同態加密法是允許在密文之間做運算的一種加密方式，當其產生的加密結果解密時，其結果會與在明文間做運算後相同，同態加密法的特性常用於現代的通訊系統和密碼系統。綜觀現有的研究文獻，目前現有的同態加密法都支援加法或乘法同態，並沒有同態加密法專門支援邏輯運算的功能，基於這個動機，我們提出了第一個專門邏輯運算功能之同態加密法，我們所提出的機制可以應用在2-DNF和k-CNF上，此外，此機制在破解決定子群難題之假設下具有可證明安全性。

Homomorphic encryption is a form of encryption that allows computations to be carried out on ciphertext and generate an encrypted result which, when decrypted, matches the result of operations performed on the plaintexts. The feature of homomorphic encryption is used in modern communication system architectures and cryptosystems. In view of the previous works, most of homomorphic encryptions support additive or multiplicative homomorphism. There is few homomorphic encryption schemes tailored for logical operations. In this paper, we propose a homomorphic encryption scheme that supports logical operations. Additionally, our proposed scheme can be applied to 2-DNF and k-CNF. Furthermore, the proposed scheme achieves provable security under the subgroup decision assumption.

論文審定書 i
Acknowledgments iii
摘要 iv
Abstract v
List of Figures viii
List of Tables ix

Chapter 1 Introduction 1
1.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
1.2 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Chapter 2 Preliminaries 3
2.1 Composite Order Bilinear Groups . . . . . . . . . . . . . . . . . . . . .3
2.2 Subgroup Decision Problem . . . . . . . . . . . . . . . . . . . . . . . . .4
2.3 Hard Assumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Chapter 3 Related Works 6
3.1 Boneh et al.’s Homomorphic Encryption Scheme . . . . . . . . 6
Chapter 4 Our Construction 8
4.1 The Proposed Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.2 Correctness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
4.3 Homomorphism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.3.1 The OR Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.3.2 The AND Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.4 Discussions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.4.1 2-DNF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
4.4.2 k-CNF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Chapter 5 Security Proof 15
5.1 Hardness of the SD Problem . . . . . . . . . . . . . . . . . . . . . . . 15
5.1.1 Notations and the Master Theorem . . . . . . . . . . . . . . . . . 15
5.2 Security Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Chapter 6 Comparison 19
6.1 Properties Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
6.2 Performance Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Chapter 7 Conclusion 21
Bibliography 22

[1] Josh Daniel Cohen Benaloh. Verifiable secret-ballot elections. 1987.
[2] Dan Boneh, Eu-Jin Goh, and Kobbi Nissim. Evaluating 2-dnf formulas on ciphertexts. In Theory of Cryptography Conference, pages 325–341. Springer, 2005.
[3] Josh D Cohen and Michael J Fischer. A robust and verifiable cryptographically secure election scheme. Yale University. Department of Computer Science, 1985.
[4] Ronald Cramer, Matthew Franklin, Berry Schoenmakers, and Moti Yung. Multi-authority secret-ballot elections with linear work. In International Conference on the Theory and Applications of Cryptographic Techniques, pages 72–83. Springer, 1996.
[5] Ronald Cramer, Rosario Gennaro, and Berry Schoenmakers. A secure and optimally efficient multi-authority election scheme. Transactions on Emerging Telecommunications Technologies, 8(5):481–490, 1997.
[6] Alexander W Dent. A brief history of provably-secure public-key encryption. In International Conference on Cryptology in Africa, pages 357–370. Springer, 2008.
[7] Taher ElGamal. A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE transactions on information theory, 31(4):469–472, 1985.
[8] Michael J Freedman, Kobbi Nissim, and Benny Pinkas. Efficient private matching and set intersection. In International conference on the theory and applications of cryptographic techniques, pages 1–19. Springer, 2004.
[9] Shafi Goldwasser and Silvio Micali. Probabilistic encryption & how to play mental poker keeping secret all partial information. In Proceedings of the fourteenth annual ACM symposium on Theory of computing, pages 365–377. ACM, 1982.
[10] Jonathan Katz, Amit Sahai, and Brent Waters. Predicate encryption supporting disjunctions, polynomial equations, and inner products. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 146–162. Springer,
2008.
[11] Eyal Kushilevitz and Rafail Ostrovsky. Replication is not needed: Single database, computationally-private information retrieval. In Foundations of Computer Science, 1997. Proceedings., 38th Annual Symposium on, pages 364–373. IEEE, 1997.
[12] Liam Morris. Analysis of partially and fully homomorphic encryption. Rochester Institute of Technology, New York, page 5, 2013.
[13] Michael Naehrig, Kristin Lauter, and Vinod Vaikuntanathan. Can homomorphic encryption be practical? In Proceedings of the 3rd ACM workshop on Cloud computing security workshop, pages 113–124. ACM, 2011.
[14] Vassiliy Ilyich Nechaev. Complexity of a determinate algorithm for the discrete logarithm. Mathematical Notes, 55(2):165–172, 1994.
[15] Tatsuaki Okamoto and Shigenori Uchiyama. A new public-key cryptosystem as secure as factoring. Advances in Cryptology—EUROCRYPT’98, pages 308–318, 1998.
[16] Pascal Paillier. Public-key cryptosystems based on composite degree residuosity classes. In International Conference on the Theory and Applications of Cryptographic Techniques, pages 223–238. Springer, 1999.
[17] Ronald L Rivest, Adi Shamir, and Leonard Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2):120–126,1978.
[18] Victor Shoup. Lower bounds for discrete logarithms and related problems. In International Conference on the Theory and Applications of Cryptographic Techniques, pages 256–266. Springer, 1997.
[19] Xun Yi, Russell Paulet, and Elisa Bertino. Homomorphic encryption and applications. Springer, 2014.