Improved collusion‐resistant unidirectional proxy re‐encryption scheme from lattice

IET Information SecurityVolume 14, Issue 3 p. 342-351 Research ArticleFree Access Improved collusion-resistant unidirectional proxy re-encryption scheme from lattice Xuyang Wang, Xuyang Wang School of Information Science and Engineering, Southeast University, Sipailou 2, Nanjing, 210096 People's Republic of China Purple Mountain Laboratory, Nanjing, 210096 People's Republic of ChinaSearch for more papers by this authorAiqun Hu, Corresponding Author Aiqun Hu aqhu@seu.edu.cn School of Information Science and Engineering, Southeast University, Sipailou 2, Nanjing, 210096 People's Republic of ChinaSearch for more papers by this authorHao Fang, Hao Fang UPSEC Cyber Inc., Nanjing, 210096 People's Republic of ChinaSearch for more papers by this author Xuyang Wang, Xuyang Wang School of Information Science and Engineering, Southeast University, Sipailou 2, Nanjing, 210096 People's Republic of China Purple Mountain Laboratory, Nanjing, 210096 People's Republic of ChinaSearch for more papers by this authorAiqun Hu, Corresponding Author Aiqun Hu aqhu@seu.edu.cn School of Information Science and Engineering, Southeast University, Sipailou 2, Nanjing, 210096 People's Republic of ChinaSearch for more papers by this authorHao Fang, Hao Fang UPSEC Cyber Inc., Nanjing, 210096 People's Republic of ChinaSearch for more papers by this author First published: 01 May 2020 https://doi.org/10.1049/iet-ifs.2018.5246AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Proxy re-encryption (PRE) is a promising cryptographic structure for pervasive data sharing in cloud-based social networks, which enables a semi-trusted proxy to convert a ciphertext for Alice into a ciphertext for Bob without seeing the corresponding plaintext. Since the proxy is semi-trust, a PRE scheme which can resist the collusion attack will be of great practical value. Jiang et al. in 2015 and Kim and Jeong in 2016 have proposed collusion-resistant PRE (CR-PRE) schemes from the lattice by a similar technique, respectively. However, through the analysis of their schemes, the authors find that both of them have defects in the construction of the re-encryption key, which will lead to the re-encryption ciphertext cannot be decrypted or decrypted error with high probability. In this study, the authors first point out the defects in the work of Jiang et al. 's work and Kim and Jeong's work and propose an improved collusion-resistant unidirectional PRE scheme from lattice, based on learning with errors problems. In addition to solving the defects, CR-PRE still has many useful properties similar to the previous schemes, such as unidirectional, collusion resistant, chosen-plaintext attack secure and so on. 1 Introduction In 1998, Blaze, Bleumer and Strauss [1] introduced a cryptographic structure called proxy re-encryption (PRE) aiming to extend the traditional public key encryption to support the decryption rights delegation, in which a semi-trusted proxy is allowed to transform a ciphertext under Alice's public key into a ciphertext under Bob's public key using a re-encryption key given by Alice. However, the proxy learns nothing about the plaintext or the secret of either Alice or Bob. Usually, we call Alice the delegator and Bob the delegate. Owing to this special property, PRE scheme has found numerous practical applications, particularly in key distribution, distributed file system, secure e-mail list, access control and digital right management [2]. PRE can be categorised into single-hop PRE and multi-hop PRE. If ciphertexts can be transformed from Alice to Bob only, the scheme is a single-hop PRE. If ciphertexts can be transformed from Alice to Bob and to Carol and so on, then the scheme is a multi-hop PRE. In addition, PRE can be further categorised into bidirectional PRE and unidirectional PRE [3]. If a re-encryption key allows ciphertexts to be transformed from Alice to Bob and vice versa, the scheme is bidirectional. Else, if a re-encryption key only allows ciphertexts to be transformed from Alice to Bob or from Bob to Alice, the scheme is unidirectional. 1.1 Related works Following Blaze, Bleumer and Strauss's seminal work which present a bidirectional chosen-plaintext attack (CPA)-secure PRE scheme, many PRE schemes have been proposed. Dodis and Ivan realise unidirectional PRE for EIgamal and RSA first, they also give an IBE scheme by sharing the user's secret key between two parties [4]. Ateniese et al. [2] realise a CPA-secure unidirectional PRE. Later, Libert and Vergnaud [5] realise an RCCA-secure unidirectional PRE. Just like the Bleumer and Strauss's work, these two schemes both rely on the somewhat costly bilinear pairings. Although many PRE schemes still rely on the average-case hardness problems such as integer factorisation problems and the discrete logarithm problems. More and more people are trying to find some new cryptographic primitives. An important reason is that quantum algorithms can solve the integer factorisation problems and discrete logarithm problems [6]. Lattice-based cryptosystem is a potential choice that satisfies the above requirement. Since the security of one cryptosystem depends on the hardness of the problem in the average-case. However, the worst-case lattice problems can be reduced to the average-case lattice problems [7], which means if a polynomial adversary can break the cryptosystems by quantum cryptanalysis, he can also solve any instance of the lattice problems in polynomial time. However, there is no such adversary for the worst-case lattice problems with certain parameters [8]. This gives strong hardness guarantee. Besides this, the lattice-based cryptosystems still have some advantages compared with the factorisation-based and discrete logarithm-based cryptosystems. First, lattice-based cryptosystems are efficient and parallelisable. Second, the lattice-based cryptosystems support homomorphism operations generally. Due to these advantages, a series of PRE schemes from lattice is proposed recently. Aono et al. [9] and Nishimaki et al. [10] realise unidirectional KP-PRE, respectively. Singh, Pandu Rangan and Banerjee realise a PRE-based onidentity [11]. Kirshanova [12] realise a CCA-1 secure unidirectional PRE, which is proved to be only CPA secure, by the analysis of Fan and Liu [13]. In addition, Fan et al. [13] propose a new and improved CCA-1 secure PRE scheme. However, these schemes from lattice cannot resist the collusion attack. Since the proxy is mostly semi-trusted in the practical application, a collusion-resistant PRE (CR-PRE) scheme from lattice is urgently needed. Jiang et al. [14] propose a multi-hop collusion-resistant unidirectional PRE in 2015. Lately, Kim and Jeong [15] proposed a collusion-resistant unidirectional PRE in 2016. They all use a similar technique (see in Section 2.4 for details) to construct the re-encryption key. However, through the analysis of their schemes, we find that both of the two schemes have defects in the construction of the re-encryption key, which will lead to the re-encryption ciphertext cannot be decrypted or decrypted error with high probability. 1.2 Our contributions In this paper, we present the following results. First, as mentioned above, we point out the defects in the schemes of Jiang et al. [14] and Kim and Jeong [15]. The main reason for the defects is because of the inappropriate estimation of the samples. The estimation is only satisfied for samples whose mean is 0. However, the mean for the samples in both the schemes is related to the public key of the re-encryption users. In fact, according to the constraints of the public key, the mean for the samples in both schemes will never be 0. Therefore, this inappropriate estimation will lead to the re-encryption ciphertext cannot be decrypted or decrypted error with high probability. And both of the schemes cannot be easily fixed by themselves. Second, we fix the defects and propose an improved collusion-resistant unidirectional PRE scheme CR-PRE from the lattice. Third, we prove that CR-PRE still maintains almost all the useful properties as before, such as CPA secure, unidirectional, collusion resistant and so on. 2 Preliminaries The real numbers are denoted by , the rationals by , the integers by and the natural by . For a real r, denotes the closest integer to r. For a positive integer n, denotes . The function log denotes the natural logarithm. A non-negative function is called negligible, written , if it vanishes faster than any inverse polynomial, i.e. for every constant . A function is called overwhelming if it is . For a vector , the i th component of is denoted by . The inner product between is . Note that for any . The statistical distance between two distributions X and Y (or two random variables have those distributions, respectively) is defined as . When D is a countable set, we have . If (or for any PPT machine , ), we say the two distributions X and Y are statistically (or computationally) indistinguishable, and denote it by , and distribution X (or a random variable having distribution X) is c -uniform if its statistical distance from the uniform distribution over D is at most c. We write for some unspecified polynomial function in its parameter. 2.1 Lattice Let be a set of n linearly independent vectors in . The lattice generated by is the set of all integer combinations The set is called a basis of the lattice, and its size is the rank. Every lattice has an infinite number of bases generating it. Let be a non-trivial lattice, i.e. it contains at least one non-zero vector . Then a question is naturally occurring: Does there exist a shortest non-zero vector in ? Definition 1 (shortest vector problem (SVP)).Given a size parameter , , find a non-zero vector , such that .Minkowski [16] defined the length of one of the shortest non-zero vectors as the first minimum of the lattice L, denoted by . It was also mentioned that this vector is not necessarily unique; if is a solution, then so is . It is hard to find in a random lattice [8].The ary lattices are widely used in the lattice-based cryptography. Given the matrix for some positive integers q, m, n, lattice and are defined as There is also a definition for the coset which is generated by the columns of Ajtai [7], Alwen and Peikert [17] have shown how to sample an essentially uniform matrix with the short basis for . Lemma 1.Let be any fixed constant. There is a probabilistic polynomial-time algorithm GenBasis that, on input positive integers n, odd and , outputs such that (i) is -uniform over , (ii) is a basic of , (iii) and with overwhelming probability, where , . 2.2 Gaussian distribution The (unnormalised) variance of Gaussian distribution of parameter and mean for , denoted by , is defined by . More generally, by for . The discrete Gaussian distribution over is defined by , and more generally, over a lattice L by . The distribution is usually defined over the lattice or over a coset . For any coset , the discrete Gaussian distribution (centre at ) over the coset assigns probability proportional to to each . Gentry show efficient sampling algorithms which output samples from distributions statistically close to and [18, 19]. Lemma 2.Let be an integer matrix and be a basis for . Then for , and , we have (i) . (ii) There is a probabilistic polynomial-time algorithm SampleD1 that return drawn from a distribution statistically close to . (iii) There is a probabilistic polynomial-time algorithm SampleD2 that return drawn from a distribution statistically close to , where and is real. Recall that if is not empty then for some . 2.3 Small integer solutions (SISs) From the definitions of , a special hard problem can be given [20]. Definition 2 (SIS).Given a size parameter , , and real constant , find a non-zero vector , such that and .SIS has a variant problem, which is to find a short solution to a random inhomogeneous system, specifically, (where both and are uniformly random). Definition 3 (inhomogeneous SIS (ISIS)).Given a size parameter , , , a syndrome and real constant , find a non-zero vector , such that and .Micciancio and Peikert [21] show the reduction from the worst case to SIS, which means SIS is hard enough for certain parameters. Lemma 3.Let and be integers, let be reals, let and for some constant . Then solving SISm,n,q with parameters m, n, q and solutions set is at least as hard as approximating lattice problems in the worst case on n - dimensional lattice to within factors. 2.4 Learning with errors (LWEs) LWE is a special hard problem in the lattice. Regev [22] introduced the LWE problem, first. Before giving the definition of LWE, we give some extra notation. Let be an integral modulus, and be a probability distribution (mainly discrete Guassian distribution) on , uniformly at random, according to the distribution . See details in Appendix 1. Definition 4 (LWEs).Given a size parameter , , the LWE problem is to find the from the arbitrary number of independent samples from the distribution .Clearly, if the number of samples is m, then the LWE problem is equal to find from , where and , i indicate the value is from the i -th times sampling.Besides this, there is also a decisional variant to LWE. Definition 5 (decisional LWEs (dLWEs)).Given a size parameter , , and a set of independent samples from , the dLWE problem is to find where these samples have come from. Return yes if these samples come from and no if they come from the uniform distribution on .Regev [23] gives the relations of LWE and dLWE, he also shows that the reduction from the SVP to LWE, which means LWE is hard enough for certain parameters. Lemma 4.Let , . Assume we have access to a procedure W that for all accepts with probability exponentially close to 1 on inputs from and rejects with probability exponentially close to 1 on inputs from the uniform distribution U. Then, there exists an efficient algorithm Wʹ such that, given samples from for some unknown , outputs with probability exponentially close to 1. Lemma 5.Let be an integer and be a real number in (0,1) such that . Assume there exists an efficient algorithm (possibly quantum) solves LWEm,n,α,q, then there exists a quantum algorithm that approximates the SVP and the shortest independent vectors problems to within in the worst case.In this paper, we also need a special LWE problem, which is LWE with uniformly distributed errors (u-LWE). For sample, we call it u-LWE. Definition 6 (u-LWE).Given a size parameter , , , , , the u-LWE problem is to find the from the arbitrary number of independent samples from the distribution .In 2013, Döttling and Müller [24] gave a result for the magnitude of errors at least [21], where is a positive constant. Lemma 6.Let be a modulus and be an integer with . Let . If there exists a PPT algorithm that solves with non-negligible probability, then there exists an efficient quantum algorithm that approximates the decision version of the SVP (GapSVP) to within in the worst case. 3 PRE and security notions 3.1 Model of PRE Let us recall the syntactic of the unidirectional PRE scheme described in [2]. As of [25], this paper refers to the original ciphertext (input ciphertext) and the re-encrypted ciphertext (output ciphertext) as the second-level ciphertext and the first-level ciphertext, repectively. Definition 7 (Unidirectional PRE).A single-hop unidirectional PRE scheme consists of the following algorithms (Fig. 1 shows the flow chart of the PRE scheme): : This setup algorithm takes security parameter as an input and outputs set params for public parameters used by all parties in the scheme. Fig. 1Open in figure viewerPowerPoint Flow chart of PRE scheme : This key generation algorithm takes the public parameters params and a user identified i as an input and outputs a pair of public and secret keys . : This encryption algorithm takes the public parameters params, user i's public key and a plaintext M as an input and outputs a second-level ciphertext that can be re-encrypted. : This second-level decryption algorithm takes the public parameters params, a pair of public and secret keys () and a second-level decryption ciphertext and outputs a plaintext M or an error symbol . : This first-level decryption algorithm takes the public parameters params, a pair of public and secret keys () and a first-level decryption ciphertext and outputs a plaintext M or an error symbol . : This re-encryption key generation algorithm takes the public parameters params, a user i's public key and secret key , and a user j's public key as an input and outputs a key , which allows converting a second-level ciphertext into a first-level ciphertext . : This re-encryption algorithm takes the public parameters params and a second-level ciphertext , output a first-level ciphertext for the user j. Definition 8 (correctness).For any , any message , any couple of pairs of public and secret keys () of the user i and () of the user j, the PRE scheme is correctness if the following conditions hold 3.2 Secure notions In the subsection, we provide secure notions of PRE. Each notion includes a series of oracle queries. As of [5], the corrupted users and honest users are determined at the beginning of games definition for each notion. 3.2.1 Chosen plaintext attacks secure Let be the security parameter. Let be an oracle TM, representing the adversary. The IND-Uni-CPA game consists of execution of with the following oracles. The game consists of three phases, which are executed in order. Within each phase, each oracle can be executed in any order, times, unless otherwise specified. Setup. The challenger performs Setup() to get the public parameter. Query phase 1 : Public parameter generation queries: The public parameters are generated and given to . This oracle is executed first and only once. Uncorrupted key generation queries: Obtain a new key pair by running KeyGen . is given pk. Let be the set of honest user indices. Corrupted key generation queries: Obtain a new key pair by running KeyGen . is given . Let be the set of corrupt user indices. Query phase 2 : Re-encryption key generation queries: On input by the adversary, where the key pairs for i and j were generated in phase 1, return the key . All requests where or where and are ignored (an output of ). Re-encryption queries: On input , where the keys for i and j were generated in phase 1, return = ReEnc (params, ReKeyGen ). For requests where or where and , output . Challenge: On input , the oracle chooses a random and returns the challenge ciphertext . This oracle can only be queried once, and it is required that . Guess: Eventually, outputs decision . wins the game if and only if . Definition 9 (IND-Uni-CPA Secure).Given security parameter , a PRE scheme is IND-Uni-CPA secure for of messages if it is correct for M and PPT adversaries , a negligible function such that wins the game with advantage at most . 3.2.2 Collusion resistant and master secret security Collusion resistance means that even if a user colludes with a proxy who knows a re-encryption key , they cannot get any information about the first-level ciphertext. This security notion is modelled as a master secret secure in [2]. Definition 10 (Collusion resistant).For any polynomial-time adversaries, if he or they cannot get any information about the first-level ciphertext of the delegator and delegates by even a coalition of other colluding delegates. The PRE scheme is collusion resistance. Definition 11 (Master Secret Security).For any polynomial-time adversaries, if he or they cannot get any information about the long-term secret key of the delegator and delegates by even a coalition of other colluding delegates. The PRE scheme is master secret security.Note that in the master secret security model an adversary should output the secret key of the target user. Thus, if an adversary can break the master secret security, then the adversary can also win . Therefore, the master secret security implies IND-Uni-CPA secure. 4 Schemes analysis and defects In this section, we give analysis to Jiang et al. 's scheme and Kim et al. 's scheme and point out the defects of these schemes, respectively. 4.1 Jiang et al. 's scheme Let us revisit Jiang et al. 's scheme in Appendix 2. It claims that they constructed the first multi-use unidirectional PRE scheme from lattices. Besides this, they claim that their scheme is non-interactive, collusion resistant and CPA secure in the standard model based on the hardness assumption of LWE. Although Jiang et al. 's scheme has many useful properties, there is a defect in their work, and this defect will lead to the re-encryption ciphertext, which cannot be decrypted or decrypted error with high probability. In the re-encryption key generation algorithm of Jiang et al. 's scheme, the ReKeyGen algorithm, they use a pre-image sampleable algorithm SamplePre to obtain a series of pre-image vector from to m, and then obtain . Clearly, the above process is the same as the transformation algorithm Transform (see details in Appendix 1). Later in the decryption algorithm Dec, they need each entry of vector to be smaller than q to decrypt the re-encryption ciphertext correctly. They claim that these inequations can be obtained under the constraint conditions. Also, one of the constraints is . However, through our analysis, we find this constraint cannot be established in the algorithm Transform. We think the authors have misinterpreted the relevant conclusions and this is the reason for this situation. From Appendix 2, we know the algorithm SamplePre is obtained by Lemma 2. More specifically, it is obtained by algorithm SampleD2. The SamplePre need to find a to satisfy , where is an sample from lattice . If is not empty, then for some . Then with an overwhelming probability. Obviously, the range in Lemma 2 cannot ensure unless . In this situation, the norm of or will be larger than q. If this happens, the re-encryption ciphertext will not be decrypted correctly. In fact, because is random in , will not be equal to with an overwhelming probability. Therefore, the correctness of Lemma 2 does not mean the correctness of Jiang et al. 's scheme. In other words, the scheme cannot use the SampleD2 algorithm to ensure . Without this guarantee, the decryption of Jiang et al. 's scheme will no longer correct. Note that the conclusion does not mean they never have a transformation algorithm between any two matrices. First, we can find a transformation matrix between some special matrices in polynomial time, where . For example, if matrix , then unit matrix is a transformation matrix between and . However, the transformation between such matrices basically make no sense. In addition, the adversary can also obtain the transformation matrix in polynomial time for such special matrices. Second, there exists a transformation matrix for all but an at most fraction matrices, where . This is because there is a such that , for every and all but an at most fraction of [19]. However, according to Lemma 3, find a transformation matrix with is at least as hard as approximating lattice problems in the worst case on n -dimensional lattice to within factors. In addition, there is no polynomial-time algorithm for such problems now. Therefore, if the transformation matrix is obtained in polynomial time, then its mean will be not small enough. If its mean is small enough, then this transformation matrix will not be obtained in polynomial time by Lemma 2. So, there is no way to improve the scheme by itself. 4.2 Kim and Jeong's scheme Let us revisit Kim and Jeong's scheme PE in Appendix 3. It claims that they construct the first unidirectional PRE scheme based on LWE. Besides this, Kim and Jeong claim that PE is non-interactive, proxy invisible, key optimal, non-transitive, collusion resistant and CPA secure in the random oracle model based on the hardness assumption of LWE. Similar to Jiang et al. 's scheme, PE use the transformation algorithm, Transform, in the re-encryption algorithm PE.ReKeyGen. From Appendix 1, we know the algorithm Transfrom is also obtained by Lemma 2 and algorithm SampleD2. Therefore, it has the same mistake as Jiang et al. 's scheme. In addition this defect will lead to the re-encryption ciphertext cannot be decrypted or decrypted error with high probability. Specifically, to obtain the re-encryption key , the scheme uses the algorithm Transform in the algorithm PE.ReKeyGen. Lately in the algorithm PE.Dec, they need each entry of vector to be smaller than q to decrypt the re-encryption ciphertext correctly. According to Subsection 4.1, the correctness of Lemma 2 does not mean the correctness of PE, because the vector contains a transformation matrix. In addition, there still is another mistake in Kim and Jeong's paper, the constraint related to decrypt the re-encryption ciphertext still cannot be satisfied in any way. 5 Improved PRE scheme In this section, we give an improved collusion-resistant unidirectional PRE scheme CR-PRE based on u-LWE. The parameters and correctness of these schemes will be discussed later. 5.1 Construction CE.Setup : On input a security parameter , set public parameters, such as m, n, q, r. Output a set of public parameters . CE.KeyGen : To generate a user i 's public key and secret key, CE.KeyGen runs GenBasic algorithm to obtain , short bases of . Set i 's public key , secret key . CE.Enc : To make a second-level ciphertext for a plaintext with a user i 's public key , a sender processes as follows: (i) Chooses a uniformly random non-zero error vector . (ii) Chooses a uniformly random non-zero vectors . (iii) Sets , where . (iv) Outputs a second-level ciphertext . CE.Dec2 : To decrypt the second-level decryption ciphertext user i processes as follows: (i) Computes , because . Furthermore, if , . (ii) Computes . If , output , otherwise, output . CE.ReKeyGen : To generate the re-encryption key from user i to user j, an user i processes as follows: (i) Chooses a uniformly random non-zero matrix , where the first column of is not zero. (ii) Chooses a uniformly random non-zero matrix . (iii) Output the re-encryption key . CE.ReEnc : To convert a second-level ciphertext for user i into a first-level ciphertext , the proxy with re-encryption key , the proxy processes as follows: (i) Compute . (ii) Output re-encryption ciphertext . CE.Dec1 : To decrypt the first-level decryption ciphertext . Just use the re-encryption ciphertext, for example, user j processes as follows: (i) Computes , because . Furthermore, if , . (ii) Computes . If , output , otherwise, output . 5.2 Parameters and correctness In order to ensure the correctness of the CR-PRE scheme, the parameters should satisfy the following constraints: 1. : For such m, n, q, to keep the algorithm GenBasis [7, 17] generates a random lattice and the short basis of dual lattice. 2.1. : For such n, r, q, to keep the correctness of the algorithm CE.Dec2. This is because and , and CE.Dec2 needs and . 2.2. : For such m, n, r, q, to keep the correctness of the algorithm CE.Dec1. This is because , and [26], and CE.Dec1 needs and . For sample, we can combine constraints 2.1 and 2.2, and obtain constraint 2 as follows: 2. : For such m, n, r, q, to keep the correctness of the algorithm CE.Dec1 and CE.Dec2. When the parameters satisfy all the constraints above, we can obtain the correctness of CR-PRE scheme. Corollary 1 (correctness).For any message , CR-PRE scheme decrypts correctly if constraints 1–2 satisfied. Proof.According to the definition of CR-PRE, if we want to obtain public and secret keys in probabilistic polynomial time, we need .When the CR-PRE is constructed, from the Definition 8, we need to prove two different conditions to ensure the correctness of this scheme.According to algorithm CE.Enc, we have CE.Enc (params, pki, M) = .So, CE.Dec2 (params, pki, ski, CE.Enc (params, pki, M) = CE.Dec2 (params, pki, ski, )).Similarly, CE.Dec1 ((params, pkj, skj), CE.ReEnc (params, rki→ j, CE.Enc (params, pki, M))) = CE.Dec1 (params, pkj, skj), CE.ReEnc (params, rki→ j, ) = CE.Dec1 (params, pkj, skj, ).Obviously, the correctness of CR-PRE is equal to algorithms CE.Dec1 and CE.Dec2 decrypt correctly. According to constraint 2, CE.Dec1 and CE.Dec2 both can decrypt correctly.□ In addition to the constraints above, there still are some constraints, which are useful for security results. 3. : For such m, n, r, to keep the worst-case lattice problem (GapSVP) reducing to u-LWE problem [21, 24]. 4. : For such m, n, q, to keep the worst case lattice problem reducing to SIS [21]. 5. : For such and q, to keep SVP reducing to LWE problem [23], where is a real number in (0,1). To satisfy all the above constraints, we can select the parameters for CR-PRE as in Table 1. Table 1.