基于MGSW15方案的分组密码电路的同态运算

Homomorphic evaluation of block cipher circuits based on MGSW15 scheme

摘要:

全同态加密(FHE)允许在不知道秘密信息的前提下对密文进行任意运算，已成为大数据和云安全背景下的热门研究方向，近年来取得了重大进展.但在实际应用中全同态加密仍面临诸多问题，其中严重的密文扩张给密文传输带来了巨大压力，通过将全同态加密方案与对称密码相融合可以有效解决这一问题.GSW类型的全同态加密方案效率较高，且进行同态计算不需要再线性化技术，本文选取了支持并行操作的MGSW15方案，其密文可以转化为任意基于LWE的FHE方案的密文.给出了在云计算背景下基于MGSW15方案实现密文压缩的基本框架，并利用该方案分别同态计算实现了分组密码AES-128、PRINCE、SIMON-64/128电路，根据每种分组密码的结构特点对其明文分组采用多种切割方式以提高同态运算效率，最后对效率和安全性进行了分析.结合AES算法的安全性、通用性以及轻量级分组密码算法PRINCE和SIMON的高效性，本文的工作在实际应用中效率更高、应用范围更广，密文传输量与明文规模的比值趋近于1，且传输1比特明文只需进行1次同态乘法.

Abstract:

Fully homomorphic encryption (FHE), which allows arbitrary computation of ciphertexts without knowing the secret information, has become a hot research direction in the context of big data and cloud security and has made great progress in recent years. However, in practical applications, fully homomorphic encryption still faces many problems, among which the serious expansion of ciphertext brings great pressure to the transmission of ciphertext. This problem can be effectively solved by combining the full homomorphic encryption scheme with symmetric cipher. The GSW-type full homomorphic encryption scheme is more efficient, and does not need the re-linearization technique in homomorphic evaluations. This paper selects the MGSW15 scheme which supports parallel operations, and whose ciphertext can be transformed into the ciphertext of any FHE scheme based on LWE. We present the basic framework of achieving ciphertext compression based on MGSW15 scheme in the background of cloud computing, and implement homomorphic evaluations of the block cipher AES-128, PRINCE and SIMON-64/128 circuits respectively. According to the structural characteristics of each block cipher, we use various kinds of plaintext-slicing ways to improve the efficiency of homomorphic evaluation. Finally, we analyze efficiency and security. Combined with the security and generality of AES and the efficiency of lightweight block cipher algorithms PRINCE and SIMON, the work of this paper is more efficient, and more widely used in practical applications, in which the communication complexity of ciphertexts is approximately equal to the scale of plaintexts and only one homomorphic multiplications are needed every plaintext bit.