Skip to content

Commit

Permalink
docs: Adjust spacing
Browse files Browse the repository at this point in the history
  • Loading branch information
sp301415 committed Feb 14, 2025
1 parent d5bea06 commit 531c94b
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,10 @@ Single-Key parameters of TFHE-go ensure at least 128 bits of security, with boot

### Block Binary Keys

TFHE-go implements block binary distribution[[LMSS23](https://eprint.iacr.org/2023/958)] for sampling secret keys, which may lower the security level. Impacted parameters were carefully adjusted following the authors' security estimation to support 128 bit security. To use uniform binary secret keys like the original TFHE scheme, you can set `BlockSize` to 1.
TFHE-go implements block binary distribution [[LMSS23](https://eprint.iacr.org/2023/958)] for sampling secret keys, which may lower the security level. Impacted parameters were carefully adjusted following the authors' security estimation to support 128 bit security. To use uniform binary secret keys like the original TFHE scheme, you can set `BlockSize` to 1.

### IND-CPA<sup>D</sup> Security
Recently, [[CCP+24](https://eprint.iacr.org/2024/127)] proposed an attack against TFHE over IND-CPA<sup>D</sup> security model. This attack may be effective, often resulting in full key recovery, if bootstrapping failure proabability is high enough. TFHE-go only considers IND-CPA security, and assumes that decrypted plaintexts are not shared with any third parties. If you need such functionality, you must use parameters with lower bootstrapping failure rate.

## Distributed Decryption
In multi-key FHE schemes, decrypting a ciphertext requires all parties to engage in a distributed decryption protocol, which allows parties to obtain decrypted messages without any information leak. However, in multi-key TFHE, this protocol is typically expensive, requring multy-party garbling[[Ben18](https://eprint.iacr.org/2017/1186)] or modified noise flooding[[DDK+23](https://eprint.iacr.org/2023/815)]. For simplicity, TFHE-go assumes the presence of a trusted third party (known as the *Decryptor*) who possesses the secret keys of all parties to decrypt ciphertexts.
In multi-key FHE schemes, decrypting a ciphertext requires all parties to engage in a distributed decryption protocol, which allows parties to obtain decrypted messages without any information leak. However, in multi-key TFHE, this protocol is typically expensive, requring multy-party garbling [[Ben18](https://eprint.iacr.org/2017/1186)] or modified noise flooding [[DDK+23](https://eprint.iacr.org/2023/815)]. For simplicity, TFHE-go assumes the presence of a trusted third party (known as the *Decryptor*) who possesses the secret keys of all parties to decrypt ciphertexts.

0 comments on commit 531c94b

Please sign in to comment.