1. Non-Trivial Witness Encryption and Null-𝑖𝑂 from Standard Assumptions
Zvika Brakerski (Weizmann), Aayush Jain (UCLA), Ilan Komargodski (Cornell), Alain Passelègue (UCLA → Inria), Daniel Wichs (Northeastern U.)
0’-0’15”
bonjour a tous, je suis tres heureux d’etre ici pour vous parler ce projet qui porte sur l’etude des fonctions pseudo-aleatoires. Je suis actuellement en postdoc a UCLA depuis un peu plus d’un an et j’ai fait ma these auparavant a l’ENS

2. motivation I want to know if a certain statement is valid
I am willing to give a reward for the answer
I want this reward to remain safe if the statement is invalid
e.g. “factoring is in 𝑃”
e.g bitcoin
proof
public
prove Riemann, 1000bitcoins
“statement”
/19

3. witness encryption [GGSW14]
𝐿 an 𝑁𝑃-language induced by a relation 𝑅 𝐿 : 0,1 𝑛 × 0,1 𝑚 → 0,1
statement 𝑠
witness 𝑤
if 𝑠∉𝐿
𝐸𝑛𝑐 1 𝜆 ,𝑠,𝑚
≈ 𝑐 𝐸𝑛𝑐 1 𝜆 ,𝑠,𝑚′
keyless
no security guarantee regarding 𝑚 if 𝑠∈𝐿
definition for NP
𝑤 with 𝑅 𝐿 𝑠,𝑤 =1
if 𝑠∈𝐿 𝑚
/19

4. witness encryption [GGSW14]
if 𝑠∉𝐿
𝐸𝑛𝑐 1 𝜆 ,𝑠,𝒓𝒆𝒘𝒂𝒓𝒅
≈ 𝑐 𝐸𝑛𝑐 1 𝜆 ,𝑠,𝒓𝒂𝒏𝒅𝒐𝒎
reward can be claimed
⇔ the statement is valid
definition for NP
𝑤 with 𝑅 𝐿 𝑠,𝑤 =1
if 𝑠∈𝐿
𝑟𝑒𝑤𝑎𝑟𝑑
/19

5. applications [GGSW14,KNY14]
public-key encryption, identity-based encryption
attribute-based encryption for 𝑃/𝑝𝑜𝑙𝑦
secret-sharing for monotone 𝑁𝑃
SS for NP, ...
/19

6. state of the art only known from multilinear maps, obfuscation, ...
security of these notions is still very uncertain
can we build non-trivial witness encryption from standard assumptions?
here is a construction!
here is how to break it!
[GGH13, CLT13, GGH15, MZ18, ...]
[CHL+15, CGH+15, MSZ16, CFL+16, ...]
io, mmaps... LWE?
/19

7. non-trivial efficiency
non-trivial efficiency first introduced in the context of 𝑖𝑂 [LPST16] 𝐶
correctness: 𝑪 ≡𝑪
security: 𝑪≡ 𝑪 ′ ⇒ 𝑪 ≈ 𝒄 𝑪 ′ 𝑖𝑂 𝐶
trivial: truth-table 𝐶
𝐶( 0 𝑛 )
𝐶( 1 𝑛 ) … 𝐶
non-trivial IO + LWE => IO
2 𝑛 ⋅ 𝑜𝑢𝑡𝑝𝑢𝑡 = 2 𝑛 ⋅𝑝𝑜𝑙𝑦 𝐶
/19

8. importance of non-trivial constructions
non-trivial efficiency first introduced in the context of 𝑖𝑂 [LPST16] 𝐶
correctness: 𝑪 ≡𝑪
security: 𝑪≡ 𝑪 ′ ⇒ 𝑪 ≈ 𝒄 𝑪 ′ 𝑖𝑂 𝐶
non-trivial: 𝐶
𝑋𝑖𝑂 𝐶
non-trivial IO + LWE => IO
𝟐 𝒏𝜸 ⋅𝒑𝒐𝒍𝒚 𝑪
with 𝜸<𝟏
thm: [LPST16] 𝛾-𝑋𝑖𝑂 with 𝛾=Ω 1 +LWE⇒ full-fledged 𝑖𝑂
used in most 𝑖𝑂 constructions since then [LV16, BNPW16, Lin17, AS17, LT17, Agr18, LM18, AJKS18, ...]
/19

9. what is trivial/non-trivial for WE?
𝑅 𝐿 : 0,1 𝑛 × 0,1 𝑚 → 0,1
if 𝑠∉𝐿
𝐸𝑛𝑐 1 𝜆 ,𝑠,𝑚
≈ 𝑐 𝐸𝑛𝑐 1 𝜆 ,𝑠,𝑚′
if 𝑠∈𝐿
𝑤 with 𝑅 𝐿 𝑠,𝑤 =1
correctness only if 𝒙∈𝑳
security only if 𝒙∉𝑳 𝑚
trivial construction:
to encrypt (𝑠,𝑚), check if 𝑠∈𝐿 (e.g., test 𝑅 𝐿 𝑠,𝑤 ,∀𝑤∈ 0,1 𝑚 )
if 𝒔∈𝑳: output 𝒎 (correctness)
else: output ⊥ (security)
𝑬𝒏𝒄 run-time = 𝟐 𝒎 ⋅𝒑𝒐𝒍𝒚(𝝀,𝒏,𝒎)
trivial in 2^m, non trivial?
non-trivial: 𝑬𝒏𝒄 run-time = 𝟐 𝜸𝒎 ⋅𝒑𝒐𝒍𝒚(𝝀,𝒏,𝒎) with 𝜸<𝟏
we call it 𝜸-XWE(𝛾-EXponentially efficient Witness Encryption)
/19

10. our results we construct 𝟏/𝟐-XWE (run-time 2 𝑚/2 ⋅𝑝𝑜𝑙𝑦(𝜆,𝑛,𝑚)):
for 𝑵𝑷 from 𝐋𝐖𝐄
for 𝑵𝑷 languages with 𝑵 𝑪 𝟏 verification from 𝐁𝐃𝐃𝐇
we construct 𝟏/𝟐-Xnull-𝒊𝑶 from 𝐋𝐖𝐄
efficiency trade-off for XWE from LWE
this talk
XWE, XNiO
/19

11. attribute-based encryption
public attribute
private message
𝐸𝑛 𝑐 𝑠𝑘 𝐴,𝑚
can delegate partial decryption keys
𝑠 𝑘 𝑃
technical slides
predicate
/19

12. attribute-based encryption
public attribute
private message
if 𝑃 𝐴 =0
𝐸𝑛 𝑐 𝑠𝑘 𝐴,𝑚
𝐸𝑛 𝑐 𝑠𝑘 𝐴,𝑚
≈ 𝑐 𝐸𝑛 𝑐 𝑠𝑘 𝐴,𝑚′
can delegate partial decryption keys
𝑠 𝑘 𝑃
𝑠 𝑘 𝑃
technical slides
if 𝑃 𝐴 =1
predicate 𝑚
/19

13. ½-XWE from ABE
𝐿 an 𝑁𝑃-language induced by a relation 𝑹 𝑳 : 𝟎,𝟏 𝒏 × 𝟎,𝟏 𝒎 → 𝟎,𝟏
𝒔∈𝑳⇔∃𝒘∈ 𝟎,𝟏 𝒎 𝒔.𝒕. 𝑹 𝑳 𝒔,𝒘 =𝟏
for any fixed statement 𝑠∈ 0,1 𝑛 , consider the circuit 𝑹 𝒔 ≔ 𝑹 𝑳 𝒔,⋅
𝑹 𝒔 : 𝟎,𝟏 𝒎/𝟐 × 𝟎,𝟏 𝒎/𝟐 →{𝟎,𝟏}
𝑹 𝒔 : 𝟎,𝟏 𝒎 →{𝟎,𝟏}
𝑤 1
technical slides
𝑤 2
𝑅 𝑠 ( 𝑤 1 || 𝑤 2 )
𝑅 𝑠 𝑤 𝑤
2 𝑚/2
2 𝑚/2
/19

14. ½-XWE from ABE
𝐿 an 𝑁𝑃-language induced by a relation 𝑹 𝑳 : 𝟎,𝟏 𝒏 × 𝟎,𝟏 𝒎 → 𝟎,𝟏
𝒔∈𝑳⇔∃𝒘∈ 𝟎,𝟏 𝒎 𝒔.𝒕. 𝑹 𝑳 𝒔,𝒘 =𝟏
for any fixed statement 𝑠∈ 0,1 𝑛 , consider the circuit 𝑹 𝒔 ≔𝑹 𝒔,⋅
how to encrypt (𝒔,𝒎) for a fixed statement 𝑠?
𝑹 𝒔 : 𝟎,𝟏 𝒎/𝟐 × 𝟎,𝟏 𝒎/𝟐 →{𝟎,𝟏}
𝑬𝒏 𝒄 𝒔𝒌 ( 𝒘 𝟏 ,𝒎)
𝑤 1
technical slides
𝒔𝒌 𝑹 𝒔 (⋅| 𝒘 𝟐 )
𝑤 2
𝑅 𝑠 ( 𝑤 1 || 𝑤 2 )
𝑅 𝑠 𝑤 𝑤
2 𝑚/2
2 𝑚/2
/19

15. ½-XWE from ABE 𝑅 𝑠 𝑤 𝑤 𝑹 𝒔 : 𝟎,𝟏 𝒎/𝟐 × 𝟎,𝟏 𝒎/𝟐 →{𝟎,𝟏}
𝑹 𝒔 : 𝟎,𝟏 𝒎/𝟐 × 𝟎,𝟏 𝒎/𝟐 →{𝟎,𝟏}
how to encrypt (𝒔,𝒎) for a fixed statement 𝑠?
correctness:
𝒔∈𝑳⇔∃𝒘= 𝒘 𝟏 | 𝒘 𝟐 𝒔.𝒕. 𝑹 𝒔 𝒘 𝟏 | 𝒘 𝟐 =𝟏
security:
𝒔∉𝑳⇔∀𝒘= 𝒘 𝟏 | 𝒘 𝟐 , 𝑹 𝒔 𝒘 𝟏 | 𝒘 𝟐 =𝟎
𝑬𝒏 𝒄 𝒔𝒌 ( 𝒘 𝟏 ,𝒎)
𝑅 𝑠 𝑤 𝑤
2 𝑚/2
𝑬𝒏 𝒄 𝒔𝒌 ( 𝒘 𝟏 ,𝒎)
𝒔𝒌 𝑹 𝒔 (⋅| 𝒘 𝟐 )
≈ 𝒄 𝑬𝒏 𝒄 𝒔𝒌 ( 𝒘 𝟏 ,𝒎′)
𝒔𝒌 𝑹 𝒔 (⋅| 𝒘 𝟐 )
technical slides 𝒎
𝒔𝒌 𝑹 𝒔 (⋅| 𝒘 𝟐 )
/19

16. ½-XWE from ABE 𝐸𝑛𝑐 1 𝜆 ,𝑠,𝑚 is formed of:
𝐿 an 𝑁𝑃-language induced by a relation 𝑅: 0,1 𝑛 × 0,1 𝑚 → 0,1
𝐸𝑛𝑐 1 𝜆 ,𝑠,𝑚 is formed of:
𝟐 𝒎/𝟐 ABE ciphertexts 𝐸𝑛 𝑐 𝑠𝑘 𝑤 1 ,𝑚 𝑤 1 ∈ 0,1 𝑚/2
𝟐 𝒎/𝟐 ABE partial keys 𝑠 𝑘 𝑅 𝑠 (⋅| 𝑤 2 ) 𝑤 2 ∈ 0,1 𝑚/2
each ciphertext/partial key can be generated in time 𝑝𝑜𝑙𝑦(𝜆,𝑛,𝑚)
overall run-time: 𝟐 𝒎/𝟐 ⋅𝒑𝒐𝒍𝒚 𝝀,𝒏,𝒎 ⇒𝟏/𝟐-XWE
ABE requirement: can generate keys for predicates 𝑹 𝒔 ⋅ 𝒘 𝟐
technical slides
/19

17. instantiations from standard assumptions
instantiated with known ABE schemes, we obtain:
½-XWE for all 𝑁𝑃 from LWE [GVW13]
½-XWE for 𝑁𝑃 languages with verification in 𝑁 𝐶 1 (e.g. SAT) from BDDH [GPSW06]
possible trade-off using ABE with short keys [BGG+14]
idea: 𝑠 𝑘 𝑃 =𝑝𝑜𝑙𝑦 𝑑𝑒𝑝𝑡ℎ 𝑃
⇒ generate partial keys for 𝑤 3 ∈ 0,1 𝑚/3 𝑅 𝑠 (⋅ 𝑤 2 𝑤 3 )
⇒ longer to encrypt (generate keys for exponential-sized predicate)
but fewer keys/ciphertexts (with similar size) thus shorter to decrypt
BDDH for NC1, LWE for all NP
/19

18. non-trivial null-𝑖𝑂 𝐶 𝐶 correctness: 𝑪 ≡𝑪,∀𝑪
security: 𝑪≡ 𝑪 ′ ⇒ 𝑪 ≈ 𝒄 𝑪 ′ 𝐶
𝑛𝑢𝑙𝑙-𝑖𝑂 𝑖𝑂
𝑪≡ 𝑪 ′ ≡𝟎
trivial construction:
test if 𝐶≡0 (e.g. test 𝐶 𝑥 ==0, ∀𝑥∈ 0,1 𝑛 ):
if 𝐶≡0:
output 𝟎 (security)
else:
output 𝑪 (correctness)
run-time: 2 𝑛 ⋅𝑝𝑜𝑙𝑦 𝜆, 𝐶
BDDH for NC1, LWE for all NP
non-trivial: 𝟐 𝜸𝒏 ⋅𝒑𝒐𝒍𝒚 𝝀, 𝑪 for any 𝜸<𝟏
we call it 𝜸-Xnull-𝒊𝑶
/19

19. 1/2-Xnull-𝑖𝑂 we obtain 𝟏/𝟐-Xnull-𝒊𝑶 from 𝐋𝐖𝐄 in two ways:
compression-preserving transform from WE to null-𝑖𝑂 via lockable obfuscation (LWE) [WZ17,GKW17]
⇒𝜸-XWE + 𝐋𝐖𝐄⇒ 𝜸-null-𝒊𝑶
similar to XWE construction but using predicate encryption (attribute remains hidden if 𝑃(𝐴)=0):
𝐸𝑛 𝑐 𝑠𝑘 𝐶, 𝑥 1 ,1 𝑥 1 ∈ 0,1 𝑛/2
𝑠 𝑘 𝑈 𝑥 𝑥 2 ∈ 0,1 𝑛/2 with 𝑈 𝑥 2 𝐶, 𝑥 1 =𝐶( 𝑥 1 | 𝑥 2 )
𝐶 𝑥 1 𝑥 2 =1⇒𝐷𝑒𝑐 𝑠 𝑘 𝑈 𝑥 2 ,𝑐 𝑡 𝑥 1 =1 (correctness)
if 𝐶≡0, 𝑈 𝑥 2 𝐶, 𝑥 1 =0, ∀ 𝑥 1 , 𝑥 (security)
BDDH for NC1, LWE for all NP
/19

20. conclusion and open problems
we construct 𝟏/𝟐-XWE and 𝟏/𝟐-Xnull-𝒊𝑶 from standard assumptions
can we bootstrap XWE (resp. Xnull-𝑖𝑂) to full-fledged WE (resp. null-𝑖𝑂) like in the case of 𝑖𝑂?
can we use XWE or Xnull-𝑖𝑂 to build efficient primitives from standard assumptions?
BDDH for NC1, LWE for all NP
/19

21. thanks!