WO2017041669A1

WO2017041669A1 - Password based key exchange from ring learning with er-rors

Info

Publication number: WO2017041669A1
Application number: PCT/CN2016/097895
Authority: WO
Inventors: Jintai Ding
Original assignee: Jintai Ding
Priority date: 2015-09-08
Filing date: 2016-09-02
Publication date: 2017-03-16
Also published as: US10764042B2; US20180302218A1

Abstract

Use the same basic idea of KE based on Ring LWE, this invention gives con-structions of a new authenticated key exchanges system, where the authentication is achieved through a shared password between two parties. These new systems are effi-cient and have very strong security property including provable security and resistance to quantum computer attacks. This invention can also be modified using the LWE problem.

Description

Password Based Key Exchange from Ring Learning with Er-rors

Background

The present disclosure claims priority to the U.S. provisional patent ap-plication 62/215,186, entitled” Password Based Key Exchange from Ring Learning with Errors” , filed September 8, 2012, whichis incorporatedhereinby reference in its entirety andforallpurposes.

In our modern communication systems like Internet, cell phone, etc, to pro-tect the secrecy of the information concerned, we need to encrypt the message. There are two different ways to do this. In the first case, we use symmetric cryptosystems to perform this task, where the sender uses the same key to encrypt the message as the key that the receiver uses to decrypt the message. Symmetric systems demand that the sender and the receiver have a way to exchange such a shared key securely. In an open communication channel without any central authority, like wireless communica-tion, this demands a way to perform such a key exchange (KE) in the open between two parties. In a system with a central server, like a cell phone system within one cell company, this demands an efficient and easy to use key exchange system between the server and the clients.

This invention is related to the construction of an authenticated key ex-change (KE) systems, where the authentication is achieved using a simple password. Such a system is very useful for many applications, in particular, the case where a client wants to communicate securely with a server, and where the only share secret is the password or certain hash value of a password. We call such a key exchange a password-authenticatedkey exchange (PAKE) .

PAKE systems were proposed in [BMc] , [Mc] , whose security is based on the hardness of discrete logarithm problems. This system can be broken by future quantum computers as showed in the work of Shor [SHO] .

In this invention, we construct new PAKEs that can resist quantum com-puter attacks use the LWE problem. The invention is based on the new KE from the LWE problem first constructed in the US Patent” Cryptographic systems using pairing with errors” with Patent number 9246675.

.

BRIEF SUMMARY OF THE INVENTION

This invention first contains a novel method for two parties i and j to per-form an secure authenticated KE over an open communication channel assuming that they share a secret password π. This method is based on the idea of the computation of pairing of the same bilinear form in two different ways but each with different small errors. The shared key is derived from the pairings with a rounding technique. This method can be viewed as an extension of the idea of the learning with errors (LWE) problem discovered by Regev in 2005 [Reg] and the Ring LWE [LPR] . The security of this system depends the hardness of certain lattice problem, which can be mathe-matically proven hard [DALSS] . This system involves only simple multiplication and therefore is very efficient. Such a system can also resist the future quantum computer attacks.

This invention contains an additive construction of PAKE with either ex-plicit authentication or implicit authentication. Furthermore, this invention can be mod-ified slightly to build multiplicative version.

Though this invention has been described with specific embodiments thereof, it is clear that many variations, alternatives, or modifications will become apparent to those who are skilled in the art ofcryptography. Therefore, the preferred embodiments of the invention as set forth herein, are intended to be illustrative, not limiting. Various changes may be made without departing from the scope and spirit of the invention as set forth herein and defined in the claims. The claims in this invention are based on the U.S. provisional patent application with Ser. No. 62/215,186, entitled” Password Based Key Exchange from Ring Learning with Errors” , filed September 8, 2012, only more technical details are added.

DETAILED DESCRIPTION OF THE INVENTION

1.1 The basic background

The learning with errors (LWE) problem, introduced by Regev in 2005 [Reg] , and its extension, the ring learning with errors (RLWE) problem [LPR] have broad application in cryptographic constructions with some good provable secure prop-erties. The main claim is that they are as hard as certain worst-case lattice problems and hence the related cryptographic constructions.

A LWE problem can be described as follows. First, we have a parameter n, a (prime) modulus q, and an error probability distribution κ on the finite ring (field)

with q elements. To simplify the exposition, we will take q to be an odd prime but we can also work on any whole number except that we may need to make slight modifications.

In

each element is represented by the set {- (q-1) /2, .., 0, ..., (q-1) /2} . In this exposition, by” an error” distribution, we mean a distribution such that if we select an element following this distribution, there is a high probability we will select an element, which is small. There are many such selections and the selections directly affect the security of the system. One should select good error distribution to make sure the system works well and securely.

Let Π_S, κon

be the probability distribution obtained by selecting an element A in

randomly and uniformly, choosing e∈F_q according to κ, and out-putting (A, <A, S>+e) , where+is the addition that is performed in F_q. An algo-rithm that solves the LWE problem with modulus q and error distribution κ, if, for any S in

with an arbitrary number of independent samples from Π_S, κ, it outputs S (with high probability) .

To achieve the provable security of the related cryptographic construc-tions based on the LWE problem, one chooses q to be specific polynomial functions of n, thatis q is replaced by a polynomial functions ofn, which we will denote as q (n) , κto be certain discrete version ofnormal distributioncentered around 0 withthe standard deviation

and elements of F_q are represented by integers in the range [- (q-1) /2, (q-1) /2) ] , which we denote as κ_σ.

In the original encryption system based on the LWE problem, one can only encrypt one bit a time, therefore the system is rather inefficient and it has a large key size. To further improve the efficiency of the cryptosystems based on the LWE problem, anew problem, which is a LWE problem based on a quotient ring of the polynomial ring F_q [x] [LPR] , was proposed. This is called the ring LWE (RLWE) problem. In the cryptosystems based on the RLWE problem, their security is reduced to hard problems on a subclass oflattices, the class ofideal lattices, instead of general lattices.

Later, anew variant of LWE was proposed in [ACPS] . This variant of the LWE problem is based on the LWE problem. We will replace a vector A with a matrix A of size m×n, and S also with a matrix of size n×1, such that they are compatible to perform matrix multiplication A×S. We also replace e with a compatible matrix of size m×1. We will work on the same finite field with q elements.

To simplify the exposition, we will only present PAKE, in detail, for the case using Ring LWE.

For all our constructions, we first define the following notations, which we will use throughout this application. Let n be a power of 2, and f (x) ＝xⁿ+1. Let q≈2^ω (log n) be an odd prime such that q mod 2n＝1. Take

and

as above. For

be a hash function with output distributionχ_γ. Let H₂: {0, 1} ^*→ {0, 1} ^k be the Key Derivation Function (KDF) , where kis the bit-length of the final shared key. We model both functions as random oracles. Letχ_α, χ_βbe two discrete Gaussian distributions with parameters

Let π_i, _j be the shared password of parties i and j, and let h:

be a uniform hash function used to hide the password.

We now define the Sig and Mod₂ functions. We denote

and consider the set

i.e. the “middle” of

Recall that Sig is simply the characteristic function of the complement of E [DiLi] , and that Mod₂:

is defined as:

When Sig, Mod₂ are applied to a ring elements, it will apply to each coefficient of the ring element. Sig was also denoted by Cha before, and they are the same function with different notation.

We will leave off the subscripts onπin what follows when the parties involved are clearfromcontext.

1.1 The construction of the PAKE with explicit authentication

We also take verification hashesη, η^′to ensure both parties are mutually authenticated. Our protocol consists of the following steps, illustrated in Figure 1:

Initiation Party i randomly samples r_i, f_i←χ_β, computes x_i＝ar_i+2f_i, and sends m＝x_i+h (π) to party j.

Response Party j receives x_i+h (π) from party i and recovers x_i＝m-h (π) . Party j then randomly samples r_j, f_j←χ_βand computes y_j＝ar_j+2f_j and k_j＝x_i·r_j.

Next, party j computes w_j＝Sig (k_j) ∈ {0, 1} ² andσ＝Mod₂ (k_j, w_j) . Party j sends y_j, w_j, and κ＝η (i, j, x_i, y_j, σ, π) to party i. Lastly, derives the session key sk_j＝H₂ (i, j, x_i, y_j, w_j, σ) .

Finish Party i computes k_i＝r_i·y_j and κ^′＝η^′ (j, i, x_i, y_j, σ, π) .

Finally, party i computes σ＝Mod₂ (k_i, w_j) and derives the session key sk_i＝H₂ (i, j, x_i, y_j, w_j, σ) . Party i also verifies thatκ＝η (i, j, x_i, y_j, σ, π) matches the value of κ receivedfrom party j. If it does not, party i ends the communica-tion. If it does, party i sends κ^′to party j, who verifies it in the same way.

Figure 1: Explicitly Authenticated Protocol

1.2 The construction of the PAKE with implicit authentication

We construct here a variation of the protocol that gives implicit authenti-cation, similar to the PPK variation on the PAK protocol. If either party provides an incorrect password, then the parties’ “shared” keys will not actually match, effectively preventing communication without explicitly checking for matching passwords.

Next, party j computes w_j＝Sig (k_j) ∈ {0, 1} ². Party j sendsμ＝y_j+h (π) and w_j to party i. Lastly, party j computesσ_j＝Mod₂ (k_j, w_j) and derives the session key sk_j＝H₂ (i, j, x_i, y_j, w_j, σ_j) .

Finish Party i recovers the pair (y_j, w_j) , and uses itcompute k_i＝r_i·y_j.

Finally, party i computesσ_i＝Mod₂ (k_i, w_j) and derives the session key sk_i＝ H₂ (i, j, x_i, y_j, w_j, σ_i) .

Figure 2: Implicitly Authenticated Protocol

1.3 The construction of Multiplicative Version the PAKE

In addition to the two protocols above, we can also blind the protocol messages by multiplying by the hashed password rather than adding as done above. Note that this form only works if h (π) is invertible in the ring, but that condition will usually be met.

Initiation Party i randomly samples r_i, f_i←χ_β, computes x_i＝ar_i+2f_i, and sends m＝x_i·h (π) to partyj.

Response Party j receives x_i·h (π) from party i and recovers x_i＝m·h (π) ^-1. Party j then randomly samples r_j, f_j←χ_βand computes y_j＝ar_j+2f_j and k_j＝x_i·r_j.

Next, partyj computes w_j＝Sig (k_j) ∈ {0, 1} ² andσ＝Mod₂ (k_j, w_j) . Party j sends y_j, w_j, andκ＝η (i, j, x_i, y_j, σ, π) to party i. Lastly, derives the session key sk_j＝H₂ (i, j, x_i, y_j, w_j, σ) .

Finish Party i computes k_i＝r_i·y_j andκ^′＝η^′ (j, i, x_i, y_j, σ, π) .

Finally, party i computesσ＝Mod₂ (k_i, w_j) and derives the session key sk_i＝ H₂ (i, j, x_i, y_j, w_j, σ) . Party i also verifies thatκ＝η (i, j, x_i, y_j, σ, π) matches the value of κ receivedfrom party j. Ifit does not, party i ends the communica-tion. If it does, party i sends κ^′to party j, who verifies itinthe same way.

Figure 3: Multiplicative Protocol

We can also apply themultiplicative variant to the implicitly authenticated version, as described below:

Initiation Party i randomly samples r_i, f_i←χ_β, computes x_i＝ar_i+2f_i, and sends m＝x_i·h (π) to party j.

Next, party j computes w_j＝Sig (k_j) ∈ {0, 1} ². Partyj sendsμ＝y_j·h (π) ^-1 and w_j to party i. Lastly, party j computesσ_j＝Mod₂ (k_j, w_j) and derives the session key sk_j＝H₂ (i, j, x_i, y_j, w_j, σ_j) .

Finish Party i recovers the pair (y_j, w_j) , anduses itcompute k_i＝r_i·y_j.

Figure 4: Multiplicative Implicitly Authenticated Protocol

LITERATURE CITED

[ACPS] B. Applebaum, D. Cash, C. Peikert, A. Sahai； Fast Cryptographic Prim-itives and Circular-Secure Encryption Based on Hard Learning Problems. Advances in Cryptology-CRYPTO 2009, Lecture Notes in Computer Science, Volume 5677 pp 595-618,2009

[BMc] Boyko, V.； P. MacKenzie； S. Patel (2000) . ” Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman” . Advances in Cryptology–Eu-rocrypt 2000, LNCS. Lecture Notes in Computer Science. Springer-Verlag. 1807: 156？ 171.

[COP] D. Coppersmith, Shmuel Winograd, Matrix multiplication via arithmetic progressions, Journal ofSymbolic Computation-Special issue on computational alge-braic complexity archive 9 (3) , pp 251-280, 1990

[DALSS] Jintai Ding, Saed Alsayigh, Jean Lancrenon, Saraswathy RV, Michael Snook, Provably Secure Password Authenticated Key Exchange Based on RLWE for the Post-QuantumWorld, Cryptology ePrint Archive: Report 2016/552

[DiHe] W. Diffie, M. Hellman, New directions in cryptography, IEEE Transactions on Information Theory 22 (6) , pp 644-54, 1976.

[DiLi] J. Ding, X. Lin, A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem, Cryptology ePrint Archive, Report 688, 2012

[LPR] V. Lyubashevsky, C. Peikert, O. Regev, On ideal lattices and learning with errors over rings In Eurocrypt 2010

[Mc] MacKenzie, P. : On the Security of the SPEKE Password-Authenticated Key Exchange Protocol. Cryptology ePrint Archive, Report 2001/057 (2001) ,

http: //eprint. iacr. org/2001/057

[REG] O. Regev, On lattices, learning with errors, random linear codes, and cryp-tography, in Proceedings of the 37th Annual ACM Symposium on Theory of Comput-ing–STOC05, ACM, pp 84-93, 2005

[SHO] P. Shor, Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Journal of Computing 26, pp. 1484-1509, 1997.

Claims

Method for establishing a key exchange over an open channel between a first party i and a second party j with a shared password and explicit authen-tication， comprising：

Set up Party i and Party j openly choose the following parameters and functions. n be a power of 2， and f (x) ＝ xⁿ + 1. q ≈ 2^ω (log n) be an odd prime such that q mod 2n ＝ 1. Take
and
Choose
and
be a hash function with output distribution χ_γ. Choose H₂： {0， 1} ^* → {0， 1} ^k be the Key Derivation Func-tion (KDF) ， where k is the bit-length of the final shared key. Let χ_α， χ_β be two discrete Gaussian distributions with parameters α，
π_i，j be the shared password of parties i and j， and choose h： {0， 1} ^* → R_q be a uniform hash function used to hide the password. We will leave off the subscripts on π in what follows when the parties involved are clearfrom context.

Choose the Sig and Mod₂ functions. We denote
and consider the set
i.e. the “middle” of
Recall that Sig is simply the characteristic function of the complement of E [DiLi] ， and that Mod₂：
is defined as：

When Sig， Mod₂ are applied to a ring elements， it will apply to each coefficient of the ring element.

Initiation Party i randomly samples r_i， f_i ← χ_β， computes x_i ＝ ar_i + 2f_i， and sends m ＝ x_i + h (π) to party j.

Response Party j receives x_i + h (π) from party i and recovers x_i ＝ m-h (π) . Party j then randomly samples r_j， f_j ← χ_β and computes y_j ＝ ar_j + 2f_j and k_j ＝ x_i·r_j. Next， party j computes w_j ＝ Sig (k_j ) ∈ {0， 1} ² and σ ＝ Mod₂ (k_j， w_j ) . Party j sends y_j， w_j， and κ ＝ η (i， j， x_i， y_j， σ， π) to party i. Lastly， derives the session key sk_j ＝ H₂ (i， j， x_i， y_j， w_j， σ) .

Finish Party i computes k_i ＝ r_i·y_j and κ′ ＝ η′ (j， i， x_i， y_j， σ， π) .

Finally， party i computes σ ＝ Mod₂ (k_i， w_j) and derives the session key sk_i ＝ H₂(i， j， x_i， y_j， w_j， σ) . Party i also verifies that κ ＝ η (i， j， x_i， y_j， σ， π) matches the value of κ received from party j. If it does not， party i ends the communica-tion. If it does， party i sends κ′ to party j， who verifies it in the same way.
Method for establishing a key exchange over an open channel between a first party i and a second party j with a shared password and implicit au-thentication， comprising：

Set up Party i and Party j openly choose the following parameters and functions. n be a power of 2， and f (x) ＝ xⁿ + 1. q ≈ 2^ω (log n) be an odd prime such that q mod 2n ＝ 1. Take
and
Choose
and H₁：
be a hash function with output distribution χ_γ. Choose H₂： {0， 1} ^* → {0， 1} ^k be the Key Derivation Func-tion (KDF) ， where k is the bit-length of the final shared key. Let χ_α， χ_β be two discrete Gaussian distributions with parameters α，
π_i，j be the shared password of parties i and j， and choose h： {0， 1} ^* → R_q be a uniform hash function used to hide the password. We will leave off the subscripts on π in what follows when the parties involved are clearfrom context.

Choose the Sig and Mod₂ functions. We denote
and consider the set
i.e. thte “middle” of
Recall that Sig is simply the characteristic function of the complement of E [DiLi] ， and that Mod₂：
is defined as：

When Sig， Mod₂ are applied to a ring elements， it will apply to each coefficient of the ring element.

Initiation Party i randomly samples r_i， f_i ← χ_β， computes x_i ＝ ar_i + 2f_i， and sends m ＝ x_i + h (π) to party j.

Response Party j receives x_i + h (π) from party i and recovers x_i ＝ m-h (π) . Party j then randomly samples r_j， f_j ← χ_β and computes y_j ＝ ar_j + 2f_j and k_j ＝ x_i·r_j. Next， party j computes w_j ＝ Sig (k_j) ∈ {0， 1} ². Party j sends μ ＝ y_j + h (π) and w_j to party i. Lastly， party j computes σ_j ＝ Mod₂ (k_j， w_j ) and derives the session key sk_j ＝ H₂ (i， j， x_i， y_j， w_j， σ_j) .

Finish Party i recovers the pair (y_j， w_j) ， and uses it compute k_i ＝ r_i·y_j.

Finally， party i computes σ_i ＝ Mod₂ (k_i， w_j) and derives the session key sk_i ＝ H₂(i， j， x_i， y_j， w_j， σ_i) .
Method for establishing a key exchange over an open channel between a first party i and a second party j with a shared password and explicit authen-tication by multiplication of hashed password， comprising：

Set up Party i and Party j openly choose the following parameters and functions. n be a power of 2， and f (x) ＝ xⁿ + 1. q ≈ 2^ω (log n) be an odd prime such that q mod 2n ＝ 1. Take
and
Choose
and H₁：
be a hash function with output distribution χ_γ. Choose H₂： {0， 1} ^* → {0， 1} ^k be the Key Derivation Func-tion (KDF) ， where k is the bit-length of the final shared key. Let χ_α， χ_β be two discrete Gaussian distributions with parameters α，
π_i， j be the shared password of parties i and j， and choose h： {0， 1} ^* → R_q be a uniform hash function used to hide the password. We will leave off the subscripts on π in what follows when the parties involved are clearfrom context.

Choose the Sig and Mod₂ functions. We denote
and consider the set
i.e. the “middle” of
Recall that Sig is simply the characteristic function of the complement of E [DiLi] ， and that Mod₂：
is de fined as：

When Sig， Mod₂ are applied to a ring elements， it will apply to each coefficient of the ring element.

Initiation Party i randomly samples r_i， f_i ← χ_β， computes x_i ＝ ar_i + 2f_i， and sends m ＝ x_i·h (π) to party j.

Response Party j receives x_i·h (π) from party i and recovers x_i ＝ m·h (π) ^-1. Party j then randomly samples r_j， f_j ← χ_β and computes y_j ＝ ar_j + 2f_j and k_j ＝ x_i·r_j. Next， party j computes w_j ＝ Sig (k_j) ∈ {0， 1} ² and σ＝ Mod₂ (k_j， w_j ) . Party j sends y_j， w_j， and κ ＝ η (i， j， x_i， y_j， σ， π) to party i. Lastly， derives the session key sk_j ＝ H₂ (i， j， x_i， y_j， w_j， σ) .

Finish Party i computes k_i ＝ r_i·y_j and κ′ ＝ η′ (j， i， x_i， y_j， σ， π) .

Finally， party i computes σ ＝ Mod₂ (k_i， w_j) and derives the session key sk_i ＝ H₂(i， j， x_i， y_j， w_j， σ) . Party i also verifies that κ ＝ η (i， j， x_i， y_j， σ， π) matches the value of κ received from party j. If it does not， party i ends the communica-tion. If it does， party i sends κ′ to party j， who verifies it in the same way.
Method for establishing a key exchange over an open channel between a first party i and a second party j with a shared password and implicit au-thentication by multiplication of hashed password， comprising：

Set up Party i and Party j openly choose the following parameters and functions. n be a power of 2， and f (x) ＝ xⁿ + 1. q ≈ 2^ω (log n) be an odd prime such that q mod 2n ＝ 1. Take
and
Choose
and H₁：
be a hash function with output distribution χ_γ. Choose H₂： {0， 1} ^* → {0， 1} ^k be the Key Derivation Func-tion (KDF) ， where k is the bit-length of the final shared key. Let χ_α， χ_β be two discrete Gaussian distributions with parameters α，
π_i， j be the shared password of parties i and j， and choose h： {0， 1} ^* → R_q be a uniform hash function used to hide the password. We will leave off the subscripts on π in what follows when the parties involved are clear from context.

Choose the Sig and Mod₂ functions. We denote
and consider the set
i.e. the “middle” of
Recall that Sig is simply the characteristic function of the complement of E [DiLi] ， and that Mod₂：
is defined as：

When Sig， Mod₂ are applied to a ring elements， it will apply to each coefficient of the ring element.

Initiation Party i randomly samples r_i， f_i ← χ_β， computes x_i ＝ ar_i + 2f_i， and sends m ＝ x_i·h (π) to party j.

Response Party j receives x_i·h (π) from party i and recovers x_i ＝ m·h (π) ^-1. Party j then randomly samples r_j， f_j ← χ_β and computes y_j ＝ ar_j + 2f_j and k_j ＝ x_i·r_j. Next， party j computes w_j ＝ Sig (k_j) ∈ {0， 1} ². Party j sends μ ＝ y_j·h (π) ^-1 and w_j to party i. Lastly， party j computes σ_j ＝ Mod₂ (k_j， w_j ) and derives the session key sk_j ＝ H₂ (i， j， x_i， y_j， w_j， σ_j) .

Finish Party i recovers the pair (y_j， w_j) ， and uses it compute k_i ＝ r_i·y_j.

Finally， party i computes σ_i ＝ Mod₂ (k_i， w_j) and derives the session key sk_i ＝ H₂ (i， j， x_i， y_j， w_j， σ_i) .
The method according to Claim 1， wherein the ”Set Up” step chooses different parameters (q n， distributions etc) as long as the related Ring LWE problem is hard to solve.
The methods according to Claim 1， wherein the ”Set Up” step choose parameters from the LWE problem instead of the Ring LWE problem， and we will do matrix operation instead of ring element operations and the matrices is rectan-gular or square as long as the matrix multiplication is compatible and the parameters are adjusted accordingly.
The methods according to Claim 1， wherein one of Party i and Party j is a server and the other a client.
The methods according to Claim 1， wherein the rounding tech-nique is replaced with a similar technique.
The method according to Claim 2， wherein the ”Set Up” step chooses different parameters (q n， distributions etc) as long as the related Ring LWE problem is hard to solve.
The methods according to Claim 2， wherein the ”Set Up” step choose parameters from the LWE problem instead of the Ring LWE problem， and we will do matrix operation instead of ring element operations and the matrices is rectan-gular or square as long as the matrix multiplication is compatible and the parameters are adjusted accordingly.
The methods according to Claim 2， wherein one of Party i and Party j is a server and the other a client.
The methods according to Claim 2， wherein the rounding tech-nique is replaced with a similar technique.
The method according to Claim 3， wherein the ”Set Up” step chooses different parameters (q n， distributions etc) as long as the related Ring LWE problem is hard to solve.
The methods according to Claim 3， wherein the ”Set Up” step choose parameters from the LWE problem instead of the Ring LWE problem， and we will do matrix operation instead of ring element operations and the matrices is rectan-gular or square as long as the matrix multiplication is compatible and the parameters are adjusted accordingly.
The methods according to Claim 3， wherein one of Party i and Party j is a server and the other a client.
The methods according to Claim 3， wherein the rounding tech-nique is replaced with a similar technique.
The method according to Claim 4， wherein the ”Set Up” step chooses different parameters (q n， distributions etc) as long as the related Ring LWE problem is hard to solve.
The methods according to Claim 4， wherein the ”Set Up” step choose parameters from the LWE problem instead of the Ring LWE problem， and we will do matrix operation instead of ring element operations and the matrices is rectan-gular or square as long as the matrix multiplication is compatible and the parameters are adjusted accordingly.
The methods according to Claim 4， wherein one of Party i and Party j is a server and the other a client.
The methods according to Claim 4， wherein the rounding tech-nique is replaced with a similar technique.