Obfuscation from Low Noise Multilinear Maps

Döttling, Nico; Garg, Sanjam; Gupta, Divya; Miao, Peihan; Mukherjee, Pratyay

doi:10.1007/978-3-030-05378-9_18

Cited by 3 publications

(26 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our work builds on the vast amount of previous work showing applications of mmaps-most notably, MIFE [30,10] and obfuscation [15,7,38,3,40,5,29,6,34,35,27,37,22].…”

Section: Related Workmentioning

confidence: 99%

5Gen

Lewi

Malozemoff

Apon

et al. 2016

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Secure multilinear maps (mmaps) have been shown to have remarkable applications in cryptography, such as multi-input functional encryption (MIFE) and program obfuscation. To date, there has been little evaluation of the performance of these applications. In this paper we initiate a systematic study of mmap-based constructions. We build a general framework, called 5Gen, to experiment with these applications. At the top layer we develop a compiler that takes in a high-level program and produces an optimized matrix branching program needed for the applications we consider. Next, we optimize and experiment with several MIFE and obfuscation constructions and evaluate their performance. The 5Gen framework is modular and can easily accommodate new mmap constructions as well as new MIFE and obfuscation constructions, as well as being an open-source tool that can be used by other research groups to experiment with a variety of mmap-based constructions.1 The name 5Gen comes from the fact that multilinear maps can be considered the "fifth generation" of cryptography, where the prior four are: symmetric key, public key, bilinear maps, and fully homomorphic encryption.

show abstract

“…Our work builds on the vast amount of previous work showing applications of mmaps-most notably, MIFE [30,10] and obfuscation [15,7,38,3,40,5,29,6,34,35,27,37,22].…”

Section: Related Workmentioning

confidence: 99%

5Gen

Lewi

Malozemoff

Apon

et al. 2016

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Some iO constructions come with a security proof based on assumptions in the standard model [2,29,30], but cannot be securely instantiated with the GGH13 MMap as they require low-level encodings of 0. Others are proved secure in a non-standard model (the Generic MMap model [4,9] or the Weak MMap Model [15,18]). These models remain not fully satisfactory, as they imply Virtual-Black-Box Obfuscation [9,18], a provably impossible primitive [5].…”

Section: Introductionmentioning

confidence: 99%

“…Nevertheless, no formal statement was made on what this countermeasure prevents: the countermeasure is heuristic. This particular countermeasure turned out to be a difficulty when considering variants of the original scheme, as done in [15]. This candidate obfuscator aims at reaching polynomially small errors and modulus (in order to improve both efficiency and security of the GGH map, especially in the light of the dense sublattice attacks [1,12,26]) and hence cannot use the original sampling methods from [17].…”

Section: Introductionmentioning

confidence: 99%

“…This candidate obfuscator aims at reaching polynomially small errors and modulus (in order to improve both efficiency and security of the GGH map, especially in the light of the dense sublattice attacks [1,12,26]) and hence cannot use the original sampling methods from [17]. Two modified versions of [17] are then proposed in [15], a so-called conservative one, leading to quite efficient parameters, and a so-called aggressive one.…”

Section: Introductionmentioning

confidence: 99%

“…We first suggest a common formalism that encompasses all the variants at hand, by parametrising the sampling procedure for encodings by an arbitrary covariance matrix. Following the nomenclature of [15,17], except for the second one that had no clear name, we consider:…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

On the Statistical Leak of the GGH13 Multilinear Map and Some Variants

Ducas

Pellet-Mary

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

At EUROCRYPT 2013, Garg, Gentry and Halevi proposed a candidate construction (later referred as GGH13) of cryptographic multilinear map (MMap). Despite weaknesses uncovered by Hu and Jia (EURO-CRYPT 2016), this candidate is still used for designing obfuscators. The naive version of the GGH13 scheme was deemed susceptible to averaging attacks, i.e., it could suffer from a statistical leak (yet no precise attack was described). A variant was therefore devised, but it remains heuristic. Recently, to obtain MMaps with low noise and modulus, two variants of this countermeasure were developed by Döttling et al. (EPRINT:2016/599). In this work, we propose a systematic study of this statistical leakage for all these GGH13 variants. In particular, we confirm the weakness of the naive version of GGH13. We also show that, among the two variants proposed by Döttling et al., the so-called conservative method is not so effective: it leaks the same value as the unprotected method. Luckily, the leakage is more noisy than in the unprotected method, making the straightforward attack unsuccessful. Additionally, we note that all the other methods also leak values correlated with secrets. As a conclusion, we propose yet another countermeasure, for which this leakage is made unrelated to all secrets. On our way, we also make explicit and tighten the hidden exponents in the size of the parameters, as an effort to assess and improve the efficiency of MMaps.

show abstract

Cryptanalysis of FRS obfuscation based on the CLT13 multilinear map

Kim

Lee

2021

IET Information Security

View full text Add to dashboard Cite

The authors present a classical polynomial-time attack against the branching program obfuscator of Fernando-Rasmussen-Sahai (for short FRS, Asiacrypt'17) (with one zerotest parameter), which is robust against all known classical cryptanalyses on obfuscators when instantiated with the CLT13 multilinear map. The first step is to recover a plaintext modulus of the CLT13 multilinear map. To achieve the goal, the Coron and Notarnicola (Asiacrypt'19) algorithm is applied. However, because of parameter issues, the algorithm cannot be used directly. In order to detour the issue, the authors convert an FRS obfuscator into a new programme containing a small message space. Through the conversion, the authors obtain two zerotest parameters and encodings of zero except for two non-zero slots. Then, they are used to mitigate parameter constraints of the message space recovering algorithm. Then, a cryptanalysis of the FRS obfuscation based on the recovered message space is proposed. The authors show that there exist two functionally equivalent programmes such that their obfuscated programmes are computationally distinguishable. Thus, the FRS scheme does not satisfy the desired security without any additional constraints.

show abstract

Obfuscation from Low Noise Multilinear Maps

Cited by 3 publications

References 43 publications

5Gen

5Gen

On the Statistical Leak of the GGH13 Multilinear Map and Some Variants

Cryptanalysis of FRS obfuscation based on the CLT13 multilinear map

Contact Info

Product

Resources

About