Robustly Reusable Fuzzy Extractor from Standard Assumptions

Lossy Algebraic Filters with Short Tags

“…Lossy algebraic filters (LAFs) are a variant LTFs introduced by Hofheinz [26] as a tool enabling the design of chosen-ciphertextsecure encryption schemes with key-dependent message (KDM-CCA) security [6]. Recently, they were also used by Wen and Liu [45] in the construction of robustly reusable fuzzy extractors. In LAF families, each function takes as arguments an input x and a tag t, which determines if the function behaves as a lossy or an injective function.…”

“…On the other hand, LAFs depart from lossy trapdoor functions in that they need not be efficiently invertible using a trapdoor. For their applications to KDM-CCA security [26] and fuzzy extractors [45], lossy algebraic filters are expected to satisfy two security properties. The first one, called indistinguishability, requires that lossy tags be indistinguishable from random tags.…”

“…, x n ) ∈ Z n p , where p is the order of a pairing-friendly G, the core components t c contain Θ(n 2 ) elements of G. For the application to KDM-CCA security [26] (where t c should be part of ciphertexts), quadratic-size tags are not prohibitively expensive as the encryption scheme of [26,Section 4] can make do with a constant n (typically, n = 6). In the application to fuzzy extractors [45], however, it is desirable to reduce the tag length. In the robustly reusable fuzzy extractor of [45], the core tag component t c is included in the public helper string P that allows reconstructing a secret key from a noisy biometric reading w. The latter lives in a metric space that should be small enough to fit in the input space Z n p of the underlying LAF family.…”

“…In the application to fuzzy extractors [45], however, it is desirable to reduce the tag length. In the robustly reusable fuzzy extractor of [45], the core tag component t c is included in the public helper string P that allows reconstructing a secret key from a noisy biometric reading w. The latter lives in a metric space that should be small enough to fit in the input space Z n p of the underlying LAF family. Even if p is exponentially large in the security parameter λ, a constant n would restrict biometric readings to have linear length in λ.…”

“…As a result, our proof of evasiveness only loses a factor O(λ) with respect to the Symmetric eXternal Diffie-Hellman assumption (SXDH). If our scheme is plugged into the robustly reusable fuzzy extractor of Wen and Liu [45], it immediately translates into a tight proof of robustness in the sense of the definition of [45]. While directly using our second LAF in the KDM-CCA-secure scheme of [26] does not seem sufficient to achieve tight key-dependent message security, it may still provide a building block for future constructions of tightly KDM-CCA-secure encryption schemes with short ciphertexts.…”