Bi-Homomorphic Lattice-Based PRFs and Unidirectional Updatable Encryption

Vipin Singh Sehrawat; Yvo Desmedt

REVIEW 3 major objections 6 minor 56 references

Bi-Homomorphic Lattice-Based PRFs and Unidirectional Updatable Encryption

T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper constructs a lattice-based PRF that is homomorphic in both key and part of the input, and uses it to build updatable encryption whose update tokens cannot undo ciphertext updates.

desk verdict Interesting new definitions and a real open problem, but the central homomorphic identity is false, so the main results collapse. read the letter →

arxiv 1908.09032 v4 pith:XUFXIZLW submitted 2019-08-23 cs.CR

Vipin Singh Sehrawat , Yvo Desmedt This is my paper · ORCID

classification cs.CR MSC 94A60

keywords bi-homomorphicPRFkey-homomorphicinput-homomorphiclearningwitherrorsroundingupdatableencryptionunidirectionalupdatespost-compromisesecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces bi-homomorphic pseudorandom functions: PRFs that remain key-homomorphic and are also homomorphic on a fixed subset of input bits, where the input operation can lengthen the input. It claims a learning-with-errors construction of such a family and proves it pseudorandom under the decision-LWE assumption. The family is then used to build QPC-UE-UU, an updatable encryption scheme with unidirectional updates: tokens can move ciphertexts from one epoch key to the next but cannot be used to move them back. The whole construction hangs on the identity $F'_{S_1+S_2}(z_0,z_1)=F_{S_1}(x)+F_{S_2}(y)+E$ with $\lVert E\rVert_\infty\le 1$, where the right halves of the inputs are combined by an 'almost XOR' operation.

What carries the argument

The machinery is a gadget matrix $G=I_n\otimes g$ with binary decomposition $G^{-1}$ whose output dimension is $d=\lceil\log q\rceil+1$ bits, one more than the usual bit length; the paper claims this extra bit makes $G^{-1}$ additive, $G^{-1}(A_i+A_j)=G^{-1}(A_i)+G^{-1}(A_j)$, by absorbing carries. The recursive tree functions $A_T$, $B^S_T$, and $C^S_T$ build the key and input homomorphism from matrices $A_0,A_1$ and seed $S$, and the 'almost XOR' operation $1\bar{\oplus}1=0$, $0\bar{\oplus}0=00$, $0\bar{\oplus}1=1$ produces the variable input length and the nonce-update token. The identity in the correctness proof is exactly the point where these three ingredients meet.

What would settle it

Take $q=4$, so $l=2$ and $d=3$, with $g=(0,1,2)$. Compute $g^{-1}(1)+g^{-1}(1)=(0,2,0)$ and $g^{-1}(2)=(0,0,1)$; they are unequal, so Equation (4) is false already for the scalar case, and therefore Equation (3) lacks a valid proof. The same test applies entrywise to any matrix pair.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is a PRF family of the form $F_S(y)=\lfloor S^T A_T(y_{\ell h})+R_0(y_{\ell h})G^{-1}(B^S_T(y_{r h}))\rceil_p$, with $A_T$ and $B^S_T$ defined recursively over a full binary tree, together with a companion family $F'$ on the larger domain $\{0,1,\bar{0}\}^{|T|}$. The paper claims that these families are decision-LWE-secure PRFs and that they satisfy approximate bi-homomorphism: for inputs sharing a left half $z_0$, the output at summed keys and almost-XORed right halves equals the sum of the two outputs up to a rounding error bounded by 1. This identity is what carries the unidirectional-update property of the updatable encryption scheme.

Load-bearing premise

The load-bearing premise is that decomposing the sum of two matrices into bits gives the same result as adding their separate bit decompositions; this is what makes the PRF's homomorphic identity and the encryption update formula go through.

Editorial extensions

If this is right

If the construction is sound, updatable encryption gains a genuinely one-way rotation: a host holding the update token can roll ciphertexts forward, but cannot recover the previous epoch's ciphertext from the current ciphertext and the token.
The PRF's security is claimed under decision-LWE, so the resulting updatable encryption scheme would be quantum-safe in the usual cryptographic sense, unlike prior post-compromise schemes based on discrete-log-style assumptions vulnerable to quantum computers.
The restricted left/right variant would supply the first key-homomorphic constrained PRF with variable input length, enabling delegation of evaluation on one fixed side of the input.
Using fresh random nonces per epoch makes the encryption probabilistic while keeping the underlying PRF deterministic, which is what defeats attacks aimed at reusing old nonces.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the additivity of $G^{-1}$ is not a minor technicality; ordinary binary decomposition cannot be made linear over the integers by appending a single bit, because carries can propagate through several positions. Any repair would require a different decomposition, and the security proof would need to be reworked.
If the homomorphic identity fails, the update formula in the proposed scheme no longer produces a ciphertext decryptable under the new epoch key, so the unidirectional-update claim collapses along with it.
The paper's open searchable-encryption idea would test the same identity across multiple servers: the owner combines $t$ PRF outputs and needs the sum to equal the PRF at the combined key and input, so the identical carry problem would reappear there.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the paper introduces genuinely new definitional machinery and aims at a real open problem, but the central homomorphic identity is false, so both the PRF and the updatable-encryption results are unsupported as written.

What is actually new: the KIH/HVL-PRF definitions, the left/right KH-CPRF notion, and the attempt at unidirectional updatable encryption. The construction is a direct extension of the Banerjee-Peikert KH-PRF, which is fine; the paper is transparent about that. The writing is mostly clear, and the UE application is motivated by a real gap in the literature.

The soft spots are not minor. Theorem 2 depends on Eq. (4), the claim that G^{-1}(A_i+A_j)=G^{-1}(A_i)+G^{-1}(A_j). That is false for the standard binary-decomposition gadget. G^{-1} outputs bit vectors; componentwise addition of two bit vectors can produce a 2 in some coordinate, and carries are not represented in the output. The paper tries to fix this by adding an extra leading zero bit, but that does not absorb carries that can ripple more than one position. So the homomorphic identity is not established, and the proof of Theorem 2 fails at its load-bearing step.

Theorem 4 has a separate problem: it argues that F_S is a PRF because it is a sum of four PRF terms with input-dependent coefficients. A sum of correlated PRFs with input-dependent weights is not generally a PRF; the proof would need a hybrid argument over the sum, not a claim about each summand. That is a real gap in the security argument.

The QPC-UE-UU scheme inherits these failures. The update formula in Figure 1 relies on the same cancellation, and it also uses an 'almost-XOR' subtraction that is not defined. Lemma 2 is an informal statement, not a reduction, and it does not establish unidirectionality. I don't see a way to patch these locally; the framework would need a genuinely linear decomposition and a proper security proof for the sum.

That said, the paper is not a waste of time. The definitions are interesting, and if the homomorphism were repaired, the UE idea might work. I would take a look at a revised version if the authors fix the algebra and redo the security reduction.

For peer review: this deserves a serious referee, because the definitions and the open problem are real. But the current version should be rejected; the central claims do not hold up.

Referee Report

3 major / 6 minor

Summary. The paper introduces a new class of pseudorandom functions called bi-homomorphic PRFs, which are simultaneously fully key homomorphic and partially input homomorphic (KIH), with the input homomorphism inducing a variable input length (HVL). The main construction is an LWE-based family inspired by the Banerjee--Peikert key-homomorphic PRF, and the paper claims this family is a secure PRF (Theorem 4), satisfies an approximate key-and-input homomorphic identity (Theorem 2), and yields the first quantum-safe, post-compromise secure updatable encryption scheme with unidirectional updates (QPC-UE-UU, Section 8). The paper also sketches left/right key-homomorphic constrained PRFs with HVL from the same family and an open problem on searchable encryption.

Significance. If the main claims were correct, the paper would introduce a novel and potentially useful primitive: a lattice-based PRF that is simultaneously key homomorphic and partially input homomorphic with variable output length. The application to unidirectional updatable encryption addresses a recognized open problem, and building it from LWE gives a plausible route to post-quantum security. The definitions are clearly presented, and the proposed use of input homomorphism to refresh nonces during key rotation is conceptually interesting. However, the central derivation rests on an incorrect algebraic claim about the binary decomposition function, and the security proof uses an invalid composition argument. Since these issues affect the correctness of the PRF homomorphism, the PRF security proof, and the updatable encryption update formula, the main results are not established as written.

major comments (3)

[Section 4.4, Eq. (4)] The claimed linearity G^{-1}(A_i + A_j) = G^{-1}(A_i) + G^{-1}(A_j) is false for the decomposition function defined in Section 4.2. In that definition, g^{-1}(a) outputs a bit vector whose leading entry x' is fixed to 0, and the gadget vector g has first entry 0, so the leading position cannot absorb a carry out of the top bit. Componentwise addition of two bit vectors yields entries 0, 1, or 2 with no carry propagation, while the binary decomposition of the integer sum requires carries. For example, with q = 8, l = 3, and d = 4, one has g^{-1}(3) + g^{-1}(5) = (0, 2, 1, 1), whereas g^{-1}(3 + 5) = g^{-1}(8) is not defined in Z_8 (or, reducing modulo q, equals g^{-1}(0) = (0, 0, 0, 0)); the two sides are not equal. Equation (4) is exactly the step that converts the sum of two evaluations F_{S_1}(x) + F_{S_2}(y) into F'_{S_1+S_2}(z_0, z_1) in the proof of Theorem 2, so the homomorphic identity is unsupported. The updatable encryption scheme in Section 8 inherits this failure because its update formula relies on the same cancellation.
[Section 5.2, Theorem 4 proof] The proof of Theorem 4 concludes that F_S is a secure PRF because it is written as a sum of terms of the form d_1 * [rounding term 1] + d_2 * [rounding term 2] + d_3 * [rounding term 3] + E, where each individual rounding term is claimed to be a PRF. This does not imply that their sum is a PRF. Pseudorandomness is not closed under addition, especially when the terms share the same seed S and when the coefficients d_1, d_2, d_3 depend on the input length or on x. A valid argument would need a hybrid reduction or an independent-key composition theorem, neither of which is provided. Corollary 4 extends the claim to the family F' without addressing the new C matrices or the extended domain {0, 1, bar-0}^{|T|}, so the security of F' is also not established.
[Section 8, Fig. 1 and Lemma 2] The ciphertext update formula in Fig. 1 is algebraically invalid. The scheme sets Delta N_{e+1} = N_e bar-oplus N_{e+1} and then computes C_{e+1} = C_e - F'_{Delta k}(i, Delta N_{e+1}), and the displayed simplification to F'_{2 k_e - k_{e+1}}(i, N_{e+1}) + m requires both the law N_e - (N_e bar-oplus N_{e+1}) = N_{e+1} and exact cancellation of rounding errors. Subtraction is not defined for the almost-XOR operation, and the asserted law already fails for single bits: 0 - (0 bar-oplus 1) = -1, not 1. Moreover, the almost-homomorphic identity in Theorem 2 holds only up to an error E with ||E||_infty <= 1, and that error is ignored in the update computation, so even a repaired homomorphic identity would not give the exact equality used for decryption. Consequently, the correctness of the update procedure and the unidirectionality proof in Lemma 2 are not supported.

minor comments (6)

[Table 1] The truth table for the almost-XOR operation omits the entry for 1 bar-oplus 0; commutativity presumably gives 1, but this should be stated explicitly.
[Section 4.2] The text says that addition inside g^{-1} and G^{-1} is performed as simple integer operations over Z, but the interaction of this convention with the requirement that g^{-1} output {0,1}^d is never formalized; a precise definition of how sums of bit vectors are decomposed would prevent the ambiguity that surrounds Eq. (4).
[Section 5.2, Observation 2] The displayed equation for the decomposition of F_S(x) contains malformed brace-control text ('/bracehtipupleft', '/bracehtipdownright'), which obscures the intended expression and should be fixed.
[Section 7] The sentence 'Wlog, we demonstrate left' is incomplete, and the paragraph on achieving HVL presents the left and right cases in a confusingly interleaved way; the exposition should be restructured.
[Section 8.1] The symbol d is used both for the bit length d = l + 1 in Section 4.2 and for a data block identifier d_i in Section 8.1; this overloading is confusing and should be resolved.
[Section 8.2] The phrase 'as defined in Corollary 4,z' appears to contain a typo ('4,z' instead of '4'), and should be corrected.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's construction is self-contained against external LWE/BP14 assumptions, and its gaps are correctness flaws rather than circular reductions.

full rationale

The load-bearing claims do not reduce to fitted inputs or to self-citation. Theorem 4's PRF security is argued from decision-LWE and the Banerjee-Peikert Theorem 3, which are external hardness assumptions independent of the target result; the footnote self-citation [53] is only the conference version of the same paper and is not load-bearing. The homomorphic identity of Theorem 2 is checked against the explicit definitions: the C matrices and the almost-XOR table are chosen so that B^{S1}_T + B^{S2}_T aligns with C^{S1+S2}_T, which is standard constructional design rather than a prediction fitted to data. The proof does contain a serious unsupported step: Eq. (4) asserts G^{-1}(A_i+A_j)=G^{-1}(A_i)+G^{-1}(A_j) 'by virtue of the extra bit', but the extra bit x' is defined to be 0, so it cannot absorb carry bits; this makes Eq. (4) false and the homomorphism proof invalid. That is a mathematical correctness gap, not a circular reduction, because the assertion is not an input to the construction nor a renamed output of it. Similarly, the unidirectional-update argument in Lemma 2 depends on the paper's chosen domain Y and almost-XOR semantics; that is a definitional feature of the scheme, and any weakness in it is a security-proof issue, not circularity. No parameter is fitted from data, no external result is replaced by a self-citation, and no uniqueness theorem is imported from the authors' prior work. Therefore the circularity burden is low.

Assumptions & free parameters 0 free parameters · 5 assumptions · 3 invented entities

The paper's actual mathematical input is modest: standard LWE/LWR assumptions and BP14's KH-PRF theorem, plus newly invented operators and matrices designed to make the homomorphism identity true. The invented additivity of G^{-1} is the point where the derivation fails.

assumptions (5)

domain assumption Decision-LWE is hard for the chosen parameters.
Security of the PRF and UE scheme is reduced to decision-LWE; no attack on LWE for these parameters is given.
standard math The LWR reduction and the Banerjee-Peikert KH-PRF theorem apply to the modified decomposition dimension d=l+1.
The paper imports Theorem 3 from [7] and the LWR hardness theorem from [8]; the modification from l to d=l+1 changes the size of matrices.
ad hoc to paper G^{-1} is additive: G^{-1}(A_i+A_j)=G^{-1}(A_i)+G^{-1}(A_j).
Invoked in Section 4.4 Eq. (4); false for binary decomposition under carries. This is the fatal premise.
ad hoc to paper The almost-XOR operation is well-defined, commutative, and cancellative in the ways used by the UE update.
Used in Figure 1 and Lemma 2; no algebraic definition of string-level almost-XOR or proof of the needed identities is given.
ad hoc to paper A sum of PRFs with correlated seeds is a PRF.
Theorem 4 concludes security of F from security of four summand terms; this inference is not generally valid, but the proof depends on it.

invented entities (3)

almost-XOR operation
purpose: Combine right halves of inputs and produce variable-length outputs for HVL
Defined by a four-row truth table; no external validation; required cancellation properties are assumed rather than proved.
C matrices (C1, C0, C_variant)
purpose: Represent sums of B matrices so the homomorphism identity holds by construction
C1=A0+B1 and the two C0 variants are chosen to match B0+B0, B1+B1, and B0+B1 patterns; this bakes the target identity into the definition.
HVL-KIH-PRF family F'
purpose: Serve as the basis for the updatable encryption scheme
The new primitive is the paper's contribution and has no prior instantiation; its security is supposed to follow from LWE.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Bi-Homomorphic Lattice-Based PRFs and Unidirectional Updatable Encryption." pith.science (2026). https://pith.science/paper/XUFXIZLW

@misc{pith2026190809032,
  author       = {Pith},
  title        = {Pith review of: Bi-Homomorphic Lattice-Based PRFs and Unidirectional Updatable Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XUFXIZLW}},
  note         = {Machine review of arXiv:1908.09032}
}

abstract

We define a pseudorandom function (PRF) $F: \mathcal{K} \times \mathcal{X} \rightarrow \mathcal{Y}$ to be bi-homomorphic when it is fully Key homomorphic and partially Input Homomorphic (KIH), i.e., given $F(k_1, x_1)$ and $F(k_2, x_2)$, there is an efficient algorithm to compute $F(k_1 \oplus k_2, x_1 \ominus x_2)$, where $\oplus$ and $\ominus$ are (binary) group operations. The homomorphism on the input is restricted to a fixed subset of the input bits, i.e., $\ominus$ operates on some pre-decided $m$-out-of-$n$ bits, where $|x_1| = |x_2| = n$, and the remaining $n-m$ bits are identical in both inputs. In addition, the output length, $\ell$, of the operator $\ominus$ is not fixed and is defined as $n \leq \ell \leq 2n$, hence leading to Homomorphically induced Variable input Length (HVL) as $n \leq |x_1 \ominus x_2| \leq 2n$. We present a learning with errors (LWE) based construction for a HVL-KIH-PRF family. Our construction is inspired by the key homomorphic PRF construction due to Banerjee and Peikert (Crypto 2014). An updatable encryption scheme allows rotations of the encryption key, i.e., moving existing ciphertexts from old to new key. These updates are carried out via \emph{update tokens}, which can be used by an untrusted party since the update procedure does not involve decryption of the ciphertext. We use our novel PRF family to construct an updatable encryption scheme, named QPC-UE-UU, which is quantum-safe, post-compromise secure and supports unidirectional ciphertext updates, i.e., the update tokens can be used to perform ciphertext updates but they cannot be used to undo already completed updates. Our PRF family also leads to the first left/right key homomorphic constrained-PRF family with HVL.

Figures

Figures reproduced from arXiv: 1908.09032 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 56 canonical work pages

[1]

Functional Encryption for Inner Product Predicat es from Learning with Errors

Shweta Agrawal, David Mandell Freeman, and Vinod Vaikunt anathan. Functional Encryption for Inner Product Predicat es from Learning with Errors. In ASIACRYPT, pages 21–40, 2011

work page 2011
[2]

S imultaneous hardcore bits and cryptography against memory attacks

Adi Akavia, Shaﬁ Goldwasser, and Vinod Vaikuntanathan. S imultaneous hardcore bits and cryptography against memory attacks. In TCC, pages 474–495, 2009

work page 2009
[3]

Learning with Rounding, Revisited

Joël Alwen, Stephan Krenn, Krzysztof Pietrzak, and Danie l Wichs. Learning with Rounding, Revisited. In CRYPTO, pages 57–74, 2013

work page 2013
[4]

Protecting data using client-side encryption, 2 006

Amazon. Protecting data using client-side encryption, 2 006

work page
[5]

Fast Cryptographic Primitives and Circular-Secure En- cryption Based on Hard Learning Problems

Benny Applebaum, David Cash, Chris Peikert, and Amit Saha i. Fast Cryptographic Primitives and Circular-Secure En- cryption Based on Hard Learning Problems. In CRYPTO, pages 595–618, 2009

work page 2009
[6]

Key-homomorphic cons trained pseudorandom functions

Abhishek Banerjee, Georg Fuchsbauer, Chris Peikert, Krz ysztof Pietrzak, and Sophie Stevens. Key-homomorphic cons trained pseudorandom functions. In TCC, pages 31–60, 2015

work page 2015
[7]

New and Improved Key -Homomorphic Pseudorandom Functions

Abhishek Banerjee and Chris Peikert. New and Improved Key -Homomorphic Pseudorandom Functions. In CRYPTO, pages 353–370, 2014

work page 2014
[8]

Pseudo random functions and lattices

Abhishek Banerjee, Chris Peikert, and Alon Rosen. Pseudo random functions and lattices. In EUROCRYPT, pages 719–737, 2012. Bi-Homomorphic Lattice-Based PRFs and Unidirectional Upd atable Encryption 21

work page 2012

Show all 56 references

[9]

Bellare, R

M. Bellare, R. Canetti, and H. Krawczyk. Pseudorandom fun ctions revisited: the cascade construction and its concret e security. In FOCS, pages 514–523, 1996

1996
[10]

On the construction o f variable-input-length ciphers

Mihir Bellare and Phillip Rogaway. On the construction o f variable-input-length ciphers. In FSE, pages 231–244, 1999

1999
[11]

Saarinen, Ludo Tolhuizen, and Zhenfei Zhang

Hayo BaanSauvik Bhattacharya, Scott Fluhrer, Oscar Gar cia-Morchon, Thijs Laarhoven, Ronald Rietman, Markku- Juhani O. Saarinen, Ludo Tolhuizen, and Zhenfei Zhang. Roun d5: Compact and fast post-quantum public-key encryption. In PQCrypto, pages 83–102, 2019

2019
[12]

On the Hardness of Learning with Rounding over Small Modulus

Andrej Bogdanov, Siyao Guo, Daniel Masny, Silas Richels on, and Alon Rosen. On the Hardness of Learning with Rounding over Small Modulus. In TCC, pages 209–224, 2016

2016
[13]

Key homomorphic PRFs and their applications

Dan Boneh, Kevin Lewi, Hart Montgomery, and Ananth Raghu nathan. Key homomorphic PRFs and their applications. In CRYPTO, pages 410–428, 2013

2013
[14]

Constrained pseudorandom fu nctions and their applications

Dan Boneh and Brent Waters. Constrained pseudorandom fu nctions and their applications. In ASIACRYPT, pages 280–300, 2013

2013
[15]

Function al Signatures and Pseudorandom Functions

Elette Boyle, Shaﬁ Goldwasser, and Ioana Ivan. Function al Signatures and Pseudorandom Functions. In PKC, pages 501–519, 2014

2014
[16]

Classical hardness of learning wi th errors

Zvika Brakerski, Adeline Langlois, Chris Peikert, Oded Regev, and Damien Stehlé. Classical hardness of learning wi th errors. STOC, pages 575–584, 2013

2013
[17]

Fully Homomo rphic Encryption from Ring-L WE and Security for Key Depen- dent Messages

Zvika Brakerski and Vinod Vaikuntanathan. Fully Homomo rphic Encryption from Ring-L WE and Security for Key Depen- dent Messages. In CRYPTO, pages 505–524, 2011

2011
[18]

Constrained Key-Homomorphic PRFs from Standard Lattice Assumptions – or: How to Secretly Embed a Circuit in Your PRF

Zvika Brakerski and Vinod Vaikuntanathan. Constrained Key-Homomorphic PRFs from Standard Lattice Assumptions – or: How to Secretly Embed a Circuit in Your PRF. In TCC, pages 1–30, 2015

2015
[19]

Privacy pres erving keyword searches on remote encrypted data

Yan-Cheng Chang and Michael Mitzenmacher. Privacy pres erving keyword searches on remote encrypted data. In Applied Cryptography and Network Security , pages 442–455, 2005

2005
[20]

Anamaria Costache and Nigel P. Smart. Homomorphic encry ption without gaussian noise. IACR Cryptology ePrint Archive , 163, 2017

2017
[21]

Searchable symmetric encryption: improved deﬁnitio ns and eﬃcient constructions

Reza Curtmola, Juan Garay, Seny Kamara, and Rafail Ostro vsky. Searchable symmetric encryption: improved deﬁnitio ns and eﬃcient constructions. In ACM conference on Computer and communications security , pages 79–88, 2006

2006
[22]

Saber: Module-L WR based key exchange, CPA-secure encryption and CCA-secure kem

Jan-Pieter D’Anvers, Angshuman Karmakar, Sujoy Sinha R oy, and Frederik Vercauteren. Saber: Module-L WR based key exchange, CPA-secure encryption and CCA-secure kem. In AFRICACRYPT, pages 282–305, 2018

2018
[23]

Everspaugh, K.G

A. Everspaugh, K.G. Paterson, T. Ristenpart, and S. Scot t. Key rotation for authenticated encryptionkey rotation f or authenticated encryption. In CRYPTO, pages 98–129, 2017

2017
[24]

Trapdoors for hard lattices and new cryptograp hic constructions

Craig Gentry, Chris Peikert, and Vinod Vaikuntanathan C raig Gentry. Trapdoors for hard lattices and new cryptograp hic constructions. In STOC, pages 197–206, 2008

2008
[25]

Secure indexes

Eu-Jin Goh. Secure indexes. Cryptology ePrint Archive, Report 2003/216 , 2003

2003
[26]

How to construct random functions

Oded Goldreich, Shaﬁ Goldwasser, and Silvio Micali. How to construct random functions. Journal of the ACM (JACM) , 33:792–807, Oct. 1986

1986
[27]

Reusable garbled circ uits and succinct functional encryption

Shaﬁ Goldwasser, Yael Kalai, Raluca Ada Popa, Vinod Vaik untanathan, and Nickolai Zeldovich. Reusable garbled circ uits and succinct functional encryption. In STOC, pages 555–564, 2013

2013
[28]

Managing data encryption, 2019

Google. Managing data encryption, 2019

2019
[29]

N. J. Hopper and M. Blum. Secure human identiﬁcation prot ocols. In ASIACRYPT, pages 52–66, 2001

2001
[30]

Juels and S

A. Juels and S. A. Weis. Authenticating pervasive device s with human protocols. In CRYPTO, pages 293–308, 2005

2005
[31]

Parallel and D ynamic Searchable Symmetric Encryption

Seny Kamara and Charalampos Papamanthou. Parallel and D ynamic Searchable Symmetric Encryption. In Financial Cryptography and Data Security , pages 258–274, 2013

2013
[32]

D ynamic searchable symmetric encryption

Seny Kamara, Charalampos Papamanthou, and Tom Roeder. D ynamic searchable symmetric encryption. In CCS, pages 965–976, 2012

2012
[33]

Katz, J.S

J. Katz, J.S. Shin, and A. Smith. Parallel and concurrent security of the HB and hb+ protocols. Journal of Cryptology , 2010. 22 V. S. Sehrawat and Y. Desmedt

2010
[34]

Smooth project ive hashing and password-based authenticated key exchange from lattices

Jonathan Katz and Vinod Vaikuntanathan. Smooth project ive hashing and password-based authenticated key exchange from lattices. In ASIACRYPT, pages 636–652, 2009

2009
[35]

Delegatable pseudorandom fun ctions and applications

Aggelos Kiayias, Stavros Papadopoulos, Nikos Triandop oulos, and Thomas Zacharias. Delegatable pseudorandom fun ctions and applications. In CCS, pages 669–684, 2013

2013
[36]

Kiltz, K

E. Kiltz, K. Pietrzak, D. Cash, A. Jain, and D. Venturi. Eﬃ cient authentication from hard learning problems. In EURO- CRYPT, pages 7–26, 2011

2011
[37]

UC-Secure searchab le symmetric encryption

Kaoru Kurosawa and Yasuhiro Ohtaki. UC-Secure searchab le symmetric encryption. In Financial Cryptography and Data Security, pages 285–298, 2012

2012
[38]

Updatable encryption w ith post-compromise security

Anja Lehmann and Björn Tackmann. Updatable encryption w ith post-compromise security. In EUROCRYPT, pages 685–716, 2018

2018
[39]

Computationally Eﬃcient Search able Symmetric Encryption

Peter Van Liesdonk, Saeed Sedghi, Jeroen Doumen, Pieter Hartel, and Willem Jonker. Computationally Eﬃcient Search able Symmetric Encryption. In Workshop on Secure Data Management , pages 87–100, 2010

2010
[40]

Fiat-shamir with aborts: Applicat ions to lattice and factoring-based signatures

Vadim Lyubashevsky. Fiat-shamir with aborts: Applicat ions to lattice and factoring-based signatures. In ASIACRYPT, pages 598–616, 2009

2009
[41]

Lattice Signatures without Trapdo ors

Vadim Lyubashevsky. Lattice Signatures without Trapdo ors. In EUROCRYPT, pages 738–755, 2012

2012
[42]

On id eal lattices and learning with errors over rings

Vadim Lyubashevsky, Chris Peikert, and Oded Regev. On id eal lattices and learning with errors over rings. In EUROCRYPT, 2010

2010
[43]

Hardness of sis an d lwe with small parameters

Daniele Micciancio and Chris Peikert. Hardness of sis an d lwe with small parameters. In CRYPTO, pages 21–39, 2013

2013
[44]

Distributed Pseudo-random Functions and KDCs

Moni Naor, Benny Pinkas, and Omer Reingold. Distributed Pseudo-random Functions and KDCs. In EUROCRYPT, pages 327–346, 1999

1999
[45]

Synthesizers and their appl ication to the parallel construction of pseudo-random func tions

Moni Naor and Omer Reingold. Synthesizers and their appl ication to the parallel construction of pseudo-random func tions. Journal of Computer and System Sciences , pages 336–375, 1999

1999
[46]

A noiseless key-homomorphic prf: Application on distribut ed storage systems

Jhordany Rodriguez Parra, Terence Chan, and Siu-Wai Ho. A noiseless key-homomorphic prf: Application on distribut ed storage systems. In Australasian Conference on Information Security and Priva cy, pages 505–513, 2016

2016
[47]

Public-key cryptosystems from the worst -case shortest vector problem

Chris Peikert. Public-key cryptosystems from the worst -case shortest vector problem. STOC, pages 333–342, 2009

2009
[48]

Eﬃcient collision-resist ant hashing from worst-case assumptions on cyclic lattices

Chris Peikert and Alon Rosen. Eﬃcient collision-resist ant hashing from worst-case assumptions on cyclic lattices . In TCC, pages 145–166, 2006

2006
[49]

A Framework for Eﬃcient and Composable Oblivious Transfer

Chris Peikert, Vinod Vaikuntanathan, and Brent Waters. A Framework for Eﬃcient and Composable Oblivious Transfer. In CRYPTO, pages 554–571, 2008

2008
[50]

Pietrzak

K. Pietrzak. Subspace L WE. In TCC, pages 548–563, 2012

2012
[51]

On lattices, learning with errors, random li near codes, and cryptography

Oded Regev. On lattices, learning with errors, random li near codes, and cryptography. In STOC, pages 84–93, 2005

2005
[52]

Lattice-based blind signatures

Markus Rückert. Lattice-based blind signatures. In ASIACRYPT, pages 413–430, 2010

2010
[53]

Bi-Homomorphic La ttice-Based PRFs and Unidirectional Updatable Encryption

Vipin Singh Sehrawat and Yvo Desmedt. Bi-Homomorphic La ttice-Based PRFs and Unidirectional Updatable Encryption . In CANS, volume 11829, pages 3–23. LNCS, Springer, 2019

2019
[54]

How to share a secret

Adi Shamir. How to share a secret. Communications of the ACM , 22:612–613, Nov. 1979

1979
[55]

P. W. Shor. Algorithms for quantum computation: discret e logarithms and factoring. In FOCS, pages 124–134, 1994

1994
[56]

Pra ctical techniques for searches on encrypted data

Dawn Xiaodong Song, David Wagner, and Adrian Perrig. Pra ctical techniques for searches on encrypted data. In IEEE Symposium on Security and Privacy , pages 44–55, 2000

2000

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Functional Encryption for Inner Product Predicat es from Learning with Errors

Shweta Agrawal, David Mandell Freeman, and Vinod Vaikunt anathan. Functional Encryption for Inner Product Predicat es from Learning with Errors. In ASIACRYPT, pages 21–40, 2011

work page 2011

[2] [2]

S imultaneous hardcore bits and cryptography against memory attacks

Adi Akavia, Shaﬁ Goldwasser, and Vinod Vaikuntanathan. S imultaneous hardcore bits and cryptography against memory attacks. In TCC, pages 474–495, 2009

work page 2009

[3] [3]

Learning with Rounding, Revisited

Joël Alwen, Stephan Krenn, Krzysztof Pietrzak, and Danie l Wichs. Learning with Rounding, Revisited. In CRYPTO, pages 57–74, 2013

work page 2013

[4] [4]

Protecting data using client-side encryption, 2 006

Amazon. Protecting data using client-side encryption, 2 006

work page

[5] [5]

Fast Cryptographic Primitives and Circular-Secure En- cryption Based on Hard Learning Problems

Benny Applebaum, David Cash, Chris Peikert, and Amit Saha i. Fast Cryptographic Primitives and Circular-Secure En- cryption Based on Hard Learning Problems. In CRYPTO, pages 595–618, 2009

work page 2009

[6] [6]

Key-homomorphic cons trained pseudorandom functions

Abhishek Banerjee, Georg Fuchsbauer, Chris Peikert, Krz ysztof Pietrzak, and Sophie Stevens. Key-homomorphic cons trained pseudorandom functions. In TCC, pages 31–60, 2015

work page 2015

[7] [7]

New and Improved Key -Homomorphic Pseudorandom Functions

Abhishek Banerjee and Chris Peikert. New and Improved Key -Homomorphic Pseudorandom Functions. In CRYPTO, pages 353–370, 2014

work page 2014

[8] [8]

Pseudo random functions and lattices

Abhishek Banerjee, Chris Peikert, and Alon Rosen. Pseudo random functions and lattices. In EUROCRYPT, pages 719–737, 2012. Bi-Homomorphic Lattice-Based PRFs and Unidirectional Upd atable Encryption 21

work page 2012