Constrained Pseudorandom Functions: Verifiable and Delegatable Nishanth Chandran Srinivasan Raghuraman Dhinakaran Vinayagamurthy

Constrained Pseudorandom Functions: Verifiable and Delegatable
Nishanth Chandran∗
Srinivasan Raghuraman†
Dhinakaran Vinayagamurthy‡
Abstract
Constrained pseudorandom functions (introduced independently by Boneh and Waters (CCS 2013), Boyle,
Goldwasser, and Ivan (PKC 2014), and Kiayias, Papadopoulos, Triandopoulos, and Zacharias (CCS 2013)),
are pseudorandom functions (PRFs) that allow the owner of the secret key k to compute a constrained key kf ,
such that anyone who possesses kf can compute the output of the PRF on any input x such that f (x) = 1 for
some predicate f . The security requirement of constrained PRFs state that the PRF output must still look
indistinguishable from random for any x such that f (x) = 0.
Boneh and Waters show how to construct constrained PRFs for the class of bit-fixing as well as circuit
predicates. They explicitly left open the question of constructing constrained PRFs that are delegatable - i.e.,
constrained PRFs where the owner of kf can compute a constrained key kf 0 for a further restrictive predicate
f 0 . Boyle, Goldwasser, and Ivan left open the question of constructing constrained PRFs that are also verifiable.
Verifiable random functions (VRFs), introduced by Micali, Rabin, and Vadhan (FOCS 1999), are PRFs that
allow the owner of the secret key k to prove, for any input x, that y indeed is the output of the PRF on x;
the security requirement of VRFs state that the PRF output must still look indistinguishable from random,
for any x for which a proof is not given.
In this work, we solve both the above open questions by constructing constrained pseudorandom functions
that are simultaneously verifiable and delegatable.
1
Introduction
Pseudorandom functions were introduced by Goldreich, Goldwasser, and Micali, in their seminal paper [GGM86].
A PRF F : K × X → Y takes in a key k ∈ K and an input x ∈ X . A user who has the key k can compute
F (k, x) ∈ Y deterministically in polynomial time for any x ∈ X . But for those who do not have the key k, the
PRF output F (k, x) is indistinguishable from random, even given oracle access to the function.
1.1
Verifiable and Delegatable Constrained PRFs
Constrained PRFs. Recently, the notion of constrained PRFs was proposed independently by Boneh and
Waters [BW13], Boyle, Goldwasser and Ivan [BGI14] and Kiayias, Papadopoulos, Triandopoulos and Zacharias
[KPTZ13], where a user with the key k can generate a constrained key kf for some predicate (represented as
a circuit) f such that the user possessing the constrained key kf can compute F (k, x) (by running a different
Eval(kf , x) algorithm) only when f (x) = 1. Otherwise, F (k, x) is indistinguishable from random. Even when users
possessing kf1 , · · · , kfm collude, they should be able to obtain F (k, x) only when fi (x) = 1 for some i ∈ [m], and
for all other x in the domain, F (k, x) should be indistinguishable from random. This way of partially delegating
the PRF evaluation, results in interesting applications like broadcast encryption with optimal ciphertext length,
identity based key exchange and so on. Boneh and Waters [BW13] construct constrained PRFs for both bit-fixing
predicates and for arbitrary circuit predicates, relying on multilinear maps. Boyle et al. [BGI14] and Kiayias et al.
[KPTZ13] construct constrained PRFs for prefix predicates based on [GGM86] and also achieve predicate privacy
where the predicate is hidden given the constrained key.
Verifiable PRFs. PRFs inherently rely on the honesty of the evaluator for the correctness of F (k, x). That is,
the user who receives F (k, x) has no way of checking whether the value he got is the correct PRF output or not.
To address this, Micali, Rabin and Vadhan [MRV99] proposed a notion called verifiable random functions (VRFs).
VRFs are extensions of PRFs where the user possessing the key k can non-interactively generate a proof π along
∗ Microsoft
Research, India; Email: nichandr@microsoft.com
Institute of Technology, Madras; Email: rsrini@cse.iitm.ac.in. Work done while at Microsoft Research, India.
‡ University of Toronto; Email: dhinakaran5@cs.toronto.edu. Work done while at Microsoft Research, India.
† Indian
1
with the PRF output F (k, x), so that the user receiving (y, π) will be able to verify whether the value y he received
is indeed the correct PRF output F (k, x). But on points x ∈ X for which π is not received, the PRF security still
holds i.e the output F (k, x) is indistinguishable from random. At first glance, it might seem trivial to generate
such a proof through standard zero-knowledge protocols. However, such an approach has the following drawbacks.
First, the interactive version of zero-knowledge cannot be used here as we would like the PRF evaluation and proof
generation to be non-interactive. Second, using non-interactive zero-knowedge would require a trusted setup such
as a common reference string (CRS) which would defeat the purpose of not trusting the evaluator to provide the
right output of the PRF. The works of [Lys02, DY05, CL07, ACF14, BGRV09, HW10] give various constructions
of VRFs under different assumptions and security guarantees.
Our Results. In this work, we construct a verifiable constrained random function (VCRF) for arbitrary constraints that can be represented as a polynomial size levelled circuit with any (fixed) polynomial depth, thus
solving the main open question posed by Boyle, Goldwasser, and Ivan [BGI14]. We also extend our scheme to
provide key delegation, where a constrained key kf obtained for a constraint f can be used to generate a further
constrained key kf ∧f 0 for a constraint f ∧ f 0 . More generally, when provided with constrained keys kf1 , · · · , kfm
for some m, our key delegation mechanism enables us to generate a constrained key for any constraint which is of
the form (g1 (f1 , . . . , fm ) ∧ f 0 ) ∨ g2 (f1 , . . . , fm ) for any two monotone boolean formulae g1 , g2 and any constraint
f 01 . In fact, our scheme allows for multiple levels of delegation. Thus we also solve an open problem posed by
[BW13] on achieving key delegation for constrained PRFs. Our construction achieves selective security based on
the κ-Multilinear Decisional Diffie-Hellman assumption. Adaptive security of our scheme can be achieved through
standard complexity leveraging.
Very recently, Hofheinz [Hof14] constructed a fully secure constrained PRF scheme for the “bit-fixing” constraints using multilinear maps and indistinguishability obfuscation in the random oracle model. Fuchsbauer et
al. [FKPR14] give a new security reduction for constrained PRFs for prefix predicates based on PRFs in [GGM86]
which incurs only quasi-polynomial factor loss.
Our results on VCRFs can be extended to functional signatures. Functional signatures were introduced recently
by [BGI14, BF13, BMS13] where there is a master secret key k using which a user can sign any message m. There
is also a way to generate a constrained key kf for some f from a family F of constraints, and a user possessing kf
can sign only the messages m0 in the range of f i.e m0 = f (m) for some m. One can see that a VCRF scheme for
a constraint family F implies a functional signature scheme for the same family F. In fact, a VCRF scheme for
some F imply a functional unique signature scheme for the same F (a unique signature scheme [GO92, Lys02] is a
signature scheme such that there exists only one valid signature for every message, even for adversarially generated
(pk, sk) pairs). Thus our results on VCRFs imply that there also exists a functional unique signature scheme for a
family of polynomial size predicate circuits of (fixed) polynomial depth. This functional unique signature scheme
also allows for multiple levels of delegation in the same way as described for our VCRF scheme.
1.2
Techniques
[BW13] overview. The starting point of our construction is the constrained PRF constructed by Boneh and
Waters [BW13] based on multilinear maps (we will refer to it as the BW scheme). In the main construction of
BW where the constraints are circuit predicates (represented by f ), they assume the existence of multilinear maps
with n + ` levels, where n is the number of input wires in the circuit and ` is the depth of the output wire in the
circuit (with the input wire at depth 1). A pair of secret values (di,0 , di,1 ) ← Z2q are assigned for each input wire
in the circuit (and the corresponding Di,0 = g di,0 , Di,1 = g di,1 are added as part of the public key). The PRF
output is,
Q
u
F (k, x) = gn+`i∈[n]
di,xi
where u ← Zq is a random component exponent and is part of the secret key k. When a user obtains a constrained
key kf for some circuit f , for any wire w in f , he is somehow allowed to compute the component
rw
Q
Kw = gn+j
i∈[n]
di,xi
whenever fw (x) = 1 i.e when the value on the wire w is 1 on evaluating the circuit f with input x. Here, j is the
depth of wire w in circuit f . Intuitively, the security guarantees that the user will not get anything for the wire w
1 We note that any constraint f 00 such that ∀x, f 00 (x) = 1 ⇒ f (x) = 1 for some i ∈ [m] can be represented in the given form and
i
hence we allow the delegation to any further restrictive predicate.
2
when fw (x) = 0. With the user receiving the
Kw components for the input as a part of the constrained key kf ,
Q
u
by induction, he will be able to compute gn+`i∈[n]
di,xi
when f (x) = 1.
How to make it verifiable? Now our goal is to provide a way to generate a proof π along with the PRF output
y enabling the receiver to check whether y is the correct PRF output or not. Our first idea is to make the BW
PRF output itself the proof. Now, to make this proof verifiable, we must add something related to u as part of
u
the public key. In our construction, U = g`+1
is given as a part of the public key. We next assume the existence of
multilinear maps upto n + ` + 1 levels (one more level than BW). Unfortunately, now we cannot use the BW PRF
output (which is also our proof) as our PRF output because this value, if output to an adversary, is now publicly
verifiable, and one can just use the public parameters to distinguish this from a randomly generated element from
the same group. To overcome this issue, we first use one more level of pairing to generate the proof as
Q
uQ
di,x
uv i∈[n] di,xi
π = e gn+`i∈[n] i , V = gn+`+1
where V = g v is provided as a part of the public key with v ← Zq being part of the secret key k (this is similar in
spirit to the techniques used by Hohenberger and Waters [HW10] to construct verifiable random functions). Now
the actual PRF output is obtained by using one more level of pairing, i.e
Q
uv Q
uvw
di,x
i∈[n] di,xi
F (k, x) = e gn+`+1
, W = gn+`+2i∈[n] i
where again W = g w is provided as a part of the public key with w ← Zq being part of the secret key k.
Now, a user
receiving (y, π) can check whether y is the correct output or not as follows: the user first computes
Q
uv
di,x
i∈[n]
i
by using pairing (multiple times) the components Di,xi , U, V (which are all part of the public
π̃ = gn+`+2
key), then checks the following two equations:
?
π̃ = e(π, g)
?
e(π, W ) = y
Now, one can show that it is impossible for an adversary to generate a (y, π) pair which is not valid and also
satisfies these two constraints. Now, we can also show our PRF output is indistinguishable from random on any
input such that f (x) = 0. Next, we show how a user with a constrained key kf , can generate a proof π along with
y = Eval(kf , x) = Q
F (k, x) such that y is the correct PRF output for x. To do this, we first use the constrained key
u
kf to compute Qgn+`i∈[n]
to get π =
di,xi
in the same way that the PRF output of BW is computed and then pair this with V
uv i∈[n] di,xi
.
gn+`+1
Delegating the PRF. We next show that the above construction supports key delegation. We give a mechanism
through which a user possessing a constrained key kf can delegate the evaluation of the PRF by generating a
further constrained key kf ∧f 0 for any f 0 where kf ∧f 0 allows to compute F (k, x) only when both f (x) = 1 and
f 0 (x) = 1. We do this as follows. We first note, that the only secret component that prevents a user having just
the public parameters, from generating a constrained key kf for some circuit f is u. Hence any user can pick a u0
of his choice and provide a k̃f 0 which would allow one to compute
u0 vw
Q
gn+`+2 i∈[n]
di,xi
whenever f 0 (x) = 1. Now, for key delegation the user possessing the constrained key kf picks a random u0 ← Zq
and modifies just the key component for the last gate so that given this modified key one could compute
(u+u0 )vw
Q
gn+`+2
i∈[n]
di,xi
whenever f (x) = 1. Next, he generates the key k̃f 0 for f 0 using u0 . The key k̃f 0 and the modified form of kf
form the key kf ∧fQ0 . When a user wishes to evaluate the PRF with this key on some input x, he first uses k̃f 0
u0 vw
to compute gn+`+2 i∈[n]
0
(u+u )vw
obtain gn+`+2
Q
i∈[n]
di,xi
di,xi
which he can obtain only when f 0 (x) = 1. Then he uses the modified form of kf to
which he can do only when f (x) = 1. From these two values, he can obtain the PRF
3
uvw
Q
di,x
output F (k, x) = gn+`+2i∈[n] i . We can similarly do multiple levels of delegation just by “secret sharing” the
component u further. In general, if the user has secret keys kf1 , . . . , kfm for some m, he can provide a secret key
for any constraint of the form g1 (f1 , . . . , fm ) ∧ f 0 ∨ g2 (f1 , . . . , fm ) where g1 and g2 are some monotone boolean
formulae and any f 0 .
1.3
Organization
We briefly overview the κ-Multilinear Decisional Diffie-Hellman (MDDH) assumption and define verifiable constrained random functions (with key delegation) in Section 2. As a warmup, we present a construction of a verifiable
constrained random function (VCRF) for bit-fixing predicates, in Section 3. Our VCRF construction for circuit
predicates is provided in Section 4. Next, in Section 5, we show how our scheme supports key delegation. Finally,
in Appendix B, we show how to transform our scheme into the setting of graded encoding systems [GGH13a] (as
opposed to multilinear maps).
2
Preliminaries
Leveled multilinear groups. We assume the existence of a group generator G, which takes as input a security
paramter 1λ and a positive integer κ to indicate the number of levels. G(1λ , κ) outputs a sequence of groups
~ = (G1 , . . . , Gκ ) each of large prime order p > 2λ . In addition, we let gi be a canonical generator of Gi that is
G
known from the group’s description. We let g = g1 .
We assume the existence of a set of multilinear maps {ei,j : Gi × Gj → Gi+j |i, j ≥ 1; i + j ≤ κ}. The map ei,j
satisfies the following relation:
ab
ei,j (gia , gjb ) = gi+j
∀a, b ∈ Zp .
When the context is obvious, we will drop the subscripts i, j. For example, we may simply write
ab
e(gia , gjb ) = gi+j
.
We define the κ-Multilinear Decisional Diffie-Hellman (κ-MDDH) assumption [GGH13a] as follows:
Assumption 2.1. (κ-Multilinear Decisional Diffie-Hellman: κ-MDDH) The κ-Multilinear Decisional DiffieHellman (κ-MDDH) problem is as follows: A challenger runs G(1λ , κ) to generate groups and generators of order
p. Then it picks random c1 , . Q
. . , cκ+1 ∈ Zp . The assumption states that given g = g1 , g c1 , . . . , g cκ+1 , it is hard to
distinguish the element T = gκ
in the security parameter λ.
2.1
j∈[κ+1]
cj
from a random group element in Gκ with better than negligible advantage
Definitions
Verifiable Constrained Random Functions. We begin by defining a verifiable constrained random function
(VCRF).
Definition 2.1. Let F : {0, 1}seed(λ) × {0, 1}in(λ) → {0, 1}out(λ) , where seed, in and out are all polynomials in the
security parameter 1λ , be an efficient function. We say that F is a verifiable constrained random function with
in(λ)
respect to a set system S ⊆ 2{0,1}
if there exist algorithms (Setup, Constrain, Evaluate, Prove, Verify) such that
• Setup(1λ , 1in(λ) ) outputs a pair of keys (pk, sk);
• Constrain(sk, S) outputs a constrained key kS which enables the evaluation of F (sk, x) for all x ∈ S and no
other x;
• Evaluate(kS , x) outputs F (sk, x) if x ∈ S and ⊥ otherwise, where ⊥6∈ {0, 1}out(λ) , we will use the shorthand
F (kS , x) for F.Evaluate(kS , x);
• Prove(kS , x) outputs a pair (F (kS , x), πkS (x)), where πkS (x) is the proof of correctness of F (sk, x); and
• Verify(pk, x, y, π) verifies that y = F (sk, x) using the proof π and public key pk.
Formally, the following security properties are to be satisfied:
4
1. Provability: For all (pk, sk) ∈ Setup(1λ , 1in(λ) ) and inputs x ∈ {0, 1}in(λ) , and for all keys output by
Constrain(sk, S) (for all S) if x ∈ S and (y, π) = Prove(kS , x), then Verify(pk, x, y, π) = 12 .
2. Uniqueness: For all (pk, sk) ∈ Setup(1λ , 1in(λ) ) and inputs x ∈ {0, 1}in(λ) , there does not exist a tuple
(y1 , y2 , π1 , π2 ) such that y1 6= y2 , Verify(pk, x, y1 , π1 ) = 1 and Verify(pk, x, y2 , π2 ) = 1.
3. Pseudorandomness: For all p.p.t. distinguishers A = (A1 , A2 ), there exists a negligible function µ such
that:
Constrain(·),Prove(·,·)
Pr[(pk, sk) ← Setup(1λ , 1in(λ) ); (x, s) ← A1
(1λ , pk); y0 = F (sk, x);
Constrain(·),Prove(·,·)
y1 ← {0, 1}out(λ) ; b ← {0, 1}; b0 ← A2
(yb , s) :
1
+ µ(λ),
2
where S = S1 ∪ S2 , S1 = ∪i Si where the Si ’s are the queries given by A to its oracle Constrain and S2 is the
set of queries given by A to its oracle Prove.
b = b0 ∧ x 6∈ S] ≤
Remarks. When constructing verifiable constrained random functions, it will be more convenient to work with
the definition where the adversary is allowed to issue only a single challenge query. A standard hybrid argument
shows that this definition is equivalent to the one where an adversary is allowed to issue multiple challenge queries.
In the pseudorandomness property, we do not provide explicit oracle access to Evaluate as he can always obtain
access to Evaluate through Constrain. Finally, while the definition allows for verification of the final function value
being computed, it provides no guarantee that the constrained key obtained is correct. A proof that the constrained
key provided is correct can be obtained by considering the N P statement that proves this and one can then give
an interactive zero-knowledge proof for the correctness of the constrained key produced. One could potentially
have two extra algorithms ProveKey and VerifyKey which would model non-interactive proofs (and verification)
that the constrained key was constructed honestly. In the case of bit-fixing, we have provide such well-defined
algorithms itself which would suffice and we do not need an interactive zero-knowledge proof, as described in the
construction. It would be an interesting problem to come up with such algorithms in the case of general circuits.
Key Delegation. We now proceed to the notion of key delegation, which we describe as follows. A user U
requests the owner of the secret key sk for a constrained key corresponding to S and gains possession of kS . U
then makes public the information that it possesses kS . A second user U 0 can request U for a constrained key
corresponding to S 0 . In the ideal case, we would expect that S 0 ⊆ S, but the definition below is general enough
to accommodate for any S 0 so that U does not enable U 0 to compute anything more than what he himself can
compute.
Definition 2.2. Let F : {0, 1}seed(λ) × {0, 1}in(λ) → {0, 1}out(λ) , where seed, in and out are all polynomials in the
security parameter 1λ , be an efficient function. We say that F is a verifiable constrained random function with
in(λ)
respect to a set system S ⊆ 2{0,1}
which supports key delegation if there exist algorithms (Setup, Constrain,
KeyDel, Evaluate, Prove, Verify) such that Setup, Constrain, Evaluate, Prove and Verify are as specified in Definition
2.1 and KeyDel(kS , S 0 ) outputs a constrained key kS∩S 0 which enables the evaluation of F (sk, x) for all x ∈ S ∩ S 0
and no other x. The same properties listed in Definition 2.1 need to be satisfied.
Note that in the case that S 0 ⊆ S, kS∩S 0 = kS 0 in the sense defined earlier, i.e., it enables the evaluation of
F (sk, x) for all x ∈ S 0 and no other x.
3
A Bit-Fixing Construction
In this section, we show how to construct a verifiable constrained random function for bit-fixing predicates. We
base our construction on multilinear maps and on the κ-MDDH assumption; we later show how to transform our
construction into the language of graded encodings for which a candidate construction due to [GGH13a] is known.
As described in the introduction, the starting point of our construction is the constrained PRF construction of
Boneh and Waters [BW13]. The “proof” for our verifiable constrained random function will take a form very
similar to the constrained PRF of [BW13], thereby ensuring that anyone with a constrained key for a set S can
2 This
property must also hold for the secret key sk, but it is implicitly captured by the key kS when S is the set of all inputs.
5
generate proofs for the correct evaluation of F (k, x) for x ∈ S. We would now need to provide a new value as the
PRF output value. We do this by pairing the proof with a random element (present in the public key) to get the
final PRF output. When we do this, we must be careful that the proof and PRF value are both not computable
by an adversary on the challenge input x∗ , but proofs must still be verifiable for all other inputs. For this, we
must carefuly select the values that will go into the public key. We now describe the verifiable constrained random
function construction for bit-fixing predicates.
3.1
Construction
3
F .Setup(1λ , 1n ):
The setup algorithm takes as input the security parameter λ and the bit length, n, of PRF inputs. The algorithm
~ = (G1 , . . . , Gκ ) of prime order p with canonical
runs G(1λ , κ = n + 2) and outputs a sequence of groups G
generators g1 , . . . , gκ , where g = g1 . It chooses random exponents u, v, w ∈ Zp and (d1,0 , d1,1 ), . . . , (dn,0 , dn,1 ) ∈ Z2p
and computes Di,β = g di,β for i ∈ [n] and β ∈ {0, 1}. It computes U = g u , V = g v and W = g w . It then sets the
keys as:
~ p, g1 , . . . , gκ , U, V, W, D1,0 , D1,1 , . . . , Dn,0 , Dn,1 ); sk = (G,
~ p, g1 , . . . , gκ , u, v, w, d1,0 , d1,1 , . . . , dn,0 , dn,1 )
pk = (G,
Letting xi denote the i-th bit of x ∈ {0, 1}n , the keyed pseudo-random function is defined as
uvw
Q
F (sk, x) = gκ
i∈[n]
di,xi
F .Constrain(sk, v):
The constrain algorithm takes as input the secret key sk and a vector v ∈ {0, 1, ?}n . Let V be the set of indices
i ∈ [n] such that vi 6=?, i.e., the indices for which the bit is fixed to either 0 or 1. The constrained key is computed
as:
Q
di,v
uv
kv = g1+|V|i∈V i
Note that if V is empty, then we interpret the product to be 1.
F .Evaluate(kv , x):
The evaluate algorithm takes as input a constrained key kv and an input x ∈ {0, 1}n . If ∃ i ∈ V such that xi 6= vi ,
the algorithm aborts. If |V| = n, then all bits are fixed and the output of the function is e(kv , W ). Otherwise,
through repeated application of pairing of Di,xi , ∀i 6∈ V, the algorithm can compute the intermediate value
Q
i∈[n]\V
S = gn−|V|
di,xi
uv Q
di,x
and finally computes e(e(kv , S), W ) = e gn+1 i∈[n] i , W .
F .Prove(kv , x):
The prove algorithm takes as input a constrained
key kv and an input x ∈ {0, 1}n . The algorithm outputs
Q
uv
di,x
F (kv , x) together with a proof π = gn+1 i∈[n] i . Note that this value can be computed from kv , x, and the
public key pk. If the evaluate algorithm aborts, then this algorithm aborts as well. There is non-⊥ output only if
the evaluate algorithm does not abort.
F .Verify(pk, x, y, π):
The verify
algorithm takes as input the public key pk, an input x ∈ {0, 1}n , a value y and a proof π. It computes
Q
u
π̃ = gn+1i∈[n]
di,xi
through repeated use of pairing of Di,xi ∀i ∈ [n] and U , and checks that:
?
e(π, g) = e(π̃, V )
?
e(π, W ) = y
3 Henceforth,
we let in(λ) = n denote the length of inputs to our VCRF. out(λ) would be dictated by the function definition.
6
and outputs 1 if and only if both checks verify.
F .ProveKey(v):
The algorithm Q
takes as input a vector v ∈ {0, 1, ?}n . The algorithm outputs F .Constrain(sk, v) together with a
uv i∈V di,xi
. Note that if V is empty, then we interpret the product to be 1.
proof πv = g1+|V|
F .VerifyKey(pk, v, k, πv ):
The algorithm takes
as input the public key pk, a vector v ∈ {0, 1, ?}n , a key k and a proof πv . The algorithm
Q
u i∈V di,xi
computes π̃ = g1+|V|
through repeated use of pairing of Di,xi ∀i ∈ V and U (if V is empty, then π̃ = U ),
and checks that e(πv , g) = e(π̃, V ) and outputs 1 if and only if the check verifies.
3.2
Proof of VCRF
The provability property is verifiable in a straightforward manner from the construction. The uniqueness property
also follows easily from the group structure; that is, for any input, there is only one group element in Gκ that
is the valid output and it is not possible to give a valid proof for another element. More formally, assume the
existence of an x and a tuple (y1 , y2 , π1 , π2 ) such that y1 6= y2 , Verify(pk, x, y1 , π1 ) = 1 and Verify(pk, x, y2 , π2 ) = 1.
From the description of F .Verify, we have
uv
Q
e(π1 , g) = e(π2 , g) = e(π̃, V ) = gn+2
i∈[n]
di,xi
which is fixed for a given x. So, it must be the case that π1 = π2 . However, we also have that e(π1 , W ) = y1 and
e(π2 , W ) = y2 . Since π1 = π2 , y1 = y2 , which is a contradiction.
The pseudorandomness property of the VCRF is proved ahead. The proof will use the standard complexity leveraging technique of guessing the challenge x∗ to prove adaptive security. This guess will cause a loss
of a 1/2n -factor in the reduction.
Theorem 3.1. If there exists a PPT adversary A that breaks the pseudorandomness property of our bit-fixing
construction for n-bit inputs with advantage (λ), then there exists a PPT algorithm B that breaks the κ = n + 2Multilinear Decisional Diffie-Hellman assumption with advantage (λ)/2n .
Proof. The algorithm B first receives a κ = n + 2-MDDH challenge
consisting of the group sequence description
Q
i∈[κ+1] ci
c1
cκ+1
~
or a random group element in Gκ .
G and g = g1 , g , . . . , g
along with T , where T is either gκ
Setup:
It chooses an x∗ ∈ {0, 1}n uniformly at random. Next, it chooses random z1 , . . . , zn ∈ Zp and sets
(
g ci x∗i = β
Di,β =
g zi x∗i 6= β
for i ∈ [n] and β ∈ {0, 1}. This corresponds to setting
(
di,β =
ci
zi
x∗i = β
x∗i 6= β
It then sets u = cκ−1 , v = cκ and w = cκ+1 . The keys are computed as before.
Constrain:
Suppose a query is made for a secret key for v ∈ {0, 1, ?}n . Let V be the set of indices i ∈ [n] such that vi 6= ?,
i.e., the indices for which the bit is fixed to either 0 or 1. If vi = x∗i for all i ∈ V, then B aborts (note that the
an arbitrary i ∈ V such that vi 6= x∗i .
this happens with probability at most 1 − 21n ). Otherwise, B identifies
Q
uv
Through pairing of Dj,xj ∀j ∈ V\{i}, U and V , it computes g1+|V|j∈V\{i}
Q
kv =
uv
di,v
g1+|V|i∈V i
and outputs it.
7
dj,vj
and raises it to di,vi = zi to get
Evaluate:
Suppose a query is made for a secret key for an input x ∈ {0, 1}n . If x = x∗ , then B aborts.
Otherwise, B
Q
j∈[n]\{i}
identifies an arbitrary i such that xQi 6= x∗i . Through pairing of Dj,xj ∀j ∈ [n]\{i}, it computes gn−1
0
i∈[n]
raises it to di,xi = zi to get H = gn−1
di,xi
dj,xj
and
. Finally it computes
e(e(e(H 0 , U ), V ), W ) = F (sk, x)
and outputs it.
Prove:
On query input x, B first checks if x = x∗ and aborts if this is true, outputting a random bit as its guess. Otherwise,
it identifies an arbitrary i such that xi 6= x∗i . Through
pairing of Dj,xj ∀j ∈ [n]\{i}, U and V , it computes
Q
Q
uv
gn+1
j∈[n]\{i}
dj,xj
uv
and raises it to di,xi = zi to get π = gn+1
i∈[n]
di,xi
and computes y = e(π, W ). It outputs y and π.
4
ProveKey:
If vi = x∗i for all i ∈ V, then B aborts. Otherwise, B identifies
an arbitrary i ∈ V such that vi 6= x∗i .
Q
uv
Through pairing of Dj,xj ∀j ∈ V\{i}, U and V , it computes g1+|V|j∈V\{i}
dj,vj
and raises it to di,vi = zi to get
Q
uv
di,v
g1+|V|i∈V i .
On query input x, if ∃i ∈ V such that xi 6= vi , B aborts. If |V| = n, then all bits are fixed
πv =
and B sets y = e(kv , W ). Otherwise, through repeated application of pairing of Di,xi ∀i 6∈ V, B computes the
intermediate value
Q
i∈[n]\V di,xi
S = gn−|V|
Q
uv Q
uv
di,x
di,x
Then it computes e(S, kv ) = gn+1 i∈[n] i and finally computes y = e gn+1 i∈[n] i , W . Note that if the set
of indices under consideration in any product is empty, then we interpret the product to be 1. B finally outputs
y and πv .
Eventually, A will issue a challenge input x̃. If x̃ = x∗ , B will return the value T and output the
same bit as A does as its guess. If x̃ 6= x∗ , B outputs a random bit as its guess. This completes the description of
the adversary B.
We first begin by noting that when T comes from an MDDH tuple, as long as B does not abort, the distribution
of the real game and the game executed by B are identical. We now analyze the probability that B’s guess was
correct. Let δ 0 denote B’s output and let δ denote whether T is an MDDH tuple or not, δ, δ 0 ∈ {0, 1}. Now
Pr[δ 0 = δ] = Pr[δ 0 = δ|abort] Pr[abort] + Pr[δ 0 = δ|abort] Pr[abort]
1
= (1 − 2−n ) + Pr[δ 0 = δ|abort] · (2−n )
2
1
1
−n
= (1 − 2 ) +
+ · (2−n )
2
2
1
= + · (2−n )
2
The set of equations shows that the advantage of B is (λ)/2n . The second equation is true since the probability
of B not aborting is 2−n . The third equation comes from the fact that the probability of the adversary winning
conditioned on not aborting is the same as the original probability of the attacker winning. The reason is that
the attacker’s success is independent of whether B guessed x∗ .
This completes the proof of the theorem, which establishes the pseudorandomness property of the construction. Hence, VCRF construction for the bit-fixing case is secure under the κ-MDDH assumption.
4
A Circuit-predicate Construction
In this section, we now show how to construct a verifiable constrained random function for arbitrary polynomial
size circuit predicates. Once again, we base our construction on multilinear maps and on the κ-MDDH assumption.
4 This part of the simulation is not required for the proof since it is not part of the definition. But since the ProveKey algorithm
has been presented in the construction, we present its simulation here for completeness.
8
Again, the starting point of our construction is the constrained PRF construction of Boneh and Waters [BW13]
which is based on the attribute-based encryption construction for circuits [GGH+ 13b]. We will follow the same
overall strategy that we did while constructing our verifiable constrained random function for bit-fixing predicates.
We will use the same notation found in [BW13, GGH+ 13b] when describing the circuits; for details, please refer
Appendix A.
4.1
Construction
F .Setup(1λ , 1n , 1` ):
The setup algorithm takes as input the security parameter λ, the bit length, n, of PRF inputs and `, the maximum
~ = (G1 , . . . , Gκ )
depth of the circuit. The algorithm runs G(1λ , κ = n + ` + 2) and outputs a sequence of groups G
of prime order p with canonical generators g1 , . . . , gκ , where g = g1 . It chooses random exponents u, v, w ∈ Zp
u
and (d1,0 , d1,1 ), . . . , (dn,0 , dn,1 ) ∈ Z2p and computes Di,β = g di,β for i ∈ [n] and β ∈ {0, 1}. It computes U = g`+1
,
v
w
V = g and W = g . It then sets the keys as:
~ p, g1 , . . . , gκ , U, V, W, D1,0 , D1,1 , . . . , Dn,0 , Dn,1 ); sk = (G,
~ p, g1 , . . . , gκ , u, v, w, d1,0 , d1,1 , . . . , dn,0 , dn,1 )
pk = (G,
Letting xi denote the i-th bit of x ∈ {0, 1}n , the keyed pseudo-random function is defined as
uvw
Q
F (sk, x) = gκ
i∈[n]
di,xi
F .Constrain(sk, f = (n, q, A, B, GateType)):
The constrain algorithm takes as input the secret key sk and a circuit description f . The circuit has n + q wires
with n input wires, q gates and the wire n + q designated as the output wire.
To generate a constrained key kf , the key generation algorithm chooses random r1 , . . . , rn+q−1 ∈ Zp , where we
think of the the random value rw as being associated with the wire w. It sets rn+q = u.
Next, the algorithm generates key components for every wire w. The structure of the key components depends
on whether w is an input wire, an output of an OR gate or an output of an AND gate. The key components in
each case are described below.
• Input wire
By convention, if w ∈ [n], then it corresponds to the w-th input. The key component is:
r dw,1
Kw = g2w
• OR gate
Suppose that w ∈ Gates and that GateType(w) = OR. In addition, let j = depth(w) be the depth of the
wire w. The algorithm chooses random aw , bw ∈ Zp . Then, the algorithm creates key components:
rw −aw ·rA(w)
Kw,1 = g aw , Kw,2 = g bw , Kw,3 = gj
rw −bw ·rB(w)
, Kw,4 = gj
• AND gate
Suppose that w ∈ Gates and that GateType(w) = AND. In addition, let j = depth(w) be the depth of the
wire w. The algorithm chooses random aw , bw ∈ Zp . Then, the algorithm creates key components:
rw −aw ·rA(w) −bw ·rB(w)
Kw,1 = g aw , Kw,2 = g bw , Kw,3 = gj
The constrained key kf consists of all these n + q key components.
F .Evaluate(kf , x):
The evaluate algorithm takes as input a constrained key kf for the circuit f = (n, q, A, B, GateType) and an input
x ∈ {0, 1}n . The algorithm first checks that f (x) = 1, and if not, it aborts.
Q
rw
di,x
Consider the wire w at depth j. If fw (x) = 1, then, the algorithm computes Ew = gn+j i∈[n] i . If fw (x) = 0,
then nothing needs to be computed for that wire. The algorithm proceeds iteratively starting with computing
E1 and proceeds, in order, to compute En+q . Computing these values in order ensures that the computation
on a depth j − 1 wire that evaluates to 1 will be defined before computing for a depth j wire. Since rn+q = u,
9
u
Q
di,x
En+q = gn+`i∈[n] i .
We show how to compute Ew for all w where
f (x) = 1, case-wise, according to whether the wire is an input,
Q w
an OR gate or an AND gate. Define D(x) = gn i∈[n]
di,xi
, which is computable through pairing operations.
• Input wire
By convention, if w ∈ [n],
then it corresponds to the w-th input. Suppose fw (x) = 1. Through pairing
Q
j∈[n]\{i}
operations, it computes gn−1
dj,xj
. It then computes:
Q
Q
rw
di,x
j∈[n]\{i} dj,xj
Ew = e Kw , gn−1
= gn+1 i∈[n] i
• OR gate
Consider a wire w ∈ Gates with GateType(w) = OR. In addition, let j = depth(w) be the depth of the wire
w. The computation is performed if fw (x) = 1. Note that in this case, at least one of fA(w) (x) and fB(w) (x)
must be 1. If fA(w) (x) = 1, the algorithm computes:
Ew = e(EA(w) , Kw,1 ) · e(Kw,3 , D)
Q
Q
Q
r
u
di,x
rw
di,x
di,x
r
−aw ·rA(w)
A(w)
, gn i∈[n] i = gn+j i∈[n] i
= e gn+j−1 i∈[n] i , g aw · e gj A(w)
Otherwise, fB(w) (x) = 1 and the algorithm computes:
Ew = e(EB(w) , Kw,2 ) · e(Kw,4 , D)
Q
Q
Q
r
di,x
di,x
di,x
rw
u
r
−bw ·rB(w)
B(w)
= e gn+j−1 i∈[n] i , g bw · e gj B(w)
, gn i∈[n] i = gn+j i∈[n] i
• AND gate
Consider a wire w ∈ Gates with GateType(w) = AND. In addition, let j = depth(w) be the depth of the
wire w. The computation is performed if fw (x) = 1. Note that in this case, fA(w) (x) = fB(w) (x) = 1. The
algorithm computes:
Ew = e(EA(w) , Kw,1 ) · e(EB(w) , Kw,2 ) · e(Kw,3 , D)
Q
Q
Q
r
r
di,x
di,x
u
di,x
r
−aw ·rA(w) −bw ·rB(w)
A(w)
B(w)
= e gn+j−1 i∈[n] i , g aw · e gn+j−1 i∈[n] i , g bw · e gj A(w)
, gn i∈[n] i
rw
Q
= gn+j
i∈[n]
di,xi
The procedures above are evaluated in order for all w for which fw (x) = 1. Then, the algorithm computes
S = e(En+q , V ) and finally computes e(S, W ) = F (sk, x).
F .Prove(kf , x):
The prove algorithm takes as input aQconstrained key kf and an input x ∈ {0, 1}n . The algorithm outputs
uv
di,x
i∈[n]
i
F (kf , x) together with a proof π = gn+`+1
. Note that if the evaluate algorithm aborts, then this algorithm
aborts as well. There is non-⊥ output only if the evaluate algorithm does not abort.
F .Verify(pk, x, y, π):
The verify
algorithm takes as input the public key pk, an input x ∈ {0, 1}n , a value y and a proof π. It computes
Q
u
i∈[n]
π̃ = gn+`+1
di,xi
through repeated use of pairing of Di,xi ∀i ∈ [n] and U , and checks that:
?
e(π, g) = e(π̃, V )
?
e(π, W ) = y
and outputs 1 if and only if both checks verify.
ProveKey and VerifyKey for this construction could be protocols as decribed earlier. We do not provide
their descriptions here.
10
4.2
Proof of VCRF
The provability property is verifiable in a straightforward manner from the construction. The uniqueness property
also follows easily from the group structure; that is, for any input, there is only one group element in Gκ that
is the valid output and it is not possible to devise a valid proof for another element. More formally, assume the
existence of an x and a tuple (y1 , y2 , π1 , π2 ) such that y1 6= y2 , Verify(pk, x, y1 , π1 ) = 1 and Verify(pk, x, y2 , π2 ) = 1.
From the description of F .Verify, we have
uv
Q
e(π1 , g) = e(π2 , g) = e(π̃, V ) = gn+2
i∈[n]
di,xi
which is fixed for a given x. So, it must be the case that π1 = π2 . However, we also have that e(π1 , W ) = y1 and
e(π2 , W ) = y2 . Since π1 = π2 , y1 = y2 , which is a contradiction.
The pseudorandomness property of the VCRF is proved ahead. The proof will use the standard complexity leveraging technique of guessing the challenge x∗ to prove adaptive security. This guess will cause a loss
of a 1/2n -factor in the reduction.
Theorem 4.1. If there exists a PPT adversary A that breaks the pseudorandomness property of our circuitpredicate construction for n-bit inputs with advantage (λ), then there exists a PPT algorithm B that breaks the
κ = n + ` + 2- Multilinear Decisional Diffie-Hellman assumption with advantage (λ)/2n .
Proof. The algorithm B first receives a κ = n + ` + 2-MDDH challenge
consisting of the group sequence deQ
~ and g = g1 , g c1 , . . . , g cκ+1 along with T , where T is either gκ
scription G
i∈[κ+1]
ci
or a random group element in Gκ .
Setup:
It chooses an x∗ ∈ {0, 1}n uniformly at random. Next, it chooses random z1 , . . . , zn ∈ Zp and sets
(
g ci x∗i = β
Di,β =
g zi x∗i 6= β
for i ∈ [n] and β ∈ {0, 1}. This corresponds to setting
(
di,β =
ci
zi
x∗i = β
x∗i 6= β
It then sets u = cn+1 · cn+2 · . . . · cn+`+1 , v = cκ and w = cκ+1 . The keys are computed as before.
Constrain:
Suppose a query is made for a secret key for a circuit f = (n, q, A, B, GateType. If f (x∗ ) = 1, then B aborts.
Otherwise, B generates key components for every wire w, case-wise, according to whether w is an input wire, an
OR gate or an AND gate as described below.
• Input wire
By convention, if w ∈ [n], then it corresponds to the w-th input. If x∗w = 1, then B chooses rw at random.
The key component is:
r d
Kw = e(Dw,1 , g rw ) = g2w w,1
If x∗w = 0, then B sets rw = cn+1 cn+2 + ηw , where ηw ∈ Zp is a randomly chosen element. The key
component is:
r d
Kw = (e(g cn+1 , g cn+2 ) · g2ηw )zw = g2w w,1
• OR gate
Suppose that w ∈ Gates and that GateType(w) = OR. In addition, let j = depth(w) be the depth of the
wire w. If fw (x∗ ) = 1, then B chooses aw , bw and rw at random. Then, B creates key components:
rw −aw ·rA(w)
Kw,1 = g aw , Kw,2 = g bw , Kw,3 = gj
rw −bw ·rB(w)
, Kw,4 = gj
If fw (x∗ ) = 0, then B sets aw = cn+j+1 + ψw , bw = cn+j+1 + φw and rw = cn+1 · . . . · cn+j+1 + ηw , where
ψw , φw , ηw ∈ Zp are a randomly chosen elements. Then, B creates key components:
Kw,1 = g cn+j+1 +ψw = g aw , Kw,2 = g cn+j+1 +φw = g bw ,
11
ηw −cn+j+1 ·ηA(w) −ψw (cn+1 ·...·cn+j +ηA(w) )
rw −aw ·rA(w)
Kw,3 = gj
= gj
ηw −cn+j+1 ·ηB(w) −ψw (cn+1 ·...·cn+j +ηB(w) )
Kw,4 = gj
,
rw −bw ·rB(w)
= gj
B is able to create the last two key components due to a cancellation. Since fA(w) (x∗ ) = fB(w) (x∗ ) = 0,
c
·...·cn+j
B would have set rA(w) = cn+1 · . . . · cn+j + ηA(w) and rB(w) = cn+1 · . . . · cn+j + ηB(w) . Further, gj n+1
can be computed using pairing of g ci , n + 1 ≤ i ≤ n + j.
• AND gate
Suppose that w ∈ Gates and that GateType(w) = AND. In addition, let j = depth(w) be the depth of the
wire w. If fw (x∗ ) = 1, then B chooses aw , bw and rw at random. Then, B creates key components:
rw −aw ·rA(w) −bw ·rB(w)
Kw,1 = g aw , Kw,2 = g bw , Kw,3 = gj
If fw (x∗ ) = 0, then at least one of fA(w) (x∗ ) and fB(w) (x∗ ) must be zero. If fA(w) (x∗ ) = 0, then B sets
aw = cn+j+1 + ψw , bw = φw and rw = cn+1 · . . . · cn+j+1 + ηw , where ψw , φw , ηw ∈ Zp are a randomly chosen
elements. Then, B creates key components:
Kw,1 = g cn+j+1 +ψw = g aw , Kw,2 = g φw = g bw ,
ηw −ψw ·cn+1 ·...·cn+j −(cn+j+1 +ψw )ηA(w) −φw ·rB(w)
Kw,3 = gj
rw −aw ·rA(w) −bw ·rB(w)
= gj
B is able to create the last key component due to a cancellation. Since fA(w) (x∗ ) = 0, B would have set
r
c
·...·cn+j
rA(w) = cn+1 · . . . · cn+j + ηA(w) . Further, gj B(w) can be directly computed and gj n+1
can be computed
using pairing of g ci , n + 1 ≤ i ≤ n + j.
The case where fB(w) (x∗ ) = 0 and fA(w) (x∗ ) = 1 is performed in a symmetric way to the above, with the
roles of aw and bw interchanged.
We set, for the output wire w = n + q, ηw = 0, so that rw = u in our internal view. It is easy to see that aw and
bw have the same distribution in the real game and game executed by B, since in the real game, they are chosen
at random and in the game executed by B, they are either chosen at random or are values offset by some random
values ψw and φw , respectively. For w ∈ [n + q − 1], rw also has the same distribution in the real game and game
executed by B, since in the real game, they are chosen at random and in the game executed by B, they are either
chosen at random or are values offset by some random values ηw . Now, we look at rn+q . In the real game, it is a
fixed value u, and in the game executed by B, by setting ηn+q = 0, rn+q = cn+1 · cn+2 · . . . · cn+`+1 = u internally.
Hence, they too have the same distribution. Hence all the parameters in the real game and game executed by B
have the identical distribution.
The constrained key kf consists of all these n + q key components.
Evaluate:
Suppose a query is made for a secret key for an input x ∈ {0, 1}n . If x = x∗ , then B aborts. Otherwise,
B identifies an arbitrary i such that xi 6= x∗i . Through pairing of g ci , n + 1 ≤ i ≤
n + ` + 1, it computes
Q
c
·...·cn+`+1
j∈[n]\{i} dj,xj
. Then, through pairing of Dj,xj ∀j ∈ [n]\{i}, it computes
gn−1
and raises
Q
Q
d
u
d
i,x
i,x
i∈[n]
i∈[n]
i
i
get H 0 = gn−1
. Then, it computes H 00 = e(H, H 0 ) = gn+l
. Finally it computes
n+1
u
H = g`+1
= g`+1
to di,xi = zi to
it
e(e(H 00 , V ), W ) = F (sk, x)
and outputs it.
Prove:
On query input x, B first checks if x = x∗ and aborts if this is true, outputting a random bit Qas its guess.
uv
Otherwise, it identifies an arbitrary i suchQthat xi 6= x∗i . Through pairing operations, it computes gn+1
uv
and raises it to di,xi = zi to get π = gn+1
i∈[n]
di,xi
j∈[n]\{i}
dj,xj
and computes y = e(π, W ). It outputs y and π.
Eventually, A will issue a challenge input x̃. If x̃ = x∗ , B will return the value T and output the
same bit as A does as its guess. If x̃ 6= x∗ , B outputs a random bit as its guess.
12
This completes the description of the adversary B. We first note that in the case where T is part of a
MDDH tuple, the real game and game executed by B have the identical distribution. Secondly, in both cases
(i.e., whether or not T is part of the MDDH tuple), as long as B does not abort, once again, the real game and
game executed by B have the identical distribution, except for the output of B on the challenge query x∗ . We
now analyze the probability that B’s guess was correct. Let δ 0 denote B’s output and let δ denote whether T is
an MDDH tuple or not, δ, δ 0 ∈ {0, 1}. Now
Pr[δ 0 = δ] = Pr[δ 0 = δ|abort] Pr[abort] + Pr[δ 0 = δ|abort] Pr[abort]
1
= (1 − 2−n ) + Pr[δ 0 = δ|abort] · (2−n )
2
1
1
+ · (2−n )
= (1 − 2−n ) +
2
2
1
= + · (2−n )
2
The set of equations shows that the advantage of B is (λ)/2n . The second equation is true since the probability
of B not aborting is 2−n . The third equation comes from the fact that the probability of the attacker winning
conditioned on not aborting is the same as the original probability of the attacker winning. The reason is that
the attacker’s success is independent of whether B guessed x∗ .
This completes the proof of the theorem, which establishes the pseudorandomness property of the construction. Hence, VCRF construction for the circuit-predicate case is secure under the κ-MDDH assumption.
5
Key Delegation
uv
Q
For bit-fixing predicates, it is trivial to delegate keys as noted in [BW13]. On obtaining kv = g1+|V|i∈V
can generate a key kv0 (for any set v0 formed by replacing some ? in v with 0 or 1) as follows:
Q
Q
uv i∈V0 di,v0
0 \V di,xi
i
= g1+|V0 |
kv0 = e kv , g|Vi∈V
0 \V|
di,vi
, we
Also this way we can delegate keys for multiple levels. Now, in this section, we extend the constructions for
circuit-predicates to support key delegation.
5.1
Construction
We only describe KeyDel here. The other algorithms are as defined in the earlier construction.
F .KeyDel(kf , f 0 ):
The key delegation algorithm takes as input a constrained key kf and a circuit f 0 . Without loss of generality, we
may assume that w = n + q, the output wire of the circuit f has depth greater than 1, i.e., the output wire of f
is that of an AND or an OR gate. We choose a u0 at random and alter the keys for the output wire as under,
depending on whether it is an AND or an OR gate.
• OR gate
0
u+u0 −aw ·rA(w)
K̃w,3 = Kw,3 · g`u = g`
0
u+u0 −bw ·rB(w)
, K̃w,4 = Kw,4 · g`u = g`
• AND gate
u+u0 −aw ·rA(w) −bw ·rB(w)
0
K̃w,3 = Kw,3 · g`u = g`
In essence, we have replaced the randomness for the output wire, rn+q , with u + u0 , instead of u which was used
earlier. Let k̃f be kf with the keys for the output wire replaced suitably by the ones specified above.
Next, we obtain a “constrained key”, k̃f 0 for f 0 with randomness for the output wire as u0 , instead
of u. This
can be done by emulating F .Constrain(sk, f 0 ) setting rn+q = u0 . We set the delegated key
kf ∧f 0 = k̃f , k̃f 0 .
13
The evaluationQ now requires some
Q additional work. If we proceed to evaluate as earlier, the two sets of keys
(u+u0 )
now yield gn+`
Remark.
i∈[n]
di,xi
u0
and gn+` i∈[n]
di,xi
. Dividing the first by the second gives us the required value.
For multilevel delegation, the key would be of the form kf ∧f 0 ∧f 00 ∧···∧f (t) =
k̃f , k̃f 0 , k̃f 00 , . . . , k̃f (t) .
Given, kf ∧f 0 ∧f 00 ∧···∧f (t−1) , the alteration of keys for the output wire would be done on k̃f (t−1) and we compute
k̃f (t) as described for the computation of k̃f 0 in the single level delegation case above.
The evaluation again has additional steps.
Suppose the randomness
u was split asQu+u0 , u0 +u00 , u00 +u000Q, . . . , u(t) .
Q
Q
(u+u0 )
di,x
(u0 +u00 )
di,x
(u00 +u000 )
i∈[n]
i∈[n]
i
i
We would now end up evaluating gn+`
, gn+`
, gn+`
Dividing one by the other in sequence will give the required value in t − 1 steps.
5.2
i∈[n]
di,xi
u(n)
, . . . , gn+`
i∈[n]
di,xi
.
Proof of VCRF with key delegation
The provability property is verifiable in a straightforward manner from the construction. The uniqueness property
also follows easily from the group structure; that is, for any input, there is only one group element in Gκ that is
the valid output and it is not possible to devise a valid proof for another element. The formal proof can be given
as before.
The pseudorandomness property of the VCRF is shown ahead. The proof will use the standard complexity
leveraging technique of guessing the challenge x∗ to prove adaptive security. This guess will cause a loss of a
1/2n -factor in the reduction.
Theorem 5.1. If there exists a PPT adversary A that breaks the pseudorandomness property of our circuitpredicate construction which supports key delegation for n-bit inputs with advantage (λ), then there exists a PPT
algorithm B that breaks the κ = n + ` + 2- Multilinear Decisional Diffie-Hellman assumption with advantage
(λ)/2n .
Proof. The algorithm B first receives a κ = n + ` + 2-MDDH challenge
consisting of the group sequence deQ
i∈[κ+1] ci
c1
cκ+1
~
or a random group element in Gκ .
scription G and g = g1 , g , . . . , g
along with T , where T is either gκ
We only describe how B emulates KeyDel here.
proof.
The other algorithms are emulated as in the earlier
KeyDel:
Suppose a query is made for a secret key for f 0 by constraining kf . We have two cases here. Suppose that a query
to obtain a contrained key for f , i.e., for kf has already been made5 , either by virtue of Constrain or KeyDel, then
we assume that B has kf and it proceeds. Otherwise, B aborts, claiming that it does not have kf .
If B does not abort, without loss of generality, we may assume that w = n + q, the output wire of the
circuit f has depth greater than 1, i.e., the output wire of f is that of an AND or an OR gate. B chooses a u0 at
random and alter the keys for the output wire as under, case-wise, depending on whether it is an AND or an OR
gate.
• OR gate
0
u+u0 −aw ·rA(w)
K̃w,3 = Kw,3 · g`u = g`
0
u+u0 −bw ·rB(w)
, K̃w,4 = Kw,4 · g`u = g`
• AND gate
u+u0 −aw ·rA(w) −bw ·rB(w)
0
K̃w,3 = Kw,3 · g`u = g`
Let k̃f be kf with the keys for the output wire replaced suitably by the ones specified above.
Next, we obtain a “constrained key”, k̃f 0 for f 0 with randomness for the output wire as u0 , instead of
u. This can be done by emulating F .Constrain(sk, f 0 ) setting rn+q = u0 .
B outputs the delegated key kf ∧f 0 = k̃f , k̃f 0 .
5 This can always be kept track of. For instance, assume that B maintains a table with tuples of the form (f, k ), and it updates
f
this table after every Constrain or KeyDel query for which it returns a non-⊥ output.
14
(u+u0 )
The evaluation again requires some additional work. The two sets of keys can be used to obtain gn+`
0
u
Q
and gn+` i∈[n]
di,xi
Q
i∈[n]
di,xi
. Dividing the first by the second gives the required value.
This completes the description of the adversary B. The analysis of the probability that B’s guess was
correct is as before. This completes the proof of the theorem, which establishes the pseudorandomness property
of the construction. Hence, VCRF construction for the circuit-predicate case supporting key delegation is secure
under the κ-MDDH assumption.
5.3
More general forms of delegation
Our scheme can in fact support delegations much more than getting the constrained key kf ∧f 0 from kf . Consider
a user who has constrained keys kf1 , . . . , kfm for some m which is polynomial in the security parameter λ. This
user can now generate a secret key for any constraint of the form g = g1 (f1 , . . . , fm ) ∧ f 0 ∨ g2 (f1 , . . . , fm ) for any
two monotone boolean formulae g1 , g2 and for any constraint f 0 . One simple way to answer a query of the above
form using our scheme is to convert the formula
W g into its Disjunctive Normal Form (DNF). Note that when g
is represented in DNF, it will be of the form (fi ∧ h) for some circuit h which is a conjunction involving some
of f1 , . . . , fm , f 0 and for i ∈ [m]. The user can now generate keys for each clause separately by using our KeyDel
scheme (through multiple levels of delegation) described in the previous section because the clause has one of
f1 , . . . , fm for which the constrained key is known. Now the constrained key kg is set of the constrained keys for
each of the individual clauses.
References
[ACF14]
Michel Abdalla, Dario Catalano, and Dario Fiore. Verifiable random functions: Relations to identitybased key encapsulation and new constructions. J. Cryptology, 27(3):544–593, 2014.
[BF13]
Mihir Bellare and Georg Fuchsbauer. Policy-based signatures. Cryptology ePrint Archive, Report
2013/413, 2013.
[BGI14]
Elette Boyle, Shafi Goldwasser, and Ioana Ivan. Functional signatures and pseudorandom functions.
In Public Key Cryptography, pages 501–519, 2014.
[BGRV09]
Zvika Brakerski, Shafi Goldwasser, Guy N. Rothblum, and Vinod Vaikuntanathan. Weak verifiable
random functions. In TCC, pages 558–576, 2009.
[BMS13]
Michael Backes, Sebastian Meiser, and Dominique Schrder. Delegatable functional signatures. Cryptology ePrint Archive, Report 2013/408, 2013.
[BW13]
Dan Boneh and Brent Waters. Constrained pseudorandom functions and their applications. In
ASIACRYPT (2), pages 280–300, 2013.
[CL07]
Melissa Chase and Anna Lysyanskaya. Simulatable vrfs with applications to multi-theorem nizk. In
CRYPTO, pages 303–322, 2007.
[DY05]
Yevgeniy Dodis and Aleksandr Yampolskiy. A verifiable random function with short proofs and keys.
In Public Key Cryptography, pages 416–431, 2005.
[FKPR14]
Georg Fuchsbauer, Momchil Konstantinov, Krzysztof Pietrzak, and Vanishree Rao. Adaptive security
of constrained prfs. Cryptology ePrint Archive, Report 2014/416, 2014.
[GGH13a]
Sanjam Garg, Craig Gentry, and Shai Halevi. Candidate multilinear maps from ideal lattices. In
EUROCRYPT, pages 1–17, 2013.
[GGH+ 13b] Sanjam Garg, Craig Gentry, Shai Halevi, Amit Sahai, and Brent Waters. Attribute-based encryption
for circuits from multilinear maps. In CRYPTO (2), pages 479–499, 2013.
[GGM86]
Oded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random functions. J. ACM,
33(4):792–807, 1986.
15
[GO92]
Shafi Goldwasser and Rafail Ostrovsky. Invariant signatures and non-interactive zero-knowledge
proofs are equivalent (extended abstract). In CRYPTO, pages 228–245, 1992.
[Hof14]
Dennis Hofheinz. Fully secure constrained pseudorandom functions using random oracles. Cryptology
ePrint Archive, Report 2014/372, 2014.
[HW10]
Susan Hohenberger and Brent Waters. Constructing verifiable random functions with large input
spaces. In EUROCRYPT, pages 656–672, 2010.
[KPTZ13]
Aggelos Kiayias, Stavros Papadopoulos, Nikos Triandopoulos, and Thomas Zacharias. Delegatable
pseudorandom functions and applications. In ACM Conference on Computer and Communications
Security, pages 669–684, 2013.
[Lys02]
Anna Lysyanskaya. Unique signatures and verifiable random functions from the dh-ddh separation.
In CRYPTO, pages 597–612, 2002.
[MRV99]
Silvio Micali, Michael O. Rabin, and Salil P. Vadhan. Verifiable random functions. In FOCS, pages
120–130, 1999.
A
Circuit Notation
We restrict our consideration to certain classes of boolean circuits. First, our circuits will have a single output
gate. Next, we will consider layered circuits. In a layered circuit, a gate at depth j will receive both of its inputs
from wires at depth j − 1. Finally, we restrict ourselves to monotonic circuits where gates are either AND or OR
gates of two inputs.6
Our circuits will be a five tuple f = (n, q, A, B, GateType). We let n be the number of inputs and q be the
number of gates. We define inputs = [n], Wires = [n + q] and Gates = [n + q]\[n]. The wire n + q is designated
as the output wire, outputwire. A : Gates → Wires\{outputwire} is a function where A(w) identifies w’s first
incoming wire and B : Gates → Wires\{outputwire} is a function where B(w) identifies w’s second incoming wire.
Finally, GateType : Gates → {AND, OR} is a function that identifies a gate as either an AND gate or an OR gate.
We require that w > B(w) > A(w). We also define a function depth(w) where if w ∈ inputs, depth(w) = 1 and
in general depth(w) of a wire w is equal to the length of the shortest path to an input wire plus one. Since our
circuit is layered, we require that for all w ∈ Gates, if depth(w) = j, then depth(A(w)) = depth(B(w)) = j − 1.
We will abuse notation and let f (x) be the evaluation of the circuit f on the input x ∈ {0, 1}n . On addition,
we let fw (x) be the value of the wire w of the circuit on the input x.
B
VCRFs using graded encoding systems
In this section, we describe how to map our contructions for VCRFs using multilinear maps to the graded encoding
realization of Garg, Gentry and Halevi [GGH13a]. We will describe the translation of our bit-fixing7 explicity. The
translation of our circuit construction follows in a similar manner. For simplicity, we drop the params argument
given as input to the algorithms.
B.1
B.1.1
A Bit-Fixing Construction
Construction
F .Setup(1λ , 1n ):
The setup algorithm takes as input the security parameter λ and the bit length, n, of PRF inputs. The algorithm
runs InstGen(1λ , n + 1) to obtain the graded encoding system, G. Next, it runs the algorithm samp (2n + 3)
times to generate random level-0 encodings tg , tuv , tw and Di,β for i ∈ [n] and β ∈ {0, 1}. It computes Tuv =
encode(1, tuv ). It then sets the keys as:
pk = (G, tg , Tuv , tw , D1,0 , D1,1 , . . . , Dn,0 , Dn,1 ), sk = (G, tg , tuv , tw , D1,0 , D1,1 , . . . , Dn,0 , Dn,1 )
6 These restrictions are mostly useful for exposition and do not implact functionality. General circuits can be built from nonmonotonic circuits. In addition, given a circuit, an equivalent layered circuit exists that is larger by atmost a polynomial factor.
7 We omit the descriptions of F .ProveKey and F .VerifyKey here, since they are not required. However, they can be translated in a
way similar to the descriptions given for the other algorithms.
16
Letting xi denote the i-th bit of x ∈ {0, 1}n , the keyed function is defined as


Y
F (sk, x) = extract pzt , tuv · tw ·
Di,xi 
i∈[n]
where the multiplication is interpreted as repeated application of the multiplication algorithm in the graded
encoding system.
F .Constrain(sk, v):
The constrain algorithm takes as input the secret key sk and a vector v ∈ {0, 1, ?}n . Let V be the set of indices
i ∈ [n] such that vi 6=?, i.e., the indices for which the bit is fixed to either 0 or 1. The constrained key is computed
as:
!
Y
kv = rerand tuv ·
Di,xi
i∈V
Note that if V is empty, then we interpret the product to be 1.
F .Evaluate(kv , x):
The evaluate algorithm takes as input a constrained key kv and an input x ∈ {0, 1}n . If ∃i ∈ V such that xi 6= vi ,
the algorithm aborts. If |V| = n, then all bits are fixed and the output of the function is extract(pzt , tw · kv ).
Otherwise, through repeated application of the mutliplication algorithm on Di,xi ∀i 6∈ V, the algorithm can
compute the intermediate value
Y
S = kv ·
Di,xi
i∈[n]\V
and finally computes extract(pzt , tw · kv · S).
F .Prove(kv , x):
The prove algorithm takes as input a constrained
key kv and an input x ∈ {0, 1}n . The algorithm outputs
Q
F (kv , x) together with a proof π = tuv · i∈[n] Di,xi . Note that if the evaluate algorithm aborts, then this
algorithm aborts as well. There is non-⊥ output only if the evaluate algorithm does not abort.
F .Verify(pk, x, y, π):
The verifyQalgorithm takes as input the public key pk, an input x ∈ {0, 1}n , a value y and a proof π. It computes
π̃ = Tuv · i∈[n] Di,xi through repeated use of multiplication of Di,xi ∀i ∈ [n] and Tuv , and checks that:
?
extract(pzt , tg · π) = extract(pzt , π̃)
?
extract(pzt , tw · π) = y
and outputs 1 if and only if both checks verify.
B.1.2
Proof of VCRF
The provability property is verifiable in a straightforward manner from the construction. The uniqueness property
also follows easily from the group structure; that is, for any input, there is only one group element in Gκ that
is the valid output and it is not possible to devise a valid proof for another element. More formally, assume the
existence of an x and a tuple (y1 , y2 , π1 , π2 ) such that y1 6= y2 , Verify(pk, x, y1 , π1 ) = 1 and Verify(pk, x, y2 , π2 ) = 1.
From the description of F .Verify, we have
extract(pzt , tg · π1 ) = extract(pzt , tg · π2 ) = extract(pzt , π̃)
So, tg · π1 , tg · π2 and π̃ must be level-n encodings of the same α, for some α. So, it must be the case that π1
and π2 are level-(n − 1) encodings of the same α0 , for some α0 and hence tw · π1 and tw · π2 are level-n encodings
of the same α00 , for some α00 . Since extract(pzt , tw · π1 ) = y1 and extract(pzt , tw · π2 ) = y2 , y1 = y2 , which is a
contradiction.
17
The pseudorandomness property/security of the VCRF can be proved as before using an analogue of
the κ-Multilinear Decisional Diffie-Hellman stated in the language of graded encodings given in [GGH13a].
Remark. The subscript uv for t is used since we have combined the u and v of our scheme here. The other
subscripts are self-explanatory and reflect the relevant parameters of our scheme. As such, this construction
mirrors the previous one. Another point to note is that in our construction as well, the public and secret keys can
be made to look similar to the ones used here with all evaluations being done by pairings.
18