Functional Encryption: Deterministic to Randomized Functions from Simple Assumptions Shashank Agrawal David J. Wu
Public-Key Functional Encryption [BSW11, OβN10] π¦ π(π¦) Keys are associated with deterministic functions π sk π
Public-Key Functional Encryption [BSW11, OβN10] π¦ π(π¦) Keys are associated with deterministic functions π sk π π sk π
Public-Key Functional Encryption [BSW11, OβN10] π¦ π(π¦) Keys are associated with deterministic functions π sk π π(π) Decrypt(sk π , ct π ) π sk π
Public-Key Functional Encryption [BSW11, OβN10] Setup 1 π : Outputs (msk, mpk) β’ eyGen(msk, π) : Outputs decryption key sk π β’ Encrypt mpk, π : Outputs ciphertext ct π β’ Decrypt(sk π , ct π ) : Outputs π π
Public-Key Functional Encryption [BSW11, OβN10] k π ππ k π k π ππ‘ π§ππ ππππ’ππ§π πππ π‘π’π£ππ’π£π βΆ ππ) , ksm(neGyeSetup 1 π : Outputs (msk, mpk) β’ KeyGen(msk, π) : Outputs decryption key sk π β’ Encrypt mpk, π : Outputs ciphertext ct π β’ Decrypt(sk π , ct π ) : Outputs π π
Public-Key Functional Encryption [BSW11, OβN10] ct π ct π πππ’ ct π π π’π¦ππ’π πβπππ π‘π’π£ππ’π£π ππ mpk, π βΆ , ππ mpk, π ππ’ππ§π ππ k π ππ k π k π ππ‘ π§ππ ππππ’ππ§π πππ π‘π’π£ππ’π£π βΆ ππ) , ksm(neGyeSetup 1 π : Outputs (msk, mpk) β’ KeyGen(msk, π) : Outputs decryption key sk π β’ Encrypt mpk, π : Outputs ciphertext ct π β’ Encrypt mpk, π : Outputs ciphertext ct π
Public-Key Functional Encryption [BSW11, OβN10] ππ π ππ π π‘π’π£ππ’π£π βΆ t π ππ t π ) t π π’π k π ππ k π , k π ππ‘(π’ππ§π ππ ct π ct π πππ’ ct π π π’π¦ππ’π πβπππ π‘π’π£ππ’π£π ππ mpk, π βΆ , ππ mpk, π ππ’ππ§π ππ k π ππ k π k π ππ‘ π§ππ ππππ’ππ§π πππ π‘π’π£ππ’π£π βΆ ππ) , ksm(neGyeSetup 1 π : Outputs (msk, mpk) β’ KeyGen(msk, π) : Outputs decryption key sk π β’ Encrypt mpk π : Outputs ciphertext ct
Public-Key Functional Encryption [BSW11, OβN10] ππ π ππ π π‘π’π£ππ’π£π βΆ t π ππ t π ) t π π’π k π ππ k π , k π ππ‘(π’ππ§π ππππ π ππ π π‘π’π£ππ’π£π βΆ t π ππ t π ) t π π’π k π ππ k π , k π ππ‘(π’ππ§π ππ ct π ct π πππ’ ct π π π’π¦ππ’π πβπππ π‘π’π£ππ’π£π ππ mpk, π βΆ , ππ mpk, π ππ’ππ§π ππ k π ππ k π k π ππ‘ π§ππ ππππ’ππ§π πππ π‘π’π£ππ’π£π βΆ ππ) , ksm(neGyeSetup 1 π : Outputs (msk, mpk)
Public-Key Functional Encryption [BSW11, OβN10] β’ Setup 1 π : Outputs (msk, mpk) β’ KeyGen(msk, π) : Outputs decryption key sk π β’ Encrypt mpk, π : Outputs ciphertext ct π Deterministic function π β’ Decrypt(sk π , ct π ) : Outputs π π
Functional Encryption for Randomized Functionalities (rFE) [ABFGGTW13, GJKS15] π π¦ But what if π is π(π¦ ; π ) randomized ? Many interesting functions are randomized
Application 1: Proxy Re-Encryption Alice
Application 1: Proxy Re-Encryption Alice
Application 1: Proxy Re-Encryption personal email Alice Alice
Application 1: Proxy Re-Encryption personal email Alice Alice work email Secretary
Application 1: Proxy Re-Encryption personal email Alice Alice work email Mail server has functional key to re-encrypt message under Secretary secretaryβs public key
Application 2: Auditing an Encrypted Database
Application 2: Auditing an Encrypted Database Encrypted database of records π π 2 π 3 π π 5 π 6 1 4
Application 2: Auditing an Encrypted Database Encrypted database of records π π 2 π 3 π π 5 π 6 1 4 Sample a random subset to audit
Application 2: Auditing an Encrypted Database Encrypted database of records π π 2 π 3 π π 5 π 6 1 4 Sample a random π 2 π 6 subset to audit
Does Public-Key rFE Exist?
Does Public-Key rFE Exist? [GJKS15] General- iO Purpose rFE (selectively secure)
Public-Key Functional Encryption [BSW11, OβN10] Can be instantiated from a wide range of assumptions
Public-Key Functional Encryption [BSW11, OβN10] Can be instantiated from a wide range of assumptions [SS10, GVW12, GKPVZ13, β¦] Bounded- PKE / LWE Collusion FE
Public-Key Functional Encryption [BSW11, OβN10] Can be instantiated from a wide range of assumptions [SS10, GVW12, GKPVZ13, β¦] Bounded- PKE / LWE Collusion FE [GGHRSW13, Wat15, GGHZ16, β¦] Multilinear General- Maps / iO Purpose FE
The Landscape of (Public-Key) Functional Encryption Deterministic functionalities [SS10, GVW12, β¦] Bounded- PKE / LWE Collusion FE [GGHRSW13, GGHZ16, β¦ ] Multilinear General- Maps / iO Purpose FE Generally adaptively secure
The Landscape of (Public-Key) Functional Encryption Deterministic functionalities Randomized functionalities [SS10, GVW12, β¦] Bounded- PKE / LWE [GJKS15] Collusion FE General- iO [GGHRSW13, GGHZ16, β¦ ] Purpose rFE Multilinear General- Maps / iO Purpose FE Generally adaptively Selectively secure secure
The Landscape of (Public-Key) Functional Encryption PKE / LWE Does extending FE to support General- randomized functionalities require Purpose rFE much stronger tools? Multilinear Maps / iO
Our Main Result General-purpose FE for deterministic functionalities
Our Main Result General-purpose FE General-purpose FE Number Theory for deterministic for randomized functionalities functionalities (e.g., DDH, RSA)
Our Main Result General-purpose FE General-purpose FE Number Theory for deterministic for randomized functionalities functionalities (e.g., DDH, RSA) Implication : randomized FE is not much more difficult to construct than standard FE.
Defining rFE
Correctness for FE Deterministic functions
Correctness for FE Deterministic functions π sk π
Correctness for FE Deterministic functions π π(π) Decrypt(sk π , ct π ) sk π
Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions
Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions π sk π
Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions π π(π ; π ) Decrypt(sk π , ct π ) sk π
Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions π π(π ; π ) Decrypt(sk π , ct π ) sk π π β² Different ciphertexts
Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions π π(π ; π ) Decrypt(sk π , ct π ) sk π π β² sk π Different Same function ciphertexts key
Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions π π(π ; π ) Decrypt(sk π , ct π ) sk π π β² π(π β² ; π β²) Decrypt(sk π , ct π β² ) sk π Independent draws Different Same function from output ciphertexts key distribution
Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions π π(π ; π ) Decrypt(sk π , ct π ) sk π π π β² (π ; π β² ) Decrypt(sk π β² , ct π ) sk π β² Independent draws Same Different from output ciphertexts function keys distribution
Simulation-Based Security (Informally) msk sk π π Real World: honestly generated ciphertexts π and secret keys π
Simulation-Based Security (Informally) msk sk π π Real World: honestly generated ciphertexts π and secret keys π π Ideal World: sk π simulated ciphertexts and secret keys π(π) π
The Case for Malicious Encrypters [GJKS15] Encrypted database of records π π 2 π 3 π π 5 π 6 1 4 Sample a random π 2 π 6 subset to audit
The Case for Malicious Encrypters [GJKS15] Encrypted database of records π π 2 π 3 π π 5 π 6 1 4 What if encrypter (bank) is adversarial? Sample a random π 2 π 6 subset to audit
The Case for Malicious Encrypters [GJKS15] Randomized functionalities π π(π ; π ) Decrypt(sk π , ct π ) sk π π β² π(π β² ; π ) Decrypt(sk π , ct π β² ) sk π Dishonest encrypters can construct βbadβ ciphertexts such that decryption produces correlated outputs
The Case for Malicious Encrypters [GJKS15] Randomized functionalities π π(π ; π ) Decrypt(sk π , ct π ) sk π π β² π(π β² ; π ) Decrypt(sk π , ct π β² ) sk π Formally captured by giving adversary access to a decryption oracle (like in the CCA-security game). [See paper for details.]
Our Generic Transformation
Recommend
More recommend