Multilinear Maps over the Integers: From Design to Security1cm

Multilinear Maps over the IntegersFrom Design to SecurityTancrède Lepoint CryptoExperts

The Mathematics of Modern Cryptography Workshop, July 10th 2015

Timeline: The Hype Cycle of Multilinear Maps

first candidate construction [GGH13]second candidate construction [CLT13]

weak DL [GGH13]break of CLT [CHLRS15]tentatives fixes for CLT [BWZ14,GGHZ14]break of previous fixes and extensions [CGHLMMRST15]break of (G)DDH in GGH [HJ15]

time

visibility

2 / 30

Timeline



time

visibility

2 / 30

Timeline

1 “technology trigger”



time

visibility

2 / 30

Timeline



time

visibility

2 / 30

Timeline


2 “peak of inflated expectations”


time

visibility

2 / 30

Timeline


iO


time

visibility

2 / 30

Timeline


3 “trough of disillusionment”


time

visibility

2 / 30

Timeline


weak DL [GGH13]break of CLT [CHLRS15]tentatives fixes for CLT [BWZ14,GGHZ14]break of previous fixes and extensions [CGHLMMRST15]break of (G)DDH in GGH [HJ15] time

visibility

2 / 30

Today

Graph induced [GGH15]New multilinear maps over integers [CLT15]

time

visibility

3 / 30

Today

4“slope of enlightenment”


time

visibility

3 / 30

Today


time

visibility

3 / 30

The CLT SchemeMultilinear maps over the integers [CoronL.Tibouchi’13’15]

Second candidate constructionComposite-order maps (different from [GGH13,GGH15])Follow [GGH13] recipeI Level by multiplicative maskI Zero-testing by multiplication and “shortness”

Similar to FHE schemes based on Approximate-GCD

Useful formany applications...

4 / 30


Second candidate construction

Composite-order maps (different from [GGH13,GGH15])Follow [GGH13] recipeI Level by multiplicative maskI Zero-testing by multiplication and “shortness”



4 / 30


Second candidate constructionComposite-order maps (different from [GGH13,GGH15])

Follow [GGH13] recipeI Level by multiplicative maskI Zero-testing by multiplication and “shortness”



4 / 30





4 / 30





4 / 30




Useful formany applications...4 / 30

SWHE vs. MMAPsComputation over encrypted dataWe want to compute homomorphically over encrypted data

encode a into [a] ←→ encrypt a into [a] = Enc(a)in both cases, computing low-degree polys of [ai ]’s is possible, up to a degree k

. . . but we do not want the same information from the result than with HE

MMAPS can test if it is zero, at level k (andhard to compute at degree > k )

5 / 30

SWHE vs. MMAPsComputation over encrypted dataWe want to compute homomorphically over encrypted dataencode a into [a] ←→ encrypt a into [a] = Enc(a)

in both cases, computing low-degree polys of [ai ]’s is possible, up to a degree k



5 / 30

SWHE vs. MMAPsComputation over encrypted dataWe want to compute homomorphically over encrypted dataencode a into [a] ←→ encrypt a into [a] = Enc(a)in both cases, computing low-degree polys of [ai ]’s is possible, up to a degree k



5 / 30


. . . but we do not want the same information from the result than with HEMMAPS can test if it is zero, at level k (andhard to compute at degree > k )

5 / 30


. . . but we do not want the same information from the result than with HEMMAPS can test if it is zero, at level k (andhard to compute at degree > k )SHWE no information on a from the result,except with secret key

5 / 30

Starting from Homomorphic EncryptionSWHE over the integers [DGHV10,CMNT11,CNT12,CCKLLMTY13,CLT14]

Secret keyPublic key for very large (hard to factor) q0

Ciphertext of

for q ← [0, q0) and ← χ “small”+

××

6 / 30


Secret key prime p

Public key for very large (hard to factor) q0

Ciphertext of


××

6 / 30


Secret key prime p

Public key x0 = q0 · p for very large (hard to factor) q0

Ciphertext of


××

6 / 30


Secret key prime p


Ciphertext of m c = q · p + g · r + mfor q ← [0, q0) and r ← χ “small”

+

××

6 / 30


Secret key prime p


Ciphertext of m c = CRTq0,p( q′ , g · r + m )for q′ ← [0, q0) and r ← χ “small”

+

××

6 / 30


Secret key primes p1, . . . , pn

Public key x0 = q0 · p1 · · · pn for very large (hard to factor) q0

Ciphertext of ~m c = CRTq0,p1,...,pn( q′ , g1 · r1 + m1, . . . , gn · rn + mn )for q′ ← [0, q0) and r1, . . . , rn ← χ “small”

+

××

6 / 30


Secret key primes p1, . . . , pn

Public key x0 = q0 · p1 · · · pn for very large (hard to factor) q0

Ciphertext of ~m c = CRTq0,p1,...,pn( q′ , g1 · r1 + m1, . . . , gn · rn + mn )for q′ ← [0, q0) and r1, . . . , rn ← χ “small”+

××

6 / 30

Adding Sharp LevelsUsing multiplicative mask [GGH13,CLT13]

Let z ← [0, x0) be a random (invertible) multiplicative maskEncoding of ~m ∈ Zg1 × · · · × Zgn at level j :

[~m]j = c/z j mod x0 =CRTq,p1,...,pn(q′, r1 · g1 + m1, . . . , rn · gn + mn)

z j mod x0

Operations over Zx0 :Addition [~m]j + [~m′]j ' [~m + ~m′]jMultiplication [~m]j1 × [~m′]j2 ' [~m · ~m′]j1+j2

7 / 30


Let z ← [0, x0) be a random (invertible) multiplicative mask

Encoding of ~m ∈ Zg1 × · · · × Zgn at level j :[~m]j = c/z j mod x0 =

CRTq,p1,...,pn(q′, r1 · g1 + m1, . . . , rn · gn + mn)

z j mod x0


7 / 30




z j mod x0


7 / 30




z j mod x0


7 / 30

Main Ingredient: Testing for ZeroUsing the “shortness” of the noise [GGH13,CLT13]

How to test whether two degree-k encodings are equal?[~m]k ' [~]k (i.e. ~m = ~) ⇐⇒ [~m − ~]k ' [~0]k

What is an encoding of ~m = ~0?[~0]k =

CRTq,p1,...,pn(q′, r1 · g1, . . . , rn · gn)

zk mod x0

Idea of [GGH13]: multiply by an element which will cancel zk and when the ri ’sare small (rigi � pi ), yield something small compared to x0.

8 / 30

Main Ingredient: Testing for ZeroUsing the “shortness” of the noise [GGH13,CLT13]How to test whether two degree-k encodings are equal?

[~m]k ' [~]k (i.e. ~m = ~) ⇐⇒ [~m − ~]k ' [~0]k


CRTq,p1,...,pn(q′, r1 · g1, . . . , rn · gn)

zk mod x0


8 / 30


[~m]k ' [~]k (i.e. ~m = ~) ⇐⇒ [~m − ~]k ' [~0]k


CRTq,p1,...,pn(q′, r1 · g1, . . . , rn · gn)

zk mod x0


8 / 30


[~m]k ' [~]k (i.e. ~m = ~) ⇐⇒ [~m − ~]k ' [~0]k


CRTq,p1,...,pn(q′, r1 · g1, . . . , rn · gn)

zk mod x0

Idea of [GGH13]: multiply by an element which will cancel zk and when the ri ’sare small (rigi � pi ), yield something small compared to x0.8 / 30

Simplifications for Zero-Testing

[~0]k =∑

i

gi ri · (p∗i−1/zk mod pi) · p∗i + (

∏pj) · q′′ mod x0

where p∗i =∏

j 6=i pj

The random value q′′ makes difficult to obtain something small... except if weare working modulo∏ pj

In the following x0 =∏

pj , and[~m]j = c/z j mod x0 =

CRTp1,...,pn(r1 · g1 + m1, . . . , rn · gn + mn)

z j mod x0

9 / 30

Simplifications for Zero-Testing[~0]k =

∑i



where p∗i =∏

j 6=i pj





z j mod x0

9 / 30


∑i



where p∗i =∏

j 6=i pj





z j mod x0

9 / 30


∑i



where p∗i =∏

j 6=i pj





z j mod x0

9 / 30

Zero-Testing ProcedureMultiply by the public element (where hi � pi )

pzt =∑

i

hi · (g−1i zk mod pi) · p∗i mod x0

[~m]k = c/zk mod x0 =CRTp1,...,pn(r1 · g1 + m1, . . . , rn · gn + mn)

zk mod x0

therefore[~m]k · pzt =

∑i

(ri + mig−1i ) · hi · p∗i mod x0

We have (we prove equivalence whp when many pzt ’s are given)~m = ~0 ⇒ |[~m]k · pzt mod x0| � x0

10 / 30


pzt =∑

i



zk mod x0


∑i



10 / 30


pzt =∑

i



zk mod x0


∑i



10 / 30

Hardness Assumptions

GDDH: Given (k + 1) elements [ ~mi ]1 and [ ~m′]k , determinewhether ~m′ '∏k+1i=1 ~mi .

At the heart of the multipartite key echange protocolAssumed to be hard (no reduction to Approx.-GCD)Asymptotic parameters obtained from numerous attacksorthogonal lattice attack on encodingsGCD attack on zero-testinghidden subset sum attack on zero-testingattacks on the inverse zero-testing matrixbrute-force on the noises, . . .

11 / 30

Hardness AssumptionsGDDH: Given (k + 1) elements [ ~mi ]1 and [ ~m′]k , determinewhether ~m′ '∏k+1

i=1 ~mi .

At the heart of the multipartite key echange protocolAssumed to be hard (no reduction to Approx.-GCD)Asymptotic parameters obtained from numerous attacksorthogonal lattice attack on encodingsGCD attack on zero-testinghidden subset sum attack on zero-testingattacks on the inverse zero-testing matrixbrute-force on the noises, . . .

11 / 30


i=1 ~mi .At the heart of the multipartite key echange protocol

Assumed to be hard (no reduction to Approx.-GCD)Asymptotic parameters obtained from numerous attacksorthogonal lattice attack on encodingsGCD attack on zero-testinghidden subset sum attack on zero-testingattacks on the inverse zero-testing matrixbrute-force on the noises, . . .

11 / 30


i=1 ~mi .At the heart of the multipartite key echange protocolAssumed to be hard (no reduction to Approx.-GCD)

Asymptotic parameters obtained from numerous attacksorthogonal lattice attack on encodingsGCD attack on zero-testinghidden subset sum attack on zero-testingattacks on the inverse zero-testing matrixbrute-force on the noises, . . .

11 / 30


i=1 ~mi .At the heart of the multipartite key echange protocolAssumed to be hard (no reduction to Approx.-GCD)Asymptotic parameters obtained from numerous attacksorthogonal lattice attack on encodingsGCD attack on zero-testinghidden subset sum attack on zero-testingattacks on the inverse zero-testing matrixbrute-force on the noises, . . .

11 / 30

But... Zeroizing AttackEurocrypt 2015 best paper [CHLRS15]

12 / 30

The Zeroizing Attack on CLT13Exploiting the (bi)linearity of the zero-testingprocedure

[~0]k · pzt =∑

i ri · (hi · p∗i ) ∈ Z[~0]k−2 · [~b]1 · [~c ]1 · pzt =∑

i ri · bi · ci · (hi · p∗i ) ∈ Z

ri

bi · (hi · p∗i )ciri

bi · (hi · p∗i )ci

13 / 30

The Zeroizing Attack on CLT13Exploiting the (bi)linearity of the zero-testingprocedure[~0]k · pzt =

∑i ri · (hi · p∗i ) ∈ Z

[~0]k−2 · [~b]1 · [~c ]1 · pzt =∑

i ri · bi · ci · (hi · p∗i ) ∈ Z

ri



13 / 30


[~0]k · pzt =∑

i ri · (hi · p∗i ) ∈ Z

[~0]k−2 · [~b]1 · [~c ]1 · pzt =∑

i ri · bi · ci · (hi · p∗i ) ∈ Z

ri



13 / 30


[~0]k · pzt =∑

i ri · (hi · p∗i ) ∈ Z

[~0]k−2 · [~b]1 · [~c ]1 · pzt =∑

i ri · bi · ci · (hi · p∗i ) ∈ Z

ri


ribi · (hi · p∗i )

ci

13 / 30


[~0]k · pzt =∑

i ri · (hi · p∗i ) ∈ Z

[~0]k−2 · [~b]1 · [~c ]1 · pzt =∑

i ri · bi · ci · (hi · p∗i ) ∈ Z

ri



ci

13 / 30

The Zeroizing Attack on CLT13Inversion over QLet’s do it with many [~0]k−2, [~c ]1 and two targets [~b]1, [~b′]1


ci ×

=

ribi/b′i

(ri)−1

14 / 30



ci

×

rib′i · (hi · p∗i )

ci

=

ribi/b′i

(ri)−1

14 / 30



ci

×

(ci)−1 1

b′i · (hi · p∗i )(r−1

i )

=

ribi/b′i

(ri)−1

14 / 30



ci × (ci)−1 1

b′i · (hi · p∗i )(r−1

i )

=

ribi/b′i

(ri)−1

14 / 30

The Zeroizing Attack on CLT13Computing eigenvaluesConsider the target encodings

[~b]1 = CRTpi (bi)/z , [~b′]1 = CRTpi (b′i)/z

ribi/b′i

(ri)−1

Compute the eigenvalues βi/β′i = bi/b′iWe have that

pi | (β′i · [~b]1 − βi · [~b′]1)

Computepi = gcd(β′i · [~b]1 − βi · [~b′]1, x0)

15 / 30



ribi/b′i

(ri)−1

Compute the eigenvalues βi/β′i = bi/b′i

We have thatpi | (β′i · [~b]1 − βi · [~b′]1)


15 / 30



ribi/b′i

(ri)−1


pi | (β′i · [~b]1 − βi · [~b′]1)


15 / 30



ribi/b′i

(ri)−1


pi | (β′i · [~b]1 − βi · [~b′]1)


15 / 30

Generalizing the Zeroizing Attack on CLT13Zeroizing without low-level zeroes [CGHLMMRST15]

Breaks early tentative fixes [BWZ14,GGHZ14] using zero-testing as a black-boxDon’t need [~0]k−2 · [~b]1 · [~c ]1 but [~a]k−2 · [~b]1 · [~c ]1 ' [~0]k

Can be diagonal per block. Instead of computing eigenvalues usecharacteristic polynomial.


ci

16 / 30

Generalizing the Zeroizing Attack on CLT13Zeroizing without low-level zeroes [CGHLMMRST15]Breaks early tentative fixes [BWZ14,GGHZ14] using zero-testing as a black-box

Don’t need [~0]k−2 · [~b]1 · [~c ]1 but [~a]k−2 · [~b]1 · [~c ]1 ' [~0]k



ci

16 / 30

Generalizing the Zeroizing Attack on CLT13Zeroizing without low-level zeroes [CGHLMMRST15]Breaks early tentative fixes [BWZ14,GGHZ14] using zero-testing as a black-boxDon’t need [~0]k−2 · [~b]1 · [~c ]1 but [~a]k−2 · [~b]1 · [~c ]1 ' [~0]k



ci

16 / 30

Generalizing the Zeroizing Attack on CLT13Zeroizing without low-level zeroes [CGHLMMRST15]Breaks early tentative fixes [BWZ14,GGHZ14] using zero-testing as a black-boxDon’t need [~0]k−2 · [~b]1 · [~c ]1 but [~a]k−2 · [~b]1 · [~c ]1 ' [~0]k



ci

16 / 30

Thwarting Cheon et al. Attack?Can we remove this linearity? [CLT15]

The encodings look like DGHV ciphertextsEven without the randomness q, their form should not be an issue

In [CoronL.Tibouchi15], we revisit the zero-testing procedure itselfIn a nutshell:I the zero-testing is done modulo a new prime modulus N ;I x0 is no longer public.

17 / 30


The encodings look like DGHV ciphertexts

Even without the randomness q, their form should not be an issue


17 / 30




17 / 30



In [CoronL.Tibouchi15], we revisit the zero-testing procedure itself

In a nutshell:I the zero-testing is done modulo a new prime modulus N ;I x0 is no longer public.

17 / 30




17 / 30

Inherent randomness in current encodings

Current form of encodings[~m]k = CRTpi (mi + gi ri)/zk mod x0

[~m]k =∑

i

(mig−1i + ri mod pi) · ui + a · x0 over Z

with ui = (gip∗i−1z−k mod pi)p∗i .

The element a is highly non-linear in the ri ’sThe element a is different from the random q′ we had before when adaptingDGHV (~m = ~0↔ a is small)

18 / 30

Inherent randomness in current encodingsCurrent form of encodings

[~m]k = CRTpi (mi + gi ri)/zk mod x0

[~m]k =∑

i




18 / 30



[~m]k =∑

i




18 / 30



[~m]k =∑

i



The element a is highly non-linear in the ri ’sThe element a is different from the random q′ we had before when adaptingDGHV (~m = ~0↔ a is small)18 / 30

New Zero-Test ParameterPick a random, large prime N � x0. We want to generate a new zero-testvalue αzt such that

|[~m]k · αzt mod N| � N ⇐⇒ ~m = 0

In particular, we have[~m]k · αzt mod N

=∑

i

(mig−1i + ri mod pi) · (ui · αzt) + a · x0 · αzt mod N

so we want |αzt · ui mod N| � N and |αzt · x0 mod N| � N

19 / 30


|[~m]k · αzt mod N| � N ⇐⇒ ~m = 0


=∑

i


so we want |αzt · ui mod N| � N and |αzt · x0 mod N| � N

19 / 30


|[~m]k · αzt mod N| � N ⇐⇒ ~m = 0


=∑

i


so we want |αzt · ui mod N| � N and |αzt · x0 mod N| � N19 / 30

How To Generate αzt?Given N , the generation of αzt ∈ ZN such that for all i , |uiαzt mod N| and|x0αzt mod N| are small is not obvious.

The problem amounts to finding a relatively short vector in a lattice1 u1 · · · un x0

N . . .N

N

Use LLL? (we can tolerate an exponential approx. factor over SVP), but typicallyn ≥ 105

20 / 30

How To Generate αzt?Given N , the generation of αzt ∈ ZN such that for all i , |uiαzt mod N| and|x0αzt mod N| are small is not obvious.The problem amounts to finding a relatively short vector in a lattice

1 u1 · · · un x0

N . . .N

N


20 / 30

How To Generate αzt?Given N , the generation of αzt ∈ ZN such that for all i , |uiαzt mod N| and|x0αzt mod N| are small is not obvious.The problem amounts to finding a relatively short vector in a lattice

1 u1 · · · un x0

N . . .N

N


20 / 30

How To Generate αzt?Using the structure of the ui ’s

Remember that N � x0 and ui = (gip∗i−1zk mod pi)p∗i

First note that p−1j ui mod N is small for all i 6= jOnly p−1

j uj mod N is not a priori smallLet us find αj such that αj · p−1

j uj mod N is smallAs before it amounts to finding a short vector in(dN/Be p−1

j uj

N

)

21 / 30

How To Generate αzt?Using the structure of the ui ’sRemember that N � x0 and ui = (gip∗i

−1zk mod pi)p∗i




j uj

N

)

21 / 30


−1zk mod pi)p∗i

First note that p−1j ui mod N is small for all i 6= j

Only p−1j uj mod N is not a priori small

Let us find αj such that αj · p−1j uj mod N is smallAs before it amounts to finding a short vector in(dN/Be p−1

j uj

N

)

21 / 30


−1zk mod pi)p∗i


j uj mod N is not a priori small

Let us find αj such that αj · p−1j uj mod N is smallAs before it amounts to finding a short vector in(dN/Be p−1

j uj

N

)

21 / 30


−1zk mod pi)p∗i




j uj

N

)21 / 30

How To Generate αzt?Using the structure of the ui ’s(dN/Be p−1

j uj

N

)

We chose B such that LLL finds a short vector(αj · dN/Be, βj)

where |αj | ≤√

pj and |βj = αj · p−1j uj mod N| ≤ N/

√pj .

New zero-testing element:αzt =

∑j

hj · αj · p−1j mod N

22 / 30


j uj

N

)We chose B such that LLL finds a short vector

(αj · dN/Be, βj)

where |αj | ≤√


√pj .


∑j


22 / 30


j uj

N

)We chose B such that LLL finds a short vector

(αj · dN/Be, βj)

where |αj | ≤√


√pj .


∑j


22 / 30

How To Generate αzt?Using the structure of the ui ’sNew zero-testing element (sizes to keep in mind N ≈ x0 · pj , αj ≈

√pj ):

αzt =∑

j


When applied on an encoding [~m]k :[~m]k · αzt mod N

=∑

i


23 / 30

How To Generate αzt?Using the structure of the ui ’sNew zero-testing element (sizes to keep in mind N ≈ x0 · pj , αj ≈

√pj ):

αzt =∑

j


When applied on an encoding [~m]k :[~m]k · αzt mod N

=∑

i

(mig−1i + ri mod pi) · (hiβi +

∑j 6=i

hjαj · ui/pj)

+ a · x0 · αzt mod N

23 / 30

An Important CaveatCannot work directly modulo x0

x0 cannot be made public, contrary to [CLT13]However, define v0 = x0 · αzt mod N , and

([~0]k · αzt mod N) mod v0

= (∑

i

ri · (hiβi +∑j 6=i

hjαj · ui/pj) + a · v0 ∈ Z) mod v0

=∑

i


hjαj · ui/pj) mod v0

We can apply Cheon et al. attack modulo v0

24 / 30


x0 cannot be made public, contrary to [CLT13]

However, define v0 = x0 · αzt mod N , and


= (∑

i



=∑

i




24 / 30




= (∑

i



=∑

i




24 / 30




= (∑

i



=∑

i



We can apply Cheon et al. attack modulo v024 / 30

An Important CaveatA Ladder of encodings

Making x0 secret is somewhat inconvenient:when we add or multiply encodings, we cannot reduce them modulo x0anymore to keep them of the same sizeSolution (taken from [DGHV10]): publish a ladder of encodings of 0 ofincreasing sizeI encodings

X (j)i = (CRTpi (rigi)/z j mod x0) + qi · x0

with qi ← [0, 2i) for i = 1, . . . , log(x0)

I do the operation over Z, and remove X (j)i for decreasing i ’s

25 / 30

An Important CaveatA Ladder of encodingsMaking x0 secret is somewhat inconvenient:when we add or multiply encodings, we cannot reduce them modulo x0anymore to keep them of the same size

Solution (taken from [DGHV10]): publish a ladder of encodings of 0 ofincreasing sizeI encodings




25 / 30

An Important CaveatA Ladder of encodingsMaking x0 secret is somewhat inconvenient:when we add or multiply encodings, we cannot reduce them modulo x0anymore to keep them of the same sizeSolution (taken from [DGHV10]): publish a ladder of encodings of 0 ofincreasing sizeI encodings




25 / 30

Concrete Attempt

Consider u = [~0]k−2 · [~b]1 · [~c ]1Apply the ladder to reduce its size to the size of x0:u′ = u +

∑siX

(k)i

Write u′ over Z:u′ =

∑i

(ri · bi · ci + si · rX ,i ,k) · ui − a · x0

All si ’s and a come up in the way of Cheon et al. attack

26 / 30

Concrete AttemptConsider u = [~0]k−2 · [~b]1 · [~c ]1

Apply the ladder to reduce its size to the size of x0:u′ = u +

∑siX

(k)i


∑i



26 / 30

Concrete AttemptConsider u = [~0]k−2 · [~b]1 · [~c ]1Apply the ladder to reduce its size to the size of x0:

u′ = u +∑

siX(k)i


∑i



26 / 30


u′ = u +∑

siX(k)i


∑i



26 / 30


u′ = u +∑

siX(k)i


∑i


All si ’s and a come up in the way of Cheon et al. attack26 / 30

Proof-of-concept Implementationhttps://github.com/tlepoint/new-multilinear-maps

Instantiation λ κ n η ∆ ρ γ = n · η pp sizeSmall 52 6 540 1679 23 52 0.9 · 106 27 MBMedium 62 6 2085 1989 45 62 4.14 · 106 175 MBLarge 72 6 8250 2306 90 72 19.0 · 106 1.2 GBExtra 80 6 25305 2619 159 85 66.3 · 106 6.1 GB

Setup Publish KeyGen

5.9 s 0.10 s 0.17 s36 s 0.33 s 1.06 s583 s 2.05 s 6.17 s4528 s 7.8 s 23.9 s27 / 30

https://github.com/tlepoint/new-multilinear-maps

Conclusion

The CLT scheme has many interesting features:composite order maps,assumed hardness of GDDH but also of DLIN & SubMConcrete targets to attack in practice if desiredSame efficiency as original CLT13Open problems for CLT15:I Analyze the reparationI Improve the efficiencyI Adapt the technique to [GGH13]?

28 / 30

ConclusionThe CLT scheme has many interesting features:composite order maps,assumed hardness of GDDH but also of DLIN & SubM

Concrete targets to attack in practice if desiredSame efficiency as original CLT13Open problems for CLT15:I Analyze the reparationI Improve the efficiencyI Adapt the technique to [GGH13]?

28 / 30

ConclusionThe CLT scheme has many interesting features:composite order maps,assumed hardness of GDDH but also of DLIN & SubMConcrete targets to attack in practice if desiredSame efficiency as original CLT13

Open problems for CLT15:I Analyze the reparationI Improve the efficiencyI Adapt the technique to [GGH13]?

28 / 30

ConclusionThe CLT scheme has many interesting features:composite order maps,assumed hardness of GDDH but also of DLIN & SubMConcrete targets to attack in practice if desiredSame efficiency as original CLT13Open problems for CLT15:I Analyze the reparationI Improve the efficiencyI Adapt the technique to [GGH13]?

28 / 30

Thank YouQuestions & Discussion

29 / 30

Discussion1. Design

I public encoding space / inversion2. Attacks3. Assumptions

I what sort of assumptions can be made?I base multilinear maps on well-known problems

4. ApplicationsI something that look different from obfuscationI what can you do with a small number of levels?I relation between 2-multilinear maps / pairings in applications

30 / 30

Multilinear Maps over the Integers: From Design to Security1cm

Documents