Homomorphic Smooth Projective Hashing Hoeteck Wee ENS, Paris . . - PowerPoint PPT Presentation

KDM-Security via Homomorphic Smooth Projective Hashing Hoeteck Wee ENS, Paris . . . . . . . .

key-dependent message security. [ Black Rogaway Shrimpton 02 ] this work. unifying framework with a simple proof of security “ enc pk ( sk ) ” . . . . . . . .

this work. unifying framework with a simple proof of security “ enc pk ( sk ) ” key-dependent message security. [ Black Rogaway Shrimpton 02 ] ▶ applications: formal methods [ Adão Bana Herzog Scedrov 05 ] , credentials [ Camenisch Lysyanskaya 01 ] , fully homomorphic encryption [ Gentry 09 ] . . . . . . . .

this work. unifying framework with a simple proof of security “ enc pk ( sk ) ” key-dependent message security. [ Black Rogaway Shrimpton 02 ] ▶ many constructions [ Boneh Halevi Hamburg Ostrovsky 08, Applebaum Cash Peikert Sahai 09, Brakerski Goldwasser 10, Brakerski Vaikuntanathan 11, Barak Haitner Hofheinz Ishai 10, Brakerski Goldwasser Kalai 11, Malkin Teranishi Yung 11, Applebaum 11, ... ] . . . . . . . .

“ enc pk ( sk ) ” key-dependent message security. [ Black Rogaway Shrimpton 02 ] ▶ many constructions [ Boneh Halevi Hamburg Ostrovsky 08, Applebaum Cash Peikert Sahai 09, Brakerski Goldwasser 10, Brakerski Vaikuntanathan 11, Barak Haitner Hofheinz Ishai 10, Brakerski Goldwasser Kalai 11, Malkin Teranishi Yung 11, Applebaum 11, ... ] this work. unifying framework with a simple proof of security . . . . . . . .

+ map Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) determined given µ ( sk ) where µ is lossy . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) witness r . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) − ( smoothness ) Λ sk ( C / ∈ G y ) random given µ ( sk ) . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C subgroup assumption. uniform ( G y ) ≈ c uniform ( G ) . . . . . . . .

x y g r g ar g x ay r i.e. c x c y x y c c G g x ay x y x y g r g ar g xr ayr random given x ay and r r Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C DDH instantiation. [ Cramer Shoup 98 ] − pp = ( g , g a ) , G y = ( g r , g ar ) ⊂ G = G 2 − DDH assumption ⇔ uniform ( G y ) ≈ c uniform ( G ) . . . . . . . .

x y g r g ar g x ay r i.e. g x ay x y x y g r g ar g xr ayr random given x ay and r r Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C DDH instantiation. [ Cramer Shoup 98 ] − pp = ( g , g a ) , G y = ( g r , g ar ) ⊂ G = G 2 0 c y − Λ ( x , y ) ( c 0 , c 1 ) = c x 1 . . . . . . . .

g x ay x y x y g r g ar g xr ayr random given x ay and r r Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C DDH instantiation. [ Cramer Shoup 98 ] − pp = ( g , g a ) , G y = ( g r , g ar ) ⊂ G = G 2 0 c y − Λ ( x , y ) ( c 0 , c 1 ) = c x 1 i.e. Λ ( x , y ) ( g r , g ar ) = ( g x + ay ) r . . . . . . . .

x y g r g ar g xr ayr random given x ay and r r Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C DDH instantiation. [ Cramer Shoup 98 ] − pp = ( g , g a ) , G y = ( g r , g ar ) ⊂ G = G 2 0 c y − Λ ( x , y ) ( c 0 , c 1 ) = c x 1 i.e. Λ ( x , y ) ( g r , g ar ) = ( g x + ay ) r − µ ( x , y ) = g x + ay . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C DDH instantiation. [ Cramer Shoup 98 ] − pp = ( g , g a ) , G y = ( g r , g ar ) ⊂ G = G 2 0 c y − Λ ( x , y ) ( c 0 , c 1 ) = c x 1 i.e. Λ ( x , y ) ( g r , g ar ) = ( g x + ay ) r − µ ( x , y ) = g x + ay − Λ ( x , y ) ( g r , g ar ′ ) = g ( xr + ayr ′ ) random given x + ay and r ̸ = r ′ . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C cpa-secure encryption. Λ sk ( · ) as one-time pad − gen ( pp ) : ( pk , sk ) , pk = µ ( sk ) r − enc pk ( m ) : ( C , Λ sk ( C ) · m ) , C ← G y � �� � pub ( pk , C , r ) . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C cpa-secure encryption. Λ sk ( · ) as one-time pad − gen ( pp ) : ( pk , sk ) , pk = µ ( sk ) r − enc pk ( m ) : ( C , Λ sk ( C ) · m ) , C ← G y − dec sk ( C , ψ ) : Λ sk ( C ) − 1 · ψ . . . . . . . .

C sk C c C sk C s C random C r r r C C y Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C cpa-secure encryption. Λ sk ( · ) as one-time pad − gen ( pp ) : ( pk , sk ) , pk = µ ( sk ) r − enc pk ( m ) : ( C , Λ sk ( C ) · m ) , C ← G y subgroup + smoothness ⇒ cpa-security . . . . . . . .

s C random C r Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C cpa-secure encryption. Λ sk ( · ) as one-time pad − gen ( pp ) : ( pk , sk ) , pk = µ ( sk ) r − enc pk ( m ) : ( C , Λ sk ( C ) · m ) , C ← G y subgroup + smoothness ⇒ cpa-security ( C , Λ sk ( C )) C ←G y ≈ c ( C , Λ sk ( C )) C r r ←G . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C cpa-secure encryption. Λ sk ( · ) as one-time pad − gen ( pp ) : ( pk , sk ) , pk = µ ( sk ) r − enc pk ( m ) : ( C , Λ sk ( C ) · m ) , C ← G y subgroup + smoothness ⇒ cpa-security ( C , Λ sk ( C )) C ←G y ≈ c ( C , Λ sk ( C )) C ←G ≈ s ( C , random ) C r r r ←G . . . . . . . .

Projective Hashing definition. projective hash function for G ⊇ G y [ Cramer Shoup 02 ] − family Λ sk ( C ∈ G ) indexed by sk + map µ − ( projective ) Λ sk ( C ∈ G y ) = pub ( µ ( sk ) , C , r ) r − ( smoothness ) Λ sk ( C ← G ) random given µ ( sk ) , C cpa-secure encryption. Λ sk ( · ) as one-time pad − gen ( pp ) : ( pk , sk ) , pk = µ ( sk ) r − enc pk ( m ) : ( C , Λ sk ( C ) · m ) , C ← G y subgroup + smoothness ⇒ cpa-security ( C , Λ sk ( C )) C ←G y ≈ c ( C , Λ sk ( C )) C ←G ≈ s ( C , random ) C r r r ←G . . . . . . . .

i.e. sk C C sk C sk C , if is homomorphic sk theorem. CPA scheme is KDM secure e , subgroup C C C e C 1. r c r y y 2. note. only use smoothness for CPA security. KDM security definition. ( gen , enc , dec ) is KDM secure w.r.t. F if sim ( pk , f ) ≈ c enc pk ( f ( sk )) for all f ∈ F . . . . . . . .