Packed leveled fully homomorphic signatures from ideal lattices

Abstract

Fully homomorphic signature (FHS) schemes allow users to cryptographically verify the results of arbitrary computation on their signed data by an untrusted server. In a leveled scheme, the maximal circuit depth d of the computation must be fixed during setup. More concretely, a user Alice signs a large dataset {x₁,....,xN} yielding short signatures {[sigma]₁,....,[sigma]N}. She then sends the signed dataset to Bob, an untrusted party, who will perform some computation y = g(x₁,....,xN). Bob will then homomorphically derive a new short signature [sigma][subscript g,y], such that anyone with Alice's verification key can verify the correctness of the computation without the underlying dataset. In this work, we modify a previous FHS scheme [GVW15] by basing our solution on the hardness of the ring small integer solution problem (Ring-SIS) in ideal lattices. Working in this ring setting allows for shorter signatures, smaller key sizes, and more ecient computation.

To further improve the eciency of this signature scheme, we also show how to sign a collection of many data items with one short signature. This packing technique is based on batch optimization techniques introduced in [BGV12]. As a modular building block for our homomorphic signature scheme construction, we present a homomorphic trapdoor function (HTDF) construction that supports all functions on its inputs. Additionally, when working with packed inputs, we support two types of operations - pairwise addition (l-Add) and pairwise multiplication (l-Mult). Unlike in [GHS12], we do not show how to perform a data permutation operation (l-Permute), which would allow for arbitrary computation on packed data. Finally, we present an implementation using the PALISADE Lattice Cryptography Library, which we benchmark on certain operations motivated by practical applications.

We utilize PALISADE's implementation of an ecient Gaussian sampling algorithm for lattice trapdoors [GPR+17], which is based on the ring setting of [MP12].