Securely Obfuscating Re-encryption

We present a positive obfuscation result for a traditional cryptographic functionality. This positive result stands in contrast to well-known impossibility results (Barak et al. in Advances in Cryptology—CRYPTO’01, 2002), for general obfuscation and recent impossibility and implausibility (Goldwasser and Kalai in 46th IEEE Symposium on Foundations of Computer Science (FOCS), pp. 553–562, 2005) results for obfuscation of many cryptographic functionalities.Whereas other positive obfuscation results in the standard model apply to very simple point functions (Canetti in Advances in Cryptology—CRYPTO’97, 1997; Wee in 37th ACM Symposium on Theory of Computing (STOC), pp. 523–532, 2005), our obfuscation result applies to the significantly more complex and widely-used re-encryption functionality. This functionality takes a ciphertext for message m encrypted under Alice’s public key and transforms it into a ciphertext for the same message m under Bob’s public key.To overcome impossibility results and to make our results meaningful for cryptographic functionalities, our scheme satisfies a definition of obfuscation which incorporates more security-aware provisions.

We consider the client-server setting for the concurrent composition of secure protocols: in this setting, a single server interacts with multiple clients concurrently, executing with each client a specified protocol where only the client should receive any nontrivial output. Such a setting is easily motivated from an application standpoint. There are important special cases for which positive results are known – such as concurrent zero knowledge protocols – and it has been an open question whether other natural functionalities such as Oblivious Transfer (OT) are possible in this setting.In this work: We resolve this open question by showing that unfortunately, even in this very limited concurrency setting, broad new impossibility results hold, ruling out not only OT, but in fact all nontrivial finite asymmetric functionalities. Our new negative results hold even if the inputs of all honest parties are fixed in advance, and the adversary receives no auxiliary information. Along the way, we establish a new unconditional completeness result for asymmetric functionalities, where we characterize functionalities that are non-interactively complete secure against active adversaries. When we say that a functionality \(\mathcal {F}\) is non-interactively complete, we mean that every other asymmetric functionality can be realized by parallel invocations of several copies of \(\mathcal {F}\), with no other communication in any direction. Our result subsumes a completeness result of Kilian [STOC’00] that uses protocols which require additional interaction in both directions. KeywordsImpossibility ResultOblivious TransferHonest PartyErasure ChannelCorrupt PartyThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In the first part we make an assessment of the impossibility result, due to Chichilnisky, in the topological approach to social choice theory. We observe that this result depends essentially on the choice of the topology for the set of preferences. In the second part, we present two positive results, obtained using the global approach. The first one deals with the space of continuous and strictly convex preferences, a space which, in the local approach, would produce an impossibility result. The second result deals with a class of preferences which is dense in the space of all continuous preferences. Thus, an approximate solution of the Chichilnisky problem has been obtained on this space.

One of the main lines of research in functional encryption (FE) has consisted in studying the security notions for FE and their achievability. This study was initiated by [Boneh et al. – TCC’11, O’Neill – ePrint’10] where it was first shown that for FE the indistinguishability-based (IND) security notion is not sufficient in the sense that there are FE schemes that are provably IND-Secure but concretely insecure. For this reason, researchers investigated the achievability of Simulation-based (SIM) security, a stronger notion of security. Unfortunately, the above-mentioned works and others [e.g., Agrawal et al. – CRYPTO’13] have shown strong impossibility results for SIM-Security. One way to overcome these impossibility results was first suggested in the work of Boneh et al. where it was shown how to construct, in the Random Oracle (RO) model, SIM-Secure FE for restricted functionalities and was asked the generalization to more complex functionalities as a challenging problem in the area. Subsequently, [De Caro et al. – CRYPTO’13] proposed a candidate construction of SIM-Secure FE for all circuits in the RO model assuming the existence of an IND-Secure FE scheme for circuits with RO gates. To our knowledge there are no proposed candidate IND-Secure FE schemes for circuits with RO gates and they seem unlikely to exist. We propose the first constructions of SIM-Secure FE schemes in the RO model that overcome the current impossibility results in different settings. We can do that because we resort to the two following models: Both results also assume the RO model, but not functionalities with RO gates and rely on extractability obfuscation [Boyle et al. – TCC’14] (and other standard primitives) secure only in the standard model.

We study fair allocation of indivisible goods among additive agents with feasibility constraints. In these settings, every agent is restricted to get a bundle among a specified set of feasible bundles. Such scenarios have been of great interest to the AI community due to their applicability to real-world problems. Following some impossibility results, we restrict attention to matroid feasibility constraints that capture natural scenarios, such as the allocation of shifts to medical doctors and the allocation of conference papers to referees. We focus on the common fairness notion of envy-freeness up to one good (EF1). Previous algorithms for finding EF1 allocations are either restricted to agents with identical feasibility constraints or allow free disposal of items. An open problem is the existence of EF1 complete allocations among agents who differ both in their valuations and in their feasibility constraints. In this work, we make progress on this problem by providing positive and negative results for several matroid and valuation types. Among other results, we devise polynomial-time algorithms for finding EF1 allocations in the following settings: (i) n agents with heterogeneous (non-identical) binary valuations and partition matroids with heterogeneous capacities; (ii) two agents with heterogeneous additive valuations and partition matroids with heterogeneous capacities; and (iii) three agents with heterogeneous binary valuations and identical base-orderable matroid constraints.

We formalize the standard application of identity-based encryption IBE, namely non-interactive secure communication, as realizing an ideal system which we call delivery controlled channel DCC. This system allows users to be registered by a central authority for an identity and to send messages securely to other users only known by their identity. Quite surprisingly, we show that existing security definitions for IBE are not sufficient to realize DCC. In fact, it is impossible to do so in the standard model. We show, however, how to adjust any IBE scheme that satisfies the standard security definition IND-ID-CPA to achieve this goal in the random oracle model. We also show that the impossibility result can be avoided in the standard model by considering a weaker ideal system that requires all users to be registered in an initial phase before any messages are sent. To achieve this, a weaker security notion, which we introduce and call IND-ID1-CPA, is actually sufficient. This justifies our new security definition and might open the door for more efficient schemes. We further investigate which ideal systems can be realized with schemes satisfying the standard notion and variants of selective security. As a contribution of independent interest, we show how to model features of an ideal system that are potentially available to dishonest parties but not guaranteed, and which such features arise when using IBE.

Under CPA and CCA1 attacks, a secure bit encryption scheme can be applied bit-by-bit to construct a secure many-bit encryption scheme. The same construction fails, however, under a CCA2 attack. In fact, since the notion of CCA2 security was introduced by Rackoff and Simon [21], it has been an open question to determine whether single bit CCA2 secure encryption implies the existence of many-bit CCA2 security. We positively resolve this long-standing question and establish that bit encryption is complete for CPA, CCA1, and CCA2 notions. Our construction is black-box, and thus requires novel techniques to avoid known impossibility results concerning trapdoor predicates [10]. To the best of our knowledge, our work is also the first example of a non-shielding reduction (introduced in [9]) in the standard (i.e., not random-oracle) model.

Informally, an obfuscator \({\mathcal{O}}\) is an efficient, probabilistic “compiler” that transforms a program P into a new program (P) with the same functionality as P, but such that \({\mathcal{O}}(P)\) protects any secrets that may be built into and used by P. Program obfuscation, if possible, would have numerous important cryptographic applications, including: (1) “Intellectual property” protection of secret algorithms and keys in software, (2) Solving the long-standing open problem of homomorphic public-key encryption, (3) Controlled delegation of authority and access, (4) Transforming Private-Key Encryption into Public-Key Encryption, and (5) Access Control Systems. Unfortunately however, program obfuscators that work on arbitrary programs cannot exist [1]. No positive results for program obfuscation were known prior to this work.In this paper, we provide the first positive results in program obfuscation. We focus on the goal of access control, and give several provable obfuscations for complex access control functionalities, in the random oracle model. Our results are obtained through non-trivial compositions of obfuscations; we note that general composition of obfuscations is impossible, and so developing techniques for composing obfuscations is an important goal. Our work can also be seen as making initial progress toward the goal of obfuscating finite automata or regular expressions, an important general class of machines which are not ruled out by the impossibility results of [1]. We also note that our work provides the first formal proof techniques for obfuscation, which we expect to be useful in future work in this area.KeywordsAccess ControlAccess PointPoint FunctionTuring MachineRegular ExpressionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Can we always design a game form so that all its Bayesian equilibrium outcomes are either interim individually rational efficient or interim envy-free efficient in asymmetric information economies? We show that the answer is no. Given that such games exist in complete information economies, can this gap be filled by games that information endogenously without enlarging the equilibrium set? We adopt two approaches. First, we introduce a theory of cheap play as a natural model of such games. The second is an extreme approach that adopts an ex post viewpoint. Neither yields a possibility result. Information leakage does not recover efficiency. This paper addresses the following question: in any domain of asymmetric information economies, is it always possible to design a game form so that all its equilibrium outcomes are either interim individually rational efficient or interim fair (envy-free efficient)? Our first result is that with Bayesian equilibrium as the solution concept, we can never design such a game form in a wide domain of economies. The impossibility result persists even if there were strong restrictions on the information structure guaranteeing incentive compatibility of all allocation rules. From the Nash-implementation literature (Maskin 1977, Hurwicz et al. 1984) we know that such games exist in complete information economies. Our first result indicates the cost, in terms of social welfare, imposed on society by the presence of information asymmetry. This raises a natural question: can the gap between the positive results under complete information and the negative ones under incomplete information be bridged by devising game forms that leak information endogenously? In an equilibrium of such a game, the players' optimality calculations are conditioned on the newly acquired information. Superficially, it appears that such games may yield a solution to the problem of nonexistence of efficient mechanisms. Information leakage is a mixed blessing since, typically, it would require pre-play communication which tends to enlarge the set of equilibria. Our negative findings using Bayesian equilibrium were primarily due to the presence of too many equilibria in every conceivable game form. Clearly, we need a game form that

The hash-and-sign RSA signature is one of the most elegant and well known signatures schemes, extensively used in a wide variety of cryptographic applications. Unfortunately, the only existing analysis of this popular signature scheme is in the random oracle model, where the resulting idealized signature is known as the RSA Full Domain Hash signature scheme (RSA-FDH). In fact, prior work has shown several “uninstantiability” results for various abstractions of RSA-FDH, where the RSA function was replaced by a family of trapdoor random permutations, or the hash function instantiating the random oracle could not be keyed. These abstractions, however, do not allow the reduction and the hash function instantiation to use the algebraic properties of RSA function, such as the multiplicative group structure of ℤ n * . n. In contrast, the multiplicative property of the RSA function is critically used in many standard model analyses of various RSA-based schemes. Motivated by closing this gap, we consider the setting where the RSA function representation is generic (i.e., black-box) but multiplicative, whereas the hash function itself is in the standard model, and can be keyed and exploit the multiplicative properties of the RSA function. This setting abstracts all known techniques for designing provably secure RSA-based signatures in the standard model, and aims to address the main limitations of prior uninstantiability results. Unfortunately, we show that it is still impossible to reduce the security of RSA-FDH to any natural assumption even in our model. Thus, our result suggests that in order to prove the security of a given instantiation of RSA-FDH, one should use a non-black box security proof, or use specific properties of the RSA group that are not captured by its multiplicative structure alone. We complement our negative result with a positive result, showing that the RSA-FDH signatures can be proven secure under the standard RSA assumption, provided that the number of signing queries is a-priori bounded.

In recent years, the obfuscation has been one of the most intriguing open problems in cryptography. Loosely speaking, an obfuscation O(P) of a program P should preserve P's functionality and its code remains ``unintelligent''. However, few positive results have been proposed. Hada et. al in EUROCRYPT'10 demonstrated an obfuscation of encrypted signature. Inspired by their work, We construct a structure-preserving encrypted proxy signature. Alice wants to make encrypted signatures to Bob, but she will be absent. During this period, she wants to delegate her signing authority to a proxy without sending him her secret signing key. We run a step for obfuscation and then successfully solve the problem. Our proposed structure satisfies the virtual box property of obfuscation. We show its security in the sequel. The whole proof is under the standard model.

An important question in particle physics is whether the neutrino is its own antiparticle (Majorana) or whether the neutrino and antineutrino are different particles (Dirac). This question is also important for investigating physics beyond the Standard Model, the accepted theory of particle physics. One experimental test is to search for neutrinoless double β decay. Such a decay is possible only if the neutrino is a Majopra particle. Early experiments found no evidence for such a decay, although a few members of the Heidelberg-Moscow collaboration claimed that it had, in fact, been observed. Once again, discordant results led to experimental pursuit. All subsequent experiments, excepting some further analysis by some members of the Heidelberg-Moscow collaboration, have reported no evidence for neutrinoless double β decay. This case is particularly interesting because while there is an overwhelming host of negative results, and while the Heidelberg-Moscow positive results have been subjected to considerable detailed and rather pointed criticism, the pursuit of a positive result continues for reasons that we examine in this chapter.

Obfuscation was first studied in computer programming field, which could be explained as a compiler that translates computer codes into an unintelligible form while preserving the original functionality. Since obfuscation for cryptographic purposes was raised out, several positive results have been presented in despite of the general impossibility. Secure obfuscation of point functions have been studied well and it was pointed out that secure composition of several point function obfuscation could realize the secure obfuscation of set-membership predicate function. However, secure composition of point function obfuscation was only proposed in one literature and the security was proved in Generic Group Model(GGM) under the definition of Virtual Grey Box-Obfuscation(VGB). In this paper we propose a new obfuscation construction of set-membership predicate functions under the standard definition of Virtual Black Box-Obfuscation(VBB). We utilize the vector space technique instead of obfuscation composition, and the security of obfuscation relies on an assumption which exists in standard model. Moreover, our obfuscation result of set-membership predicate functions can hide the real scale of the set and the obfuscation construction can be securely composed for different sets.

In this paper two scheduling models are addressed. First is the standard model (unicast) where requests (or jobs) are independent. The other is the broadcast model where broadcasting a page can satisfy multiple outstanding requests for that page. We consider online scheduling of requests when they have deadlines. Unlike previous models, which mainly consider the objective of maximizing throughput while respecting deadlines, here we focus on scheduling all the given requests with the goal of minimizing the maximum delay factor. The delay factor of a schedule is defined to be the minimum α ≥ 1 such that each request i is completed by time ai + α(di - ai) where ai is the arrival time of request i and di is its deadline. Delay factor generalizes the previously defined measure of maximum stretch which is based only the processing times of requests [9, 11].We prove strong lower bounds on the achievable competitive ratios for delay factor scheduling even with unit-time requests. Motivated by this, we consider resource augmentation analysis [24] and prove the following positive results. For the unicast model we give algorithms that are (1 + e)-speed O(1/e)-competitive in both the single machine and multiple machine settings. In the broadcast model we give an algorithm for same-sized pages that is (2 + e)-speed O(1/e2)-competitive. For arbitrary page sizes we give an algorithm that is (4 + e)-speed O(1/e2)-competitive.

In the literature on the urban income distribution two important questions have been ignored. First is the question of the appropriateness of hypotheses testing on samples of SMSAs with broad ranges of populations sizes. The second question is the stability of the effects of city size and other determinants on the urban income distribution through time. This stability is crucial to the propriety of drawing policy implications from previous studies which have employed data from only a single point in time. This study finds that hypotheses tests are sensitive to the size classes of cities being examined, and hence the results of hypotheses tested for SMSAs with broad ranges of population may be misleading. The present analysis also reveals that significant structural changes have taken place in the standard linear model over time, and therefore inferences regarding the future from past studies should be viewed with caution.