Obfustopia Built on Secret-Key Functional Encryption Fuyuki - - PowerPoint PPT Presentation

Obfustopia Built on Secret-Key Functional Encryption

Fuyuki Kitagawa (Tokyo Institute of Technology) Ryo Nishimaki (NTT Secure Platform Laboratories) Keisuke Tanaka(Tokyo Institute of Technology)

FocusConstructing indistinguishability obfuscation (IO) from secret-key functional encryption (SKFE)

Our results

collusion-resistant SKFE 1-key succinct SKFE

IO

for all circuits

Obfuscation

Obfuscation program code

• bfuscated code

unintelligible preserving functionality Virtual-black-box (VBB) obfuscation is most natural and intuitive But, impossibility for VBB obfuscation L No impossibility J àMany works focus on an weaker notion indistinguishability obfuscation (IO)

Usefulness and difficulty of IO

Many works constructed a wide variety of crypto primitives from IO

many classical primitives, deniable encryption, collusion-resistant FE program watermarking

Usefulness and difficulty of IO

All constructions rely on multi-linear maps… Many works constructed a wide variety of crypto primitives from IO little studied L

many classical primitives, deniable encryption, collusion-resistant FE program watermarking

However, “IO from standard assumption” is still major open question

Usefulness and difficulty of IO

All constructions rely on multi-linear maps…

To realize IO from mild assumptions, It’s important to find seemingly weaker primitives implying IO

We have functional encryption Many works constructed a wide variety of crypto primitives from IO little studied L

many classical primitives, deniable encryption, collusion-resistant FE program watermarking

However, “IO from standard assumption” is still major open question

Functional encryption (FE)

cloud

data data encryption key data

Functional encryption (FE)

cloud

data data encryption key master secret key functional key (decryption key tied to f) data function f

Functional encryption (FE)

cloud

data data data encryption key master secret key functional key (decryption key tied to f) data f(data) function f

• nly

Functional encryption (FE)

cloud

data data data encryption key master secret key functional key (decryption key tied to f) data f(data) function f

• nly

≠ public-key (PKFE)

• secret-key (SKFE)

uCiphertext size

• data

succinct

cipher text ,

Succinctness / Collusion-resistance

γ (0 ≤ γ < 1)

(or size of enc circuit)

uCiphertext size

• data

succinct

cipher text …

u# of issuable functional keys

master secret key ,

Succinctness / Collusion-resistance

issuable unbounded keys à collusion-resistant issuable only 1 functional key à 1-key scheme

γ (0 ≤ γ < 1)

(or size of enc circuit)

Previous works

1-key succinct PKFE

IO

exp loss [BV15, AJ15] for all circuits

+ LWE or IBE [LPST16, BNPW16, KNT18] +PKE [BNPW16, KNT18]

coll-resist SKFE 1-key succinct SKFE

Previous works

1-key succinct PKFE

IO

exp loss [BV15, AJ15] for all circuits

+ LWE or IBE [LPST16, BNPW16, KNT18] +PKE [BNPW16, KNT18]

coll-resist SKFE 1-key succinct SKFE

Previous works

1-key succinct PKFE FE with some property + Public-key primitive

⇒

IO

From these results

IO

exp loss [BV15, AJ15] for all circuits

Motivation

In other words Is it possible to construct IO based only on secret-key primitives?

• 1. Question

We really need public-key primitives to construct IO?

Motivation

In other words Somewhat negative answer [AS15] Is it possible to construct IO based only on secret-key primitives?

black-box impossibility

Best candidate is SKFE Partial answer [KS17]

IO for poly-log inputs

• 1. Question
• 2. Known results

We really need public-key primitives to construct IO?

Motivation

In other words Somewhat negative answer [AS15] Is it possible to construct IO based only on secret-key primitives?

black-box impossibility

Real power of IO appears SKE PKE IO Solving the above question is a key advancement to discover the exact requirement for IO Best candidate is SKFE Partial answer [KS17]

IO for poly-log inputs

• 1. Question
• 2. Known results
• 3. Requirement for IO

We really need public-key primitives to construct IO?

+ LWE or IBE [LPST16, BNPW16, KNT18] +PKE [BNPW16, KNT18]

coll-resist SKFE 1-key succinct SKFE

Our results

1-key succinct PKFE FE with some property + public-key primitive

⇒

IO

From these results

IO

exp loss [BV15, AJ15] exp loss, w/o PKE non-black-box for all circuits

+ LWE or IBE [LPST16, BNPW16, KNT18] +PKE [BNPW16, KNT18]

coll-resist SKFE 1-key succinct SKFE

Our results

1-key succinct PKFE FE with some property + public-key primitive

⇒

IO

From these results

IO

exp loss [BV15, AJ15] exp loss, w/o PKE non-black-box quasi-poly loss for all circuits

+ LWE or IBE [LPST16, BNPW16, KNT18] +PKE [BNPW16, KNT18]

coll-resist SKFE 1-key succinct SKFE

Our results

1-key succinct PKFE FE with some property + public-key primitive

⇒

IO

From these results

IO

exp loss [BV15, AJ15] exp loss, w/o PKE non-black-box quasi-poly loss Even SKFE for all circuits

+ LWE or IBE [LPST16, BNPW16, KNT18] +PKE [BNPW16, KNT18]

coll-resist SKFE 1-key succinct SKFE

Our results

1-key succinct PKFE FE with some property + public-key primitive

⇒

IO

From these results

IO

exp loss [BV15, AJ15] exp loss, w/o PKE non-black-box quasi-poly loss Even SKFE

Puncturable SKFE

for all circuits

Puncturable SKFE

SKFE that can generate a punctured MSK MSK∗{m0, m1}

punctured at two msgs

and satisfies the following two properties

Puncturable SKFE

SKFE that can generate a punctured MSK MSK∗{m0, m1}

punctured at two msgs

and satisfies the following two properties

• 1. Functionality preserving

Enc(MSK, m) = PEnc(MSK∗{m0, m1}, m)

if m / ∈ {m0, m1}

∃PEnc s.t.

Puncturable SKFE

SKFE that can generate a punctured MSK MSK∗{m0, m1}

punctured at two msgs

and satisfies the following two properties

• 1. Functionality preserving

Enc(MSK, m) = PEnc(MSK∗{m0, m1}, m)

• 2. Semantic security at punctured points

Enc(MSK, m0) ≈ Enc(MSK, m1)

holds even if MSK∗{m0, m1} is given

if m / ∈ {m0, m1}

∃PEnc s.t.

Puncturable SKFE from SKFE

IO

Puncturable SKFE

Succinct

It has been open how to construct it

exp loss [BV15]

Puncturable SKFE from SKFE

IO

Puncturable SKFE

Succinct

We show coll-resist SKFE Puncturable SKFE

Succinct

in two steps It has been open how to construct it

exp loss [BV15]

was

coll-resist SKFE

Puncturable SKFE from SKFE

IO

Puncturable SKFE

OWF

Non-succinct

Puncturable SKFE

Succinct

trivial We show coll-resist SKFE Puncturable SKFE

Succinct

in two steps It has been open how to construct it

exp loss [BV15]

was

coll-resist SKFE

Puncturable SKFE from SKFE

IO

Puncturable SKFE

OWF

Non-succinct

Puncturable SKFE

Succinct

SXIO

[BNPW16]

trivial We show coll-resist SKFE Puncturable SKFE

Succinct

in two steps It has been open how to construct it

exp loss [BV15]

was

Weaker variant

• f IO

coll-resist SKFE

1st step: Non-succinct scheme from OWF IO

Puncturable SKFE

Succinct

SXIO

[BNPW16]

trivial Puncturable SKFE

OWF

Non-succinct

Based on [SS10] : GC + PKE = non-succinct PKFE

coll-resist SKFE

1st step: Non-succinct scheme from OWF IO

Puncturable SKFE

Succinct

SXIO

[BNPW16]

trivial Puncturable SKFE

OWF

Non-succinct

We show GC + puncturable PRF = non-succinct puncturable SKFE Based on [SS10] : GC + PKE = non-succinct PKFE

both implied by OWF functionality preserving semantic security at punctured points come from the corresponding

properties of puncturable PRF

coll-resist SKFE

IO

[BNPW16]

trivial

OWF

2nd step: Non-succinct to succinct

Puncturable SKFE

Succinct

SXIO

Extend techniques by [LPST16, BNPW16, KNT18] Puncturable SKFE

Non-succinct

However, there is a problem…

Succinctness from SXIO

by [LPST16, BNPW16, KNT18] FEnon-suc

FEsuc

+ SXIO

In Encsuc

= CT output by Encnon-suc

Succinctness from SXIO

Naïve idea by [LPST16, BNPW16, KNT18] FEnon-suc

FEsuc

+ SXIO

In Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

Succinctness from SXIO

Naïve idea Punctured programming [SW14] àSemantic security at punctured points J by [LPST16, BNPW16, KNT18] FEnon-suc

FEsuc

+ SXIO

In Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

Succinctness from SXIO

Naïve idea Punctured programming [SW14] àSemantic security at punctured points J But, not functionality preserving… L by [LPST16, BNPW16, KNT18] FEnon-suc

FEsuc

+ SXIO

In Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

Problem with SXIO technique

If non-succinct scheme satisfies functionality preserving generate the same CTs by [LPST16, BNPW16, KNT18] FEnon-suc

FEsuc

+ SXIO

In Naïve idea Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

PEncnon-suc

Encnon-suc

Problem with SXIO technique

If non-succinct scheme satisfies functionality preserving generate the same CTs

6=

But, they are different object à Not functionality preserving L

It seems difficult to achieve functionality preserving as long as we use SXIO…

by [LPST16, BNPW16, KNT18] FEnon-suc

FEsuc

+ SXIO

In Naïve idea Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

PEncnon-suc

Encnon-suc

Problem with SXIO technique

If non-succinct scheme satisfies functionality preserving generate the same CTs

6=

But, they are different object à Not functionality preserving L

It seems difficult to achieve functionality preserving as long as we use SXIO…

à Introduce an weaker property by [LPST16, BNPW16, KNT18] FEnon-suc

FEsuc

+ SXIO

In Naïve idea Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

PEncnon-suc

Encnon-suc

Indistinguishability of functionality

An weaker variant of functionality preserving Enc(MSK, m) = PEnc(MSK∗{m0, m1}, m)

if m / ∈ {m0, m1}

∃PEnc s.t.

Indistinguishability of functionality

An weaker variant of functionality preserving Enc(MSK, m) = PEnc(MSK∗{m0, m1}, m)

if m / ∈ {m0, m1}

∃PEnc s.t.

≈

Computationally indistinguishable

even if both

MSK MSK∗{m0, m1}

are given

Indistinguishability of functionality

An weaker variant of functionality preserving Enc(MSK, m) = PEnc(MSK∗{m0, m1}, m)

if m / ∈ {m0, m1}

∃PEnc s.t.

≈

Computationally indistinguishable

even if both

MSK MSK∗{m0, m1}

are given In the SXIO based construction Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

Indistinguishability of functionality

An weaker variant of functionality preserving Enc(MSK, m) = PEnc(MSK∗{m0, m1}, m)

if m / ∈ {m0, m1}

∃PEnc s.t.

≈

Computationally indistinguishable

even if both

MSK MSK∗{m0, m1}

are given In the SXIO based construction by only the SXIO security à Indistinguishability of functionality J

≈

Computationally indistinguishable

Encsuc

= CT output by = PEncsuc

CT output by PEncnon-suc

Encnon-suc

coll-resist SKFE

Puncturable SKFE from SKFE

Puncturable SKFE

OWF

Non-succinct

Puncturable SKFE

Succinct

SXIO

[BNPW16]

trivial

• nly indistinguishability
• f functionality

coll-resist SKFE

Puncturable SKFE from SKFE

IO

Puncturable SKFE

OWF

Non-succinct

Puncturable SKFE

Succinct

SXIO

[BNPW16]

trivial

• nly indistinguishability
• f functionality

Is it possible?

coll-resist SKFE

IO from Puncturable SKFE with indistinguishability of functionality

Puncturable SKFE

OWF

Non-succinct

SXIO

[BNPW16]

trivial

IO

Puncturable SKFE

Succinct

• nly indistinguishability
• f functionality

using more (but asymptotically the same) hybrid games than [BV15]

Overview of security proof

[BV15]: recursive construction

IO(i) IO(i+1)

IO(i) : IO for i-bit inputs Puncturable SKFE

Overview of security proof

Obfuscated Obfuscated

[BV15]: recursive construction

IO(i) IO(i+1)

In each recursion

IO(i) : IO for i-bit inputs Puncturable SKFE

Enc(i)

PEnc(i)

holds by Functionality preserving (+ IO(i) security)

≈

Overview of security proof

Obfuscated Obfuscated

[BV15]: recursive construction

IO(i) IO(i+1)

In each recursion

IO(i) : IO for i-bit inputs Puncturable SKFE

Enc(i)

PEnc(i)

holds by Functionality preserving (+ IO(i) security)

≈

But, indistinguishability of functionality…?

Overview of security proof

Obfuscated Obfuscated

[BV15]: recursive construction

IO(i) IO(i+1)

In each recursion

IO(i) : IO for i-bit inputs Puncturable SKFE

Enc(i)

PEnc(i)

holds by Functionality preserving (+ IO(i) security)

≈

But, indistinguishability of functionality…? à Introduce more hybrids

Overview of security proof

Obfuscated Obfuscated

[BV15]: recursive construction

IO(i) IO(i+1)

In each recursion

IO(i) : IO for i-bit inputs Puncturable SKFE

Enc(i)

PEnc(i)

holds by Functionality preserving (+ IO(i) security) Obfuscated

HEnc(i)

k

for inputs for inputs

> k

≤ k

Enc(i)

PEnc(i)

≈

But, indistinguishability of functionality…? à Introduce more hybrids

Overview of security proof

Obfuscated Obfuscated

[BV15]: recursive construction

IO(i) IO(i+1)

In each recursion

IO(i) : IO for i-bit inputs Puncturable SKFE

Enc(i)

PEnc(i)

holds by Functionality preserving (+ IO(i) security) Obfuscated

HEnc(i)

k

for inputs for inputs

> k

≤ k

Enc(i)

PEnc(i)

HEnc(i)

HEnc(i)

2i

≈

by indistinguishability of functionality (+ IO(i) security)

≈

≈

But, indistinguishability of functionality…? à Introduce more hybrids

Overview of security proof

Obfuscated Obfuscated

[BV15]: recursive construction

IO(i) IO(i+1)

In each recursion

IO(i) : IO for i-bit inputs Puncturable SKFE

Enc(i)

PEnc(i)

holds by Functionality preserving (+ IO(i) security) Obfuscated

HEnc(i)

k

for inputs for inputs

> k

≤ k

Enc(i)

PEnc(i)

HEnc(i)

HEnc(i)

2i

≈

MSK punctured MSK by indistinguishability of functionality (+ IO(i) security) are given Need to hold even if

≈

≈

But, indistinguishability of functionality…? à Introduce more hybrids

Overview of security proof

Obfuscated Obfuscated

[BV15]: recursive construction

IO(i) IO(i+1)

In each recursion

IO(i) : IO for i-bit inputs Puncturable SKFE

Enc(i)

PEnc(i)

holds by Functionality preserving (+ IO(i) security) Obfuscated

HEnc(i)

k

for inputs for inputs

> k

≤ k

Enc(i)

PEnc(i)

HEnc(i)

HEnc(i)

2i

≈

MSK punctured MSK by indistinguishability of functionality (+ IO(i) security) are given Need to hold even if

≈

Additional 2i loss, but still canceled by sub-exp security of building-blocks J

≈

But, indistinguishability of functionality…? à Introduce more hybrids

+ LWE or IBE [LPST16, BNPW16, KNT18] +PKE [BNPW16, KNT18]

coll-resist SKFE 1-key succinct SKFE

Summary

1-key succinct PKFE FE with some property + public-key primitive

⇒

IO

From these results

IO

exp loss [BV15, AJ15] exp loss, w/o PKE non-black-box quasi poly loss Even SKFE

Puncturable SKFE

for all circuits