On Assumptions and the Limits of Cryptography Nils Fleischhacker - - PowerPoint PPT Presentation

▶
on assumptions and the limits of cryptography
SMART_READER_LITE
LIVE PREVIEW

On Assumptions and the Limits of Cryptography Nils Fleischhacker - - PowerPoint PPT Presentation

Aug 26, 2023 282 likes •1.06k views

On Assumptions and the Limits of Cryptography Nils Fleischhacker Bochum, January 23, 2019 The sad truth is: At the moment we cant! Not really. Can we know whether all of this is secure? So, how do we know all of this is secure? 2 The sad

slide-1
SLIDE 1

On Assumptions and the Limits of Cryptography

Nils Fleischhacker Bochum, January 23, 2019
slide-2
SLIDE 2 2 So, how do we know all of this is secure? Can we know whether all of this is secure? The sad truth is: At the moment we can’t! Not really.
slide-3
SLIDE 3 2 So, how do we know all of this is secure? Can we know whether all of this is secure? The sad truth is: At the moment we can’t! Not really.
slide-4
SLIDE 4 2 So, how do we know all of this is secure? Can we know whether all of this is secure? The sad truth is: At the moment we can’t! Not really.
slide-5
SLIDE 5 2 So, how do we know all of this is secure? Can we know whether all of this is secure? The sad truth is: At the moment we can’t! Not really.
slide-6
SLIDE 6 2 So, how do we know all of this is secure? Can we know whether all of this is secure? The sad truth is: At the moment we can’t! Not really.
slide-7
SLIDE 7 2 So, how do we know all of this is secure? Can we know whether all of this is secure? The sad truth is: At the moment we can’t! Not really.
slide-8
SLIDE 8 2 So, how do we know all of this is secure? Can we know whether all of this is secure? The sad truth is: At the moment we can’t! Not really.
slide-9
SLIDE 9 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-10
SLIDE 10 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-11
SLIDE 11 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-12
SLIDE 12 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-13
SLIDE 13 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-14
SLIDE 14 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-15
SLIDE 15 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-16
SLIDE 16 3 The Cryptographic Landscape DS PKE 2PC FHE iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-17
SLIDE 17 3 The Cryptographic Landscape DS PKE 2PC FHE iO iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-18
SLIDE 18 3 The Cryptographic Landscape DS PKE 2PC FHE iO iO One-way Functions Trapdoor Permutations Trapdoor Permutations Oblivious Transfer LWE Multi-Linear Maps Multi-Linear Maps Well this seems like a terrible idea!
slide-19
SLIDE 19 4 One-Way Functions f x ???
slide-20
SLIDE 20 4 One-Way Functions f x y ???
slide-21
SLIDE 21 4 One-Way Functions f x y ???
slide-22
SLIDE 22 4 One-Way Functions f x y ???
slide-23
SLIDE 23 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P NP
slide-24
SLIDE 24 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P NP
slide-25
SLIDE 25 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P NP
slide-26
SLIDE 26 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P NP
slide-27
SLIDE 27 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P NP
slide-28
SLIDE 28 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P NP
slide-29
SLIDE 29 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P ̸= NP
slide-30
SLIDE 30 5 Why We Need to Make Assumptions OWF ENC MAC PKE 2PC FHE P ̸= NP
slide-31
SLIDE 31 6 Idea Behind Provable Security Assumption ENC MAC 2PC
slide-32
SLIDE 32 6 Idea Behind Provable Security Assumption ENC MAC 2PC
slide-33
SLIDE 33 6 Idea Behind Provable Security Assumption ENC MAC 2PC
slide-34
SLIDE 34 6 Idea Behind Provable Security Assumption ENC MAC 2PC
slide-35
SLIDE 35 6 Idea Behind Provable Security Abstract Assumption ENC MAC 2PC B P
slide-36
SLIDE 36 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-37
SLIDE 37 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-38
SLIDE 38 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-39
SLIDE 39 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-40
SLIDE 40 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-41
SLIDE 41 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-42
SLIDE 42 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-43
SLIDE 43 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-44
SLIDE 44 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-45
SLIDE 45 7 Determining Minimal Assumptions Statistical Security One-Way Functions Trapdoor Permutations Oblivious Transfer . . . Fully Homomorphic Encryption . . .
slide-46
SLIDE 46 8 3-Round ZK-Proofs [FGJ18] 2-Party Computation Obfuscation Any Assumption
slide-47
SLIDE 47 8 3-Round ZK-Proofs [FGJ18] 2-Party Computation Obfuscation Any Assumption
slide-48
SLIDE 48 9 Zero-Knowledge Proof Protocols ▶ A Zero-Knowledge Proof allows me to to prove that a statement is true without revealing the reason why. A ZK-Proof must be Sound Zero-Knowledge Incredibly useful tools in Cryptography
slide-49
SLIDE 49 9 Zero-Knowledge Proof Protocols ▶ A Zero-Knowledge Proof allows me to to prove that a statement is true without revealing the reason why. ▶ A ZK-Proof must be ▶ Sound Zero-Knowledge Incredibly useful tools in Cryptography
slide-50
SLIDE 50 9 Zero-Knowledge Proof Protocols ▶ A Zero-Knowledge Proof allows me to to prove that a statement is true without revealing the reason why. ▶ A ZK-Proof must be ▶ Sound ▶ Zero-Knowledge Incredibly useful tools in Cryptography
slide-51
SLIDE 51 9 Zero-Knowledge Proof Protocols ▶ A Zero-Knowledge Proof allows me to to prove that a statement is true without revealing the reason why. ▶ A ZK-Proof must be ▶ Sound ▶ Zero-Knowledge ▶ Incredibly useful tools in Cryptography
slide-52
SLIDE 52 10 Round-Complexity of ZK-Proofs for NP [GO94] [GK96]
slide-53
SLIDE 53 10 Round-Complexity of ZK-Proofs for NP [GO94] [GK96]
slide-54
SLIDE 54 10 Round-Complexity of ZK-Proofs for NP [GO94]

✓

[GK96]
slide-55
SLIDE 55 10 Round-Complexity of ZK-Proofs for NP [GO94]

✓

[GK96]
slide-56
SLIDE 56 10 Round-Complexity of ZK-Proofs for NP [GO94]

✓

[GK96]
slide-57
SLIDE 57 11 Compressing Proofs
slide-58
SLIDE 58 11 Compressing Proofs
slide-59
SLIDE 59 11 Compressing Proofs
slide-60
SLIDE 60 12 3-Round ZK-Proofs [FGJ18] 2-Party Computation [DFKLS14] Obfuscation Any Assumption Malicious PUFs
slide-61
SLIDE 61 13 Secure Two-Party Computation from PUFs ▶ The idea: Use secure hardware to overcome impossibility of information theoretically secure 2-PC. Use Physically Uncloneable Functions Behave like random functions. Cannot be copied.
slide-62
SLIDE 62 13 Secure Two-Party Computation from PUFs ▶ The idea: Use secure hardware to overcome impossibility of information theoretically secure 2-PC. ▶ Use Physically Uncloneable Functions Behave like random functions. Cannot be copied.
slide-63
SLIDE 63 13 Secure Two-Party Computation from PUFs ▶ The idea: Use secure hardware to overcome impossibility of information theoretically secure 2-PC. ▶ Use Physically Uncloneable Functions ▶ Behave like random functions. Cannot be copied.
slide-64
SLIDE 64 13 Secure Two-Party Computation from PUFs ▶ The idea: Use secure hardware to overcome impossibility of information theoretically secure 2-PC. ▶ Use Physically Uncloneable Functions ▶ Behave like random functions. ▶ Cannot be copied.
slide-65
SLIDE 65 14 Secure Computation from PUFs [BFSK11] [OSVW13] Our Paper Our Paper

? ?

Honest Malicious Stateless Malicious Stateful Unconditional
slide-66
SLIDE 66 14 Secure Computation from PUFs [BFSK11] [OSVW13] Our Paper Our Paper

? ?

Honest Malicious Stateless Malicious Stateful Unconditional
slide-67
SLIDE 67 15 3-Round ZK-Proofs [FGJ18] 2-Party Computation [DFKLS14] Obfuscation [BBF16] Any Assumption Malicious PUFs Stateless Malicious PUFs Statistical Security
slide-68
SLIDE 68 16 Statistically Secure Obfuscation O C C′ r Perfect Correctness: For any circuit
  • Approximate Correctness: For any circuit
, Pr
slide-69
SLIDE 69 16 Statistically Secure Obfuscation O C C′ r ▶ Perfect Correctness: For any circuit C ∀x : C′(x) = C(x)
  • Approximate Correctness: For any circuit
, Pr
slide-70
SLIDE 70 16 Statistically Secure Obfuscation O C C′ r ▶ Perfect Correctness: For any circuit C ∀x : C′(x) = C(x) ▶ (1 − ϵ)-Approximate Correctness: For any circuit C, Pr r,x [ C′(x) = C(x) ] ≥ 1 − ϵ(n)
slide-71
SLIDE 71 17 Statistically Secure Obfuscation O C C′ r ▶ Indistinguishability Obfuscator: For any pair of circuits, such that C1 ≡ C2 and |C1| = |C2| SD(O(C1), O(C2)) ≤ negl(n)
  • Correlation Obfuscator: For any pair of circuits,
such that and SD O O
slide-72
SLIDE 72 17 Statistically Secure Obfuscation O C C′ r ▶ Indistinguishability Obfuscator: For any pair of circuits, such that C1 ≡ C2 and |C1| = |C2| SD(O(C1), O(C2)) ≤ negl(n) ▶ (1 − δ)-Correlation Obfuscator: For any pair of circuits, such that C1 ≡ C2 and |C1| = |C2| SD(O(C1), O(C2)) ≤ δ(n)
slide-73
SLIDE 73 18 Why Do We Even Care About Approximate Correctness? Because approximate obfuscation is useful! [MMNPs16,SW14,Hol06] 0.1 0.2 0.3 0.4 0.5 0.25 0.5 0.75 1 Correctness Error ϵ Statistical Distance δ Allows PKE from OWF
slide-74
SLIDE 74 19 Main Result ▶ If statistically secure, approximately correct iO (saiO) exists, then either one-way functions do not exist, or NP ⊆ AM ∩ coAM. ▶ More Generally: If (1 − δ)-statistically secure, (1 − ϵ)-approximately correct correlation obfuscation (sacO) exists with δ(n) ≤ 1 3 − 2 3ϵ(n) − 1 poly(n), then either one-way functions do not exist, or NP ⊆ AM ∩ coAM. ▶ For very weak parameters, a trivial construction of sacO exists with δ(n) = 2ϵ(n).
slide-75
SLIDE 75 20 The Landscape of Correlation Obfuscation 0.1 0.2 0.3 0.4 0.5 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Correctness Error ϵ Statistical Distance δ Achievable with Trivial Construction Ruled out by Negative Result
slide-76
SLIDE 76 20 The Landscape of Correlation Obfuscation 0.1 0.2 0.3 0.4 0.5 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Correctness Error ϵ Statistical Distance δ Achievable with Trivial Construction Ruled out by Negative Result Allows PKE from OWF