Simple Functional Encryption Schemes for Inner Products Michel - - PowerPoint PPT Presentation

Overview of the results The Framework Work in progress

Simple Functional Encryption Schemes for Inner Products

Michel Abdalla, Florian Bourse, Angelo De Caro, and David Pointcheval

´ Ecole normale sup´ erieure, CNRS, INRIA, PSL, Paris, France

R E S E A R C H U N I V E R S I T Y

PKC 2015 — Maryland, USA Wednesday, April 1

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress

1

Overview of the results What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

2

The Framework Overview of the framework Example Proof of security Generalization

3

Work in progress What is there left to do? Thank you!

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption?

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption? Introduced by Dan Boneh, Amit Sahai and Brent Waters [BSW10]

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption? Introduced by Dan Boneh, Amit Sahai and Brent Waters [BSW10] Generalizes multiple concepts:

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption? Introduced by Dan Boneh, Amit Sahai and Brent Waters [BSW10] Generalizes multiple concepts: Identity-Based Encryption

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption? Introduced by Dan Boneh, Amit Sahai and Brent Waters [BSW10] Generalizes multiple concepts: Identity-Based Encryption Fuzzy Identity-Based Encryption

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption? Introduced by Dan Boneh, Amit Sahai and Brent Waters [BSW10] Generalizes multiple concepts: Identity-Based Encryption Fuzzy Identity-Based Encryption Attribute-Based Encryption

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption? Introduced by Dan Boneh, Amit Sahai and Brent Waters [BSW10] Generalizes multiple concepts: Identity-Based Encryption Fuzzy Identity-Based Encryption Attribute-Based Encryption Predicate Encryption, etc.

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Brief history

What is Functional Encryption? Introduced by Dan Boneh, Amit Sahai and Brent Waters [BSW10] Generalizes multiple concepts: Identity-Based Encryption Fuzzy Identity-Based Encryption Attribute-Based Encryption Predicate Encryption, etc. Enables keys that give partial information.

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Motivation

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Motivation

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Formal definition

Functionality F : K × X → M (k, x) → F(k, x) Secret key for k : skk ← msk Ciphertext for x : ctx ← pk

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Formal definition

Functionality F : K × X → M (k, x) → F(k, x) Secret key for k : skk ← msk Ciphertext for x : ctx ← pk Correctness Decrypt(skk, ctx) = F(k, x)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Formal definition

Functionality F : K × X → M (k, x) → F(k, x) ((Picture,Bob),data) → Pictures of Bob Secret key for k : skk ← msk Ciphertext for x : ctx ← pk Correctness Decrypt(skk, ctx) = F(k, x)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Formal definition

Functionality F : K × X → M (k, x) → F(k, x) ((Picture,Bob),data) → Pictures of Bob Secret key for k : skk ← msk Ciphertext for x : ctx ← pk Correctness Decrypt(skk, ctx) = F(k, x) Alice gets Bob’s pictures in her data.

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Security

Intuitively: skk doesn’t leak any more information than F(k, x) Even if there are collusions ! skk and sk′

k don’t leak more information than F(k, x) and F(k′, x)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Security

Intuitively: skk doesn’t leak any more information than F(k, x) The server doesn’t access Alice’s private data other than needed. Even if there are collusions ! skk and sk′

k don’t leak more information than F(k, x) and F(k′, x)

Pictures of Jean and pictures of Jacques don’t make pictures of Jean-Jacques.

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

current lines of work

Designing efficient functional encryption for access control...

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

current lines of work

Designing efficient functional encryption for access control... nothing about partial information

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

current lines of work

Designing efficient functional encryption for access control... nothing about partial information Obtain functional encryption for all circuits...

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

current lines of work

Designing efficient functional encryption for access control... nothing about partial information Obtain functional encryption for all circuits... construction from inefficient primitives

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

current lines of work

Designing efficient functional encryption for access control... nothing about partial information Obtain functional encryption for all circuits... construction from inefficient primitives This work: figuring out what we can do with simple assumption

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Inner Product functionality

Functionality F : Zℓ

p × Zℓ p → Zp

(y, x) →< x, y > Secret key for y : sky Ciphertext for x : ctx

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Inner Product functionality

Functionality F : Zℓ

p × Zℓ p → Zp

(y, x) →< x, y > Secret key for y : sky Ciphertext for x : ctx Correctness Decrypt(y, ctx) = < x, y >

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Motivation example: Online dating system

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Motivation example: Online dating system

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Motivation example: Online dating system

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Motivation example: Online dating system

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Properties

Inner product is very interesting: lots of applications easy to compute - only need additions if one vector is known still non-trivial: |K| is exponential in ℓ theoretically interesting problem - enables any computation in NC 0

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Inherent security limitation

< x, y > gives a lot of information about x ℓ well chosen secret keys reveals everything

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Basic primitive: PKE with some additional structural properties

Our framework can be instantiated with different well known Public Key Encryption schemes

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Basic primitive: PKE with some additional structural properties

Our framework can be instantiated with different well known Public Key Encryption schemes Additive ElGamal, based on Decisional Diffie-Hellman (DDH) assumption

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Basic primitive: PKE with some additional structural properties

Our framework can be instantiated with different well known Public Key Encryption schemes Additive ElGamal, based on Decisional Diffie-Hellman (DDH) assumption Lattice based Public Key Encryption scheme, based on the Learning With Errors (LWE) assumption

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Efficient

Ciphertext size is ℓ + 1 elements Key size is 1 element

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Efficient

Ciphertext size is ℓ + 1 elements Key size is 1 element This is really close to information theoretical optimal for correctness

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Selective IND-CPA security

The resulting scheme is secure under selective chosen plaintext attacks Security game: A submits x0, x1

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Selective IND-CPA security

The resulting scheme is secure under selective chosen plaintext attacks Security game: A submits x0, x1 A receives pk, ctxb

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Selective IND-CPA security

The resulting scheme is secure under selective chosen plaintext attacks Security game: A submits x0, x1 A receives pk, ctxb A sends some set of queries {y}, such that < x0, y >=< x1, y >

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Selective IND-CPA security

The resulting scheme is secure under selective chosen plaintext attacks Security game: A submits x0, x1 A receives pk, ctxb A sends some set of queries {y}, such that < x0, y >=< x1, y > A receives {sky}

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is Functional Encryption? Inner Product functionality What does simple mean? What do we achieve?

Selective IND-CPA security

The resulting scheme is secure under selective chosen plaintext attacks Security game: A submits x0, x1 A receives pk, ctxb A sends some set of queries {y}, such that < x0, y >=< x1, y > A receives {sky} A guesses b′

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

How to apply our framework?

Our framework is easy to instantiate: Pick a good Public Key Encryption scheme requires structural properties stated later

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

How to apply our framework?

Our framework is easy to instantiate: Pick a good Public Key Encryption scheme requires structural properties stated later Reuse Randomness to encrypt a vector

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

How to apply our framework?

Our framework is easy to instantiate: Pick a good Public Key Encryption scheme requires structural properties stated later Reuse Randomness to encrypt a vector Use additive homomorphism to decrypt the correct value

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

How to apply our framework?

Our framework is easy to instantiate: Pick a good Public Key Encryption scheme requires structural properties stated later Reuse Randomness to encrypt a vector Use additive homomorphism to decrypt the correct value And it’s done !

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

How to apply our framework?

Our framework is easy to instantiate: Pick a good Public Key Encryption scheme requires structural properties stated later Reuse Randomness to encrypt a vector Use additive homomorphism to decrypt the correct value And it’s done ! (and safe !)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

The additively homomorphic ElGamal public key encryption scheme

Public parameters : p, G, g Secret key : s Public key : gs Ciphertext for m : (gr, grsgm)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

The additively homomorphic ElGamal public key encryption scheme

Public parameters : p, G, g Secret key : s Public key : gs Ciphertext for m : (gr, grsgm) Correctness grsgm (gr)s =gm

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Reusing randomness

Public parameters : p, G, g Secret key : s Public key : gs Ciphertext for m : (gr, grsgm)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Reusing randomness

Public parameters : p, G, g, ℓ Secret key : s = s1 . . . sℓ Public key : g

s = gs1 . . . gsℓ

Ciphertext for x : (gr, gr

sg x = grs1gx1 . . . grsℓgxℓ)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Reusing randomness

Public parameters : p, G, g, ℓ Secret key : s = s1 . . . sℓ Public key : g

s = gs1 . . . gsℓ

Ciphertext for x : (gr, gr

sg x = grs1gx1 . . . grsℓgxℓ)

Now onto correctness...

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Using homomorphism to decrypt the inner product

Secret key : s = s1 . . . sℓ Public key : g

s = gs1 . . . gsℓ

Ciphertext for x : (gr, gr

sg x = grs1gx1 . . . grsℓgxℓ)

Correctness grs1gx1grs2gx2 =gr(s1+s2)gx1+x2

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Using homomorphism to decrypt the inner product

Secret key : s = s1 . . . sℓ Public key : g

s = gs1 . . . gsℓ

Ciphertext for x : (gr, gr

sg x = grs1gx1 . . . grsℓgxℓ)

Correctness grs1gx1grs2gx2 =gr(s1+s2)gx1+x2

• i

(grsigxi)yi =(gr)

• i yisig
• i xiyi

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

First trick

You can change easily the basis used in the whole scheme

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

First trick

You can change easily the basis used in the whole scheme Given a matrix P, a ciphertext ct

x, and the master secret key

s You can generate a new ciphertext ctP

x using the homomorphism,

and a new master secret key P s

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Second trick

In the security game, there exists a basis in which the adversary cannot find the first coordinate

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Second trick

In the security game, there exists a basis in which the adversary cannot find the first coordinate Indeed, A can only ask secret keys for y such that < y, x1 − x0 >= 0 So a basis having x1 − x0 as first vector verifies this

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Putting it together

Here is a simulator S using both tricks to solve a challenge given an adversary breaking the scheme:

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Putting it together

Here is a simulator S using both tricks to solve a challenge given an adversary breaking the scheme: S finds a basis having x1 − x0 as first vector

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Putting it together

Here is a simulator S using both tricks to solve a challenge given an adversary breaking the scheme: S finds a basis having x1 − x0 as first vector S generates ct∗ with its input challenge in the first coordinate

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Putting it together

Here is a simulator S using both tricks to solve a challenge given an adversary breaking the scheme: S finds a basis having x1 − x0 as first vector S generates ct∗ with its input challenge in the first coordinate S moves ct∗ in the correct basis

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

Putting it together

Here is a simulator S using both tricks to solve a challenge given an adversary breaking the scheme: S finds a basis having x1 − x0 as first vector S generates ct∗ with its input challenge in the first coordinate S moves ct∗ in the correct basis

• Florian Bourse

Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

What properties do we need?

2 properties: Randomness Reuse gr, gr

sg x is safe

In this case, it is an instance of ElGamal with secret keys r and randomnesses si Homomorphism of message and key grs1+x1grs2+x2 = gr(s1+s2)+(x1+x2)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

How to generalize?

To generalize, replace: s → sk gs → pk gr → C(r) grs+x → Enc(pk, x; r)

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

the LWE assumption

Public parameters : q, n, m, A ∈ Zm×n

q

Secret key : s ∈ Zm

q

Public key : A s + e ∈ Zm

q

• e ← χm

Ciphertext for x : ( rA, r(A s + e) + ⌊q 2⌉x)

• r ← {0, 1}1×m

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

the LWE assumption

Public parameters : q, n, m, A ∈ Zm×n

q

Secret key : s ∈ Zm

q

Public key : A s + e ∈ Zm

q

• e ← χm

Ciphertext for x : ( rA, r(A s + e) + ⌊q 2⌉x)

• r ← {0, 1}1×m

Advantages Avoid small space restriction of additive ElGamal Post-quantum

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress Overview of the framework Example Proof of security Generalization

the LWE assumption

Public parameters : q, n, m, A ∈ Zm×n

q

Secret key : s ∈ Zm

q

Public key : A s + e ∈ Zm

q

• e ← χm

Ciphertext for x : ( rA, r(A s + e) + ⌊q 2⌉x)

• r ← {0, 1}1×m

Advantages Avoid small space restriction of additive ElGamal Post-quantum Inconvenients Noisy setup - proof is more subtle

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is there left to do? Thank you!

Work in progress

Work in progress What is there left to do? Adaptive security A gets pk before choosing x0 and x1

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is there left to do? Thank you!

Work in progress

Work in progress What is there left to do? Adaptive security A gets pk before choosing x0 and x1 Function privacy In private setting - A doesn’t know what his key compute

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is there left to do? Thank you!

Work in progress

Work in progress What is there left to do? Adaptive security A gets pk before choosing x0 and x1 Function privacy In private setting - A doesn’t know what his key compute Find other interesting fitting PKE Paillier-like cryptosystem would solve the small space restrictions etc.

Florian Bourse Simple Functional Encryption Schemes for Inner Products

Overview of the results The Framework Work in progress What is there left to do? Thank you!

Thank you!

Thank you for your attention!

Florian Bourse Simple Functional Encryption Schemes for Inner Products