Cryptographic Multilinear Maps Craig Gentry and Shai Halevi

Cryptographic Multilinear Maps Craig Gentry and Shai Halevi China Summer School on Lattices and Cryptography, June 2014

Multilinear Maps (MMAPs) A Technical Tool A primitive for building applications, but not an application in itself More a technique than a single primitive Several different variants, all share the same core properties but differ in details Extension of bilinear maps [J 00, SOK 00, BF 01] Bilinear maps are extensions of DL-based crypto

Starting Point: DL-based Crypto

Starting Point: DL-based Crypto To use DH, design applications where: legitimate parties only compute linear functions adversary needs to compute/check quadratics Some examples: DH key-exchange, El. Gamal Encryption, Cramer-Shoup CCA-Secure Encryption, Naor-Reingold PRF, Efficient ZKPs, …

Beyond DDH: Bilinear Maps In bilinear-map groups you can compute quadratic functions in the exponent But computing/checking cubics is hard Now the legitimate parties can do a lot more Leads to new capabilities Identity-based encryption (IBE) Predicate encryption (for simple predicates) Efficient non-interactive zero-knowledge proofs …

Why Stop at Two?

The [GGH’ 13] Approach

MMAPs vs. SWHE MMAPs SWHE

Main Ingredient: Testing for Zero

Goal: Graded Encoding Schemes

Graded Encoding Schemes

Bird-Eye View of [GGH’ 13]

Starting From NTRU Encryption

Obscuring the Plaintext Space

Encoding and Homomorphism

Zero-Test Parameter

Zero-Test Parameter

Zero-Test Parameter

Zero-Test Parameter (2)

Correctness of Zero-Testing

Correctness of Zero-Testing (2)

Correctness of Zero-Testing (3)

Zero-Testing Invalid Encodings

Extracting Unique Representation

Hardness Assumptions

“Weak-DL Attacks” in [GGH’ 13]

Dealing with “Weak DL” Attacks

A Few Words About Performance

Some Variants

More Variants

Summary

Backup Slides

Weak DL attack (1)

Weak DL attack (2)

Weak DL attack (3)

Weak DL attack (4)