adaptively secure succinct garbled ram with persistent...

1

Adaptively Secure Succinct Garbled RAM with Persistent Memory

Ran Canetti, Yilei Chen, Justin Holmgren, Mariana Raykova

DIMACS workshopMIT Media LabJune 8~10, 2016

2

: June 11, 2016, Boston, heavy snow.

3

: June 11, 2016, Boston, heavy snow. Alice finds a quasi-polynomial time algorithm for factoring.

4


Alice

5


: Instead of submitting to STOC, she thinks it’s cool to write a program and show off to her friends.

6

> Factoring.hs RSA2048

7

> Factoring.hs RSA2048Running time 7 hrs 34 mins25195908475…20720357 = 83990...4079279 x 3091701...723883

Next question

8

: It is slow on her laptop (quasi-polynomial time, you know) … cannot fit into a party.

9


: So she turns to cloud, but clouds are big brothers

10


: So she turns to cloud, but clouds are big brothers

: She heard that one can delegate the computation in a way that the server learns only the output of the computation but nothing else

11

“My friends and NSA will be shocked by the runtime without learning anything other than the output”

12

“The algorithm has huge preprocessing, stores lots of non-zero points on the Zeta function ...”


13

“The algorithm has huge preprocessing, stores lots of non-zero points on the Zeta function ...”


“Wait ... the audiences already know too much.”

14

> sudo apt-get install FHE

15

> sudo apt-get install FHE> FHE Factoring.hs

16

> sudo apt-get install FHE> FHE Factoring.hsTurning the program into circuits ...

17

> sudo apt-get install FHE> FHE Factoring.hsTurning the program into circuits ...^C

18

> sudo apt-get install FHE> FHE Factoring.hsTurning the program into circuits ...^C>> sudo apt-get install Yao> Yao Factoring.hs

19

> sudo apt-get install FHE> FHE Factoring.hsTurning the program into circuits ...^C>> sudo apt-get install Yao> Yao Factoring.hsStill turning the program into circuits ...

#Yao

20

> sudo apt-get install FHE> FHE Factoring.hsTurning the program into circuits ...^C>> sudo apt-get install Yao> Yao Factoring.hsStill turning the program into circuits ...^C^C^C^C^C^C^C>

21

> sudo apt-get install GRAM_Lu_Ostrovsky> GRAM_Lu_Ostrovsky Factoring.hs

22

> sudo apt-get install GRAM_Lu_Ostrovsky> GRAM_Lu_Ostrovsky Factoring.hsWarning: Program size as big as the running time, continue (y) or not (n)

23

> sudo apt-get install GRAM_Lu_Ostrovsky> GRAM_Lu_Ostrovsky Factoring.hsWarning: Program size as big as the running time, continue (y) or not (n)n>

24

> sudo apt-get install PRAM

25

> sudo apt-get install PRAM> PRAM Factoring.hs

26

> sudo apt-get install PRAM> PRAM Factoring.hsDone -> PRAM_Factoring

27

> sudo apt-get install PRAM> PRAM Factoring.hsDone -> PRAM_Factoring> PRAM_Factoring RSA2048

28

> sudo apt-get install PRAM> PRAM Factoring.hsDone -> PRAM_Factoring> PRAM_Factoring RSA2048Warning: cannot adaptively choose functions or inputs, security at user’s own risk, continue (y) or not (n)

29

> sudo apt-get install PRAM> PRAM Factoring.hsDone -> PRAM_Factoring> PRAM_Factoring RSA2048Warning: cannot adaptively choose functions or inputs, security at user’s own risk, continue (y) or not (n)n

30

“Don’t turn into circuits, don’t blow up too much”

“Adaptively pick integers”

“Huge amount of preprocessed data reusable”

31

Garbling/randomized encoding for RAM with persistent memory

32


mskGen =>

33


D0

mskGen =>

msk + => G(D0)

34


D0

mskGen =>

msk + => G(D0)

P1msk + => G(P1)

35


D0

mskGen =>

msk + => G(D0)

P1msk + => G(P1)

G(P1)Eval G(D0) => P1(D0)

36


D0

mskGen =>

msk + => G(D0)

P1msk + => G(P1)

G(P1)Eval G(D0) => G(D1)P1(D0)

Persistency

37


D0

mskGen =>

msk + => G(D0)

P1msk + => G(P1)


P2msk + => G(P2)

Persistency

38


D0

mskGen =>

msk + => G(D0)

P1msk + => G(P1)


P2msk + => G(P2)


...

Persistency

39


D0

G(D0)

P1

G(P1)

Succinct

40


?

?

P1(D0)

Adaptively simulation

secure

41


? => G(D0)

? => G(P1)

G(P1)G(D0) <= G(D1)P1(D0)


secure

42


? => G(D0)

? => G(P1)

G(P1)G(D0) <= G(D1)P1(D0)

?

G(D1) P2(D1)


secure

43


? => G(D0)

? => G(P1)

G(P1)G(D0) <= G(D1)P1(D0)

? => G(P2)

G(P2)G(D1) <= G(D2)P2(D1)


secure

44

Theorem

45

[Main Theorem]

Adaptively secure succinct garbled RAM with persistent memoryfrom indistinguishability obfuscation for circuits, and poly-to-1 collision-resistant hash function.

46

Starring

47

Indistinguishability Obfuscator

48

iO[ F0 ] ≈ iO[ F1 ]

if F0 and F1 have identical functionality

Indistinguishability Obfuscator for circuits

Candidate constructions:[Garg-Gentry-Halevi-Raykova-Sahai-Waters ‘13], [Barak-Garg-Kalai-Paneth-Sahai ‘14], [Brakerski-Rothblum ‘14], [Pass-Seth-Telang ‘14], [Zimmerman ‘15], [Applebaum-Brakerski ‘15], [Ananth-Jain ‘15], [Bitansky-Vaikuntanathan ‘15], [Gentry-Gorbunov-Halevi ‘15], [Lin ‘16], …

Cryptanalyses:[Cheon-Han-Lee-Ryu-Stehle ‘15], [Coron et al ‘15], [Miles-Sahai-Zhandry ‘16], ...

Defined by [Barak-Goldreich-Impagliazzo-Rudich-Sahai-Vadhan-Yang ‘01]

Security:

49

Poly-to-oneCollision Resistant Hash function

50

Poly-to-one collision resistant hash functions

H is collision resistant + each image has at most poly preimages.

[Thm] Exists for constant c, assuming Factoring or Discrete-log is hard.

51

The rest of the talk:

1. The main idea of the construction. 2. The technical heart: adaptively-enforceable accumulator.3. Wrap up, and the easiest ways to think of our scheme.

52

Starting point: Canetti-Holmgren’s selective secure scheme.

53


High-level idea of the Canetti-Holmgren construction:Garble the CPU-step circuit, encrypt and authenticate the intermediate states, memories.

54

You never know how hard it is to use iO before actually play with it.

[ said Justin Holmgren, June 22, 2015, sunny ]

55



Canetti-Holmgren scheme details:Fixed-transcript => Fixed-access => Fixed-address => Fully secure

56




Indistinguishable as long as transc = (q, op) are the same.[KLW-technique]

57





q can be different[encrypt the state]

58






Memory content can be different[encrypt the data]

59







Hide access pattern.[oram]

60








61

Canetti-Holmgren (ITCS16)

62

Canetti-Holmgren (ITCS16) + Zoom-in the core step:

63


Koppula-Lewko-Waters (STOC15)(iO-friendly) Iterator(iO-friendly) Accumulator(iO-friendly) Splittable signature

64



What is written in eprint 2015/1074

Accumulator iO-friendly Merkle-tree

65





initi

alize

G(D0)

66





initi

alize

Authenticate

G(D0)

G(Pi+1)

key

67





initi

alize

Authenticate

update

G(D0)

G(Pi+1)

G(Di+1)

key

68

Canetti-Holmgren (ITCS16) + Zoom-in the core step:++ Zoom-in the accumulator

69


Properties needed for the Accumulator- Normal property like a Merkle-tree.

#Merkletree

70



#Merkletree

71



#Merkletree

72



#Merkletree

73


Properties needed for the Accumulator- Normal property like a Merkle-tree.- Enforcement (iO-friendly property):

there’s only one preimage x* of the current root value y*.

#Merkletree

y*

x*

74




Impossible information theoretically.

#Merkletree

y*

x*

75





KLW’s computational enforcement: Normal.Gen( )->HEnforce.Gen( x*, y*)->H*, H ≈ H*

#Merkletree

y*

x*

76





KLW’s computational enforcement: Normal.Gen( )->HEnforce.Gen( x*, y*)->H*, H ≈ H*

Alternatively: SSB hashing => [Ananth-Chen-Chung-Lin-Lin]

#Merkletree

y*

x*

77

Selective Enforcing Adaptive Enforcing

78


x* <= Adversary

79

Gen( ) => H


Enforcing(x*, y*) => H*

x* <= Adversary

80

Gen( ) => H



Gen( ) => Hx* <= Adversary

81

Gen( ) => H



Gen( ) => H

x* <= Adversary(H)

x* <= Adversary

82

Gen( ) => H



Gen( ) => H


x* <= Adversary(H)

x* <= Adversary

83

( … wait, what?)

Gen( ) => H



Gen( ) => H


x* <= Adversary(H)

x* <= Adversary

84

#Mindblowing

85

Fact ICan separate the key

86



initi

alize

Authenticate

update

G(D0)

G(Pi+1)

G(Di+1)

key

key hk vk= +

87



initi

alize

Authenticate

update

G(D0)

G(Pi+1)

G(Di+1)

key

key hk vk= +

hk

vk

hk

88

Adaptive Enforcing

hk

89

Adaptive Enforcing

x* <= Adversary( hk )

hk

90

Adaptive Enforcing

x* <= Adversary( hk )

hk

vk vk*(x*) ≈

91

Fact IIIf you believe diO ...

92

Adaptive Enforcingkey hk vk= +

93

Adaptive Enforcingkey hk vk= +

hk

always_hk_Gen( ) -> hk := CRHF key h

94

Adaptive Enforcing

x* <= Adversary(H)

key hk vk= +

hk


95

Adaptive Enforcing

x* <= Adversary(H)

key hk vk= +

hk

vk


normal_vk_Gen( ) -> vk vk(x,y) = diO( if h(x)=y, output 1; else: output 0 )

96

Adaptive Enforcing

x* <= Adversary(H)

key hk vk= +

hk

vk vk*(x*)


normal_vk_Gen( ) -> vk vk(x,y) = diO( if h(x)=y, output 1; else: output 0 )

enforce_vk_Gen( x*, y* ) -> vk* vk*(x,y) = diO( if y!=y* and h(x)=y, output 1; Elseif y=y* and x=x*, output 1; Else: output 0 )

≈

97

Fact III:If you don’t believe diO, can still do this with iO.

98

From iO + preimage-bounded CRHF:

c-to-1 CRHF can be constructed from discrete-log or factoring

99



enforce_vk( x*, y* ) -> vk* vk*(x,y) = diO( if y!=y* and h(x)=y, output 1; Elseif y=y* and x=x*, output 1; Else: output 0 )

100




By diO-iO equivalence lemma [ Boyle-Chung-Pass ‘14 ]:“ If f1 and f2 differ only on polynomially many input-output values, and they are hard to find, then iO(f1) ≈ iO(f2) ”

101




From shrinking 1 bit to length-halving: Merkle-Damgaard.

102

Fact IV:Adaptive Enforceable

Accumulator done

103

Rest of the upgrades:


Indistinguishable as long as transc = (q, op) are the same.[KLW-technique. Assume iO]




104







+ adaptively enforceable accumulator [ from iO+dlog or factoring ]

105







Need a special property of the ORAM“Strong local randomness”, satisfied by Chung-Pass ORAM.With this property, can “guess” polynomially many addresses.


106







Need a special property of the ORAM“Strong local randomness”, satisfied by Chung-Pass ORAM.With this property, can “guess” polynomially many addresses.

[Ananth-Chen-Chung-Lin-Lin, eprint 2015/1082] can be viewed as accomplishing this for all the steps.


SSB hash [Hubacek-W

ichs]

[OPWW

]

107

Summary

1. Adaptively secure garbled RAM with persistent memory. 2. Everything is succinct.3. Upgrading to delegation with verifiability is almost for free.4. “Reusability” is natural.5. New iO-friendly tool: adaptively-enforceable accumulator (from

iO+Preimage-bounded-CRHF)

108

Scenes

110

> sudo apt-get install GRAM_Canetti_Holmgren

111

> sudo apt-get install GRAM_Canetti_Holmgrenpackage indistinguishability_obfuscation not an accepted assumption, security at user’s own risk, continue (y) or not (n)

112

> sudo apt-get install GRAM_Canetti_Holmgrenpackage indistinguishability_obfuscation not an accepted assumption, security at user’s own risk, continue (y) or not (n)y

113

> sudo apt-get install GRAM_Canetti_Holmgrenpackage indistinguishability_obfuscation not an accepted assumption, security at user’s own risk, continue (y) or not (n)y> upgrade GRAM_CCHRDone

114

> sudo apt-get install GRAM_Canetti_Holmgrenpackage indistinguishability_obfuscation not an accepted assumption, security at user’s own risk, continue (y) or not (n)y> upgrade GRAM_CCHRDone > NSAcloud: GRAM_CCHR_Factoring RSA2048

115

> sudo apt-get install GRAM_Canetti_Holmgrenpackage indistinguishability_obfuscation not an accepted assumption, security at user’s own risk, continue (y) or not (n)y> upgrade GRAM_CCHRDone > NSAcloud: GRAM_CCHR_Factoring RSA2048Running time 1.0s25195908475…20720357 = 83990...4079279 x 3091701...723883

Next question

adaptively secure succinct garbled ram with persistent...

Documents