Functional Encryption from Pairings Michel Abdalla, CNRS and ENS - - PowerPoint PPT Presentation

▶
functional encryption from pairings
SMART_READER_LITE
LIVE PREVIEW

Functional Encryption from Pairings Michel Abdalla, CNRS and ENS - - PowerPoint PPT Presentation

Oct 25, 2023 169 likes •588 views

Multi-input Inner-Product Functional Encryption from Pairings Michel Abdalla, CNRS and ENS Romain Gay, ENS Mariana Raykova, Yale University Hoeteck Wee, CNRS and ENS Functional Encryption [Boneh, Sahai, Waters 11] m Alice Functional

slide-1
SLIDE 1

Multi-input Inner-Product Functional Encryption from Pairings

Michel Abdalla, CNRS and ENS Romain Gay, ENS Mariana Raykova, Yale University Hoeteck Wee, CNRS and ENS

slide-2
SLIDE 2

Functional Encryption

Alice

m [Boneh, Sahai, Waters 11]

slide-3
SLIDE 3

Functional Encryption

Alice

m

Bob f(m)

[Boneh, Sahai, Waters 11]

slide-4
SLIDE 4

Functional Encryption

Alice

m

Bob Carol f(m) g(m)

[Boneh, Sahai, Waters 11]

slide-5
SLIDE 5

Multi-input Functional Encryption

Alice

m1

Bob Carol f(m1, m2) g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

slide-6
SLIDE 6

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup pk msk KeyGen skf skg f(m1, m2)

slide-7
SLIDE 7

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup pk msk KeyGen skf skg f(m1, m2)

slide-8
SLIDE 8

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup pk msk KeyGen skf skg f(m1, m2) ∀m, m′: f m, m2 , f m1, m′

slide-9
SLIDE 9

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup pk msk KeyGen skf skg f(m1, m2) ∀m, m′: f m, m2 , f m1, m′ ∀m, m′: g m, m2 , g m1, m′

slide-10
SLIDE 10

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup msk KeyGen skf skg f(m1, m2)

slide-11
SLIDE 11

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup msk KeyGen skf skg f(m1, m2)

m′1 m′2

slide-12
SLIDE 12

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup msk KeyGen skf skg f(m1, m2)

m′1 m′2

slide-13
SLIDE 13

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup msk KeyGen skf skg f m1, m2 , f(m1, m′2)

m′1 m′2

slide-14
SLIDE 14

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup msk KeyGen skf skg f m1, m2 , f m1, m′2 , f(m′1, m2)

m′1 m′2

slide-15
SLIDE 15

Multi-input Functional Encryption

Alice

m1

Bob Carol g(m1, m2)

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup msk KeyGen skf skg f m1, m2 , f m1, m′2 , f m′1, m2 , f(m′1, m′2)

m′1 m′2

slide-16
SLIDE 16

Multi-input Functional Encryption

Alice

m1

Bob Carol

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

m2

Setup msk KeyGen skf skg f m1, m2 , f m1, m′2 , f m′1, m2 , f(m′1, m′2)

m′1 m′2

g m1, m2 , g m1, m′2 , g m′1, m2 , g(m′1, m′2)

slide-17
SLIDE 17

Multi-input Functional Encryption

Alice

m1

1

Bob Carol

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

mn

1

Setup msk KeyGen skf skg Qn values

m1

Q

mn

Q

Qn values

… … …

slide-18
SLIDE 18

Multi-input Functional Encryption

Alice

m1

1

Bob Carol

[Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14]

Dave

mn

1

Setup msk KeyGen skf skg Qn values

m1

Q

mn

Q

Qn values

… … …

Collusion

slide-19
SLIDE 19

Prior works

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded

slide-20
SLIDE 20

Prior works

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded

Standard-based FE for restricted class of functions?

slide-21
SLIDE 21

Prior works

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded Ours Inner Product 2maps (SXDH) poly 𝑡𝑙𝑧 for 𝑧 ∈ ℤ𝑞

𝑜𝑛

…

∀𝑗: 𝑦i∈ ℤ𝑞

𝑛

𝑦1, … , 𝑦𝑜 , 𝑧 𝑦1 𝑦n

slide-22
SLIDE 22

Prior works

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded Ours Inner Product 2maps (SXDH) poly [ABDP 15, ALS 15, ABDP 16] Inner Product 1maps (DDH) 1

slide-23
SLIDE 23

Concurrent works

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded Ours Inner Product 2maps (SXDH) poly [ABDP 15, ALS 15, ABDP 16] Inner Product 1maps (DDH) 1 [LL 16] Inner Product 2maps (SXDH & 3DH) 2

slide-24
SLIDE 24

Our construction

Single-input Inner Product FE Multi-input Inner Product FE

1

Generic, naive

2

[Agrawal, Libert, Stehlé] single input FE

slide-25
SLIDE 25

Multi-input Functional Encryption

Bob Dave Setup KeyGen Enc(msk1, 𝑦1) Enc(mskn, 𝑦n) msk1, … , mskn …

Naive Attempt

Alice for: 𝑧 = 𝑧1, … , 𝑧𝑜 ∈ ℤ𝑞

𝑜𝑛

sk𝑧 = sk𝑧1, … , sk𝑧𝑜

slide-26
SLIDE 26

Multi-input Functional Encryption

Bob Dave Setup KeyGen Enc(msk1, 𝑦1) Enc(mskn, 𝑦n) msk1, … , mskn …

Naive Attempt

𝑦1, 𝑧1 , … , 𝑦𝑜, 𝑧𝑜 Alice for: 𝑧 = 𝑧1, … , 𝑧𝑜 ∈ ℤ𝑞

𝑜𝑛

sk𝑧 = sk𝑧1, … , sk𝑧𝑜

slide-27
SLIDE 27

Multi-input Functional Encryption

Bob Dave Setup KeyGen Enc(msk1, 𝑦1) Enc(mskn, 𝑦n) msk1, … , mskn …

Naive Attempt

𝑦1, 𝑧1 , … , 𝑦𝑜, 𝑧𝑜

𝑗

𝑦𝑗, 𝑧𝑗 Alice for: 𝑧 = 𝑧1, … , 𝑧𝑜 ∈ ℤ𝑞

𝑜𝑛

sk𝑧 = sk𝑧1, … , sk𝑧𝑜

slide-28
SLIDE 28

Multi-input Functional Encryption

Bob Dave Setup KeyGen Enc(msk1, 𝑦1) Enc(mskn, 𝑦n) msk1, … , mskn …

Naive Attempt

𝑦1, 𝑧1 , … , 𝑦𝑜, 𝑧𝑜

𝑗

𝑦𝑗, 𝑧𝑗 Alice for: 𝑧 = 𝑧1, … , 𝑧𝑜 ∈ ℤ𝑞

𝑜𝑛

sk𝑧 = sk𝑧1, … , sk𝑧𝑜

slide-29
SLIDE 29

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, 𝑦1) Enc(mskn, 𝑦n) msk1, … , mskn … Enc( ski, 𝑦𝑗, 𝑧𝑗 ) sk1, … , sk𝑜 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = sk𝑧1, … , sk𝑧𝑜

∀𝑗: Bob

slide-30
SLIDE 30

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, 𝑦1) Enc(mskn, 𝑦n) msk1, … , mskn … Enc( ski, 𝑦𝑗, 𝑧𝑗 ) Enc(∑ ski, ∑ 𝑦𝑗, 𝑧𝑗 ) sk1, … , sk𝑜 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = sk𝑧1, … , sk𝑧𝑜

∀𝑗: Bob

slide-31
SLIDE 31

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, 𝑦1) Enc(mskn, 𝑦n) msk1, … , mskn … Enc( ski, 𝑦𝑗, 𝑧𝑗 ) Enc(∑ ski, ∑ 𝑦𝑗, 𝑧𝑗 ) ∑ 𝑦𝑗, 𝑧𝑗 sk1, … , sk𝑜 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = sk𝑧1, … , sk𝑧𝑜 , ∑ sk𝑗

∀𝑗: Bob

slide-32
SLIDE 32

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, ( 𝑦1, sk1)) Enc(mskn, ( 𝑦n, sk𝑜)) msk1, … , mskn … sk1, … , sk𝑜 ←𝑆 ℤ𝑞 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = sk(𝑧1,𝑠), … , sk(𝑧𝑜,𝑠) , ∑ sk𝑗

∀𝑗: 𝔿1of order 𝑞 𝑠 ←𝑆 ℤ𝑞

𝑕1

𝑦𝑗,𝑧𝑗 ⋅ 𝑕1 sk𝑗𝑠

in 𝔿1 in 𝔿1 Bob

slide-33
SLIDE 33

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, ( 𝑦1, sk1)) Enc(mskn, ( 𝑦n, sk𝑜)) msk1, … , mskn … sk1, … , sk𝑜 ←𝑆 ℤ𝑞 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = sk(𝑧1,𝑠), … , sk(𝑧𝑜,𝑠) , ∑ sk𝑗

∀𝑗: 𝔿1of order 𝑞 𝑠 ←𝑆 ℤ𝑞

𝑕1

𝑦𝑗,𝑧𝑗 ⋅ 𝑕1 sk𝑗𝑠

in 𝔿1 in 𝔿1 Bob Contain ( 𝑧𝑗, 𝑠) in ℤ𝑞

slide-34
SLIDE 34

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, ( 𝑦1, sk1)) Enc(mskn, ( 𝑦n, sk𝑜)) msk1, … , mskn … sk1, … , sk𝑜 ←𝑆 ℤ𝑞 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = g2

sk(𝑧1,𝑠), … , g2 sk(𝑧𝑜,𝑠), ∑

sk𝑗

∀𝑗: 𝑠 ←𝑆 ℤ𝑞

𝑕𝑈

𝑦𝑗,𝑧𝑗 ⋅ 𝑕𝑈 sk𝑗𝑠

in 𝔿1 in 𝔿1 Bob 𝑓: 𝔿1 × 𝔿2 → 𝔿𝑈

slide-35
SLIDE 35

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, ( 𝑦1, sk1)) Enc(mskn, ( 𝑦n, sk𝑜)) msk1, … , mskn … sk1, … , sk𝑜 ←𝑆 ℤ𝑞 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = g2

sk(𝑧1,𝑠), … , g2 sk(𝑧𝑜,𝑠), ∑

sk𝑗

∀𝑗: 𝑠 ←𝑆 ℤ𝑞

𝑕𝑈

𝑦𝑗,𝑧𝑗 ⋅ 𝑕𝑈 sk𝑗𝑠

in 𝔿1 in 𝔿1 Bob 𝑓: 𝔿1 × 𝔿2 → 𝔿𝑈 ∑ 𝑦𝑗, 𝑧𝑗 𝑕𝑈 ⋅ 𝑕𝑈 ∑ sk𝑗𝑠

slide-36
SLIDE 36

Multi-input Functional Encryption

Alice Dave Setup KeyGen Enc(msk1, ( 𝑦1, sk1)) Enc(mskn, ( 𝑦n, sk𝑜)) msk1, … , mskn … sk1, … , sk𝑜 ←𝑆 ℤ𝑞 for: 𝑧 = ( 𝑧1, … , 𝑧𝑜)

sk𝑧 = g2

sk(𝑧1,𝑠), … , g2 sk(𝑧𝑜,𝑠), ∑

sk𝑗

∀𝑗: 𝑠 ←𝑆 ℤ𝑞

𝑕𝑈

𝑦𝑗,𝑧𝑗 ⋅ 𝑕𝑈 sk𝑗𝑠

in 𝔿1 in 𝔿1 Bob 𝑓: 𝔿1 × 𝔿2 → 𝔿𝑈 ∑ 𝑦𝑗, 𝑧𝑗 𝑕𝑈 ⋅ 𝑕𝑈 ∑ sk𝑗𝑠 ∑ 𝑦𝑗, 𝑧𝑗

slide-37
SLIDE 37

Open problems

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded Ours Inner Product 2maps (SXDH) poly [ABDP 15, ALS 15, ABDP 16] Inner Product 1maps (DDH) 1 [LL 16] Inner Product 2maps (SXDH & 3DH) 2

slide-38
SLIDE 38

Open problems

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded Ours Inner Product 2maps (SXDH) poly [ABDP 15, ALS 15, ABDP 16] Inner Product 1maps (DDH) 1 [LL 16] Inner Product 2maps (SXDH & 3DH) 2

Remove the use

  • f pairing?
slide-39
SLIDE 39

Open problems

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded Ours Inner Product 2maps (SXDH) poly [ABDP 15, ALS 15, ABDP 16] Inner Product 1maps (DDH) 1 [LL 16] Inner Product 2maps (SXDH & 3DH) 2

Remove the use

  • f pairing?

Larger classes of functions from standard assumptions?

slide-40
SLIDE 40

Open problems

Construction: Functions: Assumption: # slots: [BLRSZZ 14, GGGJKLSSZ 14, AJ 15, BGJS 15, BKS 16,KS 17] any circuit Non standard Poly, unbounded Ours Inner Product 2maps (SXDH) poly [ABDP 15, ALS 15, ABDP 16] Inner Product 1maps (DDH) 1 [LL 16] Inner Product 2maps (SXDH & 3DH) 2

Remove the use

  • f pairing?

Larger classes of functions from standard assumptions?

Thank you