Breaking the Sub-Exponential Barrier in Obfustopia

Abstract

Indistinguishability obfuscation ( 𝑖 ) has emerged as a surprisingly powerful notion. Almost all known cryptographic primitives can be constructed from general purpose 𝑖 and other minimalistic assumptions such as one-way functions. A major challenge in this direction of research is to develop novel techniques for using 𝑖 since 𝑖 by itself offers virtually no protection for secret information in the underlying programs. When dealing with complex situations, often these techniques have to consider an exponential number of hybrids (usually one per input) in the security proof. This results in a sub-exponential loss in the security reduction. Unfortunately, this scenario is becoming more and more common and appears to be a fundamental barrier to many current techniques.

A parallel research challenge is building obfuscation from simpler assumptions. Unfortunately, it appears that such a construction would likely incur an exponential loss in the security reduction. Thus, achieving any application of 𝑖 from simpler assumptions would also require a sub-exponential loss, even if the 𝑖 -to-application security proof incurred a polynomial loss. Functional encryption (  ) is known to be equivalent to 𝑖 up to a sub-exponential loss in the  -to- 𝑖 security reduction; yet, unlike 𝑖 ,  can be achieved from simpler assumptions (namely, specific multilinear map assumptions) with only a polynomial loss.

In the interest of basing applications on weaker assumptions, we therefore argue for using  as the starting point, rather than 𝑖 , and restricting to reductions with only a polynomial loss. By significantly expanding on ideas developed by Garg, Pandey, and Srinivasan (CRYPTO 2016), we achieve the following early results in this line of study: We construct universal samplers based only on polynomially-secure public-key  . As an application of this result, we construct a non-interactive multiparty key exchange (NIKE) protocol for an unbounded number of users without a trusted setup. Prior to this work, such constructions were only known from indistinguishability obfuscation.

We also construct trapdoor one-way permutations (OWP) based on polynomially-secure public-key  . This improves upon the recent result of Bitansky, Paneth, and Wichs (TCC 2016) which requires 𝑖 of sub-exponential strength. We proceed in two steps, first giving a construction requiring 𝑖 of polynomial strength, and then specializing the  -to- 𝑖 conversion to our specific application.

Many of the techniques that have been developed for using 𝑖 , including many of those based on the “punctured programming” approach, become inapplicable when we insist on polynomial reductions to  . As such, our results above require many new ideas that will likely be useful for future works on basing security on  .