Bounded Functional Encryption for Turing Machines: Adaptive Security from General Assumptions

Abstract

AbstractThe recent work of Agrawal et al. [Crypto ’21] and Goyal et al. [Eurocrypt ’22] concurrently introduced the notion of dynamic bounded collusion security for functional encryption (FE) and showed a construction satisfying the notion from identity based encryption (IBE). Agrawal et al. [Crypto ’21] further extended it to FE for Turing machines in non-adaptive simulation setting from the sub-exponential learining with errors assumption (\(\textsf{LWE}\)). Concurrently, the work of Goyal et al. [Asiacrypt ’21] constructed attribute based encryption (ABE) for Turing machines achieving adaptive indistinguishability based security against bounded (static) collusions from IBE, in the random oracle model. In this work, we significantly improve the state of art for dynamic bounded collusion FE and ABE for Turing machines by achieving adaptive simulation style security from a broad class of assumptions, in the standard model. In more detail, we obtain the following results: 1. We construct an adaptively secure (\(\textsf{AD}\hbox {-}\textsf{SIM}\)) FE for Turing machines, supporting dynamic bounded collusion, from sub-exponential \(\textsf{LWE}\). This improves the result of Agrawal et al. which achieved only non-adaptive (\(\textsf{NA}\hbox {-}\textsf{SIM}\)) security in the dynamic bounded collusion model. 2. Towards achieving the above goal, we construct a ciphertext policy FE scheme (\(\textsf{CPFE}\)) for circuits of unbounded size and depth, which achieves \(\textsf{AD}\hbox {-}\textsf{SIM}\) security in the dynamic bounded collusion model from IBE and laconic oblivious transfer (LOT). Both IBE and LOT can be instantiated from a large number of mild assumptions such as the computational Diffie-Hellman assumption, the factoring assumption, and polynomial \(\textsf{LWE}\). This improves the construction of Agrawal et al. which could only achieve \(\textsf{NA}\hbox {-}\textsf{SIM}\) security for \(\textsf{CPFE}\) supporting circuits of unbounded depth from IBE. 3. We construct an \(\textsf{AD}\hbox {-}\textsf{SIM}\) secure FE for Turing machines, supporting dynamic bounded collusions, from LOT, ABE for \({\textsf{NC}}^1\) (or \({\textsf{NC}}\)) and private information retrieval (PIR) schemes which satisfy certain properties. This significantly expands the class of assumptions on which \(\textsf{AD}\hbox {-}\textsf{SIM}\) secure FE for Turing machines can be based. In particular, it leads to new constructions of FE for Turing machines including one based on polynomial \(\textsf{LWE}\) and one based on the combination of the bilinear decisional Diffie-Hellman assumption and the decisional Diffie-Hellman assumption on some specific groups. In contrast the only prior construction by Agrawal et al. achieved only \(\textsf{NA}\hbox {-}\textsf{SIM}\) security and relied on sub-exponential LWE. To achieve the above result, we define the notion of \(\textsf{CPFE}\) for read only RAM programs and succinct FE for LOT, which may be of independent interest. 4. We also construct an ABE scheme for Turing machines which achieves \(\textsf{AD}\hbox {-}\textsf{IND}\) security in the standard model supporting dynamic bounded collusions. Our scheme is based on IBE and LOT. Previously, the only known candidate that achieved \(\textsf{AD}\hbox {-}\textsf{IND}\) security from IBE by Goyal et al. relied on the random oracle model. KeywordsTuring machinesFunctional encryptionAttribute based encryption