On Basing Private Information Retrieval on NP-Hardness Tianren Liu 1 Vinod Vaikuntanathan 1 1 MIT liutr@mit.edu , vinodv@csail.mit.edu Thirteenth IACR Theory of Cryptography Conference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 1 / 14
Assumptions and Primitives in Cryptography Add-Homomorphic Enc Trapdoor PIR Permutation Pub-key Enc CRHF OWP OWF Avg-NP ⊈ BPP NP ⊈ BPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 2 / 14
Assumptions and Primitives in Cryptography Add-Homomorphic Enc Trapdoor PIR Permutation Pub-key Enc CRHF OWP OWF Avg-NP ⊈ BPP NP ⊈ BPP Can we prove the security of a cryptographic primitive from the minimal assumption NP ⊈ BPP ? (Brassard 1979) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 2 / 14
(Black-box) Security Proofs To prove the security of X based on NP ⊈ BPP , find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X ”, R A solves SAT R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14
(Black-box) Security Proofs To prove the security of X based on NP ⊈ BPP , find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X ”, R A solves SAT A R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14
(Black-box) Security Proofs To prove the security of X based on NP ⊈ BPP , find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X ”, R A solves SAT A ) { accepts w.p. ≥ 2 / 3 , if x ∈ SAT ( x accepts w.p. ≤ 1 / 3 , if x / ∈ SAT R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14
(Black-box) Security Proofs To prove the security of X based on NP ⊈ BPP , find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X ”, R A solves SAT A ) { accepts w.p. ≥ 2 / 3 , if x ∈ SAT ( x accepts w.p. ≤ 1 / 3 , if x / ∈ SAT R Note: Black-box security proof but allow arbitrary construction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14
Impossibility Results Add-Homomorphic Enc No known cryptographic scheme based on NP ⊈ BPP . Trapdoor PIR Several negative results* (Brassard Permutation 1979, . . . ) Pub-key Enc CRHF OWP OWF Avg-NP ⊈ BPP NP ⊈ BPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14
Impossibility Results Add-Homomorphic Enc One-way Permutations (Brassard 1979) Trapdoor PIR Permutation Pub-key Enc CRHF OWP OWF Avg-NP ⊈ BPP NP ⊈ BPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14
Impossibility Results (restricting the primitives) Add-Homomorphic Enc Homomorphic Encryption ∗ (Bogdanov-Lee 2013) Trapdoor PIR One-way Functions ∗ Permutation (Akavia-Goldreich-Goldwasser- Pub-key Enc CRHF OWP Moshkovitz 2006, Bogdanov-Brzuska 2014) OWF Avg-NP ⊈ BPP NP ⊈ BPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14
Impossibility Results (restricting the reductions) Add-Homomorphic Enc Public-key Encryption Scheme, via “smart” reduction Trapdoor PIR (Goldreich-Goldwasser 1998) Permutation Collision-resistant Hash Functions, Pub-key Enc CRHF OWP via constant-adaptive reduction (Haitner-Mahmoody-Xiao 2009) OWF Average-case NP, via non-adaptive reduction Avg-NP ⊈ BPP (Bogdanov-Trevisan 2006) NP ⊈ BPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14
Our Result: Private Information Retrieval [CGKS95, KO97] Add-Homomorphic Enc Theorem (Informal) Trapdoor PIR Permutation Let Π be a single-server one-round PIR scheme. Pub-key Enc CRHF OWP Security of Π can not be based on NP-hardness unless OWF polynomial hierarchy collapses. Avg-NP ⊈ BPP NP ⊈ BPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 5 / 14
Our Result: Private Information Retrieval [CGKS95, KO97] Add-Homomorphic Enc Theorem (Informal) Trapdoor PIR Permutation Let Π be a single-server one-round PIR scheme. Pub-key Enc CRHF OWP Security of Π can not be based on NP-hardness unless OWF polynomial hierarchy collapses. Avg-NP ⊈ BPP Rule out approximately correct PIR. NP ⊈ BPP Rule out PIR with communication complexity n − o ( n ). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 5 / 14
Proof Overview Lemma 1 (Single-server one-round) PIR can be broken with an SZK oracle Lemma 2 Language L ∈ BPP SZK = ⇒ L ∈ AM ∩ coAM (Mahmoody & Xiao, 2010) Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM . Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses (Boppana, H˚ astad & Zachos, 1987) Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14
Proof Overview Lemma 1 (Single-server one-round) PIR can be broken with an SZK oracle Lemma 2 Language L ∈ BPP SZK = ⇒ L ∈ AM ∩ coAM (Mahmoody & Xiao, 2010) Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM . Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses (Boppana, H˚ astad & Zachos, 1987) Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14
Proof Overview Lemma 1 (Single-server one-round) PIR can be broken with an SZK oracle Lemma 2 Language L ∈ BPP SZK = ⇒ L ∈ AM ∩ coAM (Mahmoody & Xiao, 2010) Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM . Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses (Boppana, H˚ astad & Zachos, 1987) Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14
Proof Overview Lemma 1 (Single-server one-round) PIR can be broken with an SZK oracle Lemma 2 Language L ∈ BPP SZK = ⇒ L ∈ AM ∩ coAM (Mahmoody & Xiao, 2010) Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM . Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses (Boppana, H˚ astad & Zachos, 1987) Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14
Proof Overview Lemma 1 (Single-server one-round) PIR can be broken with an SZK oracle Lemma 2 Language L ∈ BPP SZK = ⇒ L ∈ AM ∩ coAM (Mahmoody & Xiao, 2010) Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM . Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses (Boppana, H˚ astad & Zachos, 1987) Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14
Recommend
More recommend
