functional encryption deterministic
play

Functional Encryption: Deterministic to Randomized Functions from - PowerPoint PPT Presentation

Functional Encryption: Deterministic to Randomized Functions from Simple Assumptions Shashank Agrawal David J. Wu Public-Key Functional Encryption [BSW11, ON10] () Keys are associated with deterministic functions sk


  1. Functional Encryption: Deterministic to Randomized Functions from Simple Assumptions Shashank Agrawal David J. Wu

  2. Public-Key Functional Encryption [BSW11, O’N10] 𝑦 𝑔(𝑦) Keys are associated with deterministic functions 𝑔 sk 𝑔

  3. Public-Key Functional Encryption [BSW11, O’N10] 𝑦 𝑔(𝑦) Keys are associated with deterministic functions 𝑔 sk 𝑔 𝑛 sk 𝑔

  4. Public-Key Functional Encryption [BSW11, O’N10] 𝑦 𝑔(𝑦) Keys are associated with deterministic functions 𝑔 sk 𝑔 𝑔(𝑛) Decrypt(sk 𝑔 , ct 𝑛 ) 𝑛 sk 𝑔

  5. Public-Key Functional Encryption [BSW11, O’N10] Setup 1 πœ‡ : Outputs (msk, mpk) β€’ eyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 β€’ Decrypt(sk 𝑔 , ct 𝑛 ) : Outputs 𝑔 𝑛

  6. Public-Key Functional Encryption [BSW11, O’N10] k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 β€’ Decrypt(sk 𝑔 , ct 𝑛 ) : Outputs 𝑔 𝑛

  7. Public-Key Functional Encryption [BSW11, O’N10] ct 𝑛 ct 𝑛 𝑛𝑛𝑒 ct 𝑛 𝑑 π‘’π‘¦π‘“π‘’π‘ π‘“β„Žπ‘žπ‘—π‘‘ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ 𝑛𝑛 mpk, 𝑛 ∢ , π‘™π‘ž mpk, 𝑛 π‘›π‘’π‘žπ‘§π‘ π‘‘π‘œ k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛

  8. Public-Key Functional Encryption [BSW11, O’N10] 𝑔𝑔 𝑛 𝑛𝑛 𝑛 π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ t 𝑛 𝑛𝑛 t 𝑛 ) t 𝑛 𝑒𝑑 k 𝑔 𝑔𝑔 k 𝑔 , k 𝑔 𝑙𝑑(π‘’π‘žπ‘§π‘ π‘‘π‘“ ct 𝑛 ct 𝑛 𝑛𝑛𝑒 ct 𝑛 𝑑 π‘’π‘¦π‘“π‘’π‘ π‘“β„Žπ‘žπ‘—π‘‘ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ 𝑛𝑛 mpk, 𝑛 ∢ , π‘™π‘ž mpk, 𝑛 π‘›π‘’π‘žπ‘§π‘ π‘‘π‘œ k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk 𝑛 : Outputs ciphertext ct

  9. Public-Key Functional Encryption [BSW11, O’N10] 𝑔𝑔 𝑛 𝑛𝑛 𝑛 π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ t 𝑛 𝑛𝑛 t 𝑛 ) t 𝑛 𝑒𝑑 k 𝑔 𝑔𝑔 k 𝑔 , k 𝑔 𝑙𝑑(π‘’π‘žπ‘§π‘ π‘‘π‘“π‘”π‘” 𝑛 𝑛𝑛 𝑛 π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ t 𝑛 𝑛𝑛 t 𝑛 ) t 𝑛 𝑒𝑑 k 𝑔 𝑔𝑔 k 𝑔 , k 𝑔 𝑙𝑑(π‘’π‘žπ‘§π‘ π‘‘π‘“ ct 𝑛 ct 𝑛 𝑛𝑛𝑒 ct 𝑛 𝑑 π‘’π‘¦π‘“π‘’π‘ π‘“β„Žπ‘žπ‘—π‘‘ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ 𝑛𝑛 mpk, 𝑛 ∢ , π‘™π‘ž mpk, 𝑛 π‘›π‘’π‘žπ‘§π‘ π‘‘π‘œ k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk)

  10. Public-Key Functional Encryption [BSW11, O’N10] β€’ Setup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 Deterministic function 𝑔 β€’ Decrypt(sk 𝑔 , ct 𝑛 ) : Outputs 𝑔 𝑛

  11. Functional Encryption for Randomized Functionalities (rFE) [ABFGGTW13, GJKS15] 𝑠 𝑦 But what if 𝑔 is 𝑔(𝑦 ; 𝑠) randomized ? Many interesting functions are randomized

  12. Application 1: Proxy Re-Encryption Alice

  13. Application 1: Proxy Re-Encryption Alice

  14. Application 1: Proxy Re-Encryption personal email Alice Alice

  15. Application 1: Proxy Re-Encryption personal email Alice Alice work email Secretary

  16. Application 1: Proxy Re-Encryption personal email Alice Alice work email Mail server has functional key to re-encrypt message under Secretary secretary’s public key

  17. Application 2: Auditing an Encrypted Database

  18. Application 2: Auditing an Encrypted Database Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4

  19. Application 2: Auditing an Encrypted Database Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 Sample a random subset to audit

  20. Application 2: Auditing an Encrypted Database Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 Sample a random 𝑠 2 𝑠 6 subset to audit

  21. Does Public-Key rFE Exist?

  22. Does Public-Key rFE Exist? [GJKS15] General- iO Purpose rFE (selectively secure)

  23. Public-Key Functional Encryption [BSW11, O’N10] Can be instantiated from a wide range of assumptions

  24. Public-Key Functional Encryption [BSW11, O’N10] Can be instantiated from a wide range of assumptions [SS10, GVW12, GKPVZ13, …] Bounded- PKE / LWE Collusion FE

  25. Public-Key Functional Encryption [BSW11, O’N10] Can be instantiated from a wide range of assumptions [SS10, GVW12, GKPVZ13, …] Bounded- PKE / LWE Collusion FE [GGHRSW13, Wat15, GGHZ16, …] Multilinear General- Maps / iO Purpose FE

  26. The Landscape of (Public-Key) Functional Encryption Deterministic functionalities [SS10, GVW12, …] Bounded- PKE / LWE Collusion FE [GGHRSW13, GGHZ16, … ] Multilinear General- Maps / iO Purpose FE Generally adaptively secure

  27. The Landscape of (Public-Key) Functional Encryption Deterministic functionalities Randomized functionalities [SS10, GVW12, …] Bounded- PKE / LWE [GJKS15] Collusion FE General- iO [GGHRSW13, GGHZ16, … ] Purpose rFE Multilinear General- Maps / iO Purpose FE Generally adaptively Selectively secure secure

  28. The Landscape of (Public-Key) Functional Encryption PKE / LWE Does extending FE to support General- randomized functionalities require Purpose rFE much stronger tools? Multilinear Maps / iO

  29. Our Main Result General-purpose FE for deterministic functionalities

  30. Our Main Result General-purpose FE General-purpose FE Number Theory for deterministic for randomized functionalities functionalities (e.g., DDH, RSA)

  31. Our Main Result General-purpose FE General-purpose FE Number Theory for deterministic for randomized functionalities functionalities (e.g., DDH, RSA) Implication : randomized FE is not much more difficult to construct than standard FE.

  32. Defining rFE

  33. Correctness for FE Deterministic functions

  34. Correctness for FE Deterministic functions 𝑛 sk 𝑔

  35. Correctness for FE Deterministic functions 𝑛 𝑔(𝑛) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔

  36. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions

  37. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 sk 𝑔

  38. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔

  39. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² Different ciphertexts

  40. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² sk 𝑔 Different Same function ciphertexts key

  41. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² 𝑔(𝑛 β€² ; 𝑠′) Decrypt(sk 𝑔 , ct 𝑛 β€² ) sk 𝑔 Independent draws Different Same function from output ciphertexts key distribution

  42. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 𝑔 β€² (𝑛 ; 𝑠 β€² ) Decrypt(sk 𝑔 β€² , ct 𝑛 ) sk 𝑔 β€² Independent draws Same Different from output ciphertexts function keys distribution

  43. Simulation-Based Security (Informally) msk sk 𝑔 𝑔 Real World: honestly generated ciphertexts 𝑛 and secret keys 𝑛

  44. Simulation-Based Security (Informally) msk sk 𝑔 𝑔 Real World: honestly generated ciphertexts 𝑛 and secret keys 𝑛 𝑔 Ideal World: sk 𝑔 simulated ciphertexts and secret keys 𝑔(𝑛) 𝑛

  45. The Case for Malicious Encrypters [GJKS15] Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 Sample a random 𝑠 2 𝑠 6 subset to audit

  46. The Case for Malicious Encrypters [GJKS15] Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 What if encrypter (bank) is adversarial? Sample a random 𝑠 2 𝑠 6 subset to audit

  47. The Case for Malicious Encrypters [GJKS15] Randomized functionalities 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² 𝑔(𝑛 β€² ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 β€² ) sk 𝑔 Dishonest encrypters can construct β€œbad” ciphertexts such that decryption produces correlated outputs

  48. The Case for Malicious Encrypters [GJKS15] Randomized functionalities 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² 𝑔(𝑛 β€² ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 β€² ) sk 𝑔 Formally captured by giving adversary access to a decryption oracle (like in the CCA-security game). [See paper for details.]

  49. Our Generic Transformation

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend