Fully Key-Homomorphic Encryption, Arithmetic Circuit ABE and Compact Garbled Circuits

Self Cite

174

In predicate encryption, a ciphertext is associated with descriptive attribute values x in addition to a plaintext µ, and a secret key is associated with a predicate f . Decryption returns plaintext µ if and only if f (x) = 1. Moreover, security of predicate encryption guarantees that an adversary learns nothing about the attribute x or the plaintext µ from a ciphertext, given arbitrary many secret keys that are not authorized to decrypt the ciphertext individually.We construct a leveled predicate encryption scheme for all circuits, assuming the hardness of the subexponential learning with errors (LWE) problem. That is, for any polynomial function d = d(λ), we construct a predicate encryption scheme for the class of all circuits with depth bounded by d(λ), where λ is the security parameter. *

Section: Our Contributionsmentioning

confidence: 99%

Section: Overview Of Our Constructionmentioning

confidence: 99%

Section: Overview Of Our Constructionmentioning

confidence: 99%

See 1 more Smart Citation

Predicate Encryption for Circuits from LWE

Gorbunov

Vaikuntanathan

Wee

2015

Self Cite

174

“…Additionally, it has been shown that there exist "special" (non random) matrices G for which SIS is easy to solve as well. The following lemma summarizes the above known results (similar to a lemma in [10]):…”

Section: Lattices and Small Integer Solution Problemmentioning

confidence: 65%

Multi-key Homomorphic Authenticators

Fiore

Mitrokotsa

Nizzardo

et al. 2016

Abstract. Homomorphic authenticators (HAs) enable a client to authenticate a large collection of data elements m1, . . . , mt and outsource them, along with the corresponding authenticators, to an untrusted server. At any later point, the server can generate a short authenticator σ f,y vouching for the correctness of the output y of a function f computed on the outsourced data, i.e., y = f (m1, . . . , mt). Recently researchers have focused on HAs as a solution, with minimal communication and interaction, to the problem of delegating computation on outsourced data. The notion of HAs studied so far, however, only supports executions (and proofs of correctness) of computations over data authenticated by a single user. Motivated by realistic scenarios (ubiquitous computing, sensor networks, etc.) in which large datasets include data provided by multiple users, we study the concept of multi-key homomorphic authenticators. In a nutshell, multi-key HAs are like HAs with the extra feature of allowing the holder of public evaluation keys to compute on data authenticated under different secret keys. In this paper, we introduce and formally define multi-key HAs. Secondly, we propose a construction of a multi-key homomorphic signature based on standard lattices and supporting the evaluation of circuits of bounded polynomial depth. Thirdly, we provide a construction of multi-key homomorphic MACs based only on pseudorandom functions and supporting the evaluation of low-degree arithmetic circuits. Albeit being less expressive and only secretly verifiable, the latter construction presents interesting efficiency properties.

“…However, it was the work of Sahai and Waters [56] that coined the term Attribute Based Encryption, and the subsequent, natural unification of all these primitives under the umbrella of Functional Encryption took place only relatively recently [18,48]. Constructions of public index FE have matured from specialized -equality testing [16,12,34], keyword search [15,1,43], boolean formulae [41], inner product predicates [43], regular languages [58] -to general polynomial-size circuits [33,39,17] and even Turing machines [36]. The journey of private index FE has been significantly more difficult, with inner product predicate constructions [43,3] being the state of the art for a long time until the recent elegant generalization to polynomial-size circuits [40].…”

Section: Introductionmentioning

confidence: 99%

Fully Secure Functional Encryption for Inner Products, from Standard Assumptions

Agrawal

Libert

Stehlé

2016

192

158

Abstract. Functional encryption is a modern public-key paradigm where a master secret key can be used to derive sub-keys SKF associated with certain functions F in such a way that the decryption operation reveals F (M ), if M is the encrypted message, and nothing else. Recently, Abdalla et al. gave simple and efficient realizations of the primitive for the computation of linear functions on encrypted data: given an encryption of a vector y over some specified base ring, a secret key SKx for the vector x allows computing x, y . Their technique surprisingly allows for instantiations under standard assumptions, like the hardness of the Decision Diffie-Hellman (DDH) and Learning-with-Errors (LWE) problems. Their constructions, however, are only proved secure against selective adversaries, which have to declare the challenge messages M0 and M1 at the outset of the game. In this paper, we provide constructions that provably achieve security against more realistic adaptive attacks (where the messages M0 and M1 may be chosen in the challenge phase, based on the previously collected information) for the same inner product functionality. Our constructions are obtained from hash proof systems endowed with homomorphic properties over the key space. They are (almost) as efficient as those of Abdalla et al. and rely on the same hardness assumptions. In addition, we obtain a solution based on Paillier's composite residuosity assumption, which was an open problem even in the case of selective adversaries. We also propose LWE-based schemes that allow evaluation of inner products modulo a prime p, as opposed to the schemes of Abdalla et al. that are restricted to evaluations of integer inner products of short integer vectors. We finally propose a solution based on Paillier's composite residuosity assumption that enables evaluation of inner products modulo an RSA integer N = p · q. We demonstrate that the functionality of inner products over a prime field is powerful and can be used to construct bounded collusion FE for all circuits.