학위논문 (박사)-- 서울대학교 대학원 자연과학대학 수리과학부, 2017. 8. 천정희.(Fully) Homomorphic encryption (FHE, HE) is one of the natural and powerful tools for ensuring privacy of sensitive data since it enables to handle ciphertexts without decryption and thus allow complicated computations on the encrypted data. Due to this property, homomorphic encryption can be applied to many scenarios in the real life, especially, databases. Until now, most of homomorphic encryption schemes restrict a plaintext space as an integer and thus numeric data should be represented by integers. However, there are many applications working in the real number system that operate on very sensitive information, for example, user's location information and patient's medical information. Usually, these information can be represented by the real numbers and thus it should be encoded into the integers. The general decimal representation requires \emph{quite large} plaintext space and a polynomial representation also requires a \emph{higher degree} of polynomials, which has a bad influence to the performance of FHE scheme.
In this thesis, we employ continued fraction to represent real numbers and to alleviate this inefficiency. With continued fraction, real numbers can be represented by a set of \emph{quite small} integers and it makes performance improvement than other encoding techniques. Moreover, we can develop a set of algorithms and circuits using continued fraction for the following operations: homomorphic integer division, equality circuit and comparison circuits over the real numbers.
First, we suggest an algorithm for homomorphic integer division using continued fraction and restoring division algorithm. Since the integer is not closed under the division, the most of homomorphic encryption schemes cannot support the division, however, we suggest a transformation from rational numbers to continued fractions being encrypted and it allows to divide two encrypted integers. Further, we can evaluate a polynomial whose coefficients are in the rational numbers.
Second, we describe comparison circuits over the encrypted real numbers including equality circuits. Since comparing two continued fraction is also easy as much as comparing two decimal numbers, we can build \emph{more efficient} comparison circuits while maintaining the small message space utilizing the homomorphic comparison circuits over the integers.
With our efficient comparison circuits, we can apply to the real-type database which indicates each numeric data is represented by the real numbers and our circuits enable to sorting and private database queries such as retrieval queries and aggregate queries, which makes database useful.
Finally, we present a proof of correct decryption in a single party homomorphic encryption. Although a server evaluates some polynomial being encrypted, the server cannot know any information about the result. Thus, if a server is interested in the result, a data owner returns the decryption result. The problem is that the server should believe the data owner at this time because the data owner can manipulate the decryption result and the server cannot recognize it. We prevent this situation by utilizing one-time message authentication code. Moreover, this technique can be applied to many scenarios, especially, a protocol for authentication of biometrics.1 Introduction 1
1.1 Overview and Contributions 2
1.1.1 Homomorphic Integer Division 2
1.1.2 Homomorphic Comparisons over the Real Numbers 4
1.1.3 Integrity of Homomorphic Evaluations 6
2 Preliminaries 9
2.1 Notation 9
2.2 Continued Fraction 9
2.3 Homomorphic Encryption 14
2.4 Homomorphic Comparisons over the Integers 16
2.4.1 Equality Circuit over the Integers 16
2.4.2 Greater-Than and Less-Than Circuits over the Integers 17
2.5 Fuzzy Extractor 18
2.5.1 Reusable Fuzzy Extractor 19
3 Algorithms for Homomorphic Integer Division 22
3.1 Overview and RelatedWorks 22
3.2 Restoring Division Algorithm 24
3.3 Homomorphic Integer Division 27
3.3.1 Algorithm 28
3.3.2 Efficiency 29
3.4 Homomorphic Arithmetics over the Polynomials 31
3.4.1 Description 31
4 Algorithms for Homomorphic Comparisons over the Real Numbers 33
4.1 Overview and Related Works 33
4.2 Comparing Two Continued Fractions 37
4.2.1 Our Idea: Comparing Two CFs in the Clear 37
4.3 EqualityCircuit 39
4.3.1 Construction 40
4.3.2 Complexity 40
4.4 Greater-Than and Less-Than 41
4.4.1 Construction 41
4.4.2 Complexity 42
4.5 Implementation 44
4.5.1 Environment 44
4.5.2 Scheme Parameters 45
4.5.3 Experimental Results and Comparisons 46
4.6 Applications to Database Service 48
4.6.1 Sorting 48
4.6.2 Private Database Queries 49
5 Algorithms for Integrity-based Homomorphic Evaluations 54
5.1 Overview and RelatedWorks 54
5.2 Models and Settings 57
5.2.1 System Model and Participants 57
5.2.2 Threat Model 57
5.2.3 Security Model 58
5.3 Integrity of Homomorphic Evaluations 59
5.3.1 Message Authentication Code 59
5.3.2 Protocol Constructions 60
5.3.3 Security Proof 63
5.4 Application to Biometric Authentication 72
5.4.1 How Ghostshell Works 72
5.4.2 Analysis 73
5.4.3 Optimization 74
5.5 Implementation 79
5.5.1 Micro-experiments 80
5.6 Reusable Fuzzy Extractor for the Hamming Distance 83
5.6.1 Insecurity of Previous Reusable Fuzzy Extractor 84
5.6.2 Revising Reusable Fuzzy Extractor 85
5.6.3 Revising Idea 86
5.6.4 Our Construction 87
5.6.5 Analyisis 88
6 Conclusion 90
Abstract (in Korean) 100Docto