Cryptographic system using pairing with errors

Abstract

Using the same mathematical principle of paring with errors, which can be viewed as an extension of the idea of the LWE problem, this invention gives constructions of a new key exchanges system, a new key distribution system and a new identity-based encryption system. These new systems are efficient and have very strong security property including provable security and resistance to quantum computer attacks.

Description

Such a product can be mathematically viewed as computing the bilinear paring of the row vectors of A with column vectors of C.

For two matrices A and B with small entries following certain error distributions, for example, with entries following some error distributions, instead of computing this product directly, we can first compute
AB+E_a,
then compute
(AB+E_A)C or (AB+E_A)C+E_AC,
or we will compute
BC+E_C,
then compute
A(BC+E_c) or (AB+E_A)C+E_BC,
where E_A, E_B, E_AC, E_BC are matrices with small entries following the same (or different) error distributions. Then we have two way to compute the product ABC with small errors or differences between these two matrices. We call such a computation pairing with errors. All our constructions depends on such a paring with errors and on the fact that the two different paring are close to each other if A and C are also small.

We can mathematically prove the theorem that an MLWE problem is as hard as the corresponding LWE problem with the same parameters. This provides the foundation of the provable security of our constructions

1.2 The Construction of the New KE Systems Based on Paring with Errors

Two parties Alice and Bob decide to do a key exchange (KE) over an open channel. This means that the communication of Alice and Bob are open to anyone including malicious attackers. To simplify the exposition, we will assume in this part all matrices involves are n×n matrices. But they do not have to be like this, and they can be matrices of any sizes except that we need to choose the compatible sizes such that the matrix multiplications performed are well defined.

Their key change protocol will go step by step as follows.

• • (1) Alice and Bob will first publicly select F_q, n and a n×n matrix M over F_q uniformly and randomly, where q is of size of a polynomial of n, for example q≈n³, and an error distribution κ_n2 to be a distribution over n×n matrices over F_q, for example, a distribution that each component are independent and each component follow certain error distribution like the discrete error distribution κ_σ as in the case of LWE, namely a discrete normal distribution over F_q center around 0 with standard deviation approximately √{square root over (n)}. All the information above is public. They jointly and publicly choose a small (prime) integer t (t<<n).
  • (2) Then each party chooses its own secret S_i (i=A, B) as a n×n matrix chosen according to the error distribution κ_n2, e_i also as a n×n matrix following the error distribution. For Alice, she computes
    M_A=MS_A+te_A,
    • where t is a small integer (t<<n).
      • For Bob, he computes
        M_B=M^tS_B+te_B.
  • (3) Both parties exchange M_i in the open communication channel. This means both M_i (i=A, B) are public, but keep S_i and e_i (i=A, B), secret.
  • (4) Alice computes:
    K_A=S^t_A×M_B=S^t_AM^tS_B+tS^t_Ae_B.
    • Bob computes:
      K_B=M^t_A×S_B=S^t_AM^tS_B+te^t_AS_B.
  • (5) Both of them will perform a rounding technique to derive the shared key as follows:
    • (a) Bob will make a list T₁ of all positions of the entries of K_B such that these entries are in the range of [−(q−1)/4, (q−1)/4] and a list T₂ of all positions which are not in the range of [−(q−1)/4, (q−1)/4]. Then Bob will send to Alice the list T₁.
    • (b) Then each party will compute the residues of these entries modular t in T₁, and for the entries not in T₁, which is in T₂, they will add (q−1)/2 to each entry and compute the residue modular q first (into the range of [−(q−1)/4, (q−1)/4]) then the residue modular t. That gives a shared key between these two users.

The reason that Alice and Bob can derive from K_A and K_B a shared secret to be the exchanged key via certain rounding techniques as in the case above is exactly that e_i and S_i are small, therefore K_A and K_B are close. We call this system a SMLWE key exchange protocol. We can derive the provable security of this more efficient system [Dili].

In term of both communication and computation efficiency, the new system is very good. The two parties need to exchange n² entries in F_q, and each perform 2n^2.8 computations (with Strassen fast matrix multiplication [STR]) to derive n² bits if t=2.

S_i and e_i can follow different kind of error distributions.

We can prove the theorem that if we choose the same system parameters, namely n and q, the matrix SLWE key exchange protocol is provably secure if the error distribution is properly chosen [DiLi]. The proof relies on the mathematical hardness of the following pairing with error problem.

Assume that we are given

• • (1) an n×n matrix M, a prime integer q, a small positive integer t, and an error distribution κ_n and;
    M′_A=MS′_A+te_A
    and
    M′_B=M^tS′_B+te_B,  (2)
    • where e_i, a n×1 vector follows the error distribution κ_n and the entries of n×1 vectors also follows the same error distribution;
  • (3) and the fact that
    K′_B=M^t_A×S′_B=(S′_A)^tM^tS′_B+t<e_A,S′_B>
    • is in the range of [−(q−1)/4, (q−1)/4] or not;
      the problem is to find an algorithm to derive
      K′_A=(S′_A)^t×M_B=(S′_A)^tM^tS′_B+t<S′_A,e_B>
      modular t if K′_B is in the range of [−(q−1)/4, (q−1)/4], otherwise K′_A+(q−1)/2 first modular q then modular t, with a high probability. We call such a problem a pairing with error problem (PEP).

The proof follows from the fact that the SMLWE problem is as hard as the SLWE problem, since the matrix version can be viewed as just assembling multiple SLWE samples into one matrix SLWE sample.

We note here that we can choose also rectangular matrix for the construction as long as we make sure the sizes are matching in terms of matrix multiplications, but parameters need to be chosen properly to ensure the security.

Similarly we can build a key exchange system based on the ring learning with errors problem (RLWE) [LPR], we will a variant of the RLWE problem described in [LNV].

For the RLWE problem, we consider the rings R=Z[x]/f(x), and R_q=R/qR, where f(x) is a degree n polynomial in Z[x], Z is the ring of integers, and q is a prime integer. Here q is an odd (prime) and elements in Z_q=F_q=Z/q are represented by elements: −(q−1)/2, . . . , −1, 0, 1, . . . , (q−1)/2, which can be viewed as elements in 2 when we talk about norm of an element. Any element in R_q, is represented by a degree n polynomial, which can also be viewed as a vector with its corresponding coefficients as its entries. For an element
a(x)=a₀+a₁x+ . . . +a_n-1x^n-1,
we define
∥a∥=max|a_i|,
the l_∞ norm of the vector (a₀, a₁, . . . , a_n-1) and we treat this vector as an element in Zⁿ and a_i an element in Z. We can also choose q to be even positive number and things need slight modification.

The RLWE_f,q,χ problem is parameterized by an polynomial f(x) of degree n, a prime number q and an error distribution X over R_q. It is defined as follows.

Let the secret s be an element in R_q, a uniformly chosen random ring element. The problem is to find s, given any polynomial number of samples of the pair
(a_i,b_i=a_i×s+e_i),
where a_i is uniformly random in R_q and e_i is selected following certain error distribution X.

The hardness of such a problem is based on the fact that the b_i are computationally indistinguishable from uniform in R_q. One can show [LPR] that solving the RLWE_f,q,χ problem above is known to give us a quantum algorithm that solves short vector problems on ideal lattices with related parameters. We believe that the latter problem is exponentially hard.

We will here again use the facts in [ACPS], [LPR] that the RLWE_f,q,χ problem is equivalent to a variant where the secret s is sampled from the error distribution X rather than being uniform in R_q and the error element e_i are multiples of some small integer t.

To derive the provable security, we need consider the RLWE problem with specific choices of the parameters.

• • We choose f(x) to be the cyclotomic polynomial xⁿ+1 for n=2^u, a power of two;
  • The error distribution χ is the discrete Gaussian distribution D_Zn,σ for some n>>σ>ω(√{square root over (log n)})>1;
  • q=1 (mod 2n) and q a polynomial of n and q≈n³;
  • t a small prime and t<<n<<q.
    We can also use other parameters for practical applications.

There are two key facts in the RLWE_f,q,χ setting defined above, which are needed for our key exchange system.

• • (1) The length of a vector drawn from a discrete Gaussian of with standard deviation a is bounded by σn, namely,
    Pr(∥X∥>σn)≤2⁻ⁿ⁺¹,
    • for X chosen according to X.
  • (2) The multiplication in the ring R_q increases from the norms of the constituent elements in a reasonable scale, that is,
    ∥X×Y(mod f(x))∥≤n∥X∥∥Y∥,
    • for X, Y ϵ R_q and the norm is the l_∞ norm defined above.

With the RLWE_f,q,χ setting above, we are now ready to have two parties Alice and Bob to do a key exchange over an open channel. It goes step by step as follows.

• • (1) Alice and Bob will first publicly select all the parameters for the RLWE_f,q,χ including q(≈n³ or similar polynomial functions of n), n, f(x) and χ. In addition, they will select a random element M over R_q uniformly. All the information above is public.
  • (2) Then each party chooses its own secret s_i as an element in R_q according to the error distribution χ, and e_i independently also as an element following the error distribution χ, but jointly choose a small prime integer t (t<<n) For Alice, she computes
    M_A=Ms_A+te_A,
  • where t is a small integer (t<<n).
    • For Bob, he computes
      M_B=Ms_B+te_B.
  • (3) Both parties exchange M_i. This means both M_i are public, but certainly keep s_i and e_i secret.
  • (4) Alice computes:
    K_A=s_A×M_B=s_AMs_B+te_Bs_A.
    • Bob computes:
      K_B=M_A×s_B=s_AMs_B+te_As_B.
  • (5) Both of them will perform a rounding technique to derive the shared key as follows:
    • (a) Bob will then make a list of size n, and this list consists of pairs in the form of (i, j), where i=0, . . . , n−1, and j=1 if the xⁱ coefficient of K_B is in the range of [−(q−1)/4, (q−1)/4], otherwise j=0.
    • (b) Then Bob will send this list to Alice. Then each will compute the residue of the corresponding entries modular t in the following way:
      • for an element of the list (i, j),
      • 1) if j=1, each will compute the i-th entry of K_A and K_B modular t respectively;
      • 2) if j=0, each will add (q−1)/2 to the i-th entry of K_A and K_B modular q back to range of [−(q−1)/4, (q−1)/4], then compute the residues modular t.

We can use different distributions for s_i and e_i.

That will give a shared key between these two users. We call this system a RLWE key exchange system. We can deduce that there is a very low probability of failure of this key exchange system. We note here that the commutativity and the associativity of the ring R_q play a key role in this construction.

In terms of security analysis, we can show the provable security of the system following the hardness of the RLWE_f,q,χ problem by using a similar PEP over the ring R_q [DiLi].

Assume that we are given

• • a random element M in R_q, prime integers t, q and the error distribution X with parameters selected as in the RLWE_f,q,χ above;
  • M_A=Ms_A+te_A and M_B=Ms_B+te_B, where e_i follows the error distribution X and s_i also follows the error distribution χ;
  • and the fact that (K_B)_i, the coefficients xⁱ of K_B=M_A×s_B=s_AMs_B+te_As_B is in the range of [−(q−1)/4, (q−1)/4] or not;
    the problem is to find an algorithm to derive K_B (or K_A) modular t or K_B+(q−1)/2 (or K_A+(q−1)/2) modular q (into the range of [−(q−1)/4, (q−1)/4]) and then modular t with a high probability. We call such a problem a pairing with error problem over a ring (RPE).

It is nearly a parallel extension of the proof of the provable security of the case of SLWE key exchange system to the RLWE key exchange system. We conclude that the RLWE key exchange system is provable secure based on the hardness of the RLWE_f,q,χ problem.

With the same parameters q and n, this system can be very efficient due to the possibility doing fast multiplication over the ring R_q using FFT type of algorithms.

1.3 The Construction of the New KD Systems Based on Paring with Errors

Over a large network, key distribution among the legitimate users is a critical problem. Often, in the key distribution systems, a difficult problem is how to construct a system, which is truly efficient and scalable. For example, in the case of the constructions of [BSHKVY], the system can be essentially understood as that the master key of a central server is a symmetric matrix M of size n×n and each user's identity can be seen as a row vector H_i of size n. The central server gives each user the secret H_i×M. Then two users can derive the shared key as H_i×M×H_j^t. The symmetric property of M ensures that
H_i×M×H_j^t=H_j^t×M×H_i.
However, large number of users can collaborate to derive the master key. If one can collect enough (essentially n) H_i×M, which then can be used to find the master key M and therefore break the system.

We will build a truly scalable key distribution system using the pairing with error with a trusted central server, which can be viewed as a combination of the idea above and the idea of the LWE.

We work again over the finite field F_q, whose elements are represented by −(q−1)/2, . . . , 0, . . . , (q−1)/2. We choose q≈n³ or other similar polynomial function of n, we choose again κ_n2 to be an error distribution over the space of n×n matrices, for example, an distribution each component are independent, and each component follows error distribution κ_σ, the discrete distribution as in the case of LWE, namely a discrete normal distribution over F_q centered around 0 with standard deviation approximately √{square root over (n)}. The choice of these parameters can be modified.

The key distribution system is set up step by step as follows.

• • (1) We have a central server, which will select a symmetric randomly chosen n×n matrix S, as a master key, whose entries are in F_q:
    S=S^t.
  • (2) For each user index as i, the central server gives it a (in general not symmetric) matrix A_t (as an ID) with small entries following error distribution κ_n2. The ID matrix of each user is public and it can also be generated with information that can identify the user like email address, name and etc.
  • (3) For each user, the central server distribute securely a secret:
    E_i=A_iS+te_i,
  • where e_i is a matrix (not symmetric) selected following certain error distribution, such as κ_n2. This is kept private for each user.

To obtain a secret key shared between the user i and the user j, the user i computes
K_i=E_i×A_j^t=A_iSA_j^t+te_iA_j^t;
and the user j computes
K_j=A_i×(E_j)^t=A_iS^tA_j^t+tA_ie_j^t=A_iSA_j^t+tA_ie_j^t.
This is possible because the IDs are public. They then can use the following simple rounding method to derive a shared key between the two users.

• • When the user j wants to establish a shared key with the user i, the user j will collect all the entries (including their positions in the matrix) in K_j that are in the range of (−(q−1)/4, (q−1)/4), namely those entries which are closer to 0 than (q−1)/2. Then user j will send to the user i a list of the positions of the entries in the matrix (only the position not the values of the entries themselves) that are randomly selected from the collection, which is tagged by 0, and a list of entries not in the list tagged by 0. Then the user i will select the same entries in its own matrix E_i×A_j. Now they have a shared list of common entry positions, therefore the corresponding entries of the matrix. Then each user will compute the residue of these entries modular t tagged by 1 and compute the residue of the sum of each of these entries tagged by 0 with (q−1)/2 to build a new identical ordered list of values, which will be their shared secret key.

Because S symmetric, we have that
A_iSA_j^t=A_iS^tA_j^t,
therefore the user j derives
A_iSA_j^t+tA_iA_ie_j^t.
The difference between the results computed by the two users is:
E_i×A^t_j−A_i×E^t_J=A_iSA^t_j+te_iA^t_j−(A_iSA^t_j+tA_ie^t_j)=te_iA^t_j−tA_ie^t_j.

This difference is small since t is small and e_iA_j^t and A_ie_j^t are small, which is due to the fact that e_i, e_j, A_i and A_j are all small. This allows us to get a common key for i and j by certain rounding techniques and therefore build a key distribution system.

Since the error terms for both matrices, te_iA_j and te_j^tA_i, are small, the corresponding selected entries with tag 1 in A_iSA_j (without the error terms) are essentially within the range of [(−(q−1)/4, (q−1)/4] or very close. Therefore the error terms will not push those selected terms in A_iSA_j over either (−(q−1)/2 or (q−1)/2), that is when added the error terms, those selected entries will not need any further modular q operation but just add them as integers, since each element is represented as an integer in the range of [(−(q−1)/2(q−1)/2)]. The same argument goes with entries tagged by 0. These ensures that the process give a shared key between these two users.

From the way matrices K_i, K_j are constructed, we know that each entry of K_i and K_j follows uniform distribution. Therefore we expect that each time the size of the first list selected by the user j from the matrix K_j should be around n². Therefore this system can provide the shared secret with enough bits if we choose proper n.

Also we can build a version of this system with none symmetric matrices, in this case, the central serve needs to compute more matrices like A_iS+e and A_i^tS+e′. Then it is possible, we can do the same kind of key distribution. This system again is less efficient.

On the other hand, since the RLWE problem can be viewed as a specialized commutative version of matrix-based LWE since an element in the ring can be view as a homomorphism on the ring. We can use the RLWE to build a key distribution in the same way.

Now let us look at why this key distribution is scalable. Clearly each user will have a pair A, and E_i=A_iS+te_i, and many users together can get many pairs, then to find the secret master key S is to solve the corresponding MLWE problem, except that, in this case, we impose the symmetric condition on the secret S. It is not difficult to argue again that this problem is as hard as a LWE problem, since given a LWE problem, we can convert it also into such a MLWE problem with symmetric secret matrix. Therefore, it is easy to see that this system is indeed scalable.

In terms of the provable security of the system, the situation is similar to the work done in the paper [DiLi]. We can give a provable security argument along the same line.

As we said before, since RLWE can be viewed as a special case MLWE, we will use the RLWE to build a very simple key distribution system.

We will choose the ring R_q to be F_q[x]/xⁿ+1. To ensure the provable security, we need to choose parameter properly n, q, properly, for example n=2^k, q=1 mod(2n)[LPR]. For provable secure systems, we assume that we will follow the conventional assumptions on these parameters, and the assumption on the error distribution like χ in [LPR].

This construction is essentially based on the systems of above. We assume that we have a ring R_q with a properly defined learning with error problem on the ring R_q with error distribution X. The problem is defined as follows:

We are given a pair (A, E), where
E=A×S+te′,
A, S where e′ are elements in R, t is small integer, e′ is an error element following the distribution of χ, S is a fixed element and A is select randomly following uniform distribution, and the problem is to find the secret S.

With a central server, we can build a simple key distribution system as follows.

• • (1) The central server will also select a random element M in R_q following uniform distribution.
  • (2) For each user, the central server will assign an public ID as A_i, where A_i should be in the form of a chosen small element in R_q, namely following an error distribution like χ.
  • (3) Each member is given a secret key by the central server:
    S_i=MA_S+te_e,
    • where e_i follows an error distribution χ.
  • (4) If two user i and j wants to build a shared key, one user, say i can use the ID matrix of j, namely A_i, the its secret key to build a shared key with j by computing
    K_i=A_j×S_i=A_jMA_i+tA_je_i,
    • and j can use its secret key to build a shared key with i by computing
      K_j=A_i×S_j=A_jMA_i+tA_ie_j,
    • then derive the shared key with the rounding technique as follows:
      • (a) i will then make a list of size n, and this list consists of pairs in the form of (a, b), where a=0, . . . , n−1, and b=1 if the x^a coefficient of K_i is in the range of [−(q−1)/4, (q−1)/4], otherwise b=0.
      • (b) i will send this list to j. Then each will compute the residue of the corresponding entries modular t in the following way:
        • for an element of the list (a, b),
        • 1) if b=1, each will compute the a-th entry of K_i and K_j modular t respectively;
        • 2) if b=0, each will add (q−1)/2 to the a-th entry of K_i and K_j modular q back to range of [−(q−1)/4, (q−1)/4], then compute the residues modular t.

Since A_i and e_i are small elements in R_q, we have A_i×e_i is also small. This ensures that we indeed have a shared secret key. This, therefore, gives an key-distribution system.

Here we use very much the fact that in a RLWE problem that the multiplication is commutative. The key feature of our construction is that it is simple and straight forward. The provable security of the system is also straightforward.

1.4 the Construction of the New IBE Systems Based on Paring with Errors

We will first build a new public key encryption based on MLWE. To build an encryption system, we choose similar parameter q≈n³ or n⁴ or similar polynomial functions of n, we choose again κ_n2 to be an error distribution, for example the error distribution with each component are independent, and each component follow the same discrete distribution κ_σ as in the case of LWE, namely a discrete normal distribution over F_q center around 0 with standard deviation approximately √{square root over (n)}. Surely we can also select high dimensional Gaussian distribution, which should be very convenient for the purpose to provable security. We select this simple distribution to simplify the argument concerning the validity of the encryption system. We can surely choose other parameters.

With such a setting, we can build an encryption system as in the case of the MLWE problem as follows:

• • (1) We select an n×n matrix S, whose entries are small following an error distribution κ_n2, for example, each entries independently and randomly follows the distribution κ_σ.
  • (2) In the setting of the MLWE, we will derive one output pair (A, E), where
    E=A×S+e,
    or
    E=A×S+te,
    • and t is small, t<<n, and they form the public key of our encryption system. Here e follow certain error distributions, for example the distribution we use above.
  • (3) S is the private key of the cryptosystem.
  • (4) A message in is represented as n×n matrix with binary entries of 0, 1 or n×n matrix with entries in the range modular t, namely 0, 1 . . . , t−1.
  • (5) A sender chooses a n×n small matrix B similar to S namely following an error distribution κ_n2, for example, each entries independently and randomly follows the distribution κ_σ. Then the sender compute the encrypted message as:
    (D₁,D₂)=(B×A+e₁,B×E+e₂+m (q/2)),
    or
    ((D₁,D₂)=(B×A+te₁,B×E+te₂+m,
    • where e₁ and e₂ are error matrices selected independently following some error distribution like e.
  • (6) To decrypt, the legitimate, in the first case, computes
    D₂−D₁×S=(BE+e₂+m(q/2)−(BA+e₁)S)=eE+e₂−e₁S+m(q/2),
    • where everything is done in F_q, and we can check on each entry of the matrix, if it is near 0, we output 0, and if it is near (q−1)/2, we output 1, or we divide them by (q−1)/2 performed as a real number division and round them to 0 or 1 and the output will be the plaintext m; or in the second case, the legitimate user computes
      D₂−D₁×S=(BE+te₂+m−(BA+te₁)S)=,teE+te₂−te₁S+m,
    • then modular t. This will be the plaintext m.

A, B, e_i can follow different error distributions.

With large n, the output can give us the right plaintext with as high probability as demanded. The reason we could decrypt with high probability comes from the following.
D₂−D₁×S=BE+e₂+m(q/2)−(BA+e)S=B×(A×S+e)+e₂+m(q/2)−(BA+e₁)×S=B×e+e₂−e₁×S+m(q/2)
B×e+e₂−e₁×S can be viewed as a error terms, which is determined by the distribution of the following random variable. With proper choice of parameters, like in the case of KE or KD systems, the decryption process will surely return the right answer when n is large enough. The same argument goes with the second case.

One key point of this new method is that on average, we can do the encryption much faster in terms of per bit speed because we can use fast matrix multiplication [CW] to speed up the computation process.

We note here that since matrix multiplication is not commutative, when we multiply two elements, the order is very important, unlike the case of the RLWE related systems.

We can also use the same idea in the ring LWE (RLWE)[LPR] to do encryption, where all the elements are in the ring R_q, and we have
E=A×S+te,
t is small positive integer and the entries of S is also small following error distribution κ_n2. We encrypt a message as
(D₁,D₂)=(BA+te₁,BE+te₂+m).
Then we decrypt by computing
(BE+te₂+m−B(AS+te₁))(mod t).
This works because
D₂−D₁×S=BE+te₂+m−(BA+t₁e₁)S=B×(A×S+te)+te₂+m−(BA+te₁)×S=tB×e+te₂−te₁×S+m
Since the error terms are small, by modular t, we certainly should get back the original plaintext.

For the MLWE problem, we surely need to choose the distribution accordingly when we need to obtain the provable security of the system.

There are several versions of identity-based encryption systems based on lattice related problems including the LWE problem [ABB], [ABVVW], [BKPW]. But they all look rather complicated. We can use the MLWE to build an identity-based encryption system.

With a central server, we can build a simple identity-based encryption system as follows.

• • (1) The central server will first select a secret n×n matrix S as the secret master key, where S is selected as a small element following certain error distribution κ_n2 like error distributions like in KE and KD systems.
  • (2) The central server will also select a random element M following uniform distribution or similar distribution, but make sure that M has an inverse. If we could not find one first time, we will try again till we find one. We have a high probability of success to find such a M when q is large. Then the central serve will compute
    M₁=MS+te,
    • where e is small following certain error distribution κ_n2.
  • (3) Then the central server will publicize M and M₁ as the master public key.
  • (4) For each user, the central server will assign an public ID as A_i, where A_i is small following certain error distribution κ_n2, and it can be generated from information that can identify the user.
  • (5) Each member is given a secret key:
    S_i=SA_i+tM⁻¹e_i,
    • where e_i's entries are small following the error distribution n. Surely this is the same as given
      MS_i=MSA_i+te_i,
    • since M is public.
  • (6) Anyone can use the ID, namely A_i, and the master public key to build a new public key for the user with ID A_i, which is given as the pair (A_i, B_i), where
    A_i=M
    and
    B_i=M₁A_i=MSA_i+teA_i,
    • and it is used as the public key to encrypt any message use the MLWE encryption system above.
      This gives an identity based encryption system.

S, A_i, e_i, e can also follow different error distributions.

Since A_i and e are small, we have A_i×e is also small. W also have that
MS_i−B_i=MS_i−B_i=M(SA_i+tM⁻¹e_i)−MSA_i+teA_i=MSA_i+tMM⁻¹e_i)−MSA_i+teA_i=te_i−teA_i,
Since e, A_i and e_i are small, e−A_ie_i is also small and te_i−tA_ie_i is also small. Therefore S_i is a solution to a MLWE problem with the pair (A_i, B_i) as the problem input. Therefore S_i is indeed a secret key that could be used for decryption. Therefore the construction works. We need to choose parameters properly to ensure security.

The key feature of our construction is that it is simple and straight forward. The provable security of the system is also straightforward.

we can extend this construction using the RLWE problem. We will choose the ring R to be F_q[x]/xⁿ+1. To ensure the provable security, we need to choose parameter properly n, q, properly, namely n=2^k, q=1 mod(2n)[LPR]. But we can select other parameters for secure applications.

This construction is directly based on the encryption systems of the RLWE[LPR], namely, we assume that we have a ring R with a properly defined learning with error problem on the ring R. The problem is defined as follows: we are given a pair (A, E), where
E=A×S+te′,
A, S where e′ are elements in R_q, t is small integer, e′ is an error element following an error distribution X, S is a fixed element and A is select randomly following uniform distribution, and the problem is to find the secret S. We also know that one can build a public key encryption systems using the RLWE problem[LPR], where A, and E serve as the public key, and the secret S, which needs to be small, serves as the private key. We can use the fact that in a ring-LWE problem that the multiplication is commutative.

With a central server, we can build a simple identity-based encryption system as follows.

• • (1) The central server will first select a secret S in R as the secret master key, where S is a selected small element follow certain error distributions χ.
  • (2) The central server will also select a random element M in R following uniform distribution and make sure that M has an inverse. If we could not find one first time, we will try again till we find one. We have a high probability of success to find such a M when q is large. Then the central serve will computer
    M₁−MS−te,
    • where e is small and follows error distribution χ.
  • (3) Then the central server will publicize M and M₁ as the master public key.
  • (4) For each user, the central server will assign an public ID as A_i, where A, is a small element in R_q, and it follows error distribution χ.
  • (5) Each member is given a secret key:
    S_i=SA_i+tM⁻¹e_i,
    • where e_i small element in R, and it follow certain error distribution X. Surely this is the same as given
      MS_i=MSA_i+te_i,
    • since M is public.
  • (6) Anyone can use the ID, namely A_i, and the master public key to build a new public key for the user with ID A_i, which is given as the pair (A_i, B_i), where
    A_i=M
    and
    B_i=A_iM₁=A_iMS+tA_ie=MSA_i+tA_ie,
    • and it is used as the public key to encrypt any message.
      This gives an identity based encryption system.

The small elements like S, A_i, e, e_i can follow different error distributions.

Since A_i and e are small elements in R, we have A_i×e is also small. We have that
S_iA_i−B_i=S_iM−B_i=M(SA_i+iM⁻¹e_i)−MSA_i+A_ite=MSA_i+tMM⁻¹e_i)−MSA_i+A_ite==te−tA_ie_i,
which is due to the fact that this is a commutative ring. Since e, A_i and e_i are small, e−A_ie_i is also small and te−tA_ie_i is also small. Therefore S_i is a solution to a ring LWE problem with the pair (A_i, B_i) as the problem input. Therefore S_i is indeed a secret key that could be used for decryption.

We can build easily a hierarchical IBE system using similar procedure, where each user can server as a central server.

The key feature of our construction is that it is simple, straight forward and efficient. The provable security of the system is also straightforward.

In the all the systems above using pairing with errors over the ring, one may use polynomials in the form of
f(x)=Πf_i(x)+g(x),
where each f_i, g(x) is a extremely sparse matrix with very few terms, for example, 2 or 3 terms none-zero. Using this kind of polynomial can speed up the encryption and decryption computations.

Claims

1. Method for establishing a shared key exchange over an open communication channel between a first party party A and a second party party b, comprising:

(1) openly selecting, by the party A and the party b together, parameters, n, q and small whole number t, (t<<n), where q is an odd prime, and an error distribution κ_n2 to be a distribution over n×n matrix over F_q, a n×n matrix M over F_q uniformly and randomly, where q is of size of a polynomial of n like n³, and elements of F_q are represented by integers in the range [−(q−1)/2, (q−1)/2)]; [−(q−1)/2, (q−1)/2];

(2) choosing, by each of the parties privately, its own secret matrix S_i (i=A, b) a n×n matrix chosen according to the error distribution κ_n2, and error matrix e_i, (i=A, b) as a n×n matrix following the error distribution κ_n2;

computing by a processor of the party A

M_A=MS_A+te_A,

2. The method according to claim 1, wherein q is a polynomial function of degree 2 or higher, or a similar function, and κ_n2 is the a distribution that each component are independent and each component follow certain error distribution like the a discrete error distribution κ_σ, namely a discrete normal distribution over F_q center around 0 with standard deviation approximately √{square root over (n)}, or a similar distribution.

3. The method according to claim 1, wherein the matrices is rectangular as long as the matrix multiplication is compatible and the parameters are adjusted accordingly.

4. The method according to claim 1, wherein the matrices are replaced with elements of the a ring R_q=F_q[x]/f(x) with f(x)=xⁿ+1 and the parameters is adjusted accordingly.

5. The method according to claim 1, wherein the rounding technique is replaced with a similar technique.

6. The method according to claim 1, wherein the matrices are replaced with elements of the a ring R_q=F_q[x]/f(x) with f(x)=x_n+1, the parameters is adjusted accordingly, and the polynomial elements used are selected in the form of f(x)=Πf_i(x)+g(x), where each f_i, g(x) is a sparse matrix with very few terms terms none-zero non-zero.

7. Method, for a central server, building a key distribution (KD) system, comprising:

(1) selecting, by the central server, parameters select parameters, n, q and small whole number t, (t<<n), where q is an odd prime, q is of size of a polynomial of n like n³ and elements of F_q are represented by integers in the range [−(q−1)/2, (q−1)/2)], [−(q−1)/2, (q−1)/2], an error distribution κ_n2 a distribution over n×n matrix over F_q; and selecting by the central server a symmetric randomly chosen n×n matrix S over F_q as a master key;

(2) giving, by the central server, to each user index as i, a general matrix A_i as an id with small entries following error distribution κ_n2, where the id matrix of each user is public and the central server have also has a choice to generate the id with information that can identify the user;

(3) distributing, by the central server, for each user securely a secret matrix:

E_i=A_iS+te_i,

8. The method according to claim 7, wherein q is a polynomial function of degree 2 or higher, or a similar function, and κ_n2 is the a distribution that each component are independent and each component follow certain error distribution like the a discrete error distribution κ_σ, namely a discrete normal distribution over F_q center around 0 with standard deviation approximately √{square root over (n)}or a similar distribution.

9. The method according to claim 7, wherein the matrices are replaced with elements of the a ring R_q=F_q[x]/f(x) with f(x)=xⁿ+1 and the parameters is adjusted accordingly.

10. The method according to claim 7, wherein the procedure for two users i and j to derive a shared key is modified such that the roles of user i and user j and are exchanged.

11. The method according to claim 7, wherein several central servers to work together to build a distributed KD system.

12. The method according to claim 7, wherein the matrices are replaced with elements of the a ring R_q=F_q[x]/f(x) with f(x)=x_n+1, the parameters is adjusted accordingly, and the polynomial elements used are selected in the form of f(x)=Πf_i(x)+g(x), where each f_i, g(x) is a sparse matrix with very few terms terms none-zero non-zero.

13. Method, for a central server, building an identity-based encryption system, comprising:

(1) selecting, by the central server, parameters, n, q and small whole number t, (t<<n), where q is an odd prime, q is of size of a polynomial of n like n³ and elements of F_q are represented by integers in the range [−(q−1)/2, (q−1)/2)], [−(q−1)/2, (q−1)/2], and an error distribution κ_n2 to be a distribution over n×n matrix over F_q; and selecting by the central server a secret n×n matrix S as the a secret master key, where S is selected as a small element following certain error distribution κ_n2;

(2) selecting, by the central server, a random element M following uniform distribution, but making sure that M has an inverse: when the central server could not find one first time, it tries again till it finds one; then computing by the central server

M₁=MS+te,

where e is small following certain error distribution κ_n2;

(3) then publicizing, by the central server, M and M₁ as the a master public key;

(4) assigning, by the central server, for each user indexed by i an and public id as A_i, where A_i is small following certain error distribution κ_n2, and the central server has can generate A_i from information that can identify the user user i;

(5) processing by a processor and giving by the central server for each user, namely, the user i, a secret key:

S_i=SA_i+tM⁻¹e_i,

where e_i's entries are small following the error distribution κ;

(6) then establishing by anyone, using the public id, A_i, and the master public key, a new public key for the user with public id A_i, which is given as the pair (A_i, b_i), where

A_i=M

and

b_i=M₁A_i=MSA_i+teA_i,

and using by anyone as the new public key to encrypt any message use the a matrix learning with errors (MLWE) encryption system.

14. The method according to claim 13, wherein q is a polynomial function of degree 2 or higher, or a similar function, and κ_n2 is the a distribution that each component are independent and each component follow certain error distribution like the a discrete error distribution κ_σ, namely a discrete normal distribution over F_q center around 0 with standard deviation approximately √{square root over (n)}or a similar distribution.

15. The method according to claim 7, wherein the matrices is rectangular as long as the matrix multiplication is compatible and the parameters are adjusted accordingly.

16. The method according to claim 13, wherein the matrices are replaced with elements of the a ring R_q=F_q[x]/f(x) with f(x)=xⁿ+1 and the parameters is adjusted accordingly.

17. The method according to claim 13, wherein several central servers to work together to build a distributed identity-based encryption (IBE) system.

18. The method according to claim 13, wherein the procedure method is extended further to build a hierarchical IBE system, where each user servers serves as a lower level central server.

19. The method according to claim 13, wherein the matrices are replaced with elements of the a ring R_q=F_q[x]/f(x) with f(x)=x_n+1, the parameters is adjusted accordingly, and the polynomial elements used are selected in the form of f(x)=Πf_i(x)+g(x), where each f_i, g(x) is a sparse matrix with very few terms terms none-zero non-zero.