functional encryption deterministic
play

Functional Encryption: Deterministic to Randomized Functions from - PowerPoint PPT Presentation

Functional Encryption: Deterministic to Randomized Functions from Simple Assumptions Shashank Agrawal David J. Wu Public-Key Functional Encryption [BSW11, ON10] () Keys are associated with deterministic functions sk


  1. Functional Encryption: Deterministic to Randomized Functions from Simple Assumptions Shashank Agrawal David J. Wu

  2. Public-Key Functional Encryption [BSW11, O’N10] 𝑦 𝑔(𝑦) Keys are associated with deterministic functions 𝑔 sk 𝑔

  3. Public-Key Functional Encryption [BSW11, O’N10] 𝑦 𝑔(𝑦) Keys are associated with deterministic functions 𝑔 sk 𝑔 𝑛 sk 𝑔

  4. Public-Key Functional Encryption [BSW11, O’N10] 𝑦 𝑔(𝑦) Keys are associated with deterministic functions 𝑔 sk 𝑔 𝑔(𝑛) Decrypt(sk 𝑔 , ct 𝑛 ) 𝑛 sk 𝑔

  5. Public-Key Functional Encryption [BSW11, O’N10] Setup 1 πœ‡ : Outputs (msk, mpk) β€’ eyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 β€’ Decrypt(sk 𝑔 , ct 𝑛 ) : Outputs 𝑔 𝑛

  6. Public-Key Functional Encryption [BSW11, O’N10] k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 β€’ Decrypt(sk 𝑔 , ct 𝑛 ) : Outputs 𝑔 𝑛

  7. Public-Key Functional Encryption [BSW11, O’N10] ct 𝑛 ct 𝑛 𝑛𝑛𝑒 ct 𝑛 𝑑 π‘’π‘¦π‘“π‘’π‘ π‘“β„Žπ‘žπ‘—π‘‘ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ 𝑛𝑛 mpk, 𝑛 ∢ , π‘™π‘ž mpk, 𝑛 π‘›π‘’π‘žπ‘§π‘ π‘‘π‘œ k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛

  8. Public-Key Functional Encryption [BSW11, O’N10] 𝑔𝑔 𝑛 𝑛𝑛 𝑛 π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ t 𝑛 𝑛𝑛 t 𝑛 ) t 𝑛 𝑒𝑑 k 𝑔 𝑔𝑔 k 𝑔 , k 𝑔 𝑙𝑑(π‘’π‘žπ‘§π‘ π‘‘π‘“ ct 𝑛 ct 𝑛 𝑛𝑛𝑒 ct 𝑛 𝑑 π‘’π‘¦π‘“π‘’π‘ π‘“β„Žπ‘žπ‘—π‘‘ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ 𝑛𝑛 mpk, 𝑛 ∢ , π‘™π‘ž mpk, 𝑛 π‘›π‘’π‘žπ‘§π‘ π‘‘π‘œ k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk 𝑛 : Outputs ciphertext ct

  9. Public-Key Functional Encryption [BSW11, O’N10] 𝑔𝑔 𝑛 𝑛𝑛 𝑛 π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ t 𝑛 𝑛𝑛 t 𝑛 ) t 𝑛 𝑒𝑑 k 𝑔 𝑔𝑔 k 𝑔 , k 𝑔 𝑙𝑑(π‘’π‘žπ‘§π‘ π‘‘π‘“π‘”π‘” 𝑛 𝑛𝑛 𝑛 π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ t 𝑛 𝑛𝑛 t 𝑛 ) t 𝑛 𝑒𝑑 k 𝑔 𝑔𝑔 k 𝑔 , k 𝑔 𝑙𝑑(π‘’π‘žπ‘§π‘ π‘‘π‘“ ct 𝑛 ct 𝑛 𝑛𝑛𝑒 ct 𝑛 𝑑 π‘’π‘¦π‘“π‘’π‘ π‘“β„Žπ‘žπ‘—π‘‘ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ 𝑛𝑛 mpk, 𝑛 ∢ , π‘™π‘ž mpk, 𝑛 π‘›π‘’π‘žπ‘§π‘ π‘‘π‘œ k 𝑔 𝑔𝑔 k 𝑔 k 𝑔 𝑙𝑑 𝑧𝑓𝑙 π‘œπ‘π‘—π‘’π‘žπ‘§π‘ π‘‘π‘“π‘’ π‘‘π‘’π‘£π‘žπ‘’π‘£π‘ƒ ∢ 𝑔𝑔) , ksm(neGyeSetup 1 πœ‡ : Outputs (msk, mpk)

  10. Public-Key Functional Encryption [BSW11, O’N10] β€’ Setup 1 πœ‡ : Outputs (msk, mpk) β€’ KeyGen(msk, 𝑔) : Outputs decryption key sk 𝑔 β€’ Encrypt mpk, 𝑛 : Outputs ciphertext ct 𝑛 Deterministic function 𝑔 β€’ Decrypt(sk 𝑔 , ct 𝑛 ) : Outputs 𝑔 𝑛

  11. Functional Encryption for Randomized Functionalities (rFE) [ABFGGTW13, GJKS15] 𝑠 𝑦 But what if 𝑔 is 𝑔(𝑦 ; 𝑠) randomized ? Many interesting functions are randomized

  12. Application 1: Proxy Re-Encryption Alice

  13. Application 1: Proxy Re-Encryption Alice

  14. Application 1: Proxy Re-Encryption personal email Alice Alice

  15. Application 1: Proxy Re-Encryption personal email Alice Alice work email Secretary

  16. Application 1: Proxy Re-Encryption personal email Alice Alice work email Mail server has functional key to re-encrypt message under Secretary secretary’s public key

  17. Application 2: Auditing an Encrypted Database

  18. Application 2: Auditing an Encrypted Database Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4

  19. Application 2: Auditing an Encrypted Database Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 Sample a random subset to audit

  20. Application 2: Auditing an Encrypted Database Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 Sample a random 𝑠 2 𝑠 6 subset to audit

  21. Does Public-Key rFE Exist?

  22. Does Public-Key rFE Exist? [GJKS15] General- iO Purpose rFE (selectively secure)

  23. Public-Key Functional Encryption [BSW11, O’N10] Can be instantiated from a wide range of assumptions

  24. Public-Key Functional Encryption [BSW11, O’N10] Can be instantiated from a wide range of assumptions [SS10, GVW12, GKPVZ13, …] Bounded- PKE / LWE Collusion FE

  25. Public-Key Functional Encryption [BSW11, O’N10] Can be instantiated from a wide range of assumptions [SS10, GVW12, GKPVZ13, …] Bounded- PKE / LWE Collusion FE [GGHRSW13, Wat15, GGHZ16, …] Multilinear General- Maps / iO Purpose FE

  26. The Landscape of (Public-Key) Functional Encryption Deterministic functionalities [SS10, GVW12, …] Bounded- PKE / LWE Collusion FE [GGHRSW13, GGHZ16, … ] Multilinear General- Maps / iO Purpose FE Generally adaptively secure

  27. The Landscape of (Public-Key) Functional Encryption Deterministic functionalities Randomized functionalities [SS10, GVW12, …] Bounded- PKE / LWE [GJKS15] Collusion FE General- iO [GGHRSW13, GGHZ16, … ] Purpose rFE Multilinear General- Maps / iO Purpose FE Generally adaptively Selectively secure secure

  28. The Landscape of (Public-Key) Functional Encryption PKE / LWE Does extending FE to support General- randomized functionalities require Purpose rFE much stronger tools? Multilinear Maps / iO

  29. Our Main Result General-purpose FE for deterministic functionalities

  30. Our Main Result General-purpose FE General-purpose FE Number Theory for deterministic for randomized functionalities functionalities (e.g., DDH, RSA)

  31. Our Main Result General-purpose FE General-purpose FE Number Theory for deterministic for randomized functionalities functionalities (e.g., DDH, RSA) Implication : randomized FE is not much more difficult to construct than standard FE.

  32. Defining rFE

  33. Correctness for FE Deterministic functions

  34. Correctness for FE Deterministic functions 𝑛 sk 𝑔

  35. Correctness for FE Deterministic functions 𝑛 𝑔(𝑛) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔

  36. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions

  37. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 sk 𝑔

  38. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔

  39. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² Different ciphertexts

  40. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² sk 𝑔 Different Same function ciphertexts key

  41. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² 𝑔(𝑛 β€² ; 𝑠′) Decrypt(sk 𝑔 , ct 𝑛 β€² ) sk 𝑔 Independent draws Different Same function from output ciphertexts key distribution

  42. Correctness for rFE [ABFGGTW13, GJKS15] Randomized functions 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 𝑔 β€² (𝑛 ; 𝑠 β€² ) Decrypt(sk 𝑔 β€² , ct 𝑛 ) sk 𝑔 β€² Independent draws Same Different from output ciphertexts function keys distribution

  43. Simulation-Based Security (Informally) msk sk 𝑔 𝑔 Real World: honestly generated ciphertexts 𝑛 and secret keys 𝑛

  44. Simulation-Based Security (Informally) msk sk 𝑔 𝑔 Real World: honestly generated ciphertexts 𝑛 and secret keys 𝑛 𝑔 Ideal World: sk 𝑔 simulated ciphertexts and secret keys 𝑔(𝑛) 𝑛

  45. The Case for Malicious Encrypters [GJKS15] Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 Sample a random 𝑠 2 𝑠 6 subset to audit

  46. The Case for Malicious Encrypters [GJKS15] Encrypted database of records 𝑠 𝑠 2 𝑠 3 𝑠 𝑠 5 𝑠 6 1 4 What if encrypter (bank) is adversarial? Sample a random 𝑠 2 𝑠 6 subset to audit

  47. The Case for Malicious Encrypters [GJKS15] Randomized functionalities 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² 𝑔(𝑛 β€² ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 β€² ) sk 𝑔 Dishonest encrypters can construct β€œbad” ciphertexts such that decryption produces correlated outputs

  48. The Case for Malicious Encrypters [GJKS15] Randomized functionalities 𝑛 𝑔(𝑛 ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 ) sk 𝑔 𝑛 β€² 𝑔(𝑛 β€² ; 𝑠) Decrypt(sk 𝑔 , ct 𝑛 β€² ) sk 𝑔 Formally captured by giving adversary access to a decryption oracle (like in the CCA-security game). [See paper for details.]

  49. Our Generic Transformation

Recommend


More recommend