[do not merge] Lattice-based IBE#251
Draft
jonas-lj wants to merge 13 commits into
Draft
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Replace per-share RNG draws with deterministic derivation from a single global seed `r` plus `(index, pk_i, full_id)`, store `c_r = r XOR k_r` in `IBEEncryptions::Falcon512.encrypted_randomness`. Implement `decrypt_all_shares` for Falcon: recover `r`, re-derive each share's randomness, recompute the share via `w XOR H(k)`, and verify the recomputed ciphertext matches.
Run with:
cargo test --release -p crypto --lib bench_ibe -- --ignored --nocapture
Times seal_encrypt and seal_decrypt (with and without verification) for
BF-BLS12381 and Falcon-512 at n in {3, 5, 7, 10}, plus Falcon keygen.
Marked #[ignore] so it doesn't run in the default test set.
Now that MystenLabs/fastcrypto-lattice#1 is merged, replace the local path dep with a pinned git rev (20a0d5c).
After rebasing onto origin/main, the renamed/added IBEEncryptions methods need Falcon arms, and the tests/bench need to use sui_sdk_types::Address (NewObjectID) instead of sui_types::ObjectID when invoking seal_encrypt. - Add Falcon512 arm to combine_and_verify_nonce (no-op: no nonce). - Add Falcon512 arm to seal-cli's Display for IBEEncryptions. - Convert ObjectID -> NewObjectID in Falcon tests and bench.
Adds per-config measurements: `extract` (deriving one user secret key), public key size, user secret key size, and total encrypted object size.
fastcrypto-lattice renamed `falcon_util` to `falcon` (inner `falcon` submodule -> `signature`) and dropped the `IBE` trait. Update imports accordingly and re-pin to the new revision.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds Falcon-512 lattice-based IBE as a post-quantum alternative to the existing Boneh-Franklin BLS12-381 scheme, implementing the PQ-TSS-BF-KEM protocol. The threshold secret-sharing layer is unchanged; only the per-share IBE encapsulation is swapped.
What's included
IBEEncryptions::Falcon512,IBEPublicKeys::Falcon512,IBEUserSecretKeys::Falcon512variants.seal_encrypt/seal_decryptFalcon paths.ris sampled once; every share's lattice randomness(k, r_i, e1, e2)is derived viaHash(r, i, A_i, H(ID)).c_r = r XOR k_ris stored asencrypted_randomness.decrypt_all_shares_and_verify_nonceFalcon arm): recoversr, re-derives each share's randomness, recomputes the share viaw XOR H(k), and re-encrypts to verify the ciphertext matches. Tampering with(u, v)is caught directly; tampering withwis caught by the polynomial-consistency check.seal-cli'sDisplay.Protocol conformance
Every step of PQ-TSS-BF-KEM Encrypt/Decrypt is implemented, including the final ciphertext-verification assertion. One known structural divergence (pre-existing): the underlying primitive uses a Fujisaki-Okamoto-style mask (
w = share XOR H(k), randomk) rather than the protocol's direct bit-encoding. Functionally equivalent for transport; verification works under either. Reconciling the encoding is tracked separately and would live infastcrypto-lattice.Dependency
Depends on MystenLabs/fastcrypto-lattice#1 (merged) - pinned via git rev
20a0d5c. That PR adds the deterministic encryption helpers and makesCiphertextfields public.Benchmarks
cargo test --release -p crypto --lib bench_ibe -- --ignored --nocapture(Apple Silicon, single-threaded; 20-iter avg for BF ops, 50 for BF extract, 5 for Falcon).Boneh-Franklin BLS12-381
Falcon-512
Observations
encrypt/decryptare actually faster than BF (lattice NTT + rounding vs BLS pairings); verification adds ~3-6x (BF) / ~5x (Falcon) to decrypt.keygen(~1.5-2.3 s/keypair) andextract(~10-18 ms, variable due to rejection sampling) are the expensive operations - both one-time / per-request server-side costs.Test plan
cargo test --workspace- all suites pass (26 crypto tests incl. newtest_pq_round_trip_with_verification).bench_ibeis#[ignore]d (excluded from the default test run).Note
Marked [do not merge] - staging branch for the lattice IBE work.