Fully Key-Homomorphic Encryption and its Applications

Transcription

1 Fully Key-Homomorphic Encryption and its Applications D. Boneh, C. Gentry, S. Gorbunov, S. Halevi, Valeria Nikolaenko, G. Segev, V. Vaikuntanathan, D. Vinayagamurthy

2 Outline Background on PKE and IBE Functionality of FKHE Applications Future & current work Based on Fully Key-Homomorphic Encryption, Arithmetic Circuit ABE and Compact Garbled Circuits, EUROCRYPT 2014

3 Background: Public-Key Encryption (PKE) [Diffie and Hellman 1976; Rivest, Shamir, Adleman 1977] KeyGen (pk, sk) pk Decrypts using, gets m m Decrypts: Dec(sk, c) m c c = Enc(pk, m)

4 Background: Identity Based Encryption (IBE) Proposed by Shamir 1984, constructed by Boneh, Franklin and Cocks in 2001 IBE is a public key encryption scheme; public keys are identities pp does not need to know s public key Decrypts: Dec(sk, c) m c c = Enc(, m)

5 Functionality of FKHE IBE: Identities are x,y Z k q (attributes) FKHE: x Z k q, f Z q k Z q, y Z q Decrypts: Dec(sk y, c x ) m iff x == y c x c x = Enc(x, m) c x Decrypts: Dec(sk y,f, c x ) m iff f(x) == y c x = Enc(x, m)

6 Functionality of FKHE IBE: Identities are x,y Z k q (attributes) FKHE: x Z k q, f Z q k Z q, y Z q Decrypts: Dec(sk y, c x ) m iff x == y c x c x = Enc(x, m) Evaluates: Enc(x, m) Enc( <f(x), f>, m) c x c f(x), f Decrypts: Dec(sk y,f, c f(x),f ) m iff f(x) == y c x c x = Enc(x, m) Key Homomorphism

7 Functionality of FKHE II Setup(1 λ ) pp, msk KeyGen(msk, (y, f)) sk y, f Secret key for pk = (y, f) Secure under LWE Unbounded number of collusions Z q {Z q k Z q } Enc(pp, x, m) c x Encryption under pk = x Z k q Eval(pp, f, c x ) c f(x), f Encryption under pk = (f(x), f) {Z q k Z q } Dec(c f(x), f, sk y, f ) m iff f(x) = y

8 Applications: Attribute Based Encryption: short secret keys, arithmetic circuits Compressed Garbled Circuits

9 Attribute Based Encryption (ABE) [SW05] Charlie Policies: AND OR PhD student Computer Science PhD student GS Business Attributes: PhD student Electrical Engineering c Enc(m, Attributes ) sk sk Can decrypt if Policy(Attributes) = 1

10 Attribute Based Encryption Polices Attributes Security Key size SW05 Single threshold gates In ciphertext BDH GPSW06, HW13 Monotone formulas In key BDH O(size) BSW07 Monotone formulas In ciphertext Non-standard assumption O(size) GJPS08 Bounded size threshold gts In ciphertext DBDH LOSTW10 Monotone formulas In ciphertext Non-standard assumption O(size) OT10 Span programs In key DLIN ABVVW12 Single threshold In cipher LWE Wat12 DFA In key l-expanded BDHE OSW12 Any formula In key DBDH O(size) SW12, GGH12, GGHSW13 Boolean circuits In key, in cipher Multi-linear maps O(size) Boy13 Boolean formulas In key LWE O(size) GVW13 Boolean circuits In key LWE O(size) This Arithmetic circuits In key LWE O(depth)

11 ABE from FKHE Policy: f Policy: g Charlie Attribute: x Message: m Ciphertext: c x Enc(pp, x, m) sk = sk 1,f sk = sk 1,g KeyGen(msk, 1, f) sk 1,f KeyGen(msk, 1, g) sk 1,g

12 ABE from FKHE (decryption) Charlie c x Enc(x, m) (has sk 1,f ) Eval(f, c x ) Thm: FKHE is secure ABE is secure c f(x),f = Enc((f(x), f), m) If f(x) = 1 can decrypt with sk 1,f

13 Our new ABE (key policy) Arithmetic circuits, not just boolean Key size depends on depth, not on size Arbitrary fan-in gates Delegatable

14 Delegation Alicia Policy: f Delegate f AND g More restricted policy: sk f sk fλg Our scheme supports delegation: can create a custom restricted secret key herself.

15 Garbled Circuits [Yao 86]: (x) For new y, repeat Want to compute f(x, y), not revealing x or y garbled circuit: O( f ) OT: O( x + y ) (y) f(x, y) [GKPVZ 13]: reusable garbled circuit (x) For new y, repeat garbled circuit: O( f ) O( x + y ) Using our ABE: becomes short O(depth) (y) f(x, y)

16 Garbled Circuits [GKPVZ 13] [This] ABE FHE with short keys Garbled circuits O(depth) Reusable garbled circuits compressed

17 Future & current work FKHE hides neither x nor f Hiding x Functional Encryption Hiding f Program Obfuscation sk f c x = Enc(x) Dec(c x, sk f ) -> f(x) In FHE gets c f(x) = Enc( f(x) ) Ɵ(f) = sk f - Can compute f(x) for any x - Learns nothing about f

18 Thank you