Weak Puncturable PRF R wPPRF Theorem: sPPRF R 16 / 51 R β ← − { 0 , 1 } β =? ( pp, k ) ← Gen ( λ ) x ∗ ← − X pp, x ∗ , k x ∗ , y ∗ β k x ∗ ← Punc ( k, x ∗ ) y ∗ 0 ← F ( k, x ∗ ) y ∗ ← − Y 1
Weak Puncturable PRF R R R 16 / 51 β ← − { 0 , 1 } β =? ( pp, k ) ← Gen ( λ ) x ∗ ← − X pp, x ∗ , k x ∗ , y ∗ β k x ∗ ← Punc ( k, x ∗ ) y ∗ 0 ← F ( k, x ∗ ) y ∗ ← − Y 1 Theorem: sPPRF ⇔ wPPRF
Preserving Functionality: , Pr Indistinguishability of Obfuscation PPT adversaries , a negl. function : Pr Pr Pr 17 / 51 Indistinguishability Obfuscation [BGI + 12] A uniform PPT machine i O is called an indistinguishability obfuscator if:
Indistinguishability of Obfuscation PPT adversaries , a negl. function : Pr Pr Pr 17 / 51 Indistinguishability Obfuscation [BGI + 12] A uniform PPT machine i O is called an indistinguishability obfuscator if: Preserving Functionality: ∀ C ∈ C λ , ∀ x ∈ { 0 , 1 } ∗ Pr [ C ′ ( x ) = C ( x ) : C ′ ← i O ( C )] = 1 C 0 i O i O ( C 0 )
17 / 51 Indistinguishability of Obfuscation Indistinguishability Obfuscation [BGI + 12] A uniform PPT machine i O is called an indistinguishability obfuscator if: Preserving Functionality: ∀ C ∈ C λ , ∀ x ∈ { 0 , 1 } ∗ Pr [ C ′ ( x ) = C ( x ) : C ′ ← i O ( C )] = 1 ∀ PPT adversaries ( S , D ) , ∃ a negl. function α : Pr [ ∀ x, C 0 ( x ) = C 1 ( x ) : ( C 0 , C 1 , aux ) ← S ( λ )] ≥ 1 − α ( λ ) ⇒ | Pr [ D ( aux, i O ( C 0 )) = 1] − Pr [ D ( aux, i O ( C 1 )) = 1] | ≤ α ( λ ) ≡ C 0 C 1 i O i O ≈ c i O ( C 0 ) i O ( C 1 )
Outline Leakage-Resilient PKE Leakage-Resilient SKE Leakage-Resilient Signature 18 / 51 1 Background 2 Motivation 3 Primitives 4 Our Framework Towards Leakage-Resilience 5 Achieving Optimal Leakage Rate
In order to answer arbitrary leakage queries, it seems Approaches towards Leakage Resilience Assumptions Technical hurdle: a seemingly paradox must know Typically does not know since the challenge instance is embedded in it 19 / 51 R F sk
In order to answer arbitrary leakage queries, it seems Approaches towards Leakage Resilience Assumptions Technical hurdle: a seemingly paradox must know Typically does not know since the challenge instance is embedded in it 19 / 51 R F sk
In order to answer arbitrary leakage queries, it seems Approaches towards Leakage Resilience Assumptions Technical hurdle: a seemingly paradox must know Typically does not know since the challenge instance is embedded in it 19 / 51 R F sk
Approaches towards Leakage Resilience Assumptions Technical hurdle: a seemingly paradox Typically does not know since the challenge instance is embedded in it 19 / 51 R f F sk f ( sk ) In order to answer arbitrary leakage queries, it seems R must know sk
Approaches towards Leakage Resilience Assumptions Technical hurdle: a seemingly paradox 19 / 51 R f F sk f ( sk ) In order to answer arbitrary leakage queries, it seems R must know sk Typically R does not know sk since the challenge instance is embedded in it
Akavia et al. [AGV09]: normal Approach I Rely on leakage-resilient assumptions, i.e., the assumption still holds even in the presence of partial leakage of secret Assumptions leakage-resilient Katz and Vaikuntanathan [KV09]: UOWHF is LR-OW + ss-NIZK LR SIG lossy even in the presence of leakage Regev PKE is LR 20 / 51 R F sk
Akavia et al. [AGV09]: normal Approach I Rely on leakage-resilient assumptions, i.e., the assumption still holds even in the presence of partial leakage of secret Assumptions leakage-resilient Katz and Vaikuntanathan [KV09]: UOWHF is LR-OW + ss-NIZK LR SIG lossy even in the presence of leakage Regev PKE is LR 20 / 51 R f F sk
Katz and Vaikuntanathan [KV09]: UOWHF is LR-OW + ss-NIZK Akavia et al. [AGV09]: normal Approach I Regev PKE is LR leakage even in the presence of lossy LR SIG 20 / 51 Rely on leakage-resilient assumptions, i.e., the assumption still holds even in the leakage-resilient Assumptions presence of partial leakage of secret R f F sk f ( sk )
Akavia et al. [AGV09]: normal Approach I Rely on leakage-resilient assumptions, i.e., the assumption still holds even in the presence of partial leakage of secret Assumptions leakage-resilient lossy even in the presence of leakage Regev PKE is LR 20 / 51 R f F sk f ( sk ) Katz and Vaikuntanathan [KV09]: UOWHF is LR-OW + ss-NIZK ⇒ LR SIG
Approach I Rely on leakage-resilient assumptions, i.e., the assumption still holds even in the presence of partial leakage of secret Assumptions leakage-resilient 20 / 51 R f F sk f ( sk ) Katz and Vaikuntanathan [KV09]: UOWHF is LR-OW + ss-NIZK ⇒ LR SIG Akavia et al. [AGV09]: normal pk ≈ c lossy pk even in the presence of sk leakage ⇒ Regev PKE is LR
Dodis et al. [DGK 10]: DDH Approach II Goldreich-Levin theorem (leakage-resilient assumption) model) (auxliary-input w.r.t. hc ; leftover hash lemma (leakage-resilient fact) detached strategy + leakage-resilient assumptions/facts Ext ; Naor and Segev [NS09]: SMP F Assumptions 21 / 51 F sk c
Dodis et al. [DGK 10]: DDH Approach II leftover hash lemma (leakage-resilient fact) Goldreich-Levin theorem (leakage-resilient assumption) model) (auxliary-input w.r.t. hc ; Ext detached strategy + leakage-resilient assumptions/facts ; Naor and Segev [NS09]: SMP Assumptions 21 / 51 F sk c ≈ c F sk ˆ c
Naor and Segev [NS09]: SMP Dodis et al. [DGK 10]: DDH Approach II leftover hash lemma (leakage-resilient fact) Goldreich-Levin theorem (leakage-resilient assumption) model) (auxliary-input w.r.t. hc ; ; Ext detached strategy + leakage-resilient assumptions/facts Assumptions 21 / 51 F sk c f ≈ c f ( sk ) F sk ˆ c
Dodis et al. [DGK 10]: DDH Approach II leftover hash lemma (leakage-resilient fact) Goldreich-Levin theorem (leakage-resilient assumption) model) (auxliary-input w.r.t. hc ; 21 / 51 Assumptions detached strategy + leakage-resilient assumptions/facts F sk c f ≈ c f ( sk ) F sk ˆ c Naor and Segev [NS09]: SMP ⇒ c ≈ c ˆ c ; k ← Ext ( sk, ˆ c )
Approach II detached strategy + leakage-resilient assumptions/facts Goldreich-Levin theorem (leakage-resilient assumption) model) leftover hash lemma (leakage-resilient fact) 21 / 51 Assumptions F sk c f ≈ c f ( sk ) F sk ˆ c Naor and Segev [NS09]: SMP ⇒ c ≈ c ˆ c ; k ← Ext ( sk, ˆ c ) Dodis et al. [DGK + 10]: DDH ⇒ c ≈ c ˆ c ; k ← hc ˆ c ( sk ) w.r.t. f (auxliary-input
A common theme of the two above main approaches queries with real secret key. design with specifjc structure. It is interesting to investigate the possibility of simulate leakage oracle computationally , i.e., answering leakage queries with simulated leakage This might lend new techniques to address the unsolved problems in LRC. 22 / 51 R always try to simulate leakage oracle perfectly , i.e., answering leakage To do so, we have to either rely on LR assumptions or resort to sophisticated
23 / 51 Dachman-Soled et al. [DGL + 16] discovered powerful applications of i O to LRC Sahai-Waters PKE � leakage resilient
Background: Sahai-Waters KEM R Encaps 24 / 51 Ingredients: i O , PRG G : { 0 , 1 } λ → { 0 , 1 } 2 λ , weak puncturable PRF F : SK × { 0 , 1 } 2 λ → Y Gen ( λ ) : pick sk ← − SK , pk ← i O ( Encaps ) Encaps ( pk ; r ) : ( c, k ) ← pk ( r ) Decaps ( sk, c ) : k ← F ( sk, c ) Constants: PPRF key sk Input: randomness r ∈ { 0 , 1 } λ 1 compute x ← G ( r ) ; output c = x , k ← F ( sk, x )
Dachman-Soled et al. [DGL 16] made Sahai-Waters KEM leakage-resilient by Why Sahai-Waters is not Leakage-Resilient? , and thus may not be random anymore in twice. using to handle arbitrary leakage queries. , and thus unable only knows Proof perspective: in some hybrid game, ’s view. queries on The proof uses “punctured programs” technique and security is reduced to the could be leaked via leakage Construction perspective: the information of The sources for non-leakage-resilient R weak pseudorandomness of punctured PRF 25 / 51 pk ← i O ( Encaps ( sk )) ⇝ pk ← i O ( Encaps ∗ ( sk x ∗ )) session key k ∗ ← y ∗ ← F ( sk, x ∗ ) , where x ∗ − { 0 , 1 } 2 λ ←
Dachman-Soled et al. [DGL 16] made Sahai-Waters KEM leakage-resilient by Why Sahai-Waters is not Leakage-Resilient? The proof uses “punctured programs” technique and security is reduced to the twice. using to handle arbitrary leakage queries. The sources for non-leakage-resilient weak pseudorandomness of punctured PRF R 25 / 51 pk ← i O ( Encaps ( sk )) ⇝ pk ← i O ( Encaps ∗ ( sk x ∗ )) session key k ∗ ← y ∗ ← F ( sk, x ∗ ) , where x ∗ − { 0 , 1 } 2 λ ← Construction perspective: the information of y ∗ could be leaked via leakage queries on sk , and thus may not be random anymore in A ’s view. Proof perspective: in some hybrid game, R only knows sk x ∗ , and thus unable
Why Sahai-Waters is not Leakage-Resilient? The proof uses “punctured programs” technique and security is reduced to the weak pseudorandomness of punctured PRF R The sources for non-leakage-resilient to handle arbitrary leakage queries. 25 / 51 pk ← i O ( Encaps ( sk )) ⇝ pk ← i O ( Encaps ∗ ( sk x ∗ )) session key k ∗ ← y ∗ ← F ( sk, x ∗ ) , where x ∗ − { 0 , 1 } 2 λ ← Construction perspective: the information of y ∗ could be leaked via leakage queries on sk , and thus may not be random anymore in A ’s view. Proof perspective: in some hybrid game, R only knows sk x ∗ , and thus unable Dachman-Soled et al. [DGL + 16] made Sahai-Waters KEM leakage-resilient by using i O twice.
Outline Leakage-Resilient PKE Leakage-Resilient SKE Leakage-Resilient Signature 26 / 51 1 Background 2 Motivation 3 Primitives 4 Our Framework Towards Leakage-Resilience 5 Achieving Optimal Leakage Rate
Abstract and Generalize the Core Idea ? , is effjcient compostion lemma simulate leakage in a computationally indistinguishable manner 27 / 51 sk R
Abstract and Generalize the Core Idea ? is effjcient compostion lemma simulate leakage in a computationally indistinguishable manner 27 / 51 sk R sk x ∗ , y ∗
Abstract and Generalize the Core Idea ? is effjcient compostion lemma simulate leakage in a computationally indistinguishable manner 27 / 51 sk C ≡ R sk x ∗ , y ∗ C ′
Abstract and Generalize the Core Idea is effjcient simulate leakage in a computationally indistinguishable manner lemma compostion 27 / 51 ? i O ( C ) sk C i O ≈ c ≡ R sk x ∗ , y ∗ i O ( C ′ ) C ′
Abstract and Generalize the Core Idea compostion simulate leakage in a computationally indistinguishable manner lemma 27 / 51 ? i O ( C ) f ( i O ( C )) sk C f is effjcient i O ≈ c ≈ c ≡ R sk x ∗ , y ∗ i O ( C ′ ) f ( i O ( C ′ )) C ′
Abstract and Generalize the Core Idea compostion simulate leakage in a computationally indistinguishable manner lemma 27 / 51 ? i O ( C ) f ( i O ( C )) sk C f is effjcient i O ≈ c ≈ c ≡ R sk x ∗ , y ∗ i O ( C ′ ) f ( i O ( C ′ )) C ′
Key Observation Can we push the idea to extreme? Punc-PRF into Punc-“publicly evaluable” PRF These two results suggest: 28 / 51 Dachman-Soled et al. [DGL + 16]: Sahai-Waters KEM can be made LR by setting sk as an obfuscated program Chen et al. [CZ14]: the essence of Sahai-Waters KEM – i O bootstraps i O ( Punc-PEPRF ) � LR PEPRF
Punc (Puncturable) Publicly Evaluable PRF 29 / 51 ( pk, sk ) ← Gen ( λ ) Priv ( sk, x ) X F ( sk, x ) Y L Samp ( λ ) Pub ( pk, x, w ) W
(Puncturable) Publicly Evaluable PRF 29 / 51 sk x ∗ ← Punc ( sk, x ∗ ) ( pk, sk ) ← Gen ( λ ) Priv ( sk, x ) X F ( sk, x ) Y L Samp ( λ ) Pub ( pk, x, w ) W
Security of (Puncturable) Publicly Evaluable PRF Gen Samp Punc R R , , Pr negl 30 / 51
Security of (Puncturable) Publicly Evaluable PRF Samp Punc R R , , Pr negl 30 / 51 ( pk, sk ) ← Gen ( λ ) pk
Security of (Puncturable) Publicly Evaluable PRF R negl Pr R 30 / 51 ← − { 0 , 1 } β ( pk, sk ) ← Gen ( λ ) pk ( x ∗ , w ∗ ) ← Samp ( λ ) sk x ∗ ← Punc ( sk, x ∗ ) y ∗ 0 ← F ( sk, x ∗ ) y ∗ ← − Y 1 x ∗ , y ∗ β , sk x ∗
Security of (Puncturable) Publicly Evaluable PRF R negl Pr R 30 / 51 ← − { 0 , 1 } β β =? ( pk, sk ) ← Gen ( λ ) pk ( x ∗ , w ∗ ) ← Samp ( λ ) sk x ∗ ← Punc ( sk, x ∗ ) y ∗ 0 ← F ( sk, x ∗ ) y ∗ ← − Y 1 x ∗ , y ∗ β , sk x ∗ β ′
Security of (Puncturable) Publicly Evaluable PRF R R 30 / 51 ← − { 0 , 1 } β β =? ( pk, sk ) ← Gen ( λ ) pk ( x ∗ , w ∗ ) ← Samp ( λ ) sk x ∗ ← Punc ( sk, x ∗ ) y ∗ 0 ← F ( sk, x ∗ ) y ∗ ← − Y 1 x ∗ , y ∗ β , sk x ∗ β ′ | Pr [ β = β ′ ] − 1/2 | ≤ negl ( λ )
Security of (Puncturable) Publicly Evaluable PRF R R 30 / 51 ← − { 0 , 1 } β β =? ( pk, sk ) ← Gen ( λ ) pk ( x ∗ , w ∗ ) ← Samp ( λ ) sk x ∗ ← Punc ( sk, x ∗ ) f i y ∗ 0 ← F ( sk, x ∗ ) f i ( sk ) y ∗ ← − Y 1 x ∗ , y ∗ β , sk x ∗ β ′ | Pr [ β = β ′ ] − 1/2 | ≤ negl ( λ )
LR-PEPRF from Punc-PEPRF 1 : Ext to from LR PEPRF Ext output Input: Idea: Obfuscate-and-Extract Constants: Punc-PEPRF secret key Priv Ext Pub Priv Samp Gen 31 / 51
LR-PEPRF from Punc-PEPRF Priv : Ext to from LR PEPRF Ext output 1 Input: Constants: Punc-PEPRF secret key Ext 31 / 51 Idea: Obfuscate-and-Extract ( pk, sk ) ← Gen ( λ ) Priv ( sk, x ) X F ( sk, x ) Y L Samp ( λ ) Pub ( pk, x, w ) W
LR-PEPRF from Punc-PEPRF Priv : Ext to from LR PEPRF Ext output 1 Input: Constants: Punc-PEPRF secret key Ext Idea: Obfuscate-and-Extract 31 / 51 ( pk, sk ) ← Gen ( λ ) Priv ( sk, x ) X F ( sk, x ) Y L Samp ( λ ) Pub ( pk, x, w ) W S
LR-PEPRF from Punc-PEPRF Idea: Obfuscate-and-Extract LR PEPRF Ext output 1 Input: Constants: Punc-PEPRF secret key Priv Ext 31 / 51 ( pk, sk ) ← Gen ( λ ) Priv ( sk, x ) X F ( sk, x ) Y L Samp ( λ ) Z Pub ( pk, x, w ) W S ˆ F from X × S to Z : Ext ( F ( sk, x ) , s )
LR-PEPRF from Punc-PEPRF Ext LR PEPRF 1 Priv Idea: Obfuscate-and-Extract 31 / 51 i O Constants: Punc-PEPRF secret key sk ( pk, sk ) ← Gen ( λ ) ˆ sk Input: ˆ x = ( x, s ) output z ← Ext ( F ( sk, x ) , s ) Priv ( sk, x ) X F ( sk, x ) Y L Samp ( λ ) Z Pub ( pk, x, w ) W S ˆ F from X × S to Z : Ext ( F ( sk, x ) , s )
32 / 51 R setting. Theorem: The above PEPRF ˆ F is leakage-resilient under appropriate parameter Game 0. (the original game) ˆ sk ← i O ( Priv ) sk ← i O ( Priv ∗ ) , where y ∗ ← F ( sk, x ∗ ) Game 1. ˆ Priv ∗ Constants: Punc-PEPRF punctured key sk x ∗ , x ∗ and y ∗ Input: ˆ x = ( x, s ) 1 If x = x ∗ , output Ext ( y ∗ , s ) . Else, output Ext ( F ( sk x ∗ , x ) , s ) . Game 2. y ∗ ← − Y Priv ≡ Priv ∗ + i O ⇒ Game 0 ≈ c Game 1 punc-PEPRF ⇒ Game 1 ≈ c Game 2 randomness extractor ⇒ z ∗ ← Ext ( y ∗ , s ∗ ) ≈ s U Z
Constructions of Punc-PEPRF How to construct Punc-PEPRF? clarify and encompass Dachman-Soled et al’s construction instantiated succinctly “derivable” is a mild property that satisfjed by all the known realizations of 33 / 51 i O ( Punc-PEPRF ) ⇝ LR-PEPRF ⇒ LR-KEM wPPRF+PRG+ i O (a slight modifjcation of SW KEM) Punc-TDF ⇐ correlated-product TDF [RS09] PTDF can be viewed as a special type of adaptive TDF – O inv can be Punc-EHPS ⇐ derivable EHPS EHPS [Wee10]
Signifjcance Matsuda and Hanaoka [MH15]: Punc-KEM – capture a common pattern towards CCA security CCA security obtained via punctured road can be converted to Leakage-Resilience PKE via CP-TDF PKE via EHPS 34 / 51 Punc-PEPRF ⇒ Punc-KEM with perfect punctured decapsulation soundness in a non-black-box manner via i O
Outline Leakage-Resilient PKE Leakage-Resilient SKE Leakage-Resilient Signature 35 / 51 1 Background 2 Motivation 3 Primitives 4 Our Framework Towards Leakage-Resilience 5 Achieving Optimal Leakage Rate
Extension to the Symmetric Setting Ext LR wPRF 1 Priv 36 / 51 i O ( weak-Punc-PRF ) ⇝ LR-weak-PRF ⇒ LR-SKE i O Constants: wPPRF secret key sk ( pp, sk ) ← Gen ( λ ) ˆ sk Input: ˆ x = ( x, s ) output z ← Ext ( F ( sk, x ) , s ) F ( sk, x ) X Y Z S ˆ F from X × S to Z : Ext ( F ( sk, x ) , s )
Outline Leakage-Resilient PKE Leakage-Resilient SKE Leakage-Resilient Signature 37 / 51 1 Background 2 Motivation 3 Primitives 4 Our Framework Towards Leakage-Resilience 5 Achieving Optimal Leakage Rate
Extenstion to Signature set the signing key as obfuscated program develop leakage translation mechanism This solves the open problem posed by Boyle et al. [BSW11] (Eurocrypt’ 11) 38 / 51 Starting Point – Sahai-Waters Signature (from PRG, sPPRF, and i O ) LR OWF + sPPRF + i O ⇒ public-coin LR SIG
Outline Leakage-Resilient PKE Leakage-Resilient SKE Leakage-Resilient Signature 39 / 51 1 Background 2 Motivation 3 Primitives 4 Our Framework Towards Leakage-Resilience 5 Achieving Optimal Leakage Rate
How to achieve optimal leakage rate? The leakage rate of our basic constructions is low Can we achieve optimal leakage rate? 40 / 51 secret key is an obfuscated program � large size the maximum leakage amount ≤ log 2 | Y |
Dachman-Soled et al. ’s Approach Secret key – a secret obfuscated program (like a gun that must be kept secretly) Decompose the secret obfuscated program make the logic part public set a trigger device inside the public program and use trigger as the secret key 41 / 51
Dachman-Soled et al. ’s Approach Secret key – a secret obfuscated program (like a gun that must be kept secretly) Decompose the secret obfuscated program make the logic part public set a trigger device inside the public program and use trigger as the secret key 41 / 51
The Case of LR-PEPRF from Punc-PEPRF Priv Priv 42 / 51 Constants: Punc-PEPRF secret key sk Input: ˆ x = ( x, s ) 1 Output z ← Ext ( F ( sk, x ) , s ) Modifjcation: ct ∗ ← Enc ( k e , 0 n ) , n = log | Y | ; pick a CRHF h , set h ( ct ∗ ) = t ∗ ct ∗ is set as secret key, obfuscated program is made public. Constants: Punc-PEPRF secret key sk , t ∗ Input: ct , ˆ x = ( x, s ) 1 If h ( ct ) ̸ = t ∗ , output ⊥ . Else, output z ← Ext ( F ( sk, x ) , s ) . greatly shrink the size of secret key: an obfuscated program � a ciphertext
Security Proof R 43 / 51 Game 0. C eval ← i O ( Priv ) as part of pk , ct ∗ ← SKE . Enc ( k e , 0 n ) as sk . Game 1. ct ∗ ← SKE . Enc ( k e , y ∗ ) , where y ∗ ← F ( sk, x ∗ ) Game 2. C eval ← i O ( Priv ∗ ) Game 3. y ∗ ← − Y Priv ∗ Constants: Punc-PEPRF punctured secret key sk x ∗ , k e , t ∗ Input: ct , ˆ x = ( x, s ) 1 If h ( ct ) ̸ = t ∗ , output ⊥ . 2 Else if x = x ∗ , set y ∗ ← SKE . Dec ( k e , ct ) , output z ← Ext ( y ∗ , s ) . 3 Otherwise, output z ← Ext ( F ( sk, x ) , s ) . | t ∗ | + ℓ ≤ | Y | , | Y | ≤ | ct ∗ | and ρ = ℓ / | ct ∗ |
Analysis To achieve optimal leakage rate The choice may make the programs in Game 1 and Game 2 have difgering-inputs 44 / 51 h must be compressing to decrease | t ∗ | , otherwise t ∗ (hardwired in public program) will reveal too much information of y ∗ ← F ( sk, x ∗ ) a collision: ct ′ ̸ = ct ∗ but h ( ct ′ ) = t ∗ = h ( ct ∗ ) where ct ′ decrypts to y ′ ̸ = y ∗ � one have to resort to difgering-input obfuscation, which is highly suspicious.
This trick might be instructive elsewhere for avoiding difgering-input obfuscation Our Technique 45 / 51 Idea: replace CRHF with lossy function Injective mode: ensure Priv and Priv ∗ are equivalent � safely use i O Lossy mode: switch to lossy mode to greatly reduce | t ∗ | � t ∗ only leaks very little information of y ∗ , By appropriate parameter choice, ρ = 1 − o (1) This settles the open problem posed by Dachman-Soled et al. [DGL + 16]: achieving optimal leakage ratio without resorting to di O
Conclusion We develop a framework for building leakage-resilient cryptography in BLM from Major insight: various punc-PRFs can achieve LR on an obfuscated street as a building block of independent interest, we realize punc-PEPRF from newly introduced punc-objects such as PTDFs and PEHPS. solve the open problem posed by Boyle et al. (Eurocrypt 2011) optimal leakage rate – not known to be achievable for wPRF, PEPRF and public-coin Sig before. solve the open problem posed by Dachman-Soled et al. (PKC 2016, JOC 2018) 46 / 51 punc-primitives and i O . 1 wPPRF+ i O ⇝ LR wPRF ⇒ LR-SKE 2 punc-PEPRF+ i O ⇝ LR PEPRF ⇒ LR-PKE 3 sPPRF+ LR-OWF + i O ⇒ the fjrst LR-public-coin Sig 4 By further assuming lossy functions, all the above constructions achieve
Thanks for Your Attention! Any Questions? https://eprint.iacr.org/2018/781 47 / 51
Recommend
More recommend
