Cluster Computing
https://doi.org/10.1007/s10586-017-1444-9
Lossy trapdoor functions based on the PLWE
Chengli Zhang
1
· Wenping Ma
1
· Hefeng Chen
2
· Feifei Zhao
1
Received: 27 July 2017 / Revised: 20 November 2017 / Accepted: 23 November 2017
© Springer Science+Business Media, LLC, part of Springer Nature 2017
Abstract
In 2011, Chris Peikert and Brent Waters proposed the concept of lossy trapdoor functions, which is an inherent and powerful
cryptographic concept. Lossy trapdoor functions can be used for simple black-box constructing CCA encryption schemes,
collision-resistent hash functions and oblivious transfer schemes. Chris Peikert and Brent Waters constructed lossy trapdoor
functions based on decisional Diffie–Hellman assumption and learning with errors problem separately, which can be gen-
eralized to all-but-one trapdoor functions. In this paper, we generalize the lossy trapdoor functions and all-but-one trapdoor
functions based on the polynomial ring separately, and we construct two types of trapdoor functions based on polynomial
learning with errors assumption, which have more throughput and efficiency.
Keywords Lattices · Lossy trapdoor functions · All-but-one trapdoor functions · Polynomial learning with errors
1 Introduction
A central goal in cryptography is to realize a variety of secu-
rity notions based on plausible and concrete computational
assumptions. The assumptions have typically been concerned
with problems from three categories: factoring large inte-
gers [1–5], computing discrete logarithms in cyclic groups
[6–8], computational problems on lattices [9–13]. In public
key cryptography, two important notions are trapdoor func-
tions (TDFs) and security under chosen ciphertext attack
(CCA security). Trapdoor functions were first realized by
the RSA function of Rivest, Shamie, and Adleman. While
CCA security has become the notion of s ecurity for public
key encryption under active attacks.
In resent years, lattices have raised as a very attractive
foundation for cryptography [14–18]. The appeal of lattice-
based primitives stems from the fact that the security can
often be based on worst-case hardness assumptions. Much
more recent research in lattice cryptography focus on ring-
based primitives such as ring-LWE [19,20].
A lattice has a typical linear structure and some compu-
tational problems about it have been proven to be NP-hard.
B
Chengli Zhang
zcl0719@163.com
1
State Key Laboratory of Integrated Services Networks,
Xidian University, Xi’an 710071, People’s Republic of China
2
Computer Engineering College, Jimei University,
Xiamen 361021, People’s Republic of China
Many exciting developments in lattice-based cryptography
have occurred in the past few years, and there have been
renewed interest in lattice-based cryptography as prospects
for a real quantum computer improve. As is well known,
some lattice-based cryptosystems can be resistant to attack
by both classical and quantum computers.
Before the year of 2008, for CCA security, the main
approach in the existing literature relies on non-interactive
zero-knowledge (NIZK) proofs. Cryptosystems have been
constructed based on problems related to factoring and dis-
crete logs, but not lattices. For trapdoor functions, the state
of the art is even less satisfactory: though TDFs are widely
viewed as a general primitive, they have so far been realized
only from problems related to factoring.
In 2011, Chris Peikert and Brent Waters proposed the defi-
nition of lossy trapdoor functions based on lattice whose exis-
tence implies that of general trapdoor functions [13]. And it
can be used to develop new approaches for injective trapdoor
functions, constructing collision resistant hash functions,
oblivious transfer sch-emes, and chosen ciphertext-secure
cryptosystems. All of the above constructions are simple,
efficient, and black-box. Chris Peikert and Brent Waters
realized lossy TDFs under a variety of different number-
theoretic assumptions, including hardness of the decisional
Diffie–Hellman (DDH) problem, and the worst-case hard-
ness of standard l attice problem for quantum algorithms
(alternately, under an average-case hardness assumption for
classical algorithms). These constructions are simple and
123