Lattice-based cryptography is the use of conjectured hard problems on point lattices in Rn as the foundation for secure cryptographic systems. Attractive features of lattice cryptography include apparent resistance to quantum attacks (in contrast with most number-theoretic cryptography), high asymptotic efficiency and parallelism, security under worst-case intractability assumptions, and solutions to long-standing open problems in cryptography. This work surveys most of the major developments in lattice cryptography over the past ten years. The main focus is on the foundational short integer solution (SIS) and learning with errors (LWE) problems (and their more efficient ring-based variants), their provable hardness assuming the worst-case intractability of standard lattice problems, and their many cryptographic applications.

/pdf/a-decade-of-lattice-cryptography-47cz03fxsi.pdf

A Decade of Lattice Cryptography.

Lattice-based cryptography is the use of conjectured hard problems on point lattices in Rn as the foundation for secure cryptographic systems. Attractive features of lattice cryptography include apparent resistance to quantum attacks in contrast with most number-theoretic cryptography, high asymptotic efficiency and parallelism, security under worst-case intractability assumptions, and solutions to long-standing open problems in cryptography. This work surveys most of the major developments in lattice cryptography over the past ten years. The main focus is on the foundational short integer solution SIS and learning with errors LWE problems and their more efficient ring-based variants, their provable hardness assuming the worst-case intractability of standard lattice problems, and their many cryptographic applications.

/pdf/a-decade-of-lattice-cryptography-4em28paukr.pdf

A Decade of Lattice Cryptography

In a constrained PRF, the owner of the PRF key K can generate constrained keys $K_f$ that allow anyone to evaluate the PRF on inputs x that satisfy the predicate f (namely, where f(x) is “true”) but reveal no information about the PRF evaluation on the other inputs. A private constrained PRF goes further by requiring that the constrained key $K_f$ hides the predicate f.

Private Constrained PRFs (and More) from LWE

A software watermarking scheme allows one to embed a “mark” into a program without significantly altering the behavior of the program. Moreover, it should be difficult to remove the watermark without destroying the functionality of the program. Recently, Cohen et al. (STOC 2016) and Boneh et al. (PKC 2017) showed how to watermark cryptographic functions such as PRFs using indistinguishability obfuscation. Notably, in their constructions, the watermark remains intact even against arbitrary removal strategies. A natural question is whether we can build watermarking schemes from standard assumptions that achieve this strong mark-unremovability property.

/pdf/watermarking-cryptographic-functionalities-from-standard-3s0fezrbgt.pdf

Watermarking Cryptographic Functionalities from Standard Lattice Assumptions

Let $F$ be a field of characteristic $p>2$ and $A\subset F$ have sufficiently small cardinality in terms of $p$. We improve the state of the art of a variety of sum-product type inequalities. In particular, we prove that $$ |AA|^2|A+A|^3 \gg |A|^6,\qquad |A(A+A)|\gg |A|^{3/2}. $$ We also prove several two-variable extractor estimates: ${\displaystyle |A(A+1)| \gg|A|^{9/8},}$ $$ |A+A^2|\gg |A|^{11/10},\; |A+A^3|\gg |A|^{29/28}, \; |A+1/A|\gg |A|^{31/30}.$$ 
Besides, we address questions of cardinalities $|A+A|$ vs $|f(A)+f(A)|$, for a polynomial $f$, where we establish the inequalities $$ \max(|A+A|,\, |A^2+A^2|)\gg |A|^{8/7}, \;\; \max(|A-A|,\, |A^3+A^3|)\gg |A|^{17/16}. $$ Szemeredi-Trotter type implications of the arithmetic estimates in question are that a Cartesian product point set $P=A\times B$ in $F^2$, of $n$ elements, with $|B|\leq |A|< p^{2/3}$ makes $O(n^{3/4}m^{2/3} + m + n)$ incidences with any set of $m$ lines. In particular, when $|A|=|B|$, there are $\ll n^{9/4}$ collinear triples of points in $P$, $\gg n^{3/2}$ distinct lines between pairs of its points, in $\gg n^{3/4}$ distinct directions. 
Besides, $P=A\times A$ determines $\gg n^{9/16}$ distinct pair-wise distances. 
These estimates are obtained on the basis of a new plane geometry interpretation of the incidence theorem between points and planes in three dimensions, which we call collisions of images.

/pdf/growth-estimates-in-positive-characteristic-via-collisions-6uc5dnj6hf.pdf

Growth Estimates in Positive Characteristic via Collisions

We prove a new upper bound for the number of incidences between points and lines in a plane over an arbitrary field F, a problem first considered by Bourgain, Katz and Tao. Specifically, we show that m points and n lines in F2, with m7/8<n<m8/7, determine at most O(m11/15n11/15) incidences (where, if F has positive characteristic p, we assume m−2n13≪p15). This improves on the previous best-known bound, due to Jones.

To obtain our bound, we first prove an optimal point-line incidence bound on Cartesian products, using a reduction to a point-plane incidence bound of Rudnev. We then cover most of the point set with Cartesian products, and we bound the incidences on each product separately, using the bound just mentioned.

We give several applications, to sum-product-type problems, an expander problem of Bourgain, the distinct distance problem and Beck's theorem.

An improved point‐line incidence bound over arbitrary fields

We prove new exponents for the energy version of the Erdős-Szemeredi sum-product conjecture, raised by Balog and Wooley. They match the previously established milestone values for the standard formulation of the question, both for general fields and the special case of real or complex numbers, and appear to be the best ones attainable within the currently available technology. Further results are obtained about multiplicative energies of additive shifts and a strengthened energy version of the "few sums, many products" inequality of Elekes and Ruzsa. The latter inequality enables us to obtain a minor improvement of the state-of the art sum-product exponent over the reals due to Konyagin and the second author, up to $\frac{4}{3}+\frac{1}{1509}$. An application of energy estimates to an instance of arithmetic growth in prime residue fields is presented.

On The Energy Variant of the Sum-Product Conjecture

A pseudorandom function (PRF) is a keyed function $F : {\mathcal K}\times{\mathcal X}\rightarrow{\mathcal Y}$ where, for a random key $k\in{\mathcal K}$, the function F(k,·) is indistinguishable from a uniformly random function, given black-box access. A key-homomorphic PRF has the additional feature that for any keys k,k′ and any input x, we have F(k + k′, x) = F(k,x) ⊕ F(k′,x) for some group operations + , ⊕ on $\mathcal{K}$ and $\mathcal{Y}$, respectively. A constrained PRF for a family of sets ${\mathcal S} \subseteq \mathcal{P}({\mathcal X})$ has the property that, given any key k and set $S \in \mathcal{S}$, one can efficiently compute a “constrained” key k S that enables evaluation of F(k,x) on all inputs x ∈ S, while the values F(k,x) for x ∉ S remain pseudorandom even given k S .

/pdf/key-homomorphic-constrained-pseudorandom-functions-chu8ax6toa.pdf

Key-Homomorphic Constrained Pseudorandom Functions

We study the Erdos distinct distance conjecture in the plane over an arbitrary field $\mathbb{F}$, proving that any $A$ with $|A|\leq\mathrm{char}(\mathbb{F})^{4/3}$ in positive characteristic, either determines $\gg |A|^{2/3}$ distinct pairwise distances from some point of $A$ to its other points, or the set $A$ lies on an isotropic line. We also establish for the special case of the prime residue field $\mathbb{F}_p$ that the condition $|A|\geq p^{5/4}$ suffices for $A$ to determine a positive proportion of the feasible $p$ distances. This significantly improves prior results on the problem.

On the Pinned Distances Problem over Finite Fields

A pseudorandom function (PRF) is a keyed function F : K × X → Y where, for a random key k ∈ K, the function F (k, ·) is indistinguishable from a uniformly random function, given black-box access. A key-homomorphic PRF has the additional feature that for any keys k, k′ and any input x, we have F (k+ k′, x) = F (k, x)⊕F (k′, x) for some group operations +,⊕ on K and Y , respectively. A constrained PRF for a family of sets S ⊆ P(X ) has the property that, given any key k and set S ∈ S, one can efficiently compute a “constrained” key kS that enables evaluation of F (k, x) on all inputs x ∈ S, while the values F (k, x) for x / ∈ S remain pseudorandom even given kS . In this paper we construct PRFs that are simultaneously constrained and key homomorphic, where the homomorphic property holds even for constrained keys. We first show that the multilinear map-based bit-fixing and circuit-constrained PRFs of Boneh and Waters (Asiacrypt 2013) can be modified to also be key- homomorphic. We then show that the LWE-based key-homomorphic PRFs of Banerjee and Peikert (Crypto 2014) are essentially already prefix-constrained PRFs, using a (non-obvious) definition of constrained keys and associated group operation. Moreover, the constrained keys themselves are pseudorandom, and the constraining and evaluation functions can all be computed in low depth. As an application of key-homomorphic constrained PRFs, we construct a proxy re-encryption scheme with fine-grained access control. This scheme allows storing encrypted data on an untrusted server, where each file can be encrypted relative to some attributes, so that only parties whose constrained keys match the attributes can decrypt. Moreover, the server can re-key (arbitrary subsets of) the ciphertexts without learning anything about the plaintexts, thus permitting efficient and fine- grained revocation. ? Supported by the third author’s grants. ?? Research supported by ERC starting grant (259668-PSPC). ? ? ? This material is based upon work supported by the National Science Foundation under CAREER Award CCF-1054495, by DARPA under agreement number FA8750-11-C-0096, and by the Alfred P. Sloan Foundation. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation, DARPA or the U.S. Government, or the Sloan Foundation. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon. † Research supported by ERC starting grant (259668-PSPC). ‡ Work done while visiting the Institute of Science and Technology Austria.

/pdf/key-homomorphic-constrained-pseudorandom-functions-4dnd87zxfr.pdf

Sophie Stevens

Papers

An improved point‐line incidence bound over arbitrary fields

On The Energy Variant of the Sum-Product Conjecture

Key-Homomorphic Constrained Pseudorandom Functions

On the Pinned Distances Problem over Finite Fields

Key-Homomorphic Constrained Pseudorandom Functions.