On Extractability Obfuscation

Abstract

We initiate the study of extractability obfuscation, a notion first suggested by Barak et al. (JACM 2012): An extractability obfuscator eO for a class of algorithms M guarantees that if an efficient attacker A can distinguish between obfuscations eO(M1), eO(M2) of two algorithms M1, M2 ∈ M, then A can efficiently recover (given M1 and M2) an input on which M1 and M2 provide different outputs.-We rely on the recent candidate virtual black-box obfuscation constructions to provide candidate constructions of extractability obfuscators for NC 1 ; next, following the blueprint of Garg et al. (FOCS 2013), we show how to bootstrap the obfuscator for NC 1 to an obfuscator for all non-uniform polynomial-time Turing machines. In contrast to the construction of Garg et al., which relies on indistinguishability obfuscation for NC 1 , our construction enables succinctly obfuscating non-uniform Turing machines (as opposed to circuits), without turning running-time into description size. -We introduce a new notion of functional witness encryption, which enables encrypting a message m with respect to an instance x, language L, and function f , such that anyone (and only those) who holds a witness w for x ∈ L can compute f (m, w) on the message and particular known witness. We show that functional witness encryption is, in fact, equivalent to extractability obfuscation. -We demonstrate other applications of extractability extraction, including the first construction of fully (adaptive-message) indistinguishability-secure functional encryption for an unbounded number of key queries and unbounded message spaces. -We finally relate indistinguishability obfuscation and extractability obfuscation and show special cases when indistinguishability obfuscation can be turned into extractability obfuscation.

Simulation-Based Secure Functional Encryption in the Random Oracle Model

“…Boyl et al [14] defined obfuscators secure against general distributional auxiliary input. We recall their definition (cf.…”

“…In Section 4 we will show how to construct a CRIND-Secure MI-FE from extractability obfuscation w.r.t. distributional auxiliary input [14] (cf. Remark 3).…”

“…In order to achieve CRIND-security of MI-FE (as defined in Section 2.1), we make use of the following ideas inspired by the construction of fully IND-Secure FE of Boyle et al [14]. We assume a functional signature scheme FS [21].…”

Deniable Functional Encryption

“…Next we show show how to transform any "IND-secure" FE scheme for general circuits (i.e., where its functionality F computes general boolean circuits on some input length) into a FE for the same functionality that is (n c , poly)-receiver-deniable in the full model (but where the receiver gets assistance from the master authority to equivocate) without introducing any additional assumption. In particular, recent works [19,13,34,21] show IND-secure FE for general circuits whose security is based either on indistinguishable obfuscation and its variants or polynomial hardness of simple assumptions on multi-linear maps. We can use any of these schemes in our construction.…”

“…Namely, a ciphertext of the functional encryption scheme for x corresponds to a double encryption, a la Naor-Yung [28], of x, using a statistical simulation-soundness NIZK. A secret key for circuit C is the differing-input obfuscation [4,2,13] of a trapdoor circuit Trap[C] that takes in input the double encryption of x and the double encryption of the trapdoor values related to Trap [C]. Intuitively, differing-input obfuscation is required because there are certain Ct that allows to understand, for example, which secret key Trap[C] is using to decrypt the double encryption of x.…”