watermarking cryptographic functionalities from standard ...functionality-preserving: on input a...
TRANSCRIPT
![Page 1: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/1.jpg)
Watermarking Cryptographic Functionalities from Standard Lattice Assumptions
Sam Kim and David J. Wu
Stanford University
![Page 2: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/2.jpg)
Digital Watermarking
CRYPTO 2017
CRYPTO 2017 CRYPTO 2017
CRYPTO 2017
Often used to identify owner of content and prevent unauthorized distribution
![Page 3: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/3.jpg)
Digital Watermarking
CRYPTO 2017
CRYPTO 2017 CRYPTO 2017
CRYPTO 2017
โข Content is (mostly) viewable
![Page 4: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/4.jpg)
Digital Watermarking
CRYPTO 2017
CRYPTO 2017 CRYPTO 2017
CRYPTO 2017
โข Content is (mostly) viewableโข Watermark difficult to remove (without destroying the image)
![Page 5: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/5.jpg)
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Embed a โmarkโ within a program
If mark is removed, then program is destroyed
Two main algorithms:โข Mark wsk, ๐ถ โ ๐ถโฒ: Takes a circuit ๐ถ and outputs a marked circuit ๐ถโฒ
โข Verify wsk, ๐ถโฒ โ 0,1 : Tests whether a circuit ๐ถโฒ is marked or not
![Page 6: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/6.jpg)
Two main algorithms:โข Mark wsk, ๐ถ โ ๐ถโฒ: Takes a circuit ๐ถ and outputs a marked circuit ๐ถโฒ
โข Verify wsk, ๐ถโฒ โ 0,1 : Tests whether a circuit ๐ถโฒ is marked or not
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Embed a โmarkโ within a program
If mark is removed, then program is destroyed
Both marking and verification require a secret
watermarking key wsk
![Page 7: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/7.jpg)
Two main algorithms:โข Mark wsk, ๐ถ โ ๐ถโฒ: Takes a circuit ๐ถ and outputs a marked circuit ๐ถโฒ
โข Verify wsk, ๐ถโฒ โ 0,1 : Tests whether a circuit ๐ถโฒ is marked or not
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Embed a โmarkโ within a program
If mark is removed, then program is destroyed
Extends to setting where watermark can be an
(arbitrary) string [See paper]
![Page 8: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/8.jpg)
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Mark algorithm outputs a circuit ๐ถโฒ where:
๐ถ ๐ฅ = ๐ถโฒ(๐ฅ)on all but a negligible fraction of inputs ๐ฅ
Mark
![Page 9: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/9.jpg)
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Mark algorithm outputs a circuit ๐ถโฒ where:
๐ถ ๐ฅ = ๐ถโฒ(๐ฅ)on all but a negligible fraction of inputs ๐ฅ
MarkPerfect functionality-preserving impossible assuming obfuscation [BGIRSVY12]
![Page 10: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/10.jpg)
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Unremovability: Given a marked program ๐ถ, no efficient adversary can construct a circuit ๐ถโฒ where
โข ๐ถโฒ ๐ฅ = ๐ถ(๐ฅ) on all but a negligible fraction of inputs ๐ฅโข Verify wsk, ๐ถโฒ = 1
![Page 11: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/11.jpg)
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Unremovability: Given a marked program ๐ถ, no efficient adversary can construct a circuit ๐ถโฒ where
โข ๐ถโฒ ๐ฅ = ๐ถ(๐ฅ) on all but a negligible fraction of inputs ๐ฅโข Verify wsk, ๐ถโฒ = 1
Adversary has completeflexibility in crafting ๐ถโฒ
Adversary given access to marking oracle
[Also require unforgeability; see paper for details]
![Page 12: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/12.jpg)
Watermarking Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
โข Notion only achievable for functions that are not learnableโข Focus has been on cryptographic functions
![Page 13: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/13.jpg)
pseudorandom function
PRF(๐,โ )
pseudorandom function
PRF(๐,โ )
Watermarking Cryptographic Programs[NSS99, BGIRSVY01, HMW07, YF11, Nis13, CHNVW16, BLW17]
CRYPTO
Mark
โข Focus of this work: watermarking PRFs [CHNVW16, BLW17]
โข Enables watermarking of symmetric primitives built from PRFs (e.g., encryption, MACs, etc.)
![Page 14: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/14.jpg)
pseudorandom function
PRF(๐,โ )
pseudorandom function
PRF(๐,โ )
Main Result
CRYPTO
Mark
This work: Under standard lattice assumptions, there exists a (secretly)-verifiable watermarkable family of PRFs.
![Page 15: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/15.jpg)
๐ฆ2๐ฆ1
๐ฆ3
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3
domain range
PRF key
Step 1: Evaluate PRF on test points ๐ฅ1, ๐ฅ2, ๐ฅ3 (part of the watermarking secret key)
![Page 16: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/16.jpg)
๐ฆ1๐ฆ2
๐ฆ3
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3
domain range
PRF key
Step 2: Derive a pair (๐ฅโ, ๐ฆโ) from ๐ฆ1, ๐ฆ2, ๐ฆ3
๐ฅโ, ๐ฆโ
![Page 17: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/17.jpg)
๐ฆ1๐ฆ2
๐ฆ3
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3
domain range
PRF key
Step 2: Derive a pair (๐ฅโ, ๐ฆโ) from ๐ฆ1, ๐ฆ2, ๐ฆ3
๐ฅโ, ๐ฆโ
Need different ๐ฅโ for different programs โ otherwise easy to
remove if adversary sees watermarked keys of its choosing
![Page 18: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/18.jpg)
๐ฅโ
๐ฆ1๐ฆ2
๐ฆ3
PRF ๐, ๐ฅโ
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3
domain range
PRF key
๐ฅโ, ๐ฆโ
Step 3: โMarked keyโ is a circuit that implements the PRF at all points, except at ๐ฅโ, the output is changed to ๐ฆโ
![Page 19: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/19.jpg)
๐ฆ1๐ฆ2
๐ฆ3๐ฆโ
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3๐ฅโ
domain range
marked key
Step 3: โMarked keyโ is a circuit that implements the PRF at all points, except at ๐ฅโ, the output is changed to ๐ฆโ
PRF ๐, ๐ฅโ
![Page 20: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/20.jpg)
๐ฆ1๐ฆ2
๐ฆ3๐ฆโ
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3๐ฅโ
domain range
marked key
Step 3: โMarked keyโ is a circuit that implements the PRF at all points, except at ๐ฅโ, the output is changed to ๐ฆโ
PRF ๐, ๐ฅโ
Defer implementation details for nowโฆ
![Page 21: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/21.jpg)
๐ฆ1๐ฆ2
๐ฆ3๐ฆโ
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3๐ฅโ
domain range
marked key
Verification: Evaluate function at ๐ฅ1, ๐ฅ2, ๐ฅ3, derive (๐ฅโ, ๐ฆโ) and check if the value at ๐ฅโ matches ๐ฆโ
PRF ๐, ๐ฅโ
Defer implementation details for nowโฆ
![Page 22: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/22.jpg)
๐ฆ1๐ฆ2
๐ฆ3๐ฆโ
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3๐ฅโ
marked key
Defer implementation details for nowโฆ
Functionality-preserving: function differs at a single pointโ
![Page 23: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/23.jpg)
๐ฆ1๐ฆ2
๐ฆ3๐ฆโ
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฅ1๐ฅ2
๐ฅ3๐ฅโ
marked key
Unremovable: as long as adversary cannot tell that ๐ฅโ, ๐ฆโ is โspecialโ
Defer implementation details for nowโฆ
Functionality-preserving: function differs at a single pointโ
โ
![Page 24: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/24.jpg)
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
๐ฆโ๐ฅโ
How to implement this functionality?
Prior solutions: use obfuscation to hide ๐ฅโ, ๐ฆโ
![Page 25: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/25.jpg)
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
How to implement this functionality?
Prior solutions: use obfuscation to hide ๐ฅโ, ๐ฆโ
Obfuscated program has PRF key embedded inside and outputs PRF(๐, ๐ฅ) on all inputs ๐ฅ โ ๐ฅโ
and ๐ฆโ when ๐ฅ = ๐ฅโ
๐ ๐ฅโ,๐ฆโ (๐ฅ):
โข if ๐ฅ = ๐ฅโ, output ๐ฆโ
โข else, output PRF(๐, ๐ฅ)
Obfuscated program:
![Page 26: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/26.jpg)
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
How to implement this functionality?
Prior solutions: use obfuscation to hide ๐ฅโ, ๐ฆโ
Obfuscated program has PRF key embedded inside and outputs PRF(๐, ๐ฅ) on all inputs ๐ฅ โ ๐ฅโ
and ๐ฆโ when ๐ฅ = ๐ฅโ
๐ ๐ฅโ,๐ฆโ (๐ฅ):
โข if ๐ฅ = ๐ฅโ, output ๐ฆโ
โข else, output PRF(๐, ๐ฅ)
Obfuscated program:
Essentially relies on secretly re-programming
the value at ๐ฅโ
![Page 27: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/27.jpg)
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
Prior solutions: use obfuscation to hide ๐ฅโ, ๐ฆโ
Obfuscated program has PRF key embedded inside and outputs PRF(๐, ๐ฅ) on all inputs ๐ฅ โ ๐ฅโ
and ๐ฆโ when ๐ฅ = ๐ฅโ
Key technical challenge: How to hide ๐ฅโ, ๐ฆโ within the watermarked key (without obfuscation)?
๐ ๐ฅโ,๐ฆโ (๐ฅ):
โข if ๐ฅ = ๐ฅโ, output ๐ฆโ
โข else, output PRF(๐, ๐ฅ)
Obfuscated program:
![Page 28: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/28.jpg)
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
Prior solutions: use obfuscation to hide ๐ฅโ, ๐ฆโ
Obfuscated program has PRF key embedded inside and outputs PRF(๐, ๐ฅ) on all inputs ๐ฅ โ ๐ฅโ
and ๐ฆโ when ๐ฅ = ๐ฅโ
Key technical challenge: How to hide ๐ฅโ, ๐ฆโ within the watermarked key (without obfuscation)?
๐ ๐ฅโ,๐ฆโ (๐ฅ):
โข if ๐ฅ = ๐ฅโ, output ๐ฆโ
โข else, output PRF(๐, ๐ฅ)
Obfuscated program:
Has an obfuscation flavor: need to embed a secret inside a piece of code that cannot be removed
![Page 29: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/29.jpg)
Blueprint for Watermarking PRFs [CHNVW16, BLW17]
Prior solutions: use obfuscation to hide ๐ฅโ, ๐ฆโ
Obfuscated program has PRF key embedded inside and outputs PRF(๐, ๐ฅ) on all inputs ๐ฅ โ ๐ฅโ
and ๐ฆโ when ๐ฅ = ๐ฅโ
This work: Under standard lattice assumptions, there exists a (secretly)-verifiable watermarkable family of PRFs.
๐ ๐ฅโ,๐ฆโ (๐ฅ):
โข if ๐ฅ = ๐ฅโ, output ๐ฆโ
โข else, output PRF(๐, ๐ฅ)
Obfuscated program:
![Page 30: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/30.jpg)
Starting Point: Private Puncturable PRFs [BLW17, BKM17, CC17]
๐ฆโ๐ฅโ
โข Watermarked PRF implements PRF at all but a single point
โข Structurally very similar to a puncturable PRF [BW13, BGI13, KPTZ13]
Puncturable PRF:
Puncture๐ฅโ
PRF key punctured key
![Page 31: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/31.jpg)
Starting Point: Private Puncturable PRFs [BLW17, BKM17, CC17]
๐ฆโ๐ฅโ
โข Watermarked PRF implements PRF at all but a single point
โข Structurally very similar to a puncturable PRF [BW13, BGI13, KPTZ13]
Puncturable PRF:
Puncture๐ฅโ
Can be used to evaluate the PRF on all points ๐ฅ โ ๐ฅโ
PRF key punctured key
![Page 32: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/32.jpg)
Starting Point: Private Puncturable PRFs [BLW17, BKM17, CC17]
Puncture๐ฅโ
PRF key punctured key
Recall general approach for watermarking:
1. Derive ๐ฅโ, ๐ฆโ from input/output behavior of PRF
2. Give out a key that agrees with PRF everywhere, except has value
๐ฆโ at ๐ฅ = ๐ฅโ PRF key punctured at ๐ฅโ
However, punctured key does not necessarily hide ๐ฅโ, which allows adversary to remove watermark
![Page 33: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/33.jpg)
Starting Point: Private Puncturable PRFs [BLW17, BKM17, CC17]
Puncture๐ฅโ
PRF key punctured key
Recall general approach for watermarking:
1. Derive ๐ฅโ, ๐ฆโ from input/output behavior of PRF
2. Give out a key that agrees with PRF everywhere, except has value
๐ฆโ at ๐ฅ = ๐ฅโ PRF key punctured at ๐ฅโ
Punctured keys typically do not provide flexibility in programming value at
punctured point: difficult to test if a program is watermarked or not
However, punctured key does not necessarily hide ๐ฅโ, which allows adversary to remove watermark
![Page 34: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/34.jpg)
Starting Point: Private Puncturable PRFs [BLW17, BKM17, CC17]
Puncture๐ฅโ
PRF key punctured key
Problem 1: Punctured keys do not hide the punctured point ๐ฅโ
โข Use private puncturable PRFs
Problem 2: Difficult to test whether a value is the result of using a
punctured key to evaluate at the punctured point
![Page 35: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/35.jpg)
Starting Point: Private Puncturable PRFs [BLW17, BKM17, CC17]
Puncture๐ฅโ
PRF key punctured key
Problem 1: Punctured keys do not hide the punctured point ๐ฅโ
โข Use privately puncturable PRFs
Problem 2: Difficult to test whether a value is the result of using a
punctured key to evaluate at the punctured point
In existing lattice-based private puncturable PRF constructions [BKM17, CC17], value of punctured key at punctured point is a deterministic function of
the PRF key
![Page 36: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/36.jpg)
Starting Point: Private Puncturable PRFs [BLW17, BKM17, CC17]
Puncture๐ฅโ
PRF key punctured key
Problem 1: Punctured keys do not hide the punctured point ๐ฅโ
โข Use privately puncturable PRFs
Problem 2: Difficult to test whether a value is the result of using a
punctured key to evaluate at the punctured point
โข Relax programmability requirement
![Page 37: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/37.jpg)
Private Translucent PRFs
๐ฆ2๐ฆ1
๐ฆ3
๐ฅ1๐ฅ2
๐ฅ3
PRF key
๐ฅโ
PRF ๐, ๐ฅโ
Private puncturable PRF family with the property that output of any punctured key on a punctured point lies in a sparse, hidden subspace
![Page 38: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/38.jpg)
Private Translucent PRFs
๐ฆ2๐ฆ1
๐ฆ3
๐ฅ1๐ฅ2
๐ฅ3
punctured key
Private puncturable PRF family with the property that output of any punctured key on a punctured point lies in a sparse, hidden subspace
๐ฅโ๐ฆโ
![Page 39: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/39.jpg)
Private Translucent PRFs
๐ฆ2๐ฆ1
๐ฆ3
๐ฅ1๐ฅ2
๐ฅ3
punctured key
Private puncturable PRF family with the property that output of any punctured key on a punctured point lies in a sparse, hidden subspace
๐ฅโ๐ฆโ
Secret testing key associated with the PRF family can be used to test for membership in the hidden subspace
![Page 40: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/40.jpg)
Private Translucent PRFs
๐ฆ2๐ฆ1
๐ฆ3
๐ฅ1๐ฅ2
๐ฅ3
punctured key
๐ฅโ๐ฆโ
โข Values in special set looks indistinguishable from a random value (without secret testing key)
โข Indistinguishable even though it is easy to sample values from the set
Sets satisfying such properties are called
translucent [CDNO97]
![Page 41: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/41.jpg)
Watermarking from Private Translucent PRFs
๐ฆ2๐ฆ1
๐ฆ3
๐ฅ1๐ฅ2
๐ฅ3
PRF key
๐ฅโ
PRF ๐, ๐ฅโ
Watermarking secret key (wsk): test points ๐ฅ1, โฆ , ๐ฅ๐and testing key for private translucent PRF
![Page 42: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/42.jpg)
Watermarking from Private Translucent PRFs
๐ฆ2๐ฆ1
๐ฆ3
๐ฅ1๐ฅ2
๐ฅ3
๐ฅโ
To mark a PRF key ๐, derive special point ๐ฅโ and puncture ๐ at ๐ฅโ; watermarked key is a program that evaluates using
the punctured key
marked key
๐ฆโ
![Page 43: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/43.jpg)
Watermarking from Private Translucent PRFs
๐ฆ2๐ฆ1
๐ฆ3
๐ฅ1๐ฅ2
๐ฅ3
๐ฅโ
To test whether a program ๐ถโฒ is watermarked, derive test point ๐ฅโ
and check whether ๐ถโฒ ๐ฅโ is in the translucent set (using the testing key for the private translucent PRF)
marked key
๐ฆโ
![Page 44: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/44.jpg)
Constructing Private Translucent PRFs
![Page 45: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/45.jpg)
Learning with Errors (LWE) [Reg05]:
๐จีRโค๐๐ร๐, ๐ี
Rโค๐๐, ๐ี
R๐๐, ๐ี
Rโค๐๐
๐จ, ๐๐๐จ + ๐๐ โ ๐จ, ๐๐
![Page 46: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/46.jpg)
Homomorphic Matrix Encodings [BGGHNSVV14]
A way to encode ๐ฅ โ 0,1 โ as a collection of LWE samplestake LWE matrices ๐จ1, โฆ , ๐จโ โ โค๐
๐ร๐ and a secret ๐ โ โค๐๐:
![Page 47: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/47.jpg)
Homomorphic Matrix Encodings [BGGHNSVV14]
A way to encode ๐ฅ โ 0,1 โ as a collection of LWE samplestake LWE matrices ๐จ1, โฆ , ๐จโ โ โค๐
๐ร๐ and a secret ๐ โ โค๐๐:
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1encoding of ๐ฅ1 with respect to ๐จ1
๐ฎ denotes a special โgadgetโ matrix
LWE matrix associated with each
input bit
![Page 48: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/48.jpg)
Homomorphic Matrix Encodings [BGGHNSVV14]
A way to encode ๐ฅ โ 0,1 โ as a collection of LWE samplestake LWE matrices ๐จ1, โฆ , ๐จโ โ โค๐
๐ร๐ and a secret ๐ โ โค๐๐:
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโ โ ๐ฎ + ๐โ
โฎ
๐ฎ denotes a special โgadgetโ matrix
LWE matrix associated with each
input bit
encoding of ๐ฅ1 with respect to ๐จ1
![Page 49: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/49.jpg)
Homomorphic Matrix Encodings [BGGHNSVV14]
A way to encode ๐ฅ โ 0,1 โ as a collection of LWE samplestake LWE matrices ๐จ1, โฆ , ๐จโ โ โค๐
๐ร๐ and a secret ๐ โ โค๐๐:
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโ โ ๐ฎ + ๐โ
โฎ ๐๐ ๐จ๐ + ๐ ๐ฅ โ ๐ฎ + noise
Encodings support homomorphic operations
Function of ๐ and ๐จ1, โฆ , ๐จโ
๐ฎ denotes a special โgadgetโ matrix
LWE matrix associated with each
input bit
![Page 50: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/50.jpg)
Puncturable PRFs from LWE [BV15]
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโ โ ๐ฎ + ๐โ
โฎ ๐๐ ๐จ๐ + ๐ ๐ฅ โ ๐ฎ + noise
For any function ๐, two ways to (approximately) compute ๐๐๐จ๐โข Directly given the LWE secret ๐ and public matrices ๐จ1, โฆ , ๐จโโข Homomorphically given encodings ๐๐ ๐จ๐ + ๐ฅ๐ โ ๐ฎ
โข Works as long as ๐ ๐ฅ = 0
![Page 51: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/51.jpg)
Puncturable PRFs from LWE [BV15]
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโ โ ๐ฎ + ๐โ
โฎ ๐๐ ๐จ๐ + ๐ ๐ฅ โ ๐ฎ + noise
For puncturing at ๐ฅโ, let ๐๐ฅ ๐ฅโ = eq ๐ฅ, ๐ฅโ be the equality function
โข PRF evaluation at ๐ฅ with secret key ๐: PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ ๐
![Page 52: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/52.jpg)
Puncturable PRFs from LWE [BV15]
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโ โ ๐ฎ + ๐โ
โฎ ๐๐ ๐จ๐ + ๐ ๐ฅ โ ๐ฎ + noise
For puncturing at ๐ฅโ, let ๐๐ฅ ๐ฅโ = eq ๐ฅ, ๐ฅโ be the equality function
โข PRF evaluation at ๐ฅ with secret key ๐: PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ ๐
To evaluate at ๐ฅ, homomorphically compute ๐จ๐๐ฅ
![Page 53: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/53.jpg)
Puncturable PRFs from LWE [BV15]
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโ โ ๐ฎ + ๐โ
โฎ ๐๐ ๐จ๐ + ๐ ๐ฅ โ ๐ฎ + noise
For puncturing at ๐ฅโ, let ๐๐ฅ ๐ฅโ = eq ๐ฅ, ๐ฅโ be the equality function
โข PRF evaluation at ๐ฅ with secret key ๐: PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ ๐
โข Punctured key consists of encodings of bits of ๐ฅโ
โข Allows computing ๐๐ ๐จ๐๐ฅ + eq ๐ฅ, ๐ฅโ โ ๐ฎ + noise for all ๐ฅ
![Page 54: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/54.jpg)
Puncturable PRFs from LWE [BV15]
๐๐ ๐จ1 + ๐ฅ1 โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโ โ ๐ฎ + ๐โ
โฎ ๐๐ ๐จ๐ + ๐ ๐ฅ โ ๐ฎ + noise
For puncturing at ๐ฅโ, let ๐๐ฅ ๐ฅโ = eq ๐ฅ, ๐ฅโ be the equality function
โข PRF evaluation at ๐ฅ with secret key ๐: PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ ๐
โข Punctured key consists of encodings of bits of ๐ฅโ
โข Allows computing ๐๐ ๐จ๐๐ฅ + eq ๐ฅ, ๐ฅโ โ ๐ฎ + noise for all ๐ฅ
Enables evaluation at all ๐ฅexcept when ๐ฅ = ๐ฅโ
![Page 55: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/55.jpg)
Privately Puncturable PRFs [BKM17]
๐๐ ๐จ1 + ๐ฅ1โ โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโโ โ ๐ฎ + ๐โ
โฎ
Evaluating PRF using punctured key requires knowledge of ๐ฅโ
Key idea in [BKM17]: encrypt the punctured point using an FHE scheme and homomorphically evaluate the equality function
Evaluating using punctured key outputs
๐๐๐จ๐๐ฅ + ๐๐๐
2โ eq ๐ฅ, ๐ฅโ + ๐ โ ๐ฎ + ๐โฒ
PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ ๐
![Page 56: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/56.jpg)
Privately Puncturable PRFs [BKM17]
Evaluating PRF using punctured key requires knowledge of ๐ฅโ
Evaluating using punctured key outputs
๐๐๐จ๐๐ฅ + ๐๐๐
2โ eq ๐ฅ, ๐ฅโ + ๐ โ ๐ฎ + ๐โฒ
PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ ๐
Value after FHE evaluation and
decryption
๐๐ ๐จ1 + ๐ฅ1โ โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโโ โ ๐ฎ + ๐โ
โฎ
Key idea in [BKM17]: encrypt the punctured point using an FHE scheme and homomorphically evaluate the equality function
![Page 57: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/57.jpg)
Privately Puncturable PRFs [BKM17]
Evaluating PRF using punctured key requires knowledge of ๐ฅโ
Evaluating using punctured key outputs
๐๐๐จ๐๐ฅ + ๐๐๐
2โ eq ๐ฅ, ๐ฅโ + ๐ โ ๐ฎ + ๐โฒ
Rounding away the FHE error: small if ๐ is short and we restrict to low-
norm columns of ๐ฎ
PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ ๐
๐๐ ๐จ1 + ๐ฅ1โ โ ๐ฎ + ๐1
๐๐ ๐จโ + ๐ฅโโ โ ๐ฎ + ๐โ
โฎ
Key idea in [BKM17]: encrypt the punctured point using an FHE scheme and homomorphically evaluate the equality function
![Page 58: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/58.jpg)
Private Translucent PRFs
Evaluating using a punctured key yields
๐๐ ๐จ๐๐ฅ + ๐ค โ eq ๐ฅ, ๐ฅโ + ๐ โ ๐ฎ ๐ฎโ1 ๐ซ + noise
Change real PRF evaluation: PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ๐ฎโ1(๐ซ)
๐
Use a different scaling factor in FHE scheme
(instead of ฮค๐ 2)
![Page 59: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/59.jpg)
Private Translucent PRFs
Evaluating using a punctured key yields
๐๐ ๐จ๐๐ฅ๐ฎโ1 ๐ซ + ๐ค โ eq ๐ฅ, ๐ฅโ + ๐ โ ๐ซ + noise
Change real PRF evaluation: PRF ๐, ๐ฅ โ เถ เถ๐๐๐จ๐๐ฅ๐ฎโ1(๐ซ)
๐
When ๐ฅ = ๐ฅโ, this becomes เถ เถ๐๐ ๐จ๐๐ฅ๐ฎโ1 ๐ซ +๐ค๐ซ
๐
Can choose ๐ค (part of the punctured key) to tweak the
value at punctured point
![Page 60: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/60.jpg)
Private Translucent PRFs
If ๐ฅ = ๐ฅโ, evaluating using the punctured key yields เถ เถ๐๐ ๐จ๐๐ฅ๐ฎโ1 ๐ซ +๐ค๐ซ
๐
Key idea: sum up multiple evaluations with different multiples ๐ค๐ and ๐ซ๐ yields
แจ แง
๐
๐๐ ๐จ๐๐ฅ๐ฎโ1 ๐ซ +๐ค๐๐ซ๐
๐
= เถ เถ๐๐๐พ๐
Output at punctured point is an LWE sample with respect to ๐พ (fixed public
matrix) โ critical for implementing a translucent set
![Page 61: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/61.jpg)
Private Translucent PRFs
If ๐ฅ = ๐ฅโ, evaluating using the punctured key yields เถ เถ๐๐ ๐จ๐๐ฅ๐ฎโ1 ๐ซ +๐ค๐ซ
๐
Key idea: sum up multiple evaluations with different multiples ๐ค๐ and ๐ซ๐ yields
แจ แง
๐
๐๐ ๐จ๐๐ฅ๐ฎโ1 ๐ซ +๐ค๐๐ซ๐
๐
= เถ เถ๐๐๐พ๐
Testing key is a short vector ๐ where ๐พ๐ = 0:
เถ เถ๐๐๐พ๐, ๐ โ เถ เถ๐๐๐พ๐
๐= 0
[See paper for details]
![Page 62: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/62.jpg)
watermarking[CHNVW16, BLW17]
private puncturable PRFs [BKM17, CC17]
Conclusions
lattice-based assumptions
indistinguishability obfuscation
![Page 63: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/63.jpg)
this work
watermarking (via private translucent PRFs)
private puncturable PRFs [BKM17, CC17]
Conclusions
lattice-based assumptions
indistinguishability obfuscation
![Page 64: Watermarking Cryptographic Functionalities from Standard ...Functionality-preserving: On input a program (modeled as a circuit ๐ถ), the Markalgorithm outputs a circuit ๐ถโฒwhere:](https://reader036.vdocument.in/reader036/viewer/2022081410/609f9d30f8e46b6a277370e9/html5/thumbnails/64.jpg)
Open Problems
Publicly-verifiable watermarking without obfuscation?โข Current best construction relies on iO [CHNVW16]
Additional applications of private translucent PRFs?
Thank you!
http://eprint.iacr.org/2017/380