Separations in Circular Security for Arbitrary Length Key Cycles. Venkata Koppula! Kim Ramchen! Brent Waters



Similar documents
Recongurable Cryptography: A exible approach to long-term security

1 Construction of CCA-secure encryption

Identity-Based Encryption from the Weil Pairing

CryptoVerif Tutorial

Non-Black-Box Techniques In Crytpography. Thesis for the Ph.D degree Boaz Barak

Boosting Linearly-Homomorphic Encryption to Evaluate Degree-2 Functions on Encrypted Data

Lecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture - PRGs for one time pads

MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC

Lecture 15 - Digital Signatures

Lecture 3: One-Way Encryption, RSA Example

Foundations of Group Signatures: The Case of Dynamic Groups

Lecture 17: Re-encryption

1 Message Authentication

Post-Quantum Cryptography #4

Simplified Security Notions of Direct Anonymous Attestation and a Concrete Scheme from Pairings

Secure Attribute Based Mechanism through Access cipher policy in Outsourced Cloud Data

New Efficient Searchable Encryption Schemes from Bilinear Pairings

NEW CRYPTOGRAPHIC CHALLENGES IN CLOUD COMPUTING ERA

Arnab Roy Fujitsu Laboratories of America and CSA Big Data WG

SYMMETRIC ENCRYPTION. Mihir Bellare UCSD 1

A New and Efficient Signature on Commitment Values

Computational Soundness of Symbolic Security and Implicit Complexity

Secure Group Oriented Data Access Model with Keyword Search Property in Cloud Computing Environment

Chosen-Ciphertext Security from Identity-Based Encryption

Adaptively-Secure, Non-Interactive Public-Key Encryption

Computing on Encrypted Data

The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)

Provable-Security Analysis of Authenticated Encryption in Kerberos

Information Security Theory vs. Reality

Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre

Hosting Services on an Untrusted Cloud

Efficient Unlinkable Secret Handshakes for Anonymous Communications

Lecture 2 August 29, 13:40 15:40

Secure and Efficient Data Retrieval Process based on Hilbert Space Filling Curve

Practical Yet Universally Composable Two-Server Password-Authenticated Secret Sharing

Secure Deduplication of Encrypted Data without Additional Independent Servers

A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem

Indistinguishability Obfuscation for Turing Machines with Unbounded Memory

MTAT Cryptology II. Digital Signatures. Sven Laur University of Tartu

Verifiable Delegation of Computation over Large Datasets

Authentication and Encryption: How to order them? Motivation

Lecture 9 - Message Authentication Codes

Privacy and Security in Cloud Computing

Authenticated Encryption: Relations among notions and analysis of the generic composition paradigm

CS155. Cryptography Overview

Introduction. Digital Signature

Authenticated encryption

Identity-based Encryption with Post-Challenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks

CS558. Network Security. Boston University, Computer Science. Midterm Spring 2014.

Digital Signatures. Prof. Zeph Grunschlag

3-6 Toward Realizing Privacy-Preserving IP-Traceback

Practical Yet Universally Composable Two-Server Password-Authenticated Secret Sharing

1 Signatures vs. MACs

1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.

Computing Blindfolded: New Developments in Fully Homomorphic Encryption

On the Security of the Tor Authentication Protocol

Chapter 11. Asymmetric Encryption Asymmetric encryption schemes

Efficient and Secure Authenticated Key Exchange Using Weak Passwords

Victor Shoup Avi Rubin. Abstract

QUT Digital Repository:

Digital Signatures. What are Signature Schemes?

Certificate Based Signature Schemes without Pairings or Random Oracles

Patient Controlled Encryption: Ensuring Privacy of Electronic Medical Records

Multi-Channel Broadcast Encryption

An Application of the Goldwasser-Micali Cryptosystem to Biometric Authentication

DAC-MACS: Effective Data Access Control for Multiauthority Cloud Storage Systems

Talk announcement please consider attending!

ANONIZE: A Large-Scale Anonymous Survey System

Advanced Cryptography

Transcription:

Separations in Circular Security for Arbitrary Length Key Cycles Venkata Koppula! Kim Ramchen! Brent Waters

Circular Security

Circular Security

Circular Security Choose pk, sk! Encrypt using pk!

Circular Security Choose pk, sk! Encrypt using pk!

Circular Security sk Choose pk, sk! Encrypt using pk!

Circular Security sk Choose pk, sk! Encrypt using pk! Choose pk, sk'! Encrypt using pk!

Circular Security sk sk Choose pk, sk! Encrypt using pk! Choose pk, sk'! Encrypt using pk!

Circular Security sk sk Choose pk, sk! Encrypt using pk! Choose pk, sk'! Encrypt using pk!

Circular Security

Circular Security pk pk

Circular Security pk pk Enc(pk, sk ) Enc(pk, sk)

Circular Security pk pk Enc(pk, sk ) Enc(pk, sk) Optimistic Enc(pk, sk ), Enc(pk, sk)! " Enc(pk, 0), Enc(pk, 0)

Circular Security pk pk Enc(pk, sk ) Enc(pk, sk) Optimistic Enc(pk, sk ), Enc(pk, sk)! " Enc(pk, 0), Enc(pk, 0) Does not learn sk/sk

n-circular Security [CL01] pk 1,, pk n Enc(pk 1, sk 2 ) Enc(pk 2, sk 3 ).!.!. Enc(pk n, sk 1 )

n-circular Security [CL01]

n-circular Security [CL01] Challenger Adversary

n-circular Security [CL01] Challenger Adversary Choose bit b.

n-circular Security [CL01] Challenger Adversary Choose bit b. Choose n key pairs (pk i, sk i ).

n-circular Security [CL01] Challenger Adversary Choose bit b. Choose n key pairs (pk i, sk i ). y i = Enc(pk i, 0) or Enc(pk i, sk i+1 )

n-circular Security [CL01] Challenger Adversary Choose bit b. Choose n key pairs (pk i, sk i ). y i = Enc(pk i, 0) or Enc(pk i, sk i+1 ) (pk 1,, pk n, y 1,, y n )

n-circular Security [CL01] Challenger Adversary Choose bit b. Choose n key pairs (pk i, sk i ). y i = Enc(pk i, 0) or Enc(pk i, sk i+1 ) (pk 1,, pk n,! (pk 1,, pk n, y 1,, y n ) y 1,, y n )

n-circular Security [CL01] Challenger Adversary Choose bit b. Choose n key pairs (pk i, sk i ). y i = Enc(pk i, 0) or Enc(pk i, sk i+1 ) (pk 1,, pk n,! (pk 1,, pk n, y 1,, y n ) y 1,, y n ) b

n-circular Security [CL01] Challenger Adversary Choose bit b. Choose n key pairs (pk i, sk i ). y i = Enc(pk i, 0) or Enc(pk i, sk i+1 ) (pk 1,, pk n,! (pk 1,, pk n, y 1,, y n ) y 1,, y n ) b

Applications of n-circular Security

Applications of n-circular Security Disk Encryption Utilities

Applications of n-circular Security Disk Encryption Utilities Anonymous Credential System - Camenisch & Lysyanskaya [CL01]

Applications of n-circular Security Disk Encryption Utilities Anonymous Credential System - Camenisch & Lysyanskaya [CL01] Bootstrapping HE - Gentry [G09]

n - Circular Secure Schemes

n - Circular Secure Schemes Boneh, Hamburg, Halevi & Ostrovsky! DDH based construction [BHHO08]

n - Circular Secure Schemes Boneh, Hamburg, Halevi & Ostrovsky! DDH based construction [BHHO08] Applebaum, Cash, Peikert & Sahai! LWE based construction [ACPS09]

n - Circular Secure Schemes Boneh, Hamburg, Halevi & Ostrovsky! DDH based construction [BHHO08] Applebaum, Cash, Peikert & Sahai! LWE based construction [ACPS09] Extending Functionalities - [BG10, BHHI10, BGK11, App11, MTY11, BV11, AP12]

Is circular security implied by semantic security?

Circular Security - Negative Results

Circular Security - Negative Results n=1

Circular Security - Negative Results n=1 Folklore: Any IND-CPA secure encryption scheme can be transformed into one that is IND-CPA secure, but not 1-circular secure.

Circular Security - Negative Results n=2

Circular Security - Negative Results n=2 Acar, Belenkiy, Bellare & Cash [ABBC10]! Semantic Security circular security

Circular Security - Negative Results n=2 Acar, Belenkiy, Bellare & Cash [ABBC10]! Semantic Security circular security Cash, Green & Hohenberger [CGH12]! Semantic Security weak circular security

Circular Security - Negative Results n=2 Acar, Belenkiy, Bellare & Cash [ABBC10]! Semantic Security circular security Bilinear Groups Cash, Green & Hohenberger [CGH12]! Semantic Security weak circular security

Is circular security implied by semantic security for n>2?

Our Results

Our Results Theorem 1: (io + PRGs) (Semantic Security n-circular Security).

Our Results Theorem 1: (io + PRGs) (Semantic Security n-circular Security). Theorem 2: (io + PRGs) (Semantic Security n-circular Security for bit encryption).

Our Results Theorem 1: (io + PRGs) (Semantic Security n-circular Security). Theorem 2: (io + PRGs) (Semantic Security n-circular Security for bit encryption). Theorem 3: ( IND-CPA secure, n-circular insecure scheme) ( IND-CPA secure scheme where cycle results in key recovery)

Circular Security pk pk Enc(pk, sk ) Enc(pk, sk) Optimistic Enc(pk, sk ), Enc(pk, sk)! " Enc(pk, 0), Enc(pk, 0) Does not learn sk/sk

Circular Security pk pk Enc(pk, sk ) Enc(pk, sk) Optimistic Enc(pk, sk ), Enc(pk, sk)! " Enc(pk, 0), Enc(pk, 0) Does not learn sk/sk Theorem 1

Circular Security pk pk Enc(pk, sk ) Enc(pk, sk) Optimistic Enc(pk, sk ), Enc(pk, sk)! " Enc(pk, 0), Enc(pk, 0) Does not learn sk/sk Theorem 1 Theorem 1 & 3

Our Results Theorem 1: (io + PRGs) (Semantic Security n-circular Security). This talk!

Code Obfuscation

Code Obfuscation Goal: Make programs maximally unintelligible.

Code Obfuscation Goal: Make programs maximally unintelligible. P

Code Obfuscation Goal: Make programs maximally unintelligible. P Obfuscator

Code Obfuscation Goal: Make programs maximally unintelligible. P Obfuscator P

Code Obfuscation Goal: Make programs maximally unintelligible. P Obfuscator P

Code Obfuscation Goal: Make programs maximally unintelligible. P Virtual Black Box Obfuscator! Having obfuscated code!! Having black box access to code Obfuscator P

Code Obfuscation Goal: Make programs maximally unintelligible. P Virtual Black Box Obfuscator! Having obfuscated code!! Having black box access to code [BGIRSVY01] Obfuscator P

Code Obfuscation Goal: Make programs maximally unintelligible.

Code Obfuscation Goal: Make programs maximally unintelligible. Indistinguishability Obfuscator! C 0, C 1 functionally identical circuits.! io(c 0 ) io(c 1 )

Code Obfuscation Goal: Make programs maximally unintelligible. [BGIRSVY01] negative result does not apply for io. Indistinguishability Obfuscator! C 0, C 1 functionally identical circuits.! io(c 0 ) io(c 1 )

Code Obfuscation Goal: Make programs maximally unintelligible. [BGIRSVY01] negative result does not apply for io. Indistinguishability Obfuscator! C 0, C 1 functionally identical circuits.! io(c 0 ) io(c 1 ) [GGHRSW13] gave a candidate construction for io.

Transform IND-CPA scheme E to n-circular insecure scheme E.

Transform IND-CPA scheme E to n-circular insecure scheme E. Prove E is IND-CPA secure

Transform IND-CPA scheme E to n-circular insecure scheme E. Prove E is IND-CPA secure Using VBB obfuscation

Transform IND-CPA scheme E to n-circular insecure scheme E. Prove E is IND-CPA secure Using VBB obfuscation Modify E to use Indistinguishability Obfuscation

IND-CPA Scheme E Setup Enc(pk, m) Dec(sk, ct) pk sk ct m

IND-CPA Scheme E Scheme E Setup Enc(pk, m) Dec(sk, ct) pk sk ct m

IND-CPA Scheme E Scheme E Setup pk sk Setup pk sk Enc(pk, m) ct Dec(sk, ct) m

IND-CPA Scheme E Scheme E Setup pk sk Setup pk sk Enc(pk, m) ct Enc (pk, m) ct Dec(sk, ct) m

IND-CPA Scheme E Scheme E Setup pk sk Setup pk sk Enc(pk, m) ct Enc (pk, m) ct aux Dec(sk, ct) m

IND-CPA Scheme E Scheme E Setup pk sk Setup pk sk Enc(pk, m) ct Enc (pk, m) ct aux Dec(sk, ct) m Dec(sk, ct) m

IND-CPA Scheme E Scheme E Setup pk sk Setup pk sk Enc(pk, m) ct Enc (pk, m) ct aux Dec(sk, ct) m Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

IND-CPA Scheme E Scheme E Setup pk sk Setup pk sk Enc(pk, m) ct Enc (pk, m) ct aux Dec(sk, ct) m Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Setup pk sk Enc (pk, m) ct aux Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Setup pk sk Enc (pk, m) ct aux Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Setup pk sk Enc (pk, m) ct io(p) Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Program P Setup pk sk Enc (pk, m) ct io(p) Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Program P Constants: m, pk Setup pk sk Enc (pk, m) ct io(p) Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Program P Constants: m, pk Setup pk sk Inputs: ct 1,, ct n Enc (pk, m) ct io(p) Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Program P Constants: m, pk Setup pk sk Inputs: ct 1,, ct n Enc (pk, m) ct io(p) 1. sk 2 = m. Dec(sk, ct) m Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Program P Constants: m, pk Setup pk sk Inputs: ct 1,, ct n Enc (pk, m) Dec(sk, ct) ct m io(p) 1. sk 2 = m. 2. For i=2 to n sk i+1 = Dec(sk i, ct i ). Helps detect cycles, but shouldn t break IND-CPA!

Scheme E Program P Constants: m, pk Setup pk sk Inputs: ct 1,, ct n Enc (pk, m) Dec(sk, ct) ct m io(p) Helps detect cycles, but shouldn t break IND-CPA! 1. sk 2 = m. 2. For i=2 to n sk i+1 = Dec(sk i, ct i ). 3. Check sk n+1 is secret key for pk. If yes, output 1.

Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, sk 2 ) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, sk 3 ) = (ct 2*, io(p 2 )). pk n, Enc (pk n, sk 1 ) = (ct n*, io(p n )) Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, sk 2 ) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, sk 3 ) = (ct 2*, io(p 2 )). pk n, Enc (pk n, sk 1 ) = (ct n*, io(p n )) Program P! Constants: m, pk!! Inputs: ct 1,, ct n! P 1! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, sk 2 ) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, sk 3 ) = (ct 2*, io(p 2 )). pk n, Enc (pk n, sk 1 ) = (ct n*, io(p n )) Program P! Constants: m, pk!! sk 2 Inputs: ct 1,, ct n! P 1! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, sk 2 ) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, sk 3 ) = (ct 2*, io(p 2 )). pk n, Enc (pk n, sk 1 ) = (ct n*, io(p n )) Program P! Constants: m, pk!! sk 2 pk 1 Inputs: ct 1,, ct n! P 1! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk! sk 2 pk 1! P 1 pk 1, Enc (pk 1, sk 2 ) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, sk 3 ) = (ct 2*, io(p 2 )). pk n, Enc (pk n, sk 1 ) = (ct n*, io(p n )) Inputs: ct 1,, ct n!! ct * 1 ct * n 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk! sk 2 pk 1! P 1 pk 1, Enc (pk 1, sk 2 ) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, sk 3 ) = (ct 2*, io(p 2 )). pk n, Enc (pk n, sk 1 ) = (ct n*, io(p n )) Inputs: ct 1,, ct n!! ct * 1 ct * n 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, 0) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, 0) = (ct 2*, io(p 2 )). pk n, Enc (pk n, 0) = (ct n*, io(p n )) Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, 0) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, 0) = (ct 2*, io(p 2 )). pk n, Enc (pk n, 0) = (ct n*, io(p n )) Program P! Constants: m, pk!! Inputs: ct 1,, ct n! P 1! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, 0) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, 0) = (ct 2*, io(p 2 )). pk n, Enc (pk n, 0) = (ct n*, io(p n )) Program P! Constants: m, pk!! 0 Inputs: ct 1,, ct n! P 1! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure pk 1, Enc (pk 1, 0) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, 0) = (ct 2*, io(p 2 )). pk n, Enc (pk n, 0) = (ct n*, io(p n )) Program P! Constants: m, pk!! 0 pk 1 Inputs: ct 1,, ct n! P 1! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk! 0 pk 1! P 1 pk 1, Enc (pk 1, 0) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, 0) = (ct 2*, io(p 2 )). pk n, Enc (pk n, 0) = (ct n*, io(p n )) Inputs: ct 1,, ct n!! ct * 1 ct * n 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk! 0 pk 1! P 1 pk 1, Enc (pk 1, 0) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, 0) = (ct 2*, io(p 2 )). pk n, Enc (pk n, 0) = (ct n*, io(p n )) Inputs: ct 1,, ct n!! ct * 1 ct * n 1. sk 2 = m.! Fails w.h.p. 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

E is n-circular insecure Program P! Constants: m, pk! 0 pk 1! P 1 pk 1, Enc (pk 1, 0) = (ct 1*, io(p 1 )) pk 2, Enc (pk 2, 0) = (ct 2*, io(p 2 )). pk n, Enc (pk n, 0) = (ct n*, io(p n )) Inputs: ct 1,, ct n!! ct * 1 ct * n 1. sk 2 = m.! Fails w.h.p. 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Is E IND-CPA secure? Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Is E IND-CPA secure? Assuming io is a virtual black box obfuscator? Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Is E IND-CPA secure? Assuming io is a virtual black box obfuscator? Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Is E IND-CPA secure? Assuming io is a virtual black box obfuscator? Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Is E IND-CPA secure? Assuming io is a virtual black box obfuscator? Assuming io is indistinguishability obfuscator?? Program P! Constants: m, pk!! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! sk i+1 = Dec(sk i, ct i ).! 3. Check sk n+1 is secret key for pk. If yes, output 1.!

Scheme E

Scheme E Setup (sk, r) (pk, t=prg(r))

Scheme E Setup Enc (pk, m) (sk, r) (pk, t=prg(r)) ct, io(p )

Scheme E Setup Enc (pk, m) (sk, r) (pk, t=prg(r)) ct, io(p ) Dec(sk, ct) m

Scheme E Program P Setup Enc (pk, m) (sk, r) (pk, t=prg(r)) ct, io(p ) Dec(sk, ct) m

Scheme E (sk, r) Setup (pk, t=prg(r)) Program P Constants: m, pk t PRG(r) Enc (pk, m) ct, io(p ) Dec(sk, ct) m

Scheme E (sk, r) Setup (pk, t=prg(r)) Program P Constants: m, pk t PRG(r) Inputs: ct 1,, ct n Enc (pk, m) ct, io(p ) Dec(sk, ct) m

Scheme E (sk, r) Setup (pk, t=prg(r)) Program P Constants: m, pk t PRG(r) Inputs: ct 1,, ct n Enc (pk, m) ct, io(p ) 1. sk 2 = m. Dec(sk, ct) m

Scheme E (sk, r) Setup (pk, t=prg(r)) Program P Constants: m, pk t PRG(r) Inputs: ct 1,, ct n Enc (pk, m) Dec(sk, ct) ct, io(p ) m 1. sk 2 = m. 2. For i=2 to n (sk i+1, r i+1 ) = Dec(sk i, ct i ).

Scheme E (sk, r) Setup (pk, t=prg(r)) Program P Constants: m, pk t PRG(r) Inputs: ct 1,, ct n Enc (pk, m) Dec(sk, ct) ct, io(p ) m 1. sk 2 = m. 2. For i=2 to n (sk i+1, r i+1 ) = Dec(sk i, ct i ). 3. Check sk n+1 is secret key for pk. Check PRG(r n+1 ) = t. If yes, output 1.

Proving E n-circular insecure: Same as E

Proving E n-circular insecure: Same as E Proving E IND-CPA secure: Follows from io + PRG security

Theorem 1: Assuming io + PRGs exist, there exists a scheme E that is IND-CPA secure but not n-circular secure.

Theorem 1: Assuming io + PRGs exist, there exists a scheme E that is IND-CPA secure but not n-circular secure. Related concurrent work: [MO13] showed a different construction using VBB obfuscation.

Conclusions and Open Problems

Conclusions and Open Problems IND-CPA security does not imply n-circular security.

Conclusions and Open Problems IND-CPA security does not imply n-circular security. Our solution uses indistinguishability obfuscation.

Conclusions and Open Problems IND-CPA security does not imply n-circular security. Our solution uses indistinguishability obfuscation. Can we get these counterexamples from weaker assumptions? From multilinear maps?

Conclusions and Open Problems IND-CPA security does not imply n-circular security. Our solution uses indistinguishability obfuscation. Can we get these counterexamples from weaker assumptions? From multilinear maps? Rothblum s counterexample [R13] for bit encryption comes close.

Thank you! Questions?

IND-CPA Adversary

IND-CPA Adversary public key = (pk, t=prg(r)) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

IND-CPA Adversary public key = (pk, t=prg(r)) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t=prg(r)) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t=prg(r)) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t=prg(r)) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1. public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t=prg(r)) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1. PRG public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t=prg(r)) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1. PRG public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1.

public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1. Fails w.h.p.

public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. Output. 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1. Fails w.h.p.

public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. sk 2 = m.! 2. For i=2 to n! (sk i+1, r i+1 ) = Dec(sk i, ct i ).! 3. Check PRG(r n+1 ) = t. If yes, output 1. Fails w.h.p. io public key = (pk, t : random) Enc (m, pk)= (ct, io(p )) Program P! Constants: m, t! Inputs: ct 1,, ct n!! 1. Output.