Practical Cryptography in High Dimensional Tori IBM实用密码学在高维环面的IBM.pptVIP

Practical Cryptography in High Dimensional Tori Marten van Dijk1, Robert Granger2, Dan Page2, Karl Rubin3, Alice Silverberg3, Martijn Stam2, David Woodruff1 Outline Application of Torus Cryptography Goals of Torus Cryptography Security Efficiency Space – Compression Time – Exponentiations Our Contribution Implementation Conclusion Sample Application Outline Application of Torus Cryptography Goals of Torus Cryptography Security Efficiency Space – Compression Time – Exponentiations Our Contribution Implementation Conclusion Security Setting: Gq μ F*pn How to choose Gq? Security: Can’t compute gab from ga, gb (CDH) Pollard ?: log2 q 160 Index Calculus: n log2 p 1024 Pohlig-Hellman: Gq not in proper subfield Security: Pohlig-Hellman Setting: Gq μ F*pn How to choose Gq? Pohlig-Hellman: Gq not in proper subfield Security: Pohlig-Hellman Setting: Gq μ F*pn How to choose Gq? Pohlig-Hellman: Gq not in proper subfield Security: Pohlig-Hellman Setting: Gq μ F*pn How to choose Gq? Pohlig-Hellman: Gq not in proper subfield Outline Application of Torus Cryptography Goals of Torus Cryptography Security Efficiency Space – Compression Time – Exponentiations Our Contribution Implementation Conclusion Efficiency: Communication Efficiency: Communication Efficiency: Communication Efficiency: Communication Efficiency: Computation Outline Our Contribution Reduce m in the map Tn(Fp) x Am $ Am + ?(n) Better for more applications More computationally efficient Give the first implementation of T30(Fp) and show it is practical Our Contribution Let n = 30. Our map is inspired by the equation: ?30(p) ￠ ?6(p) = ?6(p5) This suggests a mapping: T30(Fp) x T6(Fp) $ T6(Fp5) We can represent T6(Fp) and T6(Fp5) using CEILIDH! Get an “almost bijection” T30(Fp) x A2(Fp) $ A10(Fp) Affine surplus m = 2, instead of m = 32 in [vDW] Our Contribution Applications Let’s compress two elements of T30(Fp) in dif