Proving Lemma 4.34: Security for ¨ E

In this section, we will prove Lemma 4.34, which states that the security of the compiled scheme ¨

E = ( ¨G,E,¨ D¨) can be reduced to the security of E.

First, note that for a random public key ¨pk = (pk,LearnG) produced as ((pk,LearnG),∗) ←

¨

G(1κ), the variable LearnG can be perfectly sampled solely based on pk and that pk is identically distributed to a random public key produced under the original G(1κ). With this in mind, given an attacker A against E, we give a poly-query attacker SecRedA,O that, given (pk,LearnG, c), where (pk, c) are produced under the original scheme (GO, EO, DO) will sample H∗ then run

A(pk,LearnG, c,H∗). We will then show that for bothb∈ {0,1}the following holds: the joint distri- bution of (pk,LearnG, c,H) is close to (pk,LearnG, c,H∗), where ˙pk= (pk,LearnG)←G˙(1κ), (c,H)←

¨

EO( ˙pk, b) and the hint listH∗ is generated during the security reductionSecRedA,O(pk,LearnG, c).

Challenges and overview of techniques. Let us first start with a high level description of the main challenges and how we overcome them. Consider a random public key ¨pk = (pk,LearnG) ←

¨

G(1κ_{) and a random ciphertext (c,H)←E}¨O_{( ¨pk, b) for some unknown plaintext bitb. Notice thatc}

is identically distributed to a random ciphertext outputted byEO(pk, b). Thus, the main challenge is to sample a simulated H∗ which is close enough to the real H, and to do this solely based on (pk,LearnG, c), and in particular without knowing OrigE, the set of query/response pairs used to sample c←EO(pk, b).

Recall the random variables (Oi,b skic) sampled during the real execution of ¨EO( ¨pk, b). In order

to be able to sampleH∗ we should be able to sample (O∗_i, sk_i∗) that is close to (Ob_i,csk_i). The main

challenge in doing so is that (Oi,b cski) is conditioned on LearnG∪OrigE, andOrigEis not available

to SecRedO(pk,LearnG, c). We will show that if we sample (O∗_i, sk∗_i) based on (pk,LearnG), then (O∗_i, sk∗_i) and (Oi,b cski) will be reasonably close enough, assuming that LearnG has captured all ε

Now assuming that (O∗_i, sk∗_i) is close to (Ob_i,csk_i), letting S = LearnG∪OrigE, the algorithm SecRedA,O(pk,LearnG, c) needs to be able to run the execution of DOi∗♦O[S](sk∗

i, c) in order to be

able to simulate that of DOib♦O[S]₍ c

ski, c). For simplicity of exposition, in the following assume

that (O∗_i, sk∗_i) and (Ob_i,csk_i) are identically distributed, and so we show how SecRedA,O simulates

the execution of DOib♦O[S]₍ c

ski, c), assuming that it knows (skc_i,Ob_i). The main challenge in this

simulation is that SecRedA,O(pk,LearnG, c) does not know what S is. A simple way around for

SecRedA,O is to use its full access to the oracle evalto make up for its lack of access toS. That is,

SecRedA,O would performDOib♦O₍ c

ski, c). But this idea runs into the following problem: The oracle

b

Oi♦O[S] may reply to an encountered query qu = ((F ,e Xe) −−→

eval ?) with ⊥, but we may have that

eval(F ,e Xe) =6 ⊥, in which case we will have Ob_i♦O[S](qu) = ⊥ but Ob_i♦O(qu) 6= ⊥. To overcome

this problem, it seems that the algorithmSecRedA,O, during the execution ofDO∗i♦S(sk∗

i, c) should

only resort to its eval oracle for a query eval(F ,e Xe) if indeed O[S](qu) 6= ⊥. But checking for

this seems difficult, mainly because SecRedA,O(pk,LearnG, c) does not know what S is. Let us call this event bad. We resolve this bad event as follows. Notice that whenever bad happens for a query qu = ((F ,e Xe) −−→

eval ?), then w.h.p.

e

F must have been generated in OrigG as a result of a

gc query. Moreover, if this Fe appears during the decryption execution of DOib♦O(cski, c), it should

appear during many other random executions of the same kind. Thus, we perform the following experiment to collect all suchFe: Sample OrigE0 by runningc0 ←EO(pk, b0) for bothb0 ∈ {0,1}; let

S0 =LearnG∪OrigE0; and sample (O,b skc) consistent with (pk,LearnG∪OrigE0) and run the execution

ofDOb♦O[S0]

(sk0, c0) and record in a setHidGallFe such that we see a query ((F ,e Xe)−−→

eval ?) for which we have eval(F ,e Xe)6=⊥butOb♦O[S0](F ,e Xe) =⊥.

Then, in the simulated execution ofDOib♦O₍ c

ski, c) wheneverSecRedA,O sees a query ((F ,e

e

x)−−→

eval ?), it will forward this query to O only if F /e ∈ HidG. If Fe ∈HidG then SecRedA,O replies to that

query with ⊥.

Procedure SecRedA,O(pk,LearnG, c) with output bitb0:

1. Finding hidden garbled circuits in OrigG: LetHidG:=∅. Do the followingqτ times.

(a) For bothb∈ {0,1}do the following:

i. Sample c0 ← EO(pk, b) and let OrigE0 be the set of all query/response pairs during this execution.

ii. Let_OrigD\0

1, . . . ,OrigD\0t be sampled as in DistGen1(pk,LearnG,OrigE0) and let

\ OrigD=_OrigD\0 1∪ · · · ∪OrigD\0t. iii. If there isqu= ((F ,e Xe)−−→ eval ⊥)∈ \

OrigDbuteval(F ,e Xe)6=⊥, then addFe toHidG.

2. Sampling H∗:

(a) Samplet0 ←[1, t]. Fori∈[t0]:

ii. ExecuteDOlim(sk_i∗, c), where Olim(qu) replies exactly asO∗i♦O(qu), except for the

following case in whichOlim replies with ⊥:

• qu= ((F ,e Xe)−−→

eval?) and

e

F ∈HidG

When the execution is over,

• Let EvalD∗_i :=∅. For any eval query qu= ((F ,e Xe) −−→

eval?) during the execution for which F /e ∈HidGand eval(F ,e Xe) =y6=⊥, add ((F ,e Xe)−−→

eval y) to EvalD

∗

i

(b) SetH∗ ←ConstHelpO(EvalD₁∗∪· · ·∪EvalD∗_t0), where the procedureConstHelpOis defined

in Definition4.25.

3. Outputb0 ← A(pk,LearnG, c,H∗)

To describe our statement about the closeness of HandH∗, we define the following experiment outputting random variables over which we later state some events and probability statements.

Experiment Expr₁(1κ) for bit b∈ {0,1}: Output

Vars = (OrigG,OrigE, c,(Si,Ob_i,csk_i)_i∈[t],H,(O_i∗, sk_i∗)_i∈[t],HidG,H∗),

where

1. ((pk,LearnG), sk)←GO(1κ).

2. (c,H) ← E¨((pk,LearnG), b) with OrigE and (Oi,b skic) being the random variables sampled

inside this execution, andSi is the value of S in theith iteration based on which (Oi,b cski) is

sampled — i.e., (Oi,b cski)←Partial(pk,S_i).

3. H∗,HidGand (O∗_i, sk∗_i) are sampled as in the execution ofSecRedA,O(pk,LearnG, c).

We will prove the following lemma which shows that our proposed reduction SecRed does a good job of simulatingH.

Lemma 4.47. Let p be an arbitrary polynomial which satisfies 8tq2ε+ 1 2κ/2−1 ≤ 1 p. We have ∆(H,H∗)≤t(_p−11 + 4tq2_ε+ 1 qτ−1 +₂κ/12−1),

where Hand H∗ are sampled as in Expr₁(1κ).

The proof of Lemma 4.47follows from Lemmas 4.48and 4.49, given below.

Lemma 4.48. Let p be a polynomial as in Lemma 4.47. For anyi∈[t] we have ∆((O_i∗, sk_i∗,LearnG,OrigE, c),(Ob_i,csk_i,LearnG,OrigE, c))≤ _p−11 ,

Lemma 4.49. Fix i ∈ [t]. Let O0_lim be defined as follows: O_lim0 replies to a query qu exactly as

b

Oi♦O except for the following case in whichO0_lim replies with⊥: qu= ((F ,e ∗)−−→

eval ?)and

e

F ∈HidG.

Let Evnt: be the event that Trace(DO0lim(csk_i, c)) = Trace(DOib♦O[OrigE∪LearnG∪Si](skc_i, c)). Then

Pr[Evnt]≤4tq2ε+_qτ1−1 +₂κ/12−1,

where all the variables insideEvnt are sampled as in Expr₁(1κ).

We will first how to prove of Lemma 4.47 using Lemmas 4.48 and 4.49. We will then prove Lemma4.48 and Lemma4.49.

Proof of Lemma 4.47. Fixi∈[t]. LetOlim be defined as in the execution of the security reduction

SecRedA,O(pk,LearnG, c): Namely, Olim replies to a query qu exactly as O∗i♦O except for the

following case in which Olim replies with⊥: qu= ((F ,e ∗)−−→

eval?) and

e

F ∈HidG.

Let T1 = Trace(DOlim(ski∗, c)) and T2 = Trace(DOib♦O[LearnG∪OrigE∪Si](cski, c)), where Trace de-

notes the set of query/response pairs made during a given execution. We show

∆(T1,T2)≤ _p−11 + 4tq2ε+_qτ1−1 +₂κ/12−1. (14)

Using a union bound we will then obtain the desired upper bound for ∆(H,H∗).

We show how to obtain Equation 14based on Lemmas 4.48and4.49. By Lemma4.48we have ∆((O_i∗, sk_i∗,LearnG,OrigE, c),(Ob_i,csk_i,LearnG,OrigE, c))≤ _p−11 . (15)

Note that sinceHidG is sampled independently of all the variables in Equation15 we have

∆((O∗_i, sk∗_i,OrigE, c,HidG),(Ob_i,csk_i,OrigE, c,HidG))≤ _p−11 . (16)

Define the oracle O_lim0 as in Lemma 4.49: O_lim0 replies to a query qu exactly asOb_i♦O except

for the following case in which O0_lim replies with ⊥: qu = ((F ,e ∗) −−→

eval?) and

e

F ∈ HidG. Define

T0₁ = Trace(DO0lim(sk∗ i, c))

From Equation 16 we have

∆(T1,T01)≤ 1

p−1. (17)

By Lemma4.49 we have

∆(T0₁,T2)≤4tq2ε+_qτ1−1 +₂κ/12−1. (18)

Roadmap for the proof of Lemma 4.48. We now focus on proving Lemma 4.48. Fix an arbitrary iterationi∈[t] for which we want to showDist1 = (Oi∗, ski∗,LearnG,OrigE, c) andDist2=

(Ob_i,csk_i,LearnG,OrigE, c) are statistically close. Recall that

(O_i∗, sk_i∗)←D1 := (O,sk|pk∪LearnG),

and

(Oi,b cski)←D₂ := (O,sk|pk∪LearnG∪OrigE∪S_i).

Define

Diff := (OrigE∪Si\LearnG).

Comparing the ways in which (O_i∗, sk_i∗) and (Ob_i,csk_i) are sampled, Diff is the only extra set on

which Ob_i is conditioned on. With this in mind, to prove that Dist₁ and Dist₂ are close, we first

define a notion ofdisjointedness between two sets of query/response pairs. We will then show that if (a)O_i∗ andDiff are disjoint and (b)Oib andDiff are disjoint, then the induced distributionsDist₁

and Dist2 are identical. We will then bound the probability that (a) or (b) does not hold.

The notion of disjointness is described below.

Definition 4.50. LetS1,S2 be partial oracles (i.e., two sets of query/response pairs). We say

• S1 hits S2 if there is some queryqu on which bothS1(qu) and S2(qu) are defined. We stress that even if the outputs are the same (i.e,S1(qu) =S2(qu)) we still call this event a hit.

• S1 andS2 aredisjoint ifS1 and S2 do not hit and thatS1∪S2 is a valid oracle.

Define the following two disjoint events:

• Disjoint₁:=O∗_i is disjoint ofDiff.

• Disjoint₂:=Oib is disjoint of Diff.

We show the following lemma.

Lemma 4.51. Let p be as in Lemma 4.47. That is, 8tq2ε+₂κ/12−1 ≤

1

p. Then:

1. ((O_i∗, sk_i∗,LearnG,OrigE, c)|Disjoint₁)≡((Ob_i,csk_i,LearnG,OrigE, c)|Disjoint₂),

2. Pr[Disjoint₁]≥1−1

p,

3. Pr[Disjoint₂]≥1− 1

p−1,

where all the variables are sampled as inExpr₁(1κ).

Proof of Lemma 4.48. The proof follows in a straightforward way from Lemma 4.51. We now focus on proving Lemma 4.51.

Roadmap for the proof of Lemma 4.51, Part 2. We first describe three events Bad1,Bad2

and Bad3 in Definition 4.52. Then the proof of this part of the lemma will be divided into two

lemmas. First, in Lemma4.53 we will show that Pr[Disjoint₁]≥Pr[Bad1∨Bad2∨Bad3]. Then, in

Lemma 4.54 we will show that Pr[Bad1∨Bad2∨Bad3]≤8tq2ε+ ₂κ/12−1. These two will complete

the proof of Part 2of Lemma4.51.

Definition 4.52. We define the following bad events. Informally,Bad1 is the event that the output

of somegcorgiquery defined byO∗_i is at the range of the actual oraclesgc andgibut that output does not appear in OrigG. Also, Bad2 is the event that some non-heavy query in OrigG also does

appear inDiff. Finally,Bad3 is defined as inBad2 by replacing OrigGwithOi∗.

• Bad1: the event that at least one of the following occurs:

1. There exists (∗ −→

gc Fe)∈O

∗

i such that for some (s, F): gc(s, F) =Feand that ((s, F)−→

gc e F)∈/ (OrigG∪LearnG). 2. There exists (∗ −→ gi xe) ∈ O ∗

i such that that for some (s, i, b): gi(s, i, b) = xe and that

((s, i, b)−→

gi xe)∈/ (OrigG∪LearnG).

• Bad2: the event that there exists a query that appears in both OrigGand Diff. That is, for

someT ∈ {f,gc,gi}there exists a queryqusuch that (qu−→

T ∗)∈OrigGand (qu−→T ∗)∈Diff.

• Bad3: the event that there exists a query that appears both inOi∗ andDiff. That is, for some T ∈ {f,gc,gi} there exists a queryqusuch that (qu−→

T ∗)∈O

∗

i and (qu−→

T ∗)∈Diff.

Lemma 4.53. We have

Pr[Disjoint₁]≥Pr[Bad1∨Bad2∨Bad3],

where all the variables are sampled as inExpr₁(1κ).

Proof. We show wheneverBad1∨Bad2∨Bad3 then the eventDisjoint1 must necessarily hold. Sup-

pose toward a contradiction that Disjoint₁ holds, or in other words O_i∗ and Diff are not disjoint. Recalling the notion of disjointedness from Definition 4.50 we consider all possible cases, deriving a contradiction for each case:

1. O_i∗ hits Diff or in other words there is a query that appears in both O∗_i and Diff: This contradicts the fact thatBad3 holds.

2. O_i∗ does not hitDiff butO∗_i ∪Diff is not a valid partial oracle: if this happens then at least one of the following must happen:

(a) for some qu1 6= qu2 we have (qu1 −→

gc Fe) ∈ O

∗

i and (qu2 −→

gc Fe) ∈ Diff: in this case we claim (qu2 −→

gc Fe) ∈ OrigG, which contradicts the fact that Bad2 holds. To prove the claim suppose to the contrary that (qu2 −→

gc Fe) ∈/ OrigG. Firs, note that since (qu2 −→gc

e

F) ∈ Diff we have gc(qu2) = Fe. Also, note that we must have (qu₂ −→

gc Fe) ∈/ LearnG because we knowO_i∗ agrees withLearnG and so we could not have had (qu1−→

gc Fe)∈O

∗

for qu1 6= qu2. Now we reach a contradiction to the fact that Bad1 holds, because we

now haveFeis a valid garbled circuit, (qu₁ −→

gc Fe)∈O

∗

i and (∗ −→_gc Fe)∈/ OrigG∪LearnG.

(b) for somequ16=qu2 we have (qu1 −→

gc ex)∈O

∗

i and (qu2−→

gc ex)∈Diff: in exactly the same way as in the previous case we can show that this case is also impossible.

Lemma 4.54. We havePr[Bad1∨Bad2∨Bad3]≤8tq2ε+₂κ/12−1,where all the variables are sampled

as in Expr₁(1κ).

Proof. We can bound the probability of any of these events using ideas discussed extensively before, and so we outline the main ideas. First, note that whenever the event Bad1 holds, we have hit

the image of a sparse random function, which in our case is either gc or gi. This is becauseO∗_i is sampled in offline mode while conditioning solely onOrigG∪LearnG. Thus, by Lemma3.1we have Pr[Bad1]≤2×₂12κ.

Recall thatDiff =OrigE\LearnG. The eventBad2 is the event that there is a queryqu∈OrigG

which is at most ε heavy, but that it appears during a process which is independent of that used to produce OrigG and which consists of at most 4tq2 queries. (See Lemma 4.32.) Thus, we have Pr[Bad2]≤4tq2ε. Finally, the event Bad3 can be bounded in exactly the same way.

Proof of Lemma 4.51, Part 2. the proof of this part follows from Lemmas 4.53and 4.54. Proof of Lemma 4.51, Part 3. Recall the distributionsD1 and D2:

(O∗_i, r_i∗)←D1 := (O,sk|pk∪LearnG).

(Ob_i,r_bi)←D₂ := (O,sk|pk∪LearnG∪OrigE∪S_i).

Recall that Diff = (OrigE∪Si)\LearnG.

In what follows we write (O0, r0)∈D1 to mean that (O0, r0) is in the support set ofD1. Consider

the following partitioning of the worlds:

• S1: the set of all (O0, r0)∈D2 such that GO 0

(r0) does not hitDiff.

• S2: the set of all (O0, r0)∈D2 such that GO 0

(r0) hitsDiff.

• S3: the set of worlds generated by D1 which disagree withDiff. Namely, for all (O0, r0)∈S3 we have O0∪Diff is an invalid partial oracle.

Note that S1 ∪S2∪S3 covers all the worlds in the support set ofD1. Also, S1∪S2 covers all the worlds in the support set of D2. By Part 2of Lemma 4.51we have

|S2|+|S3|

|S1|+|S2|+|S3|

≤ 1

p.

We want to bound |S2|/(|S1|+|S2|). We have

|S2| |S1|+|S2| ≤ |S2|+|S3| |S1| ≤ |S2|+|S3| |S1|+|S2|+|S3| |S1| |S1|+|S2|+|S3| ≤ 1 p p−1 p = 1 p−1.

We now focus on proving Lemma 4.49.

Proof of Lemma 4.49. Let OrigD\_i be the set of all queries issued during the execution of the pro- cedure DOib♦O[OrigE∪LearnG∪S_i]

(cski, c). Define the following events: • Miss: the event that there exists Fe such that (∗ −→

gc Fe) ∈ OrigG, that (∗ −→gc Fe) ∈/ LearnG∪

OrigE∪Si, thatF /e∈HidGand that for someXe: ((F ,e Xe)−−→

eval ?)∈

\

OrigD_i andeval(F ,e Xe)6=⊥.

• Bad4: the event that there exists Fe such that (∗ −→

gc Fe) ∈/ OrigG∪LearnG∪OrigE∪Si, that ((F ,e ∗)−−→

eval?)∈

\

OrigD_i for some sandF: gc(s, F) =Fe.

• Bad5: the event that there is Fe such that Fe∈HidGand (∗ −→

gc Fe)∈/OrigG.

• Bad6: the event that there exists a query qusuch that (qu−→

gc ∗)∈OrigG∩Diff, where recall thatDiff = (OrigE∪Si)\LearnG.

We show that if Evnt holds, then Miss∨Bad4 ∨Bad5 ∨Bad6 holds, or equivalently, if Miss∧

Bad4 ∧Bad5∧Bad6 holds then Evnt holds. We will then show that the probability that Miss∨

Bad4∨Bad5∨Bad6 holds is at mostqε+_q115 + 2×₂κ/12.

Suppose Miss∧Bad4 ∧Bad5 ∧Bad6 holds and suppose to the contrary that Evnt holds. Let

S := LearnG ∪OrigE∪Si. Let T1 = Trace(DOext(skc_i, c)) and let T₂ = Trace(DOib♦O[S](csk_i, c)).

Consider the first point in which T1 and T2 become different: this point must be an eval query

qu= ((F ,e Xe)−−→

eval ?), where gc(s, F) =

e

F for some (s, F) and for which one of the following holds: We show that each case leads to a contradiction.

1. Oext(qu) = ⊥ and Ob_i♦O[S](qu) 6= ⊥: The fact that Oext(qu) = ⊥ implies Fe ∈ HidG. Since

Bad5 holds we have (∗ −→

gc Fe) ∈ OrigG. Also, by the way in which HidG is designed, we have (∗ −→

gc Fe) ∈/ LearnG. Now the fact that Oib♦O[S](qu) 6=⊥and that (∗ −→gc Fe)∈/ LearnG imply that (∗ −→

gc Fe) ∈ S\LearnG = Diff. Now the facts that (∗ −→gc Fe) ∈ Diff and that (∗ −→

gc Fe)∈OrigGimply thatBad6 holds, which is a contradiction.

2. Oext(qu) 6= ⊥ and Oib♦O[S](qu) = ⊥: Since Oib♦O[S](qu) = ⊥ and eval(qu) 6= ⊥ we have

(∗ −→

gc Fe) ∈/ S. Also, since Bad4 holds, we have (∗ −→gc Fe) ∈ OrigG∪S, and thus by the preceding condition we have (∗ −→

gc Fe) ∈OrigG. Moreover, Oext(qu) 6=⊥ implies F /e ∈ HidG. Now the facts that (∗ −→

gc Fe) ∈OrigG\S, thatF /e ∈HidG, that ((F ,e Xe) −−→eval ?)∈

\

OrigD_i and thateval(F ,e Xe)6=⊥ imply Missholds, which is a contradiction.

We now show how to bound each of the events above. We can easily show that each of the events Bad4 and Bad5 happens with probability at most ₂κ/12 because the occurrence of each of

a special case of the event Bad2 (Definition 4.52), which we have shown in Lemma 4.54 that this

event occurs with probability at most 4tq2_ε.

We now bound the probability of the event Miss. To this end, we define a Bernoulli random variable for any Fe such that ((∗ −→

gc Fe))∈ OrigG and then show that the event Miss is the event that for some Fe where ((∗ −→

gc Fe))∈OrigG: the first q

τ _{trials of that Bernoulli variable fails, but}

the last one succeeds. We obtain the desired bound ofq×_q1τ from Lemma3.1and a union bound.

Fix Fe for which ((∗ −→

gc Fe))∈OrigG. Define the following Bernoulli trial.

Bernoulli Trial:

1. For both b∈ {0,1}do the following:

(a) Samplec0 ← EO(pk, b) and let OrigE0 be the set of all query/response pairs during this execution.

(b) LetOrigD\_i be sampled as in DistGen1(pk,LearnG,OrigE0).

• We say the Bernoulli trial succeeds if there is a queryqu= ((F ,e Xe)−−→

eval ⊥)∈

\

OrigD_i

buteval(F ,e Xe)6=⊥. Otherwise, we say the Bernoulli trial fails.

Now suppose the eventMissholds. This means that there existsFesuch that (∗ −→

gc Fe)∈OrigG, thatF /e∈HidG, that (∗ −→

gc Fe)∈/ LearnG∪OrigE∪Si, and that for someXe the query ((F ,e Xe)−−→eval ?) appears during the execution ofDOib♦O[LearnG∪OrigE∪Si]_{(cski, c) and thateval(F ,e Xe)6=⊥. This means}

that this particular Bernoulli trial (based on OrigE, Oib and cski) succeeds. Moreover, F /e ∈ HidG

means that all the previousqτ Bernoulli trials performed to form the random variable HidGfailed.

In document Limits on the Power of Garbling Techniques for Public-Key Encryption (Page 34-48)