: where indℓ is the last bit of the index ind. Note that only one of indℓ, 1− indℓ is non-zero.Since all the matrices AmrL ,AmrR in the tree are stored in aux, the procedure Hmr,ind :=WGenaux(ind) can compute Hmr,ind in poly(ℓ, λ) time by recursively computing only oneof HmrL,ind− (if indℓ = 0) or HmrR,ind− (if indℓ = 1).Example Embodiments and ImplementationsIn some cases, a laconic encryption system may be implemented as shown in Fig.1. The laconic encryption system may include multiple components that interact toprovide secure encryption and decryption capabilities.The laconic encryption system may include a setup procedure for generating publicand secret key pairs for users. In some cases, local devices, such as local device 1,local device 2, and up to an arbitrary local device n, may execute respective setupprocedures. The setup procedures may sample a random set of bits as the secret keysand compute the public keys based on the private key material and a public randomparameter. In some cases, the public keys generated by the local devices may be transmittedover a network to a centralized key store. The centralized key store may aggregate thereceived public keys. A single digest may be generated based on some or all of thepublic keys available to the centralized key store.The laconic encryption system may include a ciphertext generation module forgenerating ciphertexts for individual users. In some cases, the ciphertext generationmodule may obtain the single digest from the centralized key store and a message forencryption. The ciphertext generation module may then generate a ciphertext basedon the single digest and the message.For decryption, the laconic encryption system may include a ciphertext decryp-tion module. In some cases, the ciphertext decryption module may receive a secretkey from a local device and non-secret decryption material to generate a decryptedmessage.The laconic encryption system may utilize various mathematical operations andfunctions during the encryption and decryption processes. For example, the setupprocedure may involve sampling v from { mi 0, 1} , such that vi is a random set of bitsfor the user i, wherein {0, 1}m represents the set of binary vectors of length m. Thepublic key computation may involve computing pi as defined by A0vi, wherein A0is a public random parameter matrix in Zn×mq , where denotes the ring of integersmodulo q.In some cases, the digest generation process may involve setting Pi as defined by[pi | 0 | · · · | 0] ∈ Zn×mq , where [L] denotes the set {1, 2, ... , L}. The process mayalso involve computing an EvalPK homomorphic evaluation of mReadP over a publicrandom parameter A ∈ Zn×ℓm ∗q to obtain (A , {Hi}i∈[L]), where Hi are correspondingcoefficient matrices and A∗ is a resulting evaluation matrix.For ciphertext generation, the system may compute learning with errors samplesand combine them with the message and single digest. The decryption process mayinvolve computing the message µ as defined by roundq(c2 − c⊤ ⊤1 hi − c0 vi), wherein The laconic encryption system may provide a secure and efficient method for en-crypting and decrypting messages while compressing public key material for multipleusers into a single digest.In some cases, the laconic encryption system may be implemented using a com-puter system 500, as illustrated in Fig. 2. The computer system 500 may include mul-tiple components interconnected through a communication infrastructure 506, whichfacilitates data exchange between various system elements.The computer system 500 may include a processor 504 connected to the communi-cation infrastructure 506. The processor 504 may be configured to execute a setup pro-cedure for a user to generate a public and secret key pair. In some cases, the processor504 may implement a random bit generator module configured to sample a randomset of bits for the user. The processor 504 may also implement a public key compu-tation module configured to compute a public key using a public random parametermatrix. Amain memory 508 may be connected to the communication infrastructure 506.The main memory 508 may store instructions and data for immediate access by theprocessor 504. In some cases, the main memory 508 may be a volatile memory type.The computer system 500 may include user input / output interfaces 502 that con-nect to user input / output devices 503. These interfaces and devices may allow foruser interaction with the computer system 500.A secondary memory 510 may be connected to the communication infrastructure506. The secondary memory 510 may provide additional storage capacity and may in-clude several storage components. These components may include a hard disk mem-ory 512 and a removable storage drive 514. The removable storage drive 514 mayinteract with a removable storage unit 518. In some cases, an interface 520 may be pro-vided to connect to another removable storage unit, labeled as Unknown 522 in Fig.2. The secondary memory 510 may serve as a non-transitory computer-readable stor-age medium configured to locally store the public and secret keys generated by thesetup procedure. In some cases, the secondary memory 510 may also store instruc-tions for compressing public key material for multiple users in a single digest.The computer system 500 may include a communications interface 524 connectedto the communication infrastructure 506. The communications interface 524 may en-able communication with remote devices, networks, entities 528 through a commu-nications path 526. This capability may allow the computer system 500 to exchangedata and instructions with other systems or devices involved in the laconic encryptionprocess. The communication infrastructure 506 may serve as the central connection point,linking the processor 504, main memory 508, user input / output interfaces 502, sec-ondary memory 510, and communications interface 524 together. This infrastructuremay enable system operation and data flow between components, facilitating the exe-cution of the laconic encryption system’s functions.In some cases, the laconic encryption system may be implemented using an alter-native computer system 900, as illustrated in Fig. 3. The computer system 900 may in-clude multiple components interconnected through a communication bus 930, whichfacilitates data exchange between various system elements.The computer system 900 may include a processing device 902 connected to thecommunication bus 930. The processing device 902 may be configured to execute asetup procedure for a user to generate a public and secret key pair. In some cases, theprocessing device 902 may implement a random bit generator module configured tosample a random set of bits for the user. The processing device 902 may also imple-ment a public key computation module configured to compute a public key using apublic random parameter matrix.A main memory 904 and a static memory 906 may be connected to the communi-cation bus 930. The main memory 904 and static memory 906 may store instructionsand data for immediate access by the processing device 902. In some cases, the mainmemory 904 may be a volatile memory type, while the static memory 906 may be anon-volatile memory type.The computer system 900 may include several input / output devices connected tothe communication bus 930. These devices may include a video display unit 910, analphanumeric input device 912, a cursor control device 914, and a signal generationdevice 916. These devices may allow for user interaction with the computer system900. Adata storage device 918 may be connected to the communication bus 930. Thedata storage device 918 may provide additional storage capacity and may serve as anon-transitory computer-readable storage medium. The data storage device 918 maycontain a machine-readable medium 924 that stores executable instructions 926. Theseexecutable instructions 926 may be used for compressing public key material for mul-tiple users in a single digest.The computer system 900 may include specialized processing units connected tothe communication bus 930. These units may include a graphics processing unit 922,a video processing unit 928, and an audio processing unit 932. These specialized pro-cessing units may enhance the system’s capabilities for handling specific types of dataand computations.A network interface device 908 may be connected to the communication bus 930.The network interface device 908 may enable communication with an external net-work 920. This capability may allow the computer system 900 to exchange data andinstructions with other systems or devices involved in the laconic encryption process.In some cases, the computer system 900 may include a decryption module im-plemented as part of the executable instructions 926 stored in the machine-readablemedium 924. The decryption module may be configured to decrypt a ciphertext foran individual user. The decryption module may parse the ciphertext, a secret key, andnon-secret decryption material. In some cases, the decryption module may compute amessage µ as defined by roundq(c2 − c⊤1 hi − c⊤0 vi), wherein roundq(x) is ⌈2x / q⌋.The network interface device 908 may be configured to receive public keys frommultiple users. These public keys may be used in the process of generating a singledigest for compressing public key material.The communication bus 930 may serve as the central connection point, linking theprocessing device 902, main memory 904, static memory 906, input / output devices,specialized processing units, data storage device 918, and network interface device908 together. This infrastructure may enable system operation and data flow betweencomponents, facilitating the execution of the laconic encryption system’s functions.In some cases, a laconic encryption system may be implemented as an encryptionsystem 1000, as illustrated in FIG. 4. The encryption system 1000 may include multipleinterconnected modules that work together to process and encrypt data.A setup module 1002 may be included in the encryption system 1000. The setupmodule 1002 may contain a random bit sampler 1004 and a public key computer 1006.In some cases, the random bit sampler 1004 may be configured to sample a randomset of bits for a user. The public key computer 1006 may be configured to compute apublic key using a public random parameter matrix.The encryption system 1000 may include a digest generation module 1008. Thedigest generation module 1008 may comprise a matrix function establisher 1010 anda homomorphic evaluator 1012. In some cases, the matrix function establisher 1010may be configured to establish a matrix-valued function. The homomorphic evaluator1012 may be configured to compute an EvalPK homomorphic evaluation of mReadPover a public random parameter A ∈ Zn×ℓmq to obtain (A∗, {Hi}i∈[L]), where Hi arecorresponding coefficient matrices and A∗ is a resulting evaluation matrix.A ciphertext generation module 1014 may be included in the encryption system1000. The ciphertext generation module 1014 may contain a learning with errors sam-ple generator 1016 and a ciphertext combiner 1018. In some cases, the learning witherrors sample generator 1016 may be configured to sample a learning with errors se-cret vector. The ciphertext combiner 1018 may be configured to form a ciphertext as acombination of computed values.The encryption system 1000 may include public parameters 1020. In some cases,the public parameters 1020 may be accessible to multiple components through con-nection paths.User devices 1022 may interface with the encryption system 1000. In some cases,the user devices 1022 may connect to the setup module 1002, allowing for user inter-action with the encryption processes.The encryption system 1000 may include a data processing unit configured to parseand set public key matrices. In some cases, for i ∈ [L], the data processing unit mayparse pki is p and set Pi is defined as [pi where [L] denotesset {1, 2, ... , L}.The encryption system 1000 may utilize the secondary memory to locally storethe public and secret keys in a non-transitory computer-readable storage medium.In some cases, the encryption system 1000 may set and store non-secret decryptionmaterial and a single digest in the secondary memory.The communications interface may be configured to receive public keys via a net-work interface. In some cases, the digest generation module 1008 may be configuredto generate a single digest from multiple public keys received through the communi-cations interface.The encryption system 1000 may maintain connections between modules to facili-tate the flow of encryption-related data and operations. In some cases, the system maycompute learning with errors samples and combine them with other computed valuesto form ciphertexts.In some cases, a decryption system 1100 may be implemented as shown in FIG. 5.The decryption system 1100 may include multiple interconnected modules that worktogether to process and decrypt encrypted messages.A ciphertext parser 1102 may be included in the decryption system 1100. The ci-phertext parser 1102 may be configured to receive an encrypted message 1114. Insome cases, the ciphertext parser 1102 may parse the encrypted message 1114 into itsconstituent components.The decryption system 1100 may include a secret key handler 1104. The secret keyhandler 1104 may be configured to manage and process the secret key associated witha user. In some cases, the secret key handler 1104 may retrieve the secret key from asecure storage location within the decryption system 1100.A non-secret decryption material handler 1106 may be included in the decryptionsystem 1100. The non-secret decryption material handler 1106 may be configured tomanage and process non-secret decryption material. In some cases, this non-secretdecryption material may include public parameters or other information necessaryfor the decryption process.The decryption system 1100 may include a message computer 1108. The messagecomputer 1108 may be configured to perform the actual decryption of the encryptedmessage 1114. In some cases, the message computer 1108 may receive inputs fromthe ciphertext parser 1102, the secret key handler 1104, and the non-secret decryptionmaterial handler 1106.A rounding function 1110 may be included within the message computer 1108.The rounding function 1110 may be used in the final stages of the decryption processto convert the computed values into the decrypted message.In some cases, the decryption system 1100 may interface with a user device 1112.The user device 1112 may be used to initiate the decryption process and receive thedecrypted message 1116.The decryption system 1100 may work in conjunction with the encryption system1000 to provide a complete encryption and decryption solution. In some cases, the ci-phertext generation module 1014 of the encryption system 1000 may generate a cipher-text for an individual user. This ciphertext may then be processed by the decryptionsystem 1100.The ciphertext generation module 1014 may compute learning with errors samplesbased on different matrices. In some cases, these samples may be used in the formationof the ciphertext. The ciphertext generation module 1014 may sample a learning witherrors secret vector as part of this process.When decrypting a message, the ciphertext parser 1102 may parse the ciphertext,the secret key handler 1104 may process the secret key, and the non-secret decryptionmaterial handler 1106 may handle the non-secret decryption material. These compo-nents may work together to provide the necessary inputs for the message computer1108. In some cases, the message computer 1108 may compute the message µ as definedby roundq(c2 − c⊤1 hi − c⊤0 vi), wherein roundq(x) is ⌈2x / q⌋. This computation may in-volve the use of the rounding function 1110 to produce the final decrypted message1116. The decryption system 1100 may provide a secure and efficient method for de-crypting messages that have been encrypted using the laconic encryption system. Byworking in conjunction with the encryption system 1000, the decryption system 1100may enable secure communication between users while maintaining the benefits ofpublic key compression.Computerized EmbodimentsFigs. 2 and 3 depict example computer systems useful for implementing variousembodiments described in the present disclosure. Various embodiments may be im-plemented, for example, using one or more computer systems, such as computer sys-tem 500 shown in Fig. 2. One or more computer system(s) 500 may be used, for exam-ple, to implement any of the embodiments discussed herein, as well as combinationsand sub-combinations thereof.Computer system 500 may include one or more processors (also called central pro-cessing units, processing devices, or CPUs), such as a processor 504. Processor 504may be connected to a communication infrastructure 506 (e.g., such as a bus).Computer system 500 may also include user input / output device(s) 503, such asmonitors, keyboards, pointing devices, etc., which may communicate with communi-cation infrastructure 506 through user input / output interface(s) 502. One or more ofprocessors 504 may be a graphics processing unit (GPU). In an embodiment, a GPUmay be a processor that is a specialized electronic circuit designed to process mathe-matically intensive applications. The GPU may have a parallel structure that is effi-cient for parallel processing of large blocks of data, such as mathematically intensivedata common to computer graphics applications, images, videos, etc.Computer system 500 may also include a main memory 508, such as random-access memory (RAM). Main memory 508 may include one or more levels of cache.Main memory 508 may have stored therein control logic (i.e., computer software, in-structions, etc.) and / or data. Computer system 500 may also include one or moresecondary storage devices or secondary memory 510. Secondary memory 510 may in-clude, for example, a hard disk drive 512 and / or a removable storage device or remov-able storage drive 514. Removable storage drive 514 may interact with a removablestorage unit 518. Removable storage unit 518 may include a computer-usable or read-able storage device having stored thereon computer software (control logic) and / ordata. Removable storage drive 514 may read from and / or write to removable storageunit 518.Secondary memory 510 may include other means, devices, components, instru-mentalities, or other approaches for allowing computer programs and / or other in-structions and / or data to be accessed by computer system 500. Such means, devices,components, instrumentalities, or other approaches may include, for example, a re-movable storage unit 522 and an interface 520. Examples of the removable storage unit522 and the interface 520 may include a program cartridge and cartridge interface, aremovable memory chip (such as an EPROM or PROM) and associated socket, a mem-ory stick and USB port, a memory card and associated memory card slot, and / or anyother removable storage unit and associated interface.Computer system 500 may further include communications interface 524 (e.g., net-work interface). Communications interface 524 may enable computer system 500 tocommunicate and interact with any combination of external devices, external net-works, external entities, etc. (individually and collectively referenced as remote de-vice(s), network(s), entity(ies) 528). For example, communications interface 524 mayallow computer system 500 to communicate with external or remote device(s), net-work(s), entity(ies) 528 over communications path 526, which may be wired and / orwireless (or a combination thereof), and which may include any combination of LANs,WANs, the Internet, etc. Control logic and / or data may be transmitted to and fromcomputer system 500 via communications path 526.Computer system 500 may also be any of a personal digital assistant (PDA), desk-top workstation, laptop or notebook computer, netbook, tablet, smartphone, smart-watch or other wearable devices, appliance, part of the Internet-of-Things, and / orembedded system, to name a few non-limiting examples, or any combination thereof.Computer system 500 may be a client or server computing device, accessing orhosting any applications and / or data through any delivery paradigm, including butnot limited to remote or distributed cloud computing solutions; local or on-premisessoftware (“on-premise” cloud-based solutions); “as a service” models (e.g., content asa service (CaaS), digital content as a service (DCaaS), software as a service (SaaS), man-aged software as a service (MSaaS), platform as a service (PaaS), desktop as a service(DaaS), framework as a service (FaaS), backend as a service (BaaS), mobile backendas a service (MBaaS), infrastructure as a service (IaaS), etc.); and / or a hybrid modelincluding any combination of the foregoing examples or other services or deliveryparadigms. Fig. 3 illustrates an example machine of a computer system 900 within which a setof instructions, for causing the machine to perform any one or more of the operationsdiscussed herein, may be executed. In alternative implementations, the machine maybe connected (e.g., networked) to other machines in a LAN, an intranet, an extranet,and / or the Internet. The machine may operate in the capacity of a server or a clientmachine in a client-server network environment, as a peer machine in a peer-to-peer(or distributed) network environment, or as a server or a client machine in a cloudcomputing infrastructure or environment.The machine may be a personal computer (PC), a tablet PC, a set-top box (STB),a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, anetwork router, a switch or bridge, a specialized application or network security ap-pliance or device, or any machine capable of executing a set of instructions (sequentialor otherwise) that specify actions to be taken by that machine. Further, while a singlemachine is illustrated, the term “machine” shall also be taken to include any collectionof machines that individually or jointly execute a set (or multiple sets) of instructionsto perform any one or more of the methodologies discussed herein.The example computer system 900 includes a processing device 902, a main mem-ory 904 (e.g., read-only memory (ROM), flash memory, dynamic random-access mem-ory (DRAM) such as synchronous DRAM (SDRAM), etc.), a static memory 906 (e.g.,flash memory, static random-access memory (SRAM), etc.), and a data storage device918, which communicate with each other via a bus 930.Processing device 902 represents one or more processing devices such as a micro-processor, a central processing unit, or the like. More particularly, the processing de-vice may be complex instruction set computing (CISC) microprocessor, reduced in-struction set computing (RISC) microprocessor, very long instruction word (VLIW)microprocessor, or processor implementing other instruction sets, or processors imple-menting a combination of instruction sets. Processing device 902 may also be one ormore special-purpose processing devices such as an application-specific integrated cir-cuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP),network processor, or the like. The processing device 902 is configured to executeinstructions 926 for performing the operations and steps discussed herein.The computer system 900 may further include a network interface device 908 tocommunicate over the network 920. The computer system 900 also may include avideo display unit 910, an alphanumeric input device 912 (e.g., a keyboard), a cursorcontrol device 914 (e.g., a mouse), a graphics processing unit 922, a signal generationdevice 916 (e.g., a speaker), graphics processing unit 922, video processing unit 928,and audio processing unit 932.The data storage device 918 may include a machine-readable medium 924 (alsoknown as a computer-readable storage medium) on which is stored one or more setsof instructions 926 (e.g., software instructions) embodying any one or more of the op-erations described herein. The instructions 926 may also reside, completely or at leastpartially, within the main memory 904 and / or within the processing device 902 dur-ing execution thereof by the computer system 900, where the main memory 904 andthe processing device 902 also constitute machine-readable storage media.In an example, the instructions 926 include instructions to implement operationsand functionality corresponding to the disclosed subject matter. While the machine-readable storage medium 924 is shown in an example implementation to be a singlemedium, the term “machine-readable storage medium” should be taken to include asingle medium or multiple media (e.g., a centralized or distributed database, and / orassociated caches and servers) that store the one or more sets of instructions 926. Theterm “machine-readable storage medium” shall also be taken to include any mediumthat is capable of storing or encoding a set of instructions 926 for execution by the ma-chine and that cause the machine to perform any one or more of the operations of thepresent disclosure. The term “machine-readable storage medium” shall accordinglybe taken to include, but not be limited to, solid-state memories, optical media, andmagnetic media.Some portions of the detailed description have been presented in terms of algo-rithms and symbolic representations of operations on data bits within a computermemory. These algorithmic descriptions and representations are the ways used bythose skilled in the data processing arts to most effectively convey the substance oftheir work to others skilled in the art. An algorithm is here, and generally, conceived tobe a self-consistent sequence of operations leading to a desired result. The operationsare those requiring physical manipulations of physical quantities. Usually, though notnecessarily, these quantities take the form of electrical or magnetic signals capable ofbeing stored, combined, compared, and otherwise manipulated. It has proven con-venient at times, principally for reasons of common usage, to refer to these signals asbits, values, elements, symbols, characters, terms, numbers, or the like.It should be borne in mind, however, that all of these and similar terms are to beassociated with the appropriate physical quantities and are merely convenient labelsapplied to these quantities. Unless specifically stated otherwise as apparent from theabove discussion, it is appreciated that throughout the description, discussions utiliz-ing terms such as “identifying” or “determining” or “executing” or “performing” or“collecting” or “creating” or “sending” or the like, refer to the action and processes of acomputer system, or similar electronic computing device, that manipulates and trans-forms data represented as physical (electronic) quantities within the computer sys-tem’s registers and memories into other data similarly represented as physical quan-tities within the computer system memories or registers or other such informationstorage devices.The present disclosure also relates to an apparatus for performing the operationsherein. This apparatus may be specially constructed for the intended purposes, or itmay comprise a computer selectively activated or reconfigured by a computer pro-gram stored in the computer. Such a computer program may be stored in a computer-readable storage medium, such as but not limited to, any type of disk including floppydisks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs),random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, orany type of media suitable for storing electronic instructions, each coupled to a com-puter system bus.The operations and illustrations presented herein are not inherently related to anyparticular computer or other apparatus. Various types of systems may be used withprograms in accordance with the teachings herein, or it may prove convenient to con-struct a more specialized apparatus to perform the operations. The structure for avariety of these systems will appear as set forth in the description herein. In addition,the present disclosure is not described with reference to any particular programminglanguage. It will be appreciated that a variety of programming languages may be usedto implement the teachings of the disclosure as described herein.The present disclosure may be provided as a computer program product, or soft-ware, that may include a machine-readable medium having stored thereon instruc-tions, which may be used to program a computer system (or other electronic devices)to perform a process according to the present disclosure. A machine-readable mediumincludes any mechanism for storing information in a form readable by a machine (e.g.,a computer). For example, a machine-readable (e.g., computer-readable) medium in-cludes a machine (e.g., a computer) readable storage medium such as read-only mem-ory (“ROM”), random access memory (“RAM”), magnetic disk storage media, opticalstorage media, flash memory devices, etc.In some embodiments, a tangible, non-transitory apparatus or article of manufac-ture comprising a tangible, non-transitory computer useable or readable medium hav-ing control logic (software) stored thereon may also be referred to herein as a computerprogram product or program storage device. This includes, but is not limited to, com-puter system 500, main memory 508, secondary memory 510, and removable storageunits 518 and 522, as well as tangible articles of manufacture embodying any com-bination of the foregoing. Such control logic, when executed by one or more dataprocessing devices (such as computer system 500), may cause such data processingdevices to operate as described herein.Based on the teachings contained in this disclosure, it will be apparent to personsskilled in the relevant art(s) how to make and use embodiments of this disclosure us-ing data processing devices, computer systems, and / or computer architectures otherthan that shown in Figs. 2 and 3. In particular, embodiments can operate with soft-ware, hardware, and / or operating system implementations other than those describedherein. It is to be appreciated that the Detailed Description section, and not any other sec-tion, is intended to be used to interpret the claims. Other sections can set forth oneor more but not all exemplary embodiments as contemplated by the inventor(s), andthus, are not intended to limit this disclosure or the appended claims in any way.While this disclosure describes exemplary embodiments for exemplary fields andapplications, it should be understood that the disclosure is not limited thereto. Otherembodiments and modifications thereto are possible and are within the scope andspirit of this disclosure. For example, and without limiting the generality of this para-graph, embodiments are not limited to the software, hardware, firmware, and / or en-tities illustrated in the figures described herein. Further, embodiments (whether or notexplicitly described herein) have significant utility to fields and applications beyondthe examples described herein.Embodiments have been described herein with the aid of functional building blocksillustrating the implementation of specified functions and relationships thereof. Theboundaries of these functional building blocks have been arbitrarily defined hereinfor the convenience of the description. Alternate boundaries can be defined as longas the specified functions and relationships (or equivalents thereof) are appropriatelyperformed. Also, alternative embodiments can perform functional blocks, steps, oper-ations, methods, etc. using orderings different than those described herein.References herein to “one embodiment,” “an embodiment,” “an example embodi-ment,” or similar phrases, indicate that the embodiment described can include a par-ticular feature, structure, or characteristic, but every embodiment may not necessarilyinclude the particular feature, structure, or characteristic. Moreover, such phrases arenot necessarily referring to the same embodiment. Further, when a particular feature,structure, or characteristic is described in connection with an embodiment, it wouldbe within the knowledge of persons skilled in the relevant art(s) to incorporate suchfeature, structure, or characteristic into other embodiments whether or not explicitlymentioned or described herein. Additionally, some embodiments can be describedusing the expression “coupled” and “connected” along with their derivatives. Theseterms are not necessarily intended as synonyms for each other. For example, someembodiments can be described using the terms “connected” and / or “coupled” to in-dicate that two or more elements are in direct physical or electrical contact with eachother. The term “coupled,” however, can also mean that two or more elements are notin direct contact with each other, but yet still co-operate or interact with each other.The breadth and scope of this disclosure should not be limited by any of the above-described exemplary embodiments but should be defined only in accordance with thefollowing claims and their equivalents. In the foregoing specification, implementa-tions of the disclosure have been described with reference to specific example imple-mentations thereof. It will be evident that various modifications may be made theretowithout departing from the broader spirit and scope of implementations of the disclo-sure as set forth in the following claims. The specification and drawings are, accord-ingly, to be regarded in an illustrative sense rather than a restrictive sense.

Claims

CLAIMS1. A method for compressing public key material for multiple users in a single digest,the method comprising:(a) executing, by a computerized processor, a setup procedure for a user i togenerate a public and secret key pair, the setup procedure comprising:(i) sampling, by a random bit generator module, v mi from {0, 1} , such that viis a random set of bits for the user i, wherein {0, 1}m represents the set ofbinary vectors of length m;(ii) computing, by a public key computation module, pi is defined as A0vi,wherein A is a publ n×m0 ic random parameter matrix in Zq , wheredenotes the ring of integers modulo q;(iii) locally storing, in a non-transitory computer-readable storage medium,the public and secret keys as (pki, ski) is defined as (pi,vi);(b) generating, by a digest generation module, a single digest from L public keys,the method comprising:(i) receiving, via a network interface, pk1, ... , pkL, where L represents a totalnumber of users;(ii) for i ∈ [L], parsing, by a data processing unit, pki is pi and setting Pi isdefined as [pi | 0 | · · · | 0] ∈ Zn×mq , where [L] denotes the set {1, 2, ... , L};(iii) setting, by the data processing unit, P is (P1, ... ,PL), where P representsa collection of all public key matrices;(iv) establishing, by a matrix function module, a matrix-valued functionmReadP(i) is Pi, where mReadP is a function that returns the matrix Piwhen given index i;(v) computing, by a homomorphic evaluation module, an EvalPKhomomorphic evaluation of mReadP over a public random parameterA ∈ Zn×ℓm to ob ∗q tain (A , {Hi}i∈[L]), where Hi are correspondingcoefficient matrices and A∗ is a resulting evaluation matrix;(vi) setting, by the data processing unit, witi is (i,hi) where hi is a first columnof Hi to be non-secret decryption material for the user i, and storing witi inthe non-transitory computer-readable storage medium; and(vii) setting, by the data processing unit, dig is defined as A∗ to be the singledigest, and storing the single digest in the non-transitorycomputer-readable storage medium.

2. The method of claim 1, further comprising generating a ciphertext for anindividual user by:(a) receiving the public parameters A0,A, the single digest A∗, an index i and amessage µ for encryption;(b) sampling a learning with errors secret vector s;(c) computing a learning with errors sample c0 based on the learning with errorssecret vector s and the public random parameter matrix A0;(d) computing a learning with errors sample c1 based on the learning with errorssecret vector s and a matrix A − i ⊗ G;(e) computing c2 to be the sum of µ · ⌈q / 2⌋ and a learning with errors sample basedon the learning with errors secret vector s and the single digest A∗, wherein q isa modulus of the method; and(f) forming a ciphertext as a combination ct is (c0, c1, c2).

3. The method of claim 2, further comprising decrypting the ciphertext ct for theindividual user i who has a secret key sk and non-secret decryption material witi by:(a) parsing the ciphertext ct is (c0, c1, c2), the secret key sk is vi and the non-secretdecryption material witi is (i,hi); and(b) computing the message µ as µ is defined as roundq(c2 −whereinroundq(x) is ⌈2x / q⌋.

4. The method of claim 1, further comprising:(a) receiving, via the network interface, a request to update a public key for a userwith index j, where j ∈ [L] or to add a new public key for a user with indexL+1; (b) executing, by the computerized processor, the setup procedure to generate anew public and secret key pair (pk′j, sk′ j) for the user j;(c) updating, by the digest generation module, the single digest dig and thenon-secret decryption materials {witi}i∈[L] by:(i) recomputing P u ′j sing the new public key pkj ;(ii) recomputing the EvalPK homomorphic evaluation of mReadP with theupdated Pj ;(iii) updating dig and {witi}i∈[L] based on the recomputed evaluation;(d) storing the updated dig and {witi}i∈[L] in the non-transitory computer-readablestorage medium.

5. The method of claim 1, wherein the EvalPK homomorphic evaluation is performedusing a bootstrapped preprocessing system of homomorphic operations, the methodfurther comprising:(a) generating, by the computerized processor, a data structure DS during theEvalPK evaluation;(b) storing DS in the non-transitory computer-readable storage medium;(c) using DS in subsequent homomorphic evaluations to reduce computationalcomplexity to polylog L.

6. A system for compressing public key material for multiple users in a single digest,the system comprising:(a) a computerized processor configured to execute a setup procedure for a user ito generate a public and secret key pair, the setup procedure comprising:(i) a random bit generator module configured to sample v mi from {0, 1} ,such that v is a random set of bits for the user mi i, wherein {0, 1}represents the set of binary vectors of length m;(ii) a public key computation module configured to compute pi is defined asA v , wherein A is a public random par n×m0 i 0 ameter matrix in Zq , wheredenotes the ring of integers modulo q;(iii) a non-transitory computer-readable storage medium configured to locallystore the public and secret keys as (pki, ski) is defined as (pi,vi);(b) a digest generation module configured to generate a single digest from L publickeys, the digest generation module comprising:(i) a network interface configured to receive pk1, ... , pkL, where L representsa total number of users;(ii) a data processing unit configured to, for i ∈ [L], parse pki is pi and set Pi isdefined as [p n×mi | 0 | · · · | 0] ∈ Zq , where [L] denotes the set {1, 2, ... , L};(iii) the data processing unit further configured to set P is (P1, ... ,PL), whereP represents a collection of all public key matrices;(iv) a matrix function module configured to establish a matrix-valued functionmReadP(i) is Pi, where mReadP is a function that returns the matrix Piwhen given index i;(v) a homomorphic evaluation module configured to compute an EvalPKhomomorphic evaluation of mReadP over a public random parameterA ∈ Zn×ℓmq to obtain (A∗, {Hi}i∈[L]), where Hi are correspondingcoefficient matrices and A∗ is a resulting evaluation matrix;(vi) the data processing unit further configured to set witi is (i,hi) where hi is afirst column of Hi to be non-secret decryption material for the user i, andstore witi in the non-transitory computer-readable storage medium; and(vii) the data processing unit further configured to set dig is defined as A∗ to bethe single digest, and store the single digest in the non-transitorycomputer-readable storage medium.

7. The system of claim 6, further comprising a ciphertext generation moduleconfigured to generate a ciphertext for an individual user by:(a) receiving the public parameters A0,A, the single digest A∗, an index i and amessage µ for encryption;(b) sampling a learning with errors secret vector s;(c) computing a learning with errors sample c0 based on the learning with errorssecret vector s and the public random parameter matrix A0;(d) computing a learning with errors sample c1 based on the learning with errorssecret vector s and a matrix A − i ⊗ G;(e) computing c2 to be the sum of µ · ⌈q / 2⌋ and a learning with errors sample basedon the learning with errors secret vector s and the single digest A∗, wherein q isa modulus of the system; and(f) forming a ciphertext as a combination ct is (c0, c1, c2).

8. The system of claim 7, further comprising a decryption module configured todecrypt the ciphertext ct for the individual user i who has a secret key sk andnon-secret decryption material witi by:(a) parsing the ciphertext ct is (c0, c1, c2), the secret key sk is vi and the non-secretdecryption material witi is (i,hi); and(b) computing the message µ as µ is defined as roundq(c2 − c⊤ ⊤1 hi − c0 vi), whereinroundq(x) is ⌈2x / q⌋.

9. The system of claim 6, wherein:(a) the network interface is further configured to receive a request to update apublic key for a user with index j, where j ∈ [L] or to add a new public key fora user with index L+1;(b) the computerized processor is further configured to execute the setupprocedure to generate a new public and secret key pair (pk′′ j, sk j) for the user j;(c) the digest generation module is further configured to update the single digestdig and the non-secret decryption materials {witi}i∈[L] by:(i) recomputing P ′j using the new public key pkj ;(ii) recomputing the EvalPK homomorphic evaluation of mReadP with theupdated Pj ;(iii) updating dig and {witi}i∈[L] based on the recomputed evaluation;(d) the non-transitory computer-readable storage medium is further configured tostore the updated dig and {witi}i∈[L].

10. The system of claim 6, wherein the EvalPK homomorphic evaluation is performedusing a bootstrapped preprocessing system of homomorphic operations, andwherein: (a) the computerized processor is further configured to generate a data structureDS during the EvalPK evaluation;(b) the non-transitory computer-readable storage medium is further configured tostore DS;(c) the homomorphic evaluation module is further configured to use DS insubsequent homomorphic evaluations to reduce computational complexity topolylog L.

11. A non-transitory computer-readable storage medium storing instructions that,when executed by a processor, cause the processor to perform a method forcompressing public key material for multiple users in a single digest, the methodcomprising: (a) executing a setup procedure for a user i to generate a public and secret key pair,the setup procedure comprising:(i) sampling vi from {0, 1}m, such that vi is a random set of bits for the user i,wherein {0, 1}m represents the set of binary vectors of length m;(ii) computing pi is defined as A0vi, wherein A0 is a public randomparameter matrix in Zn×mq , wheredenotes the ring of integers modulo q;(iii) locally storing the public and secret keys as (pki, ski) is defined as (pi,vi);(b) generating a single digest from L public keys, the method comprising:(i) receiving pk1, ... , pkL, where L represents a total number of users;(ii) for i ∈ [L], parsing pki is pi and setting Pi is defined asdenotes the set {1, 2, ... , L};(iii) setting P is (P1, ... ,PL), where P represents a collection of all public keymatrices; (iv) establishing a matrix-valued function mReadP(i) is Pi, where mReadP is afunction that returns the matrix Pi when given index i;(v) computing an EvalPK homomorphic evaluation of mReadP over a publicrandom parameter A ∈ Zn×ℓm ∗q to obtain (A , {Hi}i∈[L]), where Hi arecorresponding coefficient matrices and A∗ is a resulting evaluation matrix;(vi) setting witi is (i,hi) where hi is a first column of Hi to be non-secretdecryption material for the user i, and storing witi; and(vii) setting dig is defined as A∗ to be the single digest, and storing the singledigest.

12. The non-transitory computer-readable storage medium of claim 11, wherein themethod further comprises generating a ciphertext for an individual user by:(a) receiving the public parameters A ∗0,A, the single digest A , an index i and amessage µ for encryption;(b) sampling a learning with errors secret vector s;(c) computing a learning with errors sample c0 based on the learning with errorssecret vector s and the public random parameter matrix A0;(d) computing a learning with errors sample c1 based on the learning with errorssecret vector s and a matrix A − i ⊗ G;(e) computing c2 to be the sum of µ · ⌈q / 2⌋ and a learning with errors sample basedon the learning with errors secret vector s and the single digest A∗, wherein q isa modulus of the method; and(f) forming a ciphertext as a combination ct is (c0, c1, c2).

13. The non-transitory computer-readable storage medium of claim 12, wherein themethod further comprises decrypting the ciphertext ct for the individual user i whohas a secret key sk and non-secret decryption material witi by:(a) parsing the ciphertext ct is (c0, c1, c2), the secret key sk is vi and the non-secretdecryption material witi is (i,hi); and(b) computing the message µ as µ is defined as round ⊤ ⊤q(c2 − c1 hi − c0 vi), whereinroundq(x) is ⌈2x / q⌋.

14. The non-transitory computer-readable storage medium of claim 11, wherein themethod further comprises:(a) receiving a request to update a public key for a user with index j, where j ∈ [L]or to add a new public key for a user with index L+1;(b) executing the setup procedure to generate a new public and secret key pair(pk′′ j, sk j) for the user j;(c) updating the single digest dig and the non-secret decryption materials {witi}i∈[L]by: (i) recomputing P ′j using the new public key pkj ;(ii) recomputing the EvalPK homomorphic evaluation of mReadP with theupdated Pj ;(iii) updating dig and {witi}i∈[L] based on the recomputed evaluation;(d) storing the updated dig and {witi}i∈[L].

15. The non-transitory computer-readable storage medium of claim 11, wherein theEvalPK homomorphic evaluation is performed using a bootstrapped preprocessingsystem of homomorphic operations, the method further comprising:(a) generating a data structure DS during the EvalPK evaluation;(b) storing DS;(c) using DS in subsequent homomorphic evaluations to reduce computationalcomplexity to polylog L.

Images