2-dnf加密机制英文ppt文件.pdfVIP

Evaluating 2-DNF Formulas on Ciphertexts Dan Boneh, Eu-Jin Goh, and Kobbi Nissim Theory of Cryptography Conference 2005 Homomorphic Encryption Enc. scheme is homomorphic to function f if • from E[A], E[B], can compute E[f(A,B)] e.g. f can be +, ×, ⊕, … Ideally, want f = NAND, or f = {+,×} • Called doubly homomorphic encryption Can do universal computation on ciphertext! Why is doubly homomorphic encryption useful? Gives efficient solutions for many problems. e.g. 1. 2 party Secure Function Evaluation 2. Computing on encrypted databases App: Database Computation Outsourced server with database containing encrypted data • User wants to compute function g on encrypted data • e.g. data mining, data aggregation With doubly homomorphic encryption, • Database encrypted with doubly hom. enc. • User sends g to server • Server computes g on encrypted database • Encrypted result returned to user These applications are pretty cool, so where can I get a fully homomorphic encryption scheme? Sorry, it doesn’t exist (yet). • Long standing open problem [RAD78] • Existing schemes hom. to 1 function • E.g. ElGamal (×), Paillier (+), GM (⊕) But some progress … Main Result Homomorphic encryption scheme that supports one ×and arbitrary +. • Based on finite bilinear groups with composite order • Semantic security based on natural decision problem Related Work Sander et al. [SYY99] • Enc. scheme — NC1 circuit eval. on CTs ⇒Can evaluate 2-DNFs on CTs But CT len. exponential in circuit depth • CT size doubles for every + op • Poly. len. 2-DNF gives poly. size CT • Our scheme — constant size CT