Skip to main content

Aayush Jain

Followers

2

Following

1

Public Views

Pratyay Mukherjee

UC Berkeley

Satyanarayana Vusirikala

Dublin City University

Alberto Trombetta

Interests

Uploads

Papers by Aayush Jain

Indistinguishability Obfuscation from LPN over F_p, DLIN, and PRGs in NC^0

IACR Cryptol. ePrint Arch., 2021

In this work, we study what minimal sets of assumptions suffice for constructing indistinguishabi... more In this work, we study what minimal sets of assumptions suffice for constructing indistinguishability obfuscation (iO). We prove: Theorem(Informal): Assume sub-exponential security of the following assumptions: • the Learning Parity with Noise (LPN) assumption over general prime fields Fp with polynomially many LPN samples and error rate 1/k , where k is the dimension of the LPN secret, and δ > 0 is any constant; • the existence of a Boolean Pseudo-Random Generator (PRG) in NC with stretch n , where n is the length of the PRG seed, and τ > 0 is any constant; • the Decision Linear (DLIN) assumption on symmetric bilinear groups of prime order. Then, (subexponentially secure) indistinguishability obfuscation for all polynomial-size circuits exists. Further, assuming only polynomial security of the aforementioned assumptions, there exists collusion resistant public-key functional encryption for all polynomial-size circuits. This removes the reliance on the Learning With Errors (LW...

A Note on the Pseudorandomness of Low-Degree Polynomials over the Integers

IACR Cryptol. ePrint Arch., 2021

We initiate the study of a problem called the Polynomial Independence Distinguishing Problem (PID... more We initiate the study of a problem called the Polynomial Independence Distinguishing Problem (PIDP). The problem is parameterized by a set of polynomials Q = (q1, . . . , qm) where each qi : R → R and an input distribution D over the reals. The goal of the problem is to distinguish a tuple of the form {qi, qi(x)}i∈[m] from {qi, qi(xi)}i∈[m] where x,x1, . . . ,xm are each sampled independently from the distribution D. Refutation and search versions of this problem are conjectured to be hard in general for polynomial time algorithms (Feige, STOC 02) and are also subject to known theoretical lower bounds for various hierarchies (such as Sum-of-Squares and Sherali-Adams). Nevertheless, we show polynomial time distinguishers for the problem in several scenarios, including settings where such lower bounds apply to the search or refutation versions of the problem. Our results apply to the setting when each polynomial is a constant degree multilinear polynomial. We show that this natural pr...

Analysis of Lightweight Block Cipher FeW on the Basis of Neural Network

Harmony Search and Nature Inspired Optimization Algorithms, 2018

Over the past few years, several lightweight ciphers have been proposed to supplement the Interne... more Over the past few years, several lightweight ciphers have been proposed to supplement the Internet of Things (IOT). FeW is one of the lightweight ciphers, which uses a mix of Feistel and generalized Feistel structures to achieve high efficiency in software-based department. This paper focuses on the analysis of lightweight block cipher FeW using the machine learning approach. This approach involves using artificial neural network to find the inherited biases present in the design of FeW.

Indistinguishability Obfuscation from Simple-to-State Hard Problems: New Assumptions, New Techniques, and Simplification

Lecture Notes in Computer Science, 2021

In this work, we study the question of what set of simpleto-state assumptions suffice for constru... more In this work, we study the question of what set of simpleto-state assumptions suffice for constructing functional encryption and indistinguishability obfuscation (iO), supporting all functions describable by polynomial-size circuits. Our work improves over the state-ofthe-art work of Jain, Lin, Matt, and Sahai (Eurocrypt 2019) in multiple dimensions. New Assumption: Previous to our work, all constructions of iO from simple assumptions required novel pseudorandomness generators involving LWE samples and constant-degree polynomials over the integers, evaluated on the error of the LWE samples. In contrast, Boolean pseudorandom generators (PRGs) computable by constant-degree polynomials have been extensively studied since the work of Goldreich (2000). (Goldreich and follow-up works study Boolean pseudorandom generators with constant-locality, which can be computed by constant-degree polynomials.) We show how to replace the novel pseudorandom objects over the integers used in previous works, with appropriate Boolean pseudorandom generators with sufficient stretch, when combined with LWE with binary error over suitable parameters. Both binary error LWE and constant degree Goldreich PRGs have been a subject of extensive cryptanalysis since much before our work and thus we back the plausibility of our assumption with security against algorithms studied in context of cryptanalysis of these objects. New Techniques: we introduce a number of new techniques:

Robust Transforming Combiners from Indistinguishability Obfuscation to Functional Encryption

Lecture Notes in Computer Science, 2017

Indistinguishability Obfuscation (iO) has enabled an incredible number of new and exciting applic... more Indistinguishability Obfuscation (iO) has enabled an incredible number of new and exciting applications. However, our understanding of how to actually build secure iO remains in its infancy. While many candidate constructions have been published, some have been broken, and it is unclear which of the remaining candidates are secure. This work deals with the following basic question: Can we hedge our bets when it comes to iO candidates? In other words, if we have a collection of iO candidates, and we only know that at least one of them is secure, can we still make use of these candidates? This topic was recently studied by Ananth, Jain, Naor, Sahai, and Yogev [CRYPTO 2016], who showed how to construct a robust iO combiner: Specifically, they showed that given the situation above, we can construct a single iO scheme that is secure as long as (1) at least one candidate iO scheme is a subexponentially secure iO, and (2) either the subexponential DDH or LWE assumptions hold. In this work, we make three contributions:-(Better robust iO combiners.) First, we work to improve the assumptions needed to obtain the same result as Ananth et al.: namely we show how to replace the DDH/LWE assumption with the assumption that subexponentially secure one-way functions exist.

Non-Trivial Witness Encryption and Null-iO from Standard Assumptions

A witness encryption (WE) scheme can take any \({{\textsf {NP}}}\) statement as a public-key and ... more

Affine Determinant Programs: A Framework for Obfuscation and Witness Encryption

An affine determinant program ADP : {0, 1} → {0, 1} is specified by a tuple (A, B1, . . . , Bn) o... more An affine determinant program ADP : {0, 1} → {0, 1} is specified by a tuple (A, B1, . . . , Bn) of square matrices over Fq and a function Eval : Fq → {0, 1}, and evaluated on x ∈ {0, 1} by computing Eval(det(A + ∑ i∈[n] xiBi)). In this work, we suggest ADPs as a new framework for building general-purpose obfuscation and witness encryption. We provide evidence to suggest that constructions following our ADP-based framework may one day yield secure, practically feasible obfuscation. As a proof-of-concept, we give a candidate ADP-based construction of indistinguishability obfuscation (iO) for all circuits along with a simple witness encryption candidate. We provide cryptanalysis demonstrating that our schemes resist several potential attacks, and leave further cryptanalysis to future work. Lastly, we explore practically feasible applications of our witness encryption candidate, such as public-key encryption with near-optimal key generation.

Threshold Fully Homomorphic Encryption

IACR Cryptol. ePrint Arch., 2017

We formally define and give the first construction of (leveled) threshold fully homomorphic encry... more We formally define and give the first construction of (leveled) threshold fully homomorphic encryption for any access structure induced by a monotone boolean formula and in particular for the threshold access structure. Our construction is based on the learning with errors assumption and can be instantiated with any existing homomorphic encryption scheme that satisfies fairly general conditions, such as Gentry, Sahai, Waters (CRYPTO 2013) and Brakerski, Gentry, Vaikuntanathan (ITCS 2012). From threshold homomorphic encryption, we construct function secret sharing and distributed pseudorandom functions for the aforementioned access structures. No such constructions were known prior to this work.

Indistinguishability Obfuscation Without Multilinear Maps: iO from LWE, Bilinear Maps, and Weak Pseudorandomness

IACR Cryptol. ePrint Arch., 2018

The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, sign... more The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, significantly expanding the scope of problems amenable to cryptographic study. All known approaches to constructing iO rely on d-linear maps which allow the encoding of elements from a large domain, evaluating degree d polynomials on them, and testing if the output is zero. While secure bilinear maps are well established in cryptographic literature, the security of candidates for d > 2 is poorly understood. We propose a new approach to constructing iO for general circuits. Unlike all previously known realizations of iO, we avoid the use of d-linear maps of degree d ≥ 3. At the heart of our approach is the assumption that a new weak pseudorandom object exists, that we call a perturbation resilient generator (∆RG). Informally, a ∆RG maps n integers to m integers, and has the property that for any sufficiently short vector a ∈ Z, all efficient adversaries must fail to distinguish the distrib...

Amplifying the Security of Functional Encryption, Unconditionally

IACR Cryptol. ePrint Arch., 2020

Security amplification is a fundamental problem in cryptography. In this work, we study security ... more Security amplification is a fundamental problem in cryptography. In this work, we study security amplification for functional encryption (FE). We show two main results: For any constant \(\epsilon \in (0,1)\), we can amplify any FE scheme for \(\mathsf {P/poly}\) which is \(\epsilon \)-secure against all polynomial sized adversaries to a fully secure FE scheme for \(\mathsf {P/poly}\), unconditionally. For any constant \(\epsilon \in (0,1)\), we can amplify any FE scheme for \(\mathsf {P/poly}\) which is \(\epsilon \)-secure against subexponential sized adversaries to a fully subexponentially secure FE scheme for \(\mathsf {P/poly}\), unconditionally.

How to leverage hardness of constant-degree expanding polynomials over ℝ to build iO

IACR Cryptol. ePrint Arch., 2018

In this work, we introduce and construct D-restricted Functional Encryption (FE) for any constant... more In this work, we introduce and construct D-restricted Functional Encryption (FE) for any constant D ≥ 3, based only on the SXDH assumption over bilinear groups. This generalizes the notion of 3-restricted FE recently introduced and constructed by Ananth et al. (ePrint 2018) in the generic bilinear group model. A D = (d+ 2)-restricted FE scheme is a secret key FE scheme that allows an encryptor to efficiently encrypt a message of the form M = (x,y,z). Here, x ∈ Fd×n p and y,z ∈ Fp. Function keys can be issued for a function f = ΣI=(i1,..,id,j,k) cI ·x[1, i1] · · ·x[d, id] · y[j] · z[k] where the coefficients cI ∈ Fp. Knowing the function key and the ciphertext, one can learn f(x,y,z), if this value is bounded in absolute value by some polynomial in the security parameter and n. The security requirement is that the ciphertext hides y and z, although it is not required to hide x. Thus x can be seen as a public attribute. D-restricted FE allows for useful evaluation of constant-degree p...

Simultaneous Amplification: The Case of Non-Interactive Zero-Knowledge

In this work, we explore the question of simultaneous privacy and soundness amplification for non... more In this work, we explore the question of simultaneous privacy and soundness amplification for non-interactive zero-knowledge argument systems (NIZK). We show that any \(\delta _s-\)sound and \(\delta _z-\)zero-knowledge NIZK candidate satisfying \(\delta _s+\delta _z=1-\epsilon \), for any constant \(\epsilon >0\), can be turned into a computationally sound and zero-knowledge candidate with the only extra assumption of a subexponentially secure public-key encryption.

Simplifying Constructions and Assumptions for iO

The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, sign... more The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, significantly expanding the scope of problems amenable to cryptographic study. A recent line of work [Ananth, Jain, and Sahai, 2018; Aggrawal, 2018; Lin and Matt, 2018; Jain, Lin, Matt, and Sahai, 2019] has developed a new theory for building iO from simpler building blocks, and represents the state of the art in constructing iO from succinct and instance-independent assumptions. This line of work has culminated in a construction of iO from four assumptions, consisting of two standard assumptions, namely sub-exponentially secure LWE and SXDH over bilinear groups, and two other pseudorandomness assumptions: The first assumes weak pseudorandomness properties of generators computable by constant-degree polynomials over the integers, as well as an LWE leakage assumption, introduced by [Jain, Lin, Matt, and Sahai, 2019]. The second assumes the existence of Boolean PRGs with constant block localit...

Multiparty Reusable Non-interactive Secure Computation from LWE

Lecture Notes in Computer Science, 2021

Motivated by the goal of designing versatile and flexible secure computation protocols that at th... more Motivated by the goal of designing versatile and flexible secure computation protocols that at the same time require as little interaction as possible, we present new multiparty reusable Non-Interactive Secure Computation (mrNISC) protocols. This notion, recently introduced by Benhamouda and Lin (TCC 2020), is essentially two-round Multi-Party Computation (MPC) protocols where the first round of messages serves as a reusable commitment to the private inputs of participating parties. Using these commitments, any subset of parties can later compute any function of their choice on their respective inputs by just sending a single message to a stateless evaluator, conveying the result of the computation but nothing else. Importantly, the input commitments can be computed without knowing anything about other participating parties (neither their identities nor their number) and they are reusable across any number of desired computations. We give a construction of mrNISC that achieves standard simulation security, as classical multi-round MPC protocols achieve. Our construction relies on the Learning With Errors (LWE) assumption with polynomial modulus, and on the existence of a pseudorandom function (PRF) in NC 1. We achieve semi-malicious security in the plain model and malicious security by further relying on trusted setup (which is unavoidable for mrNISC). In comparison, the only previously known constructions of mrNISC were either using bilinear maps or using strong primitives such as program obfuscation. We use our mrNISC to obtain new Multi-Key FHE (MKFHE) schemes with threshold decryption: • In the CRS model, we obtain threshold MKFHE for NC 1 based on LWE with only polynomial modulus and PRFs in NC 1 , whereas all previous constructions rely on LWE with super-polynomial modulus-to-noise ratio.

Threshold Cryptosystems from Threshold Fully Homomorphic Encryption

Lecture Notes in Computer Science, 2018

We develop a general approach to adding a threshold functionality to a large class of (non-thresh... more We develop a general approach to adding a threshold functionality to a large class of (non-threshold) cryptographic schemes. A threshold functionality enables a secret key to be split into a number of shares, so that only a threshold of parties can use the key, without reconstructing the key. We begin by constructing a threshold fullyhomomorphic encryption scheme (ThFHE) from the learning with errors (LWE) problem. We next introduce a new concept, called a universal thresholdizer, from which many threshold systems are possible. We show how to construct a universal thresholdizer from our ThFHE. A universal thresholdizer can be used to add threshold functionality to many systems, such as CCA-secure public-key encryption (PKE), signature schemes, pseudorandom functions, and others primitives. In particular, by applying this paradigm to a (non-threshold) lattice signature system, we obtain the first single-round threshold signature scheme from LWE.

Counterexamples to New Circular Security Assumptions Underlying iO

Advances in Cryptology – CRYPTO 2021, 2021

We study several strengthening of classical circular security assumptions which were recently int... more We study several strengthening of classical circular security assumptions which were recently introduced in four new lattice-based constructions of indistinguishability obfuscation: Brakerski-Döttling-Garg-Malavolta (Eurocrypt 2020), Gay-Pass (STOC 2021), Brakerski-Döttling-Garg-Malavolta (Eprint 2020) and Wee-Wichs (Eprint 2020). We provide explicit counterexamples to the 2-circular shielded randomness leakage assumption w.r.t. the Gentry-Sahai-Waters fully homomorphic encryption scheme proposed by Gay-Pass, and the homomorphic pseudorandom LWE samples conjecture proposed by Wee-Wichs. Our work suggests a separation between classical circular security of the kind underlying un-levelled fully-homomorphic encryption from the strengthened versions underlying recent iO constructions, showing that they are not (yet) on the same footing. Our counterexamples exploit the flexibility to choose specific implementations of circuits, which is explicitly allowed in the Gay-Pass assumption and unspecified in the Wee-Wichs assumption. Their indistinguishabilty obfuscation schemes are still unbroken. Our work shows that the assumptions, at least, need refinement. In particular, generic leakage-resilient circular security assumptions are delicate, and their security is sensitive to the specific structure of the leakages involved.

Sum-of-Squares Meets Program Obfuscation, Revisited

Advances in Cryptology – EUROCRYPT 2019, 2019

We develop attacks on the security of variants of pseudorandom generators computed by quadratic p... more We develop attacks on the security of variants of pseudorandom generators computed by quadratic polynomials. In particular we give a general condition for breaking the one-way property of mappings where every output is a quadratic polynomial (over the reals) of the input. As a corollary, we break the degree-2 candidates for security assumptions recently proposed for constructing indistinguishability obfuscation by Ananth, Jain and Sahai (ePrint 2018) and Agrawal (ePrint 2018). We present conjectures that would imply our attacks extend to a wider variety of instances, and in particular offer experimental evidence that they break assumption of Lin-Matt (ePrint 2018). Our algorithms use semidefinite programming, and in particular, results on low-rank recovery (Recht, Fazel, Parrilo 2007) and matrix completion (Gross 2009).

Indistinguishability Obfuscation Without Multilinear Maps: New Paradigms via Low Degree Weak Pseudorandomness and Security Amplification

Advances in Cryptology – CRYPTO 2019, 2019

This paper is a merge of two independent works, one by Ananth, Jain, and Sahai [AJS18], and the o... more This paper is a merge of two independent works, one by Ananth, Jain, and Sahai [AJS18], and the other by Lin and Matt [LM18]. 5 Note that this does not necessarily mean that the resulting iO constructions are insecure; in particular, there have been efforts (e.g., [GMM + 16b]) in constructing iO in more complex security models for multilinear maps (e.g. [MSZ16]) that have resisted polynomial-time attacks. There have also been several other iO candidates proposed which are not known to polynomial-time broken (e.g. [CVW18, BGMZ18]). 6 A function has locality if every output element depends on at most input elements. 7 The attacks actually leave open a very small window of expansion. Nevertheless, they have weakened our confidence on the security of PRGs with block-locality 2. 8 n, m, p are parameterized by the security parameter λ

Indistinguishability obfuscation from well-founded assumptions

Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing, 2021

Indistinguishability obfuscation, introduced by Barak et al. [Crypto 2001], aims to compile progr... more Indistinguishability obfuscation, introduced by Barak et al. [Crypto 2001], aims to compile programs into unintelligible ones while preserving functionality. It is a fascinating and powerful object that has been shown to enable a host of new cryptographic goals and beyond. However, constructions of indistinguishability obfuscation have remained elusive, with all other proposals relying on heuristics or newly conjectured hardness assumptions. In this work, we show how to construct indistinguishability obfuscation from the subexponential hardness of three well-founded assumptions. We prove the following. This is joint work with Aayush Jain (UCLA and NTT Research) and Amit Sahai (UCLA).

Multi-input Functional Encryption with Unbounded-Message Security

Lecture Notes in Computer Science, 2016

Multi-input functional encryption (MIFE) was introduced by Goldwasser et al. (EUROCRYPT 2014) as ... more Multi-input functional encryption (MIFE) was introduced by Goldwasser et al. (EUROCRYPT 2014) as a compelling extension of functional encryption. In MIFE, a receiver is able to compute a joint function of multiple, independently encrypted plaintexts. Goldwasser et al. (EUROCRYPT 2014) show various applications of MIFE to running SQL queries over encrypted databases, computing over encrypted data streams, etc. The previous constructions of MIFE due to Goldwasser et al. (EUROCRYPT 2014) based on indistinguishability obfuscation had a major shortcoming: it could only support encrypting an a priori bounded number of message. Once that bound is exceeded, security is no longer guaranteed to hold. In addition, it could only support selective-security, meaning that the challenge messages and the set of "corrupted" encryption keys had to be declared by the adversary up-front. In this work, we show how to remove these restrictions by relying instead on sub-exponentially secure indistinguishability obfuscation. This is done by carefully adapting an alternative MIFE scheme of Goldwasser et al. that previously overcame these shortcomings (except for selective security wrt. the set of "corrupted" encryption keys) by relying instead on differing-inputs obfuscation, which is now seen as an implausible assumption. Our techniques are rather generic, and we hope they are useful in converting other constructions using differing-inputs obfuscation to ones using sub-exponentially secure indistinguishability obfuscation instead.

Indistinguishability Obfuscation from LPN over F_p, DLIN, and PRGs in NC^0

IACR Cryptol. ePrint Arch., 2021

In this work, we study what minimal sets of assumptions suffice for constructing indistinguishabi... more In this work, we study what minimal sets of assumptions suffice for constructing indistinguishability obfuscation (iO). We prove: Theorem(Informal): Assume sub-exponential security of the following assumptions: • the Learning Parity with Noise (LPN) assumption over general prime fields Fp with polynomially many LPN samples and error rate 1/k , where k is the dimension of the LPN secret, and δ > 0 is any constant; • the existence of a Boolean Pseudo-Random Generator (PRG) in NC with stretch n , where n is the length of the PRG seed, and τ > 0 is any constant; • the Decision Linear (DLIN) assumption on symmetric bilinear groups of prime order. Then, (subexponentially secure) indistinguishability obfuscation for all polynomial-size circuits exists. Further, assuming only polynomial security of the aforementioned assumptions, there exists collusion resistant public-key functional encryption for all polynomial-size circuits. This removes the reliance on the Learning With Errors (LW...

A Note on the Pseudorandomness of Low-Degree Polynomials over the Integers

IACR Cryptol. ePrint Arch., 2021

We initiate the study of a problem called the Polynomial Independence Distinguishing Problem (PID... more We initiate the study of a problem called the Polynomial Independence Distinguishing Problem (PIDP). The problem is parameterized by a set of polynomials Q = (q1, . . . , qm) where each qi : R → R and an input distribution D over the reals. The goal of the problem is to distinguish a tuple of the form {qi, qi(x)}i∈[m] from {qi, qi(xi)}i∈[m] where x,x1, . . . ,xm are each sampled independently from the distribution D. Refutation and search versions of this problem are conjectured to be hard in general for polynomial time algorithms (Feige, STOC 02) and are also subject to known theoretical lower bounds for various hierarchies (such as Sum-of-Squares and Sherali-Adams). Nevertheless, we show polynomial time distinguishers for the problem in several scenarios, including settings where such lower bounds apply to the search or refutation versions of the problem. Our results apply to the setting when each polynomial is a constant degree multilinear polynomial. We show that this natural pr...

Analysis of Lightweight Block Cipher FeW on the Basis of Neural Network

Harmony Search and Nature Inspired Optimization Algorithms, 2018

Over the past few years, several lightweight ciphers have been proposed to supplement the Interne... more Over the past few years, several lightweight ciphers have been proposed to supplement the Internet of Things (IOT). FeW is one of the lightweight ciphers, which uses a mix of Feistel and generalized Feistel structures to achieve high efficiency in software-based department. This paper focuses on the analysis of lightweight block cipher FeW using the machine learning approach. This approach involves using artificial neural network to find the inherited biases present in the design of FeW.

Indistinguishability Obfuscation from Simple-to-State Hard Problems: New Assumptions, New Techniques, and Simplification

Lecture Notes in Computer Science, 2021

In this work, we study the question of what set of simpleto-state assumptions suffice for constru... more In this work, we study the question of what set of simpleto-state assumptions suffice for constructing functional encryption and indistinguishability obfuscation (iO), supporting all functions describable by polynomial-size circuits. Our work improves over the state-ofthe-art work of Jain, Lin, Matt, and Sahai (Eurocrypt 2019) in multiple dimensions. New Assumption: Previous to our work, all constructions of iO from simple assumptions required novel pseudorandomness generators involving LWE samples and constant-degree polynomials over the integers, evaluated on the error of the LWE samples. In contrast, Boolean pseudorandom generators (PRGs) computable by constant-degree polynomials have been extensively studied since the work of Goldreich (2000). (Goldreich and follow-up works study Boolean pseudorandom generators with constant-locality, which can be computed by constant-degree polynomials.) We show how to replace the novel pseudorandom objects over the integers used in previous works, with appropriate Boolean pseudorandom generators with sufficient stretch, when combined with LWE with binary error over suitable parameters. Both binary error LWE and constant degree Goldreich PRGs have been a subject of extensive cryptanalysis since much before our work and thus we back the plausibility of our assumption with security against algorithms studied in context of cryptanalysis of these objects. New Techniques: we introduce a number of new techniques:

Robust Transforming Combiners from Indistinguishability Obfuscation to Functional Encryption

Lecture Notes in Computer Science, 2017

Indistinguishability Obfuscation (iO) has enabled an incredible number of new and exciting applic... more Indistinguishability Obfuscation (iO) has enabled an incredible number of new and exciting applications. However, our understanding of how to actually build secure iO remains in its infancy. While many candidate constructions have been published, some have been broken, and it is unclear which of the remaining candidates are secure. This work deals with the following basic question: Can we hedge our bets when it comes to iO candidates? In other words, if we have a collection of iO candidates, and we only know that at least one of them is secure, can we still make use of these candidates? This topic was recently studied by Ananth, Jain, Naor, Sahai, and Yogev [CRYPTO 2016], who showed how to construct a robust iO combiner: Specifically, they showed that given the situation above, we can construct a single iO scheme that is secure as long as (1) at least one candidate iO scheme is a subexponentially secure iO, and (2) either the subexponential DDH or LWE assumptions hold. In this work, we make three contributions:-(Better robust iO combiners.) First, we work to improve the assumptions needed to obtain the same result as Ananth et al.: namely we show how to replace the DDH/LWE assumption with the assumption that subexponentially secure one-way functions exist.

Non-Trivial Witness Encryption and Null-iO from Standard Assumptions

A witness encryption (WE) scheme can take any \({{\textsf {NP}}}\) statement as a public-key and ... more

Affine Determinant Programs: A Framework for Obfuscation and Witness Encryption

An affine determinant program ADP : {0, 1} → {0, 1} is specified by a tuple (A, B1, . . . , Bn) o... more An affine determinant program ADP : {0, 1} → {0, 1} is specified by a tuple (A, B1, . . . , Bn) of square matrices over Fq and a function Eval : Fq → {0, 1}, and evaluated on x ∈ {0, 1} by computing Eval(det(A + ∑ i∈[n] xiBi)). In this work, we suggest ADPs as a new framework for building general-purpose obfuscation and witness encryption. We provide evidence to suggest that constructions following our ADP-based framework may one day yield secure, practically feasible obfuscation. As a proof-of-concept, we give a candidate ADP-based construction of indistinguishability obfuscation (iO) for all circuits along with a simple witness encryption candidate. We provide cryptanalysis demonstrating that our schemes resist several potential attacks, and leave further cryptanalysis to future work. Lastly, we explore practically feasible applications of our witness encryption candidate, such as public-key encryption with near-optimal key generation.

Threshold Fully Homomorphic Encryption

IACR Cryptol. ePrint Arch., 2017

We formally define and give the first construction of (leveled) threshold fully homomorphic encry... more We formally define and give the first construction of (leveled) threshold fully homomorphic encryption for any access structure induced by a monotone boolean formula and in particular for the threshold access structure. Our construction is based on the learning with errors assumption and can be instantiated with any existing homomorphic encryption scheme that satisfies fairly general conditions, such as Gentry, Sahai, Waters (CRYPTO 2013) and Brakerski, Gentry, Vaikuntanathan (ITCS 2012). From threshold homomorphic encryption, we construct function secret sharing and distributed pseudorandom functions for the aforementioned access structures. No such constructions were known prior to this work.

Indistinguishability Obfuscation Without Multilinear Maps: iO from LWE, Bilinear Maps, and Weak Pseudorandomness

IACR Cryptol. ePrint Arch., 2018

The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, sign... more The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, significantly expanding the scope of problems amenable to cryptographic study. All known approaches to constructing iO rely on d-linear maps which allow the encoding of elements from a large domain, evaluating degree d polynomials on them, and testing if the output is zero. While secure bilinear maps are well established in cryptographic literature, the security of candidates for d > 2 is poorly understood. We propose a new approach to constructing iO for general circuits. Unlike all previously known realizations of iO, we avoid the use of d-linear maps of degree d ≥ 3. At the heart of our approach is the assumption that a new weak pseudorandom object exists, that we call a perturbation resilient generator (∆RG). Informally, a ∆RG maps n integers to m integers, and has the property that for any sufficiently short vector a ∈ Z, all efficient adversaries must fail to distinguish the distrib...

Amplifying the Security of Functional Encryption, Unconditionally

IACR Cryptol. ePrint Arch., 2020

Security amplification is a fundamental problem in cryptography. In this work, we study security ... more Security amplification is a fundamental problem in cryptography. In this work, we study security amplification for functional encryption (FE). We show two main results: For any constant \(\epsilon \in (0,1)\), we can amplify any FE scheme for \(\mathsf {P/poly}\) which is \(\epsilon \)-secure against all polynomial sized adversaries to a fully secure FE scheme for \(\mathsf {P/poly}\), unconditionally. For any constant \(\epsilon \in (0,1)\), we can amplify any FE scheme for \(\mathsf {P/poly}\) which is \(\epsilon \)-secure against subexponential sized adversaries to a fully subexponentially secure FE scheme for \(\mathsf {P/poly}\), unconditionally.

How to leverage hardness of constant-degree expanding polynomials over ℝ to build iO

IACR Cryptol. ePrint Arch., 2018

In this work, we introduce and construct D-restricted Functional Encryption (FE) for any constant... more In this work, we introduce and construct D-restricted Functional Encryption (FE) for any constant D ≥ 3, based only on the SXDH assumption over bilinear groups. This generalizes the notion of 3-restricted FE recently introduced and constructed by Ananth et al. (ePrint 2018) in the generic bilinear group model. A D = (d+ 2)-restricted FE scheme is a secret key FE scheme that allows an encryptor to efficiently encrypt a message of the form M = (x,y,z). Here, x ∈ Fd×n p and y,z ∈ Fp. Function keys can be issued for a function f = ΣI=(i1,..,id,j,k) cI ·x[1, i1] · · ·x[d, id] · y[j] · z[k] where the coefficients cI ∈ Fp. Knowing the function key and the ciphertext, one can learn f(x,y,z), if this value is bounded in absolute value by some polynomial in the security parameter and n. The security requirement is that the ciphertext hides y and z, although it is not required to hide x. Thus x can be seen as a public attribute. D-restricted FE allows for useful evaluation of constant-degree p...

Simultaneous Amplification: The Case of Non-Interactive Zero-Knowledge

In this work, we explore the question of simultaneous privacy and soundness amplification for non... more In this work, we explore the question of simultaneous privacy and soundness amplification for non-interactive zero-knowledge argument systems (NIZK). We show that any \(\delta _s-\)sound and \(\delta _z-\)zero-knowledge NIZK candidate satisfying \(\delta _s+\delta _z=1-\epsilon \), for any constant \(\epsilon >0\), can be turned into a computationally sound and zero-knowledge candidate with the only extra assumption of a subexponentially secure public-key encryption.

Simplifying Constructions and Assumptions for iO

The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, sign... more The existence of secure indistinguishability obfuscators (iO) has far-reaching implications, significantly expanding the scope of problems amenable to cryptographic study. A recent line of work [Ananth, Jain, and Sahai, 2018; Aggrawal, 2018; Lin and Matt, 2018; Jain, Lin, Matt, and Sahai, 2019] has developed a new theory for building iO from simpler building blocks, and represents the state of the art in constructing iO from succinct and instance-independent assumptions. This line of work has culminated in a construction of iO from four assumptions, consisting of two standard assumptions, namely sub-exponentially secure LWE and SXDH over bilinear groups, and two other pseudorandomness assumptions: The first assumes weak pseudorandomness properties of generators computable by constant-degree polynomials over the integers, as well as an LWE leakage assumption, introduced by [Jain, Lin, Matt, and Sahai, 2019]. The second assumes the existence of Boolean PRGs with constant block localit...

Multiparty Reusable Non-interactive Secure Computation from LWE

Lecture Notes in Computer Science, 2021

Motivated by the goal of designing versatile and flexible secure computation protocols that at th... more Motivated by the goal of designing versatile and flexible secure computation protocols that at the same time require as little interaction as possible, we present new multiparty reusable Non-Interactive Secure Computation (mrNISC) protocols. This notion, recently introduced by Benhamouda and Lin (TCC 2020), is essentially two-round Multi-Party Computation (MPC) protocols where the first round of messages serves as a reusable commitment to the private inputs of participating parties. Using these commitments, any subset of parties can later compute any function of their choice on their respective inputs by just sending a single message to a stateless evaluator, conveying the result of the computation but nothing else. Importantly, the input commitments can be computed without knowing anything about other participating parties (neither their identities nor their number) and they are reusable across any number of desired computations. We give a construction of mrNISC that achieves standard simulation security, as classical multi-round MPC protocols achieve. Our construction relies on the Learning With Errors (LWE) assumption with polynomial modulus, and on the existence of a pseudorandom function (PRF) in NC 1. We achieve semi-malicious security in the plain model and malicious security by further relying on trusted setup (which is unavoidable for mrNISC). In comparison, the only previously known constructions of mrNISC were either using bilinear maps or using strong primitives such as program obfuscation. We use our mrNISC to obtain new Multi-Key FHE (MKFHE) schemes with threshold decryption: • In the CRS model, we obtain threshold MKFHE for NC 1 based on LWE with only polynomial modulus and PRFs in NC 1 , whereas all previous constructions rely on LWE with super-polynomial modulus-to-noise ratio.

Threshold Cryptosystems from Threshold Fully Homomorphic Encryption

Lecture Notes in Computer Science, 2018

We develop a general approach to adding a threshold functionality to a large class of (non-thresh... more We develop a general approach to adding a threshold functionality to a large class of (non-threshold) cryptographic schemes. A threshold functionality enables a secret key to be split into a number of shares, so that only a threshold of parties can use the key, without reconstructing the key. We begin by constructing a threshold fullyhomomorphic encryption scheme (ThFHE) from the learning with errors (LWE) problem. We next introduce a new concept, called a universal thresholdizer, from which many threshold systems are possible. We show how to construct a universal thresholdizer from our ThFHE. A universal thresholdizer can be used to add threshold functionality to many systems, such as CCA-secure public-key encryption (PKE), signature schemes, pseudorandom functions, and others primitives. In particular, by applying this paradigm to a (non-threshold) lattice signature system, we obtain the first single-round threshold signature scheme from LWE.

Counterexamples to New Circular Security Assumptions Underlying iO

Advances in Cryptology – CRYPTO 2021, 2021

We study several strengthening of classical circular security assumptions which were recently int... more We study several strengthening of classical circular security assumptions which were recently introduced in four new lattice-based constructions of indistinguishability obfuscation: Brakerski-Döttling-Garg-Malavolta (Eurocrypt 2020), Gay-Pass (STOC 2021), Brakerski-Döttling-Garg-Malavolta (Eprint 2020) and Wee-Wichs (Eprint 2020). We provide explicit counterexamples to the 2-circular shielded randomness leakage assumption w.r.t. the Gentry-Sahai-Waters fully homomorphic encryption scheme proposed by Gay-Pass, and the homomorphic pseudorandom LWE samples conjecture proposed by Wee-Wichs. Our work suggests a separation between classical circular security of the kind underlying un-levelled fully-homomorphic encryption from the strengthened versions underlying recent iO constructions, showing that they are not (yet) on the same footing. Our counterexamples exploit the flexibility to choose specific implementations of circuits, which is explicitly allowed in the Gay-Pass assumption and unspecified in the Wee-Wichs assumption. Their indistinguishabilty obfuscation schemes are still unbroken. Our work shows that the assumptions, at least, need refinement. In particular, generic leakage-resilient circular security assumptions are delicate, and their security is sensitive to the specific structure of the leakages involved.

Sum-of-Squares Meets Program Obfuscation, Revisited

Advances in Cryptology – EUROCRYPT 2019, 2019

We develop attacks on the security of variants of pseudorandom generators computed by quadratic p... more We develop attacks on the security of variants of pseudorandom generators computed by quadratic polynomials. In particular we give a general condition for breaking the one-way property of mappings where every output is a quadratic polynomial (over the reals) of the input. As a corollary, we break the degree-2 candidates for security assumptions recently proposed for constructing indistinguishability obfuscation by Ananth, Jain and Sahai (ePrint 2018) and Agrawal (ePrint 2018). We present conjectures that would imply our attacks extend to a wider variety of instances, and in particular offer experimental evidence that they break assumption of Lin-Matt (ePrint 2018). Our algorithms use semidefinite programming, and in particular, results on low-rank recovery (Recht, Fazel, Parrilo 2007) and matrix completion (Gross 2009).

Indistinguishability Obfuscation Without Multilinear Maps: New Paradigms via Low Degree Weak Pseudorandomness and Security Amplification

Advances in Cryptology – CRYPTO 2019, 2019

This paper is a merge of two independent works, one by Ananth, Jain, and Sahai [AJS18], and the o... more This paper is a merge of two independent works, one by Ananth, Jain, and Sahai [AJS18], and the other by Lin and Matt [LM18]. 5 Note that this does not necessarily mean that the resulting iO constructions are insecure; in particular, there have been efforts (e.g., [GMM + 16b]) in constructing iO in more complex security models for multilinear maps (e.g. [MSZ16]) that have resisted polynomial-time attacks. There have also been several other iO candidates proposed which are not known to polynomial-time broken (e.g. [CVW18, BGMZ18]). 6 A function has locality if every output element depends on at most input elements. 7 The attacks actually leave open a very small window of expansion. Nevertheless, they have weakened our confidence on the security of PRGs with block-locality 2. 8 n, m, p are parameterized by the security parameter λ

Indistinguishability obfuscation from well-founded assumptions

Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing, 2021

Indistinguishability obfuscation, introduced by Barak et al. [Crypto 2001], aims to compile progr... more Indistinguishability obfuscation, introduced by Barak et al. [Crypto 2001], aims to compile programs into unintelligible ones while preserving functionality. It is a fascinating and powerful object that has been shown to enable a host of new cryptographic goals and beyond. However, constructions of indistinguishability obfuscation have remained elusive, with all other proposals relying on heuristics or newly conjectured hardness assumptions. In this work, we show how to construct indistinguishability obfuscation from the subexponential hardness of three well-founded assumptions. We prove the following. This is joint work with Aayush Jain (UCLA and NTT Research) and Amit Sahai (UCLA).

Multi-input Functional Encryption with Unbounded-Message Security

Lecture Notes in Computer Science, 2016

Multi-input functional encryption (MIFE) was introduced by Goldwasser et al. (EUROCRYPT 2014) as ... more Multi-input functional encryption (MIFE) was introduced by Goldwasser et al. (EUROCRYPT 2014) as a compelling extension of functional encryption. In MIFE, a receiver is able to compute a joint function of multiple, independently encrypted plaintexts. Goldwasser et al. (EUROCRYPT 2014) show various applications of MIFE to running SQL queries over encrypted databases, computing over encrypted data streams, etc. The previous constructions of MIFE due to Goldwasser et al. (EUROCRYPT 2014) based on indistinguishability obfuscation had a major shortcoming: it could only support encrypting an a priori bounded number of message. Once that bound is exceeded, security is no longer guaranteed to hold. In addition, it could only support selective-security, meaning that the challenge messages and the set of "corrupted" encryption keys had to be declared by the adversary up-front. In this work, we show how to remove these restrictions by relying instead on sub-exponentially secure indistinguishability obfuscation. This is done by carefully adapting an alternative MIFE scheme of Goldwasser et al. that previously overcame these shortcomings (except for selective security wrt. the set of "corrupted" encryption keys) by relying instead on differing-inputs obfuscation, which is now seen as an implausible assumption. Our techniques are rather generic, and we hope they are useful in converting other constructions using differing-inputs obfuscation to ones using sub-exponentially secure indistinguishability obfuscation instead.