Projective Arithmetic Functional Encryption and Indistinguishability Obfuscation (iO) from Degree-5 Multilinear maps Prabhanjan Ananth Amit Sahai
Constructions of iO All current constructions of iO are based on multilinear maps [GGHRSW13, BR14, BGKPS14, PST14, AGIS14, …, AB15, Zim15, GLSW15, GMMSZ16, Lin16a, LV16, Lin16b, …] Multilinear maps: generalization of bilinear maps • Degree-D multilinear maps: can compute degree-D • polynomials in the exponents of the group
What is the minimum degree of multilinear maps required to construct iO? Ideal Goal: 2 large poly(k) 32 constant [LV’16] [Lin’16] Original works [GGHRSW’13, BGKPS’14, …]: • degree = polynomial in security parameter Lin’16: degree = constant • LV’16: degree = 32 •
This Work iO from degree- 5 multinear maps Ideal Goal: 2 5 32 large poly(k,|C|) [LV’16] constant [Lin’16] A new template to construct iO from constant degree multilinear maps
Prior Works [Lin’16,LV’16] Collusion-Resistant Constant Degree Functional Encryption iO Mmaps for boolean circuits
Prior Works [Lin’16,LV’16] Collusion-Resistant Constant Degree Functional Encryption iO Mmaps for boolean circuits MMap computations performed over large fields - To construct FE from mmaps: need to “arithmetize” the boolean circuits -
Our Template Projective Arithmetic Constant Degree FE iO Mmaps for arithmetic circuits PAFE is a version of functional encryption for arithmetic circuits -
Our Template (in detail) Projective Arithmetic Degree- D FE for Multilinear maps Degree- D (subexp. secure) polynomials (subexp. secure) + degree- D randomizing polynomials (Secret Key) [BNPW16, LPST15, AJ15, BV15] Sub-linear iO FE for P + sub-exponential LWE (subexp. secure)
Instantiation iO Projective Arithmetic from Degree- 5 FE for degree-5 Multilinear maps multilinear Degree- 5 (subexp. secure) maps! polynomials (subexp. secure) + degree- 5 randomizing polynomials (assumes degree-5 PRGs (Secret Key) [BNPW16, LPST15, AJ15, BV15] with poly stretch) Sub-linear iO FE for P + sub-exponential LWE (subexp. secure)
Instantiation iO Projective Arithmetic from Degree- 5 FE for degree-5 Multilinear maps multilinear Degree- 5 (subexp. secure) maps! polynomials (subexp. secure) + CONCURRENT WORK: degree- 5 Lin’17 built iO assuming randomizing joint SXDH on degree-5 mmaps polynomials (assumes degree-5 PRGs (Secret Key) [BNPW16, LPST15, AJ15, BV15] with poly stretch) Sub-linear iO FE for P + sub-exponential LWE (subexp. secure)
Technical Overview
Our Template Projective Arithmetic Degree- D FE for Multilinear maps Degree- D (subexp. secure) polynomials (subexp. secure) + degree- randomizing polynomials (Secret Key) [BNPW16, LPST15, AJ15, BV15] Sub-linear iO FE for P + sub-exponential LWE (subexp. secure)
Projective Arithmetic FE (PAFE) • FIRST ATTEMPT: Same syntax as FE for boolean circuits except that functional keys issued for polynomials (over large fields) Encryption of x + Key of polynomial p := p ( x ) ISSUE: Current techniques are a limiting factor ! If p(x) is large, we don’t know how to construct this notion - Reason: Decryption in existing FE schemes yields Encoding(p(x)) - and can decode only if p(x) is small
Projective Arithmetic FE (PAFE) p 1 p 2 p 3 Key Generation x sk p1 sk p2 sk p3 Encryption + + + … Enc(x) Projective Decrypt ENCODINGS: p 1 (x) p 2 (x) p 3 (x) Can recover linear function of (p 1 (x),p 2 (x),p 3 (x),…) if output of linear function is “small”
Efficiency • Linear Overhead: • Size of encryption of y := |y| poly(k,D) D - degree of polynomials Security • Semi-functional security: • Inspired by ABE literature [ Wat09,LOS+10,…,GGHZ14 ] • Captures a weak form of function hiding
Our Template Projective Arithmetic Degree- D FE for Multilinear maps Degree- D (subexp. secure) polynomials (subexp. secure) + degree- D randomizing polynomials (Secret Key) [BNPW16, LPST15, AJ15, BV15] Sub-linear iO FE for P + sub-exponential LWE (subexp. secure)
Sub-linear (Secret Key) FE for Boolean circuits SUB-LINEARITY |Enc(x)| = |C| e poly(k,|x|) ; e <1
Randomizing Polynomials C Encode … p N p 1 p 2 … + + + (x, r ) … … Decode + + = C(x) p 1 (x,r) p 2 (x,r) p N (x,r) If all p i is of degree D then it is a degree-D randomizing polynomial
Construction of Sub-linear FE Key Generation of C: C Randomizing Polynomial of C … p N p 1 p 2 PAFE key generation of p 1 ,…,p N … sk pN sk p1 sk p2 Functional key of C = (sk p1 , … , sk pN )
Construction of Sub-linear FE C Key Generation of C: … p N p 1 p 2 … sk pN sk p1 sk p2 Encryption of x: x (x, r ) r
Construction of Sub-linear FE C Key Generation of C: … p N p 1 p 2 SUB-LINEARITY PROPERTY of randomizing polynomials: … sk pN sk p1 sk p2 |r| is sublinear in the length of circuit description Encryption of x: x (x, r ) r
Construction of Sub-linear FE Decryption (INTUITION) : Execute PAFE ProjectiveDecrypt - Execute Recover to obtain encoding of (C,x) - Execute the decoding procedure -
Instantiation of degree-5 randomizing polynomials (with sub-linearity property) WARMUP: Consider degree-3 randomizing polynomials - [AIK’06] (without sub-linearity property) Compress randomness using PRGs! - Use degree 5 PRGs - (maps seed of length n to n 1.49 ) TOTAL DEGREE = 5 * 3 = 15
Instantiation of degree-5 randomizing polynomials (with sub-linearity property) WARMUP: Goldreich PRG candidate: Analysed by O’Donnell and Witmer'14 Consider degree-3 randomizing polynomials - [AIK’06] (without sub-linearity property) Compress randomness using PRGs! - Use degree 5 PRGs - (maps seed of length n to n 1.49 ) TOTAL DEGREE = 5 * 3 = 15
Instantiation of degree-5 randomizing polynomials (with sub-linearity property) WARMUP: Consider degree-3 randomizing polynomials - [AIK’06] (without sub-linearity property) Degree-5 randomizing polynomials: Compress randomness using PRGs! - We use pre-processing trick! Use degree 5 PRGs - (pre-compute some partial terms ahead of time) (maps seed of length n to n 1.49 ) TOTAL DEGREE = 5 * 3 = 15
Our Template Projective Arithmetic Degree- D FE for Multilinear maps Degree- D (subexp. secure) polynomials (subexp. secure) + degree- randomizing polynomials (Secret Key) [BNPW16, LPST15, AJ15, BV15] Sub-linear iO FE for P + sub-exponential LWE (subexp. secure)
Slotted Encodings An abstraction of composite order multi-linear maps Encoding of (a,b,c) w.r.t color: a b c + = Addition w.r.t same color: a 1 +a 2 b 1 +b 2 c 1 +c 2 a 1 b 1 c 1 a 2 b 2 c 2 Multiplication w.r.t = a 1* a 2 a 1 b 1 c 1 a 2 b 2 c 2 b 1* b 2 c 1* c 2 * “compatible” colors: Zero Test w.r.t is ZERO if and only if a+b+c=0 a b c color red:
Degree-D Slotted Encodings from Degree-D Prime order mmap Degree-D slotted encodings: if it allows for evaluating polynomials of degree at most D SIMPLE CASE: Degree=2 a 1 b 1 c 1 a 2 b 2 c 2 ,
Degree-D Slotted Encodings from Degree-D Prime order mmap Degree-D slotted encodings: if it allows for evaluating polynomials of degree at most D SIMPLE CASE: Degree=2 Pick vectors u 1 , u 2 , u 3 , v 1 , v 2 , v 3 a 1 u 1 + b 1 u 2 + c 1 u 3 a 2 v 1 + b 2 v 2 + c 2 v 3 , such that < u i , v j > = 1, if i=j = 0, otherwise
Degree-D Slotted Encodings from Degree-D Prime order mmap Degree-D slotted encodings: if it allows for evaluating polynomials of degree at most D SIMPLE CASE: Degree=2 Pick vectors u 1 , u 2 , u 3 , v 1 , v 2 , v 3 a 1 u 1 + b 1 u 2 + c 1 u 3 a 2 v 1 + b 2 v 2 + c 2 v 3 , Dual vector spaces! [OT08,OT09,BJK15] such that < u i , v j > = 1, if i=j = 0, otherwise
Degree-D Slotted Encodings from Degree-D Prime order mmap Degree-D slotted encodings: if it allows for evaluating polynomials of degree at most D SIMPLE CASE: Degree=2 < > , a 1 u 1 + b 1 u 2 + c 1 u 3 a 2 v 1 + b 2 v 2 + c 2 v 3 = a 1 a 2 + b 1 b 2 + c 1 c 2
Degree-D Slotted Encodings from Degree-D Prime order mmap Higher (constant) degrees: tensoring of dual vector spaces Example: Degree=3 < > , a 1 w 1 u 1 + b 1 w 2 u 2 + c 1 w 3 u 3 a 2 v 1 + b 2 v 2 + c 2 v 3 , … = a 1 a 2 w 1 + b 1 b 2 w 2 + c 1 c 2 w 3
Construction of PAFE (Intuition) Setup: Pick R 1 ,…,R n Encryption of x: … x 1 R 1 0 x 2 R 2 0 x n R n 0 Key Generation of polynomial p: p , 0 p(R 1 ,…,R n ) 0 WHY IS IT SECURE? p(R 1 ,…,R n ) in second slot “forces” homomorphic evaluation of p on ciphertext encodings
Construction of PAFE (Intuition) Setup: Pick R 1 ,…,R n Encryption of x: … x 1 R 1 0 x 2 R 2 0 x n R n 0 Key Generation of polynomial p: p , 0 p(R 1 ,…,R n ) 0 MAIN ISSUE: Mix-and-match attacks encodings from different ciphertexts can be mixed
Construction of PAFE (Intuition) Setup: Pick R 1 ,…,R n Encryption of x: … x 1 R 1 0 x 2 R 2 0 x n R n 0 Key Generation of polynomial p: Prevented by having p , 0 p(R 1 ,…,R n ) “ciphertext-specific" checks! 0 MAIN ISSUE: Mix-and-match attacks encodings from different ciphertexts can be mixed
Recommend
More recommend
