Skip to main content
Springer Nature Link
Log in

Cryptanalysis of a (Somewhat) Additively Homomorphic Encryption Scheme Used in PIR

  • Conference paper
  • First Online:
Financial Cryptography and Data Security (FC 2015)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 8976))

Included in the following conference series:

  • 3246 Accesses

Abstract

Private Information Retrieval (PIR) protects users’ privacy in outsourced storage applications and can be achieved using additively homomorphic encryption schemes. Several PIR schemes with a “real world” level of practicality, both in terms of computational and communication complexity, have been recently studied and implemented. One of the possible building block is a conceptually simple and computationally efficient protocol proposed by Trostle and Parrish at ISC 2010, that relies on an underlying secret-key (somewhat) additively homomorphic encryption scheme, and has been reused in numerous subsequent works in the PIR community (PETS 2012, FC 2013, NDSS 2014, etc.).

In this paper, we show that this encryption scheme is not one-way: we present an attack that decrypts arbitrary ciphertext without the secret key, and is quite efficient: it amounts to applying the LLL algorithm twice on small matrices. Used against existing practical instantiations of PIR protocols, it allows the server to recover the users’ access pattern in a matter of seconds.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    The TP scheme was one possible building block of this protocol; therefore the latter might still be secure when instantiated with a different homomorphic encryption scheme.

  2. 2.

    Note that taking selecting N as a superpolynomial prime does not thwart the attack since the users sends encryption of bits.

References

  1. Blass, E.-O., Di Pietro, R., Molva, R., Önen, M.: PRISM – privacy-preserving search in mapreduce. In: Fischer-Hübner, S., Wright, M. (eds.) PETS 2012. LNCS, vol. 7384, pp. 180–200. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  2. Chor, B., Kushilevitz, E., Goldreich, O., Sudan, M.: Private information retrieval. J. ACM 45(6), 965–981 (1998)

    Article  MATH  MathSciNet  Google Scholar 

  3. Coron, J.-S., Naccache, D., Tibouchi, M.: Fault attacks against emv signatures. In: Pieprzyk, J. (ed.) CT-RSA 2010. LNCS, vol. 5985, pp. 208–220. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  4. Doröz, Y., Sunar, B., Hammouri, G.: Bandwidth efficient PIR from NTRU. In: Böhme, R., Brenner, M., Moore, T., Smith, M. (eds.) FC 2014 Workshops. LNCS, vol. 8438, pp. 195–207. Springer, Heidelberg (2014)

    Google Scholar 

  5. Elkhiyaoui, K., Önen, M., Molva, R.: Privacy preserving delegated word search in the cloud. In: Obaidat, M.S., Holzinger, A., Samarati, P. (eds.) SECRYPT 2014, pp. 137–150. SciTePress (2014)

    Google Scholar 

  6. Gentry, C.: Fully homomorphic encryption using ideal lattices. In: Mitzenmacher, M. (ed.) STOC 2009, pp. 169–178. ACM (2009)

    Google Scholar 

  7. Gao, Z., Zhu, H., Liu, Y., Li, M., Cao, Z.: Location privacy in database-driven cognitive radio networks: attacks and countermeasures. In: INFOCOM 2013, pp. 2751–2759. IEEE (2013)

    Google Scholar 

  8. Itoh, K., Okamoto, E., Mambo, M.: Proposal of a fast public key cryptosystem. In: Adams, C., Just, M. (eds.) SAC 1997, pp. 224–230 (1997)

    Google Scholar 

  9. Kushilevitz, E., Ostrovsky, R.: Replication is NOT needed: SINGLE database, computationally-private information retrieval. In: FOCS 1997, pp. 364–373. IEEE Computer Society (1997)

    Google Scholar 

  10. Lenstra, A.K., Lenstra Jr., H.W., Lovász, L.: Factoring polynomials with rational coefficients. Math. Ann. 261(4), 515–534 (1982)

    Google Scholar 

  11. Mayberry, T., Blass, E.-O., Chan, A.H.: PIRMAP: efficient private information retrieval for mapreduce. In: Sadeghi, A.-R. (ed.) FC 2013. LNCS, vol. 7859, pp. 371–385. Springer, Heidelberg (2013)

    Chapter  Google Scholar 

  12. Mayberry, T., Blass, E.-O., Chan, A.H.: Efficient private file retrieval by combining ORAM and PIR. In: NDSS 2014 (2014)

    Google Scholar 

  13. Nguyen, P.Q., Stern, J.: Merkle-hellman revisited: a cryptanalysis of the Qu-vanstone cryptosystem based on group factorizations. In: Kaliski Jr., B.S. (ed.) CRYPTO 1997. LNCS, vol. 1294, pp. 198–212. Springer, Heidelberg (1997)

    Chapter  Google Scholar 

  14. Nguyen, P.Q., Stern, J.: Cryptanalysis of a fast public key cryptosystem presented at SAC 1997. In: Tavares, S., Meijer, H. (eds.) SAC 1998. LNCS, vol. 1556, p. 213. Springer, Heidelberg (1999)

    Chapter  Google Scholar 

  15. Nguyen, P.Q., Stern, J.: The two faces of lattices in cryptology. In: Silverman, J.H. (ed.) CaLC 2001. LNCS, vol. 2146, pp. 146–180. Springer, Heidelberg (2001)

    Chapter  Google Scholar 

  16. Nguyen, P.Q., Tibouchi, M.: Lattice-based fault attacks on signatures. In: Joye, M., Tunstall, M. (eds.) Fault Analysis in Cryptography. Information Security and Cryptography, pp. 201–220. Springer (2012)

    Google Scholar 

  17. Stein, W.A., et al.: Sage Mathematics Software (Version 6.2). The Sage Development Team (2014). http://www.sagemath.org

  18. Trostle, J., Parrish, A.: Efficient computationally private information retrieval from anonymity or trapdoor groups. In: Burmester, M., Tsudik, G., Magliveras, S., Ilić, I. (eds.) ISC 2010. LNCS, vol. 6531, pp. 114–128. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. CryptoExperts, Paris, France

    Tancrède Lepoint

  2. NTT Secure Platform Laboratories, Tokyo, Japan

    Mehdi Tibouchi

Authors
  1. Tancrède Lepoint
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Mehdi Tibouchi
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Tancrède Lepoint .

Editor information

Editors and Affiliations

  1. Leibniz Universität, Hannover, Germany

    Michael Brenner

  2. Carnegie Mellon University, Pittsburgh, Pennsylvania, USA

    Nicolas Christin

  3. Carnegie Mellon University, Pittsburgh, Pennsylvania, USA

    Benjamin Johnson

  4. New Jersey Institute of Technology, Newark, New Jersey, USA

    Kurt Rohloff

Rights and permissions

Reprints and permissions

Copyright information

© 2015 International Financial Cryptography Association

About this paper

Cite this paper

Lepoint, T., Tibouchi, M. (2015). Cryptanalysis of a (Somewhat) Additively Homomorphic Encryption Scheme Used in PIR. In: Brenner, M., Christin, N., Johnson, B., Rohloff, K. (eds) Financial Cryptography and Data Security. FC 2015. Lecture Notes in Computer Science(), vol 8976. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-48051-9_14

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-48051-9_14

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-48050-2

  • Online ISBN: 978-3-662-48051-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics