On the (im)possibility of obfuscating programs

Abstract

Informally, an obfuscator O is an (efficient, probabilistic) "compiler" that takes as input a program (or circuit) P and produces a new program O(P) that has the same functionality as P yet is "unintelligible" in some sense. Obfuscators, if they exist, would have a wide variety of cryptographic and complexity-theoretic applications, ranging from software protection to homomorphic encryption to complexity-theoretic analogues of Rice's theorem. Most of these applications are based on an interpretation of the "unintelligibility" condition in obfuscation as meaning that O(P) is a "virtual black box," in the sense that anything one can efficiently compute given O(P), one could also efficiently compute given oracle access to P.In this work, we initiate a theoretical investigation of obfuscation. Our main result is that, even under very weak formalizations of the above intuition, obfuscation is impossible. We prove this by constructing a family of efficient programs P that are unobfuscatable in the sense that (a) given any efficient program P that computes the same function as a program P ∈ P, the "source code" P can be efficiently reconstructed, yet (b) given oracle access to a (randomly selected) program P ∈ P, no efficient algorithm can reconstruct P (or even distinguish a certain bit in the code from random) except with negligible probability.We extend our impossibility result in a number of ways, including even obfuscators that (a) are not necessarily computable in polynomial time, (b) only approximately preserve the functionality, and (c) only need to work for very restricted models of computation (TC 0 ). We also rule out several potential applications of obfuscators, by constructing "unobfuscatable" signature schemes, encryption schemes, and pseudorandom function families.A preliminary version of this article appeared in

Quantum cryptography beyond quantum key distribution

“…Due to its diverse and far reaching applications, program obfuscation has been long considered as a holy grail of cryptography. However, hopes of attaining highly secure obfuscation were diminished in 2011 by an impossibility proof [14] (note, however that weaker security notions are attainable [115]). The situation is completely different in the quantum case, since the proof technique is not applicable (essentially due to the nocloning theorem).…”

Simulation-Based Selective Opening CCA Security for PKE from Key Encapsulation Mechanisms

“…Indistinguishability Obfuscation (iO) was proposed in [1,2]. Informally, it requires that the obfuscations of two distinct but equal-sized programs, which implement identical functionality, are computationally indistinguishable.…”

Untitled

“…Let C (the counterfeiter) be a quantum circuit of size poly (n) that takes k public as input 11 and does the following:…”

“…10 We indulge in slight abuse of notation, since if Sign is randomized then the signature need not be a function of k private and x. 11 Actually, for our security proofs, it suffices to consider a weaker attack model, in which C only receives k public at the same time as it receives w 1 , . .…”

“…. , p m : F n 2 → F 2 , have other cryptographic applications, for example to program obfuscation [11]? Of course, there is also tremendous scope for inventing new schemes, which might be based on different assumptions and have different strengths and weaknesses.…”