brent waters
DESCRIPTION
How to Use Indistinguishability Obfuscation. Amit Sahai. Brent Waters. Code Obfuscation. Goal: Make program (maximally) unintelligible. Obfuscator. 2. Applications!. Demo or “ need to know ” software. Software Patching. - PowerPoint PPT PresentationTRANSCRIPT
Brent WatersAmit Sahai
How to Use Indistinguishability Obfuscation
2
Code Obfuscation
Goal: Make program (maximally) unintelligible
Obfuscator
3
Applications!
Demo or “need to know” software
Software Patching
Crypto galore: Traitor Tracing, Functional Encryption, Deniable Encryption, …
4
Difficulty of Achieving Obfuscation
Recent: General candidate [GGHRSW13] using multilinear maps [GGH13]
Initial Functionalities:
•Point Functions [LPS04, …] and hyperplanes [CRV10]
•Explanation of existing functionality[OS05, HRSV07]
What does this mean?
• Some (contrived) counter-examples [BGIRSVY 01]
vs.
5
Idealized Obfuscation
• Natural for applications, building crypto
Idea: Learn nothing more than with black box access
No broad candidate class of obfuscatable functionalities
Generic group proofs [BR13,BGKPS13]
• What is it good for?
Indistinguishability Obfuscation
• Avoids negative results of [BGIRSVY01]
Idea: Cannot distinguish between obfuscations of two input/output equivalent circuits • a (b+c) vs. ab + ac
7
Vision: IO as hub for cryptography
Indistinguishabilty Obfuscation
Standard Assumption (e.g. LWE)
“Most” of cryptography
This talk
+ OWFs
How do we build public key encryption from Indistinguishability Obfuscation?
9
Punctured Programs Technique
Punctured PRF key: K{x*} eval PRF on all points, but x*
Remove key element of program:
•Attacker cannot win without it
•Does not change functionality
Special case of constrained PRFs [BW13,BGI13,KPTZ13]
Build from [GGM84]
Security: Cannot distinguish F(K,x*) and random given K{x*}
10
Initial Attempt
Problems:
(1) Program knows PRF at t*
(2) If puncture out, will not be equivalent!
Setup: Choose Punctured PRF key K, PK= obfuscation of
11
Simple PKE from iO
Setup: Choose Punctured PRF key K, PK= obfuscation of
Encrypt(m): Choose random r; input m,r into programDecrypt(K,CT=(c1,c2)):
Decryption is fast = symmetric key
12
Proof of Encryption Scheme
Hyb 0: IND-CPA
13
Proof of Encryption Scheme
Hyb 0: IND-CPA
Hyb 1: t* is random
PRG security
14
Proof of Encryption Scheme
Hyb 0: IND-CPA
Hyb 1: t* is random
PRG security
Hyb 2: Use K{t*}
iO security
15
Proof of Encryption Scheme
Hyb 0: IND-CPA
Hyb 1: t* is random
PRG security
Hyb 2: Use K{t*}
iO security
Hyb 3: Replace F(K,t*) w/ z*
Punctured PRF security
16
A Very Simple CCA-KEM
Setup: Choose Punctured PRF key K, PK= obfuscation of
Encrypt: Choose random r, give as input
Decrypt(K,c):
How about signatures?
18
Natural Candidate
Setup: Choose Punctured PRF key K, VK= obfuscation of
Works with heuristic, but how to prove??
19
A Signature Scheme
Setup: Choose Punctured PRF key K, VK= obfuscation of
Verify(VK,m,s): Input m,s into verify program
Sign(K,m):
Signing is fast = symmetric key
f is a OWF
20
Proof of Signature Scheme
Hyb 0: (Selective) Signature Security [GMR84]
21
Proof of Signature Scheme
Hyb 0: (Selective) Signature Security [GMR84]
Hyb 1: Punctured Program
iO security
22
Proof of Signature Scheme
Hyb 0: (Selective) Signature Security [GMR84]
Hyb 1: Punctured ProgramHyb 2: z* random
iO security
Punctured PRF security
23
Other Core Primitives
NIZKs[BDMP91]
•Sign x if x is in L
•Succinct proofs
Semi Honest Oblivious Transfer[R81]
Injective Trapdoor Functions
Simple CCA secure KEM
24
The rest of the talk
(1)Deniable Encryption
(2) Functional Encryption [GGHRSW13]
(3) Open Directions
Deniable Encryption
26
Deniable Encryption [CDNO97]
Enc(PK, m= ,r) -> CT
Demands message and randomness!
Fake r’ where
Enc(PK, m= ,r’) -> CT
Anthony
Best solutions attacker adv. 1/n, n~ size of pub key
Problematic for encrypting many messages
27
Publicly Deniable Encryption Anyone can explain!
Setup(n) -> PK,SK
Encrypt(PK,m;u)-> c
Decrypt(SK,c) -> mExplain(PK,c,m;r) -> u’
(1) IND-CPA Security
(2) Indistinguishability of Explanation
Two security properties (implies standard deniable)
Advantage of separation: Simpler proofs
Single message game
28
Hidden Sparse Triggers
Idea: Negligible fraction of random space are “trigger values” that cause bypass normal encryption to specific value
Explain(PK, C): Encoding of C in Hidden Trigger Set
Encrypt(PK,m;u): Checks if randomness in trigger set
If yes, decrypts encoding to CT; else does fresh encrypt
Hidden triggers
Randomness Space
29
An Attempt and Malleability Issues
Encrypt:
Explain:
Malleability Attack!
30
Our Deniable Encryption System
Encrypt:
Explain:
31
Proof Overview
IND-CPA Proof: Simple proof; obfuscation not used
Explainability:
•Encoding: Look like random string & non-malleable
•Intricate multistep hybrid proof
32
Using Deployed Keys
Receiver may:
•Already have established key
•Be disinterested/uninterested in D.E.
Universal Deniable Encryption: D.E. to ordinary keys
•One time (uncorrupted) trusted setup
•Use to deniably encrypt to any PK
•Takes Encryption function as input
Functional Encryption
34
Functional Encryption [SW05…]
Public Parameters
Authority
MSK
Key: f
SK
CT: x
Functionality: Learn f(x); x is hidden
Collusion Bounded & Applications:SS10, PRV12, AGVW13, GKVPZ13
X
Collusion Resistance core to concept! (Like IBE)
35
An Application: Facial Identification
SK
36
Tools
Statistically Simulation Sound NIZKs
•Statistically sound except for simulated statement
•Build from WI proofs
Two Key Technique [NY90,S99]
37
Functional Encryption System [GGHRSW13]
Setup: Generate two keys pairs (PK1,SK1), (PK2,SK2) output CRS from NIZK setup
Encrypt(PP,m): Encrypt m under each of PK1, PK2, generate proof p of this
KeyGen(SK1,f): Obfuscate program
Decrypt(CT, SKf): Run obfuscated program on CT
38
Proof Overview
Challenge CT:
Keys:
39
Step 1
Challenge CT:
Keys:
NIZK security
40
Step 2
Challenge CT:
Keys:
IND-CPA security
41
Step 3
Challenge CT:
Keys:
IO security
42
Step 4
Challenge CT:
Keys:
IND-CPA security
43
Step 5
Challenge CT:
Keys:
IO security
44
Step 6
Challenge CT:
Keys:
NIZK security
GGHRSW 2013: Functional Encryption for any circuit45
Evolution of Functional Encryption
Sahai-Waters 2005: Introduction of Attribute-Based Encryption
GPSW 2006: Access Control (ABE) for any boolean formula
BW 2007, KSW08: “Predicate Encryption”; dot product functionalityTalks 2008: “Rebranded” as Functional Encryption , BSW11 reformalized (BSW11+O10 added simulation def.)
FE at 2013: Still Inner Product (& Applications)
Best we can do with bilinear maps
GGHSW13/GVW13: ABE for circuits
46
Evolution of Functional Encryption
Obfuscation
Looking Forward
48
Explosion of Obfuscation
• Replacing a Random Oracle: Full Domain Hash From Indistinguishability Obfuscation [HSW]
• Obfuscating Branching Programs Using Black-Box Pseudo-Free Groups [CV]
• Virtual Black-Box Obfuscation for All Circuits via Generic Graded Encoding [BR]
• Two-round secure MPC from Indistinguishability Obfuscation [GGSR]
• Protecting Obfuscation Against Algebraic Attacks [BGKPS]
• Indistinguishability Obfuscation vs. Auxiliary-Input Extractable Functions: One Must Fall [BCPR]
• Multiparty Key Exchange, Efficient Traitor Tracing, and More from Indistinguishability Obfuscation [BZ]
• There is no Indistinguishability Obfuscation in Pessiland [MR]
• On Extractability Obfuscation [BCP]
• A Note on the Impossibility of Obfuscation with Auxiliary Input [GK]
• Separations in Circular Security for Arbitrary Length Key Cycles [RVW]
• Obfuscation for Evasive Functions [BBCKPS]
• Differing-Inputs Obfuscation and Applications [ABGSZ]
• More on the Impossibility of Virtual-Black-Box Obfuscation with Auxiliary Input [BCPR]
• Multi-Input Functional Encryption [GGJS]
• Functional Encryption for Randomized Functionalities[GJKS]
• Obfuscation-based Non-black-box Simulation and Four Message Concurrent Zero Knowledge for NP [PPS]
• Multi-Input Functional Encryption [GKLSZ]
• Obfuscation from Semantically-Secure Multi-linear Encodings [PTS]
Late July: GGHRSW13, SW13 eprint
4 months later
95%
49
My Probabilities
I will make it to Weizmann in Dec. 38%
Indistinguishability Obfuscation from LWE-type assumption in 4 years
Amit eprints an obfusction paper in next 2 months
63%
50
Thank you