Polynomial Spaces: A New Framework for Composite-to-Prime-Order Transformations

Abstract. In this paper we provide new algebraic tools to study the relationship between different Matrix Diffie-Hellman (MDDH) Problems, which are recently introduced as a natural generalization of the so-called Linear Problem. Namely, we provide an algebraic criterion to decide whether there exists a generic black-box reduction, and in many cases, when the answer is positive we also build an explicit reduction with the following properties: it only makes a single oracle call, it is tight and it makes use only of operations in the base group. It is well known that two MDDH problems described by matrices with a different number of rows are separated by an oracle computing certain multilinear map. Thus, we put the focus on MDDH problems of the same size. Then, we show that MDDH problems described with a different number of parameters are also separated (meaning that a successful reduction cannot decrease the amount of randomness used in the problem instance description). When comparing MDDH problems of the same size and number of parameters, we show that they are either equivalent or incomparable. This suggests that a complete classification into equivalence classes could be done in the future. In this paper we give some positive and negative partial results about equivalence, in particular solving the open problem of whether the Linear and the Cascade MDDH problems are reducible to each other. The results given in the paper are limited by some technical restrictions in the shape of the matrices and in the degree of the polynomials defining them. However, these restrictions are also present in most of the work dealing with MDDH Problems. Therefore, our results apply to all known instances of practical interest.

Section: Our Resultsmentioning

confidence: 99%

“…This association is actually at the heart of the polynomial view of MDDH problems, introduced in [12]. Moreover, since the total degree of d A is k + 1 then the maximum of the degrees of d A,1 , .…”

Section: Proof Recall the Linearity Property Of The Determinant Polymentioning

confidence: 93%

Equivalences and Black-Box Separations of Matrix Diffie-Hellman Problems

Villar

2017

“…Integrating the benefits of dual pairing vector spaces into something like the polynomial spaces approach remains a worthwhile goal for future work. The framework in [25] also extends to the setting of multilinear groups, as do approaches based on eigenspaces, as demonstrated for example in [21].…”

Section: Introductionmentioning

confidence: 96%

“…Subsequently, Herold et al [25] presented a new translation framework called "polynomial spaces" that achieves projecting in a natural and elegant way, and can also be augmented to simultaneously achieve canceling. Like the prior result of Seo and Cheon, they employ a non-standard hardness assumption to obtain subgroup decision hardness when projecting and canceling are both supported.…”

Section: Introductionmentioning

confidence: 99%

A Profitable Sub-prime Loan: Obtaining the Advantages of Composite Order in Prime-Order Bilinear Groups

Lewko

Meiklejohn

2015

Composite-order bilinear groups provide many structural features that are useful for both constructing cryptographic primitives and enabling security reductions. Despite these convenient features, however, composite-order bilinear groups are less desirable than prime-order bilinear groups for reasons of both efficiency and security. A recent line of work has therefore focused on translating these structural features from the composite-order to the prime-order setting; much of this work focused on two such features, projecting and canceling, in isolation, but a result due to Seo and Cheon showed that both features can be obtained simultaneously in the prime-order setting.In this paper, we reinterpret the construction of Seo and Cheon in the context of dual pairing vector spaces (which provide canceling as well as useful parameter hiding features) to obtain a unified framework that simulates all of these composite-order features in the prime-order setting. We demonstrate the strength of this framework by providing two applications: one that adds dual pairing vector spaces to the existing projection in the Boneh-Goh-Nissim encryption scheme to obtain leakage resilience, and another that adds the concept of projecting to the existing dual pairing vector spaces in an IND-CPA-secure IBE scheme to "boost" its security to IND-CCA1. Our leakage-resilient BGN application is of independent interest, and it is not clear how to achieve it from pure composite-order techniques without mixing in additional vector space tools. Both applications rely solely on the Symmetric External Diffie Hellman assumption (SXDH).

“…But follow-up work has also illustrated other possibly less obvious advantages. For instance, Herold et al [21] have used the Matrix Diffie-Hellman abstraction to extend the model of composite-order to prime-order transformation of Freeman [13] and to derive efficiency improvements which were proven to be impossible in the original model. 3 We believe this illustrates that the benefits of conceptual clarity can translate into concrete improvements as well.…”

Section: Introductionmentioning

confidence: 99%

The Kernel Matrix Diffie-Hellman Assumption

Morillo

Ràfols

Villar

2016

Self Cite

Abstract. We put forward a new family of computational assumptions, the Kernel Matrix Diffie-Hellman Assumption. Given some matrix A sampled from some distribution D, the kernel assumption says that it is hard to find "in the exponent" a nonzero vector in the kernel of A . This family is a natural computational analogue of the Matrix Decisional Diffie-Hellman Assumption (MDDH), proposed by Escala et al. As such it allows to extend the advantages of their algebraic framework to computational assumptions. The k-Decisional Linear Assumption is an example of a family of decisional assumptions of strictly increasing hardness when k grows. We show that for any such family of MDDH assumptions, the corresponding Kernel assumptions are also strictly increasingly weaker. This requires ruling out the existence of some black-box reductions between flexible problems (i.e., computational problems with a non unique solution).