Chapter 1. Introduction depending on the adversary's behavior, and the winning condition for the adversary. The security game is defined in such a way that the adversary's capabilities encompass all possible attacks that could reasonably occur in a real-life scenario. The winning condition is defined so as to capture security breaches.

Defining security is a challenging task that has prompted fundamental research papers, such as [GM84], which defined the notion of semantic security for public-key encryption, and the indistinguishability-based notion of security. Security definitions always have to keep up with the apparition of new practical attacks allowed by new technologies. For instance, the practical attack of Bleichenbacher [Ble98] on certain standardized and widely used protocols prompted the adoption of a stronger security definition (known as Chosen-Ciphertext Attacks security, originally studied in [DDN03, RS92]) as the de facto security notion for encryption.

Provable security. Given a well-defined security game, to prove the security of a particular scheme, it remains to prove that no efficient adversary can win the security game with good probability. Influenced by complexity theory, cryptographers use a so-called security parameter that measures the input size of a computational problem, and adversaries are defined as probabilistic Turing machines, whose running time is polynomial in the security parameter. Since an adversary can run multiple times on different independent random tapes to increase its winning probability, the natural choice for the bound on the winning probability is any negligible function in the security parameter, that is, any function that is asymptotically dominated by all functions of the form 1/P for any polynomial P . A more practically oriented approach estimates the running time of the security reduction and its advantage in breaking the underlying assumption more precisely than polynomial running time, and negligible winning advantage. The reduction can thus be used to choose concrete security parameters for the underlying assumption. See for instance [BDJR97b, BR96] which pioneered concrete security.

Standard assumptions. To prove that there exists no polynomial time adversary that can win a security game with non-negligible probability, we use a reductionist approach. Namely, we build an efficient algorithm (called the reduction) that leverages the adversary's success in winning the security game, to find a solution to a hard problem, that is, a problem that is impossible to solve efficiently with non-negligible probability, or at least, conjectured to be so. The tradition in cryptography departs from complexity theory at this point, given that basing cryptography on NP-hard problems has remained open for many years. Instead, security of cryptographic schemes relies on a more heuristic approach, where security is proven via a reduction to a well-defined assumption, which states that some problem is hard in practice, that is, for which there exists no known efficient solution. Of course, the robustness of the security depends on how much this assumption is trusted. Provable security makes sense as long as it relies on assumptions that have been extensively studied. Typically, they involve decade-old mathematical problems, where finding an efficient algorithm would represent a huge breakthrough. Instead of using ad hoc cryptanalysis for every possible cryptographic scheme, one can rely on a small set of simple-to-state assumptions, leveraging years of mathematical research. Assumptions whose validity is widely trusted are called standard assumptions. For example, this is the case of the discrete logarithm assumption, which states that given a cyclic group of prime order p, generated by g, and an element g a for a random exponent a in Z p (we use multiplicative notation here), it is hard to compute the discrete logarithm a (of course, the choice of the underlying group is crucial to the validity of the assumption, and only for certain well-chosen groups is this assumption considered standard).

Tight Security

As explained in the paragraph about provable security, a security reduction can serve as a tool to choose concrete security parameters. Indeed, an adversary that can win a security 1.1 Tight Security

Abstract

Our work revisits public-key encryption in two ways: 1) we provide a stronger security guarantee than typical public-key encryption, which handles many users than can collude to perform sophisticated attacks. This is necessary when considering widely deployed encryption schemes, where many sessions are performed concurrently, as in the case on the Internet; 2) we consider so-called functional encryption, introduced by Boneh, Sahai, Waters in 2011, that permits selective computation on the encrypted data, as opposed to the coarse-grained access provided by traditional public-key encryption. It generalizes the latter, in that a master secret key is used to generate so-called functional decryption keys, each of which is associated with a particular function. An encryption of a message m, together with a functional decryption key associated with the function f , decrypts the value f (m), without revealing any additional information about the encrypted message m. A typical scenario involves the encryption of sensitive medical data, and the generation of functional decryption keys for functions that compute statistics on this encrypted data, without revealing the individual medical records.

In this thesis, we present a new public-key encryption that satisfies a strong security guarantee, that does not degrade with the number of users, and that prevents adversaries from tampering ciphertexts. We also give new functional encryption schemes, whose security relies on well-founded assumptions. We follow a bottom-up approach, where we start from simple constructions that can handle a restricted class of functions, and we extend these to richer functionalities. We also focus on adding new features that make functional encryption more relevant to practical scenarios, such as multi-input functional encryption, where encryption is split among different non-cooperative users. We also give techniques to decentralize the generation of functional decryption keys, and the setup of the functional encryption scheme, in order to completely remove the need for a trusted third party holding the master secret key.

iii

Résumé

Nos travaux revisitent le chiffrement à clé publique de deux facons: 1) nous donnons une meilleure garantie de sécurité que les chiffrements à clé publique typiques, qui gère de nombreux utilisateurs pouvant coopérer pour réaliser des attaques sophistiquées. Une telle sécurité est nécessaire lorsque l'on considère des schémas de chiffrement largement déployés, où de nombreuses sessions ont lieu de manière concurrente, ce qui est le cas sur internet; 2) nous considérons le chiffrement fonctionnel, introduit en 2011 par Boneh, Sahai et Waters, qui permet un calcul sélectif sur les données chiffrées, par opposition à l'accès tout ou rien permis par les schémas de chiffrement à clé publique traditionnels. Il généralise ce dernier dans le sens où une clé secrète maîtresse permet de générer des clés de chiffrement fonctionnelles, qui sont chacune associées à une fonction particulière. Le déchiffrement du chiffrement d'un message m avec une clé de déchiffrement fonctionnelle associée à une fonction f obtiendra la valeur f (m), et aucune autre information à propos du message chiffré m. Un scénario typique: des données médicales privées sont chiffrées, et des clés de déchiffrement fonctionnelles sont générées pour des fonctions qui permettent de calculer des statistiques, sans révéler les données individuelles chiffrées.

Dans cette thèse, nous présentons un nouveau schéma de chiffrement à clé publique satisfaisant une garantie de sécurité forte, qui ne se dégrade pas avec le nombre de clients utilisant le schéma, et qui empêche les adversaires de modifier activement les chiffrés. Nos donnons aussi des schémas de chiffrement fonctionnels, dont la sécurité repose sur des hypothèses calculatoires robustes. L'approche suivie est bottom-up, où des constructions simples qui permettent de générer des clés pour une classe restreinte de fonctions sont étendues à des classes de fonctions plus riches. Un intérêt a aussi été porté à l'étude d'améliorations qui rendent le chiffrement fonctionnel plus utilisable en pratique, tel que le chiffrement fonctionnel multientré, où le chiffrement est partagé entre différents utilisateurs, sans coopération. Nous donnons aussi des techniques permettant de décentraliser la génération de clés de déchiffrement fonctionnelles, et la mise en place du schéma de chiffrement, de sorte que la présence d'un tiers de confiance possédant la clé secrète principale ne soit plus nécessaire. v

Introduction

Cryptography helps resolve the tension between the ubiquitous use of mistrusted third-party servers to store sensitive data, and the desire for privacy. Concentrating data in a few powerful centers induces economies of scale, and provides an unprecedented availability of computing power and data storage. However, giving away sensitive data in the clear implies that clients have to trust their providers. Advanced encryption mechanisms overcome this issue by allowing users to encrypt their data in a way that still permits servers to perform selective computation on this encrypted data. The information revealed is exactly what is required by the server to provide its service to the clients, and nothing else. Moreover, given its unprecedented worldwide deployment, public-key cryptography needs to fulfill a strong security, which prevents sophisticated attacks using multiple concurrent sessions, which are inevitable on the Internet.

The work presented in this thesis addresses the following two limitations of traditional public-key cryptography: 1) it provides stronger security for public-key encryption, that does not degrade with the number of users, as is necessary for largely deployed systems, 2) it presents encryption schemes, known as functional encryption schemes, which permit fine-grained access and selective computation on the encrypted data.

Public-key cryptography. Following the tradition in cryptography, we exemplify publickey encryption using fictional characters Alice and Bob. Alice wants to send sensitive data to Bob through an insecure channel. Without sharing any information a priori, Alice and Bob can use public-key cryptography to prevent Eve, the eavesdropper, to intercept and read the content of the data. Namely, Bob produces a public key, which can be thought of as the digital analog of a safe, together with a key that opens the safe. The key is kept secret by Bob, whereas the safe itself is published for anybody to use (in the digital world, objects can be copied at will, and used indefinitely many times). Alice puts her message in the safe, closes it (think of a safe that can be closed without the key; this process is referred to as encrypting the message), and sends the safe (known as the ciphertext) to Bob, who can open it with his key (this process is referred to as decrypting the ciphertext). Eve doesn't see the content inside the safe, since it's opaque, thus, the message remains confidential. The only information that is revealed is an upper bound on the size of the message, since the safe has to be at least as large as the message it contains. Originally put forth by [START_REF] Diffie | New directions in cryptography[END_REF][START_REF] Merkle | Secure communications over insecure channels[END_REF], public-key encryption has become ubiquitous, in particular with the Transport Layer Security (TLS) protocol, which has widespread use on the Internet, such as web browsing or instant messaging.

Methodology: defining security. The security of public-key encryption is defined formally as a game between an adversary that tries to win, that is, to trigger a particular event, or learn some particular information (for instance, in an encryption scheme, the adversary wins if it can recover the encrypted message only knowing the public key), and a challenger that interacts with the adversary. The game simply specifies which messages are sent by the challenger game can be used by a reduction to break a computational problem that is assumed to be hard. However, the reduction may be slightly less efficient at breaking the hard problem than the adversary can win the security game. This gap in efficiency is referred to as the security loss. When choosing the security parameter according to the reduction, it is necessary to take into account this security loss. For instance, say we want 128 bits of security for a particular scheme, which means no efficient adversary should be able to break the security of the scheme with advantage more than 2 -128 . Suppose the reduction leverages the adversary to break the discrete logarithm problem with advantage 2 -128 /L, where L is the security loss. Typically, the security loss grows with the number of challenge ciphertexts involved in the security game. That is, the more deployed the scheme, the larger the security loss. This can be an issue for widespread cryptographic protocols, such as TLS, where sophisticated attacks using many concurrent sessions can be mounted. For instance, L can be as large as 2 30 in widely deployed systems. Then, it is necessary to choose a group where it is assumed to be impossible to solve the discrete logarithm problem efficiently with an advantage of more than 2 -158 . In other words, a large security loss implies large parameters, and a less efficient scheme overall. Security is said to be tight when the security loss is small and in particular, independent of the number of clients using the scheme.

State of the Art in Tight Security

The most basic security guarantee required from a public-key encryption scheme is IND-CPA security, which stands for INDistinguishability against Chosen-Plaintext Attacks, defined in [START_REF] Goldwasser | Probabilistic encryption[END_REF], which captures passive, eavesdropping attacks. Many existing IND-CPA-secure encryption schemes have a tight security. For instance, this is the case of El Gamal encryption scheme [START_REF]A public key cryptosystem and a signature scheme based on discrete logarithms[END_REF], whose security tightly reduces to the Decisional Diffie Hellman (DDH) assumption [START_REF] Diffie | New directions in cryptography[END_REF], a standard assumption that implies the discrete logarithm assumption. This directly follows from the fact that the DDH assumption is random self-reducible: it is as easy to break many instances of the DDH assumption than just one instance, for a given prime-order group. However, the de facto security definition for public-key encryption is a stronger so-called IND-CCA, which stands for INDistinguishability against Chosen-Ciphertexts Attacks, originally introduced in [START_REF] Dolev | Nonmalleable cryptography[END_REF][START_REF] Rackoff | Non-interactive zero-knowledge proof of knowledge and chosen ciphertext attack[END_REF], where the adversary can actively manipulate and tamper with ongoing ciphertexts. Such attacks have been shown to be practically realizable in real life, such as the attack from [START_REF] Bleichenbacher | Chosen ciphertext attacks against protocols based on the rsa encryption standard pkcs# 1[END_REF] on a widely used cryptographic protocol. Unfortunately, most CCA-secure public-key encryption schemes, such as the seminal construction from [START_REF] Cramer | A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack[END_REF], or its improvements in [START_REF] Kurosawa | A new paradigm of hybrid encryption scheme[END_REF][START_REF] Hofheinz | Secure hybrid encryption from weakened key encapsulation[END_REF], do not have a tight security proof: the security loss is proportional to the number of challenge ciphertexts in the security game. The first CCAsecure public-key encryption with a tight security proof was given in [START_REF] Hofheinz | Tightly secure signatures and public-key encryption[END_REF], and a long line of works [LJYP14, LPJY15, HKS15, AHY15a, GCD + 16, Hof17] improved efficiency considerably. However, the security of all of these schemes rely on a qualitatively stronger assumption than non-tightly secure schemes [CS98, [START_REF] Kurosawa | A new paradigm of hybrid encryption scheme[END_REF][START_REF] Hofheinz | Secure hybrid encryption from weakened key encapsulation[END_REF], in particular, they require pairing-friendly elliptic curves (henceforth simply referred to as pairings), an object first used for cryptography in [START_REF] Boneh | Identity-based encryption from the Weil pairing[END_REF][START_REF] Boneh | Identity-based encryption from the weil pairing[END_REF][START_REF] Joux | A one round protocol for tripartite diffie-hellman[END_REF][START_REF] Joux | A one round protocol for tripartite diffie-hellman[END_REF]. This situation prompted the following natural question: does tight security intrinsically require a qualitatively stronger assumption, for CCA-secure public-key encryption? This question falls into the broad theoretical agenda that aims at minimizing the assumptions required to build cryptographic objects as fundamental as public-key encryption. Besides, eliminating the use of pairings is also important in practice, because it broadens the class of groups that can be used for the underlying computational assumption. In particular, it makes it possible to choose groups that admit more efficient group operations and more compact representations, and also avoid the use of expensive pairing operations.

Contribution 1: Tightly CCA-Secure Encryption without Pairing

In [GHKW16], which is presented in Chapter 3 of this thesis, we answer this question negatively. Namely, we present the first CCA-secure public-key encryption scheme based on DDH where the security loss is independent of the number of challenge ciphertexts and the number of decryption queries, whereas all prior constructions [LJYP14, LPJY15, HKS15, AHY15a, GCD + 16, Hof17] rely on the use of pairings. Moreover, our construction improves upon the concrete efficiency of prior schemes, reducing the ciphertext overhead by about half (to only 3 group elements under DDH), in addition to eliminating the use of pairings. Figure 1.1 gives a comparison between existing CCA-secure public-key encryption schemes. One limitation of our construction is its large public key: unlike the schemes with looser security reduction from [CS98, [START_REF] Kurosawa | A new paradigm of hybrid encryption scheme[END_REF][START_REF] Hofheinz | Secure hybrid encryption from weakened key encapsulation[END_REF], which admit a public key that only contains a constant number of group elements, our public key contains λ group elements, where λ denotes the security parameter. Using techniques from [START_REF] Hofheinz | Adaptive partitioning[END_REF], we present in [GHK17] the first CCAsecure public-key encryption with a tight security reduction to the DDH assumption (without pairings), whose public key only contains a constant number of group elements. The efficiency is comparable with [GHKW16], since the ciphertexts only contain three group elements. We choose to only present in this thesis the work from the precursor [GHKW16].

Functional Encryption

We now proceed to address another limitation of traditional public-key encryption: it only provides an all-or-nothing access to the encrypted data. Namely, with the secret key, one can decrypt the ciphertext and recover the message entirely; without the secret key, nothing is revealed about the encrypted message (beyond its size). To broaden the scope of applications of public-key encryption, [O'N10,[START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF] introduced the concept of functional encryption, which permits selective computations on the encrypted data, that is, it allows some authorized users to compute partial information on the encrypted data. In a functional encryption scheme,

• Using functional encryption, one can perform machine learning on encrypted data. Namely, after a classifier is learned on plain data, one can generate a functional decryption key associated with this classifier, which allows decryption to run the classification on encrypted data, and reveals only the result of the classification. In [START_REF] Sans | Reading in the dark: Classifying encrypted digits with functional encryption[END_REF], a concrete implementation of functional encryption performs classification of hand-written digits from the MNIST dataset, with 97.54% accuracy, where the encryption and decryption only take a few seconds.

Difference with respect to fully homomorphic encryption. In a fully homomorphic encryption scheme, it is possible to publicly evaluate any function on the encrypted data. This differs from functional encryption in two major ways: first, the result of evaluating a function f on an encryption of message m does not reveal the evaluation f (m) in the clear, but only an encryption of it. Consider the email filtering scenario: using fully homomorphic encryption, the email server would not be able to decide whether an incoming encrypted email is spam, without the intervention of the client, who is the only one who can decrypt the result of the evaluation on encrypted data. Second, using fully homomorphic encryption, anyone can compute arbitrary functions on the encrypted data: there is no guarantee that the computation was performed correctly. In a functional encryption scheme, the owner of the functional decryption key associated with function f can extract f (m), from an encryption of m, and nothing else. In particular, this gives verifiability for free, unlike fully homomorphic encryption, which requires additional costly zero-knowledge proofs to verify that the proper function has been evaluated on the encrypted data.

Security of functional encryption. Security notions for functional encryption were first given in [O'N10,[START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF]. These works present a simulation-based security definition, where an efficient simulator is required to generate the view of the adversary in the security game, only knowing the information that leaks from the encrypted values and corrupted functional decryption keys. They prove that such a security notion is impossible to achieve in general, and give another indistinguishability-based variant of the security definition, essentially a security definition similar to [START_REF] Goldwasser | Probabilistic encryption[END_REF], generalized to the context of functional encryption. In this security game, an adversary receives the public key of the encryption scheme, and then, it can obtain functional decryption keys for functions f of its choice. It also sends two messages, m 0 and m 1 , to the challenger, in the security game, which samples a random bit b ← R {0, 1}, and sends back an encryption of the message m b . Assuming the functional encryption keys that are obtained by the adversary are associated with functions f that do not distinguish these two messages, that is, for which f (m 0 ) = f (m 1 ), the adversary should not be able to guess which bit b was used with a probability significantly more than 1/2, which can be obtained by random guessing. Intuitively, if the functions f do not help distinguish these two messages, then no information should be revealed about which message m b was encrypted. An artificial but useful weakening of the security model is the so-called selective security, where the game is identical to the description above, except the adversary is required to decide on which messages m 0 and m 1 to choose beforehand, that is, before seeing the public key or obtaining any functional decryption keys. This notion is useful as a stepping stone towards full-fledged security. Moreover, a guessing argument can convert any selectively-secure scheme into a fully-secure scheme, albeit with a quantitative gap in the quality of the security.

State of the Art in Functional Encryption

Identity-based encryption. Historically, the first functional encryption scheme beyond traditional public-key encryption dates back to identity-based encryption, where a constantsize public key is used to encrypt messages to different users, represented by their identity. Functional decryption keys are also associated with an identity, and decryption succeeds to recover the encrypted message if the identities associated with the ciphertext and the functional decryption key match. For instance, identities can be email addresses, and with a single public key, it is possible to encrypt a message to any user whose email address is known. The concept was thought of in [START_REF] Shamir | Identity-based cryptosystems and signature schemes[END_REF], and the first constructions whose security relied on standard assumptions were given in [START_REF] Boneh | Identity-based encryption from the Weil pairing[END_REF][START_REF] Cocks | An identity based encryption scheme based on quadratic residues[END_REF].

Attribute-based encryption. Later, a more general concept was introduced: attributebased encryption, where ciphertexts are associated with an access policy, and functional decryption keys are associated with a set of attributes. Decryption recovers the encrypted message if the attributes associated with the functional decryption key satisfy the access policy embedded in the ciphertext. Note that the role can be switched, that is, ciphertexts can be associated with attributes, and functional decryption keys embed access policies, as in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. These are referred to as key-policy and ciphertext-policy attributed-based encryption, respectively. Such attribute-based encryption schemes have been first realized from standard assumptions in [START_REF] Sahai | Fuzzy identity-based encryption[END_REF][START_REF] Goyal | Attribute-based encryption for fine-grained access control of encrypted data[END_REF] for policies that can be represented as Boolean formulas, or in [GVW13, GVW15a, BGG + 14] for policies that can be represented as any arbitrary circuit of polynomial size. Note that a ciphertext only hides the underlying message it encrypts, but reveals the associated access policy (or attributes, depending on whether we consider ciphertext-policy or key-policy attribute-based encryption).

Predicate encryption. Predicate encryption schemes are even more powerful than attributebased encryption schemes, since the access policy associated with a ciphertext remains hidden (or the attributes, depending on whether we consider the ciphertext-policy or the key-policy variant). The first constructions from standard assumptions were given in [START_REF] Boneh | Conjunctive, subset, and range queries on encrypted data[END_REF] for comparison and subset queries, in [START_REF] Katz | Predicate encryption supporting disjunctions, polynomial equations, and inner products[END_REF][START_REF] Katz | Predicate encryption supporting disjunctions, polynomial equations, and inner products[END_REF] for constant-depth Boolean formulas, and in [START_REF] Gorbunov | Predicate encryption for circuits from LWE[END_REF] for all circuits. Such predicate encryption schemes are sometimes referred to as private-index predicate encryption, whereas attribute-based encryption (which do not hide the policy or attributes underlying each ciphertext) are referred to as public-index predicate encryption. It is important to note that the construction from [START_REF] Gorbunov | Predicate encryption for circuits from LWE[END_REF] only hides the attributes underlying each ciphertext (they build a key-policy predicate encryption, where attributes are associated with ciphertexts) when the adversary can only obtain functional decryption keys for access policies which are not satisfied by the attribute of the challenge ciphertext. This is referred to as weakly-hiding the attributes. Prior works [BW07, [START_REF] Katz | Predicate encryption supporting disjunctions, polynomial equations, and inner products[END_REF][START_REF] Katz | Predicate encryption supporting disjunctions, polynomial equations, and inner products[END_REF] fully hide the attributes associated with each ciphertext, the only information that leaks being the value of the predicate evaluation, namely, whether or not the decryption succeeds. In fact, fully-hiding predicate encryption for all circuits essentially implies functional encryption for all circuits, for which we have no construction based on standard assumptions. We defer the interested reader to [START_REF] Gorbunov | Predicate encryption for circuits from LWE[END_REF]1.3 Discussion] for further details on the connections between predicate encryption and functional encryption for all circuits.

Functional encryption beyond predicates. So far, we have only discussed special kinds of functional encryption where decryption successfully recovers the entire message if the attributes associated with the ciphertext (resp. the functional decryption key) satisfy the access policy embedded in the key (resp. the ciphertext). While this is a fruitful generalization of traditional public-key encryption, since it permits embedding complex access policy into the encrypted data, this is still an all-or-nothing encryption: either the message is entirely recovered by the decryption, or no information whatsoever is revealed about the message. Not much is known about functional encryption with fine-grained access to the encrypted data, that is, where decryption recovers partial information about the encrypted data. In [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF], the authors build the first construction of functional encryption from standard assumptions beyond predicates. In [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF], messages to be encrypted are vectors of integers, in Z d , for some dimension d ∈ N that is fixed during the setup of the scheme. Functional decryption keys are associated with vectors y ∈ Z d . Decryption of an encryption of x ∈ Z d with a functional decryption key associated with y ∈ Z d recovers x, y ∈ Z, which denotes the inner product between x and y. Otherwise stated, this encryption scheme lets owners of functional decryption keys compute weighted sum on the encrypted data. Moreover, it is possible to encode any constant-depth formula as a polynomial of constant degree, which can be evaluated via functional encryption for inner products. That is, this scheme handles computation of NC0 circuits on encrypted data. Later, [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] gave fully-secure functional encryption schemes (the original schemes from [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF] being only selectively-secure). In this thesis, we present extensions of these functional encryption for inner products, and new functional encryption schemes with succinct ciphertexts that supports the evaluation of degree-2 polynomials on encrypted data. More details on the contributions of this thesis are given below.

Related works: functional encryption for bounded collusion.

The case where security is guaranteed only when a constant number of functional decryption keys are corrupted has been considered in prior works. [START_REF] Sahai | Worry-free encryption: functional encryption with public keys[END_REF] built the first functional encryption for all circuits, where security handles the corruption of one functional decryption key, using garbled circuits and public-key encryption. In this functional encryption, the ciphertext size depends on the size of the circuit associated with the functional decryption keys (which thus needs to be bounded during the setup of the scheme). [GKP + 13] improves upon [START_REF] Sahai | Worry-free encryption: functional encryption with public keys[END_REF] since the ciphertext size depends only on the size of the output of the function for which functional decryption keys are generated. They use attributed-based encryption for all circuits, and fully homomorphic encryption, both of which admits construction from standard assumptions. Note that the security of both of these constructions breaks down as soon as two functional decryption keys are corrupted. [START_REF] Gorbunov | Functional encryption with bounded collusions via multi-party computation[END_REF][START_REF]Stronger security for reusable garbled circuits, general definitions and attacks[END_REF] show how to generically turn any functional encryption secure only when one functional decryption key is corrupted, into a functional encryption scheme where security handles an a priori bounded polynomial number of collusions. We now consider the case of general functional encryption with unbounded collusions.

Theoretical motivation: the power of general purpose functional encryption. As mentioned before, the existing functional encryption schemes from standard assumptions only permit the evaluation of degree-1 (inner products) or degree-2 polynomials on the encrypted data. However, there are feasibility results for functional encryption schemes where functions associated to functional decryption keys can be any arbitrary circuits (such schemes are called general purpose functional encryption schemes). The first candidate construction for general purpose functional encryption appeared in [GGH + 13b, GGH + 16]. It relies on Indistinguishability Obfuscation, a powerful object, originally defined in [BGI + 01, BGI + 12], that has been remarkably successful at providing an all-purpose tool for solving cryptographic problems, as shown in [START_REF] Sahai | How to use indistinguishability obfuscation: deniable encryption, and more[END_REF]. [GGH + 13b, GGH + 16] gave a construction for Indistinguishability Obfuscation that relies on cryptographic multilinear maps, for which there is currently no construction from standard assumptions. Other works [BLR + 15, GGHZ16] gave direct candidate constructions of functional encryption from multilinear maps. Follow-ups [Lin16, LV16, Lin17, AS17, LT17] focused on reducing the degree of the required multilinear map, all the way down to 3 in [START_REF] Lin | Indistinguishability obfuscation from trilinear maps and block-wise local PRGs[END_REF] (the degree of the multilinear map required in prior works depends on the complexity of the circuits for which functional decryption keys are generated). Namely, in [START_REF] Lin | Indistinguishability obfuscation from trilinear maps and block-wise local PRGs[END_REF], general purpose functional encryption is built from succinct functional encryption which handles evaluation of degree-3 polynomials on encrypted data (which can be built from degree 3 multilinear maps), together with some assumptions on the existence of special kind of pseudo-random generators 1 . Here, succinctness refers to the fact that the ciphertext size only depends on the underlying message, and not the functions for which functional decryption keys are generated. Unfortunately, there is no construction of even degree-3 multilinear from standard assumptions. To sum up, all existing general purpose functional encryption schemes either rely on multilinear maps, or Indistinguishability Obfuscation, both of which rely on non-standard assumptions. In fact, general purpose functional encryption has been shown to imply Indistinguishability Obfuscation in [AJ15, [START_REF] Bitansky | Indistinguishability obfuscation from functional encryption[END_REF][START_REF] Bitansky | From cryptomania to obfustopia through secret-key functional encryption[END_REF].

Contribution 2: Functional Encryption with New Features, and Richer Functionalities

Motivated by the quest for succinct functional encryption for richer classes of functions, we follow the bottom-up approach initiated by [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF], which consists of building functional encryption as expressive as possible from standard assumptions. The benefit of this approach is two-fold: first, it aims at bridging the gap between the powerful Indistinguishability Obfusction, and the current constructions from standard assumptions; second, it gives practically relevant schemes based from concrete assumptions, which are interesting in their own right. We present extensions of the original functional encryption for inner products from [ABDP15, ALS16] with additional features: in contribution 2.1, we extend functional encryption for inner products to the multi-input setting, and to the multi-client setting in contribution 2.2, both of which generalize the standard single-input setting. Then, we expand functional encryption for richer classes of functions in contribution 2.3. These contributions are presented in more details below.

Contribution 2.1: multi-input encryption for inner products.

We present here an extension of the original functional encryption from [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF][START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] to the more general multi-input setting.

Definition of multi-input functional encryption. As explained above, in a functional encryption (FE) scheme [START_REF] Sahai | Fuzzy identity-based encryption[END_REF][START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF], an authority can generate restricted decryption keys that allow users to learn specific functions of the encrypted messages and nothing else. That is, each FE decryption key dk f is associated with a function f and decrypting a ciphertext Enc(x) with dk f results in f (x). Multi-input functional encryption (MIFE) introduced by [GGG + 14] is a generalization of functional encryption to the setting of multi-input functions. A MIFE, the scheme has several encryption slots and each decryption key dk f for a multi-input function f decrypts jointly ciphertexts Enc(x 1 ), . . ., Enc(x n ) for all slots to obtain f (x 1 , . . . , x n ) without revealing anything more about the encrypted messages. The MIFE functionality provides the capability to encrypt independently messages for different slots. This facilitates scenarios where information, which will be processed jointly during decryption, becomes available at different points of time or is provided by different parties. MIFE has many applications related to computation and data mining over encrypted data coming from multiple sources, which include examples such as executing search queries over encrypted data, processing encrypted streaming data, non-interactive differentially private data releases, multi-client delegation of computation, order-revealing encryption [GGG + 14, BLR + 15].

Application of multi-input functional encryption for inner products. For instance, consider a database that contains profiles of the employees in company, where each profile describes the qualifications that the person has and the position that she can hold. Each such profile can be represented as an integer vector that contains the scores that person has received for her qualifications in her last evaluation. The employee profiles are sensitive information and only direct managers can access the profile information of the people in their teams. Therefore, the information of profiles needs to be protected from everyone else in the company. At the same time when the company starts a new project, the manager assigned to lead the project needs to select people for the new team. According to the needs of the project, the team should have people serving different roles; the qualifications of each team member have different importance for every project. The selection criterion for the team members can be described as an integer vector that assigns weights to the different qualifications for the members in all team positions. In order to evaluate and compare potential teams, the manager needs to obtain the team score for each of them, which is the weighted sum of the individual qualifications.

A MIFE for inner products provides a perfect solution for the above scenario that protects the privacy of the profiles while enabling managers to evaluate possible team configurations. MIFE encryption slots will correspond to different team positions. Each person's profile will be a vector of her scores, which will be encrypted for the slot corresponding to the position she is qualified to hold. When a new project is established, the leading manager is granted a decryption key that is associated with an integer vector that assigns appropriate weight to each qualification of different team members. The manager can use this key to evaluate different combinations of people for the team while learning nothing more about the people's profiles than the team score. A similar example is the construction of a complex machine that requires parts from different manufacturers. Each part is rated based on different quality characteristics and prices, which are all manufacturer's proprietary information until a contract has been signed. The ultimate goal is to assemble a construction of parts that achieve a reasonable trade-off between quality and price. In order to evaluate different construction configurations, the company wants to compute cumulative score for each configuration that is a weighted sum over the quality rates and price of each of the parts.

State of the art for multi-input functional encryption.

There are several constructions of MIFE schemes, which can be broadly classified as follows: (i) feasibility results for general circuits [GGG + 14, BGJS15, AJ15, BKS16], and (ii) constructions for specific functionalities, notably comparison, which corresponds to order-revealing encryption [BLR + 15]. Unfortunately, all of these constructions rely on indistinguishability obfuscation, single-input FE for circuits, or multilinear maps [GGH + 13b, GGH13a], which we do not know how to instantiate under standard and well-understood cryptographic assumptions.2 A new construction of MIFE for inner products. In [AGRW17], we present a multiinput functional encryption scheme (MIFE) for inner products based on standard assumptions in prime-order bilinear groups. Our construction works for any polynomial number of encryption slots and achieves adaptive security against unbounded collusion, while relying on standard polynomial hardness assumptions. Prior to this work, we did not even have a candidate for 3-slot MIFE for inner products in the generic bilinear group model. Our work is also the first MIFE scheme for a non-trivial functionality based on standard cryptographic assumptions, as well as the first to achieve polynomial security loss for a super-constant number of slots under falsifiable assumptions. Prior works required stronger non-standard assumptions such as indistinguishability obfuscation or multilinear maps. Later, in [ACF + 18], we put forward a novel methodology to convert single-input functional encryption for inner products into multiinput schemes for the same functionality. Our transformation is surprisingly simple, general and efficient. In particular, it does not require pairings and it can be instantiated with all known single-input schemes. This leads to two main advances. First, we enlarge the set of assumptions this primitive can be based on, notably, obtaining new MIFEs for inner products from plain DDH, LWE, and Decisional Composite Residuosity. Second, we obtain the first MIFE schemes from standard assumptions where decryption works efficiently even for messages of super-polynomial size. In this thesis, we strengthen the security of these constructions to handle corruption of the input slots. That is, to encrypt, each input slot i ∈ [n] requires an encryption key ek i . We consider the private-key setting, where encryption keys remain secret. This is actually more relevant than the public-key setting, where the encryption keys ek i are revealed to everyone. Indeed, in such a case, anyone can encrypt arbitrary message for any input slot. That weakens security drastically, since a challenge ciphertext Enc(ek i , m b ) for message m b i , where b ← R {0, 1} is chosen by the security game, can be combined with encryption of arbitrary messages for the other input slots during decryption. That means that given even a single functional decryption key for a function f , one can learn f ( * ,

• • • , * , m b i , * , x • • • , * )
, where each * can be any arbitrary message. This is simply too much information in most relevant use cases. Thus, we consider the setting where encryption keys ek i aren't public, which avoids precisely this kind of leakage of information. In the schemes presented in Chapter 4 and Chapter 5, the security holds even when some ek i are corrupted. That means that even given ek i for some slots i ∈ [n], the security remains for other slots j = i. This is an important security feature, since that means even colluding users cannot learn any information about the encrypted messages by other users. This is relevant to assume such collusions, since in a multi-input encryption scheme, users do not communicate with each other, and do not trust each other. This is a novelty compared to [AGRW17, ACF + 18]. A summary of our results and prior works on functional encryption for inner products is shown in Figure 1 We now present another contribution of this thesis, which is an extension of multi-input functional encryption, where the encryption can additionally handle labels, which prevents mixing and matching different ciphertexts with different labels, thereby giving a stronger security notion. The labels are typically set to be time stamps, for the application we have in mind.

Definition of multi-client functional encryption.

In multi-client functional encryption, as defined in [GGG + 14, GKL + 13], the single input x to the encryption procedure is broken down into an input vector (x 1 , . . . , x n ) where the components are independent. An index i for each client and a (typically time-based) label ℓ are used for every encryption:

(c 1 = Enc(1, x 1 , ℓ), . . . , c n = Enc(n, x n , ℓ)).
Anyone owning a functional decryption key dk f , for an n-ary function f and multiple ciphertexts for the same label ℓ, c 1 = Enc(1, x 1 , ℓ), . . . , c n = Enc(n, x n , ℓ), can compute f (x 1 , . . . , x n ) but nothing else about the individual x i 's. The combination of ciphertexts generated for different labels does not give a valid global ciphertext and the adversary learns nothing from it. This is different from multi-input functional encryption, where every ciphertext for every slot can be combined with any other ciphertext for any other slot, and used with functional decryption keys to decrypt an exponential number of values, as soon as there is more than one ciphertext per slot. This "mix-and-match" feature is crucial for some of the applications of MIFE, such as building Indistinguishability Obfuscation [GGG + 14]. However, it also means the information leaked about the underlying plaintext is too much for some applications. In the multi-client setting, however, since only ciphertexts with the same label can be combined for decryption, the information leaked about the encrypted messages is drastically reduced.

Decentralized multi-client functional encryption. While it allows independent generation of the ciphertexts, multi-client functional encryption (like multi-input functional encryption) still assumes the existence of a trusted third party who runs the Setup algorithm and distributes the functional decryption keys. This third party, if malicious or corrupted, can easily undermine any client's privacy. We are thus interested in building a scheme in which such a third party is entirely taken out of the equation. In [CDG + 18a], we introduce the notion of decentralized multi-client functional encryption, in which the authority is removed and the clients work together to generate appropriate functional decryption keys. We stress that the authority is not simply distributed to a larger number of parties, but that the resulting protocol is indeed decentralized: each client has complete control over their individual data and the functional keys they authorize the generation of.

A new decentralized multi-client functional encryption for inner products. In [CDG + 18a], we give the first decentralized multi-client functional encryption from standard assumptions, for inner products. Security is proven using bilinear pairing groups, and handles corruption of input slots. We first give an efficient centralized scheme whose security does not take into account the information leaked when decrypting incomplete ciphertexts, that is, ciphertexts for some, but not all, slots i ∈ [n]. Moreover, this scheme is only secure when there is only one challenge ciphertext per pair (i, ℓ), where i ∈ [n] is an input slot, and ℓ is a label. The construction we give in Chapter 6 is a generalization of [CDG + 18a] to encrypt vectors (instead of scalars in [CDG + 18a]). Then, we deal with the limitation in the security model that requires for complete ciphertexts only. Our solution is quite generic, as this is an additional layer that is applied to the ciphertexts so that, unless the ciphertext is complete (with all the encrypted components), no information leaks about the individual ciphertexts, and thus on each component. This technique relies on a linear secret sharing scheme, hence the name Secret Sharing Encapsulation (SSE). It can also be seen as a decentralized version of All-Or-Nothing Transforms [Riv97, Boy99, CDH + 00]. We propose a concrete instantiation in pairing-friendly groups, under the Decisional Bilinear Diffie-Hellman problem, in the random oracle model. This transformation works on any MCFE, and not only MCFE for inner products. Secondly, we show how another independent layer of single-input functional encryption for inner products authorizes repetitions: more precisely, we remove the restriction of a unique input per client and per label. Finally, we propose an efficient decentralized algorithm to generate a sum of private inputs, which can convert an MCFE for inner products into a decentralized MCFE for inner products: this technique is inspired from [START_REF] Kursawe | Privacy-friendly aggregation for the smart-grid[END_REF], and only applies to the functional decryption key generation algorithm, and so this is compatible with the two above conversions. The resulting scheme is completely decentralized, in the sense that users do not need a trusted third party, even for setting up parameters (they just need to agree on a specific pairing group and a hash function that will be used later). These techniques used to strengthen the security of MCFE, as well as decentralize the key generation and setup, appeared in [CDG + 18b].

A use case. Consider a financial firm that wants to compute aggregates of several companies' private data (profits, number of sales) so that it can better understand the dynamics of a sector. The companies may be willing to help the financial firm understand the sector as whole, or may be offered compensation for their help, but they don't trust the financial firm or each other with their individual data. After setting up a DMCFE, each company encrypts its private data with a time-stamp label under its private key. Together, they can give the financial firm a decryption aggregation key that only reveals a sum on the companies' private data weighted by public information (employee count, market value) for a given time-stamp. New keys can retroactively decrypt aggregates on old data. In [BCFG17], we build the first functional encryption scheme based on standard assumptions that supports a functionality beyond inner products, or predicates. Our scheme allows to compute bilinear maps over the integers: messages are expressed as pairs of vectors (x, y) ∈ Z n × Z m , secret keys are associated with n • m coefficients α i,j , and decryption allows to compute i,j α i,j x i y j . Bilinear maps represent a very general class of quadratic functions that includes, for instance, multivariate quadratic polynomials. These functions have several practical applications. For instance, a quadratic polynomial can express many statistical functions (e.g. (weighted) mean, variance, covariance, root-mean-square), the Euclidean distance between two vectors, and the application of a linear or quadratic classifier (e.g., linear or quadratic regression).

Private stream aggregation (PSA

In [START_REF] Sans | Reading in the dark: Classifying encrypted digits with functional encryption[END_REF], we implement a functional encryption scheme for bilinear maps to perform machine learning on encrypted data. Namely, a quadratic classifier is learned on plain data, then, a functional decryption key is generated for a function that corresponds to the quadratic classifier. Using functional encryption, users can encrypt data, and the owner of the functional decryption key can perform classification of the encrypted data, without ever decrypting the data. In particular, no information apart from the result of the classification4 is revealed about the encrypted data. In [START_REF] Sans | Reading in the dark: Classifying encrypted digits with functional encryption[END_REF], the quadratic classifier has an accuracy of 97.54% on MNIST data set of hand-written digits, where encryption and decryption only take a few seconds. In [BCFG17], we present a fully-secure construction whose security is proven in an idealized model, called the Generic Group Model (GGM), where the adversary cannot use the structure of the underlying pairing group. This is justified in practice, since for well-chosen elliptic curves, the only known attacks are generic, they do not use the structure of the underlying group. The security of the construction from [DGP18] also relies on the generic group model. In Chapter 7, we present the construction from [BCFG17] that is proven selectively-secure under standard assumptions, as opposed to relying on the generic group model. Note that [AS17, Lin17] concurrently exhibited functional encryption schemes supporting the evaluation of degree-2 polynomials, but on the arguably simpler private-key setting, where encryption Figure 1.4: Existing functional encryption for quadratic functions. Here, ad. and sel. denote adaptive and selective security respectively and GGM stands for Generic Group Model. requires a secret key. A comparison of existing functional encryption schemes for quadratic functions is given in Figure 7.1.

Other contributions

In this manuscript, we focus on presenting tightly-secure encryption, and functional encryption schemes. During this thesis, we have been also working on other topics, which led to papers accepted in peer-reviewed conferences. We give a brief description of these contributions here. A list of personal publications appears at the end of this manuscript.

• In [GMW15], we construct a lattice-based predicate encryption scheme for multi-dimensional range and multi-dimensional subset queries. Our scheme is selectively-secure and weakly attribute-hiding, and its security is based on the standard Learning With Errors (LWE) assumption. Multi-dimensional range and subset queries capture many interesting applications pertaining to searching on encrypted data. To the best of our knowledge, these were the first lattice-based predicate encryption schemes for functionalities beyond IBE and inner products.

• In [CGW15], we present a modular framework for the design of efficient adaptively secure attribute-based encryption (ABE) schemes for a large class of predicates under the standard k-Lin assumption in prime-order groups; this is the first uniform treatment of dual system ABE across different predicates and across both composite and prime-order groups. Via this framework, we obtain concrete efficiency improvements for several ABE schemes. Our framework has three novel components over prior works: (i) new techniques for simulating composite-order groups in prime-order ones (ii) a refinement of prior encodings framework for dual system ABE in composite-order groups (iii) an extension to weakly attribute-hiding predicate encryption (which includes anonymous identity-based encryption as a special case).

• In [GKW15], we initiate a systematic treatment of the communication complexity of conditional disclosure of secrets (CDS), where two parties want to disclose a secret to a third party if and only if their respective inputs satisfy some predicate. We present a general upper bound and the first non-trivial lower bounds for conditional disclosure of secrets. Moreover, we achieve tight lower bounds for many interesting setting of parameters for CDS with linear reconstruction, the latter being a requirement in the application to attribute-based encryption. In particular, our lower bounds explain the trade-off between ciphertext and secret key sizes of several existing attribute-based encryption schemes based on the dual system methodology.

• In [FGKO17], we build new Access Control Encryption (ACE), which is a novel paradigm for encryption which allows to control not only what users in the system are allowed to read but also what they are allowed to write. The original work of Damgård et al. [START_REF] Damgård | Access control encryption: Enforcing information flow with cryptography[END_REF] introducing this notion left several open questions, in particular whether it is possible to construct ACE schemes with polylogarithmic complexity (in the number of possible identities in the system) from standard cryptographic assumptions. In this work we answer the question in the affirmative by giving (efficient) constructions of ACE for an interesting class of predicates which includes equality, comparison, interval membership, and more. We instantiate our constructions based both on standard pairing assumptions (SXDH) or more efficiently in the generic group model.

• In [AGRW17], we present a multi-input functional encryption scheme (MIFE) for inner products based on the k-Lin assumption in prime-order bilinear groups. Our construction works for any polynomial number of encryption slots and achieves adaptive security against unbounded collusion, while relying on standard polynomial hardness assumptions. Prior to this work, we did not even have a candidate for 3-slot MIFE for inner products in the generic bilinear group model. Our work is also the first MIFE scheme for a non-trivial functionality based on standard cryptographic assumptions, as well as the first to achieve polynomial security loss for a super-constant number of slots under falsifiable assumptions. Prior works required stronger non-standard assumptions such as indistinguishability obfuscation or multilinear maps.

• In [BCFG17], we present two practically efficient functional encryption schemes for a large class of quadratic functionalities. Specifically, our constructions enable the computation of so-called bilinear maps on encrypted vectors. This represents a practically relevant class of functions that includes, for instance, multivariate quadratic polynomials (over the integers). Our realizations work over asymmetric bilinear groups and are surprisingly efficient and easy to implement. For instance, in our most efficient scheme the public key and each ciphertext consists of 2n+1 and 4n+2 group elements respectively, where n is the dimension of the encrypted vectors, while secret keys are only two group elements. Our two schemes build on similar ideas, but develop them in a different way in order to achieve distinct goals. Our first scheme is proved (selectively) secure under standard assumptions, while our second construction is concretely more efficient and is proved (adaptively) secure in the generic group model. As a byproduct of our functional encryption schemes, we show new predicate encryption schemes for degree-two polynomial evaluations, where ciphertexts consist of only O(n) group elements. This significantly improves the O(n 2 ) bound one would get from predicate encryption for inner products.

• In [ABGW17], we propose, implement, and evaluate fully automated methods for proving security of ABE in the Generic Bilinear Group Model ( [START_REF] Boneh | Hierarchical identity based encryption with constant size ciphertext[END_REF][START_REF] Boyen | The uber-assumption family (invited talk)[END_REF]), an idealized model which admits simpler and more efficient constructions, and can also be used to find attacks. Our method is applicable to Rational-Fraction Induced ABE, a large class of ABE that contains most of the schemes from the literature, and relies on a Master Theorem, which reduces security in the GGM to a (new) notion of symbolic security, which is amenable to automated verification using constraint-based techniques. We relate our notion of symbolic security for Rational-Fraction Induced ABE to prior notions for Pair Encodings. Finally, we present several applications, including automated proofs for new schemes.

• In [FG18], we focus on structure-preserving signatures on equivalence classes, or equivalenceclass signatures for short (EQS), are signature schemes defined over bilinear groups whose messages are vectors of group elements. Signatures are perfectly randomizable and given a signature on a vector, anyone can derive a signature on any multiple of the vector; EQS thus sign projective equivalence classes. Applications of EQS include the first constant-size anonymous attribute-based credentials, efficient round-optimal blind signatures without random oracles and efficient access-control encryption. To date, the only existing instantiation of EQS is proven secure in the generic-group model. In this work we show that by relaxing the definition of unforgeability, which makes it efficiently verifiable, we can construct EQS from standard assumptions, namely the Matrix-Diffie-Hellman assumptions. We then show that our unforgeability notion is sufficient for most applications.

• In [GHKP18], We provide a structure-preserving signature (SPS) scheme with an (almost) tight security reduction to a standard assumption. Compared to the state-of-theart tightly secure SPS scheme of O(λ), where λ is the security parameter, and Q = poly(λ) is the number of adversarial signature queries). While our scheme is still less compact than structure-preserving signature schemes without tight security reduction, it significantly lowers the price to pay for a tight security reduction.

In fact, when accounting for a non-tight security reduction with larger key (i.e., group) sizes, the computational efficiency of our scheme becomes at least comparable to that of non-tightly secure SPS schemes. Technically, we combine and refine recent existing works on tightly secure encryption and SPS schemes. Our technical novelties include a modular treatment (that develops an SPS scheme out of a basic message authentication code), and a refined hybrid argument that enables a lower security loss of O(log Q) (instead of O(λ)).

• In [ACF + 18], we present new constructions of multi-input functional encryption (MIFE) schemes for the inner-product functionality that improve the state of the art solution of Abdalla et al. [AGRW17] in two main directions. First, we put forward a novel methodology to convert single-input functional encryption for inner products into multiinput schemes for the same functionality. Our transformation is surprisingly simple, general, and efficient. In particular, it does not require pairings and it can be instantiated with all known single-input schemes. This leads to two main advances. First, we enlarge the set of assumptions this primitive can be based on, notably obtaining new MIFEs for inner products from plain DDH, LWE and Composite Residuosity. Second, we obtain the first MIFE schemes from standard assumptions where decryption works efficiently even for messages of super-polynomial size. Our second main contribution is the first function-hiding MIFE scheme for inner products based on standard assumptions. To this end, we show how to extend the original, pairing-based, MIFE by Abdalla et al. [AGRW17] in order to make it function hiding, thus obtaining a function-hiding MIFE from the MDDH assumption.

• In [GKW18], we present a new public-key broadcast encryption scheme where both the ciphertext and secret keys consist of a constant number of group elements. Our result improves upon the work of Boneh, Gentry, and Waters [START_REF] Boneh | Collusion resistant broadcast encryption with short ciphertexts and private keys[END_REF] in two ways: (i) we achieve adaptive security instead of selective security, and (ii) our construction relies on the decisional k-Linear Assumption in prime-order groups (as opposed to q-type assumptions or subgroup decisional assumptions in composite-order groups); our improvements come at the cost of a larger public key. Finally, we show that our scheme achieves adaptive security in the multi-ciphertext setting with a security loss that is independent of the number of challenge ciphertexts.

• In [CDG + 18a], we consider a situation where multiple parties, owning data that have to be frequently updated, agree to share weighted sums of these data with some aggregator, but where they do not wish to reveal their individual data, and do not trust each other. We combine techniques from Private Stream Aggregation (PSA) and Functional Encryption (FE), to introduce a primitive we call Decentralized Multi-Client Functional Encryption (DMCFE), for which we give a practical instantiation for inner products. This primitive allows various senders to non-interactively generate ciphertexts which support inner-product evaluation, with functional decryption keys that can also be generated non-interactively, in a distributed way, among the senders. Interactions are required during the setup phase only. We prove adaptive security of our constructions, while allowing corruptions of the clients, in the random oracle model.

Road-map.

The rest of this thesis is organized as follows. In Chapter 2, we give the relevant background on public-key encryption and functional encryption, including security definitions and concrete assumptions that will be used throughout this thesis. In Chapter 3, we give our tightly CCA-secure encryption without pairings. Then, in Chapter 4, we present our multiinput functional encryption for inner products from pairings. In Chapter 5, we present our multi-input functional encryption for inner products without pairings. In Chapter 6, we exhibit our multi-client functional encryption for inner products. Finally, in Chapter 7, we present our functional encryption for quadratic functions, before concluding in Chapter 8.

Chapter 2

Preliminaries

Notations and Basics

For any set S, we denote by x ← R S an element x that is picked uniformly at random over S.

Adversaries or algorithms refer to Turing machines. PPT stands for Probabilistic Polynomial Time. For any PPT algorithm A, we denote by x ← A an output of A which is sampled at random in the output space of A, over the random coins of A. For any Turing machine A, we denote by T(A) its running time. Let p be a prime, and n, m ∈ N. For any matrix A ∈ Z n×m p , we denote by Span(A) the (column) span of A. For any dimension d ∈ N, we denote by GL d (p) the set of invertible matrices in Z d×d p . We denote by ID d×d the identity matrix in Z d×d p . For any vector x ∈ R d , we denote by x 2 the Euclidian norm of x, that is d i=1 x 2 i . Throughout this paper, we denote by λ the security parameter, and we use the notation 1 λ to indicate that the security parameter is written in unary basis. For any function in parameter λ, we denote by f (λ) = poly(λ) the fact that f is a polynomial. We denote by f (λ) = negl(λ), if for all polynomials P , f is asymptotically dominated by 1/P , that is, for λ large enough, f (λ) < 1/P (λ).

Collision resistant hashing

A hash function generator is a PPT algorithm H that, on input 1 λ , outputs an efficiently computable function H : {0, 1} * → {0, 1} λ .

Definition 1: Collision Resistance

We say that a hash function generator H outputs collision-resistant hash functions H if for all PPT adversaries A,

Adv CR H,A (λ) := Pr[x = x ′ ∧ H(x) = H(x ′ )|H ← R H(1 λ ), (x, x ′ ) ← A(1 λ , H)] = negl(λ).

Symmetric-Key Encryption Definition 2: Symmetric-Key Encryption

A symmetric key encryption (SEnc, SDec) with key space K is defined as:

• SEnc(K, m): given a key K and a message m, outputs a ciphertext ct.

• SDec(K, ct): given a key K and a ciphertext ct, outputs a plaintext.

The following must hold.

Correctness. For all messages m in the message space, Pr[SDec(K, SEnc(K, m)) = m] = 1, where the probability is taken over K ← R K.

One-time Security. For any PPT adversary A, the following advantage is negligible:

Adv OT SKE,A (λ) := Pr   b ′ = b : (m 0 , m 1 ) ← A(1 λ ) K ← R K, b ← R {0, 1}, ct = SEnc(K, m b ) b ′ ← A(ct)    - 1 2 .

Authenticated Encryption

Definition 3: Authenticated Encryption

An authenticated symmetric encryption (AE) with message-space M and key-space K consists of two polynomial-time deterministic algorithms (Enc AE , Dec AE ):

• The encryption algorithm Enc AE (K, M ) generates C, encryption of the message M with the secret key K.

• The decryption algorithm Dec AE (K, C), returns a message M or ⊥.

The following must hold.

Perfect correctness. For all λ, for all K ∈ K and m ∈ M, we have

Dec AE (K, Enc AE (K, M )) = m.
One-time Privacy and Authenticity. For any PPT adversary A, we have:

Adv ae-ot AE,A (λ) := Pr b ′ = b : K ← R K; b ← R {0, 1} b ′ ← R A EncO(•,•),DecO(•) (1 λ , M, K) -1/2 = negl(λ),
where EncO(m 0 , m 1 ), on input two messages m 0 and m 1 , returns Enc AE (K, m b ), and DecO(φ) returns Dec AE (K, φ) if b = 0, ⊥ otherwise. A is allowed at most one call to each oracle EncO and DecO, and the query to DecO must be different from the output of EncO. A is also given the description of the key-space K as input.

Public-Key Encryption

Definition 4: Public-Key Encryption

A Public-Key Encryption (PKE) consists of the following PPT algorithms (Param PKE , Gen PKE , Enc PKE , Dec PKE ):

• Gen PKE (1 λ ): on input the security parameter, generates a pair of public and secret keys (pk, sk).

• Enc PKE (pk, M ): on input the public key and a message, returns a ciphertext ct.

• Dec PKE (pk, sk, ct): deterministic algorithm that returns a message M or ⊥, where ⊥ is a special rejection symbol.

The following must hold.

Perfect correctness. For all λ, we have

Pr Dec PKE (pk, sk, ct) = M (pk, sk) ← R Gen PKE (1 λ ); ct ← R Enc PKE (pk, M ) = 1.

Definition 5: Multi-ciphertext CCA security [BBM00]

A public-key encryption PKE is IND-CCA secure if for any PPT adversary A, we have:

Adv IND-CCA PKE,A (λ) := Pr    b = b ′ C Enc := ∅, b ← R {0, 1} (pk, sk) ← R Gen PKE (1 λ ) b ′ ← A DecO(•),EncO(•,•) (1 λ , pk)    -1/2 = negl(λ)
where:

• On input the pair of messages (m 0 , m 1 ), EncO(m 0 , m 1 ) returns Enc PKE (pk, m b ) and sets C Enc := C Enc ∪ {ct}.

• DecO(ct) returns Dec PKE (pk, sk, ct) if ct / ∈ C Enc , ⊥ otherwise.

Key-Encapsulation Mechanism

Definition 6: Tag-based KEM

A tag-based Key-Encapsulation Mechanism (KEM) for tag space T and key space K consists of three PPT algorithms (Gen KEM , Enc KEM , Dec KEM ):

• Gen KEM (1 λ ): on input the security parameter, generates a pair of public and secret keys (pk, sk).

• Enc KEM (pk, τ ): on input the public key and a tag τ , returns a pair (K, C) where K is a uniformly distributed symmetric key in K and C is a ciphertext, with respect to the tag τ ∈ T .

• Dec KEM (pk, sk, τ, C): deterministic algorithm that returns a key K ∈ K, or a special rejection symbol ⊥ if it fails.

The following must hold.

Perfect correctness. For all λ, for all tags τ ∈ T , we have

Pr Dec KEM (pk, sk, τ, C) = K (pk, sk) ← R Gen KEM (1 λ ); (K, C) ← R Enc KEM (pk, τ ) = 1.

Definition 7: Multi-ciphertext PCA security [OP01].

A key encapsulation mechanism KEM is IND-PCE secure if for any adversary A, we have:

Adv IND-PCA KEM,A (λ) := Pr    b = b ′ T Enc = T Dec := ∅, b ← R {0, 1} (pk, sk) ← R Gen KEM (1 λ ) b ′ ← A DecO(•,•,•),EncO(•) (1 λ , pk)    -1/2 = negl(λ)
where:

• The decryption oracle DecO(τ, C, K) computes K := Dec KEM (pk, sk, τ, C). It re- turns 1 if K = K ∧ τ / ∈ T Enc , 0 otherwise. Then it sets T Dec := T Dec ∪ {τ }. • The oracle EncO(τ ) computes (K, C) ← R Enc KEM (pk, τ ), sets K 0 := K and K 1 ← R K. If τ / ∈ T Dec ∪ T Enc , it returns (C, K b )
, and sets T Enc := T Enc ∪ {τ }; otherwise it returns ⊥.

Cryptographic Assumptions

Prime-Order Groups

Let GGen be a PPT algorithm that on input 1 λ returns a description G = (G, q, P ) of an additive cyclic group G of order p for a 2λ-bit prime p, whose generator is P .

We use implicit representation of group elements as introduced in [EHK + 13]. For a ∈ Z p , define [a] = aP ∈ G as the implicit representation of a in G. More generally, for a matrix A = (a ij ) ∈ Z n×m p we define [A] as the implicit representation of A in G:

Definition 8: Computational Diffie-Hellman Assumption

The Computational Diffie-Hellman (CDH) assumption [START_REF] Diffie | New directions in cryptography[END_REF] states that, in a primeorder group G ← R GGen(1 λ ), no PPT adversary can compute [xy], from [x] and [y] for x, y ← R Z p , with non-negligible success probability.

Equivalently, this assumption states it is hard to compute [a 2 ] from [a] for a ← R Z p . This comes from the fact that 4

• [xy] = [(x + y) 2 ] -[(x -y) 2 ].

Pairing Groups

The use of pairing friendly elliptic curves for cryptography has been initiated by [START_REF] Boneh | Identity-based encryption from the Weil pairing[END_REF][START_REF] Boneh | Identity-based encryption from the weil pairing[END_REF][START_REF] Joux | A one round protocol for tripartite diffie-hellman[END_REF][START_REF] Joux | A one round protocol for tripartite diffie-hellman[END_REF]. We refer to [START_REF] Galbraith | Pairings for cryptographers[END_REF] for further details on the use of pairing for cryptography. Let PGGen be a PPT algorithm that on input 1 λ returns a description PG = (G 1 , G 2 , G T , p, P 1 , P 2 , e) of asymmetric pairing groups where G 1 , G 2 , G T are cyclic group of order p for a 2λ-bit prime p, P 1 and P 2 are generators of G 1 and G 2 , respectively, and e : G 1 × G 2 → G T is an efficiently computable (non-degenerate) bilinear map. Define P T := e(P 1 , P 2 ), which is a generator of G T . We again use implicit representation of group elements. For s ∈ {1, 2, T } and a ∈ Z p , define [

) := [AB] T in G T .

Matrix Diffie-Hellman

We recall the definitions of the Matrix Decision Diffie

Adv D ℓ,k (p)-mddh Gs,A (λ) := | Pr[A(G s , [A] s , [Aw] s ) = 1] -Pr[A(G s , [A] s , [u] s ) = 1]| = negl(λ),
where the probability is taken over

A ← R D ℓ,k (p), w ← R Z k p , u ← R Z ℓ p . Let Q ≥ 1. For W ← R Z k×Q p , U ← R Z ℓ×Q p
, we consider the Q-fold D ℓ,k (p)-MDDH assumption in the group G, which consists in distinguishing the distributions (

[A] s , [AW] s ) from ([A] s , [U] s ).
That is, a challenge for the Q-fold D ℓ,k (p)-MDDH assumption consists of Q independent challenges of the D ℓ,k (p)-MDDH assumption (with the same A but different randomness w). As shown in [EHK + 13] (and recalled in Lemma 1), the D ℓ,k (p)-MDDH assumption is random self reducible, that is, it implies its Q-fold variant.

Definition 11: Q-fold D ℓ,k (p)-MDDH assumption Let Q ≥ 1, and D ℓ,k (p) be a matrix distribution. We say that the Q-fold D ℓ,k (p)-MDDH assumption holds in a group G s , if for all PPT adversaries A:

Adv Q-D ℓ,k (p)-mddh Gs,A (λ) := | Pr[A(G s , [A] s , [AW] s ) = 1]-Pr[A(G s , [A] s , [U] s ) = 1]| = negl(λ),
where the probability is taken over

A ← R D ℓ,k (p), W ← R Z k×Q p , U ← R Z ℓ×Q p . Lemma 1: D ℓ,k (p)-MDDH ⇒ Q-fold D ℓ,k (p)-MDDH [EHK + 13] Let Q, ℓ, k ∈ N * such that ℓ > k,
and a group G s of prime order p. For any PPT adversary A, there exists a PPT adversary B such that:

Adv Q-D ℓ,k (p)-mddh Gs,A (λ) ≤    Q • Adv D ℓ,k (p)-mddh Gs,B (λ) if 1 ≤ Q ≤ ℓ -k (ℓ -k) • Adv D ℓ,k (p)-mddh Gs,B (λ) + 1 p-1 if Q > ℓ -k
where the probability is taken over

A ← R U ℓ,k (p), W ← R Z k×Q p , U ← R Z ℓ×Q p .
For each k ≥ 1, [EHK + 13] specifies distributions L k , SC k , C k (and others) over Z (k+1)×k p such that the corresponding D k (p)-MDDH assumptions are generically secure in prime-order groups and form a hierarchy of increasingly weaker assumptions. L k -MDDH is the well known k-Linear assumption, denote as k-Lin for short, with 1-Lin = DDH, the decisional Diffie-Hellman assumption. In this work we are particularly interested in the uniform matrix distribution U ℓ,k (p).

Definition 12: Uniform distribution

Let ℓ, k ∈ N, with ℓ > k, and p be a prime. We denote by U ℓ,k (p) the uniform distribution over all full-rank ℓ × k matrices over

Z p . Let U k (p) := U k+1,k (p).
In [GHKW16], it shown that for any ℓ, k ∈ N * such that ℓ > k, the U ℓ,k (p)-MDDH assumption is equivalent to the U k (p)-MDDH assumption.

Lemma 2: U ℓ,k (p)-MDDH ⇔ U k (p)-MDDH [GHKW16]
Let ℓ, k ∈ N * , with ℓ > k, s ∈ {1, 2, T }, and a group G s of prime-order p. For any PPT adversary A, there exists a PPT adversary B (and vice versa) such that:

Adv U ℓ,k (p)-mddh Gs,A (λ) = Adv U k (p)-mddh Gs,B (λ).
Together with Lemma 1, this implies the following corollary.

Corollary 1: U k (p)-MDDH ⇒ Q-fold U ℓ,k (p)-MDDH Let Q, ℓ, k ∈ N * ,
with ℓ > k, and a group G s of prime order p. For any PPT adversary A, there exists a PPT adversary B such that:

Adv Q-U ℓ,k (p)-mddh Gs,A (λ) ≤ Adv U k (p)-mddh Gs,B (λ) + 1 p -1 .
Among all possible matrix distributions D ℓ,k (p), the uniform matrix distribution U k (p) is the hardest possible instance as stated in Lemma 3, so in particular k-Lin ⇒ U k -MDDH.

Lemma 3: D ℓ,k (p)-MDDH ⇒ U ℓ,k (p)-MDDH, [EHK + 13]
Let D ℓ,k (p) be a matrix distribution, and G s be a group of prime order p. For any PPT adversary A, there exists a PPT adversary B such that:

Adv U ℓ,k -mddh Gs,A (λ) ≤ Adv D ℓ,k (p)-mddh Gs,B (λ)
.

We now present a standard assumption in asymmetric pairing groups, known as the Decisional Bilinear Diffie Hellman (DBDH) assumption.

Definition 13: DBDH assumption

We say that the DBDH assumption holds in a pairing group PG := (G 1 , G 2 , p, P 1 , P 2 , e), if for all PPT adversaries A:

Adv DBDH PG,A (λ) := | Pr[A(PG, [a] 1 , [b] 1 , [b] 2 , [c] 2 , [abc] T ) = 1] -Pr[A(PG, [a] 1 , [b] 1 , [b] 2 , [c] 2 , [s] T ) = 1]| = negl(λ),
where the probability is taken over a, b, c, s ← R Z p .

As for the D k (p)-MDDH assumption, we define a Q-fold variant of the DBDh assumption, and prove its random self-reducibility.

Definition 14: Q-fold DBDH assumption

For any Q ≥ 1, we say that the Q-fold DBDH assumption holds in a pairing group PG := (G 1 , G 2 , p, P 1 , P 2 , e), if for all PPT adversaries A:

Adv Q-DBDH PG,A (λ) := | Pr A PG, [a] 1 , [b] 1 , [b] 2 , {[c i ] 2 , [abc i ] T } i∈[Q] = 1 -Pr A PG, [a] 1 , [b] 1 , [b] 2 , {[c i ] 2 , [s i ] T } i∈[Q] = 1 | = negl(λ),
where the probability is taken over a, b ← R Z p , and for all i

∈ [Q], c i , s i ← R Z p . Lemma 4: DBDH ⇒ Q-fold DBDH Let Q ≥ 1,
and a pairing group PG := (G 1 , G 2 , p, P 1 , P 2 , e). For any PPT adversary A, there exists a PPT adversary B such that:

Adv Q-DBDH PG,A (λ) ≤ Adv DBDH PG,B (λ). Proof of Lemma 4. Upon receiving a DBDH challenge (PG, [a] 1 , [b] 1 , [b] 2 , [c] 2 , [s] T ), B samples α i ← R Z * p , c ′ i ← R Z p computes [c i ] 2 := [α i • c] 2 + [c ′ i ] 2 , [s i ] T := [α i • s] T + [c ′ i • ab] T for all i ∈ [Q], and gives the challenge (PG, [a] 1 , [b] 1 , [b] 2 , {[c i ] 2 , [s i ] T } i∈[Q] ) to A.
We now recall the definition another standard assumption in asymmetric pairing groups, first introduced in [START_REF] Boneh | Fully collusion resistant traitor tracing with short ciphertexts and private keys[END_REF].

Definition 15: 3-PDDH assumption

We say that the 3-party Decision Diffie-Hellman (3-PDDH) assumption holds in a pairing group PG ← PGGen(1 λ ) if for all PPT adversaries A:

Adv 3-PDDH PG,A (λ) := | Pr[A(PG, [a] 1 , [b] 2 , [c] 1 , [c] 2 , [abc] 1 ) = 1] -Pr[A(PG, [a] 1 , [b] 2 , [c] 1 , [c] 2 , [d] 1 ) = 1]| = negl(λ)
where the probability is taken over a, b, c, d ← R Z p .

Decisional Composite Residuosity

In [START_REF] Paillier | Public-key cryptosystems based on composite degree residuosity classes[END_REF], the Decisional Composite Residuosity assumption is used to build a linearly homomorphic encryption scheme where the message is Z N , for an RSA modulus N .

Definition 16: Decisional Composite Residuosity assumption

Let N = pq, for prime numbers p, q. We say the Decisional Composite Residuosity (DCR) assumption holds if for all PPT adversaries A:

Adv DCR N,A (λ) := | Pr[A(N, z N 0 ) = 1] -Pr[A(N, z) = 1]| = negl(λ),
where the probability is taken over

z 0 ← R Z * N , z ← R Z * N 2 .

Learning With Errors

We now provide minimal background on lattice-based cryptography.

Gaussian distributions. For any vector c ∈ R n and any parameter σ ∈ R >0 , let ρ σ,c (x) := exp To keep notation simple, we abbreviate ρ σ,0 and D Λ,σ,0 as ρ σ and D Λ,σ , respectively.

Definition 17: LWE q,α,m assumption Let q, m ∈ N and α ∈ (0, 1) be functions of the security parameter λ ∈ N. We say that the LWE q,α,m assumption holds if for all PPT adversaries A:

Adv LWE q,α,m,A := | Pr[A(q, A, As + e) = 1] -Pr[A(q, A, u) = 1]| = negl(λ),
where the probability is taken over A ← R Z m×λ q , s ← R Z λ q , e ← D m Z,αq .

[Reg05] gives a quantum reduction from a worst-case lattice problem to LWE. We now present a so-called multi-hint extended LWE assumption, which is stronger than the latter in general. For some parameters, it has been shown in [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] to be no stronger than LWE.

Definition 18: mheLWE q,α,m,t,D assumption Let q, m, t ∈ N, α ∈ (0, 1), D be a distribution over Z t×m , all functions of the security parameter λ ∈ N. We say that the the multi-hint extended LWE assumtpion, mheLWE q,α,m,t,D , holds, if for all PPT adversaries A:

Adv mheLWE q,α,m,t,D,A := | Pr[A(q, A, As + e, Z, Ze) = 1] -Pr[A(q, A, Z, Ze, u) = 1]| = negl(λ),
where the probability is taken over

A ← R Z m×λ q , s ← R Z λ q , Z ← R D, e ← D m Z,αq .
Theorem 1: Reduction from LWE q,α ′ ,m to mheLWE q,α,m [ALS16]

Let n ≥ 100, q ≥ 2, t < n, and m ∈ N such that m ≥ Ω(n log n) and m ≤ n O(1) . There exists ξ ≤ O(n 4 m 2 log 5/2 (n)) and a distribution D over Z t×m such that the following statements hold:

• There is a reduction from LWE q,α,m in dimension λt to mheLWE q,αξ,m,t,D that reduces the advantage by at most 2 Ω(t-n) .

• It is possible to sample from D in time polynomial in λ.

• Each entry of matrix D is an independent discrete Gaussian D i,j = D Z,σ i,j ,c i,j for some c i,j ∈ {0, 1} and σ i,j ≥ Ω(mn log m).

• With probability at least 1n -ω(1) , all rows from a sample of D have norms at most ξ.

Definitions for Single-Input Functional Encryption

We now proceed to give definitions of functional encryption, originally given in [O'N10,[START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF].

Definition 19: Functional Encryption

A functionality F defined over (K, X ) is a function F : K × X → Z. The set K is called the key space, the set X is called the message space, and Z is called the output space. A functional encryption scheme consists of the following PPT algorithms:

• GSetup(1 λ , F ): on input the security parameter λ and a functionality F , outputs global public key gpk.

• Setup(1 λ , gpk, F ): on input the security parameter λ, the global public key gpk, and a functionality F , outputs an encryption key ek, and a master secret key msk.

• Enc(gpk, ek, x): on the global public parameters gpk, an encryption key ek, and a message x ∈ X , outputs a ciphertext ct.

• KeyGen(gpk, msk, k): on input the global public key gpk, a master secret key msk and a key k ∈ K, outputs a decryption key dk k .

• Dec(gpk, dk k , ct): on input the global public key gpk, a decryption key dk k and a ciphertext ct, outputs z ∈ Z, or a special rejection symbol ⊥ if it fails.

The scheme FE for functionality F is correct if for all k ∈ K and all x ∈ X , we have:

Pr        gpk ← GSetup(1 λ , F ); (ek, msk) ← Setup(1 λ , gpk, F ); dk k ← KeyGen(gpk, msk, k); Dec(gpk, dk k , Enc(gpk, ek, x)) = F (k, x)        = 1 -negl(λ),
where the probability is taken over the coins of GSetup, Setup, KeyGen and Enc. The scheme is said to be public-key if ek is public, private-key otherwise.

Remark 1: Need for a global setup, multi-instance security

We split the setup, which is typically a single algorithm, into two algorithms: the global setup, that produces a global public key, and another setup that uses the global public key to produce the encryption key and master secret key. We do so since we will use many instances of FE as part of larger schemes, and they must share common public parameters, so as to ensure compatibility. For instance, in Chapter 4, we will use different instances of (single-input) FE, to build multi-input FE (defined below) with independent encryption and master secret keys, but working on the same group.

Security notions

Following [START_REF] Agrawal | Functional encryption: New perspectives and lower bounds[END_REF], we may consider 8 security notions xx-yy-zzz where xx ∈ {one, many} refers to the number of challenge ciphertexts; yy ∈ {SEL, AD} refers to the fact that encryption queries are selectively or adaptively chosen; zzz ∈ {IND, SIM} refers to indistinguishability vs simulation-based security. We have the following trivial relations: many ⇒ one, AD ⇒ SEL, and the following standard relations: SIM ⇒ IND, and one-yy-IND ⇒ many-yy-IND, the latter in the public-key setting. We start by describing the strongest notion, namely, many-AD-SIM. We then present the weaker notions. All the definitions we present are in the multi-instance setting (see Remark 1).

Definition 20: multi-instance, many-AD-SIM secure FE

A functional encryption FE := (GSetup, Setup, Enc, KeyGen, Dec) is many-AD-SIM secure for n instances, if there exists a PPT simulator ( GSetup, Setup, Enc, KeyGen) such that for every PPT adversary A and every security parameter λ ∈ N, the following two distributions are computationally indistinguishable:

Experiment REAL FE (1 λ , A): Experiment IDEAL FE (1 λ , A): gpk ← GSetup(1 λ , F ) ( gpk, td) ← GSetup(1 λ , F ) ∀i ∈ [n]: (ek i , msk i ) ← Setup(1 λ , gpk, F ) ∀i ∈ [n]: ( ek i , msk i ) ← Setup(1 λ , gpk, F ) α ← A OEnc(•,•),OKeygen(•,•) (gpk, (ek i ) i∈[n] ) α ← A OEnc(•,•), OKeyGen(•,•) ( gpk, ( ek) i∈[n] )
The encryption keys (highlighted in gray) are only given to the adversary in a public-key scheme. The oracle OKeygen(i, k), on input an instance i ∈ [n], and a key k ∈ K, returns KeyGen(gpk, msk i , k); OEnc(i, x), on input an instance i ∈ [n], and a message

x ∈ X , returns Enc(gpk, ek i , x);

OKeyGen(i, k), on input i ∈ [n] and k ∈ K, adds k to Q (i)
dk (the set of all decryption key queried for instance i, initially empty), and returns

KeyGen td, msk i , k, {F (k, x)} x∈Q (i) ct
, where

Q (i)
ct denotes the sets of queries to OEnc (initially empty); OEnc(i, x), on input i ∈ [n] and x ∈ X , adds x to Q (i) ct , and returns Enc td, ek i , msk i , {k,

F (k, x)} k∈Q (i) dk .
Weaker notion of many-AD-SIM security. The definition above is stronger than the standard simulation-based definition, where the algorithm Enc and KeyGen take all the information leaked by the ideal functionality. In particular, to generate a simulated decryption key for key k ∈ K and instance i ∈ [n], KeyGen takes as input not only the values

{F (k, x)} x∈Q (i) ct , but also all the values {k ′ , F (k ′ , x)} k ′ ∈Q (i) dk ,x∈Q (i) ct
, for keys k ′ for which decryption keys were previously issued. The same applies to the algorithm Enc. We choose to work with the stronger simulation definition above, for simplicity, since the schemes presented in this work achieve it anyway.

We now consider the indistinguishability variant of the previous notion.

Definition 21: multi-instance, many-AD-IND secure FE

A functional encryption scheme FE := (GSetup, Setup, Enc, KeyGen, Dec), is many-AD-IND secure for n instance if for every stateful PPT adversary A, we have:

Adv many-AD-IND FE,A,n (λ) = Pr AD-IND FE 0 (1 λ , 1 n , A) = 1 -Pr AD-IND FE 1 (1 λ , 1 n , A) = 1 = negl(λ),
where the experiments are defined for β ∈ {0, 1} as follows:

Experiment AD-IND FE β (1 λ , 1 n , A): gpk ← GSetup(1 λ , F ) ∀i ∈ [n] : (ek i , msk i ) ← Setup(1 λ , gpk, F ) α ← A OEnc(•,•),OKeygen(•,•) gpk, (ek i ) i∈[n]

Output: α

The encryption key (highlighted in gray) is only given to the adversary in a public-key scheme. The oracle OEnc(i, (x 0 , x 1 )), on input an instance i ∈ [n] and a pair of messages (x 0 , x 1 ) ∈ X 2 , returns Enc(gpk, ek i , x β ). The oracle OKeygen(i, k), on input an instance i ∈ [n] and a key k ∈ K, returns KeyGen(gpk, msk i , k). For any instance i ∈ [n], the queries k of adversary A to OKeygen(i, •) must satisfy the following condition, for all queries (x 0 , x 1 ) to OEnc(i, •): F (k, x 0 ) = F (k, x 1 ). That is, for a given instance i ∈ [n], the decryption keys should not be able to distinguish any challenge message pairs. Clearly, single-instance (that is, n = 1 in the above definition) is implied by the multiinstance security (n > 1). By a standard hybrid argument over the n instances, the converse is also true.

Lemma 5: Single-instance implies multi-instance security

For any scheme FE, PPT adversary A, xx ∈ {many,one}, yy ∈ {AD,SEL}, there exists a PPT adversary B such that for all security parameters λ:

Adv xx-yy-IND FE,A,n (λ) ≤ n • Adv xx-yy-IND FE,B,1 (λ).
Proof of Lemma 5 (sketch). We only give a high-level sketch of the proof, which uses a standard hybrid argument over the n instances. Namely, we define n games, where the i'th game answers all the queries (j, (x 0 , x 1 )) to OEnc for j ≤ i with Enc(gpk, ek j , x 1 ), and for j > i, answers with Enc(gpk, ek i , x 0 ). To transition from hybrid i to i + 1, we use the single instance security for the queries to OEnc on the i + 1'st instance. The rest can be simulated simply by sampling (ek j , msk j ) ← Setup(1 λ , gpk, F ), for all j = i + 1, since gpk is known.

We consider the following weaker notions of security.

One ciphertext, one-yy-zzz: the adversary A can only query its encryption oracle OEnc once per instance i ∈ [n].

Selective security, xx-SEL-zzz: the adversary A must send its queries to OEnc beforehand, that is, before receiving the gpk (and the (ek i ) i∈ [n] , in the public-key setting) from the experiment, and before querying OKeygen. These weaker security notions may appear artificial, and indeed, the desirable security notions are many-AD-IND or many-AD-SIM, both of which capture natural attacks. However, they are still useful as a first step towards many-yy-IND security. For instance, as explained below, in the public-key setting, one-yy-IND implies many-yy-IND. Also, using a guessing argument (see, for instance, [START_REF] Boneh | Secure identity based encryption without random oracles[END_REF], in the context of Identity-Based Encryption), one can turn any selectively-secure scheme into an adaptively-secure scheme, albeit with an exponential security loss.

Remark 2: Semi-adaptive security

In the context of Attribute-Based Encryption (which is a particular case of Functional Encryption), [START_REF] Chen | Semi-adaptive attribute-based encryption and improved delegation for Boolean formula[END_REF] put forth the notion of semi-adaptive security, where the adversary has to send its challenge messages before querying any decryption keys, but after receiving the public key from its experiment. This notion lies in between adaptive and selective security, namely, it is implied by the former, and implies the latter. In [START_REF] Goyal | Semi-adaptive security and bundling functionalities made generic and easy[END_REF], the authors give a generic transformation that turns any selectively-secure FE into a semiadaptive secure FE, only using Public-Key Encryption.

It is also known that one-xx-IND security implies many-xx-IND security, in the public-key setting.

Lemma 6: one-xx-IND security implies many-xx-IND security

For any public-key scheme FE, PPT adversary A, xx ∈ {AD,SEL}, there exists a PPT adversary B such that for all security parameters λ:

Adv many-xx-IND FE,A,n (λ) ≤ Q • Adv one-xx-IND FE,B,n (λ),
where Q is an upper bound on the number of queries to OEnc(i, •), for any i ∈ [n].

Proof of Lemma 6 (sketch). We only give a high-level sketch of the proof, which uses a standard hybrid argument over the challenge ciphertexts. Namely, we define Q games, where the i'th game answers the first i query to OEnc(j, (x 0 , x 1 )) for any j ∈ [n], with Enc(gpk, ek j , x 1 ), and the last queries with Enc(gpk, ek j , x 1 ). To transition from hybrid i to i + 1'st, we use the one-yy-IND security to switch the i + 1'st query from Enc(gpk, ek j , x 0 ) to Enc(gpk, ek j , x 1 ) simultaneously for all instances j ∈ [n]. The other queries can be addressed using the public encryption keys ek j .

Definitions for Multi-Input Functional Encryption

We recall the definition of multi-input functional encryption, that has been first introduced in [GGG + 14]. It generalizes functional encryption as follows. In a multi-input functional encryption, encryption is split among n different users, or input slots; each of which encrypts separately an input x i independently, without any interaction. Then, given a functional decryption key for an n-ary function f , decryption operates on all the n independently generated ciphertexts and recovers f (x 1 , • • • , x n ). This generalization is useful in applications where the data to encrypt is distributed among users that do not trust each other; or when the same user wants to encrypt data at different point in time (without memorizing the randomness used for prior encryption).

Definition 22: Multi-input Function Encryption

Let {F n } n∈N be a set of functionality where for each n ∈ N,

F n defined over (K n , X 1 , • • • , X n ) is a function F n : K n × X 1 × • • • × X n → Z. Each i ∈ [n] is called an input slot.
The key space K n , depends on the arity n. A multi-input functional encryption scheme MIFE for the set of functionality {F n } n∈N consists of the following algorithms:

• Setup(1 λ , F n ): on input the security parameter λ and a functionality F n , outputs a public key pk, encryption keys ek i for each input slot i ∈ [n], and a master secret key msk.

• Enc(pk, ek i , x i ): on input the public key pk, encryption key ek i for the input slot i ∈ [n], and a message x i ∈ X i , outputs a ciphertext ct. We assume that each ciphertext has an associated index i, which denotes what slot this ciphertext can be used for.

• KeyGen(pk, msk, k): on input the public key pk, the master secret key msk and a function k ∈ K n , outputs a decryption key dk k .

• Dec(pk, dk k , ct 1 , . . . , ct n ): on input the public key pk, a decryption key dk k and n ciphertexts, outputs z ∈ Z, or a sepcial rejection symbol ⊥ if it fails.

The scheme MIFE is correct if for all k ∈ K n and all x i ∈ X i for i ∈ [n], we have:

Pr     (pk, msk, (ek i ) i∈[n] ) ← Setup(1 λ , F n ); dk k ← KeyGen(pk, msk, k); Dec(pk, dk k , Enc(pk, ek 1 , x 1 ), . . . , Enc(pk, ek n , x n )) = F n (k, x 1 , . . . , x n )     = 1-negl(λ),
where the probability is taken over the coins of Setup, KeyGen and Enc.

The scheme is public-key if ek i = ∅, that is, the encryption algorithm Enc only requires the public pk to encrypt messages. It is private-key otherwise.

Security notions

As for the case of single-input FE, we may consider 8 security notions xx-yy-zzz where xx ∈ {one, many} refers to the number of challenge ciphertexts; yy ∈ {SEL, AD} refers to the fact that encryption queries are selectively or adaptively chosen; zzz ∈ {IND, SIM} refers to indistinguishability vs simulation-based security. Since simulation-security is impossible in general as proven in [START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF], we will restrict ourselves to indistinguishability-based security definition. We defer to [BLR + 15] for a description of simulation-based security definitions. Although the multi-instance setting for single-input FE is relevant to this work, the multiinstance for the multi-input setting is not. For simplicity, we focus on the single-instance setting here.

One novelty compared to the single-input setting is that some input slots can collude, and should not be able to break the security of the encryption for the other slots. This is captured, in the security game, by the oracle OCorrupt, that on input a slot i ∈ [n], returns the corresponding encryption key ek i . The public-key setting essentially corresponds to the case where all ek i are public. In particular, the adversary can encrypt any message for any slot, and decrypt them with the challenge ciphertexts for the other slots. This inherent leakage of information (it is allowed for an adversary to learn this information, by correctness of the MIFE) is captured by the Condition 1 in the many-AD-IND security game.

Definition 23: many-AD-IND secure MIFE

A multi-input functional encryption MIFE := (Setup, Enc, KeyGen, Dec) for the set of functionalities {F n } n∈N , is many-AD-IND secure if for every stateful PPT adversary A, we have:

Adv many-AD-IND MIFE,A (λ) = Pr AD-IND MIFE 0 (1 λ , A) = 1 -Pr AD-IND MIFE 1 (1 λ , A) = 1 = negl(λ),
where the experiments are defined for all β ∈ {0, 1} as follows:

Experiment AD-IND MIFE β (1 λ , A): (pk, msk, (ek i ) i∈[n] ) ← Setup(1 λ , F n ) α ← A OEnc(•,•,•),OKeygen(•),OCorrupt(•) (pk) Output: α
The oracle OEnc, on input (i, x 0 i , x 1 i ), returns Enc(pk, ek i , x β i ). For all input slots i ∈ [n], we denote by Q i the set of queries to OEnc for slot i, and Q i the size of Q i . The oracle OKeygen, on input k ∈ K n , returns KeyGen(pk, msk, k). The oracle OCorrupt, on input i ∈ [n], returns ek i . We denote by CS ⊆ [n] the set of corrupted slots. The queries of adversary A must satisfy the following condition.

Condition 1:

• For all i ∈ CS, all (x 0 i , x 1 i ) ∈ Q i , we have x 0 i = x 1 i .

• A only makes queries k to OKeygen(•) satisfying

F n (k, x 0 1 , . . . , x 0 n ) = F n (k, x 1 1 , . . . , x 1 n ) for all possible vectors (x b i ) i∈[n],b∈{0,1}
, where for all i ∈ [n], we have: either (x 0 i , x 1 i ) ∈ Q i , or (i ∈ CS and x 0 i = x 1 i ). If the condition is not satisfied, the experiment outputs 0 instead of α.

Remark 3: Winning condition

Note that Condition 1 is in general not efficiently checkable because of the combinatorial explosion in the restriction of the queries.

We consider the following weaker security notions.

One ciphertext, one-yy-IND: the adversary A can only query OEnc once per input slot

i ∈ [n], that is, Q i ≤ 1 for all i ∈ [n].

Selective security, xx-SEL-IND: the adversary

A must send its challenge {x j,b i } b∈{0,1},i∈[n],j∈[Q i ]
beforehand, that is, before receiving the public key from the experiment, and before querying OKeygen or OCorrupt.

Static corruption, xx-yy-IND-static:

the adversary A must send its queries to OCorrupt before any other query.

Zero decryption keys, xx-yy-IND-zero:

the adversary A does not query OKeygen.

Extra condition, xx-yy-IND-weak:

the adversary A must send at least one challenge per slot that is not corrupted, that is, for all i ∈ [n] \ CS, we have:

Q i ≥ 1.
These weaker security notions may appear to impose unrealistic restrictions on the adversary. As for the case of single-input FE, it is useful to start building a simpler scheme which only satisfies a weak security notion, then turn it into a many-AD-IND secure scheme. In

Removing the extra condition generically

Here we show how to remove the extra condition from any multi-input FE that is both xx-yy-IND-weak and xx-yy-IND-zero secure, for any xx ∈ {one,many}, and yy ∈ {AD,SEL}, using an extra layer of symmetric-key encryption. A similar approach is used in [AGRW17]. Namely, [AGRW17] uses a symmetric key to encrypt the original ciphertexts. The symmetric key is shared across users, and the i'th share is given as part of any ciphertext for input slot i ∈ [n]. Thus, when ciphertexts are known for all slots i ∈ [n], the decryption recovers all shares of the symmetric key, and decrypt the outer layer, to get the original ciphertext. The rest of decryption is performed as in the original multi-input FE.

The problem with this approach is that the encryption algorithm needs to know the symmetric key (and not just a share of it). Thus, corrupting one input slot allows the adversary to recover the entire symmetric key, and break the security of the scheme. Such problem did not arise in [AGRW17], which does not consider corruptions of input slots. To circumvent this issue, as in [START_REF] Datta | Full-hiding (unbounded) multi-input inner product functional encryption from the k-linear assumption[END_REF], we use the symmetric key to encrypt the functional decryption keys, instead of encrypting the ciphertexts. Each encryption key ek i for input slot i ∈ [n] contains the i'th share of the symmetric key, but the full symmetric key is only needed by the key generation algorithm, which knows msk. If one share is missing, all the functional decryption keys are random. We conclude the security proof using the security of the overall multi-input FE when zero functional decryption keys are queried. Proof of Theorem 2 (sketch). We consider two cases:

Setup(1 λ , F n ): (pk ′ , msk ′ , (ek ′ i ) i∈[n] ) ← Setup ′ (1 λ , F n ) K ← R K k 1 , . . . , k n-1 ← R {0, 1} λ , k n = i∈[n-1] k i ⊕ K pk := pk ′ , msk := (msk ′ , K), ∀i ∈ [n] : ek i := (ek ′ i , k i ) return pk, msk, (ek i ) i∈[n] Enc(pk, ek i , x i ): parse ek i = (ek ′ i , k i ) ct ′ ← Enc ′ (pk ′ , ek ′ i , x i ) return (k i , ct ′ ) KeyGen(pk, msk, k): parse msk = (msk ′ , K) dk ′ k ← KeyGen ′ (pk ′ , msk ′ , k) dk k ← Enc SE (K, dk ′ k ) return dk k Dec(pk, dk k , ct 1 , . . . , ct n ): parse {ct i = (k i , ct ′ i )} i∈[n] K ← i∈[n] k i dk ′ k ← Dec SE (K, dk k ) return Dec ′ (dk ′ k , ct ′ 1 , . . . , ct ′ n ).
• Case 1: there exists some i ∈ [n] for which Q i = 0, and i / ∈ CS. That is, the adversary never queries OEnc or OCorrupt on slot i. Here, k i and thus K is perfectly hidden from the adversary. Then, by semantic security of (Gen SE , Enc SE , Dec SE ), the decryption keys are pseudo-random. We conclude using the xx-yy-IND-zero security of MIFE ′ .

• Case 2: for all i, Q i ≥ 1. Here, security follows immediately from the xx-yy-IND-weak security of the underlying MIFE ′ .

Definitions for Multi-Client Functional Encryption

We now present the definition of multi-client functional encryption (MCFE), originally given in [GGG + 14], which enhances multi-input functional encryption in the following way. In MCFE, the encryption algorithm takes as an additional input a label (typically a time-stamp), and ciphertexts from different input slots can only be combined when they are encrypted under the same label. The limits the leakage of information from the encrypted messages. Multi-input functional encryption corresponds to the case where every message is encrypted under the same label.

Definition 24: Multi-Client Function Encryption

Let {F n } n∈N be a set of functionality where for each n ∈ N,

F n defined over (K n , X 1 , • • • , X n ) is a function F n : K n × X 1 × • • • × X n → Z. Each i is called an input slot.
The key space K n , depends on the arity n. A multi-client functional encryption scheme MCFE for the set of functionality {F n } n∈N consists of the following algorithms:

• Setup(1 λ , F n ): on input the security parameter λ and a functionality F n , outputs a public key pk, encryption keys ek i for each input slot i ∈ [n], and a master secret key msk.

• Enc(pk, ek i , x i , ℓ): on input the public key pk, encryption key ek i for the input slot i ∈ [n], a message x i ∈ X i , and a label ℓ, it outputs a ciphertext ct.

• KeyGen(pk, msk, k): on input the public key pk, the master secret key msk and a function k ∈ K n , it outputs a decryption key dk k .

• Dec(pk, dk k , ct 1 , . . . , ct n , ℓ): on input the public key pk, a decryption key dk k , n ciphertexts and a label ℓ, outputs z ∈ Z, or a special rejection symbol ⊥ if it fails.

The scheme MCFE is correct if for all k ∈ K n , all x i ∈ X i for i ∈ [n], and all label ℓ, we have:

Pr     (pk, msk, (ek i ) i∈[n] ) ← Setup(1 λ , F n ); dk k ← KeyGen(pk, msk, k); Dec(pk, dk k , Enc(pk, ek 1 , x 1 , ℓ), . . . , Enc(pk, ek n , x n , ℓ), ℓ) = F n (k, x 1 , . . . , x n )     = 1 -negl(λ),
where the probability is taken over the coins of Setup, KeyGen and Enc.

The scheme is public-key if ek i = ∅, that is, the encryption algorithm Enc only requires the public pk to encrypt messages. It is private-key otherwise.

Definition 25: many-AD-IND secure MCFE

A multi-client functional encryption MCFE := (Setup, Enc, KeyGen, Dec) for the set of functionalities {F n } n∈N , is many-AD-IND secure if for every stateful PPT adversary A, we have:

Adv many-AD-IND MCF E,A (λ) = Pr AD-IND MCFE 0 (1 λ , A) = 1 -Pr AD-IND MCFE 1 (1 λ , A) = 1 = negl(λ),
where the experiments are defined for β ∈ {0, 1} as follows:

Experiment AD-IND MCF E β (1 λ , A): (pk, msk, (ek i ) i∈[n] ) ← Setup(1 λ , F n ) α ← A OEnc(•,•,•),OKeygen(•),OCorrupt(•) (pk) Output: α
The oracle OEnc, on input (i, (x 0 i , x 1 i ), ℓ), returns Enc(pk, ek i , x β i , ℓ). For all input slots i ∈ [n], and label ℓ, we denote by Q i,ℓ the set of queries to OEnc for slot i and label ℓ, and Q i,ℓ the size of Q i,ℓ . The oracle OKeygen, on input k ∈ K n , returns KeyGen(pk, msk, k). The oracle OCorrupt, on input i ∈ [n], returns ek i . We denote by CS ⊆ [n] the set of corrupted slots. The queries of adversary A must satisfy the following condition.

Condition 1:

• For all i ∈ CS, all labels ℓ, all (

x 0 i , x 1 i ) ∈ Q i,ℓ , we have x 0 i = x 1 i .
• A only makes queries k to OKeygen(•) satisfying

F n (k, x 0 1 , . . . , x 0 n ) = F n (k, x 1 1 , . . . , x 1 n )
for all labels ℓ and all vectors (

x b i ) i∈[n],b∈{0,1} such that for all i ∈ [n], we have: either (x 0 i , x 1 i ) ∈ Q i,ℓ , or (i ∈ CS and x 0 i = x 1 i ).
If the condition is not satisfied, the experiment outputs 0 instead of α.

We consider the following weaker security notions.

one-AD-IND security:

the adversary A can only query OEnc once for each input slot i ∈ [n] and label ℓ, that is, Q i,ℓ ≤ 1 for all i ∈ [n] and all labels ℓ.

xx-AD-IND-weak security:

The queries of adversary A must satisfy the following extra condition: if there exists a label ℓ and a slot i ∈ [n] such that (x 0 i , x 1 i ) ∈ Q i,ℓ with x 0 i = x 1 i , then for all j ∈ [n], we must have either j ∈ CS or Q j,ℓ > 1. Intuitively, this condition restricts the adversary to use challenge ciphertexts for all input slots i ∈ [n] for a given label ℓ. In fact, Condition 1 does not consider the information that may be leaked from partial ciphertexts, since for all i ∈ [n], we must have either a query (

x 0 i , x 1 i ) ∈ Q i,ℓ , or i ∈ CS.
The extra condition simply prevents the occurrence of such partial ciphertexts in the security game. This artificial notion will be a useful stepping stone towards full-fledged xx-AD-IND security.

We now present a decentralized variant of multi-client functional encryption, where the generation of functional decryption keys does not require a trusted third party: the master secret key is split across users into several keys; each user can generate a share of the functional decryption keys, without any interaction; then the shares can be publicly combined to obtain a functional decryption key.

Definition 26: Decentralized Multi-Client Function Encryption

Let {F n } n∈N be a set of functionality where for each n ∈ N,

F n defined over (K n , X 1 , • • • , X n ) is a function F n : K n × X 1 × • • • × X n → Z. Each i is called an input slot.
The key space K n , depends on the arity n. A decentralized multi-client functional encryption scheme DMCFE for the set of functionality {F n } n∈N consists of the following algorithms:

• Setup(1 λ , F n ): on input the security parameter λ and a functionality F n , outputs a public key pk, encryption keys ek i for each input slot i ∈ [n], and secret keys sk i for each input slot i ∈ [n].

• Enc(pk, ek i , x i , ℓ): on input the public key pk, encryption key ek i for the input slot i ∈ [n], a message x i ∈ X i , and a label ℓ, it outputs a ciphertext ct.

• KeyGen(pk, sk i , k): on input the public key pk, the secret key sk i for slot i ∈ [n], and a function k ∈ K n , it outputs a partial decryption key dk k,i .

• KeyComb(pk, {dk k,i } i∈[n] , k): on input the public key pk, n partial decryption keys keys, and a key k, it combines its input to produce a decryption key dk k .

• Dec(pk, dk k , ct 1 , . . . , ct n , ℓ): on input the public key pk, a decryption key dk k , n ciphertexts and a label ℓ, outputs z ∈ Z, or a special rejection symbol ⊥ if it fails.

The scheme DMCFE is correct if for all k ∈ K n , all x i ∈ X i for i ∈ [n]
, and all label ℓ, we have:

Pr        (pk, (ek i , sk i ) i∈[n] ) ← Setup(1 λ , F n ); ∀i ∈ [n] : dk k,i ← KeyGen(pk, sk i , k); dk k ← KeyComb(pk, (dk i,k ) i∈[n] , k); Dec(pk, dk k , Enc(pk, ek 1 , x 1 , ℓ), . . . , Enc(pk, ek n , x n , ℓ), ℓ) = F n (k, x 1 , . . . , x n )        = 1 -negl(λ),
where the probability is taken over the coins of Setup, KeyGen, KeyComb and Enc.

The scheme is public-key if ek i = ∅, that is, the encryption algorithm Enc only requires the public pk to encrypt messages. It is private-key otherwise.

We now present the many-AD-IND security notion for decentralized multi-client functional encryption. The difference with centralized multi-client functional encryption is that the shares of the functional decryption keys can be corrupted, instead of the functional decryption keys themselves. The oracle OCorrupt also give out the secret key sk i in addition of ek i , when queried on input slot i ∈ [n].

Definition 27: many-AD-IND secure DMCFE

A decentralized multi-client functional encryption DMCFE := (Setup, Enc, KeyGen, KeyComb, Dec) for the set of functionalities {F n } n∈N , is many-AD-IND secure if for every stateful PPT adversary A, we have:

Adv many-AD-IND DMCFE,A (λ) = Pr AD-IND DMCFE 0 (1 λ , A) = 1 -Pr AD-IND DMCFE 1 (1 λ , A) = 1 = negl(λ),
where the experiments are defined for β ∈ {0, 1} as follows:

Chapter 2. Preliminaries Experiment AD-IND MCFE β (1 λ , A): (pk, (ek i , sk i ) i∈[n] ) ← Setup(1 λ , F n ) α ← A OEnc(•,•,•),OKeygen(•,•),OCorrupt(•) (pk) Output: α
The oracle OEnc, on input (i, (x 0 i , x 1 i ), ℓ), returns Enc(pk, ek i , x β i , ℓ). For any input slot i ∈ [n], and label ℓ, we denote by Q i,ℓ the set of queries to OEnc for slot i and label ℓ, and Q i,ℓ the size of Q i,ℓ . The oracle OKeygen(i, k), on input i ∈ [n], and k ∈ K n , returns KeyGen(pk, sk i , k). The oracle OCorrupt, on input i ∈ [n], returns (ek i , sk i ). We denote by CS ⊆ [n] the set of corrupted slots. The queries of adversary A must satisfy the following condition.

Condition 1:

• For all i ∈ CS, all labels ℓ, all (

x 0 i , x 1 i ) ∈ Q i,ℓ , we have x 0 i = x 1 i .
• if A queries OKeygen(•, •) on the same key k for all slots i ∈ [n], then it must be that:

F n (k, x 0 1 , . . . , x 0 n ) = F n (k, x 1 1 , . . . , x 1 n ) for all labels ℓ and all vectors (x b i ) i∈[n],b∈{0,1} such that for all i ∈ [n], we have: either (x 0 i , x 1 i ) ∈ Q i,ℓ , or (i ∈ CS and x 0 i = x 1 i ).
If the condition is not satisfied, the experiment outputs 0 instead of α.

Concrete Instances of Functional Encryption for Inner Products

In this section, we recall the public-key single-input functional encryption schemes from [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF], which are proven many-AD-IND secure for the inner products. We recall the additional properties defined in [ACF + 18], which will be useful to obtain multi-input FE from single-input FE for inner products, in Chapter 4.

Inner-Product FE from MDDH

Here we present the FE for bounded norm inner products from [ALS16, Section 3], generalized to the D k (p)-MDDH setting, as in [AGRW17, Figure 15]. It handles the following functionality

F m,X,Y IP : K × X → Z, with X := [0, X] m , K := [0, Y ] m , Z := Z,
and for all x ∈ X , y ∈ Y, we have:

F m IP (y, x) = x, y .
This restriction on the norm of x ∈ X and y ∈ K is necessary for the correctness of the scheme. Note that the scheme actually supports vector of arbitrary norms, as long as we only want to decrypt the result in the exponent (see Remark 4).

In [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF], it was proven many-AD-IND secure under the DDH assumption. We extend the one-SEL-SIM security proof given in [AGRW17] to the multi-instance setting. Note that in the public-key setting, one-SEL-IND security (which is implied by one-SEL-SIM security) implies many-SEL-IND security. Finally, we also extend the many-AD-IND security proof from [AGRW17] to the multi-instance setting. We also show that is satisfies Property 1 (two-step decryption) and Property 2 (linear encryption).

GSetup(1 λ , F m,X,Y IP ): G := (G, p, P ) ← GGen(1 λ ), A ← R D k (p), gpk := (G, [A]) Return gpk Setup(1 λ , gpk, F m,X,Y IP ): W ← R Z m×(k+1) p , ek := [WA], msk := W Return (ek, msk) Enc(gpk, ek, x): r ← R Z k p Return -Ar x + WAr ∈ G k+m+1
KeyGen(gpk, msk, y):

Return W ⊤ y y ∈ Z k+m+1 p Dec(pk, [c], d): C := [c ⊤ d] Return log(C)

Correctness. We have

C = [x ⊤ y] ∈ G. Since x ∈ [0, X] m and y ∈ [0, Y ] m , we have x, y < m • X • Y .
Thus, we can efficiently recover the discrete log x, y as long as m, X, Y are polynomials in the security parameter.

Remark 4: Correctness for vectors with large norm

Note that the the functional encryption scheme FE presented in Figure 5.7 supports vectors x, y ∈ Z m of arbitrary norm, where the decryption efficiently recovers [ x, y ] ∈ G. This feature will be used in Chapter 4 to build multi-input FE from single-input FE for inner products.

Games: G 0 , G 1 , G 2 : {x i } i∈I⊆[n] ← A(1 λ , F m,X,Y IP ) G := (G, p, P ) ← R GGen(1 λ ), A ← R D k (p), a ⊥ ← R Z k+1 p \ {0} s.t. A ⊤ a ⊥ = 0 , gpk := (G, [A]). For all i ∈ [n]: W i ← R Z m×(k+1) p , ek i := [W i A], ct i := OEnc(x i ) α ← A OKeygen(•,•) (gpk, {ek i } i∈[n] , {ct i } i∈I ) Return α. OEnc(x i ): r i ← R Z k p , c i := Ar i , c i ← R Z k+1 p s.t. c ⊤ i a ⊥ = 1 , c ′ i := x i + W i c i , c ′ i := W i c i , return -c i c ′ i
OKeygen(i, y):

dk y := W ⊤ i y y . If i ∈ I, dk y := W ⊤ i y -x i , y • a ⊥ y .
Return dk y . Proof of Theorem 3. Let A be a PPT adversary, and λ ∈ N be the security parameter. We proceed with a series of hybrid games, described in Figure 2.3. For any game G, we denote by Adv G (A) the advantage of A in game G, that is, the probability that the game G outputs 1 when interacting with A.

Game G 0 : is the experiment REAL FE (1 λ , 1 n , A).
Game G 1 : is as game G 0 , except we replace the vector

[c i ] := [Ar i ] computed by OEnc(x i ) with [c i ] ← R G k+1 such that c ⊤ i a ⊥ = 1, where a ⊥ ← R Z k+1
p \ {0} such that A ⊤ a ⊥ = 0, using the D k (p)-MDDH assumption. We do so for all instances i ∈ I simultaneously (recall we denote by I ⊆ [n] the set of instances for which a challenge ciphertext is queried). Namely, we prove in Lemma 7 that there exists a PPT adversary B such that

|Adv G 0 (A) -Adv G 1 (A)| ≤ Adv D k (p)-mddh G,B (λ) + 1 p . GSetup(1 λ , F m IP ): G := (G, p, P ) ← GGen(1 λ ), A ← R D k (p), a ⊥ ← R Z k+1 p \ {0} s.t. A ⊤ a ⊥ = 0, gpk := (G, [A]), td := a ⊥ . Return ( gpk, td). Setup( gpk, F m IP ): W ← R Z m×(k+1) p , ek := [ WA], msk := W. Return ( ek, msk).
KeyGen td, msk, y, x, y :

Return W ⊤ y -x, y • a ⊥ y .
Enc(td, ek, msk): Game G 2 : is the experiment IDEAL FE (1 λ , 1 n , A), where the simulator ( GSetup, Setup, KeyGen, Enc) is described in 2.4. In Lemma 8, we show that game G 2 and game G 1 are perfectly indistinguishable, using a statistical argument, that crucially relies on the fact that game G 1 and G 2 are selective. Namely, we prove in Lemma 8 that

c ← R Z k+1 p s.t. c ⊤ a ⊥ = 1. Return -c Wc .
Adv G 1 (A) = Adv G 2 (A).
Putting everything together, we obtain:

Adv one-SEL-SIM FE,A,n (λ) ≤ Adv D k (p)-mddh G,B (λ) + 1 p . Lemma 7: Game G 0 to G 1
There exists a PPT adversary B such that

|Adv G 0 (A) -Adv G 1 (A)| ≤ Adv D k (p)-mddh G,B (λ) + 1 p .
Proof of Lemma 7. In game G 1 , we replace the vectors

[Ar i ] computed by OEnc(x i ), with [c i ] ← R G k+1 such that c ⊤ i a ⊥ = 1, simultaneously for all instances i ∈ [n]
. This replacement is justified by the facts that:

• The following are identically distributed: {Ar i } i∈ [n] and {Ar i + Ar} i∈ [n] , where for all

i ∈ [n], r i ← R Z k p , and r ← R Z k p .
• By the D k (p)-MDDH assumption, we can switch

([A], [Ar]) to ([A], [u]), where A ← R D k (p), r ← R Z k p , and u ← R Z k+1 p .
• The uniform distribution over Z k+1

(A) -Adv 0 (A)| ≤ Adv D k -mddh G,B (λ) + 1 p . Lemma 8: Game G 1 to G 2 Adv G 1 (A) = Adv G 2 (A).
Proof of Lemma 8. We use the fact that the following are identically distributed:

{W i } i∈[n] and {W i -x i (a ⊥ ) ⊤ } i∈[n] ,
where for all i ∈ [n]:

W i ← R Z m×(k+1) p
, and

a ⊥ ← R Z k+1 p such that A ⊤ a ⊥ = 0 and for all i ∈ [n], c ⊤ i a ⊥ = 1.
The leftmost distribution corresponds to game G 1 , whereas the rightmost distribution corresponds to game G 2 . We crucially rely on the fact that these games are selective, thus, the matrices W i are picked after the adversary A sends its challenge {x i } i∈I , and therefore, independently of it.

Namely:

(W i -x i (a ⊥ ) ⊤ )A = W i A x i + (W i -x i (a ⊥ ) ⊤ )c i = W i c i (W i -x i (a ⊥ ) ⊤ ) ⊤ y = W ⊤ i y -x i , y • a ⊥
which coincides precisely with the output of the simulator. This proves Adv 2 (A) = Adv 1 (A). Games:

G 0,β , G 1,β , G ⋆ 1,β , for β ∈ {0, 1}: (x 0 , x 1 ) ← A(1 λ , F m,X,Y IP ) G := (G, p, P ) ← R GGen(1 λ ), A ← R D k (p), gpk := (G, [A]), a ⊥ ← R Z k+1 p \ {0} s. t. A ⊤ a ⊥ = 0 , W ← R Z m×(k+1) p , ek := [WA], ct := OEnc(x 0 , x 1 ) . α ← A OKeygen(•), OEnc(•) ek, ct Return α. OEnc(x 0 , x 1 ): r ← R Z k p , c := Ar, c ← R Z k+1 p s.t. c ⊤ a ⊥ = 1 , c ′ := x β + Wc, return -c c ′ .

OKeygen(y):

Return W ⊤ y y Proof of Theorem 4. First,because FE described in Figure 5.7 is a public key encryption scheme, it suffices to prove one-AD-IND security: many-AD-IND follows by a standard hybrid argument over all challenge ciphertexts (cf Lemma 6). Second, it suffices to prove security for a single instance, since it implies its many-instance variant, as shown in Lemma 5. We now prove one-AD-IND security for a single instance.

Let A be a PPT adversary, and λ ∈ N be the security parameter. We proceed with a series of hybrid games, described below. For any game G, we denote by Adv G (A) the advantage of A in game G, that is, the probability that the game G outputs 1 when interacting with A.

Games G 0,β , for β ∈ {0, 1}: are such that Adv one-AD-IND FE,A,1 (λ) = |Adv G 0,0 (A) -Adv G 0,1 (A)| (see Definition 21).
Games G 1,β , for β ∈ {0, 1}: are as games G 0,β , except we replace the vector [Ar] computed by OEnc(

x 0 , x 1 ) with [c] ← R G k+1 , such that c ⊤ a ⊥ = 1, where a ⊥ ← R Z k+1 p \ {0} such that A ⊤ a ⊥ = 0, using the D k (p)-MDDH assumption.
Namely, we prove in Lemma 9 that there exists a PPT adversary B β such that

|Adv G 0,β (A) -Adv G 1,β (A)| ≤ Adv D k (p)-mddh G,B β (λ) + 1 p .

At this point, we show that

Adv G 1,0 (A) = Adv G 1,1 (A) in three steps. First, we consider the selective variant of game G 1,β , called G ⋆ 1,β
, where the adversary must commit to its challenge {x b } b∈{0,1} beforehand. By a guessing argument, we show in Lemma 10 that there exists PPT adversary A ⋆ such that

Adv G 1,β (A) = (X + 1) 2m • Adv G ⋆ 1,β (A ⋆ ).
Then we prove in Lemma 11 that the game G ⋆ 1,0 is identical to game G ⋆ 1,1 using a statistical argument, which is only true in the selective setting. Namely, for any adversary A ′ :

Adv G ⋆ 1,0 (A ′ ) = Adv G ⋆ 1,1 (A ′ ).
Putting everything together, we obtain:

Adv one-AD-IND FE,A,1 (λ) ≤ 2 • Adv D k (p)-mddh G,B (λ) + 2 p . Lemma 9: Game G 0,β to G 1,β
There exists a PPT adversary B β such that

|Adv G 0,β (A) -Adv G 1,β (A)| ≤ Adv D k (p)-mddh G,B β (λ) + 1 p .
Proof of Lemma 9. This is proof is similar to the proof of Lemma 7, for the one-SEL-SIM security of FE. We replace the vectors [Ar] computed by OEnc(x 0 , x 1 ) with [c] ← R G k+1 such that c ⊤ a ⊥ = 1. This replacement is justified by the facts that:

• By the D k (p)-MDDH assumption, we can switch ([A], [Ar]) to ([A], [u]), where A ← R D k (p), r ← R Z k p ,
G 0 ,β (A) -Adv G 1 ,β (A)| ≤ Adv D k (p)-mddh G,B β (λ) + 1 p . Lemma 10: Game G 1,β to G ⋆ 1,β
There exists a PPT adversary A ⋆ such:

Adv G 1,β (A) = (X + 1) -2m • Adv G ⋆ 1,β (A ⋆ ).
Proof of Lemma 10. First, A ⋆ guesses the challenge by picking random:

{x ⋆ b } b∈{0,1} ← R [0, X] 2m
, and sends its to the game G ⋆ 1,β , which is a selective variant of game G 1,β . These games are described in Figure 2.5. Whenever A queries OKeygen, A ⋆ forwards the query to its own oracle, and gives back the answer to A. When A calls OEnc(x 0 , x 1 ), A ⋆ verifies its guess was correct, that is (x 0 , x 1 ) = (x ⋆ 0 , x ⋆ 1 ). If the guess is incorrect, A ⋆ ends the simulation, and sends α := 0 to the game G ⋆ 1,β . Otherwise, it keeps answering A's queries to OKeygen as explained, and forwards A's output α to the game G ⋆ 1,β . When A ⋆ guesses correctly, it simulates A's view perfectly. When it fails to guess, it outputs α := 0. Thus, the probability that

A ⋆ outputs 1 in G ⋆ 1,β is exactly (X + 1) -2m • Adv G 1,β (A). Lemma 11: Game G ⋆ 1,0 to G ⋆ 1,1
For all adversaries A ′ , we have:

Adv G ⋆ 1,0 (A ′ ) = Adv G ⋆ 1,1 (A ′ ).
Proof of Lemma 11. We use the fact that the following distributions are identical:

W and W + (x 1 -x 0 )(a ⊥ ) ⊤ , where W ← R Z m×(k+1) p
, and a ⊥ ← R Z k+1 p such that A ⊤ a ⊥ = 0. The leftmost distribution corresponds to game G ⋆ 1,0 , while the rightmost distribution corresponds to G ⋆ 1,1 , since we have:

(W + (x 1 -x 0 )(a ⊥ ) ⊤ )A = WA x 0 + (W + (x 1 -x 0 )(a ⊥ ) ⊤ )c = x 1 + Wc (W + (x 1 -x 0 )(a ⊥ ) ⊤ ) ⊤ y = W ⊤ y + ( x 1 , y -x 0 , y )a ⊥ = W ⊤ y
The first equality uses the fact that A ⊤ a ⊥ = 0, the second equality uses the fact that c ⊤ a ⊥ = 1, and the third equality uses the fact that x 0 , y = x 1 , y for any y queried to OKeygen.

Note that we are relying on the fact that in these games, W ← R Z m×(k+1) p is picked after the adversary A sends its selective challenge {x b } b∈{0,1} , and therefore, independently of it.

Inner-Product FE from LWE

Here we present the many-AD-IND secure Inner-Product FE from [ALS16, Section 4.1].

GSetup(1 λ , F m,X,Y IP ): Let integers M, q ≥ 2, real α ∈ (0, 1), and distribution D over Z m×M . Set K := m • X • Y , A ← R Z M ×λ q , gpk := (K, A). Return gpk Setup(1 λ , gpk, F m,X,Y IP ): Z ← R D, U := ZA ∈ Z m×λ q , ek := U, msk := Z. Return (ek, msk) Enc(gpk, ek, x ∈ Z m ): s ← R Z λ q , e 0 ← R D M Z,αq , e 1 ← R D m Z,αq c 0 := As + e 0 ∈ Z M q c 1 := Us + e 1 + x • q K ∈ Z m q Return ct x := (c 0 , c 1 )
KeyGen(gpk, msk, y ∈ Z m ):

Return dk y := Z ⊤ y y ∈ Z M +m
Dec gpk, dk y , ct x ): Choice of parameters. Following the analysis given in [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF], we choose:

µ ′ := c 0 c 1 ⊤ dk y mod q. Return µ ∈ {-K + 1, . . . , K -1} that minimizes ⌊ q K ⌋µ -µ ′ .
• σ 1 := Θ λ log(M ) max( √ M , K) • σ 2 := Θ λ 7/2 M 1/2 max(M, K 2 ) log 5/2 (M ) • D := D m×M/2 Z,σ 1 × D Z M/2 ,σ 2 ,u 1 × • • • × D Z M/2 ,σ 2 ,um
, where for all i ∈ [m], u i denotes the i'th canonical vector.

• Let B D be such that with probability at least 1λ ω(1) , each row of a sample from D has norm at most B D . For correctness, we must have:

α -1 ≥ K 2 B D ω( √ log λ), q ≥ α -1 ω( log(λ)). • M ≥ 4λ log q, m ≤ λ O(1) , q > mK 2

Theorem 5: many-AD-IND security [ALS16]

The FE from Figure 5.8 is correct and many-AD-IND secure under the mheLWE q,α,M,m,D assumption (see Definition 18).

Inner-Product FE from DCR

Here we present the many-AD-IND secure Inner-Product FE from [ALS16, Section 5.1].

Theorem 6: many-AD-IND security [ALS16]

The FE from Figure 5.9 is correct and many-AD-IND secure under the DCR assumption (see Definition 16).

GSetup(1 λ , F m,X,Y IP ):
Choose primes p = 2p ′ + 1, q = q ′ + 1 with prime p ′ , q ′ > 2 l(λ) for an l(λ) = poly(λ) such that factoring is λ-hard, and set

N := pq ensuring that m • X • Y < N . Sample g ′ ← R Z * N 2 , g := g ′ 2N mod N 2 . Return gpk := (N, g) Setup(1 λ , gpk, F m,X,Y IP ): s ← R D Z m ,σ , for standard deviation σ > √ λ • N 5/2
, and for all j ∈ [m],

h j := g sj mod N 2 . ek := {h j } j∈[m] , msk := {s j } j∈[m] Return (ek, msk) Enc(gpk, ek, x ∈ Z m ): r ← R {0, . . . , ⌊N/4⌋}, C 0 := g r ∈ Z N 2 , for all j ∈ [m], C j := (1 + x j N ) • h r j ∈ Z N 2 Return ct x := (C 0 , . . . , C m ) ∈ Z m+1 N 2 KeyGen(gpk, msk, y ∈ Z m ): d := j∈[m] y j s j ∈ Z. Return sk y := (d, y)
Dec gpk, sk y := (d, y), ct x ): We present the construction from [GHKW16], which was the first CCA-secure public-key encryption with a tight security reduction to DDH, without relying on the use of pairings. We refer to Figure 1.1 for a comparison with related works.

C := j∈[m] C yj j • C -d 0 mod N 2 . Return log (1+N ) (C) := C-1 mod N 2 N .
Overview of our construction. In this overview, we will consider a weaker notion of security, namely tag-based KEM security against plaintext check attacks (PCA) [START_REF] Okamoto | REACT: Rapid Enhanced-security Asymmetric Cryptosystem Transform[END_REF]. In the PCA security experiment, the adversary gets no decryption oracle (as with CCA security), but a PCA oracle that takes as input a tag and a ciphertext/plaintext pair and checks whether the ciphertext decrypts to the plaintext. Furthermore, we restrict the adversary to only query the PCA oracle on tags different from those used in the challenge ciphertexts. PCA security is strictly weaker than the CCA security we actually strive for, but allows us to present our solution in a clean and simple way. (We show how to obtain full CCA security separately.)

The starting point of our construction is the Cramer-Shoup KEM. The public key is given by pk

:= ([M], [M ⊤ k 0 ], [M ⊤ k 1 ]) for M ← R Z (k+1)×k q
. On input pk and a tag τ , the encryption algorithm outputs the ciphertext/plaintext pair

([y], [z]) = ([Mr], [r ⊤ M ⊤ k τ ]), (3.1)
where

k τ = k 0 + τ k 1 and r ← R Z k q . Decryption relies on the fact that y ⊤ k τ = r ⊤ M ⊤ k τ .
The KEM is PCA-secure under k-Lin, with a security loss that depends on the number of ciphertexts Q (via a hybrid argument) but independent of the number of PCA queries [START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF][START_REF] Abdalla | Public-key encryption indistinguishable under plaintext-checkable attacks[END_REF].

Following the "randomized Naor-Reingold" paradigm introduced by Chen and Wee on tightly secure IBE [START_REF] Chen | Fully, (almost) tightly secure IBE and dual system groups[END_REF], our starting point is (3.1), where we replace

k τ = k 0 + τ k 1 with k τ = λ j=1 k j,τ j and pk := ([M], [M ⊤ k j,b ] j=1,...,λ,b=0,1
), where (τ 1 , . . . , τ λ ) denotes the binary representation of the tag τ ∈ {0, 1} λ .

Following [START_REF] Chen | Fully, (almost) tightly secure IBE and dual system groups[END_REF], we want to analyze this construction by a sequence of games in which we first replace [y] in the challenge ciphertexts by uniformly random group elements via random self-reducibility of MDDH (k-Lin), and then incrementally replace k τ in both the challenge ciphertexts and in the PCA oracle by k τ + M ⊥ RF(τ ), where RF is a truly random function and M ⊥ is a random element from the kernel of M, i.e., M ⊤ M ⊥ = 0. Concretely, in Game i, we will replace k τ with k τ + M ⊥ RF i (τ ) where RF i is a random function on {0, 1} i applied to the i-bit prefix of τ . We proceed to outline the two main ideas needed to carry out this transition. Looking ahead, note that once we reach Game λ, we would have replaced k τ with k τ + M ⊥ RF(τ ), upon which security follows from a straight-forward information-theoretic argument (and the fact that ciphertexts and decryption queries carry pairwise different τ ).

First idea. First, we show how to transition from Game i to Game i+1, under the restriction that the adversary is only allowed to query the encryption oracle on tags whose i + 1-st bit is 0; we show how to remove this unreasonable restriction later. Here, we rely on an informationtheoretic argument similar to that of Cramer and Shoup to increase the entropy from RF i to RF i+1 . This is in contrast to prior works which rely on a computational argument; note that the latter requires encoding secret keys as group elements and thus a pairing to carry out decryption.

More precisely, we pick a random function RF ′ i on {0, 1} i , and implicitly define RF i+1 as follows:

RF i+1 (τ ) = RF i (τ ) if τ i+1 = 0 RF ′ i (τ ) if τ i+1 = 1
Observe all of the challenge ciphertexts leak no information about RF ′ i or k i+1,1 since they all correspond to tags whose i + 1-st bit is 0. To handle a PCA query (τ, [y], [z]), we proceed via a case analysis:

• if τ i+1 = 0, then k τ + RF i+1 (τ ) = k τ + RF i (τ )
and the PCA oracle returns the same value in both Games i and i + 1.

• if τ i+1 = 1 and y lies in the span of M, we have

y ⊤ M ⊥ = 0 =⇒ y ⊤ (k τ + M ⊥ RF i (τ )) = y ⊤ (k τ + M ⊥ RF i+1 (τ )),
and again the PCA oracle returns the same value in both Games i and i + 1.

• if τ i+1 = 1 and y lies outside the span of M, then y ⊤ k i+1,1 is uniformly random given M, M ⊤ k i+1,1 . (Here, we crucially use that the adversary does not query encryptions with τ i+1 = 1, which ensures that the challenge ciphertexts do not leak additional information about k i+1,1 .) This means that y ⊤ k τ is uniformly random from the adversary's viewpoint, and therefore the PCA oracle will reject with high probability in both Games i and i + 1. (At this point, we crucially rely on the fact that the PCA oracle only outputs a single check bit and not all of k τ + RF(τ ).)

Via a hybrid argument, we may deduce that the distinguishing advantage between Games i and i + 1 is at most Q/q where Q is the number of PCA queries.

Second idea. Next, we remove the restriction on the encryption queries using an idea of Hofheinz, Koch and Striecks [START_REF] Hofheinz | Identity-based encryption with (almost) tight security in the multi-instance, multi-ciphertext setting[END_REF] for tightly-secure IBE in the multi-ciphertext setting, and its instantiation in prime-order groups [GCD + 16]. The idea is to create two "independent copies" of (M ⊥ , RF i ); we use one to handle encryption queries on tags whose i + 1-st bit is 0, and the other to handle those whose i + 1-st bit is 1. We call these two copies (M * 0 , RF

(0) i ) and (M * 1 , RF (1) i ), where M ⊤ M * 0 = M ⊤ M * 1 = 0. Concretely, we replace M ← R Z (k+1)×k q with M ← R Z 3k×k q . We decompose Z 3k
q into the span of the respective matrices M, M 0 , M 1 , and we will also decompose the span of

M ⊥ ∈ Z 3k×2k q into that of M * 0 , M * 1 . Similarly, we decompose M ⊥ RF i (τ ) into M * 0 RF (0) i (τ ) + M * 1 RF (1)
i (τ ). We then refine the prior transition from Games i to i + 1 as follows:

• Game i.0 (= Game i): pick y ← Z 3k
q for ciphertexts, and replace

k τ with k τ +M * 0 RF (0) i (τ )+ M * 1 RF (1) i (τ ); basis for Z 3k q basis for Span(M ⊥ ) M M 0 M 1 M * 0 M * 1 Figure 3.1: Solid lines mean orthogonal, that is: M ⊤ M * 0 = M ⊤ 1 M * 0 = 0 = M ⊤ M * 1 = M ⊤ 0 M * 1 . • Game i.1: replace y ← R Z 3k q with y ← R Span(M, M τ i+1 ); • Game i.2: replace RF (0) i (τ ) with RF (0) i+1 (τ ); • Game i.3: replace RF (1) i (τ ) with RF (1) i+1 (τ ); • Game i.4 (= Game i + 1): replace y ← R Span(M, M τ i+1 ) with y ← R Z 3k
q . For the transition from Game i.0 to Game i.1, we rely on the fact that the uniform distributions over Z 3k q and Span(M, M τ i+1 ) encoded in the group are computationally indistinguishable, even given a random basis for Span(M ⊥ ) (in the clear). This extends to the setting with multiple samples, with a tight reduction to the D k (p)-MDDH Assumption independent of the number of samples.

For the transition from Game i.1 to i.2, we rely on an information-theoretic argument like the one we just outlined, replacing Span(M) with Span(M, M 1 ) and M ⊥ with M * 0 in the case analysis. In particular, we will exploit the fact that if y lies outside Span(M, M 1 ), then

y ⊤ k i+1,1 is uniformly random even given M, Mk i+1,1 , M 1 , M 1 k i+1,1 . The transition from Game i.2 to i.3 is completely analogous.
From PCA to CCA. Using standard techniques from [CS03, KD04, Kil06, BCHK07, AGK08], we could transform our basic tag-based PCA-secure scheme into a "full-fledged" CCA-secure encryption scheme by adding another hash proof system (or an authenticated symmetric encryption scheme) and a one-time signature scheme. However, this would incur an additional overhead of several group elements in the ciphertext. Instead, we show how to directly modify our tag-based PCA-secure scheme to obtain a more efficient CCA-secure scheme with the minimal additional overhead of a single symmetric-key authenticated encryption. In particular, the overall ciphertext overhead in our tightly CCA-secure encryption scheme is merely one group element more than that for the best known non-tight schemes [START_REF] Kurosawa | A new paradigm of hybrid encryption scheme[END_REF][START_REF] Hofheinz | Secure hybrid encryption from weakened key encapsulation[END_REF].

To encrypt a message M in the CCA-secure encryption scheme, we will (i) pick a random y as in the tag-based PCA scheme, (ii) derive a tag τ from y, (iii) encrypt M using a one-time authenticated encryption under the KEM key [y ⊤ k τ ]. The naive approach is to derive the tag τ by hashing [y] ∈ G 3k , as in [START_REF] Kurosawa | A new paradigm of hybrid encryption scheme[END_REF]. However, this creates a circularity in Game i.1 where the distribution of [y] depends on the tag. Instead, we will derive the tag τ by hashing [y] ∈ G k , where y ∈ Z k q are the top k entries of y ∈ Z 3k q . We then modify M 0 , M 1 so that the top k rows of both matrices are zero, which avoids the circularity issue. In the proof of security, we will also rely on the fact that for any y 0 , y 1 ∈ Z 3k q , if y 0 = y 1 and y 0 ∈ Span(M), then either y 0 = y 1 or y 1 / ∈ Span(M). This allows us to deduce that if the adversary queries the CCA oracle on a ciphertext which shares the same tag as some challenge ciphertext, then the CCA oracle will reject with overwhelming probability.

Alternative view-point. Our construction can also be viewed as applying the IBE-to-PKE transform from [START_REF] Boneh | Chosen-ciphertext security from identity-based encryption[END_REF] to the scheme from [START_REF] Hofheinz | Identity-based encryption with (almost) tight security in the multi-instance, multi-ciphertext setting[END_REF], and then writing the exponents of the secret keys in the clear, thereby avoiding the pairing. This means that we can no longer apply a computational assumption and the randomized Naor-Reingold argument to the secret key space. Indeed, we replace this with an information-theoretic Cramer-Shoup-like argument as outlined above.

Prior approaches. Several approaches to construct tightly CCA-secure PKE schemes exist: first, the schemes of [HJ12, ACD + 12, ADK + 13, LPJY14, LJYP14, LPJY15] construct a tightly secure NIZK scheme from a tightly secure signature scheme, and then use the tightly secure NIZK in a CCA-secure PKE scheme following the Naor-Yung double encryption paradigm [START_REF] Naor | Public-key cryptosystems provably secure against chosen ciphertext attacks[END_REF][START_REF] Dolev | Nonmalleable cryptography[END_REF]. Since these approaches build on the public verifiability of the used NIZK scheme (in order to faithfully simulate a decryption oracle), their reliance on a pairing seems inherent.

Next, the works of [CW13, BKP14, HKS15, AHY15b, GCD + 16] used a (Naor-Reingoldbased) MAC instead of a signature scheme to design tightly secure IBE schemes. Those IBE schemes can then be converted (using the BCHK transformation [START_REF] Boneh | Chosen-ciphertext security from identity-based encryption[END_REF]) into tightly CCA-secure PKE schemes. However, the derived PKE schemes still rely on pairings, since the original IBE schemes do (and the BCHK does not remove the reliance on pairings).

In contrast, our approach directly fuses a Naor-Reingold-like randomization argument with the encryption process. We are able to do so since we substitute a computational randomization argument (as used in the latter line of works) with an information-theoretic one, as described above. Hence, we can apply that argument to exponents rather than group elements. This enables us to trade pairing operations for exponentiations in our scheme.

Road-map. The rest of this chapter is organized as follows. First, we present our keyencapsulation mechanism (KEM) that is only PCA-secure when there is multiple challenge ciphertext, with a tight security reduction from DDH. Its security proof already captures most technical novelties. Then, we show how to upgrade this encryption scheme to obtain tightly, CCA-secure encryption, using an additional layer of symmetric authenticated encryption, à la [START_REF] Kurosawa | A new paradigm of hybrid encryption scheme[END_REF][START_REF] Hofheinz | Secure hybrid encryption from weakened key encapsulation[END_REF].

Multi-ciphertext PCA-secure KEM

In this section we describe a tag-based Key Encapsulation Mechanism KEM that is IND-PCAsecure (see Definition 6).

For simplicity, we use the matrix distribution U 3k,k (p) in our scheme in Figure 3.2, and prove it secure under the U k (p)-MDDH assumption (⇔ U 3k,k (p)-MDDH assumption, by Lemma 2). However, using a matrix distribution D 3k,k (p) with more compact representation yields a more efficient scheme, secure under the D 3k,k (p)-MDDH assumption (see Remark 5).

Our construction

Gen KEM (1 λ ): G := (G, p, P ) ← R GGen(1 λ ); M ← R U 3k,k (p) k 1,0 , . . . , k λ,1 ← R Z 3k p pk := G, [M], [M ⊤ k j,β ] 1≤j≤λ,0≤β≤1 sk := (k j,β ) 1≤j≤λ,0≤β≤1 Return (pk, sk) Enc KEM (pk, τ ): r ← R Z k p ; C := [r ⊤ M ⊤ ] k τ := λ j=1 k j,τj K := [r ⊤ • M ⊤ k τ ] Return (C, K) ∈ G 1×3k × G Dec KEM (pk, sk, τ, C): k τ := λ j=1 k j,τj Return K := C • k τ

Remark 5: On the use of the U k (p)-MDDH assumption

In our scheme, we use a matrix distribution U 3k,k (p) for the matrix M, therefore proving security under the U 3k,k (p)-MDDH assumption ⇔ U k (p)-MDDH assumption (see Lemma 3). This is for simplicity of the presentation. However, for efficiency, one may want to use an assumption with a more compact representation, such as the CI 3k,k -MDDH assumption [START_REF] Morillo | The kernel matrix Diffie-Hellman assumption[END_REF] with representation size 2k instead of 3k 2 for U 3k,k (p).

Perfect correctness. It follows readily from the fact that for all r ∈ Z k p and

C = r ⊤ M ⊤ , for all k ∈ Z 3k p : r ⊤ (M ⊤ k) = C • k.

Security proof

+ (Q Dec + Q Enc ) • poly(λ) and Adv IND-PCA KEM,A (λ) ≤ (4λ + 1) • Adv U k (p)-mddh G,B (λ) + (Q Dec + Q Enc ) • 2 -Ω(λ) ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

G1 Z 3k q kτ U 3k,k -MDDH on [M] G2.i Z 3k q kτ + M ⊥ RFi(τ |i ) G1 ≡ G2.0 G2.i.1 τi+1 = 0 : Span(M, M0) kτ + M ⊥ RFi(τ |i ) U 3k,k -MDDH on [M0] τi+1 = 1 : Span(M, M1) U 3k,k -MDDH on [M1] G2.i.2 τi+1 = 0 : Span(M, M0) kτ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i (τ |i ) Cramer-Shoup τi+1 = 1 : Span(M, M1) argument G2.i.3 τi+1 = 0 : Span(M, M0) kτ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i+1 (τ |i+1 ) Cramer-Shoup τi+1 = 1 : Span(M, M1) argument G2.i+1 Z 3k q kτ + M ⊥ RFi+1(τ |i+1 ) U 3k,k -MDDH on [M0]
and [M1]

k τ := λ j=1 k j,τj ; (ii) EncO(τ ) = ([y], K b ) where K 0 = [y ⊤ k ′ τ ] and K 1 ← R G; (iii) DecO(τ, [y], K) computes the encap- sulation key K := [y ⊤ • k ′ τ ]. Here, (M * 0 , M * 1 ) is a basis for Span(M ⊥ ), so that M ⊤ 1 M * 0 = M ⊤ 0 M * 1 = 0, and we write M ⊥ RF i (τ |i ) := M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i ).
The second column shows which set y is uniformly picked from by EncO, the third column shows the value of k ′ τ used by both EncO and DecO.

Proof of Theorem 7. We proceed via a series of hybrid games described in Figure 3.4 and 3.5 and for any game G, we use Adv G (A) to denote the advantage of A in game G. We also give a high-level picture of the proof in Figure 3.3, summarizing the sequence of games.

G 0 ,G 1 , G 2.i : • To go from game G 0 to G 1 , we use the MDDH assumption to "tightly" switch the distribution of all the challenge ciphertexts. In Lemma 12, we build an adversary B 0 such that:

T Enc = T Dec := ∅; b ← R {0, 1} G ← R GGen(1 λ ); M ← R U 3k,k M ⊥ ← R U 3k,2k s.t. M ⊤ M ⊥ = 0 Pick random RF i : {0, 1} i → Z 2k p k 1,0 , . . . , k λ,1 ← R Z 3k p For all τ ∈ {0, 1} λ , k τ := λ j=1 k j,τj k ′ τ := k τ + M ⊥ RF i (τ |i ) pk := G, [M], [M ⊤ k j,β ] 1≤j≤λ,0≤β≤1 b ′ ← A DecO(•,•),EncO(•) (pk) Return 1 if b = b ′ , 0 otherwise. EncO(τ ): G 0 , G 1 ,G 2.i r ← R Z k p ; y := Mr; y ← R Z 3k p K 0 := [y ⊤ • k ′ τ ]; K 1 ← R G If τ / ∈ T Dec ∪ T Enc , return (C := [y], K b ), and set T Enc := T Enc ∪ {τ }. Otherwise, return ⊥. DecO(τ, C := [y], K): G 0 ,G 1 ,G 2.i K := [y ⊤ • k ′ τ ] Return 1 if K = K ∧ τ / ∈ T Enc 0 otherwise T Dec := T Dec ∪ {τ }
|Adv G 0 (A) -Adv G 1 (A)| ≤ Adv U k (p)-mddh G,B 0 (λ) + 1 p -1 .
• In Lemma 13, we show that the game G 1 and G 2.0 are identically distributed.

• For all 0 ≤ i ≤ λ -1, we build in Lemma 14 an adversary B 2.i such that:

|Adv G 2.i (A) -Adv G 2.i+1 (A)| ≤ 4 • Adv U k (p)-mddh G,B 2.i (λ) + 4Q Dec + 2k p + 4 p -1 ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO.

• In Lemma 19, we show that Adv G 2.λ (A) ≤ Q Enc p , using a statistical argument.

Putting everything together, we obtain an adversary B such that T(B) ≈ T(A)

+ (Q Dec + Q Enc ) • poly(λ) and Adv IND-PCA KEM,A (λ) ≤ (4λ + 1) • Adv U k (p)-mddh G,B (λ) + (Q Dec + Q Enc ) • 2 -Ω(λ) ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Lemma 12: From game G 0 to game G 1

There exists an adversary B 0 such that T(B 0 ) ≈ T(A)

+ (Q Enc + Q Dec ) • poly(λ) and |Adv G 0 (A) -Adv G 1 (A)| ≤ Adv U k (p)-mddh G,B 0 (λ) + 1 p -1 ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 12. To go from G 0 to G 1 , we switch the distribution of the vectors [y] sampled by EncO, using the Q Enc -fold U 3k,k (p)-MDDH assumption on [M] (see Definition 12). We build an adversary

B ′ 0 against the Q Enc -fold U 3k,k (p)-MDDH assumption, such that T(B ′ 0 ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ) with poly(λ) independent of T(A), and |Adv G 0 (A) -Adv G 1 (A)| ≤ Adv Q Enc -U k (p)-mddh G,B ′ 0 (λ).
This implies the lemma by Corollary 1

(U k (p)-MDDH ⇒ Q Enc -fold U 3k,k (p)-MDDH). Upon receiving a challenge (G, [M] ∈ G 3k×k , [H] := [h 1 | . . . |h Q Enc ] ∈ G 3k×Q Enc ) for the Q Enc -fold U 3k,k (p)-MDDH assumption, B ′ 0 picks b ← R {0, 1}, k 1,0 , . . . , k λ,1 ← R Z 3k
p , generates pk and simulates the oracle DecO as described in Figure 3.4. To simulate EncO on its j'th query, for j = 1, . . . , Q Enc , B ′ 0 sets [y] := [h j ], and computes K b as described in Figure 3.4.

Lemma 13: From game G 1 to game G 2.0

For any adversary A, we have:

|Adv G 1 (A) -Adv G 2.0 (A)| = 0.
Proof of Lemma 13. To go from G 1 to G 2.0 , we change the distribution of

k 1,β ← R Z 3k p for β = 0, 1, to k 1,β + M ⊥ RF 0 (ε), where k 1,β ← R Z 3k p , RF 0 (ε) ← R Z 2k p , and M ⊥ ← R U 3k,2k (p) such that M ⊤ M ⊥ = 0. Note that the extra term M ⊥ RF 0 (ε) does not appear in pk, since M ⊤ (k 1,β + M ⊥ RF 0 (ε)) = M ⊤ k 1,β . Lemma 14: From game G 2.i to game G 2.i+1
For all 0 ≤ i ≤ λ -1, there exists an adversary

B 2.i such that T(B 2.i ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ) and |Adv G 2.i (A) -Adv G 2.i+1 (A)| ≤ 4 • Adv U k (p)-mddh G,B 2.i (λ) + 4Q Dec + 2k p + 4 p -1 ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 14. To go from G 2.i to G 2.i+1 , we introduce intermediate games G 2.i.1 , G 2.i.2 and G 2.i.3 , defined in Figure 3.5.

• To go from game G 2.i to game G 2.i.1 , we use the MDDH assumption to "tightly" switch the distribution of all the challenge ciphertexts. We proceed in two steps, first, by changing the distribution of all the ciphertexts with a tag τ such that τ i+1 = 0, and then, for those with a tag τ such that τ i+1 = 1. We use the MDDH assumption with respect to an independent matrix for each step. We build an adversary in B 2.i.0 Lemma 15 such that:

|Adv G 2.i (A) -Adv G 2.i.1 (A)| ≤ 2 • Adv U k (p)-mddh G,B 2.i.0 (λ) + 2 p -1 ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively.

• To go from game G 2.i.1 to game G 2.i.2 , we use a variant of the Cramer-Shoup informationtheoretic argument to move from RF i to RF i+1 , thereby increasing the entropy of k ′ τ . For the sake of readability, we proceed in two steps: in Lemma 16, we move from RF i to an hybrid between RF i and RF i+1 , and in Lemma 17, we move to RF i+1 . In Lemma 16, we show that:

|Adv G 2.i.1 (A) -Adv G 2.i.2 (A)| ≤ 2Q Dec + 2k p ,
where Q Dec is the number of times A queries DecO.

• In Lemma 17, we show that

|Adv G 2.i.2 (A) -Adv G 2.i.3 (A)| ≤ 2Q Dec p ,
where Q Dec is the number of times A queries DecO, using a statistical argument.

• The transition between G 2.i.3 and game G 2.i+1 is symmetric to the transition between game G 2.i and game G 2.i.1 (cf. Lemma 15): we use the MDDH assumption to "tightly" switch the distribution of all the challenge ciphertexts in two steps; first, by changing the distribution of all the ciphertexts with a tag τ such that τ i+1 = 0, and then, the distribution of those with a tag τ such that τ i+1 = 1, using the MDDH assumption with respect to an independent matrix for each step. We build an adversary B 2.i.3 in Lemma 18 such that:

|Adv G 2.i.3 (A) -Adv G 2.i+1 (A)| ≤ 2 • Adv U k (p)-mddh G,B 2.i.3 (λ) + 2 p -1 ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively.

Putting everything together, we obtain the lemma.

G 2.i , G 2.i.1 , G 2.i.2 , G 2.i.3 T Enc = T Dec := ∅; b ← R {0, 1} G ← R GGen(1 λ ); M ← R U 3k,k M ⊥ ← R U 3k,2k s.t. M ⊤ M ⊥ = 0 M 0 , M 1 ← R U 3k,k M * 0 , M * 1 ← R U 3k,k s.t. Span(M ⊥ ) = Span(M * 0 , M * 1 ) M ⊤ M * 0 = M ⊤ 1 M * 0 = 0 = M ⊤ M * 1 = M ⊤ 0 M * 1 Pick random RF i : {0, 1} i → Z 2k p . Pick random RF (0) i+1 : {0, 1} i+1 → Z k p and RF (1) i : {0, 1} i → Z k p Pick random RF (0) i+1 , RF (1) i+1 : {0, 1} i+1 → Z k p . k 1,0 , . . . , k λ,1 ← R Z 3k p For all τ ∈ {0, 1} λ , k τ := λ j=1 k j,τj k ′ τ := k τ + M ⊥ RF i (τ i ) k ′ τ := k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i (τ |i ) k ′ τ := k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i+1 (τ |i+1 ) pk := G, [M], [M ⊤ k j,β ] 1≤j≤λ,0≤β≤1 b ′ ← A DecO(•,•,•),EncO(•) (pk) Return 1 if b ′ = b, 0 otherwise. EncO(τ ): G 2.i , G 2.i.1 , G 2.i.2 ,G 2.i.3 y ← R Z 3k p If τ i+1 = 0 : r ← R Z k p ; r 0 ← R Z k p ; y := Mr + M 0 r 0 If τ i+1 = 1 : r ← R Z k p ; r 1 ← R Z k p ; y := Mr + M 1 r 1 K 0 := [y ⊤ • k ′ τ ]; K 1 ← R G If τ / ∈ T Dec ∪ T Enc , return (C := [y], K b ) and set T Enc := T Enc ∪ {τ }. Otherwise, return ⊥. DecO(τ, C := [y], K): G 2.i ,G 2.i.1 ,G 2.i.2 ,G 2.i.3 K := [y ⊤ k ′ τ ] Return 1 if K = K ∧ τ / ∈ T Enc 0 otherwise T Dec := T Dec ∪ {τ }. Figure 3.5: Games G 2.i (for 0 ≤ i ≤ λ),G 2.i.1 , G 2.i.2 and G 2.i.3 (for 0 ≤ i ≤ λ -1)
for the proof of Lemma 14. For all τ ∈ {0, 1} λ , we denote by τ |i the i-bit prefix of τ . In each procedure, the components inside a solid (dotted, gray) frame are only present in the games marked by a solid (dotted, gray) frame.

Lemma 15: From game G 2.i to game G 2.i.1

For all 0 ≤ i ≤ λ -1, there exists an adversary B 2.i.0 such that T(B 2.i.0 ) ≈ T(A)

+ (Q Enc + Q Dec ) • poly(λ) and |Adv G 2.i (A) -Adv G 2.i.1 (A)| ≤ 2 • Adv U k (p)-mddh G,B 2.i.0 (λ) + 2 p -1 ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 15.

.i.0 ) ≈ T(B ′′ 2.i.0 ) ≈ T(A) + (Q Enc + Q Dec )
• poly(λ) with poly(λ) independent of T(A), and

Claim 1: |Adv G 2.i (A) -Adv G 2.i.0 (A)| ≤ Adv Q Enc -U 3k,k (p)-mddh G,B ′ 2.i.0 (λ). Claim 2: |Adv G 2.i.0 (A) -Adv G 2.i.1 (A)| ≤ Adv Q Enc -U 3k,k (p)-mddh G,B ′′ 2.i.0 (λ).
This implies the lemma by Corollary 1

(U k (p)-MDDH ⇒ Q Enc -fold U 3k,k (p)-MDDH). Let us prove Claim 1. Upon receiving a challenge (G, [M 0 ] ∈ G 3k×k , [H] := [h 1 | . . . |h Q Enc ] ∈ G 3k×Q Enc ) for the Q Enc -fold U 3k,k (p)-MDDH assumption with respect to M 0 ← R U 3k,k (p), B ′ 2.i.0
does as follows:

pk: B ′ 2.i.0 picks M ← R U 3k,k , k 1,0 , . . . , k λ,1 ← R Z 3k
p , and computes pk as described in Figure 3.5. For each τ queried to EncO or DecO, it computes on the fly RF i (τ |i ) and

k ′ τ := k τ + M ⊥ RF i (τ |i ), where k τ := λ j=1 k j,τ j , RF i : {0, 1} i → Z 2k
p is a random function, and τ |i denotes the i-bit prefix of τ (see Figure 3.5). Note that B ′ 2.i.0 can compute efficiently M ⊥ from M.

EncO: To simulate the oracle EncO(τ ) on its j'th query, for j = 1, . . . , Q Enc , B ′ 2.i.0 computes [y] as follows:

if τ i+1 = 0 : r ← R Z k p ; [y] := [Mr + h j ] if τ i+1 = 1 : [y] ← R G 3k This way, B ′ 2.i.0 simulates EncO as in G 2.i.0 when [h j ] := [M 0 r 0 ] with r 0 ← R Z k p , and as in G 2.i when [h j ] ← R G 3k .
DecO: Finally, B ′ 2.i.0 simulates DecO as described in Figure 3.5.

Therefore, |Adv G 2.i (A) -Adv G 2.i.0 (A)| ≤ Adv Q Enc -U 3k,k (p)-mddh G,B ′ 2.i.0
(λ). To prove Claim 2, we build an adversary B ′′ 2.i.0 against the Q Enc -fold U 3k,k (p)-MDDH assumption with respect to a matrix M 1 ← R U 3k,k (p), independent from M 0 , similarly than B ′ 2.i.0 .

Lemma 16: From game G 2.i.1 to game G 2.i.2

For all 0

≤ i ≤ λ -1, |Adv G 2.i.1 (A) -Adv G 2.i.2 (A)| ≤ 2Q Dec + 2k p ,
where Q Dec is the number of times A queries DecO.

Proof of Lemma 16. In G 2.i.2 , we decompose Span(M ⊥ ) into two subspaces Span(M * 0 ) and Span(M * 1 ), and we increase the entropy of the components of k ′ τ which lie in Span(M * 0 ). To argue that G 2.i.1 and G 2.i.2 are statistically close, we use a Cramer-Shoup argument [START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF].

Let us first explain how the matrices M * 0 and M * 1 are sampled. Note that with probability at least 1 -2k p , (M M 0 M 1 ) forms a basis of Z 3k p . Therefore, we have

Span(M ⊥ ) = Ker(M ⊤ ) = Ker (M M 1 ) ⊤ ⊕ Ker (M M 0 ) ⊤ . We pick uniformly M * 0 and M * 1 in Z 3k×k p that generate
Ker (M M 1 ) ⊤ and Ker (M M 0 ) ⊤ , respectively (see Figure 3). This way, for all τ ∈ {0, 1} λ , we can write

M ⊥ RF i (τ |i ) := M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i ), where RF (0) i , RF (1) i : {0, 1} i → Z k p are independent random functions. We define RF (0) i+1 : {0, 1} i+1 → Z k
p as follows:

RF (0) i+1 (τ |i+1 ) :=    RF (0) i (τ |i ) if τ i+1 = 0 RF (0) i (τ |i ) + RF ′ (0) i (τ |i ) if τ i+1 = 1 where RF ′ (0) i : {0, 1} i → Z k p is a random function independent from RF (0)
i . This way, RF

i+1 is a random function.

We show that the outputs of EncO and DecO are statistically close in G 2.i.1 and G 2.i.2 . We decompose the proof in two cases (delimited with ): the queries with a tag τ ∈ {0, 1} λ such that τ i+1 = 0, and the queries with a tag τ such that τ i+1 = 1.

Queries with τ i+1 = 0:

The only difference between G 2.i.1 and G 2.i.2 is that k ′ τ is computed using the random function

RF (0) i in G 2.i.1 , whereas it uses the random function RF (0) i+1 in G 2.i.2 (see Figure 3.5). Therefore, by definition of RF (0)
i+1 , for all τ ∈ {0, 1} λ such that τ i+1 = 0, k ′ τ is the same in G 2.i.1 and G 2.i.2 , and the outputs of EncO and DecO are identically distributed.

Queries with τ i+1 = 1:

Observe that for all y ∈ Span(M, M 1 ) and all τ ∈ {0, 1} λ such that

τ i+1 = 1, G 2.i.2 y ⊤ k τ + M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i ) + M * 0 RF ′ (0) i (τ |i ) = y ⊤ k τ + M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i ) + y ⊤ M * 0 RF ′ (0) i (τ |i ) =0 = G 2.i.1 y ⊤ • k τ + M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i )
where the second equality uses the fact that M ⊤ M * 0 = M ⊤ 1 M * 0 = 0 and thus y ⊤ M * 0 = 0. This means that:

• the output of EncO on any input τ such that τ i+1 = 1 is identically distributed in G 2.i.1 and G 2.i.2 ;

• the output of DecO on any input (τ, [y], K) where τ i+1 = 1, and y ∈ Span(M, M 1 ) is the same in G 2.i.1 and G 2.i.2 .

Henceforth, we focus on the ill-formed queries to DecO, namely those corresponding to τ i+1 = 1, and y / ∈ Span(M, M 1 ). We introduce intermediate games G 2.i.1.j , and G ′ 2.i.1.j for j = 0, . . . , Q Dec , defined as follows:

• G 2.i.1.j : DecO is as in G 2.i.1 except that for the first j times it is queried, it outputs 0 to any ill-formed query. EncO is as in G 2.i.2 .

• G ′ 2.i.1.j : DecO as in G 2.i.2 except that for the first j times it is queried, it outputs 0 to any ill-formed query. EncO is as in G 2.i.2 .

We show that:

G 2.i.1 ≡ G 2.i.1.0 ≈ s G 2.i.1.1 ≈ s . . . ≈ s G 2.i.1.Q Dec ≡ G ′ 2.i.1.Q Dec ≈ s G ′ 2.i.1.Q Dec -1 ≈ s . . . ≈ s G ′ 2.i.1.0 ≡ G 2.i.2
where we denote statistical closeness with ≈ s and statistical equality with ≡.

It suffices to show that for all j = 0, . . . , Q Dec -1:

Claim 1: in G 2.i.1.j , if the j + 1-st query is ill-formed, then DecO outputs 0 with overwhelming probability 1 -1/q (this implies G 2.i.1.j ≈ s G 2.i.1.j+1 , with statistical difference 1/q); Claim 2: in G ′ 2.i.1.j , if the j + 1-st query is ill-formed, then DecO outputs 0 with overwhelming probability 1 -1/q (this implies G ′ 2.i.1.j ≈ s G ′ 2.i.1.j+1 , with statistical difference 1/q) where the probabilities are taken over the random coins used to generate pk.

Let us prove Claim 1.

Recall that in G 2.i.1.j , on its j + 1-st query,

DecO(τ, [y], K) computes K := [y ⊤ k ′ τ ],
where

k ′ τ := k τ + M * 0 RF (0) i (τ |i ) + M * 1 RF (1)
i (τ |i ) (see Figure 3.5). We prove that if (τ, [y], K) is illformed, then K is completely hidden from A, up to its j + 1-st query to DecO. The reason is that the vector k i+1,1 in sk contains some entropy that is hidden from A. This entropy is "released" on the j + 1-st query to DecO if it is ill-formed. More formally, we use the fact that the vector k i+1,1 ← R Z 3k p is identically distributed as k i+1,1 + M * 0 w, where k i+1,1 ← R Z 3k p , and w ← R Z k p . We show that w is completely hidden from A, up to its j + 1-st query to DecO.

• The public key pk does not leak any information about w, since

M ⊤ (k i+1,1 + M * 0 w ) = M ⊤ k i+1,1 . This is because M ⊤ M * 0 = 0.
• The outputs of EncO also hide w.

-For τ such that τ i+1 = 0, k ′ τ is independent of k i+1,1 , and therefore, so does EncO(τ ). -For τ such that τ i+1 = 1, and for any y ∈ Span(M, M 1 ), we have:

y ⊤ (k ′ τ + M * 0 w ) = y ⊤ k ′ τ (3.2) since M ⊤ M * 0 = M ⊤ 1 M * 0 = 0, which implies y ⊤ M * 0 = 0.
• The first j outputs of DecO also hide w.

-For τ such that τ i+1 = 0, k ′ τ is independent of k i+1,1 , and therefore, so does DecO([y], τ, K).

-For τ such that τ i+1 = 1 and y ∈ Span(M, M 1 ), the fact that DecO(τ, [y], K) is independent of w follows readily from Equation (3.2).

-For τ such that τ i+1 = 1 and y / ∈ Span(M, M 1 ), that is, for an ill-formed query, DecO outputs 0, independently of w, by definition of G 2.i.1.j . This proves that w is uniformly random from A's viewpoint.

Finally, because the j + 1-st query (τ, [y], K) is ill-formed, we have τ i+1 = 1, and y / ∈ Span(M, M 1 ), which implies that y ⊤ M * 0 = 0. Therefore, the value

K = [y ⊤ (k ′ τ + M * 0 w)] = [y ⊤ k ′ τ + y ⊤ M * 0 =0 w]
computed by DecO is uniformly random over G from A's viewpoint. Thus, with probability 1 -1/q over K ← R G, we have K = K, and DecO(τ, [y], K) = 0. We prove Claim 2 similarly, arguing than in G ′ 2.i.1.j , the value

K := [y ⊤ k ′ τ ],
where

k ′ τ := k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1)
i (τ |i ) , computed by DecO(τ, [y], K) on its j + 1-st query, is completely hidden from A, up to its j + 1-st query to DecO, if (τ, [y], K) is ill-formed. The argument goes exactly as for Claim 1.

Lemma 17: From game G 2.i.2 to game G 2.i.3 For all 0 ≤ i ≤ λ -1, |Adv G 2.i.2 (A) -Adv G 2.i.3 (A)| ≤ 2Q Dec p ,
where Q Dec is the number of times A queries DecO.

Proof of Lemma 17. In G 2.i.3 , we use the same decomposition Span(M ⊥ ) = Span(M * 0 , M * 1 ) as that in G 2.i.2 . The entropy of the components of k ′ τ that lie in Span(M * 1 ) increases from G 2.i.2 to G 2.i.3 . To argue that these two games are statistically close, we use a Cramer-Shoup argument [START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF], exactly as for Lemma 16.

We define RF

(1) i+1 {0, 1} i+1 → Z k p as follows:

RF (1) i+1 (τ |i+1 ) :=    RF (1) i (τ |i ) + RF ′ (1) i (τ |i ) if τ i+1 = 0 RF (1) i (τ |i ) if τ i+1 = 1 where RF ′ (1) i : {0, 1} i → Z k p is a random function independent from RF (1)
i . This way, RF

i+1 is a random function.

We show that the outputs of EncO and DecO are statistically close in G 2.i.1 and G 2.i.2 . We decompose the proof in two cases (delimited with ): the queries with a tag τ ∈ {0, 1} λ such that τ i+1 = 0, and the queries with tag τ such that τ i+1 = 1.

Queries with τ i+1 = 1:

The only difference between G 2.i.2 and G 2.i.3 is that k ′ τ is computed using the random function RF

(1) i in G 2.i.2 , whereas it uses the random function RF i+1 , for all τ ∈ {0, 1} λ such that τ i+1 = 1, k ′ τ is the same in G 2.i.2 and G 2.i.3 , and the outputs of EncO and DecO are identically distributed.

Queries with τ i+1 = 0:

Observe that for all y ∈ Span(M, M 0 ) and all τ ∈ {0, 1} λ such that τ i+1 = 0,

G 2.i.3 y ⊤ k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i (τ |i ) + M * 1 RF ′ (1) i (τ |i ) = y ⊤ k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i (τ |i ) + y ⊤ M * 1 RF ′ (1) i (τ |i ) =0 = G 2.i.2 y ⊤ • k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i (τ |i )
where the second equality uses the fact

M ⊤ M * 1 = M ⊤ 0 M * 1 = 0, which implies y ⊤ M * 1 = 0.

This means that:

• the output of EncO on any input τ such that τ i+1 = 0 is identically distributed in G 2.i.2 and G 2.i.3 ;

• the output of DecO on any input (τ, [y], K) where τ i+1 = 0, and y ∈ Span(M, M 0 ) is the same in G 2.i.2 and G 2.i.3 .

Henceforth, we focus on the ill-formed queries to DecO, namely those corresponding to τ i+1 = 0, and y / ∈ Span(M, M 0 ). The rest of the proof goes similarly than the proof of Lemma 16. See the latter for further details.

Lemma 18: From game G 2.i.3 to game G 2.i+1
For all 0 ≤ i ≤ λ -1, there exists an adversary B 2.i.3 such that T(B 2.i.3 ) ≈ T(A)

+ (Q Enc + Q Dec ) • poly(λ) and |Adv G 2.i.3 (A) -Adv G 2.i+1 (A)| ≤ 2 • Adv U k (p)-mddh G,B 2.i.3 (λ) + 2 p -1
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 18. First, we use the fact that for all τ ∈ {0, 1} λ , the vector

M * 0 RF (0) i+1 (τ |i+1 )+ M * 1 RF (1) i+1 (τ |i+1 ) is identically distributed to M ⊥ RF i+1 (τ |i+1 ), where RF i+1 : {0, 1} i+1 → Z 2k p is a random function. This is because (M * 0 , M * 1
) is a basis of Span(M ⊥ ). That means A's view can be simulated only knowing M ⊥ , and not M * 0 , M * 1 explicitly. Then, to go from G 2.i.3 to G 2.i+1 , we switch the distribution of the vectors [y] sampled by EncO, using the Q Enc -fold U 3k,k (p)-MDDH assumption (which is equivalent to the U k (p)-MDDH assumption, see Lemma 2) twice: first with respect to a matrix M 0 ← R U 3k,k (p) for ciphertexts with τ i+1 = 0, then with respect to an independent matrix M 1 ← R U 3k,k (p) for ciphertexts with τ i+1 = 1 (see the proof of Lemma 15 for further details).

Lemma 19: Game G 2.λ

For any PPT adversary A, we have:

Adv G 2.λ (A) ≤ Q Enc p .
Proof of Lemma 19. We show that the joint distribution of all the values K 0 computed by EncO is statistically close to uniform over G Q Enc . Recall that on input τ , EncO(τ ) computes

K 0 := [y ⊤ (k τ + M ⊥ RF λ (τ ))],
where RF λ : {0, 1} λ → Z 2k p is a random function, and y ← R Z 3k p (see Figure 3.4). We make use of the following properties:

Property 1: all the tags τ queried to EncO, such that EncO(τ ) = ⊥, are distinct.

Property 2: the outputs of DecO are independent of {RF(τ ) : τ ∈ T Enc }. This is because for all queries (τ, [y], K) to DecO such that τ ∈ T Enc , DecO(τ, [y], K) = 0, independently of RF λ (τ ), by definition of G 2.λ .

Property 3: with probability at least 1 -Q Enc p over the random coins of EncO, all the vectors y sampled by EncO are such that y ⊤ M ⊥ = 0.

We deduce that the joint distribution of all the values RF λ (τ ) computed by EncO is uniformly random over Z 2k p Q Enc (from Property 1), independent of the outputs of DecO (from Property 2). Finally, from Property 3, we get that the joint distribution of all the values K 0 computed by EncO is statistically close to uniform over G Q Enc , since:

K 0 := [y ⊤ (k τ + M ⊥ RF λ (τ )) = [y ⊤ k τ + y ⊤ M ⊥ =0 w.h.p. RF λ (τ )].
This means that the values K 0 and K 1 are statistically close, and therefore,

Adv G 3 (A) ≤ Q Enc p .

Multi-ciphertext CCA-secure Public Key Encryption scheme

Our construction

We now describe the optimized IND-CCA-secure PKE scheme. Compared to the PCA-secure KEM from Section 3.1, we add an authenticated (symmetric) encryption scheme (Enc AE , Dec AE ), and set the KEM tag τ as the hash value of a suitable part of the KEM ciphertext (as explained in the introduction). A formal definition with highlighted differences to our PCA-secure KEM appears in Figure 3.6. We prove the security under the U k (p)-MDDH assumption.

Perfect correctness. It follows from the perfect correctness of AE and the fact that for all r ∈ Z k p and y = Mr, for all k ∈ Z 3k p :

r ⊤ (M ⊤ k) = y ⊤ • k. Gen PKE (1 λ ): G ← R GGen(1 λ ); H ← R H(1 λ ) ; M ← R U 3k,k k 1,0 , . . . , k λ,1 ← R Z 3k q pk := G, [M], H , [M ⊤ k j,β ] 1≤j≤λ,0≤β≤1 sk := (k j,β ) 1≤j≤λ,0≤β≤1
Return (pk, sk)

Enc PKE (pk, m): r ← R Z k q ; y := Mr τ := H([y]) k τ := λ j=1 k j,τj K := [r ⊤ • M ⊤ k τ ] φ := Enc AE (K, m) Return ([y], φ ) Dec PKE (pk, sk, ([y], φ )): τ := H([y]) ; k τ := λ j=1 k j,τj ; K := [y ⊤ k τ ] Return Dec AE (K, φ) .
Figure 3.6: PKE, an IND-CCA-secure PKE. We color in gray the differences with KEM, the IND-PCA-secure KEM in Figure 3.2. Here, GGen is a prime-order group generator (see Section 2.2.1) , and AE := (Enc AE , Dec AE ) is an Authenticated Encryption scheme with keyspace K := G (see Definition 3).

Security proof of PKE Theorem 8: IND-CCA security

The Public Key Encryption scheme PKE defined in Figure 3.6 is IND-CCA secure, if the U k (p)-MDDH assumption holds in G, AE has one-time privacy and authenticity, and H generates collision resistant hash functions. Namely, for any adversary A, there exist adversaries B, B ′ ,

B ′′ such that T(B) ≈ T(B ′ ) ≈ T(B ′′ ) ≈ T(A) + (Q Dec + Q Enc ) • poly(λ) and Adv IND-CCA PKE,A (λ) ≤ (4λ + 1) • Adv U k (p)-mddh G,B (λ)
+ (Q Enc Q Dec + (4λ + 2)Q Dec + Q Enc ) • Adv ae-ot AE,B ′′ (λ) + Adv CR H,B ′ (λ) + Q Enc (Q Enc + Q Dec ) • 2 -Ω(λ) , (3.3)
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

We note that the Q Enc and Q Dec factors in (3.4) are only related to AE. Hence, when using a statistically secure authenticated encryption scheme, the corresponding terms in (3.4) become exponentially small.

Remark 6: Extension to the multi-user CCA security

We only provide an analysis in the multi-ciphertext (but single-user) setting. However, we remark (without proof) that our analysis generalizes to the multi-user, multi-ciphertext scenario, similar to [BBM00, HJ12, HKS15]. Indeed, all computational steps (not counting the steps related to the AE scheme) modify all ciphertexts simultaneously, relying for this on the re-randomizability of the U k (p)-MDDH assumption relative to a fixed matrix M. The same modifications can be made to many PKE simultaneously by using that the U k (p)-MDDH Assumption is also re-randomizable across many matrices M i . (A similar property for the DDH, DLIN, and bilinear DDH assumptions is used in [START_REF] Bellare | Public-key encryption in a multi-user setting: Security proofs and improvements[END_REF], [START_REF] Hofheinz | Tightly secure signatures and public-key encryption[END_REF], and [START_REF] Hofheinz | Identity-based encryption with (almost) tight security in the multi-instance, multi-ciphertext setting[END_REF], respectively.) Proof of Theorem 8. We proceed via a series of hybrid games described in Figures 3.7 and 3.8. Let A be a PPT adversary. For any game G, we use Adv G (A) to denote the advantage of A in game G i .

• We transition from game G 0 to game G 1 using the collision resistance of H and the onetime authenticity of AE to restrict the oracles DecO and EncO, as described in Figure 3.7.

In Lemma 51, we build adversaries B 0 and B ′ 0 such that:

|Adv G 0 (A) -Adv G 1 (A)| = 2Q Dec • Adv ae-ot AE,B 0 (λ) + Adv CR H,B ′ 0 (λ) + Q Enc (Q Enc + Q Dec ) p k ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

• To go from game G 1 to G 2 , we use the MDDH assumption to "tightly" switch the distribution of all the challenge ciphertexts. Similarly than in Lemma 12, we obtain an adversary B 1 such that:

|Adv G 1 (A) -Adv G 2 (A)| ≤ Adv U k (p)-mddh G,B 1 (λ) + 1 p -1 . G 0 , G 1 ,G 2 , G 3.i ,G 4 : C Enc := ∅; b ← R {0, 1} T Enc = T Dec := ∅ G ← R GGen(1 λ ); H ← R H(1 λ ); M ← R U 3k,k (p); M ⊥ ← R U 3k,2k (p) s.t. M ⊤ M ⊥ = 0 Pick random RF i : {0, 1} i → Z 2k p k 1,0 , . . . , k λ,1 ← R Z 3k p For τ ∈ {0, 1} λ , write k τ := λ j=1 k j,τj k ′ τ := k τ + M ⊥ RF i (τ |i ) pk := G, [M], H, [M ⊤ k j,β ] 1≤j≤λ,0≤β≤1 b ′ ← A DecO(•,•,•),EncO(•) (pk) Return 1 if b ′ = b, 0 otherwise. EncO(m 0 , m 1 ): G 0 , G 1 , G 2 ,G 3.i ,G 4 r ← R Z k p ; y := Mr; y ← R Z 3k p ; τ := H([y]); K := [y ⊤ • k ′ τ ] φ 0 := Enc AE (K, m 0 ); φ 1 := Enc AE (K, m 1 ) Return ([y], φ b ) and set C Enc := C Enc ∪ {([y], φ b )}. If τ / ∈ T Enc ∪ T Dec , set T Enc := T Enc ∪ {τ }, and
C Enc := C Enc ∪ {([y], φ b )} and return ([y], φ b ). Otherwise, return ⊥. DecO([y], φ): G 0 , G 1 ,G 2 ,G 3.i , G 4 τ := H([y]); K := [y ⊤ • k ′ τ ] If ([y], φ) ∈ C Enc , return ⊥; otherwise, return Dec AE (K, φ). Set T Dec := T Dec ∪ {τ }. If ([y], φ) ∈ C Enc or ∃([y ′ ], φ ′ ) ∈ C Enc with H([y ′ ]) = H([y]
) and y ′ = y, return ⊥; otherwise, return Dec AE (K, φ). • The game G 2 and G 3.0 are identically distributed. The argument is exactly as in Lemma 13, thus omitted.

Set T Dec := T Dec ∪ {τ }. If τ / ∈ T Enc , return Dec AE (K, φ); else, return ⊥.
• We build in Lemma 21 adversaries B 3.i and B ′ 3.i such that:

|Adv G 3.i (A) -Adv G 3.i+1 (A)| ≤ 4 • Adv U k (p)-mddh G,B 3.i (λ) + 4Q Dec • Adv ae-ot AE,B ′ 3.i (λ) + 4 p -1 + 2k p ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively.

• To go from game G 3.λ to G 4 , we use the one-time authenticity of AE to restrict the decryption oracle DecO. Namely, in Lemma 26, we build an adversary B 3.λ such that:

|Adv G 3.λ (A) -Adv G 4 (A)| ≤ Q Dec Q Enc • Adv ae-ot AE,B 3.λ (λ) + Q Dec p ,
where Q Enc , Q Dec are the number of queries to EncO and DecO, respectively.

• We show in Lemma 27 that there exists an adversary B 4 such that:

Adv G 4 (A) ≤ Q Enc • Adv ae-ot AE,B 4 (λ) + Q Enc p ,
where Q Enc denotes the number queries to EncO.

Putting everything together, we obtain adversaries B, B ′ ,

B ′′ such that T(B) ≈ T(B ′ ) ≈ T(B ′′ ) ≈ T(A) + (Q Dec + Q Enc ) • poly(λ) and Adv IND-CCA PKE,A (λ) ≤ (4λ + 1) • Adv U k (p)-mddh G,B (λ)
+ (Q Enc Q Dec + (4λ + 2)Q Dec + Q Enc ) • Adv ae-ot AE,B ′′ (λ) + Adv CR H,B ′ (λ) + Q Enc (Q Enc + Q Dec ) • 2 -Ω(λ) , (3.4)
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Lemma 20: From game G 0 to game G 1

There exist adversaries B 0 and

B ′ 0 such that T(B 0 ) ≈ T(B ′ 0 ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ) and |Adv G 0 (A) -Adv G 1 (A)| = 2Q Dec • Adv ae-ot AE,B 0 (λ) + Adv CR H,B ′ 0 (λ) + Q Enc (Q Enc + Q Dec ) p k ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 20. First, we use the one-time authenticity of AE to argue that if A queries DecO on a vector [y] such that y / ∈ Span(M), then, DecO outputs ⊥, with all but negligible probability. Second, we use the collision resistance of H to argue that: (i) if A queries DecO on ([y ′ ], φ ′ ), where for some previous output ([y], φ) of EncO, we have:

H([y]) = H([y ′ ]
) and y ′ = y, then, with all but negligible probability, DecO outputs ⊥; (ii) every time EncO outputs a vector [y], its tag H([y]) is fresh (no [y ′ ] with the same tag has been output by EncO or queried to DecO before), with overwhelming probability over EncO's random coins.

We introduce intermediate games G 0.j (resp. G 1.j ) for j = 0, . . . , Q Dec , defined as follows: DecO is as in G 0 (resp. G 1 ) except that for the first j times it is queried, it outputs ⊥ to any query ([y], φ) such that y / ∈ Span(M). The public key and EncO are as in G 0 (resp. G 1 ). We show that:

G 0 ≡ G 0.0 ≈ AE G 0.1 ≈ AE . . . ≈ AE G 0.Q Dec ≈ CR G 1.Q Dec ≈ AE . . . ≈ AE G 1.0 ≡ G 1
where ≡ denotes statistical equality, ≈ AE denotes indistinguishability based on the security of AE, and ≈ CR denotes indistinguishability based on the collision resistance of H.

Namely, we build adversaries B 0.j , B 1.j for j = 0, . . . , Q Dec -1, and

B ′ 0 such that T(B 0,j ) ≈ T(B 1,j ) ≈ T(B ′ 0 ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ)
, where poly(λ) is independent of T(A), and such that

Claim 1: |Adv G 0.j (A) -Adv G 0.j+1 (A)| ≤ Adv ae-ot AE,B 0.j (λ) and |Adv 1.j -Adv 1.j+1 | ≤ Adv ae-ot AE,B 0.j (λ), for j = 0, . . . , Q Dec -1. Claim 2: |Adv 0.Q Dec -Adv 1.Q Dec | ≤ Adv CR H,B ′ 0 (λ).
This implies the lemma.

Let us prove Claim 1. It suffices to show that in G 0.j and G 1.j , with all but negligible probability, DecO outputs ⊥ to its j + 1-st query if it contains [y] such that y / ∈ Span(M). Recall that in both G 0.j and G 1.j , on its j + 1-st query ([y], φ), DecO computes

K := [y ⊤ • k τ ], where τ = H([y]) and k τ := λ ρ=1 k ρ,τρ ,
and returns Dec AE (K, φ) (or ⊥, see Figure 3.7). We prove that this value K is hidden from A up to its j + 1-st query to DecO. Then, we use the one-time authenticity of AE to argue that Dec AE (K, φ) = ⊥ with overwhelming probability.

To prove K is hidden from A, we show that the vectors k 1,0 , k 1,1 in sk contain some entropy that is hidden from A. More formally, we use the fact that the vectors k 1,β ← R Z 3k p are identically distributed than k 1,β + M ⊥ w for β = 0, 1, where k 1,β ← R Z 3k p , w ← R Z k p , and M ⊥ ← R U 3k,2k such that M ⊤ M ⊥ = 0. We show that w is hidden from A, up to its j + 1-st query to DecO.

• The public key pk does not leak any information about w, since

M ⊤ (k 1,β + M ⊥ w ) = M ⊤ k 1,β .
This is because M ⊤ M ⊥ = 0.

• The outputs of EncO also hide w, since for any y ∈ Span(M), we have:

y ⊤ (k τ + M ⊥ w ) = y ⊤ k ′ τ (3.5) since M ⊤ M ⊥ = 0 which implies y ⊤ M ⊥ = 0.
• The first j outputs of DecO also hide w.

-For y ∈ Span(M), DecO([y], φ) is independent of w, from Equation (3.5).

-For y / ∈ Span(M), DecO([y], φ) = ⊥, independently of w, by definition of G 0.j .

Therefore, the value

K = [y ⊤ (k τ + M ⊥ w)] = [y ⊤ k τ + y ⊤ M ⊥ =0 w]
computed by DecO on its j + 1-st query, is uniformly random over G from A's view, since y / ∈ Span(M) ⇔ y ⊤ M ⊥ = 0. Then, by one-time authenticity of AE, there exists an adversary B 0.j such that T(B 0,j ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ), where poly(λ) is independent of T(A), and

|Adv G 0.j (A) -Adv G 0.j+1 (A)| ≤ Adv ae-ot AE,B 0.j (λ).
Let us prove Claim 2. It suffices to show that in G 0.Q Dec : (i) if DecO is queried on ([y], φ), and there exists ([y ′ ], φ ′ ) output previously by EncO, with H([y]) = H([y ′ ]) and y ′ = y, then, with all but negligible probability, DecO outputs ⊥; (ii) every time EncO outputs a vector [y], its tag H([y]) is fresh (no [y ′ ] with the same tag has been output by EncO or queried to DecO before), with overwhelming probability over its random coins.

We define B ′ 0 as follows. Upon receiving a challenge (ii) First, note that with probability at least 1 -Q Enc (Q Enc +Q Dec ) p k over its random coins, EncO samples vectors [y] whose upper parts [y] are fresh (they are distinct from those previously sampled by EncO, or queried to DecO). Therefore, conditioned on this fact, if B ′ 0 samples τ := H([y]) that is not fresh, i.e there exists a pair ([y ′ ], H([y ′ ]) = τ ) previously output by EncO or queried to DecO (along with some symmetric ciphertext φ), then we have H([y]) = H([y ′ ]), and [y] = [y ′ ], that is, B ′ 0 finds a collision. Summarizing, both games G 0.Q Dec and G 1.Q Dec proceed identically (as simulated by B ′ 0 ), unless (i) Case 1 occurs, or (ii) EncO samples a tag that was output or queried before, in which case B ′ 0 finds a collision, with overwhelming probability over its random coins.

H ← R H(1 λ ) for the collision resistance of H, B ′ 0 picks b ← R {0, 1}, k 1,0 , . . . , k λ,1 ← R Z 3k p ,
Lemma 21: From game G 3.i to game G 3.i+1

For all 0 ≤ i ≤ λ -1, there exist adversaries B 3.i and

B ′ 3.i such that T(B 3.i ) ≈ T(B ′ 3.i ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ) and |Adv G 3.i (A) -Adv G 3.i+1 (A)| ≤ 4 • Adv U k (p)-mddh G,B 3.i (λ) + 4Q Dec • Adv ae-ot AE,B ′ 3.i (λ) + 4 p -1 + 2k p ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 21. To go from G 3.i to G 3.i+1 , we introduce intermediate games G 3.i.1 , G 3.i.2 and G 3.i.3 , defined in Figure 3.5.

• To go from game G 3.i to game G 3.i.1 , we use the MDDH Assumption to "tightly" switch the distribution of all the challenge ciphertexts, as in Lemma 15 in Section 3.1. We proceed in two steps, first, by changing the distribution of all the ciphertexts with a tag τ such that τ i+1 = 0, and then, for those with a tag τ such that τ i+1 = 1. We use the MDDH Assumption with respect to an independent matrix for each step. We build an adversary B 3.i.0 in Lemma 22 such that:

|Adv G 3.i (A) -Adv G 3.i.1 (A)| ≤ 2 • Adv U k (p)-mddh G,B 3.i.0 (λ) + 2 p -1 .
• To go from game G 3.i.1 to game G 3.i.2 , we use a computational variant of the Cramer-Shoup information-theoretic argument to move from RF i to RF i+1 , thereby increasing the entropy of k ′ τ , as in Lemma 16, in Section 3.1. For the sake of readability, we proceed in two steps: in Lemma 23, we move from RF i to an hybrid between RF i and RF i+1 , and in Lemma 24, we move to RF i+1 . Overall, we build in Lemma 23 an adversary B 3.i.1 such that:

|Adv G 3.i.1 (A) -Adv G 3.i.2 (A)| ≤ 2Q Dec • Adv ae-ot AE,B 3.i.1 (λ) + 2k p ,
where Q Dec denotes the number of queries to DecO.

• In Lemma 24, we build an adversary B 3.i.2 such that:

|Adv G 3.i.2 (A) -Adv 3.i.3 | ≤ 2Q Dec • Adv ae-ot AE,B 3.i.2 (λ),
where Q Dec denotes the number of queries to DecO.

• The transition between G 3.i.3 and game G 3.i+1 is symmetric to the transition between G 3.i and G 3.i.1 (cf. Lemma 22): we use the MDDH Assumption to "tightly" switch the distribution of all the challenge ciphertexts in two steps; first, by changing the distribution

G 3.i , G 3.i.1 , G 3.i.2 , G 3.i.3 : C Enc := ∅; b ← R {0, 1} G := (G, p, P ) ← R GGen(1 λ ); H ← R H(1 λ ); M ← R U 3k,k (p) M ⊥ ← R U 3k,2k s.t. M ⊤ M ⊥ = 0 M 0 , M 1 ← R U 2k,k M * 0 , M * 1 ← R U 3k,k s.t. Span(M ⊥ ) = Span(M * 0 , M * 1 ) M ⊤ M * 0 = 0 M1 ⊤ M * 0 = 0 M ⊤ M * 1 = 0 M0 ⊤ M * 1 = 0 Pick random RF i : {0, 1} i → Z 2k q . Pick random RF (0) i+1 : {0, 1} i+1 → Z k q and RF (1) i : {0, 1} i → Z k q Pick random RF (0) i+1 , RF (1) i+1 : {0, 1} i+1 → Z k q . k 1,0 , . . . , k λ,1 ← R Z 3k q For all τ ∈ {0, 1} λ , k τ := λ j=1 k j,τj k ′ τ := k τ + M ⊥ RF i (τ |i ) k ′ τ := k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i (τ |i ) k ′ τ := k τ + M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i+1 (τ |i+1 ) Return pk := G, [M], H, [M ⊤ k j,β ] 1≤j≤λ,0≤β≤1
EncO(m 0 , m 1 ):

G 3.i , G 3.i.1 , G 3.i.2 ,G 3.i.3 r ← R Z k q ; y := Mr; τ := H([y]); y ← R Z 2k q If τ i+1 = 0 : r 0 ← R Z k q ; y := Mr + M 0 r 0 If τ i+1 = 1 : r 1 ← R Z k q ; y := Mr + M 1 r 1 K := [y ⊤ • k ′ τ ] φ 0 := Enc AE (K, m 0 ); φ 1 := Enc AE (K, m 1 ) If τ / ∈ T Enc ∪ T Dec , return ([y], φ b ), set T Enc := T Enc ∪ {τ } and C Enc := C Enc ∪ {([y], φ b )}. Otherwise, return ⊥. DecO([y], φ): G 3.i ,G 3.i.1 ,G 3.i.2 ,G 3.i.3 τ := H(y); K := [y ⊤ k ′ τ ] If ([y], φ) ∈ C Enc or ∃([y ′ ], φ ′ ) ∈ C Enc with H([y ′ ]) = H([y]
) and y ′ = y, return ⊥; otherwise, return Dec AE (K, φ). Set T Dec := T Dec ∪ {τ }.

Figure 3.8: Games G 3.i (for 0 ≤ i ≤ λ),G 3.i.1 , G 3.i.2 and G 3.i.3 (for 0 ≤ i ≤ λ -1) for the proof of Lemma 21. For all τ ∈ {0, 1} λ , we denote by τ |i the i-bit prefix of τ . In each procedure, the components inside a solid (dotted, gray) frame are only present in the games marked by a solid (dotted, gray) frame. of all the ciphertexts with a tag τ such that τ i+1 = 0, and then, the distribution of those with a tag τ such that τ i+1 = 1, using the MDDH assumption with respect to an independent matrix for each step. In Lemma 24, we build an adversary B 3.i.3 such that:

|Adv G 3.i.2 (A) -Adv 3.i.3 | ≤≤ 2 • Adv U k (p)-mddh G,B 3.i.3 (λ) + 2 p -1 .
Putting everything together, we obtain the lemma.

Lemma 22: From game G 3.i to game G 3.i.1

For all 0 ≤ i ≤ λ -1, there exists an adversary B 3.i.0 such that T(B 3.i.0 ) ≈ T(A)

+ (Q Enc + Q Dec ) • poly(λ) and |Adv G 3.i (A) -Adv G 3.i.1 (A)| ≤ 2 • Adv U k (p)-mddh G,B 3.i.0 (λ) + 2 p -1 ,
where poly(λ) is independent of T(A).

Proof of Lemma 22. The proof of this lemma is essentially as the proof of Lemma 15, in Section 3.1. The difference is that now, only the lower part of the vectors [y] sampled by EncO is randomized using the Q Enc -fold U 2k,k -MDDH Assumption. The upper part of [y] is used to compute the tag τ . We call y and y the upper and lower part of y, respectively. We introduce an intermediate game G 3.i.0 where EncO first picks r ← R Z k p , computes [y] := [Mr], τ := H([y]), and computes the rest of its output as in G 3.i.1 if τ i+1 = 0, and as in G 3.i if τ i+1 = 1; the public key pk and DecO are as in G 3.i.1 . We build adversaries B ′ 3.i.0 and B ′′ 3.i.0 such that T(B ′ 3.i.0 ) ≈ T(B ′′ 3.i.0 ) ≈ T(A)+(Q Enc +Q Dec )•poly(λ) with poly(λ) independent of T(A), and

Claim 1: |Adv G 3.i (A) -Adv G 3.i.0 (A)| ≤ Adv Q Enc -U 2k,k -mddh G,B ′ 3.i.0 (λ). Claim 2: |Adv G 3.i.0 (A) -Adv G 3.i.1 (A)| ≤ Adv Q Enc -U 2k,k -mddh G,B ′′ 3.i.0 (λ).
This implies the lemma by Corollary 1

(U k (p)-MDDH ⇒ Q Enc -fold U 2k,k (p)-MDDH). Let us prove Claim 1. Upon receiving a challenge (G, [M 0 ] ∈ G 2k×k , [H] := [h 1 | . . . |h Q Enc ] ∈ G 2k×Q Enc ) for the Q Enc -fold U 2k,k -MDDH Assumption with respect to M 0 ← R U 2k,k , B ′
3.i.0 does as follows:

pk: B ′ 3.i.0 picks M ← R U 3k,k , k 1,0 , . . . , k λ,1 ← R Z 3k p , H ← R H(1 λ
), and computes pk as described in Figure 3.8. For each τ computed while simulating EncO or DecO, B ′ 3.i.0 computes on the fly Therefore,

RF i (τ |i ), k ′ τ := k τ + M ⊥ RF i (τ |i ), where RF i : {0, 1} i → Z 2k p is a random function, k τ := λ j=1 k j,τ j ,
|Adv G 3.i (A) -Adv G 3.i.0 (A)| ≤ Adv Q Enc -U 2k,k (p)-mddh G,B ′ 3.i.0 (λ).
To prove Claim 2, we build an adversary B ′′ 3.i.0 against the Q Enc -fold U 2k,k (p)-MDDH assumption with respect to a matrix M 1 ← R U 2k,k , independent from M 0 , similarly than B ′ 3.i.0 .

Lemma 23: From game G 3.i.1 to game G 3.i.2

For all 0 ≤ i ≤ λ -1, there exists an adversary B 3.i.1 such that T(B 3.i.1 ) ≈ T(A)

+ (Q Enc + Q Dec ) • poly(λ), and
|Adv G 3.i.1 (A) -Adv G 3.i.2 (A)| ≤ 2Q Dec • Adv ae-ot AE,B 3.i.1 (λ) + 2k p
where Q Enc , Q Dec are the number of queries to EncO and DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 23. In G 3.i.2 , we decompose Span(M ⊥ ) into two spaces Span(M * 0 ) and Span(M * 1 ), and we increase the entropy of the vector k ′ τ computed by EncO and DecO. More precisely, the entropy of the components of k ′ τ that lie in Span(M * 0 ) increases from G 3.i.1 to G 3.i.2 . To argue that these two games are computationally indistinguishable, we use a Cramer-Shoup argument [START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF], together with the one-time authenticity of AE.

Let us first explain how the matrices M * 0 and M * 1 are sampled. Note that with probability 1 -2k p , (M 0 M 0 0 M 1 ) forms a basis of Z 3k p . Therefore, we have Span(M ⊥ ) = Ker(M ⊤ ) = Ker (M 0 M 1 ) ⊤ ⊕ Ker (M 0 M 0 ) ⊤ . We pick uniformly M * 0 and M * 1 in Z 3k×k p that generates Ker (M 0 M 1 ) ⊤ and Ker (M 0 M 0 ) ⊤ , respectively. This way, for all τ ∈ {0, 1} λ , we can write

M ⊥ RF i (τ |i ) := M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i ),
where

RF (0) i , RF (1)
i : {0, 1} i → Z k p are independent random functions. We define RF (0) i+1 : {0, 1} i+1 → Z k p as follows:

RF (0) i+1 (τ |i+1 ) :=    RF (0) i (τ |i ) if τ i+1 = 0 RF (0) i (τ |i ) + RF ′ (0) i (τ |i ) if τ i+1 = 1
where

RF ′ (0) i : {0, 1} i → Z k p is a random function independent from RF (0)
i . This way, RF

i+1 is a random function.

We show that the outputs of EncO and DecO are computationally indistinguishable in G 3.i.1 and G 3.i.2 . We decompose the proof in two cases (delimited with ): the queries corresponding to a tag τ ∈ {0, 1} λ such that τ i+1 = 0, and the queries corresponding to a tag τ such that τ i+1 = 1.

Queries with τ i+1 = 0:

The only difference between G 3.i.1 and G 3.i.2 is that k ′ τ is computed using the random function RF i+1 , for all τ ∈ {0, 1} λ such that τ i+1 = 0, k ′ τ is the same in G 3.i.1 and G 3.i.2 , and the outputs of EncO and DecO are identically distributed.

Queries with τ i+1 = 1:

Observe that for all y ∈ Span(M, 0 M 1 ) and all τ ∈ {0, 1} λ such that τ i+1 = 1,

G 3.i.2 y ⊤ k τ + M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i ) + M * 0 RF ′ (0) i (τ |i ) = y ⊤ k τ + M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i ) + y ⊤ M * 0 RF ′ (0) i (τ |i ) =0 = G 3.i.1 y ⊤ • k τ + M * 0 RF (0) i (τ |i ) + M * 1 RF (1) i (τ |i )
where the second equality uses the fact M ⊤ M * 0 = 0 M 1 ⊤ M * 0 = 0 and thus y ⊤ M * 0 = 0. This means that:

• the outputs of EncO that contains [y] whose tag τ = H([y]) is such that τ i+1 = 1 are identically distributed in G 3.i.1 and G 3.i.2 ;

• the output of DecO on any input ([y], φ) where τ = H([y]), τ i+1 = 1, and y ∈ Span(M, 0 M 1 ) is the same in G 3.i.1 and G 3.i.2 .

Henceforth, we focus on the ill-formed queries to DecO, namely those corresponding to τ i+1 = 1, and y / ∈ Span(M, 0 M 1 ). We introduce intermediate games G 3.i.1.j , and G ′ 3.i.1.j for j = 0, . . . , Q Dec , defined as follows:

• G 3.i.1.j : DecO is as in G 3.i.1 except that for the first j times it is queried, it outputs ⊥ to any ill-formed query. EncO is as in G 3.i.2 .

• G ′ 3.i.1.j : DecO is as in G 3.i.2 except that for the first j times it is queried, it outputs ⊥ to any ill-formed query. EncO is as in G 3.i.2 .

We show that:

G 3.i.1 ≡ G 3.i.1.0 ≈ AE G 3.i.1.1 ≈ AE . . . ≈ AE G 3.i.1.Q Dec ≡ G ′ 3.i.1.Q Dec G ′ 3.i.1.Q Dec ≈ AE G ′ 3.i.1.Q Dec -1 ≈ AE . . . ≈ AE G ′ 3.i.1.0 ≡ G 3.i.2
where ≡ denote statistical equality, and ≈ AE denotes indistinguishability based on the security of AE.

It suffices to show that for all j = 0, . . . , Q Dec -1, there exist adversaries B 3.i.1.j and B ′ 3.i.1.j against the one-time authenticity of AE, such that T(B

3.i.1.j ) ≈ T(B ′ 3.i.1.j ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ)
, with poly(λ) independent of T(A), and such that:

Claim 1: in G 3.i.1.j , if the j +1-st query is ill-formed, then DecO outputs ⊥ with overwhelming probability 1 -Adv ae-ot AE,B 3.i.1.j (λ) (this implies G 3.i.1.j ≈ AE G 3.i.1.j+1 ).
Claim 2: in G ′ 3.i.1.j , if the j + 1-st query is ill-formed, then DecO outputs 0 with overwhelming probability 1 -Adv ae-ot

AE,B ′ 3.i.1.j (λ) (this implies G ′ 3.i.1.j ≈ AE G ′ 3.i.1.j+1 ).
We prove Claim 1 and 2 as in Lemma 16, in Section 3.1, arguing that the encapsulation key K computed by DecO on an ill-formed j + 1-st query, is completely hidden from A, up to its j + 1-st query to DecO. The reason is that the vector k i+1,1 in sk contains some entropy that is hidden from A, and that is "released" on the j + 1-st query, if it is ill-formed. Then, we use the one-time authenticity of AE to argue that DecO outputs ⊥ with all but negligible probability.

Lemma 24: From game G 3.i.2 to game G 3.i.3

For all 0 ≤ i ≤ λ -1, there exists an adversary B 3.i.2 such that T(B

3.i.2 ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ), |Adv G 3.i.2 (A) -Adv 3.i.3 | ≤ 2Q Dec • Adv ae-ot AE,B 3.i.2 (λ)
, where Q Enc , Q Dec are the number of queries to EncO and DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 24. In G 3.i.3 , we use the same decomposition Span(M ⊥ ) = Span(M * 0 , M * 1 ) as that in G 3.i.2 . The entropy of the component of k ′ τ that lies in Span(M * 1 ) increases from G 3.i.2 to G 3.i.3 . That is, we use a random function RF

(1)

i+1 : {0, 1} i+1 → Z k p in place of the random function RF (1) i : {0, 1} i → Z k p .
To argue that these two games are computationally indistinguishable, we use a computational variant of the Cramer-Shoup argument [START_REF] Cramer | Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack[END_REF], exactly as in the proof of Lemma 23.

We define RF

(1) i+1 → Z k p as follows:

RF (1) i+1 (τ |i+1 ) :=    RF (1) i (τ |i ) + RF ′ (1) i (τ |i ) if τ i+1 = 0 RF (1) i (τ |i ) if τ i+1 = 1 where RF ′ (1) i : {0, 1} i → Z k p is a random function independent from RF (1)
i . This way, RF

i+1 is a random function.

We show that the outputs of EncO and DecO are computationally indistinguishable in G 3.i.1 and G 3.i.2 , similarly that in the proof of Lemma 17, in Section 3.1 (see the latter for further details).

Lemma 25: From game G 3.i.3 to game G 3.i+1

For all 0 ≤ i ≤ λ -1, there exists an adversary B 3.i.3 such that T(B

3.i.3 ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ) and |Adv 3.i.3 -Adv G 3.i+1 (A)| ≤ 2 • Adv U k (p)-mddh G,B 3.i.3 (λ) + 2 p -1 ,
where Q Enc , Q Dec are the number of times A queries EncO, DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 25. First, we use the fact that for all τ ∈ {0, 1} λ , the vector

M * 0 RF (0) i+1 (τ |i+1 ) + M * 1 RF (1) i+1 (τ |i+1 ) is identically distributed to M ⊥ RF i+1 (τ |i+1 ), where RF i+1 : {0, 1} i+1 → Z 2k p is a random function. This is because (M * 0 , M * 1
) is a basis of Span(M ⊥ ). That means A's view can be simulated only knowing M ⊥ , and not M * 0 , M * 1 explicitly. Then, to go from G 3.i.3 to G 3.i+1 , we switch the distribution of the vectors [y] sampled by EncO, using the Q Enc -fold U 2k,k (p)-MDDH Assumption (equivalent to the U k -MDDH Assumption, see Lemma 2) twice: first with respect to a matrix M 0 ← R U 2k,k (p) for ciphertexts with τ i+1 = 0, then with respect to an independent matrix M 1 ← R U 2k,k (p) for ciphertexts with τ i+1 = 1 (see the proof of Lemma 22 for further details).

Lemma 26: From game G 3.λ to G 4

There exists an adversary B 3.λ such that T(B 3.λ ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ), and

|Adv G 3.λ (A) -Adv G 4 (A)| ≤ Q Dec Q Enc • Adv ae-ot AE,B 3.λ (λ) + Q Dec p ,
where Q Enc , Q Dec are the number of queries to EncO and DecO, respectively, and poly(λ) is independent of T(A).

Proof of Lemma 26. We use the one-time authenticity of AE to argue that with all but negligible probability, DecO outputs ⊥ on any input ([y], φ) such that for some previous output

([y ′ ], φ ′ ) of EncO, H([y ′ ]) = H([y]).
We introduce intermediate games G 3.λ.j for j = 0, . . . , Q Dec , defined as G 3.λ , except that on its first j query, DecO is as in G 4 , that is, it outputs ⊥ to any query corresponding to a tag τ previously output by EncO.

We show that :

G 3.λ ≡ G 3.λ.0 ≈ AE G 3.λ.1 ≈ AE . . . ≈ AE G 3.λ.Q Dec ≡ G 4 ,
where ≡ denotes statistical equality, and ≈ AE denotes indistinguishability based on the security of AE.

Namely, we build adversaries B 3.λ.j for j = 0, . . . , Q Dec -1, such that T(B 3.λ.j ) ≈ T(A) + (Q Enc + Q Dec ) • poly(λ), where poly(λ) is independent of T(A), and

|Adv G 3.λ.j (A) -Adv G 3.λ.j+1 (A)| ≤ Q Enc • Adv ae-ot AE,B 3.λ.j (λ) + 1 p .
This implies the lemma. It suffices to show that in G 3.λ.j , with all but negligible probability, DecO outputs ⊥ to its j + 1-st query if it contains [y ⋆ ] such that H([y ⋆ ]) = H([y]), for [y] that was output previously by EncO.

We build B 3.λ.j as follows.

pk : Upon receiving the description of

K := G, B 3.λ.j picks M ← R U 3k,k , k 1,0 , . . . , k λ,1 ← R Z 3k p , H ← R H(1 λ ),
G 3.i , that is, if ([y ⋆ ], φ ⋆ ) ∈ C Enc or ∃([y], φ) ∈ C Enc with H([y ⋆ ]) = H([y]
) and y ⋆ = y, B 3.λ.j returns ⊥. Otherwise, it returns Dec AE (K ⋆ , φ ⋆ ). Finally, it sets T Dec := T Dec ∪ {H([y ⋆ ])}.

Assume the j + 1-st query ([y ⋆ ], φ ⋆ ) to DecO is such that DecO([y ⋆ ], φ ⋆ ) = ⊥ in G 4 , but not in G 3.λ.j . In particular, that means that there exists ([y], φ) ∈ C Enc such that y = y ⋆ and φ = φ ⋆ . Then, with probability 1/Q Enc over the choice of j ⋆ , ([y], φ) is the j ⋆ 'th query of EncO.

In that case, we show that A's view is simulated as in G 3.λ.j if DecO is the real decryption oracle, and as in G 4 if it is the "always ⊥" function. This implies the lemma.

Indeed, the key

K ⋆ := [y ⋆⊤ (k τ ⋆ + M ⊥ RF λ (τ ⋆ ))] for τ ⋆ := H([y ⋆ ]
) is random, independent from A's view up to its j + 1-st query on DecO (except what leaks through Enc AE (K ⋆ , m b )). This is because:

1. with probability 1/q over the random coins of B 3.λ.j , y ⋆ ← R Z 3k p / ∈ Span(M).

2. for all [y] contained in EncO outputs or DecO queries that don't output ⊥, prior to the j + 1-st DecO query, we have H([y]) = τ ⋆ , by definition of G 3.λ.j . That is, the tag τ ⋆ is "fresh". Therefore, the key

K ⋆ := [y ⋆⊤ (k τ ⋆ + M ⊥ RF λ (τ ⋆ ))] = [y ⊤ k τ ⋆ + y ⋆⊤ M ⊥ =0 RF λ (τ ⋆ )]
is random, independent of A's view up to its j + 1-st query (except what leaks through

Enc AE (K ⋆ , m b )).
This proves that

|Adv G 3.λ.j (A) -Adv G 3.λ.j+1 (A)| ≤ Q Enc • Adv ae-ot AE,B 3.λ.j (λ) + 1 p .

Lemma 27: Game G 4

There exists an adversary B 4 such that T(B 4 ) ≈ T(A)

+ (Q Enc + Q Dec ) • poly(λ), such that Adv G 4 (A) ≤ Q Enc • Adv ae-ot AE,B 4 (λ) + Q Enc p ,
where Q Enc denotes the number queries to EncO, and poly(λ) is independent of T(A).

Proof of Lemma 27. First, we show that the joint distribution of all the values K computed by EncO is statistically close to uniform over G Q Enc . Then, we use the one-time privacy of AE on each one of the Q Enc symmetric ciphertexts.

Recall that on input τ , EncO(τ ) computes

K := [y ⊤ (k τ + M ⊥ RF λ (τ ))],
where RF λ : {0, 1} λ → Z 2k p is a random function, and y ← R Z 3k p . We make use of the following properties:

Property 1: all the tags τ computed by EncO(m 0 , m 1 ), such that EncO(m 0 , m 1 ) = ⊥, are distinct.

Property 2: the outputs of DecO are independent of {RF(τ

) : τ ∈ T Enc }. This is because for all queries ([y], φ) to DecO such that H([y]) ∈ T Enc , DecO([y], φ) = ⊥, independently of RF λ (τ ), by definition of G 4 .
Property 3: with probability at least 1 -Q Enc p over the random coins of EncO, all the vectors y sampled by EncO are such that y ⊤ M ⊥ = 0.

We deduce that the joint distribution of all the values RF λ (τ ) computed by EncO is uniformly random over Z 2k p Q Enc (from Property 1), independent of the outputs of DecO (from Property 2). Finally, from Property 3, we get that the joint distribution of all the values K computed by EncO is statistically close to uniformly random over G Q Enc , since:

K := [y ⊤ (k τ + M ⊥ RF λ (τ )) = [y ⊤ k τ + y ⊤ M ⊥ =0 w.h.p. RF λ (τ )].
Therefore, we can use the one-time privacy of AE to argue that all symmetric ciphertexts φ b computed by EncO don't reveal b (this uses a hybrid argument over the Q Enc challenge ciphertexts).

Chapter 4

Multi-Input Inner-Product Functional Encryption from Pairings

Overview of the construction

In this chapter, we present a multi-input functional encryption scheme (MIFE) for inner products based on the MDDH assumption in prime-order bilinear groups. The construction appeared in [AGRW17], and was the first MIFE scheme for a non-trivial functionality based on standard cryptographic assumptions with polynomial security loss, for any polynomial number of slots and secure against unbounded collusions. We prove in this thesis a stronger security guarantee than in [AGRW17]. Namely, the novelty here, is that input slots can collude, and should not be able to break the security of the encryption for the other slots. The security notion that captures corruption of input slots is formally described in Definition 23. Moreover, using a single-input FE that is secure in a multi-instance setting, we obtain a multi-input FE (see Figure 4.6) that is more efficient that the original scheme from [AGRW17].

Concretely, the set of functionality {F n } n∈N we consider is that of "bounded-norm" multiinput inner products: each key is specified by a vector (y 1 • • • y n ) ∈ Z mn , takes as input n vectors x 1 , . . . , x n , each of dimension m, and outputs

F n ((y 1 . . . , y n ), x 1 , . . . , x n ) = n i=1 x i , y i .
We require that the x 1 , . . . , x n , y 1 , . . . , y n have bounded norm, and inner product is computed over the integers. The functionality is a natural generalization of single-input inner product functionality introduced by Abdalla et. al [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF], and studied in [ABDP15, BJK15, DDM16, ALS16, ABDP16], and captures several useful computations arising in the context of data-mining.

Prior approaches. Prior constructions of MIFE schemes in [BLR + 15] require (at least) nmlinear maps for n slots with m-bit inputs as they encode each input bit for each slot into a fresh level of a multilinear map. In addition, there is typically a security loss that is exponential in n due to the combinatorial explosion arising from combining different ciphertexts across the slots. In the case of inner products, one can hope to reduce the multilinearity to n by exploiting linearity as in the single-input FE; indeed, this was achieved in two independent works [LL16, KLM + 18] 1 showing how to realize a two-slot MIFE for inner products over bilinear groups. We stress that our result is substantially stronger: we show how to realize n-slot MIFE for inner products for any polynomial n over bilinear groups under standard assumptions, while in addition avoiding the exponential security loss. In particular, we deviate from the prior approaches of encoding each slot into a fresh level of a multilinear map. We stress that prior to [AGRW17], we did not even have a candidate for 3-slot MIFE for inner products in the generic bilinear group model.

A public-key scheme. Our first observation is that we can build a public-key MIFE for inner product by running n independent copies of a single-input FE for inner products. Combined with existing instantiations of the latter in [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF], this immediately yields a public-key MIFE for inner products under the standard DDH in cyclic group G (we use the implicit representation of group elements as defined in Section 2.2.1).

In a bit more detail, we recall the DDH-based public-key single-input FE scheme from [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF]: Our public-key MIFE scheme is as follows:

pk := [w], ct x = ([
pk := ([w 1 ], . . . , [w n ]),
ct x i := ([s i ], [x i + w i s i ]),
sk y 1 ,...,yn := ( w 1 , y 1 , . . . , w n , y n ).

We note that the encryption of x i uses fresh randomness s i ; to decrypt, we need to know each w i , y i , and not just w 1 , y 1 + • • • + w n , y n . In particular, an adversary can easily recover each [ x i , y i ], whereas the ideal functionality should only leak the sum n i=1 x i , y i . In the public-key setting, it is easy to see that x i , y i is in fact inherent leakage from the ideal functionality. Concretely, an adversary can always pad an encryption of x i in the i'th slot with encryptions of 0's in the remaining n -1 slots and then decrypt.

Our main scheme. The bulk of this work lies in constructing a multi-input FE for inner product in the private-key setting, where we can no longer afford to leak x i , y i . We modify the previous scheme by introducing additional rerandomization into each slot with the use of bilinear groups as follows:

msk := {[w i ] 2 , [v i ] 2 , [z i ] T } i∈[n] , ek i := ([w i ] 1 , [v i ] 1 , [z i ] 1 ), ct x i := ([s i ] 1 , [x i + w i s i ] 1 , [z i + v i s i ] 1 ), sk y 1 ,...,yn := ([ w 1 , y 1 + v 1 r] 2 , . . . , [ w n , y n + v n r] 2 , [r] 2 , [(z 1 + • • • + z n )r] T ).
The ciphertext ct x i can be viewed as encrypting x i z i using the single-input FE, where z 1 , . . . , z n are part of msk. In addition, we provide a single-input FE key for y i r in the secret key, where a fresh r is sampled for each key. Decryption proceeds as follows: first compute

[ x i , y i + z i r] T = e([x i + w i s i ] ⊤ 1 , [y i ] 2 ) + e([z i + v i s i ] ⊤ 1 , [r] 2 ) -e([s i ], [ w i , y i + v i r] 2 )
and then

[ n i=1 x i , y i ] T = -[(z 1 + • • • + z n )r] T + n i=1 [ x i , y i + z i r] T .
The intuition underlying security is that by the DDH assumption [z i r] T is pseudorandom and helps mask the leakage about

x i , y i in [ x i , y i + z i r] T ; in particular, [ x 1 , y 1 + z 1 r] T , . . . , [ x n , y n + z n r] T , [(z 1 + • • • + z n )r] T constitutes a computational secret-sharing of [ x 1 , y 1 + • • • + x n , y n ] T ,
even upon reusing z 1 , . . . , z n as long as we pick a fresh r. In addition, sharing the same exponent r across n elements in the secret key helps prevent mix-and-match attacks across secret keys.

Our main technical result is that a variant of the private-key MIFE scheme we just described satisfies adaptive indistinguishability-based security under the k-Lin assumption in bilinear groups; a straight-forward extension of an impossibility result in [BSW11, AGVW13] rules out simulation-based security. Our final scheme, described in Figure 4.6, remains quite simple and achieves good concrete efficiency. We focus on selective security in this overview, and explain at the end the additional ideas needed to achieve adaptive security.

Overview of the security proof.

There are two main challenges in the security proof: (i) avoiding leakage beyond the ideal functionality, (ii) avoiding super-polynomial hardness assumptions. Our proof proceeds in two steps: first, we establish security with a single challenge ciphertext per slot, and from which we bootstrap to achieve security with multiple challenge ciphertexts per slot. We will address the first challenge in the first step and the second challenge in the second. For notation simplicity, we focus on the setting with n = 2 slots and a single key query y 1 y 2 .

Step 1. To prove indistinguishability-based security, we want to switch encryptions x 0 1 , x 0 2 to encryptions of x 1 1 , x 1 2 . Here, the leakage from the ideal functionality imposes the restriction that

x 0 1 , y 1 + x 0 2 , y 2 = x 1 1 , y 1 + x 1 2
, y 2 and this is the only restriction we can work with. The natural proof strategy is to introduce an intermediate hybrid that generates encryptions of x 1 1 , x 0 2 . However, to move from encryptions x 0 1 , x 0 2 to this hybrid, we would require that x 0 1 x 0 2 , y 1 y 2 = x 1 1 x 0 2 , y 1 y 2 , which implies the extraneous restriction x 0 1 , y 1 = x 1 1 , y 1 . (Indeed, the single-input inner-product scheme in [START_REF] Bishop | Function-hiding inner product encryption[END_REF] imposes extraneous restrictions to overcome similar difficulties in the function-hiding setting.)

To overcome this challenge, we rely on a single-input FE that achieves simulation-based security, which allows us to avoid the intermediate hybrid. See Theorem 9 and Remark 11 for further details.

Step 2. Next, we consider the more general setting with Q 1 challenge ciphertexts in the first slot and Q 2 in the second, but still a single key query. We achieve security loss O(Q 1 + Q 2 ) for two slots, and more generally,

O(Q 1 + • • • + Q n ) -as opposed to Q 1 Q 2 • • • Q n corresponding
to all possible combinations of the challenge ciphertexts-for n slots.

Our first observation is that we can bound the leakage from the ideal functionality by , y 1 and more generally, x j,b i -x 1,b i , y i . Indeed, these are essentially the only constraints we need to work with, namely:

O(Q 1 + Q 2 ) relations (the trivial bound being Q 1 • Q 2 ).
x 1,0 1 , y 1 + x 1,0 2 , y 2 = x 1,1 1 , y 1 + x 1,1 2 , y 2 , x j,0 i -x 1,0 i , y i = x j,1 i -x 1,1 i , y i , j = 2, . . . , Q i , i = 1, 2.
Next, we need to translate the bound on the constraints to a O(Q 1 +Q 2 ) bound on the security loss in the security reduction. We will switch from encryptions of x j,0 i to those of x j,1 i as follows: we write

x j,0 i = x 1,0 i + (x j,0 i -x 1,0 i ).
We can switch the first terms in the sums from x1,0 i to x 1,1 i using security for a single challenge ciphertext, and then switch x j,0 ix 1,0 i to x j,1 ix 1,1 i by relying on security of the underlying single-input FE and the fact that x j,0 ix 1,0 i , y i = x j,1 ix 1,1 i , y i . Here, we will require that the underlying single-input FE satisfies a malleability property, namely given ∆, we can maul an encryption of x into that of x + ∆. Note that this does not violate security because given x, y , y, ∆, we can efficiently compute x + ∆, y . See Theorem 10 for further details.

Extension to adaptive security. The previous argument for selective security requires to embed the challenge into the setup parameters. To circumvent this issue, we use a two-step strategy for the adaptive security proof of MIFE. The first step uses an adaptive argument (this is essentially the argument used for the selective case, but applied to parameters that are picked at setup time), while the second step uses a selective argument, with perfect security. Thus, we can afford to use to simply guess the challenge beforehand, which incurs an exponential security loss, since the exponential term is multiplied by a zero term. The idea of using complexity leveraging to deduce adaptive security from selective security when the security is perfect, also appears in [Wee14, Remark 1]. See Remark 12 for further details.

Security against corruption of input slots. Proving the stronger security notion requires solving technical challenges that did not arise in [AGRW17]. In particular, to obtain full fledged many-AD-IND security, [AGRW17] use a generic transformation that uses an extra layer of symmetric encryption, to encrypt the original ciphertext. The symmetric key is shared across input slots, and the i'th share is given as part of any ciphertext for input slot i ∈ [n]. Thus, when ciphertexts are known for all slots i ∈ [n], the decryption recovers all shares of the symmetric key, and decrypt the outer layer, to get the original ciphertext. The rest of decryption is performed as in the original multi-input FE.

The problem with this approach is that the encryption algorithm needs to know the symmetric key (and not simply a share of it). Thus, corrupting one input slot allows the adversary to recover the entire symmetric key, and break the security of the scheme. Such problem did not arise in [AGRW17], which does not consider corruptions of input slots. To circumvent this issue, as in [START_REF] Datta | Full-hiding (unbounded) multi-input inner product functional encryption from the k-linear assumption[END_REF], we use the symmetric key to encrypt the functional secret keys, instead of encrypting the ciphertexts. Each encryption key ek i for input slot i ∈ [n] contains the i'th share of the symmetric key, but the full symmetric key is only needed by the key generation algorithm, which knows msk. If one share is missing, all the functional secret keys are random. Security of the overall multi-input FE when zero functional secret keys are queried concludes the security proof. See Section 2.4.2 for further details.

Theoretical perspective. The focus of this work is on obtaining constructions for a specific class of functions with good concrete efficiency. Nonetheless, we believe that our results do shed some new insights into general feasibility results for MIFE. Namely, we presented the first MIFE for a non-trivial functionality that polynomial security loss for a super-constant number of slots under falsifiable assumptions. Recall that indistinguishability obfuscation and generic multilinear maps are not falsifiable, whereas the constructions based on single-input FE in [AJ15, BV15, BKS16] incur a security loss which is exponential in the number of slots. Indeed, there is a reason why prior works relied on non-falsifiable assumptions or super-polynomial security loss. Suppose an adversary makes Q 0 key queries, and Q 1 , . . . , Q n ciphertext queries for the n slots. By combining the ciphertexts and keys in different ways, the adversary can learn

Q 0 Q 1 • • • Q n different decryptions.
When n is super-constant, the winning condition in the security game may not be efficiently checkable in polynomial-time, hence the need for either a non-falsifiable assumption or a super-polynomial security loss. To overcome this difficulty, we show that for inner products, we can exploit linearity to succinctly characterize the

Q 0 Q 1 • • • Q n constraints by roughly Q 0 • (Q 1 + • • • Q n ) constraints.
Discussion. Our constructions and techniques may seem a-priori largely tailored to the inner product functionality and properties of bilinear groups. We clarify here that our highlevel approach (which builds upon [START_REF] Wee | Dual system encryption via predicate encodings[END_REF][START_REF] Blazy | Hierarchical) identity-based encryption from affine message authentication[END_REF]) may be applicable beyond inner products, namely: i. start with a multi-input FE that is only secure for a single ciphertext per slot and one secret key, building upon a single-input FE whose security is simulation-based for a single ciphertext (in our case, this corresponds to introducing the additional z 1 , . . . , z n to hide the intermediate computation x i , y i );

ii. achieve security for a single ciphertext per slot and multiple secret keys, by injecting additional randomness to the secret keys to prevent mix-and-match attacks (for this, we replaced z 1 , . . . , z n with z 1 r, . . . , z n r, r in the exponent);

iii. "bootstrap" to multiple ciphertexts per slot, where we also showed how to avoid incurring an exponential security loss.

In particular, using simulation-based security for i. helped us avoid additional leakage beyond what is allowed by the ideal functionality.

Additional related work. Goldwasser et al. [GGG + 14] showed that both two-input publickey MIFE as well as n-input private-key MIFE for circuits already implies indistinguishability obfuscation for circuits.

There have also been several works that proposed constructions for private-key multi-input functional encryption. The work of Boneh et al. [BLR + 15] constructs a single-key MIFE in the private key setting, which is based on multilinear maps and is proven secure in the idealized generic multilinear map model. Two other papers explore the question how to construct multiinput functional encryption starting from the single input variant. In their work [START_REF] Ananth | Indistinguishability obfuscation from compact functional encryption[END_REF] Ananth and Jain demonstrate how to obtain selectively secure MIFE in the private key setting starting from any general-purpose public key functional encryption. In an independent work, Brakerski et al. [START_REF] Brakerski | Multi-input functional encryption in the private-key setting: Stronger security from weaker assumptions[END_REF] reduce the construction of private key MIFE to general-purpose private key (single input) functional encryption. The resulting scheme achieves selective security when the starting private key FE is selectively secure. Additionally in the case when the MIFE takes any constant number of inputs, adaptive security for the private key FE suffices to obtain adaptive security for the MIFE construction as well. The constructions in that work provide also function hiding properties for the MIFE encryption scheme.

While this line of work reduces MIFE to single-input FE for general-purpose constructions, the only known instantiations of construction for public and private key functional encryption with unbounded number of keys require either indistinguishability obfuscation [GGH + 13b] or multilinear maps with non-standard assumptions [START_REF] Garg | Functional encryption without obfuscation[END_REF]. We stress that the transformations from single-input to MIFE in [START_REF] Ananth | Indistinguishability obfuscation from compact functional encryption[END_REF][START_REF] Brakerski | Multi-input functional encryption in the private-key setting: Stronger security from weaker assumptions[END_REF] are not applicable in the case of inner products since these transformations require that the single-input FE for complex functionalities related to computing a PRF, which is not captured by the simple inner functionality.

Road-map.

In the rest of this chapter, we first present the selectively-secure MIFE in Section 4.1, then show in Section 4.2 how to obtain adaptive security.

Selectively-Secure, Private-Key MIFE for Inner Products

In this section, we present a private-key MIFE for bounded-norm inner products over Z, that is, for the set of functionalities {F m,X,Y n

} n∈N defined as F m,X,Y n : K n × X 1 × • • • × X n → Z, with K n := [0, Y ] mn , for all i ∈ [n], X i := [0, X] m , Z := Z, such that for any (y 1 • • • y n ) ∈ K n , x i ∈ X i , we have: F m,X,Y n (y 1 • • • y n ), x 1 , . . . , x n = n i=1
x i , y i .

Remark 7: on leakage

Let (x j,0 i , x j,1 i ) i∈[n],j∈[Q i ]
be the ciphertext queries, and y 1 • • • y n be a secret key query. For all slots i ∈ [n], all j ∈ [Q i ], and all bits b ∈ {0, 1}, the adversary can learn

x j,b i -x 1,b i , y i
via the ideal functionality. In the IND security game, this means the adversary is restricted to queries satisfying x j,0 ix 1,0 i , y i = x j,1 ix 1,1 i , y i . In the hybrid, we want to avoid additional constraints such as

x j,0 i -x 1,0 i , y i = x j,0 i -x 1,1 i , y i = x j,1 i -x 1,0 i , y i = x j,1 i -x 1,1 i , y i .
We prove many-SEL security, for static corruptions (see Definition 23), using an asymmetric pairing group PG = (G 1 , G 2 , G T , p, P 1 , P 2 , e) with e : G 1 × G 2 → G T of prime order p, where p is a 2λ-bit prime. Our construction relies on the Matrix Decisional Diffie-Hellman assumption in G 1 and in G 2 (see Definition 10), and build upon any single-input FE for inner products, that satisfies one-SEL-SIM security, along with some additional structural properties. Such singleinput FE can be obtained by straightforwardly adapting the scheme from [ALS16, Section 3], and is recalled in Section 2.6.1 for completeness. For correctness, we require n; m; X; Y to be polynomials in the security parameter. This implies that:

n • m • X • Y ≪ p.
Our generic single-to-multi input construction is described in Figure 4.1. We present a selfcontained description of the scheme in Figure 4.6.

Selectively-secure, multi-input scheme from single-input scheme

Main construction. We present in Figure 4.1 a private key multi-input FE, MIFE, for the bounded-norm inner products over Z, starting from any one-SEL-SIM secure, single-input inner products FE, FE, that additionally satisfies the following requirements.

Additional requirements. The construction and the analysis requires that FE := (GSetup ′ , Setup ′ , Enc ′ , KeyGen ′ , Dec ′ ) satisfies the following structural properties:

• The scheme can be instantiated over G 1 , where the ciphertext is a vector [c] 1 over G 1 and the secret key is a vector d i over Z p .

• Enc ′ is linearly homomorphic. More specifically, we only that, given gpk ′ , Enc ′ (gpk ′ , ek ′ , x), and x ′ , we can generate a fresh random encryption of x + x ′ , i.e. Enc ′ (gpk ′ , ek ′ , x + x ′ ). This property is used in the proof of Lemma 31 and Lemma 32.

• For correctness, Dec ′ should be linear in its input d and [c] 1 , so that Dec d,c)] T ∈ G T can be computed using a pairing.

′ (gpk ′ , [d] 2 , [c] 1 ) = [Dec ′ (gpk ′ ,
• For an efficient MIFE decryption, Dec ′ must work without any restriction on the norm of the output as long as the output is in the exponent.

• Let ( GSetup, Setup, Enc, KeyGen) be the simulator for the one-SEL-SIM security of FE.

We require that KeyGen( msk, •, •) is linear in its inputs (y, a), so that we can compute

KeyGen( msk, [y] 2 , [a] 2 ) = [ KeyGen( msk, y, a)] 2 .
This property is used in the proof of Lemma 29.

Setup(1 λ , F m,X,Y n ): gpk ′ ← GSetup ′ (1 λ , F m+k,X,Y IP ), where gpk ′ contains PG := (G 1 , G 2 , p, P 1 , P 2 , e) ← PGGen(1 λ ) For all i ∈ [n]: ek ′ i , msk ′ i ← Setup ′ (1 λ , gpk ′ , F m+k,X,Y IP ), z i ← R Z k p , ek i := (ek ′ i , z i ) pk := gpk ′ , msk := {msk ′ i , z i } i∈[n] Return (pk, msk, (ek i ) i∈[n] ) Enc(pk, ek i , x i ): Return Enc ′ (gpk ′ , ek ′ i , x i z i ) KeyGen(pk, msk, y 1 • • • y n ): r ← R Z k p , z := z 1 + • • • + z n , r For all i ∈ [n]: d i ← KeyGen ′ (gpk ′ , msk ′ i , y i r) dk y1 ••• yn := (y 1 • • • y n ), {[d i ] 2 } i∈[n] , [r] 2 , [z] T Return dk y1 ••• yn Dec pk, dk y1 ••• yn , ct 1 , . . . , ct n ): Parse dk y1 ••• yn = (y 1 • • • y n ), {[d i ] 2 } i∈[n] , [r] 2 , [z] T For all i ∈ [n]: [a i ] T ← Dec ′ (gpk ′ , [d i ] 2 , ct i ) Return the discrete log of ( n i=1 [a i ] T ) -[z] T

Correctness. By correctness of FE, we have for all i ∈ [n]: [a

i ] T = [ x i z i , y i r ] T . Thus, decryption computes: ( n i=1 x i z i , y i r ) -z 1 + • • • + z n , r T = [ x 1 • • • x n , y 1 • • • y n ] T We know i x i , y i ≤ n•m•X •Y ,
which is bounded by a polynomial in the security parameter. Thus, decryption can efficiently recover the discrete log: i x i , y i mod p = i x i , y i , where the equality holds since i x i ,

y i ≤ n • m • X • Y ≪ p.

Remark 8: Optimization

A more efficient version of our scheme would be to take z i ← R Z k p subject to i z i = 0. This way, we don't have to include the value [z] T in the secret keys, since it would cancel out. We choose to present the inefficient version which includes the value [z] T for simplicity.

Remark 9: Notations

We use subscripts and superscripts for indexing over multiple copies, and never for indexing over positions or exponentiation. Concretely, the j'th ciphertext query in slot i is x j i .

Security. First, we prove the one-SEL-IND-static security of MIFE, in Theorem 9, that is, in English: the scheme is secure for only one challenge ciphertext per input slot, in the selective setting, for static corruptions (see Definition 23). Then, in Theorem 10, we show how to upgrade the security of the MIFE to many-SEL-IND-static, that is, for many challenge ciphertexts.

Theorem 9: one-SEL-IND-static security of MIFE

Suppose FE is one-SEL-SIM secure for n instances, and that the U k (p)-MDDH assumption holds in G 2 . Then, MIFE is one-SEL-IND-static secure.

Recall that the U k (p)-MDDH assumption is the weakest of all D k (p)-MDDH assumptions, for any matrix distribution D k (p), according to Lemma 3. In particular, it is implied by the well-known k-Lin assumption. Proof of Theorem 9. Using Theorem 2, it is sufficient to prove one-SEL-IND-zero-static (i.e. the scheme is secure when no decryption keys are queried), and one-SEL-IND-weak-static i.e. we assume the adversary requests a challenge ciphertext for all slots i ∈ HS, where HS := [n] \ CS denotes the set of slots that are not corrupted) to obtain one-SEL-IND-static security.

game ct i : {d i } i∈[n] in sky: z in sky: justification/remark G 0,β Enc ′ (gpk ′ , ek ′ i , x β i z i ) KeyGen ′ (gpk ′ , msk ′ i , y i r) z = z 1 + . . . + zn, r one-SEL-IND-static security game G 1,β Enc( msk i ) KeyGen( msk i , y i r, x β i z i , y i r ) z = z 1 + . . . + zn, r one-SEL-SIM security of FE G 2,β Enc( msk i ) KeyGen( msk i , y i r, x β i , y i + z i ) z = i∈CS z i , r + i∈HS z i D k -MDDH
The one-SEL-IND-zero-static security of MIFE follows directly from the one-SEL-IND security of FE (which is implied by its one-SEL-SIM security). In what follows, we prove one-SEL-IND-weak-static security of MIFE.

We proceed via a series of games G i,β for i ∈ {0, . . . , 2}, β ∈ {0, 1}, described in Figure 4.3. The transitions are summarized in Figure 4.2. Let A be a PPT adversary. For any game G, we denote by Adv G (A) the probability that the game G outputs 1 when interacting with A. Note that the set of input slots for which a challenge ciphertext is queried, denoted by I in Figure 4.3, is such that HS ⊆ I, since we want to prove one-SEL-IND-weak security.

Games G 0,β , for β ∈ {0, 1}: are such that Adv one-SEL-IND-weak-static

MIFE,A (λ) = |Adv G 0,0 (A) - Adv G 0,1 (A)|, according to Definition 21. Games G 0,β , G 1,β , G 2,β , for β ∈ {0, 1}: {x b i } i∈I⊆[n],b∈{0,1} , CS ⊆ [n] ← A(1 λ , F m,X,Y n ) gpk ′ ← GSetup ′ (1 λ , F m+k,X,Y IP ), pk := gpk ′ . For all i ∈ [n]: (ek ′ i , msk ′ i ) ← Setup ′ (1 λ , gpk ′ , F m+k,X,Y IP ), z i ← R Z k p , ek i := (ek ′ i , z i ). For all i ∈ I: ct i := Enc ′ (gpk ′ , ek ′ i , x β i z i ). ( gpk, td) ← GSetup(1 λ , F m+k,X,Y IP ), pk := gpk.
For all i ∈ [n]:

ek i , msk i ← Setup(1 λ , gpk, F m+k,X,Y IP ), z i ← R Z k p , ek i := ( ek i , z i ).
For all i ∈ CS∩I: ct i := Enc ′ ( gpk, ek i , x β i z i ). For all i ∈ HS: ct i := Enc(td, msk i ). Games G 1,β , for β ∈ {0, 1}: we replace (GSetup ′ , Setup ′ , KeyGen ′ , Enc ′ ) by the simulator ( GSetup, Setup, KeyGen, Enc), using the one-SEL-SIM security of FE for h instances, where h denotes the size of HS, where HS is the set of honest input slots, that is, HS := [n] \ CS. We prove in Lemma 28 that there exists a PPT adversary B 1 such that

α ← A OKeygen(•) (pk, (ct i ) i∈I , (ek i ) i∈CS ) Return α. OKeygen(y 1 • • • y n ): r ← R Z k p , ∀i ∈ HS : z i ← R Z p , z := z 1 + • • • + z n , r , z := i∈CS z i , r + i∈HS z i ∀i ∈ [n]: d i ← KeyGen ′ gpk ′ , msk ′ i , y i r , d i ← KeyGen ′ gpk, msk i , y i r ∀i ∈ HS: d i ← KeyGen td, msk i , y i r, x β i z i , y i r ∀i ∈ HS : d i ← KeyGen td, msk i , y i r, x β i , y i + z i dk y1 ••• yn := {[d i ] 2 } i∈[n] , [r] 2 , [z] T Return dk y1 ••• yn
|Adv G 0,β (A) -Adv G 1,β (A)| ≤ Adv one-SEL-SIM FE,B 1 ,h (λ).
Games G 2,β , for β ∈ {0, 1}: we replace the values z i , r used by the oracle OKeygen to z i ← R Z p , for all slots i ∈ HS, using the U k (p)-MDDH assumption in G 2 . Namely, we prove in Lemma 29 that there exists a PPT adversary B 2 such that:

|Adv G 1,β (A) -Adv G 2,β (A)| ≤ Adv U k (p)-mddh G 2 ,B 2 (λ) + 1 p -1 .
Finally, in Lemma 30, we prove that G 2,0 and G 2,1 are perfectly indistinguishable, using a statistical argument that crucially relies on the fact that we are in the selective security setting, and using the restrictions on the queries to OKeygen and the challenge {x b i } i∈I⊆[n],b∈{0,1} imposed by the security game. We have:

Adv G 2,0 (A) = Adv G 2,1 (A).
Putting everything together, we obtain:

Adv one-SEL-IND-weak-static MIFE,A (λ) ≤ 2 • Adv one-SEL-SIM FE,B 0 ,h (λ) + 2 • Adv U k -mddh G 2 ,B 2 (λ) + 2 p -1 ,
where h ≤ n is the number of honest input slots.

Lemma 28: Game G 0,β to G 1,β
There exists a PPT adversary B 1,β such that

Adv G 0,β (A) -Adv G 1,β (A) ≤ Adv one-SEL-SIM FE,B 1,β ,h (λ),
where h denotes the size of HS, where HS is the set of honest input slots, that is,

HS := [n] \ CS.
Proof of Lemma 28. In the game G 1,β , we replace (GSetup ′ , Setup ′ , Enc ′ , KeyGen ′ ) by the simulator ( GSetup, Setup, Enc, KeyGen), whose existence is ensured by the one-SEL-SIM security of FE (see Definition 20). A complete description of games G 0,β and G 1,β is given in Figure 4.3. The adversary B 0,β proceeds as follows.

-Simulation of (pk, {ct i } i∈I , {ek i } i∈CS ):

Upon receiving the challenge {x b i } i∈I,b∈{0,1} , and the set of corrupted user CS ⊆ [n] from A, adversary B 0,β samples z i ← R Z k p for all i ∈ [n], and sends {(x β i z i )} i∈HS to the experiment it is interacting with, upon which it receives the global public key gpk and ciphertexts {ct i } i∈HS . The global public key gpk is either of the form gpk = gpk ′ with gpk

′ ← GSetup ′ (1 λ , F m,X,Y IP ) if
B 0,β is interacting with the experiment REAL FE (1 λ , B 0,β,ℓ ), and gpk = gpk with ( gpk, td) ←

GSetup(1 λ , F m,X,Y

IP

) if B 0,β is interacting with the experiment IDEAL FE (1 λ , B 0,β,ℓ ) (see Definition 20 for a description of these experiments, with the one-SEL restriction). The ciphertexts are of the form ct i := Enc ′ (gpk ′ , ek ′ i , x β i z i ) or Enc(td, ek i , msk i ), depending on which experiment B 0,β is interacting with.

For all i ∈ CS, B 0,β samples (ek i , msk i ) ← Setup ′ (1 λ , gpk, F m,X,Y

IP

). For all CS ∩ I, it computes ct i := Enc ′ (gpk, ek i , x β i z i ). It sets pk := gpk, and returns (pk, {ct i } i∈I , {ek i } i∈CS ) to A.

-Simulation of OKeygen(y 1 . . . y n ):

For any query (y 1 . . . y n ), B 0,β,ℓ picks r ← R Z k p . Then, for all i ∈ CS, it computes d i ← KeyGen ′ (gpk, msk i , y i r). It can do so since it knows gpk and msk i for all i ∈ CS. For all i ∈ HS, B 0,β queries its own decryption key oracle on y i r, to obtain d i := KeyGen ′ (gpk ′ , msk ′ i , y i r) if it is interacting with the real experiment, or d i := KeyGen(td, msk i , y i r, x β i z i , y i r ) if it is interacting with the ideal experiment.

Then, it computes z

:= z 1 + • • • + z n , r and returns dk y 1 ••• yn := {[d i ] 2 } i∈[n] , [r] 2 , [z] T to A.
Finally, B 0,β forwards A's output α to its own experiment. It is clear that when B 0,β interacts with the experiment REAL FE (1 λ , B 0,β ), it simulates the game G 0,β , whereas it simulates the game G ,β when it interacts with IDEAL FE (1 λ , B 0,β ). Therefore,

Adv one-SEL-SIM FE,B 0,β (λ) = Pr REAL FE (1 λ , B 0,β ) = 1 -Pr IDEAL FE (1 λ , B 0,β ) = 1 = |Adv G 0,β (A) -Adv G 1,β (A)| Lemma 29: Game G 1,β to G 2,β
There exists a PPT adversary B 2,β such that:

Adv G 1,β (A) -Adv G 2,β (A) ≤ Adv U k -mddh G 2 ,B 2,β (λ) + 1 p -1 .
Recall, from Lemma 3, that for any matrix distribution D k (p), we have

D k (p)-MDDH ⇒ U k (p)-MDDH.
Proof of Lemma 29. Here, we switch

{[r] 2 , [ z i , r ] 2 } i∈HS used by the oracle OKeygen to {[r] 2 , [ z i ] 2 } i∈HS , where z i ← R Z k p , z i ← R Z p , and r ← R Z k p .
Recall that HS denotes the set of honest slots, that is HS :=

[n] \ CS.
This is justified by the fact that {

[r] 2 , [ z i , r ] 2 } i∈HS ∈ G (k+h) 2
, where h is the size of HS, is identically distributed to [Ur] 2 where U ← R U k+h,k (p) (wlog. we assume that the upper k rows of U are full rank), which is indistinguishable from a uniformly random vector over G k+h 2 , that is, of the form: {[r] 2 , [ z i ] 2 } i∈HS , according to the U k+h,k (p)-MDDH assumption. To do the switch simultaneously for all calls to OKeygen, that is, to switch

{[r j ] 2 , [ z i , r j ] 2 } i∈HS,j∈[Q 0 ] to {[r j ] 2 , [ z j i ] 2 } i∈HS,j∈[Q 0 ]
, where z j i ← Z p and r j ← R Z k p for all j ∈ [Q 0 ], where Q 0 denotes the number of calls to OKeygen, we use the Q 0 -fold U k+h,k (p)-MDDH assumption. Namely, we build a PPT adversary B ′ 2,β such that

Adv G 1,β (A) -Adv G 2,β (A) ≤ Adv Q 0 -U k+h,k (p)-mddh G 2 ,B ′ 2,β (λ).
This, together with Corollary 1 (U k (p)-MDDH ⇒ Q 0 -fold U k+h,k (p)-MDDH), implies the lemma. The adversary B ′ 2,β proceeds as follows.

-Simulation of (pk, {ct i } i∈I , {ek i } i∈CS ):

Upon receiving an Q 0 -fold U k+h,k -MDDH challenge PG, [U] 2 ∈ G (k+h)×k 2 , h 1 • • • h Q 0 2 ∈ G (k+h)×Q 0 2 , together with the challenge {x b i } i∈I,b∈{0,1} and the set CS ⊆ [n] from A, B ′ 2,β samples ( gpk, td) ← GSetup(1 λ , F m+k,X,Y IP ). For all i ∈ [n], it samples ( ek i , msk i ) ← Setup(1 λ , gpk, F m+k,X,Y IP ), z i ← R Z k p
, and sets ek i := ( ek i , z i ). For all i ∈ HS, it samples ct i := Enc(td, ek i , msk i ). For all i ∈ CS ∩ I, it samples ct i := Enc ′ ( gpk, ek i , x β i z i ). It sets pk := gpk, and returns (pk, {ct i } i∈I , {ek i } i∈CS ) to A.

-Simulation of OKeygen(y

1 • • • y n ): On the j'th query y 1 • • • y n of A, B ′ 2,β sets [r j ] 2 := [h j ] 2
, where h j ∈ Z k p denotes the k-upper components of h j ∈ Z k+n p . For all i ∈ CS, it computes d i := KeyGen ′ ( gpk, msk i , y i r j ). For all i ∈ HS, it computes [d i ] := KeyGen td, msk i , [y i r j ] 2 , [ x β i , y i + h j k+i ] 2 , where h j k+i denotes the k + i'th coordinate of the vector h j ∈ Z k+h p . Here we rely on the fact that KeyGen(td, msk, •, •) is linear in its inputs (y, a), so that

B ′ 2,β can compute KeyGen( msk, [y] 2 , [a] 2 ) = [ KeyGen( msk, y, a)] 2 . Note that when h 1 • • • h Q 0 2 is a real MDDH challenge, B ′ 2,β simulate game G 1,β , whereas it simulates game G 2,β when h 1 • • • h Q 0 2 is uni- formly random over G (k+n)×Q 0 2 . Lemma 30: Game G 2,0 to G 2,1 Adv G 2,0 (A) = Adv G 2,1 (A).
Proof of Lemma 30. We show that G 2,β does not depend on β, using the fact that for all

y 1 • • • y n ∈ (Z m p ) n , for all {x b i ∈ Z m p } i∈[n],b∈{0,1}
, the following are identically distributed:

{ z i } i∈HS and { z i -x β i , y i } i∈HS ,
where z i ← R Z p for all i ∈ HS.

For each query

y 1 • • • y n , OKeygen(y 1 • • • y n ) picks values z i ← R Z p for i ∈ HS that are independent of y 1 • • • y n and the challenge {x b i ∈ Z m p } i∈[n]
,b∈{0,1} (note that here we crucially rely on the fact the games G 2,0 and G 2,1 are selective), therefore, using the previous fact, we can switch z i to z ix β i , y i for all i ∈ HS, without changing the distribution of the game. This way, for all i ∈ HS, OKeygen(y 1 • • • y n ) computes d i ← KeyGen(td, msk i , y i r, z i ), which does not depend on β, and

z := i∈CS z i , r + i∈HS z i -i∈HS x β i , y i .
By definition of the security game, we have x 0 i = x 1 i for all i ∈ CS ∩ I. Thus, we have:

z := i∈CS z i , r + i∈HS z i -i∈I x β i , y i .
Finally, by definition of the security game, we have: i∈I x 0 i , y i = i∈I x 1 i , y i . This is implied by Condition 1 in Definition 23, and the fact that HS ⊆ I. That means the value [z] T computed by OKeygen does not depend on β. Finally, for all i ∈ CS, OKeygen(y 1 • • • y n ) computes d i := KeyGen ′ ( gpk, msk i , y i r), which does not depend on β. Putting everything together, we get that G 2,β is independent of β.

Remark 10: decryption capabilities

As a sanity check, we note that the simulated secret keys will correctly decrypt a simulated ciphertext. However, unlike schemes proven secure via the standard dual system encryption methodology [START_REF] Waters | Dual system encryption: Realizing fully secure IBE and HIBE under simple assumptions[END_REF], a simulated secret key will incorrectly decrypt a normal ciphertext. This is not a problem because we are in the private-key setting, so a distinguisher will not be able to generate normal ciphertexts by itself.

Remark 11: why a naive argument is inadequate

We cannot afford to do a naive hybrid argument across the n slots for the challenge ciphertext as it would introduce extraneous restrictions on the adversary's queries. Concretely, suppose we want to use a hybrid argument to switch from encryptions of x 0 1 , x 0 2 in game 0 to those of x 1 1 , x 1 2 in game 2 with an intermediate hybrid that uses encryptions of x 1 1 , x 0 2 in Game 1 . To move from game 0 to game 1, the adversary's query y 1 y 2 must satisfy x 0 1 x 0 2 , y 1 y 2 = x 1 1 x 0 2 , y 1 y 2 , which implies the extraneous restriction x 0 1 , y 1 = x 1 1 , y 1 . As described in the proof above, we overcome the limitation by using simulation-based security. Note that what essentially happens in the first slot in our proof is as follows (for k = 1, that is, DDH): we switch from Enc ′ (pk ′ 1 , x 0 1 z 1 ) to Enc ′ (pk ′ 1 , x 1 1 z 1 ) while giving out a secret key which contains KeyGen ′ (msk ′ 1 , y 1 r 1 ) and [r 1 ] 2 . Observe that

x 0 1 z 1 , y 1 r 1 = x 0 1 , y 1 + z 1 r 1 , x 1 1 z 1 , y 1 r 1 = x 1 1 , y 1 + z 1 r 1
may not be equal, since we want to avoid the extraneous restriction x 0 1 , y 1 = x 1 1 , y 1 . This means that one-SEL-IND security does not provide any guarantee that the ciphertexts are indistinguishable. However, one-SEL-SIM security does provide such a guarantee, because ([

x 0 1 , y 1 + z 1 r 1 ] 2 , [r 1 ] 2 ) ≈ c ([ x 1 1 , y 1 + z 1 r 1 ] 2 , [r 1 ]
2 ) via the DDH assumption in G 2 . Since the outcomes of the decryption are computationally indistinguishable, the output of the simulated ciphertext would also be computationally indistinguishable.

Theorem 10: many-yy-IND-static security of MIFE

Let yy ∈ {AD,SEL}. Suppose FE is many-yy-IND secure and MIFE is one-yy-INDstatic secure. Then, MIFE is many-yy-IND-static secure.

Since the construction MIFE from Figure 4.1 is proven one-SEL-IND-static secure in Theorem 9, we obtain the following corollary.

Corollary 2: many-SEL-IND-static security of MIFE

The scheme MIFE from Figure 4.1 is many-SEL-IND secure, assuming the underlying FE is many-SEL-IND secure.

That is, we show that our multi-input FE is selectively secure in the setting with multiple challenge ciphertexts (and since our multi-input FE is a private key scheme, this is not immediately implied by the one-SEL-IND security).

Proof overview.

• We first switch encryptions of x 1,0 1 , . . . , x 1,0 n to those of x 1,1 1 , . . . , x 1,1 n , and for the remaining ciphertexts, we switch from an encryption of x j,0 i = (x j,0 ix 1,0 i ) + x 1,0 i to that of (x j,0 ix 1,0 i ) + x 1,1 i . This uses the one-yy-IND security of MIFE, and the fact that its encryption algorithm is linearly homomorphic, thanks to which encryption of (x j,0 ix 1,0 i ) + x 1,β i can be publicly computed from an encryption of x 1,β i . • Then, we switch from encryptions of

(x 2,0 i -x 1,0 i ) + x 1,1 i , . . . , (x Q i ,0 i -x 1,0 i ) + x 1,1 i to those of (x 2,1 i -x 1,1 i ) + x 1,1 i , . . . , (x Q i ,1 i -x 1,1 i ) + x 1,1
i . This uses the many-yy-IND security of FE.

As described earlier, to carry out the latter argument, the queries must satisfy the constraint

(x j,0 i -x 1,0 i ) + x 1,1 i , y i = (x j,1 i -x 1,1 i ) + x 1,1 i , y i ⇐⇒ x j,0 i -x 1,0 i , y i = x j,1 i -x 1,1
i , y i where the latter is already imposed by the ideal functionality.

Proof of Theorem 10. We proceed via a series of games, described in Figure 4.5. The transitions are summarized in Figure 4.4. Let A be a PPT adversary. For any game G, we denote by Adv G (A) the probability that the game G outputs 1 when interacting with A.

Game G 0 : is such that Adv many-SEL-IND MIFE,A (λ) = |Adv G 0 (A) -Adv G 2 (A)|, according to Defini- tion 21.
Game G 1 : is as game G 0 , except we replace the challenge ciphertexts to ct j i = Enc(pk, ek i , x j,0 ix 1,0 i + x 1,1 i ) for all i ∈ [n] and j ∈ [Q i ], using the one-yy-IND security of MIFE. Namely, we prove in Lemma 31 that there exists a PPT adversary B 1 such that

Adv G 0 (A) -Adv G 1 (A) ≤ Adv one-yy-IND MIFE,B 1 (λ). game ct j i : justification/remark 0 Enc(ek i , x j,0 i -x 1,0 i + x 1,0 i ) many-yy-IND security game 1 Enc(ek i , x j,0 i -x 1,0 i + x 1,1 i ) one-
Games G 0 , G 1 , G 2 : CS ⊆ [n] ← A(1 λ , F m,X,Y n ) (pk, msk, (ek i ) i∈[n] ) ← Setup(1 λ , F m,X,Y n ) α ← A OEnc(•,•),OKeygen(•) (pk, {ek i } i∈CS ) Return α.
OEnc(i, (x j,0 i , x j,1 i )): Game G 2 : we replace the challenge ciphertexts to ct j i = Enc(pk, ek i , x j,1 ix 1,1 i + x 1,1 i ) = Enc(pk, ek i , x j,1 i ) for all i ∈ [n] and j ∈ [Q i ], using the many-yy-IND security of FE for n instances, which is implied by the single-instance security (see Lemma 5). We prove in Lemma 32 that there exists a PPT adversary B 2 such that

ct j i := Enc(pk, ek i , x j,0 i -x 1,0 i + x 1,0 i ) ct j i := Enc(pk, ek i , x j,0 i -x 1,0 i + x 1,1 i ) ct j i := Enc(pk, ek i , x j,1 i -x 1,1 i + x 1,1 i ) Return ct j i . OKeygen(y 1 • • • y n ): Return KeyGen(pk, msk, y 1 • • • y n ).
Adv G 1 (A) -Adv 2 (A) ≤ Adv many-yy-IND FE,B 2 ,n (λ).
Putting everything together, we obtain:

Adv many-yy-IND MIFE,A (λ) ≤ Adv one-yy-IND MIFE,B 1 (λ) + Adv many-yy-IND FE,B 2 ,n (λ).
Lemma 31: Game G 0 to G 1

There exists a PPT adversary B 1 such that

|Adv G 0 (A) -Adv G 1 (A)| ≤ Adv one-yy-IND MIFE,B 1 (λ).
Proof of Lemma 31. In game G 1 , which is described in Figure 4.5, we replace Enc(pk, ek i ,

x j,0 i ) = Enc(pk, ek i , x 1,0 i + (x j,0 i -x 1,0 i )) with Enc(pk, ek i , x 1,1 i + (x j,0 i -x 1,0 i )) for all i ∈ [n], j ∈ [Q i ]
. This is justified by the following properties:

• one-yy-IND security of MIFE;

• the fact Enc ′ is linearly homomorphic. Namely, for all i ∈ [n], given Enc ′ (gpk ′ , ek ′ i , x 1,β i ), x j,0 ix 1,0 i and gpk ′ , we can create a fresh encryption Enc ′ (gpk ′ , ek ′ i , x 1,β i + x j,0 ix 1,0 i ) (corresponding to challenge ciphertexts in slots i in game G β ).

The adversary B 1 proceeds as follows.

-Simulation of pk:

In the adaptive variant, i.e. yy = AD, B receives the set CS ⊆ [n] from A, sends it to its own experiment, receives a public key which it forwards to A.

In the selective variant, i.e. yy = SEL, it receives the challenge

{x j,b i } i∈[n],j∈[Q i ],b∈{0,1}
, and the set CS ⊆ [n] from A. It sends the pair of vectors {x 1,b i } i∈I,b∈{0,1} as its selective challenge to its experiment, where I ⊆ [n] is the set of indices i ∈ [n] for which Q i > 0. It gets back pk, which it forwards to A, and the challenge ciphertexts {ct i } i∈I , where ct i = Enc(pk, ek i , x 1,β 1 ), for β ∈ {0, 1}, when B 1 is interacting with the experiment SEL-

IND MIFE β (1 λ , B 1 ), which is the selective variant of AD-IND MIFE β (1 λ , B 1 ) from Definition 23.
-Simulation of OEnc(i, (x j,0 i , x j,1 i )): In the adaptive variant, if j = 1, that is, it is the first query for slot i ∈ [n], then B 1 queries its own oracle to get ct i := Enc(pk, ek i , x 1,β ), where β ∈ {0, 1}, depending on the experiment B 1 is interacting with. If j > 1, B 1 uses the fact that the single-input inner-product scheme is linearly homomorphic to generate all the remaining ciphertexts ct j i for i ∈ I, j ∈ {2, . . . , Q i } by combining ct i = Enc(pk, ek i ,

x 1,β i ) = Enc ′ (gpk ′ , ek ′ i , x 1,β i z i ) with the vector (x j,0 i -x 1,0 i 0) to obtain Enc ′ (gpk ′ , ek ′ i , x 1,β i + x j,0 i -x 1,0 i z i ) = Enc(ek i , x 1,β i + x j,0 i -x 1,0 i
) which matches the challenge ciphertexts in Game G β . Note that this can be done using gpk ′ . B 1 returns

{ct j i } i∈[n],j∈[Q i ] to A.
In the selective variant, the same thing happens, except queries to OEnc are performed beforehand.

-Simulation of OKeygen(y

1 • • • y n ):
B 1 simply uses its own secret key generation oracle on input y 1 • • • y n and forwards the answer to A.

Finally, B 1 forwards the output α of A to its own experiment. It is clear that for all β ∈ {0, 1}, when B 1 interacts with one-SEL-IND MIFE β , it simulates the game G β to A. Therefore,

Adv one-yy-IND MIFE,B 1 (λ) = Pr one-yy-IND MIFE 0 (1 λ , B 1 ) = 1 -Pr one-yy-IND MIFE 1 (1 λ , B 1 ) = 1 = |Adv G 0 (A) -Adv G 1 (A)|.

Lemma 32: Game G 1 to G 2

There exists a PPT adversary B 2 such that

|Adv G 1 (A) -Adv G 2 (A)| ≤ Adv many-yy-IND FE,B 2 ,n (λ).
Proof of Lemma 32. In Game G 2 , which is described in Figure 4.5, we replace Enc(gpk ′ , ek

′ i , x 1,1 i + (x j,0 i -x 1,0 i ) z i ) with Enc(gpk ′ , ek ′ i , x 1,1 i + (x j,1 i -x 1,1 i ) z i ) = Enc(gpk ′ , ek ′ i , x j,1 i z i ), for all i ∈ [n], j ∈ [Q i ].
This follows from the many-yy-IND security of FE for n instances, which we can use since for each key query y 1 . . . y n and all r, z, we have

x 1,1 i + x j,0 i -x 1,0 i z, y i r = x 1,1 i + x j,1 i -x 1,1 i z, y i r .
The latter is equivalent to x j,0 ix 1,0 i , y i = x j,1 ix 1,1 i , y i , which follows from the restriction imposed by the security game (see Remark 7).

We build a PPT adversary B 2 such that:

|Adv G 1 (A) -Adv G 2 (A)| ≤ Adv many-yy-IND FE,B 1 ,n (λ).
Adversary B 2 proceeds as follows.

First, B 2 samples z i ← Z k p for all i ∈ [n]. Then, it simulates all challenge ciphertexts ct j i using its own encryption oracle on input (i, (x j,0 i

z i , x j,1 i z i ))
. It simulates all decryption keys dk y 1 ••• yn by first sampling r ← R Z k p , and setting d i as the output of its own decryption key oracle on input (i, y i r). It returns

dk y 1 ••• yn := ({[d i ] 2 } i∈[n] , [r] 2 , [ i z i , r ] T ).
Finally, B 2 forwards the outputs α of A to its own experiment. It is clear that for all β ∈ {0, 1}, when B 2 interacts with many-yy-IND MIFE β , it simulates the game G 1+β to A. Therefore,

Adv many-yy-IND FE,B 2 ,n (λ) = Pr many-yy-IND FE 0 (1 λ , 1 n , B 2 ) = 1 -Pr many-yy-IND FE 1 (1 λ , 1 n , B 2 ) = 1 = |Adv G 1 (A) -Adv G 2 (A)|.

Putting everything together

In Figure 4.6 we spell out the details of the scheme in the previous section with a concrete instantiation of the underlying single-input inner-product scheme, whose one-SEL-SIM security is proven under the D k -MDDH assumption, which is provided for completeness in Section 2.6.1.

Setup(1 λ , F m,X,Y n ): PG := (G 1 , G 2 , p, P 1 , P 2 , e) ← R PGGen(1 λ ), A ← R D k (p). For all i ∈ [n]: W i ← R Z m×(k+1) p , V i ← R Z k×(k+1) p , z i ← R Z k p , ek i := (z i , [W i A] 1 , [V i A] 1 ), pk := (PG, [A] 1 ), msk := {W i , V i , z i } i∈[n] . Return (pk, msk, (ek i ) i∈[n] ).
Enc(pk, ek i , x i ):

s i ← R Z k p , return   -As i x i + W i As i z i + V i As i   1 . KeyGen(msk, y 1 • • • y n ): r ← R Z k p . For all i ∈ [n]: d i :=   W ⊤ i y i + V i r y i r   , z := z 1 + • • • + z n , r Return {[d i ] 2 } i∈[n] , [r] 2 , [z] T Dec {[d i ] 2 } i∈[n] , [r] 2 , [z] T , {[c i ] 1 } i∈[n] : [d] T := i e([c i ] ⊤ 1 , [d i ] 2 ) -[z] T Return the discrete log of [d] T .

Game

c i c ′ i c ′′ i d i : z: justification/remark reference G 0,β As i W i c i + x β i V i c i + z i W ⊤ i y i + V ⊤ i r z 1 + . . . + z n , r one-AD-IND-static security game Definition 23 G 1,β As i + u W i c i + x β i V i c i + z i W ⊤ i y i + V ⊤ i r z 1 + . . . + z n , r D k -MDDH in G 1 Lemma 33 G 2,β As i + u W i c i + x β i V i c i W ⊤ i y i + V ⊤ i r -a ⊥ z i , r z 1 + . . . + z n , r inf. theoretic Lemma 34 G 3,β As i + u W i c i + x β i V i c i If i ∈ HS: W ⊤ i y i + V ⊤ i r -a ⊥ z i If i ∈ CS: W ⊤ i y i + V ⊤ i r -a ⊥ z i , r i∈CS z i , r + i∈HS z i D k -MDDH in G 2 Lemma 35 G ⋆ 3,β As i + u W i c i + x β i V i c i If i ∈ HS: W ⊤ i y i + V ⊤ i r -a ⊥ z i If i ∈ CS: W ⊤ i y i + V ⊤ i r -a ⊥ z i , r i∈CS z i , r + i∈HS z i selective variant Lemma 36
i ∈ [n], ([-c i ] 1 , [c ′ i ] 1 , [c ′′ i ] 1 ) is the challenge ciphertext computed by Enc(i, x 0 i , x 1 i ); [d i ] 2 and [z] T are part of the sk y1, ••• yn computed by OKeygen(y 1 • • • y n ). We use u ← R Z k+1 q \ Span(A) and a ⊥ ← R Z k+1 q such that A ⊤ a ⊥ = 0 and u ⊤ a ⊥ = 1.
To analyze the games G 3,β , we consider the selective variant of these games: G ⋆ 3,β . We prove using an information-theoretic argument that G ⋆ 3,0 and G ⋆ 3,1 are identically distributed. Using a guessing argument, we prove the same holds for the adaptive games G 3,0 and G 3,1 . We proceed via a series of games described in Figure 4.8. The transitions are summarized in Figure 4.7. Let A be a PPT adversary, and λ ∈ N be the security parameter. For game G, we define Adv G (A) to be the probability that the game G outputs 1 when interacting with A.

Games G 0,β , G 1,β , G 2,β , G 3,β , G ⋆ 3,β : CS ⊆ [n] ← A(1 λ , F m,X,Y n ), {x b i } i∈HS ← A(1 λ , F m,X,Y n ) PG ← PGGen(1 λ ), A ← R D k (p), pk := (PG, [A] 1 ) u ← R Z k+1 p \ Span(A), a ⊥ ← R Z k+1 p s.t. A ⊤ a ⊥ = 0 and u ⊤ a ⊥ = 1 For all i ∈ [n]: W i ← R Z m×(k+1) p , V i ← R Z k×(k+1) p , z i ← R Z k p , ek i := (z i , [W i A] 1 , [V i A] 1 ), For all i ∈ HS, ct i := OEnc(i, (x 0 i , x 1 i )) α ← A OKeygen(•),OEnc(•,•) pk, {ct i } i∈HS , {ek i } i∈CS Output α. OEnc(i, (x 0 i , x 1 i )): G 0,β , G 1,β , G 2,β ,G 3,β , G ⋆ 3,β If i ∈ HS, return ⊥. s i ← R Z k p ; c i := As i + u , c ′ i := W i c i + x β i c ′′ i := V i c i + z i ; c ′′ i := V i c i . Return   -c i c ′ i c ′′ i   OKeygen(y 1 • • • y n ): G 0,β ,G 1,β , G 2,β , G 3,β ,G ⋆ 3,β r ← R Z k p ; ∀i ∈ HS : z i ← R Z p ∀i ∈ [n] : d i := W ⊤ i y i + V ⊤ i r -a ⊥ z i , r ∀i ∈ HS : d i := W ⊤ i y i + V ⊤ i r -a ⊥ z i z := z 1 + . . . + z n , r ; z := i∈HS z i + i∈CS z i , r Return {[d i ] 2 , } i∈[n] , [r] 2 , [z] T
Games G 0,β , for β ∈ {0, 1}: are such that

Adv one-AD-IND-static MIFE,A (λ) = |Adv G 0,0 -Adv G 0,1 |, according to Definition 23.
Games G 1,β , for β ∈ {0, 1}: we change the distribution of the vectors [c i ] 1 computed by OEnc(i, •, •), for all queried i ∈ [n], using the D k (p)-MDDH assumption. Namely, in Lemma 33, we prove that there exists a PPT adversary B 1,β such that:

Adv G 0,β (A) -Adv G 1,β (A) ≤ Adv D k (p)-mddh G 1 ,B 1,β (λ) + 1 p .
Games G 2,β , for β ∈ {0, 1}: here, for all slots i ∈ [n], we change the way the vectors [c ′′ i ] 1 and [d i ] 2 are computed, respectively, by OEnc(i, •, •) and OKeygen, using an information theoretic argument. The point is to make it possible to simulate the G 2 only knowing [z i ] 2 (and not [z i ] 1 ), which will be useful later, to use the U k (p)-MDDH assumption on [z i ] 2 , in G 2 . Namely, we show in Lemma 34 that

Adv G 1,β (A) = Adv G 2,β (A). Games G 3,β ,
Adv G 2,β (A) -Adv G 3,β (A) ≤ Adv U k -mddh G 2 ,B 3,β (λ) + 1 p -1 .
At this point, we show that Adv G 3,0 (A) = Adv G 3,1 (A) in three steps. First, we consider the selective variant of game G 3,β , called G ⋆ 3,β , where the adversary must commit to its challenge (x 0 i , x 1 i ) i∈HS before receiving pk or making any decryption key queries, where HS ⊆ [n] denotes the set of input slots which are not corrupted. Further encryption queries can be made adaptively for slots i ∈ CS. By a guessing argument, we show in Lemma 36 that there exists PPT adversary A ⋆ such that

Adv G 3,β (A) = (X + 1) 2hm • Adv G ⋆ 3,β (A ⋆ )
, where h denotes the size of HS. Then we prove in Lemma 37 that the game G ⋆ 3,0 is identical to the game G ⋆ 3,1 using a statistical argument, which is only true in the selective setting, and using the restrictions on the queries imposed by the security game. Namely, we show that for all adversaries A ′ :

Adv G ⋆ 3,0 (A ′ ) = Adv G ⋆ 3,1 (A ′ ).
Putting everything together, we obtain:

Adv one-AD-IND-static MIFE,A (λ) ≤ 2 • Adv D k (p)-mddh G 1 ,B 1 (λ) + 2 • Adv U k (p)-mddh G 2 ,B 2 (λ) + 2 p .
Note that the U k (p)-MDDH is implied by D k (p)-MDDH for any matrix distribution D k (p) according to Lemma 3. In particular, it is implied by the well-known k-Lin assumption.

Lemma 33: Game G 0,β to G 1,β

There exists a PPT adversary B 1,β such that:

Adv G 0,β (A) -Adv G 1,β (A) ≤ Adv D k -mddh G 1 ,B 1,β (λ) + 1 p .
Proof of Lemma 33. Here, we switch (

[A] 1 , [As i ] 1 ) computed by OEnc(i, •, •) to ([A] 1 , [As i + u ] 1 ) simultaneously for all queried i ∈ [n], where A ← R D k (p), u ← R Z k+1 p \ Span(A), s i ← R Z k
p . This change is justified by the facts that:

1. The distributions: {s i } i∈ [n] and {s i + s} i∈ [n] , where s ← R Z k p and for all i ∈ [n], s i ← R Z k p , are identically distributed.

By the D k -MDDH assumption, we can switch ([

A] 1 , [As] 1 ) to ([A] 1 , [u] 1 ), where A ← R D k , s ← R Z k p ,
Adv G 0,β (A) -Adv G 1,β (A) ≤ Adv D k (p)-mddh G 1 ,B 1,β (λ) + 1 p .
Now we describe the adversary B 1,β . Upon receiving an MDDH challenge (PG,

[A] 1 , [h] 1 ), B 1 picks W i ← R Z m×(k+1) p , V i ← R Z k×(k+1) p
, and

z i ← R Z k p for all i ∈ [n]
, thanks to which it can compute and send (pk, {ek i } i∈CS ) to A, and simulate the oracle OKeygen, as described in Figure 4.8. To simulate OEnc(i,

•, •), B 1,β picks s i ← R Z k p , sets [c i ] 1 := [A] 1 s i + [h] 1 ,

and computes the rest of the challenge ciphertext from [c

i ] 1 . Note that when [h] 1 is a real MDDH challenge, this simulates game G 0,β , whereas it simulates G 1,β when [h] 1 is uniformly random over G k+1 1 (within 1 p statistical distance). Lemma 34: Game G 1,β to G 2,β Adv G 1,β (A) = Adv G 2,β (A).
Proof of Lemma 34. We argue that games G 1,β and G 2,β are the same, using the fact that for all A ∈ Z (k+1)×k p , u ∈ Z k+1 p \ Span(A), and all a ⊥ ∈ Z k+1 p such that A ⊤ a ⊥ = 0 and (a ⊥ ) ⊤ u = 1, the following distributions are identical:

{V i , z i } i∈[n] and {V i -z i (a ⊥ ) ⊤ , z i } i∈[n] ,
where for all i ∈

[n], V i ← R Z k×(k+1) p
, and z i ← R Z k p . This is the case because the matrices V i are picked uniformly, independently of the vectors z i . This way, we obtain

d i := W ⊤ i y i + V ⊤ i -a ⊥ z ⊤ i r = W ⊤ i y i + V ⊤ i r -a ⊥ z ⊤ i r and [c ′′ i ] 1 := V i -z i (a ⊥ ) ⊤ As i + u 1 + [z i ] 1 = V i As i + u 1 -z i (a ⊥ ) ⊤ u 1 + [z i ] 1 = V i As i + u 1
where we use the fact that (a ⊥ ) ⊤ u = 1 is the last equality, and the fact that A ⊤ a ⊥ = 0 in the penultimate equality. This corresponds to game G 2,β .

Lemma 35: Game G 2,β to G 3,β

There exists a PPT adversary B 3,β such that:

Adv G 2,β (A) -Adv G 3,β (A) ≤ Adv U k (p)-mddh G 2 ,B 3,β (λ) + 1 p -1 .
Proof of Lemma 35. Here, we switch

{[r] 2 , [ z i , r ] 2 } i∈HS used by OKeygen to {[r] 2 , [ z i ] 2 } i∈HS , where for all i ∈ [n], z i ← R Z k p , z 1 , . . . , z n ← R Z p and r ← R Z k p . This is justified by the fact that {[r] 2 , [ z i , r ] 2 } i∈HS is identically distributed to [Ur] 2 where U ← R U k+h,k
, where h denotes the size of HS (wlog. we assume that the upper k rows of U are full rank), which is indistinguishable from a uniformly random vector over G k+h 2 , that is, of the form:

{[r] 2 , [ z i ] 2 } i∈HS ,
according to the U k+h,k (p)-MDDH assumption. To do the switch simultaneously for all calls to OKeygen, that is, to switch

{[r j ] 2 , [ z i , r j ] 2 } i∈HS,j∈[Q 0 ] to {[r j ] 2 , [ z j i ] 2 } i∈HS,j∈[Q 0 ]
, where Q 0 denotes the number of calls to OKeygen, and for all j ∈ [Q 0 ], r j ← R Z k p , and z j i ← R Z p for all i ∈ HS, we use the Q 0 -fold U k+h,k (p)-MDDH assumption. Namely, we build a PPT adversary B ′ 3,β such that:

Adv G 2,β (A) -Adv G 3,β (A) ≤ Adv Q 0 -U k+h,k (p)-mddh G 2 ,B ′ 3,β (λ).
This, together with Lemma 3 (U k (p)-MDDH ⇒ Q 0 -fold U k+h,k (p)-MDDH), implies the lemma. Adversary B ′ 3,β proceeds as follows.

-Simulation of (pk,

{ek i } i∈CS ): Upon receiving an Q 0 -fold U k+h,k (p)-MDDH challenge PG, [U] 2 ∈ G (k+h)×k 2 , h 1 • • • h Q 0 2 ∈ G (k+n)×Q 0 2 , B ′ 3,β samples A ← R D k (p), u ← R Z k+1 p \ Span(A), a ⊥ ← R Z k+1 p s.t. A ⊤ a ⊥ = 0 and u ⊤ a ⊥ = 1, for all i ∈ [n]: W i ← R Z m×(k+1) p , V i ← R Z k×(k+1) p
. For all i ∈ CS:

z i ← R Z k p . It returns pk := (PG, [A] 1 ), {ek i := (z i , [W i A] 1 , [V i A] 1 )} i∈CS ) to A.
-Simulation of Enc(i, x 0 i , x 1 i ):

B ′ 3,β picks s i ← R Z k p , computes [c i ] 1 := [As i ] 1 + [u] 1 , [c ′ i ] := W i [c i ] 1 + [x β i ] 1 , [c ′′ i ] 1 := V i [c i ] 1 ,
and returns

   -c i c ′ i c ′′ i    1 to A. -Simulation of OKeygen(y 1 • • • y n ):
On the j'th query

y 1 • • • y n , B ′ 3,β sets [r] 2 := [h j ] 2
, where h j ∈ Z k p denotes the k-upper components of h j ∈ Z k+h p (recall that h denotes the size of HS). For each i ∈ HS, it uses one of the h lowest components of h j , call it h j i (a different one is used for each i ∈ HS), to compute

[d i ] 2 := [W ⊤ i y i ] 2 + V ⊤ i [h j ] 2 -a ⊥ [h j i ] 2 . For each i ∈ CS, it computes [d i ] 2 := [W ⊤ i y i ] 2 + V ⊤ i [h j ] 2 -a ⊥ [ z i , h j ] 2 . Note that when h 1 • • • h Q 0 2 is a real MDDH challenge, B ′ 3,β simulate the game G 2,β , whereas it simulates G 3,β when h 1 • • • h Q 0 2 is uniformly random over G (k+h)×Q 0 2 . Lemma 36: Game G 3,β to G ⋆ 3,β
There exists a PPT adversary A ⋆ such that:

Adv G 3,β (A) = (X + 1) 2hm • Adv G ⋆ 3,β (A ⋆ )
, where h denotes the size of HS ⊆ [n], the set of honest input slots.

Proof of Lemma 36. Upon receiving a set CS ⊆ [n] from A, A ⋆ guesses the challenge by picking random:

(z 0 i , z 1 i ) i∈HS ← R [0, X] 2hm
, which it sends, together with CS, to the game G ⋆ 3,β , which is a selective variant of game G 3,β . Then it receives a public key pk and ciphertexts {ct i } i∈HS . Whenever A queries OKeygen, A ⋆ forwards the query to its own oracle, and gives back the answer to A. When A calls OEnc(i, x 0 i , x 1 i ), if i ∈ CS, then A ⋆ queries its own encryption oracle on (i, x 0 i , x 1 i ) and forwards the answer to A. If i ∈ HS, then A ⋆ verifies its guess was correct, that is, whether (x 0 i ,

x 1 i ) = (z 0 i , z 1 i ).
If the guess is incorrect, A ⋆ ends the simulation, and sends α := 0 to the game G ⋆ 3,β . Otherwise, it returns ct i to A, and keeps answering A's queries as explained. Finally (if it didn't end the simulation before the end), it forwards A's output α to the game G ⋆ 3,β . When A ⋆ guesses correctly, it simulates A's view perfectly. When it fails to guess, it outputs α := 0. Thus, the probability that

A ⋆ outputs 1 in G ⋆ 3,β is exactly (X +1) -2hm •Adv G 3,β (A).
Lemma 37: Game G ⋆ 3,0 to G ⋆

3,1

For all adversaries A ′ , we have:

Adv G ⋆ 3,0 (A ′ ) = Adv G ⋆ 3,1 (A ′ ).
Proof of Lemma 37. We show that game G ⋆ 3,0 and G ⋆ 3,1 are perfectly indistinguishable, using an information theoretic argument that crucially relies on the fact that these games are selective, and using the restrictions on the oracle queries imposed by the security game.

This proof is similar to the proof of Lemma 30 for the one-SEL-IND-static security of the MIFE in Figure 4.1.

Namely, We show that G ⋆ 3,β does not depend on β, using the fact that for all

y 1 • • • y n ∈ (Z m p ) n , for all {x b i ∈ [0, X] m } i∈HS,b∈{0,1}
, the following are identically distributed:

{W i , z i } i∈HS and {W i -x β i (a ⊥ ) ⊤ , z i -x β i , y i } i∈HS ,
where z i ← R Z p for all i ∈ HS, and

a ⊥ ← R Z k+1 p such that A ⊤ a ⊥ = 0 and u ⊤ a ⊥ = 1. For each query y 1 • • • y n , OKeygen(msk, y 1 • • • y n ) picks values z i ← R Z p and W i ← R Z m×(k+1) p for i ∈ HS that are independent of y 1 • • • y n and the challenge {x b i ∈ [0, X] m } i∈HS,b∈{0
,1} (note that here we crucially rely on the fact the games G ⋆ 3,0 and G ⋆ 3,1 are selective here), therefore, using the previous fact, we can switch z i to z ix β i , y i and W i to W ix β i (a ⊥ ) ⊤ , for all i ∈ HS, without changing the distribution of the game. This way, for all i ∈ HS, OEnc(i, x 0 i , x 1 i ) computes:

c ′ i := (W i -x β i (a ⊥ ) ⊤ )c i + x β i = (W i -x β i (a ⊥ ) ⊤ )(As i + u) + x β i = W i c i ,
using the facts that A ⊤ a ⊥ = 0 and u ⊤ a ⊥ = 1. That is, OEnc(i, x 0 i , x 1 i ) is independent of β, for all i ∈ HS. Moreover, for all i ∈ CS ∩ I, by definition of the security game, we have

x 0 i = x 1 i . Thus, OEnc(i, x 0 i , x 1 i ) is independent of β, for all i ∈ [n]. Note that, for all i ∈ HS, OKeygen(msk, y 1 • • • y n ) computes d i := (W i -x β i (a ⊥ ) ⊤ ) ⊤ y i + V ⊤ i r -a ⊥ z i + x β i , y i = W ⊤ i y i + V ⊤ i r -a ⊥ z i ,
which does not depend on β. Finally, OKeygen also computes:

z := i∈CS z i , r + i∈HS z i -i∈HS x β i , y i .
Finally, by definition of the security game, we have: i∈HS x 0 i , y i = i∈HS x 1 i , y i , by taking x 0 i = x 1 i = 0 for all i ∈ CS in Condition 1 from Definition 23. Thus, G ⋆ 3,β is independent of β.

Remark 12: On adaptive security

To achieve adaptive security, we split the selective, computational argument used for the proof of Theorem 9, in two steps: first, we use an adaptive, computational argument, that does not involve the challenges {x b i } i∈[n],b{0,1} (this corresponds to the transition from game G 0,β to G 3,β ). Then, we prove security of game G 3,β , using a selective argument, which involves the challenges {x b i } i∈[n],b{0,1} , but relies on perfect indistinguishability. That is, we prove that G 3,β is perfectly secure, by first proving the perfect security of its selective variant, G ⋆ 3,β , and using a guessing argument to obtain security of the adaptive game G 3,β . Guessing incurs an exponential security loss, which we can afford, since it is multiplied by a zero term. The proof of Theorem 9 essentially does the two steps at once, which prevents using the same guessing argument (since in that case, the exponential term would be multiplied by the computational advantage).

Chapter 5

Multi-Input Inner-Product Functional Encryption without Pairings

Overview of our construction.

In this chapter we give a (private-key) MIFE scheme for inner products based on a variety of assumptions, notably without the need of bilinear maps, and where decryption works efficiently, even for messages of super-polynomial size. We achieve this result by proposing a generic construction of MIFE from any single-input FE (for inner products) in which the encryption algorithm is linearly-homomorphic. Our transformation is surprisingly simple, general and efficient. In particular, it does not require pairings (as in the case of the multi-input innerproduct FE from [AGRW17], presented in Chapter 4), and it can be instantiated with all known single-input functional encryption schemes (e.g., [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF][START_REF] Abdalla | Better security for functional encryption for inner product evaluations[END_REF][START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF]). This allows us to obtain new MIFE for inner products from plain DDH, composite residuosity, and LWE. Beyond the obvious advantage of enlarging the set of assumptions on which MIFE can be based, this result yields schemes that can be used with a much larger message space. Indeed, dropping the bilinear groups requirement allows us to employ schemes where the decryption time is polynomial, rather than exponential, in the message bit size. From a more theoretical perspective, our results also show that, contrary to what was previously conjectured [AGRW17], MIFE for inner product does not need any (qualitatively) stronger assumption than their single-input counterpart.

This result has been published in [ACF + 18]. The novelty in this thesis is that security is guaranteed even when some encryption keys are corrupted. Namely, each user i ∈ [n] receives a (private) encryption key ek i . Even a collusion of ek i for some malicious users i cannot break security for the encryption of other slots. This property is obtained without modifying the scheme from [ACF + 18], but requires a novel security proof. It is desirable for practical use case of MIFE to assume no particular trust between different users, since the setting already assumes these users do not cooperate or communicate while performing encryption (this would corresponds to the single-input setting).

Our solution, in more detail. Informally, the scheme from the previous chapter builds upon a two-step decryption blueprint. The ciphertexts ct 1 = Enc(x 1 ), . . . , ct n = Enc(x n ) (corresponding to slots 1, . . . , n) are all created using different instances of a single-input FE. Decryption is performed in two stages. One first decrypts each single ct i separately using the secret key dk y i of the underlying single-input FE, and then the outputs of these decryptions are added up to get the final result.

The main technical challenge of this approach is that the stage one of the above decryption algorithm leaks information on each partial inner product x i , y i . To avoid this leakage, their idea is to let source i encrypt its plaintext vector x i augmented with some fixed (random) value u i , which is part of the secret key. Moreover, dk y i are built by running the single-input FE key generation algorithm on input y i ||r, i.e., the vector y i augmented with fresh randomness r. By these modifications, and skipping many technical details, stage-one decryption then consists of using pairings to compute, in G T , the values [ x i , y i + u i r] T for every slot i. From these quantities, the result [ x, y ] T is obtained as

n i=1 [ x i , y i + u i r] T -[ n i=1 u i r] T which can be easily computed if [ n i=1 u i r]
T is included in the secret key. Intuitively, the scheme is secure as the quantities [u i r] T are all pseudo-random (under the DDH assumption) and thus hide all the partial information [ x i , y i + u i r] T may leak. Notice that, in order for this argument to go through, it is crucial that the quantities [ x i , y i + u i r] T are all encoded in the exponent, and thus decoding is possible only for small norm exponents. Furthermore, this technique seems to inherently require pairings, as both u i and r have to remain hidden while allowing to compute an encoding of their product at decryption time. This is why the possibility of a scheme without pairings was considered as "quite surprising" in [AGRW17].

We overcome these difficulties via a new FE to MIFE transform, which manages to avoid leakage in a much simpler and efficient way. Our transformation works in two steps. First, we consider a simplified scheme where only one ciphertext query is allowed and messages live in the ring Z L , for some integer L. In this setting, we build the following multi-input scheme. For each slot i the (master) secret key for slot i consists of one random vector u i ∈ Z m L . Encrypting x i merely consists in computing c i = x i + u i mod L. The secret key for function y = (y 1 . . . y n ), is just z y = n i=1 u i , y i mod L. To decrypt, one computes

x, y mod L = (c 1 , . . . , c n ), yz y mod L Security comes from the fact that, if only one ciphertext query is allowed, the above can be seen as the functional encryption equivalent of the one-time pad1 . Next, to guarantee security in the more challenging setting where many ciphertext queries are allowed, we just add a layer of (functional) encryption on top of the above one-time encryption. More specifically, we encrypt each c i using a FE (supporting inner products) that is both linearly homomorphic and whose message space is compatible with L. So, given ciphertexts {ct i = Enc(c i )} and secret key dk y = ({dk y i } i , z y ), one can first obtain { c i , y i = Dec(ct i , dk y i )}, and then extract the result as x, y = n i=1 c i , y iu, y . Our transformation actually comes in two flavors: the first one addresses the case where the underlying FE computes inner products over some finite ring Z L ; the second one instead considers FE schemes that compute bounded-norm inner products over the integers. In both cases the transformations are generic enough to be instantiated with known single-input FE schemes for inner products. This gives us new MIFE relying on plain DDH [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF], LWE [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] and Decisional Composite Residuosity [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF][START_REF] Abdalla | Better security for functional encryption for inner product evaluations[END_REF]. Moreover, the proposed transform is security-preserving in the sense that, if the underlying FE achieves adaptive security, so does our resulting MIFE.

From Single to Multi-Input FE for Inner Product

In this section, we give a generic construction of MIFE for inner product from any single-input FE for the same functionality. More precisely, we show two transformations: the first one addresses FE schemes that compute the inner product functionality over a finite ring Z L for some integer L, while the second transformation addresses FE schemes for bounded-norm inner product. The two transformations are almost the same, and the only difference is that in the case of bounded-norm inner product, we require additional structural properties on the singleinput FE. Yet we stress that these properties are satisfied by all existing constructions. Both our constructions rely on a simple MIFE scheme that is one-AD-IND secure unconditionally. In particular, our constructions show how to use single-input FE in order to bootstrap the information-theoretic MIFE from one-time to many-time security.

Setup ot (1 λ , F m,L n ): For all i ∈ [n], u i ← R Z m L , ek i := u i , pk = L, msk := {u i } i∈[n] Return (pk, msk, (ek i ) i∈[n] ). Enc ot (pk, ek i , x i ): Return x i + u i mod L. KeyGen ot (pk, msk, (y 1 • • • y n )): z := i∈[n] u i , y i mod L Return dk y1 ••• yn := (y 1 • • • y n , z). Dec ot pk, dk y1 ••• yn , ct 1 , . . . , ct n ): Parse dk y1 ••• yn := (y 1 • • • y n , z). Return n i=1 ct i , y i -z mod L

Information-Theoretic MIFE with One-Time Security

Here we present the multi-input scheme MIFE ot for inner product over Z L , that is, for the set of functionalities {F m,L n

} n∈N defined as F m,L n : K n × X 1 × • • • × X n → Z, with K n := Z nm , for all i ∈ [n], X i := Z m , Z := Z L , such that for any (y 1 • • • y n ) ∈ K n , x i ∈ X i , we have: F m,L n (y 1 • • • y n ), x 1 , . . . , x n = n i=1 x i , y i mod L.
We prove its one-AD-IND security. The scheme is described in Figure 5.1.

Theorem 12: one-AD-IND security

The MIFE described in Figure 5.1 is one-AD-IND-weak secure. Namely, for any adversary A, Adv one-AD-IND-weak

MIFE ot ,A (λ) = 0.
Proof of Theorem 12. Let A be an adversary against the one-AD-IND security of the MIFE. First, we use a guessing argument to build an adversary B such that:

Adv one-AD-IND-weak MIFE,A (λ) ≤ 2 -n • L -2mn • Adv one-SEL-IND-weak-static MIFE,B (λ). First, B samples CS ⊆ [n] uniformly at random among all subset of [n]. We denote HS := [n] \ CS. Then, for all i ∈ HS, it samples (z 1 i , z 0 i ) ← R Z 2m
L , which is a guess of the challenge ciphertexts. Then, B sends CS, {z b i } i∈HS,b∈{0,1} to its own experiment, upon which it receives (pk, {ek i } i∈CS {ct i } i∈HS ), where for all i ∈ HS, ct i := Enc(pk, ek i , z β i ), where β ∈ {0, 1} corresponds to the experiment one-SEL-IND β (1 λ , A) the adversary B is interacting with. It sends pk to A. For every query to OKeygen, B queries its own decryption key oracle oracle on the same input, and returns the answer to A. For every query i ∈ [n] of A to OCorrupt, B verifies its guess was correct, namely, that i ∈ CS. If not, B ends the simulation and returns α = 0 to its experiment. For every query (i, x 0 i , x 1 i ) to OEnc, B verifies its guess is correct, namely, whether (i ∈ CS and

x 0 i = x 1 i ), or (x 0 i , x 1 i ) = (z 0 i , z 1 i ).
If it is not the case, B ends the simulation, and returns α = 0 to its own experiment. If this is case, B does the following: if i ∈ CS, then it returns Enc(pk, ek i , x 0 i ) to A (note that it can do so since it knows ek i for all i ∈ CS); if i / ∈ CS, it returns ct i to A. Finally (if the simulation didn't end before), B forwards A's output α to its experiment. When B's guess is correct, then it simulates A's view perfectly. The guess is correct with probability at least 2 -n • L -2mn . When the guess is incorrect, then B returns α = 0 to its experiment. Thus, we obtain Adv one-AD-IND-weak

MIFE,A (λ) ≤ 2 -n • L -2mn • Adv one-SEL-IND-weak-static MIFE,B (λ)
. It remains to prove that the MIFE presented in Figure 5.1 satisfies perfect one-SEL-IND security, under static corruptions. Namely, for any adversary B,

Adv one-SEL-IND-weak-static MIFE,B (λ) = 0.
To do so, we introduce hybrid games H β (1 λ , B) described in Figure 5.2. We prove that for all β ∈ {0, 1}, H β (1 λ , B) is identical to the experiment one-SEL-IND-weak-static MIFE β (1 λ , B) (this game is defined as many-AD-MIFE β (1 λ , B) from Definition 23, with the one, SEL, weak, and static restrictions). This can be seen using the fact that for all {x β i ∈ Z m } i∈HS , where HS := [n] \ CS, the following distributions are identical: {u i mod L} i∈HS and {u i -

x β i mod L} i∈HS , with u i ← R Z m L .
Note that the independence of the x β i from the u i is only true in the selective security game. We denote by I ⊆ [n] the set of input slots that is queried by the adversary. We use the fact that for all i ∈ I ∩ CS, it must be that x 0 i = x 1 i . This is implied by the definition of the security game, and the fact that HS ⊆ I, that is, every honest slot is queried by the adversary, since we are only proving one-SEL-IND-weak-static security. Finally, we show that B's view in H β (1 λ , B) is independent of β. Indeed, the only information about β that leaks in this experiment is i∈HS x β i , y i . Moreover, by definition of the security game, we have i∈HS x 0 i , y i = i∈HS x 1 i , y i (this follows by taking

x 0 i = x 1 i = 0 for all i ∈ CS in Condition 1 from Definition 23). H β (1 λ , B): CS, {x b i } i∈I⊆[n],b∈{0,1} ← B(1 λ , F m,L n ) For all i ∈ [n]: u i ← R Z m L For all i ∈ CS, ek i := u i . For all i ∈ HS, ct i := u i . For all i ∈ I ∩ CS: ct i := u i + x 0 i α ← B OKeygen(•),OCorrupt(•) (pk, {ek i } i∈CS , {ct i } i∈I ) Output α OKeygen(y): Return i∈[n] u i , y i -i∈HS x β i , y i mod L Figure 5
.2: Experiments for the proof of Theorem 12. Note that HS ⊆ I, where I denotes the set of input slots that are queried by A.

Remark 13: Linear homomorphism

We use the fact that Enc ot is linearly homomorphic, that is, for all

i ∈ [n], x i , x ′ i ∈ Z m , Enc ot (pk, ek i , x i ) + x ′ i mod L = Enc ot (pk, ek i , x i + x ′ i ), with probability 1 over the choice of (pk, (ek i ) i∈[n] ) ← Setup ot (1 λ , F m,L n
). This property will be used when using the one-time scheme MIFE ot from Figure 5.1 as a building block to obtain a full-fledged many-AD-IND MIFE.

Our Transformation for Inner Product over Z L

We present our multi-input scheme MIFE for the class F m,L n in Figure 5.3. The construction relies on the one-time scheme MIFE ot of Figure 5.1, and any single-input, public-key FE for the functionality F m,L IP : K × X → Z, with K := Z m , X := Z m , Z := Z L , such that for any y ∈ K, x ∈ X , we have:

F m,L IP (y, x) = x, y mod L. Setup(1 λ , F m,L n ): (pk ot , msk ot , {ek ot i } i∈[n] ) ← Setup ot (1 λ , F m,L n ), gpk ′ ← GSetup ′ (1 λ , F m,L IP ). For all i ∈ [n], ek ′ i , msk ′ i ← Setup ′ (1 λ , gpk ′ , F m,L IP ) pk := pk ot , gpk ′ , {ek ′ i } i∈[n] , msk := msk ot , {msk ′ i } i∈[n] , for all i ∈ [n], ek i := (ek ot i , ek ′ i ) Return pk, msk{ek i } i∈[n]
Enc(pk, ek i , x i ): Correctness of MIFE follows from the correctness properties of the single-input scheme FE and the multi-input scheme MIFE ot . Indeed, correctness of the former implies that, for all i ∈ [n], d i = w i , y i mod L, while correctness of MIFE ot implies that i∈ [n]

w i := Enc ot (pk ot , ek ot i , x i ) Return Enc ′ (gpk ′ , ek ′ i , w i ) KeyGen(msk, y 1 • • • y n ): For all i ∈ [n], dk ′ i ← KeyGen ′ (gpk ′ , msk ′ i , y i ), z := KeyGen ot (pk ot , msk ot , y 1 • • • y n ) dk y1 ••• yn := {dk ′ i } i∈[n] , z Return dk y1 ••• yn Dec pk, dk y1 ••• yn , ct 1 , . . . , ct n ): Parse dk y1 ••• yn := ({dk ′ i } i∈[n] , z). For all i ∈ [n], d i := Dec ′ (gpk ′ , dk ′ i , ct i ) Return i∈[n] d i -z mod L
d i -z = Dec ot (z, w 1 , . . . , w n ) = i∈[n] x i , y i mod L.

Theorem 13: many-AD-IND security

If FE is many-AD-IND secure, and MIFE ot is one-AD-IND-weak secure, then MIFE described in Figure 5.3 is many-AD-IND-secure.

Since the proof of the above theorem is almost the same as the one for the case of boundednorm inner product, we only provide an overview here, and defer to the proof of Theorem 14 for further details.

Proof overview. First, we use Theorem 2 which prove that many-AD-IND security follows from many-AD-IND-weak and many-AD-IND-zero of MIFE, using an extra layer of symmetric encryption on top of the decryption keys (see Figure 2.1). The many-AD-IND-zero of MIFE follows directly from the many-AD-IND security of FE for n instances (which is implied by many-AD-IND security of FE for one instance, see Lemma 5). Thus, it remains to prove many-AD-IND-weak security of MIFE.

To do so, we first switch encryptions of x 1,0 1 , . . . , x 1,0 n to those of x 1,1 1 , . . . , x 1,1 n , using the one-AD-IND security of MIFE ot . For the remaining ciphertexts, we switch from an encryption of x j,0 i = (x j,0 ix 1,0 i ) + x 1,0 i to that of (x j,0 ix 1,0 i ) + x 1,1 i . In this step we use the fact that one can compute an encryption of Enc ot (u, i, (x j,0 ix 1,0 i ) + x 1,0 i ) from an encryption Enc ot (u, i, x 1,0 i ), because the encryption algorithm Enc ot of MIFE ot is linearly homomorphic (see Remark 13). Finally, we use the many-AD-IND security of FE for n instance (which is implied by many-AD-IND security of FE for one instance, see Lemma 5) to switch encryptions of

(x 2,0 i -x 1,0 i ) + x 1,1 i , . . . , (x Q i ,0 i -x 1,0 i ) + x 1,1 i to those of (x 2,1 i -x 1,1 i ) + x 1,1 i , . . . , (x Q i ,1 i -x 1,1 i ) + x 1,1 i .
Instantiations. The construction in Figure 5.3 can be instantiated using the single-input public-key FE schemes from [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] that are many-AD-IND-secure and allow for computing inner products over a finite ring. Specifically, we obtain:

• A MIFE for inner product over Z p for a prime p, based on the LWE assumption. This is obtained using the LWE-based scheme of We note that since both these schemes in [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] have a stateful key generation, our MIFE inherits this stateful property. Stateless MIFE instantiations are obtained from the transformation in the next section.

Our Transformation for Inner Product over Z

Here we present our transformation for the case of bounded-norm inner product. In particular, in Figure 5.4 we present a multi-input scheme MIFE for the set of functionalities {F m,X,Y n

} n∈N defined as F m,X,Y n : K n × X 1 × • • • × X n → Z, with K n := [0, Y ] mn , for all i ∈ [n], X i := [0, X] m , Z := Z, such that for any (y 1 • • • y n ) ∈ K n , x i ∈ X i , we have: F m,X,Y n (y 1 • • • y n ), x 1 , . . . , x n = n i=1 x i , y i .
Our transformation builds upon the one-time scheme MIFE ot of Figure 5.1, and a single-input, public-key scheme FE for the class F m,3X,Y IP . 2 We require FE to satisfy two properties. The first one, that we call two-step decryption, intuitively says that the FE decryption algorithm works in two steps: the first step uses the decryption key to output an encoding of the result, while the second step returns the actual result x, y provided that the bounds x ∞ < X, y ∞ < Y hold. The second property informally says that the FE encryption algorithm is additively homomorphic.

We note that the two-step property also says that the encryption algorithm accepts inputs x such that x ∞ > X, yet correctness is guaranteed as long as the encrypted inputs are within the bound at the moment of invoking the second step of decryption. Two-step decryption is formally defined as follows.

Property 1: Two-step decryption

An FE scheme FE = (GSetup, Setup, Enc, KeyGen, Dec) satisfies two-step decryption if it admits PPT algorithms GSetup ⋆ , Dec 1 , Dec 2 and an encoding function E such that:

1. For all λ, m, n, X, Y ∈ N, GSetup ⋆ (1 λ , F m,X,Y IP , 1 n ) outputs gpk which includes a 2
The reason why we need 3X instead of X is due to maintain a correct distribution of the inputs in the security proof.

bound B ∈ N, and the description of a group G (with group law

•) of order L > n • m • X • Y , which defines the encoding function E : Z L × Z → G. 2. For all gpk ← GSetup ⋆ (1 λ , F m,X,Y IP , 1 n ), (ek, msk) ← Setup(1 λ , gpk, F m,X,Y IP ), x ∈ Z m , ct x ← Enc(gpk, ek, x), y ∈ Z m ,
and dk y ← KeyGen(gpk, msk, y), we have Dec 1 (gpk, ct x , dk y ) = E( x, y mod L, noise), for some noise ∈ N that depends on ct x and dk y . Furthermore, it holds that for all x, y ∈ Z m , Pr[noise < B] = 1negl(λ), where the probability is taken over the random coins of GSetup ⋆ , Setup, Enc and KeyGen. Note that there is no restriction on the magnitude of x, y here, and we are assuming that Enc accepts inputs x whose norm may be larger than the bound.

3. Given any γ ∈ Z L , and gpk, one can efficiently compute E(γ, 0). 4. The encoding E is linear, that is: for all γ, γ ′ ∈ Z L , , noise, noise ′ ∈ Z, we have

E(γ, noise) • E(γ ′ , noise ′ ) = E(γ + γ ′ mod L, noise + noise ′ ). 5. For all γ < n • m • X • Y , and noise < n • B, Dec 2 gpk, E(γ, noise) = γ.
The second property is as follows.

Property 2: Linear encryption

For any FE scheme FE = (GSetup, Setup, Enc, KeyGen, Dec) satisfying the two-step property, we define the following additional property. There exists a deterministic algorithm Add that takes as input a ciphertext and a message, such that for all x, x ′ ∈ Z m , the following are identically distributed: Add(Enc(gpk, ek, x), x ′ ), and Enc gpk, ek, (x + x ′ mod L) ,

where gpk ← GSetup ⋆ (1 λ , F m,X,Y IP ), (ek, msk) ← Setup(1 λ , gpk, F m,X,Y

IP

). Note that the value L ∈ N is defined as part of the output of the algorithm Setup ⋆ (see the two-step property above). We later use a single input FE with this property as a building block for a multi-input FE (see Figure 5.4); this property however is only used in the security proof of our transformation.

Instantiations.

It is not hard to check that these two properties are satisfied by known functional encryption schemes for (bounded-norm) inner product. In particular, in Section 5.2, we show that this is satisfied by the many-AD-IND secure FE schemes from [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF]. This allows us to obtain MIFE schemes for bounded-norm inner product based on a variety of assumptions such as plain DDH, Decisional Composite Residuosity, and LWE. In addition to obtaining the first schemes without the need of pairing groups, we also obtain schemes where decryption works efficiently even for large outputs. This stands in contrast to the previous result in the previous chapter, where decryption requires to extract discrete logarithms.

Correctness. The correctness of the scheme MIFE follows from (i) the correctness and Property 1 (two-step decryption) of the single-input scheme, and (ii) from the correctness of MIFE ot and the linear property of its decryption algorithm Dec ot .

More precisely, consider any vector

x := (x 1 • • • x n ) ∈ (Z m ) n , y ∈ Z mn , such that x ∞ < X, y ∞ < Y , and let (pk, msk, {ek i } i∈[n] ) ← Setup(1 λ , F m,X,Y IP ), dk y ← KeyGen(pk, msk, y), Setup(1 λ , F m,X,Y n ): pk ot , msk ot , {ek ot i } i∈[n] ← Setup ot (1 λ , F m,X,Y n ), gpk ′ ← GSetup ⋆ (1 λ , F m,3X,Y IP , 1 n ), for all i ∈ [n], ek ′ i , msk ′ i ← Setup ′ (1 λ , F m,3X,Y 1 , 1 n ), ek i := ek ot i pk := (gpk, {ek ′ i } i∈[n] ), msk := msk ot , {msk ′ i } i∈[n] , Return pk, msk, {ek i } i∈[n]
Enc(pk, ek i , x i ):

w i := Enc ot (pk ot , ek ot i , x i ) Return Enc ′ (gpk ′ , ek ′ i , w i ) KeyGen(pk, msk, y 1 • • • y n ): For all i ∈ [n], dk ′ i ← KeyGen ′ (gpk ′ , msk ′ i , y i ), z ← KeyGen ot (pk ot , msk ot , y 1 • • • y n ) dk y1 ••• yn := {dk ′ i } i∈[n] , z Return dk y1 ••• yn Dec(dk y1 ••• yn , ct 1 , . . . , ct n ): Parse dk y1 ••• yn := ({dk ′ i } i∈[n] , z). For all i ∈ [n], E( x i + u i , y i mod L, noise i ) ← Dec 1 (dk ′ i , ct i ) Return Dec 2 E( x 1 + u 1 , y 1 mod L, noise 1 ) • • • • • E( x n + u n , y n mod L, noise n ) • E(-z, 0)
and ct i ← Enc(pk, ek i , x i ) for all i ∈ [n].
By (2) of Property 1, the decryption algorithm Dec(dk

y , ct 1 , . . . , ct n ) computes E( w i , y i mod L, noise i ) ← Dec 1 (dk ′ i , ct i )
where for all i ∈ [n], noise i < B, with probability 1negl(λ). By (4) of Property 1 (linearity of E), and the correctness of MIFE ot we have:

E( w 1 , y 1 mod L, noise 1 ) • • • • • E( w n , y n mod L, noise n ) • E(-z, 0) = E   Dec ot (z, w 1 , . . . , w n ), i∈[n] noise i   = E   x, y mod L, i∈[n] noise i   . Since x, y < n • m • X • Y < L and i∈[n] noise i < n • B, we have Dec 2 E( x, y mod L, i∈[n] noise i ) = x, y , by (5) of Property 1.

Proof of Security.

In the following theorem we show that our construction is a many-AD-IND-secure MIFE, assuming that the underlying single-input FE scheme is many-AD-INDsecure, and the scheme MIFE ot is one-AD-IND secure.

Theorem 14: many-AD-IND security

Assume that the single-input FE: FE, is many-AD-IND secure and the multi-input FE MIFE ot is one-AD-IND-weak secure. Then the multi-input FE MIFE in Figure 5.4 is many-AD-IND secure.

Proof of Theorem 14. Using Theorem 2, it is sufficient to prove many-AD-IND-zero (i.e. the scheme is secure when no decryption keys are queried), and many-AD-IND-weak i.e. we assume

Game ct j i justification/remark G 0 Enc(pk, ek i , x j,0 i -x 1,0 i + x 1,0 i ) many-AD-IND-weak MIF E 0 (A, 1 λ ) security game G 1 Enc(pk, ek i , x j,0 i -x 1,0 i + x 1,1 i ) one-AD-IND-weak security of MIFE ot , Lemma 33
G 2 Enc(pk, ek i , x j,1 i ) many-AD-IND security of FE for n instances, Lemma 34

Figure 5.5: An overview of the games used in the proof of Theorem 14.

Games: G 0 , G 1 , G 2 : (pk ot , msk ot , {ek ot i } i∈[n] ← Setup ot (1 λ , F m,X,Y n ), gpk ′ ← GSetup ′ (1 λ , F m,3X,Y IP ), for all i ∈ [n], (ek ′ i , msk ′ i ) ← Setup ′ (1 λ , gpk, F m,3X,Y n ), ek i := ek ot i , pk := {gpk ′ , ek ′ i } i∈[n] α ← A OKeygen(•),OEnc(•,•),OCorrupt(•) (pk) Return α.
OEnc(i, (x j,0 i , x j,1 i )):

w j i := Enc ot (pk ot , ek ot i , x j,0 i -x 1,0 i + x 1,0 i ) w j i := Enc ot (pk ot , ek ot i , x j,0 i -x 1,0 i + x 1,1 i ) w j i := Enc ot (pk ot , ek ot i , x j,1 i -x 1,1 i + x 1,1 i ) Return ct j i := Enc ′ (gpk ′ , ek ′ i , w j i ).
OKeygen(y): In what follows, we prove many-AD-IND-weak security of MIFE.

For all i ∈ [n], dk ′ i ← KeyGen ′ (gpk ′ , msk ′ i , y i ), z ← KeyGen ot (pk ot , msk ot , y 1 • • • y n ), dk y1 ••• yn := {dk ′ i } i∈[n] , z Return dk y1 ••• yn OCorrupt(i): Return ek ot i
We proceed via a series of games G i for i ∈ {0, . . . , 2}, described in Figure 5.6. The transitions are summarized in Figure 5.5. Let A be a PPT adversary. For any game G, we denote by Adv G (A) the probability that the game G outputs 1 when interacting with A. Note that the set of input slots for which a challenge ciphertext is queried, denoted by I in Figure 5.6, is such that HS ⊆ I, since we want to prove many-AD-IND-weak security.

According to Definition 21, we have:

Adv many-AD-IND-weak MIFE,A (λ) = |Adv G 0 (A) -Adv G 2 (A)|.
Game G 1 : is as game G 0 , except we replace the challenge ciphertexts to ct j i = Enc(pk, ek i ,

x j,0 i -x 1,0 i + x 1,1 i ) for all i ∈ [n] and j ∈ [Q i ],
using the one-AD-IND-weak security of MIFE ot . Namely, we prove in Lemma 33 that there exists a PPT adversary B 1 such that

Adv G 0 (A) -Adv G 1 (A) ≤ Adv one-AD-IND MIFE ot ,B 1 (λ).
Game G 2 : we replace the challenge ciphertexts to ct j i = Enc(pk, ek i ,

x j,1 i -x 1,1 i + x 1,1 i ) = Enc(pk, ek i , x j,1 i ) for all i ∈ [n] and j ∈ [Q i ],
using the many-AD-IND security of FE for n instances, which is implied by the single-instance security (see Lemma 5). We prove in Lemma 34 that there exists a PPT adversary B 2 such that

Adv G 1 (A) -Adv G 2 (A) ≤ Adv many-AD-IND FE,B 2 ,n (λ).
Putting everything together, we obtain:

Adv many-AD-IND-weak MIFE,A (λ) ≤ Adv one-AD-IND-weak MIFE ot ,B 1 (λ) + Adv many-AD-IND FE,B 2 ,n (λ). Lemma 38: Game G 0 to G 1
There exists a PPT adversary B 1 such that

|Adv G 0 (A) -Adv G 1 (A)| ≤ Adv one-AD-IND-weak MIFE ot ,B 1 (λ).
Proof of Lemma 38. In game G 1 , which is described in Figure 5.6, we replace Enc(pk, ek i ,

x j,0 i ) = Enc(pk, ek i , x 1,0 i + (x j,0 i -x 1,0 i )) with Enc(pk, ek i , x 1,1 i + (x j,0 i -x 1,0 i )) for all i ∈ [n], j ∈ [Q i ].
This is justified by one-AD-IND-weak security of MIFE ot . The adversary B 1 proceeds as follows.

-Simulation of pk:

Adversary B 1 receives pk ot from its experiment. Then, it samples gpk ′ ← GSetup ′ (1 λ , F m,3X,Y IP ), and for all i ∈ [n], (ek ′ i , msk ′ i ) ← Setup ′ (1 λ , gpk ′ , F m,3X,Y IP ). It sends pk := (pk ot , {ek ′ i } i∈[n] ) to A.
-Simulation of OEnc(i, (x j,0 i , x j,1 i )): If j = 1, that is, the first query for slot i ∈ [n], then B 1 queries its own encryption oracle to get w 1 i := Enc ot (pk ot , ek ot i , x 1,β i ), where β ∈ {0, 1}, depending on the experiment B 1 is interacting with. If j > 1, B 1 uses the fact that the MIFE ot from Figure 5.1 is linearly homomorphic (see Remark 13) to generate all the remaining w j i :=

w 1 i + x j,0 i -x 1,0 i mod L = Enc ot (pk ot , ek ot i , x j,0 i + x 1,β i -x 0 i ), which corresponds to the challenge ciphertexts in game G β . Finally, B 1 returns Enc ′ (gpk ′ , ek ′ i , w j i ) to A. -Simulation of OKeygen(y 1 • • • y n ):
B 1 uses its own secret key generation oracle on input

y 1 • • • y n to get z := KeyGen ot (y 1 • • • y n ). For all i ∈ [n], it computes dk ′ i := KeyGen ′ (gpk ′ , msk ′ i , y i ). It sends dk y 1 ••• yn := ({dk ′ i } i∈[n] , z) to A.
Finally, B 1 forwards the output α of A to its own experiment. It is clear that for all β ∈ {0, 1}, when B 1 interacts with many-AD-IND-weak MIFE ot β , it simulates the game G β to A. Therefore,

Adv many-AD-IND-weak MIFE ot ,B 1 (λ) = Pr many-AD-IND-weak MIFE ot 0 (1 λ , B 1 ) = 1 -Pr many-AD-IND-weak MIFE ot 1 (1 λ , B 1 ) = 1 = |Adv G 0 (A) -Adv G 1 (A)|.

Lemma 39: Game G 1 to G 2

There exists a PPT adversary B 2 such that

|Adv G 1 (A) -Adv G 2 (A)| ≤ Adv many-AD-IND FE,B 2 ,n (λ). Proof of Lemma 39. In Game G 2 , we replace Enc ′ (gpk ′ , ek ′ i , x 1,1 i + (x j,0 i -x 1,0 i ) z i ) with Enc(gpk ′ , ek ′ i , x 1,1 i + (x j,1 i -x 1,1 i ) z i ) = Enc(gpk ′ , ek ′ i , x j,1 i z i ), for all i ∈ [n], j ∈ [Q i ].
This follows from the many-AD-IND security of FE for n instances, which we can use since for each key query y 1 . . . y n and all r, z, we have

Enc ot (pk ot , ek ot , x 1,1 i + x j,0 i -x 1,0 i , y i = u i + x 1,1 i + x j,0 i -x 1,0 i , y i = u i + x 1,1 i + x j,1 i -x 1,1 i , y i = Enc ot (pk ot , ek ot , x 1,1 i + x j,1 i -x 1,1 i , y i
The second equality is equivalent to x j,0 ix 1,0 i , y i = x j,1 ix 1,1 i , y i , which follows from the restriction imposed by the security game (see Remark 7).

We build a PPT adversary B 2 such that:

|Adv G 1 (A) -Adv G 2 (A)| ≤ Adv many-AD-IND FE,B 2 ,n (λ).
Adversary B 2 proceeds as follows.

-Simulation of pk:

Adversary B 2 receives (gpk ′ , {ek ′ i } i∈[n] from its experiment. Then, it samples (pk ot , msk ot , {ek ot i } i∈[n] ) ← Setup ot (1 λ , F m,X,Y n
), and sends pk := (pk ot , gpk ′ , {ek ′ i } i∈[n] ), to A.

-Simulation of OEnc(i, (x j,0 i , x j,1 i )): For all b ∈ {0, 1}, B 1 computes w j,b i := x 1,1 i + x j,b ix 1,b i , and queries its own encryption oracle on input (i, w j,0 i , w j,1 i ), to get Enc ′ (gpk ′ , ek ′ i , w j,β i ), which it forwards to A, where β ∈ {0, 1}, depending on the experiment B 2 is interacting with.

-Simulation of OKeygen(y

1 • • • y n ):
for all i ∈ [n], B 1 uses its own decryption key generation oracle on input y i to get

dk ′ i := KeyGen ′ (gpk ′ , msk ′ i , y i ). It computes z := KeyGen ot (pk ot , msk ot , y 1 • • • y n ), which it can do since it knows msk ot . It sends dk y 1 ••• yn := ({dk ′ i } i∈[n] , z) to A.
-Simulation of OCorrupt(i):

B 1 returns ek ot i to A. Finally, B 2 forwards the outputs α of A to its own experiment. It is clear that for all β ∈ {0, 1}, when B 2 interacts with many-AD-

IND FE β (1 λ , 1 n , B 2 ), it simulates the game G 1+β to A. Therefore, Adv many-AD-IND FE,B 2 ,n (λ) = Pr many-AD-IND FE 0 (1 λ , 1 n , B 2 ) = 1 -Pr many-AD-IND FE 1 (1 λ , 1 n , B 2 ) = 1 = |Adv G 1 (A) -Adv G 2 (A)|.
2. We have for all x, y ∈ Z m ,

Dec 1 dk y , ct x := [c] := [c] ⊤ dk y = [ x, y ] = E( x, y mod p, 0).
3. It is straightforward to see that E(γ, 0) is efficiently and publicly computable. 4. It is also easy to see that E is linear.

Finally, for all

γ ∈ Z such that γ < n • m • X • Y , Dec 2 (E(γ mod p, 0)) := log([γ mod p]) = γ mod p = γ,
where the log can be computed efficiently since γ < n • m • X • Y is assumed to lie in a polynomial size range.

Proof of Property 2 (linear encryption).

For all x

′ ∈ Z m and [c] ∈ G m+k+1 , let Add([c], x ′ ) := [c] + 0 x ′ .
Then, for all x, x ′ ∈ Z m , and

[c] := Enc(gpk, ek, x) = -Ar x + WAr , we have:

Add([c], x ′ ) = [c] + 0 x ′ = -Ar x + x ′ + WAr = Enc gpk, ek, (x + x ′ mod p) .

Inner Product FE from LWE

Here we show that the many-AD-IND secure Inner Product FE from [ALS16, Section 4.1] and recalled in Figure 5.8, satisfies Property 1 (two-step decryption) and Property 2 (linear encryption).

Property 1 (two-step decryption).

1. The algorithm GSetup ⋆ (1 λ , F m,X,Y IP , 1 n ) works the same as Setup except that it uses n to set K := n • m • X • Y , and it also returns the bound B := q K , L := q, G := (Z q , +), and the encoding function E : Z q × Z → G defined for all γ ∈ Z q , noise ∈ Z as

E(γ mod q, noise) := γ • q K + noise mod q.
Also, parameters M, q, α and distribution D are chosen as explained in Section 2.6.2, as if working with input vectors of dimension n • m.

We let Dec 1 and Dec 2 be the first and second line of Dec in Figure 5.8 respectively.

2. We have for all x, y ∈ Z m ,

Dec 1 dk y , ct x := (c 0 , c 1 ) = c 0 c 1 ⊤ dk y mod q = x, y • q K + y ⊤ e 1 -e ⊤ 0 Z ⊤ y mod q = E( x, y mod q, noise),
where noise := y ⊤ e 1e ⊤ 0 Z ⊤ y, and Pr[noise < B] = 1negl(λ). 3. It is straightforward to see that E(γ, 0) is efficiently and publicly computable.

GSetup(1 λ , F m,X,Y IP ):
Choose primes p = 2p ′ + 1, q = q ′ + 1 with prime p ′ , q ′ > 2 l(λ) for an l(λ) = poly(λ) such that factoring is λ-hard, and set

N := pq ensuring that m • X • Y < N . Sample g ′ ← R Z * N 2 , g := g ′ 2N mod N 2 . Return gpk := (N, g) Setup(1 λ , gpk, F m,X,Y IP ): s ← R D Z m ,σ , for standard deviation σ > √ λ • N 5/2
, and for all j ∈ [m],

h j := g sj mod N 2 . ek := {h j } j∈[m] , msk := {s j } j∈[m] Return (ek, msk) Enc(gpk, ek, x ∈ Z m ): r ← R {0, . . . , ⌊N/4⌋}, C 0 := g r ∈ Z N 2 , for all j ∈ [m], C j := (1 + x j N ) • h r j ∈ Z N 2 Return ct x := (C 0 , . . . , C m ) ∈ Z m+1 N 2 KeyGen(gpk, msk, y ∈ Z m ): d := j∈[m] y j s j ∈ Z.
Return sk y := (d, y) Dec gpk, sk y := (d, y), ct x ): G as the subgroup of Z * N 2 of order N generated by (1 + N ), and the encoding function

C := j∈[m] C yj j • C -d 0 mod N 2 . Return log (1+N ) (C) := C-1 mod N 2 N .
E : Z N × Z → G defined for all γ ∈ Z N , noise ∈ Z as E(γ, noise) := 1 + γ • N mod N 2 .
We let Dec 1 and Dec 2 be the first and second line of Dec in Figure 5.9.

We have for all x, y

∈ Z m , Dec 1 (dk y := (d, y), ct x ) :=   j∈[m] C y j j   • C -d 0 mod N 2 = E( x, y mod N, 0).
3. It is straightforward to see that see that E(γ, 0) can be efficiently computed from public information.

4. It is also easy to see that E is linear.

Finally, for all

γ ∈ Z such that γ ≤ n • m • X • Y < N , it holds Dec 2 (E(γ, 0)) := E(γ, 0) -1 mod N 2 N = γ.
Property 2 (linear encryption). For all

x ′ ∈ Z m and (C 0 , C ′ 1 , . . . , C ′ m ) ∈ Z m+1 N 2 , let Add((C 0 , C 1 , . . . , C m ), x ′ ) computes C ′ j := C j • (1 + x ′ j N ) mod N 2 for all j ∈ [m] and out- puts (C 0 , C ′ 1 , . . . , C ′ m ). Then, for all x, x ′ ∈ Z m , and (C 0 , C 1 , . . . , C m ) := (g r , (1 + x 1 N ) • h r 1 , . . . , (1 + x m N ) • h r m ) ∈ Z m N 2 , we have: Add((C 0 , C 1 , . . . , C m ), x ′ ) = (g r , (1 + (x 1 + x ′ 1 )N ) • h r 1 mod N 2 , . . . , (1 + (x m + x ′ m )N ) • h r m mod N 2 ) = Enc mpk, (x + x ′ mod N ) .
Chapter 6

Multi-Client Inner Product Functional Encryption

Overview of our construction.

We build the first MCFE for inner product from standard assumptions. Our construction goes in four steps. First, we build an MCFE for inner product that only satisfies a weak notion of security, namely, one-AD-IND-weak security (see Definition 51). That is, our scheme is only secure when there is only one challenge ciphertext per input slot i ∈ [n] and label ℓ. Moreover, the security notion does not take into account the information that can be extracted from a partial decryption of ciphertexts. Recall that decryption usually operates on pk, msk, and ciphertexts ct i for all slots i ∈ [n]. But it is still possible to extract information from ciphertexts ct i for some, bot not all slots i ∈ [n]. The information on the underlying messages that is leaked by such partial decryption is not captured by the weak security notion. The security of this construction relies on the DDH assumption, in the random oracle model. This work has appeared in [CDG + 18a].

Second, we show how to transform our one-AD-IND secure MCFE for inner product into a many-AD-IND secure MCFE, thereby allowing an adversary to obtain many challenge ciphertexts, using an extra layer of single-input FE for inner product.

Third, we show how to remove the aforementioned limitation in the security model, using a layer of secret sharing on top of the original MCFE. This layer ensures that given only ciphertexts ct i for some, but not all input slots i ∈ [n], one learns no information whatsoever on the underlying messages. This transformation is generic: it takes as input any MCFE with xx-AD-IND-weak security and turns it into an xx-AD-IND secure MCFE, where xx ∈ {many,one}. It can also be seen as a decentralized version of All-Or-Nothing Transforms [Riv97, Boy99, CDH + 00]. We propose a concrete instantiation in pairing-friendly groups, under the Decisional Bilinear Diffie-Hellman problem, in the random oracle model. When applied on our one-AD-IND-weak secure MCFE, we get an one-AD-IND secure MCFE.

Fourth, we propose an efficient decentralized algorithm to generate a sum of private inputs, which can convert our many-AD-IND secure MCFE for inner product into a decentralized many-AD-IND secure MCFE. This technique is inspired from [START_REF] Kursawe | Privacy-friendly aggregation for the smart-grid[END_REF], and only applies to the functional decryption key generation algorithm, and so this is compatible with the two above conversions. We now expose our MCFE and SSE constructions in more details.

MCFE for inner product with one-AD-IND-weak security.

We briefly showcase the techniques that allow us to build efficient MCFE for inner product. The schemes we introduce later enjoy adaptive security (aka full security), where encryption queries are made adaptively by the adversary against the security game, but for the sake of clarity, we will here give an informal description of a selectively-secure scheme from the DDH assumption, where queries

Scheme MCFE [ABDP15]

Setup : ∀i ∈ [n]: are made beforehand. Namely, the standard security notion for FE is indistinguishabilitybased, where the adversary has access to a encryption oracle, that on input (m 0 , m 1 ) either always encrypts m 0 or always encrypts m 1 . While for the adaptive security, the adversary can query this oracle adaptively, in the selective setting, all queries are made at the beginning, before seeing the public parameters.

s i ← R Z m p ek i := s i ∀i ∈ [n]: s i ← R Z m p ek i := [s i ] Enc(pk, ek i , x i , ℓ) : [r] := H(ℓ) return [c i ] := [x i + s i r] r ← R Z p return ([r], [c i ] := [x i + s i r]) KeyGen(pk, msk, y 1 • • • y n ) : d := i y ⊤ i s i returns (y 1 • • • y n , d) d := i y ⊤ i s i returns (y 1 • • • y n , d) Dec(pk, dk y1 ••• yn , ct 1 , • • • , ct n , ℓ) : Discrete logarithm of i [c ⊤ i y i ] -[r • d] where [r] := H(ℓ) Discrete logarithm of i [c ⊤ i y i ] -[r • d]
We first design a secret-key MCFE scheme building up from the public-key FE scheme introduced by [ABDP15] (itself a selectively-secure scheme) where we replace the global randomness with a hash function (modeled as a random oracle for the security analysis), in order to make the generation of the ciphertexts independent for each client. The comparison is illustrated in Figure 6.1. Note that for the final decryption to be possible, one needs the function evaluation to be small enough, within this discrete logarithm setting. This is one limitation, which is still reasonable for real-world applications that use concrete numbers, that are not of cryptographic size.

Correctness then follows from:

i c ⊤ i y i -r • d = i (x i + s i r) ⊤ y i -r • i y ⊤ i s i = i x ⊤ i y i .
In [CDG + 18a, Appendix B], this scheme is proven selectively secure under the DDH assumption. To obtain adaptive security, we adapt the adaptively secure inner product FE from [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] in the same manner than described for the FE from [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF].

Secret Sharing Encapsulation. AS explained, in order to deal with partial ciphertexts, we introduce a new tool, called Secret Sharing Encapsulation (SSE). In fact, the goal is to allow a user to recover the ciphertexts from the n senders only when he gets the contributions of all of them. At first glance, one may think this could be achieved by using All-Or-Nothing Transforms or (n, n)-Secret Sharing. However, these settings require an authority who operates on the original messages or generates the shares. Consequently, they are incompatible with our multi-client schemes. Our SSE tool can be seen as a decentralized version of All-Or-Nothing Transforms or of (n, n)-Secret Sharing: for each label ℓ, each user i ∈ [n] can generate, on his own, the share S ℓ,i . And, unless all the shares S i,ℓ have been generated, the encapsulated keys are random and perfectly mask all the inputs.

We believe that SSE could be used in other applications. As an example, AONT was used in some traitor tracing schemes [START_REF] Kiayias | Traitor tracing with constant transmission rate[END_REF][START_REF] Chabanne | Public traceability in traitor tracing schemes[END_REF]. By using SSE instead of AONT, one can get decentralized traitor tracing schemes in which the tracing procedure can only be run if all the authorities agree on the importance of tracing a suspected decoder. This might be meaningful in practice to avoid the abuse of tracing, in particular on-line tracing, which might break the privacy of the users, in case the suspected decoders are eventually legitimate decoders.

MCFE with one-AD-IND-weak security

Here we present a multi-client scheme MCFE for inner product over Z, that is, for the set of functionalities {F m,X,Y n

} n∈N defined as F m,X,Y n : K n × X 1 × • • • × X n → Z, with K n := [0, Y ] mn , for all i ∈ [n], X i := [0, X] m , Z := Z, such that for any (y 1 • • • y n ) ∈ K n , x i ∈ X i , we have: F m,X,Y n (y 1 • • • y n ), x 1 , . . . , x n = n i=1 x i , y i .
We prove its one-AD-IND-weak security under the D k (p) in prime-order group (a particular case being the DDH assumption). Note that we do not require pairing-friendly groups. As explained in the introduction of this chapter, this scheme will be used to build many-AD-IND secure MCFE for inner product. The scheme is described in Figure 6.2.

Setup(1 λ , F m,X,Y n ): G := (G, p, P ) ← GGen(1 λ
), H : {0, 1} * → G k+1 be a full domain hash function modeled as a random oracle.

For all i ∈ [n], S i ← R Z m×(k+1) p , ek i := S i , pk = G, msk := {S i } i∈[n] . Return (pk, msk, (ek i ) i∈[n] ). Enc(pk, ek i , x i , ℓ): Compute [r] := H(ℓ). Return [c i ] := [x i + S i r]. KeyGen(pk, msk, (y 1 • • • y n )): d := i∈[n] S ⊤ i y i Return dk y1 ••• yn := (y 1 • • • y n , d). Dec pk, dk y1 ••• yn , [c 1 ], . . . , [c n ], ℓ): Parse dk y1 ••• yn := (y 1 • • • y n , d). Compute [r] := H(ℓ). Return the discrete log of n i=1 [c ⊤ i y i ] - [r ⊤ d].

Correctness of MCFE follows from:

i [c ⊤ i y i ] -[r ⊤ d] = i [(x i + S i r) ⊤ y i ] -[r ⊤ i S ⊤ i y i ] = i [x ⊤ i y i ].
We know i x i , y i ≤ n•m•X •Y , which is bounded by a polynomial in the security parameter. Thus, decryption can efficiently recover the discrete log: i x i , y i mod p = i x i , y i , where the equality holds since i x i , Proof of Theorem 15. We proceed via a series of games G i for i ∈ {0, . . . , 2}, described in Figure 6.3. The transitions are summarized in Figure 5.5. Let A be a PPT adversary. For any game G, we denote by Adv G (A) the probability that the game G outputs 1 when interacting with A.

y i ≤ n • m • X • Y ≪ p.
According to Definition 21, we have:

Adv one-AD-IND-weak MCF E,A (λ) = |Adv G 0 (A) -Adv G 4 (A)|. Games G 0 , G 1 , G 2 , (G 3.q.1 ) q∈[Q+1] , (G 3.q.2 , G 3.q.3 ) q∈[Q] , G 4 G := (G, p, g) ← GGen(1 λ ), pk := G. For all i ∈ [n], S i ← R Z m×(k+1) p , ek i := S i , msk := {S i } i . A ← D k (p), a ⊥ ← R Z k+1 p \ {0} s.t. A ⊤ a ⊥ = 0 α ← A OEnc(•,•,•),OKeygen(•),OCorrupt(•),RO(•) (pk).
Return α if Condition 1 and Extra condition from Definition 25 of one-AD-IND-weak security are satisfied, 0 otherwise.

RO(ℓ): // G 0 , G 1 , G 2 , G 3.q.1 , G 3.q.2 , G 3.q.3 , G 4 [u ℓ ] := H(ℓ), [u ℓ ] := RF(ℓ) , [u ℓ ] := [A • r ℓ ], with r ℓ := RF ′ (ℓ)
On the q'th (fresh) query: Game G 1 : we replace the hash function H by a truly random function onto G 2 , that is computed on the fly. This uses the pseudorandomness of the hash function H. Namely, in the Random Oracle Model:

[u ℓ ] := A • RF ′ (ℓ) + RF ′′ (ℓ) • a ⊥ Return [u ℓ ]. OEnc(i, (x 0 i , x 1 i ), ℓ): // G 0 , G 1 , G 2 , G 3.q.1 , G 3.q.2 , G 3.q.3 , G 4 [u ℓ ] := RO(ℓ), [c i ] := [x 0 i + S i u ℓ ] If [u ℓ ] is computed on the j-th RO-query, for j < q: [c i ] := [x 1 i + S i u ℓ ] If [u ℓ ] is computed on the q-th RO-query: [c i ] := [x 1 i + S i u ℓ ] [c i ] := [x 1 i + S i u ℓ ] Return [c i ] OKeygen(y): Return i S ⊤ i y i . //G 0 , G 1 , G 2 , G 3.q.1 , G 3.q.2 , G 3.q.3 , G 4 OCorrupt(i): Return S i . // G 0 , G 1 , G 2 , G 3.q.1 , G 3.q.2 , G 3.q.3 , G 4
Adv G 0 (A) = Adv G 1 (A).
Game G 2 : here, the outputs of RO are uniformly random in the span of [A] for A ← D k (p). This uses the Q-fold D k (p)-MDDH assumption, where Q is the number of call to RO(•), which tightly reduces to its 1-fold variant, using the random-self reducibility (see Lemma 1). Namely, there exists a PPT adversary B such that

Adv G 1 (A) -Adv G 2 (A) ≤ Adv D k (p)-mddh G,B (λ) + 1 p -1 .
Note that we use the fact that the Condition 1 and Extra condition from Definition 25 of one-AD-IND-weak security are efficiently checkable. This allows adversary B to decide efficiently whether to forward the output α of A, or 0 (in case the conditions are not satisfied) to its own experiment.

Game G 3.1.1 : is exactly game G 2 . Thus,

Adv G 2 (A) = Adv G 3.1.1 (A).
From game G 3.q.1 to game G 3.q.2 : we first change the distribution of the output of RO on its q'th query (note that two queries with the same input are counted once, that is, we only count fresh queries), from uniformly random in the span of [A] to uniformly random over G k+1 , using the D k (p)-MDDH assumption. Then, we use the basis (A a ⊥ ) of Z k+1 p , to write a uniformly random vector over Z k+1 p as Au 1 + u 2 • a ⊥ , where u 1 ← R Z k p , and u 2 ← R Z p . Finally, we switch to Au 1 + u 2 • a ⊥ where u 1 ← R Z k p , and u 2 ← R Z * p , which only changes the adversary view by a statistical distance of 1/p. Thus, there exists a PPT adversary B 3.q.1 such that

Adv G 3.q.1 (A) -Adv G 3.q.2 (A) ≤ Adv D k (p)-mddh G,B 3.q.1 (λ) + 1 p .
Once again, we rely on the fact that Condition 1 and Extra condition from Definition 25 of one-AD-IND-weak security are efficiently checkable.

From game G 3.q.2 to game G 3.q.3 : We prove:

Adv G 3.q.2 (A) = Adv G 3.q.3 (A).
Note that if the output of the q'th fresh query to RO is not used by OEnc, then the games G 3.q.2 and G 3.q.3 are identical. We consider the case where the output of the q'th fresh query to RO is used by OEnc. We show that we also have Adv G 3.q.2 (A) = Adv G 3.q.3 (A) in that case, in two steps.

In Step 1, we show that for all PPT adversaries B 3.q.2 and B ⋆ 3.q.3 , there exist PPT adversaries B ⋆ 3.q.2 and B 3.q.3 such that Adv G 3.q.2 (B 3.q.2 ) = (p 2m + 1) n • Adv G ⋆ 3.q.2 (B ⋆ 3.q.2 ) and Adv G 3.q.3 (B 3.q.3 ) = (p 2m + 1) n • Adv G ⋆ 3.q.3 (B ⋆ 3.q.3 ), where the games G ⋆ 3.q.2 and G ⋆ 3.q.3 are selective variants of games G 3.q.2 and G 3.q.3 respectively (see Figure 6.4). Note that those advantage are conditioned on the fact that the output of the q'th fresh query to RO is used by OEnc.

In Step 2, we show that for all PPT adversaries B ⋆ , we have Adv G ⋆ 3.q.2 (B ⋆ ) = Adv G ⋆ 3.q.3 (B ⋆ ), where again, these advantages are conditioned on the fact that the output of the q'th fresh query to RO is used by OEnc.

Step 1. We build a PPT adversary B ⋆ 3.q.2 playing against G ⋆ 3.q.2 , such that Adv G 3.q.2 (B 3.q.2 ) = (p 2m + 1) n • Adv G ⋆ 3.q.2 (B ⋆ 3.q.2 ). Adversary B ⋆ 3.q.2 first guesses for all i ∈ [n], z i ← R Z 2m p ∪ {⊥}, which it sends to its selective game G ⋆ 3.q.2 . That is, the guess z i is either a pair of vectors (x 0 i , x 1 i ) ∈ Z 2m p queried to OEnc, or ⊥, which means no query to OEnc. Then, it simulates A's view using its own oracles. When B ⋆ 3.q.2 guesses successfully (call E that event), it simulates B 3.q.2 's view exactly as in G 3.q.2 . Since event E happens with probability (p 2m + 1) -n , we obtain:

Adv G ⋆ 3.q.2 (B ⋆ 3.q.2 ) = Pr[1 ← G ⋆ 3.q.2 |E] =Pr[1←G 3.q.2 ] • Pr[E] + Pr[1 ← G ⋆ 3.q.2 |¬E] =0 • Pr[¬E] = Pr[E] • | Pr[1 ← G 3.q.2 ]| = (p 2m + 1) -n • Adv G 3.q.2 (B 3.q.2 )
Adversary B 3.q.3 is built similarly. As for prior reductions, we use the fact that Condition 1 and Extra condition from Definition 25 of one-AD-IND-weak security, and the validity of the guess {z i } i∈ [n] , can be checked efficiently.

Step 2. We assume the values (z i ) i∈ [n] sent by B ⋆ are consistent, that is, they don't make the game end and return 0. We also assume Condition 1 and Extra condition from Definition 25 of one-AD-IND-weak security are satisfied. We call E this event.

We show that games G ⋆ 3.q.2 and G ⋆ 3.q.3 are identically distributed, conditioned on E. To prove so, we use the fact that the following are identically distributed:

(S i ) i∈[n],z i =(x 0 i ,x 1 i ) and S i + γ(x 1 i -x 0 i )(a ⊥ ) ⊤ i∈[n],z i =(x 0 i ,x 1 i )
, where a ⊥ ← R Z k+1 p \ {0} such that A ⊤ a ⊥ = 0, and for

all i ∈ [n]: S i ← R Z m×(k+1) p
, and γ ← R Z p . This is true since the S i are independent of the z i (note that this is not true in adaptive games). Thus, we can re-write S i into S i +γ(x 1 i -x 0 i )(a ⊥ ) ⊤ without changing the distribution of the game.

We now take a look at where the extra terms γ(x 1 ix 0 i )(a ⊥ ) ⊤ actually appear in the adversary's view. They do not appear in the output of OCorrupt, because we assume event E holds, which implies for all i ∈ [n], either z i = ⊥, and there is no extra term; or z i = (x 0 i , x 1 i ), but by Condition 1, we must have x 0 i = x 1 i , which means there is again no extra term. They appear in OKeygen(y) as

dk y = i∈[n] S ⊤ i y i + a ⊥ • γ i:z i =(x 0 i ,x 1 i ) (x 1 i -x 0 i ) ⊤ y i ,
where the gray term equals 0 by Condition 1 and Extra condition from Definition 25 of one-AD-IND-weak security. Finally, the extra terms γ(x 1 ix 0 i )(a ⊥ ) ⊤ only appear in the output of the queries to OEnc which use [u ℓ ] computed on the q'th query to RO, since for all others, the vector [u ℓ ] lies in the span of [A], and A ⊤ a ⊥ = 0. For the former, we have

[c] := [S i u ℓ + x 0 i + γ(x 1 i -x 0 i )(a ⊥ ) ⊤ u ℓ ]. Since u ⊤ ℓ a ⊥ = 0, the above [c] is identically distributed to [S i u ℓ + x 1 i + γ(x 1 i -x 0 i )(a ⊥ ) ⊤ u ℓ ].
Finally, reverting these statistically perfect changes, we obtain that [c] is identically distributed to [S i u ℓ + x 1 i ], as in game G ⋆ 3.q.3 . Thus, when event E happens, the games are identically distributed. When ¬E happens, the games both return 0. Thus, we have

Adv G ⋆ 3.q.2 (B ⋆ ) = Adv G ⋆ 3.q.3 (B ⋆ ).
From game G 3.q.3 to game G 3.q+1.1 : this transition is the reverse of the transition from game G 3.q.1 to game G 3.q.2 , namely, we use the D k (p)-MDDH assumption to switch back the distribution of [u ℓ ] computed on the q'th (fresh) query to RO from uniformly random over G k+1 (conditioned on the fact that u ⊤ ℓ a ⊥ = 0) to uniformly random in the span of [A]. We obtain a PPT adversary B 3.q.3 such that

Adv G 3.q.3 (A) -Adv G 3.q+1.1 (A) ≤ Adv D k (p)-mddh G,B 3.q.3 (λ) + 1 p .
From game G 3.Q+1.1 to G 4 : First, we switch the distribution of all the vectors [u ℓ ] output by the random oracle to uniformly random over G k+1 , using the D k (p)-MDDH simultaneously for all queried labels ℓ, using the random self reducibility of the MDDH assumption (cf Lemma 1). Then, we using the random oracle model to argue that the output of the real hash function H are distributed as the output of a truly random function computed on the fly (this is the reserve transition than transition from gma eG 0 to game G 1 ). We obtain a PPT adversary B 4 such that:

Adv G 3.Q+1.1 (A) -G 4 ≤ Adv D k (p)-mddh G,B 4 (λ) + 1 p -1 .
Putting everything together, we obtain a PPT adversary B such that

Adv one-AD-IND-weak MCF E,A (λ) ≤ (2Q + 2) • Adv D k (p)-mddh G,B (λ) + 2Q p + 2 p -1 ,
where Q denotes the number of calls to the random oracle.

Games (G ⋆ 3.q.2 , G ⋆ 3.q.3 ) q∈[Q] : state, (z i ∈ Z 2m p ∪ {⊥}) i∈[n] ← A(1 λ , 1 n ) S := ∅, G := (G, p, P ) ← GGen(1 λ ), pk := G, A ← R D k (p), a ⊥ ← R Z k+1 p \ {0} s.t. A ⊤ a ⊥ = 0. For all i ∈ [n], S i ← R Z m×(k+1) p . α ← A OEnc(•,•,•),OKeygen(•),OCorrupt(•),RO(•) (pk, state). If ∃i ∈ [n] \ S such that z i = ⊥,

RO(ℓ):

// G ⋆ 3.q.2 , G ⋆ 3.q.3 [u ℓ ] := [Ar ℓ ], with r ℓ := RF ′ (ℓ) On the q'th (fresh) query:

[u ℓ ] := [A • RF ′ (ℓ) + RF ′′ (ℓ) • a ⊥ ] Return [u ℓ ].
OEnc(i, (x 0 , x 1 ), ℓ):

// G ⋆ 3.q.2 , G ⋆ 3.q.3 [u ℓ ] := RO(ℓ), [c] := [x 0 + S i u ℓ ] If [u ℓ
] is computed on the j'th (fresh) query to RO with j < q: [c] := [x 1 + S i u ℓ ].

If [u ℓ ] is computed on the q'th (fresh) query to RO, then:

• if (x 0 , x 1 ) = z i , the game ends and returns 0.

• otherwise, [c] := x 0 + x 1 + S i u ℓ , S := S ∪ {i}.

Return [c].

OKeygen(y):

//G ⋆ 3.q.2 , G ⋆ 3.q.3
Return i S ⊤ i y i .

OCorrupt(i): // G ⋆ 3.q.2 , G ⋆ 3.q.3
Return S i .

Figure 6.4: Games G ⋆ 3.q.2 and G ⋆ 3.q.3 , with q ∈ [Q], for the proof of Theorem 15. Here, RF, RF ′ are random functions onto G k+1 , and Z k p , respectively, that are computed on the fly. In each procedure, the components inside a solid (gray) frame are only present in the games marked by a solid (gray) frame.

From one to many ciphertext for MCFE

In this section, we add an extra layer of public-key, single-input inner product FE on top of the inner product MCFE from Section 6.1, to remove the restriction of having a unique challenge ciphertext per client and per label. Our construction works for any public-key single-input inner product FE that is compatible with the inner product MCFE from Section 6.1, that is, an FE whose message space is the ciphertext space of the MCFE. Namely, we use a single-input FE whose encryption algorithm can act on vectors of group elements, in G m , where G is a prime-order group, as opposed to vectors over Z. Decryption recovers the inner product in the group G, without any restriction on the size of the input of the encryption and decryption key generation algorithms. The message space of the FE is G m , for some dimension m, its decryption key space is Z m p , where p is the order of G, and for any [x] ∈ G m , y ∈ Z m p ,the decryption of the encryption of [x] together with the functional decryption key associated with y yields [x ⊤ y].

For correctness, we exploit the fact that decryption of the MCFE from Section 6.1 computes the inner product of the ciphertext together with the decryption keys. For security, we exploit the fact that the MCFE is linearly homomorphic, in the sense that given an input x, one can publicly maul an encryption of x ′ into an encryption of x + x ′ . This is used to bootstrap the security from one to many challenge ciphertexts per (user,label) pair, similarly to the security proof in Chapter 4 in the context of multi-input inner product FE. In fact, the construction in Chapter 5 uses a one-time secure multi-input FE as inner layer, and a single-input inner product FE as outer layer, while we use an inner product MCFE as inner layer, and a singleinput inner product FE as outer layer.

Before presenting our construction in Figure 6.5, we remark that the MCFE from Section 6.1 satisfies the following properties.

• Linear Homomorphism of ciphertexts: for any i ∈ [n], x i , x ′ i ∈ Z m p , and any label ℓ, we have [c i ] + [x ′ i ] = Enc(pk, ek i , x i + x ′ i , ℓ), where [c i ] = Enc(pk, ek i , x i , ℓ).

• Deterministic Encryption. In particular, together with the linear homomorphism of ciphertexts, this implies that for any x i , x ′ i ∈ Z m p and any label ℓ, we have: Enc(pk, ek i , x i , ℓ)-Enc(pk, ek i ,

x ′ i , ℓ) = [x i -x ′ i ].
Correctness. By correctness of IPFE, we have for all i ∈ [n], and any label ℓ:

[α ℓ,i ] = [ y i , x i + S i u ℓ ] = [ y i , x i ] + [u ℓ ] ⊤ S ⊤ i y i . Thus, i [α ℓ,i ] = [ y, x ] + [u ℓ ] ⊤ ( i S ⊤ i y i ). Since d = i S ⊤ i y i , we have i [α ℓ,i ] = [ y, x ] + [u ℓ ] ⊤ d, hence [α] = [ x, y ]. We know x, y = i x i , y i ≤ n•m•X •Y ,
which is bounded by a polynomial in the security parameter. Thus, decryption can efficiently recover the discrete logarithm: i x i , y i mod p = i x i , y i , where the equality holds since i x i ,

y i ≤ n • m • X • Y ≪ p.

Security proof. Theorem 16: many-AD-IND-weak security of MCFE

The scheme MCFE from Figure 6.5 is many-AD-IND-weak secure, assuming the underlying single-input FE IPFE is many-AD-IND secure, and using the fact that the scheme MCFE ′ from Figure 6.2 is one-AD-IND-weak secure.

Proof overview. The proof is similar than the proof of Theorem 10, in Chapter 4, which proves the many-time security of our multi-input FE from its one-time security. In the one-AD-IND-weak security game, the adversary only queries OEnc on one input (i, (x 0 i , input slot i ∈ [n] and label ℓ. In the many-AD-IND-weak security game, however, we may have many such queries, and we use an index j ∈ [Q i,ℓ ] to enumerate over such queries, where Q i,ℓ denotes the number of queries to OEnc which contain the input i ∈ [n] and the label ℓ. That is, we call (x j,0 i , x j,1 i ) the j'th query to OEnc on label ℓ and slot i. The proof goes in two steps:

x 1 i ), ℓ) per Setup(1 λ , F m,X,Y n ): (pk ′ , msk ′ , (ek ′ i ) i∈[n] ) ← Setup ′ (1 λ , F m,X,Y n ), gpk ← IP.GSetup(1 λ , F m,X,Y IP ), for all i ∈ [n], (IP.ek i , IP.msk i ) ← IP.Setup(1 λ , gpk, F m,X,Y IP ), ek i := ek ′ i , pk := (pk ′ , gpk, {IP.ek i } i∈[n] ), msk := (msk ′ , {IP.msk i } i∈[n] ). Return (pk, msk, {ek i } i∈[n] ). Enc(pk, ek i , x i , ℓ): [c ℓ,i ] ← Enc ′ (pk ′ , ek ′ i , x i , ℓ) Return C ℓ,i := IP.Enc(gpk, IP.ek i , [c ℓ,i ]) KeyGen(pk, msk, y := y 1 • • • y n ): dk ′ y ← KeyGen ′ (pk ′ , msk ′ ,
] = H(ℓ), [α] = [ i α ℓ,i ] -[u ℓ ] ⊤ d.
• We first switch encryptions of x 1,0 1 , . . . , x 1,0 n to those of x 1,1 1 , . . . , x 1,1 n all at once, and for the remaining ciphertexts, we switch from an encryption of x j,0 i = (x j,0 ix 1,0 i ) + x 1,0 i to that of (x j,0 ix 1,0 i ) + x 1,1 i . We can do so using the one-AD-IND-weak security of MCFE, and the fact that its encryption algorithm is linear homomorphic. In particular, given an encryption of x 1,β i for β ∈ {0, 1}, and the vector (x j,0 ix 1,0 i ), we can produce (only with the public key) an encryption of (x j,0 ix 1,0 i ) + x 1,β i . Thus, we can generate all the challenge ciphertexts only from the security game where there is only a single ciphertext in each slot and label.

• Then, we switch from encryptions of

(x 2,0 i -x 1,0 i ) + x 1,1 i , . . . , (x Q i ,0 i -x 1,0 i ) + x 1,1 i to those of (x 2,1 i -x 1,1 i ) + x 1,1 i , . . . , (x Q i ,1 i -x 1,1 i ) + x 1,1 i .
To carry out the latter hybrid argument, we use the fact that the queries must satisfy the constraint:

[c ⊤ 0,i y i ] = [x 1,1 i + x j,0 i -x 1,0 i ] ⊤ y i + [S i u ℓ ] ⊤ y i = [x 1,1 i + x j,1 i -x 1,1 i ] ⊤ y i + [S i u ℓ ] ⊤ y i = [c 1,i ] ⊤ y i ,
where Enc ′ denotes the encryption algorithm of MCFE ′ from Figure 6.2, and for all b ∈ {0, 1}, [c b,i ] := Enc ′ (pk ′ , ek ′ i , x 1,1 i + x j,b ix 1,b i , ℓ). The second equality is equivalent to x j,0 ix 1,0 i , y i = x j,1 ix 1,1 i , y i , which follows from the restriction imposed by the security game (see Remark 7).

Thus, we can use the many-AD-IND security of the single-input FE IPFE for n instances (which is implied by the single instance many-AD-IND security, see Lemma 5), to switch simultaneously all the challenge ciphertexts for all slots i ∈ [n]. As explained in the beginning of this section, the construction is essentially the same construction than multi-input FE for inner product as in Section 5.4, except we replace the perfectly, one-time secure MIFE used in the inner layer, by the one-time secure MCFE from Figure 6.2.

Proof of Theorem 16. We proceed via a series of games, described in Figure 6.6. Let A be a PPT adversary. For any game G, we denote by Adv G (A) the probability that the game G outputs 1 when interacting with A. Note that we have:

Adv many-AD-IND-weak MCFE,A (λ) = |Adv G 0 (A) -Adv G 2 (A)|, according to Definition 25.
Game G 1 : is as game G 0 , except we replace the challenge ciphertexts to ct j i = Enc(pk, ek i , x j,0 ix 1,0 i + x 1,1 i ) for all i ∈ [n] and j ∈ [Q i ], using the one-AD-IND-weak security of MIFE ′ . Namely, we prove in Lemma 40 that there exists a PPT adversary B 1 such that:

Adv G 0 (A) -Adv G 1 (A) ≤ Adv one-AD-IND-weak MCF E ′ ,B 1 (λ).
Game G 2 : we replace the challenge ciphertexts to ct j i = Enc(pk, ek i , x j,1 ix 1,1 i + x 1,1 i ) = Enc(pk, ek i , x j,1 i ) for all i ∈ [n] and j ∈ [Q i ], using the many-AD-IND security of IPFE for n instances, which is implied by the single-instance security (see Lemma 5). We prove in Lemma 41 that there exists a PPT adversary B 2 such that:

Adv 1 (A) -Adv 2 (A) ≤ Adv many-AD-IND
IPFE,B 2 ,n (λ). Putting everything together, we obtain:

Adv many-AD-IND-weak MCFE,A (λ) ≤ Adv one-AD-IND-weak MCF E ′ ,B 1 (λ) + Adv many-AD-IND IPFE,B 2 ,n (λ).
Lemma 40: Game G 0 to G 1

There exists a PPT adversary B 1 such that

|Adv G 0 (A) -Adv G 1 (A)| ≤ Adv one-AD-IND-weak MCFE ′ ,B 1 (λ).
Proof of Lemma 40. In game G 1 , which is described in Figure 6.6, we replace Enc(pk, ek i ,

x j,0 i , ℓ) = Enc(pk, ek i , x 1,0 i + (x j,0 i -x 1,0 i ), ℓ) with Enc(pk, ek i , x 1,1 i + (x j,0 i -x 1,0 i ), ℓ) for all i ∈ [n], j ∈ [Q i ]
. This is justified by the following properties:

• one-AD-IND-weak security of MCFE ′ ;

• the fact that Enc ′ is linearly homomorphic. Namely, for all i ∈ [n], given Enc ′ (pk ′ , ek ′ i , x 1,β i ), x j,0 ix 1,0 i and pk ′ , we can create an encryption Enc ′ (pk ′ , ek ′ i , x 1,β i + x j,0 ix 1,0 i ) (corresponding to challenge ciphertexts in slot i in game G β ).

The adversary B 1 proceeds as follows. OEnc(i, (x j,0 i , x j,1 i ), ℓ): ct j i := Enc(pk, ek i , x j,0 ix 1,0 i + x 1,0 i ) ct j i := Enc(pk, ek i , x j,0 ix 1,0 i + x 1,1 i )

Games G 0 , G 1 , G 2 : (pk, msk, (ek i ) i∈[n] ) ← Setup(1 λ , F m,X,Y n ) α ← A OEnc(•,•,•),OKeygen(•),OCorrupt(•) (pk, {ek i } i∈CS ) Return α if
ct j i := Enc(pk, ek i , x j,1 i -x 1,1 i + x 1,1 i ) Return ct j i . OKeygen(y 1 • • • y n ): Return KeyGen(pk, msk, y 1 • • • y n ).

OCorrupt(i):

Return ek i .

Figure 6.6: Games for the proof of Theorem 16.

-Simulation of pk:

The adversary B samples gpk ← GSetup(1 λ , F m,X,Y IP ), and for all i ∈ [n], (ek i , msk i ) ← IP.Setup(1 λ , gpk, F m,X,Y

IP

). It receives a public key pk ′ from its own experiment. It returns pk := (pk ′ , gpk, {IP.ek i } i∈ [n] ) to A.

-Simulation of OEnc(i, (x j,0 i , x j,1 i ), ℓ): If j = 1, that is, it is the first query for slot i ∈ [n] and label ℓ, then B 1 queries its own oracle to get [c 1 i ] := Enc ′ (pk ′ , ek ′ i , x 1,β i , ℓ), where β ∈ {0, 1}, depending on the experiment B 1 is interacting with. If j > 1, B 1 uses the fact that MCFE ′ is linearly homomorphic to generate all the remaining ciphertexts ct j i for i ∈ [n], j ∈ {2, . . . , Q i } by combining ct i = Enc ′ (pk ′ , ek ′ i , x 1,β i , ℓ) with the vector x j,0 ix 1,0 i to obtain an encryption Enc ′ (pk ′ , ek ′ i , x 1,β i +

x j,0 ix 1,0 i , ℓ), which matches the challenge ciphertexts in Game G β . Note that this can be done using pk ′ only. Moreover, there is no need to rerandomize the challenge ciphertext, since the encryption is deterministic in MCFE ′ . Then, for all i ∈ [n] and all j ∈ [Q i ], B 1 computes ct j i := IP.Enc(gpk, IP.ek i , [c j i ]), and returns

{ct j i } i∈[n],j∈[Q i ] to A.
-Simulation of OKeygen(y

:= y 1 • • • y n ):
B 1 uses its own secret key generation oracle to get dk ′ y ← OKeygen ′ (y), and for all i ∈ [n], computes dk y i ← IP.KeyGen(gpk, IP.msk i , y i ). It returns (dk ′ y , {dk

y i } i∈[n] ) to A.
-Simulation of OCorrupt(i):

B 1 uses its own oracle to get ek ′ i ← OCorrupt ′ (i), which it returns to A. Finally, B 1 forwards the output α of A to its own experiment. It is clear that for all β ∈ {0, 1}, when B 1 interacts with one-AD-IND MCFE ′ β , it simulates the game G β to A.

Therefore,

Adv one-AD-IND MCFE ′ ,B 1 (λ) = Pr one-AD-IND MCFE ′ 0 (1 λ , B 1 ) = 1 -Pr one-AD-IND MCFE ′ 1 (1 λ , B 1 ) = 1 = |Adv G 0 (A) -Adv G 1 (A)|. Lemma 41: Game G 1 to G 2
There exists a PPT adversary B 2 such that

|Adv G 1 (A) -Adv G 2 (A)| ≤ Adv many-AD-IND IPFE,B 2 ,n (λ).
Proof of Lemma 41. In Game G 2 , we replace Enc(pk, ek i ,

x 1,1 i + (x j,0 i -x 1,0 i ) , ℓ) with Enc(pk, ek i , x 1,1 i + (x j,1 i -x 1,1 i ) , ℓ) for all i ∈ [n], j ∈ [Q i ].
This follows from the many-AD-IND security of IPFE for n instances, which we can use since for each key query y 1 . . . y n , we have

[c ⊤ 0,i y i ] = [x 1,1 i + x j,0 i -x 1,0 i ] ⊤ y i + [S i u ℓ ] ⊤ y i = [x 1,1 i + x j,1 i -x 1,1 i ] ⊤ y i + [S i u ℓ ] ⊤ y i = [c 1,i ] ⊤ y i ,
where for all b ∈ {0, 1}, [c b,i ] := Enc ′ (pk ′ , ek ′ i , x 1,1 i + x j,b ix 1,b i , ℓ). The second equality is equivalent to x j,0 ix 1,0 i , y i = x j,1 ix 1,1 i , y i , which follows from the restriction imposed by the security game (see Remark 7).

We build a PPT adversary B 2 such that:

|Adv G 1 (A) -Adv G 2 (A)| ≤ Adv many-AD-IND IPFE,B 2 ,n (λ).
Adversary B 2 proceeds as follows.

-Simulation of pk:

Adversary B 2 receives (gpk, {IP.ek i } i∈[n] ) from its experiment. Then, it samples (pk ′ , msk ′ , {ek ′ i } i∈[n] ) ← Setup ′ (1 λ , F m,X,Y n
), and sends pk := (pk ′ , gpk, {IP.ek i } i∈[n] ), to A.

-Simulation of OEnc(i, (x j,0 i , x j,1 i ), ℓ):

For all b ∈ {0, 1}, B 1 computes [c j,b i ] ← Enc ′ (pk ′ , ek ′ i , x 1,1 i + x j,b i -x 1,b i , ℓ
), and queries its own encryption oracle on input (i, ([c j,0 i ], [c j,1 i ])), to get IP.Enc(gpk, IP.ek i , [c j,β i ]), which it forwards to A, where β ∈ {0, 1}, depending on the experiment B 2 is interacting with.

-Simulation of OKeygen(y

:= y 1 • • • y n ):
For all i ∈ [n], B 1 uses its own decryption key generation oracle on input y i to get dk y i := IP.KeyGen(gpk, IP.msk i , y i ). It computes dk y := KeyGen ′ (pk ′ , msk ′ , y), which it can do since it knows msk ′ . It returns (dk ′ y , {dk

y i } i∈[n] ) to A.
-Simulation of OCorrupt(i):

B 2 returns ek ′ i to A. Finally, B 2 checks whether condition 1 and extra condition from Definition 25 are satisfied. Note that involves checking an exponential number of equation for general functionalities. But in the case of inner-product, B 2 just has to look at spanned vector sub-spaces. Namely, all queries (i, x j i ,0 i ,

x j i ,1 i , ℓ) i∈[n],j i ∈[Q i ]
to OEnc and all queries y := (y 1 • • • y n ) to OKeygen must satisfy: i x j i ,0 i , y i = i x j i ,1 i , y i . This is an exponential number of linear equations, but, as noted in the beginning of Chapter 4, it suffices to verify the linearly independent equations, of which there can be at most n • m. This can be done efficiently given the queries.

If these conditions are satisfied, then B 2 forwards A's output α to its own experiment, otherwise it sends 0 to its own experiment. It is clear that for all β ∈ {0, 1}, when B 2 interacts with many-AD-IND IPFE β (1 λ , 1 n , B 2 ), it simulates the game G 1+β to A. Therefore,

Adv many-AD-IND IPFE,B 2 ,n (λ) = Pr many-AD-IND IPFE 0 (1 λ , 1 n , B 2 ) = 1 -Pr many-AD-IND IPFE 1 (1 λ , 1 n , B 2 ) = 1 = |Adv G 1 (A) -Adv G 2 (A)|.

Secret Sharing Encapsulation

As explained in the introduction of this chapter, in the xx-AD-IND-weak security notion, incomplete ciphertexts were considered illegitimate. This was with the intuition that no adversary should use it since this leaks no information. But actually, an adversary could exploit that in the real-life. We wish to obtain xx-AD-IND security, where the adversary can use incomplete ciphertexts. We upgrade the scheme from the previous section so that no information is leaked in such a case.

Namely, we present a generic layer, called the Secret Sharing Encapsulation (SSE), that we will use to encapsulate ciphertexts. It allows a user to recover the ciphertexts from the n senders only when he gets the contributions of all the servers. That is, if one sender did not send anything, the user cannot get any information from any of the ciphertexts of the other senders. More concretely, a share of a key S ℓ,i is generated for each user i ∈ [n] and each label ℓ. Unless all the shares S i,ℓ have been generated, the encapsulation keys are random and mask all the ciphertexts.

After giving the definition of SSE, we provide a construction whose security is based on the DBDH assumption in asymmetric pairing groups.

Definitions Definition 28: Secret Sharing Encapsulation (SSE)

A secret sharing encapsulation on K over a set of n senders is defined by four algorithms:

• SSE.Setup(1 λ ): Takes as input a security parameter 1 λ and generates the public parameters pk sse and the personal encryption keys are ek sse,i for all i ∈ [n];

• SSE.Encaps(pk sse , ℓ): Takes as input the public parameters pk sse and the label ℓ and outputs a ciphertext C ℓ and an encapsulation key K ℓ ∈ K;

• SSE.Share(ek sse,i , ℓ): Takes as input a personal encryption ek sse,i and the label ℓ, outputs the share S ℓ,i ;

• Security. We want to show that the encapsulated keys are indistinguishable from random if not all the shares are known to the adversary. We could define a Real-or-Random security game [START_REF] Bellare | A concrete security treatment of symmetric encryption[END_REF] for all the masks. Instead, we limit the Real-or-Random queries to one label only (whose index is chosen in advance), and for all the other labels, the adversary can do the encapsulation by itself, since it just uses a public key. This is well-known that a hybrid proof among the label indices (the order they appear in the game) shows that the One-Label security is equivalent to the Many-Label security. The One-Label definition will be enough for our applications.

Adv 1-label-IND SSE,A (λ) = Pr 1-label-IND SSE 0 (1 λ , A) = 1 -Pr 1-label-IND SSE 1 (1 λ , A) = 1 = negl(λ),
where the experiments are defined for β ∈ {0, 1} as follows:

Experiment

1-label-IND SSE β (1 λ , A): i ⋆ ← A(1 λ , 1 n ) (pk sse , (ek sse,i ) i∈[n] ) ← Setup(1 λ ) α ← A OEncaps(•),OShare(•,•),OCorrupt(•) (pk) Output: α
On input a label ℓ, the oracle OEncaps(ℓ) computes (C ℓ , K ℓ ) ← SSE.Encaps(pk sse , ℓ), K 0 := K ℓ , K 1 ← R K, and returns (C ℓ , K β ). On input i ∈ [n], and a label ℓ, the oracle OShare(i, ℓ) returns S i,ℓ ← SSE.Share(ek sse,i , ℓ). On input i ∈ [n], the oracle OCorrupt(i) returns ek sse,i . We require that the oracle OEncaps is only called on one label ℓ ⋆ , OShare is never called on input (i ⋆ , ℓ ⋆ ), and OCorrupt is never called on i ⋆ . If this condition is not satisfied, the experiment outputs 0 instead of α.

Construction of the Secret Sharing Encapsulation

We build an SSE from the DBDH assumption in asymmetric pairing groups, in the random oracle model, in Figure 6.7.

We stress here that K ℓ is not unique for each label ℓ: whereas S ℓ,i deterministically depends on ℓ and the slot i, K ℓ is randomized by the random coins r. Hence, with all the shares, using a specific C ℓ one can recover the associated K ℓ . Correctness follows from the fact that the above decapsulated key K ℓ is equal to where the pair (C ℓ , K ℓ ) has been generated by the same SSE.Encaps call, with the same random r. The intuition for the security is that given all the S ℓ,i = t i • H(ℓ) for a label ℓ, one can recover the masks

e   i∈[n] t i • H(ℓ), [r] 2   = e   H(ℓ), [r • i∈[n] t i ] 2   , SSE.Setup(1 λ ): PG := (G 1 , G 2 , p, P 1 , P 2 ) ← PGGen(1 λ ), H : {0, 1} * → G 1 be a full domain hash function modeled as a random oracle. For all i ∈ [n], t i ← R Z p , ek sse,i := t i , pk sse = (PG, H, [ i∈[n] t i ] 2 ). Return (pk sse , (ek sse,i ) i∈[n] ). SSE.Share(pk sse , ek sse,i , ℓ): Return S ℓ,i := t i • H(ℓ) ∈ G 1 . SSE.Encaps(pk sse , ℓ): r ← R Z p , C ℓ := [r] 2 , K ℓ := e(H(ℓ), r • i∈[n] t i ). Return (C ℓ , K ℓ ). SSE.Decaps(pk sse , (S i,ℓ ) i∈[n] , ℓ, C ℓ ): Return K ℓ := e( i∈[n] S ℓ,i , C ℓ ).
K ℓ = e(H(ℓ), [r • i∈[n] t i ] 2 ) using C ℓ = [
r] 2 . However if S ℓ,i is missing for one slot i, then all the encapsulation keys K ℓ are pseudo-random, from the DBDH assumption.

Our construction is reminiscent from the Identity-Based Encryption from [START_REF] Boneh | Identity-based encryption from the Weil pairing[END_REF], where a ciphertext for an identity ℓ is of the form e(H(ℓ), [msk • r] 2 ) for a random r ← R Z p , and a functional decryption key for identity ℓ is of the form H(ℓ) msk . In our construction, we share the master secret msk into the {t i } i∈ [n] , and each S ℓ,i represents a share of the functional decryption key for identity ℓ.

Security proof. Theorem 17: 1-label-IND security of SSE

The SSE scheme presented in Figure 6.7 is 1-label-IND secure under the DBDH assumption, in the random oracle model.

Proof of Theorem 17. We build a PPT adversary B such that

Adv 1-label-IND SSE,A (λ) ≤ (1 + q H ) • Adv q Enc -DBDH PG,B (λ),
where q H denotes the number of calls to the random oracle prior to any query to OEncaps, either direct calls, or indirect via OShare. The integer q Enc denotes the number of calls to the oracle OEncaps. We will then conclude using the random self reducibility of the DBDH assumption (see Lemma 4).

The adversary B receives a q Enc -fold DBDH challenge PG,

[a] 1 , [b] 1 , [b] 2 , {[c i ] 2 , [s i ] T } i∈[q Enc ]
, where q Enc denotes the number of queries of A to its oracle OEncaps, and receives i ⋆ ∈ [n] from A.

Then, B guesses ρ ← R {0, . . . , q H }. Intuitively, ρ is a guess on when the random oracle is going to be queried on ℓ ⋆ , the first label used as input to OEncaps (without loss of generality, we can assume OEncaps is queried at least once by A, otherwise the security is trivially satisfied), with ρ = 0 indicating that the adversary never queries H on ℓ ⋆ before querying OEncaps.

Then, B samples t i ← R Z p and sets ek sse,i := t i for all i ∈ [n], i = i ⋆ , and sets [t

i ⋆ ] 2 := [b] 2 . It returns pk sse := (PG, [ i∈[n] t i ] 2 ) to A.
For any query OCorrupt(i): if i = i ⋆ , B returns ek sse,i , otherwise B stops simulating the experiment for A and returns 0 to its own experiment.

For any query to the random oracle H, if this the ρ'th new query, then B sets H(ℓ ρ ) := [a] 1 . For others queries, B outputs [h] 1 for a random h ← R Z p . B keeps track of the queries and outputs to the random oracle H, so that it answers two identical queries with the same output.

For any query to OEncaps(ℓ): if ℓ has never been queried to the random oracle H before (directly, or indirectly via OShare) and ρ = 0, then B sets H(ℓ) := [a] 1 ; if ℓ was queried to random oracle as the ρ'th new query (again, we consider direct and indirect queries to H, the latter coming from OShare), then we already have H(ℓ) = [a] 1 . In both cases, B sets C ℓ ← [c j ] 2 , for the next index j in the q Enc -fold DBDH instance, computes

K ℓ ← [s j ] T + e([a] 1 , ( i =i ⋆ t i ) • [c j ]
2 ), and returns (C ℓ , K ℓ ) to A. Otherwise, the guess ρ was incorrect: B stops simulating the experiment for A, and returns 0 to its own experiment. Moreover, if A ever calls OEncaps on different labels ℓ, then B stops simulating this experiment for A and returns 0 to its own experiment.

For any query to OShare(i, ℓ): if the random oracle has been called on ℓ, then B uses the already computed input H(ℓ); otherwise, it computes H(ℓ) for the first time as explained above. If i = i ⋆ and ℓ = ℓ ρ , then B stops simulating the experiment for A and returns 0 to its own experiment. Otherwise, that means either i = i ⋆ , in which case B knows t i ∈ Z p , or ℓ = ℓ ρ , in which case B the discrete logarithm of H(ℓ). In both cases, B can compute S ℓ,i := t i •H(ℓ) ∈ G 1 , which it returns to A.

At the end of the experiment, B receives the output α from A. If its guess ρ was correct, B outputs α to its own experiment, otherwise, it ignores α and returns 0. When B's guess is incorrect, it returns 0 to its experiment. Otherwise, when it is given as input a real q Enc -fold DBDH challenge, that is s j = abc j for all indices j ∈ [q Enc ], then B simulates the 1-label-IND security game with b = 0. Indeed, since b = t i ⋆ , for the j-th query to OEncaps, we have:

K ℓ ⋆ = [s j ] T + e([a] 1 , ( i =i ⋆ t i ) • [c j ] 2 ) = [abc j ] T + e([a] 1 , ( i =i ⋆ t i ) • [c j ] 2 ) = e([a] 1 , [bc j ] 2 ) + e([a] 1 , ( i =i ⋆ t i ) • [c j ] 2 ) = e([a] 1 , [bc j ] 2 + ( i =i ⋆ t i ) • [c j ] 2 ) = e([a] 1 , (b + i =i ⋆ t i ) • [c j ] 2 ) = e([a] 1 , ( i t i ) • [c j ] 2 ) = e(H(ℓ ⋆ ), c j • T 2 )
where C ℓ ⋆ = [c j ] 2 . When given as input a a random q Enc -fold DBDH challenge, the simulation corresponds to the case b = 1. Finally, we conclude using the fact that the guess ρ is correct with probability exactly 1 q H +1 .

Strengthening the Security of MCFE Using SSE

We now show how we can enhance the security of any MCFE for any set of functionality {F n } n∈N , using a Secret Sharing Layer as defined in Section 6.3. Namely, we show that the construction from Figure 6.8 is xx-AD-IND secure if the underlying MCFE is xx-AD-IND secure, for any xx ∈ {one,many}, thereby removing the complete-ciphertext restriction. We stress our transformation is not restricted to MCFE for inner product, but works for any functionality.

Generic construction of xx-AD-IND security for MCFE

⋆ ← R {0, . . . , n} , (pk ′ , msk ′ , (ek ′ i ) i∈[n] ) ← Setup ′ (1 λ , F n ), (pk sse , (ek sse,i ) i∈[n] ) ← SSE.Setup(1 λ ), pk := (pk ′ , pk sse ), msk := msk ′ , and for all i ∈ [n], ek i := (ek ′ i , ek sse,i ). α ← A OEnc(•,•,•),OKeygen(•),OCorrupt(•) (pk) Return α if Condition 1 from Definition 25 is satisfied,
and:

(i ⋆ = 0 is never queried to OCorrupt and (ℓ ρ+1 , i ⋆ ) is never part of a query to OEnc) OR (i ⋆ = 0 and OEnc is queried on all slots i ∈ HS for label ℓ ρ+1 ) ; 0 otherwise.

OEnc(i, (x 0 i , x 1 i ), ℓ j ): If j ≤ ρ, C ′ ℓj ,i ← Enc ′ (pk ′ , ek ′ i , x 1 i , ℓ j ). If j > ρ, C ′ ℓj ,i ← Enc ′ (pk ′ , ek ′ i , x 0 i , ℓ j ). (C ℓj , K ℓj ) ← SSE.Encaps(pk sse , ℓ j ), S ℓj ,i ← SSE.Share(pk sse , ek sse,i ). If j = ρ, C ′ ℓj ,i ← Enc ′ (pk ′ , ek ′ i , x β i , ℓ j ), K ℓj ← R K . Return (D ℓj ,i := SEnc(K ℓj , C ′ ℓj ,i ), C ℓj , S ℓj ,i
|Adv G ρ-1 (A) -Adv Gρ (A)| ≤ (n + 1) • Adv xx-AD-IND-weak MCFE,Bρ (λ)+ 2 • Adv 1-label-IND SSE,B ′ ρ (λ) + q e • Adv OT SKE,B ′′ ρ (λ) ,
where q e denotes the number of queries to OEnc.

Proof of Lemma 42. Two cases can happen between games G ρ-1 and G ρ , for each ρ ∈ [L]: either all the challenge ciphertexts are generated under ℓ ρ or not all of them. We first make the guess, and then deal with the two cases: if they are all generated (for honest slots, that is, slots that are not queried to OCorrupt), we use the xx-AD-IND-weak security of MCFE ′ , otherwise there is an honest slot i ⋆ for which the ciphertext has not been generated, and we use the 1-label-IND security of SSE, together with the one-time security of the symmetric encryption scheme.

Guess of the Case for the ℓ ρ :

We define a new sequence of hybrid games G ⋆ ρ for all ρ ∈ {0, . . . , L}, which is exactly as G ρ , except that a guess for the missing honest-slot ciphertext i ⋆ under ℓ ρ is performed (i ⋆ = 0 means that all the honest-client ciphertexts are expected to be generated under ℓ ρ ). Recall that a slot is called honest if it is not queried to OCorrupt. The games are presented in Figure 6.9. Since G ⋆ ρ and G ρ are the same unless the guess is incorrect, which happens with probability exactly 1/(n + 1), for any adversary A:

Adv Gρ (A) = (n + 1) • Adv G ⋆ ρ (A).
All the ciphertexts are generated under ℓ ρ : We build a PPT adversary B ρ against the xx-AD-IND-weak security of MCFE ′ such that

|Adv G ⋆ ρ-1 (A ∧ i ⋆ = 0) -Adv G ⋆ ρ (A ∧ i ⋆ = 0)| ≤ Adv xx-AD-IND-weak MCF E ′ (B ρ ).
The adversary B ρ simulates A's view as follows:

• First, it obtains pk ′ from its own xx-AD-IND-weak security game for MCFE ′ , samples (pk sse , (ek sse,i ) i∈[n] ) ← SSE.Setup(1 λ ) and returns pk = (pk ′ , pk sse ) to the adversary A.

• OEnc(i, (x 0 , x 1 ), ℓ j ): if j < ρ, it uses its own encryption oracle OEnc ′ to get C ← OEnc ′ (i, (x 1 , x 1 ), ℓ j ); if j > ρ, it uses its own encryption oracle OEnc ′ to get C ← OEnc ′ (i, (x 0 , x 0 ), ℓ j ); if j = ρ, then it uses its own encryption oracle to get C ← OEnc ′ (i, (x 0 , x 1 ), ℓ ρ ). Then, it computes (C ℓ j , K ℓ j ) ← SSE.Encaps(pk sse , ℓ j ), and S ℓ j ,i ← SSE.Share(ek sse,i , ℓ j ). Finally, it computes and returns the ciphertext (SEnc(K ℓ j , C), C ℓ j , S ℓ j ,i ).

• OKeygen(k): it uses its own oracle to get dk ′ k ← OKeygen ′ (k), which it returns to A.

• OCorrupt(i): it uses its own corruption oracle to get ek ′ i ← OCorrupt ′ (i), and returns ek i = (ek ′ i , ek sse,i ).

• Finally, B ρ checks that OEnc is queried on all slots i ∈ HS for label ℓ ρ . If this is the case, it forwards the output α from A. Otherwise, it returns 0 to its own experiment.

First, note that when simulating A's view, B ρ only queries its encryption oracle on input (x 0 , x 1 ) with x 0 = x 1 for a unique label ℓ ρ . Moreover, when the guess i ⋆ = 0 is correct, then the extra condition from Definition 25 is satisfied: OEnc is queried for label ℓ ρ on all slots i ∈ HS (that is, all slots which are not queried to OCorrupt). Thus, we can use the xx-AD-IND-weak security of MCFE ′ to switch Enc ′ (pk ′ , ek ′ i , x 0 , ℓ ρ ), as in game

G ⋆ ρ-1 to Enc ′ (pk ′ , ek ′ i , x 1 , ℓ ρ ), as in game G ⋆ ρ .
Some ciphertexts are missing under ℓ ρ : For β ∈ {0, 1}, we define the games H ρ,β for all ρ ∈ {0, . . . , L}, and β ∈ {0, 1}, as G ⋆ ρ , except that OEnc(i, (x 0 , x 1 ), ℓ ρ ) computes the encryption of x β , and samples K ℓρ ← R K instead of using (C ℓρ , K ℓρ ) ← SSE.Encaps(pk sse , ℓ). These games are described in Figure 6.9. Now, we build PPT adversaries B ρ,0 and B ρ,1 against the 1-label-IND security of SSE such that:

|Adv G ⋆ ρ-1 (A ∧ i ⋆ = 0) -Adv H ρ,0 (A ∧ i ⋆ = 0)| ≤ Adv 1-label-IND SSE,B ρ,0 (λ); |Adv G ⋆ ρ (A ∧ i ⋆ = 0) -Adv H ρ,1 (A ∧ i ⋆ = 0)| ≤ Adv 1-label-IND SSE,B ρ,1 (λ). Let β ∈ {0, 1}.
We proceed to describe B ρ,β . First, B ρ,β samples the guess i ⋆ ← R {0, . . . , n}. If i ⋆ = 0, then B ρ,β behaves exactly as the game G ⋆ ρ-1+β . Otherwise, it does the following, using the 1-label-IND security game against SSE:

• First, it generates (pk ′ , msk ′ , (ek ′ i ) i∈[n] ) ← Setup ′ (1 λ ), and sends i ⋆ to receive pk sse from its own experiment. It returns pk = (pk ′ , pk sse ) to the adversary A.

• OEnc(i, (x 0 , x 1 ),

ℓ j ): if j < ρ, it computes C = Enc ′ (pk ′ , ek ′ i , x 1 , ℓ j ); if j > ρ, it computes C = Enc ′ (pk ′ , ek ′ i , x 0 , ℓ j ); and if j = ρ, it computes C = Enc ′ (pk ′ , ek i , x β , ℓ j ). Then it calls its own oracle to get S ℓ j ,i = OShare(i, ℓ j ). If j = ρ, it computes (C ℓ j , K ℓ j ) ← SSE.Encaps(pk sse , ℓ j ), if j = ρ it calls (C ℓρ , K ℓρ ) ← OEncaps(ℓ ρ ). Finally, it returns the ciphertext (SEnc(K ℓ j , C), C ℓ j , S ℓ j ,i ).
• OKeygen(k): it returns KeyGen ′ (msk ′ , k).

• OCorrupt(i): it uses its own corruption oracle to get ek sse,i ← OCorrupt(i), and returns ek i = (ek ′ i , ek sse,i ). • Finally, B ρ,β forwards A's output α to its own experiment. Game G ⋆ ρ , which encrypts x 1 under ℓ ρ just differs from H ρ,1 with real vs. random keys K ℓρ , as emulated by B ρ,1 , according to the real-or-random behavior of the 1-label-IND game for SSE. Game G ⋆ ρ-1 , which encrypts x 0 under ℓ ρ just differs from H ρ,0 with real vs. random keys K ℓρ , as emulated by B ρ,0 , according to the real-or-random behavior of the 1-label-IND game for SSE. Note that if adversary A makes queries that satisfy condition 1 and that the guess i ⋆ is correct, and different from 0, then the queries of B ρ,β satisfy the conditions required by the 1-label-IND security game for SSE, namely, OEncaps is only queried on one label ℓ ρ , OCorrupt is never queried on i ⋆ , and OShare is never queried on (i ⋆ , ℓ ρ ).

Since the encapsulation keys K ℓρ are uniformly random in games H ρ,0 and H ρ,1 , we can use the one-time security of SKE, for each ciphertext for the label ℓ ρ , to obtain a PPT adversary B ′′ ρ such that:

|Adv H ρ,0 (A ∧ i ⋆ = 0) -Adv H ρ,1 (A ∧ i ⋆ = 0)| ≤ q e • Adv OT SKE,B ′′ ρ (λ)
, where q e denotes maximum number of ciphertexts generated under a label.

Putting everything together, for the case i ⋆ = 0, we obtain PPT adversaries B ′ ρ and B ′′ ρ such that:

|Adv G ⋆ ρ-1 (A ∧ i ⋆ = 0) -Adv G ⋆ ρ (A ∧ i ⋆ = 0)| ≤ 2 • Adv 1-label-IND SSE (B ′ ρ ) + q e • Adv OT SKE (B ′′ ρ
)) Since for any game G and any adversary A, Adv G (A) = Adv G (A ∧ i ⋆ = 0) + Adv G (A ∧ i ⋆ = 0), this concludes the proof of Lemma 42.

Decentralizing MCFE

In decentralized MCFE, the master secret key msk is split into [n] secret keys sk i , on for each client and the generation of the functional decryption keys is distributed among the clients. We focus on non-interactive protocols to generate the decryption keys, namely, clients can first run independently an algorithm KeyGenShare that only requires the secret key ek i , and that generates a partial key. Then, all these partial decryption keys can be combined via KeyComb, that only requires the public key. This way, there is no need for different clients to interact with each other. The master secret key is only used during the setup. See Definition 26 for further details.

The correctness property essentially states the combined key corresponds to the functional decryption key. The security model is quite similar to the one for MCFE, except that • for the KeyGen protocol: the adversary has access to transcripts of the communications, thus modeled by a query OKeyShare(i, f ) that executes KeyGenShare(sk i , f ).

• corruption queries additionally reveal the secret keys sk i ;

• the distributed key generation must guarantee that without all the shares, no information is known about the functional decryption key.

Distributed Sum

In the MCFE for inner product from Section 6.1 the functional decryption keys are of the form dk y = y, i S ⊤ i y i , and msk = {S i } i∈ [n] . We split the master secret key into sk i := S i for all i ∈ [n], and we use a non-interactive prototol to compute the sum of all the S ⊤ i y i , each of which can be computed by each client i ∈ [n] independently.

The same protocol can be used to decentralize the setup of the SSE scheme from Section 6.3, since the public key pk sse contains [ i t i ] 2 .. In this section, we present such a protocol that is similar to [START_REF] Kursawe | Privacy-friendly aggregation for the smart-grid[END_REF].

Definition 30: Ideal Protocol DSum

A DSum on abelian groups G, G ′ among n senders is defined by three algorithms:

• DSSetup(1 λ ): Takes as input the security parameter 1 λ . Generates the public parameters pp and the personal secret keys sk i for all i ∈ [n].

• DSEncode(x i , ℓ, sk i ): Takes the group element x i ∈ G to encode, a label ℓ, and the personal secret key sk i of the user i. Returns the share M ℓ,i ∈ G ′

) i ) ← DSSetup(1 λ ) .
Security Notion. This protocol must guarantee the privacy of the x i 's, possibly excepted their sum when all the shares are known. This is the classical security notion for multi-party computation, where the security proof is performed by simulating the view of the adversary from the output of the result: nothing when not all the shares are asked, and just the sum of the inputs when all the shares are queried. We also have to deal with the corruptions, which give the users' secret keys.

Our DSum Protocol

We present a DSum protocol for n users, with groups G = G ′ = Z m p . The security relies on the CDH assumption in a group G of primer order p. Similar protocol can be found in [START_REF] Kursawe | Privacy-friendly aggregation for the smart-grid[END_REF].

• DSSetup(1 λ ): generates G := (G, p, P ) ← GGen(1 λ ), and a hash function

H onto Z m p . For all i ∈ [n], t i ← R Z p , sk i := t i , pp := (G, H, ([t i ]) i ). It returns pp, {sk i } i∈[n] . • DSEncode(x i ∈ Z m p , ℓ, sk i ): computes h ℓ,i,j = H([t min{i,j} ], [t max{i,j} ], t i • [t j ], ℓ) = h ℓ,j,i ∈ Z m
p for all i, j ∈ [n], and returns:

M ℓ,i = x i - j<i h ℓ,i,j + j>i h ℓ,i,j . • DSCombine({M ℓ,i } i∈[n] ): returns i M ℓ,i .
Correctness. The correctness should show that the sum of the shares is equal to the sum of the x i 's: the former is equal to

i   x i - j<i h ℓ,i,j + j>i h ℓ,i,j   = i x i - i j<i h ℓ,i,j + i j>i h ℓ,j,i = i x i - i j<i h ℓ,i,j + j i<j h ℓ,j,i = i x i

Security Analysis

We will prove that there exists a simulator that generates the view of the adversary from the output only. In this proof, we will assume static corruptions (the set CS of the corrupted clients is known from the beginning) and the hardness of the CDH problem. However, this construction will only tolerate up to n -2 corruptions, so that there are at least 2 honest users. But this is also the case for the MCFE. W.l.o.g., we can assume that HS = {1, . . . , n -c} and CS = {nc + 1, . . . , n}, by simply reordering the clients, when CS is known. We will gradually modify the behavior of the simulator, with less and less powerful queries. At the beginning, the DSEncode-query takes all the same inputs as in the real game, including the secret keys. At the end, it should just take the sum (when all the queries have been asked), as well as the corrupted x j 's.

Game G 0 : The simulator runs as in the real game, with known CS.

Game G 1 : The simulator is given a pair ([t], [t 2 ]).

• DSSetup: for all 1 ≤ i ≤ n -c: α i ← R Z p , [t i ] := [t + α i ]. For all n -c < i ≤ n: t i ← Z p . For all 1 ≤ i, j ≤ n -c, Y i,j := [t 2 + (α i + α j ) • t + α i α j ]. For all 1 ≤ i ≤ n -c, and n -c < j ≤ n, Y i,j := [(t + α i )t j ], and Y j,i = Y i,j . For all n -c < i, j ≤ n, Y i,j := [t i • t j ]. It returns pp := {[t i ]} i∈[n]
and the secret keys t i of the corrupted users.

• DSEncode(x i , ℓ): the simulator generates all the required h ℓ,i,j using the X j 's and Y i,j 's, querying the hash function, and returns M ℓ,i = x i -j<i h ℓ,i,j + j>i h ℓ,i,j .

Game G 2 : The simulator does as above, but just uses a random

[t ′ ] ← R G instead of [t 2
], to answer the DSEncode-queries. This can make a difference for the adversary if the latter asks for the hash function on some tuple (X min{i,j} , X max{i,j} , [t i •t j ], ℓ), for i, j ≤ n-c, as this will not be the value h ℓ,i,j , which has been computed using Y i,j = [t i •t j ]. In such a case, one can find [t i •t j ] = [t 2 +(α i +α j )•t+α i α j in the list of the hash queries, and thus extract t 2 = [t 2 ]. As a consequence, under the hardness of the square Diffie-Hellman problem (which is equivalent to the CDH problem), this simulation is indistinguishable from the previous one.

Game G 3 : The simulator does as above excepted for the DSEncode-queries. If this is not the last-honest query under label ℓ, the simulator returns M ℓ,i = -j<i h ℓ,i,j + j>i h ℓ,i,j ; for the last honest query, it returns M ℓ,i = S H -j<i h ℓ,i,j + j>i h ℓ,i,j , where S H = j∈HS x j .

Actually, for a label ℓ, if we denote i ℓ the index of the honest player involved in the last query, the view of the adversary is exactly the same as if, for every i = i ℓ , we have replaced

h ℓ,i,i ℓ by h ℓ,i,i ℓ + x i (if i ℓ > i) or by h ℓ,i,i ℓ -x i (if i ℓ < i).
We thus replace uniformly distributed variables by other uniformly distributed variables: this simulation is perfectly indistinguishable from the previous one.

Game G 4 : The simulator now ignores the values h ℓ,i,j for honest i, j. But for each label, it knows the corrupted x j 's, and can thus compute the values M ℓ,j for the corrupted users, using the corrupted x j 's and secret keys. If this is not the last honest query, it returns a random M ℓ,i . For the last honest query, knowing S = j x j , it outputs M ℓ,i = Sj =i M ℓ,j .

As in the previous analysis, if one first sets all the h ℓ,i,j , for j = i ℓ , this corresponds to define h ℓ,i,i ℓ from M ℓ,i , for i = i ℓ .

Application to DMCFE for Inner Products

One can convert the MCFE from Section 6.1 whose decryption keys are of the form i S ⊤ i y i into an decentralized MCFE. Each client computes S ⊤ i y i independently, and we use the DSum protocol to compute the sum, where the label is the vector y itself. Namely, we have: Using the last simulation game, we can now show that all the KeyGenShare(sk i , y) are first simulated at random, and just the last query needs to ask the KeyGen-query to the MCFE scheme to get the sum and program the output. Hence, unless all the honest queries are asked, the functional decryption key is unknown. Consequently, we can convert the MCFE from Section 6.1 into a decentralized MCFE. Note that the transformation from Section 6.2 and Section 6.4, which remove the one challenge ciphertext restriction, and the incomplete ciphertext restriction, respectively, preserve the decentralized feature of the DCMFE obtained from using the DSum on the MCFE from Section 6.1. At the end, combining all transformations, we obtain a decentralized MCFE for inner product that is many-AD-IND secure.

• KeyGenShare(sk i , y := (y 1 • • • y n )): outputs M y,i ← DSEncode(S ⊤ i y i , y, sk i ); • KeyComb((M y,i ) i∈[n] ,
Decentralizing the setup. Note that the setup of the MCFE from Section 6.1 is already decentralized, in the sense that each ek i , msk i can be generated independently for all i ∈ [n], and dynamically (the users only have to agree on a particular group and hash function to use). Applying the transformation from Section 6.2 preserves that feature, since an independent single-input FE is used for each slot i ∈ [n]. Finally, the SSE from Section 6.3 can have a distributed setup if we use a DSum protocol to compute the value [ i t i ] 2 from the public key pk sse . Consequently, we obtain a scheme where there is no need of a trusted authority.

Chapter 7

Functional Encryption for Quadratic Functions

In this section, we present the first public-key FE scheme based on a standard assumption that supports a functionality beyond inner product, or predicates. In our scheme, ciphertexts are associated with a set of values, and secret keys are associated with a degreetwo polynomial. This way, the decryption of a ciphertext ct (x 1 ,...,xn)∈Z n p with a secret key dk P ∈Zp[X 1 ,...,Xn],deg(P )≤2 recovers P (x 1 , . . . , x n ). The ciphertext size is O(n) group elements, improving upon [ABDP15, ALS16], which would require O(n 2 ) group elements, since they build an FE scheme for inner product. Our FE scheme is proved selectively secure under the Matrix Diffie-Hellman assumption [EHK + 13], which generalizes standard assumptions such as DLIN or k-Lin for k ≥ 1, and the 3-PDDH assumption [START_REF] Boneh | Fully collusion resistant traitor tracing with short ciphertexts and private keys[END_REF]. Constructions whose security is justified in the generic group model can be found in [BCFG17,[START_REF] Sans | Reading in the dark: Classifying encrypted digits with functional encryption[END_REF]. See also [START_REF] Lin | Indistinguishability obfuscation from SXDH on 5-linear maps and locality-5 PRGs[END_REF][START_REF] Ananth | Projective arithmetic functional encryption and indistinguishability obfuscation from degree-5 multilinear maps[END_REF] for private-key variants. The state of the art for functional encryption for quadratic functions is summarized in Figure 7.1.

Overview of our construction

The difficulty is to have ciphertexts ct (x 1 ,...,xn) of O(n) group elements, that must hide the message (x 1 , . . . , x n ) ∈ Z n p , but still contain enough information to recover the n 2 values x i • x j for i, j ∈ [n]. To ensure the message is hidden, the ciphertext will contain an encryption of each value x i . Since we want to multiply together these encryptions to compute products x i •x j , and since these encryption are composed of group elements, we require a pairing e : G 1 × G 2 → G T , where G 1 , G 2 , and G T are additively written, prime-order groups. Namely, decryption pairs encrypted values in G 1 with encrypted values in G 2 . For this reason, it makes sense to re-write the function as: X := Z n p × Z m p , K := Z n•m p , and for all (x, y) ∈ X , α ∈ K,

F ((x, y), α) = i∈[n],j∈[m] α i,j x i y j .
Private-key, one-ciphertext secure FE. Our starting point is a private-key FE for inner product, that is only secure for one challenge ciphertext: ,(x,y))] T , from which one can extract F (α, (x, y)) since [(a ⊥ ) ⊤ b ⊥ ] T is public, simply by enumerating all the possible values for F (α, (x, y)). This is efficient as long as the output always lies in a polynomial size domain.

ct (x,y) := {[Ar i + b ⊥ x i ] 1 } i∈[n] , {[Bs j + a ⊥ y j ] 2 } j∈[m] , dk α := [ i,j α i,j r ⊤ i A ⊤ Bs j ] T ,
+ b ⊥ x i ] ⊤ 1 , [Bs j + a ⊥ y j ] 2 ) = dk F + (a ⊥ ) ⊤ b ⊥ • [F (F
Security relies on the D k -MDDH Assumption [EHK + 13], which stipulates that given

[A] 1 , [B] 2 drawn from a matrix distribution D k over Z (k+1)×k p , [Ar] 1 ≈ c [u] 1 ≈ c [Ar + b ⊥ ] 1 and [Bs] 2 ≈ c [v] 2 ≈ c [Bs + a ⊥ ] 2 ,
where r, s ← R Z k p , and u, v ← R Z k+1 p . This allows us to change ct (x (0) ,y (0) ) into ct (x (1) ,y (1) ) , but creates an extra term x (1)⊤ Fy (1)x (0)⊤ Fy (0) T in the secret keys dk α . We conclude the proof using the fact that for all the α queried to OKeygen, F (α, (x (0) , y (0) )) = F (α, (x (1) , y (1) )), as required by the security definition for FE (see Definition 19), which cancels out the extra term in all secret keys. Public-key FE. We now present how to obtain to modify this simple scheme to obtain a public-key FE. To solve this problem, we add an extra dimension, namely, we use bases A|b ⊥ 0 0 1 and B|a ⊥ 0 0 1 where the extra dimension will be used for correctness, while (A|b ⊥ ) and (B|a ⊥ ) will be used for security (using the MDDH assumption, since a ⊥ and b ⊥ are not part of the public key anymore).

• To avoid mix and match attacks, the encryption randomizes the bases

A|b ⊥ 0 0 1 and B|a ⊥ 0 0 1 into W -1 A|b ⊥ 0 0 1 and W ⊤ B|a ⊥ 0 0 1
for W ← R GL k+2 a random invertible matrix. This "glues" the components of a ciphertext that are in G 1 to those that are in G 2 .

• We randomize the ciphertexts so as to contain [Ar i • γ] 1 and [Bs j • σ] 2 , where γ, σ ← R Z p are the same for all i ∈ [n], and j ∈ [m], but fresh for each ciphertext. The ciphertexts also contain [γ • σ] 1 , for correctness.

Related works.

We note that the techniques used here share some similarities with Dual Pairing Vector Space constructions (e.g., [OT08, OT09, Lew12, CLL + 13]). In particular, our produced ciphertexts and private keys are distributed as in their corresponding counterparts in [START_REF] Okamoto | Homomorphic encryption and signatures from vector decomposition[END_REF]. The similarities end here though. These previous constructions all rely on the Dual System Encryption paradigm [START_REF] Waters | Dual system encryption: Realizing fully secure IBE and HIBE under simple assumptions[END_REF], where the security proof uses a hybrid argument over all secret keys, leaving the distribution of the public key untouched. Our approach, on the other hand, manages to avoid this inherent security loss by changing the distributions of both the secret and public keys. Our approach also differs from [START_REF] Boneh | Fully collusion resistant traitor tracing with short ciphertexts and private keys[END_REF] and follow-up works [START_REF] Boneh | A fully collusion resistant broadcast, trace, and revoke system[END_REF][START_REF] Garg | Building efficient fully collusion-resilient traitor tracing and revocation schemes[END_REF] in that they focus on the comparison predicate, a function that can be expressed via a quadratic function that is significantly simpler than those considered here. Indeed, for the case of comparisons predicates it is enough to consider vectors of the form:

[Ar i + x i b ⊥ ] 1 , [Bs j + y j a ⊥ ] 2
, where x i and y j are either 0, or some random value (fixed at setup time, and identical for all ciphertexts and secret keys), or are just random garbage. The work of [Lin17, AS17] present constructions of private-key functional encryption schemes for degree-D poly-nomials based on D-linear maps. As a special case for D = 2, these schemes support quadratic polynomials from bilinear maps, as ours. Also, in terms of security, the construction of [START_REF] Lin | Indistinguishability obfuscation from SXDH on 5-linear maps and locality-5 PRGs[END_REF] is proven selectively secure based on the SXDH assumption, while the scheme of [START_REF] Ananth | Projective arithmetic functional encryption and indistinguishability obfuscation from degree-5 multilinear maps[END_REF] is selectively secure based on ad-hoc assumptions that are justified in the multilinear group model.

In comparison to these works, our scheme has the advantage of working in the (arguably more challenging) public key setting. [BCFG17] also gave an adaptively secure construction in the generic group model. We only present the construction whose security is based on standard assumption. Namely, we start by giving the private-key FE whose security only handles one challenge ciphertext. We then present the full-fledged public-key FE.

Private-key FE with one-SEL-IND security

We give in Figure 7.2 a private-key FE for quadratic functions, that is, the functionality F K,X,Y quad : K × X → Z, with K := [0, K] nm , X := [0, X] n × [0, Y ] m , Z := [0, nmKXY ], such that for any α ∈ K, (x, y) ∈ X , we have:

F K,X,Y
quad (α, (x, y)) = i,j α i,j x i y j .

For correctness, we require that nmKXY is of polynomial size in the security parameter. The one-SEL-SIM security relies on the D k (p)-MDDH assumption in asymmetric pairing groups.

Correctness. For any (x, y) ∈ X , i ∈ [n], j ∈ [m], we have:

e([c i ] 1 , [ c j ] 2 ) = [r ⊤ i A ⊤ Bs j + (b ⊥ ) ⊤ a ⊥ x i y j ] T ,
since A ⊤ a ⊥ = B ⊤ b ⊥ = 0. Therefore, for any (α i,j ) i,j ∈ K, the decryption computes

D := [ i,j α i,j r ⊤ i A ⊤ Bs j + i,j α i,j x i y j • (b ⊥ ) ⊤ a ⊥ ] T -e(K, [1] 2 ) -e([1] 1 , K) = i,j α i,j x i y j • [(b ⊥ ) ⊤ a ⊥ ] T .
Note that (b ⊥ ) ⊤ a ⊥ = 0 with probability 1 -1 Ω(p) over the choices of A, B ← R D k , a ⊥ ← R orth(A), and b ⊥ ← R orth(B) (see Definition 9). Therefore, one can enumerate all possible v ∈ Z and check if v • [(b ⊥ ) ⊤ a ⊥ ] T = D. This can be done in time |Z| = nmKXY + 1, which is of polynomial size in the security parameter. OKeygen(α ∈ K): Thus, in game G 0 , for all α ∈ Z n×m p , OKeygen(α) computes:

u ← R Z p , K := [ i,j α i,j c ⊤ i c j ] 1 -[ i,j α i,j x (β) i y (β) j • (b ⊥ ) ⊤ a ⊥ ] 1 -[u] 1 , K := [u] 2 Return dk α := (K, K)
K := i,j α i,j [c ⊤ i c j ] 1 -[ i,j α i,j x (β) i y (β) j • (b ⊥ ) ⊤ a ⊥ ] 1 -[u] 1 = i,j α i,j [r ⊤ i A ⊤ Bs j ] 1 -[u] 1 .
Game G 1 : is the same as game G 0 except that the vectors [c i ] from the challenge ciphertext are uniformly random over G k+1 1 . In Lemma 43 we show that G 0 is computationally indistinguishable from G 1 under the D k (p)-MDDH assumption in G 1 .

Game G 2 : is the same as game G 1 except that the vectors c j from the challenge ciphertext are uniformly random over G k+1 2 . In Lemma 44 we show that G 1 is computationally indistinguishable from G 2 under the D k (p)-MDDH assumption. Finally, we show in Lemma 45 that the adversary's view in this game is independent of the bit β, and thus the adversary's advantage in this game is zero, which concludes the proof. Note that the leftmost distribution corresponds to gpk, pk, {c i } i∈ [n] , and OKeygen distributed as in games G 1 or G 2 (these are identically distributed in these two games), while the last distribution corresponds to gpk, pk, {c i } i∈ [n] , and OKeygen simulated by B ′ 1 . Finally, when B ′ 1 is given a real MDDH challenge, i.e., when for all j ∈ [m], h j := Bs j , for s j ← R Z k p , we have c j := Bs j + y (β) j a ⊥ , exactly as in game G 1 , whereas c j is uniformly random over Z k+1 p when B ′ 1 is given a random challenge, i.e., when for all j ∈ [m], h j ← R Z k+1 p , as in game G 2 .

Public-key FE

We give in Figure 7.6 a public-key FE for quadratic functions, that is, the functionality F K,X,Y quad defined in the previous section. It builds upon the private-key from the previous section, as explained in the overview. We prove one-SEL-IND security, which implies many-SEL-IND security via a standard argument, since we are in the public-key setting. This is proved under the D k (p)-MDDH assumption in both G 1 and G 2 , as well as the 3-PDDH assumption (see Definition 15). Game G 1 : with the above observation in mind, in this game we change the distribution of the public key elements so as to be interpreted as an FE one ciphertext encrypting the vectors ( x, y) = x (β) -x (0) ,

K := [ i∈[n],j∈[m] α i,j r ⊤ i A ⊤ Bs j + r ⊤ i+n A ⊤ Bs j+m ] 1 -[u] 1 ∈ G 1 K := [u] 2 ∈ G 2 ,
y (β) y (0) ∈ Z 2n p × Z 2m p
In Lemma 46 we show how to argue that game G 1 is computationally indistinguishable from game G 0 based on the selective, single-ciphertext security of FE one (that in turn reduces to D k (p)-MDDH).

Game G 2 : in this game we change the distribution of the c i components of the challenge ciphertext. We switch from using

{γAr i + x i • γb ⊥ } i∈[2n] to {γAr i + x i • (γ + v)b ⊥ } i∈[2n] ,
for a random v ← R Z p . In Lemma 47 we prove we can do this switch using the 3-PDDH assumption.

Game G 3 : by using a statistical argument we show that in this game the challenge ciphertexts can be rewritten as . This change is analogous to that introduced in game G 2 , and its indistinguishability follows from the 3-PDDH assumption.

c i := γAr i + (γ + v)x (β) i b ⊥ 0 ⊤ W -1 ; c n+i := γAr n+i -(γ + v)x (0) i b ⊥ x (0) i ⊤ V -1 ;
The crucial observation is that the public key in this game can be seen as an FE one ciphertext encrypting vector ( x, y), while the challenge ciphertext of game G 4 can be seen as an encryption of vectors 0 x (0) , 0 y (0) ∈ Z 2n p × Z 2m p using such public key. At a high level, the idea is that we moved to a game in which the dependence on the challenge messages (x (β) , y (β) ) is only in the public key.

Game G 5 : in this game we change back the distribution of the public key elements so as to be interpreted as an FE one ciphertext encrypting vectors (0, 0). The fact that game G 3 and game G 4 are computationally indistinguishable can be argued based on the selective, single-ciphertext security of the FE one scheme.

The proof is concluded by arguing that in this game the view of the adversary is independent of the bit β.

We now prove the lemmas needed to prove the above theorem. In order to apply the one-SEL-IND security of the private-key FE (Theorem19) we rely on the fact that the public key of FE can be seen as an FE one encryption of longer vectors x (0) = 0 ∈ Z 2n p and y (0) = 0 ∈ Z 2m p in G 0 ,

x (1) = (x (β) ||x (0) ) ∈ Z 2n p and y (1) = (y (β) ||y (0) ) ∈ Z 2m p in G 1 . Also, secret keys in FE can be seen as FE one secret keys corresponding to matrices

α = α 0 0 α ∈ Z 2n×2m p .
Note that we are using the matrix representation for functions α ∈ Z nm p , since more convenient here. In particular, for any vector x ∈ Z n p , y ∈ Z m p , we denote by x ⊤ αy = i,j α i,j x i y j . With this observation in mind, it can be seen that the restriction x (1)⊤ α y (1) = x (0)⊤ α y (0) in the queries made by A translates into legitimate queries by B 0 since x (β)⊤ α y (β) -x (0)⊤ α y (0) = 0 and x (0)⊤ α y (0) = x (1)⊤ α y (1) = 0. Thus, by Theorem 19 (one-SEL-IND security of privatekey scheme), we obtain the lemma.

Lemma 47: From game G 1 to game G 2

There exists a PPT adversary B 1 such that:

|Adv G 1 (A) -Adv G 2 (A)| ≤ 2 • Adv 3-PDDH PG,B 1 (λ) + 2 -Ω(λ) .
Here, we change the distribution of the challenge ciphertexts, using the 3-PDDH assumption. It can be seen that when [z] 1 is a real 3-PDDH challenge, i.e., [z] 1 = [abc] 1 , then B 2 simulates game G 1 ; whereas it simulates game G 2 when [z] 1 ← R G 1 . In particular, while this is easy to see for the elements of the public key and for ciphertexts [ c j ] 2 , [ c m+j ] 2 , for the ciphertext elements [c i ] 1 , [c n+i ] 1 we observe that they can be written as

c i :=    γB ⊤ Ar i z • x (β) i • (b ⊥ ) ⊤ a ⊥ x (β) i    ⊤ B|b • a ⊥ 0 0 1 -1 W -1 = γAr i + zb -1 • x (β) i b ⊥ x (β) i ⊤ W -1 c n+i :=    γB ⊤ Ar n+i -z • x (0) i • (b ⊥ ) ⊤ a ⊥ 0    ⊤ B|b • a ⊥ 0 0 1 -1 V -1 = γAr n+i + zb -1 • x (0) i b ⊥ 0 ⊤ V -1 .
So, if z = abc, then zb -1 = aγ and the ciphertexts are distributed as in G 1 ; otherwise if z is random zb -1 is identically distributed to (aγ+v) as in G 2 . This proves |Adv G 1 (A)-Adv G 2 (A)| ≤ Adv 3-PDDH PG,B 2 (λ) + 2 -Ω(λ) .

Lemma 48: From game G 2 to G 3

|Adv G 2 (A) -Adv G 3 (A)| ≤ 2 -Ω(λ) .
Here, we change the distribution of the challenge ciphertexts, using a statistical argument.

Proof of Lemma 48. First, we use the fact that for all γ ∈ Z p :

(γ, v + γ) v← R Zp ≡ (γ, v) v← R Zp .

Therefore, we can write the challenge ciphertexts as follows. For all i∈ [n], j ∈ [m]:

c i := γAr i + vx (β) i b ⊥ x (β) i ⊤ W -1 , c n+i := γAr n+i -vx (0) i b ⊥ 0 ⊤ V -1 .
Then, we use the facts that:

• (v ← R Z p ) ≈ 1 p (v ← R Z p ) such that v + 1 = 0 mod p.
• (A, B, a ⊥ ) A,B← R D k ,a ⊥ ← R orth(A) ≈ 1 Ω(p) (A, B, a ⊥ ) A,B← R D k ,a ⊥ ← R orth(A)\Span(B) , by Definition 9.

• For any v ∈ Z p such that v +1 = 0 mod p, W ← R GL k+2 (p) is identically distributed than

W • B|a ⊥ 0 0 1 •    ID k×k 0 0 0 v v+1 1 v+1 0 -1 1    • B|a ⊥ 0 0 1 -1
, where W ← R GL k+2 (p),

A, B ← R D k , and a ⊥ ← R orth(A) \ Span(B).

Therefore, we can change the distribution of {c i , c j } i∈ [n],j∈ [m] as follows:

c j = W • B|a ⊥ 0 0 1 •    ID k×k 0 0 0 v v+1 1 v+1 0 -1 1       s j y (β) j y (β) j    = W • B|a ⊥ 0 0 1 •    s j y (β) j 0    = W • Bs j + y (β)
j a ⊥ 0 and

c i =    γr i vx (β) i x (β) i    ⊤    A ⊤ B 0 0 0 (b ⊥ ) ⊤ a ⊥ 0 0 0 1    •    ID k×k 0 0 0 v v+1 1 v+1 0 -1 1    -1 • B|a ⊥ 0 0 1 -1 • W -1 =    γr i v • x (β) i x (β) i    ⊤    A ⊤ B 0 0 0 (b ⊥ ) ⊤ a ⊥ -1 v+1 0 (b ⊥ ) ⊤ a ⊥ v v+1    • B|a ⊥ 0 0 1 -1 • W -1 =    γr i (v + 1) • x (β) i 0    ⊤ •    A ⊤ B 0 0 0 (b ⊥ ) ⊤ a ⊥ 0 0 0 1    • B|a ⊥ 0 0 1 -1 • W -1 = γAr i + (v + 1) • x (β) i b ⊥ 0 ⊤ • W -1
Then, we use the facts that:

• v ← R Z p such that v + 1 = 0 mod p ≈ 1 p v ← R Z p such that v + 1 = 0 mod p and v = 0 mod p.

• For any v ∈ Z p such that v + 1 = 0 mod p and v = 0 mod p, V ← R GL k+2 (p) is

identically distributed than V • B|a ⊥ 0 0 1 •   
ID k×k 0 0 0 1

1 v 0 1 1 + 1 v    • B|a ⊥ 0 0 1 -1
, where V ← R GL k+2 (p), A, B ← R D k , and a ⊥ ← R orth(A) \ Span(B).

Therefore, we can change the distribution of {c n+i , c m+j } i∈[n],j∈ [m] as follows:

c m+j = V • B|a ⊥ 0 0 1 •   
ID k×k 0 0 0 1 ID k×k 0 0 0 1

1 v 0 1 1 + 1 v       s j y (0) j 0    = V • B|a ⊥ 0 0 1 •   
1 v 0 1 1 + 1 v    -1 • B|a ⊥ 0 0 1 -1 • V -1 =    γr n+i -vx (0) i 0    ⊤    A ⊤ B 0 0 0 (b ⊥ ) ⊤ a ⊥ • (1 + 1 v ) -1 v 0 -(b ⊥ ) ⊤ a ⊥ 1    • B|a ⊥ 0 0 1 -1 • V -1 =    γr n+i -(v + 1)x (0) i x (0) i    ⊤    A ⊤ B 0 0 0 (b ⊥ ) ⊤ a ⊥ 0 0 0 1    • B|a ⊥ 0 0 1 -1 • V -1 = γAr n+i -(v + 1)x (0) i b ⊥ x (0) i ⊤ • V -1
Finally, we use the fact that for any γ ∈ Z p : (v+1) where v ← R Z p such that v+1 = 0 mod p and v = 0 mod p ≈ 2 p (v + γ), where v ← R Z p . Thus, we obtain, for all i ∈ [n] and j ∈ [m]: There exists an adversary B 3 such that:

c i := γAr i + (v + γ)x (β) i b ⊥ 0 ⊤ W -1 , c n+i := γAr n+i -(v + γ)x (0) i b ⊥ x (0) i ⊤ V -1 ,
|Adv G 3 (A) -Adv G 4 (A)| ≤ 2 • Adv 3-PDDH
PG,B 2 (λ) + 2 -Ω(λ) .

Here, we change the distribution of the challenge ciphertext, using the 3-PDDH assumption, as for Lemma 47. .

Here we use the fact that (B|ba ⊥ ) is full rank with probability 1 -1 Ω(p) over A, B ← R D k , a ⊥ ← R orth(A), and b ← R Z p (see Definition 9).

Then, for i ∈ [n], j ∈ [m], it computes Then, it simulates OKeygen as in G 4 (see Figure 7.7). Finally, if A outputs β ′ , B 2 outputs 1 if β ′ = β, and 0 otherwise.

[c i ] 1 :=        γr i z • x (β) i x (β) i    ⊤    A ⊤ B 0 0 0 (b ⊥ ) ⊤ a ⊥ 0 0 0 1    W -1     1 and [ c j ] 2 :=    W    s j y (β) j y (β) j       2 [c n+i ] 1 :=       γr n+i -z • x (0) i 0    ⊤    A ⊤ B 0 0 0 (b ⊥ ) ⊤ a ⊥ 0 0 0 1    V -1   
It can be seen that when [z] 1 is a real 3-PDDH challenge, i.e., [z] 1 = [abc] 1 , then B 3 simulates game G 4 ; whereas it simulates game G 3 when [z] 1 ← R G 1 . In particular, while this is easy to see for the elements of the public key and for ciphertexts [ c j ] 2 , [ c m+j ] 2 , for the ciphertext elements [c i ] 1 , [c n+i ] 1 we observe that they can be written as

c i :=    γB ⊤ Ar i z • x (β) i • (b ⊥ ) ⊤ a ⊥ x (β) i    ⊤ B|b • a ⊥ 0 0 1 -1 W -1 = γAr i + zb -1 • x (β) i b ⊥ x (β) i ⊤ W -1 c n+i :=    γB ⊤ Ar n+i -z • x (0) i • (b ⊥ ) ⊤ a ⊥ 0    ⊤ B|b • a ⊥ 0 0 1 -1 V -1 = γAr n+i + zb -1 • x (0) i b ⊥ 0 ⊤ V -1 .
So, if z = abc, then zb -1 = aγ and the ciphertexts are distributed as in G 4 ; otherwise, if z is random, zb -1 is identically distributed to (aγ + v) as in G 3 . This proves |Adv G 3 (A) -Adv G 4 (A)| ≤ Adv 3-PDDH PG,B 3 (λ) + 2 -Ω(λ) . schemes for the inner-product functionality that improve those from Chapter 4 in two main directions.

First, we put forward a novel methodology to convert single-input functional encryption for inner products into multi-input schemes for the same functionality. Our transformation is surprisingly simple, general and efficient. In particular, it does not require pairings and it can be instantiated with all known single-input schemes. This leads to two main advances. First, we enlarge the set of assumptions this primitive can be based on, notably, obtaining new MIFEs for inner products from plain DDH, LWE, and Decisional Composite Residuosity. Second, we obtain the first MIFE schemes from standard assumptions where decryption works efficiently even for messages of super-polynomial size. This work appeared in [ACF + 18]. As for the pairing-based MIFE presented in Chapter 4, the novelty of the work presented in Chapter 5 of this thesis is that its security handles corruptions of input slots.

Then, we turned our attention to multi-client functional encryption for inner products, which enhances multi-input functional encryption in the following way. In MCFE, the encryption algorithm takes as an additional input a label (typically a time-stamp), and ciphertexts from different input slots can only be combined when they are encrypted under the same label. This limits the leakage of information from the encrypted messages. Multi-input functional encryption corresponds to the case where every message is encrypted under the same label.

In Chapter 6, we give the first MCFE for inner products from standard assumptions, namely, bilinear groups. We first give a simple construction whose security is based on the Decisional Diffie Hellman assumption in the random oracle model, which only satisfies a somewhat weak security model. This construction appeared in [CDG + 18a].

Then, we give several transformations to strengthen security, using a new primitive that we called Secret Sharing Encapsulation; and an extra layer of single-input functional encryption on top of the original scheme. The resulting scheme is fully secure, and relies on bilinear groups, in the random oracle model. We also show a generic way to decentralize the generation of the functional decryption keys, and the setup of the scheme. These can be performed independently by all users, without interaction. We obtain a multi-client functional encryption where there is no need for trusted authority holding any master secret key. These transformations appeared in [CDG + 18b].

Finally, in Chapter 7, we give the first functional encryption that supports the evaluation of degree-2 polynomials on encrypted data, from standard assumptions. This work appeared in [BCFG17]. The ciphertexts are succinct: their size only depends linearly on the encrypted message, and not the functions for which functional decryption keys are generated. This is as far as it goes in terms of functional encryption beyond predicate encryption, for constant degree polynomials, from standard assumptions. Recall that in [START_REF] Lin | Indistinguishability obfuscation from trilinear maps and block-wise local PRGs[END_REF], it is shown that succinct functional encryption which supports the evaluation of degree-3 polynomials on encrypted data already implies indistinguishability obfuscation (together with the existence of block-wise 3local PRG), a powerful tool that has surprisingly many applications in cryptography, including solving long standing open problems (see [START_REF] Sahai | How to use indistinguishability obfuscation: deniable encryption, and more[END_REF]). Unfortunately, there is no known construction of such functional encryption (with unbounded collusion) from standard assumptions.

Open Problems

Tight security. Can we exhibit tight security reduction for more advanced encryption schemes, such as attribute-based encryption, or functional encryption? Even though tightly secure identity-based encryption are known [CW13, HKS15, AHY15a, GCD + 16], all of these schemes have a large public key (it contains Ω(λ) group elements, where λ denotes the security parameter), or rely on composite-order pairings [START_REF] Chen | Tightly secure IBE under constant-size master public key[END_REF], which are less efficient than their prime-order counterpart. Current techniques, such as adaptive partitioning from [START_REF] Hofheinz | Adaptive partitioning[END_REF], have thus far been unsuccessful at providing a tightly-secure IBE with compact ciphertexts and public key, in the prime-order setting.

More generally, we believe bridging the gap between currently known attacks against cryptographic schemes and their security proof is a fruitful research agenda. Finding tighter security reductions is one way to bridge that gap, by ruling out more attacks than traditional, asymptotic security reductions. Another approach consists of finding explicit attacks against particular cryptosystems that match as much as possible the security proof. As far as we know, there are no known attacks against concrete public-key encryption schemes which make use of the fact that the security reduction is not tight. This deserves to be investigated.

Functional encryption.

Interesting open problems include building functional encryption that supports the evaluation of degree-2 polynomials on encrypted data with large messages. Current constructions [BCFG17,[START_REF] Sans | Reading in the dark: Classifying encrypted digits with functional encryption[END_REF] crucially rely on the use of pairings, which only allows decryption to recover the value in the exponent of a group element. Since correctness involves solving a discrete logarithm in this group, we require the size of the message to be bounded by a polynomial in the security parameter (note that discrete logarithm should be hard to compute for large values, for the security of the scheme). Because they would probably require radically new techniques, and most likely avoid the use of pairings, such functional encryption with large messages would be much insightful.

Besides, exploring larger classes of functions from standard assumptions, in particular getting degree-3 succinct functional encryption from standard assumptions (and thereby, indistinguishability obfuscation, given the result of [START_REF] Lin | Indistinguishability obfuscation from trilinear maps and block-wise local PRGs[END_REF]) would be a breakthrough.

On the more practical side, mitigating the reliance on trusted third party (which holds a master secret key) would increase the practical relevance of functional encryption. Decentralized multi-client functional encryption goes into that direction. We hope this work will inspire further research following the same approach for other classes of functions, or predicate encryption.

a

  11 P ... a 1m P a n1 P ... a nm P    ∈ G n×m We will always use this implicit notation of elements in G, i.e., we let [a] ∈ G be an element in G. Note that from [a] ∈ G it is generally hard to compute the value a (discrete logarithm problem in G). Obviously, given [a], [b] ∈ G and a scalar x ∈ Z p , one can efficiently compute [ax] ∈ G and [a + b] ∈ G.

-π x-c 2 2 σ 2

 2 be the Gaussian function on R n with center c and parameter σ. Let ρ σ,c (Λ) := x∈Λ ρ σ,c (x) be the discrete integral of ρ σ,c over Λ, and let D Λ,σ,c be the discrete Gaussian distribution over Λ with center c and parameter σ. Namely, for all y ∈ Λ, D Λ,σ,c (y) := ρ σ,c (y) ρ σ,c(Λ) .

  fact, we show how to generically transform any xx-yy-IND-weakly and xx-yy-IND-zero secure MIFE into a full-fledged xx-yy-IND secure MIFE, only using symmetric-key encryption.

Figure 2 . 1 :

 21 Figure 2.1: Compiler from any MIFE ′ := (Setup ′ , Enc ′ , KeyGen ′ , Dec ′ ) with xx-yy-weak and xx-yyzero security to the MIFE := (Setup, Enc, KeyGen, Dec) with xx-yy security. Here, (Enc SE , Dec SE ) is a symmetric key encryption scheme with key space K as defined in Definition 2.

Figure 2 . 2 :

 22 Figure 2.2: FE, a functional encryption scheme for the functionality F m,X,Y IP , whose one-SEL-SIM security is based on the D k (p)-MDDH assumption.

Theorem 3 :

 3 Multi-instance, one-SEL-SIM securityIf the D k (p)-MDDH assumption holds in G, then the single-input FE in Figure5.7 is one-SEL-SIM secure, for n instances.

Figure 2 . 3 :

 23 Figure 2.3: Games for the proof of Theorem 3. In each procedure, the components inside a solid (dotted) frame are only present in the games marked by a solid (dotted) frame. Here, I ⊆ [n] denotes the set of instances for which a challenge ciphertext is queried.

Figure 2 . 4 :

 24 Figure 2.4: Simulator ( GSetup, Setup, KeyGen, Enc) for the one-SEL-SIM security of the FE from Figure 5.7.

p

  and Z k+1 p \Span(A) are 1 p -close, for any A ∈ Z (k+1)×k p of rank k. So we can take u ← R Z k+1 p \ Span(A) instead of uniformly random over Z k+1 p . Combining these facts, we obtain a PPT adversary B such that |Adv 1

Theorem 4 :

 4 Multi-instance, many-AD-IND securityIf the D k (p)-MDDH assumption holds in G, then the single-input FE in Figure5.7 is many-AD-IND secure for n instances.

Figure 2 . 5 :

 25 Figure 2.5: Games for the proof of Theorem 4. In each procedure, the components inside a solid (dotted, gray) frame are only present in the games marked by a solid (dotted, gray) frame. The encryption oracle OEnc can only be called once by adversary A.

Figure 2 . 6 :

 26 Figure 2.6: Functional encryption scheme for the class F m,X,Y IP

Figure 2 . 7 :

 27 Figure 2.7: Functional encryption scheme for the class F m,X,Y IP

Figure 3

 3 Figure 3.2: KEM, an IND-PCA-secure KEM under the U k (p)-MDDH assumption, with tagspace T = {0, 1} λ . Here, GGen is a prime-order group generator (see Section 2.2.1).

Theorem 7 :

 7 IND-PCA securityThe tag-based Key Encapsulation Mechanism KEM defined in Figure3.2 is IND-PCA secure if the U k (p)-MDDH assumption holds in G. Namely, for any adversary A, there exists an adversary B such that T(B) ≈ T(A)

Figure 3 . 3 :

 33 Figure 3.3: Sequence of games for the proof of Theorem 7. Throughout, we have (i) k τ := λ

Figure 3

 3 Figure 3.4: Games for the proof of Theorem 7. In each procedure, the components inside a solid (dotted) frame are only present in the games marked by a solid (dotted) frame.

  (1) i+1 in G 2.i.3 (see Figure3.5). Therefore, by definition of RF (1)

Figure 3 . 7 :

 37 Figure 3.7: Games for the proof of Theorem 8. In each procedure, the components inside a solid (dotted, gray) frame are only present in the games marked by a solid (dotted, gray) frame.

  and generates the public key pk, simulates the oracle EncO and DecO as in G 0.Q Dec .(i) Suppose B ′ 0 receives some [y] through a DecO query, such that there is a [y ′ ] from an earlier EncO query with H([y]) = H([y ′ ]), and y = y ′ . Then, we distinguish the following cases:Case 1: y = y ′ . Then there is a collision H([y]) = H([y ′ ]) that B ′ 0 can directly output.Case 2: y = y ′ (but y = y ′ ). Then, y / ∈ Span(M) (because y = y ′ ), and DecO outputs ⊥, as would happen both in G 0.Q Dec and G 1.Q Dec .

  and τ |i denotes the i-bit prefix of τ (see Figure 3.8). Note that B ′ 3.i.0 can compute efficiently M ⊥ from M. EncO(m 0 , m 1 ): on the j'th query, for j = 1, . . . , Q Enc , B ′ 3.i.0 samples r ← Z k p , computes [y] := [Mr], τ := H([y]), and computes [y] as follows: if τ i+1 = 0 : [y] := [Mr + h j ] if τ i+1 = 1 : [y] ← R G 2k This way, B ′ 3.i.0 simulates EncO as in G 3.i.0 when [h j ] := [M 0 r 0 ] with r 0 ← R Z k p , and as in G 3.i when [h j ] ← R G 2k . DecO(C, φ): Finally, B ′ 3.i.0 simulates DecO as described in Figure 3.8.

i

  in G 3.i.1 , whereas it uses the random function RF (0) i+1 in G 3.i.2 (see Figure 3.8). Therefore, by definition of RF (0)

  and outputs pk as in G 4 (see Figure 3.7). It also picks j ⋆ ← R {1, . . . , Q Enc }, and b ← R {0, 1}. EncO(m 0 , m 1 ) : On the j ⋆ 'th query, B 3.λ.j picks y ← R Z 3k p , calls the encryption oracle for AE, EncO(m b , m b ) to get φ b := Enc AE (K ⋆ , m b ), for a random K ⋆ ← R G. The rest of the simulation goes as in G 4 (see Figure 3.7), that is: if H([y]) / ∈ T Enc ∪ T Dec , B 3.λ.j returns ([y, ], φ b ), sets T Enc := T Enc ∪ {H([y])} and C Enc := C Enc ∪ {([y], φ b )}, otherwise, it returns ⊥. The other j = j ⋆ queries are simulated as in G 4 . DecO([y], φ): the first j queries are simulated as in G 4 , the last Q Encj -1 as in G 3.λ . For the j + 1-st query ([y ⋆ ], φ ⋆ ), B 3.λ.j calls the decryption oracle for AE, DecO([y ⋆ ], φ ⋆ ) to get Dec AE (K ⋆ , φ ⋆ ). The rest of the simulation goes as in

  s], [x + ws]), sk y := w, y . Decryption computes [ x, y ] = [x + ws] ⊤ y -[s] • w, y and then recovers x, y by computing the discrete log.

  Denote the j'th ciphertext query in the i'th slot by x j,b i , where b is the challenge bit. By decrypting the encryptions of x 2,b 1 , x 1,b 2 and x 1,b 1 , x 1,b 2 and substracting the two, the adversary learns x 2,b 1x 1,b 1

Figure 4

 4 Figure 4.1: Multi-input functional encryption scheme MIFE for the bounded norm inner-product over Z. FE := (GSetup ′ , Setup ′ , Enc ′ , KeyGen ′ , Dec ′ ) refers to a single-input inner-product FE.

Figure 4 . 2 :

 42 Figure 4.2: Sequence of games for the proof of Theorem 9. Here, for any slot i ∈ [n], ct i refers to the challenge ciphertext computed by oracle OEnc(i, (x 0 i , x 1 i )), d i and z refers to the vectors computed by the oracle OKeygen(y 1 • • • y n ) as part of dk y1 ••• yn , and ( GSetup, Setup, Enc, KeyGen) is the simulator for the one-SEL-SIM security of FE.

Figure 4 . 3 :

 43 Figure 4.3: Games for the proof of Theorem 9. In each procedure, the components inside a solid (dotted) frame are only present in the games marked by a solid (dotted) frame. Here, CS denotes the set of corrupted slots, HS := [n] \ CS denotes the set of honest slots, and I ⊆ [n] denotes the set of input slots for which there is a challenge ciphertext. We have HS ⊆ I.

Figure 4 . 4 :

 44 Figure 4.4: Sequence of games for the proof of Theorem 10. Here, for any slot i ∈ [n], and j ∈ [Q i ], ct j i refers to the j'th challenge ciphertext for slot i ∈ [n]. Changes are highlighted in gray for better visibility.

Figure 4 . 5 :

 45 Figure 4.5: Games for the proof of Theorem 10. In the selective variants of these games, the adversary sends its challenges {x j,b i } i∈[n],j∈[Qi],b∈{0,1} before seeing the public key and querying any decryption keys.

Figure 4 . 6 :

 46 Figure 4.6: Our private-key MIFE scheme for the functionality F m,X,Y n , which is proven many-SEL-IND-static in Corollary 2, and many-AD-IND secure in Theorem 51. Both rely on the D k (p)-MDDH assumption in G 1 and G 2 .

Figure 4 . 7 :

 47 Figure 4.7: Sequence of games for the proof of Theorem 11. Here, for any slot i ∈ [n], ([-c i ] 1 , [c ′

Figure 4 . 8 :

 48 Figure 4.8: Games for the proof of Theorem 11. In each procedure, the components inside a solid (dotted, gray) frame are only present in the games marked by a solid (dotted, gray) frame. Here, CS denotes the set of corrupted slots, and HS := [n] \ CS is the set of honest input slots. The oracle OEnc can be queried at most once per input slot.

\

  and u ← R Z k+1 p . 3. The uniform distribution over Z k+1 p and Z k+1 p Span(A) are 1 p -close, for all A of rank k. Combining these three facts, we obtain a PPT adversary B 1,β such that

Figure 5

 5 Figure 5.1: Private-key, information theoretically secure, multi-input FE scheme MIFE ot = (Setup ot , Enc ot , KeyGen ot , Dec ot ) for the class F m,L n .

Figure 5

 5 Figure 5.3: Private-key multi-input FE scheme MIFE := (Setup, Enc, KeyGen, Dec) for the functionality F m,L n from a public-key single-input FE FE := (Setup ′ , Enc ′ , KeyGen ′ , Dec ′ ) for the functionality F m,L IP , and the one-time multi-input FE MIFE ot = (Setup ot , Enc ot , KeyGen ot , Dec ot ) for the functionality F m,L n

Figure 5

 5 Figure 5.4: Private-key multi-input FE scheme MIFE = (Setup, Enc, KeyGen, Dec) for the functionality F m,X,Y n from public-key single-input FE scheme FE = (GSetup ′ , Setup ′ , Enc ′ , KeyGen ′ , Dec ′ ) for the functionality F m,3X,Y IP and the one-time multi-input FE MIFE ot = (Setup ot , Enc ot , KeyGen ot , Dec ot ) from Figure 5.1.

Figure 5 . 6 :

 56 Figure 5.6: Games for the proof of Theorem 14.

Figure 5 . 9 :

 59 Figure 5.9: Functional encryption scheme for the class F m,X,Y IP

Figure 6 . 1 :

 61 Figure 6.1: Comparison of the Inner-Product FE scheme from [ABDP15] and a similar MCFE obtained by introducing a hash function H.

Figure 6

 6 Figure 6.2: Private-key, one-AD-IND-weak secure, multi-client FE scheme MCFE = (Setup, Enc, KeyGen, Dec) for the class F m,X,Y n

Theorem 15 :

 15 one-AD-IND-weak securityThe scheme MCFE from Figure6.2 is one-AD-IND-weak secure assuming the D k (p)-MDDH assumption in G, in the random oracle model.

Figure 6 . 3 :

 63 Figure 6.3: Games for the proof of Theorem 15. Here, RF, RF ′ , RF ′′ are random functions onto G k+1 , Z k p , and Z * p , respectively, that are computed on the fly. In each procedure, the components inside a solid (dotted, gray) frame are only present in the games marked by a solid (dotted, gray) frame. Note that A's queries must satisfy the condition from Definition 25, including the extra condition, since we are only proving one-AD-IND-weak security.

  the game ends, and returns 0. Return α if Condition 1 and Extra condition from Definition 25 of one-AD-IND-weak security are satisfied, 0 otherwise.

  Finally, it returns the discrete logarithm α ∈ Z p .

Figure 6

 6 Figure 6.5: MCFE, a many-AD-IND-weak secure MCFE for inner product. Here, MCFE ′ := (Setup ′ , Enc ′ , KeyGen ′ , Dec ′ ) is the one-AD-IND-weak secure from Section 6.1, and IPFE := (IP.GSetup, IP.Setup, IP.Enc, IP.KeyGen, IP.Dec) is a many-AD-IND secure, public-key, single-input inner product FE. Here, H denotes the hash function that is part of pk ′ .

  condition 1 and extra condition from Definition 25 of many-AD-IND-weak security are satisfied; otherwise, return 0.

Figure 6 . 7 :

 67 Figure 6.7: SSE based on DBDH in asymmetric pairing groups.

  y): outputs dk y = (y, d y ), where d y is publicly computed as DSCombine({M y,i } i∈[n] );

•

  In the public-key setting, for the encryption to compute [Ar i + b ⊥ x i ] and [Bs j + a ⊥ y j ] for i ∈ [n], j ∈ [m] and any x ∈ Z n p , y ∈ Z m p , the vectors [a ⊥ ] 2 and [b ⊥ ] 1 would need to be part of the public key, which is incompatible with the MDDH assumption on [A] 1 or [B] 2 .

G 0 ,

 0 G 1 , G 2 : (x (0) , y (0) ), (x (1) , y(1) ) ← A(1 λ ) PG := (G 1 , G 2 , G T , p, P 1 , P 2 , e) ← R GGen(1 λ ), gpk := PG, A, B ← R D k , a ⊥ ← R orth(A), b ⊥ ← R orth(B), pk := [(a ⊥ ) ⊤ b ⊥ ] T , β ← R {0, 1}. For i ∈ [n], j ∈ [m]: r i ← R Z k p , s j ← R Z k p c i := Ar i + x (β) i b ⊥ , c i ← R G k+1 1 c j := Bs j + y (β) j a ⊥ , c j ← R G k+1 2 ct := {[c i ] 1 , [ c j ] 1 } i∈[n],j∈[m] β ′ ← A OKeygen(•) (gpk, pk, ct)Return 1 if β ′ = β, 0 otherwise.

Figure 7 .

 7 Figure 7.3: Games for the proof of Theorem 19. In each procedure, the components inside a solid (dotted) frame are only present in the games marked by a solid (dotted) frame.

Lemma 43 :

 43 From game G 0 to G 1There exists a PPT adversary B 0 such that|Adv G 0 (A) -Adv G 1 (A)| ≤ 2 • Adv D k (p)-mddh G 1 ,B 0 (λ) + 2 -Ω(λ) .Proof of Lemma 43. Here, we use the D k (p)-MDDH assumption on [A] 1 to change the distribution of the challenge ciphertext, after arguing that one can simulate the game without knowing a ⊥ or [A] 2 .Namely, we build a PPT adversary B ′ 0 against the n-foldD k -MDDH assumption in G 1 such that |Adv G 0 (A) -Adv G 1 (A)| ≤ 2 • Adv n-D k (p)-mddh G 1 ,B 0 (λ) + 2 -Ω(λ) . Then, by Lemma 1, this implies the existence of a PPT adversaryB 0 such that |Adv G 0 (A) -Adv G 1 (A)| ≤ 2 • Adv D k (p)-mddh G 1 ,B 0 (λ) + 2 -Ω(λ) .

B ′ 0 ••

 0 Figure 7.4: Adversary B ′ 0 against the n-fold D k (p)-MDDH assumption, for the proof of Lemma 43.Adversary B ′ 0 simulates the game to A as described in Figure7.4. We show that whenB ′ 0 is given a real MDDH challenge, that is, [h 1 | • • • |h n ] 1 := [AR] for R ← R Z k×n p, then it simulates the game G 0 , whereas it simulates the game G 1 when given a fully random challenge, i.e. when[h 1 | • • • |h n ] 1 ← R G (k+1)×n 1, which implies the lemma. We use the following facts. 1. For all s ∈ Z k p , B ∈ Z (k+1)×k p , b ⊥ ∈ orth(B), and a ⊥ ∈ Z k+1 p , we have: (b ⊥ ) ⊤ a ⊥ = (b ⊥ ) ⊤ (Bs + a ⊥ ).

Lemma 45 :

 45 Game G 2 Adv G 2 (A) = 0.Proof of Lemma 45. By definition of the security game, for all α queried to OKeygen, we have:i,j α i,j x (β) i y (β) j = i,j α i,j x (0) i y (0) j .Therefore, the view of the adversary in G 2 is completely independent from the random bit β ← R {0, 1}.

GSetup( 1

 1 λ , F K,X,Y quad ):PG := (G 1 , G 2 , G T , p, P 1 , P 2 , e) ← PGGen(1 λ ), gpk := PG Return gpk Setup(1 λ , gpk, F K,X,Y quad ): A, B ← R D k . For i ∈ [2n], j ∈ [2m], r i , s j ← R Z k p . Return pk := {[Ar i ] 1 , [Bs j ] 2 } i∈[2n],j∈[2m]and msk := A, B, {r i , s j } i∈[2n],j∈[2m] KeyGen(gpk, msk, α ∈ Z n×m p ):

⊤W⊤V

  where u ← R Z p . Return dk α := (K, K) ∈ G 1 × G 2 Enc(gpk, pk, (x, y) ∈ Z n p × Z m p ): W, V ← R GL k+2 (p), γ ← R Z p ; c 0 = c 0 := γ; for all i ∈ [n], j ∈ [m]: c i := γ • Ar i x i -1 , c n+i := γ • Ar n+i 0 -1 , c j := W Bs j y j , c m+j := V Bs m+j 0 ct (x,y) := {[c 0 ] 1 , [ c 0 ] 2 , [c i ] 1 , [ c j ] 2 } i∈[2n],j∈[2m]Dec(gpk, pk, ct (x,y) , dk α ):[d] T := i∈[n],j∈[m] α i,j e([c i ] 1 , [ c j ] 2 ) + e([c n+i ] 1 , [ c m+j ] 2 )e([c 0 ] 1 , K)e(K, [ c 0 ] 2 ) Return d.

Figure 7 . 6 :2

 76 Figure 7.6: FE, a scheme for the functionality F K,X,Y quad , whose one-SEL-IND security relies on the D k (p)-MDDH assumption and 3-PDDH assumption in asymmetric pairing groups.

Figure 7 . 7 :

 77 Figure 7.7: Games for the proof of Theorem 20. In each procedure, the components inside a solid (dotted, gray) frame are only present in the games marked by a solid (dotted, gray) frame.

.

  This step essentially shows that the change in game G 2 made the ciphertexts less dependent on the bit β.Game G 4 : in this game we change again the distribution of the challenge ciphertext components c i switching from using{γAr i + x i • (γ + v)b ⊥ } i∈[2n] to {γAr i + x i • γb ⊥ } i∈[2n]

Lemma 46 :

 46 from game G 0 to game G 1 There exists a PPT adversary B 0 :|Adv G 0 (A) -Adv G 1 (A)| ≤ 2 • Adv one-SEL-IND FEone,B 0 (λ).Proof of Lemma 46. Using the one-SEL-IND security of the underlying private-key scheme (which is exactly the scheme in Figure7.2), we can change the distribution of the public key elements from{[Ar i ] 1 , [Bs j ] 2 } i∈[2n],j∈[2m] to [Ar i + x (β) i b ⊥ ] 1 , [Ar n+ix (0) i b ⊥ ] 1 , [Bs j + y (β) j a ⊥ ] 2 , [Bs m+j + y (0) j a ⊥ ] 2 i∈[n],j∈[m]

,) i b ⊥ 1 ,,..B 2

 12 Proof of Lemma 47. Upon receiving a 3-PDDH challenge (PG,[a] 1 , [b] 2 , [c] 1 , [c] 2 , [z] 1 ) (see Definition 15), and the challenge messages (x (0) , y (0) ), (x (1) , y (1) ),B 1 picks A, B ← R D k ; β ← R {0, 1}; a ⊥ ← R orth(A), b ⊥ ← R orth(B), and sets [γ] 1 := [c] 1 and [γ] 2 := [c] 2 . Then, for i ∈ [2n], j ∈ [2m], B 2 picks r i ← R Z k p , s j ← R Z k p and computes pk := Ar i + ax (β) i b ⊥ 1 Ar n+iax (0Bs j + by (β) j a ⊥ 2 Bs m+j + by (0) j a ⊥ 2 i∈[n],j∈[m].It picks W, V ← R GL k+2 (p) and implicitly setsHere we use the fact that (B|ba ⊥ ) is full rank with probability 1-1 Ω(p) over A, B ← R D k , a ⊥ ← R orth(A), and b ← R Z p (see Definition 9). Then, for i ∈ [n], j ∈ [m], it computes [c i ] 1 := computes [c 0 ] 1 := [γ] 1 , [ c 0 ] 2 := [γ] 2 , gpk := PG, ct := {[c 0 ] 1 , [ c 0 ] 2 , [c i ] 1 , [ c j ] 2 } i∈[2n],j∈[2m]. It returns (gpk, pk, ct) to A. Then, it simulates OKeygen as in G 2 (see Figure7.7). Finally, when A outputs β ′ , B 2 outputs 1 if β ′ = β, and 0 otherwise.

,

  as in game G 3 .This proves |Adv G2 (A) -Adv G 3 (A)| ≤ 2 -Ω(λ) .Lemma 49: From game G 3 to game G 4

2 ,

 2 Proof of Lemma 49. Upon receiving a 3-PDDH challenge (PG,[a] 1 , [b] 2 , [c] 1 , [c] 2 , [z] 1 ) (see Definition 15), and the challenge messages (x (0) , y (0) ), (x (1) , y (1) ),B 1 samples A, B ← R D k ; b ← R {0, 1}; a ⊥ ← R orth(A), b ⊥ ← R orth(B), and sets [γ] 1 := [c] 1 and [γ] 2 := [c] 2 . Then, for i ∈ [2n], j ∈ [2m], B 2 picks r i ← R Z k p , s j ← R Z k p and computes pk := Ar i + ax Bs m+j + by (0) j a ⊥ 2 i∈[n],j∈[m].It picks W, V ← R GL k+2 (p) and implicitly sets

.B 2

 2 computes [c 0 ] 1 := [γ] 1 , [ c 0 ] 2 := [γ] 2 , gpk := PG, and ct := {[c 0 ] 1 , [ c 0 ] 2 , [c i ] 1 , [ c j ] 2 } i∈[2n],j∈[2m] .It returns (gpk, pk, ct) to A.

Lemma 50 :

 50 From game G 4 to game G 5There exists an adversary B 4 such that|Adv G 4 (A) -Adv G 5 (A)| ≤ 2 • Adv one-SEl-IND FEone,B 4 (λ).

  .3.

	Reference	# inputs	setting	security	assumption	pairing
	[ABDP15]	1	public-key many-SEL-IND	DDH	no
	[ALS16, ABDP16]	1	public-key many-AD-IND	DDH	no
	[BSW11]	1	any	many-SEL-SIM	impossible
	[LL18]	2	private-key many-SEL-IND	SXDH + T3DH	yes
	[KLM + 18]	2	private-key	single-key many-AD-IND 3	function-private FE yes
	Chapter 4	multi private-key many-AD-IND	SXDH	yes
	Chapter 5	multi private-key many-AD-IND DDH, DCR, LWE	no

Figure 1.3: Summary of constructions from cyclic or bilinear groups. We have 8 security notions xx-yy-zzz where xx ∈ {one, many} refers to the number of challenge ciphertexts; yy ∈ {SEL, AD} refers to the fact that encryption queries are selectively or adaptively chosen; zzz ∈ {IND, SIM} refers to indistinguishability vs simulation-based security. SXDH stands for Symmetric eXternal Diffie Hellman assumption, DDH stands for Decisional Diffie Hellman assumption, DCR stands for Decisional Composite Residuosity assumption, and LWE stands for Learning With Errors assumption. Contribution 2.2: multi-client functional encryption for inner products.

  ). This notion, also referred to as Privacy-Preserving Aggregation of Time-Series Data, is an older primitive introduced by Shi et al.[SCR + 11]. Even though it is quite similar to our target DMCFE scheme, PSA does not consider the possibility of adaptively generating different keys for different inner-product evaluations, but only enables the aggregator to compute the sum of the clients' data for each time period. PSA also typically involves a Differential Privacy component, which has yet to be studied in the larger setting of DMCFE. Further research on PSA has focused on achieving new properties or better efficiency [CSS12, Emu17, JL13, LC13, LC12, BJL16] but not on enabling new functionalities.

Contribution 2.3: Functional encryption for quadratic functions.

  Abe et al. [AHN + 17], our scheme has smaller signatures and public keys (of about 56%, resp. 40% of the size of signatures and public keys in Abe et al.'s scheme), and a lower security loss (of O(log Q) instead of

  a] s = aP s ∈ G s as the implicit representation of a in G s . More generally, for a matrix A = (a ij ) ∈ Z n×mWe will always use this implicit notation of elements in G s , i.e., we let[a] s ∈ G s be an element in G s . Note that from [b] T ∈ G T , it is hard to compute the value [b] 1 ∈ G 1 and [b] 2 ∈ G 2 (pairinginversion problem). Obviously, given [a] s ∈ G s and a scalar x ∈ Z p , one can efficiently compute [ax] s ∈ G s . Further, Given [a] 1 , [a] 2 , one can efficiently compute [ab] T using the pairing e. For two matrices A, B with matching dimensions define e([A] 1 , [B] 2

	representation of A in G s :		p	we define [A] s as the implicit
	[A] s :=	   a n1 P ... a nm P a 11 P ... a 1m P	   ∈ G n×m s

  Span(A) instead of uniformly random over Z k+1 p . Combining these facts, we obtain a PPT adversary B β such that |Adv

and u ← R Z k+1 p . • The uniform distribution over Z k+1 p and Z k+1 p \Span(A) are 1 p -close, for any A ∈ Z (k+1)×k p of rank k. Thus, we can chose u ← Z k+1 p \

  To go from G 2.i to G 2.i.1 , we switch the distribution of the vectors [y] sampled by EncO, using the Q Enc -fold U 3k,k (p)-MDDH assumption.We introduce an intermediate game G 2.i.0 where EncO(τ ) is computed as in G 2.i.1 if τ i+1 = 0, and as in G 2.i if τ i+1 = 1. The public key pk, and the oracle DecO are as in G 2.i.1 . We build adversaries B ′ 2.i.0 and B ′′ 2.i.0 such that T(B ′ 2

  yy-IND security of MIFE

	2	Enc(ek i , x j,1 i )	many-yy-IND security for n instance of FE

  for β ∈ {0, 1}: we use the D k (p)-MDDH assumption to switch simultaneously for all i ∈ HS the values [ z i , r ] 2 computed by OKeygen, to uniformly random values over G 2 . Recall that HS ⊆ [n] denotes the set of honest (that is, non corrupted) input slots. This relies on the fact that it is not necessary to know [z i ] 1 for i ∈ HS to simulate the games G 2,β or G 3,β . Namely, in Lemma 35, we show that there exists a PPT adversary B 3,β such that:

  Agrawal et al. [ALS16, Section 4.2]. • A MIFE for inner product over Z N where N is an RSA modulus, based on Paillier's Decisional Composite Residuosity assumption. This is obtained using the DCR-based scheme of Agrawal et al. [ALS16, Section 5.2].

  y), and for all i ∈ [n]: dk yi ← IP.KeyGen(gpk, IP.msk i , y i ). Return dk y := (dk ′ y , {dk yi } i∈[n] ). Dec pk, dk y , {C ℓ,i } i∈[n] , ℓ): Parse dk y = (dk ′ y , {dk yi } i∈[n] ), where dk ′ y = (y, d). For all i ∈ [n], compute [α ℓ,i ] ← IP.Dec(gpk, C ℓ,i , dk yi ). Then [u ℓ

  SSE.Decaps(pk sse , (S ℓ,i ) i∈[n] , ℓ, C ℓ ): Takes as input all the shares S ℓ,i for all i ∈ [n], a label ℓ, and a ciphertext C ℓ , and outputs the encapsulation key K ℓ .Correctness. For any label ℓ, we have: Pr[SSE.Decaps(pk sse , (S ℓ,i ) i∈[n] , ℓ, C ℓ ) = K ℓ ] = 1, where the probability is taken over pk sse , (ek sse,i ) i∈[n] ← SSE.Setup(λ), (C ℓ , K ℓ ) ← SSE.Encaps(pk sse , ℓ), and S ℓ,i ← SSE.Share(ek sse,i , ℓ) for all i ∈ [n].

  For any PPT adversary A, for all ρ ∈ [L], there exist PPT adversaries B ρ , B ′ ρ , and B ′′

).

OKeygen(k): return KeyGen(msk, k) OCorrupt(i): return ek i Figure

6

.9: Games for the proof of Theorem 18. Here, HS := [n] \ CS, the set of honest slots, where CS is the set of slots queried to OCorrupt. Recall that the algorithm SSE.Encaps is randomized, thus, different invocation of SSE.Encaps(pk sse , ℓ j ) on the same input will produce different outputs.

Lemma 42: From game G ρ-1 to game G ρ ρ such that:

•

  DSCombine({M ℓ,i } i∈[n] ): Takes the shares {M ℓ,i } i∈[n] ,and returns the valuei M ℓ,i ∈ G ′ .Correctness. For any label ℓ, we want Pr[DSCombine({M ℓ,i } i∈[n] ) = i x i ] = 1, where the probability is taken over M ℓ,i ← DSEncode(x i , ℓ, sk i ) for all i ∈ [n], and (pp, (sk i

  where A, B ← R D k , and (A|b ⊥ ), (B|a ⊥ ) are bases of Z k+1 p such that a ⊥ ∈ orth(A) and b ⊥ ∈ orth(B), à la [CGW15]. The vectors [Ar i ] 1 and [Bs j ] 2 for i ∈ [n], j ∈ [m], a ⊥ and b ⊥ are part of a master secret key, used to (deterministically) generate ct x,y and dk α . Correctness follows from the orthogonality property: decryption computes i,j α i,j e([Ar i

Namely, the existence of pseudo-random generators of block-wise locality 3.

Here, we refer only to unbounded collusions (i.e. the adversary can request for any number of secret keys). See the paragraph about related works for results on bounded collusions.

in fact, to be technically accurate, the functional decryption keys in[START_REF] Sans | Reading in the dark: Classifying encrypted digits with functional encryption[END_REF] leak slightly more information than just the result of the classification: they leak the probability that a given instance belongs to each possible class.

This work is independent of both works.

The security notion achieved in [KLM + 18] is actually a weaker variant of many-AD-IND in which the adversary is only allowed to perform a single key query at the beginning of the security game.

We remark that a similar information theoretic construction was put forward by Wee in[START_REF] Wee | Attribute-hiding predicate encryption in bilinear groups, revisited[END_REF], as a warm-up scheme towards an FE for inner products achieving simulation security.

Acknowledgments

Foremost, I wish to thank my advisor Hoeteck Wee. He influenced my work greatly, and his care and dedication went far beyond what I could have expected. You like to quote: "There are no two words [...] more harmful than good job"; I want to say there are no two words more appropriate than thank you. I thank Michel Abdalla, for his perspicacious advice, and his precious support, especially when I needed it. David Pointcheval, for running the lab in a seemingly effortless way. The legend has it that David has a twin brother that helps him do all the work. But that is myth, since that much work would require at least triplets.

Je remercie chaleureusement Benoît Libert d'avoir pris le soin de relire mon manuscript de thèse en détail, et d'avoir fourni de multiples conseils qui ont nettement contribué à améliorer la qualité de cette thèse. I thank Katsuyuki Takashima for accepting to review my PhD thesis. It's an honor to have you come all the way from Japan to attend my defense.

I thank Sophie Laplante and Iordanis Kerenidis for a valuable guidance and an insightful first exposure to doing research in cryptography.

I thank Eike Kiltz for hosting me in Bochum before my PhD, and for introducing me to an algebraic viewpoint in cryptography that hasn't left me since then. I thank Carla Ràfols, for teaching me all the intricacies of the Groth-Sahai proofs, and more. I only regret your French is so good I'm not even incited to practice my Spanish with you. I thank Sakib Kakvi for his random anecdotes, and my office mate Bertram Poettering, for impromptu nespresso tasting. Jiaxin Pan for making my stay sportive, Daniel Masny for making me discover light and delicate German meals, such as Schweinshaxe. I thank Olivier Blazy, Manuel Fersch, Federico Giacon, Stefan Guido Hoffmann, Gottfried Herold, Felix Heuer, Elena Kirshanova, Alexander May, Ilya Ozerov, Frank Quedenfeld, Marion Reinhardt-Kalender, Sven Schäge.

I thank Lucas Trevisan for hosting me at UC Berkeley, and showing me around the campus. I thank Tal Rabin for organizing the amazing cryptography workshop at the Simon's Institute, and my office mates Marshall Ball, Sasha Berkoff, Tobias Boelter, Paul Kirchner, Mukul Kulkarni, Tianren Liu, Manuel Sabin. I thank Tancrède Lepoint for touristic visits and somehow convincing me to wake up at 7AM to go to the gym (those who know me can appreciate how unlikely this was).

Je tiens à remercier mes collègues de l'ENS: Balthazar Bauer, compétiteur talentueux au championnat d'étourderie, Sonia Belaïd, Fabrice Benhamouda, Raphaël Bost, Florian Bourse et Geoffroy Couteau aka les bolosses, pour nos aventures hollandaises et allemandes (is this acknowledgement too big for you?), Céline Chevalier, Jérémy Chotard, Simon Cogliani, Mario Cornejo, Angelo De Caro, Léo Colisson, Rafaël Del Pino qui a peut être finalement trouvé la route du Groenland?, Itai Dinur, Léo Ducas, Edouard Dufour Sans, l'expert des big data dans tout le sud ouest: g merci , Aurélien Dupin, pour m'avoir fait connaître tous les décathlons d'île de France, et la fameuse pizzeria d'Igny, Pierre-Alain Dupont, Ehsan Ebrahimi, Pooya Farshim, Houda Ferradi, Georg Fuchsbauer que j'ai apprécié avoir comme co-auteur, Rémi Géraud, Junqing Gong, Dahmun Goudarzi pour ses poses sexy sur les parterres de fleur en terres australes, Giuseppe Guagliardo, Chloé Hébant, compétitrice talentueuse au championnat de (l'absence de) tact, Duong Hieu Phan, Quoc Huy Vu, Louiza Khati, Baptiste Louf, Vadim Lyubashevsky for teaching an inspiring crypto class, Pierrick Méaux, confident des pauses café, et prof de tact à ses heures perdues, pour son impact aquatique sur le labo, Thierry Mefenza,

Achieving Adaptive Security

In this section, we prove that MIFE from Figure 4.6 is many-AD-IND-static under D k (p)-MDDH assumption in G 1 and G 2 . That is, our scheme is secure with many challenge ciphertexts, chosen adaptively by the adversary, and handles static corruptions of input slots (see Definition 23).

Security. The security proof proceeds in two steps, similarly than the many-SEL-IND security proof in Section 4.1. First, we show in Theorem 11 that the MIFE in Figure 4.6 is one-AD-IND-static secure, that is, it is adaptively secure when there is only a single challenge ciphertext, and handles static corruption of input slots.

Then That is, we show that our multi-input FE is adaptively secure when there is only a single challenge ciphertext.

Corollary 3: many-AD-IND-static security of MIFE

Suppose the D k (p)-MDDH assumption holds in G 1 and G 2 . Then, the multi-input FE in Figure 4.6 is many-AD-IND-static secure.

Concrete instances of FE for Inner Product

In this section we discuss three instantiations of our generic construction from Section 5.1.3. In particular, we show that the existing (single-input) public-key FE schemes proposed by [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] (that are proven many-AD-IND-secure) satisfy Property 1 (two-step decryption) and Property 2 (linear encryption). These schemes are presented Section 2.6, recalled here for completeness.

Inner Product FE from MDDH

Here we present the FE for bounded norm inner product from [ALS16, Section 3], generalized to the D k (p)-MDDH setting, as in [AGRW17, Figure 15]. It handles the following functionality

and for all x ∈ X , y ∈ Y, we have:

F m ip (y, x) = x, y . In [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF], it was proven many-AD-IND secure under the DDH assumption. In Section 2.6.1, we extend the many-AD-IND security proof from [AGRW17] to the multi-instance setting. We also show in this section that it satisfies Property 1 (two-step decryption) and Property 2 (linear encryption).

KeyGen(gpk, msk, y):

Proof of Property 1 (two-step decryption).

The algorithm GSetup

Also, it returns the bound B := 0, L := p, G as the same group of order p generated by GGen(1 λ ), and the encoding function

We let Dec 1 and Dec 2 be the first and second line of Dec in Figure 5.7 respectively.

Let integers M, q ≥ 2, real α ∈ (0, 1), and distribution D over Z m×M chosen as explained in Section 2.6.2; K

KeyGen(gpk, msk, y ∈ Z m ):

Return

Dec gpk, dk y , ct x ): 4. It is also easy to see that E is linear.

Finally, for all

follows by the same decryption correctness argument in [START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF], with the only difference that here we used a larger bound K.

Property 2 (linear encryption). For all x

Then, for all x, x ′ ∈ Z m , and (c 0 , c 1 ) := (As + e 0 , Us + e 1 + x

, we have:

Inner Product FE from DCR

Here we show that the Inner Product FE from [ALS16, Section 5.1] and recalled in Figure 5.9 satisfies Property 1 (two-step decryption) and Property 2 (linear encryption).

Property 1 (two-step decryption).

The algorithm GSetup

Setup(1 λ ). pk := (pk ′ , pk sse ), msk := msk ′ , and for all i ∈ [n], ek i := (ek ′ i , ek sse,i ). Return (pk, msk, (ek i ) i∈ [n] ).

Enc(pk, ek

KeyGen(pk, msk, k): We stress that this security result keeps all the properties of MCFE ′ and SSE:

• if MCFE ′ and SSE are both secure against adaptive corruptions, then, so is MCFE;

• if MCFE ′ is many time secure (xx = many), then, so is MCFE.

Proof of Theorem 18. The proof uses a hybrid argument that goes over all the labels ℓ 1 , . . . , ℓ L used as input to the queries A makes to the oracle OEnc. We define the hybrid games G ρ , for all ρ ∈ {0, . . . , L} in Figure 6.9. For any hybrid game G ρ , we denote by Adv Gρ (A) the probability that the game G ρ outputs 1 when interacting with A. Note that

Chapter 7. Functional Encryption for Quadratic Functions

Enc(gpk, ek, (x, y) ∈ X ):

Dec(gpk, ct (x,y) , dk α ):

Theorem 19: one-SEL-IND security

The FE from Figure 7.2 is one-SEL-IND secure under the D k (p)-MDDH assumption in G 1 and G 2 .

Remark 14: one-SEL-SIM security

WE note that the FE from Figure 7.2 is in fact one-SEL-SIM secure, which implies one-SEL-IND security. This is clear from the fact that in the last hybrid game in the proof of Theorem 19, the simulator is only required to know the value α i,j x i y j . Since we only need one-SEL-IND for our public-key FE, which is the main focus of this chapter, we omit the one-SEL-SIM security proof of the private-key FE.

Proof of Theorem 19. We use a sequence of hybrid games defined in Figure 7.3. Let A be a PPT adversary. For any game G, we denote by Adv G (A) the probability that the game G returns 1 when interacting with A.

Note that we have:

. This follows from the fact that for all i ∈ [n], j ∈ [m], we have:

Proof of Lemma 50. This transition is symmetric to that between G 0 and G 1 : we use the selective, single-ciphertext security of the underlying private-key scheme (in Figure 7.2), to switch:

by definition of the security game. Thus, by Theorem 19 (one-SEL-IND security of FE one ), we obtain the lemma.

Lemma 51: Game G 5 :

Proof. This follows directly from inspection of game G 5 in Figure 7.7, which does not depend on the bit β ← R {0, 1}.

Chapter 8

Conclusion

Summary of the Contributions

In this thesis, we presented a new public-key encryption that satisfies a strong security notion, which prevents many users to collude and perform complex, large-scale attacks. Our construction, which appeared in [GHKW16], was the first CCA-secure encryption scheme with a tight security reduction from the DDH assumption, without using pairings. It also has short ciphertexts (they only contain three group elements). Figure 1.1 gives the state of the art for tightly CCA-secure encryption.

Our proof techniques depart from the long line of prior works [HJ12, LJYP14, LPJY15] that uses non-interactive zero-knowledge proofs with tight simulation soundness, for which we have no efficient construction from standard assumptions without pairings. Other works [HKS15, AHY15a, GCD + 16] first build a tightly-secure IBE to then obtain CCA-secure encryption. However, IBE is notoriously hard to build without pairings in the standard model [BPR + 08], let alone with a tight security proof and short ciphertexts. To get rid of the pairings, we revisit techniques from [START_REF] Chen | Fully, (almost) tightly secure IBE and dual system groups[END_REF] together with the hash-proof system approach used in [START_REF] Cramer | A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack[END_REF].

We address the major limitation of our construction in [GHK17], where the size of the public key is reduced to a constant number of group elements, using techniques from [START_REF] Hofheinz | Adaptive partitioning[END_REF]. We chose to only present the predecessor [GHKW16] here.

We also presented new functional encryption schemes from standard assumptions. We followed a bottom-up approach, where we explored new constructions for larger classes of functions, with new features, starting from simple constructions, that rely on well-understood assumptions. Namely, we extended the original functional encryption schemes for inner products from [ABDP15, ALS16] to a multi-input setting:

• in Chapter 4, we present a multi-input functional encryption scheme (MIFE) for inner products based on the MDDH assumption in prime-order bilinear groups. Our construction works for any polynomial number of encryption slots and achieves adaptive security against unbounded collusion, while relying on standard polynomial hardness assumptions. Prior to this work, which was published in [AGRW17], we did not even have a candidate for 3-slot MIFE for inner products in the generic bilinear group model. Our work is also the first MIFE scheme for a non-trivial functionality based on standard cryptographic assumptions, as well as the first to achieve polynomial security loss for a super-constant number of slots under falsifiable assumptions. Prior works required stronger non-standard assumptions such as indistinguishability obfuscation or multilinear maps. The construction presented in Chapter 4 improves upon [AGRW17] in that security handles corruption of input slots, with no additional efficiency cost or extra assumption.

• in Chapter 5, we present constructions of multi-input functional encryption (MIFE)

ABSTRACT

Our work revisits public-key encryption in two ways: 1) we provide stronger security guarantee that typical public-key encryption, which handles many users than can collude to perform sophisticated attacks. This is necessary when considering widely deployed encryption schemes, where many sessions are performed concurrently, as in the case on the Internet; 2) we consider so-called functional encryption, introduced by Boneh, Sahai, Waters in 2011, that permits finegrained access to the encrypted data. It generalizes traditional public-key encryption is that a master secret key is used to generate so-called functional decryption keys, each of which is associated with a particular function. An encryption of a message m, together with a functional decryption key associated with the function f, decrypts the value f(m), without revealing any additional information about the encrypted message m.