3 views

Uploaded by abdel_lak

test

- III Sem- Design Analysis Algorithm(1)
- Image Encryption Based On Diffusion And Multiple Chaotic Maps
- Combined Schemes for Signature and Encryption The public-keu and the identity-based setting.pdf
- Cam
- Cryptolab.tex
- IJCTT-V1I3P107
- Protegrity HSM Connectivity and Functionality
- Introduction to Moderen Crypto
- ID376_UBICC_376
- 3 - 4 - Order-Of-Growth Classifications (1439)
- Index-Based Symmetric DNA Encryption Algorithm
- IRJET-Secure Data Sharing using Visual Cryptography and Watermarking Method in Fog Computing
- Algorithms
- E Commerce IT FInal PPT
- Assignment 2
- 4-Zeng-286-295
- Public Key Cryptology – An Art of Keeping Secrecy and Authenticity
- DNA Sequencing
- Crypto
- Siti Rozani 23516039 Riset Dan Teknologi TI

You are on page 1of 15

January 4, 2016

Abstract

It is well known that inefficient indistinguishability obfuscators (iO) with running time

poly(|C|, ) 2n , where C is the circuit to be obfuscated, is the security parameter, and n is

the input length of C, exists unconditionally: simply output the function table of C (i.e., the

output of C on all possible inputs). Such inefficient obfuscators, however, are not useful for

applications.

We here consider iO with a slightly non-trivial notion of efficiency: the running-time

of the obfuscator may still be trivial (namely, poly(|C|, ) 2n ), but we now require that

the obfuscated code is just slightly smaller than the truth table of C (namely poly(|C|, )

2n(1) , where > 0); we refer to this notion as iO with exponential efficiency, or simply

exponentially-efficient iO (XiO). We show that, perhaps surprisingly, under the subexponential

LWE assumption, subexponentially-secure XiO for polynomial-size circuits implies (polynomial-

time computable) iO for all polynomial-size circuits.

This paper appears in PKC 2016.

University of California at Santa Barbara, Email: rachel.lin@cs.ucsb.edu. Work supported in part by NSF

grants CNS-1528178 and CNS-1514526.

Cornell University, rafael@cs.cornell.edu. Work supported in part by a Microsoft Faculty Fellowship, Google

Faculty Award, NSF Award CNS-1217821, NSF Award CCF-1214844, AFOSR Award FA9550-15-1-0262 and DARPA

and AFRL under contract FA8750-11-2-0211. The views and conclusions contained in this document are those of the

authors and should not be interpreted as representing the official policies, either expressed or implied, of the Defense

Advanced Research Projects Agency or the US Government.

Cornell University, Email: karn@cs.cornell.edu.

Cornell University, Email: sidtelang@cs.cornell.edu.

1

1 Introduction

The goal of program obfuscation is to scramble a computer program, hiding its implementa-

tion details (making it hard to reverse-engineer), while preserving the functionality (i.e, in-

put/output behavior) of the program. In recent years, the notion of indistinguishability obfuscation

(iO) [BGI+ 01, GGH+ 13b] has emerged as the central notion of obfuscation. Roughly speaking,

this notion requires that obfuscations iO(C1 ), iO(C2 ) of any two functionally equivalent circuits

C1 and C2 (i.e., whose outputs agree on all inputs) from some class C (of circuits of some bounded

size) are computationally indistinguishable.

On the one hand, this notion of obfuscation is strong enough for a plethora of amazing ap-

plications (see e.g., [SW14, BCP14, BZ14, GGHR14, BGL+ 15, CHJV14, KLW14]); on the other

hand, it may plausibly exist [GGH+ 13b, BGK+ 13, PST14a, GLSW14], whereas stronger notion

of obfuscations have run into strong impossibility results, even in idealized models (see e.g.,

[BGI+ 01, GK05, CKP15, PS15, MMN15, LPST15])

However, despite all these amazing progress, to date, all candidate constructions of iO rely

on candidate constructions of multi-linear maps [GGH13a, CLT13, GGH15, CLT15], all of which

have non-trivial attacks [CHL+ 15, MF15], and it is not clear to what extent the security of the

obfuscators that rely on them are affected.

Can Inefficient iO be Useful? Let us emphasize that for all known application of iO, it is

important that the obfuscator is efficientnamely, polynomial-time. Indeed, as already observed

by [BGI+ 01], it is trivial to provide an inefficient iO with running time poly(|C|, ) 2n , where

C is the circuit to be obfuscated, is the security parameter, and n is the input length of C, exists

unconditionally: simply output the function table of C (i.e., the output of C on all possible inputs).

Recall that, in contrast, for standard (efficient) iO, the running time and size of the obfuscator

is required to be poly(|C|, )namely, polylogarithmic in the size of the truth table of C).

In this paper, we consider iO with just a slightly non-trivial notion of efficiency: the running-

time of the obfuscator may still be trivial (namely, poly(|C|, ) 2n ), but we now require that the

obfuscated code is just slightly smaller than the truth table of C (namely poly(|C|, )2n(1) , where

> 0); we refer to this notion as iO with exponential efficiency, or simply exponentially-efficient

iO (XiO). The main question investigated in this paper is the following:

Main Theorem Perhaps surprisingly, we show that in the regime of subexponential security,

under the LWE assumption, XiO for P/poly implies (standard) iO for P/poly.

Theorem 1. Assume subexponential security of the LWE assumption, and the existence of subex-

ponentially secure XiO for Plog /poly. Then there exists subexponentially secure iO for P/poly.

Let us remark that in the proof of Theorem 1, we only employ the XiO on circuits that take

inputs of length O(log ) (it would be surprising if we didnt since we aim is to achieve an obfuscator

with polynomial efficiency). As a consequence, the proof of Theorem 1 also shows that (under the

subexponential LWE assumption), subexponentially secure XiO for circuits with such short

inputs (i.e., inputs of length O(log ))we refer to this class of circuits as Plog /polyimplies iO

for all polynomial-size circuits (withlong inputs).1 We remark that in [BGL+ 15], the authors

1

Short-input iO is more appealing than standard iO (for P/poly) in the sense that it can be efficiently checked

whether an attack on a candidate scheme succeeds [Nao03] (an attacker needs to come up with two circuits C1 , C2 that

2

(implicitly) considered a notion of short-input iO (as opposed to XiO) and demonstrate that for

some (but far from all) applications of iO, this weaker notion actually suffices. Our results show

that in the regime of subexponential security, short-input iO (and in fact, even XiO) implies

standard iO (and thus suffices for all applications of iO).

Techniques Our starting point are the recent beautiful works by Ananth and Jain [AJ15] and

Bitansky and Vaikuntanathan [BV15] which show that the existence of subexponentially-secure

functional encryption with sublinearly compact ciphertexts (a.k.a. sublinear compact FE) for P/poly

implies iO for P/poly. Roughly speaking, a (single-key) functional encryption scheme is a public-key

encryption scheme for which it is possible to release a (single) functional secret-key skC (for circuit

C of some a-priori bounded size S) such that knowledge of skC enables efficiently computing C(m)

given any encryption of the message m, (but nothing more); sublinear compactness means that the

encryption time is sublinear in the upper bound S on the circuit-size.2 We recently demonstrated

in [LPST15] that assuming subexponential LWE, it in fact suffices to start off with an FE satisfying

an even weaker notion of compactnesswhich we refer to as weak sublinear compactnesswhich

simply requires that the size of the ciphertext (but not the encryption time) is sublinear in the

circuit-size.

Our main technical contribution will be showing that XiO for Plog /poly implies weakly sublinear

compact FE for P/poly, which by the above-mentioned result implies our main theorem.

Theorem 2. Assume the LWE assumption (resp. subexponential security of the LWE assumption)

holds, and the existence of XiO for Plog /poly (resp. subexponentially-secure XiO for Plog /poly).

Then there exists weakly sublinear compact FE for P/poly (resp. subexponentially-secure weakly

sublinear compact FE for P/poly).

Note that Theorem 2 is interesting in its own right as it applies also in the regime of polynomial

security.3

The proof of Theorem 2 proceeds as follows. Following a proof template from [AJ15] (we discuss

this result in more detail below), we start off with the result of Goldwasser et al [GKP+ 13] which

shows that under the LWE assumption, there exists a functional encryption scheme for boolean

functions (i.e., functions with 1-bit outputs) in NC1 that has logarithmic compactness. Combined

with the bootstrapping result of [ABSV14], this can be used to construct a functional encryption

scheme for boolean functions in P/poly that still has logarithmic compactness. We next show how

to use XiO for Plog /poly to extend any such compact FE scheme for boolean functions to one

that handles arbitrary polynomial-sized circuits (with potentially long outputs). ([AJ15] provided

a similar transformation assuming, so-called, compact randomized encoding (for Turing machines)

instead of XiO.)

We now turn to describe our transformation from single-bit compact FE to multi-bit weakly

sublinear compact FE. As an initial approach, instead of simply encrypting a message m, encrypt

the sequence (m; 1), (m; 2), . . . (m; `), where ` is the maximum output length of the class of functions

are functionally equivalent for which it can distinguish obfuscations; checking whether two circuits are functionally

equivalent may be hard in general, but becomes efficient if the circuits are restricted to inputs of length O(log ) by

simply enumerating all inputs).

2

More precisely, in a functional encryption scheme (Setup, KeyGen, Enc, Dec), Setup samples a public-key, secret-

key pair (pk, msk), KeyGen(msk, C) generates the functional secret key skC ; Enc(pk, m) outputs an encryption c of

m, and Dec(skC , c) outputs C(m) if c is an encryption of m.

3

Furthermore, as we remark later on, weakly sublinear compact FE trivially implies a variant of XiO and this

variant of XiO is also sufficient for our theorems. As such, by our results, XiO may be viewed as a new way to

characterize the complexity of weakly sublinear compact FE.

3

we want to be able to evaluate. Then, instead of simply releasing a functional secret key for a circuit

C, release a secret key for the function C 0 (m; i) = Ci (m), where Ci (m) denotes the ith output bit of

C(m). This approach clearly enables evaluating circuits with multi-bit outputs; but the encryption

scheme is no longer (even weakly) compact! The length of the ciphertext grows linearly with

the number of output bits. To retain compactness (or at least weakly sublinear compactness),

we have the encryption algorithm release an obfuscation of a program that generates all the `

encryptionsmore precisely, given an index i, it applies a PRF (with a hard-coded seed) to the

index i to generate randomness ri and then outputs an encryption of (m; i). As long as obfuscation

size is just-slightly-compressing, the functional encryption will have weak sublinear compactness;

furthermore, the program we obfuscate only needs to take inputs of length O(log ). Thus, it

suffices to assume the obfuscator satisfies XiO for Plog /poly.

To prove security of the construction, we use the one-input-at-a-time technique from [BCP14,

GLW14, PST14b, GLSW14, CLTV15], and the punctured program technique of Sahai and Waters

[SW14]; the crucial point that enables us to keep the obfuscation small is that the output of the pro-

gram on different inputs uses independent randomness (since they are independent encryptions)

and thus in the hybrid arguments it suffices to puncture the PRF on a single point.

Let us end this section by briefly comparing our transformation to the above-mentioned trans-

formation by Ananth and Jain [AJ15]; [AJ15] shows how to use, so-called, compact randomized

encoding to transform single-bit compact FE for NC1 into multi-bit compact FE for NC1 . As we

explain in more detail in Remark 3, compact randomized encoding can be viewed as a special case

of XiO for the class of Turing machines (as opposed to circuits) with short input. Turing machine

obfuscation is a significantly more challenging task than circuit obfuscation. We provide a brief

description of their transformation in Appendix A and explain why the transformation fails when

using XiO (for circuits).

2 Preliminaries

Let N denote the set of positive integers, and [n] denote the set {1, 2, . . . , n}. We denote by

PPT probabilistic polynomial time Turing machines, and by nuPPT non-uniform probabilistic

polynomial time Turing machines. The term negligible is used for denoting functions that are

(asymptotically) smaller than one over any polynomial. More precisely, a function () from non-

negative integers to reals is called negligible if for every constant c > 0 and all sufficiently large n,

it holds that (n) < nc . For any algorithm A and input x we denote by outlenA (x), the output

length of A when run with input x.

Definition 1. We denote by Plog /poly the class of circuits {C } where C are poly()-size circuits

that have input length c log for some constant c.

Puncturable PRFs defined by Sahai and Waters [SW14], are PRFs for which a key can be given

out that allows evaluation of the PRF on all inputs, except for a designated polynomial-size set of

inputs.

triple of efficient algorithms (F.Key, F.Punc, F.Eval), and a pair of computable functions n() and

m(), satisfying the following conditions:

4

Functionality preserved under puncturing: For every polynomial size set S {0, 1}n()

and for every x {0, 1}n() \S, we have that:

Pseudorandom at punctured points: For every polynomial size set S {0, 1}n() and

for every nuPPT adversary A we have that:

F.Eval(K, x1 ), . . . F.Eval(K, xk ) where S = {x1 , ..., xk } is the enumeration of the elements of

S in lexicographic order, U` denotes the uniform distribution over ` bits.

The GGM tree-based construction of PRFs [GGM86] from one-way functions are easily seen

to yield puncturable PRFs, as recently observed by [BW13, BGI14, KPTZ13]. Furthermore, it is

easy to see that if the PRG underlying the GGM construction is sub-exponentially hard (and this

can in turn be built from sub-exponentially hard OWFs), then the resulting puncturable PRF is

sub-exponentially pseudorandom.

We recall the definition of public-key functional encryption (FE) with selective indistinguishability

based security [BSW12, ON10]. We note that in this work, we only need the security of the

functional encryption scheme to hold with respect to statically chosen challenge messages and

functions. We further consider FE schemes that only produce a single functional secret key for

each public key.

Definition 3 (Functional Encryption [ON10, BSW12]). A public key functional encryption scheme

for a class of circuits {C } is a tuple of PPT algorithms

(FE.Setup, FE.KeyGen, FE.Enc, FE.Dec) that behave as follows:

(msk, pk) FE.Setup(1 ): FE.Setup takes as input the security parameter and outputs the

master secret key msk and public key pk.

skC FE.KeyGen(msk, C): FE.KeyGen takes as input the master secret key and a circuit

C C and outputs the functional secret key skC .

c FE.Enc(pk, m): FE.Enc takes as input the public key and message m {0, 1} and outputs

the ciphertext c.

y FE.Dec(skC , c): FE.Dec takes as input the functional secret key and ciphertext and

outputs y {0, 1} .

Correctness: For every N, C C with input length n and message m {0, 1}n , we

have that

(pk, msk) FE.Setup(1 )

c FE.Enc(pk, m)

5

Selective Security: For every nuPPT A there exists a negligible function such that for

every N, every circuit C C with input length n and pair of messages m0 , m1 {0, 1}n

such that C(m0 ) = C(m1 ) we have that | Pr[A(D0 ) = 1] Pr[A(D1 ) = 1]| () where

cb FE.Enc(pk, mb )

We say the scheme has sub-exponential security if there exists a constant such that for

every , every 2 -size adversary A, | Pr[A(D0 ) = 1] Pr[A(D1 ) = 1]| 1/2 where Db is

defined above.

We recall the definition of compactness and succinctness for functional encryption schemes, as

defined in [BV15, AJ15].

Definition 4 (Compact Functional Encryption [BV15, AJ15]). We say a functional encryption

scheme for a class of circuits {C } is compact if for every N, pk FE.Setup(1 ) and m

{0, 1} we have that

Time(FE.Enc(pk, m)) = poly(, |m|, log s)

where s = maxCC |C|. We say the scheme has sub-linear compactness if the running time of

FE.Enc is bounded as

Time(FE.Enc(pk, m)) = poly(, |m|) s1

where > 0.

Definition 5 (Succinct Functional Encryption). A compact functional encryption scheme for a

class of circuits that output only a single bit is called a succinct functional encryption scheme.

Theorem 3 ([GKP+ 13]). Assuming (sub-exponentially secure) LWE, there exists a (sub-exponentially

secure) succinct functional encryption scheme for NC1 .

We note that [GKP+ 13] do not explicitly consider sub-exponentially secure succinct functional

encryption, but their construction satisfies it (assuming sub-exponentially secure LWE). Addition-

ally, we have the following bootstrapping theorem:

Theorem 4 ([GHRW14, ABSV14, AJ15]). Assuming the existence of symmetric-key encryption

with decryption in NC1 (resp. sub-exponentially secure) and succinct functional encryption for

NC1 (resp. sub-exponentially secure), there exists succinct functional encryption for P/poly (resp.

sub-exponentially secure).

Following [LPST15], we here also consider a weaker compactness notion, where only the ci-

phertext size (but not the encryption time) is sublinear in the output length of the function being

evaluated.

Definition 6 (Weakly Sublinear Compact Functional Encryption [LPST15]). We say a functional

encryption scheme for a class of circuits {C } is weakly sublinear compact if there exists > 0

such that for every N, pk FE.Setup(1 ) and m {0, 1} we have that

outlenFE.Enc (pk, m) = s1 poly(, |m|)

6

2.3 Indistinguishability Obfuscation

We recall the notion of indistinguishability obfuscation (iO).

indistinguishability obfuscator (also referred to as iO) for a circuit class {C }N if the following

conditions are satisfied:

Functionality: for all security parameters N, for all C C , for all inputs x, we have

that

Pr[C 0 iO(C) : C 0 (x) = C(x)] = 1 .

such that the following holds: For all security parameters N, for all pairs of circuits

C0 , C1 C of the same size, we have that if C0 (x) = C1 (x) for all inputs x, then

Pr D(iO(C0 )) = 1 Pr D(iO(C1 )) = 1 () .

We say the scheme has sub-exponential security if there exists a constant such that for

every , every 2 -size adversary D, | Pr[D(iO(C0 )) = 1] Pr[D(iO(C1 )) = 1]| 1/2 .

The recent beautiful results of [AJ15], Bitansky and Vaikuntanathan [BV15] show that subex-

ponentially secure sublinear compact functional encryption schemes implies iO for P/poly. In an

earlier work [LPST15], we demonstrated that (if we additionally assume subexponential LWE), it

suffices to start off with just a weakly sublinear compact functional encryption scheme (recall that

in such a scheme only the length of the ciphertext needs to be sublinear, but encryption time may

be polynomial).

Theorem 5 ([LPST15]). Assume the existence of sub-exponentially secure LWE. If there exists

a weakly sublinear compact functional encryption scheme for P/poly with sub-exponential security,

then there exists a sub-exponentially secure indistinguishability obfuscator for P/poly.

3 Exponentially-Efficient iO (XiO)

In this section, we define our new notion of exponentially-efficient indistinguishability obfuscation

(XiO), which allows the obfuscator to have running time as long as a brute-force canonicalizer that

outputs the entire truth table of the function, but requires the obfuscated program to be slightly

smaller in size than a brute-force canonicalization.

an exponentially-efficient indistinguishability obfuscator (also referred to as XiO) for a circuit class

{C }N if it satisfies the same functionality and indistinguishability property of indistinguishability

obfuscators as in Definition 7 and the following efficiency requirement.

Non-trivial Efficiency4 . There exists a constant > 0 such that for any security parameter

4

Our notion of trivial running-time is even more relaxed than the notion used in the introduction. We here

allow the running-time be polynomial in 2n , and opposed to just linear (as we described it in the introduction). This

even more relaxed notion of efficiency is useful in order to more cleanly compare XiO with the notion of compact

FE; see Remark 2.

7

N, circuit C C with input length n and C 0 XiO(1 , C), we have that

outlenXiO (1 , C) = poly(, |C|) 2n(1)

Remark 1. (Circuits with logarithmic input length) Note that if we want the obfuscation to be

efficient (i.e., polynomial-time in and the size of the circuit to be obfuscated), then the above

definition is only meaningful when the class of circuits C has input length O(log ). Our results in

this paper hold assuming XiO for Plog /poly.

Remark 2. (XiO in the preprocessing model and comparison with Compact Functional Encryp-

tion) We can consider further a relaxation of the running-time requirement of the obfuscator. The

obfuscator may first perform a long pre-processing step (without having seen the program to be

obfuscated), taking time poly(, s, 2n ) (where s is the size bound on circuits to be obfuscated), and

outputting a (potentially long) pre-processing public-key Opk . The actual obfuscation then takes

Opk , and the circuit C as inputs, runs in time poly(, s, 2n ) and outputs an obfuscated program of

size poly(, s) 2n(1) , and then the evaluation of the obfuscated program may finally also access

the public-key Opk . All our results also apply to this relaxed notion of XiO.

Additionally, we note that weakly sublinear compact FE directly implies this notion as follows:

pre-processing public key Opk (generated in the pre-processing step) is the public key pk for the FE

and the functional secret key skF T corresponding to a function table generator program that takes as

input a circuit and outputs the function table of it; the obfuscation of a circuit C is an encryption of

the circuit C (w.r.t., the FE public key pk), and evaluation of the obfuscated code uses the functional

secret key skF T inside Opk to compute the function table of C and selects the appropriate output.

Sub-linear compactness of the functional encryption scheme implies the obfuscator has exponential

efficiency.

Remark 3. (Comparison with Compact Randomized Encoding for Turing machines) [AJ15] and

[LPST15] study a notion of compact randomized encodings [IK02, AIK04]. Roughly speaking, a

randomized encoding (RE) is a method for encoding a Turing Machine , an input x and a

[ from which (x) can be efficiently decoded;

running-time bound T , into a randomized encoding (x)

furthermore the encodings does not leak anything more about and x than what can be (inefficiently)

deduced from just the output (x) (truncated at T steps).5 A randomized encodings is compact (resp.

sublinearly compact) if the encoding time is poly-logarithmic (resp sublinear) in T (and polynomial

in the size of and x). We note that sublinear compact RE directly implies XiO as follows: to

obfuscate a circuit C, compute an encoding Fd TC of the function table generator Turing machine

F TC that has the circuit C hardcoded (i.e., F TC takes no inputs and simply computes the function

table of C); evaluation of the obfuscation on an input i simply decodes the encoding FdTC and picks

out the ith output. Sublinear compactness of the RE implies that the obfuscator is exponentially-

efficient. In fact, this obfuscator has a stronger efficiency guarantee than XiO: the running time

of the obfuscator is poly(, |C|) 2n(1) whereas XiO allows for a longer running time.

In fact, the above methods extend to show that (sublinearly) compact RE implies a notion of

XiO for Turing machines. We note that Turing machine obfuscation is a significantly harder

task than circuit obfuscation (indeed, all known construction of Turing machine obfuscators first

5

Or equivalently, for any two programs 1 , 2 and inputs x1 , x2 such that 1 (x1 ) = 2 (x2 ), a randomized encoding

of 1 , x1 is indistinguishable from an encoding of 2 , x2 .

8

go through circuit obfuscation). We also point out that whereas (subexponentially-secure) iO for

circuits is known to imply iO for Turing machine [BGL+ 15, CHJV14, KLW14], these techniques

do not apply in the regime of programs with short input (and thus do not seem amenable in the

regime of inefficient iO either).

4 iO from XiO

In this section, we show how to achieve standard (polynomially-efficient) iO from XiO.

We first give our construction of weakly sublinear compact FE from succinct FE and XiO for

circuits with input-size O(log()). At a high-level, our idea is to have the ciphertext for the FE

scheme be XiO of a circuit that, on input i, generates a succinct FE encryption of (m, i). The

secret key corresponding to C consists of a single key for the succinct FE scheme, that, given a

ciphertext encrypting (m, i), computes the ith output bit of C(m).

Let F be a puncturable pseudorandom function, XiO be an exponentially-efficient indistin-

guishability obfuscator for Plog /poly and sFE be a succinct functional encryption scheme (resp.

with sub-exponential security) for an appropriate class of circuits {C0 } that includes C 0 defined

below. We define a compact functional encryption scheme FE for a class of poly-size circuits {C }

as follows:

(msk, pk) FE.Setup(1 ): FE.Setup is identical to sFE.Setup and has the same output.

c FE.Enc(pk, m): FE.Enc samples a puncturable PRF key K F.Key(1 ) and outputs

XiO(1 , G[pk, K, m]) where G[pk, K, m] is a circuit with input length n = log s where s =

maxCC outlen(C), defined as follows:

G is padded to be the same size as circuits G0 and G00 that we will define later in the security

proof. All circuits G, G0 , and G00 will ultimately have size bounded by S = poly(, |m|, log s)

where s = maxCC |C|, and are padded to size S.

skC FE.KeyGen(msk, C): FE.KeyGen outputs sFE.KeyGen(msk, C 0 ) where C 0 on input (m, i) out-

puts the ith bit of C(m), or outputs if i is greater than the output length of C.

y FE.Dec(skC , ): FE.Dec runs ci (i) and yi sFE.Dec(skC , ci ) for every i and outputs

y1 , . . . y2n .

Let {C0 } be a class of circuits that includes C 0 as defined above for every C C .

curity), XiO is an exponentially efficient indistinguishability obfuscator for Plog /poly (resp. with

subexponential security) and sFE is a succinct functional encryption scheme for {C0 } (resp. with

subexponential security), we have that FE as defined above is a functional encryption scheme for

{C } with weakly sub-linear compactness (resp. and with subexponential security).

Proof. We first show weak sublinear compactness of FE. Consider any , C C , message m, pk

FE.Setup(1 ) and puncturable PRF key K F.Key(1 ). Time(FE.Enc(pk, m)) is the time XiO takes

9

to obfuscate the circuit G[pk, K, m], which is of size S = poly(, |m|, log s) where s = maxCC |C|.

Hence we have that

0

outlenXiO (1 , G[pk, K, m]) = poly(, |m|, log s) 2n(1) poly(, |m|) s1

Next we show the selective security of FE. We proceed by using the one-input-at-a-time

technique from [BCP14, GLW14, PST14b, GLSW14, CLTV15]. More precisely, we proceed by

a hybrid argument where in each hybrid distribution, the circuit being obfuscated, on input i,

produces ciphertexts of m1 when i is less than a threshold, and ciphertexts of m0 otherwise.

Indistinguishability of neighboring hybrids is shown using the punctured programming technique

of [SW14], as was done in [CLTV15] for constructing iO for probabilistic functions. (This technique

is also used extensively in other applications of iO, eg., [BGL+ 15], [CHJV14], [KLW14] and more.)

Assume for contradiction there exists a nuPPT A and polynomial p such that for sufficiently

large , circuit C C and messages m0 , m1 such that C(m0 ) = C(m1 ), A distinguishes D0 and

D1 with advantage 1/p(), where

skC FE.KeyGen(msk, C)

skC FE.KeyGen(msk, C)

0 sFE.Enc(pk, (m0 , i); F(K, i)) if i > j

G [pk, K, j, m0 , m1 ](i) =

sFE.Enc(pk, (m1 , i); F(K, i)) if i j

We consider the hybrid sequence D0 , H1 , . . . , H` , D1 . By a hybrid argument, there exists a

pair of neighboring hybrids in this sequence such that A distinguishes the pair with probability

1 1

p()(`+2) = poly() . We show a contradiction by proving that each pair of neighboring hybrids is

computationally indistinguishable.

We first note that D0 is indistinguishable from H0 . This follows by observing that G0 [pk, K, 0, m0 , m1 ]

is functionally identical to G[pk, K, m0 ], and applying the security of XiO. The same argument also

shows that H` is indistinguishable from D1 .

Next, we show Hj and Hj +1 are indistinguishable for each j [`]. Define hybrid distribution

H0 which is identical to Hj except that XiO obfuscates a different circuit G00 [pk, Kj , j , m0 , m1 , c]

0

R. G00 on input i has the same behavior as G0 except i = j , where it outputs the hardcoded

ciphertext c. By the punctured programming technique of Sahai-Waters [SW14], which relies on

the security of the obfuscator XiO and puncturable PRF F, it follows that for sufficiently large ,

A distinguishes between Hj and H00 with negligible probability.

The puncturing programming technique itself works in two hybrid steps:

10

First the circuit G0 is replaced with circuit G00 [pk, Kj , j , m0 , m1 , c] where the hardwired

ciphertext is c = sFE.Enc(pk, (m0 , j ); F(K, j )), which is the same ciphertext G0 previously

computed. Since this doesnt change the functionality of the circuit, indistinguishability

follows from the security of XiO.

Second, the hardcoded ciphertext is modified to be generated from real randomness R, and

indistinguishability follows from the security of the puncturable PRF.

Next, we define hybrid distribution H10 which is identical to H00 except that the hardcoded

ciphertext c is generated as sFE.Enc(pk, (m1 , j ); R) for uniformly sampled randomness R. Since

C(m0 ) is identical to C(m1 ), from the security of sFE, A distinguishes H00 and H10 with negligible

probability.

Finally, note that H10 and Hj +1 differ in the same way H00 and Hj do, and are hence indistin-

guishable by a similar argument. Hence A distinguishes Hj and Hj +1 with negligible probability

and we have a contradiction. This completes the proof.

We note that the proof above is described in terms of computational indistinguishability, but

in fact also can be applied to show that FE is subexponentially-secure, if both XiO and sFE are

subexponentially secure.

Theorem 7. Assuming sub-exponentially hard LWE, if there exists a subexponentially secure expo-

nentially efficient indistinguishability obfuscator for Plog /poly then there exists an indistinguisha-

bility obfuscator for P/poly with subexponential security.

Proof. By Theorem 3 and Theorem 4, assuming subexponentially secure LWE, there exists a suc-

cinct functional encryption scheme for P/poly that is subexponentially secure. Using this with

a subexponentially secure exponentially efficient indistinguishability obfuscator for Plog /poly, by

Theorem 6, we get weakly sublinear compact function encryption for P/poly with sub-exponential

selective security. Together with Theorem 5, this gives us iO for P/poly.

Remark 4. (XiO for NC1 suffices) We remark it in fact suffices to assume XiO for only NC1

(instead of P/poly) if rely on the existence of puncturable PRFs in NC1 . Indeed, if encryption

algorithm of the succinct FE scheme and the puncturable PRF are both in NC1 , then in our con-

struction it suffices to obfuscate NC1 circuits (we also need to verify that the merged circuit used

in the hybrid argument is in NC1, which directly follows). By the result of [AIK04], assuming the

existence of pseudorandom generators in NC1 , we can assume without loss of generality that the

succinct FE encryption we rely on also has encryption in NC1 (in fact even NC0 , but this will not be

useful to us): the encryption algorithm for the new succinct FE scheme computes the randomized

encoding of the original encryption function.

References

[ABSV14] Prabhanjan Ananth, Zvika Brakerski, Gil Segev, and Vinod Vaikuntanathan. The

trojan method in functional encryption: From selective to adaptive security. Technical

report, generically. Cryptology ePrint Archive, Report 2014/917, 2014.

11

[AIK04] Benny Applebaum, Yuval Ishai, and Eyal Kushilevitz. Cryptography in nc0 . In FOCS,

pages 166175, 2004.

[AJ15] Prabhanjan Ananth and Abhishek Jain. Indistinguishability obfuscation from compact

functional encryption. IACR Cryptology ePrint Archive, 2015:173, 2015.

[BCP14] Elette Boyle, Kai-Min Chung, and Rafael Pass. On extractability obfuscation. In

TCC, pages 5273, 2014.

[BGI+ 01] Boaz Barak, Oded Goldreich, Rusell Impagliazzo, Steven Rudich, Amit Sahai, Salil

Vadhan, and Ke Yang. On the (im)possibility of obfuscating programs. In Advances

in Cryptology CRYPTO 2001, pages 118. Springer, 2001.

[BGI14] Elette Boyle, Shafi Goldwasser, and Ioana Ivan. Functional signatures and pseudoran-

dom functions. In PKC, pages 501519, 2014.

[BGK+ 13] Boaz Barak, Sanjam Garg, Yael Tauman Kalai, Omer Paneth, and Amit Sahai. Pro-

tecting obfuscation against algebraic attacks. In EuroCrypt14, 2013.

[BGL+ 15] Nir Bitansky, Sanjam Garg, Huijia Lin, Rafael Pass, and Sidharth Telang. Suc-

cinct randomized encodings and their applications. IACR Cryptology ePrint Archive,

2015:356, 2015.

[BSW12] Dan Boneh, Amit Sahai, and Brent Waters. Functional encryption: a new vision for

public-key cryptography. Commun. ACM, 55(11):5664, 2012.

[BV15] Nir Bitansky and Vinod Vaikuntanathan. Indistinguishability obfuscation from func-

tional encryption. IACR Cryptology ePrint Archive, 2015:163, 2015.

[BW13] Dan Boneh and Brent Waters. Constrained pseudorandom functions and their appli-

cations. In ASIACRYPT (2), pages 280300, 2013.

[BZ14] Dan Boneh and Mark Zhandry. Multiparty key exchange, efficient traitor tracing, and

more from indistinguishability obfuscation. In Advances in Cryptology - CRYPTO

2014 - 34th Annual Cryptology Conference, Santa Barbara, CA, USA, August 17-21,

2014, Proceedings, Part I, pages 480499, 2014.

[CHJV14] Ran Canetti, Justin Holmgren, Abhishek Jain, and Vinod Vaikuntanathan. Indistin-

guishability obfuscation of iterated circuits and RAM programs. IACR Cryptology

ePrint Archive, 2014:769, 2014.

[CHL+ 15] Jung Hee Cheon, Kyoohyung Han, Changmin Lee, Hansol Ryu, and Damien Stehle.

Cryptanalysis of the multilinear map over the integers. In Advances in Cryptology -

EUROCRYPT 2015 - 34th Annual International Conference on the Theory and Appli-

cations of Cryptographic Techniques, Sofia, Bulgaria, April 26-30, 2015, Proceedings,

Part I, pages 312, 2015.

[CKP15] Ran Canetti, Yael Tauman Kalai, and Omer Paneth. On obfuscation with random

oracles. In Theory of Cryptography - 12th Theory of Cryptography Conference, TCC

2015, Warsaw, Poland, March 23-25, 2015, Proceedings, Part II, pages 456467, 2015.

12

[CLT13] Jean-Sebastien Coron, Tancr`ede Lepoint, and Mehdi Tibouchi. Practical multilinear

maps over the integers. In Advances in Cryptology - CRYPTO 2013 - 33rd Annual

Cryptology Conference, Santa Barbara, CA, USA, August 18-22, 2013. Proceedings,

Part I, pages 476493, 2013.

[CLT15] Jean-Sebastien Coron, Tancr`ede Lepoint, and Mehdi Tibouchi. New multilinear maps

over the integers. In Advances in Cryptology - CRYPTO 2015 - 35th Annual Cryptology

Conference, Santa Barbara, CA, USA, August 16-20, 2015, Proceedings, Part I, pages

267286, 2015.

[CLTV15] Ran Canetti, Huijia Lin, Stefano Tessaro, and Vinod Vaikuntanathan. Obfuscation

of probabilistic circuits and applications. In Yevgeniy Dodis and JesperBuus Nielsen,

editors, Theory of Cryptography, volume 9015 of Lecture Notes in Computer Science,

pages 468497. Springer Berlin Heidelberg, 2015.

[GGH13a] Sanjam Garg, Craig Gentry, and Shai Halevi. Candidate multilinear maps from ideal

lattices. In Advances in CryptologyEUROCRYPT 2013, pages 117. Springer, 2013.

[GGH+ 13b] Sanjam Garg, Craig Gentry, Shai Halevi, Mariana Raykova, Amit Sahai, and Brent

Waters. Candidate indistinguishability obfuscation and functional encryption for all

circuits. Proc. of FOCS 2013, 2013.

[GGH15] Craig Gentry, Sergey Gorbunov, and Shai Halevi. Graph-induced multilinear maps

from lattices. In Theory of Cryptography - 12th Theory of Cryptography Conference,

TCC 2015, Warsaw, Poland, March 23-25, 2015, Proceedings, Part II, pages 498527,

2015.

[GGHR14] Sanjam Garg, Craig Gentry, Shai Halevi, and Mariana Raykova. Two-round secure

MPC from indistinguishability obfuscation. In Theory of Cryptography - 11th Theory

of Cryptography Conference, TCC 2014, San Diego, CA, USA, February 24-26, 2014.

Proceedings, pages 7494, 2014.

[GGM86] Oded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random func-

tions. J. ACM, 33(4):792807, 1986.

[GHRW14] Gentry, Halevi, Raykova, and Wichs. Outsourcing private ram computation. Proc. of

FOCS 2014, 2014.

[GK05] Shafi Goldwasser and Yael Tauman Kalai. On the impossibility of obfuscation with

auxiliary input. In 46th Annual IEEE Symposium on Foundations of Computer Science

(FOCS 2005), 23-25 October 2005, Pittsburgh, PA, USA, Proceedings, pages 553562,

2005.

[GKP+ 13] Shafi Goldwasser, Yael Tauman Kalai, Raluca A. Popa, Vinod Vaikuntanathan, and

Nickolai Zeldovich. Reusable garbled circuits and succinct functional encryption. In

Symposium on Theory of Computing Conference, STOC13, Palo Alto, CA, USA,

June 1-4, 2013, pages 555564, 2013.

[GLSW14] Craig Gentry, Allison Lewko, Amit Sahai, and Brent Waters. Indistinguishability

obfuscation from the multilinear subgroup elimination assumption. Cryptology ePrint

Archive, Report 2014/309, 2014.

13

[GLW14] Craig Gentry, Allison Lewko, and Brent Waters. Witness encryption from instance

independent assumptions. In Advances in CryptologyCRYPTO 2014, pages 426443.

Springer, 2014.

[IK02] Yuval Ishai and Eyal Kushilevitz. Perfect constant-round secure computation via

perfect randomizing polynomials. In ICALP, pages 244256, 2002.

[KLW14] Venkata Koppula, Allison Bishop Lewko, and Brent Waters. Indistinguishability ob-

fuscation for turing machines with unbounded memory. Technical report, Cryptology

ePrint Archive, Report 2014/925, 201 4. http://eprint. iacr. org, 2014.

[KPTZ13] Aggelos Kiayias, Stavros Papadopoulos, Nikos Triandopoulos, and Thomas Zacharias.

Delegatable pseudorandom functions and applications. In CCS, pages 669684, 2013.

[LPST15] Huijia Lin, Rafael Pass, Karn Seth, and Sidharth Telang. Output-compressing ran-

domized encodings and applications. 2015.

[MF15] Brice Minaud and Pierre-Alain Fouque. Cryptanalysis of the new multilinear map over

the integers. Cryptology ePrint Archive, Report 2015/941, 2015. http://eprint.

iacr.org/.

[MMN15] Mohammad Mahmoody, Ameer Mohammed, and Soheil Nematihaji. More on impos-

sibility of virtual black-box obfuscation in idealized models. IACR Cryptology ePrint

Archive, 2015:632, 2015.

[Nao03] Moni Naor. On cryptographic assumptions and challenges. In Dan Boneh, editor,

CRYPTO, volume 2729 of Lecture Notes in Computer Science, pages 96109. Springer,

2003.

[ON10] Adam ONeill. Definitional issues in functional encryption. Cryptology ePrint Archive,

Report 2010/556, 2010. http://eprint.iacr.org/.

[PS15] Rafael Pass and Abhi Shelat. Impossibility of VBB obfuscation with ideal constant-

degree graded encodings. IACR Cryptology ePrint Archive, 2015:383, 2015.

[PST14a] Rafael Pass, Karn Seth, and Sidharth Telang. Indistinguishability obfuscation from

semantically-secure multilinear encodings. In CRYPTO14, 2014.

[PST14b] Rafael Pass, Karn Seth, and Sidharth Telang. Indistinguishability obfuscation from

semantically-secure multilinear encodings. In Advances in CryptologyCRYPTO 2014,

pages 500517. Springer, 2014.

[SW14] Amit Sahai and Brent Waters. How to use indistinguishability obfuscation: Deniable

encryption, and more. Proc. of STOC 2014, 2014.

In this section we briefly describe the related result by [AJ15] and compare it with our result.

[AJ15] show how to construct a compact functional encryption scheme from a succinct functional

encryption scheme and compact randomized encodings for Turing machines (see Remark 3 for an

informal description of randomized encodings). The rough idea is as follows: the compact functional

14

secret key for a function f is a sequence of ` independent succinct functional secret keys where `

is the output length of f . The ith succinct functional secret key corresponds to the function that

outputs the ith bit of f . The compact functional ciphertext for a message m is the randomized

encoding of a machine that takes no input and when run, outputs {Enc(pki , m)}i[`] where pki is

the public key corresponding to the ith instance of the succinct functional scheme (these instances

are generated using a PRF, hence the description size of is independent of `). The compactness of

the functional encryption scheme follows from the compactness of the randomized encoding scheme.

Note that the above result necessarily requires the computation being encoded to be represented

as a Turing machine, since the description size is required to be independent of the output length.

As we explain in Remark 3, such a notion of randomized encodings for Turing machine does not

seem useful for our purposes.

15

- III Sem- Design Analysis Algorithm(1)Uploaded byMohan Devaraj
- Image Encryption Based On Diffusion And Multiple Chaotic MapsUploaded byAIRCC - IJNSA
- Combined Schemes for Signature and Encryption The public-keu and the identity-based setting.pdfUploaded byRisky Rionaldy
- CamUploaded bySwetha Chowdary
- Cryptolab.texUploaded byImi
- IJCTT-V1I3P107Uploaded byDeepti Sudha
- Protegrity HSM Connectivity and FunctionalityUploaded byLaurindo Gonzalez Filho
- Introduction to Moderen CryptoUploaded bypadmagvathi
- ID376_UBICC_376Uploaded byUbiquitous Computing and Communication Journal
- 3 - 4 - Order-Of-Growth Classifications (1439)Uploaded byeshwaar1
- Index-Based Symmetric DNA Encryption AlgorithmUploaded bychethan
- IRJET-Secure Data Sharing using Visual Cryptography and Watermarking Method in Fog ComputingUploaded byIRJET Journal
- AlgorithmsUploaded byMohammad Gulam Ahamad
- E Commerce IT FInal PPTUploaded byAkansha Poddar
- Assignment 2Uploaded byMark Jim Martinez
- 4-Zeng-286-295Uploaded byNeeraj Kumar
- Public Key Cryptology – An Art of Keeping Secrecy and AuthenticityUploaded byIJSTE
- DNA SequencingUploaded bymarkaz
- CryptoUploaded byMahak Ahuja
- Siti Rozani 23516039 Riset Dan Teknologi TIUploaded byCi Ty
- DAA NEW1Uploaded byManukumar
- CryptographyUploaded byArfath Pasha
- AlgoUploaded bySmmy Mma
- compusoft ,2(3),54-58Uploaded byIjact Editor
- 07458841Uploaded byÖzgürKaymakçı
- 187985328 Dynamic Programming TopCoder TutorialsUploaded byMilos Jevtovic
- 11 Chapter 3Uploaded byAkn Nanthan
- 7245490 Seminar on Network SecurityUploaded byPranav
- 27323713-Securing-a-WebSphere-MQ-Infrastructure-Services.pdfUploaded bySurendra Anam
- Dana Ron Algorithmic and Analysis Techniques in Property TestingUploaded bymail2sgarg_841221144

- V5I4-0287Uploaded byabdel_lak
- gratisexam.com-Isaca.Selftestengine.COBIT-5.v2018-03-17.by.Mia.30q(1)Uploaded byabdel_lak
- Barracuda Web Application Firewall WP AdvantageUploaded byabdel_lak
- SOC-1441Uploaded byabdel_lak
- Institutional FirewallUploaded byabdel_lak
- misc_tools_sheet_v1.pdfUploaded byabdel_lak
- NSE4-5.4Uploaded byabdel_lak
- 01-csrs2008-ThomasBryanUploaded byabdel_lak
- Bronie StrUploaded byabdel_lak
- parno-cv(1)Uploaded byabdel_lak
- --1385454776-19. An efficient structure.full.pdfUploaded byabdel_lak
- 06320109(1)Uploaded byabdel_lak
- 0fcfd5093ed673b387000000Uploaded byabdel_lak
- Master UOCUploaded byabdel_lak
- Default LogUploaded byabdel_lak
- CookiesUploaded byabdel_lak
- Us Aers Cyber Espionage 07292011Uploaded byabdel_lak
- Abowd Lane Barcelona 2004Uploaded byabdel_lak
- LicenseUploaded byKeshav Singh
- readme.txtUploaded byabdel_lak
- B.8.637Uploaded byabdel_lak
- WatchGuard Training CourseUploaded byabdel_lak
- 2016-petsUploaded byabdel_lak
- VMware VSphere Enterprise DataSheet DS EnUploaded byabdel_lak
- 05 LectureUploaded byabdel_lak
- Justin Sherrill ResumeUploaded byabdel_lak
- 2010-15 IFMAP Stage 1 Inventory Progress Report_2010Uploaded byabdel_lak
- Northern Mesoamerica: Belize, Guatemala, Mexico EcoSystemUploaded byBirdlife International Pacific Partnership
- CodeObfuscation(1)Uploaded byabdel_lak

- unit33portfolioUploaded byapi-320658411
- Applicability of Modal Response Spectrum Analysis on Rocking StructuresUploaded bycontrerasc_sebastian988
- CAPE(r) Physics Past Papers - Caribbean Examinations CouncilUploaded byShania Roopnarine
- Sociolinguistics 4 - Codeswitching, Borrowing, Language Planning, Language Shift Loss n DeathUploaded byman_dainese
- 284681014-DBDA-Introduction.docUploaded byDrMegha Kharkwal
- Saguisag vs Executive SecretaryUploaded byBianca Margaret Tolentino
- Class TestUploaded byGoldy Banerjee
- Hydraulic Design Manual_ Probability of ExceedanceUploaded byEnoch Arden
- SierraSil_InfoGuide_CA (1)Uploaded byCameron
- Notes 8.6Uploaded byCjjgrubbs
- A Meeting With Imam KhomeiniUploaded byrazafarha
- Easton College FE Prospectus 2012Uploaded byEaston College
- 005Uploaded byGerardo Serrano Valencia
- Errors in Data TransmissionUploaded bySaket Lalpura
- 295117459 St Louis Reviewer 1Uploaded byRodel
- A Thousands Paths to LeadershipUploaded byHENRY TORRES
- Exploring Green and Hedge WitchcraftUploaded byroamingnature08
- examen-ingles-selectividad-junio-2015-solucionUploaded byapi-356181352
- Caluya vs. DomingoUploaded byVince Leido
- Resistant OCDUploaded byLaloaa
- LeukemiaUploaded byShashidhar K Bangera
- 12.714_S2L05Uploaded bykarim2005
- 20048_ftp.pdfUploaded byRosalia
- Approaches to Comparative PoliticcsUploaded byPhyoben S Odyuo
- Phd New 20synopsis[1]Uploaded byslakshmimba09
- Webster Bivens v. Six Unknown Named Agents of the Federal Bureau of Narcotics, 409 F.2d 718, 2d Cir. (1969)Uploaded byScribd Government Docs
- BARRACUDA by CHRISTOS TSIOLKAS-ExcerptUploaded byCrown Publishing Group
- Translating Audio-Visual Humor--A Case StudyUploaded bylixiaoxiu
- Caricomp Manual 2001Uploaded byBioestudiantes Un
- Model Specification for Soil Testing. Geospec 3 HongkongUploaded byN.D.Jiji