E NCR YP T E D ME S S AGE S FR OM T HE HE IGHT S OF CR - - PowerPoint PPT Presentation
E NCR YP T E D ME S S AGE S FR OM T HE HE IGHT S OF CR Y PT OMANIA Craig Gentry, IB M Joint work with Sanjam Garg, Shai Halevi, Amit Sahai, B rent Waters Supported by IAR PA contract number D11PC20202 T CC 2013 T okyo,
A
I give the cloud encrypted program E
For (possibly encrypted) x, cloud can compute E
I can decrypt to recover P(x) Cloud learns nothing about P
Problem…
What if I want
So that the cloud can take some action if P(x) = 1.
Obfus
I give the cloud an “encrypted” program E
For any input x, cloud can compute E
Cloud learns “nothing” about P
B
Difference between obfuscation and FHE
In FHE
Step in right direction? Modify FHE
A zero tes
Seems as powerful as FHE
T
Use a composite N = pq message space Mod-p part for message, mod-q part for randomness
Perhaps more powerful
Control when cloud extracts information E
Difficulty:
Can we enable zero-testing without breaking the FHE
B
E
Given [x], [y], B
E
Sort of like FHE
B
p, output x.
Solvable in sub-exponential time.
T
A(x,y) over elliptic curve with smooth order.
Solvable in quantum polynomial time [vDHI03]
Corollary: FHE
p with a zero test is breakable
Not fatal, but troubling. Anyway, we don’t have a construction of FHE
SWHE
Can evaluate functions of degree bounded by some
SWHE
B
T
Cryptographic bilinear map (for groups)
Groups G1, G2 of order p with generators g1,g2 B
a,g1 b) = g2 ab for all a,b 2 F p.
B
a 1, g1 a 2, g1 a 3 2 G1, and h2 G2,
a 1a 2a 3 or is random.
B
E
a
Cryptographic k-multilinear map (for groups)
Groups G1, …, Gk of order p with generators g1, …, gk Family of maps:
ei,j(gi
a,gj b) = gi+j ab for all a,b 2 F p.
Notation Simplification: e(gi1, …, git) = gi1+...+it.
k-linear DDH: Given g1
a 1,…, g1 a k+1 2 G1, and h2 Gk,
a 1…a k+1 or is random.
k-linear group ≈ Degree-k SWHE
E
For multilinear groups, encoding is deterministic
Zero test is immediate E
For a SWHE
A zero test doesn’t imply an extraction procedure. So, let’s assume an extraction procedure for now.
E
Party i generates level-0 encoding of a i. Party I broadcasts level-1 encoding of a i. E
Secure assuming k-linear DDH: Given g1
a 1,…, g1 a k+1 2
a 1…a k+1. More interesting applications:
Attribute-based encryption for circuits [GGHSW12]. Witness encryption [GGSW13]
n → {0,1}}.
f for the function f.
f,CT
F = simple functions in prior AB
E
For F = circuits, prior schemes have exponential complexity
T
B
L
B
Just like HE
Note: Monotone circuits → general circuits.
p for each wire
p.
rw-awrx, g1bw, gj rw-bwry.
rw-awrx-bwry.
rws for wires at depth j
rws.
rxs for input x.
rws =
s, gj rw-awrx)
rxs , g1aw)
Now we have AB
T
Ciphertexts are “succinct”
Do not grow with size of circuit. Grow with size of input. Grow with depth of circuit (due to our construction of mmaps)
Security: based on k-linear DDH
Interesting concurrent work:
[GVW13] AB
Unlike AB
No “authority” in the system No “secret key” per se
R
R
Suppose we have a black box reduction of WE
Assumption depends on NP instance R
Decision No E
PR
If PK
B
Unnatural geometric maps: Why not the ‘noisy’
E
m (groups) becomes m → E
E
Our encoding system builds on the NT
Zero test: For k-linear maps, we use a level-k zero tester
R
Certain aspects of the “message space” of our encodings
Our params only enable encoding of random elements.
Sufficient for our AB
Ciphertext that encrypts m has form e/ z, where
e is small e = m mod p z is the secret key
T
Public key has encryptions of 1 and 0 (c1 and c0).
Given: CT
1, CT 2 that encrypt m 1,m 2 2
p.
CT
i = ei/ z 2 R q where ei is small and ei = m i mod p. Set CT
1+CT 2 2 R q and m = m 1+m 2 2 R p.
CT
Given: CT
1, CT 2 that encrypt m 1,m 2 2
p.
ci = ei/ z 2 R
q where ei is small and ei = m i mod p. Set CT
1∙CT 2 2 R q and m = m 1∙m 2 2 R p.
CT
Given: CT
1, …, CT t encrypting m 1,…, m t.
CT
i = ei/ z 2 R q where ei is small and ei = m i mod (p). L
1, …, CT t)2 R q, m = f(m 1, …, m t)2 R p
CT
Ciphertext that encrypts m at “level d” has form e/ zd:
e is small e = m mod p z is the secret key
T
How homomorphic?: For any degree-d homogeneous
1, …, m t)
i = ei/ z} of {m i}, if ei’s are
“Noise” – size of numerator – grows exp. with degree.
Works OK
Given level-k encodings CT
1 = e1/ zk and CT 2 = e2/ zk, how
Fact: If they encode same thing, then e1-e2 = 0 mod (p).
Zero-T
a ZT = h∙zk/ p for “medium-size” h (e.g. | h| ≈ q3/ 4) a ZT(CT
1-CT 2) = h(e1-e2)/ p If CT
1, CT 2 encode same thing, then denominator p disappears | h(e1-e2)/ p| is “medium-sized”, unreduced mod q.
a ZT·CT
1 and a ZT·CT 2 have same most significant bits → extract key
Otherwise, denominator p “randomizes” things mod q. Small ideal generator p must be secret. Ideal (p) is public.
L
NT
q of “small”
NT
[L
[Schnorr’93]: 2k-approximates SVP in 2n/ k time (roughly)
Concept of the attack:
T
Zero-testing could actually leak useful information
Attack in practice
Actually, our zero test does leak us
Our m-maps are imperfect Some assumptions that are true for “generic” m-maps
E
Distinguish (f, g, h, fx, gy, hx+y) from (f, g, h, fx, gy, hz). All elements in source group G1, none in target group G2.
k-linear source group assumption:
Source group assumptions false with our m-maps
if params includes level-1 encodings of 0
E
T
T
An “attack” on low-level encodings T
ake a level-i encoding e/ zi for i ≤ k-1 (low-level encoding)
Multiply it with A level-(k-i) encoding of 0 (from params) T
he level-k zero tester
E
xtract useful information about what is encoded
What is leaked? E
mod (p) = m mod (p)
Not m itself – i.e., not a small representative of m’s coset Not a “level-0 encoding” of m Preventing the attack on level-k encodings (p) is public, but small p is secret. No “level-0 encoding” of 0.
“Noisy” cryptographic multilinear maps
SWHE
B
Stronger computational assumptions than NT
Applications:
AB
Witness E
Security
Need more cryptanalysis of our m-maps M-maps based on better assumptions (like L
Applications
Functional encryption? Some types of obfuscation?
Ineffective attack: Multiply the k+1 contributions to
(E
Additional attacks:
T
R
T
i∙ h1 k-i = h∙c0 i∙pi-1∙e1 k-i likely generate I.
B
An attacker can break our scheme with a “small” generator
An attacker that finds a good basis of I can break our
L
k-1-i · c0 · a ZT = (e/ zi) · (a 1/ z)k-1-i · (a 0/ z) · (hzk/ p)
k-1-i · a 0’ · h
e · a 1
k-1-i · a 0’ · h unreduced mod q.
We get e’s coset mod p. We get a “bad level-0 encoding” of m.
A “good” level-i encoding has a small numerator.
Player i’s DH contribution: a level-1 encoding of a i. E
Compute level-(n-1) encodings of 1 and a i: e/ zn-1, e’/ zn-1. Multiply each of them with a zt and h0 = c0p/ z.
We get bec0 and be’c0.
Compute be’c0/ bec0 = e’/ e in R
p to get a i’s coset. Spoofing Player i: If we have a good basis of I, player i’s
T
[GS’02]: Given
a basis of I = (u) for u(x) 2 R
u’s relative norm u(x)ū(x) in the index-2 subfield
Corollary: Set v(x) = u(x)/ ū(x). We can compute v(x)
We know v(x)’s relative norm equal 1.
Attack given a basis of I = (u):
First, compute v(x) = u(x)/ ū(x). Given a basis {u(x)ri(x)} of I, multiply by 1+1/ v(x) to get
Intersect K
Apply lattice reduction to lattice {u(x)si(x) : si(x) 2 R
SL
First attack: T
1∙∙∙m k+1 from params and the parties’ encodings ei/ z. E
E
B
Now numerator’s weight is too large. Must reduce weight
B
Second attack: T
Analysis is similar: relation must have degree ≥ k+1.
Alice Server (Cloud) (Input: data x, key k) “I want 1) the cloud to process my data 2) even though it is encrypted.
R un E val[ f, E nck(x) ] = E nck[f(x)] The e spec ecial sauce! e! For security parameter k, E val’s running should be T ime(f)∙poly(λ)
T his could be encrypted too.
Delegation: Should cost less for Alice to encrypt x and decrypt f(x) than to compute f(x) herself.