diff --git a/SECURITY.md b/SECURITY.md index 3413701..742a079 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -9,10 +9,10 @@ Single-Key parameters of TFHE-go ensure at least 128 bits of security, with boot ### Block Binary Keys -TFHE-go implements block binary distribution[[LMSS23](https://eprint.iacr.org/2023/958)] for sampling secret keys, which may lower the security level. Impacted parameters were carefully adjusted following the authors' security estimation to support 128 bit security. To use uniform binary secret keys like the original TFHE scheme, you can set `BlockSize` to 1. +TFHE-go implements block binary distribution [[LMSS23](https://eprint.iacr.org/2023/958)] for sampling secret keys, which may lower the security level. Impacted parameters were carefully adjusted following the authors' security estimation to support 128 bit security. To use uniform binary secret keys like the original TFHE scheme, you can set `BlockSize` to 1. ### IND-CPAD Security Recently, [[CCP+24](https://eprint.iacr.org/2024/127)] proposed an attack against TFHE over IND-CPAD security model. This attack may be effective, often resulting in full key recovery, if bootstrapping failure proabability is high enough. TFHE-go only considers IND-CPA security, and assumes that decrypted plaintexts are not shared with any third parties. If you need such functionality, you must use parameters with lower bootstrapping failure rate. ## Distributed Decryption -In multi-key FHE schemes, decrypting a ciphertext requires all parties to engage in a distributed decryption protocol, which allows parties to obtain decrypted messages without any information leak. However, in multi-key TFHE, this protocol is typically expensive, requring multy-party garbling[[Ben18](https://eprint.iacr.org/2017/1186)] or modified noise flooding[[DDK+23](https://eprint.iacr.org/2023/815)]. For simplicity, TFHE-go assumes the presence of a trusted third party (known as the *Decryptor*) who possesses the secret keys of all parties to decrypt ciphertexts. +In multi-key FHE schemes, decrypting a ciphertext requires all parties to engage in a distributed decryption protocol, which allows parties to obtain decrypted messages without any information leak. However, in multi-key TFHE, this protocol is typically expensive, requring multy-party garbling [[Ben18](https://eprint.iacr.org/2017/1186)] or modified noise flooding [[DDK+23](https://eprint.iacr.org/2023/815)]. For simplicity, TFHE-go assumes the presence of a trusted third party (known as the *Decryptor*) who possesses the secret keys of all parties to decrypt ciphertexts.