Dynamic Decentralized Functional Encryption Jrmy Chotard, Edouard - - PowerPoint PPT Presentation

▶
dynamic decentralized functional encryption
SMART_READER_LITE
LIVE PREVIEW

Dynamic Decentralized Functional Encryption Jrmy Chotard, Edouard - - PowerPoint PPT Presentation

Mar 12, 2023 177 likes •667 views

Dynamic Decentralized Functional Encryption Jrmy Chotard, Edouard Dufour Sans , Romain Gay, Duong Hieu Phan, and David Pointcheval CRYPTO 2020, Monday August 17th 2020 The technological landscape of the early 21st century Lots of data. +

slide-1
SLIDE 1

Dynamic Decentralized Functional Encryption

Jérémy Chotard, Edouard Dufour Sans, Romain Gay, Duong Hieu Phan, and David Pointcheval

CRYPTO 2020, Monday August 17th 2020

slide-2
SLIDE 2

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

The technological landscape of the early 21st century

  • Lots of data.
  • Increasing parallel computing power.
  • Investments in Machine Learning talent.

+ Much better software products.

  • Privacy concerns.
slide-3
SLIDE 3

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Can we protect privacy without sacrificing the benefits of modern data science?

slide-4
SLIDE 4

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Isn’t that what FHE is for?

  • In FHE, a client sends a ciphertext to a server.
  • The server obliviously computes on the ciphertext.
  • The client gets back the result.
  • Multiparty extensions exist.
  • But no non-interactive way for server to extract intelligence from multiparty data.
slide-5
SLIDE 5

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Allowing a server to aggregate my data with that of other users, non-interactively.

Today’s Topic

slide-6
SLIDE 6

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

The Agenda

  • How does DDFE relate to FE?
  • What is DDFE?
  • Construction of DSum-DDFE
  • Construction of AoNE-DDFE
  • Construction of IP-DDFE
slide-7
SLIDE 7

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

A Brief History of Functional Encryption

Public Key Encryption [Cocks 1973, RSA 1977] Identity-Based Encryption [BF 2001, Cocks 2001] Attribute-Based Encryption [SW 2004, GPSW 2006] Functional Encryption [SW 2008, O’Neill 2010, BSW 2011]

slide-8
SLIDE 8

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Functional Encryption is a framework

  • PKE is not a special case of IBE.


It is a weaker primitive.

  • IBE is not a special case of ABE.


It is a weaker primitive.

  • IBE and ABE are special cases of FE.
slide-9
SLIDE 9

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Functional Encryption for Multiple Users

Multi Input / Multi Client Function Encryption [GGJS 13, GKLSZ 13] Decentralized Multi Client Functional Encryption [CDGPP 18] Ad Hoc Multi Input Functional Encryption [ACFGOT 19] Dynamic Decentralized Functional Encryption

slide-10
SLIDE 10

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

The Agenda

  • How does DDFE relate to FE? ✓
  • What is DDFE?
  • Construction of DSum-DDFE
  • Construction of AoNE-DDFE
  • Construction of IP-DDFE
slide-11
SLIDE 11

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Informally

Alice Bob Charlie Diane

slide-12
SLIDE 12

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Informally

Alice Bob Charlie Diane

We want to train a 10000-layer deep Convolutional Neural Network to do image classification from your photos

Not Very Evil Corp™

slide-13
SLIDE 13

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Ok, but I care about my privacy…

DDFE - Informally

Alice Bob Charlie Diane

Ok, but I care about my privacy… Ok, but I care about my privacy… Ok, but I care about my privacy…

slide-14
SLIDE 14

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Informally

Alice Bob Charlie Diane

Date: 3/1/2020
 To be aggregated with data from Alice, Bob, and Diane Date: 3/1/2020
 To be aggregated with data from Bob, Charlie, and Diane Date: 3/1/2020
 To be aggregated with data from Alice, Charlie, and Diane Date: 3/1/2020
 To be aggregated with data from Alice, Bob, and Charlie

slide-15
SLIDE 15

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Informally

Not Very Evil Corp™

Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data

I cannot learn anything from this data, it’s encrypted!

slide-16
SLIDE 16

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Informally

Alice Bob Charlie Diane

Allow training of Neural Network on data from Me, Bob, Charlie, Diane Allow training of Neural Network on data from Alice, Bob, Me, Diane Allow training of Neural Network on data from Alice, Me, Charlie, Diane Allow training of Neural Network on data from Alice, Bob, Charlie, Me

slide-17
SLIDE 17

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Informally

Not Very Evil Corp™

Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data

Now it’s on!

Allow training of Neural Network on data from Me, Allow training of Neural Network on data from Alice, Allow training of Neural Network on data from Alice, Allow training of Neural Network on data from Alice,
slide-18
SLIDE 18

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Informally

Not Very Evil Corp™

Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data Date: 3/1/2020
 To be aggregated with data Allow training of Neural Network on data from Me, Allow training of Neural Network on data from Alice, Allow training of Neural Network on data from Alice, Allow training of Neural Network on data from Alice,
slide-19
SLIDE 19

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Formally

  • A Functionality
  • : Generate public parameters.
  • : Generate my public/private key pair.
  • : Generate a ciphertext

.

  • : Generate a functional key

.

  • : Evaluate

.

ℱ : ℒ(𝒬𝒧 × 𝒧) × ℒ(𝒬𝒧 × ℳ) → {0,1}* Setup(λ) pk, skpk ← KeyGen() Encrypt(skpk, m) ctpk DKeyGen(skpk, k) dkpk,k Decrypt((dkpk,kpk)pk∈𝒱K, (ctpk)pk∈𝒱M) ℱ

slide-20
SLIDE 20

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Functionality examples

  • 


Set of users and a circuit

  • 


An image, a date, a set

  • f users

𝒧 = 𝒯(𝒬𝒧) × 𝒟

ℳ = ℐmages × 𝒠ates × 𝒯(𝒬𝒧)

Allow training of Neural Network on data from Me, Bob, Charlie, Diane Date: 3/1/2020
 To be aggregated with data from Bob, Charlie, and Diane

slide-21
SLIDE 21

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DDFE - Functionality examples

  • is the same for all cts
  • is the same for

all keys

𝒱M = 𝒱K = 𝒱 Date

NN_training

Allow training of Neural Network on data from Me, Bob, Charlie, Diane Date: 3/1/2020
 To be aggregated with data from Bob, Charlie, and Diane

ℱ((pk, (𝒱, NN_training))pk∈𝒱, (pk, (xpk, Date, 𝒱))pk∈𝒱) = NN_training((xpk)pk∈𝒱)

slide-22
SLIDE 22

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

The Agenda

  • How does DDFE relate to FE? ✓
  • What is DDFE? ✓
  • Construction of DSum-DDFE
  • Construction of AoNE-DDFE
  • Construction of IP-DDFE
slide-23
SLIDE 23

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: The functionality

  • Sums over an Abelian Group

.

  • 


A group element, a set of users, a label.

  • 


No keys.

  • 𝔹

ℳ = 𝔹 × 𝒯(𝒬𝒧) × {0,1}* 𝒧 = ∅ ℱ(ϵ, (pk, (xpk, 𝒱, ℓ))pk∈𝒱) = ∑

pk∈𝒱

xpk

slide-24
SLIDE 24

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

If the user can compute
 a mask such that 
 
 , 
 then they can just publish


pk rpk,𝒱,ℓ ∈ 𝔹 ∑

pk′ ∈𝒱

rpk′

,𝒱,ℓ = 0

xpk + rpk,𝒱,ℓ

slide-25
SLIDE 25

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Can we sample from

in a decentralized and non-interactive way?

(rpk)pk∈𝒱 ∑

pk∈𝒱

rpk = 0

slide-26
SLIDE 26

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Sum-of-PRFs [Waters in CC09]

  • Computational solution.
  • Compute shared randomnesses

via DH.

  • Compute

as




Kpk,pk′ rpk,𝒱,ℓ ∑

pk′ ∈ 𝒱 pk′ < pk

FKpk,pk′ (ℓ) − ∑

pk′ ∈ 𝒱 pk < pk′

FKpk,pk′ (ℓ)

slide-27
SLIDE 27

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie

slide-28
SLIDE 28

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie

I learn nothing.

slide-29
SLIDE 29

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie

slide-30
SLIDE 30

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie




xBob = 5 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

slide-31
SLIDE 31

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie




xBob = 5 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

I learn that .

xAlice + xBob = 8

slide-32
SLIDE 32

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie

slide-33
SLIDE 33

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie




x′

Alice = 20 ∈ ℤ232

𝒱 = {Alice, Bob} ℓ = Today

slide-34
SLIDE 34

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie




x′

Alice = 20 ∈ ℤ232

𝒱 = {Alice, Bob} ℓ = Today

I should learn nothing.

slide-35
SLIDE 35

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

DSum-DDFE: Technical Difficulties

Alice Bob




xAlice = 3 ∈ ℤ232 𝒱 = {Alice, Bob} ℓ = Today

Charlie




x′

Alice = 20 ∈ ℤ232

𝒱 = {Alice, Bob} ℓ = Today

I learn that

x′

Alice + rAlice,𝒱,ℓ − xAlice − rAlice,𝒱,ℓ = x′ Alice − xAlice = 17

slide-36
SLIDE 36

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

All-or-Nothing Encapsulation: The functionality

  • 


L bits of data, a set of users, a label.

  • 


No keys.

  • ℳ = {0,1}L × 𝒯(𝒬𝒧) × {0,1}*

𝒧 = ∅ ℱ(ϵ, (pk, (xpk, 𝒱, ℓ))pk∈𝒱) = (pk, xpk)pk

slide-37
SLIDE 37

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

All-or-Nothing Encapsulation solves the problem of an adversary abusing linear structure without getting enough ciphertexts for the Finalize condition to kick in.

slide-38
SLIDE 38

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

layers of IBE encryption on identity + my key for identity

|𝒱| ℓ ℓ

All-or-Nothing Encapsulation from IBE

slide-39
SLIDE 39

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

All-or-Nothing Encapsulation from [BF01] has

succinct ciphertexts

[Paper]

slide-40
SLIDE 40

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

The Agenda

  • How does DDFE relate to FE? ✓
  • What is DDFE? ✓
  • Construction of DSum-DDFE ✓
  • Construction of AoNE-DDFE ✓
  • Construction of IP-DDFE
slide-41
SLIDE 41

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Inner Product DDFE: The functionality

  • Inner Products over

.

  • 


A scalar, a set of users, a label.

  • 


Weights over a set of users

  • ℤp

ℳ = ℤp × 𝒯(𝒬𝒧) × {0,1}* 𝒧 = {(pk, ypk)pk∈𝒱|𝒱 ∈ 𝒯(𝒬𝒧)}

ℱ((pk, (pk′ , ypk′ )pk′

∈𝒱)pk∈𝒱, (pk, (xpk, 𝒱, ℓ))pk∈𝒱) = ∑ pk∈𝒱

xpkypk

slide-42
SLIDE 42

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Inner Product MCFE: Basic idea [CDGPP 18]

  • : secret key
  • :
  • :
  • :


 


KeyGen() s ← ℤp Encrypt(s, (x, 𝒱, ℓ)) gx ⋅ ℋ(𝒱||ℓ)s DKeyGen((spk)pk∈𝒱, (ypk′ , pk′ )pk′

∈𝒱) ∑ pk∈𝒱

spkypk Decrypt(dk, (pk, cpk)pk∈𝒱) ∏

pk∈𝒱

cypk

pk /ℋ(ℓ)dk = ∏ pk∈𝒱

(gxpk ⋅ ℋ(𝒱||ℓ))

ypk

/ℋ(ℓ)∑pk∈𝒱 spkypk = g ∑pk∈𝒱 xpkypk

slide-43
SLIDE 43

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

How do we distribute key generation?

slide-44
SLIDE 44

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

How do we distribute key generation? The key is a sum of the , just use DSum!

ypkspk

slide-45
SLIDE 45

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

How do we protect against repeated queries?

slide-46
SLIDE 46

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

How do we protect against repeated queries? Same as DSum, with AoNE!

slide-47
SLIDE 47

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Going from scalar messages to vector messages requires IPFE and another use

  • f AoNE [Paper].

ℤp ℤd

p

slide-48
SLIDE 48

Edouard Dufour Sans Dynamic Decentralized Functional Encryption CRYPTO 2020

Recap: Our contributions

IP-DDFE DSum All-or-Nothing Encapsulation

DDFE

IBE NIKE Groups