The impossibility of obfuscation with auxiliary input or a universal simulator

0.31 MB·

by  Nir Bitansky

The Impossibility of Obfuscation with
Auxiliary Input or a Universal Simulator
NirBitansky∗ RanCanetti† HenryCohn‡ ShafiGoldwasser§
YaelTaumanKalai¶ OmerPaneth(cid:107) AlonRosen∗∗
4 February9,2014
1
0
2

b
Abstract
e
F
Inthispaperweshowthattheexistenceofgeneralindistinguishabilityobfuscatorsconjecturedina

3 fewrecentworksimplies,somewhatcounterintuitively,strongimpossibilityresultsforvirtualblackbox
1
obfuscation. Inparticular,weshowthatindistinguishabilityobfuscationforallcircuitsimplies:

] • Theimpossibilityofaverage-casevirtualblackboxobfuscationwithauxiliaryinputforanycircuit
R
familywithsuper-polynomialpseudo-entropy. Suchcircuitfamiliesincludeallpseudo-random
C
functionfamilies,andallfamiliesofencryptionalgorithmsandrandomizeddigitalsignaturesthat
s. generatetheirrequiredcoinflipspseudo-randomly. Impossibilityholdsevenwhentheauxiliary
c input depends only on the public circuit family, and not the specific circuit in the family being
[
obfuscated.

3
• Theimpossibilityofaverage-casevirtualblackboxobfuscationwithauniversalsimulator(withor
v
withoutanyauxiliaryinput)foranycircuitfamilywithsuper-polynomialpseudo-entropy.
8
4 TheseboundssignificantlystrengthentheimpossibilityresultsofGoldwasserandKalai(STOC2005).
3
0
.
1
0
4
1
:
v
i
X
r
a
∗TelAvivUniversity,[email protected]. SupportedbyanIBMPh.D.Fellowship,andtheCheckPointInstitutefor
InformationSecurity.
†BostonUniversityandTelAvivUniversity, [email protected]. SupportedbytheCheckPointInstituteforInformation
Security,anNSFEAGERgrant,andanNSFAlgorithmicFoundationsgrant1218461.
‡MicrosoftResearch,OneMemorialDrive,Cambridge,MA02142,[email protected].
§MITandtheWeizmannInstituteofScience,[email protected].
¶MicrosoftResearch,OneMemorialDrive,Cambridge,MA02142,[email protected].
(cid:107)BostonUniversity,[e-mail]dforgraduatestudentsintheoreticalcomputerscienceand
anNSFAlgorithmicfoundationsgrant1218461.
∗∗EfiAraziSchoolofComputerScience,IDCHerzliya,Israel,[email protected]/12
andbytheERCundertheEU’sSeventhFrameworkProgramme(FP/2007-2013)ERCGrantAgreementn.307952.
1 Introduction
Thestudyofprogramobfuscation—amethodthattransformsaprogram(say,describedasaBooleancircuit)
intoaformthatisexecutable,butotherwisecompletelyunintelligible—hasbeenalongstandingresearch
directionincryptography. ItwasformalizedbyBaraketal.[BGI+01],whoformulatedanumberofsecurity
notionsforthistask. Thestrongestandmostapplicableofthesenotionsisvirtualblackbox(VBB)obfuscation,
whichrequiresthatanyadversarytryingtolearninformationfromanobfuscatedprogramcannotdobetter
thanasimulatorthatisgivenonlyblack-boxaccesstotheprogram. Baraketal.constructedcontrivedfunction
familiesthatcannotbeVBBobfuscated,thusrulingoutauniversalobfuscator,buttheyleftopenthepossibility
thatlargeclassesofprogramsmightstillbeobfuscated. Subsequently,VBBobfuscatorswereproducedonly
foranumberofrestricted(andmostlysimple)classesofprograms[Can97,CD08,CRV10,BR13a,BBC+14].
Todate,theclassificationofwhichprogramscanorcannotbeVBBobfuscatedisstillnotwellunderstood.
In contrast, recent progress for more relaxed notions of obfuscation suggests a much more positive
picture: Gargetal.[GGH+13]proposedacandidateconstructionforindistinguishabilityobfuscationforall
circuits. ThisnotionrequiresonlythatitishardtodistinguishanobfuscationofC fromanobfuscationof
0
C ,whereC andC arecircuitsofthesamesizethatcomputethesamefunction[BGI+01]. Indeed,unlike
1 0 1
thecaseofVBBobfuscation,therearenoknownimpossibilitytheoremsforindistinguishabilityobfuscation.
Furthermore,theGargetal.constructionandvariantsthereofwereshowntosatisfytheVBBguaranteein
idealalgebraicoraclemodels[CV13,BR13b,BGK+13],althoughtheseresultshavenotprovedusefulsofar
inachievingVBBobfuscationinthestandardmodelofcomputation.
Althoughindistinguishabilityobfuscationmightinitiallysoundarcane,itissurprisinglypowerful. For
example,itamountstobestpossibleobfuscation[GR07],inthesensethatanythingthatcanbehiddenby
someobfuscatorwillbehiddenbyeveryindistinguishabilityobfuscator. Subsequentto[GGH+13],aflood
ofresultshaveappearedshowingthatindistinguishabilityobfuscationsufficesformanyapplications,suchas
theconstructionofpublic-keyencryptionfromprivate-keyencryption,theexistenceofdeniableencryption,
theexistenceofmulti-inputfunctionalencryption,andmore[SW13,GGH+13,HSW13,GGJS13].
Still,formanyprogramclassesthemeaningfulnessandapplicabilityofindistinguishabilityobfuscationis
unclear. Thus,understandingwhichclassesofprogramsareVBBobfuscatableremainsofcentralimportance.
Aimingtowardssuchacharacterization,GoldwasserandKalai[GK05]provedstronglimitationsonVBB
obfuscationforabroadclassofpseudo-entropicprograms,includingmanycryptographicfunctions,such
as pseudo-random functions and certain natural instances of encryption and signatures. They showed
the impossibility of a form of VBB security with respect to adversaries that have some a priori auxiliary
information. Whentheauxiliaryinformationdependsontheactualobfuscatedprogram,theyshowedthat
noclassofpseudo-entropicfunctionscanbeobfuscated,assumingVBBobfuscationforasimpleclassof
point-filterfunctions. Forauxiliaryinformationthatdependsonlyontheclassofprogramstobeobfuscated,
theygaveanunconditionalresult,butonlyforarestrictedclassofprograms(thosethatevaluateNP-filter
functions).
Thisworkinanutshell. WestrengthentheknownimpossibilityresultsforVBBobfuscationwithauxiliary
input,andwesuggestadifferent,compellinginterpretationofauxiliary-inputobfuscation. Inasomewhat
strange twist, our negative results on VBB obfuscation are based on the existence of indistinguishability
obfuscation,whichistypicallyviewedpositively. Specifically:
• We weaken the conditions for the impossibility of dependent auxiliary-input VBB obfuscation to
witnessencryption,whichinturnfollowsfromindistinguishabilityobfuscation.
• Weextendtheimpossibilityofindependentauxiliary-inputVBBobfuscationtoallpseudo-entropic
1
functions,assumingindistinguishabilityobfuscation.
• Weobservethatauxiliary-inputVBBobfuscationisequivalenttoaverynaturalformulationofVBB
obfuscationwithuniversalsimulation. Thisequivalenceprovidesaclearconceptualargumentforthe
significanceofourextendedimpossibilityresults.
Intherestoftheintroduction,weintroducethenotionofuniversalsimulationandfurtherdiscussthenotion
of auxiliary-input VBB obfuscation. Then, we provide an overview of the results and sketch the proof
techniquesinvolved.
Universalsimulators. ThedefinitionofVBBobfuscationasproposedbyBaraketal. requiresthatforeach
PPTadversaryA,thereexistsaPPTsimulatorSthatsucceedsinsimulatingtheoutputofAwhenAisgiven
theobfuscationO(f)butSisgivenonlyblack-boxaccesstof. Thisdefinitiondoesnotsayhowhard(or
easy)itistofindthecorrespondingsimulatorSforagivenadversaryA. Whensecuritywithblack-boxaccess
tothefunctiondependsoncomputationalhardnessassumptions,thisdefinitionleavesopenthepossibilitythat
theobfuscationcouldbebrokeninpracticewithoutprovidinganalgorithmthatbreakstheseassumptions.
Astrongerandarguablymoremeaningfuldefinitionrequiresthatthereexistanefficienttransformation
from an adversary to its corresponding simulator, or equivalently a universal PPT simulator capable of
simulatinganyPPTadversaryAgiventhecodeofA. WewillrefertosuchadefinitionasVBBobfuscation
withauniversalsimulator.
Aswesaidabove,wewillshowthatVBBobfuscationwithauniversalsimulatorisimpossibleforfunction
familieswithsuper-polynomialpseudo-entropyifgeneralindistinguishabilityobfuscationispossible.
Auxiliaryinput. ThedefinitionofVBBsecuritywithauxiliaryinputs,originallyconsideredin[GK05],is
a strengthening of VBB security, which corresponds to a setting in which the adversary may have some
additionalaprioriinformation.
Allowingauxiliaryinputiscrucialwhenobfuscationisusedtogetherwithothercomponentsinalarger
schemeorprotocol. Consider,forexample,azero-knowledgeprotocolinwhichoneoftheprover’smessages
totheverifiercontainsanobfuscatedprogramO(f). Toprovethattheprotocoliszero-knowledge,wewould
like to show that every verifier V has a zero-knowledge simulator S that can simulate V’s view of the
zk
protocol. Intuitively,S wouldrelyonthesecurityofO bythinkingofVasan“obfuscationadversary”that
zk
is trying to learn information from O(f). Such an adversary has an “obfuscation simulator” S that can
O
learnthesameinformationgivenonlyblack-boxaccesstof,andS cantrytouseS . Theproblemisthat
zk O
theviewofVdoesnotdependonlyonthecodeofV,butalsoonauxiliaryinputtoV,suchasotherprover
messagesandthestatementbeingproven. Anobfuscationdefinitionthatdoesnotallowauxiliaryinputis
insufficienttohandlethiscase.
Theproblemcanbeavoidedbyusingadefinitionthatguaranteestheexistenceofanobfuscationsimulator
that can simulate the view of V given any auxiliary input. If the obfuscated program f depends on other
prover messages or on the statement, then we require security with respect to dependent auxiliary input.
Otherwiseindependentauxiliaryinputsuffices. Thepaper[GK05]consideredbothofthesenotions. Inthe
caseofdependentauxiliaryinput,thevirtualblackboxpropertyisrequiredtoholdevenwhentheauxiliary
inputgiventotheadversaryandsimulatordependsontheactual,secretcircuitbeingobfuscated. Inthecase
ofindependentauxiliaryinput,thisrequirementisweakened: theauxiliaryinputmaydependonlyonthe
familyofcircuits,whichispublic. Theactualcircuittobeobfuscatedischosenrandomlyfromthefamily,
independentlyoftheauxiliaryinputgiventotheadversaryandsimulator.
More precisely, an obfuscator O for a function family F is (worst-case) VBB secure with dependent
auxiliaryinputsifforeveryprobabilisticpolynomial-time(PPT)adversaryA,thereexistsaPPTsimulatorS
2
suchthatforeveryf ∈ F andeveryauxiliaryinputaux(whichmaydependonthefunctionf),theoutputof
A(O(f),aux(f))iscomputationallyindistinguishablefromSf(aux(f)). Theaverage-caseanalogueofthis
definitionrequiresthattheoutputofA(O(f),aux(f))becomputationallyindistinguishablefromSf(aux(f))
forarandomfunctionf ← F.
VBBsecuritywithindependentauxiliaryinputsisdefinedonlywithrespecttoanaverage-casedefinition.1
AnobfuscatorO forafunctionfamilyF isaverage-caseVBBsecurewithindependentauxiliaryinputsif
foreveryPPTadversaryA,thereexistsaPPTsimulatorSsuchthatforeveryauxiliaryinputauxandfora
randomf ← F,theoutputofA(O(f),aux)iscomputationallyindistinguishablefromSf(aux).
For the case of dependent auxiliary input, Goldwasser and Kalai [GK05] showed that functions with
super-polynomialpseudo-entropycannotbeVBBobfuscated,assumingthatadifferentclassofpointfilter
functionscanbeVBBobfuscated. FortheweakernotionofVBBobfuscationwithindependentauxiliary
input,theyshowedamorerestrictedimpossibilityresultforasubclassoffunctionscalledfilterfunctions.
Ourresultsextendthesetheorems,assumingindistinguishabilityobfuscatorsexist.
1.1 Overviewofresultsandtechniques
First we prove that VBB security with a universal simulator is equivalent to VBB security with auxiliary
inputs,whichistheobfuscationversionoftheknownequivalenceforzero-knowledgeproofs[Ore87]. More
specifically,weconsiderbothworst-caseVBBsecurityandaverage-caseVBBsecurity. Intheformerthe
simulatorisrequiredtosuccessfullysimulatetheoutputofAforeveryfunctioninthefamilyF,whereasin
thelatterthesimulatorisrequiredtosuccessfullysimulatetheoutputofAonlyforarandomfunctioninthe
family.
We prove that worst-case VBB security with a universal simulator is equivalent to worst-case VBB
security with dependent auxiliary inputs, and that average-case VBB security with a universal simulator
is equivalent to average-case VBB security with independent auxiliary inputs. To be consistent with the
literature,whenwerefertoVBBsecuritywealwaysconsidertheworst-caseversion. Whenwewouldliketo
considertheaverage-caseversionwerefertoitasaverage-caseVBB.
InformalLemma1. Acandidateobfuscatorisa(worst-case)VBBobfuscatorwithauniversalsimulatorfor
aclassoffunctionsF ifandonlyifitisa(worst-case)VBBobfuscatorforF withdependentauxiliaryinputs.
InformalLemma2. Acandidateobfuscatorisanaverage-caseVBBobfuscatorwithauniversalsimulator
foraclassoffunctionsF ifandonlyifitisanaverage-caseVBBobfuscatorforF withindependentauxiliary
inputs.
WestateandprovetheseresultsasLemmas3.1and3.2inSection3.
TheabovetwolemmasimplythatinordertoobtainnegativeresultsforVBBobfuscationwithauniversal
simulator,itsufficestoobtainnegativeresultsforVBBobfuscationwithauxiliaryinputs.
Newimpossibilityresults. Weshowthatindistinguishabilityobfuscationimpliesthatanyfunctionfamily
withsuper-polynomialpseudo-entropycannotbeVBBobfuscatedwithauxiliaryinput. Looselyspeaking,a
functionfamilyF hassuper-polynomialpseudo-entropyifitisdifficulttodistinguishagenuinefunction
in F from one that has been randomly modified in some locations: for every polynomial p there exists a
polynomial-sizesetI ofinputssuchthatnoefficientadversarycandistinguishbetweenarandomfunction
f ← F andsuchafunctionwithitsvaluesonI replacedwithanotherrandomvariablewithmin-entropyp.
WereferthereadertoDefinition2.7fortheprecisedefinition,butnotethatsuchfamiliesincludeallpseudo-
random function families. They also include all semantically secure secret-key or public-key encryption
1Itisnotclearhowtoenforcethattheauxiliaryinputisindependentofthefunctioninaworst-casedefinition.
3
schemesorsecuredigitalsignatureschemes,providedthattherandomnessisgeneratedbyusinga(secret)
pseudo-randomfunction. (SeeClaim4.0.1in[GK05].)
Recently, the notion of witness encryption was put forth by Garg et al. [GGSW13]. It was observed
byGoldwasseretal.[GKP+13]thatanextractableversionofwitnessencryptioncanbeusedtoobfuscate
theclassofpoint-filterfunctionswithrespecttodependentauxiliaryinputs. Thus, togetherwith[GK05],
this shows that the existence of an extractable witness encryption scheme implies that any function with
super-polynomialpseudo-entropycannotbeobfuscatedwithrespecttodependentauxiliaryinputs.
Hereweshowthattheproofof[GK05]actuallyimpliesthatwitnessencryption,withouttheextractability
property,sufficestoprovethatallfunctionswithsuper-polynomialpseudo-entropyarenotobfuscatablewith
respecttodependentauxiliaryinputs.
InformalTheorem3. Assumetheexistenceofawitnessencryptionscheme. Thennofunctionfamilywith
super-polynomialpseudo-entropyhasanaverage-caseVBBobfuscatorwithrespecttodependentauxiliary
input.
Theideabehindtheproofisthatfunctionswithhighpseudo-entropycannotbeefficientlycompressed;
i.e., given oracle access to such a function, one cannot produce a small circuit for it. The reason is that
functionswithgenuinelyhighentropycannotbecompressedatall(letaloneefficiently),andnoefficient
algorithmcandistinguishthemfromthosewithhighpseudo-entropy.
Usingthisobservation,theproofworksasfollows. SupposewewishtoconstructanobfuscationO(f)of
afunctionf thathashighpseudo-entropyonapolynomial-sizesetI ofinputs. Weusewitnessencryptionto
encryptarandombitbsothatitcanbereadonlybysomeonewhoknowsacircuitofsizeatmost|O(f)|for
thevaluesoff onI. Giventhisencryptionofbasauxiliaryinput,knowledgeofthecircuitO(f)sufficesto
decryptb. However,black-boxaccesstof isnotenoughtoproduceanysmallcircuit,andsoVBBsecurityis
violated.
Wenotethatthistheoremistrueinthestrongsense: foranysecretpredicateπ(f)thatisnotlearnable
from black-box access to f, there exists an adversary and auxiliary input aux(f) such that given O(f)
and aux(f), the adversary efficiently recovers π(f), whereas given aux(f) and oracle access to f, it is
computationally hard to recover π(f). Moreover, the theorem holds even if we restrict aux(f) to be an
efficientlycomputablefunctionoff.
ItwasshownbyGargetal.[GGSW13](usingdifferentterminology)thatindistinguishabilityobfuscation
forpoint-filterfunctionsimpliestheexistenceofwitnessencryption. Thus,theinformaltheoremabovecan
berestatedasfollows: assumingtheexistenceofindistinguishabilityobfuscationforpoint-filterfunctions,
functions with super-polynomial pseudo-entropy are not average-case VBB obfuscatable with respect to
dependentauxiliaryinputs.
Forindependentauxiliaryinput,weuseofadifferenthypothesis,namelyindistinguishabilityobfuscation
forpuncturablepseudo-randomfunctions(seeDefinition2.6). Roughlyspeaking,thesearepseudo-random
functionsforwhichwecanproducealternatekeysthateffectivelyrandomizetheoutputforaspecifiedinput
whileleavingtherestofthefunctionunchanged.
InformalTheorem4. Assumetheexistenceofindistinguishabilityobfuscationforaclassofpuncturable
pseudo-randomfunctions. Thennofunctionfamilywithsuper-polynomialpseudo-entropyhasanaverage-
caseVBBobfuscatorwithrespecttoindependentauxiliaryinput.
The proof of this theorem is a little more subtle than the previous proof. Suppose we are trying to
obfuscateacircuitfamilywithhighpseudo-entropyonasetI ofinputs. TheauxiliaryinputwillbeiO(K ),
s
whereiO denotesindistinguishabilityobfuscationandK isacircuitthattakesanothercircuitC˜ asinput
s
andappliesapuncturablepseudo-randomfunctionG tothevaluesC˜(I)ofC˜ onI. Here,sisarandomkey.
s
4
Now,letO(C)beacandidateobfuscationofacircuitC. Bydefinition,applyingtheauxiliarycircuit
iO(K ) to O(C) yields K (C) (i.e., G (C(I))), but we will show that K (C) cannot be computed using
s s s s
onlyblack-boxaccesstoC. Ifitcould,thenwecouldreplacetheC oraclewithsuitablerandomvaluesY on
I andstillgettheanswerG (Y),bythedefinitionofpseudo-entropy. Thenwecouldmodifytheauxiliary
s
inputtobeiO(K∗),wherethepseudo-randomfunctioninK∗ hasbeenpuncturedtorandomizeitsvalue
s s
at Y. The reason this modification is allowable is that with high probability, K and K∗ define the same
s s
function (Y has entropy too high to be compressible to any small circuit, so no input C˜ to K∗ will ever
s
satisfyC˜(I) = Y). Thus,iO(K )andiO(K∗)areindistinguishable. However,byconstructionK∗ doesnot
s s s
determinethevalueG (Y),whichisacontradiction.
s
We state and prove these results more formally as Theorems 4.1 and 4.2. Together with Lemmas 3.1
and 3.2, they immediately yield impossibility results for VBB obfuscation with a universal simulator. In
particular,Theorem4.1andLemma3.1implythefollowingcorollary.
Corollary 1. Assume the existence of a witness encryption scheme. Then no function family with super-
polynomialpseudo-entropyhasaVBBobfuscatorwithauniversalsimulator.
AswasthecaseforTheorem4.1,thiscorollaryistrueinthestrongsense: foranysecretpredicateπ(f)
thatisnotlearnablefromblack-boxaccesstof,thereexistsanadversarythatefficientlyrecoversπ(f)given
O(f),whereasgiventhecodeoftheadversaryandgivenoracleaccesstof,itiscomputationallyhardto
recoverπ(f).
Theorem4.2andLemma3.2implythefollowingcorollary.
Corollary 2. Assume the existence of indistinguishability obfuscation for a class of puncturable pseudo-
randomfunctions. Thennofunctionfamilywithsuper-polynomialpseudo-entropyhasanaverage-caseVBB
obfuscatorwithauniversalsimulator.
2 Preliminaries
(cid:83)
Let F = {f } be a family of polynomial-size circuits. In what follows, we write F = F with
s k∈N k
F = {f } . Eachcircuitf willhavesizepoly(|s|),wherepolydenotesanunspecified,polynomially-
k s s∈{0,1}k s
boundedfunction.
Definition2.1(VBBobfuscationwithuniversalsimulator). LetF = {f }beafamilyofpolynomial-size
s
circuits. WesaythataprobabilisticalgorithmO (mappingcircuitstocircuits)isanobfuscationofF witha
universalsimulatorifthefollowingconditionshold:
• Correctness: Foreveryfunctionf ∈ F andeverypossibleinputx,
s
O(f )(x) = f (x).
s s
I.e.,therandomvariableO(f )definesthesamefunctionasf withprobability1.
s s
• Polynomialslowdown: Thereexistsapolynomialpsuchthatforeveryf ∈ F,
s
|O(f )| ≤ p(|f |).
s s
• Securitywithauniversalsimulator: Thereexistsa(possiblynon-uniform)PPTSsuchthatforevery
(possiblynon-uniform)PPTA,everypredicateπ,everyk ∈ N,andeverys ∈ {0,1}k,
(cid:12) (cid:12)
(cid:12)Pr[A(O(f )) = π(s)]−Pr[Sfs(A) = π(s)](cid:12) = negl(k), (1)
(cid:12) s (cid:12)
5
wheretheprobabilitiesareovertherandomcointossesofAandS. Herenegl(k)denotesanunspecified,
negligiblefunction(i.e.,|negl(k)| = O(1/kc)foreachconstantc > 0).
We say that O is an average-case obfuscation of F with a universal simulator if Equation (1) holds for
randoms ← {0,1}k; inotherwords, itmeansthereexistsa(possiblynon-uniform)PPTSsuchthatfor
every(possiblynon-uniform)PPTA,everypredicateπ,andeveryk ∈ N,
(cid:12) (cid:12)
(cid:12)Pr[A(O(f )) = π(s)]−Pr[Sfs(A) = π(s)](cid:12) = negl(k),
(cid:12) s (cid:12)
wheretheprobabilitiesareovers ← {0,1}k andovertherandomcointossesofAandS.
NotethatwedonotassumeO(f )canbeefficientlycomputedgivenf . Ournegativeresultsruleoutthe
s s
existenceofobfuscations,andnotmerelythepossibilityoffindingthem.
WhenAisnon-uniform,thenotationSfs(A)ofcoursemeansthatSisgivenacircuitforAforinputsof
theappropriatesize. WhenAisuniform,itmeansthesamethingasinthenon-uniformcase;equivalently,S
isgiventhecodeforAtogetherwith1time(A(O(fs))) toensurethatitisallowedenoughtime.
In Definition 2.1, we have conflated the circuit size parameter k and the security parameter of the
obfuscationmethod. Onecoulddistinguishbetweenthematthecostofmorenotation,butthisconflationis
ofcourseharmlessforprovingimpossibilitytheorems.
Definition 2.2 (VBB obfuscation with auxiliary inputs). Let F = {f } be a family of polynomial-size
s
circuits. WesaythataprobabilisticalgorithmOisanobfuscationofF with(dependent)auxiliaryinputsifit
satisfiesthecorrectnessandpolynomialslowdownconditionsofDefinition2.1,andinadditionitsatisfiesthe
followingsecurityrequirement:
• Security with auxiliary inputs: For every (possibly non-uniform) PPT A, there exists a (possibly
non-uniform) PPT S such that for every predicate π, every k ∈ N, every s ∈ {0,1}k, and every
auxiliaryinputaux(s)ofsizepoly(k),
(cid:12) (cid:12)
(cid:12)Pr[A(O(f ),aux(s)) = π(s,aux(s))]−Pr[Sfs(aux(s)) = π(s,aux(s))](cid:12) = negl(k), (2)
(cid:12) s (cid:12)
wheretheprobabilitiesareovertherandomcointossesofAandS. Wewriteaux(s)asafunctionofs
forclarity,butthisisnotstrictlynecessarysincethequantificationautomaticallyallowsdependence
ons.
WesaythatO isanaverage-caseobfuscationofF with(dependent)auxiliaryinputsifEquation(2)holds
forrandoms ← {0,1}k; namely, ifforevery(possiblynon-uniform)PPTAthereexistsa(possiblynon-
uniform)PPTSsuchthatforeverypredicateπ,everyk ∈ N,andeveryauxiliaryinputaux(s)ofsizepoly(s)
(andallowedtodependons),
(cid:12) (cid:12)
(cid:12)Pr[A(O(f ),aux(s)) = π(s,aux(s))]−Pr[Sfs(aux(s)) = π(s,aux(s))](cid:12) = negl(k),
(cid:12) s (cid:12)
wheretheprobabilitiesareovers ← {0,1}k andovertherandomcointossesofAandS.
Inthedefinitionaboveweallowedtheauxiliaryinputtodependonthefunctionbeingobfuscated. Inwhat
followswedefineVBBobfuscationwithindependentauxiliaryinputs,wherewerestricttheauxiliaryinput
tobeindependentofthefunctionbeingobfuscated. Forthisdefinition,onlytheaverage-caseversionmakes
sense,sinceintheworst-caseversionitisnotclearhowtoensurethattheauxiliaryinputisindependentof
thefunctionbeingobfuscated.
6
Definition2.3(Average-caseVBBobfuscationwithindependentauxiliaryinputs). LetF = {f }bea
s
familyofpolynomial-sizecircuits. WesaythatO isanobfuscationofF withindependentauxiliaryinputsif
itsatisfiesthecorrectnessandpolynomialslowdownconditionsofDefinition2.1,andinadditionitsatisfies
thefollowingsecurityrequirement:
• Average-case security with independent auxiliary input: For every (possibly non-uniform) PPT A,
thereexistsa(possiblynon-uniform)PPTSsuchthatforeverypredicateπ,everyk ∈ N,andevery
auxiliaryinputaux ∈ {0,1}poly(k),
(cid:12) (cid:12)
(cid:12)Pr[A(O(f ),aux) = π(s,aux)]−Pr[Sfs(aux) = π(s,aux)](cid:12) = negl(k),
(cid:12) s (cid:12)
wheretheprobabilitiesareovers ← {0,1}k andovertherandomcointossesofAandS.
Definition 2.4 (Witness encryption). A witness encryption scheme for an NP language L with corre-
sponding witness relation R is a pair of PPT algorithms (Enc,Dec) such that the following conditions
L
hold:
• Correctness: Forall(x,w) ∈ R andeveryb ∈ {0,1},
L
Pr[Dec(Enc (1k,b),w) = b] = 1−negl(k).
x
• SemanticSecurity: Foreveryx (cid:54)∈ Landevery(possiblynon-uniform)PPTadversaryA,
(cid:12) (cid:12)
(cid:12)Pr[A(Enc (1k,0)) = 1]−Pr[A(Enc (1k,1)) = 1](cid:12) = negl(k),
(cid:12) x x (cid:12)
wheretheprobabilityisovertherandomcointossesofEncandA.
Definition 2.5 (Indistinguishability obfuscation). Let C be a family of polynomial-size circuits. A PPT
algorithmiOissaidtobeanindistinguishabilityobfuscatorforCifitsatisfiesthecorrectnessandpolynomial
slowdownconditionsofDefinition2.1,andinadditionitsatisfiesthefollowingsecurityrequirement:
• Indistinguishability: ForallC,C(cid:48) ∈ C thatareofthesamesizeanddefinethesamefunction,iO(C)
andiO(C(cid:48))arecomputationallyindistinguishable. Moreformally,forevery(possiblynon-uniform)
PPTdistinguisherD,
(cid:12)(cid:12)Pr[D(iO(C)) = 1]−Pr[D(iO(C(cid:48))) = 1](cid:12)(cid:12) = negl(k),
wheretheprobabilityisovertherandomcointossesofiO andD.
AlthoughDefinition2.1didnotrequireVBBobfuscationtobeefficientlycomputable(toobtainstronger
impossibility results), we require iO to be efficiently computable in Definition 2.5, because inefficient
indistinguishabilityobfuscationistrivial.
We next define puncturable pseudo-random functions. We consider a simple case in which any PRF
mightbepuncturedatasinglepoint. Thedefinitionisformulatedasin[SW13].
Definition 2.6 (Puncturable PRFs). Let (cid:96),m be polynomially bounded length functions. An efficiently
computablefamilyoffunctions
(cid:110) (cid:12) (cid:111)
G = G : {0,1}m(k) → {0,1}(cid:96)(k) (cid:12) s ∈ {0,1}k,k ∈ N ,
s (cid:12)
associatedwithanefficient(probabilistic)keysamplerGen ,isapuncturablePRFifthereexistsapuncturing
G
algorithmPuncthattakesasinputakeys ∈ {0,1}k andapointx∗ ∈ {0,1}m(k) andoutputsapunctured
keys sothatthefollowingconditionsaresatisfied:
x∗
7
• Functionality is preserved under puncturing: For every x∗ ∈ {0,1}m(k), if we sample s from
Gen (1k)andlets = Punc(s,x∗),thenG andG havethesamevaluesateverypointotherthan
G x∗ s sx∗
x∗ withprobability1.
• Indistinguishabilityatpuncturedpoints: Thetwoensembles
(cid:110) (cid:12) (cid:111)
(cid:0)x∗,s ,G (x∗)(cid:1) (cid:12) s ← Gen (1k),s = Punc(s,x∗) ,
x∗ s (cid:12) G x∗
x∗∈{0,1}m(k),k∈N
(cid:110) (cid:12) (cid:111)
(cid:0)x∗,s ,u(cid:1) (cid:12) s ← Gen (1k),s = Punc(s,x∗),u ← {0,1}(cid:96)(k)
x∗ (cid:12) G x∗
x∗∈{0,1}m(k),k∈N
arecomputationallyindistinguishableby(possiblynon-uniform)PPTdistinguishers.
To be explicit, we include x∗ in the distribution; throughout, we shall assume for simplicity that a
punctured key s includes x∗ in the clear. As shown in [BGI13, BW13, KPTZ13], the pseudo-random
x∗
functionsfrom[GGM86]yieldpuncturablePRFsasdefinedabove.
Definition2.7(Pseudo-entropyofacircuitclass). Letp = p(k)beapolynomial. Wesaythataclassof
(cid:83)
circuitsC = C haspseudo-entropyatleastp = p(k),ifthereexistsapolynomialt = t(k)andasubset
k∈N k
Ik ⊆ {0,1}k ofsizet(k),andforeveryC ∈ Ck thereexistsarandomvariableYC = (Yi)i∈Ik ∈ {0,1}Ik,
suchthatthefollowingconditionshold:
1. TherandomvariableYC hasstatisticalmin-entropyatleastp(k). Inotherwords,eachofitsvalues
occurswithprobabilityatmost2−p(k).
2. Forevery(possiblynon-uniform)PPTdistinguisherD,
(cid:12) (cid:12)
(cid:12)Pr[DC(1k) = 1]−Pr[DC◦YC(1k) = 1](cid:12) = negl(k),
(cid:12) (cid:12)
whereC◦YC denotesanoraclethatagreeswithC exceptthatYC replacesthevaluesofC forinputs
inI . HeretheprobabilitiesareoverC ← C ,therandomvariableYC,andtherandomcointosses
k k
ofD.
WesaythatC hassuper-polynomialpseudo-entropyifithaspseudo-entropyatleastpforeverypolyno-
mialp,andwethencallthecircuitsinC pseudo-entropic.
3 Equivalence between a universal simulator and auxiliary inputs
InthissectionweshowthatVBBobfuscationwithauniversalsimulatorisequivalenttoVBBobfuscation
withauxiliaryinputs. Specifically,weprovethefollowingtwolemmas.
Lemma3.1. LetF = {f }beafamilyofpolynomial-sizecircuits. ThenO isaVBBobfuscatorforF with
s
auniversalsimulatorifandonlyifitisaVBBobfuscatorforF withdependentauxiliaryinputs.
Lemma 3.2. Let F = {f } be a family of polynomial-size circuits. Then O is an average-case VBB
s
obfuscatorforF withauniversalsimulatorifandonlyifitisanaverage-caseVBBobfuscatorforF with
independentauxiliaryinputs.
8
ProofofLemma3.1.
(⇒): SupposethatO isaVBBobfuscatorforF withauniversalsimulator. Namely,thereexistsa(possibly
non-uniform)PPTSsuchthatforevery(possiblynon-uniform)PPTA,everypredicateπ,everyk ∈ Nand
everys ∈ {0,1}k,
(cid:12) (cid:12)
(cid:12)Pr[A(O(f )) = π(s)]−Pr[Sfs(A) = π(s)](cid:12) = negl(k),
(cid:12) s (cid:12)
wheretheprobabilitiesareovertherandomcointossesofAandS.
We will prove that O is a VBB obfuscator for F with dependent auxiliary inputs. To this end, fix
any (possibly non-uniform) PPT adversary A. Let S be the PPT simulator defined as follows: for every
A
auxiliaryinputaux(s), Sfs(aux(s))runstheuniversalsimulatorSfs oninputA , whereA isthe
A aux(s) aux(s)
(non-uniform) adversary that simulates A with auxiliary input aux(s). We need to prove that for every
predicateπ,everyk ∈ N,andeverys ∈ {0,1}k,
(cid:12) (cid:12)
(cid:12)Pr[A(O(f ),aux(s)) = π(s,aux(s))]−Pr[Sfs(aux(s)) = π(s,aux(s))](cid:12) = negl(k),
(cid:12) s A (cid:12)
wheretheprobabilitiesareovertherandomcointossesofAandS.
Todoso,wecheckthat
(cid:12) (cid:12)
(cid:12)Pr[A(O(f ),aux(s)) = π(s,aux(s))]−Pr[Sfs(aux(s)) = π(s,aux(s))](cid:12)
(cid:12) s A (cid:12)
(cid:12) (cid:12)
= (cid:12)Pr[A(O(f ),aux(s)) = π(s,aux(s))]−Pr[Sfs(A ) = π(s,aux(s))](cid:12)
(cid:12) s aux(s) (cid:12)
(cid:12) (cid:12)
≤ (cid:12)Pr[A(O(fs),aux(s)) = π(s,aux(s))]−Pr[Aaux(s)(O(fs)) = π(s,aux(s))](cid:12)
(cid:12) (cid:12)
+(cid:12)Pr[A (O(f )) = π(s,aux(s))]−Pr[Sfs(A ) = π(s,aux(s))](cid:12)
(cid:12) aux(s) s aux(s) (cid:12)
= negl(k),
wherethefirstequationfollowsbythedefinitionofS ,theinequalityfollowsfromthetriangleinequality,
A
andthelastequationfollowsfromthedefinitionofA andfromthefactthatO isVBBsecurewiththe
aux(s)
universalsimulatorS.
(⇐): SupposethatOisaVBBobfuscatorforF withdependentauxiliaryinputs. Namely,forevery(possibly
non-uniform) PPT A there exists a (possibly non-uniform) PPT S such that for every predicate π, every
k ∈ N,everys ∈ {0,1}k,andeveryauxiliaryinputaux(s)ofsizepoly(k),
(cid:12) (cid:12)
(cid:12)Pr[A(O(f ),aux(s)) = π(s,aux(s))]−Pr[Sfs(aux(s)) = π(s,aux(s))](cid:12) = negl(k),
(cid:12) s (cid:12)
wheretheprobabilitiesareovertherandomcointossesofAandS. WeprovethatO isaVBBobfuscatorfor
F withauniversalsimulator. Tothisend,letA∗ beauniversalPPTadversarythatinterpretsitsauxiliary
inputaux = aux(s)asa(possiblynon-uniform)PPTadversaryandrunsthisadversary. (Aspointedoutafter
Definition2.1,wemustinterpretthiscarefullyregardingrunningtimesintheuniformcase.) ThefactthatO
isaVBBobfuscatorwithdependentauxiliaryinputsimpliesthatthereisaPPTsimulatorSsuchthatfor
everypredicateπ,everyk ∈ N,everys ∈ {0,1}k,andeveryauxiliaryinputaux(s)ofsizepoly(k),
(cid:12) (cid:12)
(cid:12)Pr[A∗(O(f ),aux(s)) = π(s,aux(s))]−Pr[Sfs(aux(s)) = π(s,aux(s))](cid:12) = negl(k), (3)
(cid:12) s (cid:12)
9