Using the same mathematical principle of paring with errors, which can be viewed as an extension of the idea of the LWE problem, this invention gives constructions of a new key exchanges system, a new key distribution system and a new identity-based encryption system. These new systems are efficient and have very strong security property including provable security and resistance to quantum computer attacks.
|
1. Method for establishing a shared key exchange over an open communication channel between a first party party A and a second party party b, comprising:
(1) openly selecting, by the party A and the party b together, parameters, n, q and small whole number t, (t<<n), where q is an odd prime, and an error distribution κn
(2) choosing, by each of the parties privately, its own secret matrix Si (i=A, b) a n×n matrix chosen according to the error distribution κn
computing by a processor of the party A
MA=MSA+teA, where t is a small integer (t<<n);
computing by the party b
Mb=MtSb+teb, (3) Both of the parties exchange Mi in the open communication channel;
(4) computing by the party A:
KA=StA×Mb=StAMtSb+tstAeb; computing by the party b:
Kb=MtA×Sb=StAMtSb+tetASb; (5) performing by both the party A and the party b a rounding technique to derive the shared key, comprising:
(a) making by the party b a list t1 of all positions of the entries of Kb such that these entries are in the range of [−(q−1)/4, (q−1)/4] and a list t2 of all positions which are not in the range of [−(q−1)/4, (q−1)/4], then sending by the party b to the party A the list t1,
(b) computing by each of the parties privately the, residues of these entries modular t in t1, ; and
for the entries not in t1, which is in t2, adding (q−1)/2 to each entry in t2 and computing the a residue modular q first (into the range of [−(q−1)/4, (q−1)/4]) then the a residue modular t, which gives a the shared key between the two parties.
13. Method, for a central server, building an identity-based encryption system, comprising:
(1) selecting, by the central server, parameters, n, q and small whole number t, (t<<n), where q is an odd prime, q is of size of a polynomial of n like n3 and elements of Fq are represented by integers in the range [−(q−1)/2, (q−1)/2)], [−(q−1)/2, (q−1)/2], and an error distribution κn
(2) selecting, by the central server, a random element M following uniform distribution, but making sure that M has an inverse: when the central server could not find one first time, it tries again till it finds one; then computing by the central server
M1=MS+te, where e is small following certain error distribution κn
(3) then publicizing, by the central server, M and M1 as the a master public key;
(4) assigning, by the central server, for each user indexed by i an and public id as Ai, where Ai is small following certain error distribution κn
(5) processing by a processor and giving by the central server for each user, namely, the user i, a secret key:
Si=SAi+tM−1ei, where ei's entries are small following the error distribution κ;
(6) then establishing by anyone, using the public id, Ai, and the master public key, a new public key for the user with public id Ai, which is given as the pair (Ai, bi), where
Ai=M and bi=M1Ai=MSAi+teAi, and using by anyone as the new public key to encrypt any message use the a matrix learning with errors (MLWE) encryption system.
7. Method, for a central server, building a key distribution (KD) system, comprising:
(1) selecting, by the central server, parameters select parameters, n, q and small whole number t, (t<<n), where q is an odd prime, q is of size of a polynomial of n like n3 and elements of Fq are represented by integers in the range [−(q−1)/2, (q−1)/2)], [−(q−1)/2, (q−1)/2], an error distribution κn
(2) giving, by the central server, to each user index as i, a general matrix Ai as an id with small entries following error distribution κn
(3) distributing, by the central server, for each user securely a secret matrix:
Ei=AiS+tei, where ei Ei is a matrix selected following error distribution κn
obtaining a secret key shared key between the user i and the user j comprising:
computing by a process processor of the user i:
Ki=Ei×Ajt=AiSAjt+teiAjt; and computing by a processor of the user j
Kj=Ai×(Ej)t=AiStAjtAiStAjt+tejt=AiSAjt+teiAjt=Ki; then the two users deriving a the shared key between the two users using the following a simple rounding method, comprising:
when the user j wants to establish a the shared key with the user user i, collecting by the user user j all the entries (including their positions in the matrix) in Kj, including their positions in Kj, that are in the range of (−(q−1)/4, (q−1)/4), namely those entries which are closer to 0 than (q−1)/2;
sending, by the user j to the user user i, a list of the positions of the entries in the matrix Kj (only the position not the values of the entries themselves) that are randomly selected from the collection collected entries, which is tagged by 0 1, and a list of entries not in the list tagged by 0;
then selecting by the user user i the same entries in its own matrix Ei×Aj, which gives them user i and user j a shared list of common entry positions, therefore the corresponding entries of the matrix shared key;
then computing by each of the users the a residue of the entries modular t lagged by 1 and compute the a residue of the a sum of each of the entries tagged by 0 with (q−1)/2, which build a new identical ordered list of values, their the shared secret key.
2. The method according to
3. The method according to
4. The method according to
0. 5. The method according to
6. The method according to
8. The method according to
9. The method according to
10. The method according to
11. The method according to
12. The method according to
14. The method according to
15. The method according to
16. The method according to
17. The method according to
18. The method according to
19. The method according to
|
For two matrices A and B with small entries following certain error distributions, for example, with entries following some error distributions, instead of computing this product directly, we can first compute
AB+Ea,
then compute
(AB+EA)C or (AB+EA)C+EAC,
or we will compute
BC+EC,
then compute
A(BC+Ec) or (AB+EA)C+EBC,
where EA, EB, EAC, EBC are matrices with small entries following the same (or different) error distributions. Then we have two way to compute the product ABC with small errors or differences between these two matrices. We call such a computation pairing with errors. All our constructions depends on such a paring with errors and on the fact that the two different paring are close to each other if A and C are also small.
We can mathematically prove the theorem that an MLWE problem is as hard as the corresponding LWE problem with the same parameters. This provides the foundation of the provable security of our constructions
1.2 The Construction of the New KE Systems Based on Paring with Errors
Two parties Alice and Bob decide to do a key exchange (KE) over an open channel. This means that the communication of Alice and Bob are open to anyone including malicious attackers. To simplify the exposition, we will assume in this part all matrices involves are n×n matrices. But they do not have to be like this, and they can be matrices of any sizes except that we need to choose the compatible sizes such that the matrix multiplications performed are well defined.
Their key change protocol will go step by step as follows.
The reason that Alice and Bob can derive from KA and KB a shared secret to be the exchanged key via certain rounding techniques as in the case above is exactly that ei and Si are small, therefore KA and KB are close. We call this system a SMLWE key exchange protocol. We can derive the provable security of this more efficient system [Dili].
In term of both communication and computation efficiency, the new system is very good. The two parties need to exchange n2 entries in Fq, and each perform 2n2.8 computations (with Strassen fast matrix multiplication [STR]) to derive n2 bits if t=2.
Si and ei can follow different kind of error distributions.
We can prove the theorem that if we choose the same system parameters, namely n and q, the matrix SLWE key exchange protocol is provably secure if the error distribution is properly chosen [DiLi]. The proof relies on the mathematical hardness of the following pairing with error problem.
Assume that we are given
The proof follows from the fact that the SMLWE problem is as hard as the SLWE problem, since the matrix version can be viewed as just assembling multiple SLWE samples into one matrix SLWE sample.
We note here that we can choose also rectangular matrix for the construction as long as we make sure the sizes are matching in terms of matrix multiplications, but parameters need to be chosen properly to ensure the security.
Similarly we can build a key exchange system based on the ring learning with errors problem (RLWE) [LPR], we will a variant of the RLWE problem described in [LNV].
For the RLWE problem, we consider the rings R=Z[x]/f(x), and Rq=R/qR, where f(x) is a degree n polynomial in Z[x], Z is the ring of integers, and q is a prime integer. Here q is an odd (prime) and elements in Zq=Fq=Z/q are represented by elements: −(q−1)/2, . . . , −1, 0, 1, . . . , (q−1)/2, which can be viewed as elements in 2 when we talk about norm of an element. Any element in Rq, is represented by a degree n polynomial, which can also be viewed as a vector with its corresponding coefficients as its entries. For an element
a(x)=a0+a1x+ . . . +an-1xn-1,
we define
∥a∥=max|ai|,
the l∞ norm of the vector (a0, a1, . . . , an-1) and we treat this vector as an element in Zn and ai an element in Z. We can also choose q to be even positive number and things need slight modification.
The RLWEf,q,χ problem is parameterized by an polynomial f(x) of degree n, a prime number q and an error distribution X over Rq. It is defined as follows.
Let the secret s be an element in Rq, a uniformly chosen random ring element. The problem is to find s, given any polynomial number of samples of the pair
(ai,bi=ai×s+ei),
where ai is uniformly random in Rq and ei is selected following certain error distribution X.
The hardness of such a problem is based on the fact that the bi are computationally indistinguishable from uniform in Rq. One can show [LPR] that solving the RLWEf,q,χ problem above is known to give us a quantum algorithm that solves short vector problems on ideal lattices with related parameters. We believe that the latter problem is exponentially hard.
We will here again use the facts in [ACPS], [LPR] that the RLWEf,q,χ problem is equivalent to a variant where the secret s is sampled from the error distribution X rather than being uniform in Rq and the error element ei are multiples of some small integer t.
To derive the provable security, we need consider the RLWE problem with specific choices of the parameters.
There are two key facts in the RLWEf,q,χ setting defined above, which are needed for our key exchange system.
With the RLWEf,q,χ setting above, we are now ready to have two parties Alice and Bob to do a key exchange over an open channel. It goes step by step as follows.
We can use different distributions for si and ei.
That will give a shared key between these two users. We call this system a RLWE key exchange system. We can deduce that there is a very low probability of failure of this key exchange system. We note here that the commutativity and the associativity of the ring Rq play a key role in this construction.
In terms of security analysis, we can show the provable security of the system following the hardness of the RLWEf,q,χ problem by using a similar PEP over the ring Rq [DiLi].
Assume that we are given
It is nearly a parallel extension of the proof of the provable security of the case of SLWE key exchange system to the RLWE key exchange system. We conclude that the RLWE key exchange system is provable secure based on the hardness of the RLWEf,q,χ problem.
With the same parameters q and n, this system can be very efficient due to the possibility doing fast multiplication over the ring Rq using FFT type of algorithms.
1.3 The Construction of the New KD Systems Based on Paring with Errors
Over a large network, key distribution among the legitimate users is a critical problem. Often, in the key distribution systems, a difficult problem is how to construct a system, which is truly efficient and scalable. For example, in the case of the constructions of [BSHKVY], the system can be essentially understood as that the master key of a central server is a symmetric matrix M of size n×n and each user's identity can be seen as a row vector Hi of size n. The central server gives each user the secret Hi×M. Then two users can derive the shared key as Hi×M×Hjt. The symmetric property of M ensures that
Hi×M×Hjt=Hjt×M×Hi.
However, large number of users can collaborate to derive the master key. If one can collect enough (essentially n) Hi×M, which then can be used to find the master key M and therefore break the system.
We will build a truly scalable key distribution system using the pairing with error with a trusted central server, which can be viewed as a combination of the idea above and the idea of the LWE.
We work again over the finite field Fq, whose elements are represented by −(q−1)/2, . . . , 0, . . . , (q−1)/2. We choose q≈n3 or other similar polynomial function of n, we choose again κn
The key distribution system is set up step by step as follows.
To obtain a secret key shared between the user i and the user j, the user i computes
Ki=Ei×Ajt=AiSAjt+teiAjt;
and the user j computes
Kj=Ai×(Ej)t=AiStAjt+tAiejt=AiSAjt+tAiejt.
This is possible because the IDs are public. They then can use the following simple rounding method to derive a shared key between the two users.
Because S symmetric, we have that
AiSAjt=AiStAjt,
therefore the user j derives
AiSAjt+tAiAiejt.
The difference between the results computed by the two users is:
Ei×Atj−Ai×EtJ=AiSAtj+teiAtj−(AiSAtj+tAietj)=teiAtj−tAietj.
This difference is small since t is small and eiAjt and Aiejt are small, which is due to the fact that ei, ej, Ai and Aj are all small. This allows us to get a common key for i and j by certain rounding techniques and therefore build a key distribution system.
Since the error terms for both matrices, teiAj and tejtAi, are small, the corresponding selected entries with tag 1 in AiSAj (without the error terms) are essentially within the range of [(−(q−1)/4, (q−1)/4] or very close. Therefore the error terms will not push those selected terms in AiSAj over either (−(q−1)/2 or (q−1)/2), that is when added the error terms, those selected entries will not need any further modular q operation but just add them as integers, since each element is represented as an integer in the range of [(−(q−1)/2(q−1)/2)]. The same argument goes with entries tagged by 0. These ensures that the process give a shared key between these two users.
From the way matrices Ki, Kj are constructed, we know that each entry of Ki and Kj follows uniform distribution. Therefore we expect that each time the size of the first list selected by the user j from the matrix Kj should be around n2. Therefore this system can provide the shared secret with enough bits if we choose proper n.
Also we can build a version of this system with none symmetric matrices, in this case, the central serve needs to compute more matrices like AiS+e and AitS+e′. Then it is possible, we can do the same kind of key distribution. This system again is less efficient.
On the other hand, since the RLWE problem can be viewed as a specialized commutative version of matrix-based LWE since an element in the ring can be view as a homomorphism on the ring. We can use the RLWE to build a key distribution in the same way.
Now let us look at why this key distribution is scalable. Clearly each user will have a pair A, and Ei=AiS+tei, and many users together can get many pairs, then to find the secret master key S is to solve the corresponding MLWE problem, except that, in this case, we impose the symmetric condition on the secret S. It is not difficult to argue again that this problem is as hard as a LWE problem, since given a LWE problem, we can convert it also into such a MLWE problem with symmetric secret matrix. Therefore, it is easy to see that this system is indeed scalable.
In terms of the provable security of the system, the situation is similar to the work done in the paper [DiLi]. We can give a provable security argument along the same line.
As we said before, since RLWE can be viewed as a special case MLWE, we will use the RLWE to build a very simple key distribution system.
We will choose the ring Rq to be Fq[x]/xn+1. To ensure the provable security, we need to choose parameter properly n, q, properly, for example n=2k, q=1 mod(2n)[LPR]. For provable secure systems, we assume that we will follow the conventional assumptions on these parameters, and the assumption on the error distribution like χ in [LPR].
This construction is essentially based on the systems of above. We assume that we have a ring Rq with a properly defined learning with error problem on the ring Rq with error distribution X. The problem is defined as follows:
We are given a pair (A, E), where
E=A×S+te′,
A, S where e′ are elements in R, t is small integer, e′ is an error element following the distribution of χ, S is a fixed element and A is select randomly following uniform distribution, and the problem is to find the secret S.
With a central server, we can build a simple key distribution system as follows.
Since Ai and ei are small elements in Rq, we have Ai×ei is also small. This ensures that we indeed have a shared secret key. This, therefore, gives an key-distribution system.
Here we use very much the fact that in a RLWE problem that the multiplication is commutative. The key feature of our construction is that it is simple and straight forward. The provable security of the system is also straightforward.
1.4 the Construction of the New IBE Systems Based on Paring with Errors
We will first build a new public key encryption based on MLWE. To build an encryption system, we choose similar parameter q≈n3 or n4 or similar polynomial functions of n, we choose again κn
With such a setting, we can build an encryption system as in the case of the MLWE problem as follows:
A, B, ei can follow different error distributions.
With large n, the output can give us the right plaintext with as high probability as demanded. The reason we could decrypt with high probability comes from the following.
D2−D1×S=BE+e2+m(q/2)−(BA+e)S=B×(A×S+e)+e2+m(q/2)−(BA+e1)×S=B×e+e2−e1×S+m(q/2)
B×e+e2−e1×S can be viewed as a error terms, which is determined by the distribution of the following random variable. With proper choice of parameters, like in the case of KE or KD systems, the decryption process will surely return the right answer when n is large enough. The same argument goes with the second case.
One key point of this new method is that on average, we can do the encryption much faster in terms of per bit speed because we can use fast matrix multiplication [CW] to speed up the computation process.
We note here that since matrix multiplication is not commutative, when we multiply two elements, the order is very important, unlike the case of the RLWE related systems.
We can also use the same idea in the ring LWE (RLWE)[LPR] to do encryption, where all the elements are in the ring Rq, and we have
E=A×S+te,
t is small positive integer and the entries of S is also small following error distribution κn
(D1,D2)=(BA+te1,BE+te2+m).
Then we decrypt by computing
(BE+te2+m−B(AS+te1))(mod t).
This works because
D2−D1×S=BE+te2+m−(BA+t1e1)S=B×(A×S+te)+te2+m−(BA+te1)×S=tB×e+te2−te1×S+m
Since the error terms are small, by modular t, we certainly should get back the original plaintext.
For the MLWE problem, we surely need to choose the distribution accordingly when we need to obtain the provable security of the system.
There are several versions of identity-based encryption systems based on lattice related problems including the LWE problem [ABB], [ABVVW], [BKPW]. But they all look rather complicated. We can use the MLWE to build an identity-based encryption system.
With a central server, we can build a simple identity-based encryption system as follows.
S, Ai, ei, e can also follow different error distributions.
Since Ai and e are small, we have Ai×e is also small. W also have that
MSi−Bi=MSi−Bi=M(SAi+tM−1ei)−MSAi+teAi=MSAi+tMM−1ei)−MSAi+teAi=tei−teAi,
Since e, Ai and ei are small, e−Aiei is also small and tei−tAiei is also small. Therefore Si is a solution to a MLWE problem with the pair (Ai, Bi) as the problem input. Therefore Si is indeed a secret key that could be used for decryption. Therefore the construction works. We need to choose parameters properly to ensure security.
The key feature of our construction is that it is simple and straight forward. The provable security of the system is also straightforward.
we can extend this construction using the RLWE problem. We will choose the ring R to be Fq[x]/xn+1. To ensure the provable security, we need to choose parameter properly n, q, properly, namely n=2k, q=1 mod(2n)[LPR]. But we can select other parameters for secure applications.
This construction is directly based on the encryption systems of the RLWE[LPR], namely, we assume that we have a ring R with a properly defined learning with error problem on the ring R. The problem is defined as follows: we are given a pair (A, E), where
E=A×S+te′,
A, S where e′ are elements in Rq, t is small integer, e′ is an error element following an error distribution X, S is a fixed element and A is select randomly following uniform distribution, and the problem is to find the secret S. We also know that one can build a public key encryption systems using the RLWE problem[LPR], where A, and E serve as the public key, and the secret S, which needs to be small, serves as the private key. We can use the fact that in a ring-LWE problem that the multiplication is commutative.
With a central server, we can build a simple identity-based encryption system as follows.
The small elements like S, Ai, e, ei can follow different error distributions.
Since Ai and e are small elements in R, we have Ai×e is also small. We have that
SiAi−Bi=SiM−Bi=M(SAi+iM−1ei)−MSAi+Aite=MSAi+tMM−1ei)−MSAi+Aite==te−tAiei,
which is due to the fact that this is a commutative ring. Since e, Ai and ei are small, e−Aiei is also small and te−tAiei is also small. Therefore Si is a solution to a ring LWE problem with the pair (Ai, Bi) as the problem input. Therefore Si is indeed a secret key that could be used for decryption.
We can build easily a hierarchical IBE system using similar procedure, where each user can server as a central server.
The key feature of our construction is that it is simple, straight forward and efficient. The provable security of the system is also straightforward.
In the all the systems above using pairing with errors over the ring, one may use polynomials in the form of
f(x)=Πfi(x)+g(x),
where each fi, g(x) is a extremely sparse matrix with very few terms, for example, 2 or 3 terms none-zero. Using this kind of polynomial can speed up the encryption and decryption computations.
Patent | Priority | Assignee | Title |
Patent | Priority | Assignee | Title |
6263437, | Feb 19 1998 | UNWIRED PLANET IP MANAGER, LLC; Unwired Planet, LLC | Method and apparatus for conducting crypto-ignition processes between thin client devices and server devices over data networks |
7603554, | Jun 12 2003 | Panasonic Corporation | Encryption communication system |
8107397, | Jun 05 2006 | Purdue Research Foundation | Protocol for secure and energy-efficient reprogramming of wireless multi-hop sensor networks |
8297510, | Jun 30 2011 | Mathematical method of 2D barcode authentication and protection for embedded processing | |
20030081774, | |||
20060034457, | |||
20070271606, | |||
20080046732, | |||
20080069344, | |||
20080112596, | |||
20090154711, | |||
20090204823, | |||
20090208019, | |||
20090327141, | |||
20100077462, | |||
20120236968, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Date | Maintenance Fee Events |
Jan 26 2018 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
Feb 13 2018 | SMAL: Entity status set to Small. |
Jul 26 2023 | M2552: Payment of Maintenance Fee, 8th Yr, Small Entity. |
Date | Maintenance Schedule |
Feb 04 2023 | 4 years fee payment window open |
Aug 04 2023 | 6 months grace period start (w surcharge) |
Feb 04 2024 | patent expiry (for year 4) |
Feb 04 2026 | 2 years to revive unintentionally abandoned end. (for year 4) |
Feb 04 2027 | 8 years fee payment window open |
Aug 04 2027 | 6 months grace period start (w surcharge) |
Feb 04 2028 | patent expiry (for year 8) |
Feb 04 2030 | 2 years to revive unintentionally abandoned end. (for year 8) |
Feb 04 2031 | 12 years fee payment window open |
Aug 04 2031 | 6 months grace period start (w surcharge) |
Feb 04 2032 | patent expiry (for year 12) |
Feb 04 2034 | 2 years to revive unintentionally abandoned end. (for year 12) |