In this work, we present a new class of polynomial-time attacks on the original multilinear maps of Garg, Gentry, and Halevi (2013). Previous polynomial-time attacks on GGH13 were "zeroizing" attacks that generally required the availability of low-level encodings of zero. Most significantly, such zeroizing attacks were not applicable to candidate indistinguishability obfuscation (iO) schemes. iO has been the subject of intense study. To address this gap, we introduce annihilation attacks, which attack multilinear maps using non-linear polynomials. Annihilation attacks can work in situations where there are no low-level encodings of zero. Using annihilation attacks, we give the first polynomial-time cryptanalysis of candidate iO schemes over GGH13. More specifically, we exhibit two simple programs that are functionally equivalent, and show how to efficiently distinguish between the obfuscations of these two programs. Given the enormous applicability of iO, it is important to devise iO schemes that can avoid attack. We discuss some initial directions for safeguarding against annihilating attacks.

All known candidate indistinguishability obfuscation (iO) schemes rely on candidate multilinear maps. Until recently, the strongest proofs of security available for iO candidates were in a generic model that only allows "honest" use of the multilinear map. Most notably, in this model the zero-test procedure only reveals whether an encoded element is 0, and nothing more.However, this model is inadequate: there have been several attacks on multilinear maps that exploit extra information revealed by the zero-test procedure. In particular, Miles, Sahai and Zhandry (Crypto'16) recently gave a polynomial-time attack on several iO candidates when instantiated with the multilinear maps of Garg, Gentry, and Halevi (Euro-crypt' 13), and also proposed a new "weak multilinear map model" that captures all known polynomial-time attacks on GGH13.In this work, we give a new iO candidate which can be seen as a small modification or generalization of the original candidate of Garg, Gentry,Halevi, Raykova, Sahai, and Waters (FOCS'13). We prove its security in the weak multilinear map model, thus giving the first iO candidate that is provably secure against all known polynomial-time attacks on GGH13. The proof of security relies on a new assumption about the hardness of computing annihilating polynomials, and we show that this assumption is implied by the existence of pseudorandom functions in NC1.

Recent devastating attacks by Cheon et al. [Eurocrypt'15] and others have highlighted significant gaps in our intuition about security in candidate multilinear map schemes, and in candidate obfuscators that use them. The new attacks, and some that were previously known, are typically called "zeroizing" attacks because they all crucially rely on the ability of the adversary to create encodings of 0. In this work, we initiate the study of post-zeroizing obfuscation, and we obtain a key new mathematical tool to analyze security in a post-zeroizing world. Our new mathematical tool allows for analyzing polynomials constructed by the adversary when given encodings of randomized matrices arising from a general matrix branching program. This technique shows that the types of encodings an adversary can create are much more restricted than was previously known, and is a crucial step toward achieving post-zeroizing security. We also believe the technique is of independent interest, as it yields efficiency improvements for existing schemes – efficiency improvements that have already found application in other settings. Finally, we show how to apply our new mathematical tool to the special case of evasive functions. We show that our obfuscator survives all known attacks on the underlying multilinear maps, by proving that no top-level encodings of 0 can be created by a generic-model adversary. Previous obfuscators (for both evasive and general functions) were either analyzed in a less-conservative "pre-zeroizing" model that does not capture recent attacks, or were proved secure relative to assumptions that no longer have any plausible instantiation due to zeroizing attacks.

We reduce non-deterministic time T≥2n to a 3SAT instance ϕ of quasilinear size |ϕ|=T⋅logO(1)⁡T such that there is an explicit NC0 circuit C that encodes ϕ in the following way: on input a (log⁡|ϕ|)-bit index i, C outputs the ith clause of ϕ. The previous best result was C in NC1. Even in the simpler setting of polynomial size (|ϕ|=poly(T)), the previous best result was C in AC0. More generally, for any time T≥n and parameter r≤n we obtain |ϕ|=max⁡(T,2n/r)⋅(nlog⁡T)O(1), and each output bit of C is a decision tree of depth O(log⁡r). As an application, we tighten Williams' connection between satisfiability algorithms and circuit lower bounds (STOC 2010; SIAM J. Comput. 2013).

We study the complexity of black-box constructions of pseudorandom functions (PRFs) from one-way functions (OWFs) that are secure against non-uniform adversaries. We show that if OWFs do not exist, then given as an oracle any (inefficient) hard-to-invert function, one can compute a PRF in polynomial time with only k ( n ) oracle queries, for any k ( n )= ω (1) (e.g., k ( n )=log ∗ n ). Combining this with the fact that OWFs imply PRFs, we show that unconditionally there exists a (pathological) construction of a PRF from OWF making at most k ( n ) queries. This result shows a limitation of a certain class of techniques for proving efficiency lower bounds on the construction of PRFs from OWFs. Our result builds on the work of Reingold, Trevisan, and Vadhan (TCC’04), who show that when OWFs do not exist there is a pseudorandom generator (PRG) construction that makes only one oracle query to the hard-to-invert function. Our proof combines theirs with the Nisan–Wigderson generator (JCSS’94), and with a recent technique by Berman and Haitner (TCC’12). Working in the same context (i.e., when OWFs do not exist), we also construct a poly-time PRG with arbitrary polynomial stretch that makes non-adaptive queries to an (inefficient) one-bit-stretch oracle PRG. This contrasts with the well-known adaptive stretch-increasing construction due to Goldreich and Micali. Both above constructions simply apply an affine function (parity or its complement) to the query answers. We complement this by showing that if the post-processing is restricted to only taking projections then non-adaptive constructions of PRFs, or even linear-stretch PRGs, can be ruled out.

Recent devastating attacks by Cheon et al. [Eurocrypt’15] and others have highlighted significant gaps in our intuition about security in candidate multilinear map schemes, and in candidate obfuscators that use them. The new attacks, and some that were previously known, are typically called “zeroizing” attacks because they all crucially rely on the ability of the adversary to create encodings of 0. In this work, we initiate the study of post-zeroizing obfuscation, and we present a construction for the special case of evasive functions. We show that our obfuscator survives all known attacks on the underlying multilinear maps, by proving that no encodings of 0 can be created by a generic-model adversary. Previous obfuscators (for both evasive and general functions) were either analyzed in a less-conservative “pre-zeroizing” model that does not capture recent attacks, or were proved secure relative to assumptions that are now known to be false. To prove security, we introduce a new technique for analyzing polynomials over multilinear map encodings. This technique shows that the types of encodings an adversary can create are much more restricted than was previously known, and is a crucial step toward achieving postzeroizing security. We also believe the technique is of independent interest, as it yields efficiency improvements for existing schemes. This paper subsumes a previous work of Sahai and Zhandry [SZ14]. Supported in part by a DARPA/ONR PROCEED award, NSF grants 1228984, 1136174, 1118096, 1065276,0916574 and 0830803, a Xerox Faculty Research Award, a Google Faculty Research Award, an equipment grant from Intel, and an Okawa Foundation Research Grant. This material is based upon work supported by the Defense Advanced Research Projects Agency through the U.S. Office of Naval Research under Contract N00014-11-10389. The views expressed are those of the author and do not reflect the official policy or position of the Department of Defense, the National Science Foundation, or the U.S. Government.

We extend the recent zeroizing attacks of Cheon, Han, Lee, Ryu and Stehlé (Eurocrypt’15) on multilinear maps to settings where no encodings of zero below the maximal level are available. Some of the new attacks apply to the CLT13 scheme (resulting in a total break) while others apply to (a variant of) the GGH13 scheme (resulting in a weak-DL attack). We also note the limits of these zeroizing attacks.

Obfuscation, the task of compiling circuits or programs to make the internal computation unintelligible while preserving input/output functionality, has become an object of central focus in the cryptographic community. A work of Garg et al. [FOCS 2013] gave the first candidate obfuscator for general polynomial-size circuits, and led to several other works constructing candidate obfuscators. Each of these constructions is built upon another cryptographic primitive called a multilinear map, or alternatively a graded encoding scheme. Several of these candidates have been shown to achieve the strongest notion of security (virtual black-box, or VBB) against “purely algebraic” attacks in a model that we call the fully-restricted graded encoding model. In this model, each operation performed by an adversary is required to obey the algebraic restrictions of the graded encoding scheme. These restrictions essentially impose strong forms of homogeneity and multilinearity on the allowed polynomials. While important, the scope of the security proofs is limited by the stringency of these restrictions. We propose and analyze another variant of the Garg et al. obfuscator in a setting that imposes fewer restrictions on the adversary, which we call the arithmetic setting. This setting captures a broader class of attacks than considered in previous works. We also explore connections between notions of obfuscation security and longstanding questions in arithmetic circuit complexity. Our results include the following. � In the arithmetic setting where the adversary is limited to creating multilinear, but not necessarily homogenous polynomials, we obtain an unconditional proof of VBB security. This requires a substantially different analysis than previous security proofs. � In the arithmetic setting where the adversary can create polynomials of arbitrary degree, we show that a proof of VBB security for any currently available candidate obfuscator would imply VP 6 VNP. To complement this, we show that a weaker notion of security (indistinguishability obfuscation) can be achieved unconditionally in this setting, and that VBB security can be achieved under a complexity-theoretic assumption related to the ETH.

We study the classical problem of privacy amplification, where two parties Alice and Bob share a weak secret X of min-entropy k, and wish to agree on secret key R of length m over a public communication channel completely controlled by a computationally unbounded attacker Eve. Despite being extensively studied in the literature, the problem of designing “optimal” efficient privacy amplification protocols is still open, because there are several optimization goals. The first of them is (1) minimizing the entropy loss L = k − m. Other important considerations include (2) minimizing the number of communication rounds, (3) maintaining security even after the secret key is used (this is called post-application robustness), and (4) ensuring that the protocol P does not leak some “useful information” about the source X (this is called source privacy). Additionally, when dealing with a very long source X, as happens in the so-called Bounded Retrieval Model (BRM), extracting as long a key as possible is no longer the goal. Instead, the goals are (5) to touch as little of X as possible (for efficiency), and (6) to be able to run the protocol many times on the same X, extracting multiple secure keys. Achieving goals (1)-(4) (or (2)-(6) in BRM) simultaneously has remained open. In this work we improve upon the current state-of-the-art, by designing a variety of new privacy amplification protocols, thereby achieving the following goals for the first time:

It has been widely observed that there is a significant gap between the way that many cryptographic primitives are constructed and analyzed by the theory/foundations community, and the way that they are implemented, used, and attacked in practice. In this dissertation we study from two different perspectives the complexity of constructing cryptographic primitives, with an eye towards bridging this gap.

We study which functions can be computed by efficient circuits whose gate connections are very easy to compute. We give quasilinear-size circuits for sorting whose connections can be computed by decision trees with depth logarithmic in the length of the gate description. We also show that NL has NC2 circuits whose connections can be computed with constant locality. ∗Supported by NSF grants CCF-0845003, CCF-1319206. Email: {hamid,enmiles,viola}@ccs.neu.edu

We show that if NC 1 ≠ L, then for every element α of the alternating group A t , circuits of depth O (log t ) cannot distinguish between a uniform vector over ( A t ) t with product = α and one with product = identity. Combined with a recent construction by the author and Viola in the setting of leakage-resilient cryptography [STOC '13], this gives a compiler that produces circuits withstanding leakage from NC 1 (assuming NC 1 ≠ L). For context, leakage from NC 1 breaks nearly all previous constructions, and security against leakage from P is impossible. We build on work by Cook and McKenzie [J. Algorithms '87] establishing the relationship between L = logarithmic space and the symmetric group S t . Our techniques include a novel algorithmic use of commutators to manipulate the cycle structure of permutations in A t .

In today’s lecture we study one-time message authentication codes (MACs) which are secure in an information-theoretic sense. We will see that, compared to informationtheoretically secure encryption, significantly better parameters can be achieved. We will also study such MACs in the setting of imperfect randomness, i.e. when the secret key is not drawn from the uniform distribution but rather is only guaranteed to have some min-entropy.

We show how to efficiently compile any given circuit C into a leakage-resistant circuit C' such that any function on the wires of C' that leaks information during a computation C'(x) yields advantage in computing the product of |C'| Ω(1) elements of the alternating group A u . In combination with new compression bounds for A u products, also obtained here, C' withstands leakage from virtually any class of functions against which average-case lower bounds are known. This includes communication protocols, and AC 0 circuits augmented with few arbitrary symmetric gates. If NC 1 ' TC 0 then then the construction resists TC 0 leakage as well. We also conjecture that our construction resists NC 1 leakage. In addition, we extend the construction to the multi-query setting by relying on a simple secure hardware component. We build on Barrington's theorem [JCSS '89] and on the previous leakage-resistant constructions by Ishai et al. [Crypto '03] and Faust et al. [Eurocrypt '10]. Our construction exploits properties of A u beyond what is sufficient for Barrington's theorem.

This article takes a new step towards closing the gap between pseudorandom functions (PRF) and their popular, bounded-input-length counterparts. This gap is both quantitative, because these counterparts are more efficient than PRF in various ways, and methodological, because these counterparts usually fit in the substitution-permutation network paradigm (SPN), which has not been used to construct PRF. We give several candidate PRF F i that are inspired by the SPN paradigm. Most of our candidates are more efficient than previous ones. Our main candidates are as follows. — F 1 : {0,1} n → {0,1} n is an SPN whose S-box is a random function on b bits given as part of the seed. We prove that F 1 resists attacks that run in time ≤ 2 ϵb . — F 2 : {0,1} n → {0,1} n is an SPN where the S-box is (patched) field inversion, a common choice in practical constructions. We show that F 2 is computable with boolean circuits of size n ⋅ log O (1) n and that it has exponential security 2 Ω( n ) against linear and differential cryptanalysis. — F 3 : {0,1} n → {0,1} is a nonstandard variant on the SPN paradigm, where “states” grow in length. We show that F 3 is computable with TC 0 circuits of size n 1 + ϵ , for any ϵ > 0, and that it is almost 3-wise independent. — F 4 : {0,1} n → {0,1} uses an extreme setting of the SPN parameters (one round, one S-box, no diffusion matrix). The S-box is again (patched) field inversion. We show that F 4 is computable by circuits of size n ⋅ log O (1) n and that it fools all parity tests on ≤2 0.9 n outputs. Assuming the security of our candidates, our work narrows the gap between the Natural Proofs barrier and existing lower bounds in three models: circuits, TC 0 circuits, and Turing machines.

Common presentations of the NP-completeness of SAT suffer from two drawbacks which hinder the scope of this flagship result. First, they do not apply to machines equipped with random-access memory, also known as direct-access memory, even though this feature is critical in basic algorithms. Second, they incur a quadratic blow-up in parameters, even though the distinction between, say, linear and quadratic time is often as critical as the one between polynomial and exponential. But the landmark result of a sequence of works overcomes both these drawbacks simultaneously! [HS66, Sch78, PF79, Coo88, GS89, Rob91] We give the first self-contained rendering of these results, along the way simplifying and extending the proof. Compared to previous proofs, ours more directly reduces random-access machines to circuits, bypassing sequential Turing machines, and using a simple, well-known sorting algorithm: Odd-Even Merge sort [Bat68]. We note that the impressive works [BSCGT12b, BSCGT12a] give the stronger type of reduction where a candidate satisfying assignment to the SAT instance can be verified probabilistically in polylogarithmic time. These works are independent from ours.

We study the complexity of black-box constructions of linear-stretch pseudorandom generators starting from a 1-bit stretch oracle generator G . We show that there is no construction which makes non-adaptive queries to G and then just outputs bits of the answers. The result extends to constructions that both work in the non-uniform setting and are only black-box in the primitive G (not the proof of correctness), in the sense that any such construction implies NP/poly ≠ P/poly. We then argue that not much more can be obtained using our techniques: via a modification of an argument of Reingold, Trevisan, and Vadhan (TCC '04), we prove in the non-uniform setting that there is a construction which only treats the primitive G as black-box, has polynomial stretch, makes non-adaptive queries to the oracle G , and outputs an affine function (i.e., parity or its complement) of the oracle query answers.

We put forth several simple candidate pseudorandom functions fk : {0,1} n → {0,1} with security (a.k.a. hardness) 2 n that are inspired by the AES block-cipher by Daemen and Rijmen (2000). The functions are computable more efficiently, and use a shorter key (a.k.a. seed) than previous constructions. In particular, we have candidates computable by

This paper takes a new step towards closing the troubling gap between pseudorandom functions (PRF) and their popular, bounded-input-length counterpart: block ciphers. This gap is both quantitative, because block-ciphers are more efficient than PRF in various ways, and methodological, because block-ciphers usually fit in the substitution-permutation network paradigm (SPN) which has no counterpart in PRF. We give several candidate PRF Fi that are inspired by the SPN paradigm. This paradigm involves a “substitution function” (S-box). Our main candidates are: F1 : {0, 1}n → {0, 1}n is an SPN whose S-box is a random function on b = O(lg n) bits, given as part of the seed. We prove unconditionally that F1 resists attacks that run in time ≤ 2ǫb. Setting b = ω(lg n) we obtain an inefficient PRF, which however seems to be the first such construction using the SPN paradigm. F2 : {0, 1}n → {0, 1}n is an SPN where the S-box is (patched) field inversion, a common choice in block ciphers. F2 is computable with Boolean circuits of size n·log n, and in particular with seed length n·log n. We prove that this candidate has exponential security 2Ω(n) against linear and differential cryptanalysis. F3 : {0, 1}n → {0, 1} is a non-standard variant on the SPN paradigm, where “states” grow in length. F3 is computable with size n1+ǫ, for any ǫ > 0, in the restricted circuit class TC of unbounded fan-in majority circuits of constant-depth. We prove that F3 is almost 3-wise independent. F4 : {0, 1}n → {0, 1} uses an extreme setting of the SPN parameters (one round, one S-box, no diffusion matrix). The S-box is again (patched) field inversion. We prove that this candidate is a small-bias generator (for tests of weight up to 20.9n). Assuming the security of our candidates, our work also narrows the gap between the“Natural Proofs barrier” [Razborov & Rudich; JCSS ’97] and existing lower bounds, in three models: unbounded-depth circuits, TC circuits, and Turing machines. In particular, the efficiency of the circuits computing F3 is related to a result by Allender and Koucky [JACM ’10] who show that a lower bound for such circuits would imply a lower bound for TC. ∗Supported by NSF grant CCF-0845003. Email: {enmiles,viola}@ccs.neu.edu ISSN 1433-8092 Electronic Colloquium on Computational Complexity, Revision 1 of Report No. 76 (2011)

Nepomnjascii's Theorem states that for all 0 <= ϵ< 1 and k > 0 the class of languages recognized in nondeterministic time n^k and space n^ϵ, NTISP[n^k, n^ϵ], is contained in the linear time hierarchy. By considering restrictions on the size of the universal quantifiers in the linear time hierarchy, this paper refines Nepomnjascii's result to give a sub- hierarchy, Eu-LinH, of the linear time hierarchy that is contained in NP and which contains NTISP[n^k, n^ϵ]. Hence, Eu-LinH contains NL and SC. This paper investigates basic structural properties of Eu-LinH. Then the relationships between Eu-LinH and the classes NL, SC, and NP are considered to see if they can shed light on the NL = NP or SC = NP questions. Finally, a new hierarchy, zeta -LinH, is defined to reduce the space requirements needed for the upper bound on Eu-LinH.