Evaluating 2-DNF Formulas on Ciphertexts

Abstract

Abstract. Let ψ be a 2-DNF formula on boolean variables x1, . . . , xn ∈ {0, 1}. We present a homomorphic public key encryption scheme that allows the public evaluation of ψ given an encryption of the variables x1, . . . , xn. In other words, given the encryption of the bits x1, . . . , xn, anyone can create the encryption of ψ(x1, . . . , xn). More generally, we can evaluate quadratic multi-variate polynomials on ciphertexts provided the resulting value falls within a small set. We present a number of applications of the system: 1. In a database of size n, the total communication in the basic step of the Kushilevitz-Ostrovsky PIR protocol is reduced from √ n to 3 √ n.2. An efficient election system based on homomorphic encryption where voters do not need to include non-interactive zero knowledge proofs that their ballots are valid. The election system is proved secure without random oracles but still efficient. 3. A protocol for universally verifiable computation.

Compact Group Signatures Without Random Oracles

“…The second assumption we need is the subgroup decision assumption, introduced in [BGN05]; it is based on the hardness of factoring, and is recalled next.…”

“…Clearly, the signature σ on "ID.M " from the Waters signature scheme will give away the identity of the signer. To protect his anonymity, a signer, in our scheme, will encrypt the signature components of σ using the Boneh-Goh-Nissim [BGN05] encryption system. Additionally, the signer will attach a NIZK proof that the encrypted signature is a signature on "X.M " for 1 ≤ X ≤ 2 k , where 2 k is the number of signers in the system.…”

“…We achieve this efficiency by taking advantage of special properties of the NIZK scheme of Groth, Ostrovsky, and Sahai and avoid the general method of circuit construction. The security of these techniques is proven based on the relatively new subgroup decision problem, which was introduced by Boneh, Goh, and Nissim [BGN05]. However, recent work [GOS06a] has shown that the techniques of Groth, Ostrovsky, and Sahai can be generalized to work only with the decision linear assumption, introduced by Boneh, Boyen, and Shacham [BBS04].…”

Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products

“…We review some general notions about bilinear groups of composite order, first used in cryptographic applications by [9]. In contrast to all prior work using composite-order bilinear groups, however, we use groups whose order N is a product of three (distinct) primes.…”

“…To do this, we will make use of a bilinear group G whose order N is the product of three primes p, q, and r. Let G p , G q , and G r denote the subgroups of G having order p, q, and r, respectively. We will (informally) assume, as in [9], that a random element in any of these subgroups is indistinguishable from a random element of G. 2 Thus, we can use random elements from one subgroup to "mask" elements from another subgroup.…”