How to Shuffle in Public

Abstract

We show how to obfuscate a secret shuffle of ciphertexts: shuffling becomes a public operation. Given a trusted party that samples and obfuscates a shuffle before any ciphertexts are received, this reduces the problem of constructing a mix-net to verifiable joint decryption. We construct public-key obfuscations of a decryption shuffle based on the Boneh-Goh-Nissim (BGN) cryptosystem and a re-encryption shuffle based on the Paillier cryptosystem. Both allow efficient distributed verifiable decryption. Finally, we give a distributed protocol for sampling and obfuscating each of the above shuffles and show how it can be used in a trivial way to construct a universally composable mix-net. Our constructions are practical when the number of senders N is small, yet large enough to handle a number of practical cases, e.g. N = 350 in the BGN case and N = 2000 in the Paillier case.

On Strong Simulation and Composable Point Obfuscation

“…We show that this is the case as long as t = O (1). However, when t = ω(1), major (and seemingly inherent) difficulties rise.…”

“…Here VGB comes to our aid when t = ω (1). That is, having limited oracle access to the point programs and sufficient power to compute the distinguishing elements allows performing the required simulation.…”

“…-( Virtual Black Box) 1 For any PPT adversary A and polynomial p there is a PPT simulator S such that for all sufficiently large n ∈ N and C ∈ C n : …”

“…The INDO (BPO) definition is 1 As noted by [3] the above can be replaced with the equivalent requirement that…”

“…Another relaxation requires the obfuscation to be secure only when the program is sampled from some adequate distribution (rather than requiring security for any program in the family). This was done in the context of perfect one-way hashing [11] , point proximity testing [14], re-encryption [22] and more [1,21,18]. However, in some scenarios such a relaxation does not capture the security properties we would expect from an obfuscation.…”