Private Puncturable PRFs from Standard Lattice Assumptions

Transcription

1 Private Puncturable PRFs from Standard Lattice Assumptions Sam Kim Stanford University Joint work with Dan Boneh and Hart Montgomery

2 Pseudorandom Functions (PRFs) [GGM84]

3 Constrained PRFs [BW13, BGI13, KPTZ13] PRF with additional constrain functionality Constrained key k f can be used to evaluate at all points x X where f (x) = 1.

4 Constrained PRFs [BW13, BGI13, KPTZ13] Correctness: constrained evaluation at x X where f (x) = 1 yields PRF value at x

5 Constrained PRFs [BW13, BGI13, KPTZ13] Correctness: constrained evaluation at x X where f (x) = 1 yields PRF value at x Security: PRF value at points x X where f (x) = 0 are indistinguishable from random given the constrained key

6 Constrained PRFs [BW13, BGI13, KPTZ13] Many applications: Identity-Based Key Exchange, Optimal Broadcast Encryption [BW13],... Punctured Programming Paradigm [SW14]

7 Puncturable PRF Puncturing: f c (x) = { 1 c x 0 c = x Punctured key can evaluate the PRF at all but a single point

8 Puncturable PRF Puncturing: f c (x) = { 1 c x 0 c = x Punctured key can evaluate the PRF at all but a single point Can be constructed from standard GGM

9 Puncturable PRF Puncturing: f c (x) = { 1 c x 0 c = x Punctured key can evaluate the PRF at all but a single point Can be constructed from standard GGM (but punctured key leaks c)

10 Privately Constrained PRFs [BLW17] Can we build a constrained PRF where the constrained key for a function f hides f?

11 Privately Constrained PRFs [BLW17]

12 Privately Puncturing Correctness: constrained evaluation at x c yields F (k, x) Pseudorandomness: F (k, c) is indistinguishable from random Privacy: constrained key hides c

13 Distributed Point Functions [GI14, BGI15]

14 Distributed Point Functions [GI14, BGI15]

15 Distributed Point Functions [GI14, BGI15]

16 Distributed Point Functions [GI14, BGI15]

17 Distributed Point Functions [GI14, BGI15]

18 Distributed Point Functions [GI14, BGI15]

19 Distributed Point Functions [GI14, BGI15]

20 Distributed Point Functions [GI14, BGI15]

21 Distributed Point Functions [GI14, BGI15]

22 Distributed Point Functions [GI14, BGI15]

23 Construction

24 Construction

25 Construction

26 Learning with Errors (LWE) Assumption For A r Z n m q, s χ n, e χ m, u r Z m q (some low-norm distribution χ), distinguish between the two distributions A = a 1 a m, b T = s T A + e T c A = a 1 a m, u T

27 Matrix Circuit Encodings [BGGHNSVV14] Encode elements in x 1,... x l Z n q (A 1,..., A l ) f A f

28 Matrix Circuit Encodings [BGGHNSVV14] Encode elements in c 1,... c l {0, 1} n (A 1,..., A l ) eq(x, ) A x

29 Matrix Circuit Encodings [BGGHNSVV14] Encode elements in c 1,... c l {0, 1} n (A 1,..., A l ) eq(x, ) A x

30 Matrix Circuit Encodings [BGGHNSVV14] Encode elements in c 1,... c l {0, 1} n F (k, x) = s T A x + e

31 Matrix Circuit Encodings [BGGHNSVV14] Encode elements in c 1,... c l {0, 1} n F (k, x) = s T A x p

32 Matrix Circuit Encodings [BGGHNSVV14] Encode elements in c 1,... c l {0, 1} n F (k, x) = s T A x p (Public) Puncturable PRF [BV15]

33 Matrix Circuit Encodings [GVW15] Encode elements in c 1,... c l {0, 1} n F (k, x) = s T A x p

34 Matrix Circuit Encodings [GVW15] Encode elements in c 1,... c l {0, 1} n F (k, x) = s T A x p Include the encodings of FHE decryption key

35 Matrix Circuit Encodings [GVW15] Encode elements in c 1,... c l {0, 1} n F (k, x) = s T A x p Include the encodings of FHE decryption key Use asymmetric multiplication property!

36 To conclude... Concurrent Work [CC17]: Private Constrained PRF for NC 1 circuits Use instances of GGH15 multilinear maps reducible to LWE

37 To conclude... Concurrent Work [CC17]: Private Constrained PRF for NC 1 circuits Use instances of GGH15 multilinear maps reducible to LWE Extensions: Watermarkable PRFs from LWE Previously only known from obfuscation

38 Open Problems Private puncturable PRFs from other assumptions? (DDH, Pairings,...)

39 Open Problems Private puncturable PRFs from other assumptions? (DDH, Pairings,...) Other applications of privacy in constrained PRFs?

40 Open Problems Private puncturable PRFs from other assumptions? (DDH, Pairings,...) Other applications of privacy in constrained PRFs? Apply the techniques to predicate encryption?

41 Open Problems Private puncturable PRFs from other assumptions? (DDH, Pairings,...) Other applications of privacy in constrained PRFs? Apply the techniques to predicate encryption? Thanks!