TFHE is a fully homomorphic encryption scheme over the torus that supports fast bootstrapping. Its primary evaluation mechanism is based on gate bootstrapping and programmable bootstrapping (PBS), which computes functions while simultaneously refreshing noise. PBS-based evaluation is user-friendly and efficient for small circuits; however, the number of bootstrapping operations increases exponentially with the circuit depth. To address the challenge of efficiently evaluating large-scale circuits, Chillotti et al. introduced a leveled homomorphic evaluation (LHE) mode at Asiacrypt 2017. This mode decouples circuit evaluation from bootstrapping, resulting in a speedup of hundreds of times over PBS-based methods. However, the remaining circuit bootstrapping (CBS) becomes a performance bottleneck, even though its frequency is linear with the circuit depth.

Abstract The Blum-Kalai-Wasserman (BKW) algorithm is a significant combinatorial algorithm used to tackle the Learning with Errors (LWE) and Learning with Rounding (LWR) problems. In 2015, Duc et al. (in: Oswald and Fischlin (eds) EUROCRYPT 2015, Springer, Berlin, 2015) proposed the first BKW algorithm applied directly to LWR, which consists of the reduction phase and the solving phase. In this paper, we propose an improved LWR-solving BKW algorithm. For the reduction phase, we design a novel coding method with relaxed collision conditions and introduce a post-processing stage and for the solving phase, we switch to a more efficient Fast Fourier Transform (FFT) distinguisher with pruning. Compared to previous LWR-solving BKW algorithms, our new BKW algorithm achieves a time complexity improvement of 4.0–48.5 bits for the instances considered. Additionally, by incorporating a novel heuristic method in the reduction phase, our algorithm further improves the sample complexity by 3.7–48.7 bits.

Abstract We present eBiBa (enhanced BiBa), a hash-based signature scheme with the smallest possible signature size, while ensuring high feasibility and security in a specific application model. Our scheme is tailored to address the communication requirement of a large-scale public data stream continuously disseminated between two participants while ensuring data source and data integrity authentication. To achieve these goals, firstly, we optimized the classical hash tree mode into a hybrid mode to efficiently perform public key authentication and eliminate the need for an authenticated channel to transmit large amounts of data, unlike the initial BiBa-based broadcast authentication protocol. Secondly, we employed a specific tweakable hash chain function to digest a batch of messages, reducing the required conditions for post-quantum existential unforgeability under adaptive chosen message attack (EUCMA) of eBiBa to a second-pre-image-resistance-like property instead of collision resistance. This results in reduced pre-computation in both key and signature generations. Thirdly, we utilized a forward-secure pseudorandom function to achieve forward-secure of the proposed scheme. Finally, we minimize the signature size through a series of procedures. Firstly, we select BiBa few-time signature as the underlying signature scheme since it is currently the few-time hash-based signature with the smallest signature size that we are aware of; in addition, the hybrid approach we employed can also significantly reduce the signature size compared to using a hash tree solely; for the hash tree structure, we design a specific authentication path in combination with the related communication model to further minimize the signature size; finally, we optimize the authentication approach to achieve the minimum signature size in a single transmission. Our construction minimizes the signature size in the aforementioned model, achieving a compression rate of 0.017 to 0.828 based on distinct values of parameters, as compared to XMSS-256. We also demonstrated that eBiBa can achieve post-quantum forward-secure and EUCMA security.

Abstract Stealth address protocol (SAP) is widely used in blockchain to achieve anonymity. In this paper, we formalize a key derivable signature scheme (KDS) to capture the functionality and security requirements of SAP. We then propose a framework to construct key separation KDS, which follows the key separation principle as all existing SAP solutions to avoid the reuse of the master keys in the derivation and signature component. We also study the joint security in KDS and construct a key reusing KDS framework, which implies the first compact stealth address protocol using a single key pair. Finally, we provide instantiations based on the elliptic curve (widely used in cryptocurrencies) and on the lattice (with quantum resistance), respectively.

Abstract The Learning With Errors (LWE) problem is widely used in lattice-based cryptography, which is the most promising post-quantum cryptography direction. There are a variety of LWE-solving methods, which can be classified into four groups: lattice methods, algebraic methods, combinatorial methods, and exhaustive searching. The Blum–Kalai–Wasserman (BKW) algorithm is an important variety of combinatorial algorithms, which was first presented for solving the Learning Parity With Noise (LPN) problem and then extended to solve LWE. In this paper, we give an overview of BKW algorithms for solving LWE. We introduce the framework and key techniques of BKW algorithms and make comparisons between different BKW algorithms and also with lattice methods by estimating concrete security of specific LWE instances. We also briefly discuss the current problems and potential future directions of BKW algorithms.

Many fast variants of RSA are designed to speed up encryption and decryption. Prime power RSA (PP-RSA) is one of the most important variants. It is widely used in electronic money trading systems and high-speed programs. At present, the security of PP-RSA with moduli N = prqshas not been fully studied. In this paper, we give three powerful attacks based on Coppersmith’s method, applying to the cases when the most significant bits or the least significant bits of the private key are known. Our attacks work in polynomial time. This is the first work on partial key exposure attacks of PP-RSA with moduli N = prqs.

Abstract In this paper, we study the hybrid dual attack over learning with errors (LWE) problems for any secret distribution. Prior to our work, hybrid attacks are only considered for sparse and/or small secrets. A new and interesting result from our analysis shows that for most cryptographic use cases a hybrid dual attack outperforms a standalone dual attack, regardless of the secret distribution. We formulate our results into a framework of predicting the performance of the hybrid dual attacks. We also present a few tricks that further improve our attack. To illustrate the effectiveness of our result, we re-evaluate the security of all LWE related proposals in round 3 of NIST’s post-quantum cryptography process, and improve the state-of-the-art cryptanalysis results by 2-15 bits, under the BKZ-core-SVP model.

Abstract The current development toward quantum attack has shocked our confidence on classical digital signature schemes. As one of the mainstreams of post quantum cryptography primitives, hash-based signature has attracted more and more concern in both cryptographic research and application in recent years. The goal of this paper is to present, classify and discuss different solutions for hash-based signature. Firstly, this paper discusses the research progress in the component of hash-based signature, i.e., one-time signature and few-time signature; then classifies the tree-based public key authentication schemes of hash-based signature into limited number and stateful schemes, unlimited number and stateful schemes and unlimited number and stateless schemes. The above discussion aims to analyze the overall design idea of different categories of hash-based signatures, as well as the construction, security reduction and performance efficiency of specific schemes. Finally, the perspectives and possible development directions of hash-based signature are briefly discussed.

We present a secure backpropagation neural network training model (SecureBP), which allows a neural network to be trained while retaining the confidentiality of the training data, based on the homomorphic encryption scheme. We make two contributions. The first one is to introduce a method to find a more accurate and numerically stable polynomial approximation of functions in a certain interval. The second one is to find a strategy of refreshing ciphertext during training, which keeps the order of magnitude of noise at O˜e33 .

Almost all existing well‐known fully homomorphic encryption (FHE) schemes, which are based on either the learning with errors (LWE) or the ring LWE problem, require expensive Gaussian noise sampling. In this study, the authors propose an FHE scheme based on the ring learning with rounding (RLWR) problem. The learning with rounding (LWR) problem was proposed as a deterministic variant of LWE, while the RLWR is a variant of LWR. Sampling an LWR instance does not require Gaussian noise sampling process, and neither does an RLWR instance. Thus, our FHE scheme can be instantiated without the need for Gaussian noise sampling. To implement homomorphic operations, we devise a specific relinearisation method. Furthermore, we also prove that our RLWR‐based FHE scheme is IND‐CPA secure under RLWR assumption.

Very recently, Costache and Smart proposed a fully homomorphic encryption (FHE) scheme based on the Learning with Rounding (LWR) problem, which removes the noise (typically, Gaussian noise) sampling needed in the previous lattices-based FHEs. But their scheme did not work, since the noise of homomorphic multiplication is complicated and large, which leads to failure of decryption. More specifically, they chose LWR instances as a public key and the private key therein as a secret key and then used the tensor product to implement homomorphic multiplication, which resulted in a tangly modulus problem. Recall that there are two moduli in the LWR instances, and then the moduli will tangle together due to the tensor product. Inspired by their work, we built the first workable LWR-based FHE scheme eliminating the tangly modulus problem by cleverly adopting the celebrated approximate eigenvector method proposed by Gentry et al. at Crypto 2013. Roughly speaking, we use a specific matrix multiplication to perform the homomorphic multiplication, hence no tangly modulus problem. Furthermore, we also extend the LWR-based FHE scheme to the multikey setting using the tricks used to construct LWE-based multikey FHE by Mukherjee and Wichs at Eurocrypt 2016. Our LWR-based multikey FHE construction provides an alternative to the existing multikey FHEs and can also be applied to multiparty computation with higher efficiency.