Cryptology ePrint Archive: Report 2015/780

Multilinear Maps from Obfuscation

Martin R. Albrecht and Pooya Farshim and Dennis Hofheinz and Enrique Larraia and Kenneth G. Paterson

Abstract: We provide constructions of multilinear groups equipped with natural hard problems from indistinguishability obfuscation, homomorphic encryption, and NIZKs. This complements known results on the constructions of indistinguishability obfuscators from multilinear maps in the reverse direction.

We provide two distinct, but closely related constructions and show that multilinear analogues of the DDH assumption hold for them. Our first construction is \emph{symmetric} and comes with a k-linear map e : G^k --> G_T for prime-order groups G and G_T. To establish the hardness of the k-linear DDH problem, we rely on the existence of a base group for which the (k - 1)-strong DDH assumption holds. Our second construction is for the \emph{asymmetric} setting, where e : G_1 x ... x G_k --> G_T for a collection of k + 1 prime-order groups G_i and G_T, and relies only on the standard DDH assumption in its base group. In both constructions the linearity k can be set to any arbitrary but a priori fixed polynomial value in the security parameter.

We rely on a number of powerful tools in our constructions: (probabilistic) indistinguishability obfuscation, dual-mode NIZK proof systems (with perfect soundness, witness indistinguishability and zero knowledge), and additively homomorphic encryption for the group Z_N^{+}. At a high level, we enable "bootstrapping" multilinear assumptions from their simpler counterparts in standard cryptographic groups, and show the equivalence of IO and multilinear maps under the existence of the aforementioned primitives.

Category / Keywords: foundations / Multilinear map, indistinguishability obfuscation, homomorphic encryption, decisional Diffie-Hellman, Groth-Sahai proofs.

Original Publication (with minor differences): IACR-TCC-2016

Date: received 5 Aug 2015, last revised 27 Nov 2015

Contact author: pooya farshim at gmail com

Available format(s): PDF | BibTeX Citation

Note: This version of the paper fixes a flaw that we found in the proof of Theorem 5.3. The construction of Section 4 has been slightly modified, but it does not make use of stronger assumptions and has comparable efficiency.

Version: 20151127:132915 (All versions of this report)

Short URL: ia.cr/2015/780

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]