Multilinear maps from lattices Constructions, attacks, and - PowerPoint PPT Presentation

GGH15 > (Ring)LWE analogy: in a nutshell A, S 1 A+E 1 ,..., S k A+E k → ∏SA+E mod q > GGH15: (also appear as “cascaded LWE” in [ Koppula-Waters 16], [ Alamati-Peikert 16]) A 0 D 1 = S 1 A 1 +E 1 , A 1 D 2 = S 2 A 2 +E 2 mod q D i is sampled using the trapdoor of A i-1 39

GGH15 > (Ring)LWE analogy: in a nutshell A, S 1 A+E 1 ,..., S k A+E k → ∏SA+E mod q > GGH15: (also appear as “cascaded LWE” in [ Koppula-Waters 16], [ Alamati-Peikert 16]) A 0 D 1 = S 1 A 1 +E 1 , A 1 D 2 = S 2 A 2 +E 2 mod q D i is sampled using the trapdoor of A i-1 = mod q D 1 S 1 A 1 +E 1 A 0 = mod q D 2 S 2 A 2 +E 2 A 1 40

Zoom in the most important relation of S is the eigenvalue of D this talk A i-1 D i x = A i S i + E mod q D i is sampled using the trapdoor of A i-1 41

GGH15 > (Ring)LWE analogy: in a nutshell A, S 1 A+E 1 ,..., S k A+E k → ∏SA+E mod q > GGH15: (also appear as “cascaded LWE” in [ Koppula-Waters 16], [ Alamati-Peikert 16]) A 0 D 1 = S 1 A 1 +E 1 , A 1 D 2 = S 2 A 2 +E 2 mod q D i is sampled using the trapdoor of A i-1 Publish A 0 , D 1 , D 2 as the encodings of S 1 , S 2 42

GGH15 > (Ring)LWE analogy: in a nutshell A, S 1 A+E 1 ,..., S k A+E k → ∏SA+E mod q > GGH15: (also appear as “cascaded LWE” in [ Koppula-Waters 16], [ Alamati-Peikert 16]) A 0 D 1 = S 1 A 1 +E 1 , A 1 D 2 = S 2 A 2 +E 2 mod q D i is sampled using the trapdoor of A i-1 Publish A 0 , D 1 , D 2 as the encodings of S 1 , S 2 Eval = A 0 D 1 D 2 = (S 1 A 1 +E 1 )D 2 = S 1 S 2 A 2 + S 1 E 2 + E 1 D 2 mod q functionality small 43

A toy example of GGH15 eval D 1,1 D 2,1 D 3,1 D 4,1 A 0 D 1,0 D 2,0 D 3,0 D 4,0 Eval(0110) = A 0 D 1,0 D 2,1 D 3,1 D 4,0 A i-1 D i, b = x A i S i, b + E mod q 44

A toy example of GGH15 eval ( ) D 2,1 D 3,1 D 4,1 + S 1,1 E 1,1 A 1 + S 1,0 E 1,0 D 2,0 D 3,0 D 4,0 Eval(0110) = A 0 D 1,0 D 2,1 D 3,1 D 4,0 = (s 1,0 A 1 +E 1,0 )D 2,1 D 3,1 D 4,0 A i-1 D i, b = x A i S i, b + E mod q 45

D 2,1 D 3,1 D 4,1 S 1,1 A 1 S 1,0 D 2,0 D 3,0 D 4,0 Eval(0110) + “small” = A 0 D 1,0 D 2,1 D 3,1 D 4,0 = (s 1,0 A 1 +E 1,0 )D 2,1 D 3,1 D 4,0 = s 1,0 A 1 D 2,1 D 3,1 D 4,0 + “small” A toy example of GGH15 eval 46

( ) D 3,1 D 4,1 + S 1,1 S 2,1 E 2,1 A 2 + S 1,0 S 2,0 E 2,0 D 3,0 D 4,0 Eval(0110) + “small” = A 0 D 1,0 D 2,1 D 3,1 D 4,0 = (s 1,0 A 1 +E 1,0 )D 2,1 D 3,1 D 4,0 = s 1,0 A 1 D 2,1 D 3,1 D 4,0 + “small” A toy example = s 1,0 (s 2,1 A 2 +E 2,1 )D 3,1 D 4,0 + “small” of GGH15 eval 47

D 3,1 D 4,1 S 1,1 S 2,1 A 2 S 1,0 S 2,0 D 3,0 D 4,0 + Eval(0110) “still small” = A 0 D 1,0 D 2,1 D 3,1 D 4,0 = (s 1,0 A 1 +E 1,0 )D 2,1 D 3,1 D 4,0 = s 1,0 A 1 D 2,1 D 3,1 D 4,0 + “small” A toy example = s 1,0 (s 2,1 A 2 +E 2,1 )D 3,1 D 4,0 + “small” = s 1,0 s 2,1 A 2 D 3,1 D 4,0 + “still small” of GGH15 eval 48

S 1,1 S 2,1 S 3,1 S 4,1 A 4 S 1,0 S 2,0 S 3,0 S 4,0 “still small” + Eval(0110) = A 0 D 1,0 D 2,1 D 3,1 D 4,0 = (s 1,0 A 1 +E 1,0 )D 2,1 D 3,1 D 4,0 = s 1,0 A 1 D 2,1 D 3,1 D 4,0 + “small” A toy example = s 1,0 (s 2,1 A 2 +E 2,1 )D 3,1 D 4,0 + “small” = s 1,0 s 2,1 A 2 D 3,1 D 4,0 + “still small” of GGH15 eval = s 1,0 s 2,1 s 3,1 A 3 D 4,0 + “still smallish” = s 1,0 s 2,1 s 3,1 s 4,0 A 4 + “small” 49

S 1,1 S 2,1 S 3,1 S 4,1 A 4 S 1,0 S 2,0 S 3,0 S 4,0 + “small” e t a u l a v E D 1,1 D 2,1 D 3,1 D 4,1 A toy example A 0 of GGH15 eval D 1,0 D 2,0 D 3,0 D 4,0 50

Functionality D 1,1 D 2,1 D 3,1 D 4,1 A 0 D 1,0 D 2,0 D 3,0 D 4,0 A 0 , S 1 A 1 +E 1 ,..., S k A k +E k → ∏SA k +E mod q Functionality: evaluate and test whether ∏S is zero or not. (Designing GGH15 applications: put structures in S i, b ) 51

Functionality D 1,1 D 2,1 D 3,1 D 4,1 and Security A 0 D 1,0 D 2,0 D 3,0 D 4,0 A 0 , S 1 A 1 +E 1 ,..., S k A k +E k → ∏SA k +E mod q Functionality: evaluate and test whether ∏S is zero or not. (Designing GGH15 applications: put structures in S i, b ) Security (intuitively): hides S i, b for all i, b 52

Functionality & Security S D 1,1 +E = A 1 A 0 toy examples S S = +E A 0 D 1,0 A 1 ∏SA 2 +E S D 2,1 = +E A 2 A 1 F(00) = 0 S F(01) = 1 F(10) = 1 = +E D 2,0 A 2 A 1 S F(11) = 1 53

Functionality & Security S D 1,1 +E = A 1 A 0 toy examples S S = +E A 0 D 1,0 A 1 S S D 2,1 = +E A 2 A 1 S Claim: this construction hides all the structures in the S matrices. S = +E D 2,0 A 2 A 1 S 54

Recall decisional LWE + E A S x A , ≈ computational A U , Permutation - LWE: A(1) A(1) S + E A(2) x A(2) S , A(3) A(3) S ≈ computational A(1) , U A(2) A(3) 55

Functionality & Security S D 1,1 +E = A 1 A 0 toy examples S S = +E A 0 D 1,0 A 1 S S D 2,1 = +E A 2 A 1 S Claim: this construction hides all the structures in the S matrices. S = +E D 2,0 A 2 A 1 S 56

Functionality & Security S D 1,1 +E = A 1 A 0 toy examples S S = +E A 0 D 1,0 A 1 S D 2,1 = U 2,1 A 1 = U 2,0 D 2,0 A 1 Permutation LWE 57

Functionality & Security S D 1,1 +E = A 1 A 0 toy examples S S = +E A 0 D 1,0 A 1 S D 2,1 = U 2,1 A 1 = U 2,0 D 2,0 A 1 Turn off the trapdoor using GPV 58

Functionality & Security U 1,1 D 1,1 = A 0 toy examples = U 1,0 A 0 D 1,0 D 2,1 = U 2,1 A 1 = U 2,0 D 2,0 A 1 Permutation LWE 59

Functionality & Security U 1,1 D 1,1 = A 0 toy examples = U 1,0 A 0 D 1,0 D 2,1 = U 2,1 A 1 = U 2,0 D 2,0 A 1 Turn off the trapdoor using GPV 60

Ok, looks simple. Are there insecure examples? 61

For example, let S 2 = 0 in Insecurity A 0 D 1 = S 1 A 1 +E 1 , A 1 D 2 = S 2 A 2 +E 2 mod q example = mod q D 1 S 1 A 1 +E 1 A 0 = mod q D 2 E 2 A 1 62

For example, let S 2 = 0 in Insecurity A 0 D 1 = S 1 A 1 +E 1 , A 1 D 2 = S 2 A 2 +E 2 mod q example D 2 becomes a “weak trapdoor” of A 1 , then S 1 is in danger = mod q D 1 S 1 A 1 +E 1 A 0 = mod q D 2 E 2 A 1 63

For example, let S 2 = 0 in Insecurity A 0 D 1 = S 1 A 1 +E 1 , A 1 D 2 = S 2 A 2 +E 2 mod q example D 2 becomes a “weak trapdoor” of A 1 , then S 1 is in danger Eval = A 0 D 1 D 2 = (S 1 A 1 +E 1 )D 2 = S 1 E 2 + E 1 D 2 mod q Recover S 1 E 2 + E 1 D 2 over integers, can do many things. = mod q D 1 S 1 A 1 +E 1 A 0 = mod q D 2 E 2 A 1 64

Plan of today: 1. Introduction 2. The GGH15 construction: functionality and security overview 3. Applications Open problems will be mentioned throughout the talk 65

Private constrained PRFs [ Canetti, Chen 17 ] Witness encryption Multiparty key agreement [ Chen, Vaikuntanathan, Wee 18 ] Multilinear maps Indistinguishability obfuscation Deniable encryption Lockable obfuscation (Compute-then-Compare obf.) Broadcast encryption Reduction from LWE; Candidates exists; Broken 66

What are private constrained PRFs? 67

Private constrained Pseudorandom Function in 3 slides 68

Private constrained Pseudorandom Function in 3 slides A truly random function PRF a d v With oracle access to either left or right 69

Private constrained Pseudorandom Function in 3 slides original key Privately modified key a d v either the original key or the modified one Private key owner 70

What are private constrained PRFs? Fine, so why is it useful? 71

H i d e t h e p r o g r a i m n t h e c o n s t r a i n t Reminiscent of obfuscation ...

Theorem [ Canetti Chen 17 ]: Two-key PCPRF (for a circuit class C) implies obfuscation (for C) Construction: Obf = ( K[C], K[Original] ) Obfuscation Eval(x): check consistency Eval( K[C], x) =? Eval( K[Original], x) C Z 73

Jumping ahead, if you publish two constrained keys, there is an attack … In the rest of the talk, we will focus on: 1-key secure PCPRFs. 74

D e c r y p t a n d e v a l 1-key PCPRF => Reusable Garbled Circuits

Theorem [ Canetti Chen 17 ] 1-key PCPRF implies 1-key private-key functional encryption (reusable garbled circuits). Construction: from normal encryption Sym and PCPRF F Enc(m;r): ct = Enc Sym.K (m;r); tag = F[K](ct) FSK[Sym.K, F.K, C]: constrained key for the “decryption and eval” functionality C(Dec Sym.K ( . )) Eval: compute F[C(Dec Sym.K ( . ))](ct), and compare with tag

Applications of PCPRFs: *Obfuscation Reusable garbled circuits Privately-detectable watermarking Maybe more … 77

What are private constrained PRFs? Why is it useful? How to construct? 78

Step 1: We need a PRF. Step 2: Add a constraint privately. 79

[ Banerjee, Peikert, Rosen ’12 ] Subset-product & rounding ... s 1,1 s 2,1 s n,1 A Key: mod q ... s 1,0 s 2,0 s n,0 F(x) = { ∏s i,xi A } 2 Eval: s i,b are LWE secrets from low-norm distributions 80

Rounding: {t} p : Z q -> Z p Compute t*p/q, then round to the nearest integer In this talk, p=2, q/p>exp(L), q/p ∼ super-polynomial q Amount of noise 81

[ Banerjee, Peikert, Rosen 12 ] Uniform Small Unspecified Proof of pseudorandomness A is public, S i,xi are secret S 1,1 S 2,1 S 3,1 S 4,1 A mod q S 1,0 S 2,0 S 3,0 S 4,0 F(x) = { ∏s i,xi A } 2 Main observation: After rounding, can inject noises without changing functionality whp. 82

[ Banerjee, Peikert, Rosen 12 ] Uniform Small Unspecified Proof of pseudorandomness A is public, S i,xi are secret S 1,1 S 2,1 S 3,1 S 4,1 A mod q S 1,0 S 2,0 S 3,0 S 4,0 F(x) = { ∏s i,xi A } 2 F(0110) = { s 1,0 s 2,1 s 3,1 s 4,0 A } 2 83

[ Banerjee, Peikert, Rosen 12 ] Uniform Small Unspecified Proof of pseudorandomness A is public, S i,xi are secret S 1,1 S 2,1 S 3,1 S 4,1 A mod q S 1,0 S 2,0 S 3,0 S 4,0 F(x) = { ∏s i,xi A } 2 F(0110) = { s 1,0 s 2,1 s 3,1 s 4,0 A } 2 ≈ s { s 1,0 s 2,1 s 3,1 (s 4,0 A+E 4,0 ) } 2 84

[ Banerjee, Peikert, Rosen 12 ] Uniform Small Unspecified Proof of pseudorandomness A is public, S i,xi are secret S 1,1 S 2,1 S 3,1 S 4,1 A mod q S 1,0 S 2,0 S 3,0 S 4,0 F(x) = { ∏s i,xi A } 2 F(0110) = { s 1,0 s 2,1 s 3,1 s 4,0 A } 2 ≈ s { s 1,0 s 2,1 s 3,1 (s 4,0 A+E 4,0 ) } 2 ≈ c { s 1,0 s 2,1 s 3,1 Y ***0 } 2 85

[ Banerjee, Peikert, Rosen 12 ] Uniform Small Unspecified Proof of pseudorandomness A is public, S i,xi are secret S 1,1 S 2,1 S 3,1 S 4,1 A mod q S 1,0 S 2,0 S 3,0 S 4,0 F(x) = { ∏s i,xi A } 2 F(0110) = { s 1,0 s 2,1 s 3,1 s 4,0 A } 2 ≈ s { s 1,0 s 2,1 s 3,1 (s 4,0 A+E 4,0 ) } 2 ≈ c { s 1,0 s 2,1 s 3,1 Y ***0 } 2 ≈ s { s 1,0 s 2,1 (s 3,1 Y ***0 +E 3,1 ) } 2 86

[ Banerjee, Peikert, Rosen 12 ] Uniform Small Unspecified Proof of pseudorandomness A is public, S i,xi are secret S 1,1 S 2,1 S 3,1 S 4,1 A mod q S 1,0 S 2,0 S 3,0 S 4,0 F(x) = { ∏s i,xi A } 2 F(0110) = { s 1,0 s 2,1 s 3,1 s 4,0 A } 2 ≈ s { s 1,0 s 2,1 s 3,1 (s 4,0 A+E 4,0 ) } 2 ≈ c { s 1,0 s 2,1 s 3,1 Y ***0 } 2 ≈ s { s 1,0 s 2,1 (s 3,1 Y ***0 +E 3,1 ) } 2 ≈ c { s 1,0 s 2,1 Y **10 } 2 ≈ … ≈{ Y 0110 } 2 87

[ Banerjee, Peikert, Rosen ’12 ] Subset-product & rounding ... s 1,1 s 2,1 s n,1 A Key: mod q ... s 1,0 s 2,0 s n,0 F(x) = { ∏s i,xi A } 2 Eval: Exercise: show that taking matrix subset-product without rounding does not give a PRF. 88

[ Banerjee, Peikert, Rosen ’12 ] Subset-product & rounding ... s 1,1 s 2,1 s n,1 A Key: mod q ... s 1,0 s 2,0 s n,0 F(x) = { ∏s i,xi A } 2 Eval: Open problem: prove or disprove that when q is a polynomial, the construction is a PRF. 89

... s 1,1 s 2,1 s n,1 A Key: mod q ... s 1,0 s 2,0 s n,0 F(x) = { ∏s i,xi A } 2 Eval: What we need in addition to build a Private Constrained PRF: + Embed structures in the secret terms to perform functionality (Barrington’s theorem) + A proper public mode of the function (GGH15 encoding) 90

Imagine the GGH15 encoding of the PRF S 1,1 S 2,1 S 3,1 S 4,1 A 4 S 1,0 S 2,0 S 3,0 S 4,0 + “small” e t a u l a v E D 1,1 D 2,1 D 3,1 D 4,1 A 0 D 1,0 D 2,0 D 3,0 D 4,0 91

Barrington’s theorem (used to embed a circuit into the key) 92

93 (Bonus) Barrington 1986: log-depth boolean circuits can be recognized by subset products of permutation matrices of width 5. Example: how to represent an AND gate P -1 Q -1 P Q 1 I I I I 0 Input wire 1 Input wire 2 Input wire 1 Input wire 2

94 (Bonus) Barrington 1986: log-depth boolean circuits can be recognized by subset products of permutation matrices of width 5. Example: how to represent an AND gate 0 and 0 1 I I I I 0 Input wire 1 Input wire 2 Input wire 1 Input wire 2

95 (Bonus) Barrington 1986: log-depth boolean circuits can be recognized by subset products of permutation matrices of width 5. Example: how to represent an AND gate 0 and 1 Q -1 Q 1 I I 0 Input wire 1 Input wire 2 Input wire 1 Input wire 2

96 (Bonus) Barrington 1986: log-depth boolean circuits can be recognized by subset products of permutation matrices of width 5. Example: how to represent an AND gate 1 and 0 P -1 P 1 I I 0 Input wire 1 Input wire 2 Input wire 1 Input wire 2

97 (Bonus) Barrington 1986: log-depth boolean circuits can be recognized by subset products of permutation matrices of width 5. Example: how to represent an AND gate 1 and 1 PQP -1 Q -1 = C ≠ I P -1 Q -1 P Q 1 0 Input wire 1 Input wire 2 Input wire 1 Input wire 2

Representation of the constraint predicate: branching program 1 B 1,1 B 2,1 B 3,1 ... B L,1 0 B 1,0 B 2,0 B 3,0 ... B L,0 Eval: ∏B z(i),x_z(i) = I or C Steps 1 2 3 ... L Input z(1) z(2) z(3) ... z(L) 98

We set the secrets like: S S 1,1 S 2,1 S 3,1 S 4,1 A 4 S S 1,0 S 2,0 S 3,0 S 4,0 S S S Representation of secrets (to be encoded by GGH15): B i,b ⊗ s i,b S S S S e.g. I ⊗ s = P ⊗ s = S S S S 99 S S

PCPRF for NC1 constraints (permutation branching programs) 100