Deniable Functional Encryption

Abstract

Abstract. Deniable encryption, first introduced by Canetti et al. (CRYPTO 1997), allows a sender and/or receiver of encrypted communication to produce fake but authentic-looking coins and/or secret keys that "open" the communication to a different message. Here we initiate its study for the more general case of functional encryption (FE), as introduced by Boneh et al. (TCC 2011), wherein a receiver in possession of a key k can compute from any encryption of a message x the value F (k, x) according to the scheme's functionality F . Our results are summarized as follows: We put forth and motivate the concept of deniable FE, for which we consider two models. In the first model, as previously considered by O'Neill et al. (CRYPTO 2011) in the case of identity-based encryption, a receiver gets assistance from the master authority to generate a fake secret key. In the second model, there are "normal" and "deniable" secret keys, and a receiver in possession of a deniable secret key can produce a fake but authentic-looking normal key on its own. This parallels the "multidistributional" model of deniability previously considered for public-key encryption. In the first model, we show that any FE scheme for the general circuit functionality (as several recent candidate construction achieve) can be converted into an FE scheme having receiver deniability, without introducing any additional assumptions. In addition we show an efficient receiver deniable FE for Boolean Formulae from bilinear maps. In the second (multi-distributional) model, we show a specific FE scheme for the general circuit functionality having receiver deniability. This result additionally assumes differing-inputs obfuscation and relies on a new technique we call delayed trapdoor circuits. To our knowledge, a scheme in the multi-distributional model was not previously known even in the simpler case of identity-based encryption. Finally, we show that receiver deniability for FE implies some form of simulation security, further motivating study of the latter and implying optimality of our results.

Receiver‐ and sender‐deniable functional encryption

“…Then, Trap i,j will contain the images under the one-way function f of all z i 's. The proof is given in [21].…”

“…In Section 2.2 we introduced the publicly deniable functional encryption primitive and we now show how to modify the receiver deniable scheme of the conference version [21] to add sender deniability.…”

“…Security: The proof that is a (1, 1)‐receiver‐deniable FE scheme for Boolean formulae is essentially that for general functionalities of the conference version [12] and we omit further details. In fact, observe that Boolean formulae are a very special case of general circuits and as such the proof follows the same structure.…”

“…A trivial fix is to put in the ciphertexts as many different s's as the number of secret keys to be faked but this will create an unnecessary dependence that can be removed by using a PRF as a compact source of randomness. In the conference version [21] we presented the result in full details. Efficient Receiver Deniable FE for Boolean Formulae.…”

“…To formalise it, recall from [11] that ‐SIM security denotes SIM‐security where the adversary is allowed to make at most non‐adaptive key queries, encryption queries (challenge ciphertexts), and adaptive key queries. We show that an ‐receiver‐deniable FE scheme is also ‐SIM‐secure (see the conference version [12] for a formal theorem and proof). On the other hand, we stress deniability is stronger in the respect that equivocable ciphertexts and keys must decrypt correctly in the real system.…”