New and Improved Key-Homomorphic Pseudorandom Functions Abhishek Banerjee 1 Chris Peikert 1 1 Georgia Institute of Technology CRYPTO ’14 19 August 2014
Outline Introduction 1 Construction, Parameters and Efficiency 2 Proof of Security (Idea) 3 Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 1 / 11
Outline Introduction 1 Construction, Parameters and Efficiency 2 Proof of Security (Idea) 3 Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 1 / 11
Pseudorandom Functions [GGM’84] A family of functions F = { F s : { 0 , 1 } k → B } such that, given adaptive query access, c F s ← F Random U ≈ ✻ ✻ ❄ ❄ x i x i F s ( x i ) U ( x i ) ?? Lots of applications in symmetric key cryptography: encryption, message authentication, friend or foe identification, . . . (Thanks to Seth MacFarlane for the adversary) Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 2 / 11
Cooking a (Provably Secure) PRF 1 Goldreich-Goldwasser-Micali [GGM’84] Based on any (doubling) PRG: F s ( x 1 , . . . , x k ) = G x k ( · · · ( G x 1 ( s )) · · · ) Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 3 / 11
Cooking a (Provably Secure) PRF 1 Goldreich-Goldwasser-Micali [GGM’84] Based on any (doubling) PRG: F s ( x 1 , . . . , x k ) = G x k ( · · · ( G x 1 ( s )) · · · ) 2 Number-theoretic direct constructions [NR’97, NRR’00] Framework: exponentiate to a product of (secret) exponents Security from number-theoretic assumptions (DDH, factoring, . . . ) Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 3 / 11
Cooking a (Provably Secure) PRF 1 Goldreich-Goldwasser-Micali [GGM’84] Based on any (doubling) PRG: F s ( x 1 , . . . , x k ) = G x k ( · · · ( G x 1 ( s )) · · · ) 2 Number-theoretic direct constructions [NR’97, NRR’00] Framework: exponentiate to a product of (secret) exponents Security from number-theoretic assumptions (DDH, factoring, . . . ) 3 Lattice-based direct constructions [BPR’12] Framework: round a product of (secret) matrices/ring elements Security from lattice assumptions (LWE, worst-case lattice problems) Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 3 / 11
Key-Homomorphic Pseudorandom Functions Key Homomorphism Can efficiently compute F s + t ( x ) from F s ( x ) and F t ( x ) Applications: Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 4 / 11
Key-Homomorphic Pseudorandom Functions Key Homomorphism Can efficiently compute F s + t ( x ) from F s ( x ) and F t ( x ) Applications: distribute the operation of a Key Distribution Center, 1 DDH-based construction [NPR’99] Security in the random oracle model Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 4 / 11
Key-Homomorphic Pseudorandom Functions Key Homomorphism Can efficiently compute F s + t ( x ) from F s ( x ) and F t ( x ) Applications: distribute the operation of a Key Distribution Center, symmetric-key proxy re-encryption, updatable encryption, and PRFs secure against related-key attacks [BC’10,LMR’14] 1 DDH-based construction [NPR’99] Security in the random oracle model 2 Lattice-based construction [BLMR’13] Security in the standard model; construction and proof similar to [BPR’12] rounded-subset-product construction Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 4 / 11
Key-Homomorphic Pseudorandom Functions Key Homomorphism Can efficiently compute F s + t ( x ) from F s ( x ) and F t ( x ) Applications: distribute the operation of a Key Distribution Center, symmetric-key proxy re-encryption, updatable encryption, and PRFs secure against related-key attacks [BC’10,LMR’14] 1 DDH-based construction [NPR’99] Security in the random oracle model 2 Lattice-based construction [BLMR’13] Security in the standard model; construction and proof similar to [BPR’12] rounded-subset-product construction Main drawback: has huge parameters, keys, and runtimes Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 4 / 11
Key-Homomorphic Pseudorandom Functions Key Homomorphism Can efficiently compute F s + t ( x ) from F s ( x ) and F t ( x ) Applications: distribute the operation of a Key Distribution Center, symmetric-key proxy re-encryption, updatable encryption, and PRFs secure against related-key attacks [BC’10,LMR’14] 1 DDH-based construction [NPR’99] Security in the random oracle model 2 Lattice-based construction [BLMR’13] Security in the standard model; construction and proof similar to [BPR’12] rounded-subset-product construction Main drawback: has huge parameters, keys, and runtimes [BPR’12] also gives (non-KH) PRFs having much better parameters, with slightly worse (still polylog) depth Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 4 / 11
Key-Homomorphic Pseudorandom Functions Key Homomorphism Can efficiently compute F s + t ( x ) from F s ( x ) and F t ( x ) Applications: distribute the operation of a Key Distribution Center, symmetric-key proxy re-encryption, updatable encryption, and PRFs secure against related-key attacks [BC’10,LMR’14] 1 DDH-based construction [NPR’99] Security in the random oracle model 2 Lattice-based construction [BLMR’13] Security in the standard model; construction and proof similar to [BPR’12] rounded-subset-product construction Main drawback: has huge parameters, keys, and runtimes [BPR’12] also gives (non-KH) PRFs having much better parameters, with slightly worse (still polylog) depth Can we obtain similar tradeoffs for KH-PRFs? Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 4 / 11
Our Results ⋆ New KH-PRFs (from lattices): Polylog ˜ O (1) depth (still) Quasi-optimal ˜ O ( λ ) key sizes First sublinear-depth PRFs (KH or otherwise) with ˜ O ( λ ) key size! Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 5 / 11
Our Results ⋆ New KH-PRFs (from lattices): Polylog ˜ O (1) depth (still) Quasi-optimal ˜ O ( λ ) key sizes First sublinear-depth PRFs (KH or otherwise) with ˜ O ( λ ) key size! Reference Key Pub Params Time/Bit λ 3 [ λ 3 ] λ 6 [ λ 4 ] λ 5 [ λ 3 ] [BLMR’13] λ 2 [ λ ] λ ω [ λ ] This work λ [ λ ] Figure : For input length λ with 2 λ security under standard assumptions. Log factors omitted. Ring-based constructions appear in [brackets]. Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 5 / 11
Our Results ⋆ New KH-PRFs (from lattices): Polylog ˜ O (1) depth (still) Quasi-optimal ˜ O ( λ ) key sizes First sublinear-depth PRFs (KH or otherwise) with ˜ O ( λ ) key size! Reference Key Pub Params Time/Bit λ 3 [ λ 3 ] λ 6 [ λ 4 ] λ 5 [ λ 3 ] [BLMR’13] λ 2 [ λ ] λ ω [ λ ] This work λ [ λ ] Figure : For input length λ with 2 λ security under standard assumptions. Log factors omitted. Ring-based constructions appear in [brackets]. ⋆ New proof technique that may be useful elsewhere Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 5 / 11
Our Results ⋆ New KH-PRFs (from lattices): Polylog ˜ O (1) depth (still) Quasi-optimal ˜ O ( λ ) key sizes First sublinear-depth PRFs (KH or otherwise) with ˜ O ( λ ) key size! Reference Key Pub Params Time/Bit λ 3 [ λ 3 ] λ 6 [ λ 4 ] λ 5 [ λ 3 ] [BLMR’13] λ 2 [ λ ] λ ω [ λ ] This work λ [ λ ] Figure : For input length λ with 2 λ security under standard assumptions. Log factors omitted. Ring-based constructions appear in [brackets]. ⋆ New proof technique that may be useful elsewhere Full version: http://eprint.iacr.org/2014/074 Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 5 / 11
Outline Introduction 1 Construction, Parameters and Efficiency 2 Proof of Security (Idea) 3 Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 5 / 11
Boneh et al. KH-PRF Construction [BLMR’13] Secret key s ∈ Z n q , pub params B 0 , B 1 ∈ { 0 , 1 } n × n , input x ∈ { 0 , 1 } k � � k � F s ( x ) = s · B x i i =1 p Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 6 / 11
Boneh et al. KH-PRF Construction [BLMR’13] Secret key s ∈ Z n q , pub params B 0 , B 1 ∈ { 0 , 1 } n × n , input x ∈ { 0 , 1 } k 1 � � k � F s ( x ) = s · B x i 0 i =1 p 2 Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 6 / 11
Boneh et al. KH-PRF Construction [BLMR’13] Secret key s ∈ Z n q , pub params B 0 , B 1 ∈ { 0 , 1 } n × n , input x ∈ { 0 , 1 } k 1 � � k � F s ( x ) = s · B x i 0 i =1 p 2 “Somewhat key-homomorphic:” F s ( x ) + F t ( x ) ∈ F s + t ( x ) + { 0 , ± 1 } n Banerjee and Peikert (Georgia Tech) New and Improved KH-PRFs CRYPTO ’14 6 / 11
Recommend
More recommend
