Come to the first Charles River Crypto Day of this academic year and get your fix of coffee, blockchains, rational proofs, memory hard functions and (need we say) indistinguishability obfuscation.

When: Friday, October 14 at MIT.

Where: 32 Vassar St (Stata Center)
G-882 (Hewlett), Cambridge MA 02139.

Organizers: Yael Kalai, Ron Rothblum, Vinod Vaikuntanathan and Daniel Wichs.

Thanks: NSF MACS Project for their generous support.

Program:

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00.
Nir Bitansky, MIT
From Cryptomania to Obfustopia through Secret-Key Functional Encryption
11:00 – 12:00.
Rachel Lin, UC Santa Barbara
Indistinguishability Obfuscation from DDH-like Assumptions on Constant-Degree Graded Encodings
12:00 – 1:30. Lunch (provided)
1:30 – 2:30. Jing Chen, Stony Brook
Rational Proofs with Multiple Provers
2:30 – 3:30. Elaine Shi, Cornell
Blockchains and Beyond: Rethinking Distributed Consensus in New Settings
3:30 – 4:00. Coffee Break
4:00 – 5:00. Jeremiah Blocki, Purdue
Towards a Theory of Data-Independent Memory Hard Functions

Abstracts:

Speaker: Nir Bitansky
Title: From Cryptomania to Obfustopia through Secret-Key Functional Encryption

Functional encryption lies at the frontiers of current research in cryptography; some variants have been shown sufficiently powerful to yield indistinguishability obfuscation (IO) while other variants have been constructed from standard assumptions such as LWE. Indeed, most variants have been classified as belonging to either the former or the latter category. However, one mystery that has remained is the case of \emph{secret-key functional encryption} with an unbounded number of keys and ciphertexts. On the one hand, this primitive is not known to imply anything outside of minicrypt, the land of secret-key crypto, but on the other hand, we do no know how to construct it without the heavy hammers in obfustopia.

In this work, we show that (subexponentially secure) secret-key functional encryption is powerful enough to construct indistinguishability obfuscation if we additionally assume the existence of (subexponentially secure) plain public-key encryption. In other words, secret-key functional encryption provides a bridge from cryptomania to obfustopia.

On the technical side, our result relies on two main components. As our first contribution, we show how to use secret key functional encryption to get “exponentially-efficient indistinguishability obfuscation” (XIO), a notion recently introduced by Lin et al. (PKC ’16) as a relaxation of IO. Lin et al. show how to use XIO and the LWE assumption to build IO. As our second contribution, we improve on this result by replacing its reliance on the LWE assumption with any plain public-key encryption scheme.

Lastly, we ask whether secret-key functional encryption can be used to construct public-key encryption itself and therefore take us all the way from minicrypt to obfustopia. A result of Asharov and Segev (FOCS ’15) shows that this is not the case under black-box constructions, even for exponentially secure functional encryption. We show, through a non-black box construction, that subexponentially secure-key functional encryption indeed leads to public-key encryption. The resulting public-key encryption scheme, however, is at most quasi-polynomially secure, which is insufficient to take us to obfustopia.

Joint work with Ryo Nishimaki, Alain Passelègue, and Daniel Wichs

Speaker: Rachel Lin
Title: Indistinguishability Obfuscation from DDH-like Assumptions on Constant-Degree Graded Encodings

All constructions of general purpose indistinguishability obfuscation (IO) rely on either meta-assumptions that encapsulate an exponential family of assumptions (e.g., Pass, Seth and Telang, CRYPTO 2014) or polynomial families of assumptions, on graded encoding schemes with a high polynomial degree/multilinearity (e.g., Gentry, Lewko, Sahai and Waters, FOCS 2014).

In this talk, we present two recent works on simplifying graded encodings needed for constructing IO [Lin EUROCRYPT 2016 and Lin-Vaikuntanathan FOCS 2016]. These two works show that IO can be constructed from only constant-degree graded encodings, with a security reduction to a DDH-like assumption — called the joint-SXDH assumption — on the graded encodings, and the sub-exponential security of a polynomial-stretch PRG in NC0. Our assumption on graded encodings is simple, has constant size, and does not require handling composite-order rings. This narrows the gap between the mathematical objects that exist (bilinear maps, from elliptic curve groups) and ones that suffice to construct general purpose IO.

Speaker: Jing Chen
Title: Rational Proofs with Multiple Provers

Classic interactive proofs model a world where a verifier delegates computation to an untrustworthy prover, verifying the prover’s claims before accepting them. We provide the first model that extends rational interactive proofs to allow multiple provers. A verifier pay the provers according to his own randomness and the information received from them. The provers are rational rather than untrustworthy —they may lie, but only to increase the payment. Properly designed protocols incentivize the provers to provide correct information and hence let the verifier to learn the correct answer.

We give tight upper and lower bounds on the computation power of this model. On the way, we show that multiple rational provers are strictly more powerful than one, under standard complexity-theoretic assumptions. We further show that the full power of rational proofs with multiple provers can be achieved using only two provers and five rounds of interaction. Finally, we consider more demanding models where the verifier wants the payment to decrease significantly when the provers are lying, and fully characterize the power of the model when the payment gap must be noticeable.

Speaker: Elaine Shi
Title: Blockchains and Beyond: Rethinking Distributed Consensus in New Settings

Abstract coming soon.

Speaker: Jeremiah Blocki
Title: Towards a Theory of Data-Independent Memory Hard Functions

There is a growing interest in functions which are moderately hard to compute on a normal single-processor machine, but which cannot be computed at a significantly lower cost of dedicated hardware. Such functions are necessary for password-hashing to prevent brute-force attacks implemented on application specific integrated circuits (ASICs). Towards this goal memory-hard functions (MHFs) have been proposed, motivated by the observation that memory costs on customized hardware is not much cheaper than on general architectures. A MHF should have the properties that: (1) Computing the MHF on any input, using a sequential algorithm requires a moderate amount of computational resources (memory and time), and (2) The MHF cannot be repeatedly computed in parallel with significantly less computational resources even if an adversary can amortize his costs across multiple instances (e.g., password guesses). More specifically, we want to ensure that any algorithm evaluating multiple instances of the MHF has high amortized ST-cost — Space X Time divided by #instances evaluated. The second property ensures that the amortized cost of computing an MHF cannot be significantly reduced by developing application specific integrated circuits (ASICs).

Of particular interest in the context of password hashing are data-independent MHFs (iMHFs) as they enjoy a natural resistance to certain side channel attacks which might otherwise leak information about the user’s password. An iMHF can be specified by fixing a directed acyclic graph (DAG) G_n on n nodes of constant indegree and a single sink node n. G_n represents the data-dependency graph between intermediate calls to an underlying hash function during the computation of the iMHF and node n represents final output.

This talk will overview recent results demonstrating that a combinatorial property called depth-robustness fully characterizes iMHFs with high amortized ST-cost. On the positive side we construct a family of DAGs G_n with ST-cost at least $\Omega(n^2/log(n))$. We also show that any iMHF has amortized ST-cost at most $O(n^2 log(log(n))/log(n))$ so our construction is nearly optimal in an asymptotic sense. On the negative side we show that Argon2i, the winner of the password hashing competition, is defined using a directed acyclic graph G_n that is not depth-robust and can be computed by an algorithm with low amortized ST-cost $O(n^{1.71})$. The resulting attacks are practical for realistic settings of the Argon2i parameters.

Based on joint works with Joel Alwen and Krzysztof Pietrzak.

Advertisements

Please join us for second Charles River Crypto Day of this academic year on Friday, February 26 at MSR New England.

Location and Arrival Instructions:
Microsoft New England Research and Development Center
Clara Barton Room (First Floor),
One Memorial Drive, Cambridge MA 02142.

Thanks to NSF MACS Project for their generous support.

Program:

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00. Ron Rothblum, MIT
Constant-round Interactive-proofs for Delegating Computations
11:30 – 12:30.
Omer Paneth, Boston University
Delegating RAM Computations
12:30 – 1:30. Lunch (provided)
1:30 – 2:30. Silas Richelson, MIT
Three round Non-Malleable Commitment from Non-Malleable Codes
3:00 – 4:00. Muthu Venkitasubramaniam, University of Rochester
On the Power of Secure Two-Party Computation

Abstracts:

Speaker: Ron Rothblum
Title: Constant-round Interactive-proofs for Delegating Computations

Interactive proofs have had a dramatic impact on Complexity Theory and Cryptography. In particular, the celebrated IP=PSPACE Theorem [LFKN92,Shamir92] allows an all-powerful but untrusted prover to convince a polynomial-time verifier of the validity of extremely complicated statements (as long as they can be evaluated using polynomial space). The interactive proof system designed for this purpose requires a polynomial number of communication rounds. It is very natural and well motivated to examine the power of more efficient interactive proofs, and this is the focus of this work.

Our main result is that for every statement that can be evaluated in polynomial time and bounded-polynomial space there exists an interactive proof that satisfies the following strict efficiency requirements: (1) the honest prover runs in polynomial time, (2) the verifier is almost linear time (and under some conditions even sub linear), and (3) the interaction consists of only a constant number of communication rounds.

We introduce several new notions for interactive proofs that turn out to be very useful in our work and may be of independent interest. One of these notions is that of unambiguous interactive proofs where the prover has a unique successful strategy. Another notion is that of probabilistically checkable interactive proofs (PCIPs) where the verifier only reads a few bits of the transcript in checking the proof (this could be viewed as an interactive extension of PCPs).

Joint work with Omer Reingold and Guy Rothblum.

Speaker: Omer Paneth
Title: Delegating RAM Computations

In the setting of cloud computing a user wishes to delegate its data, as well as computations over this data, to a cloud provider. Each computation may read and modify the data, and these modifications should persist between computations. Minding the computational resources of the cloud, delegated computations are modeled as RAM programs. In particular, the delegated computations’ running time may be sub-linear, or even exponentially smaller than the memory size.

We construct a two-message protocol for delegating RAM computations to an untrusted cloud. In our protocol, the user saves a short digest of the delegated data. For every delegated computation, the cloud returns, in addition to the computation’s output, the digest of the modified data, and a proof that the output and digest were computed correctly. When delegating a T-time RAM computation M with security parameter k, the cloud runs in time T * Poly(k) and the user in time Poly(|M|, log(T), k).

Our protocol is secure assuming super-polynomial hardness of the Learning with Error (LWE) assumption. Security holds even when the delegated computations are chosen adaptively as a function of the data and output of previous computations.

We note that RAM delegation schemes are an improved variant of memory delegation schemes [Chung et al. CRYPTO 2011]. In memory delegation, computations are modeled as Turing machines, and therefore, the cloud’s work always grows with the size of the delegated data.

Joint work with Yael Tauman Kalai.

Speaker: Silas Richelson
Title: Three-Round Non-Malleable Commitments from Non-Malleable Codes

We present a new non-malleable commitment protocol. Our protocol has the following features:

1) The protocol has only three rounds of interaction. Pass (TCC 2013) showed an impossibility result for a two-round non-malleable commitment scheme w.r.t. a black-box reduction to any “standard” intractability reduction. Thus, this resolves the round complexity of non-malleable commitment at least w.r.t. black-box security reductions. Our construction is secure as per the standard notion of non-malleability w.r.t. commitment.

2) Our protocol is efficient. In our basic protocol, the entire computation of the committer is dominated by just three invocations of a non-interactive statically binding commitment scheme, while, the receiver computation (in the commitment stage) is limited to just sampling a random string. Unlike many previous works, we directly construct a protocol for large tags and hence avoid any non-malleability amplification steps.

3) Our protocol is based on a black-box use of any non-interactive statistically binding commitment scheme. Such schemes, in turn, can be based on any one-to-one one-way function (or any one-way function at the cost of an extra initialization round). Previously, the best known black-box construction of non-malleable commitments required a larger (constant) number of rounds.

4) Our construction is public-coin and makes use of only black-box simulation. Prior to our work, no public-coin constant round non-malleable commitment schemes were known based on black-box simulation.

Our techniques depart significantly from the techniques used previously to construct non-malleable commitment schemes. As a main technical tool, we rely on non-malleable codes in the split state model. Our proofs of security are purely combinatorial in nature.

In addition, we also present a simple construction of constant round non-malleable commitments from any one-way function. While this result is not new, the main feature is its simplicity compared to any previous construction of non-malleable commitments (regardless of the number of rounds). We believe the construction is simple enough to be covered in a graduate level course on cryptography. The construction uses non-malleable codes in the split state model in a black-box way.

This is joint work with Vipul Goyal and Omkant Pandey.

Speaker: Muthu Venkitasubramaniam
Title: On the Power of Secure Two-Party Computation

Ishai, Kushilevitz, Ostrovsky and Sahai (STOC`07, SIAM JoC 2009) introduced the powerful “MPC-in-the-head” technique that provided a general transformation of information-theoretic MPC protocols secure against passive adversaries to a ZK proof in a “black-box” way. In this work, we extend this technique and provide a generic transformation of any semi-honest secure two-party computation (2PC) protocol (with mild adaptive security guarantees) in the so called \emph{oblivious-transfer} hybrid model to an adaptive ZK proof for any NP-language, in a “black-box” way assuming only one-way functions. Our basic construction based on Goldreich-Micali-Wigderson’s 2PC protocol yields an adaptive ZK proof with communication complexity proportional to quadratic in the size of the circuit implementing the NP relation. Previously such proofs relied on an expensive Karp reduction of the NP language to Graph Hamiltonicity (Lindell and Zarosim (TCC`09, Journal of Cryptology 2011)). We also improve our basic construction to obtain the first linear-rate adaptive ZK proofs by relying on efficient maliciously secure 2PC protocols. Core to this construction is a new way of transforming 2PC protocols to efficient (adaptively secure) instance-dependent commitment schemes.

As our second contribution, we provide a general transformation to construct a randomized encoding of a function f from any 2PC protocol that securely computes a related functionality (in a black-box way). We show that if the 2PC protocol has mild adaptive security guarantees then the resulting randomized encoding (RE) can be decomposed to an offline/online encoding.

As an application of our techniques, we show how to improve the construction of Lapidot and Shamir (Crypto`90) to obtain black-box constructions of commit-and-prove protocols with the so called input-delayed property where the honest prover’s algorithm does not require the actual statement until the last round. Using this, we obtain first constructions of a 4-round concurrent non-malleable commitments scheme based on one-way permutations where the underlying one-way permutation is used in a black-box way. Previous constructions either required more number of rounds or made non-black-box usage of the underlying primitive. We also show how these proofs can improve round complexity of secure computation protocols in the tamper-proof model.

Joint work with Carmit Hazay.

Please join us for first Charles River Crypto Day of this academic year on Friday, October 23 at MIT.

Location:
32 Vassar St (Stata Center)
G-449 (Patil/Kiva)
Cambridge MA 02139.

Thanks to NSF MACS Project for their generous support.

Program:

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00. Eshan Chattopadhyay, University of Texas Austin
Non-Malleable Extractors and Codes, with their Many Tampered Extensions
11:30 – 12:30.
Shai Halevi, IBM Research
The State of Multi-linear Maps
12:30 – 1:30. Lunch (provided)
1:30 – 2:00. Rump Session
2:00 – 3:00. Ron Rothblum, MIT
Proofs and Arguments of Proximity: Verifying Computations in Sub-Linear Time
3:30 – 4:30. abhi shelat, University of Virginia
Impossibility and Difficulty in Constructing Obfuscation Schemes

Rump program:

Aanchal Malhotra, BU
Adam Sealfon, MIT
Shortest Paths and Distances with Differential Privacy
Yilei Chen, BU
On the correlation intractability of obfuscated pseudorandom functions (a.k.a. the foundation of bitcoin hash functions)
Zahra Jafargholi, NEU
The New Realization of Adaptively Secure Garbled Circuits

Abstracts:

Speaker: Eshan Chattopadhyay

Title: Non-Malleable Extractors and Codes, with their Many Tampered Extensions

Randomness extractors and error correcting codes are fundamental objects in computer science. Recently, there have been several natural generalizations of these objects, in the context and study of tamper resilient cryptography. These are seeded non-malleable extractors, introduced by Dodis and Wichs; seedless non-malleable extractors, introduced by Cheraghchi and Guruswami; and non-malleable codes, introduced by Dziembowski, Pietrzak and Wichs. Besides being interesting on their own, they also have important applications in cryptography. For example, seeded non-malleable extractors are closely related to privacy amplification with an active adversary, non-malleable codes are related to non-malleable secret sharing, and seedless non-malleable extractors provide a universal way to construct explicit non-malleable codes.

However, explicit constructions of non-malleable extractors appear to be hard, and the known constructions are far behind their non-tampered counterparts. Indeed, the best known seeded non-malleable extractor requires min-entropy rate at least 0.49; while explicit constructions of non-malleable two-source extractors were not known even if both sources have full min-entropy, and was left as an open problem in the work of Cheraghchi-Guruswami. In addition, current constructions of non-malleable codes in the information theoretic setting only deal with the situation where the codeword is tampered once, and may not be enough for certain applications.

In this paper we make progress towards solving the above problems. Our contributions are as follows.

(1) We construct an explicit seeded non-malleable extractor for min-entropy k > \log^2 n . This dramatically improves all previous results and gives a simpler 2-round privacy amplification protocol with optimal entropy loss, matching the best known result by Li.

(2) We construct the first explicit non-malleable two-source extractor for min-entropy k > n-n^{\Omega(1)} , with output size n^{\Omega(1)} and error 2^{-n^{\Omega(1)}} .

(3) We motivate and initiate the study of two natural generalizations of seedless non-malleable extractors and non-malleable codes, where the sources or the codeword may be tampered many times. For this, we construct the first explicit non-malleable two-source extractor with tampering degree t up to n^{\Omega(1)} , which works for min-entropy k \geq n-n^{\Omega(1)} , with output size n^{\Omega(1)} and error 2^{-n^{\Omega(1)}} .

We further show that we can efficiently sample uniformly from any pre-image. By the connection in [CG14b], we also obtain the first explicit non-malleable codes with tampering degree t up to n^{\Omega(1)} , relative rate n^{\Omega(1)}/n , and error 2^{-n^{\Omega(1)}} .

Speaker: Shai Halevi

Title: The State of Cryptographic Multilinear Maps

This talk will give an overview of current state of the constructions of and attacks against cryptographic multilinear maps.

Speaker: Ron Rothblum

Title: Proofs and Arguments of Proximity: Verifying Computations in Sub-Linear Time

An interactive proof of proximity (IPP) is an interactive protocol in which a prover tries to convince a sublinear-time verifier that x \in L. Since the verifier runs in sublinear-time, following the property testing literature, the verifier is only required to reject inputs that are far from L. In a recent work, (Guy) Rothblum, Vadhan and Wigderson (STOC, 2013) constructed an IPP for every language computable by a low depth circuit.

In this work we consider the computational analogue, where soundness is required to hold only against a computationally bounded cheating prover. We call such protocols interactive arguments of proximity.

Assuming the existence of a sub-exponentially secure FHE scheme, we construct a one-round argument of proximity for every language computable in time t, where the running time of the verifier is o(n) + polylog(t) and the running time of the prover is poly(t).

As our second result, assuming sufficiently hard cryptographic PRGs, we give a lower bound, showing that the parameters obtained both in the IPPs of Rothblum et-al, and in our arguments of
proximity, are close to optimal.

Based on joint work with Yael Kalai.

Speaker: abhi shelat

Title: Impossibility and Difficulty in Constructing Obfuscation Schemes

The golden standard for obfuscation, Virtual blackbox obfuscation, was shown to be impossible to achieve for general circuits in the standard model by the celebrated work of Barak et al (CRYPTO 2001). Recently, Brakerski and Rothblum (TCC’15), and Barak et al (Eurocrypt’14) overcome the impossibility and show how to achieve general-purpose VBB obfuscation by using an idealized-graded encoding scheme that enables performing \emph{high-degree} “zero-tests” on encodings.

Building on a result of Canetti, Kalai and Paneth (TCC’15), we first show the impossibility of VBB obfuscation when the idealized-graded encoding scheme only allows evaluating constant-degree zero-tests on encodings. The main technique is to show how constant-degree zero-tests used in an obfuscation scheme can be “removed” by learning what the zero-tests would have answered, resulting in approximately-correct VBB obfuscation. This main technique also rules out sub-exponential secure VBB for general circuits when the idealized graded encoding scheme only allows evaluating degree n^\alpha zero-tests.

We then apply the technique to indistinguishability obfuscation schemes and combine with well-known complexity results to show that constructing iO schemes from constant-degree graded encoding schemes in a blackbox way is as hard as basing public-key cryptography on one-way functions.

This is joint work with Rafael Pass, and with Mohammad Mahmoody, Ameer Mohammed, and Soheil Nematihaji.

Please join us for the next installment of Crypto Day on Friday, April 17 at Northeastern University.

Location:
103 Churchill Hall
Northeastern University Boston, MA 02115

Program:

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00.
Leo Reyzin, BU
Wyner’s Wire-Tap Channel, Forty Years Later
11:30 – 12:30. Christopher Fletcher, MIT
Onion ORAM: A Constant Bandwidth ORAM using Additively Homomorphic Encryption
12:30 – 2:00. Lunch (provided)
2:00 – 3:00. Daniele Micciancio, UCSD
FHEW: Bootstrapping Homomorphic Encryption in less than a second
3:30 – 4:30. Kobbi Nissim, Ben-Gurion University and CRCS@Harvard
Learning under Differential Privacy

Abstracts:

Speaker: Leo Reyzin

Wyner’s Wire-Tap Channel, Forty Years Later

Wyner’s information theory paper “The Wire-Tap Channel” turns forty this year. Its importance is underappreciated in cryptography, where its intellectual progeny includes pseudorandom generators, privacy amplification, information reconciliation, and many flavors of randomness extractors (including plain, strong, fuzzy, robust, nonmalleable, source-private, local, and reusable). Focusing mostly on privacy amplification and fuzzy extractors, I will demonstrate the connection from Wyner’s paper to today’s research, including work on program obfuscation. I will conclude with some recent results on the feasibility of fuzzy extractors, based on joint work with Benjamin Fuller and Adam Smith.

 

Speaker: Christopher Fletcher

Title: Onion ORAM: A Constant Bandwidth ORAM using Additively Homomorphic Encryption

Oblivious RAM (ORAM) is a cryptographic primitive that obfuscates a client’s access pattern (address, data, read/write) to an untrusted memory source. In addition to its traditional application to outsourced storage, ORAM has proven to be an important component in the Cryptographic “swiss army knife” — finding uses in Garbled RAM, Secure Computation, Proofs of Retrievability, and more.

In this talk I will discuss Onion ORAM, a constant bandwidth ORAM that uses poly-logarithmic server computation to circumvent the well-known logarithmic lower bound in ORAM bandwidth. In addition to being constant bandwidth, Onion ORAM achieves constant client and server storage blowups — asymptotically optimal for each category — and does so without relying on Fully Homomorphic Encryption. In particular, we only require an Additively Homomorphic Encryption scheme with constant ciphertext blowup such as the Damgard-Jurik cryptosystem. We will extend the scheme to be secure against a malicious server using standard assumptions. To the best of our knowledge, Onion ORAM is the first concrete instantiation of a constant-bandwidth ORAM with poly-logarithmic computation (even for the semi-honest setting).

Joint work with Ling Ren, Srini Devadas, Marten van Dijk, Elaine Shi and Daniel Wichs

 

Speaker: Daniele Micciancio

Title: FHEW: Bootstrapping Homomorphic Encryption in less than a second

The main bottleneck affecting the efficiency of all known fully homomorphic encryption (FHE) schemes is Gentry’s bootstrapping procedure, which is required to refresh noisy ciphertexts and keep computing on encrypted data. We present a new method to homomorphically compute simple bit operations, and refresh (bootstrap) the resulting output, which runs on a personal computer in just about half a second.

Join work with Leo Ducas, to appear in Eurocrypt 2015

 

Speaker: Kobbi Nissim

Title: Learning under Differential Privacy

Learning is a task that abstracts many of the computations performed over large collections of sensitive individual information, hence natural to examine in conjunction with differential privacy. Predating differential privacy, in 2005 Blum, Dwork, McSherry and Nissim showed that any concept class that is learnable in Kearns’ model of statistical queries is also learnable with privacy. The concept of Private Learning formalized by Kasiviswanathan et al. in 2008 as the conjunction of PAC learning and differential privacy. They showed that any concept class |C| can be learned privately with O(log|C|) samples, via a construction that is somewhat analogous to the Occam Razor (non-private) learner.

Investigating the gap between the sample complexity and computational complexity of private and non-private learners resulted in a rich picture that we will highlight in the talk. In particular, we will examine some of the lower bound and upper bound techniques used in this context, and explore some of the ways to mitigate the costs of private learners. Time permitting, we will see relationships between private learning and other tasks, such as median computation and data sanitization.

Based on joint works with: Amos Beimel, Avrim Blum, Hai Brenner, Mark Bun, Cynthia Dwork, Shiva Kasiviswanathan, Homin Lee, Frank McSherry, Sofya Raskhodnikova, Adam Smith, Uri Stemmer, and Salil Vadhan.

Please join us for the next installment of Crypto Day on Friday, February 20 at Microsoft Research, New England.

Location and Arrival Instructions:
Microsoft New England Research and Development Center
One Memorial Drive, Cambridge MA 02142

Upon arrival, be prepared to show a picture ID and sign the Building Visitor Log when approaching the Lobby Floor Security Desk. Alert them to the name of the event, and ask them to direct you to the appropriate floor. The talks will be held the First Floor Conference Center, in the Horace Mann Conference Room. Detailed guidance on directions, via car or public transportation, is available here. Parking will be available for the on-site parking garage for $27/day.

Program:

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00.
Tal Malkin, Columbia
The Power of Negations in Cryptography
11:30 – 12:30. Rachel Lin, USCB
Constant-Round Concurrent Zero-knowledge from Indistinguishability Obfuscation
12:30 – 2:00. Lunch (provided)
2:00 – 3:00. Alessandra Scaffuro, BU and Northeastern
Garbled RAM From One-Way Functions
3:30 – 4:30. Henry Corrigan-Gibbs, Stanford
Building Anonymous Messaging Systems that ‘Hide the Metadata’

Abstracts:

Speaker: Tal Malkin
Title: The Power of Negations in Cryptography

The study of monotonicity and negation complexity for Boolean functions has been prevalent in complexity theory as well as in computational learning theory, but little attention has been given to it in the cryptographic context. Recently, Goldreich and Izsak (2012) have initiated a study of whether cryptographic primitives can be monotone, and showed that one-way functions can be monotone (assuming they exist), but a pseudorandom generator cannot.

In this work, we start by filling in the picture and proving that many other basic cryptographic primitives cannot be monotone. We then initiate a quantitative study of the power of negations, asking how many negations are required. We provide several lower bounds, some of them tight, for various cryptographic primitives and building blocks including one-way permutations, pseudorandom functions, small-bias generators, hard-core predicates, error-correcting codes, and randomness extractors. Among our results, we highlight the following.

i) Unlike one-way functions, one-way permutations cannot be monotone.

ii) We prove that pseudorandom functions require log n−O(1) negations (which is optimal up to the additive term).

iii) Error-correcting codes with optimal distance parameters require log n−O(1) negations (again, optimal up to the additive term).

iv) We prove a general result for monotone functions, showing a lower bound on the depth of any circuit with t negations on the bottom that computes a monotone function f in terms of the monotone circuit depth of f. This result addresses a question posed by Koroth and Sarma (2014) in the context of the circuit complexity of the Clique problem.

Joint work with Siyao Guo, Igor Carboni Oliveira, and Alon Rosen.

Speaker: Rachel Lin
Title: Constant-Round Concurrent Zero-knowledge from Indistinguishability Obfuscation

We present a constant-round concurrent zero-knowledge protocol for NP. Our protocol relies on the existence of families of collision-resistant hash functions, one-way permutations, and indistinguishability obfuscators for P/poly (with slightly super-polynomial security).

Speaker: Alessandra Scafuro
Title: Garbled RAM From One-Way Functions

Yao’s garbled circuit construction is a fundamental construction in cryptography and recent efficiency optimizations have brought it much closer to practice. However these constructions work only for circuits and garbling a RAM program involves the inefficient process of first converting it into a circuit. Towards avoiding this inefficiency, Lu and Ostrovsky [Eurocrypt 2013] introduced the notion of “garbled RAM” as a method to garble RAM programs directly. It can be seen as a RAM analogue of Yao’s garbled circuits such that, the size of the garbled program and the time it takes to create and evaluate it, is proportional only to the running time on the RAM program rather than its circuit size.
Known realizations of this primitive, either rely on stronger computational assumptions such as the existence of
Identity-Based Encryption, or rely on one-way functions only but do not achieve the aforementioned efficiency [Gentry, Halevi, Lu, Ostrovsky, Raykova and Wichs, EUROCRYPT 2014].

In this work we provide the first construction with strictly poly-logarithmic overhead in both space and time based only on the minimal assumption
that one-way functions exist.

Join work with Sanjam Garg, Steve Lu and Rafail Ostrovsky.

Speaker:
Henry Corrigan-Gibbs

Title: Building Anonymous Messaging Systems that ‘Hide the Metadata’

Encryption can protect the contents of a message being sent over an open network. In many situations, though, hiding the contents of a communication is not enough: parties to a conversation want to conceal the fact that they ever communicated. In this talk, I will explain how anonymity-preserving messaging systems can help ‘hide the metadata’ pertaining to a conversation and I will survey the state of the art in anonymous messaging protocols.

A limitation of existing protocols is that they exhibit computation and communication costs that scale linearly with the number of users (i.e., the anonymity set size) or they require expensive zero-knowledge proofs. In recent work, we have designed Riposte, a new system for anonymous messaging that applies private-information-retrieval and secure multi-party computation techniques to circumvent these limitations.

An implementation and experimental evaluation of Riposte demonstrates that, for latency-tolerant applications, the system can provide near-ideal anonymity for groups of millions of users—two orders of magnitude more than current systems support. I will conclude the talk with a discussion of open problems and directions for future work.

Joint work with: Dan Boneh and David Mazières

Please join us for the next installment of Crypto Day on Friday, December 5 at Boston University.

Location: 111 Cummington Mall Room 180. [directions]

Parking: There’s a pay lot across the street and 4-hour meters on Bay State Road.

Schedule

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00.
Yuval Ishai, Technion
Circuits Resilient to Additive Attacks, with Applications to Secure Computation
11:30 – 12:30. Omer Paneth, Boston University
Publicly-Verifiable Non-Interactive Arguments for Delegating Computations
12:30 – 2:00. Lunch (provided)
2:00 – 3:00. Elaine Shi, University of Maryland
Programs to Circuits: Towards a Programming Language for Cryptography
3:30 – 4:30. Sergey Gorbunov, MIT
Leveled Fully Homomorphic Signatures from Standard Lattices

Thanks: NSF Frontier Grant: Modular Approach to Cloud Security (MACS), Hariri Institute for Computing and Center for RISCS.

Special thanks to Leo Reyzin, Debbie Lehto, and Lauren Dupee for help with organization

Abstracts:

Speaker: Yuval Ishai
Title: Circuits Resilient to Additive Attacks, with Applications to Secure Computation

We study the question of protecting arithmetic circuits against additive attacks that can add an arbitrary fixed value to each wire in the circuit. We show how to transform an arithmetic circuit C into a functionally equivalent, randomized circuit C’ of comparable size, such that the effect of any additive attack on the wires of C’ can be simulated (up to a small statistical distance) by an additive attack on just the inputs and outputs of C.

Our study of this question is motivated by the goal of simplifying and improving protocols for secure multiparty computation (MPC). It is typically the case that securing MPC protocols against active adversaries is much more difficult than securing them against passive adversaries. We observe that in simple MPC protocols that were designed to protect circuit evaluation only against passive adversaries, the effect of any active adversary corresponds precisely to an additive attack on the circuit’s wires. Thus, to securely evaluate a circuit C in the presence of active adversaries, it suffices to apply the passive-case protocol to a corresponding circuit C’ which is secure against additive attacks. We use this methodology to simplify feasibility results and obtain efficiency improvements in several standard MPC models.

Joint work with Daniel Genkin, Manoj Prabhakaran, Amit Sahai, and Eran Tromer.

Speaker: Omer Paneth
Title: Publicly-Verifiable Non-Interactive Arguments for Delegating Computations

We construct publicly verifiable non-interactive arguments that can be used to delegate polynomial time computations. These computationally sound proof systems are completely non-interactive in the common reference string model. The verifier’s running time is nearly-linear in the input length, and poly-logarithmic in the complexity of the delegated computation. Our protocol is based on graded encoding schemes, introduced by Garg, Gentry and Halevi (Eurocrypt 2012). Security is proved under a falsifiable and arguably simple cryptographic assumption about graded encodings. All prior publicly verifiable non-interactive argument systems were based on non-falsifiable knowledge assumptions. Our new result builds on the beautiful recent work of Kalai, Raz and Rothblum (STOC 2014), who constructed privately verifiable 2-message arguments. While building on their techniques, our protocols avoid no-signaling PCPs, and we obtain a simplified and modular analysis.

As a second contribution, we also construct a publicly verifiable non-interactive argument for (logspace-uniform) computations of bounded depth. The verifier’s complexity grows with the depth of the circuit. This second protocol is adaptively sound, and its security is based on a falsifiable assumption about the hardness of a search problem on graded encodings (a milder cryptographic assumption). This result builds on the interactive proof of Goldwasser, Kalai and Rothblum (STOC 2008), using graded encodings to construct a non-interactive version of their protocol.

Joint work with Guy Rothblum.

Speaker: Elaine Shi
Title: Programs to Circuits: Towards a Programming Language for Cryptography

Modern cryptography (e.g., secure multi-party computation, fully-homomorphic encryption, program obfuscation) commonly models computation as “circuits”. To make modern cryptography work for real-world programs, it is necessary to compile “programs” into compact “circuits”. The key difficulty is that programs make dynamic memory accesses, whereas circuits have static wiring. To address this challenge, we need efficient Oblivious RAM and oblivious algorithms.

In this talk, I will first describe Circuit ORAM, a new ORAM scheme that yields very small circuit size. Circuit ORAM shows the tightness of certain stronger interpretations of the well-known Goldreich-Ostrovsky lower bound.

Next, I will describe ObliVM, a programming framework that compiles real-life programs into compact circuits, while offering formal security guarantees.

Speaker: Sergey Gorbunov
Title: Leveled Fully Homomorphic Signatures from Standard Lattices

In a homomorphic signature scheme, a user Alice signs some large dataset x using her secret signing key and uploads the signed data to an untrusted remote server. The server can then run some computation y=f(x) over the signed data and homomorphically derive a short signature \sigma_{f,y} certifying that y is the correct output of the computation f. Anybody can verify the tuple (f, y, \sigma_{f,y}) using Alice’s public verification key and become convinced of this fact without having to retrieve the entire underlying data.

In this work, we construct the first (leveled) fully homomorphic signature schemes that can evaluate arbitrary circuits over signed data. Only the maximal depth d of the circuits needs to be fixed a-priori at setup, and the size of the evaluated signature grows polynomially in d, but is otherwise independent of the circuit size or the data size. Our solution is based on the (sub-exponential) hardness of the small integer solution (SIS) problem in standard lattices. In the standard model, we get a scheme with large public parameters whose size exceeds the total size of a dataset. In the random-oracle model, we get a scheme with short public parameters. In both cases, the schemes can be used to sign many different datasets. The complexity of verifying a signature for a computation f is at least as large as that of computing f, but can be amortized when verifying the same computation over many different datasets. Furthermore, the signatures can be made context-hiding so as not to reveal anything about the data beyond the outcome of the computation.

These results offer a significant improvement in capabilities and assumptions over the best prior homomorphic signature schemes, which were limited to evaluating polynomials of constant degree.

As a building block of independent interest, we introduce and construct a new object called homomorphic trapdoor functions (HTDF) which conceptually unites homomorphic encryption and signatures.

Joint work with Vinod Vaikuntanathan (MIT) and Daniel Wichs (Northeastern).


The Charles River Crypto Day is back! We now plan to make it a regular event held about once every two months. Please join us on Friday, October 24 at MIT for the first Crypto Day of 2014-2015.

Location: MIT Stata Center Building 32 Gates Tower, 8th floor Room G-882 (Hewlett).

Program:

9:00 – 9:30. Introduction/Coffee
9:30 – 10:30.
Ron Rivest, MIT
Spritz—A spongy RC4-like stream cipher and hash function
Slides
11:00 – 12:00. Allison Bishop Lewko, Columbia
Witness Encryption and Indistinguishability Obfuscation from the Multilinear Subgroup Elimination Assumption
Slides
12:00 – 2:00. Lunch (provided)
2:00 – 3:00. Alessandro Chiesa, ETH Zurich
Scalable Zero Knowledge via Cycles of Elliptic Curves
3:30 – 4:30. Alon Rosen, IDC Herzlia
An Algebraic Approach to Non-Malleability
Slides

Abstracts:


Speaker: Ron Rivest (MIT)
Title/Abstract:  Spritz—A spongy RC4-like stream cipher and hash function

Abtract: We reconsider the design of the stream cipher RC4, and proposes an improved variant, which we call “Spritz”.

Our work leverages the considerable cryptanalytic work done on the original RC4 and its proposed variants. It also uses simulations extensively to search for biases and to guide the selection of intermediate expressions.

We estimate that Spritz can produce output with about 24 cycles/byte of computation. Furthermore, our statistical tests suggest that about 2^81 bytes of output are needed before one can reasonably distinguish Spritz output from random output; this is a marked improvement over RC4.

In addition, we formulate Spritz as a “sponge (or sponge-like) function,” (see Bertoni et al), which can Absorb new data at any time, and from which one can Squeeze pseudorandom output sequences of arbitrary length. Spritz can thus be easily adapted for use as a cryptographic hash function, an encryption algorithm, or a message-authentication code generator. (However, in hash-function mode, Spritz is rather slow.)

Joint work with Jacob Schuldt.


Speaker: Allison Bishop Lewko (Cloumbia U)
Title: Witness encryption and indistinguishability obfuscation from the multilinear subgroup elimination assumption

Abstract:
We present constructions of witness encryption and indistinguishability obfuscation along with security reductions to the multilinear subgroup elimination assumption. This assumption is a natural multilinear extension of the subgroup decision assumptions used in bilineargroups.

This talk is based on joint works with Gentry and Waters and with Gentry, Sahai and Waters.


Speaker: Alessandro Chiesa (ETH Zurich)
Title: Scalable Zero Knowledge via Cycles of Elliptic Curves

Abstract: Non-interactive zero-knowledge proofs for general NP statements are a powerful cryptographic primitive. Recent work has achieved theoretical constructions and working implementations of zero-knowledge proofs that are short and easy to verify.

Alas, all prior implementations suffer from severe scalability limitations: the proving key’s size and the prover’s space complexity grow with the size of the computation being proved.

The bootstrapping technique of Bitansky et al. (STOC 2013), following Valiant (TCC 2008), offers an approach to scalability, by recursively composing proofs, but it has never been realized in practice, due to enormous computational cost.

In this work, by leveraging new elliptic-curve cryptographic techniques, we achieve the first practical implementation of recursive proof composition, and thereby achieve the first implementation of *scalable zero knowledge*.

Joint work with Eli Ben-Sasson, Eran Tromer, and Madars Virza.


Speaker: Alon Rosen (IDC Herzliya)
Title: An Algebraic Approach to Non-Malleability

Abstract: I will present a new technique for constructing non-malleable protocols with only a single “slot”. Two direct byproducts of our ideas are a four round non-malleable commitment and a four round non-malleable zero-knowledge argument, the latter matching the round complexity of the best known zero-knowledge arguments (without the non-malleability requirement). The protocols are based on the existence of one-way functions and admit very efficient instantiations via standard homomorphic commitments and sigma protocols.

Our analysis relies on algebraic reasoning, and makes use of error correcting codes in order to ensure that committers’ tags differ in many coordinates. One way of viewing our construction is as a method for combining many atomic sub-protocols in a way that simultaneously amplifies soundness and non-malleability, thus requiring much weaker guarantees to begin with, and resulting in a protocol which is much trimmer in complexity compared to the existing ones.

Joint work with Vipul Goyal, Silas Richelson and Margarita Vald.