Multi-Input Functional Encryption for Inner Products: Function-Hiding - PowerPoint PPT Presentation

Multi-Input Functional Encryption for Inner Products: Function-Hiding Realizations and Constructions without Pairings Michel Abdalla Dario Catalano Dario Fiore Romain Gay Bogdan Ursu August 21, 2018 August 21, 2018 1 / 30

Motivation - Spam Server C Spam(M) Dec Encrypted sk Spam C email Server Spam(M)=True? Spam folder Functional Encryption Motivation August 21, 2018 2 / 30

Beyond Public Key Encryption Public key encryption [Diffie, Hellman 76] Functional encryption [Boneh, Sahai, Waters 11] Enc(pk , M ) Enc(mpk , M ) sk f sk Dec M Dec f ( M ) Functional Encryption Beyond Public Key Encryption August 21, 2018 3 / 30

Functional Encryption Setup: Generates mpk , msk Functional encryption [Boneh, Sahai, Waters 11] Enc(mpk , M ) mpk KeyGen(msk , · ) Master Authority sk f f sk f Dec f ( M ) C ( M ) f ( M ) sk f Alice Bob Functional Encryption Setting August 21, 2018 4 / 30

Multi-Input Functional Encryption Functional encryption Enc(mpk , M ) sk f f ( M ) Multi-input functional encryption Dec [Goldwasser, Gordon, Goyal, Jain, Katz, Liu, Sahai, Shi, Zhou 14] Enc(mpk , M 1 ) Enc(mpk , M n ) . . . n inputs sk f f ( M 1 . . . M n ) Dec Independent ciphertexts Multi-Input Multi-Input Setting August 21, 2018 5 / 30

Inner-Product Functional Encryption f y ( · ) = �· , y � f y 1 � ... � y n ( · , . . . , · ) = � x 1 � . . . � x n , y 1 � . . . � y n � Inner-Product Multi-input Inner-Product Functional encryption Enc(mpk , x 1 ) Enc(mpk , x n ) Enc(mpk , x ) . . . n inputs sk y 1 ... y n � x 1 � . . . � x n , y 1 � . . . � y n � Dec sk y � x , y � Dec Independent ciphertexts Multi-Input Multi-Input Setting August 21, 2018 6 / 30

Previous Work Multi-input scheme Classes of functions Assumptions [GGG + 14, BLR + 15, BGJS15] General functions IO, Multilinear maps, ... [AJ15, BKS16] FH [AGRW17] Inner products, poly inputs SXDH in Pairing Groups Inner products [DOT18] FH SXDH in Pairing Groups unbounded poly inputs FH - function hiding Multi-Input Previous work August 21, 2018 7 / 30

Previous Work + Our Contribution Multi-input scheme Classes of functions Assumptions [GGG + 14, BLR + 15, BGJS15] General functions IO, Multilinear maps, ... [AJ15, BKS16] FH [AGRW17] Inner products, poly inputs SXDH in Pairing Groups Inner products [DOT18] FH SXDH in Pairing Groups unbounded poly inputs This work Inner products, poly inputs DDH, DCR or LWE This work FH Inner products, poly inputs SXDH in Pairing Groups FH - function hiding Multi-Input Our contribution August 21, 2018 8 / 30

Previous Work + Our Contribution Multi-input scheme Classes of functions Assumptions [GGG + 14, BLR + 15, BGJS15] General functions IO, Multilinear maps, ... [AJ15, BKS16] FH [AGRW17] Inner products, poly inputs SXDH in Pairing Groups Inner products [DOT18] FH SXDH in Pairing Groups unbounded poly inputs This work Inner products, poly inputs DDH, DCR or LWE This work FH Inner products, poly inputs SXDH in Pairing Groups FH - function hiding Multi-Input Our contribution August 21, 2018 9 / 30

Security Goal Security goal Enc(mpk , x ) sk y Leaks only � x , y � , y , | x | Multi-Input Security August 21, 2018 10 / 30

Security of Multi-Input Functional Encryption Security goal Enc(mpk , x 1 ) . . . Enc(mpk , x n ) sk y 1 � ... � y n Leaks only � x 1 � . . . � x n , y 1 � . . . � y n � , y 1 � . . . � y n , {| x i |} Multi-Input Security Goal August 21, 2018 11 / 30

Security of Multi-Input Functional Encryption Security goal Enc(mpk , x 1 ) . . . Enc(mpk , x n ) sk y 1 � ... � y n Leaks only � x 1 � . . . � x n , y 1 � . . . � y n � , y 1 � . . . � y n , {| x i |} Leakage is more complex! Multi-Input Security Goal August 21, 2018 12 / 30

Multi-Input Inner-Product Encryption sk y 1 � ... � y n Can compute � x 1 � . . . � x n , y 1 � . . . � y n � Enc(msk , x 1 ) Enc(msk , x n ) Independent ciphertexts - fresh randomness . . . Multi-Input Model August 21, 2018 13 / 30

Multi-Input Inner-Product Encryption sk y 1 � ... � y n Can compute � x 1 � . . . � x n , y 1 � . . . � y n � Enc(msk , x 1 ) Enc(msk , x n ) But nothing more about � x i , y i � . . . Multi-Input Model August 21, 2018 14 / 30

Public Key - Symmetric Key sk y 1 � ... � y n Can compute � x 1 � . . . � x n , y 1 � . . . � y n � But nothing more about � x i , y i � Public key, encrypt 0 Enc(msk , x 1 ) Enc(msk , x n ) . . . � 0 . . . 0 � x i � 0 . . . 0 , y 1 � . . . � y n � = � x i , y i � Multi-Input Public Key Setting August 21, 2018 15 / 30

Mixing Ciphertexts Can compute: � x 1 � x 2 , y 1 � y 2 � sk y 1 � y 2 � x ′ 1 � x 2 , y 1 � y 2 � � x 1 � x ′ 2 , y 1 � y 2 � � x ′ 1 � x ′ 2 , y 1 � y 2 � Enc(msk , x 1 ) Enc(msk , x 2 ) Example for n = 2 Enc(msk , x ′ Enc(msk , x ′ 1 ) 2 ) Difficulty: Allow ciphertext mixing but not key mixing!!!. Multi-Input Mixing Ciphertexts August 21, 2018 16 / 30

Multi-Input Inner-Product - Security Adversary Challenger y 1 � . . . � y n KeyGen sk y 1 � ... � y n x i , i Enc Enc(msk , i , x i ) Adversary only learns � x 1 � . . . � x n , y 1 � . . . � y n � for all queried ( x i , i ) and all queried y 1 � . . . � y n . Multi-Input Security August 21, 2018 17 / 30

Construction without Pairings Roadmap 1 One ciphertext, one input 2 One ciphertext, many inputs 3 Many ciphertexts, one input 4 Many ciphertexts, many inputs Symmetric setting one ciphertext ✘✘ = ⇒ many ciphertexts ❳❳ ✘ ❳ Multi-Input Pairing-Free Construction August 21, 2018 18 / 30

1 One ciphertext, one input 1 One ciphertext, one input msk = u ∈ Z m q Enc 1 (msk , x ) = x + u ∈ Z m q KeyGen 1 (msk , y ) = � u , y � ∈ Z q , y Multi-Input Pairing-Free Construction August 21, 2018 19 / 30

1 One ciphertext, one input 1 One ciphertext, one input Decrypt with sk y : ✟ ✟ � x + u , y � − � u , y � = � x , y � + ✟✟ � u , y � − ✟✟ � u , y � msk = u ∈ Z m q Enc 1 (msk , x ) = x + u ∈ Z m q KeyGen 1 (msk , y ) = � u , y � ∈ Z q , y Multi-Input Pairing-Free Construction August 21, 2018 20 / 30

1 One ciphertext, one input 1 One ciphertext, one input Decrypt with sk y : ✟ ✟ � x + u , y � − � u , y � = � x , y � + ✟✟ � u , y � − ✟✟ � u , y � Security: msk = u ∈ Z m q ( x + u , � u , y � , y ) ≡ ( w , � w , y � − � x , y � , y ) Enc 1 (msk , x ) = x + u ∈ Z m q KeyGen 1 (msk , y ) = � u , y � ∈ Z q , y Goal: only leakage on x is � x , y � . � Multi-Input Pairing-Free Construction August 21, 2018 21 / 30

2 One ciphertext, many inputs 1 One ciphertext, one input 2 One ciphertext, many inputs msk = u 1 . . . u n ∈ Z n × m msk = u ∈ Z m q q Enc 1 (msk , x ) = x + u ∈ Z m Enc 2 (msk , i , x i ) = x i + u i ∈ Z m q q KeyGen 2 (msk , y 1 . . . y n ) = � n KeyGen 1 (msk , y ) = � u , y � ∈ Z q , y i =1 � u i , y i � ∈ Z q , y 1 . . . y n Multi-Input Pairing-Free Construction August 21, 2018 22 / 30

2 One ciphertext, many inputs 1 One ciphertext, one input 2 One ciphertext, many inputs msk = u ∈ Z m msk = u 1 . . . u n ∈ Z n × m q q Enc 1 (msk , x ) = x + u ∈ Z m Enc 2 (msk , i , x i ) = x i + u i ∈ Z m q q KeyGen 2 (msk , y 1 . . . y n ) = � n KeyGen 1 (msk , y ) = � u , y � ∈ Z q , y i =1 � u i , y i � ∈ Z q , y 1 . . . y n Dec: � n i =1 � x i + u i , y i � − � n i =1 � u i , y i � = � x 1 . . . x n , y 1 , . . . y n � Multi-Input Pairing-Free Construction August 21, 2018 23 / 30

3 Many ciphertexts, one input 1 One ciphertext, one input 3 Many ciphertexts, one input [ABDP15] msk = u ∈ Z m msk = v ∈ Z m q q Enc 3 (msk , x ) = g r , g x + r v ∈ G m +1 Enc 1 (msk , x ) = x + u ∈ Z m q KeyGen 1 (msk , y ) = � u , y � ∈ Z q , y KeyGen 3 (msk , y ) = � v , y � ∈ Z q , y G prime group of order q Using [ALS16], this step can also be based on LWE or DCR. Multi-Input Pairing-Free Construction August 21, 2018 24 / 30

Construction without Pairings 1 One ciphertext, one input msk = u Enc 1 (msk , x ) = x + u KeyGen 1 (msk , y ) = � u , y � , y 2 One ciphertext, many inputs 3 Many ciphertexts, one input msk = u 1 . . . u n msk = v Enc 2 (msk , i , x i ) = x i + u i Enc 3 (msk , x ) = g r , g x + r v ∈ G m +1 KeyGen 2 (msk , y 1 . . . y n ) = KeyGen 3 (msk , y ) = � v , y � , y � n i =1 � u i , y i � , y 1 . . . y n 4 Many ciphertexts, many inputs msk = u i , v i Enc 4 (msk , i , x ) = Enc 3 (Enc 2 (msk , i , x i )) KeyGen 4 (msk , y 1 . . . y n ) = � n i =1 � u i , y i � , KeyGen 3 ( y i ) Multi-Input Pairing-Free Construction August 21, 2018 25 / 30

Our Construction Without Pairings Pairing-free construction removed bilinear groups adaptive security support larger messages efficient schemes (linearly-sized ciphertexts and decryption keys) instantiations from DDH, LWE or DCR. polynomial number of slots Multi-Input Pairing-Free Construction August 21, 2018 26 / 30

Function-Hiding Scheme Security goal sk y Enc(mpk , x ) New multi-input function-hiding scheme for the inner product � Adaptively secure Leaks only poly-many inputs � x , y � , | x | , y Multi-Input Function-Hiding August 21, 2018 27 / 30