DOCSLIB.ORG

Can Statistical Zero Knowledge Be Made Non-Interactive? Or on The

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Can Statistical Zero Knowledge Be Made Non-Interactive? Or on The Can Statistical Zero Knowledge b e made NonInteractive or On the Relationship of SZK and N ISZK y z x Oded Goldreich Amit Sahai Salil Vadhan May Abstract We extend the study of noninteractive statistical zeroknowledge pro ofs Our main fo cus is to compare the class NISZK of problems p ossessing such noninteractive pro ofs to the class SZK of problems p ossessing interactive statistical zeroknowledge pro ofs Along these lines we rst show that if statistical zero knowledge is nontrivial then so is noninteractive statistical zero knowledge where by nontrivial we mean that the class includes problems which are not solvable in probabilistic p olynomialtime The hypothesis holds under various assumptions such as the intractability of the Discrete Logarithm Problem Furthermore we show that if NISZK is closed under complement then in fact SZK NISZK ie all statistical zero knowledge pro ofs can b e made noninteractive The main to ols in our analysis are two promise problems that are natural restrictions of promise problems known to b e complete for SZK We show that these restricted problems are in fact complete for NISZK and use this relationship to derive our results comparing the two classes The two problems refer to the statistical dierence and dierence in entropy resp ectively of a given distribution from the uniform one We also consider a weak form of NISZK in which only requires that for every inverse p olynomial pn there exists a simulator which achieves simulator deviation pn and show that this weak form of NISZK actually equals NISZK Keywords Statistical ZeroKnowledge Pro ofs NonInteractive ZeroKnowledge Pro ofs An extended abstract of this work app ears in CRYPTO GSV y Department of Computer Science Weizmann Institute of Science Rehovot Israel Email odedwisdomweizmannacil Work done while visiting LCS MIT Supp orted by DARPA grant DABTC z Lab oratory for Computer Science Massachusetts Institute of Technology Cambridge MA Email amitstheorylcsmitedu Supp orted by DODNDSEG fellowship and DARPA grant DABTC x Lab oratory for Computer Science Massachusetts Institute of Technology Cambridge MA Email saliltheorylcsmitedu Supp orted by DODNDSEG fellowship and in part by DARPA grant DABT C Introduction ZeroKnowledge pro ofs introduced by Goldwasser Micali and Racko GMR are fascinating and extremely useful constructs Their fascinating nature is due to their seemingly contradictory nature they are b oth convincing and yet yield nothing b eyond the validity of the assertion b eing proven Their applicability in the domain of cryptography is vast they are typically used to force malicious parties to b ehave according to a predetermined proto col which requires parties to provide pro ofs of the correctness of their secretbased actions without revealing these secrets Zero knowledge pro ofs come in many avors and in this pap er we fo cus on two parameters The rst parameter is the underlying communication model and the second is the type of the zeroknowledge guarantee The communication mo del When Goldwasser Micali and Racko prop osed the denition of zeroknowledge pro ofs it seemed that interaction was crucial to achieving zero knowledge that the p ossibility of zero knowledge arose through the p ower of interaction Indeed it was not unexp ected when GO showed zero knowledge to b e trivial ie only exists for pro ofs of BPP statements in the most straightforward noninteractive mo dels Surprisingly however Blum Feldman and Micali BFM showed that by changing the mo del slightly it is p ossible to achieve zero knowledge in a noninteractive setting ie where only unidirectional communication can o ccur Sp ecically they assume that b oth Prover and Verier have access to a shared truly random string called the reference string Aside from this assumption all communication consists of one message the pro of which is generated by the Prover based on the assertion b eing proved and the reference string and sent from the Prover to the Verier Noninteractive zeroknowledge pro ofs on top of b eing more communicationecient by de nition have several applications not oered by ordinary interactive zeroknowledge pro ofs They have b een used among other things to build digital signature schemes secure against adaptive chosen message attack BG publickey cryptosystems secure against chosenciphertext attack NY DDN and nonmalleable cryptosystems DDN The zeroknowledge guarantee For ordinary interactive zeroknowledge pro ofs the zero knoweldege requirement is formulated by saying that the transcript of the Veriers interaction with the Prover can b e simulated by the Verier itself Similarly for the noninteractive setting describ ed ab ove the zeroknowledge condition is formulated by requiring that one can pro duce knowing only the statement of the assertion a random reference string along with a pro of that works for the reference string More precisely we require that there exists an ecient pro cedure that on input a valid assertion pro duces a distribution which is similar to the joint distribu tion of random reference strings and pro ofs generated by the Prover The key parameter is the interpretation of similarity Two notions have b een commonly considered in the literature cf GMR GMW For BDMP BR Statistical zero know ledge requires that these distribu tions b e statistically close ie the statistical dierence b etween them is negligible Computational zero know ledge instead requires that these distributions are computationally indistinguishable cf GM Yao In this work we fo cus on the stronger security requirement of statistical zero knowledge Since its introduction in BFM most work on noninteractive zero knowledge has fo cused on the computational type cf BFM DMP DMP BDMP FLS KP With non interactive statistical zero knowledge the main ob jects of investigation have b een the sp ecic pro of system for Quadratic Nonresiduosity and variants BDMP DDP DDP Recently De Santis et al DDPY op ened the do or to a general study of noninteractive statistical zero knowledge by showing that it contains a complete promise problem Notation Throughout the pap er SZK denotes the class of promise problems having statistical zeroknowledge interactive pro of systems dened in App endix A and NISZK denotes the class of promise problems having noninteractive statistical zeroknowledge pro of systems dened in Section Our Contribution In this work we seek to understand what if any additional p ower interaction gives in the con text of statistical zero knowledge Thus we continue the investigation of NISZK fo cusing on its relationship with SZK Our rst result is that the nontriviality of SZK implies nontriviality of NISZK where by nontrivial we mean that a class includes problems which are not solv able in probabilistic p olynomialtime The hypothesis holds under various assumptions such as the intractability of Discrete Logarithm Problem GK or Quadratic Residuosity GMR or Graph Isomorphism GMW but variants of these last two problems are already known to b e in NISZK BDMP BR Furthermore we show that if NISZK is closed under complement then in fact SZK NISZK ie all statistical zeroknowledge pro ofs can b e made noninteractive We note that DDPY have claimed that NISZK is closed under complement and OR but these claims have b een retracted DDPY We also show the equivalence of NISZK with a variant in which the statistical zero knowledge requirement is weakened somewhat Complete Problems Central to our metho dology is the use of simple and natural complete problems to understand classes such as SZK and NISZK whose denitions are rather compli cated In particular we exhibit two natural promise problems and prove that they are complete for NISZK The two problems refer to the distance in two dierent senses of a given distribution from the uniform one These two problems are natural restrictions of two promise problems shown complete for SZK in SV and GV resp ectively Indeed our results ab out the relationship b etween SZK and NISZK come from relating the corresp onding complete problems This general theme of using completeness to simplify the study of a class rather than as evidence for computa tional intractability as is the traditional use of NP completeness has b een evidenced in a number of recent works cf GMW LFKN Sha ALM AS and has b een particularly useful in understanding statistical zero knowledge cf SV SV DDPY GV The noninteractive mo del Let us recall the denition of a noninteractive statistical zeroknowledge pro of system from BDMP We will adapt the denition to promise problems Note that our denition will capture what 1 The only exception is an unpublished manuscript of Bellare and Rogaway BR who proved some basic results ab out noninteractive p erfect zeroknowledge and showed a noninteractive p erfect zeroknowledge pro of for the language of graphs with trivial automorphism group 2 A promise problem is a pair of disjoint sets of strings corresp onding to yes and no instances yes no of a decision problem 3 Actually only noninteractive perfect and computational zeroknowledge pro ofs were dened in BDMP The denition we are using previously given in BR DDPY is the natural noninteractive analogue of interactive BDMP call a bounded proof system in that each shared reference string can only b e used once In contrast to noninteractive computational zero knowledge cf BDMP FLS it is unknown whether every problem that has such a b ounded noninteractive statistical zeroknowledge pro of system also has one in which the shared
Load more

Recommended publications
  • Succinct Garbled RAM from Indistinguishablity Obfuscation
    Succinct Garbled RAM from Indistinguishablity Obfuscation by Justin Lee Holmgren S.B., Massachusetts Institute of Technology (2013) Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree of Master of Engineering in Electrical Engineering and Computer Science at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY February 2015 ○c Massachusetts Institute of Technology 2015. All rights reserved. Author................................................................ Department of Electrical Engineering and Computer Science February 1, 2015 Certified by. Shafi Goldwasser RSA Professor of Electrical Engineering and Computer Science Thesis Supervisor Accepted by . Professor Albert R. Meyer Chairman, Masters of Engineering Thesis Committee 2 Succinct Garbled RAM from Indistinguishablity Obfuscation by Justin Lee Holmgren Submitted to the Department of Electrical Engineering and Computer Science on February 1, 2015, in partial fulfillment of the requirements for the degree of Master of Engineering in Electrical Engineering and Computer Science Abstract In this thesis, I give the first construction of a succinct garbling scheme forRAM programs. For a program requiring space S and time T to compute, the size of its garbling is O~(S) instead of poly(T ). This construction relies on the existence of indistinguishability obfuscation, as well as the existence of injective one-way functions. As a building block, I introduce and construct a primitive called asymmetrically constrained encryption (ACE). This primitive is an encryption system for which keys can be punctured on succinctly described sets of plaintexts. For programs acting on ACE-encrypted values, I give a natural and general condition for their obfuscations to be indistinguishable, using the fact that the encryption and decryption keys can be separately punctured.
    [Show full text]
  • Curriculum Vitae
    Curriculum Vitae Jens Groth July 11, 2021 1 Contact Information Jens Groth E-mail: [email protected] Homepage: www.cs.ucl.ac.uk/staff/J.Groth 2 Research Interests I am interested in the theory of cryptography and in the practical application of cryptographic techniques. 3 Appointments DFINITY London, UK July 2021 { present. Director of Research Febuary 2021 { June 2021 Team Lead, Research January 2019 { January 2021 Principal Researcher University College London London, UK July 2020 { present. Honorary Professor in the Department of Computer Science. October 2015 { June 2020. Professor of Cryptology in the Department of Computer Science. October 2012 { September 2015. Reader in Cryptology in the Department of Computer Science. October 2010 { September 2012. Senior Lecturer in the Department of Computer Science. September 2007 { September 2010. Lecturer in the Department of Computer Science. University of California, Los Angeles Los Angeles, US February 2005 { August 2007. Postdoctoral Employee at the Computer Science Department. Cryptomathic Arhus,˚ Denmark August 2001 { July 2004. Industrial PhD Student. 1 4 Education Aarhus University Aarhus, Denmark • PhD in Computer Science, December 2004. • Advisor: Professor Ivan Damg˚ard. • Thesis title: Honest Verifier Zero-Knowledge Proofs Applied. Danish Academy of Technical Sciences Aarhus, Denmark • Industrial Research Fellow, October 2004. • Advisor: Senior Systems Engineer, PhD Gorm Salomonsen. Aarhus University Aarhus, Denmark • MSc in Mathematics, April 2001. • Advisor: Professor Ivan Damg˚ard. • Thesis title: Non-malleable Public-Key Encryption Secure against Chosen Ciphertext At- tack based on Trapdoor Permutations. Aarhus University Aarhus, Denmark • Supplement in Philosophy, April 2001. 5 Awards and Distinctions • IACR Test-of-Time Award 2021 for Simulation-sound NIZK proofs for a practical language and constant size group signatures published at ASIACRYPT 2006.
    [Show full text]
  • Efficient Non-Interactive Secure Computation
    Efficient Non-Interactive Secure Computation Yuval Ishai1?, Eyal Kushilevitz1??, Rafail Ostrovsky2???, Manoj Prabhakaran3y, and Amit Sahai2z 1 Dept. of Computer Science, Technion, Haifa, Israel. 2 University of California, Los Angeles. 3 University of Illinois, Urbana-Champaign. Abstract. Suppose that a receiver R wishes to publish an encryption of her se- cret input x so that every sender S, holding an input y, can reveal f(x; y) to R by sending her a single message. This should be done while simultaneously pro- tecting the secrecy of y against a corrupted R and preventing a corrupted S from having an unfair influence on the output of R beyond what is allowed by f. When the parties are semi-honest, practical solutions can be based on Yao’s garbled circuit technique. However, for the general problem when the parties, or even S alone, may be malicious, all known polynomial-time solutions are highly inefficient. This is due in part to the fact that known solutions make a non-black-box use of cryptographic primitives, e.g., for providing non-interactive zero-knowledge proofs of statements involving cryptographic computations on secrets. Motivated by the above question, we consider the problem of secure two-party computation in a model that allows only parallel calls to an ideal oblivious trans- fer (OT) oracle with no additional interaction. We obtain the following results. – Feasibility. We present the first general protocols in this model which only make a black-box use of a pseudorandom generator (PRG). All previous OT- based protocols either make a non-black-box use of cryptographic primitives or require multiple rounds of interaction.
    [Show full text]
  • Indistinguishability Obfuscation from Well-Founded Assumptions
    Indistinguishability Obfuscation from Well-Founded Assumptions Aayush Jain* Huijia Lin† Amit Sahai‡ August 18, 2020 Abstract In this work, we show how to construct indistinguishability obfuscation from subexponential hardness of four well-founded assumptions. We prove: Theorem (Informal). Let τ (0, ), δ (0, 1),ǫ (0, 1) be arbitrary constants. As- ∈ ∞ ∈ ∈ sume sub-exponential security of the following assumptions, where λ is a security parameter, and the parameters ℓ,k,n below are large enough polynomials in λ: • the SXDH assumption on asymmetric bilinear groups of a prime order p = O(2λ), kǫ • the LWE assumption over Zp with subexponential modulus-to-noise ratio 2 , where k is the dimension of the LWE secret, • the LPN assumption over Zp with polynomially many LPN samples and error rate 1/ℓδ, where ℓ is the dimension of the LPN secret, • the existence of a Boolean PRG in NC0 with stretch n1+τ , Then, (subexponentially secure) indistinguishability obfuscation for all polynomial- size circuits exists. arXiv:2008.09317v1 [cs.CR] 21 Aug 2020 Further, assuming only polynomial security of the aforementioned assumptions, there exists collusion resistant public-key functional encryption for all polynomial- size circuits. *UCLA, Center for Encrypted Functionalities, and NTT Research. Email: [email protected]. †UW. Email: [email protected]. ‡UCLA, Center for Encrypted Functionalities. Email: [email protected]. Contents 1 Introduction 1 1.1 AssumptionsinMoreDetail. ... 2 1.2 OurIdeasinaNutshell............................. .. 3 2 Preliminaries 4 3 Definition of Structured-Seed PRG 7 4 Construction of Structured Seed PRG 8 5 Bootstrapping to Indistinguishability Obfuscation 20 5.1 PerturbationResilientGenerators . ........ 23 6 Acknowledgements 26 7 References 27 A Partially Hiding Functional Encryption 36 B Recap of constant-depth functional encryption 37 1 Introduction In this work, we study the notion of indistinguishability obfuscation (i ) for general O polynomial-size circuits [BGI+01a, GKR08, GGH+13b].
    [Show full text]
  • Homomorphic Encryption for Machine Learning in Medicine and Bioinformatics
    This is a repository copy of Homomorphic Encryption for Machine Learning in Medicine and Bioinformatics. White Rose Research Online URL for this paper: https://eprints.whiterose.ac.uk/151333/ Version: Accepted Version Article: Kahrobaei, Delaram orcid.org/0000-0001-5467-7832, Wood, Alexander and Najarian, Kayvan (2020) Homomorphic Encryption for Machine Learning in Medicine and Bioinformatics. ACM Comput. Surv.. ISSN 0360-0300 Reuse Items deposited in White Rose Research Online are protected by copyright, with all rights reserved unless indicated otherwise. They may be downloaded and/or printed for private study, or other acts as permitted by national copyright laws. The publisher or other rights holders may allow further reproduction and re-use of the full text version. This is indicated by the licence information on the White Rose Research Online record for the item. Takedown If you consider content in White Rose Research Online to be in breach of UK law, please notify us by emailing [email protected] including the URL of the record and the reason for the withdrawal request. [email protected] https://eprints.whiterose.ac.uk/ Homomorphic Encryption for Machine Learning in Medicine and Bioinformatics ALEXANDER WOOD∗, University of Michigan, United States KAYVAN NAJARIAN, University of Michigan, United States DELARAM KAHROBAEI, University of York, United Kingdom Machine learning and statistical techniques are powerful tools for analyzing large amounts of medical and genomic data. On the other hand, ethical concerns and privacy regulations prevent free sharing of this data. Encryption techniques such as fully homomorphic encryption (FHE) enable evaluation over encrypted data. Using FHE, machine learning models such as deep learning, decision trees, and naive Bayes have been implemented for privacy-preserving applications using medical data.
    [Show full text]
  • Using Fully Homomorphic Hybrid Encryption to Minimize Non-Interative Zero-Knowledge Proofs
    Using Fully Homomorphic Hybrid Encryption to Minimize Non-interative Zero-Knowledge Proofs Craig Gentry Jens Groth IBM T.J. Watson Research Center, U.S. University College London, U.K. [email protected] [email protected] Yuval Ishai Chris Peikert Technion, Israel Georgia Institute of Technology, U.S. [email protected] [email protected] Amit Sahai Adam Smith University of California Los Angeles, U.S. Pennsylvania State University, U.S. [email protected] [email protected] Abstract A non-interactive zero-knowledge (NIZK) proof can be used to demonstrate the truth of a statement without revealing anything else. It has been shown under standard cryptographic assumptions that NIZK proofs of membership exist for all languages in NP. While there is evidence that such proofs cannot be much shorter than the corresponding membership witnesses, all known NIZK proofs for NP languages are considerably longer than the witnesses. Soon after Gentry's construction of fully homomorphic encryption, several groups indepen- dently contemplated the use of hybrid encryption to optimize the size of NIZK proofs and dis- cussed this idea within the cryptographic community. This article formally explores this idea of using fully homomorphic hybrid encryption to optimize NIZK proofs and other related crypto- graphic primitives. We investigate the question of minimizing the communication overhead of NIZK proofs for NP and show that if fully homomorphic encryption exists then it is possible to get proofs that are roughly of the same size as the witnesses. Our technique consists in constructing a fully homomorphic hybrid encryption scheme with ciphertext size jmj+poly(k), where m is the plaintext and k is the security parameter.
    [Show full text]
  • Practical Private Information Retrieval
    Practical Private Information Retrieval by Femi George Olumofin A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Doctor of Philosophy in Computer Science Waterloo, Ontario, Canada, 2011 c Femi George Olumofin 2011 I hereby declare that I am the sole author of this thesis. This is a true copy of the thesis, including any required final revisions, as accepted by my examiners. I understand that my thesis may be made electronically available to the public. ii Abstract In recent years, the subject of online privacy has been attracting much interest, espe- cially as more Internet users than ever are beginning to care about the privacy of their online activities. Privacy concerns are even prompting legislators in some countries to de- mand from service providers a more privacy-friendly Internet experience for their citizens. These are welcomed developments and in stark contrast to the practice of Internet censor- ship and surveillance that legislators in some nations have been known to promote. The development of Internet systems that are able to protect user privacy requires private in- formation retrieval (PIR) schemes that are practical, because no other efficient techniques exist for preserving the confidentiality of the retrieval requests and responses of a user from an Internet system holding unencrypted data. This thesis studies how PIR schemes can be made more relevant and practical for the development of systems that are protective of users' privacy. Private information retrieval schemes are cryptographic constructions for retrieving data from a database, without the database (or database administrator) being able to learn any information about the content of the query.
    [Show full text]
  • Founding Cryptography on OT
    Founding Cryptography on Oblivious Transfer – Efficiently Yuval Ishai∗ Technion, Israel and University of California, Los Angeles [email protected] Manoj Prabhakaran† Amit Sahai‡ University of Illinois, Urbana-Champaign University of California, Los Angeles [email protected] [email protected] October 5, 2010 Abstract We present a simple and efficient compiler for transforming secure multi-party computation (MPC) protocols that enjoy security only with an honest majority into MPC protocols that guarantee security with no honest majority, in the oblivious-transfer (OT) hybrid model. Our technique works by combining a secure protocol in the honest majority setting with a protocol achieving only security against semi-honest parties in the setting of no honest majority. Applying our compiler to variants of protocols from the literature, we get several applications for secure two-party computation and for MPC with no honest majority. These include: • Constant-rate two-party computation in the OT-hybrid model. We obtain a statistically UC-secure two-party protocol in the OT-hybrid model that can evaluate a general circuit C of size s and depth d with a total communication complexity of O(s) + poly(k, d, log s) and O(d) rounds. The above result generalizes to a constant number of parties. • Extending OTs in the malicious model. We obtain a computationally efficient pro- tocol for generating many string OTs from few string OTs with only a constant amortized communication overhead compared to the total length of the string OTs. • Black-box constructions for constant-round MPC with no honest majority. We obtain general computationally UC-secure MPC protocols in the OT-hybrid model that use only a constant number of rounds, and only make a black-box access to a pseudorandom generator.
    [Show full text]
  • Computer Science Department
    Henry Samueli School of Engineering & Applied Science Learning the style of recorded motions (MAGIX Lab research program) COMPUTER SCIENCE DEPARTMENT University of California, Los Angeles Fall 2005 Henry Samueli School of Engineering and Applied Science Computer Science Department 4732 Boelter Hall University of California, Los Angeles Los Angeles, CA 90095-1596 Telephone: +1.310.825.3886 Fax: +1.310.825.2273 Email: [email protected] URL: www.cs.ucla.edu Computer Science Department Statistics • Faculty (40) • Graduate Enrollment (280) • M.S. Degrees Awarded (105) • Engineering Degree Awarded (1) • Ph.D. Degrees Awarded (28) • Undergraduate Enrollment (539) • Undergraduate Degrees Awarded (164) The Computer Science Department was formally established during UCLA’s 1968-69 academic year—more than 36 years ago. UCLA is one of the nation's largest and most prestigious graduate education centers in computer and information technology. The dedicated efforts of our prominent faculty and exceptional students have coalesced to rank us among the top computer science departments in the world. The UCLA Computer Science Department is well known for its research in the design and analysis of complex computer systems and networks, and for its key role in the creation of the ARPANET—the precursor to today’s Internet. Internationally recognized research has been carried out in such diverse computer science areas as embedded systems, artificial intelligence, mobile computing, architecture, simulation, graphics, data mining, CAD and reconfigurable systems, biomedical systems, programming languages and compilers. 2 The Computer Science Department has continued to excel in both research and education during the 2003 to 2005 academic years (the period covered in this report).
    [Show full text]
  • Copyright by Richard Fontaine Mcpherson III 2016
    Copyright by Richard Fontaine McPherson III 2016 The Dissertation Committee for Richard Fontaine McPherson III certifies that this is the approved version of the following dissertation: Exploiting Leakage in Privacy-Protecting Systems Committee: Mohamed G. Gouda, Supervisor Vitaly Shmatikov, Co-Supervisor Lorenzo Alvisi Emmett Witchel Exploiting Leakage in Privacy-Protecting Systems by Richard Fontaine McPherson III, B.A., M.S.Comp.Sci. DISSERTATION Presented to the Faculty of the Graduate School of The University of Texas at Austin in Partial Fulfillment of the Requirements for the Degree of DOCTOR OF PHILOSOPHY THE UNIVERSITY OF TEXAS AT AUSTIN December 2016 This thesis is dedicated to my grandfather Bud Flanders for his support and inspiration. Acknowledgments I'd like to thank my family for their constant love and support. My parents, Dana and Taine, gave me the resources and opportunity to reach this point in my life. My sister, Charlotte, has been a life-long friend. My stepparents, Liz and Ted, have always encouraged me in my studies. Finally, my grandfather Bud gave me the advice that kept me in graduate school when it got rough and is a constant inspiration that there are always new things to learn. I could not have done all that I have without the help of my co-authors. Special thanks to Paul Grubbs, Mohammed Naveed, Tom Ristenpart, Vitaly Shmatikov, and Reza Shokri for all their help with the research presented in this dissertation. I am indebted to them as well as to many others. I am extremely grateful for all of the advice and help I received from my many advisers and committee members throughout my academic career.
    [Show full text]
  • Private Search in the Real World
    Private Search in the Real World Vasilis Pappas, Mariana Raykova, Binh Vo, Steven M. Bellovin, Tal Malkin Department of Computer Science Columbia University, New York, NY, USA {vpappas, mariana, binh, smb, tal}@cs.columbia.edu ABSTRACT fiers, related content, etc.) or may differ in number of participants, Encrypted search — performing queries on protected data — has trust assumptions, anonymity requirements, revocation of search been explored in the past; however, its inherent inefficiency has capability and other areas. All of these factors affect performance. raised questions of practicality. Here, we focus on improving Choosing a different definition of “sufficient” privacy can greatly the performance and extending its functionality enough to make affect inherent cost. Making the right choice, in accordance with it practical. We do this by optimizing the system, and by stepping the actual, rather than theoretical, threat model can lead to a very back from the goal of achieving maximal privacy guarantees in an functional system, rather than one that is theoretically perfect but encrypted search scenario and consider efficiency and functionality unusably costly in practice. as priorities. In this paper we step back from absolute privacy guarantees in fa- We design and analyze the privacy implications of two prac- vor of efficiency and real-world requirements. These requirements tical extensions applicable to any keyword-based private search include not just what may leak, but to whom; depending on the system. We evaluate their efficiency by building them on top particular practical setting there may be parties who are at least of a private search system, called SADS. Additionally, we im- partially trusted.
    [Show full text]
  • Indistinguishability Obfuscation from Well-Founded Assumptions
    Indistinguishability Obfuscation from Well-Founded Assumptions Aayush Jain* Huijia Lin† Amit Sahai‡ November 12, 2020 Abstract Indistinguishability obfuscation, introduced by [Barak et. al. Crypto’2001], aims to compile programs into unintelligible ones while preserving functionality. It is a fascinating and powerful object that has been shown to enable a host of new cryp- tographic goals and beyond. However, constructions of indistinguishability obfusca- tion have remained elusive, with all other proposals relying on heuristics or newly conjectured hardness assumptions. In this work, we show how to construct indistinguishability obfuscation from subexponential hardness of four well-founded assumptions. We prove: Theorem (Informal). Let τ 2 (0; 1); δ 2 (0; 1); 2 (0; 1) be arbitrary constants. As- sume sub-exponential security of the following assumptions, where λ is a security parameter, p is a λ-bit prime, and the parameters `; k; n are large enough polynomials in λ: • the Learning With Errors (LWE) assumption over Zp with subexponential modulus- to-noise ratio 2k , where k is the dimension of the LWE secret, • the Learning Parity with Noise (LPN) assumption over Zp with polynomially many LPN samples and error rate 1=`δ, where ` is the dimension of the LPN secret, • the existence of a Boolean Pseudo-Random Generator (PRG) in NC0 with stretch n1+τ , where n is the length of the PRG seed, • the Symmetric eXternal Diffie-Hellman (SXDH) assumption on asymmetric bi- linear groups of order p. Then, (subexponentially secure) indistinguishability obfuscation for all polynomial- size circuits exists. Further, assuming only polynomial security of the aforementioned assumptions, there exists collusion resistant public-key functional encryption for all polynomial- size circuits.
    [Show full text]