Factoring and pairings are not necessary for io: Circular-secure lwe suffices

Z Brakerski, N Döttling, S Garg… - Cryptology ePrint Archive, 2020 - eprint.iacr.org
Cryptology ePrint Archive, 2020eprint.iacr.org
We construct indistinguishability obfuscation (iO) solely under circular-security properties of
encryption schemes based on the Learning with Errors (LWE) problem. Circular-security
assumptions were used before to construct (non-leveled) fully-homomorphic encryption
(FHE), but our assumption is stronger and requires circular randomness-leakage-resilience.
In contrast with prior works, this assumption can be conjectured to be post-quantum secure;
yielding the first provably secure iO construction that is (plausibly) post-quantum secure. Our …
Abstract
We construct indistinguishability obfuscation (iO) solely under circular-security properties of encryption schemes based on the Learning with Errors (LWE) problem. Circular-security assumptions were used before to construct (non-leveled) fully-homomorphic encryption (FHE), but our assumption is stronger and requires circular randomness-leakage-resilience. In contrast with prior works, this assumption can be conjectured to be post-quantum secure; yielding the first provably secure iO construction that is (plausibly) post-quantum secure. Our work follows the high-level outline of the recent work of Gay and Pass [ePrint 2020], who showed a way to remove the heuristic step from the homomorphic-encryption based iO approach of Brakerski, Döttling, Garg, and Malavolta [EUROCRYPT 2020]. They thus obtain a construction proved secure under circular security assumption of natural homomorphic encryption schemes---specifically, they use homomorphic encryption schemes based on LWE and DCR, respectively. In this work we show how to remove the DCR assumption and remain with a scheme based on the circular security of LWE alone. Along the way we relax some of the requirements in the Gay-Pass blueprint and thus obtain a scheme that is secure under a relaxed assumption. Specifically, we do not require security in the presence of a key-cycle, but rather only in the presence of a key-randomness cycle.
eprint.iacr.org
以上显示的是最相近的搜索结果。 查看全部搜索结果