Limits on the Locality of Pseudorandom Generators and Applications to Indistinguishability Obfuscation

Lombardi, Alex; Vaikuntanathan, Vinod

doi:10.1007/978-3-319-70500-2_5

Cited by 16 publications

(1 citation statement)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Despite this success, until this work, all previously known 𝑖O constructions (see [68] and the references therein) required new hardness assumptions that were postulated specifically for showing security of the 𝑖O schemes proposed. Indeed, the process of understanding these assumptions has been tortuous, with several of these assumptions broken by clever cryptanalysis [18,21,33,40,53,54,60,82,85,103,105,106]. The remaining standing ones are based on new and novel computational problems that are different in nature from well-studied computational problems (for instance, LWE with leakage on noises).…”

Section: Introductionmentioning

confidence: 99%

Indistinguishability obfuscation from well-founded assumptions

Jain

Lin

Sahai

2021

Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing

155

View full text Add to dashboard Cite

Indistinguishability obfuscation, introduced by [Barak et. al. Crypto 2001], aims to compile programs into unintelligible ones while preserving functionality. It is a fascinating and powerful object that has been shown to enable a host of new cryptographic goals and beyond. However, constructions of indistinguishability obfuscation have remained elusive, with all other proposals relying on heuristics or newly conjectured hardness assumptions.In this work, we show how to construct indistinguishability obfuscation from subexponential hardness of four well-founded assumptions. We prove: Informal Theorem: Let 𝜏 ∈ (0, ∞), 𝛿 ∈ (0, 1), 𝜖 ∈ (0, 1) be arbitrary constants. Assume sub-exponential security of the following assumptions:-the Learning With Errors (LWE) assumption with subexponential modulus-to-noise ratio 2 𝑘 𝜖 and noises of magnitude polynomial in 𝑘, where 𝑘 is the dimension of the LWE secret, -the Learning Parity with Noise (LPN) assumption over general prime fields Z 𝑝 with polynomially many LPN samples and error rate 1/ℓ 𝛿 , where ℓ is the dimension of the LPN secret, -the existence of a Boolean Pseudo-Random Generator (PRG) in NC 0 with stretch 𝑛 1+𝜏 , where 𝑛 is the length of the PRG seed, -the Decision Linear (DLIN) assumption on symmetric bilinear groups of prime order. Then, (subexponentially secure) indistinguishability obfuscation for all polynomial-size circuits exists. Further, assuming only polynomial security of the aforementioned assumptions, there exists collusion resistant public-key functional encryption for all polynomial-size circuits. CCS CONCEPTS• Theory of computation → Cryptographic primitives.

show abstract

Section: Introductionmentioning

confidence: 99%

Indistinguishability obfuscation from well-founded assumptions

Jain

Lin

Sahai

2021

Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing

155

View full text Add to dashboard Cite

show abstract

On the Concrete Security of Goldreich’s Pseudorandom Generator

Couteau

Dupin

Méaux

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Local pseudorandom generators allow to expand a short random string into a long pseudorandom string, such that each output bit depends on a constant number d of input bits. Due to its extreme efficiency features, this intriguing primitive enjoys a wide variety of applications in cryptography and complexity. In the polynomial regime, where the seed is of size n and the output of size n s for s > 1, the only known solution, commonly known as Goldreich's PRG, proceeds by applying a simple d-ary predicate to public random sized subsets of the bits of the seed. While the security of Goldreich's PRG has been thoroughly investigated, with a variety of results deriving provable security guarantees against class of attacks in some parameter regimes and necessary criteria to be satisfied by the underlying predicate, little is known about its concrete security and efficiency. Motivated by its numerous theoretical applications and the hope of getting practical instantiations for some of them, we initiate a study of the concrete security of Goldreich's PRG, and evaluate its resistance to cryptanalytic attacks. Along the way, we develop a new guess-and-determine-style attack, and identify new criteria which refine existing criteria and capture the security guarantees of candidate local PRGs in a more fine-grained way.

show abstract