Bounded Key-Dependent Message Security

Abstract

Abstract. We construct the first public-key encryption scheme that is proven secure (in the standard model, under standard assumptions) even when the attacker gets access to encryptions of arbitrary efficient functions of the secret key. Specifically, under either the DDH or LWE assumption, and for arbitrary but fixed polynomials L and N , we obtain a public-key encryption scheme that resists key-dependent message (KDM) attacks for up to N (k) public keys and functions of circuit size up to L(k), where k denotes the size of the secret key. We call such a scheme bounded KDM secure. Moreover, we show that our scheme suffices for one of the important applications of KDM security: ability to securely instantiate symbolic protocols with axiomatic proofs of security.We also observe that any fully homomorphic encryption scheme that additionally enjoys circular security and circuit privacy is fully KDM secure in the sense that its algorithms can be independent of the polynomials L and N as above. Thus, the recent fully homomorphic encryption scheme of Gentry (STOC 2009) is fully KDM secure under certain non-standard hardness assumptions.Finally, we extend an impossibility result of Haitner and Holenstein (TCC 2009), showing that it is impossible to prove KDM security against a family of query functions that contains exponentially hard pseudorandom functions if the proof makes only a black-box use of the query function and the adversary attacking the scheme. This shows that the non-black-box use of the query function in our proof of security is inherent.

Feasibility and Infeasibility of Adaptively Secure Fully Homomorphic Encryption

“…Specifically, our construction is based on (i) a two-move semi-honest oblivious transfer (OT) protocol with receiver adaptive security, in combination with (ii) a projective garbling scheme leaking only the circuit size [Yao86,BHR12], and (iii) multiple-message, receiver-non-committing public-key encryption (which is a stronger version of single-message receiver-non-committing encryption introduced in [JL00]). Next, we first recall the high-level idea of [Gen09b,GHV10,BHHI10], and then explain how to upgrade the building blocks to achieve our goal.…”

Key-Dependent Message Security: Generic Amplification and Completeness

“…In fact, this gap can be further expanded as follows. First, we can achieve length-dependent KDM security [10], which means that the target family G can be taken to be the family of all polynomial-size circuits whose size grows with their input and output lengths via a fixed polynomial rate (e.g., the circuit size is quadratic in the input and output lengths). This family is very powerful and it was shown to be rich enough for most known applications of KDM security [10] 2 .…”

“…(These details required some effort in previous works. See the appendices in [14,10,13].) This, together with the simple proof of our main theorem, allows to simplify the proofs of [10,13] for the existence of lengthdependent KDM secure encryption scheme under the Decisional Diffie-Hellman (DDH) assumption [12], the Learning With Errors assumptions (LWE) [5], and the Quadratic Residuosity (QR) assumption [13].…”

“…First, we consider the case of simulatable KDM security [10], in which it should be possible to simulate an encryption of f (sk) given only the corresponding public-key in a way that remains indistinguishable even to someone who knows the secret-key.…”

“…In [10], it was shown that if an encryption scheme is both simulatable circularsecure and fully-homomorphic then it is also simulatable fully-KDM secure. We show that the other direction holds as well, and so the two notions are equivalent.…”