FUNCTIONAL ENCRYPTION & PROPERTY PRESERVING ENCRYPTION

Shashank Agrawal (UIUC), Shweta Agrawal (IIT-D), Saikrishna Badrinarayanan (IIT-M), Abisekh Kumarasubramanian (UCLA), Manoj Prabhakaran (UIUC), Amit Sahai (UCLA).

OUTLINE

Various encryption schemes: Public-key functional encryption, Private-key functional encryption, Property Preserving encryption.

Fairly new ideas, spend some time on each one. What they are? Our results.

Come back and discuss Public-key functional encryption in detail.

PUBLIC KEY FUNCTIONAL ENC.

MSK, MPKAlice

MPK

MPK

MPK

ENC (m)

Julie

Bob

𝑓 ∈𝐹𝑆𝐾 𝑓 DEC ( ENC(m) )

= f(m)

𝑚∈𝑀

Trusted Authority

PUBLIC KEY FUNCTIONAL ENC.First formally studied by Boneh, Sahai and Waters in 2011.

Encompasses well-known notions of encryption: Public-key encryption [DH76, RSA77, …], Identity-based encryption [Sha84, BF01, Coc01, BW06, GPV08],

Attribute-based encryption [SW05, GPSW06, GVW13, GGH+13],

Predicate encryption [KSW08, LOS+10, AFV11], Searchable encryption [BCOP04], etc .

Has been the subject of intense study in the recent past.

OUR CONTRIBUTION

A new definition for Functional Encryption: Simulation based (real-ideal world), Provides both function and message hiding, Simple and intuitive.

First definition with the above features.

Construct a secure protocol in the generic group model. Practice: Security against a large class of attacks. Function family F: inner-product predicates.

PRIVATE KEY FUNCTIONAL ENC.

SK

ENC (m1, SK)

ENC (m2, SK)

ENC (m3, SK)

𝑚1 ,𝑚2 ,𝑚3∈𝑀

for an

𝑓 (𝑚1 ) , 𝑓 (𝑚2 ) , 𝑓 (𝑚3)

Client

Server

USE CASE

Client stores files on server by encrypting them.

Later the client wants all files with the keyword ‘urgent’. Client sends a key to the server.

Server applies decryption function to each file. Returns files for which output is 1 to the client.

Dec (, Enc. file) = 1 iff file contains the word ‘urgent’.

PRIVATE KEY FUNCTIONAL ENC.

First studied by Shen, Shi and Waters in 2009 [SSW09].

SSW09 construct a secure protocol for inner-product predicates.

A new protocol that is better in several ways.

AN IMPROVED PROTOCOL

SSW09 protocol Our protocol

Selective security Full security

Composite-order groups

Prime-order groups

Non-standard assumptions

Standard assumption

OUR PROTOCOL

Derived from Okamoto and Takashima [OT12]. Symmetric nature of inner-product predicates.

Ways to transform a protocol with weaker properties into one with stronger properties [Fre10, Lew12]. No method can simultaneously solve all the three problems.

PROPERTY PRESERVING ENCRYPTION

SKENC (m1, SK)

ENC (m2, SK)

Client

Server

Property :𝑀×𝑀→ {0,1}TEST(ENC(m1), ENC(m2))= P(m1, m2)

USE CASE

Property: Given two files, which one comes before in alphabetical order.

Client stores files on server by encrypting them.

Later client wants to retrieve the file which comes first in alphabetical order. Server uses to compare encrypted files. Sorts the files in alphabetical order.

PROPERTY PRESERVING ENCRYPTIONIntroduced by Pandey and Rouselakis in 2012 [PR12].

PR12 gives a protocol for the inner-product property.

We improve their protocol in two crucial ways.

Exploit connection b/n Private-key FE and PPE.

PR12 Our protocol

Composite-order groups Prime order groups

Generic group modelStandard model (DLIN assumption)

PUBLIC-KEY FUNCTIONAL ENCRYPTION

MSK, MPKAlice

MPK

MPK

MPK

ENC (m, MPK)

Julie

Adversary

𝑓 ∈𝐹𝑆𝐾 𝑓 DEC ( ENC(m) )

= f(m)

𝑚∈𝑀

Trusted Authority

INDISTINGUISHABILITY BASED DEF.Message hiding: and s.t.

indistinguishable from .

Function hiding: and s.t. . indistinguishable from . By creating , , ,… compute or Could distinguish between and .

SIMULATION BASED DEF.A new definition for Functional Encryption:Simulation based (real-ideal world),Provides both function and message hiding,Simple and intuitive.

Real world execution of a protocol is compared with an “Ideal” world.

Ideal world: Security requirements we want from our protocol.

Real World Ideal World

Environment

Environment

MSK, MPKMPK

𝐸𝑛𝑐 (𝑚1)

𝑓 1

𝑆𝐾 𝑓 1

𝑚1𝑓 𝑘∈𝐹

𝑚𝑖∈𝑀

𝑚1 ,𝑚2 ,… ,𝑚𝑖− 1

𝑓 1 , 𝑓 2 ,…, 𝑓 𝑘−1,𝑚𝑖, 𝑓 𝑘

AdversaryTrusted Authority Oracle Simulator

…,𝑚𝑖

…, 𝑓 𝑘

…,𝐸𝑛𝑐 (𝑚𝑖)

…,𝑆𝐾 𝑓 𝑘

∀ 𝐴𝑑𝑣∃𝑆𝑖𝑚𝑅𝑒𝑎𝑙≈ 𝐼𝑑𝑒𝑎𝑙

OUR SET-UP

Strong security definition.Cannot be realized in the standard model [BSW11, O’N11, BO12].

Adversary doesn’t exploit structure of the group. Generic group model: captures most real-world attacks.

Function family F: inner product predicates.Looking at some special cases of Functional Encryption.

Inner-product predicates capture those cases.

IDENTITY BASED ENCRYPTIONID = {Bob, Alice, Mary, …} and .

.. if , and otherwise.

Authority gives secret key according to id Ex: Alice gets a SK for

Bob sends to Alice.Only Alice can obtain , using SK for .

COMPLEX POLICIES

Complex policies like Head of Dept. OR (Faculty AND Security).

iff and satisfy the Boolean Expression .

INNER-PRODUCT PREDICATES Powerful primitive:

Identity Based Encryption Complex Policies like Boolean Expressions

. .

if , and otherwise.

Given a key for we would be able to recover from an encryption only if .

OUR PROTOCOL

A protocol for inner-product predicates in the Generic group model, which is secure under a strong simulation-based definition.

Two constructions Dual Pairing Vector Spaces (Okamoto and Takashima in 2008).

Secret Sharing.

The constructions have comparable efficiency. For vectors of length n, ciphertext and key of length 3n.

CONCLUSION

A new powerful definition for Public-Key Functional Encryption. Protocol in the Generic group model.

Another definition Relax-SIM. Protocol in the standard model.

Improve protocols for Private-Key Functional Encryption and Property Preserving Encryption in various ways. First protocols under standard assumptions/model.

THANK YOU

Paper will soon be available on Eprint.