Lossy Trapdoor Functions and Their Applications Chris Peikert - - PowerPoint PPT Presentation

▶
lossy trapdoor functions and their applications
SMART_READER_LITE
LIVE PREVIEW

Lossy Trapdoor Functions and Their Applications Chris Peikert - - PowerPoint PPT Presentation

Feb 08, 2023 195 likes •932 views

Lossy Trapdoor Functions and Their Applications Chris Peikert Brent Waters SRI International 1 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing

slide-1
SLIDE 1

Lossy Trapdoor Functions and Their Applications

Chris Peikert Brent Waters

SRI International

1 / 15

slide-2
SLIDE 2

On Losing Information

2 / 15

slide-3
SLIDE 3

On Losing Information

2 / 15

slide-4
SLIDE 4

On Losing Information

2 / 15

slide-5
SLIDE 5

On Losing Information

2 / 15

slide-6
SLIDE 6

On Losing Information

2.3 MB → 0.4 MB

2 / 15

slide-7
SLIDE 7

On Losing Information

2 / 15

slide-8
SLIDE 8

On Losing Information

Lossy object indistinguishable from original

2 / 15

slide-9
SLIDE 9

This Talk

1 Trapdoor functions without factoring: discrete log & lattices

3 / 15

slide-10
SLIDE 10

This Talk

1 Trapdoor functions without factoring: discrete log & lattices 2 Black-box chosen-ciphertext security via randomness recovery

3 / 15

slide-11
SLIDE 11

This Talk

1 Trapdoor functions without factoring: discrete log & lattices 2 Black-box chosen-ciphertext security via randomness recovery 3 A new general primitive: Lossy Trapdoor Functions

3 / 15

slide-12
SLIDE 12

Public Key Cryptography

1-1 Trapdoor Functions ( F , F−1 ) ← S {0, 1}n {0, 1}N x F(x) F

4 / 15

slide-13
SLIDE 13

Public Key Cryptography

1-1 Trapdoor Functions ( F , F−1 ) ← S {0, 1}n {0, 1}N x F(x) F

4 / 15

slide-14
SLIDE 14

Public Key Cryptography

1-1 Trapdoor Functions ( F , F−1 ) ← S {0, 1}n {0, 1}N x F(x) F F−1

4 / 15

slide-15
SLIDE 15

Public Key Cryptography

1-1 Trapdoor Functions Public Key Encryption ( F , F−1 ) ← S {0, 1}n {0, 1}N x F(x) F F−1 ( E , D) ← S {0, 1}N m r E(m ; r)

4 / 15

slide-16
SLIDE 16

Public Key Cryptography

1-1 Trapdoor Functions Public Key Encryption ( F , F−1 ) ← S {0, 1}n {0, 1}N x F(x) F F−1 ( E , D) ← S {0, 1}N m r E(m ; r) D

4 / 15

slide-17
SLIDE 17

Realizing Public Key Crypto

Factoring Discrete log Lattices PKE ✔ [RSA,. . . ] ✔ [ElGamal] ✔ [AD,R1,R2] CCA ✔ [DDN,. . . ,CS2] ✔ [CS1] ?? TDF ✔ [RSA,R,P] ?? ??

5 / 15

slide-18
SLIDE 18

Realizing Public Key Crypto

Factoring Discrete log Lattices PKE ✔ [RSA,. . . ] ✔ [ElGamal] ✔ [AD,R1,R2] CCA ✔ [DDN,. . . ,CS2] ✔ [CS1] ?? TDF ✔ [RSA,R,P] ?? ?? Lattice-Based Crypto: ◮ Simple & parallelizable ◮ Resist quantum algorithms (so far) ◮ Security from worst-case assumptions [Ajtai,. . . ]

5 / 15

slide-19
SLIDE 19

Realizing Public Key Crypto

Factoring Discrete log Lattices PKE ✔ [RSA,. . . ] ✔ [ElGamal] ✔ [AD,R1,R2] CCA ✔ [DDN,. . . ,CS2] ✔ [CS1] ?? TDF ✔ [RSA,R,P] ?? ?? Black-Box Separations: PKE TDF CCA

[GMR] [GMM]

5 / 15

slide-20
SLIDE 20

Realizing Public Key Crypto

Factoring Discrete log Lattices PKE ✔ [RSA,. . . ] ✔ [ElGamal] ✔ [AD,R1,R2] CCA ✔ [DDN,. . . ,CS2] ✔ [CS1] ✔ TDF ✔ [RSA,R,P] ✔ ✔ This Work: Lossy TDF Factoring Disc log Lattices TDF CCA CRHF , OT, . . .

5 / 15

slide-21
SLIDE 21

Lossy Trapdoor Functions

( F , F−1 ) ← Sinj {0, 1}n {0, 1}N x F F−1

6 / 15

slide-22
SLIDE 22

Lossy Trapdoor Functions

( F , F−1 ) ← Sinj {0, 1}n {0, 1}N x F F−1 F ← Sloss {0, 1}n {0, 1}N |Im(F)| = 2r ≪ 2n x F

6 / 15

slide-23
SLIDE 23

Lossy Trapdoor Functions

( F , F−1 ) ← Sinj {0, 1}n {0, 1}N x F F−1 F ← Sloss {0, 1}n {0, 1}N |Im(F)| = 2r ≪ 2n x F

6 / 15

slide-24
SLIDE 24

Lossy Trapdoor Functions

F

c

≈ F ( F , F−1 ) ← Sinj {0, 1}n {0, 1}N x F F−1 F ← Sloss {0, 1}n {0, 1}N |Im(F)| = 2r ≪ 2n x F

6 / 15

slide-25
SLIDE 25

Lossy TDFs ⇒ 1-1 Trapdoor Functions

Theorem ◮ Sinj generates 1-1 trapdoor functions (F, F−1).

7 / 15

slide-26
SLIDE 26

Lossy TDFs ⇒ 1-1 Trapdoor Functions

Theorem ◮ Sinj generates 1-1 trapdoor functions (F, F−1). ◮ Efficient I wants to invert F. {0, 1}n x F Sinj I

?

= x

7 / 15

slide-27
SLIDE 27

Lossy TDFs ⇒ 1-1 Trapdoor Functions

Theorem ◮ Sinj generates 1-1 trapdoor functions (F, F−1). ◮ Efficient I wants to invert F. {0, 1}n x F Sloss I

✗

= x

7 / 15

slide-28
SLIDE 28

Lossy TDFs ⇒ 1-1 Trapdoor Functions

Theorem ◮ Sinj generates 1-1 trapdoor functions (F, F−1). ◮ Efficient I wants to invert F. {0, 1}n x F Sloss I

✗

= x ◮ F(x) has 2n−r preimages (on average).

7 / 15

slide-29
SLIDE 29

Lossy TDFs ⇒ 1-1 Trapdoor Functions

Theorem ◮ Sinj generates 1-1 trapdoor functions (F, F−1). ◮ Efficient I wants to invert F. {0, 1}n x F Sloss I

✗

= x ◮ F(x) has 2n−r preimages (on average). Main Technique ◮ Swapping F with F yields statistically secure system.

7 / 15

slide-30
SLIDE 30

Lossy TDFs ⇒ Public-Key Encryption

◮ Hard-core functions [GoldreichLevin] — the lazy way.

8 / 15

slide-31
SLIDE 31

Lossy TDFs ⇒ Public-Key Encryption

◮ Hard-core functions [GoldreichLevin] — the lazy way.

  • Pairwise independent H : {0, 1}n → {0, 1}k for k ≈ n − r.

8 / 15

slide-32
SLIDE 32

Lossy TDFs ⇒ Public-Key Encryption

◮ Hard-core functions [GoldreichLevin] — the lazy way.

  • Pairwise independent H : {0, 1}n → {0, 1}k for k ≈ n − r.

x F H F(x) H(x)

8 / 15

slide-33
SLIDE 33

Lossy TDFs ⇒ Public-Key Encryption

◮ Hard-core functions [GoldreichLevin] — the lazy way.

  • Pairwise independent H : {0, 1}n → {0, 1}k for k ≈ n − r.

x F H F(x) H(x)

8 / 15

slide-34
SLIDE 34

Lossy TDFs ⇒ Public-Key Encryption

◮ Hard-core functions [GoldreichLevin] — the lazy way.

  • Pairwise independent H : {0, 1}n → {0, 1}k for k ≈ n − r.

x F H F(x) H(x) entropy k k unif bits

[ILL,DRS]

8 / 15

slide-35
SLIDE 35

Lossy TDFs ⇒ Public-Key Encryption

◮ Hard-core functions [GoldreichLevin] — the lazy way.

  • Pairwise independent H : {0, 1}n → {0, 1}k for k ≈ n − r.

x F H F(x) H(x) entropy k k unif bits

[ILL,DRS]

◮ Public key (F, H), secret key F−1. Encrypt m ∈ {0, 1}k as (F(x), m ⊕ H(x)).

8 / 15

slide-36
SLIDE 36

Chosen Ciphertext-Secure Encryption

Intuitive Definition

[DDN,NY,RS]

◮ Encryption hides message, even with decryption oracle

9 / 15

slide-37
SLIDE 37

Chosen Ciphertext-Secure Encryption

Intuitive Definition

[DDN,NY,RS]

◮ Encryption hides message, even with decryption oracle Why It Matters ◮ “Correct” security notion for active adversaries ◮ Real-world attacks on protocols [Bleichenbacher,JKS]

9 / 15

slide-38
SLIDE 38

Chosen Ciphertext-Secure Encryption

Intuitive Definition

[DDN,NY,RS]

◮ Encryption hides message, even with decryption oracle Why It Matters ◮ “Correct” security notion for active adversaries ◮ Real-world attacks on protocols [Bleichenbacher,JKS] Technical Difficulty ◮ Verify ciphertext is “well-formed” ◮ Usually via zero-knowledge proof ◮ Our approach: recover randomness

9 / 15

slide-39
SLIDE 39

All-But-One TDFs

◮ G(b, x) has extra parameter: branch b ∈ {0, 1}n.

10 / 15

slide-40
SLIDE 40

All-But-One TDFs

◮ G(b, x) has extra parameter: branch b ∈ {0, 1}n. ◮ Generate (G, G−1) with hidden lossy branch ℓ.

10 / 15

slide-41
SLIDE 41

All-But-One TDFs

◮ G(b, x) has extra parameter: branch b ∈ {0, 1}n. ◮ Generate (G, G−1) with hidden lossy branch ℓ. G G(0, ·) G(1, ·) · · · G(ℓ, ·) G(ℓ + 1, ·) · · ·

10 / 15

slide-42
SLIDE 42

All-But-One TDFs

◮ G(b, x) has extra parameter: branch b ∈ {0, 1}n. ◮ Generate (G, G−1) with hidden lossy branch ℓ. G G(0, ·) G(1, ·) · · · G(ℓ, ·) G(ℓ + 1, ·) · · · ◮ Lossy TDFs ⇔ all-but-one TDFs.

10 / 15

slide-43
SLIDE 43

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) F−1

11 / 15

slide-44
SLIDE 44

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) F−1 Encrypt m y1 = F(x) y2 = G(b , x) c = H(x) ⊕ m

11 / 15

slide-45
SLIDE 45

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) F−1 Encrypt m y1 = F(x) y2 = G(b , x) c = H(x) ⊕ m Decrypt y1 y2 c

11 / 15

slide-46
SLIDE 46

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) F−1 Encrypt m y1 = F(x) y2 = G(b , x) c = H(x) ⊕ m Decrypt Recover x = F−1(y1). Reencrypt & check. y1 y2 c

11 / 15

slide-47
SLIDE 47

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) F−1 Encrypt m y1 = F(x) y2 = G(b , x) c = H(x) ⊕ m Decrypt Recover x = F−1(y1). Reencrypt & check. y1 y2 c c ⊕ H(x)

  • r ⊥

11 / 15

slide-48
SLIDE 48

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) F−1 Challenge m y1 = F(x) y2 = G(ℓ , x) c = H(x) ⊕ m Decrypt Recover x = F−1(y1). Reencrypt & check. y1 y2 c c ⊕ H(x)

  • r ⊥

11 / 15

slide-49
SLIDE 49

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) G−1 Challenge m y1 = F(x) y2 = G(ℓ , x) c = H(x) ⊕ m Decrypt Recover x = G−1(y2). Reencrypt & check. y1 y2 c c ⊕ H(x)

  • r ⊥

11 / 15

slide-50
SLIDE 50

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) G−1 Challenge m y1 = F(x) y2 = G(ℓ , x) c = H(x) ⊕ m Decrypt Recover x = G−1(y2). Reencrypt & check. y1 y2 c c ⊕ H(x)

  • r ⊥

11 / 15

slide-51
SLIDE 51

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) G−1 Challenge m y1 = F(x) y2 = G(ℓ , x) c = H(x) ⊕ m Decrypt Recover x = G−1(y2). Reencrypt & check. y1 y2 c c ⊕ H(x)

  • r ⊥

◮ Challenge ciphertext hides m statistically.

11 / 15

slide-52
SLIDE 52

Lossy TDFs ⇒ CCA-Secure Encryption

KeyGen ( F , G , H ) G−1 Challenge m y1 = F(x) y2 = G(ℓ , x) c = H(x) ⊕ m Decrypt Recover x = G−1(y2). Reencrypt & check. y1 y2 c c ⊕ H(x)

  • r ⊥

◮ Challenge ciphertext hides m statistically. ◮ (One-time signature for CCA2 security. [DolevDworkNaor])

11 / 15

slide-53
SLIDE 53

Realizing Lossy TDFs

◮ Use any (additively) homomorphic cryptosystem.

12 / 15

slide-54
SLIDE 54

Realizing Lossy TDFs

◮ Use any (additively) homomorphic cryptosystem. ◮ Encrypted n × n matrix: I for F, 0 for F. F−1 is decryption key.

12 / 15

slide-55
SLIDE 55

Realizing Lossy TDFs

◮ Use any (additively) homomorphic cryptosystem. ◮ Encrypted n × n matrix: I for F, 0 for F. F−1 is decryption key. ◮ F(x) computed by “encrypted linear algebra.”

12 / 15

slide-56
SLIDE 56

Realizing Lossy TDFs

◮ Use any (additively) homomorphic cryptosystem. ◮ Encrypted n × n matrix: I for F, 0 for F. F−1 is decryption key. ◮ F(x) computed by “encrypted linear algebra.”       1 · · · 1 . . . ... 1            x1 x2 . . . xn      =       x1 x2 . . . xn      

12 / 15

slide-57
SLIDE 57

Realizing Lossy TDFs

◮ Use any (additively) homomorphic cryptosystem. ◮ Encrypted n × n matrix: I for F, 0 for F. F−1 is decryption key. ◮ F(x) computed by “encrypted linear algebra.”       · · · . . . ...            x1 x2 . . . xn      =       . . .      

12 / 15

slide-58
SLIDE 58

Realizing Lossy TDFs

◮ Use any (additively) homomorphic cryptosystem. ◮ Encrypted n × n matrix: I for F, 0 for F. F−1 is decryption key. ◮ F(x) computed by “encrypted linear algebra.”       · · · . . . ...            x1 x2 . . . xn      =       . . .       ◮ Randomness in each 0 leaks information!

12 / 15

slide-59
SLIDE 59

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

13 / 15

slide-60
SLIDE 60

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

1 Secure to reuse randomness across different keys

13 / 15

slide-61
SLIDE 61

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

1 Secure to reuse randomness across different keys 2 Homomorphism isolates randomness

13 / 15

slide-62
SLIDE 62

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

1 Secure to reuse randomness across different keys 2 Homomorphism isolates randomness

       0 ; r1 0 ; r1 . . . 0 ; r1       

13 / 15

slide-63
SLIDE 63

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

1 Secure to reuse randomness across different keys 2 Homomorphism isolates randomness

       0 ; r1 0 ; r2 0 ; r1 0 ; r2 . . . 0 ; r1 0 ; r2       

13 / 15

slide-64
SLIDE 64

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

1 Secure to reuse randomness across different keys 2 Homomorphism isolates randomness

       0 ; r1 0 ; r2 · · · 0 ; rn 0 ; r1 0 ; r2 0 ; rn . . . ... 0 ; r1 0 ; r2 0 ; rn       

13 / 15

slide-65
SLIDE 65

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

1 Secure to reuse randomness across different keys 2 Homomorphism isolates randomness

       0 ; r1 0 ; r2 · · · 0 ; rn 0 ; r1 0 ; r2 0 ; rn . . . ... 0 ; r1 0 ; r2 0 ; rn             x1 x2 . . . xn      =        0 ; R 0 ; R . . . 0 ; R       

13 / 15

slide-66
SLIDE 66

Realizing Lossy TDFs (Really)

◮ Homomorphic cryptosystem with special properties:

1 Secure to reuse randomness across different keys 2 Homomorphism isolates randomness

       0 ; r1 0 ; r2 · · · 0 ; rn 0 ; r1 0 ; r2 0 ; rn . . . ... 0 ; r1 0 ; r2 0 ; rn             x1 x2 . . . xn      =        0 ; R 0 ; R . . . 0 ; R        ◮ Just need n > |R| for lossiness.

13 / 15

slide-67
SLIDE 67

Concrete Assumptions

1 Decisional Diffie-Hellman (DDH) on cyclic groups

  • Additive homomorphism in ElGamal: message in the exponent
  • Reusing randomness [NaorReingold,Kurosawa,. . . ]

14 / 15

slide-68
SLIDE 68

Concrete Assumptions

1 Decisional Diffie-Hellman (DDH) on cyclic groups

  • Additive homomorphism in ElGamal: message in the exponent
  • Reusing randomness [NaorReingold,Kurosawa,. . . ]

2 Learning With Errors (LWE) on lattices [Regev]

  • Bounded homomorphism
  • Reuse most randomness — but not the error terms

14 / 15

slide-69
SLIDE 69

Future Directions

◮ Other applications of lossy TDFs (NIZK, PIR, . . . ?)

15 / 15

slide-70
SLIDE 70

Future Directions

◮ Other applications of lossy TDFs (NIZK, PIR, . . . ?) ◮ “Natural” trapdoors for lattices [GPV]

15 / 15

slide-71
SLIDE 71

Future Directions

◮ Other applications of lossy TDFs (NIZK, PIR, . . . ?) ◮ “Natural” trapdoors for lattices [GPV] ◮ Other indistinguishable properties of “huge” objects?

15 / 15