SLIDE 1
Inner Product Functional Encryption Edouard Dufour Sans January 25, - - PowerPoint PPT Presentation
Inner Product Functional Encryption Edouard Dufour Sans January 25, - - PowerPoint PPT Presentation
Inner Product Functional Encryption Edouard Dufour Sans January 25, 2018 Table of Contents Introduction Functional Encryption Security definitions Notations The Power of Inner Products Descriptive statistics Machine Learning Practical
SLIDE 2
SLIDE 3
Functional Encryption
Traditional PKE: all or nothing.
SLIDE 4
Functional Encryption
Traditional PKE: all or nothing.
◮ Have the key? Get the
plaintext.
SLIDE 5
Functional Encryption
Traditional PKE: all or nothing.
◮ Have the key? Get the
plaintext.
◮ Don’t have the key? Get
nothing.
SLIDE 6
Functional Encryption
Traditional PKE: all or nothing.
◮ Have the key? Get the
plaintext.
◮ Don’t have the key? Get
nothing. Functional Encryption: A new paradigm.
SLIDE 7
Functional Encryption
Traditional PKE: all or nothing.
◮ Have the key? Get the
plaintext.
◮ Don’t have the key? Get
nothing. Functional Encryption: A new paradigm. Get a function of the cleartext.
SLIDE 8
Functional Encryption
Traditional PKE: all or nothing.
◮ Have the key? Get the
plaintext.
◮ Don’t have the key? Get
nothing. Functional Encryption: A new paradigm. Get a function of the cleartext. Function depends on the key.
SLIDE 9
Functional Encryption: Formal definition
Four algorithms:
SLIDE 10
Functional Encryption: Formal definition
Four algorithms:
◮ Setup ◮ Encrypt ◮ KeyGen ◮ Decrypt
SLIDE 11
Functional Encryption: Formal definition
Four algorithms:
◮ Setup(λ): Returns (ek, msk). ◮ Encrypt ◮ KeyGen ◮ Decrypt
SLIDE 12
Functional Encryption: Formal definition
Four algorithms:
◮ Setup(λ): Returns (ek, msk). ◮ Encrypt(ek,x): Returns c. ◮ KeyGen ◮ Decrypt
SLIDE 13
Functional Encryption: Formal definition
Four algorithms:
◮ Setup(λ): Returns (ek, msk). ◮ Encrypt(ek,x): Returns c. ◮ KeyGen(msk,f ): Returns skf . ◮ Decrypt
SLIDE 14
Functional Encryption: Formal definition
Four algorithms:
◮ Setup(λ): Returns (ek, msk). ◮ Encrypt(ek,x): Returns c. ◮ KeyGen(msk,f ): Returns skf . ◮ Decrypt(skf ,c): Returns f (x).
SLIDE 15
Functional Encryption: Formal definition
Four algorithms:
◮ Setup(λ): Returns (ek, msk). ◮ Encrypt(ek,x): Returns c. ◮ KeyGen(msk,f ): Returns skf . ◮ Decrypt(skf ,c): Returns f (x).
Function hiding.
SLIDE 16
Functional Encryption: Formal definition
Four algorithms:
◮ Setup(λ): Returns (ek, msk). ◮ Encrypt(ek,x): Returns c. ◮ KeyGen(msk,f ): Returns skf . ◮ Decrypt(skf ,c): Returns f (x).
Function hiding (or not).
SLIDE 17
Functional Encryption: Formal definition
Four algorithms:
◮ Setup(λ): Returns (ek, msk). ◮ Encrypt(ek,x): Returns c. ◮ KeyGen(msk,f ): Returns skf . ◮ Decrypt(skf ,c): Returns f (x).
Function hiding (or not). f ∈ F: the functionality.
SLIDE 18
Security definitions
Can we simply re-use the definitions of standard SE or PKE?
SLIDE 19
Security definitions
Can we simply re-use the definitions of standard SE or PKE? No.
SLIDE 20
Security definitions
Can we simply re-use the definitions of standard SE or PKE? No. For any non-trivial f = ⇒ distinguish by submitting x0, x1 with f (x0) = f (x1).
SLIDE 21
Security definitions
Can we simply re-use the definitions of standard SE or PKE? No. For any non-trivial f = ⇒ distinguish by submitting x0, x1 with f (x0) = f (x1). Would not be a useful definition.
SLIDE 22
Security definitions
Indistinguishibility-Based Game
SLIDE 23
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
SLIDE 24
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
◮ Initialize: Run the setup and send the public key.
SLIDE 25
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
◮ Initialize: Run the setup and send the public key. ◮ KeyDer: Run KeyGen and give the decryption key.
SLIDE 26
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
◮ Initialize: Run the setup and send the public key. ◮ KeyDer: Run KeyGen and give the decryption key. ◮ LeftOrRight: Receive (x0, x1), return Encrypt(ek, xb).
SLIDE 27
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
◮ Initialize: Run the setup and send the public key. ◮ KeyDer: Run KeyGen and give the decryption key. ◮ LeftOrRight: Receive (x0, x1), return Encrypt(ek, xb). ◮ Finalize: If key requests were legitimate, check validity of
guess.
SLIDE 28
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
◮ Initialize: Run the setup and send the public key. ◮ KeyDer: Run KeyGen and give the decryption key. ◮ LeftOrRight: Receive (x0, x1), return Encrypt(ek, xb). ◮ Finalize: If key requests were legitimate, check validity of
guess. One query to LeftOrRight is enough.
SLIDE 29
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
◮ Initialize: Run the setup and send the public key. ◮ KeyDer: Run KeyGen and give the decryption key. ◮ LeftOrRight: Receive (x0, x1), return Encrypt(ek, xb). ◮ Finalize: If key requests were legitimate, check validity of
guess. One query to LeftOrRight is enough. Requests were illegitimate if for some f queries to KeyDer, f (x0) = f (x1).
SLIDE 30
Security definitions
Indistinguishibility-Based Game
Polynomial number of queries to the following oracles:
◮ Initialize: Run the setup and send the public key. ◮ KeyDer: Run KeyGen and give the decryption key. ◮ LeftOrRight: Receive (x0, x1), return Encrypt(ek, xb). ◮ Finalize: If key requests were legitimate, check validity of
guess. One query to LeftOrRight is enough. Requests were illegitimate if for some f queries to KeyDer, f (x0) = f (x1). Selective game: Adversary must query LeftOrRight first. Adaptive game: No such constraint.
SLIDE 31
Notations
◮ Brackets: [x] = gx. ◮ Matrices and brackets:
x11 . . . x1n . . . ... . . . xd1 . . . xdn = [x11] . . . [x1n] . . . ... . . . [xd1] . . . [xdn]
◮ We encrypt vectors x, and give keys for vectors y. We
conflate fy : x → n
i=1 xiyi and y. ◮ Scalar x, vector x and matrix X.
SLIDE 32
Table of Contents
Introduction Functional Encryption Security definitions Notations The Power of Inner Products Descriptive statistics Machine Learning Practical security The first practical scheme: ABDP Presentation Correctness A fully secure scheme: ALS Presentation Correctness Security
SLIDE 33
The Power of Inner Products
We will work towards constructing schemes for the inner product functionality.
SLIDE 34
The Power of Inner Products
We will work towards constructing schemes for the inner product functionality. Is this a useful primitive?
SLIDE 35
Descriptive statistics
◮ Averages.
SLIDE 36
Descriptive statistics
◮ Averages. ◮ Weighted averages.
SLIDE 37
Descriptive statistics
◮ Averages. ◮ Weighted averages. ◮ Standard deviation.
SLIDE 38
Descriptive statistics
◮ Averages. ◮ Weighted averages. ◮ Standard deviation (if we encrypt the squares).
SLIDE 39
Machine learning: linear regression
Predict t (e.g. income) from x (e.g. housing data about the family).
SLIDE 40
Machine learning: linear regression
Predict t (e.g. income) from x (e.g. housing data about the family). A somewhat naive model: t ≈ n
i=1 xiyi
≈ x, y
SLIDE 41
Machine learning: linear regression
Predict t (e.g. income) from x (e.g. housing data about the family). A somewhat naive model: t ≈ n
i=1 xiyi
≈ x, y Works very well for some (basic) problems!
SLIDE 42
Machine learning: linear classification
Figure: The CIFAR10 dataset. Source: https://www.cs.toronto.edu/∼kriz/cifar.html
SLIDE 43
Machine learning: linear classification
Figure: CIFAR10 linear classifiers as images. Source: http://cs231n.github.io/linear-classify/
SLIDE 44
Leakage
The key for y lets you compute x, y = ⇒ one projection.
SLIDE 45
Leakage
The key for y lets you compute x, y = ⇒ one projection. m independent keys = ⇒ m projections.
SLIDE 46
Leakage
The key for y lets you compute x, y = ⇒ one projection. m independent keys = ⇒ m projections. Actual number of keys you can give?
SLIDE 47
Leakage
The key for y lets you compute x, y = ⇒ one projection. m independent keys = ⇒ m projections. Actual number of keys you can give depends on plaintext distribution.
SLIDE 48
Table of Contents
Introduction Functional Encryption Security definitions Notations The Power of Inner Products Descriptive statistics Machine Learning Practical security The first practical scheme: ABDP Presentation Correctness A fully secure scheme: ALS Presentation Correctness Security
SLIDE 49
Presentation
ABDP15
Fixed n. F ≈ Zn
p, fy ≈ y.
SLIDE 50
Presentation
ABDP15
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup ◮ Encrypt ◮ KeyGen ◮ Decrypt
SLIDE 51
Presentation
ABDP15
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick s
$
← Zn
- p. Return [s], s.
◮ Encrypt ◮ KeyGen ◮ Decrypt
SLIDE 52
Presentation
ABDP15
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick s
$
← Zn
- p. Return [s], s.
◮ Encrypt([s], x): Pick r
$
← Zp. Return [r], [x] · [s]r = [r], [x + rs].
◮ KeyGen ◮ Decrypt
SLIDE 53
Presentation
ABDP15
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick s
$
← Zn
- p. Return [s], s.
◮ Encrypt([s], x): Pick r
$
← Zp. Return [r], [x + rs].
◮ KeyGen(s, y): Return s, y. ◮ Decrypt
SLIDE 54
Presentation
ABDP15
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick s
$
← Zn
- p. Return [s], s.
◮ Encrypt([s], x): Pick r
$
← Zp. Return [r], [x + rs].
◮ KeyGen(s, y): Return s, y. ◮ Decrypt(s, y, ([r], [x + rs])): Compute
[γ] = [x + rs]⊺ · y/[r]s,y and solve the discrete logarithm to return γ.
SLIDE 55
Correctness
◮ Decrypt(s, y, ([r], [x + rs])): Compute
[γ] = [x + rs]⊺ · y/[r]s,y and solve the discrete logarithm to return γ.
Proof.
On the black board, or check the paper.
SLIDE 56
Table of Contents
Introduction Functional Encryption Security definitions Notations The Power of Inner Products Descriptive statistics Machine Learning Practical security The first practical scheme: ABDP Presentation Correctness A fully secure scheme: ALS Presentation Correctness Security
SLIDE 57
Presentation
ALS16
Fixed n. F ≈ Zn
p, fy ≈ y.
SLIDE 58
Presentation
ALS16
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup ◮ Encrypt ◮ KeyGen ◮ Decrypt
SLIDE 59
Presentation
ALS16
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick a
$
← Z2
p, S
$
← Zn×2
p
. Return ([a], [Sa]), (a, S).
◮ Encrypt ◮ KeyGen ◮ Decrypt
SLIDE 60
Presentation
ALS16
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick a
$
← Z2
p, S
$
← Zn×2
p
. Return ([a], [Sa]), (a, S).
◮ Encrypt(([a], [Sa]), x): Pick r
$
← Zp. Return [ar], [x + Sar].
◮ KeyGen ◮ Decrypt
SLIDE 61
Presentation
ALS16
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick a
$
← Z2
p, S
$
← Zn×2
p
. Return ([a], [Sa]), (a, S).
◮ Encrypt(([a], [Sa]), x): Pick r
$
← Zp. Return [ar], [x + Sar].
◮ KeyGen(S, y): Return S⊺y. ◮ Decrypt
SLIDE 62
Presentation
ALS16
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick a
$
← Z2
p, S
$
← Zn×2
p
. Return ([a], [Sa]), (a, S).
◮ Encrypt(([a], [Sa]), x): Pick r
$
← Zp. Return [ar], [x + Sar].
◮ KeyGen(S, y): Return S⊺y. ◮ Decrypt(S⊺y, ([ar], [x + Sar])): Compute
[γ] = [x + Sar]⊺ · y − [ar]⊺ · S⊺y and solve the discrete logarithm to return γ.
SLIDE 63
Correctness
Compute [γ] = [(x + Sar)⊺y − (ar)⊺S⊺y] and solve the discrete logarithm to return γ.
Proof.
On the black board (or check the paper).
SLIDE 64
Security
ALS16
Fixed n. F ≈ Zn
p, fy ≈ y. ◮ Setup(λ): Pick a
$
← Z2
p, S
$
← Zn×2
p
. Return ([a], [Sa]), (a, S).
◮ Encrypt(([a], [Sa]), x): Pick r
$
← Zp. Return [ar], [x + Sar].
◮ KeyGen(S, y): Return S⊺y. ◮ Decrypt(S⊺y, ([ar], [x + Sar])): Compute
[γ] = [(x + Sar)⊺y − (ar)⊺S⊺y] and solve the discrete logarithm to return γ.
Proof.
On the black board (or check Appendix A in AGR+17).
SLIDE 65
References
- 1. M. Abdalla, F. Bourse, A. De Caro, and D. Pointcheval.
Simple functional encryption schemes for inner products. PKC 2015.
- 2. M. Abdalla, R. Gay, M. Raykova, and H. Wee. Multi-input
Inner-Product Functional Encryption from Pairings. EUROCRYPT 2017.
- 3. S. Agrawal, B. Libert, and D. Stehl´
- e. Fully secure functional
encryption for inner products, from standard assumptions. CRYPTO 2016.
- 4. D. Boneh, A. Sahai, and B. Waters. Functional encryption:
Definitions and challenges. TCC 2011.
- 5. A. O’Neill. Definitional Issues in Functional Encryption.