How to share a lattice trapdoor: threshold protocols for signatures and (H)IBE

  • Authors:
  • Rikke Bendlin;Sara Krehbiel;Chris Peikert

  • Affiliations:
  • Department of Computer Science, Aarhus University, Denmark;School of Computer Science, Georgia Institute of Technology;School of Computer Science, Georgia Institute of Technology

  • Venue:
  • ACNS'13 Proceedings of the 11th international conference on Applied Cryptography and Network Security
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

We develop secure threshold protocols for two important operations in lattice cryptography, namely, generating a hard lattice Λ together with a "strong" trapdoor, and sampling from a discrete Gaussian distribution over a desired coset of Λ using the trapdoor. These are the central operations of many cryptographic schemes: for example, they are exactly the key-generation and signing operations (respectively) for the GPV signature scheme, and they are the public parameter generation and private key extraction operations (respectively) for the GPV IBE. We also provide a protocol for trapdoor delegation, which is used in lattice-based hierarchical IBE schemes. Our work therefore directly transfers all these systems to the threshold setting. Our protocols provide information-theoretic (i.e., statistical) security against adaptive corruptions in the UC framework, and they are robust against up to ℓ/2 semi-honest or ℓ/3 malicious parties (out of ℓ total). Our Gaussian sampling protocol is both noninteractive and efficient, assuming either a trusted setup phase (e.g., performed as part of key generation) or a sufficient amount of interactive but offline precomputation, which can be performed before the inputs to the sampling phase are known.