Constrained Pseudorandom Functions for Unconstrained Inputs - - PowerPoint PPT Presentation
Constrained Pseudorandom Functions for Unconstrained Inputs Apoorvaa Deshpande (Brown University) Venkata Koppula (University of Texas at Austin) Brent Waters (University of Texas at Austin) Pseudorandom Functions (Goldreich-Goldwasser-Micali
Apoorvaa Deshpande (Brown University) Venkata Koppula (University of Texas at Austin) Brent Waters (University of Texas at Austin)
(Goldreich-Goldwasser-Micali 84)
(Goldreich-Goldwasser-Micali 84)
Keyed Function F Key space K Numerous applications in Cryptography
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
Keyed Function F, Key Space K
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
Keyed Function F, Key Space K Constrain
Constraint T
K K{T}
T
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
Keyed Function F, Key Space K For all x s.t. x satisfies T, F(K , x) = F(K{T} , x) Constrain
Constraint T
K K{T}
T
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
Families of Constraints:
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
Families of Constraints:
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
Families of Constraints:
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
construction (Boneh-Zhandry 14)
Families of Constraints:
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
construction (Boneh-Zhandry 14)
Families of Constraints:
Circuits can handle only bounded length inputs!
(Boneh-Waters, Boyle-Goldwasser-Ivan, Kiayias-Papadopoulos-Triandopoulos-Zacharias)
construction (Boneh-Zhandry 14)
Families of Constraints:
Circuits can handle only bounded length inputs!
for bounded number of users
Abusalah, Fuchsbauer, Pietrzak 14
Abusalah, Fuchsbauer, Pietrzak 14
Abusalah, Fuchsbauer, Pietrzak 14
Construction based on knowledge-type assumption
Obfuscator
P(x) = P’(x) for all inputs x
Security for obfuscation
Security for obfuscation
Virtual Black Box
Security for obfuscation
Virtual Black Box
Obfuscated code
≈
Oracle access to code
Security for obfuscation
Virtual Black Box
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001)
Security for obfuscation
Virtual Black Box
Differing inputs
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001)
Security for obfuscation
Virtual Black Box
Differing inputs
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001) If diO(P1) and diO(P2) are distinguishable, then one can extract differing input.
Security for obfuscation
Virtual Black Box
Differing inputs
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001) If diO(P1) and diO(P2) are distinguishable, then one can extract differing input. Implausibility results (Boyle et al, Garg et al, Bellare et al.)
Security for obfuscation
Virtual Black Box
Differing inputs
Public coins differing inputs
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001) If diO(P1) and diO(P2) are distinguishable, then one can extract differing input. Implausibility results (Boyle et al, Garg et al, Bellare et al.)
Security for obfuscation
Virtual Black Box
Differing inputs
Public coins differing inputs
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001) If diO(P1) and diO(P2) are distinguishable, then one can extract differing input. Implausibility results (Boyle et al, Garg et al, Bellare et al.) No implausibility results, but has ‘extractability’ nature
Security for obfuscation
Virtual Black Box
Differing inputs
Public coins differing inputs
Indistinguishability
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001) If diO(P1) and diO(P2) are distinguishable, then one can extract differing input. Implausibility results (Boyle et al, Garg et al, Bellare et al.) No implausibility results, but has ‘extractability’ nature
Security for obfuscation
Virtual Black Box
Differing inputs
Public coins differing inputs
Indistinguishability
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001) If diO(P1) and diO(P2) are distinguishable, then one can extract differing input. Implausibility results (Boyle et al, Garg et al, Bellare et al.) No implausibility results, but has ‘extractability’ nature If P1 and P2 functionally identical, then iO(P1) ≈ iO(P2)
Security for obfuscation
Virtual Black Box
Differing inputs
Public coins differing inputs
Indistinguishability
Obfuscated code
≈
Oracle access to code Impossibility results (Barak et al. 2001) If diO(P1) and diO(P2) are distinguishable, then one can extract differing input. Implausibility results (Boyle et al, Garg et al, Bellare et al.) No implausibility results, but has ‘extractability’ nature If P1 and P2 functionally identical, then iO(P1) ≈ iO(P2)
Abusalah, Fuchsbauer, Pietrzak 14
Construction based on public coins differing inputs obfuscator
Can we build a constrained PRF scheme for Turing machines based on indistinguishability obfuscation (iO)?
Can we build a constrained PRF scheme for Turing machines based on indistinguishability obfuscation (iO)?
iO for circuits
Boneh- Zhandry 14
Circuit constrained PRFs
Can we build a constrained PRF scheme for Turing machines based on indistinguishability obfuscation (iO)?
iO for circuits
Boneh- Zhandry 14
Circuit constrained PRFs iO for Turing Machines iO for circuits
K, Lewko, Waters 14
Can we build a constrained PRF scheme for Turing machines based on indistinguishability obfuscation (iO)?
iO for circuits
Boneh- Zhandry 14
Circuit constrained PRFs iO for Turing Machines iO for circuits
K, Lewko, Waters 14
Turing Machines constrained PRFs
??
Can we build a constrained PRF scheme for Turing machines based on indistinguishability obfuscation (iO)?
iO for circuits
Boneh- Zhandry 14
Circuit constrained PRFs iO for Turing Machines iO for circuits
K, Lewko, Waters 14
Turing Machines constrained PRFs
??
bounded length inputs only
Assuming iO (and one way functions), we show an Attribute Based Encryption scheme for Turing machines.
F R E E ! !
Selective Security
Chooses PRF key K. Selective Security
Chooses PRF key K. Selective Security x* y*= PRF(K, x*)
Chooses PRF key K. Selective Security x* y*= PRF(K, x*)
Mi K{Mi} Mi(x*) = 0
Chooses PRF key K. Guess PRF/random Selective Security x* y*= PRF(K, x*)
Mi K{Mi} Mi(x*) = 0
Indistinguishability Obfuscator C0, C1 functionally identical circuits. iO(C0) ≈ iO(C1)
Indistinguishability Obfuscator C0, C1 functionally identical circuits. iO(C0) ≈ iO(C1)
Candidate iO schemes for circuits:
Garg-Gentry-Halevi-Raykova-Sahai-Waters 13 Barak-Garg-Kalai-Paneth-Sahai 14 Zimmerman 14 …
PRF F with bounded length inputs
PRF F with bounded length inputs For unbounded inputs : Choose PRF key K, hash function H
PRF F with bounded length inputs For unbounded inputs : Choose PRF key K, hash function H Output F(K, v)
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
v Merkle Tree
Puncturable PRF F with bounded length inputs
Puncturable PRF F with bounded length inputs Choose puncturable PRF key K, special hash function H Our scheme’s PRF key : (K, H)
Puncturable PRF F with bounded length inputs Choose puncturable PRF key K, special hash function H Our scheme’s PRF key : (K, H)
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
Output F(K, v) v
Constrained key for Turing machine M
Next- Step
state, symbol state’, symbol’, head-movement
Constrained key for Turing machine M
Next- Step
state, symbol state’, symbol’, head-movement
K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
K{M} = H, iO(Prog-Iterate), iO(Prog-Start) Prog-Start
v sig
Output signature on (start-state, v).
K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
1 1 1
Hash
Prog-Start
v sig
Output signature on (start-state, v).
K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
Prog-Iterate K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
Prog-Iterate K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ v st, sym t, p st’, sym'
Hash
Prog-Iterate K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
Adversary not bound to correct execution.
If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ v st, sym t, p st’, sym'
Hash
Prog-Iterate K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
Adversary not bound to correct execution.
If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ v st, sym t, p st’, sym'
Hash
h’ Using h, verify sym at position p Using sym’, update h to h’ h
Hash of work tape
Prog-Iterate K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
Adversary not bound to correct execution.
Verify sig on (st, h) sig sig’ Output signature on (st’, h’) If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ v st, sym t, p st’, sym'
Hash
h’ Using h, verify sym at position p Using sym’, update h to h’ h
Hash of work tape
Prog-Iterate K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
Verify sig on (st, h) sig sig’ Output signature on (st’, h’) If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ v st, sym t, p st’, sym' h’ Using h, verify sym at position p Using sym’, update h to h’ h
Prog-Iterate K{M} = H, iO(Prog-Iterate), iO(Prog-Start)
Verify sig on (st, h) sig sig’ Output signature on (st’, h’) If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ v st, sym t, p st’, sym' h’ Using h, verify sym at position p Using sym’, update h to h’ h
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
H
H H
H H H H
H H H H H H H H
Output hash values at path from root to node, and their siblings 1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
Output hash values at path from root to node, and their siblings
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
Need hash values at path from root to node, and their siblings
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
Need hash values at path from root to node, and their siblings
H
H H
H H H H
H H H H H H H H
1 0 0 1 0 1 0 1 1 1 0 1 1 1 0 0
Need hash values at path from root to node, and their siblings
Chooses PRF key K.
Chooses PRF key K. x* y*= F(K, hash of x*)
Chooses PRF key K. x* y*= F(K, hash of x*)
v*
Chooses PRF key K. x* y*= F(K, hash of x*)
M K{M} = (H, iO(Prog-Start), iO(Prog-Iterate))
(s.t. M(x*) = 0)
v*
Chooses PRF key K. Guess PRF/random x* y*= F(K, hash of x*)
M K{M} = (H, iO(Prog-Start), iO(Prog-Iterate))
(s.t. M(x*) = 0)
v*
Chooses PRF key K. Guess PRF/random x* y*= F(K, hash of x*)
M K{M} = (H, iO(Prog-Start), iO(Prog-Iterate))
(s.t. M(x*) = 0)
Contains PRF key K v*
Prog-Iterate
Verify sig on st and h Output signature on st’ and h’ If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ Using h, verify sym at position p Using sym’, update h to h’
Prog-Iterate
Verify sig on st and h Output signature on st’ and h’ If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ Using h, verify sym at position p Using sym’, update h to h’
Prog-Iterate’
Verify sig on st and h Output signature on st’ and h’ Else if st’ = final, output F(K{v*}, v)
Next- Step
st, sym st’, sym’ Using h, verify sym at position p Using sym’, update h to h’ If st’ = final and v=v*, output ⍊
Prog-Iterate
Verify sig on st and h Output signature on st’ and h’ If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ Using h, verify sym at position p Using sym’, update h to h’
???
Prog-Iterate’
Verify sig on st and h Output signature on st’ and h’ Else if st’ = final, output F(K{v*}, v)
Next- Step
st, sym st’, sym’ Using h, verify sym at position p Using sym’, update h to h’ If st’ = final and v=v*, output ⍊
Primitives Required for our Construction:
(Collision resistant) Hash functions Signature Schemes Indistinguishability Obfuscation
Primitives Required for our Construction:
(Collision resistant) Hash functions Signature Schemes Indistinguishability Obfuscation Positional Accumulators Splittable Signature Schemes
Primitives Required for our Construction:
(Collision resistant) Hash functions Signature Schemes Indistinguishability Obfuscation Positional Accumulators Splittable Signature Schemes iO for Turing Machines
(K, Lewko, Waters 14)
Prog-Iterate
Verify sig on st and h Output signature on st’ and h’ If st’ = final, output F(K, v)
Next- Step
st, sym st’, sym’ Using h, verify sym at position p Using sym’, update h to h’
Prog-Iterate’
Verify sig on st and h Output signature on st’ and h’ Else if st’ = final, output F(K{v*}, v)
Next- Step
st, sym st’, sym’ Using h, verify sym at position p Using sym’, update h to h’
If st’ = final and v=v*, output ⍊
KLW techniques
way functions
way functions
and OWFs
way functions
and OWFs