Black-box circular-secure encryption beyond affine functions
Name
Goldwasser-Black-box circular-secure.pdf
Size
225 KB
Format
Adobe PDF
Checksum (MD5)
3168b33e07fd78a1acf051a900976b24
Author(s)
Brakerski, Zvika
Goldwasser, Shafi
Kalai, Yael Tauman
Date Issued
March 2011
Journal
Theory of Cryptography
Publisher
Springer Berlin / Heidelberg
Citation
Brakerski, Zvika, Shafi Goldwasser, and Yael Tauman Kalai. “Black-Box Circular-Secure Encryption Beyond Affine Functions.” Theory of Cryptography. Ed. Yuval Ishai. LNCS Vol. 6597. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011. 201–218.
Version
Author's final manuscript
Abstract
We show how to achieve public-key encryption schemes that can securely encrypt nonlinear functions of their own secret key. Specifically, we show that for any constant d ∈ ℕ, there exists a public-key encryption scheme that can securely encrypt any function f of its own secret key, assuming f can be expressed as a polynomial of total degree d. Such a scheme is said to be key-dependent message (KDM) secure w.r.t. degree-d polynomials. We also show that for any constants c,e, there exists a public-key encryption scheme that is KDM secure w.r.t. all Turing machines with description size clogλ and running time λ [superscript e] , where λ is the security parameter. The security of such public-key schemes can be based either on the standard decision Diffie-Hellman (DDH) assumption or on the learning with errors (LWE) assumption (with certain parameters settings).
In the case of functions that can be expressed as degree-d polynomials, we show that the resulting schemes are also secure with respect to key cycles of any length. Specifically, for any polynomial number n of key pairs, our schemes can securely encrypt a degree-d polynomial whose variables are the collection of coordinates of all n secret keys. Prior to this work, it was not known how to achieve this for nonlinear functions.
Our key idea is a general transformation that amplifies KDM security. The transformation takes an encryption scheme that is KDM secure w.r.t. some functions even when the secret keys are weak (i.e. chosen from an arbitrary distribution with entropy k), and outputs a scheme that is KDM secure w.r.t. a richer class of functions. The resulting scheme may no longer be secure with weak keys. Thus, in some sense, this transformation converts security with weak keys into amplified KDM security.
Description
8th Theory of Cryptography Conference, TCC 2011, Providence, RI, USA, March 28-30, 2011. Proceedings
MIT Department
Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike 3.0
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1007/978-3-642-19571-6_13
