SLIDE 1
Robust Transforming Combiners from iO to Functional Encryption
Prabhanjan Ananth Aayush Jain Amit Sahai
SLIDE 2 Since 2013…
. . .
Indistinguishability Obfuscation (iO)/Functional Encryption
- Two-Round (Adaptive) Multi-Party
Computation
- Instantiating Random Oracles
- Non-Interactive Multi-party Key Exchange
- Impossibility Results
- Theoretical Results (such as PPAD
Hardness)
- Constant-Round Concurrent Zero
Knowledge
- Separation Results for Circular Security
- Succinct Randomized Encodings
- Watermarking
- Patching
SLIDE 3 What is iO?
iO (
)
C C*
SLIDE 4 What is iO?
iO (
)
C C* Correctness: for all x, C*(x) = C(x)
SLIDE 5 What is iO?
C0 C1
≡
SLIDE 6 What is iO?
iO (
)
C0
iO (
)
C1
≡
SLIDE 7 What is iO?
iO (
)
C0 C0*
iO (
)
C1 C1*
≡
SLIDE 8 What is iO?
iO (
)
C0 C0* Security: ≈c
iO (
)
C1 C1*
≡
SLIDE 9 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
x
SLIDE 10 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
x x
SLIDE 11 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
x x
SLIDE 12 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
x x MSK
SLIDE 13 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
f x x MSK
SLIDE 14 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
f x x MSK f
SLIDE 15 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
f x x MSK f
Dec( , ) = f(x)
x f
SLIDE 16 Fine Grained Access to Private Data
Functional Encryption
[SW’05,GGHRSW13]
f x x SKf should not allow adversary to compute anything other than f(x) ! MSK f
Dec( , ) = f(x)
x f
SLIDE 17 Known Constructions?
[GGHRSW’13, BGKPS’14, Zim’15, GLSW’15, AB’15, GMMSSZ’16, LV’16, L’16, AS’17, LT’17….]
SLIDE 18
Are all candidates of iO broken?
NO!
SLIDE 19 Are all candidates of iO broken?
NO!
We have several unbroken iO candidates, including with proofs of security in various models.
SLIDE 20 Find a iO candidate that is secure even if only one of the candidates is secure.
Our Goal
SLIDE 21 Find a iO candidate that is secure even if only one of the candidates is secure. Problem Statement: Given any set of iO candidates, find a candidate that is secure even if only one of the candidates is secure.
Our Goal
SLIDE 22 Find a iO candidate that is secure even if only one of the candidates is secure. Problem Statement: Given any set of iO candidates, find a candidate that is secure even if only one of the candidates is secure. t iO combiner
Our Goal
SLIDE 23 Find a iO candidate that is secure even if only one of the candidates is secure. Problem Statement: Given any set of iO candidates, find a candidate that is secure even if only one of the candidates is secure.
Robust iO combiner: In fact we only require the secure candidate to be correct All other candidates can violate correctness [AJNSY16, FHNS16]
Our Goal
SLIDE 24 Robust iO Combiners
Let P = (P1, …, Pn) be any n iO candidates
SLIDE 25 Robust iO Combiners
Let P = (P1, …, Pn) be any n iO candidates
- RCiO.Obf( P , C ) outputs C*.
SLIDE 26 Robust iO Combiners
Let P = (P1, …, Pn) be any n iO candidates
- RCiO.Obf( P , C ) outputs C*.
- RCiO.Eval( P , C*, x ) outputs y.
SLIDE 27 Robust iO Combiners
Let P = (P1, …, Pn) be any n iO candidates
- RCiO.Obf( P , C ) outputs C*.
- RCiO.Eval( P , C*, x ) outputs y.
If there exists i in [n] such that Pi is correct and secure :
SLIDE 28 Robust iO Combiners
Correctness: y = C(x)
Let P = (P1, …, Pn) be any n iO candidates
- RCiO.Obf( P , C ) outputs C*.
- RCiO.Eval( P , C*, x ) outputs y.
If there exists i in [n] such that Pi is correct and secure :
SLIDE 29 Robust iO Combiners
Let P = (P1, …, Pn) be any n iO candidates
- RCiO.Obf( P , C ) outputs C*.
- RCiO.Eval( P , C*, x ) outputs y.
Security: If C0 is equivalent to C1, RCiO.Obf( P , C0) ≈c RCiO.Obf( P , C1) If there exists i in [n] such that Pi is correct and secure :
SLIDE 30 Robust iO combiners imply universal iO [AJNSY’16]
Implications
SLIDE 31 Robust iO combiners imply universal iO [AJNSY’16]
Implications
Universal iO: A scheme P is a universal iO scheme if iO exists then P is a secure iO scheme
SLIDE 32
Previous Work
SLIDE 33 Previous Work
- AJNSY16 gave candidate construction of a
robust combiner from DDH/LWE.
- Required one candidate to be
sub-exponentially secure.
- FHNS16 considers the case of combining
unconditionally.
SLIDE 34 Previous Work
- AJNSY16 gave candidate construction of a
robust combiner from DDH/LWE.
- Required one candidate to be
sub-exponentially secure.
- FHNS16 considers the case of combining
unconditionally.
- Can we achieve some applications of iO if
the secure candidate is polynomially secure?
- Can we weaken the assumptions to rely on
- nly one-way functions?
Questions?
SLIDE 35 This Work
Theorem 1 (Combiner -> Robust Combiner): Given:
- An iO Combiner AND
- One-way function f,
we construct a robust iO combiner
SLIDE 36 This Work
Theorem 1 (Combiner -> Robust Combiner): Given:
- An iO Combiner AND
- One-way function f,
we construct a robust iO combiner
Previously, as observed in AJNSY’16 and BV’15, this result required sub-exponential DDH/LWE and the underlying candidate to be sub-exponentially secure
SLIDE 37
This Work
SLIDE 38 This Work
Theorem 2: Given:
- N correct iO Candidates (with one secure)
AND
we construct a compact FE scheme with complexity poly(k,N) and polynomial security loss.
SLIDE 39 This Work
Theorem 2: Given:
- N correct iO Candidates (with one secure)
AND
we construct a compact FE scheme with complexity poly(k,N) and polynomial security loss.
Corollary [AJ15,BV15]: There exists (sub-exponential) universal iO ifsub-exponential one-way functions exist.
SLIDE 40 This Work
Theorem 2: Given:
- N correct iO Candidates (with one secure)
AND
we construct a compact FE scheme with complexity poly(k,N) and polynomial security loss.
Corollary [AJ15,BV15]: There exists (sub-exponential) universal iO ifsub-exponential one-way functions exist. Transforming Combiners
SLIDE 41 Given N candidates of primitive A=(A1,..,AN), such that one Ai is secure and correct, construct secure primitive B with efficiency polynomial in N.
Transforming Combiners
SLIDE 42 Given N candidates of primitive A=(A1,..,AN), such that one Ai is secure and correct, construct secure primitive B with efficiency polynomial in N.
Transforming Combiners
We show: There exists a transforming robust combiner from iO to Functional Encryption. This also yields any primitive implied by FE (such as NIKE. [GPSZ17])
SLIDE 43
Technical Overview
SLIDE 44
Combiner to Robust Combiner: Idea 1
SLIDE 45 Combiner to Robust Combiner: Idea 1
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
SLIDE 46 Combiner to Robust Combiner: Idea 1
P’(C) works as follows:
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
SLIDE 47 Combiner to Robust Combiner: Idea 1
P’(C) works as follows:
- 1. Compute P(C)=C*
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
SLIDE 48 Combiner to Robust Combiner: Idea 1
P’(C) works as follows:
- 1. Compute P(C)=C*
- 2. Sample x1, x2,..,xL, where L = k2
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
SLIDE 49 Combiner to Robust Combiner: Idea 1
P’(C) works as follows:
- 1. Compute P(C)=C*
- 2. Sample x1, x2,..,xL, where L = k2
- 3. Check if C*(xi)=C(xi) for all i
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
SLIDE 50 Combiner to Robust Combiner: Idea 1
P’(C) works as follows:
- 1. Compute P(C)=C*
- 2. Sample x1, x2,..,xL, where L = k2
- 3. Check if C*(xi)=C(xi) for all i
- 4. If any check fails, output C, otherwise output C*
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
SLIDE 51 Combiner to Robust Combiner: Idea 1
P’(C) works as follows:
- 1. Compute P(C)=C*
- 2. Sample x1, x2,..,xL, where L = k2
- 3. Check if C*(xi)=C(xi) for all i
- 4. If any check fails, output C, otherwise output C*
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
Pr{x,coins(P)} [C*(x)=C(x)] ≥ 1 - 1/k
SLIDE 52 Combiner to Robust Combiner: Idea 1
P’(C) works as follows:
- 1. Compute P(C)=C*
- 2. Sample x1, x2,..,xL, where L = k2
- 3. Check if C*(xi)=C(xi) for all i
- 4. If any check fails, output C, otherwise output C*
- For each obfuscation candidate P, construct modified
candidate P’ that “self-checks for correctness”:
Pr{x,coins(P)} [C*(x)=C(x)] ≥ 1 - 1/k Secure candidate is unchanged as it is correct.
SLIDE 53
Removing dependency on x: Idea 2
SLIDE 54
Removing dependency on x: Idea 2
SLIDE 55 “Encrypt Inputs” [BV’15]
Removing dependency on x: Idea 2
SLIDE 56 “Encrypt Inputs” [BV’15]
- Consider a “special” circuit garbling scheme with an
additional property.
Removing dependency on x: Idea 2
SLIDE 57 “Encrypt Inputs” [BV’15]
- Consider a “special” circuit garbling scheme with an
additional property.
For any equivalent circuits C0 and C1 Eval([C0],*)≅Eval([C1],*)
Removing dependency on x: Idea 2
SLIDE 58 “Encrypt Inputs” [BV’15]
- Consider a “special” circuit garbling scheme with an
additional property.
- Such garbled circuits can be constructed from one-way
functions.
For any equivalent circuits C0 and C1 Eval([C0],*)≅Eval([C1],*)
Removing dependency on x: Idea 2
SLIDE 59
Combining Ideas
SLIDE 60 Combining Ideas
- 1. Use the modified obfuscator to obfuscate Eval([C],*)
- 2. Release the encoding key MSK to the evaluator.
SLIDE 61 Combining Ideas
- 1. Use the modified obfuscator to obfuscate Eval([C],*)
- 2. Release the encoding key MSK to the evaluator.
For any x, Pr{coins(P)} [C*(x)=C(x)] ≥ 1-2/k
SLIDE 62 Combining Ideas
- 1. Use the modified obfuscator to obfuscate Eval([C],*)
- 2. Release the encoding key MSK to the evaluator.
For any x, Pr{coins(P)} [C*(x)=C(x)] ≥ 1-2/k
Perform BPP Amplification to get almost correctness
SLIDE 63 Theorem 2: Combining iO
IDEA:
SLIDE 64 Theorem 2: Combining iO
IDEA:
- No candidate should get the circuit in the clear.
SLIDE 65 Theorem 2: Combining iO
IDEA:
- No candidate should get the circuit in the clear.
- Every candidate should get a secret share of circuit C.
SLIDE 66 Theorem 2: Combining iO
IDEA:
- No candidate should get the circuit in the clear.
- Every candidate should get a secret share of circuit C.
- On every input x, the candidates “jointly compute” C(x)
SLIDE 67 Theorem 2: Combining iO
IDEA:
- No candidate should get the circuit in the clear.
- Every candidate should get a secret share of circuit C.
- On every input x, the candidates “jointly compute” C(x)
How to do this?
SLIDE 68 Theorem 2: Combining iO
IDEA:
- No candidate should get the circuit in the clear.
- Every candidate should get a secret share of circuit C.
- On every input x, the candidates “jointly compute” C(x)
How to do this? Use MPC Techniques!
SLIDE 69
Approach of AJNSY’16
SLIDE 70
- Let C be the circuit to be obfuscated.
Approach of AJNSY’16
SLIDE 71
- Let C be the circuit to be obfuscated.
- Use a non-interactive MPC.
Approach of AJNSY’16
SLIDE 72
- Let C be the circuit to be obfuscated.
- Use a non-interactive MPC.
- Secret share circuit C into C1,…,CN. Treat Ci as input to Pi.
Approach of AJNSY’16
SLIDE 73
- Let C be the circuit to be obfuscated.
- Use a non-interactive MPC.
- Secret share circuit C into C1,…,CN. Treat Ci as input to Pi.
- Obfuscate the circuit containing Ci and the pre-processed
state using candidate Pi
Approach of AJNSY’16
SLIDE 74
- Let C be the circuit to be obfuscated.
- Use a non-interactive MPC.
- Secret share circuit C into C1,…,CN. Treat Ci as input to Pi.
- Obfuscate the circuit containing Ci and the pre-processed
state using candidate Pi
Approach of AJNSY’16
MPC satisfying such properties are based on assumptions such as LWE/DDH [MW’16,BGI’17]
SLIDE 75
- Let C be the circuit to be obfuscated.
- Use a non-interactive MPC.
- Secret share circuit C into C1,…,CN. Treat Ci as input to Pi.
- Obfuscate the circuit containing Ci and the pre-processed
state using candidate Pi
Approach of AJNSY’16
MPC satisfying such properties are based on assumptions such as LWE/DDH [MW’16,BGI’17] Can we weaken assumptions by relying on interactive MPC?
SLIDE 76
Our Approach
SLIDE 77
Our Approach
SLIDE 78 Our Approach
- Secret share circuit to (C1,..,CN) using additive
secret sharing.
SLIDE 79 Our Approach
- Secret share circuit to (C1,..,CN) using additive
secret sharing.
- Treat each candidate as a party in interactive MP
Cprotocol.
SLIDE 80 Our Approach
- Secret share circuit to (C1,..,CN) using additive
secret sharing.
- Treat each candidate as a party in interactive MP
Cprotocol.
- Run the MPC protocol for U(C1+…+CN, x) to learn
C(x)
SLIDE 81
How to evaluate MPC?
SLIDE 82 How to evaluate MPC?
- Using candidate Pi obfuscate NextMsg(Ci, , *)
SLIDE 83 How to evaluate MPC?
- Using candidate Pi obfuscate NextMsg(Ci, , *)
SLIDE 84 How to evaluate MPC?
- Using candidate Pi obfuscate NextMsg(Ci, , *)
P1.Obf P2.Obf
SLIDE 85 How to evaluate MPC?
- Using candidate Pi obfuscate NextMsg(Ci, , *)
P1.Obf
NextMsg1(C1,*)
P2.Obf NextMsg2(C2,*)
SLIDE 86 How to evaluate MPC?
- Using candidate Pi obfuscate NextMsg(Ci, , *)
P1.Obf
NextMsg1(C1,*)
P2.Obf NextMsg2(C2,*)
We need exponentially many OTs.
SLIDE 87
(Random) OT
P1 P2
SLIDE 88 (Random) OT
(r0,r1)
P1 P2
SLIDE 89 (Random) OT
(r0,r1) b
P1 P2
SLIDE 90 (Random) OT
(r0,r1) (r0,r1) b
P1 P2
SLIDE 91 (Random) OT
(r0,r1) (r0,r1) b (b,rb)
P1 P2
SLIDE 92
How to Implement OT?
SLIDE 93 How to Implement OT?
- Use any OT protocol? Assumptions are stronger.
SLIDE 94 How to Implement OT?
- Use any OT protocol? Assumptions are stronger.
- Pre-process random OTs. Exponential pre-
processing required.
SLIDE 95 How to Implement OT?
- Use any OT protocol? Assumptions are stronger.
- Pre-process random OTs. Exponential pre-
processing required.
- Use PRF keys to generate OTs on the fly.
SLIDE 96
Using PRF keys
SLIDE 97 Using PRF keys
K12
P2.Obf NextMsg2(C2,*)
SLIDE 98 Using PRF keys
K12
P2.Obf NextMsg2(C2,*)
K12
P1.Obf
NextMsg1(C1,*)
SLIDE 99 Using PRF keys
But the PRF key Ki,j is obfuscated individually by both candidates Pi and Pj K12
P2.Obf NextMsg2(C2,*)
K12
P1.Obf
NextMsg1(C1,*)
SLIDE 100 Using PRF keys
But the PRF key Ki,j is obfuscated individually by both candidates Pi and Pj K12
P2.Obf NextMsg2(C2,*)
K12
P1.Obf
NextMsg1(C1,*)
SLIDE 101 Using PRF keys
But the PRF key Ki,j is obfuscated individually by both candidates Pi and Pj K12
P2.Obf NextMsg2(C2,*)
K12
P1.Obf
NextMsg1(C1,*)
SLIDE 102 Using PRF keys
But the PRF key Ki,j is obfuscated individually by both candidates Pi and Pj K12
P2.Obf NextMsg2(C2,*)
K12
P1.Obf
NextMsg1(C1,*)
SLIDE 103
Our Fix: Onion Combiner
SLIDE 104 Our Fix: Onion Combiner
P1.Obf (
)
NextMsg1,2[K12]
( )
P2.Obf
SLIDE 105
Further Ideas
SLIDE 106 Further Ideas
- Several other problems: Handling malicious candidates,
resetting attacks, avoiding stronger assumptions, ...
SLIDE 107 Further Ideas
- Several other problems: Handling malicious candidates,
resetting attacks, avoiding stronger assumptions, ...
- FE allows us to avoid input-by-input arguments,
allows us to use only polynomial hardness.
SLIDE 108 Further Ideas
- Several other problems: Handling malicious candidates,
resetting attacks, avoiding stronger assumptions, ...
- FE allows us to avoid input-by-input arguments,
allows us to use only polynomial hardness.
SLIDE 109
Open Questions
SLIDE 110 1. iO Combiner from polynomial hardness
Open Questions
SLIDE 111 1. iO Combiner from polynomial hardness
- 2. Combiner for poly–hard Functional
Encryption from OWF/DDH
Open Questions
