Anonymous IBE, Leakage Resilience and Circular Security from New Assumptions Zvika Brakerski, Alex Lombardi, Gil Segev, and Vinod Vaikuntanathan
Identity-Based Encryption [Sha84, BF03, Coc01]
Identity-Based Encryption [Sha84, BF03, Coc01]
Identity-Based Encryption [Sha84, BF03, Coc01] To Bob:
Identity-Based Encryption [Sha84, BF03, Coc01] Ciphertext may reveal Bob’s identity To Bob:
Anonymous Identity-Based Encryption [BCOP04] To Bob:
Constructions of IBE Reference Assumption RO? Anonymous? Boneh-Franklin Bilinear Maps Yes Yes Cocks QR Yes No Boneh-Gentry- QR Yes Yes Hamburg + Crescenzo-Saraswat Boneh-Boyen Bilinear Maps No No Boyen-Waters Bilinear Maps No Yes + Gentry Gentry-Peikert- LWE Yes Yes Vaikuntanathan Cash-Hofheinz-Kiltz- LWE No Yes Peikert + Agrawal-Boneh- Boyen
A “Postmodern” Construction of IBE
A “Postmodern” Construction of IBE • [DG17a] Non-black-box construction of IBE from CDH (implied by both DDH and Factoring) • New primitive: Chameleon Encryption
A “Postmodern” Construction of IBE • [DG17a] Non-black-box construction of IBE from CDH (implied by both DDH and Factoring) • New primitive: Chameleon Encryption Questions
A “Postmodern” Construction of IBE • [DG17a] Non-black-box construction of IBE from CDH (implied by both DDH and Factoring) • New primitive: Chameleon Encryption Questions • What about anonymity? [DG] is not anonymous. • IBE from more assumptions? Generic assumptions?
This Work
This Work • Notions/Tools • Compactness of IBE (“weak IBE” full IBE) • Batch Encryption (from which we construct “weak IBE”) • Blindness (to help obtain Anonymous IBE)
This Work • Notions/Tools • Compactness of IBE (“weak IBE” full IBE) • Batch Encryption (from which we construct “weak IBE”) • Blindness (to help obtain Anonymous IBE) • More from CDH : Anonymous IBE from CDH
This Work • Notions/Tools • Compactness of IBE (“weak IBE” full IBE) • Batch Encryption (from which we construct “weak IBE”) • Blindness (to help obtain Anonymous IBE) • More from CDH : Anonymous IBE from CDH • IBE from More : IBE from a variant of the LPN assumption
This Work • Notions/Tools • Compactness of IBE (“weak IBE” full IBE) • Batch Encryption (from which we construct “weak IBE”) • Blindness (to help obtain Anonymous IBE) • More from CDH : Anonymous IBE from CDH • IBE from More : IBE from a variant of the LPN assumption • Leakage-Resilient and KDM secure public key encryption from CDH and LPN
This Work • Notions/Tools • Compactness of IBE (“weak IBE” full IBE) * • Batch Encryption (from which we construct “weak IBE”) • Blindness (to help obtain Anonymous IBE) • More from CDH : Anonymous IBE from CDH * • IBE from More : IBE from a variant of the LPN assumption • Leakage-Resilient and KDM secure public key encryption from CDH and LPN * Also in concurrent work [DGHM18]
Outline • A blueprint for constructing IBE • Batch Encryption • Blindness and Anonymous IBE
A Blueprint for Constructing IBE
A Blueprint for Constructing IBE “IBE” Schemes (supporting T identities) Primitive |mpk| |ct| |sk| Full IBE
A Blueprint for Constructing IBE “IBE” Schemes (supporting T identities) Primitive |mpk| |ct| |sk| Trivial IBE Full IBE
A Blueprint for Constructing IBE “IBE” Schemes (supporting T identities) Primitive |mpk| |ct| |sk| Trivial IBE Weakly Compact IBE Full IBE
A Blueprint for Constructing IBE “IBE” Schemes (supporting T identities) Primitive |mpk| |ct| |sk| Trivial IBE Weakly Compact IBE Full IBE • Theorem: Weakly Compact IBE IBE
A Blueprint for Constructing IBE “IBE” Schemes (supporting T identities) Primitive |mpk| |ct| |sk| Trivial IBE Weakly Compact IBE Full IBE • Theorem: Weakly Compact IBE IBE • Uses ideas from [DG17b] (which obtained adaptively secure IBE from selectively secure IBE)
A Blueprint for Constructing IBE “IBE” Schemes (supporting T identities) Primitive |mpk| |ct| |sk| Trivial IBE Weakly Compact IBE Full IBE • Theorem: Weakly Compact IBE IBE • Uses ideas from [DG17b] (which obtained adaptively secure IBE from selectively secure IBE) • Theorem: “ Batch Encryption” can compress a Trivial IBE scheme into a Weakly Compact IBE scheme
How to construct IBE CDH (LWE) LPN
How to construct IBE Batch Encryption [DG17] (CDH) Step 1 [this work] (LPN) CDH (LWE) LPN
How to construct IBE wIBE Step 2 [this work] Batch Encryption [DG17] (CDH) Step 1 [this work] (LPN) CDH (LWE) LPN
How to construct IBE IBE Step 3 [this work] wIBE Step 2 [this work] Batch Encryption [DG17] (CDH) Step 1 [this work] (LPN) CDH (LWE) LPN
Batch Encryption (taking the “chameleon” out of Chameleon Encryption)
Batch Encryption (taking the “chameleon” out of Chameleon Encryption)
Batch Encryption (taking the “chameleon” out of Chameleon Encryption) • Correctness: for all i . • Security: computationally hidden from Bob.
Batch Encryption (taking the “chameleon” out of Chameleon Encryption) • This is Laconic OT [CDGGMP17] without receiver privacy
Batch Encryption (taking the “chameleon” out of Chameleon Encryption) • This is Laconic OT [CDGGMP17] without receiver privacy • Why is this notion powerful?
Batch Encryption (taking the “chameleon” out of Chameleon Encryption) • This is Laconic OT [CDGGMP17] without receiver privacy • Why is this notion powerful?
Batch Encryption (taking the “chameleon” out of Chameleon Encryption) • Simple black box construction of Leakage-Resilient and KDM secure PKE from Batch Encryption
Constructing Batch Encryption • CDH/Factoring [DG17]. • Hash function is the standard discrete log CRHF. • Encryption is essentially El-Gamal • LWE • Hash function is the standard SIS CRHF. • Encryption is essentially Dual Regev • LPN • CRHF constructed by [BLVW18, YZWGL17] • Encryption is “an LPN analogue to Dual Regev” • Requires noise rate (only quasipolynomially secure)
wIBE from Batch Encryption
wIBE from Batch Encryption • Question: How do you encrypt without the public key? (can’t store T public keys)
wIBE from Batch Encryption • Question: How do you encrypt without the public key? (can’t store T public keys) • Answer: garble the encryption circuit + Batch Encrypt the labels (“Deferred Encryption Paradigm”)
wIBE from Batch Encryption • Question: How do you encrypt without the public key? (can’t store T public keys) • Answer: garble the encryption circuit + Batch Encrypt the labels (“Deferred Encryption Paradigm”)
wIBE from Batch Encryption • Question: How do you encrypt without the public key? (can’t store T public keys) • Answer: garble the encryption circuit + Batch Encrypt the labels (“Deferred Encryption Paradigm”)
How to construct IBE IBE (non-black-box) [this work] wIBE [this work] + Garbled PKE Batch Encryption [DG17] (CDH) [this work] (LPN) CDH LPN
How to construct Anonymous IBE? AnonIBE wAnonIBE “Anonymous” Batch Encryption CDH LPN
How to construct Anonymous IBE? AnonIBE NO wAnonIBE “Anonymous” Batch Encryption CDH LPN
Attack on Anonymity What is the problem? In some intermediate decryption steps, Adversary has the correct secret keys.
Attack on Anonymity What is the problem? In some intermediate decryption steps, Adversary has the correct secret keys.
Attack on Anonymity What is the problem? In some intermediate decryption steps, Adversary has the correct secret keys.
Attack on Anonymity Learns the first two bits of id What is the problem? In some intermediate decryption steps, Adversary has the correct secret keys.
Attack on Anonymity Learns the first two bits of id What is the problem? In some intermediate decryption steps, Adversary has the correct secret keys. We need a notion of wIBE security that holds even against authorized users.
Blind IBE A notion of security that holds even against authorized users. To Bob:
Blind IBE A notion of security that holds even against authorized users. • Semantic Security, and To Bob:
Blind IBE A notion of security that holds even against authorized users. • Semantic Security, and
Blind IBE A notion of security that holds even against authorized users. • Semantic Security, and For random m • * *We actually allow a relaxation of this definition
Blind IBE A notion of security that holds even against authorized users. • Semantic Security, and For random m • * • We build Blind IBE from Blind Batch Encryption • Reminiscent of weak attribute hiding vs. strong attribute hiding for PE *We actually allow a relaxation of this definition
Recommend
More recommend
