title | filename | chapternum |
---|---|---|
Obfuscation II: applications |
lec_22_obfuscation_part2 |
21 |
Fully homomorphic encryption is an extremely powerful notion, but it does not allow us to obtain fine control over the access to information. With the public key you can do all sorts of computation on the encrypted data, but you still do not learn it, while with the private key you learn everything. But in many situations we want fine grained access control: some people should get access to some of the information for some of the time. This makes the "all or nothing" nature of traditional encryptions problematic. While one could still implement such access control by interacting with the holder(s) of the secret key, this is not always possible.
The most general notion of an encryption scheme allowing fine control is known as functional encryption, as was described in the previous lecture.
This can be viewed as an object dual to Fully Homomorphic Encryption, and incomparable to it.
For every function
In this lecture we will focus on a weaker notion known as identity based encryption (IBE). Unlike the case of full fledged functional encryption, there are fairly efficient constructions known for IBE.
In a sense, functional encryption or IBE is all about selective leaking of information. That is, in some sense we want to modify an encryption scheme so that it actually is "less secure" in some very precise sense, so that it would be possible to learn something about the plaintext even without knowing the (full) decryption key.
There is actually a history of cryptographic technique meant to support such operations.
Perhaps the "mother" of all such "quasi encryption" schemes is the modular exponentiation operation
More generally, even in the private key setting, people have studied encryption schemes such as
-
Deterministic encryption : an encryption scheme that maps
to in a deterministic way. This cannot be semantically secure in general but can be good enough if the message has high enough entropy or doesn't repeat and allows to check if two encryptions encrypt the same object. (We can also do this by publishing a hash of under some secret salt.) -
Order preserving encryption: is an encryption scheme mapping numbers in some range
to ciphertexts so that given and one can efficiently compare whether . This is quite problematic for security. For example, given random such encryptions you can more or less know where they lie in the interval up to multiplicative factor.. -
Searchable encryption: is a generalization of deterministic encryption that allows some more sophisticated searchers (such as not only exact match).
Some of these constructions can be quite efficient. In particular the system CryptDB developed by Popa et al uses these kinds of encryptions to automatically turn a SQL database into one that works on encrypted data and still supports the required queries. However, the issue of how dangerous the "leakage" can be is somewhat subtle. See this paper and blog post claiming weaknesses in practical use cases for CryptDB, as well as this response by the CryptDB authors.
While the constructions of IBE and functional encryption often use maps such as
The standard exponentiation mapping
Pairing based cryptography begins with the observation that in some elliptic curve groups we can use a map based on the so called Weil or Tate pairings.
The idea is that we have an efficiently computable isomorphism from a group
The Pairing Diffie Hellman Assumption is that we can find two such groups
We now show an IBE construction due to Boneh and Franklin1 how we can obtain from the pairing diffie hellman assumption an identity based encryption:
-
Master key generation: We generate
as above, choose at random in . The master private key is and the master public key is . We let and be two hash functions modeled as random oracles. -
Key distribution: Given an arbitrary string
, we generate the decryption key corresponding to , as . -
Encryption: To encrypt a message
given the public paramters and some id , we choose , and output -
Decryption: Given the secret key
and a ciphertext , we output
Correctness: We claim that
Security: To prove security we need to first present a definition of IBE security. The definition allows the adversary to request keys corresponding to arbitrary identities, as long as it does not ask for keys corresponding to the target identity it wants to attack. There are several variants, including CCA type of security definitions, but we stick to a simple one here:
Definition: An IBE scheme is said to be CPA secure if every efficient adversary Eve wins the following game with probability at most
- The keys are generated and Eve gets the master public key.
- For
, Eve chooses an identity and gets the key . - Eve chooses an identity
and two messages . - We choose
and Eve gets the encryption of with respect to the identity . - Eve outputs
and wins if .
Theorem: If the pairing Diffie Hellman assumption holds and
Proof: Suppose for the sake of contradiction that there exists some time
We will build an algorithm
The algorithm
-
When
makes a query to with , then for all but the queries, will chooose a random (as usual we'll assume is prime), choose and define . Let be the query made to the oracle. We define (where is the input to - recall that does not know .) -
When
makes a query to the key distribution oracle with then if then will then respond with . If then aborts and fails. -
When
makes a query to the oracle with input then for all but the query answers with a random string in . In the query, if then stops and fails. Otherwise, it outputs . -
does stops the simulation and fails if we get to the challenge part.
It might seem weird that we stop the simulation before we reach the challenge part, but the correctness of this reduction follows from the following claim:
Claim: In the actual attack game, with probability at least
Proof: If
Given this claim, to prove the theorem we just need to observe that, assuming it does not fail,
Boneh and Silverberg asked the question of whether we could go beyond quadratic polynomials and get schemes that allow us to compute higher degree.
The idea is to get a multilinear map which would be a set of isomorphic groups $\mathbb{G}_1,\ldots,\mathbb{G}d$ with generators $g_1,\ldots,g_d$ such that we can map $g_i^a$ and $g_j^b$ to $g{i+j}^{ab}$.
This way we would be able to compute any degree
We will now show how using such a multilinear map we can get a construction for a witness encryption scheme. We will only show the construction, without talking about the security definition, the assumption, or security reductions.
Given some circuit Exact Cover
problem is NP complete to map
The first candidate construction for a multilinear map was given by Garg, Gentry and Halevi.
It is based on computational questions on lattices and so (perhaps not surprisingly) it involves significant complications due to noise.
At a very high level, the idea is to use a fully homomorphic encryption scheme that can evaluate polynomials up to some degree
Footnotes
-
The construction we show was first published in the CRYPTO 2001 conference. The Weil and Tate pairings were used before for cryptographic attacks, but were used for a positive cryptographic result by Antoine Joux in his 2000 paper getting a three-party Diffie Hellman protocol and then Boneh and Franklin used this to obtain an identity based encryption scheme, answering an open question of Shamir. At approximately the same time as these papers, Sakai, Ohgishi and Kasahara presented a paper in the SCIS 2000 conference in Japan showing an identity-based key exchange protocol from pairing. Also Clifford Cocks (who as we mentioned above in the 1970's invented the RSA scheme at GCHQ before R,S, and A did), also came up in 2001 with a different identity-based encryption scheme using the quadratic residuosity assumption. ↩