Attributebased Encryption for Circuits Vinod Vaikuntanathan MIT Simons

Attribute-based Encryption for Circuits Vinod Vaikuntanathan MIT Simons “Math of Crypto” Workshop

Access Control of Encrypted Data [Goyal-Pandey-Sahai. Waters’ 06] ATT Policy P: AND OR PK, SK CT = Enc( PK, attributes x = (127. 0. 0. 1, 01 Jan 01, 10 B), data M = net logs) CT = Enc(PK, M = net logs) cloud Recover M iff P(x) = 0 (true)

Public vs. Private Attributes THIS TALK: Based on [Boneh-Gentry-Gorbunov-Halevi-Nikolaenko-Segev-V. -Vinayagamurthy’ 14] NEXT TALK: Based on [Gorbunov-V. -Wee’ 15]

ABE THIS TALK: Based on FIRST introduced: Sahai-Waters’ 05, Goyal-Pandey-SW’ 06 [Boneh-Gentry-Gorbunov-Halevi-Nikolaenko-Segev-V. -Vinayagamurthy’ 14] (inspired by IBE, Fuzzy IBE, etc. ) FIRST ABE for general circuits: Gorbunov-V. -Wee’ 13 (based on subexp. LWE) Garg-Gentry-Halevi-Sahai-Waters’ 13 (based on “mmaps”)

(IND) Security (MPK, MSK) ← Setup(1λ) SKP ← Keygen(MSK; P) MPK P SKP Pick random bit b CTb ← Enc(MPK, x*, Mb) x*, M 0, M 1 CTb Let me guess b P SKP challenger adversary

(IND) Selective Security x* (MPK, MSK) ← Setup(1λ) SKP ← Keygen(MSK; P) MPK P SKP Pick random bit b CTb ← Enc(MPK, x*, Mb) M 0, M 1 CTb Let me guess b P SKP challenger adversary

Main Result Attribute-based Encryption for Circuits under sub-exponential LWE assumption ─ short ciphertexts of size poly(k, d) ─ short keys: |sk. P| = |P| + poly(k, d) (k = |attributes|)

Key Idea: Key-Homomorphism ABE. Enc ( mpk, x, M ) “key-homomorphism” + P, x ABE. Enc ( pk. P, P(x), M ) + sk. P M iff P(x) =

ABE Keys mpk: ( A, A 1, A 2, …, Ak ) where k = |x| m n

ABE Keys where k = |x| mpk: ( A, A 1, A 2, …, Ak ) pk. P: AP = “Compute circuit P on A 1, …, Ak” In Retrospect: = FHE CTs = FH Comm = FHS PKs Au Au Av + A+ = Au + Av Av

ABE Encryption where k = |x| mpk: ( A, A 1, A 2, …, Ak ) Enc(mpk, x, M): ( s. TA+e, s. T(A 1+x 1 G)+e 1, , …, s. T(Ak+xk. G)+ek) s A + e

ABE Encryption T(A +x G)+e ) Enc(mpk, x, M): ( s. TA+e, s. T(A 1+x 1 G)+e 1, …, s k k k + P, Linearity to the Rescue x Enc(pk. P, P(x), ( s. T(AP+ P(x) G)+e. P )

ABE Encryption T(A +x G)+e ) Enc(mpk, x, M): ( s. TA+e, s. T(A 1+x 1 G)+e 1, …, s k k k cu = s. T(Au+xu. G) cv = + P, + s. T(Av+xv. G) x cw = cu + cv = s. T( (Au+Av) + (xu+xv)G )= s. T( Aw + xw. G )

ABE Encryption T(A +x G)+e ) Enc(mpk, x, M): ( s. TA+e, s. T(A 1+x 1 G)+e 1, …, s k k k cu = s. T(Au+xu. G) cv = + P, X x cw = - cu 1(A G- v) s. T(Av+xv. G) + xu cv = - s. T( Au G-1(Av) + xu. Av) + s. T( xu. Av + xuxv. G ) -1(A ) + x x G ) ( - A G = s. T( A + x u v w w. G )

ABE Decryption T(A +x G)+e ) Enc(mpk, x, M): ( s. TA+e, s. T(A 1+x 1 G)+e 1, …, s k k k + P, x Enc(pk. P, P(x), s. T [ A || AP + P(x)G ] +e M): Predicate Secret key sk. P = trapdoor for [ A || AP ] = [ A || AP ] T = 0 (mod q) Solves SIS and LWE m m

Summing Up: ABE mpk: ( A, A 1, A 2, …, msk: trapdoor for A A ) k T(A +x G)+e , Enc(mpk, x, M): ( s. TA+e, s. T(A 1+x 1 G)+e 1, …, s k k k HCB(s)+M ) sk. P: Trapdoor for [ A || AP ] (can be computed using trapdoor for A) Dec: Compute s. T[ A || AP ] Recover s using sk. P

Key Tool in Security Proof Two Ways to Generate Trapdoors for [A || AP] The CHKP Trick: [Cash-Hofheinz-Kiltz-Peikert’ 10] ─ Given trap for A, can generate trap for [A || B] for all B ─ Used in real key generation ≈ The ABB Trick: [Agrawal-Boneh-Boyen’ 10] ─ Given short R and trap for G, can gen trap for [A || AR+G] ─ Will use in the proof

Key Tool in Security Proof Two Ways to Generate Trapdoors for [A || AP] The CHKP Trick: [Cash-Hofheinz-Kiltz-Peikert’ 10] ─ Given trap for A, can generate trap for [A || B] for all B ─ Want: Short solution (t 1, t 2) s. t. [A || B] [t 1 || t 2]T = c (mod q) ─ Generate t 2 yourself and solve for t 1 in: A t 1 = c - B t 2 (mod q) using trap for A

Key Tool in Security Proof Two Ways to Generate Trapdoors for [A || AP] The ABB Trick: [Agrawal-Boneh-Boyen’ 10] ─ Given short R and trap for G, can gen trap for [A || AR+G] ─ Want: Short solution t s. t. [A || AR+G] t = c (mod q) ─ Note that [A || AR+G] [-R || I]T = G ─ Solve for short t s. t. Gt = u ─ [A || AR+G] [-R || I]T t = Gt = u (mod q)

lwe challenge (A, s. TA+e) Security Proof mpk*: ( A, Ai = ARi – xi*G ) Equivocal commitment (cf. Daniel talk) Ri random low-norm commitment randomness ct*: ( s. TA, s. T (Ai + xi* G) = s. TARi ) sk. P: Compute [ A || AP ] = [ A || ARP – P(x*)G] Cf. homomorphic commitments = [ A || AR P – G] x* P(x*) is NON-zero Use [ABB 10, MP 12] to gen. trap for [A||A P

Notes and Open Questions ─ Similar ideas: constrained PRFs for circuits [BV’ 15 ─ Other applications? ─ Adaptive security(without complexity Thm [ABSV’ 15]: Generic transformation for FE leveraging) ─ Bootstrap ABE for circuits (currently: circuits of a-priori bounded depth) Thm [GVW’ 12, ABSV’ 15]: Bootstrapping for

Thanks!