[PDF] Top 20 Limits on the Power of Indistinguishability Obfuscation and Functional Encryption

... the indistinguishability obfuscator to any primitive that can be constructed in a fully black-box manner from a one-way permutation (or trapdoor permutations) and indistinguishability obfuscation: ... See full document

... machines. Functional Encryption and Obfuscation are not just powerful cryptographic primitives in their own right, but are also intimately related objects – for example, it was shown in [10] that ... See full document

... On the flip side, the tremendous power of IO also begets its reliance on strong and untested computational assumptions. Indeed, it has been a major cryptographic quest to come up with a construction of IO based on ... See full document

... homomorphic encryption [35, 14] which could be constructed from LWE ...the power of iO by ruling out constructions of collision-resistant hash functions from iO and OWF (even if iO uses OWF in a ... See full document

... Indistinguishability obfuscation for Turing machines has been constructed in the works of Boyle, Chung and Pass [BCP14] and Ananth et ...differing-inputs obfuscation (diO) which extends iO to ... See full document

... The interest in iO has gained considerable momentum following the works of Garg et al. [9] who pro- posed an e ffi cient candidate construction of iO for all circuits (along with a candidate construction of func- tional ... See full document

... point obfuscation— in particular AIPO—and indistinguishability obfuscation (iO) together make a powerful ...point obfuscation scheme which can securely obfuscate point functions given as input ... See full document

... For the theorems above, we stress that we place no restrictions on the patches. A patch P can be an arbitrary Turing Machine that takes the original program description M as input, and outputs an arbitrary Turing Machine ... See full document

... assumption. (Our work will diverge technically from this.) Another line of work started with the work of Katz, Sahai, and Waters [KSW08], studying FE where secret keys corresponded to arithmetic inner product ... See full document

... consists of the initial memory content x, and a signed initial CPU state that contains the Merkle tree digest of x. Let Π and Π 0 be two computation instances defined by (P, x) and (P 0 , x) respectively with identical ... See full document

... quadratic functional encryption schemes [Lin17, BCFG17] perform decryption “brute force”, by computing a discrete logarithm in the end, restricting the space of decryptable values to be polynomial in ... See full document

... between indistinguishability obfuscations of two circuits that differ on polynomial number of inputs with noticable probability, then there is a PPT extractor that extracts a differing input with overwhelming ... See full document

... order-revealing) encryption [BCLO09], but of course we must generalize it for ...the indistinguishability-based definitions of (general) multi-input functional encryption given by Goldwasser ... See full document

... witness encryption [GGSW13] on exponential hardness of some simple as- sumptions over multinear encodings—the “multilinear subgroup eliminations assumption” and the “multilinear subgroup decision assumption” ... See full document

... many power- ful primitives such as public-key encryption, identity-based encryption, attribute-based encryption (via witness encryption), as well as NIZKs, CCA encryption, and ... See full document

... via functional encryption [SW05, BSW11], specifically transforming compact public-key functional encryption (FE) for NC 1 to iO for ...the encryption algorithm must only have a ... See full document

... In the past few years, functional encryption (FE) schemes with different efficiency and se- curity features were constructed from various computational assumptions. A central measure of interest (in general ... See full document

... of encryption algorithm has sublinear dependence on the function size, in fact, ...the encryption algorithm on a message x must be at most poly(λ, |x|) · |f | 1− for some constant < ... See full document

... standard indistinguishability game between the FE adversary and a challenger, but limit the types of queries that the adversary can ...requires indistinguishability only when each key-pair-query that the ... See full document

... Another difficulty is that our circuit must output the locations it wishes to access in the clear, which could reveal something about the underlying machine. An ORAM would solve this problem if we had a black-box CPU, ... See full document