On the Achievability of Simulation-Based Security for Functional Encryption

Abstract

Abstract. Recently, there has been rapid progress in the area of functional encryption (FE), in which a receiver with secret-key sky can compute from an encryption of x the value F (x, y) for some functionality F . Two central open questions that remain are: (1) Can we construct FE secure under an indistinguishability-based (IND) security notion for general circuits? (2) To what extent can we achieve a simulation-based (SIM) security notion for FE? Indeed, it was previously shown that IND-security for FE is too weak for some functionalities , but that there exist striking impossibility results for SIM-security [Boneh et al. -TCC'11, Agrawal et al. -ePrint 2012]. Our work establishes a connection between these questions by giving a compiler that transforms any IND-secure FE scheme for general circuits into one that is SIM-secure for general circuits.-In the random oracle model, our resulting scheme is SIM-secure for an unbounded number of ciphertexts and key-derivation queries. We achieve this result by starting from an IND-secure FE scheme for general circuits with random oracle gates. -In the standard model, our resulting scheme is secure for a bounded number of ciphertexts and non-adaptive key-derivation queries (i.e., those made before seeing the challenge ciphertexts), but an unbounded number of adaptive key-derivation queries. These parameters match the known impossibility results for SIM-secure FE and improve upon the parameters achieved by Gorbunov et al. [CRYPTO'12]. The techniques for our compiler are inspired by constructions of non-committing encryption [Nielsen -CRYPTO '02] and the celebrated Feige-Lapidot-Shamir paradigm [FOCS'90] for obtaining zeroknowledge proof systems from witness-indistinguishable proof systems. Our compiler in the standard model requires an IND-secure FE scheme for general circuits, it leaves open the question of whether we can obtain SIM-secure FE for special cases of interest under weaker assumptions. To this end, we next show that our approach leads to a direct construction of SIM-secure hidden vector encryption (an important special case of FE that generalizes anonymous identity-based encryption). The scheme, which is set in composite order bilinear groups under subgroup decision assumptions, achieves security for a bounded number of ciphertexts but unbounded number of both non-adaptive and adaptive key-derivation queries, again matching the known impossibility results. In particular, to our knowledge this is the first construction of SIM-secure FE (for any non-trivial functionality) in the standard model handling an unbounded number of adaptive key-derivation queries. Finally, we revisit the negative results for SIM-secure FE. We observe that the known results leave open the possibility of achieving SIM-security for various natural formulations of security (such as non-black-box simulation for non-adaptive adversaries). We settle these questions in the negative, thus providing essentially a full picture of the (un)achievability of SIM-security.

Simulation-Based Secure Functional Encryption in the Random Oracle Model

“…Anyway, one could object that if we instantiate the RO with any concrete hash function, the resulting scheme is not "SIM-Secure" due to the impossibility results. This problem is also shared with the constructions for the RO model of De Caro et al [8] and Boneh et al [1]. What does it mean?…”

“…-Validity. We say that an adversary A in the above game is valid with respect to a checker Checker with efficient checkability if during the execution of the above game, A outputs challenge messages x 0 and x 1 of the same length and asks a set of queries K in the key space of 8 It can appear that the definition be not well-defined because we do not specify how the key k is related to the security parameter. To understand this, you may imagine that k be the code of some algorithm P (ant thus of constant-size) to compute a keyed hash function Hash(·, ·).…”

“…On the positive direction, Boneh et al [1] showed the existence of SIM-Secure FE schemes in the Random Oracle (RO, in short) [7] model for restricted functionalities (i.e., Attribute-based Encryption), and at the same time they left as a challenging problem the construction of FE for more sophisticated functionalities that satisfy SIMSecurity in the RO model. More recently, De Caro et al [8] showed how to overcome all known impossibility results assuming the existence of INDSecure schemes for circuits with random oracle gates. This is a very strong assumption for which we do not know any candidate scheme and their existence seems unlikely.…”

“…Thus, in a standard FE scheme the functionality is fixed in advance, and the scheme should allow to compute over encrypted data accordingly to this functionality. Instead, in the scheme for the RO model of De Caro et al [8], the functionality does depend on the RO, and thus, even their implicit definition of functionality and FE scheme is not standard. Therefore, their scheme is not satisfactory.…”

“…We recall (a simplified version of) the transformation of De Caro et al [8] to bootstrap an IND-Secure scheme for Boolean circuits to a SIM-Secure scheme for the same functionality. For sake of simplicity we focus on the non-adaptive setting, specifically on SIMSecurity against adversaries asking q non-adaptive queries.…”