indistinguishability obfuscation from well-founded ......indistinguishability obfuscation from...

Indistinguishability Obfuscationfrom Well-Founded Assumptions

Tutorial, Part 1

An NSF Frontier Center

Simons Institute: New Developments in Obfuscation 12/10/2020

Huijia (Rachel) Lin UW

Aayush JainUCLA

Amit SahaiUCLA

Today

• We will establish that iO exists,assuming sub-exponentialhardness holds for all of the following assumptions:– LPN over ℤ"– LWE– PRG in NC0

– SXDH

Constructing iO: Today

iO

Well-Founded Assumptions

LPN over ℤ"PRG in NC0

LWE

++SXDH

(bilinear maps) +

[JLS20], building upon many prior works

New PseudorandomObject

LPN over ℤ" [BFKL’93, IPS 2009]

#$

Random Linear Codes over ℤ" [Hamming, 1950]

= &

AAACG3icbVDLSsNAFJ34rPVVdelmsAgupCRF0WXRjcsK9oFNDJPpTTt0MgkzE6WE/Icbf8WNC0VcCS78G6ePhbYeuHA4517uvSdIOFPatr+thcWl5ZXVwlpxfWNza7u0s9tUcSopNGjMY9kOiALOBDQ00xzaiQQSBRxaweBy5LfuQSoWixs9TMCLSE+wkFGijeSXqm5GfObmfsZcJnBHePkxVtjlEGoiZfyA3YjofhBkt/mdC5z7iV8q2xV7DDxPnCkpoynqfunT7cY0jUBoyolSHcdOtJcRqRnlkBfdVEFC6ID0oGOoIBEoLxv/luNDo3RxGEtTQuOx+nsiI5FSwygwnaND1aw3Ev/zOqkOz72MiSTVIOhkUZhyrGM8Cgp3mQSq+dAQQiUzt2LaJ5JQbeIsmhCc2ZfnSbNacU4r9vVJuXYxjaOA9tEBOkIOOkM1dIXqqIEoekTP6BW9WU/Wi/VufUxaF6zpzB76A+vrB5w6ocg=

{ai}i2[n], s Z`p

AAAB/HicbVDLSgNBEJz1GeMrmqOXJUGICGFXEL0IQS8eI5gHZEOYnXSSIbOzy0yvuCzxK7x78aCIVz/EW/7GyeOgiQUNRVU33V1+JLhGxxlbK6tr6xubma3s9s7u3n7u4LCuw1gxqLFQhKrpUw2CS6ghRwHNSAENfAENf3gz8RsPoDQP5T0mEbQD2pe8xxlFI3VyeXnlITxiGoUiGZU8EOKkkys6ZWcKe5m4c1KsFLzT53ElqXZy3143ZHEAEpmgWrdcJ8J2ShVyJmCU9WINEWVD2oeWoZIGoNvp9PiRfWyUrt0LlSmJ9lT9PZHSQOsk8E1nQHGgF72J+J/XirF32U65jGIEyWaLerGwMbQnSdhdroChSAyhTHFzq80GVFGGJq+sCcFdfHmZ1M/K7nnZuTNpXJMZMuSIFEiJuOSCVMgtqZIaYSQhL+SNvFtP1qv1YX3OWles+Uye/IH19QPslJfq

n = poly(`)


#$

Random Linear Codes over ℤ"

• Random Linear Codes exhibit strong combinatorialerror-correction capabilities vs. sparse error[Gilbert 1952, Varshamov 1957, …]

• However, no efficient (sub-exponential in ℓ) decoding algorithms known despite decades of study

+

AAACe3icbVHbitRAEO3E2xpvoz4K0jijrqJjIiyKICzqg48rOLuL0zF0OpWZZjud0F1xHJr8hH/hx/jim+BvCL4IdmYG0V0LGg6nTp3qqsobJS3G8bcgPHX6zNlzW+ejCxcvXb4yuHpt39atETARtarNYc4tKKlhghIVHDYGeJUrOMiPXvb5gw9grKz1W1w2kFZ8pmUpBUdPZYNPoxFzkEnWZU4yqelUpx19FrEcZlI74a1tF3kBZQpK5MbUC8oqjvM8d++6rKH0DmUIH9EtJM5pY+p8TDuaPGKg1HvHClDIO8rYyuQ5jf/oa5yDWUgLXcRAF5teo1E2GMbjeBX0JEg2YLh778eXh6++f97LBl9ZUYu2Ao1CcWunSdxg6rhBKVTv3lpouDjiM5h6qHkFNnWr3XX0tmcKWtbGP410xf5d4Xhl7bLKvbKf2h7P9eT/ctMWy6epk7ppEbRYNypbRbGm/SFoIQ0IVEsPuDDS/5WKOTdcoD9X5JeQHB/5JNh/PE52xvEbv40XZB1b5Aa5RbZJQp6QXfKa7JEJEeRncDO4G2wHv8JheD98sJaGwabmOvknwp3fSmrDlw==

{ei}i2[n] :(ei Zp with prob. 1/`�

ei = 0 otherwise

'


{ai}i2[n], s Z`p


n = poly(`)


#$

LPN over ℤ" Assumption:

• We assume there exist (arbitrary) constants %, ' > 0, such that this holds for all Time 2ℓ, adversaries.

• Follows from hardness of decoding – recovering # from ($, $# + /) – via search-to-decision reduction [AIK 07].

• Best known attack is 21 ℓ234 [EKM 17,BCGI 18]

+



ei = 0 otherwise

/ ≈C 6AAACFXicbVDLSsNAFJ3UV62vqEs3g0VQ0JIIosuiLlxWsA9MQphMJ+3QySTMTJQS8hNu/Ab/wI0LRdyJ4E7wN9w7fSy0euDC4Zx7ufeeIGFUKsv6MApT0zOzc8X50sLi0vKKubrWkHEqMKnjmMWiFSBJGOWkrqhipJUIgqKAkWbQOxn4zSsiJI35heonxItQh9OQYqS05Ju7bgZTn0I39zPqUg4d7uXQZSRUSIj4GroRUt0gyC5zP/HNslWxhoB/iT0m5erO1+ve6eddzTff3XaM04hwhRmS0rGtRHkZEopiRvKSm0qSINxDHeJoylFEpJcNv8rhllbaMIyFLq7gUP05kaFIyn4U6M7BjXLSG4j/eU6qwiMvozxJFeF4tChMGVQxHEQE21QQrFhfE4QF1bdC3EUCYaWDLOkQ7MmX/5LGfsU+qFjnOo1jMEIRbIBNsA1scAiq4AzUQB1gcAPuwSN4Mm6NB+PZeBm1FozxzDr4BePtGzl2o0c=

{ui}i2[n] Zp


{ai}i2[n], s Z`p


n = poly(`)


#$





+



ei = 0 otherwise


{ui}i2[n] Zp


{ai}i2[n], s Z`p


n = poly(`)

More details:

We set p = 2ℓ,7 for tiny constant %′ < %

This allows for search-to-decision reduction,which runs in time polynomial in p.

If we want %′ > %, (i.e. p larger than running time of LPN adversary)then that’s fine, but make decisional assumption directly.

36

• Gaussian Elimination attacks • Standard gaussian elimination • Blum-Kalai-Wasserman [J.ACM:BKW03] • Sample-efficient BKW [A-R:Lyu05] • Pooled Gauss [CRYPTO:EKM17] • Well-pooled Gauss [CRYPTO:EKM17] • Leviel-Fouque [SCN:LF06] • Covering codes [JC:GJL19] • Covering codes+ [BTV15] • Covering codes++ [BV:AC16] • Covering codes+++ [EC:ZJW16]

• Information Set Decoding Attacks • Prange’s algorithm [Prange62] • Stern’s variant [ICIT:Stern88] • Finiasz and Sendrier’s variant [AC:FS09] • BJMM variant [EC:BJMM12] • May-Ozerov variant [EC:MO15] • Both-May variant [PQC:BM18] • MMT variant [AC:MMT11] • Well-pooled MMT [CRYPTO:EKM17] • BLP variant [CRYPTO:BLP11]

• Other Attacks • Generalized birthday [CRYPTO:Wag02] • Improved GBA [Kirchner11] • Linearization [EC:BM97] • Linearization 2 [INDO:Saa07] • Low-weight parity-check [Zichron17]

• Statistical Decoding Attacks • Jabri’s attack [ICCC:Jab01] • Overbeck’s variant [ACISP:Ove06] • FKI’s variant [Trans.IT:FKI06] • Debris-Tillich variant [ISIT:DT17]

• Classical Techniques• Low-deg approx [ITCS:ABGKR17]

A tremendous number of attacks on LPN has been published in the literature

Security of LPN over Large FieldsSlide from: Geoffroy Couteau


#$





+



ei = 0 otherwise


{ui}i2[n] Zp


{ai}i2[n], s Z`p

{89, 89, # + /9}9; ≈? {89, 69}9;


n = poly(`)


#$





+



ei = 0 otherwise


{ui}i2[n] Zp


{ai}i2[n], s Z`p

{89, 89, # + /9}9; ≈? {89, 69}9;


n = poly(`)

LPN with ' > 0 is not known to imply PKE.(Need ' > 1/2 to imply PKE [Ale 03, AAB15].)

As far as we know,this is a “minicrypt” assumption, unlike LWE.

Constructing iO: Today

iO

Well-Founded Assumptions

LPN over ℤ"PRG in NC0

LWE

++SXDH

(bilinear maps) +

[JLS20], building upon many prior works

New PseudorandomObject

Preview: Why LPN over ℤ"?• Using LPN over ℤp to build a key pseudorandom object is at

the heart of our new work: a “structured-seed PRG” (sPRG). • sPRG has both a “public seed” and “secret seed”, following our

previous work from [AJS18, LM18, AJLMS19, JLMS19, JLS19, GJLS20].• sPRG has three main requirements:• (1) ”Degree-2 efficiency”: very roughly speaking, the output

is a degree-2 polynomial in the secret seed• (2) Expansion: The length of the structured seed is #$%&,

where the sPRG outputs # bits.• (3) Pseudorandomness

• Talk Part 2 (Rachel) will tell us why sPRG is enough to build iO• Talk Part 3 (Aayush) will tell us how to achieve (1) and (2)

Preview: Why LPN over ℤ"?• sPRG output has two parts, that are (unfortunately) correlated:• First, a part that looks like distribution from LPN over ℤp:

{$%, $%, ' + )% + *%}%,-,…,/, where each *% ← 0,1

• Second, a correlated output:345 *-,… , */

• We want to show these are (jointly) pseudorandom, despite this correlation: *% used in both outputs.

• Simple insight (of [JLS20] over [AJS18,LM18,…]):We separate the “error” into two components: )% + *%

• In earlier works, there was no LPN error )%.The entire error in the first component was *%.

Preview: Why LPN over ℤ"?• LPN over ℤp allows a simple pseudo-randomness analysis:

{$%, $%, ' + )% + *%}%,-,…,/ , 012 *-,… , */• By LPN over ℤp, this is indistinguishable from:

{$%, 3% + *%}%,-,…,/ , 012 *-,… , */≈5 {$%, 3%}%,-,…,/ , 012 *-,… , */

• Finally, by the pseudo-randomness of PRG, this is indistinguishable from:

{$%, 3%}%,-,…,/ , 1• In this simple way, LPN over ℤp is used to “break up” a

dependency – we can prove pseudo-randomness even though *-, … , */ is used both as input to PRG, and as “noise”

Other Well-Founded Assumptions

• We assume LWE (which is just like LPN, but with small Gaussian error !" instead of sparse error) with sub-exponential modulus-to-noise ratio. • Known to be true if the Shortest Vector Problem over

general lattices is worst-case hard to approximate to any sub-exponential factor [Reg 05, Pei 09, BLPRS 12].

• Search-to-decision reduction also for LWE [MM 11].• LWE has turned out to be a remarkably versatile

assumption in cryptography, most famously used for constructing Fully Homomorphic Encryption [BV 11, BGV 11, GSW 13]

Preview: Why LPN over ℤ"?• LPN over ℤp allows a simple pseudo-randomness analysis:

{$%, $%, ' + )% + *%}%,-,…,/ , 012 *-,… , */• By LPN over ℤp, this is indistinguishable from:

{$%, 3% + *%}%,-,…,/ , 012 *-,… , */≈5 {$%, 3%}%,-,…,/ , 012 *-,… , */

• Finally, by the pseudo-randomness of PRG, this is indistinguishable from:

{$%, 3%}%,-,…,/ , 1• In this simple way, LPN over ℤp is used to “break up” a

dependency – we can prove pseudorandomness even though *-, … , */ is used both as input to PRG, and as “noise”

Note: the analysis so far could have worked just as well using LWE, where the errors )% are small.

The fact that LPN errors are sparse is crucial for suitably computing the sPRG.

(Stay tuned for details in Part 3!)

Other Well-Founded Assumptions

• We assume LWE (which is just like LPN, but with small Gaussian error !" instead of sparse error) with sub-exponential modulus-to-noise ratio.

• Known to be hard if SVP is worst-case hard to approximate to any sub-exponential factor [Reg 05, Pei 09, BLPRS 12].

• We assume the existence of PRGs computable by constant-depth (NC0) circuits, with stretch #$%&, for any constant ' > 0.• Extensively studied [Gol 00, CM 01, MST 03, IKOS 08, …].• Follows from one-way-ness conjectures [App13, AK19].

• We assume the SXDH assumption over bilinear maps.• Extensively studied and used since [BdGMM 05].

• All assumptions made vs. sub-exponential time adversaries.

Parts 2 and 3

PRG in NC0

LPN

FE for NC0

+ PRG in NC0[AJS15,LV16,Lin16]

Part 2

Part 3

FE for P

+ LWE [AJ15, BV15,GS16, LM16, LPST16, GKPVZ13,BNPW17,KNT18]

IO

Bilinearmaps

[AJLMS18,JLMS19,JLS19,GJLS20,

Wee20]LWE

[Reg05,BV11]

Partially Hiding FE HE for NC0sPRG

[AJLMS18,JLMS19,JLS19,GJLS20]

[JLS20]

Image credit: Rachel Lin

indistinguishability obfuscation from well-founded ......indistinguishability obfuscation from...

Documents