CryptoDB
Akin Ünal
Publications
Year
Venue
Title
2024
PKC
Compact Selective Opening Security From LWE
Abstract
Selective opening (SO) security is a security notion for public-key
encryption schemes that captures security against adaptive corruptions of
senders. SO security comes in chosen-plaintext (SO-CPA) and chosen-ciphertext
(SO-CCA) variants, neither of which is implied by standard security notions
like IND-CPA or IND-CCA security.
In this paper, we present the first SO-CCA secure encryption scheme that
combines the following two properties: (1) it has a constant ciphertext
expansion (i.e., ciphertexts are only larger than plaintexts by a constant
factor), and (2) its security can be proven from a standard assumption.
Previously, the only known SO-CCA secure encryption scheme achieving (1) was
built from an ad-hoc assumption in the RSA regime.
Our construction builds upon LWE, and in particular on a new and surprisingly
simple construction of compact lossy trapdoor functions (LTFs). Our LTF can
be converted into an “all-but-many LTF” (or ABM-LTF), which is known to be
sufficient to obtain SO-CCA security. Along the way, we fix a technical
problem in that previous ABM-LTF-based construction of SO-CCA security.
2024
EUROCRYPT
Lower Bounds for Lattice-based Compact Functional Encryption
Abstract
Functional encryption (FE) is a primitive where the holder of a master secret key
can control which functions a user can evaluate on encrypted data. It is a powerful
primitive that even implies indistinguishability obfuscation (iO), given sufficiently
compact ciphertexts (Ananth-Jain, CRYPTO'15 and Bitansky-Vaikuntanathan, FOCS'15).
However, despite being extensively studied, there are FE schemes,
such as function-hiding inner-product FE (Bishop-Jain-Kowalczyk, AC'15,
Abdalla-Catalano-Fiore-Gay-Ursu, CRYPTO’18) and compact quadratic FE
(Baltico-Catalano-Fiore-Gay, Lin, CRYPTO’17),
that can be only realized using pairings. This raises the question if there are some
mathematical barriers that hinder us from realizing these FE schemes from other assumptions.
In this paper, we study the difficulty of constructing lattice-based compact FE. We
generalize the impossibility results of Ünal (EC'20) for lattice-based function-hiding
FE, and extend it to the case of compact FE.
Concretely, we prove lower bounds for lattice-based compact FE schemes which meet
some (natural) algebraic restrictions at encryption and decryption, and have
ciphertexts of linear size and secret keys of minimal degree. We see our results as
important indications of why it is hard to construct lattice-based FE schemes for new
functionalities, and which mathematical barriers have to be overcome.
Coauthors
- Dennis Hofheinz (1)
- Kristina Hostáková (1)
- Julia Kastner (1)
- Karen Klein (1)
- Erkan Tairi (1)
- Akin Ünal (2)