Return of GGH15: Provable Security Against Zeroizing Attacks

Matrix PRFs: Constructions, Attacks, and Applications to Obfuscation

“…Note that our model allow the adversary to perform arbitrary polynomial-time computation on the output of O r (•), whereas the "weak multi-linear map model" in [11] only allows for algebraic computation of these quantities. The latter does not capture computing the norm of these quantities, as was done in the recent statistical zeroizing attacks [19].…”

“…Note that the idea of embedding a matrix PRF into an IO candidate already appeared in [27, Section 1.3]; however, the use of matrix PRF for "noise flooding" the encodings of zeros and the lower-order bits as in our analysis -while perfectly natural in hindsight-appears to be novel to this work. In prior works [27,11], the matrix PRF is merely used to rule out non-trivial algebraic relations amongst the encodings of zeros, namely that there is no low-degree polynomial that vanishes over a large number of pseudorandom values.…”

“…The synthesizer-based PRF construction. To assist the construction of a synthesizer-based matrix PRF from Assumption (11), let us first define the lists of indices used in the induction.…”

“…In this section we give a candidate construction of indistinguishability obfuscation O, following [18,27,11].…”

“…Matrix PRFs are attractive due to their simplicity, strong connections to complexity theory and group theory [12,44,1], and recent applications in program obfuscation [27,11].…”