Optimal Authenticated Data Structures with Multilinear Forms

Abstract

Abstract. Cloud computing and cloud storage are becoming increasingly prevalent. In this paradigm, clients outsource their data and computations to third-party service providers. Data integrity in the cloud therefore becomes an important factor for the functionality of these web services. Authenticated data structures, implemented with various cryptographic primitives, have been widely studied as a means of providing efficient solutions to data integrity problems (e.g., Merkle trees). In this paper, we introduce a new authenticated dictionary data structure that employs multilinear forms, a cryptographic primitive proposed by Silverberg and Boneh in 2003 [10], the construction of which, however, remains an open problem to date. Our authenticated dictionary is optimal, that is, it does not add any extra asymptotic cost to the plain dictionary data structure, yielding proofs of constant size, i.e., asymptotically equal to the size of the answer, while maintaining other relevant complexities logarithmic. Instead, solutions based on cryptographic hashing (e.g., Merkle trees) require proofs of logarithmic size [40]. Because multilinear forms are not known to exist yet, our result can be viewed from a different angle: if one could prove that optimal authenticated dictionaries cannot exist in the computational model, irrespectively of cryptographic primitives, then our solution would imply that cryptographically interesting multilinear form generators cannot exist as well (i.e., it can be viewed as a reduction). Thus, we provide an alternative avenue towards proving the nonexistence of multilinear form generators in the context of general lower bounds for authenticated data structures [40] and for memory checking [18], a model similar to the authenticated data structures model.

Candidate Multilinear Maps from Ideal Lattices

“…Another property, which was used by Papamanthou et al [PTT10], is compactness, which means that the size of elements in the groups (as output by the instance generator) is independent of κ. We note that our multilinear maps will not satisfy this requirement, and are therefore unsuitable for the application in [PTT10].…”

“…We note that our multilinear maps will not satisfy this requirement, and are therefore unsuitable for the application in [PTT10].…”

Streaming Authenticated Data Structures

“…Other related works such as verifiable computation [2,5,15,16,17,18,34,40] and authenticated data structures [13,20,21,31,35,36,37,38] are not directly applicable to the streaming setting or their application yields high complexities or interactive protocols.…”

Forward Secure Non-Interactive Key Exchange

“…The secret key always contains one element z i = e(h x 1 , h 2 , ..., h i ) ∈ G i , updating it just consists in computing z i+1 ← e(z i , h i+1 ). Assuming, as Papamanthou et al [PTT10], the existence of multilinear maps where the size of the different groups G i is independent of the number of levels leads to a protocol where the sizes of the parameters and of the secret and public keys are independent of the number of time periods T . However, implementations of such a protocol with the maps from [GGH13] and [CLT13] will not achieve constant size since the size of the elements in the secret key will actually depend on the number of levels and so on the number of time periods.…”