Correctness.Correctness properties of our level scheme immediately follow from statistical correctness of
iOand correctness and uniqueness properties of ACE.
Overview of security proof.For security, we first informally describe the structure of the proof, and then give the sequence of hybrids in section 7.4 and security reductions in section 7.5. Recall that security definition requires that(`∗0, L∗0,PP0)≈(`∗1, L∗0,PP1), wherePPbare punctured, obfuscated programs. Starting from
the distribution(`∗0, L∗0,PP0), our proof proceeds in3major steps:
1. Switching from`∗0 = [0, m∗1]to`∗1 = [1, m∗1]. ProgramsGenZeroandIncrementdefine a chain
[0, m1]→[1, m1]→. . .→[T, m1]→ ⊥for each tagm1. In a sequence of hybrids we switch from
[0, m∗1]to[1, m∗1]by switching the whole chain from[0, m∗1]→ [1, m∗1] → . . . → [T, m∗1]→ ⊥to
[1, m∗1]→[2, m∗1]→. . .→[T+ 1, m∗1]→ ⊥.
As a result of this change, `∗0is switched to`∗1 as desired (and in particular, the punctured point in
Transformis switched from`∗0 to`∗1as well). However, this change also affects the programs in the following two ways (resulting programs are in fig. 22) :
• Wrong upper bound: programsIncrement, Transform, andRetrieveTagnow have an upper boundT+ 1(instead ofT) for the casem1 =m∗1,
• Incorrect reencryption: programTransform, given[i, m∗1]for0 ≤ i ≤ T + 1, outputs[i− 1, m∗1, m2]instead of[i, m∗1, m2].
Program GenZero(m1)
Inputs:tagm1 ∈M.
Hardwired values:encryption keyEK1 of ACE.
1. outputl←ACE.EncEK1(0, m1).
Program Increment(l) Inputs:single-tag levell
Hardwired values:encryption and decryption keysEK1,DK1of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi≥T ori <0then output0fail0; 3. outputl+1←ACE.EncEK1(i+ 1, m1).
Program Transform(l, m2)
Inputs:single-tag levell, tagm2∈M
Hardwired values:decryption keyDK1 of ACE, encryption keyEK2of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi > T ori <0then output0fail0; 3. outputL←ACE.EncEK2(i, m1, m2).
Program isLess(L0, L00) Inputs:double-tag levelsL0, L00
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out0 ←ACE.DecDK2(L
0); ifout0 =0fail0then output0fail0; else parseout0as(i0, m0
1, m02).
2. out00 ←ACE.DecDK2(L
00); ifout00=0fail0then output0fail0; else parseout00as(i00, m00
1, m002).
3. Ifi0> T ori00> T or ori0 <0ori00<0 (m01, m02)6= (m100, m002)then output0fail0; 4. Ifi0< i00then outputtrue, else outputfalse.
Program RetrieveTag(l) Inputs:single-tag levell
Hardwired values:decryption keyDK1 of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi > T ori <0then output0fail0; 3. Outputm1.
Program RetrieveTags(L) Inputs:double-tag levelL
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out←ACE.DecDK2(L); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1, m2).
2. Ifi > T ori <0then output0fail0; 3. Outputm1, m2.
2. Restoring correct upper bound in Increment,Transform, andRetrieveTag. In a sequence of hybrids we change the wrong upper boundT+ 1to the correct upper boundT in relevant programs. Resulting programs are in fig. 23. This part of the proof uses ideas from [BPR15] to argue that the adversary can never reach the upper bound and thus the upper bound can be decreased by1
indistinguishably.
3. Restoring correct reencryption inTransform.In a sequence of hybrids we make programTransform
output the correct value[i, m∗1, m2], instead of[i−1, m∗1, m2], for all0≤i≤T and for allm2.
The proof of this step follows a by-now-standard puncturing technique (which allows to change the ciphertext in a PRF-based encryption from one plaintext to another), except that we also have to deal with programisLesswhich has decryption keys inside it. Intuitively, the proof still goes through even despite those decryption keys, becauseisLessonly reveals the result of the comparison, which is not affected by our change.
At the end of this step, we obtain original punctured programs, thus proving security of our level system.
Security loss.Steps1and2require number of hybrids proportional to the upper boundT, and step3requires number of hybrids proportional to2|m2|T. In addition, in the proof of step2we also lose1/T, thus requiring
T and2|m2|to be superpolynomial.
Now we describe the proof in each step in more detail. While the reader can safely skip this part and directly go to the list of hybrids (section 7.4), we suggest that the readers familiar withiOtechniques take a look at this informal presentation first, since it outlines, in a succinct way, the logic behind the somewhat lengthy sequence of hybrids.
Step 1: Switching`∗from[0, m∗1]to[1, m∗1].
1. We first change the chain to[0, m∗1]→ [1, m∗1]→. . .→[T−1, m∗1]→[T+ 1, m∗1]→ ⊥, creating a gap betweenT −1andT + 1. This is done by first hardwiring the ciphertextlT∗ = [T, m∗1]into relevant programs, then puncturing keys corresponding to both[T, m∗1]and[T + 1, m∗1](the latter can be punctured since they are never used due to upper boundT), and finally switching hardwired ciphertext tol∗T+1 = [T + 1, m∗1]and unpuncturing keys at[T+ 1, m∗1]31.
Note that the keys remain punctured at the point[T, m∗1], which essentially means that from the point of view of programs there doesn’t exist a valid encryption of(T, m∗1).
Finally, note that switching the hardwired ciphertext from[T, m∗1]to[T + 1, m∗1]changes the upper bound fromT toT+ 1in programsTransformandRetrieveTag.
2. Then in a sequence of hybrids we move the gap fromT down to0a follows. Letj-th hybrid be a hybrid where the gap is atj+ 1, i.e.Incrementdefines a chain[0, m∗1]→[1, m∗1]→. . .→[j, m∗1]→ [j+ 2, m∗1]→. . .→[T, m∗1]→[T+ 1, m∗1], and keys are punctured at[j+ 1, m∗1], meaning that there doesn’t exist a valid encryption of(j+ 1, m∗1). We move the gap tojby first hardwiring the ciphertext
l∗j = [j, m∗1]into relevant programs, then puncturing keys corresponding to[j, m∗1](recall that keys are already punctured at[j+ 1, m∗1]), and finally switching hardwired ciphertext tol∗j+1= [j+ 1, m∗1]and unpuncturing keys at[j+ 1, m∗1].
31
Note that it is crucial for switching the ciphertext that keys are punctured atbothpoints, and only one of the two ciphertexts is present in the distribution.
Note that the keys remain punctured at the point[j, m∗1], enabling the next step.
In addition, note that in the first step the upper bound inIncrementis switched fromT toT+ 1. This is due to the fact that this step switches the hardwired ciphertext from[T −1, m∗1]to[T, m∗1], and due to the fact that there is a hardwired instruction to output[T+ 1, m∗1], given hardwired ciphertext as input (indeed, while in the originalIncrementinput[T, m∗1]results in⊥, after the change input[T, m∗1]
results in[T + 1, m∗1]).
Finally, note that the last step switches challenge level`∗0 = [0, m∗1]to`∗1= [1, m∗1].
3. As a result, we obtainIncrementwhich defines a chain1→2→. . .→T →T+ 1→ ⊥for the tag
m∗1, and keys are punctured at[0, m∗1]. We remove the puncturing using the fact that keys for[0, m∗1]
are never used, sinceGenZerodoesn’t have to work on inputm∗1. Resulting programs are in fig. 22.
Step 2: Restoring the correct upper bound ofIncrement,Transform, andRetrieveTagonm∗1. Intu- itively, nobody can tell whether these programs have an upper boundT orT+ 1, since the only way to test this is to check if, starting with level[1, m∗1],Incrementfails afterT−1orT executions, which requires superpolynomial time to compute. To turn this intuition into a formal argument, we follow the proof of [BPR15]:
1. We cut the chain1 → 2 → . . . → T → T + 1 → ⊥(here we omit the tagm∗1 for simplicity and compactness) at a random point as follows. We add a check “ifprg(i) =S thenabort” toIncrement, whereSis randomly chosen. If theprgis expanding enough, then with overwhelming probabilityS
is outside of theprgimage, and adding this line doesn’t change the functionality. However, next we changeSto beprg(s)for some randoms, which cuts the line at points: that is,Incrementnow defines the chain1→. . . s→ ⊥,s+ 1→. . .→T+ 1→ ⊥.
2. In a sequence of hybrids we cut the line in all points afters, obtaining the following chain:1→. . .→
s→ ⊥,s+ 1 → ⊥,s+ 2 → ⊥,. . .,T → ⊥,T + 1 → ⊥. Intuitively, onceIncrementoutputs⊥
given[s, m∗1], it becomes impossible for an adversary to obtain[s+ 1, m∗1], and therefore behavior of
Incrementat[s+ 1, m∗1]can be changed to⊥as well. The process can be continued. This intuition is captured by the security of constrained decryption of ACE.
As the result, we move to a hybrid where valid encryptions of(s+ 1, m∗1), . . . ,(T + 1, m∗1)do not exist.
3. Then we can move the upper bound fromT + 1back toT for the casem1 =m∗1, since programs
output⊥on input[T + 1, m∗1]anyway. Thus, changingT + 1toT doesn’t affect the functionality of the programs.
4. Then we can reverse all previous steps, restore the chain and eventually get original programs with correct upper boundT (exceptTransform, which now has the correct upper bound T, but still has incorrect behavior on inputs of the form([i, m∗1], m2)).
Resulting programs are in fig. 23.
Step 3: Restoring the correct reencryption behaviour in Transform. Note that TransformB
(fig. 23) defines the set of outputs [0, m1, m2], . . . ,[T, m1, m2] (corresponding to inputs
([0, m1], m2), . . . ,([T, m1], m2)) for the case m1 6= m∗1, and the set of outputs[−1, m∗1, m2], . . . ,[T −
the set of outputs from[−1, m∗1, m2], . . . ,[T −1, m∗1, m2]to[0, m∗1, m2], . . . ,[T, m∗1, m2]by running the
following sequence of steps for each possible second tagm2:
1. We first change the set of outputs from[−1, m∗1, m2], . . . ,[T−1, m1∗, m2]to[−1, m∗1, m2], . . . ,[T−
2, m∗1, m2],[T, m1∗, m2], creating a gap betweenT −2andT. This is done by first hardwiring the
ciphertextL∗T−1 = [T−1, m∗1, m2]into relevant programs (Transform,isLess, andRetrieveTags), then
puncturing keys corresponding to both[T−1, m∗1, m2]and[T, m∗1, m2](the latter can be punctured
since they are never used due to the upper boundT), and finally switching hardwired ciphertext to
L∗T = [T, m∗1, m2]and unpuncturing keys at[T, m∗1, m2]32.
Note that the keys remain punctured at the point[T−1, m∗1, m2], which essentially means that from
the point of view of programs there doesn’t exist a valid encryption of(T−1, m∗1, m2).
2. Then in a sequence of hybrids we move the gap fromT −1down to−1a follows. Letj-th hybrid be a hybrid where the gap is at j+ 1, i.e. Transform outputs [−1, m∗1, m2], . . . ,[j, m∗1, m2],[j+
2, m∗1, m2], . . . ,[T, m∗1, m2], and keys are punctured at[j+ 1, m∗1, m2], meaning that there doesn’t
exist a valid encryption of(j+ 1, m∗1, m2). We move the gap tojby first hardwiring the ciphertext
L∗j = [j, m∗1, m2]into relevant programs, then puncturing keys corresponding to[j, m∗1, m2](recall
that keys are already punctured at [j+ 1, m∗1, m2]), and finally switching hardwired ciphertext to
L∗j+1= [j+ 1, m∗1, m2]and unpuncturing keys at[j+ 1, m∗1, m2].
Note that the keys remain punctured at the point[j, m∗1, m2], enabling the next step.
An important property of programisLesswhich enables switching[j, m∗1, m2]to[j+ 1, m∗1, m2]at
each step is thatisLesstreats both[j, m∗1, m2]and[j+ 1, m∗1, m2]in the same way. That is, both [j, m∗1, m2]and[j+ 1, m∗1, m2]are larger than[0, m∗1, m2], . . . ,[j−1, m∗1, m2], and both are smaller
than[j+ 2, m∗1, m2], . . . ,[T, m∗1, m2]. Finally, both are equal when compared to themselves. The only
difference in the output could have occured on inputs([j, m∗1, m2],[j+ 1, m∗1, m2])(resulting inisLess
returning true) and([j+ 1, m∗1, m2],[j, m∗1, m2])(resulting inisLessreturning false); however, in each
of the two hybrids only one of the two values “exists” and the other is punctured out, thus forcing
isLessto output⊥on these inputs. This allows us to “swap"[j, m∗1, m2]and[j+ 1, m∗1, m2]without
changing the functionality of the programs.
Finally, note that we don’t perform two last steps, i.e. switching from0 to 1 and from −1 to 0, for the casem2 = m∗2 (indeed, that would switch the challenge value fromL0∗ = [0, m∗1, m∗2]to
L∗1 = [1, m∗1, m∗2], but it has to remainL∗0 = [0, m∗1, m∗2]in both experiments of the security game). In fact, we don’t have to switch from0to1sinceTransformis punctured at[l1∗, m∗2]and outputs0fail0 on this input anyway. Further, since[0, m∗1]is hard to obtain for the adversary, we argue thatTransform
may be indistinguishably changed from outputting[−1, m∗1, m∗2]to[0, m∗1, m∗2]on input[0, m∗1], m∗2
(again, this intuition is formalized using security of the constrained key of the ACE).
32
Note that it is crucial for switching the ciphertext that keys are punctured atbothpoints, and only one of the two ciphertexts is present in the distribution.
Programs inHybA Program GenZero[m∗1](m1)
Inputs:tagm1 ∈M.
Hardwired values:encryption keyEK1 of ACE, tagm∗1.
1. Ifm1 =m∗1then output0fail0;
2. outputl←ACE.EncEK1(0, m1).
Program Increment(l) Inputs:single-tag levell
Hardwired values:encryption and decryption keysEK1,DK1of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi≥T ori <0then output0fail0; 3. outputl+1←ACE.EncEK1(i+ 1, m1).
Program Transform[(l∗0, m∗2)](l, m2)
Inputs:single-tag levell, tagm2∈M
Hardwired values: decryption key DK1 of ACE, encryption key EK2 of ACE, single-tag level l∗0 =
ACE.EncEK1(0, m
∗
1), tagm∗2, upper boundT.
1. If(l, m2) = (l∗0, m∗2)then return0fail0;
2. out←ACE.DecDK1(l); ifout=
0fail0 then return0fail0; else parseoutas(i, m
1).
3. Ifi > T ori <0then return0fail0; 4. returnL←ACE.EncEK2(i, m1, m2).
Program isLess(L0, L00) Inputs:double-tag levelsL0, L00
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out0 ←ACE.DecDK2(L
0); ifout0 =0fail0then output0fail0; else parseout0as(i0, m0
1, m02).
2. out00 ←ACE.DecDK2(L
00); ifout00=0fail0then output0fail0; else parseout00as(i00, m00
1, m002).
3. Ifi0> T ori00> T ori0<0ori00<0or(m01, m02)6= (m100, m002)then output0fail0; 4. Ifi0< i00then outputtrue, else outputfalse.
Program RetrieveTag(l) Inputs:single-tag levell
Hardwired values:decryption keyDK1 of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi > T ori <0then output0fail0; 3. Outputm1.
Program RetrieveTags(L) Inputs:double-tag levelL
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out←ACE.DecDK2(L); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1, m2).
2. Ifi > T ori <0then output0fail0; 3. Outputm1, m2.
Figure 21: Programs in HybA.In addition, in this hybrid the adversary gets l0∗ = ACE.EncEK1(0, m
∗
1),
L∗0 =ACE.EncEK2(0, m
∗
Programs inHybB Program GenZeroB[m∗1](m1)
Inputs:tagm1 ∈M.
Hardwired values:encryption keyEK1 of ACE, tagm∗1.
1. Ifm1 =m∗1then output0fail0;
2. outputl←ACE.EncEK1(0, m1).
Program IncrementB(l) Inputs:single-tag levell
Hardwired values:encryption and decryption keysEK1,DK1of ACE, tagm∗1, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifm1 =m∗1and (i≥T + 1ori <0) then output0fail0;
3. Ifm1 6=m∗1and (i≥T ori <0) then output0fail0;
4. outputl+1←ACE.EncEK1(i+ 1, m1).
Program TransformB[(l∗1, m∗2)](l, m2)
Inputs:single-tag levell, tagm2∈M
Hardwired values: decryption key DK1 of ACE, encryption key EK2 of ACE, single-tag level l∗1 =
ACE.EncEK1(1, m
∗
1), tagm∗1, tagm∗2, upper boundT.
1. If(l, m2) = (l∗1, m∗2)then return0fail0;
2. out←ACE.DecDK1(l); ifout=
0fail0 then return0fail0; else parseoutas(i, m
1).
3. Ifm1 =m∗1:
(a) Ifi > T + 1ori <0then return0fail0; (b) returnL←ACE.EncEK2(i−1, m1, m2); 4. Ifm1 6=m∗1:
(a) Ifi > T ori <0then return0fail0; (b) returnL←ACE.EncEK2(i, m1, m2).
Program isLessB(L0, L00) Inputs:double-tag levelsL0, L00
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out0 ←ACE.DecDK2(L
0); ifout0 =0fail0then output0fail0; else parseout0as(i0, m0
1, m02).
2. out00 ←ACE.DecDK2(L
00); ifout00=0fail0then output0fail0; else parseout00as(i00, m00
1, m002).
3. Ifi0> T ori00> T ori0<0ori00<0or(m01, m02)6= (m100, m002)then output0fail0; 4. Ifi0< i00then outputtrue, else outputfalse.
Program RetrieveTagB(l) Inputs:single-tag levell
Hardwired values:decryption keyDK1 of ACE, tagm∗1, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifm1 =m∗1and (i > T + 1ori <0) then output0fail0;
3. Ifm1 6=m∗1and (i > T ori <0) then output0fail0;
4. Outputm1.
Program RetrieveTagsB(L) Inputs:double-tag levelL
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out←ACE.DecDK2(L); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1, m2).
2. Ifi > T ori <0then output0fail0; 3. Outputm1, m2.
Programs inHybC. Program GenZeroC[m∗1](m1)
Inputs:tagm1 ∈M.
Hardwired values:encryption keyEK1 of ACE, tagm∗1.
1. Ifm1 =m∗1then output0fail0;
2. outputl←ACE.EncEK1(0, m1).
Program IncrementC(l) Inputs:single-tag levell
Hardwired values:encryption and decryption keysEK1,DK1of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi≥T ori <0then output0fail0; 3. outputl+1←ACE.EncEK1(i+ 1, m1).
Program TransformC[(l∗1, m∗2)](l, m2)
Inputs:single-tag levell, tagm2∈M
Hardwired values: decryption key DK1 of ACE, encryption key EK2 of ACE, single-tag level l∗1 =
ACE.EncEK1(1, m
∗
1), tagm∗1, tagm∗2, upper boundT.
1. If(l, m2) = (l∗1, m∗2)then return0fail0;
2. out←ACE.DecDK1(l); ifout=
0fail0 then return0fail0; else parseoutas(i, m
1).
3. Ifi > T ori <0then return0fail0;
4. Ifm1 =m∗1returnL←ACE.EncEK2(i−1, m1, m2); 5. ReturnL←ACE.EncEK2(i, m1, m2).
Program isLessC(L0, L00) Inputs:double-tag levelsL0, L00
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out0 ←ACE.DecDK2(L
0); ifout0 =0fail0then output0fail0; else parseout0as(i0, m0
1, m02).
2. out00 ←ACE.DecDK2(L
00); ifout00=0fail0then output0fail0; else parseout00as(i00, m00
1, m002).
3. Ifi0> T ori00> T ori0<0ori00<0or(m01, m02)6= (m100, m002)then output0fail0; 4. Ifi0< i00then outputtrue, else outputfalse.
Program RetrieveTagC(l) Inputs:single-tag levell
Hardwired values:decryption keyDK1 of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi > T ori <0then output0fail0; 3. Outputm1.
Program RetrieveTagsC(L) Inputs:double-tag levelL
Hardwired values:decryption keyDK2 of ACE, upper boundT.
1. out←ACE.DecDK2(L); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1, m2).
2. Ifi > T ori <0then output0fail0; 3. Outputm1, m2.
Figure 23: Programs in HybC.In addition, in this hybrid the adversary gets l1∗ = ACE.EncEK1(1, m
∗
1),
L∗0 =ACE.EncEK2(0, m
∗
Programs inHybD Program GenZero[m∗1](m1)
Inputs:tagm1 ∈M.
Hardwired values:encryption keyEK1 of ACE, tagm∗1.
1. Ifm1 =m∗1then output0fail0;
2. outputl←ACE.EncEK1(0, m1).
Program Increment(l) Inputs:single-tag levell
Hardwired values:encryption and decryption keysEK1,DK1of ACE, upper boundT.
1. out←ACE.DecDK1(l); ifout=
0fail0 then output0fail0; else parseoutas(i, m
1).
2. Ifi≥T ori <0then output0fail0; 3. outputl+1←ACE.EncEK1(i+ 1, m1).
Program Transform[(l∗1, m∗2)](l, m2)
Inputs:single-tag levell, tagm2∈M
Hardwired values: decryption key DK1 of ACE, encryption key EK2 of ACE, single-tag level l∗1 =