Practical Fully Secure Inner Product Functional Encryption modulo p - PowerPoint PPT Presentation

K surjection where Ker p of order p . Instantiation in class groups of an imaginary quadratic fjeld • 4 a Z b 2 N b represented by a b ; for a Z and 2 b a Z can be written as ideal of h K p p • Implies h C p C p • 13 • K = Q ( √ ∆ K ) , ∆ K < 0 and ∆ K ≡ 1 mod 4 • O ∆ K and O ∆ p s.t. ∆ K = − pq , ∆ p = − qp 3 with p , q primes

Instantiation in class groups of an imaginary quadratic fjeld b 4 a Z b 2 N b represented by a b ; for a Z and 2 a Z can be written as ideal of • 13 • K = Q ( √ ∆ K ) , ∆ K < 0 and ∆ K ≡ 1 mod 4 • O ∆ K and O ∆ p s.t. ∆ K = − pq , ∆ p = − qp 3 with p , q primes • φ p : C ( O ∆ p ) �→ C ( O ∆ K ) surjection where Ker ( φ p ) of order p . • Implies h ( O ∆ p ) = p × h ( O ∆ K )

2 Instantiation in class groups of an imaginary quadratic fjeld 13 • K = Q ( √ ∆ K ) , ∆ K < 0 and ∆ K ≡ 1 mod 4 • O ∆ K and O ∆ p s.t. ∆ K = − pq , ∆ p = − qp 3 with p , q primes • φ p : C ( O ∆ p ) �→ C ( O ∆ K ) surjection where Ker ( φ p ) of order p . • Implies h ( O ∆ p ) = p × h ( O ∆ K ) √ • a ideal of O ∆ can be written as a = ( a Z + − b + ∆ Z ) and represented by ( a , b ) ; for a ∈ N , b ∈ Z , b 2 ≡ ∆ mod 4 a

K . g p f and G p K 1 p s 1 • g p 1 g • p C p • Set g g of order ps p h Instantiation in class groups of an imaginary quadratic fjeld 14 • To build G p : 2 of order s h Z • g C K • t = ( p 2 , p ) ∈ O ∆ p , set f = [ t ] ⇒ f generates Ker ( φ p ) (subgroup of order p of C ( O ∆ p ) ), and � � � p 2 Z + − L ( m ) p + ∆ p f m = L ( m ) : odd integer in [ − p , p ] s.t. L ( m ) = 1 / m mod p F = < f > cyclic group of order p , and DL easy

g p f and G Instantiation in class groups of an imaginary quadratic fjeld Z of order ps g • Set g g • To build G p : 14 2 • t = ( p 2 , p ) ∈ O ∆ p , set f = [ t ] ⇒ f generates Ker ( φ p ) (subgroup of order p of C ( O ∆ p ) ), and � � � p 2 Z + − L ( m ) p + ∆ p f m = L ( m ) : odd integer in [ − p , p ] s.t. L ( m ) = 1 / m mod p F = < f > cyclic group of order p , and DL easy $ • ˆ ← − C ( O ∆ K ) of order s | h ( O ∆ K ) . • gcd( p , h ( O ∆ K )) = 1 ⇒ gcd( p , s ) = 1 g )) p ∈ C ( O ∆ p ) p (ˆ • g p = ( φ − 1

Instantiation in class groups of an imaginary quadratic fjeld 2 g • To build G p : Z 14 • t = ( p 2 , p ) ∈ O ∆ p , set f = [ t ] ⇒ f generates Ker ( φ p ) (subgroup of order p of C ( O ∆ p ) ), and � � � p 2 Z + − L ( m ) p + ∆ p f m = L ( m ) : odd integer in [ − p , p ] s.t. L ( m ) = 1 / m mod p F = < f > cyclic group of order p , and DL easy $ • ˆ ← − C ( O ∆ K ) of order s | h ( O ∆ K ) . • gcd( p , h ( O ∆ K )) = 1 ⇒ gcd( p , s ) = 1 g )) p ∈ C ( O ∆ p ) p (ˆ • g p = ( φ − 1 • Set g = g p · f and G = < g > of order ps

Security in class groups of an imaginary quadratic fjeld this work secret key 6144 2084 4096 1572 • Security from hardness of class number computation and DL DCR 15 DCR size • Best known algos use index calculus method • Shorter keys! this work problem in C ( O ∆ K ) . ⇒ L ( 1 / 2 ) complexity λ = 112 λ = 128 ( p , ˜ s ) ( 112 , 684 ) ( 1024 , 2046 ) ( 128 , 924 ) ( 1536 , 3070 ) el t of G 112 ( ℓ + 1 ) + 684 2048 ( ℓ + 2 ) 128 ( ℓ + 1 ) + 924 3072 ( ℓ + 2 )

p s.t. g x x p x p folded gaussian distributions with large G standard deviation. and • In practice: G p p and g x Sampling exponents Problem and • Use s to instantiate distributions upper bound s for s K • Bound on h Solution 16 s unknown , so orders of G p and G unknown ⇒ Cannot sample uniformly from G or G p !

Sampling exponents s for s standard deviation. Problem 16 Solution s unknown , so orders of G p and G unknown ⇒ Cannot sample uniformly from G or G p ! • Bound on h ( O ∆ K ) ⇒ upper bound ˜ • Use ˜ s to instantiate distributions D and D p s.t. { g x , x ← ֓ D} ≈ U ( G ) , and { g x p , x ← ֓ D p } ≈ U ( G p ) • In practice: D and D p folded gaussian distributions with large

Linearly Homomorphic Public Key Encryption mod p from HSM

p f m h r C 0 C 1 From C 0 C 1 and sk C 0 C t Homomorphic PKE scheme mod p from HSM p m DL 1 t : Dec g r Ciphertext: KeyGen p Sample randomness r Z p Z Plaintext: m Enc p 17 h = g t Sample t ← ֓ D p and compute sk = t and pk = h

From C 0 C 1 and sk C 0 C t Homomorphic PKE scheme mod p from HSM KeyGen p m DL 1 t : Dec Ciphertext: Enc p 17 h = g t Sample t ← ֓ D p and compute sk = t and pk = h Plaintext: m ∈ Z / p Z Sample randomness r ← ֓ D p p , f m · h r ) ( C 0 , C 1 ) = ( g r

Homomorphic PKE scheme mod p from HSM KeyGen DL 1 Dec Ciphertext: 17 Enc p h = g t Sample t ← ֓ D p and compute sk = t and pk = h Plaintext: m ∈ Z / p Z Sample randomness r ← ֓ D p p , f m · h r ) ( C 0 , C 1 ) = ( g r From ( C 0 , C 1 ) and sk = t : m mod p C 0 / C t

Security This scheme is semantically secure under the HSM assumption. 17

Game 0: the original security experiment p Game 0 is the original security experiment. b pk Adv 18 Challenger Setup sk = t ← ֓ D p pk = h = g t m 0 , m 1 $ b ∗ ← − { 0 , 1 } r ← ֓ D p ( C 0 , C 1 ) p , C 1 = f m b ∗ · h r ) ( C 0 , C 1 )= ( g r Output ( b = b ∗ )

19 p Challenger b pk Adv Game 1: sample t from D sk = t ← ֓ D pk = h = g t m 0 , m 1 $ b ∗ ← − { 0 , 1 } r ← ֓ D p ( C 0 , C 1 ) p , C 1 = f m b ∗ · h r ) ( C 0 , C 1 )= ( g r Output ( b = b ∗ ) From A ’s view, Games 0 and 1 are identical.

20 p Challenger b pk Adv Game 2: use sk to compute ( C 0 , C 1 ) sk = t ← ֓ D pk = h = g t m 0 , m 1 $ b ∗ ← − { 0 , 1 } r ← ֓ D p ( C 0 , C 1 ) p , f m b ∗ · C t ( C 0 , C 1 )= ( g r 0 ) Output ( b = b ∗ ) From A ’s view, Games 1 and 2 are identical.

p f u f m b u t h r C 0 C 1 21 reveals m b s and u p g r u t Adv s fjxes t p p pk b Challenger fjxes r Game 3: compute C 0 ∈ G \ G p sk = t ← ֓ D pk = h = g t m 0 , m 1 $ b ∗ ← − { 0 , 1 } r ← ֓ D p and u ← ֓ Z / p Z ( C 0 , C 1 ) p · f u , f m b ∗ · C t ( C 0 , C 1 ) = ( g r 0 ) Output ( b = b ∗ ) Games 2 and 3 are undistinguishable to A under the HSM assumption.

p f u f m b u t h r C 0 C 1 21 Adv b pk p u t reveals m b g r p s and u fjxes r p Challenger Game 3: compute C 0 ∈ G \ G p sk = t ← ֓ D pk = h = g t fjxes t mod s m 0 , m 1 $ b ∗ ← − { 0 , 1 } r ← ֓ D p and u ← ֓ Z / p Z ( C 0 , C 1 ) p · f u , f m b ∗ · C t ( C 0 , C 1 ) = ( g r 0 ) Output ( b = b ∗ ) Games 2 and 3 are undistinguishable to A under the HSM assumption.

p f u f m b u t h r C 0 C 1 21 Adv Challenger b pk p p u t reveals m b g r Game 3: compute C 0 ∈ G \ G p sk = t ← ֓ D pk = h = g t fjxes t mod s m 0 , m 1 $ b ∗ ← − { 0 , 1 } r ← ֓ D p and u ← ֓ Z / p Z fjxes r mod s and u mod p ( C 0 , C 1 ) p · f u , f m b ∗ · C t ( C 0 , C 1 ) = ( g r 0 ) Output ( b = b ∗ ) Games 2 and 3 are undistinguishable to A under the HSM assumption.

p f u f m b C 0 C 1 21 b pk 0 C t Adv g r p Challenger Game 3: compute C 0 ∈ G \ G p sk = t ← ֓ D pk = h = g t fjxes t mod s m 0 , m 1 $ b ∗ ← − { 0 , 1 } r ← ֓ D p and u ← ֓ Z / p Z fjxes r mod s and u mod p ( C 0 , C 1 ) p · f u , f m b ∗ + u · t · h r ) ( C 0 , C 1 )= ( g r reveals m b ∗ + u · t mod p Output ( b = b ∗ ) Games 2 and 3 are undistinguishable to A under the HSM assumption.

Inner Product Functional Encryption mod p from HSM

f y 1 f y p C 1 Dec From C x and sk x : KeyDer h r 1 C h r IPFE scheme mod p from HSM (simplifjed) Input: x x Z p Z Output key: sk x t x x y mod p x 1 g r Setup y 1 compute C 0 Plaintext: y Enc y Z p Z Sample randomness r Ciphertext: C 22 Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ )

Dec From C x and sk x : IPFE scheme mod p from HSM (simplifjed) Ciphertext: x y mod p t x Output key: sk x Z p Z x x 1 Input: x KeyDer Setup 22 Sample randomness r Enc compute Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ )

Dec From C x and sk x : IPFE scheme mod p from HSM (simplifjed) Enc x y mod p KeyDer Setup Ciphertext: Sample randomness r 22 compute Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk �

IPFE scheme mod p from HSM (simplifjed) Enc KeyDer Setup Ciphertext: Sample randomness r 22 compute Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk � Dec From � C ,� x and sk � x : � � x ,� y � mod p

IPFE scheme mod p from HSM (simplifjed) Enc i KeyDer Setup Ciphertext: Sample randomness r 22 compute Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk � Dec From � � ℓ C ,� x and sk � i = 1 C x i x : � � x ,� y � mod p

IPFE scheme mod p from HSM (simplifjed) Enc Setup Ciphertext: Sample randomness r KeyDer 22 compute Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk � Dec From � � ℓ i = � ( f y i · h r C ,� i ) x i x and sk � i = 1 C x i x : � � x ,� y � mod p

IPFE scheme mod p from HSM (simplifjed) Enc p Setup Ciphertext: Sample randomness r KeyDer 22 compute Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk � Dec From � � ℓ � y i x i · g r · � t i x i C ,� i = f x and sk � i = 1 C x i x : � � x ,� y � mod p

IPFE scheme mod p from HSM (simplifjed) Enc p Setup KeyDer Ciphertext: Sample randomness r 22 compute Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk � � Dec From � � ℓ x � · g r ·� t ,� x � C ,� i = f � � y ,� x and sk � i = 1 C x i x : � � x ,� y � mod p

IPFE scheme mod p from HSM (simplifjed) Sample randomness r p 0 x C sk and p Setup KeyDer Ciphertext: 22 compute Enc Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk � � � Dec From � � ℓ x � · g r ·� t ,� t ,� x � = g r ·� x � C ,� i = f � � y ,� � x and sk � i = 1 C x i x : � � x ,� y � mod p

IPFE scheme mod p from HSM (simplifjed) KeyDer DL 0 x Such that: p 0 x C sk and p Setup 22 Sample randomness r compute Ciphertext: Enc Sample � t = ( t 1 , . . . , t ℓ ) h i = g t i p for i = 1 , . . . , ℓ msk = � t and mpk = ( h 1 , . . . , h ℓ ) y = ( y 1 , . . . , y ℓ ) ∈ ( Z / p Z ) ℓ Plaintext: � � p , C 1 = f y 1 · h r 1 , . . . , C ℓ = f y ℓ · h r C = ( C 0 = g r ℓ ) Input: � x = ( x 1 , . . . , x ℓ ) ∈ ( Z / p Z ) ℓ x = � � t ,� x � Output key: sk � � � Dec From � � ℓ x � · g r ·� t ,� t ,� x � = g r ·� x � C ,� i = f � � y ,� � x and sk � i = 1 C x i x : � ℓ = f � � x ,� � � x ,� y � y � mod p i / C sk � i = 1 C x i

Security This scheme is secure under the HSM assumption. 22

p f u C 1 f y b f y b f y b f y b p C 1 • Game 1 use secret key to compute challenge ciphertext • Game 2 indistinguishable from Game 1 under the HSM ’s view b is statistically hidden , given • the challenge ciphertext 1 C t 1 0 C 0 C t • the public key • key derivation queries assumption. In Game 2, from Proof technique g r 23 C t 1 C C 0 g r C 0 1 0 C C t 0 C � p , C 1 = f y b ∗ , 1 · h r 1 , . . . , C ℓ = f y b ∗ ,ℓ · h r C = ( C 0 = g r ℓ ) • Game 0 original security game

p f u C 1 f y b f y b f y b f y b p C 1 • Game 2 indistinguishable from Game 1 under the HSM ’s view b is statistically hidden , given • the challenge ciphertext • the public key In Game 2, from assumption. • key derivation queries 0 C t C 0 C t 1 1 Proof technique g r C h r C 0 g r 1 h r 1 C 23 C 0 C � p , C 1 = f y b ∗ , 1 · C t 1 0 , . . . , C ℓ = f y b ∗ ,ℓ · C t ℓ C = ( C 0 = g r 0 ) • Game 0 original security game • Game 1 use secret key to compute challenge ciphertext

f y b f y b f y b f y b p C 1 p C 1 ’s view b is statistically hidden , given C C t 0 Proof technique assumption. C • the public key • the challenge ciphertext • key derivation queries In Game 2, from 0 C t 1 1 C 0 g r 1 h r 1 C 23 C h r C 0 g r � p f u , C 1 = f y b ∗ , 1 · C t 1 0 , . . . , C ℓ = f y b ∗ ,ℓ · C t ℓ C = ( C 0 = g r 0 ) • Game 0 original security game • Game 1 use secret key to compute challenge ciphertext • Game 2 indistinguishable from Game 1 under the HSM

f y b f y b f y b f y b p C 1 p C 1 Proof technique • key derivation queries • the challenge ciphertext • the public key assumption. 0 C t C C C t 1 0 1 g r C 0 g r 1 h r 23 C 1 h r C C 0 � p f u , C 1 = f y b ∗ , 1 · C t 1 0 , . . . , C ℓ = f y b ∗ ,ℓ · C t ℓ C = ( C 0 = g r 0 ) • Game 0 original security game • Game 1 use secret key to compute challenge ciphertext • Game 2 indistinguishable from Game 1 under the HSM In Game 2, from A ’s view b ∗ is statistically hidden , given

Effjciency comparison 40ms 964ms 193ms 301ms 110ms Dec time 85ms 78ms 27ms Enc time 36876 2340 24592 1920 [ALS16] this work [ALS16] this work 24 λ = 112 , ℓ = 10 λ = 128 , ℓ = 10 sk F bitsize Dependency in ℓ is linear.

Last slide! Conclusion • Most effjcient IPFE schemes to date • First IPFE mod a prime that recover the result whatever its size. • Interesting framework, can be applied to other primitives. Ongoing work • Chosen Ciphertext Attack Secure schemes • Threshold ECDSA using our underlying framework 25

Questions? 25

M. Abdalla, F. Bourse, A. D. Caro, and D. Pointcheval. CCA-secure inner-product functional encryption from projective April 2015. In CT-RSA 2015 , LNCS 9048, pages 487–505. Springer, Heidelberg, Linearly homomorphic encryption from DDH . G. Castagnos and F. Laguillaumie. 2011. In TCC 2011 , LNCS 6597, pages 253–273. Springer, Heidelberg, March Functional encryption: Defjnitions and challenges. D. Boneh, A. Sahai, and B. Waters. March 2017. In PKC 2017, Part II , LNCS 10175, pages 36–66. Springer, Heidelberg, hash functions. F. Benhamouda, F. Bourse, and H. Lipmaa. Better security for functional encryption for inner product Heidelberg, August 2016. In CRYPTO 2016, Part III , LNCS 9816, pages 333–362. Springer, standard assumptions. Fully secure functional encryption for inner products, from S. Agrawal, B. Libert, and D. Stehlé. March / April 2015. In PKC 2015 , LNCS 9020, pages 733–751. Springer, Heidelberg, Simple functional encryption schemes for inner products. M. Abdalla, F. Bourse, A. De Caro, and D. Pointcheval. http://eprint.iacr.org/2016/011 . Cryptology ePrint Archive, Report 2016/011, 2016. evaluations. 26

p with proba p p with proba p p with proba p (1) u , folded gaussian, (almost) uniform mod s p u t perfectly masks m b mod p 27 (1) u 0 1 p 1 (2) t sampled from and s , folded gaussian, (almost) uniform mod s p Distribution of t (almost) uniform mod p and mod s and t p independent of t s Where: Distribution of t (almost) uniform mod p and mod s p independent of t (1) u Where: 0 1 p 1 Where: 0 and t 1 p 1 and (2) t sampled from Information A gets on b ∗ in PKE m b ∗ + u · t mod p

p with proba p p with proba p , folded gaussian, (almost) uniform mod s p u t perfectly masks m b mod p and 0 1 p 1 27 Where: (2) t sampled from , folded gaussian, (almost) uniform mod s p Distribution of t (almost) uniform mod p and mod s and t p independent of t s (1) u p independent of t s 0 Where: p Where: (1) u 1 p 1 and (2) t sampled from Distribution of t (almost) uniform mod p and mod s and t Information A gets on b ∗ in PKE m b ∗ + u · t mod p (1) u � = 0 mod p with proba p − 1 ≈ 1

p with proba p p with proba p (1) u u t perfectly masks m b mod p 27 and 0 1 p 1 , folded gaussian, (almost) uniform mod s p (2) t sampled from Where: Distribution of t (almost) uniform mod p and mod s and t p independent of t s (1) u p independent of t s and t Distribution of t (almost) uniform mod p and mod s and p Where: 1 p 1 0 Where: Information A gets on b ∗ in PKE m b ∗ + u · t mod p (1) u � = 0 mod p with proba p − 1 ≈ 1 (2) t sampled from D , folded gaussian, (almost) uniform mod s · p

p with proba p p with proba p (1) u u t perfectly masks m b mod p 27 and t (2) t sampled from and 1 p 1 0 (1) u Where: and Distribution of t (almost) uniform mod p and mod s p independent of t Distribution of t (almost) uniform mod p and mod s s p Where: 1 p 1 0 Where: , folded gaussian, (almost) uniform mod s p Information A gets on b ∗ in PKE m b ∗ + u · t mod p (1) u � = 0 mod p with proba p − 1 ≈ 1 (2) t sampled from D , folded gaussian, (almost) uniform mod s · p and ( t mod p ) independent of ( t mod s )

p with proba p p with proba p (1) u , folded gaussian, (almost) uniform mod s p 27 (2) t sampled from Distribution of t (almost) uniform mod p and mod s and p Where: s p independent of t and t Distribution of t (almost) uniform mod p and mod s and 1 0 p 1 0 (1) u Where: 1 p Where: 1 Information A gets on b ∗ in PKE m b ∗ + u · t mod p (1) u � = 0 mod p with proba p − 1 ≈ 1 (2) t sampled from D , folded gaussian, (almost) uniform mod s · p and ( t mod p ) independent of ( t mod s ) u · t perfectly masks m b ∗ mod p

Game 0: the original security experiment KeyDer Game 0 is the original security experiment. b y 1 mpk 28 t Setup Oracle Adv Challenger msk = � � x 1 ,� x 2 . . . mpk = ( h 1 , . . . , h ℓ ) x 1 , sk � x 2 . . . sk � � y 0 ,� $ b ∗ ← − { 0 , 1 } r ← ֓ D p C ∗ = ( C 0 = g r � p , C 1 = f y 1 · h r 1 , � C ∗ � x i ,� x i + 1 . . . . . . , C ℓ = f y ℓ · h r ℓ ) x i , sk � x i + 1 . . . sk � Output ( b = b ∗ )

29 p KeyDer Oracle Adv Challenger b t y 1 mpk Game 1: use msk to compute � C ∗ msk = � � x 1 ,� x 2 . . . mpk = ( h 1 , . . . , h ℓ ) h i = g t i x 1 , sk � x 2 . . . sk � � y 0 ,� $ b ∗ ← − { 0 , 1 } r ← ֓ D p C ∗ = ( C 0 = g r � p , C 1 = f y 1 · C t 1 0 , � C ∗ � x i ,� x i + 1 . . . . . . , C ℓ = f y ℓ · C t ℓ 0 ) x i , sk � x i + 1 . . . sk � Output ( b = b ∗ ) From A ’s view, Games 0 and 1 are identical.

30 KeyDer Oracle Adv Challenger b t y 1 mpk p Game 2: compute C 0 ∈ G \ G p msk = � � x 1 ,� x 2 . . . mpk = ( h 1 , . . . , h ℓ ) h i = g t i x 1 , sk � x 2 . . . sk � � y 0 ,� $ b ∗ ← − { 0 , 1 } r ← ֓ D p and u ← ֓ Z / p Z C ∗ = ( C 0 = g r p · f u , C 1 = f y 1 · C t 1 � 0 , � C ∗ � x i ,� x i + 1 . . . . . . , C ℓ = f y ℓ · C t ℓ 0 ) x i , sk � x i + 1 . . . sk � Output ( b = b ∗ ) Games 1 and 2 are undistinguishable to A under the HSM assumption.

Leaked Information in Game 2 • the public key • the challenge ciphertext • key derivation queries 31 We consider the information leaked on b ∗ by:

Information fjxed by public key p Fixes t 1 t mod s t 1 t mod p is still uniformly distributed to . 32 mpk = { h i = g t i mod s } i ∈ [ ℓ ]

Information fjxed by public key p Fixes t 1 t mod p is still uniformly distributed to . 32 mpk = { h i = g t i mod s } i ∈ [ ℓ ] ( t 1 , . . . , t ℓ ) mod s

Information fjxed by public key p Fixes 32 mpk = { h i = g t i mod s } i ∈ [ ℓ ] ( t 1 , . . . , t ℓ ) mod s ( t 1 , . . . , t ℓ ) mod p is still uniformly distributed to A .

g r t i f y b u t i Information fjxed by challenge ciphertext ut mod p y b Fixes p i p s C i Reveals 33 C ∗ = ( C 0 = g r � p · f u , { C i = f y b ∗ , i · C 0 t i } i ∈ [ ℓ ] )

Information fjxed by challenge ciphertext Reveals p Fixes y b ut mod p 33 C ∗ = ( C 0 = g r � p · f u , { C i = f y b ∗ , i · C 0 t i } i ∈ [ ℓ ] ) C i = g r · t i mod s · f y b ∗ , i + u · t i mod p

Information fjxed by challenge ciphertext Reveals p Fixes 33 C ∗ = ( C 0 = g r � p · f u , { C i = f y b ∗ , i · C 0 t i } i ∈ [ ℓ ] ) C i = g r · t i mod s · f y b ∗ , i + u · t i mod p y b ∗ + u � � t mod p

Reveals all the information on t for directions Information fjxed by key derivation oracle y 1 Remaining entropy on t contained in t y 0 x i t y 0 y 1 y 1 . to y 0 34 For � x such that � � x ,� y 0 � = � � x ,� y 1 � mod p : x = � � t ,� x � mod p sk �

Information fjxed by key derivation oracle y 1 . y 1 Remaining entropy on t contained in t y 0 x i t y 0 34 For � x such that � � x ,� y 0 � = � � x ,� y 1 � mod p : x = � � t ,� x � mod p sk � Reveals all the information on � t for directions ⊥ to � y 0 − � � y 1 − � � �

Information fjxed by key derivation oracle y 1 . x i t y 0 34 For � x such that � � x ,� y 0 � = � � x ,� y 1 � mod p : x = � � t ,� x � mod p sk � Reveals all the information on � t for directions ⊥ to � y 0 − � � y 1 − � � � Remaining entropy on � t contained in � � t , � y 0 − � y 1 �

u t y 0 y 1 mod p 35 y 0 negl 1 2 cannot guess b with proba y 1 y b The information on b is contained in: ut mod p y b The ciphertext reveals: A ’s success probability From A ’s view, � � t ,� y 0 − � y 1 � follows a distribution ≈ U ( Z / p Z ) .

u t y 0 y 1 mod p 35 y b negl 1 2 cannot guess b with proba y 1 y 0 The information on b is contained in: The ciphertext reveals: A ’s success probability From A ’s view, � � t ,� y 0 − � y 1 � follows a distribution ≈ U ( Z / p Z ) . y b ∗ + u � � t mod p

35 The ciphertext reveals: negl 1 2 cannot guess b with proba A ’s success probability From A ’s view, � � t ,� y 0 − � y 1 � follows a distribution ≈ U ( Z / p Z ) . y b ∗ + u � � t mod p The information on b ∗ is contained in: y 1 � + u � � � � y b ∗ ,� y 0 − � t ,� y 0 − � y 1 � mod p