The Experts below are selected from a list of 807 Experts worldwide ranked by ideXlab platform
Brent Waters - One of the best experts on this subject based on the ideXlab platform.
-
Low overhead broadcast encryption from Multilinear Maps. Cryptology ePrint Archive, Report 2014/195, 2014. http: //eprint.iacr.org
2015Co-Authors: Dan Boneh, Brent Waters, Mark ZhandryAbstract:We use Multilinear Maps to provide a solution to the long-standing problem of public-key broadcast encryption where all parameters in the system are small. In our constructions, ciphertext overhead, private key size, and public key size are all poly-logarithmic in the total number of users. The systems are fully collusion-resistant against any number of colluders. All our systems are based on an O(logN)-way Multilinear Map to support a broadcast system for N users. We present three constructions based on different types of Multilinear Maps and providing different security guarantees. Our systems naturally give identity-based broadcast systems with short parameters.
-
Low Overhead Broadcast Encryption from Multilinear Maps
2014Co-Authors: Dan Boneh, Brent Waters, Mark ZhandryAbstract:We use Multilinear Maps to provide a solution to the long-standing problem of public-key broadcast encryption where all parameters in the system are small. In our constructions, ciphertext overhead, private key size, and public key size are all poly-logarithmic in the total number of users. The systems are fully secure against any number of colluders. All our systems are based on an O(logN)-way Multilinear Map to support a broadcast system for N users. We present three constructions based on different types of Multilinear Maps and providing different security guarantees. Our systems naturally give identity-based broadcast systems with short parameters.
-
low overhead broadcast encryption from Multilinear Maps
International Cryptology Conference, 2014Co-Authors: Dan Boneh, Brent Waters, Mark ZhandryAbstract:We use Multilinear Maps to provide a solution to the long-standing problem of public-key broadcast encryption where all parameters in the system are small. In our constructions, ciphertext overhead, private key size, and public key size are all poly-logarithmic in the total number of users. The systems are fully collusion-resistant against any number of colluders. All our systems are based on an O(logN)-way Multilinear Map to support a broadcast system for N users. We present three constructions based on different types of Multilinear Maps and providing different security guarantees. Our systems naturally give identity-based broadcast systems with short parameters.
-
attribute based encryption for circuits from Multilinear Maps
International Cryptology Conference, 2013Co-Authors: Sanjam Garg, Craig Gentry, Shai Halevi, Amit Sahai, Brent WatersAbstract:In this work, we provide the first construction of Attribute- Based Encryption (ABE) for general circuits. Our construction is based on the existence of Multilinear Maps. We prove selective security of our scheme in the standard model under the natural Multilinear generalization of the BDDH assumption. Our scheme achieves both Key-Policy and Ciphertext-Policy variants of ABE. Our scheme and its proof of security directly translate to the recent Multilinear Map framework of Garg, Gentry, and Halevi.
-
full domain hash from leveled Multilinear Maps and identity based aggregate signatures
International Cryptology Conference, 2013Co-Authors: Susan Hohenberger, Amit Sahai, Brent WatersAbstract:In this work, we explore building constructions with full domain hash structure, but with standard model proofs that do not employ the random oracle heuristic. The launching point for our results will be the utilization of a “leveled” Multilinear Map setting for which Garg, Gentry, and Halevi (GGH) recently gave an approximate candidate. Our first step is the creation of a standard model signature scheme that exhibits the structure of the Boneh, Lynn and Shacham signatures. In particular, this gives us a signature that admits unrestricted aggregation.
Mark Zhandry - One of the best experts on this subject based on the ideXlab platform.
-
secure obfuscation in a weak Multilinear Map model
Theory of Cryptography Conference, 2016Co-Authors: Sanjam Garg, Amit Sahai, Eric Miles, Pratyay Mukherjee, Akshayaram Srinivasan, Mark ZhandryAbstract:All known candidate indistinguishability obfuscation iO schemes rely on candidate Multilinear Maps. Until recently, the strongest proofs of security available for iO candidates were in a generic model that only allows "honest" use of the Multilinear Map. Most notably, in this model the zero-test procedure only reveals whether an encoded element is 0, and nothing more. However, this model is inadequate: there have been several attacks on Multilinear Maps that exploit extra information revealed by the zero-test procedure. In particular, Miles, Sahai and Zhandry Crypto'16 recently gave a polynomial-time attack on several iO candidates when instantiated with the Multilinear Maps of Garg, Gentry, and Halevi Eurocrypt'13, and also proposed a new "weak Multilinear Map model" that captures all known polynomial-time attacks on GGH13. In this work, we give a new iO candidate which can be seen as a small modification or generalization of the original candidate of Garg, Gentry, Halevi, Raykova, Sahai, and Waters FOCS'13. We prove its security in the weak Multilinear Map model, thus giving the first iO candidate that is provably secure against all known polynomial-time attacks on GGH13. The proof of security relies on a new assumption about the hardness of computing annihilating polynomials, and we show that this assumption is implied by the existence of pseudorandom functions in NC $$^1$$ 1.
-
Post-Zeroizing Obfuscation: The case of Evasive Circuits∗
2016Co-Authors: Saikrishna Badrinarayanan, Amit Sahai, Eric Miles, Mark ZhandryAbstract:Recent devastating attacks by Cheon et al. [Eurocrypt’15] and others have highlighted signifi-cant gaps in our intuition about security in candidate Multilinear Map schemes, and in candidate obfuscators that use them. The new attacks, and some that were previously known, are typically called “zeroizing ” attacks because they all crucially rely on the ability of the adversary to create encodings of 0. In this work, we initiate the study of post-zeroizing obfuscation, and we present a construction for the special case of evasive functions. We show that our obfuscator survives all known attacks on the underlying Multilinear Maps, by proving that no encodings of 0 can be created by a generic-model adversary. Previous obfuscators (for both evasive and general functions) were either analyzed in a less-conservative “pre-zeroizing ” model that does not capture recent attacks, or were proved secure relative to assumptions that are now known to be false. To prove security, we introduce a new technique for analyzing polynomials over Multilinear Map encodings. This technique shows that the types of encodings an adversary can create are much more restricted than was previously known, and is a crucial step toward achieving post-zeroizing security. We also believe the technique is of independent interest, as it yields efficiency improvements for existing schemes
-
Low overhead broadcast encryption from Multilinear Maps. Cryptology ePrint Archive, Report 2014/195, 2014. http: //eprint.iacr.org
2015Co-Authors: Dan Boneh, Brent Waters, Mark ZhandryAbstract:We use Multilinear Maps to provide a solution to the long-standing problem of public-key broadcast encryption where all parameters in the system are small. In our constructions, ciphertext overhead, private key size, and public key size are all poly-logarithmic in the total number of users. The systems are fully collusion-resistant against any number of colluders. All our systems are based on an O(logN)-way Multilinear Map to support a broadcast system for N users. We present three constructions based on different types of Multilinear Maps and providing different security guarantees. Our systems naturally give identity-based broadcast systems with short parameters.
-
Low Overhead Broadcast Encryption from Multilinear Maps
2014Co-Authors: Dan Boneh, Brent Waters, Mark ZhandryAbstract:We use Multilinear Maps to provide a solution to the long-standing problem of public-key broadcast encryption where all parameters in the system are small. In our constructions, ciphertext overhead, private key size, and public key size are all poly-logarithmic in the total number of users. The systems are fully secure against any number of colluders. All our systems are based on an O(logN)-way Multilinear Map to support a broadcast system for N users. We present three constructions based on different types of Multilinear Maps and providing different security guarantees. Our systems naturally give identity-based broadcast systems with short parameters.
-
low overhead broadcast encryption from Multilinear Maps
International Cryptology Conference, 2014Co-Authors: Dan Boneh, Brent Waters, Mark ZhandryAbstract:We use Multilinear Maps to provide a solution to the long-standing problem of public-key broadcast encryption where all parameters in the system are small. In our constructions, ciphertext overhead, private key size, and public key size are all poly-logarithmic in the total number of users. The systems are fully collusion-resistant against any number of colluders. All our systems are based on an O(logN)-way Multilinear Map to support a broadcast system for N users. We present three constructions based on different types of Multilinear Maps and providing different security guarantees. Our systems naturally give identity-based broadcast systems with short parameters.
Changmin Lee - One of the best experts on this subject based on the ideXlab platform.
-
statistical zeroizing attack cryptanalysis of candidates of bp obfuscation over ggh15 Multilinear Map
International Cryptology Conference, 2019Co-Authors: Jung Hee Cheon, Wonhee Cho, Minki Hhan, Jiseung Kim, Changmin LeeAbstract:We present a new cryptanalytic algorithm on obfuscations based on GGH15 Multilinear Map. Our algorithm, statistical zeroizing attack, directly distinguishes two distributions from obfuscation while it follows the zeroizing attack paradigm, that is, it uses evaluations of zeros of obfuscated programs.
-
cryptanalysis of the clt13 Multilinear Map
Journal of Cryptology, 2019Co-Authors: Jung Hee Cheon, Kyoohyung Han, Hansol Ryu, Changmin Lee, Damien StehléAbstract:In this paper, we describe a polynomial time cryptanalysis of the (approximate) Multilinear Map proposed by Coron, Lepoint, and Tibouchi in Crypto13 (CLT13). This scheme includes a zero-testing functionality that determines whether the message of a given encoding is zero or not. This functionality is useful for designing several of its applications, but it leaks unexpected values, such as linear combinations of the secret elements. By collecting the outputs of the zero-testing algorithm, we construct a matrix containing the hidden information as eigenvalues, and then recover all the secret elements of the CLT13 scheme via diagonalization of the matrix. In addition, we provide polynomial time algorithms to directly break the security assumptions of many applications based on the CLT13 scheme. These algorithms include solving subgroup membership, decision linear, and graded external Diffie–Hellman problems. These algorithms mainly rely on the computation of the determinants of the matrices and their greatest common divisor, instead of performing their diagonalization.
-
cryptanalyses of branching program obfuscations over ggh13 Multilinear Map from the ntru problem
International Cryptology Conference, 2018Co-Authors: Jung Hee Cheon, Minki Hhan, Jiseung Kim, Changmin LeeAbstract:In this paper, we propose cryptanalyses of all existing indistinguishability obfuscation (iO) candidates based on branching programs (BP) over GGH13 Multilinear Map for all recommended parameter settings. To achieve this, we introduce two novel techniques, program converting using NTRU-solver and matrix zeroizing, which can be applied to a wide range of obfuscation constructions and BPs compared to previous attacks. We then prove that, for the suggested parameters, the existing general-purpose BP obfuscations over GGH13 do not have the desired security. Especially, the first candidate indistinguishability obfuscation with input-unpartitionable branching programs (FOCS 2013) and the recent BP obfuscation (TCC 2016) are not secure against our attack when they use the GGH13 with recommended parameters. Previously, there has been no known polynomial time attack for these cases.
-
Cryptanalysis of the Multilinear Map over the Integers
2016Co-Authors: Jung Hee Cheon, Kyoohyung Han, Hansol Ryu, Changmin Lee, Damien StehléAbstract:We describe a polynomial-time cryptanalysis of the (approximate) Multilinear Map of Coron, Lepoint and Tibouchi (CLT). The attack relies on an adaptation of the so-called zeroizing attack against the Garg, Gentry and Halevi (GGH) candidate Multilinear Map. Zeroiz- ing is much more devastating for CLT than for GGH. In the case of GGH, it allows to break generalizations of the Decision Linear and Subgroup Membership problems from pairing-based cryptography. For CLT, this leads to a total break: all quantities meant to be kept secret can be efficiently and publicly recovered.
-
cryptanalysis of Multilinear Map on ideal lattices, iacr e-print
2016Co-Authors: Jung Hee Cheon, Changmin LeeAbstract:Abstract. We improve the zeroizing attack on the Multilinear Map of Garg, Gentry and Halevi (GGH). Our algorithm can solve the Graded Decisional Diffie-Hellman (GDDH) problem on the GGH scheme when the dimension n of the ideal lattice Z[X]/(Xn+1) is O(κλ2) as suggested for the κ-linear GGH scheme. The zeroizing attack is to recover a basis of an ideal generated by a secret element g ∈ Z[X]/(Xn + 1) from the zero testing parameter and several encodings in public. It can solve the DLIN and subgroup decision prob-lems, but not the GDDH problem on the GGH scheme for the suggested dimension n due to the hardness of the smallest basis problem and the shortest vector problem on the ideal lattice. In this paper, we propose an algorithm to find a short vector in the ideal lattice 〈g 〉 by applying a lattice reduction to a sublattice obtained from the Hermit Normal Form of 〈g〉. This attack utilizes that the determinant of the lattice 〈g 〉 is not large. We further show that if g has a large residual degree, one can find a short element of g in polynomial time of n. In order to resist the pro-posed attacks, it is required that n = Ω̃(κ2λ3) and the positive generator of 〈g 〉 ∩ Z is large enough
Amit Sahai - One of the best experts on this subject based on the ideXlab platform.
-
secure obfuscation in a weak Multilinear Map model
Theory of Cryptography Conference, 2016Co-Authors: Sanjam Garg, Amit Sahai, Eric Miles, Pratyay Mukherjee, Akshayaram Srinivasan, Mark ZhandryAbstract:All known candidate indistinguishability obfuscation iO schemes rely on candidate Multilinear Maps. Until recently, the strongest proofs of security available for iO candidates were in a generic model that only allows "honest" use of the Multilinear Map. Most notably, in this model the zero-test procedure only reveals whether an encoded element is 0, and nothing more. However, this model is inadequate: there have been several attacks on Multilinear Maps that exploit extra information revealed by the zero-test procedure. In particular, Miles, Sahai and Zhandry Crypto'16 recently gave a polynomial-time attack on several iO candidates when instantiated with the Multilinear Maps of Garg, Gentry, and Halevi Eurocrypt'13, and also proposed a new "weak Multilinear Map model" that captures all known polynomial-time attacks on GGH13. In this work, we give a new iO candidate which can be seen as a small modification or generalization of the original candidate of Garg, Gentry, Halevi, Raykova, Sahai, and Waters FOCS'13. We prove its security in the weak Multilinear Map model, thus giving the first iO candidate that is provably secure against all known polynomial-time attacks on GGH13. The proof of security relies on a new assumption about the hardness of computing annihilating polynomials, and we show that this assumption is implied by the existence of pseudorandom functions in NC $$^1$$ 1.
-
Post-Zeroizing Obfuscation: The case of Evasive Circuits∗
2016Co-Authors: Saikrishna Badrinarayanan, Amit Sahai, Eric Miles, Mark ZhandryAbstract:Recent devastating attacks by Cheon et al. [Eurocrypt’15] and others have highlighted signifi-cant gaps in our intuition about security in candidate Multilinear Map schemes, and in candidate obfuscators that use them. The new attacks, and some that were previously known, are typically called “zeroizing ” attacks because they all crucially rely on the ability of the adversary to create encodings of 0. In this work, we initiate the study of post-zeroizing obfuscation, and we present a construction for the special case of evasive functions. We show that our obfuscator survives all known attacks on the underlying Multilinear Maps, by proving that no encodings of 0 can be created by a generic-model adversary. Previous obfuscators (for both evasive and general functions) were either analyzed in a less-conservative “pre-zeroizing ” model that does not capture recent attacks, or were proved secure relative to assumptions that are now known to be false. To prove security, we introduce a new technique for analyzing polynomials over Multilinear Map encodings. This technique shows that the types of encodings an adversary can create are much more restricted than was previously known, and is a crucial step toward achieving post-zeroizing security. We also believe the technique is of independent interest, as it yields efficiency improvements for existing schemes
-
Technion
2015Co-Authors: Eric Miles, Amit Sahai, Mor WeissAbstract:Obfuscation, the task of compiling circuits or programs to make the internal computation un-intelligible while preserving input/output functionality, has become an object of central focus in the cryptographic community. A work of Garg et al. [FOCS 2013] gave the first candidate obfus-cator for general polynomial-size circuits, and led to several other works constructing candidate obfuscators. Each of these constructions is built upon another cryptographic primitive called a Multilinear Map, or alternatively a graded encoding scheme. Several of these candidates have been shown to achieve the strongest notion of security (virtual black-box, or VBB) against “purely algebraic ” attacks in a model that we call the fully-restricted graded encoding model. In this model, each operation performed by an adversary is required to obey the algebraic restrictions of the graded encoding scheme. These restrictions essentially impose strong forms of homogeneity and Multilinearity on the allowed polynomials. While impor-tant, the scope of the security proofs is limited by the stringency of these restrictions. We propose and analyze another variant of the Garg et al. obfuscator in a setting that imposes fewer restrictions on the adversary, which we call the arithmetic setting. This setting captures
-
protecting obfuscation against algebraic attacks
Theory and Application of Cryptographic Techniques, 2014Co-Authors: Boaz Barak, Sanjam Garg, Yael Tauman Kalai, Omer Paneth, Amit SahaiAbstract:Recently, Garg, Gentry, Halevi, Raykova, Sahai, and Waters (FOCS 2013) constructed a general-purpose obfuscating compiler for NC1 circuits. We describe a simplified variant of this compiler, and prove that it is a virtual black box obfuscator in a generic Multilinear Map model. This improves on Brakerski and Rothblum (eprint 2013) who gave such a result under a strengthening of the Exponential Time Hypothesis. We remove this assumption, and thus resolve an open question of Garg et al. As shown by Garg et al., a compiler for NC1 circuits can be bootstrapped to a compiler for all polynomial-sized circuits under the learning with errors (LWE) hardness assumption.
-
semantically secure order revealing encryption multi input functional encryption without obfuscation
IACR Cryptology ePrint Archive, 2014Co-Authors: Dan Boneh, Amit Sahai, Mark Zhandry, Kevin Lewi, Mariana Raykova, Joe ZimmermanAbstract:Deciding “greater-than” relations among data items just given their encryptions is at the heart of search algorithms on encrypted data, most notably, non-interactive binary search on encrypted data. Order-preserving encryption provides one solution, but provably provides only limited security guarantees. Two-input functional encryption is another approach, but requires the full power of obfuscation machinery and is currently not implementable. We construct the first implementable encryption system supporting greater-than comparisons on encrypted data that provides the “best-possible” semantic security. In our scheme there is a public algorithm that given two ciphertexts as input, reveals the order of the corresponding plaintexts and nothing else. Our constructions are inspired by obfuscation techniques, but do not use obfuscation. For example, to compare two 16-bit encrypted values (e.g., salaries or age) we only need a 9-way Multilinear Map. More generally, comparing k-bit values requires only a (k/2 + 1)-way Multilinear Map. The required degree of Multilinearity can be further reduced, but at the cost of increasing ciphertext size. Beyond comparisons, our results give an implementable secret-key multi-input functional encryption scheme for functionalities that can be expressed as (generalized) branching programs of polynomial length and width. Comparisons are a special case of this class, where for k-bit inputs the branching program is of length k + 1 and width 4.
Jung Hee Cheon - One of the best experts on this subject based on the ideXlab platform.
-
statistical zeroizing attack cryptanalysis of candidates of bp obfuscation over ggh15 Multilinear Map
International Cryptology Conference, 2019Co-Authors: Jung Hee Cheon, Wonhee Cho, Minki Hhan, Jiseung Kim, Changmin LeeAbstract:We present a new cryptanalytic algorithm on obfuscations based on GGH15 Multilinear Map. Our algorithm, statistical zeroizing attack, directly distinguishes two distributions from obfuscation while it follows the zeroizing attack paradigm, that is, it uses evaluations of zeros of obfuscated programs.
-
cryptanalysis of the clt13 Multilinear Map
Journal of Cryptology, 2019Co-Authors: Jung Hee Cheon, Kyoohyung Han, Hansol Ryu, Changmin Lee, Damien StehléAbstract:In this paper, we describe a polynomial time cryptanalysis of the (approximate) Multilinear Map proposed by Coron, Lepoint, and Tibouchi in Crypto13 (CLT13). This scheme includes a zero-testing functionality that determines whether the message of a given encoding is zero or not. This functionality is useful for designing several of its applications, but it leaks unexpected values, such as linear combinations of the secret elements. By collecting the outputs of the zero-testing algorithm, we construct a matrix containing the hidden information as eigenvalues, and then recover all the secret elements of the CLT13 scheme via diagonalization of the matrix. In addition, we provide polynomial time algorithms to directly break the security assumptions of many applications based on the CLT13 scheme. These algorithms include solving subgroup membership, decision linear, and graded external Diffie–Hellman problems. These algorithms mainly rely on the computation of the determinants of the matrices and their greatest common divisor, instead of performing their diagonalization.
-
cryptanalyses of branching program obfuscations over ggh13 Multilinear Map from the ntru problem
International Cryptology Conference, 2018Co-Authors: Jung Hee Cheon, Minki Hhan, Jiseung Kim, Changmin LeeAbstract:In this paper, we propose cryptanalyses of all existing indistinguishability obfuscation (iO) candidates based on branching programs (BP) over GGH13 Multilinear Map for all recommended parameter settings. To achieve this, we introduce two novel techniques, program converting using NTRU-solver and matrix zeroizing, which can be applied to a wide range of obfuscation constructions and BPs compared to previous attacks. We then prove that, for the suggested parameters, the existing general-purpose BP obfuscations over GGH13 do not have the desired security. Especially, the first candidate indistinguishability obfuscation with input-unpartitionable branching programs (FOCS 2013) and the recent BP obfuscation (TCC 2016) are not secure against our attack when they use the GGH13 with recommended parameters. Previously, there has been no known polynomial time attack for these cases.
-
Cryptanalysis of the Multilinear Map over the Integers
2016Co-Authors: Jung Hee Cheon, Kyoohyung Han, Hansol Ryu, Changmin Lee, Damien StehléAbstract:We describe a polynomial-time cryptanalysis of the (approximate) Multilinear Map of Coron, Lepoint and Tibouchi (CLT). The attack relies on an adaptation of the so-called zeroizing attack against the Garg, Gentry and Halevi (GGH) candidate Multilinear Map. Zeroiz- ing is much more devastating for CLT than for GGH. In the case of GGH, it allows to break generalizations of the Decision Linear and Subgroup Membership problems from pairing-based cryptography. For CLT, this leads to a total break: all quantities meant to be kept secret can be efficiently and publicly recovered.
-
cryptanalysis of Multilinear Map on ideal lattices, iacr e-print
2016Co-Authors: Jung Hee Cheon, Changmin LeeAbstract:Abstract. We improve the zeroizing attack on the Multilinear Map of Garg, Gentry and Halevi (GGH). Our algorithm can solve the Graded Decisional Diffie-Hellman (GDDH) problem on the GGH scheme when the dimension n of the ideal lattice Z[X]/(Xn+1) is O(κλ2) as suggested for the κ-linear GGH scheme. The zeroizing attack is to recover a basis of an ideal generated by a secret element g ∈ Z[X]/(Xn + 1) from the zero testing parameter and several encodings in public. It can solve the DLIN and subgroup decision prob-lems, but not the GDDH problem on the GGH scheme for the suggested dimension n due to the hardness of the smallest basis problem and the shortest vector problem on the ideal lattice. In this paper, we propose an algorithm to find a short vector in the ideal lattice 〈g 〉 by applying a lattice reduction to a sublattice obtained from the Hermit Normal Form of 〈g〉. This attack utilizes that the determinant of the lattice 〈g 〉 is not large. We further show that if g has a large residual degree, one can find a short element of g in polynomial time of n. In order to resist the pro-posed attacks, it is required that n = Ω̃(κ2λ3) and the positive generator of 〈g 〉 ∩ Z is large enough