Indistinguishability Obfuscation Research Articles

On Constructing One-Way Permutations from Indistinguishability Obfuscation

We prove that there is no black-box construction of a one-way permutation family from a one-way function and an indistinguishability obfuscator for the class of all oracle-aided circuits, where the construction is “domain invariant” (i.e., where each permutation may have its own domain, but these domains are independent of the underlying building blocks). Following the framework of Asharov and Segev (FOCS ’15), by considering indistinguishability obfuscation for oracle-aided circuits we capture the common techniques that have been used so far in constructions based on indistinguishability obfuscation. These include, in particular, non-black-box techniques such as the punctured programming approach of Sahai and Waters (STOC ’14) and its variants, as well as sub-exponential security assumptions. For example, we fully capture the construction of a trapdoor permutation family from a one-way function and an indistinguishability obfuscator due to Bitansky, Paneth, and Wichs (TCC ’16). Their construction is not domain invariant, and our result shows that this, somewhat undesirable property, is unavoidable using the common techniques. In fact, we observe that constructions which are not domain invariant circumvent all known negative results for constructing one-way permutations based on one-way functions, starting with Rudich’s seminal work (PhD thesis ’88). We revisit this classic and fundamental problem and resolve this somewhat surprising gap by ruling out all such black-box constructions—even those that are not domain invariant.

Secure searchable public key encryption against insider keyword guessing attacks from indistinguishability obfuscation

Secure searchable public key encryption against insider keyword guessing attacks from indistinguishability obfuscation

Multi-input Functional Encryption in the Private-Key Setting: Stronger Security from Weaker Assumptions

We construct a general-purpose multi-input functional encryption scheme in the private-key setting. Namely, we construct a scheme where a functional key corresponding to a function f enables a user holding encryptions of $$x_1, \ldots , x_t$$ to compute $$f(x_1, \ldots , x_t)$$ but nothing else. This is achieved starting from any general-purpose private-key single-input scheme (without any additional assumptions) and is proven to be adaptively secure for any constant number of inputs t. Moreover, it can be extended to a super-constant number of inputs assuming that the underlying single-input scheme is sub-exponentially secure. Instantiating our construction with existing single-input schemes, we obtain multi-input schemes that are based on a variety of assumptions (such as indistinguishability obfuscation, multilinear maps, learning with errors, and even one-way functions), offering various trade-offs between security assumptions and functionality. Previous and concurrent constructions of multi-input functional encryption schemes either rely on stronger assumptions and provided weaker security guarantees (Goldwasser et al. in Advances in cryptology—EUROCRYPT, 2014; Ananth and Jain in Advances in cryptology—CRYPTO, 2015), or relied on multilinear maps and could be proven secure only in an idealized generic model (Boneh et al. in Advances in cryptology—EUROCRYPT, 2015). In comparison, we present a general transformation that simultaneously relies on weaker assumptions and guarantees stronger security.

Efficient Public Verification of Data Integrity for Cloud Storage Systems from Indistinguishability Obfuscation

Cloud storage services allow users to outsource their data to cloud servers to save local data storage costs. However, unlike using local storage devices, users do not physically manage the data stored on cloud servers; therefore, the data integrity of the outsourced data has become an issue. Many public verification schemes have been proposed to enable a third-party auditor to verify the data integrity for users. These schemes make an impractical assumption—the auditors have enough computation capability to bear expensive verification costs. In this paper, we propose a novel public verification scheme for the cloud storage using indistinguishability obfuscation, which requires a lightweight computation on the auditor and the delegate most computation to the cloud. We further extend our scheme to support batch verification and data dynamic operations, where multiple verification tasks from different users can be performed efficiently by the auditor and the cloud-stored data can be updated dynamically. Compared with other existing works, our scheme significantly reduces the auditor’s computation overhead. Moreover, the batch verification overhead on the auditor side in our scheme is independent of the number of verification tasks. Our scheme could be practical in a scenario, where the data integrity verifications are executed frequently, and the number of verification tasks (i.e., the number of users) is numerous; even if the auditor is equipped with a low-power device, it can verify the data integrity efficiently. We prove the security of our scheme under the strongest security model proposed by Shi et al. (ACM CCS 2013). Finally, we conduct a performance analysis to demonstrate that our scheme is more efficient than other existing works in terms of the auditor’s communication and computation efficiency.

On the Implausibility of Differing-Inputs Obfuscation and Extractable Witness Encryption with Auxiliary Input

The notion of differing-inputs obfuscation (diO) was introduced by Barak et al. (CRYPTO, pp 1–18, 2001). It guarantees that, for any two circuits \(C_0, C_1\) for which it is difficult to come up with an input x on which \(C_0(x) \ne C_1(x)\), it should also be difficult to distinguish the obfuscation of \(C_0\) from that of \(C_1\). This is a strengthening of indistinguishability obfuscation, where the above is only guaranteed for circuits that agree on all inputs. Two recent works of Ananth et al. (Differing-inputs obfuscation and applications, http://eprint.iacr.org/, 2013) and Boyle et al. (Lindell, pp 52–73, 2014) study the notion of diO in the setting where the attacker is also given some auxiliary information related to the circuits, showing that this notion leads to many interesting applications. In this work, we show that the existence of general-purpose diO with general auxiliary input has a surprising consequence: it implies that a specific circuit \(C^*\) with specific auxiliary input \({\mathsf {aux}}^*\) cannot be obfuscated in a way that hides some specific information. In other words, under the conjecture that such special-purpose obfuscation exists, we show that general-purpose diO cannot exist. This conjecture is a falsifiable assumption which we do not know how to break for candidate obfuscation schemes. We also show similar implausibility results for extractable witness encryption with auxiliary input and for “output-only dependent” hardcore bits for general one-way functions.

Hierarchical secret sharing scheme using parts of speech of English grammar

In this paper, a model to share secret information in conjunctive and disjunctive hierarchical access structure using obfuscation is proposed. Indistinguishability Obfuscation is achieved with a context free grammar (CFG) as a mimic function. Obfuscation is used to maintain confidentiality of the message in the presence of a dishonest distributor who is curious to know the secret. A new way to effectively reduce the size of the share is also achieved in this model. First, mimic function is used to convert the statistical profile of the message to a random distribution of words from a chosen paragraph. The frequency distribution of different parts of speech (PoS) components of the obfuscated string is used to build a model for distribution of shares to n people based on the responsibility of the person in a hierarchy. Sharing the information and reconstruction of the original message is also shown. It is also shown that the obfuscation is secure against chosen plain text attack.

Attribute-based fully homomorphic encryption with a bounded number of inputs

The only known way to achieve attribute-based fully homomorphic encryption (ABFHE) is through indistinguishability obfuscation. The best we can do at the moment without obfuscation is attribute-bas...

Reusable garbled gates for new fully homomorphic encryption service

In this paper, we propose a novel way to provide a fully homomorphic encryption service, namely by using garbled circuits. From a high level perspective, garbled circuits and fully homomorphic encryption, both aim at implementing complex computation on ciphertexts. We define a new cryptographic primitive named reusable garbled gate, which comes from the area of garbled circuits, then based on this new primitive we show that it is very easy to construct a fully homomorphic encryption. However, the instantiation of reusable garbled gates is rather difficult, in fact, we can only instantiate this new primitive based on indistinguishable obfuscation. Furthermore, reusable garbled gates can be a core component for constructing the reusable garbled circuits, which can reduce the communication complexity of them from O(n) to O(1). We believe that reusable garbled gates promise a new way to provide fully homomorphic encryption and reusable garbled circuits service fast.

Hierarchical secret sharing scheme using parts of speech of English grammar

In this paper, a model to share secret information in conjunctive and disjunctive hierarchical access structure using obfuscation is proposed. Indistinguishability Obfuscation is achieved with a context free grammar (CFG) as a mimic function. Obfuscation is used to maintain confidentiality of the message in the presence of a dishonest distributor who is curious to know the secret. A new way to effectively reduce the size of the share is also achieved in this model. First, mimic function is used to convert the statistical profile of the message to a random distribution of words from a chosen paragraph. The frequency distribution of different parts of speech (PoS) components of the obfuscated string is used to build a model for distribution of shares to n people based on the responsibility of the person in a hierarchy. Sharing the information and reconstruction of the original message is also shown. It is also shown that the obfuscation is secure against chosen plain text attack.

Self-Bilinear Map on Unknown Order Groups from Indistinguishability Obfuscation and Its Applications

A self-bilinear map is a bilinear map where the domain and target groups are identical. In this paper, we introduce a self-bilinear map with auxiliary information which is a weaker variant of a sel...

Multiparty Key Exchange, Efficient Traitor Tracing, and More from Indistinguishability Obfuscation

In this work, we show how to use indistinguishability obfuscation (iO) to build multiparty key exchange, efficient broadcast encryption, and efficient traitor tracing. Our schemes enjoy several interesting properties that have not been achievable before: Our multiparty non-interactive key exchange protocol does not require a trusted setup. Moreover, the size of the published value from each user is independent of the total number of users. Our broadcast encryption schemes support distributed setup, where users choose their own secret keys rather than be given secret keys by a trusted entity. The broadcast ciphertext size is independent of the number of users. Our traitor tracing system is fully collusion resistant with short ciphertexts, secret keys, and public key. Ciphertext size is logarithmic in the number of users and secret key size is independent of the number of users. Our public key size is polylogarithmic in the number of users. The recent functional encryption system of Garg, Gentry, Halevi, Raykova, Sahai, and Waters also leads to a traitor tracing scheme with similar ciphertext and secret key size, but the construction in this paper is simpler and more direct. These constructions resolve an open problem relating to differential privacy. Generalizing our traitor tracing system gives a private broadcast encryption scheme (where broadcast ciphertexts reveal minimal information about the recipient set) with optimal size ciphertext. Several of our proofs of security introduce new tools for proving security using indistinguishability obfuscation.

Secure oblivious transfer protocol from indistinguishability obfuscation

A new secure oblivious transfer (OT) protocol from indistinguishability obfuscation (iO) is proposed in this paper. The candidate iO and a dual-mode cryptosystem are the main technical tools of this scheme. Garg et al. introduced a candidate construction of iO in 2013. Following their steps, a new k-out-of-l OT protocol is presented here, and its realization from decisional Diffie-Hellman (DDH) is described in this paper, in which iO was combined with the dual-mode cryptosystem. The security of the scheme mainly relies on the indistinguishability of the obf-branches (corresponding to the two modes in dual-mode model). This paper explores a new way for the application of iO.

Hiding secrets in software

Can we hide secrets in software? Can we obfuscate programs---that is, make programs unintelligible while preserving their functionality? What exactly do we mean by "unintelligible"? Why would we even want to do this? In this article, we describe some rigorous cryptographic answers to these quasi-philosophical questions. We also discuss our recent "candidate indistinguishability obfuscation" scheme and its implications.

Proxy re‐encryption via indistinguishability obfuscation

AbstractIn this paper, we present a proxy re‐encryption (PRE) scheme via an indistinguishability obfuscation ( ) by adding two algorithms to the public key encryption scheme by Sahai and Waters' (STOC 2014). Although a re‐encryption function from one public key to another can be considered as a randomized functionality on the underlying plaintext and that functionality can be achieved by using a probabilistic by Canetti et al. (TCC2015), we need a sub‐exponential to construct the probabilistic . In our construction, we need not the probabilistic but the standard . In addition, our proposed PRE scheme has some good properties. That is, unidirectional re‐encryption, unbounded multi‐hop re‐encryption, constant‐size ciphertext, and fast decryption. To the best of our knowledge, this is the first construction of a multi‐hop and unidirectional PRE scheme. Copyright © 2016 John Wiley & Sons, Ltd.

Limits on the Power of Indistinguishability Obfuscation and Functional Encryption

Recent breakthroughs in cryptography have positioned indistinguishability obfuscation as a “central hub” for almost all known cryptographic tasks, and as an extremely powerful building block for new cryptographic tasks resolving long-standing and foundational open problems. However, constructions based on indistinguishability obfuscation almost always rely on non-black-box techniques, and thus the extent to which it can be used as a building block has been completely unexplored so far. We present a framework for proving meaningful negative results on the power of indistinguishability obfuscation. By considering indistinguishability obfuscation for oracle-aided circuits, we capture the common techniques that have been used so far in constructions based on indistinguishability obfuscation. These include, in particular, non-black-box techniques such as the punctured programming approach of Sahai and Waters [A. Sahai and B. Waters, How to use indistinguishability obfuscation: Deniable encryption, and more, in Proceedings of the 46th Annual ACM Symposium on Theory of Computing, ACM, New York, 2014, pp. 475--484] and its variants, as well as subexponential security assumptions. Within our framework we prove the first negative results on the power of indistinguishability obfuscation and of the tightly related notion of functional encryption. Our results are as follows: (1) There is no fully black-box construction of a collision-resistant function family from an indistinguishability obfuscator for oracle-aided circuits. (2) There is no fully black-box construction of a key-agreement protocol with perfect completeness from a private-key functional encryption scheme for oracle-aided circuits. Specifically, we prove that any such potential constructions must suffer from an exponential security loss, and thus our results cannot be circumvented using subexponential security assumptions. Our framework captures constructions that may rely on a wide variety of primitives in a non-black-box manner (e.g., obfuscating or generating a functional key for a function that uses the evaluation circuit of a puncturable pseudorandom function), and we only assume that the underlying indistinguishability obfuscator or functional encryption scheme itself is used in a black-box manner.

Candidate Indistinguishability Obfuscation and Functional Encryption for All Circuits

In this work, we study indistinguishability obfuscation and functional encryption for general circuits: Indistinguishability obfuscation requires that given any two equivalent circuits $C_0$ and $C_1$ of similar size, the obfuscations of $C_0$ and $C_1$ should be computationally indistinguishable. In functional encryption, ciphertexts encrypt inputs $x$ and keys are issued for circuits $C$. Using the key $\mathrm{SK}_C$ to decrypt a ciphertext $\mathrm{CT}_x={\sf Enc}(x)$ yields the value $C(x)$ but does not reveal anything else about $x$. Furthermore, no collusion of secret key holders should be able to learn anything more than the union of what they can each learn individually. We give constructions for indistinguishability obfuscation and functional encryption that supports all polynomial-size circuits. We accomplish this goal in three steps: (1) We describe a candidate construction for indistinguishability obfuscation for $\mathbf{NC}^1$ circuits. The security of this construction is based on a new al...

Прототип системы контролируемого разграничения доступа к файлам документальных форматов

The safety problem with information circulating in corporate informationcomputer nets is urgent under conditions of presentday information society. The authors have developed a generalized functional model of the process of controlled access differentiation. At the same time come forward users identified by accounts as access subjects in the model and files of documentation formats are objects. Rules for the differentiation of a subject access to objects are specified as a matrix of powers taking into account marks of confidentiality. A distinguishing feature consists in that a container storing data is protected on basis of the method of indistinguishable obfuscation. The model developed allows storing data in a uniformed kind and ensuring a single method for an access to them. For safe storing is used a format of the protected container where information is stored in an obfuscated form. A container represents an executable file having a number of preset properties and functions allowing unambiguously the user identification, differentiation of an access to data (rights: to read, write, and assignation), assurance of the security for a confidence of the document implemented. The container format ensures its safe storing and transmission through a network.

Analytical Model for Protecting Documentary File Formats from Unauthorized Access

The article describes the method of documentary file formats protection from unau-thorized access based on indistinguishable program code obfuscation. The application of indistinguishable obfuscation to solve the problem of unauthorized access protection is substantiated. Mathematical model of indistinguishable program code obfuscation underlying the method of documentary file formats protection from unauthorized access is proposed.

Sakai–Ohgishi–Kasahara identity-based non-interactive key exchange revisited and more

Identity-based non-interactive key exchange (IB-NIKE) is a powerful but a bit overlooked primitive in identity-based cryptography. While identity-based encryption and signature have been extensively investigated over the past three decades, IB-NIKE has remained largely unstudied. So far, there are only few IB-NIKE schemes in the literature. Among them, Sakai---Ohgishi---Kasahara (SOK) scheme is the first efficient and secure two-party IB-NIKE scheme, which has great influence on follow-up works. However, the SOK scheme required its identity mapping function to be modeled as a random oracle to prove security. Moreover, its existing security proof heavily relies on the ability of programming the random oracle. It is unknown whether such reliance is inherent. In this work, we intensively revisit the SOK IB-NIKE scheme and present a series of possible and impossible results in the random oracle model and the standard model. In the random oracle model, we first improve previous security analysis for the SOK IB-NIKE scheme by giving a tighter reduction. We then use meta-reduction technique to show that the SOK scheme is unlikely proven to be secure based on the computational bilinear Diffie---Hellman assumption without programming the random oracle. In the standard model, we show how to instantiate the random oracle in the SOK scheme with a concrete hash function from admissible hash functions (AHFs) and indistinguishability obfuscation. The resulting scheme is adaptively secure based on the decisional bilinear Diffie---Hellman inversion assumption. To the best of our knowledge, this is the first adaptively secure IB-NIKE scheme in the standard model that does not explicitly require multilinear maps. Previous schemes in the standard model either have merely selective security or require programmable hash functions from multilinear maps. At the technical heart of our scheme, we generalize the definition of AHFs and propose a generic construction which enables AHFs with previously unachieved parameters. This might be of independent interest. In addition, we present some new results about IB-NIKE. Firstly, we propose a generic construction of multiparty IB-NIKE from extractable witness PRFs and existentially unforgeable signatures. Secondly, we investigate the relation between semi-adaptive security and adaptive security of IB-NIKE. Somewhat surprisingly, we show that these two notions are polynomially equivalent.