Impossibility Results for Lattice-Based Functional Encryption Schemes Akın Ünal ETH Zürich, Zürich, Switzerland auenal@inf.ethz.ch (Work done while the author was at KIT – Karlsruhe Institute of Technology, Karlsruhe, Germany.) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 1
Uniformly Random Public Matrices Learning with Errors [Reg05] A cryptographic hardness assumption… mod 𝑟 A A e s A b × + ≈ c Secret Vector with Gaussian Distributed Sufficient Entropy Noise Vector | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 2
Learning with Errors [Reg05] A cryptographic hardness assumption… mod 𝑟 A A e s A b × + ≈ c with strong homomorphic properties which enables a lot of different cryptographic primitives: ▪ Fully Homomorphic Encryption [BV11] ▪ Lockable Obfuscation [GKW17, WZ17] ▪ Attribute-Based Encryption [GVW13, BGG+14] | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 2
Learning with Errors [Reg05] A cryptographic hardness assumption… mod 𝑟 A A e s A b × + ≈ c with strong homomorphic properties which enables a lot of different cryptographic primitives: ▪ Fully Homomorphic Encryption [BV11] ▪ Lockable Obfuscation [GKW17, WZ17] But what about Functional Encryption? ▪ Attribute-Based Encryption [GVW13, BGG+14] | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 2
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] Compact Cubic FE (Non-Compact ✓ ✓ Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] Compact Cubic FE (Non-Compact Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] Compact Cubic FE (Non-Compact ✓ ✓ Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] Compact Cubic FE (Non-Compact ✓ ✓ Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] Compact Cubic FE (Non-Compact Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] This (+ additional assumptions) Compact Cubic FE would imply Indistinguishability Obfuscation. [LT17] (Non-Compact Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] By Compact Quadratic FE Linearization ✓ [BCFG17] Compact Cubic FE (Non-Compact ✓ ✓ Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] Compact Cubic FE (Non-Compact ✓ ✓ Const.-degree FE) (We do not list IBE, ABE and Bounded-Collusion FE here.) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Comparing Functional Encryption Schemes Pairing-Based Schemes Lattice-Based Schemes Inner-Product Encryption ✓ ✓ [AFV11, ALS16] Function-Hiding Inner-Product ✓ Encryption [BJK15, DDM16, Lin17, ACF+18] Compact Quadratic FE ✓ [BCFG17] Compact Cubic FE (Non-Compact ✓ ✓ Const.-degree FE) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 3
Question What hinders us from constructing function-hiding inner-product encryption schemes whose security can be proven solely from the learning with errors assumption? Maybe fundamental mathematical barriers… | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 4
Secret-Key Inner-Product Encryption 𝑜 . ▪ Messages and functions are vectors 𝑦, 𝑧 ∈ ℤ 𝑞 ▪ Setup( 1 𝜇 ) generates a master secret key msk. 𝑦〉 mod 𝑞 𝑧 aaa 𝑡𝑙 𝑧 , 𝑑𝑢 𝑦 | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 5
Secret-Key Inner-Product Encryption 𝑜 . ▪ Messages and functions are vectors 𝑦, 𝑧 ∈ ℤ 𝑞 ▪ Setup( 1 𝜇 ) generates a master secret key msk. 𝑦〉 mod 𝑞 𝑧 KeyGen(msk, 𝑧 ) Enc(msk, 𝑦 ) aaa 𝑡𝑙 𝑧 , 𝑑𝑢 𝑦 | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 5
Secret-Key Inner-Product Encryption 𝑜 . ▪ Messages and functions are vectors 𝑦, 𝑧 ∈ ℤ 𝑞 ▪ Setup( 1 𝜇 ) generates a master secret key msk. 𝑦〉 mod 𝑞 𝑧 KeyGen(msk, 𝑧 ) Enc(msk, 𝑦 ) aaa 𝑡𝑙 𝑧 , 𝑑𝑢 𝑦 Dec( 𝑡𝑙 𝑧 , 𝑑𝑢 𝑦 ) | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 5
Selective Function-Hiding IND-CPA Security Challenger C Adversary A Insert good Compute face Insert 0 , 𝑔 0 , … , 𝑔 0 , (0) , … , 𝑦 𝑢 Draw 𝑦 1 here… 𝑛 1 evil face 1 , 𝑔 1 , … , 𝑔 1 ∈ ℤ 𝑞 𝑐 ← 0,1 , (1) , … , 𝑦 𝑢 𝑜 𝑦 1 here… 𝑛 1 msk ← Enc 1 𝜇 , s.t. (𝑐) ), 𝑑𝑢 𝑗 ← Enc(msk, 𝑦 𝑗 (0) 〉 = 𝑔 (1) 〉 0 1 ∀𝑗, 𝑘: 𝑔 𝑦 𝑘 𝑦 𝑘 𝑗 𝑗 (𝑐) ) 𝑡𝑙 𝑘 ← KeyGen(msk, 𝑔 𝑘 Dark Magic happens here… Adversary wins , if 𝑐 = 𝑐′ and for all 𝑗, 𝑘: 0 (0) 〉 = 𝑔 1 (1) 〉 𝑔 𝑦 𝑘 𝑦 𝑘 𝑗 𝑗 | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 6
Selective Function-Hiding IND-CPA Security ▪ The advantage of the adversary 𝐵 is: Adv 𝐵 𝑛−𝑔ℎ−𝐽𝑂𝐸−𝐷𝑄𝐵 := 2 × Pr[ 𝐵 wins] – 1. ▪ For 𝑛 = 𝑛 𝜇 secret keys, the IPE scheme is called selectively m-function-hiding IND-CPA secure , if Adv 𝐵 𝑛−𝑔ℎ−𝐽𝑂𝐸−𝐷𝑄𝐵 ∈ negl (𝜇) for each ppt 𝐵 . ▪ The IPE scheme is called (unbounded) selectively function-hiding IND-CPA secure , if it is sel. m-function-hiding IND-CPA secure for each 𝑛 ∈ poly (𝜇) . | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 7
Contribution Idealized Impossibility “Theorem”. There does not exist a lattice-based Inner-Product Encryption scheme which is function-hiding secure. This really has to mean something! Idea: Replace „lattice - based“ by common design patterns of lattice-based crypto-schemes. | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 8
Common Design Patterns: Linear Decryption In most cases: ▪ Ciphertexts 𝑑𝑢 𝑦 and secret keys 𝑡𝑙 𝑔 are vectors over ℤ 𝑟 . ▪ Decryption has the following formula: Dec 𝒕𝒍 𝒈 , 𝒅𝒖 𝒚 ≔ ⟨𝑡𝑙 𝑔 | 𝑑𝑢 𝑦 ⟩ mod 𝑟 ∈ ℤ 𝑞 𝑟 𝑞 | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 9
Common Design Patterns: Offline/Online-Encryption [HW14,AR17] Almost always: Encryption follows an offline/online-pattern. Offline Phase: compute arbitrary complex randomness without looking at input 𝑦 . Online Phase: combine randomness with 𝑦 in a very simple way (by evaluating const-degree polynomials at 𝑦 ). Enc (𝒏𝒕𝒍, 𝒚) : • Compute 𝑡 multinomial degree- 𝑒 integer polynomials 𝑡 ← Enc 𝑝𝑔𝑔 𝑛𝑡𝑙 . 𝑠 1 , … , 𝑠 𝑡 . • Compute and output 𝑑𝑢 𝑦 ≔ 𝑠 mod 𝑟 ∈ ℤ 𝑟 1 𝑦 , … , 𝑠 𝑡 𝑦 | | D-INFK – Foundations of Cryptography Akın Ünal EuroCrypt 2020, May 11 - 14 10
Recommend
More recommend
