Calculation device for encryption using public key and encryption method thereof

1. An encryption method executed by a calculation device, the method comprising:

setting a secret key, and generating a public key using the secret key and an error; and

transmitting the public key over a network to an external device, receiving a ciphertext over the network from the external device that encrypts a message, and decrypting the ciphertext using the secret key, or

generating a ciphertext by encrypting a message and transmitting the ciphertext over the network to an external device that decrypts the ciphertext using the secret key,

wherein the encrypting the message comprises:

applying the public key to the message; and

performing a calculation to remove a predetermined number of lower bits of the message to which the public key is applied by multiplying the message to which the public key is applied by p/q and changing a real value of each component of a multiplication result into an integer value closest to the real value, where p is a maximum value of each element of the ciphertext and q is a maximum value of each element of the public key,

wherein the secret key is a random combination from among −1, 0 and 1, and

wherein a size of the error is determined by an error parameter which is greater than 0 and less than 1.

2. The encryption method as claimed in claim 1 , wherein the generating the public key comprises:

calculating a first random matrix (A) including randomly-determined values;

calculating the secret key by randomly combining a column vector of which each component has one value from among −1, 0 and 1 in a matrix form;

extracting the error (E) from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution;

calculating a second random matrix (B) by modulating the first random matrix, the secret key and the error; and

calculating the public key including the first random matrix and the second random matrix.

3. The encryption method as claimed in claim 2 , wherein the encrypting the message comprises:

setting a random vector of which each component has a value of −1, 0 and 1; and

respectively calculating a first value which is obtained by calculating the first random matrix and the random vector, and a second value which is obtained by adding a value obtained by encoding the message to a result value obtained by calculating the second random matrix and the random vector,

wherein the performing the calculation comprises removing a predetermined number of lower bits of each of the first and second values, and generating the ciphertext corresponding to the message.

4. The encryption method as claimed in claim 1 , wherein the generating the public key comprises:

setting a ring which is a set of polynomials with a predetermined coefficient;

calculating the secret key from the ring;

calculating a first random polynomial from the ring;

extracting the error from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution;

calculating a second random polynomial by modulating the error in the first random polynomial and the secret key; and

setting the public key including the first random polynomial and the second random polynomial.

5. The encryption method as claimed in claim 4 , wherein the encrypting the message comprises:

randomly extracting a polynomial of which each coefficient has one value from among −1, 0 and 1; and

respectively calculating a first value which is obtained by calculating the first random polynomial and the polynomial, and a second value which is obtained by adding a value obtained by encoding the message to a result value obtained by calculating the second random polynomial and the polynomial,

wherein the performing the calculation comprises removing a predetermined number of lower bits of each of the first and second values, and generating a ciphertext polynomial corresponding to the message.

6. A calculation device, comprising:

a memory; and

a processor configured to:

set a secret key;

generate a public key using the secret key and an error;

store the secret key and the public key in the memory; and

transmit the public key over a network to an external device, receive a ciphertext over the network from the external device that encrypts a message, and decrypt the ciphertext using the secret key, or

generate a ciphertext by encrypting a message and transmit the ciphertext over the network to an external device that decrypts the ciphertext using the secret key,

wherein in encrypting the message, the processor applies the public key to the message, and then perform a calculation to remove a predetermined number of lower bits of the message to which the public key is applied by multiplying the message to which the public key is applied by p/q and changing a real value of each component of a multiplication result into an integer value closest to the real value, where p is a maximum value of each element of the ciphertext and q is a maximum value of each element of the public key,

wherein the secret key is a random combination from among −1, 0 and 1, and

wherein a size of the error is determined by an error parameter which is greater than 0 and less than 1.

7. The calculation device as claimed in claim 6 , wherein the processor is configured to:

calculate a first random matrix (A) including randomly-determined vectors;

calculate the error (E) from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution;

calculate a second random matrix (B) by modulating the first random matrix, the secret key and the error; and

set the public key including the first random matrix and the second random matrix.

8. The calculation device as claimed in claim 7 , wherein the processor is configured to:

set a random vector of which each component has a value of −1, 0 and 1;

respectively calculate a first value which is obtained by calculating the first random matrix and the random vector, and a second value which is obtained by adding a value obtained by encoding the message to a result value obtained by calculating the second random matrix and the random vector; and

perform a calculation to remove a predetermined number of lower bits of each of the first and second values, and generate the ciphertext corresponding to the message.

9. The calculation device as claimed in claim 8 , wherein the processor is configured to:

set a ring which is a set of polynomials with a predetermined coefficient;

calculate the secret key from the ring;

calculate a first random polynomial from the ring;

extract the error from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution; and

calculate a second random polynomial by modulating the error in the first random polynomial and the secret key, and set the public key including the first random polynomial and the second random polynomial.

10. The calculation device as claimed in claim 9 , wherein the processor is configured to:

randomly extract a polynomial of which each coefficient has one value from among −1, 0 and 1;

respectively calculate a first value which is obtained by calculating the first random polynomial and the polynomial, and a second value which is obtained by adding a value obtained by encoding the message to a result value obtained by calculating the second random polynomial and the polynomial; and

perform a calculation to remove a predetermined number of lower bits of each of the first and second values, and generate a ciphertext polynomial corresponding to the message.

11. The calculation device as claimed in any one of claims 6 to 10 , further comprising:

a communicator for broadcasting the public key stored in the memory,

wherein the processor is configured to, based on another message encrypted by the public key being received, decrypt the received another message to the secret key.

12. A non-transitory computer-readable medium on which a program code is stored, the program code sequentially causing a calculation device to execute the steps for:

calculating a first random matrix (A) including randomly-determined values;

calculating a secret key by randomly combining a column vector of which each component has one value from among −1, 0 and 1 in a matrix form;

calculating an error from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution;

calculating a second random matrix (B) by modulating the first random matrix, the secret key and the error;

setting a public key including the first random matrix and the second random matrix;

transmitting the public key over a network to an external device, receiving a ciphertext over the network from the external device that encrypts a message, and decrypting the ciphertext using the secret key, or

encrypting a message to generate a ciphertext and transmitting the ciphertext over the network to an external device that decrypts the ciphertext using the secret key,

in the encrypting the message, applying the set public key to the message; and

performing a calculation to remove a predetermined number of lower bits of the message to which the public key is applied by multiplying the message to which the public key is applied by p/q and changing a real value of each component of a multiplication result into an integer value closest to the real value, where p is a maximum value of each element of the ciphertext and q is a maximum value of each element of the public key, wherein

a size of the error is determined by an error parameter which is greater than 0 and less than 1.

13. The computer-readable medium as claimed in claim 12 , wherein the program code further performs the steps for:

setting a random vector of which each component has a value of −1, 0 and 1;

respectively calculating a first value which is obtained by calculating the first random matrix and the random vector, and a second value which is obtained by adding a value obtained by encoding the message to a result value obtained by calculating the second random matrix and the random vector; and

calculating the ciphertext corresponding to the message.