如今認證機制已經在眾多領域被採用。但目前大多數認證機制都是基於傳統密碼元件，而眾所周知,傳統密碼元件無法抵抗量子電腦的攻擊。為了有效解決量子電腦攻擊問題，學者Ajtai的團隊在1996年提出了基於格的密碼技術。據我們研究調查發現，目前現有的基於格的公開金鑰加密技術名為NTRU加密技術。該加密技術是由Hoffstein，Pipher和Silverman三位學者於1998年提出。目前現有的基於格的認證機制中並沒有給出具體的安全性證明，只有安全性分析。並且這些機制都只是針對單一用戶的情形。基於以上問題，我們提出了一個基於格的群組認證機制及其安全性之證明。

Authentication has been adopted in many areas. But most of these authentication schemes are built on traditional cryptographic primitives. It is widely believed that such primitives are not resistant to quantum algorithms. To deal with those quantum attacks, lattice-based cryptography has been introduced by Ajtai in 1996. To the best of our knowledge, the existing lattice-based authentication schemes are based on a lattice-based public key encryption called NTRU encryption, proposed by Hoffstein, Pipher, and Silverman in 1998. However, the security the existing schemes has not been formally proven, where only some discussions in security were provided. Besides, these schemes only support the case of single user. In view of aforementioned issues, we propose a lattice-based group authentication scheme with formal security proof.

論文審定書i
Acknowledgments iii
摘要iv
Abstract v
List of Figures viii
List of Tables ix
Chapter 1 Introduction 1
1.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Chapter 2 Preliminaries 3
2.1 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2 Lattices [1] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.3 The Gaussian Sampling Algorithm: SampleD [2] . . . . . . . . . . . . . . . . . 4
2.4 The Basis Delegation Algorithm: BasisDel [3] . . . . . . . . . . . . . . . . . . . 5
2.5 Security Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Chapter 3 Related Works 10
3.1 NTRU cryptosystem[4] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.2 Moustaine et al.’s Lattice-Based Authentication Scheme for Low-Cost RFID [5] 11
3.3 Park et al.’s Mutual Authentication Scheme Based on Lattice for the NFC-PCM
Payment Service Environment [6] . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Chapter 4 Our Construction 15
4.1 The Proposed Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.1.1 Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.1.2 Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4.1.3 Group Joining . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4.1.4 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Chapter 5 Security Proof and Analysis 18
5.1 Security Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
5.2 Security Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.3 Discussions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Chapter 6 Performance Comparisons 28
Chapter 7 Conclusion 30
Bibliography 31

[1] P. J. Mahabir and S. N. Reihaneh, “Compact accumulator using lattices,” in International
Conference on Security, Privacy, and Applied Cryptography Engineering, pp. 347–358,
Springer, 2015.
[2] C. Gentry, C. Peikert, and V. Vaikuntanathan, “Trapdoors for hard lattices and new cryptographic
constructions,” in Proceedings of the fortieth annual ACM symposium on Theory
of computing, pp. 197–206, ACM, 2008.
[3] D. Cash, D. Hofheinz, E. Kiltz, and C. Peikert, “Bonsai trees, or how to delegate a lattice
basis,” in Eurocrypt, vol. 6110, pp. 523–552, Springer, 2010.
[4] J. Hoffstein, J. Pipher, and J. H. Silverman, “Ntru: A ring-based public key cryptosystem,”
in International Algorithmic Number Theory Symposium, pp. 267–288, Springer, 1998.
[5] E. E. Moustaine and M. Laurent, “A lattice-based authentication for low-cost rfid,” in
RFID-Technologies and Applications (RFID-TA), 2012 IEEE International Conference
on, pp. 68–73, IEEE, 2012.
[6] Park, Sung-Wook, Lee, and Im-Yeong, “Mutual authentication scheme based on lattice
for nfc-pcm payment service environment,” International Journal of Distributed Sensor
Networks, p. 9471539, 2016.
[7] P. W. Shor, “Algorithms for quantum computation: Discrete logarithms and factoring,”
in Foundations of Computer Science, 1994 Proceedings., 35th Annual Symposium on,
pp. 124–134, Ieee, 1994.
[8] M. Ajtai, “Generating hard instances of lattice problems,” in Proceedings of the twentyeighth
annual ACM symposium on Theory of computing, pp. 99–108, ACM, 1996.
[9] J. Alwen, “Generating shorter bases for hard random lattices,” Theory of Computing Systems,
vol. 48, no. 3, pp. 535–553, 2011.
[10] D. Micciancio, “Trapdoors for lattices: Simpler, tighter, faster, smaller,” in EuroCrypt,
vol. 7237, pp. 700–718, Springer, 2012.
[11] M. Bellare and P. Rogaway, “Entity authentication and key distribution,” in Crypto,
vol. 93, pp. 232–249, Springer, Springer, 1993.
[12] R. Cramer and V. Shoup, “A practical public key cryptosystem provably secure against
adaptive chosen ciphertext attack,” in Advances in Cryptology—CRYPTO’98, pp. 13–25,
Springer, Springer, 1998.
[13] R. Cramer and V. Shoup, “Design and analysis of practical public-key encryption schemes
secure against adaptive chosen ciphertext attack,” SIAM Journal on Computing, vol. 33,
no. 1, pp. 167–226, 2003.
[14] S. K. Sahu and A. Kushwaha, “Performance analysis of symmetric encryption algorithms
for mobile ad hoc network,” International Journal of Emerging Technology and Advanced
Engineering IJETAE, vol. 4, no. 6, 2014.
[15] Follath, “Gaussian sampling in lattice based cryptography,” Tatra Mountains Mathematical
Publications, vol. 60, no. 1, pp. 1–23, 2014.
[16] K. Gaj, E. Homsirikamol, and M. Rogawski, “Fair and comprehensive methodology for
comparing hardware performance of fourteen round two sha-3 candidates using fpgas,” in
CHES, pp. 264–278, Springer, 2010.
[17] H. S. Min, O. S. Yeop, and Y. Hyunsoo, “New modular multiplication algorithms for fast
modular exponentiation,” in International Conference on the Theory and Applications of
Cryptographic Techniques, pp. 166–177, Springer, 1996.
[18] D. Micciancio and O. Regev, “Lattice-based cryptography,” in Post-quantum cryptography,
pp. 147–191, Springer, 2009.
[19] H. Krawczyk, M. Bellare, and R. Canetti, “Hmac: Keyed-hashing for message authentication,”
1997.