Kevin Lewi

Key Homomorphic PRFs and Their Applications

A pseudorandom function \(F: {\mathcal K} \times{\mathcal X} \to{\mathcal Y}\) is said to be key homomorphic if given F(k1,x) and F(k2,x) there is an efficient algorithm to compute F(k1 ⊕ k2, x), where ⊕ denotes a group operation on k1 and k2 such as xor. Key homomorphic PRFs are natural objects to study and have a number of interesting applications: they can simplify the process of rotating encryption keys for encrypted data stored in the cloud, they give one round distributed PRFs, and they can be the basis of a symmetric-key proxy re-encryption scheme. Until now all known constructions for key homomorphic PRFs were only proven secure in the random oracle model. We construct the first provably secure key homomorphic PRFs in the standard model. Our main construction is based on the learning with errors (LWE) problem. We also give a construction based on the decision linear assumption in groups with an l-linear map. We leave as an open problem the question of constructing standard model key homomorphic PRFs from more general assumptions.

Semantically Secure Order-Revealing Encryption: Multi-input Functional Encryption Without Obfuscation

Deciding “greater-than” relations among data items just given their encryptions is at the heart of search algorithms on encrypted data, most notably, non-interactive binary search on encrypted data. Order-preserving encryption provides one solution, but provably provides only limited security guarantees. Two-input functional encryption is another approach, but requires the full power of obfuscation machinery and is currently not implementable.

Practical Order-Revealing Encryption with Limited Leakage

In an order-preserving encryption scheme, the encryption algorithm produces ciphertexts that preserve the order of their plaintexts. Order-preserving encryption schemes have been studied intensely in the last decade, and yet not much is known about the security of these schemes. Very recently, Boneh eti¾?al. Eurocrypti¾?2015 introduced a generalization of order-preserving encryption, called order-revealing encryption, and presented a construction which achieves this notion with best-possible security. Because their construction relies on multilinear maps, it is too impractical for most applications and therefore remains a theoretical result. In this work, we build efficiently implementable order-revealing encryption from pseudorandom functions. We present the first efficient order-revealing encryption scheme which achieves a simulation-based security notion with respect to a leakage function that precisely quantifies what is leaked by the scheme. In fact, ciphertexts in our scheme are only about 1.6 times longer than their plaintexts. Moreover, we show how composing our construction with existing order-preserving encryption schemes results in order-revealing encryption that is strictly more secure than all preceding order-preserving encryption schemes.

Exact weight subgraphs and the k -sum conjecture

We consider the Exact-Weight-H problem of finding a (not necessarily induced) subgraph H of weight 0 in an edge-weighted graph G. We show that for every H, the complexity of this problem is strongly related to that of the infamous k-sum problem. In particular, we show that under the k-sum Conjecture, we can achieve tight upper and lower bounds for the Exact-Weight-H problem for various subgraphs H such as matching, star, path, and cycle. One interesting consequence is that improving on the O(n3) upper bound for Exact-Weight-4-path or Exact-Weight-5-path will imply improved algorithms for 3-sum, 5-sum, All-Pairs Shortest Paths and other fundamental problems. This is in sharp contrast to the minimum-weight and (unweighted) detection versions, which can be solved easily in time O(n2). We also show that a faster algorithm for any of the following three problems would yield faster algorithms for the others: 3-sum, Exact-Weight-3-matching, and Exact-Weight-3-star.

Constraining Pseudorandom Functions Privately

In a constrained pseudorandom function PRF, the master secret key can be used to derive constrained keys, where each constrained keyi¾?k is constrained with respect to some Boolean circuiti¾?C. A constrained keyi¾?k can be used to evaluate the PRF on all inputsi¾?x for which

Function-Hiding Inner Product Encryption Is Practical

Cx = 1

Losing Weight by Gaining Edges

. In almost all existing constrained PRF constructions, the constrained keyi¾?k reveals its constrainti¾?C. In this paper we introduce the concept of private constrained PRFs, which are constrained PRFs with the additional property that a constrained key does not reveal its constraint. Our main notion of privacy captures the intuition that an adversary, given a constrained keyi¾?k for one of two circuits