Witness Encryption and Null-IO from Evasive LWE

• Published in: Advances in Cryptology - ASIACRYPT 2022 Vol. 13791; pp. 195 - 221
• Main Authors: Vaikuntanathan, Vinod, Wee, Hoeteck, Wichs, Daniel
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer 2023; Springer Nature Switzerland
• Series: Lecture Notes in Computer Science
• ISBN: 9783031229626; 3031229622
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-031-22963-3_7

Witness encryption (WE) allows us to use an arbitrary NP statement x as a public key to encrypt a message, and the witness w serves as a decryption key. Security ensures that, when the statement x is false, the encrypted message remains computationally hidden. WE appears to be significantly weaker than indistinguishability obfuscation (iO). Indeed, WE is closely related to a highly restricted form of iO that only guarantees security for null circuits (null iO). However, all current approaches towards constructing WE under nice assumptions go through iO. Such constructions are quite complex and are unlikely to lead to practically instantiable schemes. In this work, we revisit a very simple WE and null iO candidate of Chen, Vaikuntanathan and Wee (CRYPTO 2018). We show how to prove its security under a nice and easy-to-state assumption that we refer to as evasive LWE following Wee (EUROCRYPT 2022). Roughly speaking, the evasive LWE assumption says the following: assume we have some joint distributions over matrices P\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\textbf{P}$$\end{document}, S\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\textbf{S}$$\end{document} and auxiliary information aux\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\textsf{aux}$$\end{document} such that (SB+E,SP+E′,aux)≈c(U,U′,aux),\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$({\textbf{S}\textbf{B}+ \textbf{E}},{\textbf{S}\textbf{P}+ \textbf{E}'}, \textsf{aux}) \approx _c ({\textbf{U}},{\textbf{U}'}, \textsf{aux}),$$\end{document}for a uniformly random (and secret) matrix B\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\textbf{B}$$\end{document}, where U,U′\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\textbf{U}, \textbf{U}'$$\end{document} are uniformly random matrices, and E,E′\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\textbf{E},\textbf{E}'$$\end{document} are chosen from the LWE error distribution with appropriate parameters. Then it must also be the case that: (SB+E,B-1(P),aux)≈c(U,B-1(P),aux).\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$({\textbf{S}\textbf{B}+ \textbf{E}}, \textbf{B}^{-1}(\textbf{P}),\textsf{aux}) \approx _c (\textbf{U}, \textbf{B}^{-1}(\textbf{P}),\textsf{aux}).$$\end{document}Essentially the above says that given SB+E\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$${\textbf{S}\textbf{B}+ \textbf{E}}$$\end{document}, getting the additional component B-1(P)\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\textbf{B}^{-1}(\textbf{P})$$\end{document} is no more useful than just getting the product (SB+E)·B-1(P)≈SP+E′\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$({\textbf{S}\textbf{B}+ \textbf{E}})\cdot \textbf{B}^{-1}(\textbf{P}) \approx \textbf{S}\textbf{P}+ \textbf{E}'$$\end{document}.