Compact Adaptively Secure ABE from -Lin: Beyond NC 1 and Towards NL - - PowerPoint PPT Presentation

โ–ถ
compact adaptively secure abe from lin
SMART_READER_LITE
LIVE PREVIEW

Compact Adaptively Secure ABE from -Lin: Beyond NC 1 and Towards NL - - PowerPoint PPT Presentation

May 25, 2023 163 likes โ€ข588 views

Compact Adaptively Secure ABE from -Lin: Beyond NC 1 and Towards NL Huijia (Rachel) Lin and Ji Luo 1 / 42 Attribute-Based Encryption [SW05] Setup mpk, msk KeyGen msk, sk policy Compact: ct = sk Expressive:

slide-1
SLIDE 1

Compact Adaptively Secure ABE from ๐‘™-Lin: Beyond NC1 and Towards NL

Huijia (Rachel) Lin and Ji Luo

1 / 42

slide-2
SLIDE 2

Attribute-Based Encryption [SW05]

Setup โ†’ mpk, msk KeyGen msk, ๐‘” โ†’ sk Enc mpk, ๐‘ฆ, ๐œˆ โ†’ ct

๐‘ฆ, ct

policy attribute message

  • Correctness. Learn ๐œˆ if ๐‘” ๐‘ฆ โ‰  0

(sk is authorized)

sk

Compact: ct = ๐‘ƒ ๐‘ฆ Expressive: ๐‘” โˆˆ powerful class of functions

Dec sk, ๐‘”, ct, ๐‘ฆ โ†’ ๐œˆ๐‘” ๐‘ฆ

2 / 42

slide-3
SLIDE 3

Attribute-Based Encryption [SW05]

Setup โ†’ mpk, msk KeyGen msk, ๐‘”

๐‘— โ†’ sk๐‘—

Enc mpk, ๐‘ฆ, ๐œˆ โ†’ ct

๐‘ฆ, ct

  • Security. Hide ๐œˆ if ๐‘”

๐‘— ๐‘ฆ = 0 for all ๐‘—

(sk๐‘—โ€™s are unauthorized)

sk๐‘—โ€™s Message is hidden given arbitrary number of unauthorized keys.

Collusion Resistance

3 / 42

slide-4
SLIDE 4

Adaptive IND-CPA Security

Exp๐‘

mpk ๐‘”

๐‘Ÿ

sk๐‘”

๐‘Ÿ

๐‘”

๐‘Ÿ

sk๐‘”

๐‘Ÿ

ct โ† Enc ๐‘ฆ, ๐œˆ๐‘

if for all queried keys ๐‘”

๐‘Ÿ ๐‘ฆ = 0, then Exp0 โ‰ˆ Exp1

๐‘ฆ, ๐œˆ0, ๐œˆ1

4 / 42

slide-5
SLIDE 5

(Weaker) Selective IND-CPA Security

Exp๐‘

mpk ๐‘”

๐‘Ÿ

sk๐‘”

๐‘Ÿ

๐‘”

๐‘Ÿ

sk๐‘”

๐‘Ÿ

๐œˆ0, ๐œˆ1 ct โ† Enc ๐‘ฆ, ๐œˆ๐‘

if for all queried keys ๐‘”

๐‘Ÿ ๐‘ฆ = 0, then Exp0 โ‰ˆ Exp1

๐‘ฆ,

Adaptive Security

5 / 42

slide-6
SLIDE 6

Challenging to have it all

Compactness: ct = ๐‘ƒ ๐‘ฆ Adaptive Security Standard Assumptions

  • Goal. Have it ALL for expressive classes of policies.

Previously, the largest class was ๐Ž๐ƒ๐Ÿ [KW19].

Contribution 1. Extend to ABP.

Arithmetic Branching Programs โŠ‡ NC1, arithmetic computation over โ„ค๐‘ž. NC1 and ABP are non-uniform: Each sk works with attribute of fixed length.

6 / 42

slide-7
SLIDE 7

Challenging to have it all

the first ABE for uniform computation with all above

Contribution 2. L, NL * (log-space Turing machines)

* relaxed compactness ABE for uniform computation: Each sk works with attribute of any length.

Compactness: ct = ๐‘ƒ ๐‘ฆ Adaptive Security Standard Assumptions DFA, NFA (regular languages)

7 / 42

slide-8
SLIDE 8

Related Works: Non-Uniform Model

NOT compact NOT adaptive NON-standard assumptions

all-in-one: compact, adaptive, standard assumptions

[LOSTW10] for MSP [GPSW06] for MSP [GVW13, BGGHNSVV14] for ฮค ๐‘„ poly [LW12] for MSP

๐‘Ÿ-type assumption

[KW19] for NC1 [GW20] for BP concurrent this work for ABP โŸธ ๐‘™-Lin in pairing groups

8 / 42

slide-9
SLIDE 9

Related Works: Uniform Model

NOT compact NOT adaptive NON-standard assumptions

all-in-one: compact, adaptive, standard assumptions [Wat12, Att14, AMY19, GWW19] for DFA [GW20] for DFA concurrent this work for DFA, NFA

  • r
  • r

[GW20] for NFA concurrent beyond finite automata [AS16] for P (FE, based on iO) this work for L, NL ct = ๐‘ƒ ๐‘ฆ ๐‘ˆ๐‘‡2๐‘‡ sk = ๐‘ƒ TM (relaxed compactness)

๐‘™-Lin

9 / 42

slide-10
SLIDE 10

New General Framework

Inner-Product Functional Encryption Arithmetic Key Garbling Scheme ABE

information-theoretic tool

1-ABE

1-key = 1-ciphertext secret-key special randomized encoding computational tool

10 / 42

slide-11
SLIDE 11

1-ABE via AKGS and IPFE

๐œˆ๐‘” ๐‘ฆ

Randomized Encoding Partially Hiding [IW14]

sk๐‘”,๐œˆ ct๐‘ฆ Simple: RE is linear in ๐‘ฆ. Secure: เทฃ ๐œˆ๐‘” ๐‘ฆ hides ๐œˆ beyond ๐œˆ๐‘” ๐‘ฆ . It does not hide ๐‘”, ๐‘ฆ. เทฃ ๐œˆ๐‘” ๐‘ฆ

use ๐œˆ as one-time pad convenience โ€“ ๐œˆ in secret key

compute using IPFE โŸน

11 / 42

AKGS

slide-12
SLIDE 12

Arithmetic Key Garbling Scheme

๐‘”: โ„ค๐‘ž

๐‘œ โ†’ โ„ค๐‘ž

๐‘ฆ โˆˆ โ„ค๐‘ž

๐‘œ

  • 1. Label functions: ๐‘€1, โ€ฆ , ๐‘€๐‘› โ† Garble ๐‘”, ๐œˆ; ๐‘ 
  • 2. Garblings:

โ„“1, โ€ฆ , โ„“๐‘› = ๐‘€1 ๐‘ฆ , โ€ฆ , ๐‘€๐‘› ๐‘ฆ

๐‘”, ๐‘ฆ, โ„“1, โ€ฆ , โ„“๐‘› Eval ๐‘”, ๐‘ฆ, โ„“1, โ€ฆ , โ„“๐‘› = ๐œˆ๐‘” ๐‘ฆ

a.k.a. โ€œlabelsโ€

Security (partial hiding). Sim ๐‘”, ๐‘ฆ, ๐œˆ๐‘” ๐‘ฆ โ†’ โ„“1, โ€ฆ , โ„“๐‘›

not hidden

12 / 42

slide-13
SLIDE 13

Linearity.

  • 1. ๐‘€1, โ€ฆ , ๐‘€๐‘› are linear in ๐‘ฆ:

๐‘€๐‘˜ ๐‘ฆ = ๐‘€๐‘˜, ๐‘ฆ

  • 2. coefficients of ๐‘€1, โ€ฆ , ๐‘€๐‘› are linear in ๐œˆ, ๐‘ 
  • 3. Eval is linear in โ„“1, โ€ฆ , โ„“๐‘›

Arithmetic Key Garbling Scheme

๐‘”: โ„ค๐‘ž

๐‘œ โ†’ โ„ค๐‘ž

๐‘ฆ โˆˆ โ„ค๐‘ž

๐‘œ

  • 1. Label functions: ๐‘€1, โ€ฆ , ๐‘€๐‘› โ† Garble ๐‘”, ๐œˆ; ๐‘ 
  • 2. Garblings:

โ„“1, โ€ฆ , โ„“๐‘› = ๐‘€1 ๐‘ฆ , โ€ฆ , ๐‘€๐‘› ๐‘ฆ

Eval ๐‘”, ๐‘ฆ, โ„“1, โ€ฆ , โ„“๐‘› = ๐œˆ๐‘” ๐‘ฆ ๐‘”, ๐‘ฆ, โ„“1, โ€ฆ , โ„“๐‘› thanks to partial hiding

13 / 42

slide-14
SLIDE 14

Inner-Product Functional Encryption

isk 2 โ† KeyGen msk, ๐’˜ 2 ict 1 โ† Enc msk, ๐’— 1

๐’—, ๐’˜

T

Function-Hiding Property isk ๐’˜1 isk ๐’˜2 โ‹ฏ isk ๐’˜๐ฝ isk ๐’—1 ict ๐’—2 โ‹ฏ ict ๐’—๐พ isk ๐’˜1

โ€ฒ

isk ๐’˜2

โ€ฒ

โ‹ฏ isk ๐’˜๐ฝ

โ€ฒ

isk ๐’—1

โ€ฒ

ict ๐’—2

โ€ฒ

โ‹ฏ ict ๐’—๐พ

โ€ฒ

โ‰ˆ

if ๐’—๐‘—, ๐’˜๐‘˜ = ๐’—๐‘—

โ€ฒ, ๐’˜๐‘˜ โ€ฒ for all ๐‘—, ๐‘˜

Adaptive Security: ฮค isk ict can interleave. Dec

14 / 42

slide-15
SLIDE 15

Pairing-Based IPFE [ALS16, LV16]

isk 2 โ† KeyGen msk, ๐’˜ 2 ict 1 โ† Enc msk, ๐’— 1

๐’—, ๐’˜

T

Asymmetric Pairing Groups ๐ป1: ๐‘ 1 = ๐‘•1

๐‘

๐ป2: ๐‘ 2 = ๐‘•2

๐‘

pairing

  • peration

๐‘๐‘ T = ๐‘•T

๐‘๐‘ โˆˆ ๐ปT

Dec

= pairing

15 / 42

slide-16
SLIDE 16

1-ABE via AKGS and IPFE

sk๐‘”,๐œˆ ct๐‘ฆ

๐‘€1, โ€ฆ , ๐‘€๐‘› โ† Garble ๐‘”, ๐œˆ

= isk ๐‘€๐‘˜

๐‘˜โˆˆ ๐‘›

= ict ๐‘ฆ ๐œˆ๐‘” ๐‘ฆ

T

Eval

linear

IPFE Dec

labels in the exponent

โ„“๐‘˜ = ๐‘€๐‘˜ ๐‘ฆ

T

Intuitions for Security.

  • IPFE โŸน only โ„“๐‘˜โ€™s are revealed
  • AKGS โŸน only ๐œˆ๐‘” ๐‘ฆ is revealed

16 / 42

slide-17
SLIDE 17

Selective Security of 1-ABE

Real World

sk๐‘”,๐œˆ ct๐‘ฆ { isk ( ict ( ๐‘€๐‘˜ ๐‘ฆ ) } )

  • want. ๐œˆ is hidden

s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ โ„“๐‘˜ = ๐‘€๐‘˜ ๐‘ฆ ๐‘€1, โ€ฆ , ๐‘€๐‘› โ† Garble ๐‘”, ๐œˆ

Next step: hardwire labels in secret key

17 / 42

slide-18
SLIDE 18

Hardwire Labels in Secret Key via IPFE

sk๐‘”,๐œˆ ct๐‘ฆ { isk ( ict ( ๐‘ฆ โ„“๐‘˜ 1 ) } ) s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ ๐‘€1, โ€ฆ , ๐‘€๐‘› โ† Garble ๐‘”, ๐œˆ โ„“๐‘˜ = ๐‘€๐‘˜ ๐‘ฆ

  • want. ๐œˆ is hidden

Next step: simulate labels

18 / 42

slide-19
SLIDE 19

Simulate Labels via AKGS

sk๐‘”,๐œˆ ct๐‘ฆ { isk ( ict ( ๐‘ฆ โ„“๐‘˜ 1 ) } ) s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ โ„“1, โ€ฆ , โ„“๐‘› โ† Sim ๐‘”, ๐‘ฆ, ๐œˆ๐‘” ๐‘ฆ

  • want. ๐œˆ is hidden

19 / 42

slide-20
SLIDE 20

s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Adaptive Security?

sk๐‘”,๐œˆ ct๐‘ฆ { isk ( ict ( ๐‘ฆ โ„“๐‘˜ 1 ) } ) โ„“1, โ€ฆ , โ„“๐‘› โ† Sim ๐‘”, ๐‘ฆ, ๐œˆ๐‘” ๐‘ฆ

  • Idea. Rely on special structure of simulator.

need ๐‘ฆ to simulate

20 / 42

slide-21
SLIDE 21

Special Simulation Structure

โ„“1, โ€ฆ , โ„“๐‘› are uniformly random subject to correctness: Eval ๐‘”, ๐‘ฆ, โ„“1, โ€ฆ , โ„“๐‘› = ๐œˆ๐‘” ๐‘ฆ .

Simulator

  • 1. Draw โ„“2, โ€ฆ , โ„“๐‘› โ† โ„ค๐‘ž.
  • 2. Find unique โ„“1 s.t. evaluation is correct.

โ˜บ independent of ๐‘ฆ

Real Garbling

โ˜บ only one label depends on ๐‘ฆ linear constraint

21 / 42

slide-22
SLIDE 22

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Simulation for Adaptive Security

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ ) ) โ„“1 1 isk ( ) โ„“2 โ‹ฎ isk ( ) โ„“๐‘˜

find โ„“1 s.t. Eval ๐‘”, ๐‘ฆ, โ€ฆ = ๐œˆ๐‘” ๐‘ฆ

โ„“2 โ† โ„ค๐‘ž โ„“๐‘˜ โ† โ„ค๐‘ž โ‹ฎ โ‹ฎ

  • Idea. Put โ„“1 in ciphertext

equation depends on ๐‘ฆ

22 / 42

slide-23
SLIDE 23

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Simulation for Adaptive Security

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) 1 isk ( ) โ„“2 โ‹ฎ isk ( ) โ„“๐‘˜ โ„“2 โ† โ„ค๐‘ž โ„“๐‘˜ โ† โ„ค๐‘ž โ‹ฎ โ‹ฎ

find โ„“1 s.t. Eval ๐‘”, ๐‘ฆ, โ€ฆ = 0

23 / 42

slide-24
SLIDE 24

Real World vs. Simulation

Real World Simulation

sk๐‘”,๐œˆ isk ( ๐‘€1 ) sk๐‘”,๐œˆ isk ( 0 1 ) ct๐‘ฆ ict ( ๐‘ฆ ) ct๐‘ฆ ict ( ๐‘ฆ โ„“1 ) 1

๐‘˜ > 1 {isk ( ๐‘€๐‘˜

)}

๐‘˜ > 1 {isk ( 0

)} โ„“๐‘˜

๐‘€1, โ€ฆ , ๐‘€๐‘› โ† Garble ๐‘”, ๐œˆ โ„“1, โ€ฆ , โ„“๐‘› = ๐‘€1 ๐‘ฆ , โ€ฆ , ๐‘€๐‘› ๐‘ฆ โ„“2, โ€ฆ , โ„“๐‘› โ† โ„ค๐‘ž find โ„“1 s.t. Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ = 0

same distribution of labels need same labels to use IPFE honestly generated labels simulated labels

24 / 42

slide-25
SLIDE 25

Bridging the Gap: Piecewise Security

๐‘€1, โ€ฆ , ๐‘€๐‘› โ† Garble ๐‘”, ๐œˆ

โ„“1 is uniquely determined by Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ . Labels are marginally random given subsequent label functions.

for ๐‘˜ > 1 and all ๐‘ฆ: ๐‘€๐‘˜ ๐‘ฆ , ๐‘€๐‘˜+1, โ€ฆ , ๐‘€๐‘› โ‰ก $, ๐‘€๐‘˜+1, โ€ฆ , ๐‘€๐‘›

We show that AKGS for ABP [IW14] is piecewise secure.

piecewise security

25 / 42

slide-26
SLIDE 26

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Adaptive Security of 1-ABE

Real World

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘€1 ๐‘ฆ ) ) isk ( ๐‘€2 ) โ‹ฎ isk ( ๐‘€๐‘˜ ) โ„“1 = ๐‘€1 ๐‘ฆ

Next step: hardwire โ„“1 in ciphertext

26 / 42

slide-27
SLIDE 27

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Hardwire โ„“1 in Ciphertext via IPFE

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) isk ( ๐‘€2 ) โ‹ฎ isk ( ๐‘€๐‘˜ ) โ„“1 = ๐‘€1 ๐‘ฆ

Next step: find unique โ„“1 from correctness equation

27 / 42

slide-28
SLIDE 28

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Find Unique โ„“1 via AKGS

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) isk ( ๐‘€2 ) โ‹ฎ isk ( ๐‘€๐‘˜ )

find โ„“1 s.t. Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ

28 / 42

slide-29
SLIDE 29

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

  • Goal. Simulate โ„“2 as Random

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) isk ( ๐‘€2 โ‹ฎ isk ( ๐‘€๐‘˜ ) โ„“2 = ๐‘€2 ๐‘ฆ

Next step: hardwire โ„“2 in ciphertext

)

find โ„“1 s.t. Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ = 0

29 / 42

slide-30
SLIDE 30

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Hardwire โ„“2 in Ciphertext via IPFE

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) โ„“2 isk ( ) 1 โ‹ฎ isk ( ๐‘€๐‘˜ ) โ„“2 = ๐‘€2 ๐‘ฆ

Next step: replace โ„“2 by random

find โ„“1 s.t. Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ = 0

30 / 42

slide-31
SLIDE 31

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Replace โ„“2 by Random via AKGS

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) โ„“2 isk ( ) 1 โ‹ฎ isk ( ๐‘€๐‘˜ ) โ„“2 โ† โ„ค๐‘ž

find โ„“1 s.t. Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ = 0

Next step: put โ„“2 back into secret key

31 / 42

slide-32
SLIDE 32

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Put โ„“2 Back into Secret Key via IPFE

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) 1 isk ( ) โ„“2 โ‹ฎ isk ( ๐‘€๐‘˜ ) โ„“2 โ† โ„ค๐‘ž

find โ„“1 s.t. Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ = 0

Next step: simulate the other labels

Goal achieved: simulate โ„“2

32 / 42

slide-33
SLIDE 33

โ‹ฎ s.t. ๐‘” ๐‘ฆ = 0 ๐‘ฆ

Adaptive Security of 1-ABE

Final Simulation

sk๐‘”,๐œˆ ct๐‘ฆ isk ( ict ( ๐‘ฆ 1 โ„“1 ) ) 1 isk ( ) โ„“2 โ‹ฎ isk ( ) โ„“๐‘˜ ๐œˆ is hidden

find โ„“1 s.t. Eval โ‹ฏ = ๐œˆ๐‘” ๐‘ฆ = 0

โ„“2 โ† โ„ค๐‘ž โ‹ฎ โ„“๐‘˜ โ† โ„ค๐‘ž โ‹ฎ

33 / 42

slide-34
SLIDE 34

Adaptively Secure 1-ABE

sk ct 1 1 multi-ciphertext security ? make it public-key ?

uses msk multi {

} { isk ( ๐‘€๐‘˜ ) } ict ( ๐‘ฆ )

34 / 42

slide-35
SLIDE 35

Multi-Ciphertext Security

sk { โŸฆ isk ( ๐‘€๐‘˜ ) โŸง2 } ct1 โŸฆ ict ( ๐‘ฆ1 ) โŸง1 ct2 โŸฆ ict ( ๐‘ฆ2 ) โŸง1 โŸฆ๐‘€๐‘˜ ๐‘ฆ1 โŸงT โŸฆ๐‘€๐‘˜ ๐‘ฆ2 โŸงT

  • Problem. Label functions (its randomness) cannot be reused.
  • Idea. Use DDH to rerandomize them.

35 / 42

slide-36
SLIDE 36

Multi-Ciphertext Security

sk { โŸฆ isk ( ๐‘€๐‘˜ ) โŸง2 } ct1 โŸฆ ict ( ๐œ1๐‘ฆ1 ) โŸง1 ct2 โŸฆ ict ( ๐œ2๐‘ฆ2 ) โŸง1 โŸฆ๐œ1๐‘€๐‘˜ ๐‘ฆ1 โŸงT โŸฆ๐œ2๐‘€๐‘˜ ๐‘ฆ2 โŸงT

  • Problem. ๐œ๐‘€๐‘˜ T is not pseudorandom given ๐œ 1, ๐‘€๐‘˜ 2.
  • Idea. Use IPFE to move ๐œ into the same group as ๐‘€๐‘˜โ€™s, then use DDH.
  • Intuition. Label functions are

pseudorandom via DDH.

36 / 42

slide-37
SLIDE 37

Adaptively Secure Secret-Key ABE

sk ct make it public-key ?

uses msk

{ โŸฆ isk ( ๐‘€๐‘˜ ) โŸง2 } โŸฆ ict ( ๐œ๐‘ฆ ) โŸง1

multi {

}

multi {

} multi-ciphertext security Slotted IPFE

37 / 42

slide-38
SLIDE 38

Public-Key ABE via Slotted IPFE

sk { โŸฆ isk ( ๐‘€๐‘˜ ) โŸง2 }

multi {

} IPFE with

public slot private slot

+ ct โŸฆ ict ( ๐œ๐‘ฆ ) โŸง1

multi {

}

Enc using mpk (or msk) Enc needs msk not hidden function-hiding

make it public-key ? make it public-key

for scheme for proof KeyGen needs msk

38 / 42

slide-39
SLIDE 39

ABP for

function-hiding IPFE piecewise secure AKGS 1-ABE full ABE

slotted IPFE ABP for

uniform computation: more challenges

39 / 42

slide-40
SLIDE 40

Ideas for Uniform Model

DFA/NFA/L/NL = matrix multiplication piecewise secure AKGS for each input length unique challenge: # โ„“, ๐’” โˆ ๐‘ฆ ๐‘ˆ๐‘‡2๐‘‡ TM

(or ๐‘ฆ โ‹… TM for DFA/NFA)

ct โˆ ๐‘ฆ ๐‘ˆ๐‘‡2๐‘‡ sk โˆ TM โ‰ช Neither sk nor ct can fit all label functions / labels!

40 / 42

slide-41
SLIDE 41

as if we did Garble ๐‘”, ๐œˆ; ๐’”x โŠ— ๐’”f

Tensoring for Expansion

sk๐‘ ct๐‘ฆ,๐‘ˆ,๐‘‡

# isk, ๐’”f โˆ ๐‘… # ict, ๐’”x โˆ ๐‘‚๐‘ˆ๐‘‡2๐‘‡

IPFE Dec Intuition. ๐’”x โŠ— ๐’”f T โ‰ˆ

DDH ๐’” T

with ๐’”f isk1 isk2 โ‹ฏ isk# with ๐’”x ict1 ict2 โ‹ฎ ict# โ„“11 โ„“21 โ„“12 โ„“22 โ‹ฎ โ„“#1 โ‹ฎ โ„“#2 โ‹ฏ โ‹ฏ โ„“1# โ„“2# โ‹ฑ โ‹ฏ โ‹ฎ โ„“## # โ„“ โˆ ๐‘‚๐‘ˆ๐‘‡2๐‘‡๐‘…

41 / 42

slide-42
SLIDE 42

function-hiding IPFE

ABP DFA/NFA L/NL for

piecewise secure AKGS 1-ABE full ABE

slotted IPFE

ia.cr/2020/318

Thank you!

42 / 42