Embed Size (px)
Citation preview
Program obfuscation
Alice Pellet-Mary
LIP, ENS de Lyon
PhD seminar, CWIJuly 12, 2019
A. Pellet-Mary Program obfuscation PhD seminar 1/23
Obfuscation
An obfuscator should:
render the code of a program unintelligible;
while preserving functionality and e�ciency.
Two kind of obfuscators:
practical obfuscators (white box)
theoretical obfuscators (iO)
A. Pellet-Mary Program obfuscation PhD seminar 2/23
Obfuscation
An obfuscator should:
render the code of a program unintelligible;
while preserving functionality and e�ciency.
Two kind of obfuscators:
practical obfuscators (white box)
theoretical obfuscators (iO)
A. Pellet-Mary Program obfuscation PhD seminar 2/23
Obfuscation
An obfuscator should:
render the code of a program unintelligible;
while preserving functionality and e�ciency.
Two kind of obfuscators:
practical obfuscators (white box)
theoretical obfuscators (iO)
A. Pellet-Mary Program obfuscation PhD seminar 2/23
Overview of the talk
1 De�nition
2 CandidatesSecurityPracticability
3 Example of construction of an obfuscator
A. Pellet-Mary Program obfuscation PhD seminar 3/23
Outline of the talk
1 De�nition
2 CandidatesSecurityPracticability
3 Example of construction of an obfuscator
A. Pellet-Mary Program obfuscation PhD seminar 4/23
What is a program?
C/C++/Python/· · · code;
Turing machine;
Boolean circuit;
Branching programs;
x
y
z
x ∨ (y ∧ z)
Notation
C = class of all polynomial size boolean circuits
A. Pellet-Mary Program obfuscation PhD seminar 5/23
What is a program?
C/C++/Python/· · · code;Turing machine;
Boolean circuit;
Branching programs;
x
y
z
x ∨ (y ∧ z)
Notation
C = class of all polynomial size boolean circuits
A. Pellet-Mary Program obfuscation PhD seminar 5/23
What is a program?
C/C++/Python/· · · code;Turing machine;
Boolean circuit;
Branching programs;
x
y
z
x ∨ (y ∧ z)
Notation
C = class of all polynomial size boolean circuits
A. Pellet-Mary Program obfuscation PhD seminar 5/23
What is a program?
C/C++/Python/· · · code;Turing machine;
Boolean circuit;
Branching programs;
x
y
z
x ∨ (y ∧ z)
Notation
C = class of all polynomial size boolean circuits
A. Pellet-Mary Program obfuscation PhD seminar 5/23
Virtual Black Box (VBB) obfuscation
Recall
C = class of all polynomial size boolean circuits
A VBB obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);(Virtual Black Box security) For all PPT A, there exists a PPT Sims.t. for all C ∈ C,∣∣∣P [A(O(C )) = 1]− P
[SimC (1|C |) = 1
]∣∣∣ ≤ negl.
VBB obfuscation is impossible to achieve [BGI+01]
[BGI+01] B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan and K.
Yang. On the (im) possibility of obfuscating programs, Crypto.
A. Pellet-Mary Program obfuscation PhD seminar 6/23
Virtual Black Box (VBB) obfuscation
Recall
C = class of all polynomial size boolean circuits
A VBB obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);(Virtual Black Box security) For all PPT A, there exists a PPT Sims.t. for all C ∈ C,∣∣∣P [A(O(C )) = 1]− P
[SimC (1|C |) = 1
]∣∣∣ ≤ negl.
VBB obfuscation is impossible to achieve [BGI+01]
[BGI+01] B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan and K.
Yang. On the (im) possibility of obfuscating programs, Crypto.
A. Pellet-Mary Program obfuscation PhD seminar 6/23
Virtual Black Box (VBB) obfuscation
Recall
C = class of all polynomial size boolean circuits
A VBB obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);
(Virtual Black Box security) For all PPT A, there exists a PPT Sims.t. for all C ∈ C,∣∣∣P [A(O(C )) = 1]− P
[SimC (1|C |) = 1
]∣∣∣ ≤ negl.
VBB obfuscation is impossible to achieve [BGI+01]
[BGI+01] B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan and K.
Yang. On the (im) possibility of obfuscating programs, Crypto.
A. Pellet-Mary Program obfuscation PhD seminar 6/23
Virtual Black Box (VBB) obfuscation
Recall
C = class of all polynomial size boolean circuits
A VBB obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);(Virtual Black Box security) For all PPT A, there exists a PPT Sims.t. for all C ∈ C,∣∣∣P [A(O(C )) = 1]− P
[SimC (1|C |) = 1
]∣∣∣ ≤ negl.
VBB obfuscation is impossible to achieve [BGI+01]
[BGI+01] B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan and K.
Yang. On the (im) possibility of obfuscating programs, Crypto.
A. Pellet-Mary Program obfuscation PhD seminar 6/23
Virtual Black Box (VBB) obfuscation
Recall
C = class of all polynomial size boolean circuits
A VBB obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);(Virtual Black Box security) For all PPT A, there exists a PPT Sims.t. for all C ∈ C,∣∣∣P [A(O(C )) = 1]− P
[SimC (1|C |) = 1
]∣∣∣ ≤ negl.
VBB obfuscation is impossible to achieve [BGI+01]
[BGI+01] B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan and K.
Yang. On the (im) possibility of obfuscating programs, Crypto.A. Pellet-Mary Program obfuscation PhD seminar 6/23
Indistinguishability Obfuscation (iO)
An indistinguishability obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);(indistinguishability) For all C1,C2 ∈ C with C1 ≡ C2,
O(C1) 'c O(C2).
A. Pellet-Mary Program obfuscation PhD seminar 7/23
Indistinguishability Obfuscation (iO)
An indistinguishability obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);(indistinguishability) For all C1,C2 ∈ C with C1 ≡ C2,
O(C1) 'c O(C2).
A. Pellet-Mary Program obfuscation PhD seminar 7/23
Indistinguishability Obfuscation (iO)
An indistinguishability obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);
(indistinguishability) For all C1,C2 ∈ C with C1 ≡ C2,
O(C1) 'c O(C2).
A. Pellet-Mary Program obfuscation PhD seminar 7/23
Indistinguishability Obfuscation (iO)
An indistinguishability obfuscator O : C → C should satisfy
(Functionality) For all C ∈ C, O(C ) ≡ C ;
(E�ciency) O is PPT ⇒ for all C ∈ C, |O(C )| ≤ poly(|C |);(indistinguishability) For all C1,C2 ∈ C with C1 ≡ C2,
O(C1) 'c O(C2).
A. Pellet-Mary Program obfuscation PhD seminar 7/23
If P = NP . . .
If P = NP, then iOs exist, e.g.:⇒ There exist ine�cient iOs (even if P 6= NP)
O(C ) = smallest circuit computing the same function as C
A. Pellet-Mary Program obfuscation PhD seminar 8/23
If P = NP . . .
If P = NP, then iOs exist, e.g.:⇒ There exist ine�cient iOs (even if P 6= NP)
O(C ) = smallest circuit computing the same function as C
A. Pellet-Mary Program obfuscation PhD seminar 8/23
Why is iO useful (1)
iO achieves �best possible� obfuscation
Proof:
let O be an iO obfuscator and O′ be another obfuscator
for any C ∈ C, O(C ) 'c O(O′(C ))
O(O′(C )) reveals less info than O′(C )
O(C ) reveals less info than O′(C )
Informally: anything revealed by O(C ) is revealed by any C ′ ≡ C
A. Pellet-Mary Program obfuscation PhD seminar 9/23
Why is iO useful (1)
iO achieves �best possible� obfuscation
Proof:
let O be an iO obfuscator and O′ be another obfuscator
for any C ∈ C, O(C ) 'c O(O′(C ))
O(O′(C )) reveals less info than O′(C )
O(C ) reveals less info than O′(C )
Informally: anything revealed by O(C ) is revealed by any C ′ ≡ C
A. Pellet-Mary Program obfuscation PhD seminar 9/23
Why is iO useful (1)
iO achieves �best possible� obfuscation
Proof:
let O be an iO obfuscator and O′ be another obfuscator
for any C ∈ C, O(C ) 'c O(O′(C ))
O(O′(C )) reveals less info than O′(C )
O(C ) reveals less info than O′(C )
Informally: anything revealed by O(C ) is revealed by any C ′ ≡ C
A. Pellet-Mary Program obfuscation PhD seminar 9/23
Why is iO useful (1)
iO achieves �best possible� obfuscation
Proof:
let O be an iO obfuscator and O′ be another obfuscator
for any C ∈ C, O(C ) 'c O(O′(C ))
O(O′(C )) reveals less info than O′(C )
O(C ) reveals less info than O′(C )
Informally: anything revealed by O(C ) is revealed by any C ′ ≡ C
A. Pellet-Mary Program obfuscation PhD seminar 9/23
Why is iO useful (1)
iO achieves �best possible� obfuscation
Proof:
let O be an iO obfuscator and O′ be another obfuscator
for any C ∈ C, O(C ) 'c O(O′(C ))
O(O′(C )) reveals less info than O′(C )
O(C ) reveals less info than O′(C )
Informally: anything revealed by O(C ) is revealed by any C ′ ≡ C
A. Pellet-Mary Program obfuscation PhD seminar 9/23
Why is iO useful (1)
iO achieves �best possible� obfuscation
Proof:
let O be an iO obfuscator and O′ be another obfuscator
for any C ∈ C, O(C ) 'c O(O′(C ))
O(O′(C )) reveals less info than O′(C )
O(C ) reveals less info than O′(C )
Informally: anything revealed by O(C ) is revealed by any C ′ ≡ C
A. Pellet-Mary Program obfuscation PhD seminar 9/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)
Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Why is iO useful (2)Many cryptographic constructions from iO:functional encryption, deniable encryption, NIKZs, oblivious transfer, . . .
Example: black box decryption (symmetric setting)Recall: anything revealed by O(C) is revealed by any C ′ ≡ C
take (Setup,Enc,Dec) your favourite SKE scheme
Setup':I sk1 ← Setup(), sk2 ← Setup()I output sk ′ = (sk1, sk2)
Enc'(m, sk ′):I c1 ← Enc(m, sk1), c2 ← Enc(m, sk2)I output (c1, c2)
Dec':I C1(c1, c2) = Dec(sk1, c1) (sk1 hardcoded in C1)I C2(c1, c2) = Dec(sk2, c2) (sk2 hardcoded in C2)
C1 ≡ C2 ⇒ C = O(C1) 'c O(C2) does not reveal sk1 or sk2
A. Pellet-Mary Program obfuscation PhD seminar 10/23
Outline of the talk
1 De�nition
2 CandidatesSecurityPracticability
3 Example of construction of an obfuscator
A. Pellet-Mary Program obfuscation PhD seminar 11/23
Disclaimer
We only have candidate iO(no construction based on standard cryptographic assumptions)
A. Pellet-Mary Program obfuscation PhD seminar 12/23
Three main categories
Branching program obfuscators
I needs bootstrapping via fully homomorphic encryptionI security proofs in some idealized models . . .I . . . but many attacks
Circuit obfuscatorsI no need for bootstrappingI security proofs of VBB in some idealized models . . .I . . . but many attacks
Obfuscation via functional encryptionI try to �nd the weakest primitive implying iOI some attacks and impossibility results (not well understood yet)I most of them are not instantiable
A. Pellet-Mary Program obfuscation PhD seminar 13/23
Three main categories
Branching program obfuscatorsI needs bootstrapping via fully homomorphic encryption
I security proofs in some idealized models . . .I . . . but many attacks
Circuit obfuscatorsI no need for bootstrappingI security proofs of VBB in some idealized models . . .I . . . but many attacks
Obfuscation via functional encryptionI try to �nd the weakest primitive implying iOI some attacks and impossibility results (not well understood yet)I most of them are not instantiable
A. Pellet-Mary Program obfuscation PhD seminar 13/23
Three main categories
Branching program obfuscatorsI needs bootstrapping via fully homomorphic encryptionI security proofs in some idealized models . . .I . . . but many attacks
Circuit obfuscatorsI no need for bootstrappingI security proofs of VBB in some idealized models . . .I . . . but many attacks
Obfuscation via functional encryptionI try to �nd the weakest primitive implying iOI some attacks and impossibility results (not well understood yet)I most of them are not instantiable
A. Pellet-Mary Program obfuscation PhD seminar 13/23
Three main categories
Branching program obfuscatorsI needs bootstrapping via fully homomorphic encryptionI security proofs of VBB in some idealized models . . .I . . . but many attacks
Circuit obfuscatorsI no need for bootstrappingI security proofs of VBB in some idealized models . . .I . . . but many attacks
Obfuscation via functional encryptionI try to �nd the weakest primitive implying iOI some attacks and impossibility results (not well understood yet)I most of them are not instantiable
A. Pellet-Mary Program obfuscation PhD seminar 13/23
Three main categories
Branching program obfuscatorsI needs bootstrapping via fully homomorphic encryptionI security proofs of VBB in some idealized models . . .I . . . but many attacks
Circuit obfuscatorsI no need for bootstrapping
I security proofs of VBB in some idealized models . . .I . . . but many attacks
Obfuscation via functional encryptionI try to �nd the weakest primitive implying iOI some attacks and impossibility results (not well understood yet)I most of them are not instantiable
A. Pellet-Mary Program obfuscation PhD seminar 13/23
Three main categories
Branching program obfuscatorsI needs bootstrapping via fully homomorphic encryptionI security proofs of VBB in some idealized models . . .I . . . but many attacks
Circuit obfuscatorsI no need for bootstrappingI security proofs of VBB in some idealized models . . .I . . . but many attacks
Obfuscation via functional encryptionI try to �nd the weakest primitive implying iOI some attacks and impossibility results (not well understood yet)I most of them are not instantiable
A. Pellet-Mary Program obfuscation PhD seminar 13/23
Three main categories
Branching program obfuscatorsI needs bootstrapping via fully homomorphic encryptionI security proofs of VBB in some idealized models . . .I . . . but many attacks
Circuit obfuscatorsI no need for bootstrappingI security proofs of VBB in some idealized models . . .I . . . but many attacks
Obfuscation via functional encryptionI try to �nd the weakest primitive implying iOI some attacks and impossibility results (not well understood yet)I most of them are not instantiable
A. Pellet-Mary Program obfuscation PhD seminar 13/23
Security
Branching program and circuit obfuscators use multilinear maps.All the candidate multilinear maps we know su�er from weaknesses.
number ofcandidates
still standingclassically
still standingquantumly
Branchingprogram iO
≈ 20 ≈ 10 3
Circuit iO ≈ 8 ≈ 8 0
All attacks rely on the underlying multilinear map
A. Pellet-Mary Program obfuscation PhD seminar 14/23
Security
Branching program and circuit obfuscators use multilinear maps.All the candidate multilinear maps we know su�er from weaknesses.
number ofcandidates
still standingclassically
still standingquantumly
Branchingprogram iO
≈ 20 ≈ 10 3
Circuit iO ≈ 8 ≈ 8 0
All attacks rely on the underlying multilinear map
A. Pellet-Mary Program obfuscation PhD seminar 14/23
Restricted functionalities
VBB obfuscators based on RLWE for
point functionsfy (x) = 1 i� x = y
conjunctions
f (x1, . . . , xn) =∧i∈I
yi (with yi = xi or xi )
compute-and-compare functions
fg ,y (x) = 1 i� g(x) = y
A. Pellet-Mary Program obfuscation PhD seminar 15/23
Restricted functionalities
VBB obfuscators based on RLWE for
point functionsfy (x) = 1 i� x = y
conjunctions
f (x1, . . . , xn) =∧i∈I
yi (with yi = xi or xi )
compute-and-compare functions
fg ,y (x) = 1 i� g(x) = y
A. Pellet-Mary Program obfuscation PhD seminar 15/23
Restricted functionalities
VBB obfuscators based on RLWE for
point functionsfy (x) = 1 i� x = y
conjunctions
f (x1, . . . , xn) =∧i∈I
yi (with yi = xi or xi )
compute-and-compare functions
fg ,y (x) = 1 i� g(x) = y
A. Pellet-Mary Program obfuscation PhD seminar 15/23
Restricted functionalities
VBB obfuscators based on RLWE for
point functionsfy (x) = 1 i� x = y
conjunctions
f (x1, . . . , xn) =∧i∈I
yi (with yi = xi or xi )
compute-and-compare functions
fg ,y (x) = 1 i� g(x) = y
A. Pellet-Mary Program obfuscation PhD seminar 15/23
Practicability
function
obfuscated
security
parameter
λ
size
obfuscated
program
obfuscation
time
evaluation
time
security
assumptionreference
AES 128 18 700 TB1010 multsof 108 bitsintegers
none - [YLX17]
one-roundkey-exchangewith 4 users
52 4.8 GB 2h20 ≤ 1 min none - [CP18]
Ax11 × · · · ×Ax2020
80 80 h 25 min none [HHSSD17]
x1 ∧ x4 ∧· · · ∧ x32
53 6.2 min 32msentropicRLWE
[CDCG+18]
x1 ∧ x4 ∧· · · ∧ x64
73 6.7h 2.4sentropicRLWE
[CDCG+18]
A. Pellet-Mary Program obfuscation PhD seminar 16/23
Outline of the talk
1 De�nition
2 CandidatesSecurityPracticability
3 Example of construction of an obfuscator
A. Pellet-Mary Program obfuscation PhD seminar 17/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0
×
x1
M1,0
M1,1
×
x1
M2,0
M2,1
×
x2
M3,0
M3,1
×
x1
M4,0
M4,1
×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑ ↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0
×
x1
M1,0
M1,1
×
x1
M2,0
M2,1
×
x2
M3,0
M3,1
×
x1
M4,0
M4,1
×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑ ↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0
×
x1
M1,0
M1,1
×
x1
M2,0
M2,1
×
x2
M3,0
M3,1
×
x1
M4,0
M4,1
×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑ ↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1
×
x1
M2,0
M2,1
×
x2
M3,0
M3,1
×
x1
M4,0
M4,1
×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1↑
↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1 ×
x1
M2,0
M2,1
×
x2
M3,0
M3,1
×
x1
M4,0
M4,1
×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1↑
↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1 ×
x1
M2,0
M2,1 ×
x2
M3,0
M3,1
×
x1
M4,0
M4,1
×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑
↑
↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1 ×
x1
M2,0
M2,1 ×
x2
M3,0
M3,1 ×
x1
M4,0
M4,1
×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1↑
↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1 ×
x1
M2,0
M2,1 ×
x2
M3,0
M3,1 ×
x1
M4,0
M4,1 ×
x3
M5,0
M5,1
×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑ ↑
↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1 ×
x1
M2,0
M2,1 ×
x2
M3,0
M3,1 ×
x1
M4,0
M4,1 ×
x3
M5,0
M5,1 ×
x2
M6,0
M6,1
×
M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑
↑
↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1 ×
x1
M2,0
M2,1 ×
x2
M3,0
M3,1 ×
x1
M4,0
M4,1 ×
x3
M5,0
M5,1 ×
x2
M6,0
M6,1 × M7
= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑ ↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Branching programs
A branching program represents a function (cf Turing machine, or circuit).
A Branching Program (BP) is a collection of
2` matrices Mi ,b (for i ∈ {1, . . . , `} and b ∈ {0, 1}),two vectors M0 and M`+1,
a vector inp ∈ {1, . . . , r}` (where r is the size of the input).
M0 ×
x1
M1,0
M1,1 ×
x1
M2,0
M2,1 ×
x2
M3,0
M3,1 ×
x1
M4,0
M4,1 ×
x3
M5,0
M5,1 ×
x2
M6,0
M6,1 × M7= 0→ 06= 0→ 1
BP
Evaluation on x = 0 1 1
↑ ↑ ↑
A. Pellet-Mary Program obfuscation PhD seminar 18/23
Cryptographic multilinear maps
De�nition: κ-multilinear map
Di�erent levels of encodings, from 1 to κ.Write Enc(a, i) a level-i encoding of the message a.
Addition: Add(Enc(a1, i), Enc(a2, i)) = Enc(a1 + a2, i).
Multiplication: Mult(Enc(a1, i), Enc(a2, j)) = Enc(a1 · a2, i + j).
Zero-test: Zero-test(Enc(a, κ)) = True i� a = 0.
A. Pellet-Mary Program obfuscation PhD seminar 19/23
Simple obfuscator[GGH+13, BR14, BGK+14, PST14, AGIS14, MSW14, GMM+16]
Input: A branching program
Randomize the branching programI Add random diagonal blocksI Killian's randomizationI Multiply by random (non zero) bundling scalars
Encode the matrices using a multilinear map
Output: The encoded matrices and vectors
A0
0R1
Enc( )
A1,0
A1,1
B1,0
B1,1
R−11 R2
R−11 R2
α1,0×
α1,1×
Enc( )
Enc( )
A2,0
A2,1
B2,0
B2,1
R−12 R3
R−12 R3
α2,0×
α2,1×
Enc( )
Enc( )
A3,0
A3,1
B3,0
B3,1
R−13 R4
R−13 R4
α3,0×
α3,1×
Enc( )
Enc( )
A4
?
R−14Enc( )
A. Pellet-Mary Program obfuscation PhD seminar 20/23
Simple obfuscator[GGH+13, BR14, BGK+14, PST14, AGIS14, MSW14, GMM+16]
Input: A branching program
Randomize the branching programI Add random diagonal blocksI Killian's randomizationI Multiply by random (non zero) bundling scalars
Encode the matrices using a multilinear map
Output: The encoded matrices and vectors
A00
R1
Enc( )
A1,0
A1,1
B1,0
B1,1
R−11 R2
R−11 R2
α1,0×
α1,1×
Enc( )
Enc( )
A2,0
A2,1
B2,0
B2,1
R−12 R3
R−12 R3
α2,0×
α2,1×
Enc( )
Enc( )
A3,0
A3,1
B3,0
B3,1
R−13 R4
R−13 R4
α3,0×
α3,1×
Enc( )
Enc( )
A4
?
R−14Enc( )
A. Pellet-Mary Program obfuscation PhD seminar 20/23
Simple obfuscator[GGH+13, BR14, BGK+14, PST14, AGIS14, MSW14, GMM+16]
Input: A branching program
Randomize the branching programI Add random diagonal blocksI Killian's randomizationI Multiply by random (non zero) bundling scalars
Encode the matrices using a multilinear map
Output: The encoded matrices and vectors
A0
0
R1
Enc( )
A1,0
A1,1
B1,0
B1,1
R−11 R2
R−11 R2
α1,0×
α1,1×
Enc( )
Enc( )
A2,0
A2,1
B2,0
B2,1
R−12 R3
R−12 R3
α2,0×
α2,1×
Enc( )
Enc( )
A3,0
A3,1
B3,0
B3,1
R−13 R4
R−13 R4
α3,0×
α3,1×
Enc( )
Enc( )
A4
?
R−14
Enc( )
A. Pellet-Mary Program obfuscation PhD seminar 20/23
Simple obfuscator[GGH+13, BR14, BGK+14, PST14, AGIS14, MSW14, GMM+16]
Input: A branching program
Randomize the branching programI Add random diagonal blocksI Killian's randomizationI Multiply by random (non zero) bundling scalars
Encode the matrices using a multilinear map
Output: The encoded matrices and vectors
A0
0R1
Enc( )
A1,0
A1,1
B1,0
B1,1
R−11 R2
R−11 R2
α1,0×
α1,1×
Enc( )
Enc( )
A2,0
A2,1
B2,0
B2,1
R−12 R3
R−12 R3
α2,0×
α2,1×
Enc( )
Enc( )
A3,0
A3,1
B3,0
B3,1
R−13 R4
R−13 R4
α3,0×
α3,1×
Enc( )
Enc( )
A4
?
R−14Enc( )
A. Pellet-Mary Program obfuscation PhD seminar 20/23
Simple obfuscator[GGH+13, BR14, BGK+14, PST14, AGIS14, MSW14, GMM+16]
Input: A branching program
Randomize the branching programI Add random diagonal blocksI Killian's randomizationI Multiply by random (non zero) bundling scalars
Encode the matrices using a multilinear map
Output: The encoded matrices and vectors
A0
0R1
Enc( )
A1,0
A1,1
B1,0
B1,1
R−11 R2
R−11 R2
α1,0×
α1,1×
Enc( )
Enc( )
A2,0
A2,1
B2,0
B2,1
R−12 R3
R−12 R3
α2,0×
α2,1×
Enc( )
Enc( )
A3,0
A3,1
B3,0
B3,1
R−13 R4
R−13 R4
α3,0×
α3,1×
Enc( )
Enc( )
A4
?
R−14Enc( )
A. Pellet-Mary Program obfuscation PhD seminar 20/23
Simple obfuscator[GGH+13, BR14, BGK+14, PST14, AGIS14, MSW14, GMM+16]
Input: A branching program
Randomize the branching programI Add random diagonal blocksI Killian's randomizationI Multiply by random (non zero) bundling scalars
Encode the matrices using a multilinear map
Output: The encoded matrices and vectors
A0
0R1
Enc( )
A1,0
A1,1
B1,0
B1,1
R−11 R2
R−11 R2
α1,0×
α1,1×
Enc( )
Enc( )
A2,0
A2,1
B2,0
B2,1
R−12 R3
R−12 R3
α2,0×
α2,1×
Enc( )
Enc( )
A3,0
A3,1
B3,0
B3,1
R−13 R4
R−13 R4
α3,0×
α3,1×
Enc( )
Enc( )
A4
?
R−14
Enc( )
A. Pellet-Mary Program obfuscation PhD seminar 20/23
Mixed-input attack
Notations
Ai ,b input branching program
Ai ,b after randomisation
Ai ,b after encoding with a multilinear map (output of the iO)
A0
Enc( , 1)
A1,0
A1,1
x1
1
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x2
1
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x1
1
Enc( , 1)
Enc( , 1)
A4
Enc( , 1)
A. Pellet-Mary Program obfuscation PhD seminar 21/23
Mixed-input attack
Notations
Ai ,b input branching program
Ai ,b after randomisation
Ai ,b after encoding with a multilinear map (output of the iO)
A0
Enc( , 1)
A1,0
A1,1
x11
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x21
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x11
Enc( , 1)
Enc( , 1)
A4
Enc( , 1)
A. Pellet-Mary Program obfuscation PhD seminar 21/23
Mixed-input attack
Notations
Ai ,b input branching program
Ai ,b after randomisation
Ai ,b after encoding with a multilinear map (output of the iO)
A0
Enc( , 1)
A1,0
A1,1
x11
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x20
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x11
Enc( , 1)
Enc( , 1)
A4
Enc( , 1)
A. Pellet-Mary Program obfuscation PhD seminar 21/23
Mixed-input attack
Notations
Ai ,b input branching program
Ai ,b after randomisation
Ai ,b after encoding with a multilinear map (output of the iO)
A0
Enc( , 1)
A1,0
A1,1
x10
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x21
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x10
Enc( , 1)
Enc( , 1)
A4
Enc( , 1)
A. Pellet-Mary Program obfuscation PhD seminar 21/23
Mixed-input attack
Notations
Ai ,b input branching program
Ai ,b after randomisation
Ai ,b after encoding with a multilinear map (output of the iO)
A0
Enc( , 1)
A1,0
A1,1
x10
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x20
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x10
Enc( , 1)
Enc( , 1)
A4
Enc( , 1)
A. Pellet-Mary Program obfuscation PhD seminar 21/23
Mixed-input attack
Notations
Ai ,b input branching program
Ai ,b after randomisation
Ai ,b after encoding with a multilinear map (output of the iO)
A0
Enc( , 1)
A1,0
A1,1
x10
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x20
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x11
Enc( , 1)
Enc( , 1)
A4
Enc( , 1)
A. Pellet-Mary Program obfuscation PhD seminar 21/23
Mixed-input attack
Notations
Ai ,b input branching program
Ai ,b after randomisation
Ai ,b after encoding with a multilinear map (output of the iO)
A0Enc( , 1)
A1,0
A1,1
x10
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x20
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x11
Enc( , 1)
Enc( , 1)
A4Enc( , 1)
A. Pellet-Mary Program obfuscation PhD seminar 21/23
Preventing mixed-input attacks
In the randomization phase ⇒ not in this talk [GGH+13, BR14]
Using the mmap ⇒ straddling set system[BGK+14, PST14, AGIS14, MSW14, GMM+16]
Mmap degree: κ = 5
A0Enc( , 1)
A1,0
A1,1
x1
0
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x2
0
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x1
1
Enc( , 1)
Enc( , 1)
A4Enc( , 1)
Total level: 7 ⇒ cannot zero-test
A. Pellet-Mary Program obfuscation PhD seminar 22/23
Preventing mixed-input attacks
In the randomization phase ⇒ not in this talk [GGH+13, BR14]
Using the mmap ⇒ straddling set system[BGK+14, PST14, AGIS14, MSW14, GMM+16]
Mmap degree: κ = 5
A0Enc( , 1)
A1,0
A1,1
x1
0
Enc( , 1)
Enc( , 1)
A2,0
A2,1
x2
0
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x1
1
Enc( , 1)
Enc( , 1)
A4Enc( , 1)
Total level: 7 ⇒ cannot zero-test
A. Pellet-Mary Program obfuscation PhD seminar 22/23
Preventing mixed-input attacks
In the randomization phase ⇒ not in this talk [GGH+13, BR14]
Using the mmap ⇒ straddling set system[BGK+14, PST14, AGIS14, MSW14, GMM+16]
Mmap degree: κ = 6
A0Enc( , 1)
A1,0
A1,1
x1
0
Enc( , 2)
Enc( , 1)
A2,0
A2,1
x2
0
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x1
1
Enc( , 1)
Enc( , 2)
A4Enc( , 1)
Total level: 7 ⇒ cannot zero-test
A. Pellet-Mary Program obfuscation PhD seminar 22/23
Preventing mixed-input attacks
In the randomization phase ⇒ not in this talk [GGH+13, BR14]
Using the mmap ⇒ straddling set system[BGK+14, PST14, AGIS14, MSW14, GMM+16]
Mmap degree: κ = 6
A0Enc( , 1)
A1,0
A1,1
x10
Enc( , 2)
Enc( , 1)
A2,0
A2,1
x20
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x11
Enc( , 1)
Enc( , 2)
A4Enc( , 1)
Total level: 7 ⇒ cannot zero-test
A. Pellet-Mary Program obfuscation PhD seminar 22/23
Preventing mixed-input attacks
In the randomization phase ⇒ not in this talk [GGH+13, BR14]
Using the mmap ⇒ straddling set system[BGK+14, PST14, AGIS14, MSW14, GMM+16]
Mmap degree: κ = 6
A0Enc( , 1)
A1,0
A1,1
x10
Enc( , 2)
Enc( , 1)
A2,0
A2,1
x20
Enc( , 1)
Enc( , 1)
A3,0
A3,1
x11
Enc( , 1)
Enc( , 2)
A4Enc( , 1)
Total level: 7 ⇒ cannot zero-test
A. Pellet-Mary Program obfuscation PhD seminar 22/23
What to remember
+ iO would be very useful (at least for theory) . . .
− . . . but no constructions from standard assumptions yet
− . . . even insecure constructions are very ine�cient
+ maybe for restricted class of functions e�ciency and security arepossible
Questions?
A. Pellet-Mary Program obfuscation PhD seminar 23/23
What to remember
+ iO would be very useful (at least for theory) . . .
− . . . but no constructions from standard assumptions yet
− . . . even insecure constructions are very ine�cient
+ maybe for restricted class of functions e�ciency and security arepossible
Questions?
A. Pellet-Mary Program obfuscation PhD seminar 23/23
What to remember
+ iO would be very useful (at least for theory) . . .
− . . . but no constructions from standard assumptions yet
− . . . even insecure constructions are very ine�cient
+ maybe for restricted class of functions e�ciency and security arepossible
Questions?
A. Pellet-Mary Program obfuscation PhD seminar 23/23
What to remember
+ iO would be very useful (at least for theory) . . .
− . . . but no constructions from standard assumptions yet
− . . . even insecure constructions are very ine�cient
+ maybe for restricted class of functions e�ciency and security arepossible
Questions?
A. Pellet-Mary Program obfuscation PhD seminar 23/23
What to remember
+ iO would be very useful (at least for theory) . . .
− . . . but no constructions from standard assumptions yet
− . . . even insecure constructions are very ine�cient
+ maybe for restricted class of functions e�ciency and security arepossible
Questions?
A. Pellet-Mary Program obfuscation PhD seminar 23/23
References I
Benny Applebaum and Zvika Brakerski.
Obfuscating circuits via composite-order graded encoding.In Theory of Cryptography Conference, pages 528�556. Springer, 2015.
Daniel Apon, Nico Döttling, Sanjam Garg, and Pratyay Mukherjee.
Cryptanalysis of indistinguishability obfuscations of circuits over ggh13.In 44th International Colloquium on Automata, Languages, and Programming (ICALP 2017). SchlossDagstuhl-Leibniz-Zentrum fuer Informatik, 2017.
Prabhanjan Ananth, Divya Gupta, Yuval Ishai, and Amit Sahai.
Optimizing obfuscation: Avoiding barrington's theorem.In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pages646�658. ACM, 2014.
Boaz Barak, Oded Goldreich, Rusell Impagliazzo, Steven Rudich, Amit Sahai, Salil Vadhan, and Ke Yang.
On the (im) possibility of obfuscating programs.In Annual International Cryptology Conference, pages 1�18. Springer, 2001.
Boaz Barak, Sanjam Garg, Yael Tauman Kalai, Omer Paneth, and Amit Sahai.
Protecting obfuscation against algebraic attacks.In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages221�238. Springer, 2014.
Zvika Brakerski and Guy N. Rothblum.
Virtual black-box obfuscation for all circuits via generic graded encoding.In Theory of Cryptography Conference, pages 1�25. Springer, 2014.
A. Pellet-Mary Program obfuscation PhD seminar 24/23
References II
David Bruce Cousins, Giovanni Di Crescenzo, Kamil Doruk Gür, Kevin King, Yuriy Polyakov, Kurt Rohlo�,
Gerard W Ryan, and Erkay Savas.Implementing conjunction obfuscation under entropic ring lwe.In 2018 IEEE Symposium on Security and Privacy (SP), pages 354�371. IEEE, 2018.
Yilei Chen, Craig Gentry, and Shai Halevi.
Cryptanalyses of candidate branching program obfuscators.In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages278�307. Springer, 2017.
Jung Hee Cheon, Minki Hhan, Jiseung Kim, and Changmin Lee.
Cryptanalyses of branching program obfuscations over ggh13 multilinear map from the ntru problem.In Annual International Cryptology Conference, pages 184�210. Springer, 2018.
Jean-Sébastien Coron and Hilder VL Pereira.
On kilian's randomization of multilinear map encodings.ePrint, 2018.
Nico Döttling, Sanjam Garg, Divya Gupta, Peihan Miao, and Pratyay Mukherjee.
Obfuscation from low noise multilinear maps.In International Conference in Cryptology in India, pages 329�352. Springer, 2018.
Rex Fernando, Peter MR Rasmussen, and Amit Sahai.
Preventing clt attacks on obfuscation with linear overhead.In International Conference on the Theory and Application of Cryptology and Information Security, pages242�271. Springer, 2017.
Sanjam Garg, Craig Gentry, Shai Halevi, Mariana Raykova, Amit Sahai, and Brent Waters.
Candidate indistinguishability obfuscation and functional encryption for all circuits.pages 40�49, 2013.
A. Pellet-Mary Program obfuscation PhD seminar 25/23
References III
Sanjam Garg, Eric Miles, Pratyay Mukherjee, Amit Sahai, Akshayaram Srinivasan, and Mark Zhandry.
Secure obfuscation in a weak multilinear map model.In Theory of Cryptography Conference, pages 241�268. Springer, 2016.
Shai Halevi, Tzipora Halevi, Victor Shoup, and Noah Stephens-Davidowitz.
Implementing bp-obfuscation using graph-induced encoding.In SIGSAC, pages 783�798. ACM, 2017.
Eric Miles, Amit Sahai, and Mor Weiss.
Protecting obfuscation against arithmetic attacks.IACR Cryptology ePrint Archive, 2014:878, 2014.
Eric Miles, Amit Sahai, and Mark Zhandry.
Annihilation attacks for multilinear maps: Cryptanalysis of indistinguishability obfuscation over ggh13.In Annual International Cryptology Conference, pages 629�658. Springer, 2016.
Alice Pellet-Mary.
Quantum attacks against indistinguishablility obfuscators proved secure in the weak multilinear map model.In Annual International Cryptology Conference, pages 153�183. Springer, 2018.
Rafael Pass, Karn Seth, and Sidharth Telang.
Indistinguishability obfuscation from semantically-secure multilinear encodings.In Annual Cryptology Conference, pages 500�517. Springer, 2014.
Dingfeng Ye, Peng Liu, and Jun Xu.
How fast can we obfuscate using ideal graded encoding schemes.ePrint, 2017.
A. Pellet-Mary Program obfuscation PhD seminar 26/23
References IV
Joe Zimmerman.
How to obfuscate programs directly.In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages439�467. Springer, 2015.
A. Pellet-Mary Program obfuscation PhD seminar 27/23
History (GGH13-based branching program obfuscation)
2013 2014 2015 2016 2017 2018
[GGH+13]
[BR14][BGK+14, PST14][AGIS14, MSW14] [GMM+16]
[MSZ16]
[FRS17]
[CGH17][ADGM17]
[CHKL18][Pel18]
Constructions
Attacks
[MSZ16]: all constructions without diagonal blocks
[ADGM17]: idem MSZ but from circuits
[CGH17]: use input-partitionability (cf CLT13)
⇒ prevented by [FRS17]
[CHKL18]: NTRU attack for speci�c choices of parameters
[Pel18]: quantum attack
A. Pellet-Mary Program obfuscation PhD seminar 28/23
History (GGH13-based branching program obfuscation)
2013 2014 2015 2016 2017 2018
[GGH+13]
[BR14][BGK+14, PST14][AGIS14, MSW14] [GMM+16]
[MSZ16]
[FRS17]
[CGH17][ADGM17]
[CHKL18][Pel18]
Constructions
Attacks
[MSZ16]: all constructions without diagonal blocks
[ADGM17]: idem MSZ but from circuits
[CGH17]: use input-partitionability (cf CLT13)
⇒ prevented by [FRS17]
[CHKL18]: NTRU attack for speci�c choices of parameters
[Pel18]: quantum attack
A. Pellet-Mary Program obfuscation PhD seminar 28/23
History (GGH13-based branching program obfuscation)
2013 2014 2015 2016 2017 2018
[GGH+13]
[BR14][BGK+14, PST14][AGIS14, MSW14] [GMM+16]
[MSZ16]
[FRS17]
[CGH17][ADGM17]
[CHKL18][Pel18]
Constructions
Attacks
[MSZ16]: all constructions without diagonal blocks
[ADGM17]: idem MSZ but from circuits
[CGH17]: use input-partitionability (cf CLT13)
⇒ prevented by [FRS17]
[CHKL18]: NTRU attack for speci�c choices of parameters
[Pel18]: quantum attack
A. Pellet-Mary Program obfuscation PhD seminar 28/23
History (GGH13-based branching program obfuscation)
2013 2014 2015 2016 2017 2018
[GGH+13]
[BR14][BGK+14, PST14][AGIS14, MSW14] [GMM+16]
[MSZ16]
[FRS17]
[CGH17][ADGM17]
[CHKL18][Pel18]
Constructions
Attacks
[MSZ16]: all constructions without diagonal blocks
[ADGM17]: idem MSZ but from circuits
[CGH17]: use input-partitionability (cf CLT13)
⇒ prevented by [FRS17]
[CHKL18]: NTRU attack for speci�c choices of parameters
[Pel18]: quantum attack
A. Pellet-Mary Program obfuscation PhD seminar 28/23
History (GGH13-based branching program obfuscation)
2013 2014 2015 2016 2017 2018
[GGH+13]
[BR14][BGK+14, PST14][AGIS14, MSW14] [GMM+16]
[MSZ16]
[FRS17]
[CGH17][ADGM17]
[CHKL18][Pel18]
Constructions
Attacks
[MSZ16]: all constructions without diagonal blocks
[ADGM17]: idem MSZ but from circuits
[CGH17]: use input-partitionability (cf CLT13) ⇒ prevented by [FRS17]
[CHKL18]: NTRU attack for speci�c choices of parameters
[Pel18]: quantum attack
A. Pellet-Mary Program obfuscation PhD seminar 28/23
History (GGH13-based branching program obfuscation)
2013 2014 2015 2016 2017 2018
[GGH+13]
[BR14][BGK+14, PST14][AGIS14, MSW14] [GMM+16]
[MSZ16]
[FRS17]
[CGH17][ADGM17]
[CHKL18][Pel18]
Constructions
Attacks
[MSZ16]: all constructions without diagonal blocks
[ADGM17]: idem MSZ but from circuits
[CGH17]: use input-partitionability (cf CLT13) ⇒ prevented by [FRS17]
[CHKL18]: NTRU attack for speci�c choices of parameters
[Pel18]: quantum attack
A. Pellet-Mary Program obfuscation PhD seminar 28/23
History (GGH13-based branching program obfuscation)
2013 2014 2015 2016 2017 2018
[GGH+13]
[BR14][BGK+14, PST14][AGIS14, MSW14] [GMM+16]
[MSZ16]
[FRS17]
[CGH17][ADGM17]
[CHKL18][Pel18]
Constructions
Attacks
[MSZ16]: all constructions without diagonal blocks
[ADGM17]: idem MSZ but from circuits
[CGH17]: use input-partitionability (cf CLT13) ⇒ prevented by [FRS17]
[CHKL18]: NTRU attack for speci�c choices of parameters
[Pel18]: quantum attack
A. Pellet-Mary Program obfuscation PhD seminar 28/23
Current status
AttacksiOs
[GGH+13][BR14, BGK+14,PST14, AGIS14,
MSW14][GMM+16]
circuit obfuscators[Zim15, AB15,
DGG+18]
[MSZ16] fully broken
[CGH17]input-
partitionable
[CHKL18] some parameters some parameters
[Pel18] quantum quantum
Still standing classically:
[GGH+13]+[FRS17]
[GMM+16]
all circuit obfuscators
Still standing quantumly:
[GGH+13]+[FRS17]
A. Pellet-Mary Program obfuscation PhD seminar 29/23
![Indistinguishability Obfuscation for all Circuits · AW07, CD08, BC10, HMLS10, HRSV11, BR13] 10/4/2013 Indistinguishability Obfuscation 16 . Aside: Obfuscation vs. HE 10/4/2013 Indistinguishability](https://img.pdfslide.us/doc/110x75/5c046daa09d3f2183a8bae27/indistinguishability-obfuscation-for-all-circuits-aw07-cd08-bc10-hmls10.jpg)
