Cryptanalysis of branching program obfuscators

Transcription

1 Cryptanalysis of branching program obfuscators Jung Hee Cheon 1, Minki Hhan 1, Jiseung Kim 1, Changmin Lee 1, Alice Pellet-Mary 2 1 Seoul National University 2 ENS de Lyon Crypto 2018 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

2 What is this talk about Two partial attacks against some candidate obfuscators built upon the GGH13 multilinear map [GGH13a] an attack for specific choices of parameters a quantum attack Main idea of the two attacks Transform known weaknesses of the GGH13 map into concrete attacks against the candidate obfuscators M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

3 Obfuscation Obfuscator An obfuscator O for a class of circuits C is an efficiently computable function over C such that C C, x, C(x) = O(C)(x) In this talk, C = polynomial size circuits M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

4 Obfuscation Obfuscator An obfuscator O for a class of circuits C is an efficiently computable function over C such that C C, x, C(x) = O(C)(x) In this talk, C = polynomial size circuits Security. VBB: O(C) acts as a black box computing C M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

5 Obfuscation Obfuscator An obfuscator O for a class of circuits C is an efficiently computable function over C such that C C, x, C(x) = O(C)(x) In this talk, C = polynomial size circuits Security. VBB: O(C) acts as a black box computing C (impossible, [BGI + 01]) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

6 Obfuscation Obfuscator An obfuscator O for a class of circuits C is an efficiently computable function over C such that C C, x, C(x) = O(C)(x) In this talk, C = polynomial size circuits Security. VBB: O(C) acts as a black box computing C (impossible, [BGI + 01]) io: C 1 C 2, i.e. C 1 (x) = C 2 (x) x, O(C 1 ) c O(C 2 ) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

7 Obfuscation Obfuscator An obfuscator O for a class of circuits C is an efficiently computable function over C such that C C, x, C(x) = O(C)(x) In this talk, C = polynomial size circuits Security. VBB: O(C) acts as a black box computing C (impossible, [BGI + 01]) io: C 1 C 2, i.e. C 1 (x) = C 2 (x) x, O(C 1 ) c O(C 2 ) Many cryptographic constructions from io: functional encryption, deniable encryption, NIZKs, oblivious transfer,... M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

8 Multilinear maps (mmaps) and io Observation Almost all io constructions for all circuits rely on multilinear maps (mmap). Three main candidate multilinear maps: GGH13, CLT13, GGH15 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

9 Multilinear maps (mmaps) and io Observation Almost all io constructions for all circuits rely on multilinear maps (mmap). Three main candidate multilinear maps: GGH13, CLT13, GGH15 Caution All these candidate multilinear maps suffer from weaknesses (e.g. encodings of zero, zeroizing attacks,... ). all current attacks against io rely on the underlying mmap M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

10 Multilinear maps (mmaps) and io Observation Almost all io constructions for all circuits rely on multilinear maps (mmap). Three main candidate multilinear maps: GGH13, CLT13, GGH15 Caution All these candidate multilinear maps suffer from weaknesses (e.g. encodings of zero, zeroizing attacks,... ). all current attacks against io rely on the underlying mmap In this talk: we exploit known weaknesses of GGH13 to mount concrete attacks against some io using it. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

11 History (branching program obfuscators based on GGH13) Some candidate io for all circuits and attacks: 2013: [GGH + 13b], first candidate : [AGIS14, BGK + 14, BR14, MSW14, PST14, BMSZ16], with proofs in idealized models (the mmap is supposed to be somehow ideal) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

12 History (branching program obfuscators based on GGH13) Some candidate io for all circuits and attacks: 2013: [GGH + 13b], first candidate : [AGIS14, BGK + 14, BR14, MSW14, PST14, BMSZ16], with proofs in idealized models (the mmap is supposed to be somehow ideal) 2016: [MSZ16], attack against all candidates above except [GGH + 13b] 2016: [GMM + 16], proof in a weaker idealized model (captures [MSZ16]) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

13 History (branching program obfuscators based on GGH13) Some candidate io for all circuits and attacks: 2013: [GGH + 13b], first candidate : [AGIS14, BGK + 14, BR14, MSW14, PST14, BMSZ16], with proofs in idealized models (the mmap is supposed to be somehow ideal) 2016: [MSZ16], attack against all candidates above except [GGH + 13b] 2016: [GMM + 16], proof in a weaker idealized model (captures [MSZ16]) 2017: [CGH17], attack against [GGH + 13b] (in input-partitionable case) 2017: [FRS17], prevent [CGH17] attack M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

14 State of the art and contributions Attacks io (using GGH13) Branching program obfuscators [GGH + 13b] [BR14] [AGIS14, MSW14] [PST14, BGK + 14] [BMSZ16] [GMM + 16] Circuit obfuscators [Zim15, AB15] [DGG + 16] [MSZ16] [CGH17] This work 1 [CHKL18] This work 2 [Pel18] for input-partitionable branching programs for specific choices of parameters in the quantum setting M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

15 Outline 1 Simple obfuscator 2 GGH13 multilinear map 3 Contributions M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

16 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

17 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A 0 A A 1,0 A 2,0 A 3,0 A 4,0 A 5,0 A 7 6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

18 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A 0 A A 1,0 A 2,0 A 3,0 A 4,0 A 5,0 A 7 6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

19 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A A1,0 A 2,0 A 3,0 A 4,0 A 5,0 A 7 6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

20 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A A1,0 A2,0 A 3,0 A 4,0 A 5,0 A 7 6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

21 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A A1,0 A2,0 A3,0 A 4,0 A 5,0 A 7 6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

22 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A A1,0 A2,0 A3,0 A4,0 A 5,0 A 7 6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

23 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A A1,0 A2,0 A3,0 A4,0 A5,0 A 7 6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

24 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A 7 A1,0 A2,0 A3,0 A4,0 A5,0 A6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

25 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 A 7 A1,0 A2,0 A3,0 A4,0 A5,0 A6,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

26 Branching programs A branching program is a way of representing a function (like a Turing machine, or a circuit). A Branching Program (BP) is a collection of 2l matrices A i,b (for i {1,..., l} and b {0, 1}), two vectors A 0 and A l+1, a function inp : {1,..., l} {1,..., r} (where r is the size of the input). i inp(i) x = A A 0 1,1 A 2,1 A 3,1 A 4,1 A 5,1 A 6,1 = 0 0 A 7 A1,0 A2,0 A3,0 A4,0 A5,0 A6,0 0 1 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

27 Cryptographic multilinear maps Definition: κ-multilinear map Different levels of encodings, from 1 to κ. Denote by Enc(a, i) a level-i encoding of the message a. Addition: Add(Enc(a 1, i), Enc(a 2, i)) = Enc(a 1 + a 2, i). Multiplication: Mult(Enc(a 1, i), Enc(a 2, j)) = Enc(a 1 a 2, i + j). Zero-test: Zero-test(Enc(a, κ)) = True iff a = 0. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

28 Simple obfuscator Input: A branching program Randomize the branching program Add random diagonal blocks Killian s randomization Multiply by random (non zero) bundling scalars Encode the matrices using GGH13 Output: The encoded matrices and vectors A 1,1 A 2,1 A 3,1 A 0 A 4 A 1,0 A 2,0 A 3,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

29 Simple obfuscator Input: A branching program Randomize the branching program Add random diagonal blocks Killian s randomization Multiply by random (non zero) bundling scalars Encode the matrices using GGH13 Output: The encoded matrices and vectors B 1,1 B 2,1 B 3,1 0 A 0 A 1,1 B 1,0 A 2,1 B 2,0 A 3,1 B 3,0 A 4 A 1,0 A 2,0 A 3,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

30 Simple obfuscator Input: A branching program Randomize the branching program Add random diagonal blocks Killian s randomization Multiply by random (non zero) bundling scalars Encode the matrices using GGH13 Output: The encoded matrices and vectors R A 1 1 1,1 R 2 R A 2 1 2,1 R 3 R A 3 1 3,1 R 4 A 0 R 1 R 1 4 A 4 R A 1 1 1,0 R 2 R A 2 1 2,0 R 3 R A 3 1 3,0 R 4 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

31 Simple obfuscator Input: A branching program Randomize the branching program Add random diagonal blocks Killian s randomization Multiply by random (non zero) bundling scalars Encode the matrices using GGH13 Output: The encoded matrices and vectors α 1,1 A 1,1 α 2,1 A 2,1 α 3,1 A 3,1 A 0 A 4 α 1,0 A 1,0 α 2,0 A 2,0 α 3,0 A 3,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

32 Simple obfuscator Input: A branching program Randomize the branching program Add random diagonal blocks Killian s randomization Multiply by random (non zero) bundling scalars Encode the matrices using GGH13 Output: The encoded matrices and vectors à 1,1 à 2,0 à 2,0 à 0 à 4 à 1,0 à 2,0 à 2,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

33 Simple obfuscator Input: A branching program Randomize the branching program Add random diagonal blocks Killian s randomization Multiply by random (non zero) bundling scalars Encode the matrices using GGH13 Output: The encoded matrices and vectors Enc( Ã 0 ) Enc( ) Ã 1,1 Enc( ) Ã 2,0 Enc( ) Ã 2,0 Enc( Ã 4 ) Enc( ) Ã 1,0 Enc( ) Ã 2,0 Enc( ) Ã 2,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

34 Outline 1 Simple obfuscator 2 GGH13 multilinear map 3 Contributions M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

35 The GGH13 multilinear map Define R = Z[X ]/(X n + 1) with n = 2 k. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

36 The GGH13 multilinear map Define R = Z[X ]/(X n + 1) with n = 2 k. The plaintext space is P = R/ g for a small element g in R. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

37 The GGH13 multilinear map Define R = Z[X ]/(X n + 1) with n = 2 k. The plaintext space is P = R/ g for a small element g in R. The encoding space is R q = R/(qR) = Z q [X ]/(X n + 1) for a large integer q. We write [x] q the elements in R q for x R. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

38 The GGH13 multilinear map: encodings and zero-test Sample z uniformly in R q and h in R of the order of q 1/2. Encoding: An encoding of a at level i is u = [(a + rg)z i ] q where a + rg is a small element in a + g. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

39 The GGH13 multilinear map: encodings and zero-test Sample z uniformly in R q and h in R of the order of q 1/2. Encoding: An encoding of a at level i is u = [(a + rg)z i ] q where a + rg is a small element in a + g. Zero-testing: A zero-testing parameter is defined by p zt = [z κ hg 1 ] q. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

40 The GGH13 multilinear map: encodings and zero-test Sample z uniformly in R q and h in R of the order of q 1/2. Encoding: An encoding of a at level i is u = [(a + rg)z i ] q where a + rg is a small element in a + g. Zero-testing: A zero-testing parameter is defined by p zt = [z κ hg 1 ] q. Zero-test To test if u = [cz κ ] q is an encoding of zero (i.e. c = 0 mod g), compute [u p zt ] q = [chg 1 ] q. This is small iff c is a small multiple of g. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

41 Outline 1 Simple obfuscator 2 GGH13 multilinear map 3 Contributions M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

42 Global ideas of the two attacks Main idea Transform known weaknesses of the GGH13 map into concrete attacks against the candidate obfuscators. 1 or classical sub-exponential time [BEF + 17] for specific (unused) parameters M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

43 Global ideas of the two attacks Main idea Transform known weaknesses of the GGH13 map into concrete attacks against the candidate obfuscators. Attack 1 [CHKL18]: NTRU attack [ABD16, CJL16, KF17] classical polynomial time, for specific choices of parameters 1 or classical sub-exponential time [BEF + 17] for specific (unused) parameters M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

44 Global ideas of the two attacks Main idea Transform known weaknesses of the GGH13 map into concrete attacks against the candidate obfuscators. Attack 1 [CHKL18]: NTRU attack [ABD16, CJL16, KF17] classical polynomial time, for specific choices of parameters Attack 2 [Pel18]: short principal ideal problem algorithm [CDPR16] quantum polynomial time [BS16] 1 1 or classical sub-exponential time [BEF + 17] for specific (unused) parameters M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

45 Attack 1: Starting point = NTRU For two encodings [a 1 z 1 ] q, [a 2 z 1 ] q for small a 1, a 2, we can compute [a 1 z 1 ] q [a 2 z 1 ] 1 q = [a 1 /a 2 ] q M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

46 Attack 1: Starting point = NTRU For two encodings [a 1 z 1 ] q, [a 2 z 1 ] q for small a 1, a 2, we can compute [a 1 z 1 ] q [a 2 z 1 ] 1 q = [a 1 /a 2 ] q Using the NTRU solver [ABD16, CJL16, KF17], we can obtain (c a 1, c a 2 ) R 2 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

47 Attack 1: Starting point = NTRU For two encodings [a 1 z 1 ] q, [a 2 z 1 ] q for small a 1, a 2, we can compute [a 1 z 1 ] q [a 2 z 1 ] 1 q = [a 1 /a 2 ] q Using the NTRU solver [ABD16, CJL16, KF17], we can obtain (c a 1, c a 2 ) R 2 For another encoding [a 3 z 1 ] q, compute [a 3 z 1 ] q /[a 1 z 1 ] q (c a 1 ) = c a 3 R. M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

48 Attack 1: Starting point = NTRU For two encodings [a 1 z 1 ] q, [a 2 z 1 ] q for small a 1, a 2, we can compute [a 1 z 1 ] q [a 2 z 1 ] 1 q = [a 1 /a 2 ] q Using the NTRU solver [ABD16, CJL16, KF17], we can obtain (c a 1, c a 2 ) R 2 For another encoding [a 3 z 1 ] q, compute Simultaneous NTRU solver [a 3 z 1 ] q /[a 1 z 1 ] q (c a 1 ) = c a 3 R. ([a i z 1 ] q ) i (c a i R) i or, for GGH13 encodings, Enc(A) c (A + R g) Mat(R) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

49 Attack 1: Starting point = NTRU For two encodings [a 1 z 1 ] q, [a 2 z 1 ] q for small a 1, a 2, we can compute [a 1 z 1 ] q [a 2 z 1 ] 1 q = [a 1 /a 2 ] q Using the NTRU solver [ABD16, CJL16, KF17], we can obtain (c a 1, c a 2 ) R 2 For another encoding [a 3 z 1 ] q, compute Simultaneous NTRU solver [a 3 z 1 ] q /[a 1 z 1 ] q (c a 1 ) = c a 3 R. ([a i z 1 ] q ) i (c a i R) i or, for GGH13 encodings, Enc(A) c (A + R g) Mat(R) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

50 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? Enc(Ã0) Enc(Ã1,1) Enc(Ã2,1) Enc(Ã3,1) Enc(Ã4) Enc(Ã1,0) Enc(Ã2,0) Enc(Ã3,0) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

51 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? c 0(Ã0 + R0g) c 1,1(Ã1,1 + R1,1g) c 2,1(Ã2,1 + R2,1g) c 3,1(Ã3,1 + R3,1g) c 4(Ã4 + R4g) c 1,0(Ã1,0 + R1,0g) c 2,0(Ã2,0 + R2,0g) c 3,0(Ã3,0 + R3,0g) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

52 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? c 0(Ã0 + R0g) c 1,1(Ã1,1 + R1,1g) c 2,1(Ã2,1 + R2,1g) c 3,1(Ã3,1 + R3,1g) c 4(Ã4 + R4g) c 1,0(Ã1,0 + R1,0g) c 2,0(Ã2,0 + R2,0g) c 3,0(Ã3,0 + R3,0g) These matrices R rather than R q M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

53 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? BP matrix output 0 Enc(Ã) enc(0)= [rg/z κ ] q M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

54 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? BP matrix output 0 Enc(Ã) enc(0)= [rg/z κ ] q c(ã + Rg) c rg M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

55 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? BP matrix output 0 Enc(Ã) enc(0)= [rg/z κ ] q c(ã + Rg) c rg Collecting several top level zeros, recover g M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

56 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? BP matrix output 0 Enc(Ã) enc(0)= [rg/z κ ] q c(ã + Rg) c rg cã mod g Collecting several top level zeros, recover g M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

57 Attack 1 Input: An obfuscated program O(P) and plain program Q De-randomize the branching program Solve NTRU simultaneously Recover g using zero of program Distinguish by Matrix Zeroizing Attack Result: Distinguishing Attack: P = Q? BP matrix output 0 Enc(Ã) enc(0)= [rg/z κ ] q c(ã + Rg) c rg cã mod g cã mod g do not contain the randomness r and level parameter z M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

58 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

59 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways (omitted) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

60 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways (omitted) Mixed-input attack can be carried out! M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

61 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways (omitted) Mixed-input attack can be carried out! Invalid inputs can induce the different outputs of equivalent BPs M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

62 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways (omitted) Mixed-input attack can be carried out! Invalid inputs can induce the different outputs of equivalent BPs i inp(i) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

63 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways (omitted) Mixed-input attack can be carried out! Invalid inputs can induce the different outputs of equivalent BPs i inp(i) Ã 1,1 Ã 2,1 Ã 3,1 B 1,1 B 2,1 B 3,1 Ã 0 B0 Ã 4 B 4 Ã 1,0 Ã 2,0 Ã 3,0 B 1,0 B 2,0 B 3,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

64 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways (omitted) Mixed-input attack can be carried out! Invalid inputs can induce the different outputs of equivalent BPs i inp(i) invalid input indices à 1,1 à 2,1 à 3,1 B 1,1 B 2,1 B 3,1 à 0 B0 à 4 B 4 à 1,0 à 2,0 à 3,0 B 1,0 B 2,0 B 3,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

65 Attack 1: Mixed-input Attack We remove the effects of scalar bundlings using algebraic ways (omitted) Mixed-input attack can be carried out! Invalid inputs can induce the different outputs of equivalent BPs i inp(i) invalid input indices à 1,1 à 2,1 à 3,1 B 1,1 B 2,1 B 3,1 à 0 à 4 B 0 B 4 à 1,0 à 2,0 à 3,0 B 1,0 B 2,0 B 3,0 outputs zero outputs non-zero M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

66 Attack 1: Matrix Zeroizing Attack We remove the effects of scalar bundlings using algebraic ways (omitted) Matrix-zeroizing attack: extended mixed-input attack Invalid inputs can induce the different outputs of equivalent BPs Summation of mixed-input can yield the different outputs of BPs i inp(i) invalid input 010, 011, 100, 101, Ã0 Ã 4 B 0 B 4 Ã 1,1 Ã 2,1 Ã 3,1 B 1,1 B 2,1 B 3,1 Ã 1,0 Ã 2,0 Ã 3,0 B 1,0 B 2,0 B 3,0 outputs zero outputs non-zero M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

67 Attack 2: Starting point = Principal Ideal Problem We compute for evaluation of program with output 0 [up zt ] q = rh R M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

68 Attack 2: Starting point = Principal Ideal Problem We compute for evaluation of program with output 0 [up zt ] q = rh R Using SPIP solver, we obtain h R in quantum polytime [BS16, CDPR16] M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

69 Attack 2: Starting point = Principal Ideal Problem We compute for evaluation of program with output 0 [up zt ] q = rh R Using SPIP solver, we obtain h R in quantum polytime [BS16, CDPR16] We can compute the double-zero testing parameter at level 2κ: [(p zt /h) 2 ] q = [z 2κ g 2 ] q M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

70 Attack 2: Starting point = Principal Ideal Problem We compute for evaluation of program with output 0 [up zt ] q = rh R Using SPIP solver, we obtain h R in quantum polytime [BS16, CDPR16] We can compute the double-zero testing parameter at level 2κ: [(p zt /h) 2 ] q = [z 2κ g 2 ] q New Zerotesting Procedure We can run 2κ level zerotest, or 2κ level obfuscated program M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

71 Attack 2: Mixed-input Attack Run mixed-input attack on obfuscated program at level κ i inp(i) Ã 1,1 Ã 2,1 Ã 3,1 Ã 0 Ã 4 Ã 1,0 Ã 2,0 Ã 3,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

72 Attack 2: Mixed-input Attack Run mixed-input attack on obfuscated program at level κ i inp(i) invalid input indices à 1,1 à 2,1 à 3,1 à 0 à 4 à 1,0 à 2,0 à 3,0 M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

73 Attack 2: Mixed-input Attack Run mixed-input attack on obfuscated program at level κ We cannot evaluate it in obfuscated program due to constructions 2 i inp(i) invalid input indices à 1,1 à 2,1 à 3,1 à 0 à 4 à 1,0 à 2,0 à 3,0 2 level parameters, scalar bundlings M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

74 Attack 2: Mixed-input Attack Run mixed-input attack on obfuscated program at level κ We cannot evaluate it in obfuscated program due to constructions 2 i inp(i) invalid input indices à 1,1 à 2,1 à 3,1 à 0 à 4 à 1,0 à 2,0 à 3,0 2 level parameters, scalar bundlings M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

75 Attack 2: Mixed-input Attack Run mixed-input attack on obfuscated program at level κ We cannot evaluate it in obfuscated program due to constructions 2 Construct 2κ-level obfuscated program i inp(i) invalid input indices à 1,1 à 2,1 à 3,1 à 1,1 à 2,1 à 3,1 à 0 à 4 à 0 à 4 à 1,0 à 2,0 à 3,0 à 1,0 à 2,0 à 3,0 2 level parameters, scalar bundlings M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

76 Attack 2: Mixed-input Attack Run mixed-input attack on obfuscated program at level κ We cannot evaluate it in obfuscated program due to constructions 2 Construct 2κ-level obfuscated program Run mixed-input attack on obfuscated program at level 2κ i inp(i) invalid input indices à 1,1 à 2,1 à 3,1 à 1,1 à 2,1 à 3,1 à 0 à 4 à 0 à 4 à 1,0 à 2,0 à 3,0 à 1,0 à 2,0 à 3,0 2 level parameters, scalar bundlings M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

77 Summary and work in progress Attacks io (using GGH13) Branching program obfuscators [GGH + 13b] [BR14] [AGIS14, MSW14] [PST14, BGK + 14] [BMSZ16] [GMM + 16] Circuit obfuscators [Zim15, AB15] [DGG + 16] [MSZ16] [CGH17] This work 1 [CHKL18] This work 2 [Pel18] for input-partitionable branching programs for specific choices of parameters in the quantum setting M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

78 Summary and work in progress Attacks io (using GGH13) Branching program obfuscators [GGH + 13b] [BR14] [AGIS14, MSW14] [PST14, BGK + 14] [BMSZ16] [GMM + 16] Circuit obfuscators [Zim15, AB15] [DGG + 16] [MSZ16] [CGH17] This work 1 [CHKL18]? This work 2 [Pel18]? for input-partitionable branching programs for specific choices of parameters in the quantum setting M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

79 Work in progress [GGH + 13b] in quantum world M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

80 Work in progress [GGH + 13b] in quantum world Combination! =Double-zero testing + Matrix-zeroizing attack M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

81 Work in progress [GGH + 13b] in quantum world Combination! =Double-zero testing + Matrix-zeroizing attack Circuit obfuscations in classical world M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

82 Work in progress [GGH + 13b] in quantum world Combination! =Double-zero testing + Matrix-zeroizing attack Circuit obfuscations in classical world Extending the NTRU attack! M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

83 Perspectives / Open problems Obfuscation for evasive functions Countermeasure on the attacks Parameter constraints to prevent our classical attack 3 : n = Ω(κ 2 λ) 3 n: dimension of space, κ: multilinearity level, λ: security parameter To prevent classical PIP attack and our attack: n = Ω(max(κ 2 λ, λ 2 )) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

84 Perspectives / Open problems Obfuscation for evasive functions Countermeasure on the attacks Parameter constraints to prevent our classical attack 3 : n = Ω(κ 2 λ) Remark Proofs in idealized models VS Constructions with concrete schemes 3 n: dimension of space, κ: multilinearity level, λ: security parameter To prevent classical PIP attack and our attack: n = Ω(max(κ 2 λ, λ 2 )) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

85 Perspectives / Open problems Obfuscation for evasive functions Countermeasure on the attacks Parameter constraints to prevent our classical attack 3 : n = Ω(κ 2 λ) Remark Proofs in idealized models VS Constructions with concrete schemes Many concrete schemes are not fit in the idealized model 3 n: dimension of space, κ: multilinearity level, λ: security parameter To prevent classical PIP attack and our attack: n = Ω(max(κ 2 λ, λ 2 )) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

86 Perspectives / Open problems Obfuscation for evasive functions Countermeasure on the attacks Parameter constraints to prevent our classical attack 3 : n = Ω(κ 2 λ) Remark Proofs in idealized models VS Constructions with concrete schemes Many concrete schemes are not fit in the idealized model This gap can cause a significant weakness of the concrete scheme! 3 n: dimension of space, κ: multilinearity level, λ: security parameter To prevent classical PIP attack and our attack: n = Ω(max(κ 2 λ, λ 2 )) M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

87 Thank you! 감사합니다! Merci! For more details, see papers or eprint reports Quantum attack: ia.cr/2018/533 Classical attack: ia.cr/2018/408 Combined/Extended work: Coming Soon..? M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

88 References I Benny Applebaum and Zvika Brakerski. Obfuscating circuits via composite-order graded encoding. In TCC 2015, pages , Martin R. Albrecht, Shi Bai, and Léo Ducas. A subfield lattice attack on overstretched NTRU assumptions - cryptanalysis of some FHE and graded encoding schemes. In Crypto 2016, pages , Prabhanjan Ananth, Divya Gupta, Yuval Ishai, and Amit Sahai. Optimizing obfuscation: Avoiding barrington s theorem. In CCS 2014, pages ACM, Jean-François Biasse, Thomas Espitau, Pierre-Alain Fouque, Alexandre Gélin, and Paul Kirchner. Computing generator in cyclotomic integer rings. In Eurocrypt 2017, pages Springer, Boaz Barak, Oded Goldreich, Rusell Impagliazzo, Steven Rudich, Amit Sahai, Salil Vadhan, and Ke Yang. On the (im) possibility of obfuscating programs. In Crypto 2001, pages Springer, Boaz Barak, Sanjam Garg, Yael Tauman Kalai, Omer Paneth, and Amit Sahai. Protecting obfuscation against algebraic attacks. In Eurocrypt 2014, pages , Saikrishna Badrinarayanan, Eric Miles, Amit Sahai, and Mark Zhandry. Post-zeroizing obfuscation: New mathematical tools, and the case of evasive circuits. In Eurocrypt 2016, pages , M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

89 References II Zvika Brakerski and Guy N Rothblum. Obfuscating conjunctions. Crypto 2014, Jean-François Biasse and Fang Song. Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields. In SODA 2016, pages Society for Industrial and Applied Mathematics, Ronald Cramer, Léo Ducas, Chris Peikert, and Oded Regev. Recovering short generators of principal ideals in cyclotomic rings. In Eurocrypt 2016, pages , Yilei Chen, Craig Gentry, and Shai Halevi. Cryptanalyses of candidate branching program obfuscators. In Eurocrypt 2017, pages Springer, Jung Hee Cheon, Jinhyuck Jeong, and Changmin Lee. An algorithm for ntru problems and cryptanalysis of the ggh multilinear map without a low-level encoding of zero. LMS Journal of Computation and Mathematics, 19(A): , Nico Döttling, Sanjam Garg, Divya Gupta, Peihan Miao, and Pratyay Mukherjee. Obfuscation from low noise multilinear maps. eprint, Report 2016/599, Rex Fernando, Peter Rasmussen, and Amit Sahai. Preventing CLT attacks on obfuscation with linear overhead. In Asiacrypt 2017, pages , M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

90 References III Sanjam Garg, Craig Gentry, and Shai Halevi. Candidate multilinear maps from ideal lattices. In Eurocrypt 2017, pages Springer, Sanjam Garg, Craig Gentry, Shai Halevi, Mariana Raykova, Amit Sahai, and Brent Waters. Candidate indistinguishability obfuscation and functional encryption for all circuits. FOCS 2013, Sanjam Garg, Eric Miles, Pratyay Mukherjee, Amit Sahai, Akshayaram Srinivasan, and Mark Zhandry. Secure obfuscation in a weak multilinear map model. In TCC 2016, pages , Paul Kirchner and Pierre-Alain Fouque. Revisiting lattice attacks on overstretched ntru parameters. In Eurocrypt 2017, pages Springer, Eric Miles, Amit Sahai, and Mor Weiss. Protecting obfuscation against arithmetic attacks. eprint, Report 2014/878, Eric Miles, Amit Sahai, and Mark Zhandry. Annihilation attacks for multilinear maps: Cryptanalysis of indistinguishability obfuscation over GGH13. In Crypto 2016, pages , Rafael Pass, Karn Seth, and Sidharth Telang. Indistinguishability obfuscation from semantically-secure multilinear encodings. In Crypto 2014, pages , M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23

91 References IV Joe Zimmerman. How to obfuscate programs directly. In Eurocrypt 2015, pages , M. Hhan, A. Pellet-Mary Cryptanalysis of branching program obfuscators Crypto /23