(Threshold-)CL: (Threshold) Linearly Homomorphic PKE from Class Groups

"Preview Talk" (by team CL) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, I will present the Castagnos-Laguillaumie (CL) encryption scheme, a Linearly Homomorphic Public-Key Encryption (LHE) scheme based on Class Groups of imaginary quadratic fields, as well as its threshold variant, Threshold-CL. Both schemes are submitted to the NIST Threshold Call as Gadgets (category S7). LHE and Threshold-LHE have become key tools for building secure MPC protocols. CL offers a LHE that, compared to Paillier, is more efficient for security levels of 128 bits and above, and gives shorter ciphertexts. CL does not require a trusted setup, thanks to the unique context of class groups, another useful property for secure MPC. The threshold variant, Threshold-CL, is statically secure in the honest majority setting, and provides efficient distributed decryption that scales well with large sets of parties. I will provide a performance overview of CL and Threshold-CL from their implementation in the BICYCL library, and give examples of threshold schemes that make use of CL or Threshold-CL.

Joint work: Cyril Bouvier, Lennart Braun, Guilhem Castagnos, Quentin Combal, Fabien Laguillaumie, Kelsey Melissaris, Ida Tucker.

Suggested readings

• Preview Writeup (PDF): CL and Threshold-CL: (Threshold) Linearly Homomorphic PKE from Class Group
• Practical Fully Secure Unrestricted Inner Product Functional Encryption modulo p (ia.cr/2018/791)
• An Improved Threshold Homomorphic Cryptosystem Based on Class Groups (ia.cr/2024/717)