Lossy Algebraic Filters with Short Tags

Abstract

Lossy algebraic filters (LAFs) are function families where each function is parametrized by a tag, which determines if the function is injective or lossy. While initially introduced by Hofheinz (Eurocrypt 2013) as a technical tool to build encryption schemes with key-dependent message chosen-ciphertext (KDM-CCA) security, they also find applications in the design of robustly reusable fuzzy extractors. So far, the only known LAF family requires tags comprised of Θ(n 2) group elements for functions with input space Z n p , where p is the group order. In this paper, we describe a new LAF family where the tag size is only linear in n and prove it secure under simple assumptions in asymmetric bilinear groups. Our construction can be used as a drop-in replacement in all applications of the initial LAF system. In particular, it can shorten the ciphertexts of Hofheinz's KDM-CCA-secure public-key encryption scheme by 19 group elements. It also allows substantial space improvements in a recent fuzzy extractor proposed by Wen and Liu (Asiacrypt 2018). As a second contribution, we show how to modify our scheme so as to prove it (almost) tightly secure, meaning that security reductions are not affected by a concrete security loss proportional to the number of adversarial queries.

Cumulatively All-Lossy-But-One Trapdoor Functions from Standard Assumptions

“…Lossy algebraic filters (LAFs) [39,43] are tag-based lossy functions that were used to construct public-key encryption schemes with circular chosen-ciphertext security [39]. They provide similar functionalities to CALBO in that they explicitly require multiple evaluations {F ek (x, tag i )} i on distinct lossy tags to always leak the same information about x.…”