obfuscation from lwe proofs attacks candidates
play

Obfuscation from LWE? proofs, attacks, candidates Hoeteck Wee CNRS - PowerPoint PPT Presentation

Obfuscation from LWE? proofs, attacks, candidates Hoeteck Wee CNRS & ENS . . . . . . . . C x C x C x C C c obfuscation [ BGIRSVY01, H00, GR07, GGHRSW13 ] . . . . . . . . C x C x C x C C c obfuscation [


  1. Obfuscation from LWE? proofs, attacks, candidates Hoeteck Wee CNRS & ENS . . . . . . . .

  2. C x C x C x C C c obfuscation [ BGIRSVY01, H00, GR07, GGHRSW13 ] . . . . . . . .

  3. C x C x C x C C c obfuscation [ BGIRSVY01, H00, GR07, GGHRSW13 ] C . . . . . . . .

  4. C x C x C x C c obfuscation [ BGIRSVY01, H00, GR07, GGHRSW13 ] C O ( C ) . . . . . . . .

  5. C c obfuscation [ BGIRSVY01, H00, GR07, GGHRSW13 ] C ′ C ≡ ∀ x : C ( x ) = C ′ ( x ) O ( C ) . . . . . . . .

  6. obfuscation [ BGIRSVY01, H00, GR07, GGHRSW13 ] C ′ C ≡ ∀ x : C ( x ) = C ′ ( x ) ≈ c O ( C ′ ) O ( C ) . . . . . . . .

  7. obfuscation [ BGIRSVY01, H00, GR07, GGHRSW13 ] from LWE ? candidates, proofs, and attacks . . . . . . . .

  8. preliminaries . . . . . . . .

  9. LWE assumption [ Regev 05 ] ( A , sA + e ) ≈ c uniform s e A + . . . . . . . .

  10. LWE assumption [ Regev 05 ] ( A , SA + E ) ≈ c uniform S A E + . . . . . . . .

  11. LWE assumption [ Regev 05 ] ( A , ( I 2 ⊗ S ) A + E ) ≈ c uniform S 0 A E + 0 S . . . . . . . .

  12. LWE assumption [ Regev 05 ] ( A , ( I 2 ⊗ S ) A + E ) ≈ c uniform S 0 A E + 0 S A . . . . . . . .

  13. LWE assumption [ Regev 05 ] ( A , ( I 2 ⊗ S ) A + E ) ≈ c uniform SA E + SA . . . . . . . .

  14. LWE assumption [ Regev 05 ] ( A , ( M ⊗ S ) A + E ) ≈ c uniform ( M ⊗ S ) A + E for any permutation matrix M . . . . . . . .

  15. LWE assumption [ Regev 05 ] ( A , ( M ⊗ S ) A ✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) ≈ c uniform ( M ⊗ S ) A + E for any permutation matrix M . . . . . . . .

  16. evaluation. branching programs M 1 , 0 M 2 , 0 · · · M ℓ, 0 M 1 , 1 M 2 , 1 · · · M ℓ, 1 ∈ { 0 , 1 } poly × poly . . . . . . . .

  17. u u u branching programs M 1 , 0 M 2 , 0 M ℓ, 0 · · · M 1 , 1 M 2 , 1 M ℓ, 1 · · · ∏ M i , x i = 0 evaluation. accept iff M x = . . . . . . . .

  18. u u u – captures both logspace and NC branching programs M 1 , 0 M 2 , 0 M ℓ, 0 · · · M 1 , 1 M 2 , 1 M ℓ, 1 · · · ∏ M i , x i = 0 evaluation. accept iff M x = – read-many M x = ∏ M i , x i +1 mod n , | x | = n ≪ ℓ . . . . . . . .

  19. u u u branching programs M 1 , 0 M 2 , 0 M ℓ, 0 · · · M 1 , 1 M 2 , 1 M ℓ, 1 · · · ∏ M i , x i = 0 evaluation. accept iff M x = – read-many M x = ∏ M i , x i +1 mod n , | x | = n ≪ ℓ – captures both logspace and NC 1 . . . . . . . .

  20. branching programs u M 1 , 0 M 2 , 0 M ℓ, 0 · · · M 1 , 1 M 2 , 1 M ℓ, 1 · · · evaluation. accept iff uM x = u ∏ M i , x i = 0 – read-many M x = ∏ M i , x i +1 mod n , | x | = n ≪ ℓ – captures both logspace and NC 1 . . . . . . . .

  21. u u accept iff x a branching programs (1 − a 1 ) (1 − a 2 ) · · · (1 − a ℓ ) ( a 1 ) ( a 2 ) ( a ℓ ) · · · ∏ M i , x i = 0 evaluation. accept iff M x = example. ( 1 × 1 matrices) . . . . . . . .

  22. u u branching programs (1 − a 1 ) (1 − a 2 ) · · · (1 − a ℓ ) ( a 1 ) ( a 2 ) ( a ℓ ) · · · ∏ M i , x i = 0 evaluation. accept iff M x = example. accept iff x � = a ( 1 × 1 matrices) . . . . . . . .

  23. obfuscation FIRST principles . . . . . . . .

  24. A A A A A S A A S A S A A S S x obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] M 1 , 0 M 2 , 0 M 1 , 1 M 2 , 1 evaluation. M x . . . . . . . .

  25. A A A A A A A A A A S x obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] M 1 , 0 ⊗ S 1 , 0 M 2 , 0 ⊗ S 2 , 0 M 1 , 1 ⊗ S 1 , 1 M 2 , 1 ⊗ S 2 , 1 evaluation. M x . . . . . . . .

  26. A A A A A A A A A A obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] M 1 , 0 ⊗ S 1 , 0 M 2 , 0 ⊗ S 2 , 0 M 1 , 1 ⊗ S 1 , 1 M 2 , 1 ⊗ S 2 , 1 evaluation. M x ⊗ S x ( A ⊗ B )( C ⊗ D ) = AC ⊗ BD . . . . . . . .

  27. A A A A A A A obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 A − 1 0 ( M 1 , 0 ⊗ S 1 , 0 M 2 , 0 ⊗ S 2 , 0 ) A − 1 0 ( M 1 , 1 ⊗ S 1 , 1 M 2 , 1 ⊗ S 2 , 1 ) evaluation. M x ⊗ S x . . . . . . . .

  28. A A A A A A A obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 need a trapdoor to sample short pre-image of A 0 A − 1 0 ( M 1 , 0 ⊗ S 1 , 0 M 2 , 0 ⊗ S 2 , 0 ) A − 1 0 ( M 1 , 1 ⊗ S 1 , 1 M 2 , 1 ⊗ S 2 , 1 ) evaluation. M x ⊗ S x . . . . . . . .

  29. A A A obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 A − 1 A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 ) 1 (( M 2 , 0 ⊗ S 2 , 0 ) ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 ) A − 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) ) evaluation. M x ⊗ S x . . . . . . . .

  30. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 A − 1 A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 ) 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 ) A − 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ) evaluation. ( M x ⊗ S x ) A ℓ . . . . . . . .

  31. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) ( M x ⊗ S x ) A ℓ evaluation. ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ . . . . . . . .

  32. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) ( M x ⊗ S x ) A ℓ evaluation. M i , b , S i , b small [ ACPS09 ] ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ . . . . . . . .

  33. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) ( M x ⊗ S x ) A ℓ ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ≈ 0 evaluation. ⇒ M x = 0 ⇐ . . . . . . . .

  34. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] A 0 A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) ( M x ⊗ S x ) A ℓ ≈ 0 ⇒ accept evaluation. ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ . . . . . . . .

  35. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] ( u ⊗ I ) A 0 A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) ( uM x ⊗ S x ) A ℓ ≈ 0 ⇒ accept evaluation. ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ . . . . . . . .

  36. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] ( u ⊗ I ) A 0 A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) candidate obfuscation for NC 1 ! [ GGHRSW13, HHRS17, ... ] . . . . . . . .

  37. obfuscation via GGH15 [ Gentry Gorbunov Halevi 15, Canetti Chen 17, ... ] ( u ⊗ I ) A 0 A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 0 ⊗ S 1 , 0 ) A 1 1 (( M 2 , 0 ⊗ S 2 , 0 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) A − 1 0 (( M 1 , 1 ⊗ S 1 , 1 ) A 1 1 (( M 2 , 1 ⊗ S 2 , 1 ) A 2 ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ ) ? Q. O ( u , { M i , b } ) ≈ c O ( u ′ , { M ′ i , b } ) if ( u , { M i , b } ) ≡ ( u ′ , { M ′ i , b } ) . . . . . . . .

Recommend


More recommend