Communication Dans Un Congrès Année : 2024

On the practical CPA$^D$ security of “exact” and threshold FHE schemes and libraries

Résumé

In their Eurocrypt'21 seminal paper, Li and Micciancio presented a passive attack against the CKKS approximate FHE scheme and introduced the notion of CPA$^D$ security. The current status quo is that this line of attacks does not apply to "exact" FHE. In this paper, we challenge this status quo by exhibiting a CPA$^D$ key recovery attack on the linearly homomorphic Regev cryptosystem which easily generalizes to other xHE schemes such as BFV, BGV and TFHE showing that these cryptosystems are not CPA$^D$ secure in their basic form. We also show that existing threshold variants of BFV, BGV and CKKS are particularily exposed to CPA$^D$ attackers and would be CPA$^D$-insecure without proper smudging noise addition after partial decryption. Finally we successfully implement our attack against several mainstream FHE libraries and discuss a number of natural countermeasures as well as their consequences in terms of FHE practice, security and efficiency. The attack itself is quite practical as it typically takes less than an hour on an average laptop PC, requiring a few thousand ciphertexts as well as up to around a million evaluations/decryptions, to perform a full key recovery.

Fichier principal
Vignette du fichier
CPADBFV (1).pdf (566.44 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

cea-04706832 , version 1 (20-03-2025)

Licence

Identifiants

Citer

Marina Checri, Renaud Sirdey, Aymen Boudguiga, Jean-Paul Bultel. On the practical CPA$^D$ security of “exact” and threshold FHE schemes and libraries. Crypto 2024 - 44th Annual International Cryptology Conference, Aug 2024, Santa Barbara, United States. pp.3-33, ⟨10.1007/978-3-031-68382-4_1⟩. ⟨cea-04706832⟩
383 Consultations
419 Téléchargements

Altmetric

Partager

  • More