Keywords: cryptography, pseudorandom functions, provable security, related-key security, algebraic constructions, computational assumptions

In this thesis, we study the algebraic structure underlying number-theoretic pseudorandom functions. Specifically, we define an algebraic framework that translates the pseudorandomness of a particular form of functions into a simple algebraic property. The resulting generic framework encompasses most of existing constructions and naturally extends to related primitives, such as related-key secure, aggregate, and multilinear pseudorandom functions.

This framework holds under a family of MDDH assumptions, that contains especially different classical assumptions, such as DDH, DLin, or k-Lin. Therefore, setting accordingly the parameters in the constructions, our framework can be used to construct secure pseudorandom functions (or related primitives) whose security holds under these assumptions.

Finally, we also study more specifically the case of related-key security. On the one hand, we propose a fix and some extensions to the Bellare-Cash framework and then build pseudorandom functions secure against larger classes of attacks. On the other hand, we construct the first pseudorandom function provably secure against XOR attacks. The latter construction relies on the existence of a weak form of multilinear maps.

iii -NP BPP), which states intuitively that the set of problems whose solutions can be efficiently verified is not a subset of the set of problems that can be solved efficiently. That is, one requires that there exist problems such that it is hard to find a solution, but for which, given a solution, it is easy to verify its correctness. Loosely speaking, in terms of encryption, we want the decryption of a ciphertext given the secret key to be an efficient procedure, while decrypting the message without the secret key being a hard problem. Whether P = NP (or NP BPP) is still an open question, and probably the most important open question in theoretical computer science, an overwhelming proportion of the community believes it is the case. Therefore, as cryptographers, we would like to construct encryption schemes proven secure assuming this assumption. That is, we would like to design cryptosystems and prove that if an adversary can break the scheme, then it can solve hard problems (which is unlikely).

Unfortunately, it appears that this is not a sufficient assumption for building encryption. Indeed, this assumption only states that there exist easy-to-verify but hard-to-solve problems. However, a problem is hard to solve as soon as there exist some instances that are hard to solve. Thus, a problem being hard does not provide any guarantee that most instances nor average instances of the problem are hard. Intuitively, basing the security of an encryption scheme on the hardness of such problems could lead to an encryption scheme for which some ciphertexts are hard to decrypt without the knowledge of the secret key, but for which it could still be easy to decrypt most ciphertexts. Hence, we actually need the existence of problems that are hard on the average, and not only in the worst case.

The existence of such problems is not known to be implied by P = NP (nor by NP BPP), and actually, this is still not good enough for having good encryption schemes. Indeed, assuming only the existence of hard-on-average problems, it might be easy to build an encryption scheme for which it is hard to decrypt ciphertexts, but even for a legitimate user (that knows the secret key), which would thus have no advantage in comparison to adversaries. Specifically, a problem being hard on average does not mean that it is easy to construct hard instances (ciphertexts that are hard to decrypt) together with some auxiliary information (the secret key) that allows to efficiently solve this hard instance (decrypt the ciphertexts). However, the latter is precisely what we would like for building an encryption scheme.

This assumption is actually translated by the existence of one-way functions. A one-way function is simply a function that is easy to compute, but hard (on the average) to invert. In regard of the above, intuitively, we are interested in one-way functions as a solution to create hard instances of a problem (the output of the one-way function) and auxiliary information (the input of the one-way function), such that given the auxiliary information, the instance is easy to solve, but given only the instance, one cannot recover the auxiliary information (and thus not solve the instance either). For now, it is not known whether the existence of hard-on-average problems (nor whether P = NP or NP BPP) implies the existence of one-way functions, but once again, the majority of the community believes that one-way functions exist.

It appears that basing cryptography on the existence of one-way functions offers the possibility of designing secure symmetric encryption schemes (and much more) even if the key is much shorter than the total length of the messages sent, and in particular, the size of the key does not limit the number of messages that can be sent. In particular, going back to the example of agreeing on different times, if one-way functions exist, there exist procedures that allow to generate many pseudorandom values from a small shared secret. These procedures, termed pseudorandom functions, are one of the most central primitives in Chapter 1

Our Contributions

Chapter 2

Chapter 2 Preliminaries

In this chapter, we introduce the notation and basic notions used throughout this manuscript. We start by recalling some standard mathematical and computational concepts, and by briefly introducing provable security. We also remind some standard number-theoretic assumptions, and define most of the cryptographic primitives involved in this work, including standard, aggregate, and multilinear pseudorandom functions. Please note that the definition of relatedkey secure pseudorandom functions is postponed to Chapter 3. We conclude this chapter by introducing multilinear maps and the multilinear map model.

Multilinear maps and the multilinear map model are central in Chapter 7 and Section 4.4, but these two parts are rather independent from the rest of this thesis, so we recommend to inspect Section 2.4 only before reading either of these parts. Most of the other notions introduced in this chapter are rather usual, thus it can be easily skimmed through. However, we encourage the reader to inspect Section 2.3.2 that is central for the sequel.

A list of notation and abbreviations is provided at the end of this manuscript on pages 139 and 141.

Introduction

Since the early ages of "cryptography", the most central and basic problem has been to provide solutions for secret communication over insecure communication channels. The problem can easily be defined as follows: two parties, for instance a source and a journalist, want to communicate with each other while keeping a third party, called the adversary, as ignorant as possible about their discussion. Intuitively, an encryption scheme is a protocol designed towards solving this problem, and consists in two procedures, termed encryption and decryption. Assuming the source wants to send a message to the journalist, it first applies the encryption algorithm to the message in order to compute an encrypted message, called ciphertext, that it next sends to the journalist over a (possibly public) communication channel. In particular, it is reasonable to assume that the adversary also knows the ciphertext. Finally, the journalist applies the decryption algorithm to the ciphertext to recover the original message.

As the ciphertext could be known by the adversary, it is obvious that the journalist must know something that the adversary does not. Otherwise, the adversary could just proceed in the same manner as the journalist and get the message. We call this extra knowledge the secret key, and assume without loss of generality that the secret key is an argument that is fed, along with the ciphertext, to the decryption procedure, which can then be considered to be a public procedure. We further assume that this secret key is shared by the source and the journalist. This corresponds to the case of private-key encryption (a.k.a. symmetric encryption). Now that is it clear that there must exist some secret key, the main question remains:

Which type of secrecy can we hope for?

The best we can hope is that the ciphertext does not reveal any information about the message. In this sense, the ciphertext must not contain any information about the message. This security notion is called information-theoretic or perfect security. It might seem surprising that this perfect security can be achieved, and is actually achieved by an elementary scheme, called the one-time-pad encryption. Intuitively, the scheme follows this basic idea: assume the source wants to send secretly to the journalist a time to meet. Then, they share a secret key that is just a time taken uniformly at random, for instance 17:42. When the source wants to send the time to meet to the journalist, for instance 08:30, it simply sends the sum of the two times, which is 02:12. The journalist can then recover 08:30 by subtracting 17:42 to 02:12.

The key point here is that for any ciphertext, there exists one and only one pair of message/secret key that produces this ciphertext. For instance, if the message had been 14:53 and not 08:30, then 02:12 would still have been a valid encryption with the secret key 11:19. Hence, as the secret key was chosen uniformly at random and could have been any time, the ciphertext does not reveal any information about the message, which could also have been any time. In other words, to encrypt a message, one masks it with a message of the same form, such that the mask hides any information about the message, and such that one can remove the mask if one knows it.

The main drawback of this encryption scheme is that the size of the secret key (mask) is the same as the total size of the messages being exchanged. This is actually a necessary condition:

Perfect security requires a key at least as long as the total length of the messages sent.

The above statement immediately implies drastic limitations on the practicality of such encryption: one needs a huge key if one wants to send a long message, and reversely, the number of messages is directly limited by the size of the secret key. Finally, as the key has to be perfectly random, it might be hard to generate a long key.

Thus, it seems that cryptography falls short to both guarantee security while achieving practicality. To put the above statements in a nutshell, either you get perfect security at the cost of impracticality, or you have a practical encryption scheme, but do not achieve perfect security. As we aim for practicality, the natural question is then the following:

Do we need perfect security?

While by definition one cannot hope for a stronger security model, there is one point that could be weakened in the model without impacting much the security. Indeed, perfect security asks that a ciphertext does not contain any information about the message. This is ideal, but in the real world, adversaries have limited resources (time, memory, power, . . . ). Therefore, the question is not really whether a ciphertext does or does not contain any information about the message, but rather if information about the message can be efficiently extracted from the message. In other words, the question is not whether it is possible to extract information from the message but rather if it is feasible.

For example, let us consider the case in which a source wants to send 10 different times to meet up with a journalist. As explained above, in order to achieve perfect security, they have to share 10 masks, so 10 uniformly random times, which are then used to mask the 10 real times. However, assume that the journalist and the source share a small secret and know a procedure that allows both of them to privately and efficiently generate 10 masks. Then, if it is infeasible for an adversary to distinguish the 10 times generated using their small shared secret from 10 uniformly random times, the adversary cannot learn anything about the real times. Such values that one cannot distinguish from truly random values are called pseudorandom values and are a central notion of our work, but before giving further details, we need to address the following question:

What is or is not feasible by an adversary?

Modern cryptography relies on the belief that there are problems that can be solved efficiently, while others cannot. In particular, one always assumes P = NP (and even modern cryptography, and are the main focus of this thesis. In particular, pseudorandom functions have a fundamental role in both theory and practice. Let us now jump into further details by defining more properly pseudorandom functions.

Pseudorandom Functions

A pseudorandom function is a family of deterministic functions indexed by short keys. For each key is associated a function that is efficiently computable on many inputs and such that, without the knowledge of the key defining the function, it is computationally hard to distinguish the outputs of the function from truly random values from the same range, even if the adversary chooses the inputs on which the function is evaluated.

More formally, let F : K × D → R be a family of functions, indexed by the key space K, so for each key K ∈ K is associated a function F (K, •): D → R. We say that F is a pseudorandom function if for any polynomial-time adversary, its advantage in the following game is negligible. The game starts by picking a random challenge bit b, a random target key K ∈ K and a random function G: D → R. The adversary can repeatedly query an oracle that, given an input x ∈ D, returns either F (K, x), if b = 1, or G(x), if b = 0. Finally, the adversary outputs a bit b , and its advantage is defined by 2 Pr [ b = b ] -1.

Pseudorandom functions play a central role in cryptography, both in theory and in practice. Specifically, on the theoretical side, combining results by Goldreich and Levin [START_REF] Goldreich | A Hard-Core Predicate for all One-Way Functions[END_REF] and by Goldreich, Goldwasser, and Micali [START_REF] Goldreich | How to Construct Random Functions (Extended Abstract)[END_REF], we obtain the following result:

Pseudorandom functions exist if and only if one-way functions exist.

On the practical side, due to their simplicity and security properties, pseudorandom functions have been used in numerous applications, including symmetric encryption, authentication, and key exchange. In particular, pseudorandom functions yield simple constructions of symmetric encryption schemes, and this observation is widely used in practice (often implicitly). Furthermore, since pseudorandom functions can be used to model real-world block-ciphers, such as AES [START_REF]Advanced Encryption Standard (AES)[END_REF], they are also extremely useful for the security analysis of protocols that rely on these primitives.

Therefore, the study of pseudorandom functions is at the core of modern cryptography. We now introduce in more details the scope of our work, by first explaining the above statement, and then detailing our case of study.

From One-Way Functions to Pseudorandom Functions

Before the notion of pseudorandom functions was introduced by Goldreich, Goldwasser, and Micali in [START_REF] Goldreich | How to Construct Random Functions (Extended Abstract)[END_REF], cryptographers studied the notion of pseudorandom generator. Broadly speaking, a pseudorandom generator with -bit stretch is a function G : {0, 1} κ → {0, 1} κ+ , with ≥ 1, that takes as input a bitstring s ∈ {0, 1} κ , called the seed, and outputs a longer bitstring G(s) ∈ {0, 1} κ+ . Furthermore, we require the following property: assuming s is taken uniformly at random, it is computationally hard to distinguish G(s) from a uniformly random string taken from {0, 1} κ+ without the knowledge of s. Thus, a pseudorandom generator is simply a function that takes as input a small random bitstring and outputs an -bit longer pseudorandom bitstring. Fundamental results in this area were shown by Goldreich and Levin in [START_REF] Goldreich | A Hard-Core Predicate for all One-Way Functions[END_REF]. Specifically, they prove the following two results:

• Pseudorandom generators with 1-bit stretch exist if and only if one-way functions exist.

• For any = poly(κ), pseudorandom generators with -bit stretch exist if and only if pseudorandom generators with 1-bit stretch exist.

Then, putting these results together, we obtain that pseudorandom generators with polynomial stretch exist if and only if one-way functions exist. In particular, considering length-doubling pseudorandom generators, so with domain {0, 1} κ and range {0, 1} 2κ , we immediately have:

Length-doubling pseudorandom generators exist if and only if one-way functions exist.

The above statements are not detailed further in this manuscript, as we focus on constructions of pseudorandom functions, but let us explain how length-doubling pseudorandom generators can then be used to build pseudorandom functions, as shown by Goldreich, Goldwasser, and Micali in their seminal work [START_REF] Goldreich | How to Construct Random Functions (Extended Abstract)[END_REF]. Specifically, let us briefly sketch a proof of the following statement:

Pseudorandom functions exist if and only if length-doubling pseudorandom generators exist.

Assume the existence of a length-doubling pseudorandom generator G: {0, 1} κ → {0, 1} 2κ , for κ ≥ 1. Then, one can build a pseudorandom function F : {0, 1} κ × {0, 1} n → {0, 1} κ as follows, for any n = poly(κ).

For a key K ∈ {0, 1} κ and a bitstring x ∈ {0, 1} , 0 ≤ ≤ n, we recursively define K x as:

• K ε = K, where ε denotes the empty string;

• K x 0 K x 1 = G(K x ), with |K x 0 | = |K x 1 | = κ. Then, the GGM pseudorandom function is defined via F (K, x) = K x .
Intuitively, this corresponds to following a path in a binary tree of depth n whose root is labeled by K and such that the two siblings of any internal node labeled by a string s are respectively labeled by the first and second half of G(s). Computing F (K, x) then simply corresponds in outputting the label of the x-th leaf of this tree. Please refer to Figure 1. 1 for further details about this computation.

The security of this pseudorandom function follows from the security of the pseudorandom generator. Let us assume that the adversary makes only one query x = 0 n . That is, to compute F (K, x), one first evaluates G(K) and evaluate G again on the first half of G(K), and so on. Then, assuming the security of G, if K is chosen uniformly at random, one can change G(K) = K 0 K 1 to a uniformly random string of length 2κ. This change is computationally indistinguishable due to the security of G. Then, one can change G(K 0 ) to a uniformly random string of length 2κ under the security of G, as K 0 is now a uniformly random bitstring. By repeating n times this process, one change the output F (K, 0 n ) to a uniformly random bitstring of length κ, and this change is computationally indistinguishable assuming the security of G. In the case of multiple queries, one just needs to reiterate this process on each path of the tree that is used to answer the (polynomial number of) queries made by the adversary.

The other direction is immediate, as, given a pseudorandom function F : {0, 1} κ × D → {0, 1} , one can just construct a length-doubling pseudorandom generator by evaluating F on fixed inputs with the seed as a key, and concatenate (or truncate) the outputs to obtain a bitstring of length 2κ.

K K 0 K 00 K 000 K 001 x 2 = 0 K 01 K 010 K 011 x 2 = 1 x 1 = 0 K 1 K 10 K 100 K 101 K 11 K 110 K 111 x 1 = 1 Figure 1.1:
The GGM construction for F : {0, 1} κ × {0, 1} 3 → {0, 1} κ

Number-Theoretic Constructions

Despite its elegance, the original construction of pseudorandom functions by Goldreich, Goldwasser, and Micali based on pseudorandom generators is not very efficient. In order to improve its efficiency while still being able to prove its security under reasonable complexity assumptions, Naor and Reingold [START_REF] Naor | Number-theoretic Constructions of Efficient Pseudo-random Functions[END_REF] proposed a new construction based on the Decisional Diffie-Hellman assumption (DDH). Let #" a = (a 0 , . . . , a n ) ∈ (Z * p ) n+1 be the key and x = x 1 . . . x n ∈ {0, 1} n be the input of the pseudorandom function. Let g be a fixed public generator of a group G of prime order p. The Naor-Reingold pseudorandom function is then defined as

NR( #" a , x) = a 0 n i=1 a x i i ,
where for any a ∈ Z p , [a] stands for g a , as defined in [START_REF] Escala | An Algebraic Framework for Diffie-Hellman Assumptions[END_REF].

As mentioned in [START_REF] Boneh | Algebraic pseudorandom functions with improved efficiency from the augmented cascade[END_REF], the algebraic nature of the Naor-Reingold pseudorandom function has led to many applications, such as verifiable random functions [ACF09; HW10], distributed pseudorandom functions [START_REF] Naor | Number-theoretic Constructions of Efficient Pseudo-random Functions[END_REF], and related-key secure pseudorandom functions [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF], which are hard to obtain from generic pseudorandom functions. Hence, due to its importance, several other extensions of the Naor-Reingold pseudorandom function have been proposed [START_REF] Lewko | Efficient pseudorandom functions from the decisional linear assumption and weaker variants[END_REF][START_REF] Boneh | Algebraic pseudorandom functions with improved efficiency from the augmented cascade[END_REF] based on different assumptions, such as the Decision Linear assumption (DLin) [START_REF] Boneh | Short Group Signatures[END_REF] and the d-DDHI assumption [START_REF] Boneh | Algebraic pseudorandom functions with improved efficiency from the augmented cascade[END_REF][START_REF] Goyal | Correlated-Input Secure Hash Functions[END_REF].

An important part of this work is to study the algebraic structure of such pseudorandom functions, as well as extensions of these constructions, such as related-key secure, aggregate, and multilinear pseudorandom functions. Let us then define more formally these primitives.

Extensions of Pseudorandom Functions

Pseudorandom functions have been extended in different directions, either to add functionalities, for instance with the notions of aggregate or verifiable pseudorandom functions, or to strengthen their security. In particular, due to their central role in constructing block-ciphers, building pseudorandom functions that resist to real-world attacks has been an important area of research. An aspect of this area corresponds to related-key security. In this thesis, we focus on aggregate, multilinear, and related-key secure pseudorandom functions and briefly introduce these notions below.

Related-Key Security

As already explained, a common approach to prove the security of a cryptographic scheme, known as provable security, is to relate its security to one of its underlying primitives or to an accepted hard computational problem. While this approach is now standard and widely accepted, there is still a significant gap between the existing models used in security proofs and the actual environment in which these cryptosystems are deployed. For example, most of the existing security models assume that the adversary has no information about the user's secret key. However, it is well known that this is not always true in practice: the adversary may be able to learn partial information about the secrets using different types of side-channel attacks, such as the study of energy consumption, fault injection, or timing analysis. In the particular case of fault injection, for instance, an adversary can learn not only partial information about the secret key, but it may also be able to force a cryptosystem to work with different but related secret keys. Then, if it can observe the outcome of this cryptosystem, it may be able to break it. This is what is known in the literature as a related-key attack (RKA).

Most primitives are designed without taking related-key attacks into consideration so their security proofs do not provide any guarantee against such attacks. Hence, a cryptographic scheme that is perfectly safe in theory may be completely vulnerable in practice. Indeed, many such attacks were found during the last decade, especially against practical block-ciphers [BDK05; BDK08; BDK+10; BK09; BKN09; KHP07]. Inspired by this cryptanalytic work, some years ago, theoreticians started to develop appropriate security models and search for cryptographic primitives which can be proven related-key secure.

Though related-key attacks were first introduced by Biham and Knudsen [START_REF] Biham | New Types of Cryptoanalytic Attacks Using related Keys (Extended Abstract)[END_REF][START_REF] Knudsen | Cryptanalysis of LOKI91[END_REF] in the early 1990's, it was only in 2003 that Bellare and Kohno [START_REF] Bellare | A Theoretical Treatment of Related-Key Attacks: RKA-PRPs, RKA-PRFs, and Applications[END_REF] began the formalization of the theoretical foundations for related-key security. We recall their security definition of related-key security for pseudorandom functions here. Let F : K × D → R be a family of functions for a security parameter κ, and let Φ = {φ: K → K} be a set of functions on the key space K, called a related-key deriving (RKD) function set. We say that F is a Φ-related-key secure pseudorandom function if for any polynomial-time adversary, its advantage in the following game is negligible. The game starts by picking a random challenge bit b, a random target key K ∈ K and a random function G: K × D → R. The adversary can repeatedly query an oracle that, given a pair (φ, x) ∈ Φ × D, returns either F (φ(K), x), if b = 1, or G(φ(K), x), if b = 0. Finally, the adversary outputs a bit b , and its advantage is defined by 2 Pr [ b = b ] -1. Note that if the class Φ of RKD functions contains only the identity function, then this notion matches standard PRF security.

In this work, Bellare and Kohno also proved that there are inherent limitations to security against related-key attacks. In particular, there exist simple classes of related-key deriving functions for which related-key security is impossible. For instance, it is impossible to achieve related-key security against any class of functions that contains a constant function, as it implies that the adversary is able to change the key to a fixed constant value. Hence, it is important to understand which classes of RKD functions can or cannot be handled.

It appears that pseudorandom functions are a central notion in related-key security. Indeed, it has been shown by Bellare, Cash, and Miller in [START_REF] Bellare | Cryptography Secure against Related-Key Attacks and Tampering[END_REF], that having related-key secure pseudorandom functions for a class of RKD functions is sufficient to transform several standard cryptographic primitives (including signatures, symmetric encryption, public-key encryption, identity-based encryption, . . . ) into related-key secure ones for the same class of functions. Therefore, studying pseudorandom functions, in the related-key setting, is of prime interest.

Yet, building related-key secure pseudorandom functions under standard assumptions has been a wide-open problem for years, until the seminal work by Bellare and Cash [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF], and achieving related-key security under standard assumptions for real-world classes, such as XOR relations, is still a major open problem.

Aggregate Pseudorandom Functions

Aggregate pseudorandom functions were introduced by Cohen, Goldwasser, and Vaikunthanathan in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF] The main interest of an aggregate pseudorandom function is to provide the user with the possibility of aggregating the values of the function over super-polynomially many outputs with only a polynomial-time computation, without enabling a polynomial-time adversary to distinguish the function from a truly random function. For instance, one such example of an aggregate query could be to compute the product of all the output values of the pseudorandom function corresponding to a given exponentially-sized interval of the input domain.

In addition to proposing the notion of aggregate pseudorandom functions, Cohen, Goldwasser, and Vaikunthanathan [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF] also proposed first constructions for several different classes of aggregate queries, such as decision trees, hypercubes, and read-once boolean formulas, achieving different levels of expressiveness. Unfortunately, for most of the constructions proposed in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF], the proofs of security suffer from an exponential (in the input length) overhead in their running time and have to rely on the sub-exponential hardness of the Decisional Diffie-Hellman (DDH) problem.

Indeed, to prove the security of their constructions, the authors use a generic result which is simply saying the following: given an adversary A against the aggregate pseudorandom function security of a pseudorandom function F , one can build an adversary B against the standard pseudorandom function security of F . B just queries all the values required to compute the aggregate or output values, and computes the aggregate values itself before sending them to A .

Clearly, this reduction proves that any secure pseudorandom function is actually also a secure aggregate pseudorandom function. However, this reduction is not efficient, since to answer to only one aggregate query, the adversary B may have to query an exponential number of values to its oracle. Hence, as soon as we can aggregate in one query a super-polynomial number of PRF values, this generic reduction does not run in polynomial time.

Multilinear Pseudorandom Functions

In order to overcome the shortcomings of the work of Cohen, Goldwasser, and Vaikuntanathan [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF], Cohen and Holmgren introduced the concept of multilinear pseudorandom functions in [START_REF] Cohen | Multilinear Pseudorandom Functions[END_REF]. Informally speaking, a multilinear pseudorandom function is a variant of the standard notion of pseudorandom function, which works with vector spaces and which guarantees indistinguishability from random multilinear functions with the same domain and range. As shown in [START_REF] Cohen | Multilinear Pseudorandom Functions[END_REF], multilinear pseudorandom functions can be used to prove the aggregate pseudorandom function security of the Naor-Reingold (NR) pseudorandom function [START_REF] Naor | Number-theoretic Constructions of Efficient Pseudo-random Functions[END_REF] with a polynomial-time reduction for the case of hypercubes and decision trees aggregations. Unfortunately, their technique does not extend to the more general case of read-once formulas aggregation, which is the most expressive form of aggregation in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF]

Our Contributions

Our main focus in this thesis is the study of pseudorandom functions and above extensions, and our main contributions in these areas are the following.

Extension and Correction of the Bellare-Cash Framework

As already mentioned, Bellare and Cash [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF] designed the first related-key secure pseudorandom functions based on standard assumptions. These foundational results are obtained by applying a single, elegant, general framework to the Naor-Reingold pseudorandom function and handle certain multiplicative and additive RKD function classes. Unfortunately, it was discovered later that the framework of [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF] had a minor bug that prevented its proof to go through. They corrected this bug by strengthening the requirements of their framework, but their new requirements did no longer allow the framework to be applied to additive classes.

In this thesis, our first contribution is to correct and extend this framework. Specifically, we provide a new proof of their framework that goes through assuming only the original requirements. Therefore, it allows us to apply our framework to the additive case, as originally done in [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF]. Moreover, we provide new tools that let us handle larger classes of relations and extend the framework. For instance, we are able to construct a related-key secure pseudorandom function for the class of affine relations.

Algebraic Framework for Pseudorandom Functions

The second contribution of this thesis is an algebraic framework, termed "polynomial linear pseudorandomness security", that can be used to construct and prove the security of a wide variety of pseudorandom functions. Intuitively, we prove the following theorem: let G = g be a cyclic group of prime order p and let us denote by [a] the group element g a , for any a ∈ Z p . Let a 1 , . . . , a n be n uniformly random secret scalars from Z p . Then, for any positive integer q and any multivariate polynomials P 1 , . . . , P q defined over Z p and with indeterminates T 1 , . . . , T n , the group elements:

[P 1 (a 1 , . . . , a n )] , . . . , [P q (a 1 , . . . , a n )] are computationally indistinguishable, under some standard assumptions, from the group elements:

[U (P 1 )] , . . . , [U (P q )] ,

where U is a random linear map from the set of multivariate polynomials to Z p . This theorem is straightforward in the generic group model, but we prove that it is also true assuming only the hardness of some standard assumptions (discussed below). Furthermore, this framework is general enough to encompass standard and related-key securities for pseudorandom functions as well as multilinear and aggregate pseudorandom functions, and allows us to solve various open questions in these areas. In particular, it let us define a fully algebraic framework for related-key security that only requires some basic algebraic properties to be applied, or to provide a polynomial-time reduction that proves the aggregate pseudorandom function security of the Naor-Reingold construction for read-once formulas aggregation.

Assumptions

Our algebraic framework is proven under different assumptions. In particular, depending on certain parameters, such as the degree of polynomials P 1 , . . . , P q , we are able to prove our theorem assuming only the DDH assumption or a stronger assumption, such as the d-DDHI assumption (with d being a bound on the degree of polynomials).

We actually prove our framework under a new family of computational assumptions, termed E k,d -MDDH assumptions (where d is a bound on the degree of polynomials and k is some parameter precised later), that encompasses in particular classical assumptions such as DDH, d-DDHI, k-Lin, . . . and a side contribution of this thesis is to prove the security of all our non-classical assumptions in the generic group model.

Related-Key Secure Pseudorandom Function for XOR Relations

The last contribution of this thesis is a construction of related-key secure pseudorandom functions for XOR relations, based on the existence of a weak form of multilinear maps. Indeed, even if the results discussed above in related-key security allow to handle different and large classes of RKD functions, the functions have to be algebraic transformations (such as multivariate polynomials), and thus do not really correspond to real-world attacks. Here, our construction is secure even assuming that the adversary has the capacity of flipping any bit of the key at each query, which is closer to the actual capacities of a real-world adversary.

However, our result should be seen as a proof of concept, as the existence of multilinear maps is still a very strong assumption, as revealed by the recent devastating attacks. Yet, despite the numerous attacks against current multilinear maps, our construction circumvents all the known attacks, and we only rely on the existence of a weak form of multilinear map. In particular, we hope that such weak form of multilinear maps might be instantiated in the future under standard assumptions, such as lattice-based assumptions.

Other Contributions

Independently from the work presented in this manuscript, we also worked on the following unrelated subjects.

Order-Revealing Encryption

In a collaboration resulting from an internship at Technicolor Research with Marc Joye, we study order-revealing encryption. An order-revealing encryption scheme is a private-key encryption scheme that provides anyone with the capacity of comparing plaintexts given only the ciphertexts, without revealing anything more about the plaintexts. The first construction of order-revealing encryption was proposed by Boneh et al. in [START_REF] Boneh | Semantically Secure Order-Revealing Encryption: Multi-input Functional Encryption Without Obfuscation[END_REF] and relied on the existence of multilinear maps. In our work, we propose a first construction of order-revealing Chapter 1

1. 3 Other Contributions encryption assuming one-way functions exist, but only for polynomial-size domains. We also propose a construction that reveals the order but also a bit more, for exponential-sized domains, assuming the hardness of the DLin problem.

Private Circuits

In a joint work with Sonia Belaïd, Fabrice Benhamouda, Emmanuel Prouff, Adrian Thillard, and Damien Vergnaud, we study the construction of multiplication circuits in the probing model. This model has been introduced by Ishai, Sahai, and Wagner in [START_REF] Ishai | Private Circuits: Securing Hardware against Probing Attacks[END_REF] to capture the security of implementations against side-channel attacks, such as attacks using the power consumption or the electromagnetic radiation of the device running the cryptosystem. When devices are not protected against such attacks, it is often possible to exploit these physical measures to retrieve sensitive data.

Specifically, this model assumes that the attacker can obtain a bounded number of intermediate values of the computation (called probes), and we call a private circuit a circuit that is secure in this model. The seminal work by Ishai, Sahai, and Wagner, shows how to transform any circuit into a private circuit, at the cost of extra randomness. The main tool for this transformation is the construction of the first private circuit for bit-multiplication.

In our work, we focus on studying the bit-multiplication and try to optimize the number of random bits used by the private circuit computing this operation. Letting d denote the bound on the number of probes that the attacker can make, we obtain the following results: on the theoretical side, we prove a linear lower bound (in d) on the number of additional random bits, and a quasi-linear upper bound (O(d • log d)). These bounds result from an algebraic characterization of the security of a private circuit, which relies on basic linear algebra. On the practical side, we construct a private circuit for bit-multiplication that halves the randomness complexity of the previous circuit by Ishai, Sahai, and Wagner, and also construct private circuits for small (real-world) cases (d ≤ 4) whose randomness complexity match our linear lower bound. Finally, we also implement a tool, based on our algebraic characterization of security, that allows to find attacks against multiplication circuits which is magnitude faster that previous known tools (such as [START_REF] Barthe | Verified Proofs of Higher-Order Masking[END_REF]), but is not perfectly sound. That is, our tool might not always find attacks against a non-secure scheme so cannot serve for proving security of a scheme, but allows to discard quickly bad candidates.

Functional Encryption and Obfuscation

In a work with Nir Bitansky, Ryo Nishimaki, and Daniel Wichs, resulting from an internship at Northeastern University, we study the relation between private-key functional encryption and indistinguishability obfuscation. By designing different intermediate tools, we are able to construct a compact public-key functional encryption scheme from any unbounded-collusion private-key functional encryption scheme and any plain public-key encryption scheme. Putting this result together with the transform by Bitansky and Vaikunthanathan [START_REF] Bitansky | Indistinguishability Obfuscation from Functional Encryption[END_REF] or by Ananth and Jain [START_REF] Ananth | Indistinguishability Obfuscation from Compact Functional Encryption[END_REF], we then obtain that private-key functional encryption is sufficient, combined with any plain public-key encryption scheme, to build indistinguishability obfuscation. In particular, this proves that private-key functional encryption is (almost) as powerful as public-key functional encryption.

Organization

The rest of this manuscript is organized as follows: Chapter 2 first introduces basic mathematical, computational, and cryptographic notions. Next, Chapter 3 introduces related-key security and corrects and extends the Bellare-Cash framework. Chapter 4 defines our new family of assumptions and either relates them to classical assumptions or proves their security in a generic-group model. Chapter 5 then uses the new family of assumptions to prove the security of our main algebraic framework. Next, Chapter 6 applies the new algebraic framework to pseudorandom functions, related-key secure pseudorandom functions, aggregate pseudorandom functions, and multilinear pseudorandom functions. Finally, Chapter 7 describes our construction of related-key secure pseudorandom function for XOR relations and Chapter 8 concludes this thesis.

Notation and Preliminaries

Mathematical Notions

Integers, Sets, and Modular Arithmetic. We denote by Z the set of integers and by N the set of non-negative integers. If S is a set, then |S | denotes its size.

For two sets D and R, we denote by Fun(D, R) the set of all functions f : D → R with domain D and range R.

For a positive integer N , we denote by (Z N , +) the additive group of integers modulo N and by (Z N , +, •) the ring of integers modulo N . We often abuse this notation by using Z N . Furthermore, we denote by (Z * N , •) or simply Z * N the multiplicative subgroup of (Z N , +, •) that contains the invertible elements of the ring Z N . For an integer x ∈ Z, we denote by x mod N the remainder of the Euclidean division of x by N , which can be considered both as an integer in {0, . . . , N -1} or as an element of Z N . We then identify elements from Z N with integers of the set {0, . . . , N -1}. We recall that performing additions and multiplications over Z N is efficient (polynomial-time in the size of N ).

In this work, N is often a prime integer, thus denoted p. Please note that, for any prime number p, the ring (Z p , +, •) is also a finite field, and then Z * p = Z p \ {0}. Cyclic Groups. We make extensive use of cyclic groups in this thesis. We recall that a cyclic group is a finite group generated by a single element. In particular, a cyclic group is commutative (or Abelian). Throughout this manuscript, we denote by a tuple (p, G, g) a multiplicative cyclic group of prime order p generated by an element g, so that G = g = {1, g, . . . , g p-1 }, where 1 denote the identity element (corresponding to g 0 ). We often abuse this notation by using the notation G when the order and the generator are clear from the context. We denote by [x] g , or simply [x] when the generator is clear from the context, the element g x , for any x ∈ Z p , so in particular g = [1] g .

We also assume that the multiplication over G is an efficient operation, so given g and x ∈ Z p , one can efficiently compute [x] g . Linear Algebra. For two vector spaces D and R, we denote by L(D, R) the vector space of linear functions from D to R. Similarly, if D 1 , . . . , D n denote n vector spaces, then

L(D 1 ⊗ • • • ⊗ D n , R) is the vector space of n-linear functions from D 1 × • • • × D n to R.
In this thesis, vector spaces are implicitly supposed to be Z p -vector spaces.

Vectors and Matrices.

Vectors are denoted with an arrow (e.g., #" v ) and matrices by bold capital letters (e.g., A). For a vector #" v , | #" v | denotes its length and v i denotes its i-th component, so

#" v = (v i ) i=1,...,| #" v | . For a vector #" v ∈ D n and a function f : D → R, we denote by f ( #" v ) the vector (f (v i )) i=1,...,n ∈ R n .
Reversely, for a vector of functions #" f = (f i ) i=1,...,n , we denote by #" f (x) the vector (f 1 (x), . . . , f n (x)). For two vectors #" u , #" v of same length n over a ring R, we denote by #" u , #" v = n i=1 u i • v i their inner product. For a matrix A, we denote by a i,j its entry in the i-th row and j-th column. We sometimes combine both notations, by defining vectors of matrices (e.g., #" A = (A 1 , . . . , A | #" A| ). For a cyclic group (p, G, g) and a vector #" a ∈ Z n p , we denote by [ #" a ] g the vector of group elements ([a 1 ] g , . . . , [a n ] g ) ∈ G n . Similarly, for a matrix A ∈ Z n×m p , we denote by [A] g the matrix of group elements ([a i,j ] g )i=1,...,n j=1,...,m ∈ G n×m . As already stated above, we often abuse these notations by not specifying the generator g when it is clear from the context.

Polynomials. We denote by Z p [T 1 , . . . , T n ] the vector space (and ring) of multivariate polynomials in indeterminates T 1 , . . . , T n over Z p , and by Z p [T 1 , . . . , T n ] ≤d its subspace containing only polynomials whose degree in each indeterminate is at most d. We sometimes denote by P ( #" T ) the polynomial P (T 1 , . . . , T n ) ∈ Z p [T 1 , . . . , T n ], and by P ( #" a ) its evaluation by setting #" T to #" a , meaning that we set T 1 = a 1 , . . . , T n = a n . Assignation. If S is a set, x $ ← S indicates that x is taken uniformly at random from the set S (independently of everything else). We also write x, y $ ← S to indicate that x and y are chosen independently and uniformly at random from S . We often write that an element is "picked at random" to mean "picked independently and uniformly at random".

Algorithmic Concepts

Bitstrings. Binary strings are denoted with lowercase letters (e.g., x). We denote by {0, 1} * the set of all bitstrings and by {0, 1} n the set of all bitstrings of length n. For a binary string x, we denote its length by |x|, so x ∈ {0, 1} |x| , and x i its i-th bit, so x = x 1 . . . x |x| . The exclusive or (XOR) of two bitstrings x and y of same length is denoted by x ⊕ y. Algorithms and Efficiency. For simplicity, we consider our algorithms as probabilistic Turing machines. That is, we implicitly assume that they can use an additional tape containing random bits (also referred to as random coins). In the rest of this thesis, the term PPT algorithm stands for Probabilistic Polynomial-Time algorithm and we say that an algorithm is efficient if it is a PPT algorithm.

For an algorithm A, we denote by y $ ← A(x) for the fact of running algorithm A on input x and with fresh random coins and letting y denote its output. If A is deterministic, we simply note y ← A(x).

Provable Security

Negligibility. Let be a function from N to [0, 1]. We say that is negligible or 1 -is overwhelming, if for any constant c ∈ N, there exists η ∈ N such that for any κ ≥ η, ≤ 1 κ c . Security Parameter. As most of the cryptosystems, our constructions only achieve a computational notion of security and can actually be broken with a powerful enough computer. However, it is widely accepted that if 2 128 elementary operations are required to break a cryptosystem with high probability, then this cryptosystem can be considered as secure. We say that such a cryptosystem provides 128 bits of security.

Of course, with the computers being more and more powerful, it might happen in the future that making 2 128 elementary operations is reasonable. We then use the notion of security parameter to formalize the security of our constructions. Informally speaking, the security parameter is an integer κ ∈ N that is (sometimes implicitly) fed (in unary) to all the algorithms of a cryptosystem and such that algorithms run in polynomial time in this security parameter and such that a specific instantiation of the cryptosystem with security parameter κ provides κ bits of security.

Adversaries. Adversaries are probabilistic Turing machines and are denoted by calligraphic letters (e.g., A , D). Adversaries implicitly takes as input a unary representation of the security parameter. We consider two types of adversaries: on the one hand PPT adversaries, which run in polynomial time, so in particular in polynomial time in the security parameter, and on the other hand unbounded adversaries.

Experiments, Games, Oracles. We often define our security notions or assumptions using experiments, parametrized by the security parameter κ, and during which an adversary is called one or several times with various inputs. The adversary may also be provided access to oracles, which are Turing machines, however, the running time of an adversary does not depend on the running time of the oracle and a query to an oracle only counts for one operation.

Then, an experiment can be seen as a game between an adversary A and an implicit challenger which provides its input to the adversary as well as some oracle access. This game has an Initialize procedure, procedures to respond to adversary oracle queries, and a Finalize procedure. In the case where the Finalize procedure is not explicitly defined, it is implicitly defined as the procedure that simply outputs its input. To execute a game G with an adversary A , we proceed as follows. First, Initialize is executed and its outputs become the input of A . When A executes, its oracle queries are answered by the corresponding procedures of G. When A terminates, its outputs become the input of Finalize. The output of the latter, denoted G A is called the output of the game, and we let "G A ⇒ 1" denote the event that this game output takes the value 1. The running time of an adversary by convention is the worst case time for the execution of the adversary with any of the games defining its security, so that the time of the called game procedures is included.

Advantage. The advantage of an adversary A in an experiment Exp is the probability that this adversary outputs 1 in this experiment:

Adv Exp (A , κ) := Pr [ Exp(A , κ) = 1 ] .
Similarly, we define the advantage of an adversary D in distinguishing two experiments Exp 0 and Exp 1 as:

Adv Exp (D, κ) := Pr Exp 1 (D, κ) = 1 -Pr Exp 0 (D, κ) = 1 .
The advantage depends on the security parameter κ. For simplicity, κ is often implicit.

Assumptions, Security, and Indistinguishability. To define an assumption or a security notion, we then define a problem as an experiment or as distinguishing two experiments. We say that the problem is hard If no PPT algorithm can solve it.

We say that an assumption (or security) computationally holds if the above advantage is negligible for any PPT adversary. We further say that it statistically holds if the above advantage is negligible for any (even unbounded) adversary. We finally say that it perfectly holds if the above advantage is 0 for any (even unbounded) adversary.

Similarly, we say that two games are computationally indistinguishable if the advantage of any PPT adversary in distinguishing these two games is negligible. We say that two experiments are statistically indistinguishable (resp. perfectly indistinguishable or equivalent) if the advantage of any (unbounded) adversary in distinguishing these two games is negligible (resp. 0). Hybrid Arguments. Most of our security proofs are proofs by games (also called hybrid arguments) as defined by Shoup in [Sho01; KR01; BR06]: to bound an advantage in some game experiment corresponding to some security notion, we construct of sequence of games.

The first game is G 0 is the experiment itself, while the last game corresponds to some security notion or is such that the adversary just cannot win. Furthermore, we prove that two consecutive games are indistinguishable either perfectly, statistically, or computationally. In other words, we bound the difference of advantages by a negligible quantity.

Similarly, to bound an advantage of an adversary in distinguishing two experiments, we construct a sequence of indistinguishable games starting with the first experiment and ending with the second experiment.

Classical Computational Assumptions

The Discrete Logarithm Problem

For cryptographic purpose, we require our cyclic groups (p, G, g) to be such that the reverse operation of exponentiation is hard. This operation, called the discrete logarithm operation, consists, given an element g ∈ G and an element h = g x ∈ G, in computing scalar x ∈ Z p such that h = g x . The scalar x is called the discrete logarithm of h in the basis g.

Classical Discrete-Logarithm-Based Assumptions

Search Assumptions

We define two assumptions, termed the discrete logarithm and the strong discrete logarithm assumptions, that respectively correspond to the hardness of the following search problems. Discrete Logarithm. We define the advantage of an adversary A against the discrete logarithm (DL) problem in G as:

Adv dl G (A ) := Pr DL A G ⇒
DL G d-SDL G proc Initialize a $ ← Z * p Return ([1] , [a]) proc Finalize(a ) Return ([a] = [a ]) proc Initialize a $ ← Z * p Return ([1] , [a] , . . . , a d ) proc Finalize(a ) Return ([a] = [a ])

Decisional Assumptions

We first define two assumptions, termed the Decisional Diffie-Hellman and the d-Decisional Diffie-Hellman Inversion assumptions, that respectively correspond to the hardness of the following decisional problems.

DDH.

The advantage of an adversary D against the DDH problem in G is defined to be: We also define the k-Linear assumption as the hardness of the following decisional problem. The particular case with k = 2 is usually referred to as the Decisional Linear (DLin) assumption. k-Lin. For k ≥ 2, the advantage of an adversary D against the k-Lin problem in G is defined as:

Adv ddh G (D) := Pr DDHReal D G ⇒ 1 -Pr DDHRand D G ⇒
DDHReal G DDHRand G proc Initialize a, b $ ← Z p Return ([1] , [a] , [b] , [ab]) proc Finalize(b) Return b proc Initialize a, b $ ← Z p ; z $ ← Z p Return ([1] , [a] , [b] , [z]) proc Finalize(b) Return b d-DDHIReal G d-DDHIRand G proc Initialize a $ ← Z * p Return ([1] , [a] , . . . , a d ,
Adv k-lin G (D) := Pr k-LinReal D G ⇒ 1 -Pr k-LinRand D G ⇒ 1
where the probabilities are over the choices of a, z ∈ Z p , g ∈ G, and the random coins used by the adversary, and where k-LinReal G and k-LinRand G are described in Figure 2

.3. k-LinReal G k-LinRand G proc Initialize a 1 , . . . , a k $ ← Z p w 1 , . . . , w k $ ← Z p z ← w 1 + • • • + w k Return ([1] , [a 1 ] , . . . , [a k ] , [a 1 w 1 ] , . . . , [a k w k ] , [z]) proc Finalize(b) Return b proc Initialize a 1 , . . . , a k $ ← Z p w 1 , . . . , w k $ ← Z p z $ ← Z p Return ([1] , [a 1 ] , . . . , [a k ] , [a 1 w 1 ] , . . . , [a k w k ] , [z]) proc Finalize(b) Return b Figure 2.3: Games defining the k-Lin problem in G

Building DDH-Hard Groups

It is widely accepted that one can build groups in which the DDH assumption holds (and thus, also the DL assumption) from elliptic curves [START_REF] Victor | Use of Elliptic Curves in Cryptography[END_REF][START_REF] Koblitz | Elliptic curve cryptosystems[END_REF][START_REF] Daniel | Curve25519: New Diffie-Hellman Speed Records[END_REF]. Specifically, for a security parameter κ, it is believed that in "reasonably well-chosen" elliptic curves of prime order p, the only way to compute the discrete logarithm is by using generic algorithm (such as Shank's baby-step giant-step algorithm [START_REF] Shanks | Class number, a theory of factorization, and genera[END_REF], which runs in time O( √ p)). Therefore, with p being a 2κ-bit prime number, one can find an elliptic curve of order p that provides κ bits of security for the discrete logarithm problem. Please note that, using point compression, elements from such a group can be represented using about 2κ + 1 bits.

In the sequel, we do not extend further on how groups in which our assumptions hold can be generated. We only assume that it can be done efficiently (in polynomial time) and that there exist small (polynomial-size) representations for the group and its elements. This is sufficient for our purpose.

Cryptographic Primitives

Collision-Resistant Hash Functions

Definition 2.3.1 (Collision-Resistant Hash Function). A collision-resistant hash function is defined by a tuple of two polynomial-time algorithms H = (H.Setup, H.Eval) such that:

• H.Setup(1 κ ) outputs some public parameters pp;

• H.Eval pp (m) is a function that depends on pp, takes as input a bitstring m ∈ {0, 1} * , and deterministically outputs a bitstring y ∈ {0, 1} n(κ) called the hash value of m. The size of the output is determined by some polynomial n(•).

Furthermore, we additionally require that any PPT adversary cannot find two inputs m 0 = m 1 that have the same hash value, unless with negligible property. Formally, we define the advantage of an adversary A in attacking the collision-resistance security of H as:

Adv cr H (A ) := Pr [ Exp cr (A , κ) = 1 ] ,
where Exp cr is defined in Figure 2.4. We say that H is a collision-resistant hash function if the advantage of any PPT adversary in attacking the collision-resistance security of H is negligible.

In order to ease the reading, we often abuse notation by simply writing that H is a collision resistant hash function and letting H(•) stands for H.Eval pp (•), where public parameters pp is implicitly sampled in advance as pp $ ← H.Setup(1 κ ) for the given security parameter. • F.Setup(1 κ ) outputs some public parameters pp;

Pseudorandom Functions

• F.Eval pp (•, •) is a function that depends on pp and takes as input a secret key K ∈ K and an input x ∈ D and deterministically outputs a value y = F.Eval pp (K, x) ∈ R.

Furthermore, we define the advantage of an adversary D in attacking the pseudorandom function security of F as:

Adv prf F (D) := Pr PRFReal D F ⇒ 1 -Pr PRFRand D F ⇒ 1 ,
where PRFReal F and PRFRand F are described in Figure 2.4. We say that F is a pseudorandom function if the advantage of any PPT adversary in attacking the pseudorandom function security of F is negligible. f is picked uniformly at random from Fun(D, R). Defining such a function could be an exponential time procedure if D has an exponential size. However, as the adversary is allowed to do only a polynomial number of queries, this game can be simulated polynomially by generating f lazily. That is, when the adversary asks for the evaluation of f on an input x, we either pick the output f (x) uniformly at random in R and store (x, f (x)) in a table (if Chapter 2

Exp cr PRFReal F PRFRand F proc Initialize pp $ ← H.Setup(1 κ ) Return pp proc Finalize(m 0 , m 1 ) Return H.Eval pp (m 0 ) = H.Eval pp (m 1 ) proc Initialize pp $ ← F.Setup(1 κ ) K $ ← K Return pp proc Fn(x) Return F.Eval pp (K, x) proc Finalize(b) Return b proc Initialize pp $ ← F.Setup(1 κ ) f $ ← Fun(D, R) Return pp proc Fn(x) Return f (x) proc Finalize(b) Return b

Cryptographic Primitives 21

x has never been queried before), or returns the value y such that (x, y) is in this table (if x has already been queried). This is a polynomial-time procedure (and it also requires a polynomial-size memory).

In order to ease the reading, we often abuse notation by simply writing that F : K × D → R is a pseudorandom function and letting F (•, •) stands for F.Eval pp (•, •), where public parameters pp are implicitly sampled in advance as pp $ ← F.Setup(1 κ ) for the given security parameter.

Naor-Reingold Construction

The construction by Naor and Reingold [START_REF] Naor | Number-theoretic Constructions of Efficient Pseudo-random Functions[END_REF] is the first pseudorandom function based on number-theoretic assumptions. It has the major interest to be very efficient compared to the Goldreich-Goldwasser-Micali construction. We denote NR = (NR.Setup, NR.Eval) this construction, defined as follows:

• NR.Setup(1 κ ) generates public parameters pp = (p, G, g) where (p, G, g) describes a cyclic group of prime order p generated by g;

• NR.Eval pp (•, •) takes as input a key #" a = (a 0 , a 1 , . . . , a n ) ∈ Z n+1 p and an input x = x 1 . . . x n ∈ {0, 1} n and outputs [a 0 • n i=1 a x i i ] g .
As mentioned above, we often use the notation NR(•, •) to denote NR.Eval pp (•, •).

Theorem 2.3.4. Assuming the DDH assumption holds in G, NR is a pseudorandom function.

Boneh-Montgomery-Raghunathan Construction

We recall the construction by Boneh, Montgomery, and Raghunathan [START_REF] Boneh | Algebraic pseudorandom functions with improved efficiency from the augmented cascade[END_REF]. We denote BMR = (BMR.Setup, BMR.Eval) this construction, defined as follows:

• BMR.Setup(1 κ ) generates public parameters pp = (p, G, g) where (p, G, g) describes a cyclic group of prime order p generated by g;

• BMR.Eval pp (•, •) takes as input a key #" a = (a 1 , . . . , a n ) ∈ Z n p as well as an input x = x 1 . . . x n ∈ {1, . . . , d} n and outputs We also introduce two extensions of pseudorandom functions below. Namely, we define aggregate and multilinear pseudorandom functions. These two notions are later studied in Chapter 6. Please note that the definition of related-key secure pseudorandom functions is given only in Chapter 3.

Aggregate Pseudorandom Functions

Definition

Aggregate pseudorandom function are an extension of pseudorandom functions that allows to aggregate multiple(possibly exponentially many) outputs of the pseudorandom functions efficiently without impacting the security. The notion has been originally defined by Cohen, Goldwasser, and Vaikunthanathan in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF]. We first define an aggregation function and then recall the definition of an aggregate pseudorandom function.

Aggregation Function. Let f : K × D → R be a function. We define an aggregation function by describing two objects:

• a collection S of subsets S of the domain D;

• an aggregation function Γ: R * → V that takes as input a tuple of values from the range R of f and aggregates them to produce a value in an output set V.

In addition, we require the set ensemble S to be efficiently recognizable, meaning that for any S ∈ S , there exists a polynomial-time procedure to check if x ∈ S, for any x ∈ D. Also, we require the aggregation function Γ to be polynomial-time and the output of the function not to depend on the order of the elements provided as inputs. Finally, we require all sets S to have a representation of polynomial size in the security parameter κ.

Given an aggregation function (S , Γ), we define the aggregate function AGG = AGG f,S ,Γ as the function that takes as input a set S ∈ S and outputs the aggregation of all values f (x) for all x ∈ S. That is, AGG(S) outputs Γ(f (x 1 ), . . . , f (x |S| )), where S = {x 1 , . . . , x |S| }. We will require the computation of AGG to be polynomial-time (even if the input set S is exponentially large) if the function f provided is the evaluation function F.Eval pp (K, •) of a pseudorandom function F = (F.Setup, F.Eval) we consider, for some fixed key K. Definition 2.3.6 (Aggregate Pseudorandom Function). Let F = (F.Setup, F.Eval) denote a pseudorandom function whose key space, domain, and range are respectively K, D, and R and let (S , Γ) be an associated aggregation function. We say that F is an (S , Γ)-aggregate pseudorandom function if the advantage of any PPT adversary in attacking the aggregate pseudorandom function security of F is negligible, where the advantage of an adversary D is defined via

Adv agg-prf F,S ,Γ (D) := Pr AGGPRFReal D F ⇒ 1 -Pr AGGPRFRand D F ⇒ 1 ,
where games AGGPRFReal F and AGGPRFRand F are depicted in Figure 2.5.

Remark 2.3.7. Again, game AGGPRFRand F may not be polynomial-time, as AGG f,S ,Γ may require to compute an exponential number of values f (x). However, for all the aggregate pseudorandom functions that we consider in this manuscript, this game is statistically indistinguishable from a polynomial-time game, by doing lazy simulation. Further details are given in the corresponding sections.

Cohen-Goldwasser-Vaikunthanathan Construction

To illustrate this definition, we give one of the constructions proposed in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF], for hypercube aggregation. We consider the Naor-Reingold pseudorandom function, whose key space, domain, and range are respectively Z n+1 p , {0, 1} n , and G = g a cyclic group of prime order p. Then, the aggregation function for hypercubes is defined as:

AGGPRFReal F AGGPRFRand F proc Initialize pp $ ← F.Setup(1 κ ) K $ ← K Return pp proc Fn(x) Return F.Eval pp (K, x) proc AGG(S) Return AGG F.Evalpp(K,•),S ,Γ (S) proc Initialize pp $ ← F.Setup(1 κ ) f $ ← Fun(D, R) Return pp proc Fn(x) Return f (x) proc AGG(S) Return AGG f,S ,Γ (S)
• S = {S z | z ∈ {0, 1, } n }, where for any z ∈ {0, 1, } n , S z is the subset of {0, 1} n containing all bitstrings x such that x i = z i if z i ∈ {0, 1} and x i ∈ {0, 1} if z i = , for i = 1, . . . , n.
For instance, S n = {0, 1} n and S 0 = {00, 01};

• Γ: G * → G takes as input a tuple of elements (g 1 , . . . , g ) ∈ G and outputs their product i=1 g i .

Then, it is clear that AGG NR.Evalpp( #" a ,•),S ,Γ (S z ) = a 0 • z i =1 a i • z i = (a i + 1) , and security immediately follows from the security of NR (please refer to the introduction for further explanation). It was later shown by Cohen and Holmgren in [START_REF] Cohen | Multilinear Pseudorandom Functions[END_REF] that the above construction is actually secure assuming only the polynomial hardness of the DDH problem in G, introducing multilinear pseudorandom functions.

Multilinear Pseudorandom Functions

Definition

Multilinear pseudorandom functions are a variant of the standard notion of pseudorandom functions, which works with vector spaces. It has been originally defined in [START_REF] Cohen | Multilinear Pseudorandom Functions[END_REF] as follows.

Definition 2.3.9 (Multilinear Pseudorandom Function). A multilinear pseudorandom function is defined by a tuple of two polynomial-time algorithms F = (F.Setup, F.Eval), such that:

• F.Setup(1 κ ) outputs some public parameters pp;

• F.Eval pp (•, •) is a function that depends on pp and takes as input a secret key K ∈ K and an input x ∈ D and deterministically outputs a value y = F.Eval pp (K, x) ∈ R.

Moreover, its domain

D = D 1 × • • • × D n is a cartesian product of n vector spaces D 1 , . . . , D n ,
for some integer n, and its range R is a vector space. We say that F is a multilinear pseudorandom function if the advantage of any PPT adversary in attacking the multilinear pseudorandom function security of F is negligible, where the advantage of an adversary D is defined via

Adv mprf F (D) := Pr MPRFReal D F ⇒ 1 -Pr MPRFRand D F ⇒ 1 ,
where games MPRFReal F and MPRFRand F are depicted in Figure 2.6. Once again, game MPRFRand F can be implemented in polynomial time using lazy simulation, for instance using a deterministic algorithm to check linearity of simple tensors. Such a procedure is given in [START_REF] Bogdanov | A Stateful Implementation of a Random Function Supporting Parity Queries over Hypercubes[END_REF].

MPRFReal F MPRFRand F proc Initialize pp $ ← F.Setup(1 κ ) K $ ← K Return pp proc Fn( #" x ) Return F.Eval pp (K, #" x ) proc Initialize pp $ ← F.Setup(1 κ ) f $ ← L(D 1 ⊗ • • • ⊗ D n , R) Return pp proc Fn( #" x ) Return f ( #" x )

Cohen-Holmgren Construction

We also recall the first construction given by Cohen and Holmgren in [START_REF] Cohen | Multilinear Pseudorandom Functions[END_REF]. We denote CH = (CH.Setup, CH.Eval) this construction, defined as follows:

• CH.Setup(1 κ ) generates public parameters pp = (p, G, g, 1 , . . . , n ) where (p, G, g) describes a cyclic group of prime order p generated by g, and 1 , . . . , n describe the dimensions of vector spaces such that

D := K := Z 1 p × • • • × Z n p ; • CH.Eval pp (•, •) takes as input a key ( #" a 1 , . . . , # " a n ) ∈ Z 1 p × • • • × Z n p as well as an input ( # " x 1 , . . . , # " x n ) ∈ Z 1 p × • • • × Z n p and outputs [ n i=1 #" a i , #" x i ] g .
Once again, we often use the notation CH(

Multilinear Maps and the Generic Multilinear Map Model

In this section, we introduce multilinear maps and the generic multilinear map model, that are central in Chapter 7. The generic multilinear map model is also used in Section 4.4 under the term multilinear group model but in a quite informal manner, and we provide a simple intuition of this model in the corresponding section. Thus, though we encourage the reader to get used to this model before reading Section 4.4, this section is crucial only for reading Chapter 7.

Multilinear Maps

Multilinear maps, also known as graded multilinear maps or graded encodings, are a generalization of bilinear maps. We recall that a bilinear map is an application e:

G 1 × G 2 → G T that satisfies e(g a 1 , g b 2 ) = e(g 1 , g 2 ) ab
, where G 1 , G 2 , G T are cyclic groups of same order N , respectively generated by g 1 , g 2 , e(g 1 , g 2 ). From a high-level view, a multilinear map allows to transform scalars x and y into encodings, denoted x and ŷ, at any level, of a given hierarchy. Moreover, it allows to perform arithmetic operations: specifically, given encodings x, ŷ at a same level S, one can compute an encoding of x + y at level S; given encodings x, ŷ at levels S 1 , S 2 respectively, one can compute an encoding of xy at a level S 1 S 2 , where is an operation over the levels to be precised. In the case of a symmetric bilinear map e: G × G → G T , one can let the levels to be 0 for scalars, 1 for elements in G and 2 for elements in G T , so that given two encodings at a same level i, one can create an encoding of their sum (by summing scalars or multiplying group elements), and given two encodings at levels i and j, one can create an encoding of their product at level i + j if i + j ≤ 2 (by multiplying scalars, raising a group element to some scalar, or applying the pairing to two group elements), so is simply the addition in this case. As in the case of symmetric bilinear maps, for multilinear maps, these levels in the hierarchy limit the operations that one can perform: one can always perform additions at a fixed level and one always "increases" the level when performing a multiplication.

In the case of an asymmetric bilinear map e: G 1 × G 2 → G T , we usually identify levels with the subset lattice ∅ ⊆ {A}, {B} ⊆ {A, B}, with ∅ corresponding to scalars, {A} to G 1 , {B} to G 2 and {A, B} to G T . With these notations, the operation simply becomes the union of the levels, as set union. This notion naturally extends to the case of asymmetric multilinear maps: we identify levels to sets of formal symbols. In this thesis, we follow this notion, and formal definitions are detailed below and follow the notations of [START_REF] Zimmerman | How to Obfuscate Programs Directly[END_REF].

Generic Multilinear Map Model

The generic multilinear map model is a generalization of the generic group model [START_REF] Shoup | Lower Bounds for Discrete Logarithms and Related Problems[END_REF]. Roughly speaking, the adversary has only the capability to apply operations (add, multiply, and zero-test) of the multilinear map to encodings. A scheme is secure in the generic multilinear map model if for any adversary breaking the real scheme, there is a generic adversary that breaks a modified scheme in which encodings are replaced by fresh nonces, called handles, that it can supply to a stateful oracle M , defined as follows:

Chapter 3 Introduction to Related-Key Security

In this chapter, we provide an introduction to related-key security. We start by defining the security model for pseudorandom functions and by recalling first results by Bellare and Kohno [START_REF] Bellare | A Theoretical Treatment of Related-Key Attacks: RKA-PRPs, RKA-PRFs, and Applications[END_REF]. In particular, we recall some impossibility results. Next, we describe how related-key secure pseudorandom functions play a central role in related-key security. Indeed, many related-key secure cryptographic primitives can be built directly from related-key pseudorandom functions, as shown by Bellare, Cash, and Miller [START_REF] Bellare | Cryptography Secure against Related-Key Attacks and Tampering[END_REF]. Finally, we recall, correct, and extend the Bellare-Cash framework [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF] and provide some simple applications of the resulting frameworks.

This framework was originally introduced in 2010 as a solution to construct the first related-key secure pseudorandom functions under standard assumptions. Unfortunately, its proof suffered from a minor bug and the framework had to be slightly changed, weakening the results of the paper. Here, we provide a different approach for proving its security, which allows us to recover all the results from the original paper, and more. This justifies our claim of repairing the Bellare-Cash framework.

Contents

Definition and Security Model

As already detailed in the introduction of this thesis, the classical security models usually assume that an adversary has only black-box access to the cryptosystem. For instance, in the case of pseudorandom functions, the classical security model (see Definition 2.3.2) only allows the adversary to query the pseudorandom function on inputs of its choice. In particular, the key is perfectly hidden and the adversary has no power regarding the choice of the key. However, in the real world, it has been shown that an adversary might be more powerful, and might be able to modify the key.

The related-key security model provides the adversary with such capacities. Specifically, in this model, an adversary is associated to a set Φ of functions, termed related-key deriving functions, and is given the capacity to force the cryptosystem to work on different but related keys, obtained by applying functions of Φ to the original key. In particular, if Φ only contains the identity function, we obtain the classical security notion. This model has been formalized by Bellare and Kohno in [START_REF] Bellare | A Theoretical Treatment of Related-Key Attacks: RKA-PRPs, RKA-PRFs, and Applications[END_REF] as follows. denote a pseudorandom function whose key space, domain, and range are respectively denoted K, D, and R. We define the advantage of an adversary D in attacking the related-key security of F as:

Adv rka-prf F,Φ (D) := Pr RKPRFReal D F ⇒ 1 -Pr RKPRFRand D F ⇒ 1 ,
where RKPRFReal F and RKPRFRand F are described in Figure 3.1. Furthermore, for a set of functions Φ ⊆ Fun(K, K), termed a class of related-key deriving (RKD) functions, we say that an adversary D is Φ-restricted, if it is restricted to make only queries (φ, x) with φ ∈ Φ.

Then, we say that F is a Φ-related-key secure pseudorandom function if the advantage of any Φ-restricted PPT adversary in attacking the related-key security of F is negligible. Similarly to the classical pseudorandom function security model, the Initialize procedure of game RKPRFRand could not be a polynomial-time procedure, according to our definition. This issue can easily be circumvent (see Remark 2.3.3). Please also note that the adversary cannot modify the public parameters pp. In particular, assuming the public parameters contain the description of a group (p, G, g), the adversary does not have any power regarding these values.

RKPRFReal F RKPRFRand F proc Initialize pp $ ← F.Setup(1 κ ) K $ ← K Return pp proc RKFn(φ, x) Return F.Eval pp (φ(K), x) proc Finalize(b) Return b proc Initialize pp $ ← F.Setup(1 κ ) f $ ← Fun(K × D, R) K $ ← K Return pp proc RKFn(φ, x) Return f (φ(K),
As described in the following section, there exist classes Φ of RKD functions such that one cannot construct Φ-related-key secure pseudorandom functions. Therefore, one of the goals in related-key security is to understand which classes of RKD functions can be handled and if one can protect cryptosystems against meaningful (real-world) classes.

First Impossibility and Feasibility Results

Beyond formalizing the security model for related-key security, Bellare and Kohno also proposed first impossibility and feasibility results in this setting. Here we describe succinctly and informally these results. The main point is to emphasize that depending on the classes of related-key deriving functions, it might be impossible to achieve related-key security. For further details, please refer to the original paper [START_REF] Bellare | A Theoretical Treatment of Related-Key Attacks: RKA-PRPs, RKA-PRFs, and Applications[END_REF].

Impossibility Results

While related-key security is something we need in the real world, Bellare and Kohno proved that it is not achievable for certain classes of functions. The first example is obvious: assuming a class Φ of related-key deriving functions contains a constant function f equals to c, then achieving Φ-related-key security is impossible. This impossibility result is immediate, as the adversary has the power, applying f to the key, to make the cryptosystem run with the known key c.

They also proposed more elaborate impossibility results. For instance, assume the key space is {0, 1} κ and assume that Φ contains the identity function and the permutations φ i , for i = 1, . . . , k, where φ i (K) = K if K i = 0 and φ i (K) = K ⊕ 1 i-1 0 1 κ-i otherwise. Then, one can just pick any input x in the domain of the pseudorandom function and query (id, x), (φ 1 , x), . . . , (φ κ , x). For every i = 1, . . . , κ, if the values obtained with queries (id, x) and (φ i , x) match, then the i-th bit of K is 0 with overwhelming probability (assuming the range is big, otherwise one can just do this comparison with multiple inputs). Thus, it is obvious that one cannot achieve related-key security against such a class.

Similarly, assume that Φ contains XOR relations with bitstrings 0 i-1 1 0 κ-i and additions with 2 i-1 modulo 2 κ (seeing the key as the bit-representation of an integer modulo 2 κ ), for i = 1, . . . , κ, then a similar attack can be mounted from the fact that K ⊕ 0 i-1 1 0 κ-i and K + 2 κ-i-1 mod 2 κ match if and only if K i = 0.

Ton conclude, it is clear that there is no hope in proving related-key security for certain classes, and it is of prime interest to understand which types of classes can be handled (and if natural classes, such as XOR relations, can be handled).

Feasibility Results

Though it is impossible to protect against certain classes of functions, related-key security for real-world classes remains one of the main goals of modern blockciphers, such as AES. Hence, Bellare and Kohno also studied the related-key security of blockciphers and proposed first feasibility results. Specifically, they prove that an ideal blockcipher is Φ-related-key secure as soon as the class of functions Φ satisfies two properties, termed collision-resistance and output-unpredictability. Informally, consider a random key K, a small subset S of Φ, and a small subset X of the key space K, then collision-resistance asks that the probability that φ 1 (K) = φ 2 (K) for two distinct functions φ 1 , φ 2 ∈ S, is small, while output-unpredictability asks that the probability that there exists a function φ ∈ S such that φ(K) ∈ X is small. Intuitively, collision-resistance guarantees that every related-key is distinct, while outputunpredictability guarantees that every related-key is random, and thus, related-key security simply follows from standard security, as running the related-key security game is not different from running multiple instances of the standard security game with different, random, and independent keys.

In particular, if Φ contains only permutations, collision-resistance is immediate and an ideal blockcipher is Φ-related-key secure as soon as Φ satisfies output-unpredictability. Thus, as the class of XOR relations contains only permutations and satisfies output-unpredictability, this feasibility proves that ideal blockciphers are secure against XOR relations.

The Central Role of Pseudorandom Functions

Almost ten years after this first theoretical treatment of related-key security, building relatedkey secure cryptosystems in the standard model remained a wide-open problem. Bellare and Cash proposed the first construction of related-key secure pseudorandom function under standard assumptions only in 2010. This description is described in the next section, but before giving details about this construction, let us discuss about other primitives and why pseudorandom functions are actually fundamental in related-key security.

Related-key security solves practical issues, such as certain types of side-channel attacks, so it might seem natural to focus on primitives that are widely used in practice, such as symmetric encryption or signatures. However, it appears that building related-key secure pseudorandom functions is actually sufficient to build most of the primitive we might be interested in. Indeed, in [START_REF] Bellare | Cryptography Secure against Related-Key Attacks and Tampering[END_REF], Bellare, Cash, and Miller proved that, given a Φ-related-key secure pseudorandom function, one can transform any symmetric encryption (resp. signature, public-key encryption, identity-based encryption) scheme that is secure in the classical security model into a Φ-related-key secure one.

Moreover, the transform is rather simple and practical: informally, given a related-key secure pseudorandom function, one can build a related-key secure pseudorandom generator. Then, the transform mainly consists in fixing the secret key to be some random K and in switching the randomness used in the key generation algorithm to the output of the related-key secure pseudorandom generator evaluated on K. As the pseudorandom generator is related-key secure, running multiple instances with different related keys simply corresponds to running multiple instances with independent and uniformly random keys, and security follows.

Therefore, pseudorandom functions should be the main focus in related-key security, as the allows to build most of the interesting primitives for real-world applications. We do not further discuss this result and encourage the reader to read [START_REF] Bellare | Cryptography Secure against Related-Key Attacks and Tampering[END_REF] for details.

The Bellare-Cash Framework, Revisited

In this section, we describe the Bellare-Cash framework [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF]. This framework, introduced in 2010, allowed to build the first related-key secure pseudorandom functions under standard assumptions. Unfortunately, the proof of this framework presented a minor bug, and the authors modified the construction, by strengthening the requirements of their framework, in order to correct this issue. This modification weakens the framework and prevents it from being applied to certain classes of functions. Here, we provide a new proof that slightly deviates from the original (and incorrect) proof by Bellare and Cash. Our approach allows us to correct the bug from the original framework and to recover all the original results. In particular, our requirements are exactly the same as those of the original framework. Here, we directly present a simple extension of this framework that let us handle larger classes of RKD functions. The original Bellare-Cash framework consists in a particular case of our framework.

Until the end of this chapter, we denote by F = (F.Setup, F.Eval) a pseudorandom function whose key space, domain, and range are respectively denoted by K, D, and R. For simplicity, we often denote F.Eval pp (K, x) by F (K, x) throughout this chapter, and when doing so, setup and public parameters are implicit. In particular, we adopt these notations for the proof of the framework to ease the reading. We first introduce some additional material that is later used for the framework and its proof.

Additional Notions

We define the notions of strong key fingerprint, unique-input adversary, key-malleability, and compatible hash function introduced in [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF] and used in the framework. Strong Key Fingerprint. A strong key fingerprint is a tool used to detect whether a key arises more than once in a simulation, even if we do not have any information about the key itself. Let #" ω be a vector over D and let n its length. We say that #" ω is a strong key fingerprint for the pseudorandom function F = (F.Setup, F.Eval) if (F.Eval pp (K, ω 1 ), . . . , F.Eval pp (K, ω n )) = (F.Eval pp (K , ω 1 ), . . . , F.Eval pp (K , ω n )) , for all distinct K, K ∈ K and any public parameters pp.

Unique-Input Adversary. We say that an adversary against the related-key security of a pseudorandom function is unique-input if its oracle queries (φ 1 , x 1 ), . . . , (φ q , x q ) are such that x 1 , . . . , x q are always distinct.

Key-Malleability.

Let Φ be a class of RKD functions. Suppose KT is a deterministic algorithm that, given an oracle f : D → R and inputs (φ, x) ∈ Φ × D, returns a point KT f (φ, x) ∈ R. We say that KT is a key-transformer for (F, Φ) if it satisfies the following correctness and uniformity conditions. Correctness requires that, for any public parameters pp, KT F.Evalpp(K,•) (φ, x) = F.Eval pp (φ(K), x) for every (φ, K, x) ∈ Φ × K × D. Uniformity requires that for any (even inefficient) Φ-restricted unique-input adversary U ,

Pr KTReal U KT ⇒ 1 = Pr KTRand U KT ⇒ 1 ,
where games KTReal KT and KTRand KT are described in Figure 3.2. Finally, we say that F is Φ-key-malleable if such a key-transformer for (F, Φ) exists. ω ∈ D m and let D = D × R m . We denote by Qrs(KT, F, Φ, #" ω ) the set of all w ∈ D such that there exists (f, φ, i) ∈ Fun(D, R) × Φ × {1, . . . , m} such that the computation of KT f (φ, ω i ) makes oracle query w. Then, we say that a hash function

KTReal KT KTRand KT proc Initialize f $ ← Fun(D, R) proc KTFn(φ, x) Return KT f (φ(K), x)
H: D → S is compatible with (KT, F, Φ, #" ω ), if S ⊆ D \ Qrs(KT, F, Φ, #" ω ).
Remark 3.4.1. A first attempt to fix the minor bug of the Bellare-Cash framework was proposed by the authors in [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure Against Related-Key Attacks[END_REF]. To circumvent the issue in the proof, they used a stronger notion of compatible hash function. While providing a correct proof, this change weakens the framework and prevents it from being applied to certain classes. Here, we stick to the original (and weaker) notion of compatible hash function, which let us recover all the original results. We simply fix the proof by using a slightly different strategy.

Dealing with Key-Collisions

Before describing the framework, we introduce two new notions that allow us to slightly generalize the framework. Indeed, the original framework by Bellare and Cash only allowed to handle classes Φ of RKD functions that are claw-free, which means that for any K ∈ K and any distinct φ, φ ∈ Φ, φ(K) = φ (K). In this section, we give a method to deal with classes of RKD functions that are not claw-free, such as affine classes. We introduce two new security notions: the first one is called Φ-Key-Collision Security and captures the likelihood that an adversary finds two distinct RKD functions which lead to the same derived key given oracle access to F , while the second one, called Φ-Statistical-Key-Collision Security, is similar but replaces the oracle access to the pseudorandom function with an oracle access to a truly random function.

Φ-Key-Collision (Φ-kc) Security. We define the advantage of an adversary A against the Φ-key-collision security of F , denoted by Adv kc Φ,F (A ), to be the probability of success in the game on the left side of Figure 3.3, where the functions φ appearing in A 's queries are restricted to lie in Φ. In particular, if Φ is claw-free, this advantage is 0.

Φ-Statistical-Key-Collision (Φ-skc) Security. We define the advantage of an adversary

A against the Φ-statistical-key-collision security for Fun(K × D, R), denoted by Adv skc Φ (A ), to be the probability of success in the game on the right side of Figure 3.3. Here the functions φ appearing in A 's queries are again restricted to lie in Φ. In particular, if Φ is claw-free, this advantage is 0.

Φ-kc security Φ-skc security proc Initialize pp $ ← F.Setup(1 κ ) K $ ← K proc RKFn(φ, x) y ← F.Eval pp (φ(K), x) Return y proc Finalize(φ 1 , φ 2 ) Return (φ 1 = φ 2 and φ 1 (K) = φ 2 (K)) proc Initialize K $ ← K ; D ← ∅ ; E ← ∅ f $ ← Fun(K × D, R) ; b ← 0 proc RKFn(φ, x) If φ(K) ∈ E and φ / ∈ D then b ← 1 D ← D ∪ {φ} ; E ← E ∪ {φ(K)} y ← f (φ(K), x) Return y proc Finalize Return (b = 1)

The (Extended) Framework

We now describe our framework, which both repairs and extends the main result of [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF].

Intuitively, this framework allows to build a Φ-related-key secure pseudorandom function from any pseudorandom function that is Φ-key-malleable, as soon as there exists a strong key fingerprint #" ω for F and a collision-resistant hash function that is compatible with (KT, F, Φ, #" ω ). The construction is detailed below. Assuming the class Φ is claw-free, the advantages against key-collision and statistical-key-collisions securities are 0 and the framework below matches exactly the original Bellare-Cash framework.

F.Eval pp (K, x) := M.Eval pp (K, H(x, M.Eval pp (K, #" ω ))) , for all K ∈ K and x ∈ D.
Then, assuming M is a pseudorandom function and is Φ-key-collision secure, H is a collision-resistant hash function, and

Fun(K × D, R) is Φ-statistical-key-collision secure, F is a Φ-related key secure pseudorandom function.
Furthermore, the running time of the reduction is polynomial in the running time of the key-transformer and of the adversary against the Φ-related-key security of F . Proof Overview. The proof of the above theorem is detailed below and relies on the sequence of 11 games (games G 0 -G 10 ) described in Figure 3.4. Here we provide a brief overview. Since the RKD functions that we consider in our case may have claws, we start by dealing with possible collisions on the related-keys in the RKPRFReal case, using the key-collision notion (games G 0 -G 2 ). Then, in games G 3 -G 4 , we deal with possible collisions on hash values in order to ensure that the hash values h used to compute the output y are pairwise distinct so the attacker is unique-input. Then, using the properties of the keytransformer and the compatibility condition, we show that it is hard to distinguish the output from a uniformly random output (games G 5 -G 7 ) based on the standard pseudorandom function security of M . Finally, we use the statistical-key-collision security notion to deal with possible key collisions in the RKPRFRand case (games G 8 -G 10 ) so that G 10 matches the description of the RKPRFRand game.

Remark 3.4.3. It is worth noting that we deviate from the original proof of [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF] in games G 5 -G 7 , filling the gap in their original proof, but under the same technical conditions on compatibility. Unlike in their proof, we are able to show that the output of F is already indistinguishable from a uniformly random output as soon as one replaces the underlying pseudorandom function M with a random function f due to the uniformity condition of the transformer. In order to build a unique-input adversary against the uniformity condition, the main trick is to precompute the values of f (w) for all w ∈ Qrs(KT, M, Φ, #" ω ) and use these values to compute KT f (φ, ω i ), for i = 1, . . . , | #" ω | and φ ∈ Φ, whenever needed. This avoids the need to query the oracle in the uniformity game twice on the same input when computing the fingerprint.

Proof of Theorem 3.4.2. The proof is based on the sequence of games in Figure 3.4. Much of the proof is similar to that of the general framework of Bellare and Cash from [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF]. However, we have additional games to deal with non-claw-freeness (games G 1 , G 2 , G 9 and G 10 ), and some games (games G 6 and G 7 ) are modified to deal with the gap in the proof of the corresponding theorem in [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF]. Let Succ i denote the event that game G i output takes the value 1. Let A be an adversary against the Φ-related-key security of F , and let us assume (without loss of generality) that it never repeats a query.

G 0 matches the description of the RKPRFReal F game, so:

Pr [ Succ 0 ] = Pr RKPRFReal A F ⇒ 1 .
Game G 1 introduces storage of used RKD functions and values of #" ω in sets D and E respectively and sets flag 1 to true if the same value of #" ω arises for two different RKD functions. Since this storage does not affect the values returned by RKFn, we have

Pr [ Succ 1 ] = Pr [ Succ 0 ] .
Game G 2 adds the boxed code which changes how the repetition of an #" ω value is handled, by picking instead a random value from R m \ E that will not repeat any previous one. Games G 1 and G 2 are identical until flag 1 is set to true, hence we have

Pr [ Succ 1 ] ≤ Pr [ Succ 2 ] + Pr [ E 1 ] ,
where E 1 denotes the event that the execution of A with game G 1 sets flag 1 to true. We design an adversary D attacking the Φ-key-collision security of M such that

Pr [ E 1 ] ≤ Adv kc Φ,M (D) .
Adversary D runs A . When the latter makes an RKFn-query (φ, x), adversary D queries (φ, ω i ), for i = 1, . . . , | #" ω |, to its oracle, then computes #" ω and then h = H(x, #" ω ) and finally queries (φ, h) to its oracle and sends it to A . When A stops, D searches for two different RKD functions φ queried by A that lead to the same value #" ω and returns these two functions if found. Since #" ω is a strong key fingerprint, two such functions lead to the same key, so D wins if it finds such two functions. (Of course, if the class of RKD functions is claw-free, the advantage of the attacker is 0.) Game G 3 introduces storage of hash values in a set G and sets flag 2 to true if the same hash output arises twice. Since this storage does not affect the values returned by RKFn

Pr [ Succ 3 ] = Pr [ Succ 2 ] .
Game G 4 adds the boxed code which changes how repetition of hash values is handled, by picking instead a random value h from S \ G that will not repeat any previously used hash value. Games G 3 and G 4 are identical until flag 2 is set to true, hence we have

Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Pr [ E 2 ] ,
where E 2 denotes the event that the execution of A with game G 3 sets flag 2 to true. We design an adversary C attacking the cr security of H such that

Pr [ E 2 ] ≤ Adv cr H (C ) .
Adversary C starts by picking K $ ← K and initializes j ← 0. It runs A . When the latter makes an RKFn-query (φ, x), adversary C responds via:

For i = 0, . . . , | #" ω | do: ω i ← M (φ(K), ω i ) j ← j + 1 ; φ j ← φ ; x j ← x If #" ω ∈ E and φ / ∈ D then #" ω $ ← S \ E ( * ) Else D ← D ∪ {φ} E ← E ∪ { #" ω } w j ← #" ω h ← H(x, #" ω ) h j ← h y ← M (φ(K), h) Return y.
When A halts, C searches for a, b satisfying 1 ≤ a < b ≤ j such that h a = h b and, if it finds them, outputs (x a , w a ), (x b , w b ) and halts. The pairs (x a , w a ) and (x b , w b ) are distinct. Indeed, consider two cases: first, if φ a = φ b then since A never repeats an oracle query, In game G 6 , we replace the oracle M (K, •) given to the key-transformer KT by a random function f . We design an adversary B attacking the pseudorandom function security of M such that Pr

x a = x b hence (x a , w a ) = (x b , w b ). Second, if φ a = φ b ,
[ Succ 5 ] ≤ Pr [ Succ 6 ] + Adv prf M (B) .
Adversary B runs A . When the latter makes an RKFn-query (φ, x), adversary B responds via

For i = 0, . . . , | #" ω | do ω i ← KT Fn (φ, ω i ) If #" ω ∈ E and φ / ∈ D then #" ω $ ← S \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) y ← KT Fn (φ, h) Return y
where Fn is B's own oracle. When A halts, B halts with the same output. Then

Pr PRFReal B M ⇒ 1 = Pr [ Succ 5 ] and Pr PRFRand B M ⇒ 1 = Pr [ Succ 6 ]
. In game G 7 , instead of computing the output y using the key-transformer, we set the value y to a uniformly random value. To show that games G 6 and G 7 are perfectly indistinguishable, we use the uniformity condition of the Key-Transformer KT. Let us recall that, as formally defined in [BC10b, Section 3.1], the uniformity condition states that for any (even inefficient) Φ-restricted, unique-input adversary U ,

Pr KTReal U KT ⇒ 1 = Pr KTRand U KT ⇒ 1 ,
where game KTReal KT picks f $ ← Fun(D, R) during the initialization and responds to oracle query KTFn(φ, x) via KT f (φ, x), while game KTRand KT has no initialization and responds to oracle query KTFn(φ, x) by returning a value y $ ← R chosen uniformly at random in R. We show that if an adversary A can distinguish games G 6 and G 7 , then we can construct a unique-input adversary U that can distinguish games KTReal KT and KTRand KT ; since KT is a key-transformer, these two games are perfectly indistinguishable for a unique-input adversary by the uniformity condition. Hence, so are G 6 and G 7 .

Adversary U starts by initializing sets D ← ∅, E ← ∅, G ← ∅, then makes the queries (id, w) to its oracle, for every w ∈ Qrs(KT, M, Φ, #" ω ) and stores these values. This is possible under our assumption that id ∈ Φ. We let f w denote the value that D gets from its oracle in response to the query (id, w). Depending on U 's oracle, the value of f w for w ∈ Qrs(KT, M, Φ, #" ω ) is either KT f (id, w) = f (w) (KTReal KT ), with f the random function defined in the Initialize procedure of KTReal KT , or a uniformly random value from R (KTRand KT ). All these values will be used by U to compute the value #" ω in its simulation. Now, U runs A . When A makes an oracle query (φ, x), U starts by computing the values ω i , for i = 1, . . . , | #" ω |, using the values f w it has stored, the function φ it gets from A , and the key-transformer KT. Note that, because U already queried (id, w) to its oracle for every w ∈ Qrs(KT, M, Φ, #" ω ), U is able to compute by itself the values ω i , for i = 1, . . . , | #" ω |. This is because, in making these queries, U already sets a value f w for every w ∈ Qrs(KT, M, Φ, #" ω ), and this is the set of all values that might be needed in computing KT f (φ, ω i ), for i = 1, . . . , | #" ω | and φ ∈ Φ. Notice that, in making these queries all at once at the beginning, U remains a unique-input adversary. After computing

#" ω , U checks if #" ω ∈ E and φ / ∈ D. If these conditions hold, U picks #" ω $ ← R m \ E at random, otherwise U sets D ← D ∪ {φ}. It then sets E ← E ∪ { #" ω }. Next, U computes h ← H(x, #" ω ) and checks if h ∈ G. If this holds, U picks h $ ← S \ G at random.
Notice that this step guarantees that all values h are in S and are all distinct as long as A makes at most |S| queries. Finally, U sets G ← G ∪ {h}, makes the query (φ, h) to its oracle, and returns the value it gets, which is either KT f (φ, h) or a uniformly random value, to A . When A halts, U halts with the same output. The compatibility condition ensures that S does not contain any w with w ∈ Qrs(KT, M, Φ, #" ω ). It follows from these observations that U is a unique-input adversary. Finally, it is clear that if U 's oracle is KTReal KT , then it simulates exactly game G 6 with f being the function f chosen at random in the Initialize procedure of game KTReal KT . If U 's oracle is KTRand KT , then it simulates exactly game G 7 since the values given to A are uniformly random values. Then, we have

Pr KTReal U KT ⇒ 1 = Pr [ Succ 6 ] and Pr KTRand U KT ⇒ 1 = Pr [ Succ 7 ] ,
and then, since Pr KTReal U KT ⇒ 1 = Pr KTRand U KT ⇒ 1 for any unique-input adversary U , by the uniformity condition, we finally have

Pr [ Succ 6 ] = Pr [ Succ 7 ] .
Games G 7 and G 8 are identical since even if two different queries lead to the same key, the "If" test ensures that the returned value is still uniformly random over R. Hence,

Pr [ Succ 7 ] = Pr [ Succ 8 ] .
Games G 8 and G 9 are identical until flag 3 is set to true, hence we have

Pr [ Succ 8 ] ≤ Pr [ Succ 9 ] + Pr [ E 3 ] ,
where E 3 denotes the event that the execution of A with game G 9 sets flag 3 to true. We design an adversary E breaking Φ-statistical-key-collision security for Fun(K, D, R) such that:

Pr [ E 3 ] ≤ Adv skc Φ (E ) .
Adversary E runs A . When the latter makes an RKFn-query (φ, x), so does E and E returns the value it receives to A . When A stops, if A has queried two different functions φ 1 and φ 2 such that φ 1 (K) = φ 2 (K) then b was set to 1 when the second of these two functions was queried by E , and then E wins. (Of course, if the class of RKD functions is claw-free, this probability is 0.) Games G 9 and G 10 are identical, so

Pr [ Succ 9 ] = Pr [ Succ 10 ] .
Finally, G 10 matches the description of the RKPRFRand F game, so:

Pr [ Succ 10 ] = Pr RKPRFRand A F ⇒ 1 .
Theorem 3.4.2 now follows by combining the bounds arising in the different game hops.

proc Initialize / / G 0 K $ ← K proc RKFn(φ, x) / / G 0 For i = 1, . . . , | #" ω | do ω i ← M (φ(K), ω i ) h ← H(x, #" ω ) y ← M (φ(K), h) Return y proc Finalize(b) / / All Games Return b proc Initialize / / G 1 , G 2 K $ ← K ; D ← ∅ ; E ← ∅ proc RKFn(φ, x) / / G 1 , G 2 For i = 1, . . . , | #" ω | do ω i ← M (φ(K), ω i ) If #" ω ∈ E and φ / ∈ D then flag 1 ← true ; #" ω $ ← R m \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) y ← M (φ(K), h) Return y proc Initialize / / G 3 , G 4 K $ ← K ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn(φ, x) / / G 3 , G 4 For i = 1, . . . , | #" ω | do ω i ← M (φ(K), ω i ) If #" ω ∈ E and φ / ∈ D then #" ω $ ← R m \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) If h ∈ G then flag 2 ← true h $ ← S \ G G ← G ∪ {r} y ← M (φ(K), h) Return y proc Initialize / / G 5 K $ ← K ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn(φ, x) / / G 5 For i = 1, . . . , | #" ω | do ω i ← KT M (K,•) (φ, ω i ) If #" ω ∈ E and φ / ∈ D then #" ω $ ← R m \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) If h ∈ G then h $ ← S \ G G ← G ∪ {r} y ← KT M (K,•) (φ, h) Return y proc Initialize / / G 6 K $ ← K ; D ← ∅ ; E ← ∅ ; G ← ∅ f $ ← Fun(D, R) proc RKFn(φ, x) / / G 6 For i = 1, . . . , | #" ω | do ω i ← KT f (φ, ω i ) If #" ω ∈ E and φ / ∈ D then #" ω $ ← R m \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) If h ∈ G then h $ ← S \ G G ← G ∪ {r} y ← KT f (φ, h) Return y proc Initialize / / G 8 , G 9 K $ ← K ; D ← ∅ ; E ← ∅ G $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 8 , G 9 y ← G(φ(K), x) If φ(K) ∈ E and φ / ∈ D then flag 3 ← true ; y $ ← R D ← D ∪ {φ} ; E ← E ∪ {φ(K)} Return y proc Initialize / / G 7 K $ ← K ; D ← ∅ ; E ← ∅ G $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 7 y $ ← R Return y proc Initialize / / G 10 K $ ← K ; G $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 10 y ← G(φ(K), x) Return y

Application: Related-Key Security for Affine Relations

In this section, we apply the above framework to the variant NR * of the Naor-Reingold pseudorandom function to build a related-key secure pseudorandom function for affine relations. Recall that NR * was defined in [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF] as:

• NR * .Setup(1 κ ) generates public parameters pp = (p, G, g) where (p, G, g) describes a cyclic group of prime order p generated by g;

• NR * .Eval pp (•, •) takes as input a key #" a = (a 1 , . . . , a n ) ∈ Z n p and an input x = x 1 . . . x n ∈ {0, 1} n \ {0 n } and outputs [ n i=1 a x i i ]
g . We first recall the following lemma from [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF]. We define the class Φ aff of affine relations as the set of all functions φ :

Z n p → Z n p such that there exist α i ∈ Z * p , β i ∈ Z p , for i = 1, . . . , n, such that φ( #" a ) = (α 1 • a 1 + β 1 , . . . , α n • a n + β n ) ∈ Z n p .
Then, using the above framework, we prove that NR * can be used to build a Φ aff -relatedkey secure pseudorandom function under the DDH assumption and therefore recover and strengthen the withdrawn result from [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF]. In what follows, we prove the properties needed to apply Theorem 3.4.2 to NR * .

Ingredients

Strong Key Fingerprint. Let ω i = 0 i-1 1 0 n-i , for i = 1, . . . , n. Then #" ω is a strong key fingerprint for NR * . Indeed, we have (NR * ( #" a , ω 1 ), . . . , NR * ( #" a , ω n )) = ([a 1 ] , . . . , [a n ]), so if #" a = #" a are two distinct keys in K = Z n p , then there exists i ∈ {1, . . . , n} such that a i = a i , so

[a i ] = [ #" a i ].
Compatible Hash Function. We have Qrs(KT Φ aff , NR * , Φ aff , #" ω ) = {ω 1 , . . . , ω n }, so let D = {0, 1} n × G n and let h: D → {0, 1} n-2 be a collision resistant hash function. Then the hash function defined by H(x, #" z ) = 11 h(x, #" z ) is a collision resistant hash function that is compatible with (KT Φ aff , NR * , Φ aff , #" ω ) since every element of Qrs(KT Φ aff , NR * , Φ aff , #" ω ) has at most one 1 bit and every output of H has at least two 1 bits. Note that in particular the output of H is never 0 n , so it is always in the domain of NR * .

Key-Collision Security.

The Φ aff -key-collision security of NR * immediately follows from the hardness of the discrete logarithm problem in G, as stated in the lemma below.

Lemma 3.5.2. Assuming the hardness of the discrete logarithm in

G, NR * is Φ aff -key-collision secure.
Since the hardness of DDH implies the hardness of DL, the above lemma does not introduce any additional hardness assumptions beyond DDH.

Proof of Lemma 3.5.2. Let A be an adversary against the Φ aff -key-collision security of NR * that makes Q A oracle queries. Then we construct an adversary B against the DL problem in G as follows. Adversary B receives as input a DL tuple ( [1] , [a]). Adversary B then picks j $ ← {1, . . . , n} at random; this is a guess of a coordinate where the two vectors of affine functions #" φ (1) and #" φ (2) that A will use as inputs in the Finalize procedure are different. Then B picks a i $ ← Z p for i = 1, . . . , n, i = j at random. Adversary B implicitly sets a j = a.

When A makes a query (φ, x), B computes y = ([φ j (a j ) x j ])

n i=1 i =j φ i (a i ) x i = [ n i=1 φ i (a i ) x i ] = NR * ( #" a , x)
, where #" a = (a 1 , . . . , a n ). Here, B uses its input [a] to compute an "affine function in the exponent" for [φ j (a j )]. At the end, A sends ( #" φ (1) , #" φ (2) ) to B and A wins if #" φ (1) = #" φ (2) and #" φ (1) ( #" a ) = #" φ (2) ( #" a ), where #"

φ (i) = (φ (i) 1 , . . . , φ (i)
n ), i ∈ {1, 2}. Since j was chosen uniformly at random and #" φ (1) = #" φ (2) , with probability at least 1 n , we have φ

(1)

j = φ (2) j but φ (1) j (a j ) = φ (2)
j (a j ). In this case, a j = a is the root of the non-zero affine function

ψ = φ (1) j -φ (2)
j , that can be easily computed. Hence, we have

Adv kc Φ aff ,NR * (A ) ≤ n • Adv dl G (B)
, and the claim follows.

Key-Transformer. We define a key-transformer for (NR * , Φ aff ) as:

KT f Φ aff (φ, x) =   i∈S(x) β i   • y x,y =0 n f (y) j∈S(y) α j k∈S(x)\S(y) β k , where φ( #" a ) = (α 1 • a 1 + β 1 , . . . , α n • a n + β n ) ∈ Z n p .
Then, we have the following lemma: Lemma 3.5.3. KT Φ aff is a key-transformer for (NR * , Φ aff ) and its worst-case running time

is the time required to compute O(2 n ) exponentiations in G.
Proof of Lemma 3.5.3. Let us first check the correctness condition.

KT NR * ( #" a ,•) Φ aff ( #" φ , x) =   i∈S(x) β i   • y x,y =0 n   l∈S(y) a l   j∈S(y) α j k∈S(x)\S(y) β k = R⊆S(x)   i∈R (α i • a i ) j∈S(x)\R β j   =   R⊆S(x) i∈R (α i • a i ) j∈S(x)\R β j   =   i∈S(x) (α i • a i + β i )   = n i=1 (α i • a i + β i ) x i = NR * ( #" φ ( #" a ), x) .
Then, we have verified the correctness condition, and it is clear that the worst-case running time is the time to compute 2 n exponentiations in G, when x = 11 . . . 1 and none of the exponents is 0. Hence, only the uniformity condition remains to prove. We use the sequence of games in Figure 3.5. Let us recall that the adversary is supposed to be unique-input, meaning that for any sequence of queries ( #" φ 1 , x 1 ), . . . , ( #" φ q , x q ), the entries x i , for i = 1, . . . , q are all distinct. We denote by hw(x) the Hamming weight of a bitstring x. Let Succ i denote the event that game G i output takes the value 1.

In game G 0 , the "If" statement will always pass since hw(x) ≤ n for any bitstring of length n. Hence, we have We claim that for all 0

Pr [ Succ 0 ] = Pr KTReal A KT ⇒ 1 . proc Initialize / / G i , i = 0, . . . , n f $ ← Fun({0, 1} n \ {0 n }, G) proc Finalize(b) Return b proc RKFn(φ, x) / / G i , i = 0, . . . , n If hw(x) ≤ n -i then y ← KT f Φ aff (φ, x) Else y $ ← G Return y
≤ i ≤ n -1, Pr [ Succ i ] = Pr [ Succ i+1 ] .
The only difference between games G i and G i+1 is in the way that bitstrings x of Hamming weight ni are handled. Indeed, such a string is fed to

KT f Φ aff ( #" φ , x) in G i , which computes KT f Φ aff ( #" φ , x) =   i∈S(x) β i   • y x,y =0 n f (y) j∈S(y) α j k∈S(x)\S(y) β k , where #" φ = (φ 1 , . . . , φ n ) ∈ Φ aff , with φ i : #" T → α i T i + β i , α i = 0, for i = 1, .
. . , n. Now, since we need only deal with unique-input adversaries, this is the only time that G i will query f at input x (all other queries to f will be at other points with the same Hamming weight or at points with strictly smaller Hamming weight). Hence, the entire value computed above can equivalently be set to a value chosen uniformly at random. (This relies on the exponent for f (x) used in the computation being non-zero; this is guaranteed by the requirement that α i = 0, for i = 1, . . . , n and the fact that when y = x, the product k∈S(x)\S(y) β k is empty.) Setting the entire value to a uniformly random value is exactly what is done in G i+1 , and the claim follows.

Finally, in G n , the "If" statement will never pass since hw(x) > 0 for any x ∈ {0, 1} n \ {0} n , so we have Pr [ Succ n ] = Pr KTRand A KT ⇒ 1 . The uniformity condition follows.

Statistical-Key-Collision Security.

The Φ aff -statistical-key-collision security for Fun(Z n p × {0, 1} n \ {0 n }, G) holds statistically, as stated below. Lemma 3.5.4. Let A be an adversary against the Φ aff -statistical-key-collision security for

Fun(Z n p , {0, 1} n , G) making Q A queries.
Then we have:

Adv skc Φ aff (A ) ≤ Q 2 A 2p .
Proof of Lemma 3.5.4. Let A be an adversary against the Φ aff -statistical-key-collision security for Fun(Z n p , {0, 1} n , G) that makes Q A queries. Since the function F defined in the Initialize procedure is a random function, A does not learn any information on the key #" a until b ← 1, so Adv skc Φ aff (A ) is bounded by the probability that A makes use in its queries of two different RKD functions that lead to the same key. We claim that

Adv skc Φ aff (A ) ≤ Q 2 A 2p .
This follows easily on noting that, if two different RKD functions lead to the same key, then those two functions must differ in some coordinate k. This means that the difference in those components is a non-constant affine function ψ k such that ψ k (a k ) = 0, where a k is the k-th component of key #" a that was taken uniformly at random in the Initialize procedure. Since ψ k is a non-constant affine function and a k is uniformly random in Z p , the probability that ψ k (a k ) = 0 is bounded by 1 p . To obtain the final result, one simply applies a union bound over the (at most) Q A 2 pairs of choices of different RKD functions accessed by A .

We now have everything we need to apply Theorem 3.4.2 to NR * .

Putting Everything Together

Combining Theorem 3.4.2, Lemmata 3.5.1-3.5.4 and the above properties, we obtain the following theorem. Moreover, the running time of the reduction is polynomial in 2 n × T , where T is the running time of the adversary against the Φ aff -related-key pseudorandom function security.

Further Generalization of the Bellare-Cash Framework

Relaxing the Requirements of the Framework

In this section, we introduce a new type of pseudorandom functions called (S, Φ)-unique-inputrelated-key pseudorandom functions. This notion allows us to design a different framework that can be applied to non-key-malleable pseudorandom functions. We later show that any key-malleable pseudorandom function is also a unique-input-related-key pseudorandom function as soon as the key-transformer satisfies an adequate property. Definition 3.6.1 (Unique-Input-Related-Key Pseudorandom Function). Let F = (F.Setup, F.Eval) be a function whose key space, domain, and range are denoted by K, D, and R, respectively. Let S be a subset of D and Φ be a class of RKD functions. We consider the class of Φ-restricted adversaries D such that all queries (φ, x) with x ∈ S made by D to its oracle are for distinct values of x. We define of such an adversary D in attacking the (S, Φ)-unique-input-related-key security of F as:

Adv ui-rka-prf F,S,Φ (D) := Pr UIRKPRFReal D F,S ⇒ 1 -Pr UIRKPRFRand D F,S ⇒ 1 ,
where UIRKPRFReal F,S and UIRKPRFRand F,S are described in Figure 3.6. We say that F is an (S, Φ)-unique-input-related-key secure pseudorandom function if for any such PPT adversary D, this advantage is negligible.

The following theorem is an analogue of Theorem 3.4.2 in which the roles of key-malleability and hash function compatibility are replaced by our new security notion. Theorem 3.6.2. Let M = (M.Setup, M.Eval) be a pseudorandom function whose key space, domain, and range are denoted K, D, R, respectively. Let Φ be a class of RKD functions. Let

UIRKPRFReal F,S UIRKPRFRand F,S proc Initialize pp $ ← F.Setup(1 κ ) K $ ← K Return pp proc RKFn(φ, x) Return F.Eval pp (φ(K), x) proc Finalize(b) Return b proc Initialize pp $ ← F.Setup(1 κ ) K $ ← K Return pp proc RKFn(φ, x) If x ∈ S then y $ ← R Else y ← F.Eval pp (φ(K), x)
F.Eval pp (K, x) := M.Eval pp (K, H(x, M.Eval pp (K, #" ω ))) , for all K ∈ K and x ∈ D.
Then, assuming M is an (S, Φ)-unique-input-related-key secure pseudorandom function and is Φ-key-collision secure, H is a collision-resistant hash function, and Fun(K × D, R) is Φ-statistical-key-collision secure, then F is a Φ-related key secure pseudorandom function.

Moreover, the running time of the reduction is polynomial in the running time of the adversary and of the key-transformer.

Proof Overview. The proof of the above theorem is detailed below and is very similar to the proof of Theorem 3.4.2. The difference lies essentially in the fact that we use the unique-input-related-key security and the compatibility condition to show that it is hard to distinguish the output of F from a uniformly random output, in games G 5 , G 6 , instead of using the key-malleability in the previous proof.

Proof of Theorem 3.6.2. The proof is based on the sequence of games in Figure 3.7. Much of the proof is similar to the proof of Theorem 3.4.2 (which itself is based on the proof of the general framework of Bellare and Cash from [START_REF] Bellare | Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks[END_REF]). The current proof, however, is somewhat simpler and has fewer games since it relies on a stronger security property, namely the (S, Φ)-unique-input-related-key pseudorandom function security of M . Let Succ i denote the event that game G i output takes the value 1. Let A be an adversary against the Φ-related-key security of F , and let us assume (without loss of generality) that it never repeats a query.

G 0 matches the description of the RKPRFReal F game, so: Game G 2 adds the boxed code which changes how the repetition of an #" ω value is handled, by picking instead a random value from R m \ E that will not repeat any previous one. Games G 1 and G 2 are identical until flag 1 is set to true, hence we have

Pr [ Succ 0 ] = Pr RKPRFReal A F ⇒ 1 . proc Initialize / / G 0 K $ ← K proc RKFn(φ, x) / / G 0 For i = 1, . . . , | #" ω | do ω i ← M (φ(K), ω i ) h ← H(x, #" ω ) y ← M (φ(K), h) Return y proc Finalize(b ) / / All Games Return b proc Initialize / / G 1 , G 2 K $ ← K ; D ← ∅ ; E ← ∅ proc RKFn(φ, x) / / G 1 , G 2 For i = 1, . . . , | #" ω | do ω i ← M (φ(K), ω i ) If #" ω ∈ E and φ / ∈ D then flag 1 ← true ; #" ω $ ← R m \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) y ← M (φ(K), h) Return y proc Initialize / / G 3 , G 4 K $ ← K ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn(φ, x) / / G 3 , G 4 For i = 1, . . . , | #" ω | do ω i ← M (φ(K), ω i ) If #" ω ∈ E and φ / ∈ D then #" ω $ ← R m \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) If h ∈ G then flag 2 ← true h $ ← S \ G G ← G ∪ {r} y ← M (φ(K), h) Return y proc Initialize / / G 5 K $ ← K ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn(φ, x) / / G 5 For i = 1, . . . , | #" ω | do ω i ← M (φ(K), ω i ) If #" ω ∈ E and φ / ∈ D then #" ω $ ← R m \ E Else D ← D ∪ {φ} E ← E ∪ { #" ω } h ← H(x, #" ω ) If h ∈ G then h $ ← S \ G G ← G ∪ {r} y $ ← R Return y proc Initialize / / G 6 K $ ← K ; D ← ∅ ; E ← ∅ G $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 6 y $ ← R Return y proc Initialize / / G 7 , G 8 K $ ← K ; D ← ∅ ; E ← ∅ G $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 7 , G 8 y ← G(φ(K), x) If φ(K) ∈ E and φ / ∈ D then flag 3 ← true ; y $ ← R D ← D ∪ {φ} ; E ← E ∪ {φ(K)} Return y proc Initialize / / G 9 K $ ← K ; G $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 9 y ← G(φ(K), x) Return y
Pr [ Succ 1 ] ≤ Pr [ Succ 2 ] + Pr [ E 1 ] ,
where E 1 denotes the event that the execution of A with game G 1 sets flag 1 to true. We design an adversary D attacking the Φ-key-collision security of M such that

Pr [ E 1 ] ≤ Adv kc Φ,M (D) .
Adversary D runs A . When the latter makes an RKFn-query (φ, x), adversary D queries (φ, ω i ), for i = 1, . . . , | #" ω |, to its oracle, then computes #" ω and then h = H(x, #" ω ) and finally queries (φ, h) to its oracle and sends it to A . When A stops, D searches for two different RKD functions φ queried by A that lead to the same value #" ω and returns these two functions if found. Since #" ω is a strong key fingerprint, two such functions lead to the same key, so D wins if it finds such two functions. (Of course, if the class of RKD functions is claw-free, the advantage of the attacker is 0.) Game G 3 introduces the storage of hash values in a set G and sets flag 2 to true if the same hash output arises twice. Since this storage does not affect the values returned by RKFn, we have

Pr [ Succ 3 ] = Pr [ Succ 2 ] .
Game G 4 adds the boxed code which changes how repetition of hash values is handled, by picking instead a random value h from S \ G that will not repeat any previously used hash value. Games G 3 and G 4 are identical until flag 2 is set to true, hence we have

Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Pr [ E 2 ] ,
where E 2 denotes the event that the execution of A with game G 3 sets flag 2 to true. We design an adversary C attacking the cr-security of H such that

Pr [ E 2 ] ≤ Adv cr H (C ) .
Adversary C starts by picking K $ ← K and initializes j ← 0. It runs A . When the latter makes an RKFn-query (φ, x), adversary C responds via

For i = 0, . . . , | #" ω | do: ω i ← M (φ(K), ω i ) j ← j + 1 ; φ j ← φ ; x j ← x If #" ω ∈ E and φ / ∈ D then #" ω $ ← S \ E ( * ) Else D ← D ∪ {φ} E ← E ∪ { #" ω } w j ← #" ω h ← H(x, #" ω ) h j ← h y ← M (φ(K), h) Return y.
When A halts, C searches for a, b satisfying 1 ≤ a < b ≤ j such that h a = h b and, if it finds them, outputs (x a , w a ), (x b , w b ) and halts. The pairs (x a , w a ) and (x b , w b ) are distinct. Indeed, consider two cases: first, if φ a = φ b then since A never repeats an oracle query, ω |, it asks (φ, ω i ) to its oracle and sets ω i to this value. Since for all i = 1, . . . , | #" ω |, ω i / ∈ S by assumption, the value it gets is M (φ(K), ω i ), whatever its oracle is. Then, B checks if

x a = x b hence (x a , w a ) = (x b , w b ). Second, if φ a = φ b ,
#" ω ∈ E and φ / ∈ D. If they do, B picks #" ω $ ← R m \ E at random, otherwise B sets D ← D ∪ {φ}. B then sets E ← E ∪ { #" ω }. Next, B computes h ← H(x, #" ω ) and checks if h ∈ G. If it does, B picks h $ ← S \ G at random.
Notice that this step guarantees that all values h are in S and are all distinct as long as A makes at most |S| queries. Finally, B sets G ← G ∪ {h}, makes the query (φ, h) to its oracle, and returns the value it gets, which is either M (φ(K), h) or a uniformly random value, to A . When A halts, B halts with the same output. The definition of S ensures that it does not contain any ω i for i = 1, . . . , | #" ω |. It follows from these observations that B is a unique-input adversary for queries in S. Finally, it is clear that if B's oracle gives real outputs of M for queries in S, then it simulates exactly game G 4 and if B's oracle gives uniformly random values for queries in S, then it simulates exactly game G 5 .

In game G 6 , we simply set the value y to a uniformly random value. Clearly, G 5 and G 6 are identical since the value returned is a uniformly random value for any query. Then, we have Pr [

Succ 5 ] = Pr [ Succ 6 ] .
In game G 7 , we check if two different queries can lead to a key collision. Since the "If" test ensures that the returned value is still uniformly random over R even when two different queries result in the same key, games G 6 and G 7 are identical. Hence,

Pr [ Succ 6 ] = Pr [ Succ 7 ] .
In game G 8 , we compute the output of RKFn using a random function G in Fun(K, D, R).

Since games G 7 and G 8 are identical until flag 3 is set to true, we have

Pr [ Succ 7 ] ≤ Pr [ Succ 8 ] + Pr [ E 3 ] ,
where E 3 denotes the event that the execution of A with game G 8 sets flag 3 to true. To bound the probability of event E 3 , we design an adversary E attacking Φ-statistical-key-collision security for Fun(K, D, R) such that

Pr [ E 3 ] ≤ Adv skc Φ (E ) .
Adversary E runs A . When the latter makes an RKFn-query (φ, x), so does E and E returns the value it receives to A . When A stops, if A has queried two different functions φ 1 and φ 2 such that φ 1 (K) = φ 2 (K) then b was set to 1 when the second of these two functions was queried by E , and then E wins. (Of course, if the class of RKD functions is claw-free, this probability is 0.) Since A does not repeat oracle queries and since key collisions are dealt with in a similar way, it follows that games G 8 and G 9 are identical. Thus,

Pr [ Succ 8 ] = Pr [ Succ 9 ] .
Finally, G 10 matches the description of the RKPRFRand F game, so:

Pr [ Succ 10 ] = Pr RKPRFRand A F ⇒ 1 . Theorem 3.6.2 now follows by combining the bounds arising in the different game hops.

From Malleability to Unique-Input-Related-Key Security

In this section, we explore the relationship between key-malleability and unique-inputrelated-key security. Specifically, we show that a Φ-key malleable pseudorandom function is also an (S, Φ)-unique-input-related-key secure pseudorandom function under the standard pseudorandom function security as soon as the key-transformer KT associated with M satisfies a new notion of uniformity that we call S-uniformity and which is defined below.

S-Uniform Key-Transformer. Let M be a pseudorandom function whose key space, domain, and range are respectively denoted K, D, and R, and let Φ be a class of RKD functions such that there exists a key-transformer KT for (M, Φ). We generalize the uniformity property of a key-transformer by allowing the uniformity condition to be restricted to a subset S of D. Indeed, let S be a subset of D; then we say that KT is an S-uniform key-transformer if the games S-KTReal KT and S-KTRand KT defined in Figure 3.8 are perfectly indistinguishable for any Φ-restricted adversary A , where A belongs to the class of adversaries such that all queries (φ, x) with x ∈ S made by A to its oracle are for distinct values of x. That is,

Pr S-KTReal A KT ⇒ 1 = Pr S-KTRand A KT ⇒ 1 .
Please note that the standard uniformity condition given on page 33 corresponds to the KT being a D-uniform key-transformer. Whether S-uniformity is implied by (regular) uniformity is an open question. Proof of Theorem 3.6.3. The proof is based on the sequence of games in Figure 3.9. Let Succ i denote the event that game G i output takes the value 1. Let A be an adversary against the (S, Φ)-unique-input-related-key security of M , and let us assume (without loss of generality) that it never repeats a query.

S-KTReal

KT S-KTRand KT proc Initialize f $ ← Fun(D, R) proc KTFn(φ, x) Return KT f (φ(K), x) proc Finalize(b) Return b proc Initialize f $ ← Fun(D, R) proc KTFn(φ, x) If x ∈ S then y $ ← R Else y ← KT f (φ(K),
K $ ← K proc RKFn(φ, x) / / G 0 y ← M (φ(K), x) Return y proc Finalize(b) / / All Games Return b proc Initialize / / G 1 K $ ← K proc RKFn(φ, x) / / G 1 y ← KT M (φ, x) Return y proc Initialize / / G 2 K $ ← K f $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 2 y ← KT f (φ, x) Return y proc Initialize / / G 3 K $ ← K f $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 3 If x ∈ S then y $ ← R Else y ← KT f (φ, x) Return y proc Initialize / / G 4 K $ ← K proc RKFn(φ, x) / / G 4 If x ∈ S then y $ ← R Else y ← KT M (φ, x) Return y proc Initialize / / G 5 K $ ← K proc RKFn(φ, x) / / G 5 If x ∈ S then y $ ← R Else y ← M (φ(K), x)
Return y Figure 3.9: Games for the proof of Theorem 3.6.3 G 0 matches the description of the UIRKPRFReal M,S game, so:

Pr [ Succ 0 ] = Pr UIRKPRFReal A M,S ⇒ 1 .
In game G 1 , we use the key-transformer KT to compute M (φ(K), •) via oracle calls to

M (K, •).
The correctness property of the key-transformer implies

Pr [ Succ 0 ] = Pr [ Succ 1 ] .
In game G 2 , we replace the oracle M (K, •) given to the key-transformer KT by a random function f . We design an adversary B attacking the standard pseudorandom function security of M such that Pr

[ Succ 1 ] ≤ Pr [ Succ 2 ] + Adv prf M (B) .
Adversary B runs A . When the latter makes an RKFn-query (φ, x), adversary B responds via

y ← KT Fn (φ, x) Return y
where Fn is B's own oracle. When A halts, B halts with the same output. Then

Pr PRFReal B M ⇒ 1 = Pr [ Succ 1 ] and Pr PRFRand B M ⇒ 1 = Pr [ Succ 2 ] .
Games G 2 and G 3 differ only in the way that queries (φ, x) with x ∈ S are handled. Indeed, for such queries, in G 3 , the output is just taken uniformly at random instead of computed using the key-transformer. Since the adversary A belongs to the class of Φ-restricted adversaries such that all queries (φ, x) with x ∈ S made by A to its oracle are for distinct values of x, games G 2 and G 3 match exactly games S-KTReal KT and S-KTRand KT , respectively. Since we assume that KT is an S-uniform key-transformer KT, these two games are perfectly indistinguishable. So

Pr [ Succ 2 ] = Pr [ Succ 3 ] .
In game G 4 , we replace the random function f given to the key-transformer KT by the oracle Finally, G 5 matches the description of the UIRKPRFRand M,S game, so:

M (K, •).
Pr [ Succ 5 ] = Pr UIRKPRFRand A M,S ⇒ 1 .
Theorem 3.6.3 now follows by combining the bounds arising in the different game hops.

Application: Related-Key Security for Affine Relations.

We can apply Theorem 3.6.2 and Theorem 3.6.3 to NR * to prove that the construction given in Section 3.5 is a Φ aff -related-key secure pseudorandom function. Note that this gives an alternative and simpler proof of Theorem 3.5.5. As the result has already been proven in a previous section, we do not detail every step of this proof. Let S = {0, 1} n \ ({ω 1 , . . . , ω n } ∪ {0 n }). The only point that remains to prove is that there exists an S-uniform key-transformer KT Φ aff for (NR * , Φ aff ). This result is actually implied by Lemma 3.5.3. Indeed, the same key-transformer is an S-uniform key-transformer for (NR * , Φ aff ). This statement is implied by the fact that games G 0 and G n-1 , defined in the proof of Lemma 3.5.3, are indistinguishable, even when the adversary is not a unique-input adversary with respect to the set S (where S denotes the complement of S).

To see why, note that the argument used to prove that Games G j and G j+1 are indistinguishable in that proof remains valid because all points in S have a strictly smaller Hamming weight than those in S. Hence, there exists an S-uniform key-transformer KT Φ aff for (NR * , Φ aff ), and the (S, Φ aff )-unique-input-related-key pseudorandom function security of NR * follows. Finally, by applying Theorem 3.6.2, we can prove a similar statement to the one in Theorem 3.5.5. Remark 3.7.1. While this result is immediate from the results of Section 3.5, it is worth noting that it is not clear, in general, that the usual uniformity condition of a key-transformer directly implies that the same key-transformer is S-uniform for S ⊂ D without making additional assumptions about the key-transformer.

Chapter 4

Chapter 4 A New Family of Assumptions

In this chapter, we study particular forms Matrix-Decisional-Diffie-Hellman (MDDH) assumptions. MDDH assumptions were introduced in 2013 by Escala et al. [START_REF] Escala | An Algebraic Framework for Diffie-Hellman Assumptions[END_REF]. The authors defined an elegant algebraic framework for describing a wide variety of assumptions, that encompasses in particular most of classical assumptions, such as DDH, DLin, or k-Lin.

Here, we first give a simple introduction to the generic multilinear group model and briefly describe the framework and main results from [START_REF] Escala | An Algebraic Framework for Diffie-Hellman Assumptions[END_REF]. We later introduce our new family of assumptions, that fits partially in their framework, and that we use to prove our main result from Chapter 5. We then argue about the security of these assumptions, by first directly relating a subset of our assumptions to classical assumptions, and then by providing a proof that every of our new assumption holds in the generic multilinear group model.

The latter proof of security, provided in Section 4.4, is rather technical but is not necessary towards understanding the rest of this manuscript and thus can easily be omitted. However, these assumptions will be used throughout this manuscript and we encourage the reader to study carefully Sections 4.2 and 4.3.1. In particular, the relations between our new assumptions and classical assumptions, summarized in Table 4.1 on page 56, should be kept in mind as our statements are often written using directly the classical assumptions.

The Matrix-Decisional-Diffie-Hellman Assumptions

Escala et al. defined the MDDH assumptions as the hardness of decisional problems. Specifically, given G = g a cyclic group of order p, an MDDH assumption is parametrized by a distribution D over Z ×k p , and states that, for any matrix from Γ chosen at random from D, it is hard to distinguish, given [1] and [Γ], a group element [Γ • #" r ], with #" r ∈ Z p a uniformly random vector, from [ #" u ], with #" u ∈ Z p a uniformly random vector. This notion is formally defined as follows:

Adv D ,k -mddh G (D) := Pr D ,k -MDDHReal D G ⇒ 1 -Pr D ,k -MDDHRand D G ⇒ 1 ,
where the probabilities are over the choice of

Γ $ ← D ,k , W $ ← Z k×1 p , U $ ← Z ×1 p ,
D ,k -MDDHReal G D ,k -MDDHRand G proc Initialize Γ $ ← D ,k W $ ← Z k×1 p Return ([1] , [Γ] , [Γ • W ]) proc Finalize(b) Return b proc Initialize Γ $ ← D ,k U $ ← Z ×1 p Return ([1] , [Γ] , [U ]) proc Finalize(b) Return b
   a 1 0 0 a 2 1 1    with a 1 , a 2 $ ← Z p ,
we obtain exactly the DLin assumption, and extending this to matrices of size (k + 1) × k, the k-Lin assumption.

Moreover, the distribution over Z ×k p that results in the weakest MDDH assumption is simply the uniform distribution, denoted U ,k . In particular, we denote by U k the uniform distribution over Z k+1,k p , so U k = U k+1,k , and the U k -MDDH assumption is then a weaker assumption than k-Lin.

Another nice feature of the MDDH assumption lies in their random self-reducibility. Namely, let (D ,k , Q)-MDDH denote the Q-fold D ,k -MDDH assumption, which is similar to the

D ,k -MDDH assumption, except that W $ ← Z k×Q p , U $ ← Z ×Q p
, so the advantage of an adversary D against the (D ,k , Q)-MDDH problem in G is defined as:

Adv (D ,k ,Q)-mddh G (D) := Pr (D ,k , Q)-MDDHReal D G ⇒ 1 -Pr (D ,k , Q)-MDDHRand D G ⇒ 1
Chapter 4

4.2 A New Family of Matrix-Diffie-Hellman Assumptions 55

where the probabilities are over the choice of

Γ $ ← D ,k , W $ ← Z k×Q p , U $ ← Z ×Q p
, and the random coins used by the adversary, and where experiments (D ,k , Q)-MDDHReal G and (D ,k , Q)-MDDHRand G are described in Figure 4.2. Then, this assumption is actually implied by the latter D ,k -MDDH, as stated in the above lemma, for any distribution Finally, Escala et al. also proposed some conditions on the distribution D ,k to guarantee the hardness of the D ,k -MDDH problem in the generic multilinear group model. As our distribution of matrices does not satisfy these conditions in general, we do not explain these conditions. Please refer to [START_REF] Escala | An Algebraic Framework for Diffie-Hellman Assumptions[END_REF] for details. This is the reason we provide a proof of security of our assumptions in the generic multilinear group model, in the general case, though most of our assumptions are related to classical assumptions. Let us now define formally the distribution of matrices we are interested in.

D ,k . (D ,k , Q)-MDDHReal G (D ,k , Q)-MDDHRand G proc Initialize Γ $ ← D ,k W ← Z k×Q p Return ([1] , [Γ] , [Γ • W ]) proc Finalize(b) Return b proc Initialize Γ $ ← D ,k U $ ← Z ×Q p Return ([1] , [Γ] , [U ]) proc Finalize(b) Return b

A New Family of Matrix-Diffie-Hellman Assumptions

We now introduce a new family of MDDH assumptions, termed the E k,d -MDDH assumptions. Our main result, a generic and algebraic framework for pseudorandom functions and associated primitives, proves that any function that achieves certain simple algebraic properties is a secure pseudorandom function under the E k,d -MDDH assumption. Our family of MDDH assumptions is simply an MDDH for a particular distribution of matrices over Z p , denoted

E k,d , defined below. Definition 4.2.1 (E k,d -MDDH Assumption). Let k, d ≥ 1.
We define the matrix distribution E k,d as the set of all matrices Γ of the form:

Γ =       A 0 • B A 1 • B . . . A d • B       ∈ Z k(d+1)×k p with A, B $ ← Z k×k p .
We then define the E k,d -MDDH assumption as the hardness of the MDDH problem parametrized by the distribution E k,d .

Connexion with Standard Assumptions

Summary of Relations

Our family of assumptions encompasses a wide-variety of assumptions. In particular, for

d = 1, it is immediate that the E k,d -MDDH
k = 1 k = 2 k ≥ 3 d = 1 = Adv ddh G 2 • Adv U 2 -mddh G k • Adv U k -mddh G d ≥ 2 d • Adv d-ddhi
G generic bilinear group generic k-linear group

Relation with the DDHI Assumption

In this section, we show that the E The following lemma follows immediately from a standard hybrid argument.

Adv E 1,(d, ) -mddh G (D) := Pr E 1,(d, ) -MDDHReal D G ⇒ 1 -Pr E 1,(d, ) -MDDHRand A G ⇒ 1 ,
E 1,(d, ) -MDDHReal G E 1,(d, ) -MDDHRand G proc Initialize a, b, w $ ← Z p Γ ← (b, ab, a 2 b, . . . , a d b) Z ← (bw, abw, a 2 bw, . . . , a -1 bw, a bw) Return ([1] , [Γ] , [Z]) proc Finalize(b) Return b proc Initialize a, b, w, c $ ← Z p Γ ← (b, ab, a 2 b, . . . , a d b) Z ← (bw, abw, a 2 bw, . . . , a -1 bw, c) Return ([1] , [Γ] , [Z]) proc Finalize(b) Return b
A such that Pr [ H ⇒ 1 ] -Pr [ H -1 ⇒ 1 ] ≤ Adv E 1,(d, ) -mddh G (A l ), for = 1, . . . , d.
Adversary A simply samples d -random group elements to complete its matrix and the simulation is perfect.

Finally, it is clear that Adv (d,d) -MDDH by simply taking the last + 1 rows of the second matrix (which is a perfect tuple fixing w = a d-w). Lemma 4.3.1 easily follows.

E 1,(d, ) -mddh G (A l ) ≤ Adv E 1,(d,d) -mddh G (A d ) for = 1, . . . , d, since one can obtain the E 1,(d, ) -MDDH matrices from a E 1,
We now conclude with the following lemma. , for j = 0, . . . , d and either x is random, either x = 1 a and then

Chapter 4 A New Family of Assumptions

x = h ( 1 a ) d+1
. Hence, this is exactly a tuple of the wanted form X. The claim now easily follows.

Security in the Generic Multilinear Group Model

In this section, and to conclude this chapter, we provide a proof that our assumptions hold in the generic k-linear group model, for any k ≥ 1 and any d ≥ 1. A formalization of this model (defined as the generic multilinear map model) is detailed in Section 2.4, but only a simple intuition, given below, is necessary for understanding the following.

Intuition

a 1 • • • a k+1 .
Hence, to prove that an assumption is secure in the k-linear group model, it is sufficient to prove that there is no polynomial relation of degree at most k between the discrete logarithms of the group elements in the (real or random) distribution of the assumption.

We start by defining supplementary material on commutative algebra in Section 4.4.1, then state and prove our main lemma in Section 4.4.2, and conclude about the security of our assumptions in Section 4.4.3.

Definitions: Monomial Order and Leading Commutative Monomials

Definition 4.4.1 (Monomial order). Let n be a positive integer. A monomial order for Z p [T 1 , . . . , T n ] is a total order < such that, for any monomials u, v, w:

• if u < v, then uw < vw, • 1 ≤ u. We write #" T #" i = T i 1 1 • • • T in n for #" i = (i 1 , . . . , i n ). The leading monomial of a polynomial P ( #" T ) = #" i α #" i #" T #" i is the maximum of the set { #" T #" i | α #" i = 0}
for the monomial order <, and is denoted LM(P ). The leading term of this polynomial

P is α #" i #" T #" i , when LM(P ) = #" T #"
i . We extend this definition to non-commutative polynomials as follows: let

π: Z p T 1 , . . . , T n → Z p [T 1 , . . . , T n ] ,
be the (canonical) linear map from the set of non-commutative polynomials Z p T 1 , . . . , T n to the set of (commutative) polynomials Z p [T 1 , . . . , T n ], defined by π(T

j 1 • • • T j k ) = T j 1 • • • T j k .
The leading monomials set of a non-commutative polynomial

P ( #" T ) = k≥1 j 1 ,...,j k ∈{1,...,n} α j 1 ,...,j k T j 1 • • • T j k , Chapter 4
4.4 Security in the Generic Multilinear Group Model 59

is the set of monomials

T j 1 • • • T j k such that π(T j 1 • • • T j k ) is the maximum of {π(T j 1 • • • T j k ) | α j 1 ,...,j k = 0} .
It is denoted CLM(P ). We say a polynomial has unique commutative leading monomial if CLM(P ) is a singleton {T j 1 • • • T j k }, in which case, we also often write CLM(P ) = T j 1 • • • T j k , to simplify notations.

We remark that if we identify (commutative) polynomials with non-commutative polynomials (by writing them as

P = #" i α #" i #" T #" i = #" i α #" i T i 1 1 • • • T in n )
, then polynomials have unique commutative leading monomial.

Example 4.4.2. For n = 2 and < the lexicographic order with T 1 > T 2 , we have:

LM(5T 2 1 T 2 + T 1 T 3 2 + T 2 ) = T 2 1 T 2 LM(T 3 1 + 3T 1 T 7 2 ) = T 3 1
for commutative polynomials, and

CLM(5T 2 1 T 2 + T 1 T 3 2 + T 2 ) = {T 2 1 T 2 } CLM(5T 2 1 T 2 + T 1 T 2 T 1 + T 2 T 2 1 + T 2 + T 1 ) = {T 2 1 T 2 , T 1 T 2 T 1 , T 2 T 2 1 }
for non-commutative polynomials.

Finally, the partial degree of a polynomial P in a set S ⊆ {T 1 , . . . , T n } of indeterminates is the degree of the polynomial P seen as a polynomial with indeterminates (T i ) i∈S and coefficients in

Z p [(T i ) i / ∈S ].

Main Lemma

Before stating our main lemma, we need to introduce two technical lemmata.

Lemma 4.4.3. Let k 1 , n 1 , n 2 , q 1 be positive integers. Let Q 1,1 , . . . , Q 1,q 1 ∈ Z p [X 1,1 , . . . , X 1,n 1 ]
be q 1 polynomials. We suppose that, if there exists a polynomial R ∈ Z p [U 1,1 , . . . , U 1,q 1 ] of total degree at most k 1 such that:

R(Q 1,1 , . . . , Q 1,q 1 ) = 0 then R = 0. Then, the same is true when R is in Z p [X 2,1 , . . . , X 2,n 2 ][U 1,1 , . . . , U 1,q 1 ] instead of being in Z p [U 1,1 , . . . , U 1,q 1 ], i.e., when coefficients of R are polynomials in Z p [X 2,1 , . . . , X 2,n 2 ] instead of being scalars. Proof of Lemma 4.4.3. Let us suppose that R is a polynomial in Z p [X 2,1 , . . . , X 2,n 2 ][U 1,1 , . . . , U 1,q 1 ] of partial degree at most k 1 in {U 1,1 , . . . , U 1,q 1 }, such that R(Q 1,1 , . . . , Q 1,q 1 ) = 0 . We want to show that R = 0. Seeing R as a polynomial in Z p [U 1,1 , . . . , U 1,q 1 ][X 2,1 , . . . , X 2,n 2 ],
we can write:

R = i 1 ,...,in 2 λ i 1 ,...,in 2 • R i 1 ,...,in 2 (U 1,1 , . . . , U 1,q 1 ) • X i 2,1 2,1 • • • X i 2,n 2 2,n 2 , ( 4.1)
where

λ i 1 ,...,in 2 ∈ Z p and R 1,i 1 ,...,in 2 ∈ Z p [U 1,1 , . . . , U 1,q 1 ]. We can then evaluate R on (Q 1,1 , . . . , Q 1,q 1 ) and define R ∈ Z p [X 1,1 , . . . , X 1,n 1 ][X 2,1 , . . . , X 2,n 2 ] as: R = R(Q 1,1 , . . . , Q 1,q 1 ) = i 1 ,...,in 2 λ i 1 ,...,in 2 • R i 1 ,...,in 2 (Q 1,1 , . . . , Q 1,q 1 ) • X i 2,1 2,1 • • • X i 2,n 2 2,n 2 .
We also know that

R = 0. Since R i 1 ,...,in 2 (Q 1,1 , . . . , Q 1,q 1 ) ∈ Z p [X 1,1 , . . . , X 1,n 1 ], the polyno- mials λ i 1 ,...,in 2 • R i 1 ,...,in 2 (Q 1,1 , . . . , Q 1,q 1
) can be seen as the coefficients of R (seen as a polynomial over Z p [X 2,1 , . . . , X 2,n 2 ]), we have:

R i 1 ,...,in 2 (Q 1,1 , . . . , Q 1,q 1 ) = 0 .
As R i 1 ,...,in 2 has degree at most k 1 , from the assumption of the lemma, we have R i 1 ,...,in 2 = 0. It implies that R = 0 (from Equation (4.1)), which concludes the proof of Lemma 4.4.3.

Lemma 4.4.4. Let k 1 , k 2 , n 1 , n 2 , q 1 , q 2 be positive integers. Let Q 1,1 , . . . , Q 1,q 1 ∈ Z p [X 1,1 , . . . , X 1,n 1 ] and Q 2,1 , . . . , Q 2,q 2 ∈ Z p [X 2,1 , . . . , X 2,n 2 ] be q 1 + q 2 polynomials. We suppose that, if there exist polynomials R 1 ∈ Z p [U 1,1 , . . . , U 1,q 1 ] of total degree at most k 1 and R 2 ∈ Z p [U 2,1 , . . . , U 2,q 2 ]
of total degree at most k 2 such that:

R 1 (Q 1,1 , . . . , Q 1,q 1 ) = 0 R 2 (Q 2,1 , . . . , Q 2,q 2 ) = 0 (4.2) then R 1 = 0 and R 2 = 0. This condition is called Condition . Let us suppose there exists a polynomial R ∈ Z p [U 1,1 , . . . , U 1,q 1 , U 2,1 , . . . , U 2,q 2 ] such that any monomial of R is of the form U i 1,1 1,1 • • • U i 1,q 1 1,q 1 • U i 2,1 2,1 • • • U i 2,q 2 2,q 2 with i 1,1 + • • • + i 1,q 1 ≤ k 1 i 2,1 + • • • + i 2,q 2 ≤ k 2 , ,
and such that

R(Q 1,1 , . . . , Q 1,q 1 , Q 2,1 , . . . , Q 2,q 2 ) = 0 .
Then, R = 0.

Proof of Lemma 4.4.4. Let us write R as follows:

R = i 1 +•••+iq 1 ≤k 1 λ i 1 ,...,iq 1 • R 2,i 1 ,...,iq 1 (U 2,1 , . . . , U 2,q 2 ) • U i 1 1,1 • • • U iq 1 1,q 1 (4.3)
where

λ i 1 ,...,iq 1 ∈ Z p and R 2,i 1 ,...,iq 1 ∈ Z p [U 2,1 , . . . , U 2,q 2 ] of degree at most k 2 . Let R be the polynomial in Z p [X 2,1 , . . . , X 2,n 2 ][U 1,1 , . . . , U 1,q 1 ]
, defined as:

R = R(U 1,1 , . . . , U 1,q 1 , Q 2,1 , . . . , Q 2,q 2 ) = i 1 +•••+iq 1 ≤k 1 λ i 1 ,...,iq 1 • R 2,i 1 ,...,iq 1 (Q 2,1 , . . . , Q 2,q 2 ) • U i 1 1,1 • • • U iq 1 1,q 1 .
As a polynomial over

Z p [X 2,1 , . . . , X 2,n 2 ] in U 1,1 , . . . , U 1,q 1 ,
R has degree at most k 1 and we have that R (Q 1,1 , . . . , Q 1,q 1 ) = 0. Therefore, R = 0 thanks to Lemma 4.4.3 and the assumption that there is no non-zero polynomial R 1 of degree at most k 1 such that

R 1 (Q 1,1 , . . . , Q 1,q 1 ) = 0. This means that R 2,i 1 ,...,iq 1 (Q 2,1 , . . . , Q 2,q 2 ) = 0 (which is a poly- nomial in Z p [X 2,1 , . . . , X 2,n 2 ]
), for all i 1 , . . . , i q 1 . Since R 2,i 1 ,...,iq 1 has degree at most k 2 , R 2,i 1 ,...,iq 1 = 0. From Equation (4.3), we get that R = 0.

We can now prove our main lemma, that we later use to prove the security of the E k,d -MDDH assumptions in the generic k-linear group model. Lemma 4.4.5 (Main Lemma). Let k, n, m, q be positive integers. We suppose fixed a monomial order < for Z p [T 1 , . . . , T n ]. Let (P s ) s=1,...,q be a family of polynomials with distinct and unique commutative leading monomial. Let

R = Z p [(X ,i,j ) =1,...,n i=1,...,k j=1,...,k , (Y i,j ) i=1,...,k j=1,...,m
] .

Let us define

#" A ∈ R k×k n a vector of k × k matrices of (commutative) polynomials with indeterminates X ,i,j , such that a ,i,j = X ,i,j . Let us also define B ∈ R k×m , such that b i,j = Y i,j . In other words:

A =    X ,1,1 . . . X ,1,k . . . . . . X ,k,1 . . . X ,k,k    B =    Y 1,1 . . . Y 1,m . . . . . . Y k,1 . . . Y k,m    .
Let Q s,i,j ∈ R be the polynomial corresponding to the coordinate (i, j) ∈ {1, . . . , k}×{1, . . . , m} of the matrix P s ( #" A) • B (for any s = 1, . . . , q). Finally, let us suppose there exists a polynomial

R ∈ Z p [(U s,i,j ) s=1,...,q i=1,...,k j=1,...,m ] of total degree at most k, such that R((Q s,i,j ) s,i,j ) = 0. (4.4)
Then, necessarily, R = 0 (R is the zero polynomial).

Proof of Lemma 4.4.5. Let us assume, without loss of generality that:

CLM(P 1 ) < . . . < CLM(P q ) .

We do the proof by induction over k.

Base case (k = 1). When k = 1, Q s,1,1 = P s ((X ,1,1 ) ) and Equation (4.4) shows there is a linear combination between the P s 's, which is impossible as their leading monomials are distinct (here everything is commutative, as matrices have size 1 × 1).

Inductive step. We suppose the lemma holds for some value all values lower than k, and prove it for k.

First, let us show that R contains no monomial of the form:

U s 1 ,i 1 ,j 1 • • • U s k 1 ,i k 1 ,j k 1 • U s k 1 +1 ,i k 1 +1 ,j k 1 +1 • • • U s k 1 +k 2 ,i k 1 +k 2 ,j k 1 +k 2 ,
with k 1 and k 2 two positive integers such that

k 1 + k 2 ≤ k and i 1 , . . . , i k 1 ∈ {1, . . . , k 1 } i k 1 +1 , . . . , i k 1 +k 2 ∈ {k 1 + 1, . . . , k}.
More precisely, let k 1 , k 2 be two positive integers such that k 1 + k 2 ≤ k. Let us write R as a sum R = R + R, with R containing the monomials of the above form, and R the other monomials. We want to show that R = 0. Now, in Equation (4.4), we set X ,i,j to 0 for all = 1, . . . , n and:

(i, j) / ∈ ({1, . . . , k 1 } × {1, . . . , k 1 }) ∪ ({k 1 + 1, . . . , k} × {k 1 + 1, . . . , k}) .
Concretely, this means that:

A = A 0 0 A , with A =    X ,1,1 . . . X ,1,k 1 . . . . . . X ,k 1 ,1 . . . X ,k 1 ,k 1    A =    X ,k 1 +1,k 1 +1 . . . X ,k 1 +1,k . . . . . . X ,k,k 1 +1 . . . X ,k,k    .
Let us also write

B = B B , with B =    Y 1,1 . . . Y 1,m . . . . . . Y k 1 ,1 . . . Y k 1 ,m    B =    Y k 1 +1,1 . . . Y k 1 +1,m . . . . . . Y k,1 . . . Y k,m    .
Therefore, we have:

Q s,i,j = coefficient (i, j) of the matrix P s (A ) • B if 1 ≤ i ≤ k 1 coefficient (i -k 1 , j) of the matrix P s (A ) • B if k 1 + 1 ≤ i ≤ k .
Thus, all monomials in R((Q s,i,j ) s,i,j ) have partial degree k 1 in {Y i,j } i=1,.. (coming from the

polynomials Q s k 1 +1 ,i k 1 +1 ,j k 1 +1 , . . . , Q s k 1 +k 2 ,i k 1 +k 2 ,j k 1 +k 2 )
, while no monomial in R((Q s,i,j ) s,i,j ) has such partial degrees. Since R((Q s,i,j ) s,i,j ) = 0, we have R((Q s,i,j ) s,i,j ) = 0. Now we can apply Lemma 4.4.4, where

(Q 1,i ) i corresponds to (Q s,i,j ) s=1,...,q i=1,...,k 1 j=1,...,m (X 1,i ) i corresponds to (X i,j ) i=1,...,k 1 j=1,...,k 1 ∪ (Y i,j ) i=1,...,k 1 j=1,...,m (Q 2,i ) i corresponds to (Q s,i,j ) s=1,...,q i=k 1 +1,...,k j=1,...,m (X 2,i ) i corresponds to (X i,j ) i=k 1 +1,...,k j=k 1 +1,...,k ∪ (Y i,j ) i=k 1 +1,...,k j=1,...,m R corresponds to R.
Condition is satisfied thanks to the induction hypothesis for k 1 < k and k 2 < k.

Second, let 1 ≤ j 1 , . . . , j k ≤ k be positive integers in {1, . . . , k}. These integers are fixed in all this second step. Let us show that R contains no monomial of the form

U s 1 ,1,j 1 • • • U s k ,1,j k .
Let us write R as a sum R = R + R, with R containing the monomials of the above form, and R the other monomials. We remark that all monomials in R((Q s,i,j ) s,i,j ) are multiple of Y i 1 ,j 1 • • • Y i k ,j k (for some i 1 , . . . , i k ), while monomials in R((Q s,i,j ) s,i,j ) are not. Since R((Q s,i,j ) s,i,j ) = 0, R((Q s,i,j ) s,i,j ) = 0. We now just need to prove that R = 0.

We order monomials of R using the product order on {Y i,j } i,j × {X ,i,j } ,i,j , with the lexicographic order on {Y i,j } corresponding to the lexicographic order on (i, j), and with the order on {X ,i,j } corresponding to the lexicographic order on (i, j, ):

Y i,j < Y i ,j ⇐⇒ i < i or i = i and j < j X ,i,j < X ,i ,j ⇐⇒ i < i
or i = i and j < j or (i, j) = (i , j ) and < Now, we set X ,i,j to 0 for all = 1, . . . , n and i = j and i = 1. We also set X ,1,i = X ,i,i . For the sake of simplicity, in this step, we write X ,1,i = X ,i,i = X ,i , and #" X i = (X 1,i , . . . , X n,i ). Concretely, this means that:

A =          X ,1 X ,2 X ,3 . . . X ,k 0 X ,2 0 . . . 0 0 0 X ,3 . . . . . . . . . . . . . . . 0 0 . . . . . . 0 X ,k         
.

Then, we get (easily by induction):

P s ( #" A) =          P s ( #" X
( #" X k )         
, where LT(P s ( #" X i )) + . . . corresponds to a polynomial with leading term LT(P s ( #" X i )). Thus, we have:

Q s,1,j = P s ( #" X 1 ) • Y 1,j + (LT(P s ( #" X 2 )) + . . . ) • Y 2,j + • • • + (LT(P s ( #" X k )) + . . . )Y k,j (4.5)
Let us now suppose by contradiction that R = 0. Let U s 1 ,1,j 1 • • • U s k ,1,j k be the monomial of R, for which the tuple (s σ(k) , . . . , s σ(1) ) is the highest for the lexicographic order, where σ is a permutation of {1, . . . , k} such that

s σ(k) ≥ • • • ≥ s σ(1) . When R is evaluated on (Q s,i,j ) s,i,j this monomial corresponds to Q s 1 ,1,j 1 • • • Q s k ,1,j k .
From Equation (4.5), we get that the latter expression contains the following monomial:

M = P s σ(1) ( #" X 1 ) • Y 1,j σ(1) • LM(P s σ(2) ( #" X 2 )) • Y 2,j σ(2) • • • LM(P s σ(k) ( #" X k )) • Y k,j σ(k) . • if k = k and i 1 = • • • = i k ,
then choose σ to be an arbitrary permutation such that σ(i 1 ) = 1. We know that the corresponding polynomial R then contains the monomial

M = U s 1 ,1,j 1 • • • U s k ,k,j k .
But that is impossible according to the second step, as R ((Q s,i,j ) s,i,j ) = 0.

• otherwise, let k 1 = |{p|i p = i 1 }| be the number of "i" indices equal to i 1 . We know that k 1 < k. Let k 2 = kk 1 and let (I 1 , I 2 ) be a partition of {1, . . . , k} such that

|I 1 | = k 1 , |I 2 | = k -k 1 ≥ k 2 , i 1 ∈ I 1
, and for all i p = i 1 , i p ∈ I 2 . Such a partition exist because there are only k 2 values i p = i 1 . Then, let σ be an arbitrary permutation such that σ(I 1 ) = {1, . . . , k 1 } and σ(I 2 ) = {k 1 + 1, . . . , k}. Finally, we remark that the corresponding polynomial R contains the monomial

U s 1 ,i 1 ,j 1 • • • U s k 1 ,i k 1 ,j k 1 • U s k 1 +1 ,i k 1 +1 ,j k 1 +1 • • • U s k 1 +k 2 ,i k 1 +k 2 ,j k 1 +k 2 ,
such that:

i 1 , . . . , i k 1 ∈ {1, . . . , k 1 } i k 1 +1 , . . . , i k 1 +k 2 ∈ {k 1 + 1, . . . , k},
where i p = σ(i p ). But the first step of our proof show it is impossible.

This concludes the proof.

Putting Everything Together

Similarly to the proof of Theorem 3 of [START_REF] Escala | An Algebraic Framework for Diffie-Hellman Assumptions[END_REF] and the proof for uber assumptions [START_REF] Boneh | Hierarchical Identity Based Encryption with Constant Size Ciphertext[END_REF][START_REF] Boyen | The Uber-Assumption Family (Invited Talk)[END_REF], to prove the security of the E k,d -MDDH assumption in generic symmetric k-linear groups (in which there would exist a symmetric k-linear map), we just need to show that there is no (non-trivial) polynomial relation of degree k between entries of Γ and Z, both when Z = Γ • W and when Z = U , with

Γ =       B A • B . . . A d • B      
.

Indeterminates are entries of A and B (a i,j , b i,j , for i = 1, . . . , k, j = 1, . . . , k), entries of W (w i , for i = 1, . . . , k), and entries of U (u i,j , for i = 1, . . . , k(d + 1), j = 1, . . . , k). The polynomial independence follows from Lemma 4.4.5, with n = 1, q = d + 1, and

P s = T s-1 1 , for s = 1, . . . , d + 1.

Chapter 5

Chapter 5

An Algebraic Framework for Pseudorandomness

In this chapter, we introduce one of the main results of this manuscript. We describe a simple, algebraic framework, that translates the pseudorandomness property of a function into a simple algebraic characterization.

We start by giving a brief intuition of our notion and by describing a few subtleties in the formal definition. Then, we formally define our new security notion, termed polynomial linear pseudorandomness security (PLP) and later state our main result, that relates this new notion to the E k,d -MDDH assumption.

The full proof of the latter statement is given in Section 5.3 and is quite technical. However, our result is only applied in a black-box manner throughout the rest of this manuscript, thus understanding the proof is not necessary for reading the rest of this work.

Yet, we make extensive use of Theorem 5.2.2 to argue about the security of pseudorandom functions, related-key secure pseudorandom functions, aggregate pseudorandom functions, as well as multilinear pseudorandom functions in the next chapter and thus encourage the reader to inspect carefully Sections 5.1 and 5.2.

Contents

Intuition and Subtleties

We start by giving some intuition about our security notion and by arguing about some subtleties before providing the formal definition in Section 5.2.

Intuition

Let us consider a group G = g of order p. Intuitively, the polynomial linear pseudorandomness security notion says that for any polynomials P 1 , . . . , P q ∈ Z p [T 1 , . . . , T n ], the group elements In particular, when P 1 , . . . , P q are linearly independent, [U (P 1 )] , . . . , [U (P q )] are uniformly random and independent group elements in G. Therefore, under the polynomial linear pseudorandomness security, any efficient function that produces on input x ∈ D an output of the form [P x ( #" a ) • b], with {P x } x∈D being a family of linearly independent polynomials, is a pseudorandom function.

[P 1 ( #" a ) • b] , . . . , [P q ( #" a ) • b] , with #" a $ ← Z n p and b $ ← Z p ,
We remark that, in the generic group model, the polynomial linear pseudorandomness security notion holds trivially, by definition. The difficulty of the work is to prove it under classical assumptions such as the E 1,d -MDDH assumption.

Procedure for Testing Linear Dependence

When we want to formally define the polynomial linear pseudorandomness security notion, we quickly face a problem:

How to compute [U (P i )] for a random linear map U $ ← L(Z p [T 1 , . . . , T n ] ≤d , Z p )?
Such a map can be represented by a (random) vector with (d + 1) n entries. But doing so would make the game in the security notion exponential time. As already done earlier in this manuscript, the idea is to define or draw U lazily: each time we need to evaluate it on a polynomial P i linearly independent of all the previous polynomials P j (with j < i), we define U (P i ) $ ← Z p ; otherwise, we compute U (P i ) as a linear combination of U (P j ). More precisely, if

P i = i-1 j=1 λ j • P j , U (P i ) = i-1 j=1 λ j • U (P j ).
Then, for this simulation to be efficient, we need an efficient procedure for testing such linear dependencies. We denote by TestLin a procedure which takes as inputs a list L of polynomials (R 1 , . . . , R L ) (such that R 1 , . . . , R L are linearly independent as polynomials) and a polynomial R and which outputs:

⊥ if R is linearly independent of the set {R 1 , . . . , R L } #" λ = (λ 1 , . . . , λ L ) otherwise, so that R = λ 1 R 1 + . . . + λ L R L .
#" λ is uniquely defined since we assume that polynomials from the input list are linearly independent. However, we are facing a problem since no such procedure is known for multivariate polynomials, if we require the procedure to be deterministic and polynomialtime. Luckily, it is easy to construct such a randomized procedure which is correct with overwhelming probability, and such a statistical procedure is sufficient for our purpose. We describe such a procedure in Figure 5.1. Proof of Lemma 5.1.1. Let us prove that this approximate procedure is incorrect with probability at most 1 p (over its random coins). The polynomials P #" φ l ,x l ,j with l = 1, . . . , L are supposed to be linearly independent. Then, there are two cases:

TestLin(L, R) / / L[ ] = R for = 1, . . . , L and L = |L| R L+1 ← R N ← 2L + 4 For k = 1, . . . , N #" γ k $ ← Z n p M matrix over Z p of L + 1 rows and N columns For = 1, . . . , L + 1 For k = 1, . . . , N m ,k ← R ( #" γ k ) Apply Gaussian elimination on M If M is full-rank then Return ⊥ Else Let #" λ be the row vector such that #" λ • M = #" 0 #" λ ← (λ 1 /λ L+1 , . . . , λ L /λ L+1 ) Return #" λ
1. If P #"
φ ,x,j = P #" φ L+1 ,x L+1 ,j is linearly independent from P #" φ 1 ,x 1 ,j , . . . , P #" φ L ,x L ,j , then the probability that the procedure does not return ⊥ is (over the value of X):

Pr ∃ #" λ ∈ Z (L+1) p , #" λ • M = 0 ≤ #" λ ∈Z (L+1) p Pr #" λ • M = 0 ≤ #" λ ∈Z (L+1) p Pr ∀k = 1, . . . , N, ( L+1 l=1 λ l P #" φ l ,x l ,j )(γ k ) = 0
and L+1 l=1 λ l P #" φ l ,x l ,j is a non-zero polynomial of degree at most jd. Since γ k are chosen independently and uniformly at random in Z n p , according to the Schwartz-Zippel lemma, the error probability is at most:

#" λ ∈Z (L+1) p jd p N = p L+1 • jd p N ≤ p L+1 • 1 p L+2 = 1 p ,
since jd ≤ nd ≤ √ p and N = 2L + 4.

2. If P #" φ ,x,j = P #" φ l+1 ,x L+1 ,j is not linearly independent from P #" φ 1 ,x 1 ,j , . . . , P #" φ L ,x L ,j , then there exists #" λ ∈ Z L p such that P #" φ ,x,j = L l=1 λ l P #" φ l ,x l ,j , and such #" λ is unique. Let us prove that the probability that the TestLin procedure does not return #" λ is at most 1 p . Let Λ be the set of

#" λ ∈ Z L+1 p such that λ L+1 • #" λ = #" λ 1,...,L .
Then the error probability of the TestLin procedure is at most:

Pr ∃ #" λ ∈ Λ, #" λ • M = 0 ≤ #" λ ∈Λ Pr ∀k = 1, . . . , N, ( L+1 l=1 λ l P #" φ l ,x l ,j )(γ k ) = 0 .
Moreover, L+1 l=1 λ l P #" φ l ,x l ,j is a polynomial of degree at most jd, which is non-zero because otherwise the P #" φ 1 ,x 1 ,j , . . . , P #" φ L ,x L ,j would not be independent. We can conclude the proof as in the first case, since |Λ| ≤ |Z

(L+1) p |.
This concludes the proof of Lemma 5.1.1.

Extension to Weaker Assumptions

Before, arguing the last subtlety and showing the formal definition and theorem, let us briefly introduce an extension of our polynomial linear pseudorandomness security notion to handle weaker assumptions, namely E k,d -MDDH, with k ≥ 2. In that case, we need to evaluate polynomials on matrices: As multiplication of matrices is not commutative, it is clear we need to make some restrictions on the form of polynomials queried. This is actually already the case in the restricted case where k = 1, for different reasons. A precise analysis of our restrictions is thus given in the next subsection.

[P i (A) • B], with A $ ← Z k×k

On the Representation of Multivariate Polynomials

A last challenge is to define how the polynomials are represented. Indeed, an important but subtle point of our work is that we do not need polynomials to be given in expanded form in the polynomial linear pseudorandomness security notion. Otherwise, the theorem would be quite easy to prove but would not encompass many interesting cases. Specifically, it would restrict us to polynomials with a polynomial number of monomials and forbid polynomials such as n i=1 (a i + 1), for instance. However, some representations of polynomials will even not enable us to define properly the PLP game (Figure 5.2). It is indeed at the very least necessary to be able to evaluate the polynomial at arbitrary points (which may be scalars in Z p when k = 1, or matrices in Z k×k p when k ≥ 2). For example, it would be inconceivable to define a polynomial P by an RSA modulus N , as the polynomial P = (Xp 1 )(Xp 2 ), with p 1 and p 2 the two prime factors of N .

For this subsection only, let us write P the representation of the polynomial, while P is the mathematical polynomial object. The same polynomial may have many representations. We always suppose that P has a polynomial size in n and d. This assumption is reasonable and simplifies the bounds, but is not required (bounds in theorems would then need to be changed).

The Scalar Case

In the case k = 1, we could actually just require the following condition.

Condition 1. It is possible to get from P (in polynomial time):

full evaluation the value P (a 1 , . . . , a n ) ∈ Z p , given a 1 , . . . , a n ∈ Z p ; partial evaluation for any j = 0, . . . , n, a representation Q of the j-variate polynomial Q = P (T 1 , . . . , T j , a j+1 , . . . , a n ), given a j+1 , . . . , a n ∈ Z p . This representation Q has again to verify (recursively) Condition 1. In all cases in our work, actually, P is just an expression or an abstract syntax tree (AST) where internal nodes are either + or •, while leaves are either an indeterminate T i or a scalar in Z p . A partial evaluation can be performed by replacing T i by a i (when i > j) in the AST, while a full evaluation can be performed by evaluating the AST (after the previous replacement, with j = 0). Both operations are polynomial-time in the size of the AST.

The Matrix Case

When k > 1, everything is more contrived because of the absence of commutativity. Intuitively, we want that all the indeterminates always appear in the same order. Without loss of generality, T n appears before T n-1 , T n-1 before T n-2 , . . . This has to hold not only in the polynomial as a mathematical object, but somehow also "in the representation" if we want to be able to prove something. More precisely, we do not want that, at some point, when evaluating the polynomial, we have to compute A j A i with i > j, even if this expression does not appear in the resulting polynomial. For example, the representation T 2 T 3 -T 2 (T 3 +T 1 ) is not acceptable (because of the presence of T 2 T 3 ), while the representation T 2 T 1 (which corresponds to the same polynomial) is acceptable.

More formally, we assume the representation of the polynomials satisfies the following condition.

Condition 2. The representation of a polynomial is an expression or AST (where internal

nodes are either + or •, while leaves are either an indeterminate T i or a scalar in Z p ) with the following additional (natural) property (to deal with non-commutativity): if P1 • P2 is a sub-expression of P , and if T j is a leaf of P1 for some j, then for any i > j, T i is not a leaf of P2 .

We remark that, because of this condition, even if the polynomials we consider would normally be non-commutative, we can as well view them as commutative polynomials (when we evaluate a polynomial from a mathematical point of view, we perform multiplications of the indeterminates in the right order). We also remark that, when k = 1, Condition 2 is stronger than Condition 1.

Formal Security Notion and Main Result

Here, we define formally the polynomial linear pseudorandomness security and state our main result in Theorem 5.2.2. Once again, we consider a cyclic group G = g of order p. When m is not specified, it is implicitly equal to 1. Note that when k = m = 1, we get exactly the intuitive security notion defined in Section 5.1.1, as in that case Proof Overview. As we directly prove the general result, the notation makes to proof slightly hard to read. However, the main idea is rather simple. Basically, we define hybrid games in which we replace partial evaluations in A i+1 , . . . , A n of the polynomials queried by uniformly random values (still preserving the linear relations) to obtain a polynomial in i indeterminates T 1 , . . . , T i . Then, under the E k,d -MDDH assumption, we can replace elements

Formal Definition of the Polynomial Linear Pseudorandomness Security

#" A = #" a ∈ Z n p and B = b ∈ Z p . (n, d, k, m)-PLPReal G (n, d, k, m)-PLPRand G proc Initialize #" A $ ← (Z k×k p ) n B $ ← Z k×m p proc Pl(P ) Return P ( #" A) • B proc Finalize(b) Return b proc Initialize L 1 ← empty list L 2 ← empty list L ← 0 proc Pl(P ) #" λ ← TestLin(L 1 , P ) If #" λ = ⊥ then Y $ ← Z k×m p L ← L + 1 L 1 [L] ← P L 2 [L] ← Y Else Y ← L i=1 λ i • L 2 [i] Return [Y ] proc Finalize(b) Return b

The PLP Theorem

A k i • B • W to

Immediate Corollary: the LIP Theorem

Before proving the PLP theorem, we introduce the following simple corollary that we use extensively in the next chapter. We term this corollary the LIP theorem, where LIP stands for Linearly Independent Polynomial. This is just a simplification of the PLP theorem in the case where we further restrict the adversary to query only linearly independent polynomials. In particular, under these assumptions, one can simplify the PLP security notion by defining the following LIP security notion as follows.

Definition 5.2.3 (Linearly Independent Polynomial Security). The advantage of an adversary D against the (n, d, k, m)-LIP security of G security of G is defined as: Moreover, the running time of this reduction is polynomial (in n, d, and the running time of the adversary).

Adv (n,d,k,m)-lip G (D) := Pr (n, d, k, m)-LIPReal D G ⇒ 1 -Pr (n, d, k, m)-LIPRand D G ⇒ 1 ,

Proof of Theorem 5.2.2

In order to prove the PLP theorem, we will need to able to run some decomposition algorithms on the polynomials queried. The following subsection provides a few lemmata that detail the types of decomposition we require in our proof.

Decomposition Lemmata

Lemma 5.3.1. Let k ≥ 2 be an integer. There exists a polynomial-time algorithm which takes as input:

• an integer j ∈ {0, . . . , n},

• nj matrices A j+1 , . . . , A n in Z k×k p ,

• an expression P of a multivariate polynomial P ∈ Z p [T 1 , . . . , T n ] satisfying Condition 2, and which outputs a decomposition of P as N polynomials Q 1 , . . . , Q N ∈ Z p [T 1 , . . . , T j ] and N matrices C 1 , . . . , C N ∈ Z k×k p such that:

P (T 1 , . . . , T j , A j+1 , . . . , A n ) = N ν=1 C ν • Q ν (T 1 , . . . , T j ).

In addition, N is less than the number of internal nodes in the expression or AST P ; and the representations of the polynomials

Q 1 , . . . , Q N satisfy Condition 2.
Proof of Lemma 5.3.1. We do the proof by recursion:

• Base case (a leaf): an indeterminate T i or a scalar in Z p . Straightforward.

• Recursive case 1: additive node P1 + P2 . We decompose recursively P1 and P2 .

• Recursive case 2: multiplicative node P1 • P2 . This is the most important case. We consider two sub-cases:

-P1 only contain leaves with scalars or indeterminates T j+1 , . . . , T n . In that case, its decomposition is just a matrix in Z k×k p . The decomposition of P1 • P2 then contains as many terms as in the decomposition of P2 .

-Otherwise, P2 does not contain indeterminates T j+1 , . . . , T n (otherwise that would break Condition 2), and so the decomposition of P2 is just a polynomial (matrices are identity matrices). The decomposition of P1

P = Q 0 + Q 1 • T j + • • • + Q d • T d j .
In addition, the representations of Q 0 , . . . , Q d satisfy Condition 1.

Chapter 5

Proof of Theorem 5.2.2 75

Proof of Lemma 5.3.2. We can use the Lagrange interpolation

P = d i=0 P (T 1 , . . . , T j-1 , i) i =0,...,d i =i (T j -i ) i -i ,
and regroup terms correctly.

The Main Proof

Preliminaries. We recall that the representations of the polynomials we consider satisfy Condition 1 (when k = 1) or Condition 2 (when k ≥ 2). Please refer to Section 5.1.4 for the definition of these conditions. Let #" A ∈ (Z k×k p ) n . When k ≥ 2, for any polynomial P ∈ Z p [T 1 , . . . , T n ] whose degree in one indeterminate is at most d and for j = 1, . . . , n, using Lemma 5.3.1, we can decompose

Q P, #"
A,j = P (T 1 , . . . , T j , A j+1 , . . . , A n ) as follows (in polynomial time):

Q P, #" A,j = N P, #" A,j ν=1 C P, #" A,j,ν • Q P, #" A,j,ν (T 1 , . . . , T j ),
with N P, #" A,j a positive integer, C P, #" A,j,ν a matrix in Z k×k p , and Q P, #" A,j,ν a polynomial in Z p [T 1 , . . . , T j ] (given by a representation still satisfying Condition 2), for ν = 1, . . . , N P, #" A,j . We remark that this decomposition exists and can trivially be obtained when k = 1 (in this case N P, #" A,j = 1 and C P, #" A,j,1 = 1. When the index

#"

A is clear from context, it is omitted. We write N the maximum possible value of N P,j (when k = 1, N = 1).

Since Q P,j,ν is a polynomial in Z p [T 1 , . . . , T j ], with degree in any indeterminate bounded by d, according to Lemma 5.3.2, we can decompose it in polynomial time as:

Q P,j,ν = Q P,j,ν,0 + T j • Q P,j,ν,1 + • • • + T d j • Q P,j,ν,d ,
with Q P,k,ν,0 , . . . , Q P,k,ν,d polynomials in Z p [T 1 , . . . , T j ] (given by a representation satisfying Condition 1).

In particular, we have:

Q P,j = N P,j ν=1 d i=0 C P,j,ν • T i j • Q P,j,ν,i (5.1) Q P,j-1 = N P,j ν=1 d i=0 C P,j,ν • A j i • Q P,j,ν,i (5.2)
Finally, we write C P,j,z 1 ,...,z j ∈ Z k×k p the (matrix) coefficient of T

z j j • • • T z 1 1 in Q P,j
, and we write c P,j,ν,z 1 ,...,z j ∈ Z p the coefficient of the previous monomial in Q P,j,ν (or equivalently in Q P,j,ν,z j • T i j ). As we have:

Q P,j = z 1 ,...,z j C P,j,z 1 ,...,z j • T z j j • • • T z 1 1 Q P,j = N P,j ν=1 z 1 ,...,z j C P,j,ν • c P,j,ν,z 1 ,...,z j • T z j j • • • T z 1 1 Q P,j = N P,j+1 ν=1 z 1 ,...,z j d i=0 C P,j+1,ν • A i j+1 • c P,j+1,ν,z 1 ,...,z j ,i • T z j j • • • T z 1 1
we have:

C P,j,
Adv (n,d,k,m)-plp G (A ) ≤ n • Adv (E k,d ,M )-mddh G (B) + 2n(d + 1)qN p + n p + n p 2 .
(5.5)

The proof of the above equation is based on the sequence of games in Figure 5.4. The games are used in the following order: G 0,1 , G 1,1 , G 0,2 , . . . , G 1,n . We denote by Succ i the event that game G i output takes the value 1.

Let us start with the proof. For the sake of simplicity, let us first suppose the procedure TestLin is perfect. We will deal with its imperfection at the end of the proof. We first show that game G 0,1 instantiates exactly the game defining the (n, d, k, m)-PLP security of G. For any query P , we have Q P, #" A,1,ν ∈ Z p [T 1 ] (for any ν = 1, . . . , N P,1 ) and according to Equation (5.1):

Q P,1 = N P,1 ν=1 d i=0 C P,1,ν,i • T i 1 • Q P,1,ν,i , with Q P,1,ν,i ∈ Z p and C P,1,ν,i ∈ Z k×k p
. The first time we see a non-zero coefficient α =

Q P,1,ν,i ∈ Z p : L[1] ← α ∈ Z p , T[1, 0] $ ← Z k×k p
(let us write this element αA ), and

T[1, ] ← α • A j • A for = 1, . . . , d. Afterwards, TestLin(L, Q P,1,ν,i ) always outputs #" λ (ν,i) = Q P,1,ν,i /α, proc Initialize / / G 0,j ; j = 1, . . . , n #" A $ ← Z n p L ← empty list T ← empty 2-dimensional table L ← 0 (length of L) proc RKFn(P ) / / G 0,j ; j = 1, . . . , n Y ← 0 ∈ Z k×m p For ν = 1, . . . , N P,j For i = 0, . . . , d #" λ (ν,i) ← TestLin(L, Q P,j,ν,i ) If #" λ (ν,i) =⊥ then L ← L + 1 L[L] ← Q P,j,ν,i T[L, 0] $ ← Z k×m p For = 1, . . . , d T[L, ] $ ← A j • T[L, 0] #" λ (ν,i) ← (0, . . . , 0, 1) ∈ Z L+1 p Y ← Y + C P,j,ν • L l=1 λ (ν,i) l • T[l, i] Return [Y ] proc Initialize / / G 1,j ; j = 1, . . . , n #" A $ ← Z n p L ← empty list T ← empty 2-dimensional table L ← 0 (length of L) proc RKFn(P ) / / G 1,j ; j = 1, . . . , n Y ← 0 ∈ Z k×m p For ν = 1, . .

. , N P,j

For i = 0, . . . , d #"

λ (ν,i) ← TestLin(L, Q P,j,ν,i ) If #" λ (ν,i) =⊥ then L ← L + 1 L[L] ← Q P,j,ν,i T[L, 0] $ ← Z k×m p For = 1, . . . , d T[L, ] $ ← Z p #" λ (ν,i) ← (0, . . . , 0, 1) ∈ Z L+1 p Y ← Y + C P,j,ν • L l=1 λ (ν,i) l • T[l, i] Return [Y ]
Y = N P,1 ν=1 d i=0 C P,1,ν • 1 l=1 λ (ν,i) l • T[l, i] = N P,1 ν=1 d i=0 C P,1,ν • Q P,1,ν,i • α -1 • α • A i 1 • A = N P,1 ν=1 d i=0 C P,1,ν • Q P,1,ν,i • A i 1 • A = Q P,0 • A = P (A 1 , . . . , A n ) • A ,
where the last-but-one equality comes from Equation (5.2). Hence, this is exactly the game (n, d, k, m)-PLPReal G . Now, let us show Game G 0,j and Game G 1,j are indistinguishable under the (E k,d , M )-MDDH assumption. Afterwards, we will show that Game G 1,j and Game G 0,j+1 are perfectly indistinguishable.

Indistinguishability of Game G 0,j and Game G 1,j under the (E 1,d , d • q)-MDDH assumption. We recall that M = (d + 1)

• q • N • m. We design adversaries B j attacking the (E 1,d , M )-MDDH problem in G such that Pr [ Succ 0,j ] -Pr [ Succ 1,j ] ≤ Adv (E 1,d ,M )-mddh G (B j ) ; ∀j = 1, . . . , n.
The adversary B j takes as input a tuple (

[Γ] , [Z]) ∈ G k(d+1)×k × G (d+1)×M , where either Z = Γ • W , and W $ ← Z k×M p , or Z = U $ ← Z k(d+1)×M p
, with Γ defined as in Section 4.2, and has to distinguish these two cases. For that purpose, the adversary B j simulates everything as in Game G 0,j or G 1,j for A , except it sets T[l, i] to be the k × m matrix with z α+ki,β+lm as the entry of index (α, β) ∈ {1, . . . , k} × {1, . . . , m}. Assuming the matrix B ∈ Z k×k p (in the definition of Γ) is invertible (which happens with probability (1

-1/p) • • • (1 -1/p k ) ≥ 1 -1/p -1/p 2 ,
thanks to Euler's Pentagonal Number Theorem), in the first case, everything is simulated as in Game G 0,j , while in the second case, everything is simulated as in Game G 1,j . In the first case, everything is simulated as in Game G 0,j , while in the second case, everything is simulated as in Game G 1,j .

Perfect Indistinguishability of Game G 1,j and Game G 0,j+1 . We introduce an intermediate Game G 2,j , described in Figure 5.5. We will use it to prove that Game G 1,j is perfectly indistinguishable from Game G 0,j+1 by showing that both these games are perfectly indistinguishable from game G 2,j . This intermediate game is not polynomial-time, since U is a linear map from Z p [T 1 , . . . , T j ] ≤d to Z k×m p and so would be represented by a matrix with km(d + 1) j entries. But this does not affect our proof since we show that it is perfectly indistinguishable from Game G 1,j and Game G 0,j+1 which are both polynomial-time.

First, we prove that game G 1,j is perfectly indistinguishable from Game G 2,j . For that, we remark that T in G 1,j can be seen as computed as

T[l, i] = U (T i j • Q l ), for k = 0, . . . , d, with U $ ← L(Z p [T 1 , . . . , T j ] ≤d , Z k×m p ) and L[l] = Q l ∈ Z p [T 1 , . . . , T j-1 ]
. Indeed, the polynomials T i j • Q l are linearly independent, and so U (T j i • Q l ) are independent uniform matrices in Z k×m p . We have:

Q P,j,ν,i = L l=1 λ (ν,i) l • Q l .
Thus, for a query P , we remark that the matrix Y is computed as:

Y = N P,j ν=1 d i=0 C P,j,ν • L l=1 λ (ν,i) l • T[l, i] = N P,j ν=1 d i=0 C P,j,ν • L l=1 λ (ν,i) l • U (T i j • Q l ) = N P,j ν=1 C P,j,ν • U d i=0 L l=1 λ (ν,i) l • T i j • Q l = N P,j ν=1 d i=0 C P,j,ν • U d i=0 Q P,j,ν,i • T i j = N P,j ν=1 C P,j,ν • U ( z 1 ,...,z j c P,j,ν,z 1 ,...,z j • T z j j • • • T z 1 1 ) = z 1 ,...,z j   N P,j ν=1 C P,j,ν • c P,j,ν,z 1 ,...,z j   • U (T z j j • • • T z 1 1 ) = z 1 ,...,z j C P,j,z 1 ,...,z j • U (T z j j • • • T z 1 1 ),
where the last equality comes from Equation (5.3) and most other equalities come from the linearity of U . The matrix Y is computed exactly as in Game G 2,j . Therefore, Games G 1,j and G 2,j are perfectly indistinguishable, for j = 1, . . . , n.

proc Initialize / / G 2,j ; j = 1, . . . , n

U $ ← L(Z p [T 1 , . . . , T j ] ≤d , Z k×m p ) proc RKFn(P ) / / G 2,j ; j = 1 . . . , n Y ← z 1 ,...,z j C P,j,z 1 ,...,z j • U (T z j j • • • T z 1 1 )
Return [Y ]

Figure 5.5: Games G 2,j for the proof of the PLP theorem Second, we prove that Game G 2,j is perfectly indistinguishable from Game G 0,j+1 . The proof is similar to the previous one. For that, we remark that T in G 1,j can be seen as computed as

T[l, i] = A i j+1 • U (Q l ), for i = 0, . . . , d, with U $ ← L(Z p [T 1 , . . . , T j ] ≤d , Z k×m p ) with L[l] = Q l ∈ Z p [T 1 , . . . , T j ]
. Indeed, the polynomials Q l are linearly independent, and so U (Q l ) are independent uniform matrices in Z k×m p . We also have:

Q P,j+1,ν,i = L l=1 λ (ν,i) l Q l .
Thus, for a query P , we remark that the matrix Y is computed as:

Y = N P,j+1 ν=1 d i=0 C P,j+1,ν • L l=1 λ (ν,i) l • T[l, i] = N P,j+1 ν=1 d i=0 C P,j+1,ν • L l=1 λ (ν,i) l • A i j+1 • U (Q l ) = N P,j+1 ν=1 d i=0 C P,j+1,ν • A i j+1 • U L l=1 λ (ν,i) l • Q l = N P,j+1 ν=1 d i=0 C P,j,ν • A i j+1 • U (Q P,j+1,ν,i ) = N P,j+1 ν=1 d i=0 C P,j,ν • U ( z 1 ,...,z j c P,j+1,ν,z 1 ,...,z j ,i • T z j j • • • T z 1 1 ) = z 1 ,...,z j   N P,j+1 ν=1 d i=0 C P,j,ν • c P,j+1,ν,z 1 ,...,z j ,i   • U (T z j j • • • T z 1 1 ) = z 1 ,...,z j C P,j,z 1 ,...,z j • U (T z j j • • • T z 1 1 ),
where the last equality comes from Equation (5.4) and most other equalities come from the linearity of U . This is computed exactly as in Game G 2,j . Therefore, games G 1,j and G 2,j are perfectly indistinguishable, for j = 1, . . . , n.

To conclude, let us prove that Game G 1,n is perfectly indistinguishable from the game (n, d, k, m)-PLPRand G . Since Game G 1,n is perfectly indistinguishable from Game G 2,n , we just need to prove the G 2,0 is perfectly indistinguishable from the game (n, d, k, m)-PLPRand G . This is the case, since Q P,n = P is a polynomial with scalar coefficients, and in the expression of the matrix Y = z 1 ,...,z j C P,n,z 1 ,...,zn • U (T zn n • • • T z 1 1 ) (in Game G 2,0 ), C P,n,z 1 ,...,zn can be seen as a scalar, and Y = U (Q P,n ) = U (P ) by linearity.

Dealing with an Imperfect TestLin. To deal with an imperfect TestLin, we just remark that the only part where we supposed TestLin to be perfect in the proof was to prove the perfect indistinguishability of Game G 1,j and Game G 0,j+1 , and the perfect indistinguishability between Game G 0,1 (respectively Game G 1,n ) with the game (n, d, k, m)-PLPReal G (respectively (n, d, k, m)-PLPRand G ). All this properties are statistical, so that it is possible to replace the real TestLin (with error 1/p) by a perfect (with error 0, as used in the proof). This just loses an additive factor at most (d+1)qN/p each time, and so at most 2n(d+1)qN/p in total. Equation (5.5) easily follows from the bounds arising in the different game hops, and then Theorem 5.2.2 immediately follows.

Chapter 6 Applications

In this chapter, we show some applications of the PLP theorem (Theorem 5.2.2 on page 72). Specifically, we first show how the LIP theorem (Theorem 5.2.4 on page 73) can be used to prove the (standard and related-key) security of pseudorandom functions. In particular, using this theorem, we are able to design a fully algebraic framework for related-key security that allows to improve previous known results, by providing positive results for larger classes of related-key deriving functions, but also by building secure constructions based on weaker assumptions. We also apply the PLP theorem to solve many open questions in the area of aggregate pseudorandom functions and multilinear pseudorandom functions.

Our statements are directly given using the classical assumptions (rather than the

E k,d -MDDH

Applications to Standard Pseudorandom Functions

In this section, we introduce weighted (extended) versions of the Naor-Reingold and Boneh-Montgomery-Raghunathan pseudorandom functions, termed weighted NR and weighted BMR, and respectively denoted WNR and WBMR. We later use these extended constructions in order to build related-key secure pseudorandom functions for new classes of RKD functions (Section 6.2). These weighted versions are obtained by applying particular permutations to the key space. Then, in the standard setting, it is straightforward that the security of NR and BMR implies the security of their weighted versions. However, as detailed in Section 6.2, in the related-key setting, we can prove that some of these weighted constructions are secure against certain classes of RKD functions while both NR and BMR are not, even if we apply the framework from Chapter 3.

Finally, the security proofs of WNR and WBMR are straightforward using the LIP theorem, and so are the security proofs of NR, NR * , and BMR, as particular cases of WNR and WBMR. Thus, as a first application of the LIP theorem theorem, we detail proofs of security for both these extended constructions. w .Eval) the following construction:

Extended Number-Theoretic Pseudorandom Functions

• WNR #"
w .Setup(1 κ ) generates public parameters pp = (p, G, g) where (p, G, g) describes a cyclic group of prime order p generated by g;

• WNR #"
w .Eval pp (•, •) takes as input a key #" a = (a 0 , a 1 , . . . , a n ) ∈ Z n+1 p and an input

x = x 1 . . . x n ∈ {0, 1} n and outputs [a 0 • n i=1 a x i i ] g .
Furthermore, in the case where w 0 = 0, we consider the key space to be Z n p (by ignoring a 0 ) and restrict the input x to be in {0, 1} n \ {0 n }, similarly to the definition of NR * . As before, for simplicity, we often use the notation WNR #" w ( #" a , x) to denote WNR #" w .Eval pp ( #" a , x). w is a pseudorandom function, for any #" w ∈ Z n+1 p such that w i and p -1 are coprime, for i = 0, . . . , n. Remark 6.1.2. We recover the standard NR and NR * constructions by letting #" w = (1, . . . , 1) and #" w = (0, 1, . . . , 1) respectively. For a weight #" w such that there exists i with w i and p -1 not being coprime, we could still use the LIP theorem to prove the security, but we would need to rely on a stronger assumption (as the application a ∈ Z p → a w i ∈ Z p is no longer a bijection).

Extended BMR

Let #" w = (w 1 , . . . , w n ) ∈ Z n p . We denote WBMR #" w = (WBMR #" w .Setup, WBMR #"
w .Eval) the following construction:

• WBMR #"
w .Setup(1 κ ) generates public parameters pp = (p, G, g) where (p, G, g) describes a cyclic group of prime order p generated by g;

• WBMR #"
w .Eval pp (•, •) takes as input a key #" a = (a 1 , . . . , a n ) ∈ Z n p and an input x = x 1 . . . x n ∈ {0, . . . , d} n and outputs n i=1 1 a i +w i +x i g . Again, we often use the notation WBMR #" w ( #" a , x) to denote WBMR #" w .Eval pp ( #" a , x). w is a pseudorandom function, for any #" w ∈ Z n p . Remark 6.1.4. We recover the standard BMR construction by letting #" w = (0, . . . , 0).

Simple Proofs of Security

(a i + w i + k)   • b   g = [P ( #" a ) • b] g
which is a generator with overwhelming probability. Then, when the adversary makes a query

x, it is clear that

n i=1 1 a i + w i + x i h =     n i=1 k∈{0,...,d}\{x i } (a i + w i + k)   • b   g = [P x ( #" a ) • b] g .
As each polynomial P x is null on every input -x for x ∈ {0, . . . , d} n , seen as a vector of Z n p , except when x = x, and as P is null on all -x , P and (P x ) x are linearly independent. Then, we conclude the security proof of WBMR #" w by applying the LIP theorem.

Extended NR

Proof of Lemma 6.1.1. Since the application a ∈ Z p → a w ∈ Z p is a bijection as long as w and p -1 are coprime, it is clear that if NR is a secure pseudorandom, then so is WNR #" w , as long as w i and p -1 are coprime, for i = 0, . . . , n, since we just apply a permutation to the key space.

Let A be an adversary against the pseudorandom function security of NR that makes q oracle queries. We can assume without loss of generality that A never repeats a query. Then we can construct an adversary B against the (n, 1)-LIP security of G that makes q queries P 0 , P 1 , . . . , P q , defined as follows.

First, B sends the public parameters (p, G, g) to A . By doing so, it implicitly sets a 0 = b.

Next, B runs adversary A . When the latter makes a query x ∈ {0, 1} n , adversary B makes the query P x (T 1 , . . . , T n ) = n i=1 T x i i to its oracle and returns the value it gets to A . When A halts, B halts with the same output. If B's oracle responds to a query P by the value

[P ( #" a ) • b], then B sends [P x ( #" a ) • b] = [b • n i=1 a x i i b] = NR((b, #" a ), x)
to A when the latter makes a query x, while if B's oracle responds to a query P by a uniformly random value, then B sends uniformly random values to A . Hence, B simulates exactly the game defining the pseudorandom function security of NR for the key #" a which is taken at random over Z n+1 p .

The only thing we need to prove is that all these queries are allowed to B, meaning that for any distinct queries x 1 , . . . , x q of A , polynomials P x 1 , . . . , P xq are linearly independent over Z p , which is straightforward. Hence, we have

Adv prf NR (A ) ≤ Adv (n,1)-lip G (B) .
We now conclude the proof by applying the LIP theorem. This also proves the security of WNR #"

w for any #" w such that w i and p -1 are coprime, for i = 0, . . . , n. Please also note that if w 0 = 0 (for instance for NR * ), we can do a similar proof using the (n, 1)-LIP security of G, by querying 1 at first and revealing [b] as the generator instead of g.

Extended BMR

Proof of Lemma 6.1.3. Let A be an adversary against the pseudorandom function security of WBMR #" w that makes q oracle queries. We can assume without loss of generality that A never repeats a query. Then we can construct an adversary B against the (n, d)-LIP security of G that makes q + 1 queries P 0 , P 1 , . . . , P q , defined as follows.

First, B queries polynomial P 0 ( #" T ) = n i=1 k∈{0,...,d} (T i + w i + k) and gets

h =     n i=1 k∈{0,...,d} (a i + w i + k)   • b   g = [P 0 ( #" a ) • b] g ,
that it sends to A along with G and p as public parameters (h is a generator with probability ( p-d-1 p

) n ). Next, B runs adversary A . When the latter makes a query x ∈ {0, . . . , d} n , adversary B makes the query P x (T 1 , . . . , T n ) = n i=1 k∈{0,...,d}\{x} (T i + w i + k) to its oracle and returns the value he gets to A . When A halts, B halts with the same output. If B's oracle responds to a query P by the value

[P ( #" a ) • b] g , then B sends [P x ( #" a ) • b] g =     n i=1 k∈{0,...,d}\{x} (a i + w i + k)   • b   g = P 0 ( #" a ) • b n i=1 (a i + w i + x i ) g = n i=1 1 a i + w i + x i h ,
to A when the latter makes a query x, while if B's oracle responds to a query P by a uniformly random value, then B sends uniformly random values to A . Hence, B simulates exactly the game defining the pseudorandom function security of WNR #" w for the key #" a which is taken at random over Z n p and the generator h. Then, since P x (T 1 , . . . , T n ) = n i=1 k∈{0,...,d}\{x} (T i + w i + k) is a degree at most d polynomial in each indeterminate, the only thing that remains to prove is that all these queries are allowed to B, meaning that for any distinct queries x (1) , . . . , x (q) of A , polynomials P 0 , P x (1) , . . . , P x (q) are linearly independent over Z p . By contradiction, let us assume there is a sequence of distinct queries x (1) , . . . , x (q) such that there is a linear combination:

λ 0 P 0 + q m=1 λ k P x (k)
with λ k = 0 for all k = 1, . . . , q.

By evaluating this sum in -x (k) -#" w = (-x

(k) 1 -w 1 , . . . , -x (k) n -w n ) ∈ Z n p , we get P 0 (-x (k) -#" w) = 0 for all k and P x (i) (-x (k) -#" w) = 0 for all i = k and then λ k P x (k) (-x (k) -#" w) = 0, which directly implies λ k = 0, since P x (k) (-x (k) -#"
w) = 0 for all k = 1, . . . , q. Then, we have proven that λ k = 0, for all k = 1, . . . , q. Finally, since P 0 is not the zero polynomial and λ 0 P 0 = 0, we have also λ 0 = 0.

Then, for any distinct queries x (1) , . . . , x (q) of A , polynomials P 0 , P x (1) , . . . , P x (q) are linearly independent over Z p . Hence, we have

Adv prf WBMR #" w (A ) ≤ p p -d -1 n • Adv (n,d)-lip G (B) .
We conclude the proof by applying the LIP theorem.

Applications to Related-Key Security

In this section, we show how the LIP theorem can also be used to prove the related-key security of a pseudorandom function F = (F.Setup, F.Eval) such that F.Eval takes a key #" a and an input x and outputs a group element F.Eval pp ( #" a , x) = [P x ( #" a )] over a group G = g of prime order p, described by the F.Setup procedure, where P x is a certain multivariate polynomial depending on x. For simplicity, let us once again simply denote by F ( #" a , x) the output F.Eval pp ( #" a , x).

For simplicity, we only consider the case k = 1 in the following, but similar constructions can be obtained with k > 1 (except when permutations are involved). A brief extension is provided at the end of this section.

Let Φ be a class of RKD functions, where functions

#" φ = (φ 1 , . . . , φ n ) ∈ Φ are such that φ i are multivariate polynomials in Z p [T 1 , . .

. , T n ]. Then, for an RKD function

#" φ and an input x, the pseudorandom function outputs F ( #" φ ( #" a ), x) = P #" φ ,x ( #" a ) , where the polynomial

P #" φ ,x ( #" T ) = P x ( #" φ ( #" T )) = P x (φ 1 ( #" T ), . . . , φ n ( #"
T )) depends on #" φ and x. In particular, P id,x = P x for all x, where id is the identity function.

When all polynomials P #" φ ,x and the constant polynomial 1 are linearly independent, the LIP theorem directly shows that F is Φ-related-key secure under the hardness of the E 1,d -MDDH problem (with d being the maximum degree in one indeterminate occurring in the family {P #" φ ,x } #" φ ,x ). To illustrate this, we use this method to construct a related-key secure pseudorandom function for the class of permutations in Section 6.2.1.

However, to assume that all polynomials P #" φ ,x are linearly independent is a very strong property and, in general, this is not the case for all x and #" φ . Hence, in Section 6.2.2, we consider the less restrictive case where the polynomials P #" φ 1 ,x 1 , . . . , P #" φ q ,xq are linearly independent as long as the inputs x 1 , . . . , x q are distinct (so the adversary is unique-input). Specifically, we design a new algebraic framework that extends the one from Section 3.6, when the pseudorandom function F outputs elements of the form [P x ( #" a )] and when the RKD functions are multivariate polynomials. The proof of this framework follows easily from the LIP theorem. We then use this algebraic framework to construct related-key secure pseudorandom functions for new and larger classes of RKD functions as well as weaker assumptions.

Direct Constructions

In this section, we show how the LIP theorem can be used to prove the Φ-related-key security of a pseudorandom function F of the above form in the particular case where all polynomials P #" φ ,x are linearly independent, for any #" φ ∈ Φ and any input x. Here, we consider the class Φ Sn of functions defined as {σ | σ ∈ S n } such that, applying a function σ ∈ Φ Sn to a key #" a = (a 1 , . . . , a n ) ∈ Z n p leads to the key σ( #" a ) = (a σ -1 (1) , . . . , a σ -1 (n) ), so the i-th component of #" a becomes the σ(i)-th component of the key

σ( #" a ).
It is clear that BMR is not Φ Sn -related-key secure, since we can distinguish BMR from a random function with only 2 queries. Indeed, let id be the identity function and (12) be the permutation which switches the first two components of the key. Then, one can just query (id, 100 . . . 0) and ((12), 010 . . . 0) and check whether the output of these queries are the same, which is the case in the real case while they are independent in the random case. However, we show in what follows that a particular case of WBMR, defined below, is a Φ Sn -related-key secure PRF.

Linear WBMR PRF. We define WBMR lin as the particular case of WBMR, where w i = (i -1)(d + 1), for i = 1, . . . , n. Please refer to Section 6.1.1.2 for details. Lemma 6.2.1. Assuming (n(d + 1) -1)-DDHI holds in G, WBMR lin is a Φ Sn -related-key secure pseudorandom function.

Moreover, the time overhead of this reduction is polynomial in n, d and in the running time of the adversary.

The proof is given below and is very similar to the proof of security of WBMR in Section 6.1.

Proof of Lemma 6.2.1. Let A be a Φ Sn -restricted adversary against the related-key security of WBMR lin that makes q queries. We design an adversary B against the (n, n(d + 1) -1)-LIP security of G that makes q + 1 queries as follows.

First, B queries polynomial P 0 ( #" T ) = n i=1 k∈{0,...,n(d+1)-1} (T i + k) and gets h with

h =     n i=1 k∈{0,...,n(d+1)-1} (a i + k)   • b   g = [P 0 ( #" a ) • b] g ,
or a random group element, that it sends to A as the generator along with G and p as the public parameters for WBMR lin (h is a generator with probability at least ( p-n(d+1)-1 p

) n ). Next, B runs adversary A . When the latter makes a query (σ, x), B computes the polynomial

P σ,x ( #" T ) = n i=1 n(d+1)-1 k=0 (T i + k) n i=1 (T σ -1 (i) + w i + x i ) = P 0 ( #" T ) n i=1 (T i + w σ(i) + x σ(i)
) and queries P σ,x . This is possible since n i=1 (T i + w σ(i) + x σ(i) ) divides P 0 and since P σ,x is a degree n(d + 1) -1 polynomial in each indeterminate. It then returns the value it gets to A .

It is clear that if B's oracle returns uniformly random values, B simulates exactly the game RKPRFRand WBMR lin , whereas if it returns [P ( #" a ) • b] for a query P , then B simulates exactly game RKPRFReal WBMR lin with the generator defined above. Indeed, in that case, let h = [P 0 ( #" a ) • b] g be the generator given to A . Then for a query (σ, x),

[P σ,x ( #" a ) • b] g = n i=1 1 #" a [σ -1 (i)]+w i +x i h = WBMR lin (σ( #" a ), x)
, where WBMR lin is defined using the generator h. Then, the only thing that remains to prove is that all the polynomials queried by B to its oracle are linearly independent over Z p .

Hence, let us now prove that all polynomials P σ,x ( #" T ) corresponding to queries (σ, x) are linearly independent. By contradiction, let us assume that there exists a sequence of distinct queries (σ (1) , x (1) ), . . . , (σ (q) , x (q) ) such that there exists a linear combination:

λ 0 P 0 + q k=1 λ k • P σ (k) ,x (k) = 0 with λ k = 0 for all k = 1, . . . , q.
Then, by evaluating the above sum of polynomials on points

(-w σ (k) (1) -x (k) σ (k) (1) , . . . , -w σ (k) (n) -x (k) σ (k) (n)
), since all the above polynomials except P σ (k) ,x (k) take the value 0 on these points, we obtain, for k = 1, . . . , q, λ k = 0. Then, we have λ 0 P 0 = 0 and since P 0 = 0, we have λ 0 = 0. Hence, all these polynomials are linearly independent. Then, Lemma 6.2.1 easily follows from the above and from the LIP theorem. Remark 6.2.2. By slightly changing the construction, we can also achieve Φ Sn,+ k -related-key security, where Φ Sn,+ k is the class of functions σ #" b that, when applied to a key #" a ∈ Z n p , leads to the key (a σ -1 (1) +b 1 , . . . , a σ -1 (n) +b n ), for any σ ∈ S n and any #" b ∈ {0, . . . , k} n . In other words, Φ Sn,+ k also tolerates small additive factors in addition to permutations. Indeed, considering the function WBMR lin k as the particular case of WBMR where w i = (i -1)(d + 1)(k + 1) for i = 1, . . . , n one can prove that this construction is Φ Sn,+ k -related-key secure under the (d(k + 1) + k + (n -1)(d + 1)(k + 1))-DDHI assumption in G and the proof follows closely the proof of Lemma 6.2.1. In particular, with k = 0, this is exactly the result from Lemma 6.2.1.

Constructions From Unique-Input-Related-Key Security, Algebraically

In this section, we address the less restrictive case in which we only require the polynomials P #" φ 1 ,x 1 , . . . , P #" φ q ,xq to be linearly independent for any #" φ 1 , . . . , #" φ q when the inputs x 1 , . . . , x q are all distinct. Please notice that this is the case for all the classes considered in previous sections and chapters. We now denote by M = (M.Setup, M.Eval) the "original" pseudorandom function (that we want to transform into a related-key secure one) such that for any x, M ( #" a , x) = M.Eval pp ( #" a , x) = [P x ( #" a )] for a certain multivariate polynomial P x depending on x.

In order to build related-key secure pseudorandom functions from such pseudorandom functions, we would like to apply the generic framework from Section 3.6 that allows to transform a unique-input-related-key secure pseudorandom function M into a related-key secure one, F . Recall that the framework is simply the following: F keeps the same setup (F.Setup = M.Setup) and its outputs are defined as:

F.Eval pp (K, x) = M.Eval pp (K, H(x, M (K, #" ω ))),
where H is a compatible collision-resistant hash function, and where #" ω is a strong key fingerprint. Please refer to Chapter 3 and especially Sections 3.4 and 3.6 for further details.

Unfortunately, if we consider WNR #"

w with some w i > 1, then it is not clear how to find a strong key fingerprint, which can be used to apply the above framework. Furthermore, this framework requires to prove several non-algebraic properties (statistical or computational), namely key-collision, statistical-key-collision, and unique-input-related-key securities.

For this reason, we design a new algebraic framework, that generalizes this framework in the particular case of pseudorandom functions of the form M ( #" a , x) = [P x ( #" a )] and considering classes of multivariate polynomials. For completeness, a more general framework, which does not make any assumptions about the outputs of the pseudorandom function, is also given in Section 6.2.5. Afterwards, we use our algebraic framework to design new related-key secure pseudorandom functions based on WNR for larger classes for which previous constructions are not secure.

An Algebraic Framework for Related-Key Security

Here, we describe a new framework that transforms any pseudorandom function of the above form that satisfies that P #" φ 1 ,x 1 , . . . , P #" φ q ,xq are linearly independent, for any #" φ 1 , . . . , #" φ q as long as x 1 , . . . , x q are all distinct inputs, into a related-key secure pseudorandom function. To do so, we first introduce three new notions, termed algebraic fingerprint, helper information, and expansion function, and defined as follows.

Algebraic Fingerprint. In order to overcome the possible lack of a strong key fingerprint, we introduce the notion of algebraic fingerprint, which will be used to replace M (K, #" ω ) from the previous framework, where #" ω is a strong fingerprint. An algebraic fingerprint is simply an injective function #" Ω:

Z n p → G m such that the image #" Ω( #" a ) is a vector of group elements ([Ω 1 ( #" a ) • b] , . . . , [Ω m ( #" a ) • b]) with Ω 1 , . . . , Ω m being polynomials in Z p [T 1 , . . . , T n ] and b ∈ Z p .
In our applications, we will simply have

#" Ω( #" a ) = ([a 1 ] , . . . , [a n ]), so m = n and Ω i ( #" T ) = T i for i = 1, .
. . , n. Helper Information. In order to prove the security of our framework, we need to be able to compute the image of the algebraic fingerprint, #"

Ω( #" φ ( #" a )) = ((Ω 1 • #" φ )( #" a ), . . . , (Ω m • #" φ )( #" a )), for any related key #" φ ( #" a ) ∈ Z n p , with
#" φ ∈ Φ, from some information which can somehow be made public without hurting security. We call this information a helper information, write it Help Φ ( #" a ), and call Help Φ the helper function. We suppose that Help

Φ ( #" a ) = ([help 1 ( #" a ) • b] , . . . , [help ( #" a ) • b]
), with help 1 , . . . , help linearly independent polynomials which generate a vector subspace of Z p [T 1 , . . . , T n ] containing the polynomials Ω i • #" φ for i = 1, . . . , m, and #" φ ∈ Φ. Hash Function and Expansion Function. Let D = D × G m where D is the domain of M , and let h be a collision-resistant hash function h: D → hSp, where hSp is a large enough space. The last thing we need to define is an expansion function, which is simply an injective function E: hSp → S ⊆ D such that for any sequence ( #" φ 1 , x 1 ), . . . , ( #" φ q , x q ) where x 1 , . . . , x q are distinct inputs in S and #" φ 1 , . . . , #" φ q are RKD functions, polynomials help 1 , . . . , help and polynomials P #" φ 1 ,x 1 , . . . , P #" φ q ,xq and 1 (which needs to be queried to define [b]) are linearly independent over Z p . In particular, E has to be injective.

Using these new tools, we obtain the following framework.

F.Eval pp ( #" a , x) = M.Eval pp ( #" a , E(h(x, #" Ω( #" a ))))
for all #" a ∈ Z n p and x ∈ D. Then, assuming d-DDHI holds in G and that h is a collision-resistance hash function, F is a Φ-related-key secure pseudorandom function.

Moreover, the running time of this reduction is polynomial in n, d, q, and in the running time of the adversary.

Proof Overview. The proof of the above theorem is detailed below and relies on the sequence of 10 games (games G 0 -G 9 ) described in Figure 6.2 and on Lemma 6.2.4. We first prove an intermediate statement whose proof is very similar to the proof of Theorem 3.4.2, under a notion termed extended key-collision security (that states the hardness of finding key collisions given the helper information and oracle access to the pseudorandom function) which is defined below. Afterwards, we reduce this notion to the hardness of the d-SDL problem in G (which is trivially implied by the (n, d)-LIP security). Here we provide a brief overview of the proof of this intermediate statement.

We start by giving the generator along with G and p as public parameters for the pseudorandom function by querying polynomial 1. Hence, the generator is simply [b]. Since we may have key collisions (i.e., two RKD functions φ 1 = φ 2 , such that φ 1 ( #" a ) = φ 2 ( #" a )), we start by dealing with possible collisions on the related keys in the game RKPRFReal F , using the extended key-collision notion (games G 0 -G 2 ). These claws can be detected by looking for collisions on images of #" Ω for different RKD functions. Then, in games G 3 -G 4 , we deal with possible collisions on hash values in order to ensure that the inputs t = E(h(x, #" Ω( #" a ))) used to compute the output y are distinct (recall that E is injective). Next, we use the (n, d)-LIP security notion to show that it is hard to distinguish the output of F and the helper information from uniformly random values (games G 5 -G 6 ).

Finally, we use once again the extended-key-collision security notion to deal with possible key collisions in the game RKPRFRand F (games G 7 -G 9 ) so that G 9 matches exactly the description of RKPRFRand F . These key collisions can still be detected in these games by making crucial use of the helper information.

Proof of Theorem 6.2.3. Let A denote an adversary against the Φ-related-key security of F . We assume without loss of generality that it never repeats a query. We first introduce a new security notion termed extended key-collision security, whose security game is depicted in Figure 6.1 below, which extends the key-collision security notion defined in Section 3.4.2 but where Initialize also leaks Help Φ to the adversary.

proc Initialize #" a $ ← Z n p pp $ ← M.Setup(1 κ ) Return (pp, Help Φ ( #" a )) proc RKFn( #" φ , x) y ← M.Eval pp ( #" φ ( #" a ), x) Return y proc Finalize( #" φ 1 , #" φ 2 ) Return ( #" φ 1 = #" φ 2 and #" φ 1 ( #" a ) = #" φ 2 ( #" a ))
Figure 6.1: Security game for extended Φ-key-collision of a pseudorandom function M for a class Φ Then, we show that:

Adv rka-prf Φ,F (A ) ≤ Adv (n,d)-lip G (B) + Adv cr H (C ) + 2 • Adv ext-kc Φ,M (D) . (6.1)
Afterwards, we the extended key-collision security notion to the d-SDL assumption in G, which is implied by the d-DDHI assumption. This proves our statement.

Proof of this Intermediate Statement.

The proof is based on the sequence of games in Figure 6.2. We denote by Succ i the event that game G i output takes the value 1. G 0 matches the description of the RKPRFReal F game, so:

Pr [ Succ 0 ] = Pr RKPRFReal A F ⇒ 1 .
Game G 1 introduces storage of used RKD functions and values of images #" C of #" Ω in sets D and E respectively and sets flag 1 to true if the same value of #" C arises for two different RKD functions. Since this storage does not affect the values returned by RKFn

Pr [ Succ 0 ] = Pr [ Succ 1 ] .
Game G 2 adds the boxed code which changes how the repetition of a value #" C is handled, by picking instead a random value from G m \ E that will not repeat any previous one. Games G 1 and G 2 are identical until flag 1 is set to true, hence we have

Pr [ Succ 1 ] ≤ Pr [ Succ 2 ] + Pr [ E 1 ] ,
where E 1 denotes the event that the execution of A with game G 1 sets flag 1 to true. We design an adversary D attacking the extended Φ-key-collision security of M such that

Pr [ E 1 ] ≤ Adv ext-kc Φ,M (D) .
Adversary D gets helper information help Φ = Help Φ ( #" a ), then runs A . When the latter makes an RKFn-query ( #" φ , x), adversary D computes #" C = #" Ω( #" φ ( #" a )) using its helper information, z = h(x, #" C) and t = E(z) and finally queries ( #" φ , t) to its oracle and sends the value it gets to A . When A halts, D searches for two different RKD functions #" φ 1 , #" φ 2 queried by A that lead to the same value #" C and returns these two functions if found. Since #" Ω is a Algebraic Fingerprint, such two functions lead to the same key, so D wins if he finds such two functions. Game G 4 adds the boxed code which changes how repetition of hash values is handled, by picking instead a random value z from hSp \ G that will not repeat any previously used hash value. Games G 3 and G 4 are identical until flag 2 is set to true, hence we have

proc Initialize / / G 0 #" a $ ← Z n p proc RKFn( #" φ , x) / / G 0 #" C ← #" Ω( #" φ ( #" a )) z ← h(x, #" C) t ← E(z) y ← M ( #" φ ( #" a ), t) Return y proc Finalize(b') / / All Games Return b proc Initialize / / G 1 , G 2 #" a $ ← Z n p ; D ← ∅ ; E ← ∅ proc RKFn( #" φ , x) / / G 1 , G 2 #" C ← #" Ω( #" φ ( #" a )) If #" C ∈ E and #" φ / ∈ D then flag 1 ← true ; #" C $ ← G m \ E D ← D ∪ { #" φ } ; E ← E ∪ { #" C} z ← h(x, #" C) t ← E(z) y ← M ( #" φ ( #" a ), t) Return y proc Initialize / / G 3 , G 4 #" a $ ← Z n p ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn( #" φ , x) / / G 3 , G 4 #" C ← #" Ω( #" φ ( #" a )) If #" C ∈ E and #" φ / ∈ D then #" C $ ← G m \ E D ← D ∪ { #" φ } ; E ← E ∪ { #" C} z ← h(x, #" C) If z ∈ G then flag 2 ← true z $ ← hSp \ G G ← G ∪ {z} t ← E(z) y ← M ( #" φ ( #" a ), t) Return y proc Initialize / / G 5 #" a $ ← Z n p ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn( #" φ , x) / / G 5 #" C ← #" Ω( #" φ ( #" a )) If #" C ∈ E and #" φ / ∈ D then #" C $ ← G m \ E D ← D ∪ { #" φ } ; E ← E ∪ { #" C} z ← h(x, #" C) If z ∈ G then z $ ← hSp \ G G ← G ∪ {z} t ← E(z) y $ ← G Return y proc Initialize / / G 6 #" a $ ← Z n p ; D ← ∅ ; E ← ∅ G $ ← Fun(Z n p , D, G) proc RKFn( #" φ , x) / / G 6 y $ ← G Return y proc Initialize / / G 7 , G 8 #" a $ ← Z n p ; D ← ∅ ; E ← ∅ G $ ← Fun(Z n p , D, G) proc RKFn( #" φ , x) / / G 7 , G 8 If #" φ ( #" a ) ∈ E and #" φ / ∈ D then y $ ← G ; flag 3 ← true else y ← G( #" φ ( #" a ), x) D ← D ∪ { #" φ } ; E ← E ∪ { #" φ ( #" a )} Return y proc Initialize / / G 9 #" a $ ← Z n p ; G $ ← Fun(Z n p , D, G) proc RKFn( #" φ , x) / / G 9 y ← G( #" φ ( #" a ), x) Return y
Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Pr [ E 2 ] ,
where E 2 denotes the event that the execution of A with game G 3 sets flag 2 to true. We design an adversary C attacking the collision-resistance security of h such that

Pr [ E 2 ] ≤ Adv cr h (C ) . Adversary C starts by picking #" a $ ← Z n p and initializes j ← 0. It runs A . When the latter makes an RKFn-query ( #" φ , x), adversary C responds via

#" C ← #" Ω( #" φ ( #" a )) j ← j + 1 ; #" φ j ← #" φ ; x j ← x If #" C ∈ E and #" φ / ∈ D then #" C $ ← G m \ E ( * ) D ← D ∪ { #" φ } ; E ← E ∪ { #" C} #" C j ← #" C z ← h(x, #" C) z j ← z t ← E(z) y ← M ( #" φ ( #" a ), t) Return y. When A halts, C searches for a, b satisfying 1 ≤ a < b ≤ j such that z a = z b and, if it finds them, outputs (x a , #" C a ), (x b , #" C b ) and halts. The pairs (x a , #" C a ) and (x b , #" C b ) are distinct. Indeed, consider two cases: first, if #" φ a = #" φ b then since A never repeats an oracle query, x a = x b hence (x a , #" C a ) = (x b , #" C b ). Second, if #" φ a = #" φ b , then condition ( * ) ensures that #" C a = #" C b . Hence once again, (x a , #" C a ) = (x b , #" C b ),
#" C = #" Ω( #" φ ( #" a )) using its helper information. Then, B checks if #" C ∈ E and #" φ ∈ D. If they do, B picks #" C $ ← G m \ E at random. B then sets D ← D ∪ { #" φ } and E ← E ∪ { #" C}. Next, B computes z ← h(x, #" C) and checks if z ∈ G. If it does, B picks z $
← hSp \ G at random. Notice that this step guarantees that all values z are distinct as long as A makes at most |hSp| queries. Finally, B sets G ← G ∪ {z}, computes t = E(z) and makes the query P #" φ ,t to its oracle, where P #" φ ,t is the polynomial such that M ( #" φ ( #" a ), t) = P #" φ ,t ( #" a ) , and returns the value it gets, which is either P #" φ ,t ( #" a ) • b or a uniformly random value, to A . When A halts, B halts with the same output. It is clear that all the polynomials queried by B are linearly independent via the definition of E. Finally, it is clear that if B's oracle answers to a query P by the value [P ( #" a ) • b], then it simulates exactly game G 4 (where the generator used for the PRF construction is [b], and if B's oracle gives uniformly random values, then the outputs are correctly simulated, since they are uniformly random. This concludes the proof of the above statement.

In game G 6 , we simply set the value y to a uniformly random value. Clearly, G 5 and G 6 are identical since the value returned is a uniformly random value for any query. Then, we have Pr [

Succ 5 ] = Pr [ Succ 6 ] .
In game G 7 , we check if two different queries can lead to a key collision. Since the "If" test ensures that the returned value is still uniformly random over G even when two different queries result in the same key, games G 6 and G 7 are identical. Hence,

Pr [ Succ 6 ] = Pr [ Succ 7 ] .
In game G 8 , we compute the output of RKFn using a random function G in Fun(Z n p , D, G). Since games G 7 and G 8 are identical until flag 3 is set to true, we have

Pr [ Succ 7 ] ≤ Pr [ Succ 8 ] + Pr [ E 3 ] ,
where E 3 denotes the event that the execution of A with game G 8 sets flag 3 to true. To bound the probability of event E 3 , we design an adversary D attacking the extended Φ-key-collision security of M such that

Pr [ E 3 ] ≤ Adv ext-kc Φ,M (D) . Adversary D starts by initializing a list L ← empty list and by choosing an element #" ψ in Φ and by setting #"

ψ 1 ← #" ψ and #" ψ 2 ← #"
ψ . Then, it runs A . When the latter makes an RKFn-query

( #" φ , x), if #" ψ 1 = #" ψ 2 , adversary D does the following: it first computes #" C ← #" Ω( #" φ ( #" a
)) using its helper information and searches for all tuples ( #" ). If the execution of A sets flag 3 to true, then A has queried #"

φ i , #" C i ) ∈ L such that #" C i = #" C. If
φ 1 = #" φ 2 such that #" φ 1 ( #" a ) = #" φ 2 ( #" a )
and assuming it has first queried #" φ 1 , when D computes #" Ω( #" φ 2 ( #" a )) and checks if this value is already in L, it finds that this value matches #" Ω( #" φ 1 ( #" a )) and since #"

φ 1 = #" φ 2 , it sets #" ψ 1 = #" φ 1 and #" ψ 2 = #" φ 2 , so D wins. Then, we have Pr [ E 3 ] ≤ Adv ext-kc Φ,M (
D) . Since A does not repeat oracle queries and since key collisions are dealt with in a similar way, it follows that games G 8 and G 9 are identical. Thus,

Pr [ Succ 8 ] = Pr [ Succ 9 ] .
Finally, G 9 matches the description of the RKPRFRand F game, so: From Extended-Key-Collision Security to SDL. In the following lemma, we reduce the extended-key-collision security to the hardness of the d-SDL problem in G. Lemma 6.2.4. Let d be an integer such that, for any polynomial in {help 1 , . . . , help }∪{P x, #" φ | x ∈ S, #" φ ∈ Φ}, its maximum degree in any indeterminate is at most d. Then, assuming d-SDL holds in G, so does the extended Φ-key-collision security of M .

Pr [ Succ 9 ] = Pr RKPRFRand A F ⇒ 1 . Equation (6.
Moreover, the running time of this reduction is polynomial in n, d, q, and in the running time of the adversary.

Proof of Lemma 6. Then, B computes the helper information

Help Φ ( #" a ) = ([help 1 ( #" a ) • b] , . . . , [help ( #" a ) • b]
) using its d-SDL tuple and the known values b, a i for i = j and sends this helper information to A . When A makes a query ( #" φ , x), B wants to return to A the value

M ( #" φ ( #" a ), x) = P x ( #" φ ( #" a )) • b = P #" φ ,x ( #" a ) • b .
To do so, B starts by computing P #" φ ,x (a 1 , . . . , a j-1 , T j , a j+1 , . . . , a n ) using chosen values a i , i = j. It then gets a degree at most d polynomial P j in T j . Hence, using its d-SDL tuple and the known value b, it can now easily compute [P j (a j ) • b] = P #" φ ,x ( #" a ) • b and returns this value to A .

At the end, A sends (

#" φ 1 , #" φ 2 ) to B and wins if #" φ 1 = #" φ 2 and #" φ 1 ( #" a ) = #" φ 2 ( #" a ). Hence, B computes #" ψ = #" φ 1 - #" φ 2 . Since #" φ 1 = #" φ 2 , there is at least a component of #" ψ which is a non-zero multivariate polynomial. Let us call this component R ∈ Z p [T 1 , . . . , T n ].
Since we chose j at random in {1, . . . , n}, the indeterminate T j appears in R with probability at least

1 n . B now evaluates R in (a 1 , . . . , a j-1 , T j , a j+1 , . . . , a n ) to obtain a univariate polynomial S ∈ Z p [T j ].
This polynomial is a non-zero polynomial with probability at least p-(n-1)d p , via the Schwartz-Zippel lemma.

Finally, B simply factorizes S (for instance using the Kedlaya-Umans algorithm), and outputs the unique root r of S such that [r] = [a]. Hence, we have:

Adv ext-kc Φ,M (A ) ≤ p p -(n -1)d • n • Adv d-sdl G (B) , (6.2)
and Lemma 6.2.4 follows.

Theorem 6.2.3 now follows from combining Equation (6.1), Equation (6.2), and from the LIP theorem (and from the fact that the hardness of d-SDL problem is implied by the E 1,d -MDDH assumption).

Related-Key Security for Permutations of Univariate Polynomials

We now apply our framework to a particular case of WNR and build the first related-key secure pseudorandom function for the class of permutations of univariate polynomials. We choose to set w 0 to 0 in our construction in order to ease the readability so that the key space of the pseudorandom function stays Z n p , but similar results can be proven with w 0 = 1 or set to a prime number p 0 > d (and distinct to p 1 , . . . , p n defined below).

For d ≥ 1, let Φ d be the class of degree at most d non-constant univariate polynomials defined as

Φ d = { #" φ : Z n p → Z n p | φ i : #" T → d j=0 α i,j T j i , (α i,1 , . . . , α i,d ) = 0 d , ∀i = 1, . . . , n}.
Then we consider the class Φ Sn,d of permutations of degree at most d non-constant univariate polynomials, defined as follows:

Φ Sn,d = {σ • #" φ | (σ, #" φ ) ∈ S n × Φ d } .
For a key #" a = (a 1 , . . . , a n ) ∈ Z n p , applying an RKD function σ

• #" φ ∈ Φ Sn,d , where #" φ = (φ 1 , . . . , φ n ) leads to the key (φ σ -1 (1) ( #" a ), . . . , φ σ -1 (n) ( #" a )) ∈ Z n
p , so the i-th component a i of the key is changed into φ i ( #" a ) and becomes the σ(i)-th component of the related key.

Before explaining our construction, we would like to point out that, even if we just consider the simple class of permutations Φ Sn ⊂ Φ Sn,1 introduced in Section 6.2.1, we can already show that NR and NR * are not Φ Sn -related-key secure, even with respect to unique-input adversaries. Indeed, let us consider NR * : let id be the identity function and (12) be the permutation which switches the first two components of the key. Then, the output of the queries (id, 100 . . . 0) and ((12), 010 . . . 0) will be the same in the real case and independent in the random case.

In fact, we can generalize the attack above to show that there even exists a compatible collision-resistant hash function h such that the pseudorandom function that one obtains when applying the Bellare-Cash transform (or one of the transforms from Chapter 3) to NR * would not be related-key secure with respect to the class of permutations. Indeed, let h be a collision-resistant hash function. The counter-example for h could be as follows (where x 1 and x 2 are two arbitrary distinct inputs):

h(x, [a 1 ] , . . . , [a n ]) =      1110 h (x 1 , [a 1 ] , . . . , [a n ]) if x = x 1 1101 h (x 1 , [a 2 ] , [a 1 ] , [a 3 ] , . . . , [a n ]) if x = x 2 1111 h (x, [a 1 ] , . . . , [a n ]) otherwise.
Note that h is a compatible collision-resistant hash function. It is easy to see that the output of the queries (id, x 1 ) and ((12), x 2 ) will be the same in the real case and independent in the random case. The same kind of attack can be mounted against NR.

However, while NR and NR * are not related-key secure against permutations attacks, we show in what follows that a particular case of WNR, defined below, yields a Φ Sn,d -related-key secure pseudorandom function.

Linear WNR. Let d ≥ 1. Let p 1 < p 2 < • • • < p n be distinct prime numbers such that p 1 > d.
We define WNR d-lin as the particular case of WNR, where w 0 = 0 and w i = p i . Please refer to Section 6.1.1.2 for details. Using standard inequalities over prime numbers, it is easy to see that we can find p 1 , . . . , p n such that p n = Õ(d + n).

In order to apply the framework from Theorem 6.2.3 to WNR d-lin and Φ Sn,d , we define:

• [b] ∈ G denote the generator output by the setup procedure along with G and p

• #" Ω: #" a ∈ Z n p → ([a 1 ] , . . . , [a n ]) ∈ G n • Help Φ Sn,d : #" a ∈ Z n p → ([1] , [a 1 ] , . . . , a d 1 , . . . , [a n ] , . . . , a d n ) ∈ G nd+1
• h can be any collision-resistant hash function h:

{0, 1} n × G n → {0, 1} n-2 • E: z ∈ {0, 1} n-2 → 11 z ∈ {0, 1} n
We just need to prove that E satisfies the linear independence property required to apply the framework, which is done below, and sketched here. We order monomials of multivariate polynomials, with any order respecting the total degree of polynomials (e.g., the graded lexicographic order). The leading monomial (i.e., the first monomial for that order) of the polynomial P #" φ ,x is T

x σ(1) p σ(1) d 1 1 • • • T x σ(n) p σ(n) dn n
, with d i > 0 the degree of φ i . The polynomials for the helper information (help k ) are T j i . Therefore, the leading monomials of help 1 , . . . , help , P # " φ 1 ,x 1 , . . . , P # " φq,xq , 1 are all distinct, when x 1 , . . . , x q are distinct inputs. This means that the matrix whose columns correspond to monomials (ordered as specified above) and whose rows correspond to the polynomials help 1 , . . . , help , P # " φ 1 ,x 1 , . . . , P # " φq,xq , 1 (ordered according to their leading monomial) is in echelon form. Hence, the latter polynomials are linearly independent. Finally, using Theorem 6.2.3, we obtain the following result. Lemma 6.2.5. Assuming p n d-DDHI holds in G and h is a collision-resistant hash function, the construction obtained with the above ingredients and Theorem 6.2.3 is a Φ Sn,d -related-key secure pseudorandom function.

Moreover, the running time of the reduction is polynomial in n, d, p n , and in the running time of the adversary.

Proof of Lemma 6.2.5.

Let P σ• #" φ ,x ( #" T ) = n i=1 φ i ( #" T ) p σ(i) •x σ(i) for σ • #" φ ∈ Φ Sn,d and x ∈ {0, 1} n . Let S = {11 z | z ∈ {0, 1} n-2 }.
The only thing we need to prove is that, for any sequence (x 1 , σ 1 • #" φ 1 ), . . . , (x q , σ q • #" φ q ), polynomials 1, T j i for i = 1, . . . , n and j = 1, . . . , d (revealed in the helper information) and polynomials P σ 1 • #" φ 1 ,x 1 , . . . , P σq• #" φ q ,xq are linearly independent, as long as x 1 , . . . , x q are all distinct in S.

By contradiction, let us assume that there exists a sequence of distinct polynomials P 1 , . . . , P q , where for k = 1, . . . , q, P k = P σ• #" φ ,x for distinct x ∈ S or P k = T j i for some (i, j) ∈ {1, . . . , n} × {1, . . . , d} or P k = 1, such that:

q k=1 λ k • P k = 0
with λ k = 0 for all k. Since polynomials T j i , for i = 1, . . . , n and j = 1, . . . , d and polynomial 1 are clearly linearly independent over Z p , then there is at least one polynomial P k in the above sum such that P k corresponds to P σ• #" φ ,x for a query (σ

• #" φ , x) with x ∈ S. Let P σ• #" φ ,x ( #"
T ) denote a polynomial in the above sum such that x ∈ S has the maximum Hamming weight amongst all the bitstrings z ∈ S such that there exists k ∈ {1, . . . , q} and (σ

• #" φ ) ∈ Φ Sn,d such that P k = P σ• #" φ ,z . Since x ∈ S, hw(x) ≥ 2. Since φ i is a non- constant polynomial for all i = 1, . . . , n, letting d i denote the degree of φ i , the monomial n i=1 T d i p σ(i) •x σ(i) i appears in P σ• #" φ ,x ( #" T ).
Hence, since q k=1 λ k • P k is the zero polynomial and λ k = 0 for all k, there exists another query P σ • #" φ ,x such that the monomial n i=1 T

d i p σ(i) •x σ(i) i
also appears in P σ • #" φ ,x . Hence hw(x ) ≥ hw(x). But x has maximum Hamming weight by assumption, so hw(x ) ≤ hw(x) and then hw(x ) = hw(x). We note that the degree in T i in this monomial is either 0, if x σ(i) = 0, or d i p σ(i) otherwise, where 1 ≤ d i ≤ d. But by definition of P σ • #" φ ,x , the possible degrees in T i in a monomial that appears in

P σ • #" φ ,x is either 0 if x σ (i) = 0 or a non-zero multiple l • p σ (i) of p σ (i) with 1 ≤ l ≤ d otherwise.
However, p 1 , . . . , p n are clearly coprime and d < p 1 < . . . < p n by assumption. Hence, for all i = 1, . . . , n such that x σ(i) = 1, we have, by Gauss's Lemma, p σ (i) = p σ(i) and x σ(i) = 1 implies x σ (i) = 1. Finally, since p σ (i) = p σ(i) implies σ (i) = σ (i) for all i such that x σ(i) = 1, and since they have both same Hamming weight, it implies that x = x and then to have such a linear combination, we need to use twice the same entry x ∈ S, which is not possible.

The linear independence property follows, and so does Lemma 6.2.5.

Other Applications to Related-Key Security

Here, we describe how our new framework can be used to build related-key secure pseudorandom functions for two other classes. The first class we address, in Section 6.2.3.1, is the class Φ d of degree at most d univariate polynomials. We use our framework to show that for any choice of weights, WNR is Φ d -related-key secure. The second class we address, in Section 6.2.3.2, is the class Φ n+1,multi-aff of non-constant affine multivariate functions. However, this construction is of limited interest and should only be seen as a first step towards building related-key secure pseudorandom functions for large classes of RKD functions. All the proofs of statements are detailed in Section 6.2.3.3.

Related-Key Security for Univariate Polynomials

Here, we apply our framework to WNR, for the class of RKD functions

Φ d = { #" φ : K → K | #" φ i : #" T → d j=0 α i,j • T j i , (α i,1 , . . . , α i,d ) = 0 d , ∀i = 0, . . .

, n}, for any choice of weights.

In what follows, we assume that w 0 = 0, but similar results can easily be proven if w 0 = 0.

In order to apply our framework to WNR and Φ d , we need to define associated algebraic fingerprint, helper function, collision-resistant hash function and expansion function. We define these as follows:

• [b] ∈ G denote the generator output by the setup procedure along with G and p

• #" Ω: #" a ∈ Z n p → ([a 1 ] , . . . , [a n ]) ∈ G n • Help Φ d : #" a ∈ Z n p → ([1] , [a 1 ] , . . . , a d 1 , . . . , [a n ] , . . . , a d n ) ∈ G nd+1
• h can be any collision-resistant hash function h:

{0, 1} n × G n → {0, 1} n-2 • E: z ∈ {0, 1} n-2 → 11 z ∈ {0, 1} n
We just need to prove that E satisfies the linear independence property required to apply the framework, which is done in Section 6.2.3.3, and then, using Theorem 6.2.3, we obtain the following lemma. Lemma 6.2.6. Let m = max(w 0 , . . . , w n ) be the maximum component of #"

w. Assuming md-DDHI holds in G and h is a collision-resistant hash function, the construction obtained with the above ingredients and Theorem 6.2.3 is a Φ d -related-key secure pseudorandom function.

Moreover, the running time of the reduction is polynomial in n, d, m, and in the running time of the adversary.

Related-Key Security for Affine Multivariate Functions

In order to deal with larger classes of related-key attacks, it would be important to consider multivariate RKD functions in which the attacker is allowed to mix different components of the secret key. In fact, the construction WNR d-lin given in the previous section seems like a plausible candidate if we assume that the RKD functions that are being applied to each sub-key are linearly independent. However we have not been able to prove or disprove this statement. We construct an alternative pseudorandom function that can be shown to be related-key secure against an adversary that can modify the key by applying functions from Φ n+1,multi-aff , defined as:

{(M , #" b ) | (M , #" b ) ∈ Z (n+1)×(n+1) p × Z n+1 p s.t. # " M i = 0 n+1 , ∀i = 0, . . . , n}
where # " M i denote the i-th row of M , for i = 0, . . . , n. Hence, for a key #" a = (a 0 , . . . ,

a n ) ∈ Z n+1 p , applying an RKD function (M , #" b ) ∈ Φ n+1,multi-aff , leads to the key M • #" a + #" b = ( # " M 0 • #" a + b 0 , . . . , # " M n • #" a + b n ) ∈ Z n+1 p .
Since the new construction is based on WNR with exponential weights w i = 2 i , it is of limited interest given that its security relies on an assumption whose input is of exponential size. Moreover, in settings in which it is acceptable to have security assumptions with exponential-size inputs, much simpler constructions are possible. Nevertheless, we still believe that the new construction provides a first small step towards building related-key secure pseudorandom functions for large classes of RKD functions such as multivariate affine functions or even multivariate polynomial functions.

To construct a Φ n+1,multi-aff -related-key secure pseudorandom function, we apply our framework to a particular case of WNR, defined as follows:

Exponential WNR. We define WNR exp as the particular case of WNR, where w i = 2 i , for i = 0, . . . , n. Please refer to Section 6.1.1.2 for details.

In order to apply our framework to WNR exp and Φ n+1,multi-aff , we need to define associated algebraic fingerprint, helper function, collision-resistant hash function and expansion function. We define these as follows:

• [b] ∈ G denote the generator output by the setup procedure along with G and p

• #" Ω: #" a ∈ Z n p → ([a 1 ] , . . . , [a n ]) ∈ G n • Help Φ n+1,multi-aff : #" a ∈ Z n p → ([1] , [a 1 ] , . . . , [a n ]) ∈ G n+1
• h can be any collision-resistant hash function h:

{0, 1} n × G n → {0, 1} n-2 • E: z ∈ {0, 1} n-2 → 11 z ∈ {0, 1} n
We just need to prove that E satisfies the linear independence property required to apply the framework, which is done in Section 6.2.3.3, and then, combining the above ingredients with Theorem 6.2.3, we obtain the following theorem. Theorem 6.2.7. Assuming 2 n+1 -DDHI holds in G and h is a collision-resistant hash function, the construction obtained with the above ingredients and Theorem 6.2.3 is a Φ n+1,multi-affrelated-key secure pseudorandom function.

Moreover, the running time of the reduction is polynomial in n, d, 2 n , and in the running time of the adversary. Remark 6.2.8. The above construction could be easily generalized to multivariate polynomial RKD functions of degree at most d, by properly changing the exponential sequence used in the construction to w i = (d + 1) i in order to guarantee that, for any two different values of x and x and any d i , d i ∈ {1, . . . , d} for i = 0, . . . , d, the sums w 0 d 0 + n i=1 w i d i x i and w 0 d 0 + n i=1 w i d i x i are distinct. We can then use exactly the same helper function than in Section 6.2.2.2.

Proof of

#" T ) = φ 0 ( #" T ) w 0 • n i=1 φ i ( #" T ) w i x i for #" φ ∈ Φ d and x ∈ {0, 1} n . Let S = {11 h | z ∈ {0, 1} n-2 }.
The only thing we need to prove is that, for any sequence (x 1 , #" φ 1 ), . . . , (x q , #" φ q ), polynomials 1, T j i for i = 0, . . . , n and j = 1, . . . , d and polynomials P #" φ 1 ,x 1 , . . . , P #" φ q ,xq are linearly independent, as long as x 1 , . . . , x q are distinct in S.

By contradiction, let us assume that there exists a sequence of distinct polynomials P 1 , . . . , P q , where for k = 1, . . . , q, P k = P #" φ ,x for distinct x ∈ S or P k = T j i for some (i, j) ∈ {0, . . . , n} × {1, . . . , d} or P k = 1, such that:

q k=1 λ k • P k = 0 with λ k = 0 for all k.
Since polynomials T j i , for i = 0, . . . , n and j = 1, . . . , d and polynomial 1 are clearly linearly independent over Z p , there is at least one polynomial P k in the above sum such that P k corresponds to P #" φ ,x for a query ( #" φ , x) with x ∈ S. We now consider an arbitrary monomial T z 0 0 • • • T zn n appearing in at least one of the polynomials in this combination and such that z has highest Hamming weight. It is clear that hw(z 1 . . . z n ) ≥ 2, since the Hamming weight of x ∈ S is at least 2. But, since the sum is the zero polynomial, there must exist at least two distinct polynomials P #" φ 1 ,x 1 and P #" φ 2 ,x 2 containing this monomial T z 0 0 • • • T zn n in the above sum. Let ẑ denote the n-bit string such that ẑi = 0 if z i = 0, while ẑi = 1 otherwise, for i = 1, . . . , n. It is clear that hw(ẑ) ≥ 2 and then ẑ ∈ S. Also, since ẑ has the highest possible Hamming weight, x 1 = x 2 = ẑ (from the definitions of P #" φ 1 ,x 1 and P #" φ 2 ,x 2 and since the first components of #" φ 1 and #" φ 2 , which are the polynomials that apply to A 0 , have degree at least 1). This means ẑ ∈ S has been used twice, which is forbidden. Hence, all the polynomials are linearly independent. The linear independence property follows.

For Multivariate Affine Functions.

Let P (M , #" b ),x ( #" T ) = ( # " M 0 • #" T +b 0 ) n i=1 ( # " M i • #" T +b i ) 2 i •x i for (M , #" b ) ∈ Φ n+1,multi-aff and x ∈ {0, 1} n , where # " M i denote the i-th row of matrix M . Let S = {11 h | z ∈ {0, 1} n-2 }.
The only thing we need to prove is that, for any sequence (x 1 , (M 1 , #" b 1 )), . . . , (x q , (M q , #" b q )) with, for k = 1, . . . , q, x k all distinct in S and (M k , #" b k ) ∈ Φ n+1,multi-aff , polynomials 1, T i for i = 0, . . . , n and polynomials P (M 1 , #" b 1 ),x 1 , . . . , P (M q , #" b q ),xq are linearly independent.

Polynomial 1 is a degree 0 polynomial and polynomials T i , for i = 0, . . . , n are degree 1 polynomials, and they are all linearly independent. Then, we just prove that for any ((M , #" b ), x) and ((M , #" b ), x ) with x, x ∈ S and x = x , the degrees of polynomials P (M , #" b ),x and P (M , #" b ),x are always distinct and greater than 2.

Let ((M ,

#" b ), x) with x ∈ S, then

P (M , #" b ),x ( #" T ) = ( # " M 0 • #" T + b 0 ) n i=1 ( # " M i • #" T + b i ) 2 i •x i . Since for any i = 0, . . . , n, # " M i = 0 n+1 , # " M i • #" T + b i is always a multivariate polynomial of degree 1, ( # " M i • #" T + b i ) 2 i
is always a polynomial of degree 2 i . Hence, P (M , #" b ),x ( #" T ) is a multivariate polynomial of degree n i=0 2 i x i , which is clearly greater than 2 since hw(x) ≥ 2 for any x ∈ S. Finally, since the entries x used in distinct queries has to be always distinct, and since for any x = x , n i=0 2 i x i = n i=0 2 i x i by the uniqueness of the binary decomposition, the degrees of polynomials P (M , #" b ),x and P (M , #" b ),x are always distinct and at least 2 for any queries ((M , #" b ), x) and ((M , #" b ), x ) with x, x ∈ S and x = x . The linear independence property follows.

Extension to Weaker Assumptions

One can easily extend part of the above results to k-Lin-based pseudorandom functions designing a more general framework and still using the LIP theorem. One just needs to be careful that the RKD functions do not mix the matrices that are components of the key, such that Condition 2 on page 71 is always satisfied. In particular, one cannot prove related-key security for multivariate affine functions or permutations, but the result for univariate polynomials can easily be extended to k-Lin. We do not detail more this possibility as it is rather immediate.

A Further Generalization of the Framework

While the above framework (Section 6.2.2.1) is already quite powerful, it makes a strong assumption about the form of the outputs of the pseudorandom functions, which prevents it to being applied for other forms of pseudorandom functions, contrarily to the frameworks proposed in Chapter 3. Nevertheless, the latter frameworks require the use of a strong key fingerprint. The existence of such a tool is not always clear. For instance, given #" w ∈ Z p ×(Z * p ) n , if w 0 = 0 or if there exists i ∈ {1, . . . , n} such that w i > 1, there is no practical strong key fingerprint for WNR #" w . Also, for any weight, it is not very clear that there exists a strong key-fingerprint for WBMR. Thus, it seems one cannot apply any of the frameworks given in Chapter 3 to WNR or WBMR, in general.

Therefore, in this section, we design a new and generalized framework, that generalizes in particular the frameworks given in Chapter 3 and does not make any specific assumption about the form of the output of the pseudorandom function. This generic framework encompasses in particular the framework we propose in Section 3.6 as well as the framework given above in Section 6.2.2.1 (using the the LIP theorem). However, the latter algebraic framework (Section 6.2.2.1) is significantly easier to use, which explains why we chose to give it first and propose this generic framework only as an extension, for completeness.

We introduce new notions, defined as follows, that extends the notions introduced in Section 6.2.2.

Perfectly Binding Key-Commitment. In order to overcome the lack of a strong key fingerprint, we introduce perfectly binding key-commitment. A perfectly binding key-commitment is a (deterministic) algorithm Com: K → ComSp that takes a key K ∈ K as input and outputs a value Com(K) such that for any K, K in K, we have Com(K) = Com(K ) if and only if K = K (perfectly binding). As we will see later, we also want that for K ∈ K, Com(K) hides the value of K. However, we do not need special requirement for this in the present definition, since this requirement will be implied by the extended definitions of the key-collision and unique-input-related-key pseudorandom function security notions, defined below.

Helper Information. In order to prove the security of our framework, we need to be able to compute commitments of any related key from some (public) information. Then, we enable the adversary to have access to some helper information help Φ = Help Φ (K) ∈ HelpSp about the secret K, where Help Φ is a function from K to HelpSp. The helper function Help Φ depends on the class Φ of RKD functions we are interested in. We suppose that it is possible to compute Com(φ(K)) just by knowing φ and Help Φ (K) but not K.

Then, we use the extended version of the key-collision and unique-input-rka-prf security games depicted in Figure 6.3 and Figure 6.4, where Initialize also leaks help Φ to the adversary. We remark that unique-input-related-key pseudorandom function security implies that help Φ hides K, otherwise it would be trivial to win the game defining this security notion. This directly implies that the commitment of K is hiding, since it can be computed from help Φ . Remark 6.2.9. We do not need a statistical-key-collision security notion, because it is implied by the extended key-collision security. The compatibility of the hash function is also simplified. We just require that it is a collision-resistant hash function and that its range S is such that the extended (S, Φ)-unique-input-related-key pseudorandom function security holds. proc Initialize

proc Initialize pp $ ← M.Setup(1 κ ) K $ ← K help Φ ← Help Φ (K) Return (pp, help Φ ) proc RKFn(φ, x) y ← M.Eval pp (φ(K), x) Return y proc Finalize(φ 1 , φ 2 ) Return (φ 1 = φ 2 and φ 1 (K) = φ 2 (K))
K $ ← K ; b $ ← {0, 1} help Φ ← Help Φ (K) Return help Φ proc Finalize(b ) Return b = b proc RKFn(φ, x) If x ∈ S then If b = 0 then y ← M (φ(K), x) Else y $ ← R Else y ←⊥ Return y
F.Eval pp (K, x) := M.Eval pp (K, H(x, M.Eval pp (K, Com(K))))
for all K ∈ K and x ∈ D.

Then, assuming M is an (S, Φ)-unique-input-related-key secure pseudorandom function and is extended Φ-key-collision secure, and H is a collision-resistant hash function, then F is a Φ-related-key secure pseudorandom function.

Proof Overview. The proof of the above theorem is detailed below and relies on the sequence of 10 games (games G 0 -G 9 ) described in Figure 6.5. It is very similar to the proof other frameworks. Here we provide a brief overview. Since the RKD functions that we consider in our case may have claws, we start by dealing with possible collisions on the related keys in the RKPRFReal F case, using the extended key-collision notion (games G 0 -G 2 ). These claws can be detected by looking for collisions of perfectly binding key-commitments for different RKD functions. Then, in games G 3 -G 4 , we deal with possible collisions on hash values in order to ensure that the hash values h = H(x, Com(K)) used to compute the output y are distinct. Then, we use the new extended (S, Φ)-unique-input-related-key pseudorandom function security notion to show that it is hard to distinguish the output of F from a uniformly random output (games G 5 -G 6 ). Finally, we use once again the extended key-collision security notion to deal with possible key collisions in the RKPRFRand F case (games G 7 -G 9 ) so that G 9 matches the description of the RKPRFRand F Game. These key collisions can still be detected in these games by making crucial use of the helper function.

Proof of Theorem 6.2.10. The proof is based on the sequence of games in Figure 6.5. Much of the proof is similar to the proof of previously introduced frameworks. We denote by Succ i the event that game G i output takes the value 1. Boolean flags are assumed initialized to false. Games G i , G j are said to be identical until flag if their code differs only in statements that follow the setting of flag to true. Let A be an adversary against the Φ-related-key security of F . We assume without loss of generality that adversary A never repeats an oracle query.

G 0 matches the description of the RKPRFReal F game, so: Game G 2 adds the boxed code which changes how the repetition of a commitment value com is handled, by picking instead a random value from ComSp\E that will not repeat any previous one. Games G 1 and G 2 are identical until flag 1 is set to true, hence we have where E 1 denotes the event that the execution of A with game G 1 sets flag 1 to true. We design an adversary D attacking the extended Φ-key-collision security of M such that

Pr [ Succ 0 ] = Pr RKPRFReal A F ⇒ 1 . Game G 1 introduces
Pr [ Succ 1 ] ≤ Pr [ Succ 2 ] + Pr [ E 1 ] , proc Initialize / / G 0 K $ ← K proc RKFn(φ, x) / / G 0 com ← Com(φ(K)) h ← H(x, com) y ← M (φ(K), h) Return y proc Finalize(b') / / All Games Return b proc Initialize / / G 1 , G 2 K $ ← K ; D ← ∅ ; E ← ∅ proc RKFn(φ, x) / / G 1 , G 2 com ← Com(φ(K)) If com ∈ E and φ / ∈ D then flag 1 ← true ; com $ ← ComSp\E D ← D ∪ {φ} ; E ← E ∪ {com} h ← H(x, com) y ← M (φ(K), h) Return y proc Initialize / / G 3 , G 4 K $ ← K ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn(φ, x) / / G 3 , G 4 com ← Com(φ(K)) If com ∈ E and φ / ∈ D then com $ ← ComSp\E D ← D ∪ {φ} ; E ← E ∪ {com} h ← H(x, com) If h ∈ G then flag 2 ← true h $ ← S\G G ← G ∪ {r} y ← M (φ(K), h) Return y proc Initialize / / G 5 K $ ← K ; D ← ∅ ; E ← ∅ ; G ← ∅ proc RKFn(φ, x) / / G 5 com ← Com(φ(K)) If com ∈ E and φ / ∈ D then com $ ← ComSp\E D ← D ∪ {φ} ; E ← E ∪ {com} h ← H(x, com) If h ∈ G then h $ ← S\G G ← G ∪ {r} y $ ← R Return y proc Initialize / / G 6 K $ ← K ; D ← ∅ ; E ← ∅ G $ ← Fun(K, D, R) proc RKFn(φ, x) / / G 6 y $ ← R Return y proc Initialize / / G 7 , G 8 K $ ← K ; D ← ∅ ; E ← ∅ G $ ← Fun(K, D,
Pr [ E 1 ] ≤ Adv ext-kc Φ,M (D)
. Adversary D gets helper information help Φ = Help Φ (K), then runs A . When the latter makes an RKFn-query (φ, x), adversary D computes com = Com(φ(K)) using its helper information and then h = H(x, com) and finally queries (φ, h) to its oracle and sends the value it gets to A . When A halts, D searches for two different RKD functions φ queried by A that lead to the same commitment value com and returns these two functions if found.

Since Com is a perfectly binding key-commitment, two such functions lead to the same key, so D wins if he finds such two functions.

Game G 3 introduces the storage of hash values in a set G and sets flag 2 to true if the same hash output arises twice. Since this storage does not affect the values returned by RKFn, we have Pr [

Succ 3 ] = Pr [ Succ 2 ] .
Game G 4 adds the boxed code which changes how repetition of hash values is handled, by picking instead a random value h from S\G that will not repeat any previously used hash value. Games G 3 and G 4 are identical until flag 2 is set to true, hence we have

Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Pr [ E 2 ] ,
where E 2 denotes the event that the execution of A with game G 3 sets flag 2 to true. We design an adversary C attacking the cr-security of H such that

Pr [ E 2 ] ≤ Adv cr H (C ) . Adversary C starts by picking K $ ← K and initializes j ← 0. It runs A . When the latter makes an RKFn-query (φ, x), adversary C responds via B sets G ← G ∪ {h}, makes the query (φ, h) to its oracle, and returns the value it gets, which is either M (φ(K), h) or a uniformly random value, to A . When A halts, B halts with the same output. It follows from these observations that B is a unique-input adversary for queries in S. Finally, it is clear that if B's oracle gives real outputs of M for queries in S, then it simulates exactly game G 4 and if B's oracle gives uniformly random values for queries in S, then it simulates exactly game G 5 .

com ← Com(φ(K)) j ← j + 1 ; φ j ← φ ; x j ← x If com ∈ E and φ / ∈ D then com $ ← ComSp\E ( * ) D ← D ∪ {φ} ; E ← E ∪ {com} com j ← com h ← H(x, com) h j ← h y ← M (φ(K), h) Return y.
In game G 6 , we simply set the value y to a uniformly random value. Clearly, G 5 and G 6 are identical since the value returned is a uniformly random value for any query. Then, we have Pr [

Succ 5 ] = Pr [ Succ 6 ] .
In game G 7 , we check if two different queries can lead to a key collision. Since the "If" test ensures that the returned value is still uniformly random over R even when two different queries result in the same key, games G 6 and G 7 are identical. Hence,

Pr [ Succ 6 ] = Pr [ Succ 7 ] .
In game G 8 , we compute the output of RKFn using a random function G in Fun(K, D, R).

Since games G 7 and G 8 are identical until flag 3 is set to true, we have

Pr [ Succ 7 ] ≤ Pr [ Succ 8 ] + Pr [ E 3 ] ,
where E 3 denotes the event that the execution of A with game G 8 sets flag 3 to true. To bound the probability of event E 3 , we design an adversary D attacking extended Φ-key-collision security of M such that Pr [ E 3 ] ≤ Adv ext-kc Φ,M (D) . Adversary D starts by initializing a list L ← empty list and by choosing an element ψ in Φ and by setting ψ 1 ← ψ and ψ 2 ← ψ. Then, it runs A . When the latter makes an RKFn-query (φ, x), adversary D does the following: it first computes com ← Com(φ(K)) using its helper information and searches for all tuples (φ i , com i ) ∈ L such that com i = com. If it does find such tuples, it checks for all of them if φ = φ and in that case sets ψ 1 ← φ and ψ 2 ← φ. Finally, D picks y $ ← R at random, returns y to A and adds (φ, com) to L. When A halts, B halts and outputs (ψ 1 , ψ 2 ). If the execution of A sets flag 3 to true, then A has queried φ 1 = φ 2 such that φ 1 (K) = φ 2 (K) and assuming it has first queried φ 1 , when D computes Com(φ 2 (K)) and checks if this value is already in L, it finds that this value matches Com(φ 1 (K)) and since φ 1 = φ 2 , it sets ψ 1 = φ 1 and ψ 2 = φ 2 , so D wins. Then, we have

Pr [ E 3 ] ≤ Adv ext-kc Φ,M (D) . Since A does not repeat oracle queries and since key collisions are dealt with in a similar way, it follows that games G 8 and G 9 are identical. Thus,

Pr [ Succ 8 ] = Pr [ Succ 9 ] .
Finally, G 9 matches the description of the RKPRFRand F game, so: Pr [ Succ 9 ] = Pr RKPRFRand A F ⇒ 1 . Theorem 6.2.10 now follows by combining the bounds arising in the different game hops.

Applications to Aggregate Pseudorandom Functions

In this section, we show that for all constructions proposed in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF], one can prove the aggregate pseudorandom function security with a polynomial-time reduction, while proofs proposed in this seminal paper suffered from an exponential (in the input size) overhead in the running time of the reduction. Moreover, our reductions are almost straightforward via the PLP theorem.

A first attempt to solve the issue of the exponential time of the original reductions was done in [START_REF] Cohen | Multilinear Pseudorandom Functions[END_REF]. By introducing multilinear pseudorandom functions and giving a particular instantiation, Cohen and Holmgren showed that one can prove the aggregate pseudorandom function security of NR with a polynomial-time reduction for hypercubes and decision trees aggregation. However, their technique does not extend to the more general case of read-once formulas aggregation. Also, as we show in what follows, their construction can be seen as a particular case of our main theorem, and then can be proven secure very easily using our result.

Here, we provide a polynomial-time reduction for the general case of read-once formulas. This implies in particular the previous results on hypercubes and decision trees which are particular cases of read-once formulas.

Intuitively, if we consider the PLP security for k = 1 and aggregation with the Naor-Reingold pseudorandom function, our PLP theorem (Theorem 5.2.2) implicitly says that as long as the aggregate values can be computed as a group element whose discrete logarithm is the evaluation of a multivariate polynomial on the key, then, if the corresponding polynomials have a small representation, the PLP theorem guarantees the security (with a polynomial-time reduction), even if the number of points aggregated is super-polynomial. Please notice that if these polynomials do not have any small representation (e.g. the smallest representation is exponential in the input size), then there is no point of considering such aggregation, since the whole point of aggregate pseudorandom function lies in the possibility of aggregating super-polynomially many outputs with a very efficient computation.

Read-Once Formula Aggregation

Read-Once Formulas. A read-once formula is a circuit on x = (x 1 , . . . , x n ) ∈ {0, 1} n composed of only AND, OR and NOT gates with fan-out 1, so that each input literal is fed into at most one gate and each gate output is fed into at most one other gate. We denote by ROF n the family of all read-once boolean formulas over x 1 , . . . , x n variables. In order to ease the reading, we restrict these circuits to be in a standard form, so that they are composed of fan-in 2 and fan-out 1 AND and OR gates, and NOT gates occurring only at the inputs. This common restriction can be done without loss of generality. Hence, one can see such a circuit as a binary tree where each leaf is labeled by a variable x i or its negation xi and where each internal node has a label C and has two children with labels C L and C R and represents either an AND or an OR gate (with fan-in 2). We identify a formula (and the set it represents) with the label of its root C φ .

Aggregation for Read-Once Formulas. We recall the definition of read-once formula aggregation used in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF]. For the sake of simplicity, we only consider the case of the Naor-Reingold pseudorandom function. We define the aggregation function for read-once formulas of length n as follows.

Chapter 6

Applications to Aggregate Pseudorandom Functions 107

The collection S rof ⊆ {0, 1} n corresponds to all the subsets of S ⊆ {0, 1} n such that there exists a read-once formula

C φ ∈ ROF n such that S = {x ∈ {0, 1} n | C φ (x) = 1}.
The aggregation function Γ rof is defined as the product (assuming the group is a multiplicative group) of the values on such a subset. Hence, we have:

AGG NR,S rof ,Γ rof (C φ ) = x|C φ (x)=1 a 0 n i=1 a x i i =   a 0 x|C φ (x)=1 n i=1 a x i i   = a 0 • A C φ ,1 ( #" a ) ,
• If C is a literal for variable x i , then A C,1 = T i and A C,0 = 1 if C = x i ; and A C,1 = 1 and A C,0 = T i if C = xi ;
• If C is an AND gate with C L and C R its two children, then we have:

A C,1 = A C L ,1 • A C R ,1 A C,0 = A C L ,0 • A C R ,0 + A C L ,1 • A C R ,0 + A C L ,0 • A C R ,1 ;
• If C is an OR gate with C L and C R its two children, then we have:

A C,1 = A C L ,1 • A C R ,1 + A C L ,1 • A C R ,0 + A C L ,0 • A C R ,1 A C,0 = A C L ,0 • A C R ,0 .
Now we have introduced everything, we can prove that NR (or more general constructions) is an (S rof , Γ rof )-aggregate pseudorandom function under the standard DDH assumption, as stated in the lemma below. Moreover, the running time of the reduction is polynomial in n and in the running time of the adversary.

The proof is straightforward using the PLP theorem: all queries in the security game for the aggregate PRF can be seen as a queries of the form Pl(P ) for some polynomial P with a small representation: Fn(x) returns Pl(T 0 n i=1 T x i i ) and AGG(C φ ) returns Pl(T 0 • A C φ ,1 ( #" T )). Details are given below.

Proof of Lemma 6.3.1. Let A be an adversary against the (S rof , Γ rof )-aggregate pseudorandom function security of NR that makes q oracle queries. We design an adversary B against the (n, 1, 1)-PLP security in G as follows, where we denote by a 1 , . . . , a n and a 0 = b the secret values chosen at random in the Initialize procedure of the game defining the (n, 1, 1)-PLP security (it corresponds to A 1 , . . . , A n and B but since k = 1, these values are simply scalars in Z p ).

B runs A . The latter can make two types of queries, so let us first describe how B responds to both these types of queries. The first type consists in standard PRF queries. When adversary A makes a query x, then B makes the query P x = n i=1 T x i i and returns the value it gets to A . The second type of queries consists in aggregate PRF values. When A makes an aggregate query C φ ∈ ROF l , for some l ≤ n, the adversary B computes

A C φ ,1 (
#" T ) using the efficient recursive evaluation, as described in Section 6.3, then queries this polynomial P C φ = A C φ ,1 ( #" T ), and returns the value it gets to A . As A C φ ,1 ( #" T ) is a multivariate polynomial in T 1 , . . . , T l with degree at most 1 in any indeterminate (since it is a sum of such multivariate polynomials), clearly, P C φ is a multivariate polynomial with degree at most 1 in any indeterminate.

The only thing we need to prove is that B simulates correctly either AGGPRFReal . On the other hand, if B's oracle responds to a query P by random values computed taking into account related between P and previously queried polynomials, then the values A gets are statistically indistinguishable from the values it would get from the AGGPRFRand NR oracles. Indeed, the only difference lies in the fact that any value sent to A is random if the corresponding polynomial is linearly independent from previous queries, or is computed from previous values if the corresponding polynomial is linearly dependent, but these dependence are tested using a statistical procedure (which is correct with probability at least p-1 p ) while in AGGPRFRand NR , no error can occur. Hence, in the first case, B simulates perfectly AGGPRFReal NR , while in the second game, the simulation is statistically indistinguishable from AGGPRFRand NR . Thus, we have shown that

Adv agg-prf NR,S rof ,Γ rof (A ) ≤ p p -1 • Adv (n,1,1)-plp G (B)
and Lemma 6.3.1 now follows from the PLP theorem.

Impossibility Results

Impossibility Result for CNF (Conjunctive Normal Form) and DNF (Disjunctive Normal Form) Formulas. In [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF], the authors show that, unless NP=BPP, there does not exist an (S, Γ)-aggregate pseudorandom function 1 , with D = {0, 1} n , S containing the following sets:

S φ = {x ∈ {0, 1} n | φ(x) = 1}
with φ a CNF formula with n-bit input, and Γ a "reasonable" aggregate function, e.g., Γ rof (assuming R is a cyclic group G of prime order p). The proof consists in showing that if such aggregate pseudorandom function exists, then we can solve SAT in polynomial time. More precisely, given a SAT instance, i.e., a CNF formula φ, we can compute AGG(φ). If φ is not satisfiable, AGG(φ) = 1 ∈ G, while otherwise AGG(φ) = x∈{0,1} n , φ(x)=1 F (K, x). This latter value is not 1 with high probability, otherwise we would get a non-uniform distinguisher against aggregate pseudorandomness.

The case of DNF formulas (or more generally of any class for which satisfiability is tractable) was left as an important open problem in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF]. Here, we show that unless NP=BPP, there also does not exist an (S, Γ)-aggregate pseudorandom function as above, when S contains S φ for any DNF (instead of CNF) formula φ with n-bit input. For that, we first remark that the formula , always true, is a DNF formula (it is the disjunction of all the possible literals), and that the negation φ of a CNF formula φ is a DNF formula. Then, given a SAT instance, a CNF formula φ, we compute AGG( φ) and AGG( ). If φ is not satisfiable, φ is always true and AGG( φ) = AGG( ), while otherwise, AGG( φ) = AGG( )/ x∈{0,1} n , φ(x)=1 F (K, x). This latter value is not AGG( ) with high probability, otherwise we would get a non-uniform distinguisher against aggregate pseudorandomness.

Extension to Weaker Assumptions

One can easily extend this result for k-Lin-based pseudorandom functions using our main theorem. Also, one can easily use our PLP theorem (Theorem 5.2.2) to prove the security for any aggregate as soon as the aggregate values can be represented as group elements whose discrete logarithms are the evaluation of a (multivariate) polynomial on the key (and that this polynomial is efficiently computable). We do not detail further this as it is immediate.

Applications to Multilinear Pseudorandom Functions

To conclude this chapter, we explain how the PLP theorem can be used to prove directly the security of multilinear pseudorandom functions.

Cohen-Holmgren Construction

We first explain how to proof the security of CH. Please refer to Section 2.3.4.2 for the definition of this construction. Using the PLP theorem, one can easily obtain the following lemma. Moreover, the running time of the reduction is polynomial in n, in the dimension of the vector spaces, and in the running time of the adversary.

The proof is rather immediate. We give an informal proof below.

Proof of Lemma 6.4.1. Let #" T = (T 1,1 , . . . , T 1, 1 , . . . , T n,1 , . . . , T n, n ) be a vector of indeterminates, and let #" T i = (T i,1 , . . . , T i, i ). The PLP theorem shows that CH( #" a 1 , . . . , # " a n , # " x 1 , . . . , # "

x n ) (using a random key #" a ) is computationally indistinguishable from

U n i=1 #" T i , #" x i = [f ( # " x 1 , . . . , # " x n )] with U $ ← L(Z p [ #" T ] ≤1 , Z p ) and f : Z 1 p × • • • × Z n p → Z p ( # " x 1 , . . . , # " x n ) → U ( n i=1 #" T i , #" x i ) .
To conclude, we just need to prove that f is a random n-linear function in L(Z 1 p ⊗• • •⊗Z n p , Z p ). For that purpose, let us introduce the following n-linear application:

ψ : Z 1 p × • • • × Z n p → Z p [ #" T ] ≤1 ( # " x 1 , . . . , # " x n ) → n i=1 #" T i , #" x i .
We remark that f is the composition of U and ψ: f = U • ψ. Furthermore, if we write # " e i, = (0, . . . , 0, 1, 0, . . . , 0) the i-th vector of the canonical base of Z p , then:

ψ( # " e i 1 , 1 , . . . , # " e in, n ) = T 1,i 1 • • • T n,in ; and as the monomials T 1,i 1 • • • T n,in are linearly independent, ψ is injective. Since f = U • ψ and U $ ← L(Z p [ #" T ] ≤1 , Z p ), the function f is a uniform random linear function from L(Z 1 p ⊗ • • • ⊗ Z n p , Z p )
. This is exactly what we wanted to show.

Symmetric Multilinear Pseudorandom Functions

In [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF], constructing symmetric multilinear pseudorandom functions was left as an open problem. The definition of this notion is the same as the notion of multilinear pseudorandom function, except that we only require the function to be indistinguishable from a random symmetric multilinear function. In that case, we suppose that 1 = • • • = n = , i.e., all the vectors # " x 1 , . . . , # "

x n have the same size . The authors wrote in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF] that the natural modification of the CH construction to obtain a symmetric construction consisting in setting #"

a 1 = #" a 2 = • • • = # "
a n (simply denoted #" a in what follows) leads to a symmetric multilinear pseudorandom function whose security is less clear, but claimed that it holds under the E 1,n -MDDH assumption (which is exactly the n-DDHI assumption), when = | #" a | = 2. We show that this construction is actually secure under the same assumption for any = | #" a | ≥ 2 as stated in the following lemma, whose proof is almost the same as the proof of Lemma 6. Moreover, the running time of the reduction is polynomial in n, , and in the running time of the adversary.

Proof of Lemma 6.4.2. Let A be an adversary against the symmetric multilinear pseudorandom function security of CH sym that makes q oracle queries. We design an adversary B against the ( , 1, n)-PLP security in G as follows, where we denote by a 1 , . . . , a and b the secret values chosen at random in the Initialize procedure of the game defining the ( , 1, n)-PLP security (it corresponds to A 1 , . . . , A and B but since k = 1, these values are simply scalars in Z p ). B runs A . When the latter makes a query #" x = ( # "

x 1 , . . . , # "

x n ) where #" x i ∈ Z l i p , B does the following. First, it starts by computing P #" x = n i=1 #" T , #"

x i , where #" T = (T 1 , . . . , T ) is a vector of indeterminates. Hence, it computes a multivariate polynomial in Z p [T 1 , . . . , T ] with degree at most n in any indeterminate.

Afterwards, B queries P #" x to its oracle and sends the value it gets to A . Hence, on the one hand, if B's oracle outputs [P #" x (a 1 , . . . , a ) • b], then the value A gets is exactly the evaluation of CH sym in #" x with the key #" a ∈ Z p and with the generator [b] (which is a generator as soon as b = 0). On the other hand, if B's oracle responds to a query P by random values computed taking into account the linear relations between P and the previously queried polynomials, then the values A gets are statistically indistinguishable from the values it would get from the symmetric MPRFRand oracle, as this is exactly how the values output by the symmetric MPRFRand oracle are computed in order to obtain a polynomial-time simulation.

Hence, we have shown that

Adv mprf CHsym (A ) ≤ p p -1 • Adv ( ,1,n)-plp G (B)
and Lemma 6.4.1 now follows from the PLP theorem (Theorem 5.2.2) and from the fact that the E 1,n -MDDH is implied by the n-DDHI assumption.

Skew-Symmetric Multilinear Pseudorandom Function

In [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF], the author left as an open problem the construction of a skew-symmetric multilinear pseudorandom function. The definition of this notion is the same as the notion of multilinear pseudorandom function, except that we only require the function to be indistinguishable from a random skew-symmetric multilinear function. We assume that

1 = • • • = n = = n, i.
e., all the vectors # " x 1 , . . . , # "

x n have the same size = n. We need = n because there is no skew-symmetric n-multilinear map from Z p n to Z p , when < n.

We know that any skew-symmetric n-multilinear map f is of the form:

f ( # " x 1 , . . . , # " x n ) = c • det( # " x 1 , . . . , # " x n ),
with c being a scalar in Z p and det being the determinant function. Therefore, the function

F (a, ( # " x 1 , . . . , # " x n )) = [a • det( # " x 1 , . . . , # " x n )]
is a skew-symmetric multilinear pseudorandom function with key a ∈ Z p . The proof is trivial since, ( # " x 1 , . . . , # "

x n ) → F (a, ( # " x 1 , . . . , # "

x n )) is actually a random skewsymmetric n-multilinear map when a is a random scalar in Z p . No assumption is required. Our analysis shows that skew-symmetric multilinear pseudorandom functions are of limited interest, but our construction still solves an interesting open problem in [START_REF] Cohen | Aggregate Pseudorandom Functions and Connections to Learning[END_REF].

Extension to Weaker Assumptions

As for related-key secure pseudorandom functions and aggregate pseudorandom functions, it is very easy to build multilinear pseudorandom functions under k-Lin and to prove their security applying our PLP theorem (Theorem 5.2.2), for instance using the same construction but changing the key components from elements in Z p to elements in Z k×k p while keeping the same inputs space, and by defining #" A, #" x = i=1 x i • A i , with #" A = (A 1 , . . . , A ) ∈ (Z k×k p ) and x = (x 1 , . . . , x ) ∈ Z p . This leads to the following construction, where F.Setup outputs (p, G, g) and dimensions 1 , . . . , n , and where the outputs are computed via:

F.Eval pp : Z 1 p × • • • × Z n p → G k×m ( # " x 1 , . . . , # " x n ) → ( n i=1 # " A i , #" x i ) • B with ( # " A 1 , . . . , # " A n ) ∈ (Z k×k p ) 1 × • • • × (Z k×k p
) n and B ∈ Z k×m p . Once again, such a result is immediate and we do not provide further details.

Additional Material

Most of the definitions required for this chapter have already been provided in Chapters 2 and 3, especially definitions of multilinear maps and of the multilinear map model. Please refer to this chapter if necessary. Here, we only recall the definition of the class of XOR relations and provide some conventions and additional material.

Related-Key Security for XOR Relations

XOR Relations. Consider a key space K = {0, 1} k for some integer k ≥ κ. We define the class of XOR relations Φ ⊕ as the following set of functions:

Φ ⊕ = {φ s : K ∈ {0, 1} k → K ⊕ s ∈ {0, 1} k | s ∈ {0, 1} k } ,
and say that a pseudorandom function F is XOR-related-key secure if it is a Φ ⊕ -related-key secure pseudorandom function (see Definition 3.1.1 for details).

Multilinear Maps

Conventions. In order to ease the reading, we adopt the following conventions in the rest of this chapter:

• Scalars are noted with lowercase letter, e.g., a, b, . . .

• Encodings are noted either as their encoding at index set S, [a] S or simply with a hat, when the index set is clear from the context, e.g., â, b, . . . In particular, â is an encoding of the scalar a.

• Index sets and formal variables are noted with uppercase letters, e.g., X, S, S , . . . .

• We denote by S 1 • S 2 the union of sets S 1 and S 2 . This notation implicitly assumes that the two sets are disjoint. If S 1 is an element, then S 1 • S 2 stands for {S 1 } • S 2 .

• The top-level index set is refered as U .

We also naturally extend these notations when clear from the context, so for instance â + b = MM.Add(mm.pp, â, b) and â • b = MM.Mult(mm.pp, â, b).

Variant of the Multilinear Map Model.

In order to ease the reading, we actually use a slightly different and more intuitive characterization of the generic multilinear map oracle (defined in Section 2.4.2) in our proofs. Informally, instead of considering queries to MM.ZeroTest as nonces, we consider these as formal polynomials (that can be computed easily), whose formal variables are substituted with their join value distribution from the real game. In our construction, formal variables are âi,b , ĉj,b , ẑi 1 ,i Eventually, this error term becomes too big and the MM.ZeroTest can no longer recover the correct answer. This noise implicitly restricts the number of operations that can be performed. Intuitively, in current constructions, the errors are added when performing an addition and multiplied when performing a multiplication. However, the fact that current instantiations are noisy does not pose any problem regarding our construction, as the number of operations for evaluating our pseudorandom function is fixed and well defined.

Straddling Sets

Our construction and its proofs use straddling sets, as described by Barak et al. in [BGK+14], in order to prevent the adversary from mixing too many encodings and creating encodings of zero. We recall their definition below. We first recall that, for a set S , we say that {S 1 , . . . , S k }, for some integer k, is a partition of S , if and only if ∪ k i=1 S i = S , S i = ∅ and S i ∩ S j = ∅, for any 1 ≤ i, j ≤ k, i = j. Definition 7.1.1 (Straddling Set System). For k ∈ N, a k-straddling set system over a set S consists of two partitions S 0 = {S 0,1 , . . . , S 0,k } and S 1 = {S 1,1 , . . . , S 1,k } of S such that the following holds: for any T ⊆ S , if T 0 , T 1 are distinct subsequences of S 0,1 , . . . , S 0,k , S 1,1 , . . . , S 1,k such that T 0 and T 1 are partitions of T , then T = S and T 0 = S b and T 1 = S 1-b for some b ∈ {0, 1}.

Intuitively, this implies that the only two solutions to build a partition of S from combining sets in S 0 or S 1 are to use either every element in S 0 or every element in S 1 . This construction naturally extends to any set with 2k -1 elements.

The proof is immediate and thus not detailed here. Please refer to [START_REF] Barak | Protecting Obfuscation against Algebraic Attacks[END_REF] or [START_REF] Zimmerman | How to Obfuscate Programs Directly[END_REF] for details.

Our Construction

Let us now describe our construction of an XOR-related-key secure pseudorandom function, for security parameter κ, key space K = {0, 1} k , with k = 2κ, and domain D = {0, 1} n for some integer n.

Intuition

The main idea behind our construction is very natural. The starting point is the Naor-Reingold pseudorandom function, whose evaluation function is defined as NR.Eval pp : ( #" a , x) ∈

Z 2n p × {0, 1} n → [ n i=1 a i,x i ],
where #" a is the secret key. As we are interested in XOR relations, we want the key to be a bitstring. A simple solution is to tweak this construction by considering the evaluation f #" a , #" c : (

K, x) ∈ {0, 1} k × {0, 1} n → k i=1 a i,K i • n j=1 c i,x i , with #" a ∈ Z k p and #" c ∈ Z n p .
It is easy to see that without knowing #" a nor #" c , the outputs of this function are computationally indistinguishable from random (they correspond to NR evaluations with key ( #" a , #" c ) and on input (K, x)). However, given a key K ∈ {0, 1} k , one needs the values #" a , #" c in order to be able to evaluate this function, so these values need to be made public. Then, it becomes very easy, even without knowing K, to distinguish this function from a random one.

Therefore, our idea is to use a multilinear map: this allows us to publicly reveal lowlevel encodings of elements in #" a and #" c . These encodings let anyone evaluate the function on any key K and any input x, while keeping the outputs of the function computationally indistinguishable from random to an adversary that does not know the secret key K.

F.Eval pp (K, x) =   k i=1 a i,K i n j=1 c j,x i   U , with public parameters pp including {â i,b } i∈[k],b∈{0,1} and {ĉ j,b } j∈[n],b∈{0,1}
as well as the public parameters of the multilinear map.

This construction can be easily proven to be an XOR-related-key secure pseudorandom function in the generic multilinear map model, and it is also easy to show that it does not let an adversary create encodings of zero. However, it seems very hard to prove that this construction is secure under a non-interactive assumption. Hence, we slightly modify this construction by using a more complex set of indices and straddling sets. While this makes the proof in the generic multilinear map model a bit harder, this allows us to prove the security of our construction under non-interactive assumptions, whose hardness seems plausible even with current instantiations of multilinear maps. In particular, we prove in Sections 7.5 and 7.6 that these assumptions are secure in the generic multilinear map model and do not let an adversary generate (non-trivial) encodings of zero.

Actual Construction

We define our pseudorandom function F = (F.Setup, F.Eval) as follows.

Index set. First, similarly to [START_REF] Zimmerman | How to Obfuscate Programs Directly[END_REF], for each i ∈ {0, . . . , k}, we construct a k-straddling set system over a set S i of 2k -1 fresh formal symbols. We denote by S i,b the two partitions forming each of this straddling set, for b ∈ {0, 1}, and by S i,b,j their elements, for 1 ≤ j ≤ k. We also define:

BitCommit i,b = S i,b,i BitFill i 1 ,i 2 ,b 1 ,b 2 = S i 1 ,b 1 ,i 2 • S i 2 ,b 2 ,i 1
for any i, i 1 , i 2 ∈ {1, . . . , k} and b, b 1 , b 2 ∈ {0, 1}. Intuitively, the straddling set systems S i for i ≥ 1 play the same role as in [START_REF] Zimmerman | How to Obfuscate Programs Directly[END_REF] (preventing the adversary from mixing an exponential Chapter 7

7.2 Our Construction 117 number of inputs), while S 0 is used in the proof to prevent the adversary from mixing the private representation of the key from the parameters. Let X j be fresh formal symbols for j ∈ {1, . . . , n}. We then define the top-level index set as follows:

U = k i=0 S i n j=1 X j .
Setup. The algorithm F.Setup first generates the parameters (mm.pp, mm.sp, p) for the multilinear map by running MM.Setup(1 κ , U ). Then it generates the following elements:

a i,b $ ← Z p for i ∈ {1, . . . , k} and b ∈ {0, 1} âi,b ← [a i,b ] S 0,0,i BitCommit i,b for i ∈ {1, . . . , k} and b ∈ {0, 1} c j,b $ ← Z p for j ∈ {1, . . . , n} and b ∈ {0, 1} ĉj,b ← [c i,b ] X i for j ∈ {1, . . . , n} and b ∈ {0, 1} ẑi 1 ,i 2 ,b 1 ,b 2 ← [1] BitFill i 1 ,i 2 ,b 1 ,b 2 for i 1 , i 2 ∈ {1, . . . , k} and b 1 , b 2 ∈ {0, 1} with i 1 < i 2 ,
and outputs the following parameters:

pp = mm.pp, (â i,b ) i,b , (ĉ j,b ) j,b , (ẑ i 1 ,i 2 ,b 1 ,b 2 ) i 1 ,i 2 ,b 1 ,b 2 .
Intuitively, BitCommit i,b = S i,b,i is associated to the (public) encoding used to evaluate the function if the i-th bit of the key is b. By definition of a straddling set, the only way to reach the top-level U , which contains S i , once we have used an encoding with index S i,b,i is to use every index S i,b,j with j = i. These is done by multiplying the terms ẑi,j,K i ,K j . Therefore, using K i = b is like "committing" to the partition S i,b of S i , and terms ẑi,j,K i ,K j are then used to "fill" this partition. Remark 7.2.1. For the sake of simplicity, we set ẑi 1 ,i 2 ,b 1 ,b 2 to be encodings of 1, but one could also simply set it to encodings of a random value, as soon as they are all encodings of the same value.

Evaluation. The output of the pseudorandom function on a key K ∈ {0, 1} k and an input

x ∈ {0, 1} n is F.Eval pp (K, x) = MM.Extract( k i=1 âi,K i n j=1 ĉj,x j k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K i 1 ,K i 2 ) .
We can re-write it as:

F.Eval pp (K, x) = MM.Extract(   k i=1 a i,K i n j=1 c j,x i   U ) .
Extraction. As explained in Remark 2.4.4, the role of extraction (MM.Extract) is dual. First, it ensures the correctness of the pseudorandom function, as in currently known instantiations of multilinear maps [GGH13; CLT13; GGH15; CLT15], a scalar has many different encodings.

Second, it is used in our proof of security under non-interactive assumptions in Section 7.4.2, as in the security proof we change the way the group element

k i=1 âi,K i n j=1 ĉj,x j k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K i 1 ,K i 2
is computed. We indeed recall that due to the fact that a scalar has many different encodings, any group element (as the above one) leaks information on the exact computation used to obtain it, instead of just depending on its discrete logarithm. The usual way to solve this issue is to randomize the resulting group element using encodings of zero. However, we do not want to use any encoding of zero, hence the requirement for this extraction. For the proof in the generic multilinear map model in Section 7.3, this is not an issue, and we just ignore the extraction (see Remark 2.4.4).

As discussed in Remark 2.4.4, with current instantiations of multilinear maps [GGH13; CLT13; GGH15; CLT15], the output of the pseudorandom function has to be the extracted value of the group elements previously indicated, for the evaluation to be deterministic.

Security in the Generic Multilinear Map Model

In this section, we prove the security of our construction in the generic multilinear map model. As already explained in Remark 2.4.4, we suppose in this section that no extraction is performed. We actually even prove that no polynomial-time adversary can construct a (non-trivial) encoding of zero, in any of the two experiments RKPRFReal F and RKPRFRand F , with non-negligible probability. This implies, in particular, that these two experiments cannot be distinguished by a polynomial-time adversary, in the generic multilinear map model, as an adversary only sees handles which only leak information when two of them correspond to the same (top-level) element.

This section is mainly a warm-up to familiarize with the model, since the fact that we prove our construction under some assumptions that are proven secure in the generic multilinear map model and proven to not let an adversary generate encodings of zero also implies the results below. However, it is very simple to modify the proof below in order to prove the security of the simplified construction proposed in Section 7.2.1, which is of independent interest.

We first need to formally define the notion of (non-trivial) encoding of zero. We follow the definition of Badrinarayanan et

,i 2 ,b 1 ,b 2 = [1] BitFill i 1 ,i 2 ,b 1 ,b 2 for 1 ≤ i 1 < i 2 ≤ k and b 1 , b 2 ∈ {0, 1}. Let Z 1 and Z 2 be two subsets of {(i 1 , i 2 ) | 1 ≤ i 1 < i 2 ≤ k} × {0, 1} 2 . If t 1 = (i 1 ,i 2 ,b 1 ,b 2 )∈Z 1 ẑi 1 ,i 2 ,b 1 ,b 2 and t 2 = (i 1 ,i 2 ,b 1 ,b 2 )∈Z 2 ẑi 1 ,i 2 ,b 1 ,b 2 have the same index set, then Z 1 = Z 2 .
Proof of Lemma 7.

, i 2 , b 1 , b 2 ) ∈ Z 1 with i 1 < i 2 , as S i 1 ,b 1 ,i 2 is in the index set of t 1 and T ∩ S i 1 = S i 1 , there exists b such that S i 1 ,b 1 ,i 2 ,b is in Z 2 (so that S i 1 ,b 1 ,i 2 is in the index set of t 2 )
, by definition of a straddling set system. Then, there are two possibilities:

either b = b 2 and (i 1 , i 2 , b 1 , b 2 ) ∈ Z 2 , or b = 1 -b 2 . In the latter case, this means that S i 2 ,b 2 ,i 1 is contained in the index set of t 1 and S i 2 ,1-b 2 ,i 1 is contained in the index set of t 2 . As T ∩ S i 2 = S i 2 ,
this contradicts the fact that t 1 and t 2 have the same index set. Lemma 7.3.3 immediately follows.

We need to show that the adversary cannot generate a non-trivial encoding of zero.

RKPRFRand F . We start by proving it in the game RKPRFRand F . In this game, except for ẑi 1 ,i 2 ,b 1 ,b 2 , all the handles the adversary sees correspond to fresh new formal variables, as the oracle RKFn only returns fresh new formal variables (of index U ). The only polynomials the adversary can generate are therefore of the form:

P = L =1 Q (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 ,
where Q are polynomials over all the elements except ẑi 1 ,i We therefore simulate the oracle M as follows: we do everything as normal, but we make the zero-testing oracle always output "non-zero" except when its input corresponds to the zero polynomial. The Schwarz-Zippel lemma ensures that any non-zero polynomial of degree at most k + n and whose variables are fixed to uniformly random values in Z p does not evaluate to zero, except with probability at most (k + n)/p. In other words, the zero-testing oracle outputs "zero" on a non-zero polynomial with probability at most (k + n)/p, as this polynomial remains non-zero and has degree at most (k + n), when we replace ẑi 1 ,i 2 ,b 1 ,b 2 by 1. As we can suppose that the zero-testing oracle is queried with the output of the adversary without loss of generality, using at most q M hybrid games (replacing one-by-one every output of the zero-testing oracle with "non-zero") we get that:

(i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,
Pr PRFRand A F ⇒ an encoding of 0 ≤ q M k + n p .
RKPRFReal F . Let us now look at the game RKPRFReal F . The analysis is more complicated as the adversary has access to new formal variables ŷs,x = F pp (K ⊕ s, x)

returned by queries RKFn(φ s , x).

We use the same simulator as in the previous case. We need to show that if a polynomial P produced by the adversary is not zero, it remains non-zero when ẑi 1 ,i 2 ,b 1 ,b 2 is replaced by 1 and ŷs,x is replaced by its value. We first consider the case where P is not a top-level polynomial. In this case, P cannot contain these new variables ŷs,x as these variables are top-level. Then, as in RKPRFRand F , the zero-testing oracle outputs "non-zero" except with probability at most (k + n)/p.

Let us now suppose that P is a top-level polynomial. This polynomial has the form:

P = L =1 Q k i=1 âi,K ,i k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K ,i 1 ,K ,i 2 + q j=1 λ j ŷs j ,x j ,
with L being a non-negative integer (possibly exponential in q M ), Q being non-zero polynomials in the formal variables ĉj,b , K being distinct bitstrings in {0, 1} k (chosen by the adversary), q an integer less or equal to q RKFn , (s 1 , x 1 ), . . . , (s q , x q ) queries to RKFn, and λ j some scalar in Z p . Indeed, the adversary can ask for an encoding of any polynomial of the form Q k i=1 âi,K ,i , and by definition of straddling set systems, the unique way to obtain a top-level encoding from such a polynomial is by multiplying it with an encoding of

k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K ,i 1 ,K ,i 2 .
Let us suppose that P is not zero but becomes zero when ẑi 1 ,i 2 ,b 1 ,b 2 is replaced by 1 and ŷs,x is replaced by its value. In this case, in particular, the first monomial (for any order) of the term

Q 1 k i=1 âi,K 1,i k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K 1,i 1 ,K 1,i 2
necessarily needs to be canceled out by some ŷs j ,x j . The probability over K $ ← {0, 1} k that this happens is at most:

Pr ∃j ∈ {1, . . . , q }, K 1 = K ⊕ s j ≤ q 2 k ≤ q RKFn 2 k .
As before, thanks to the Schwarz-Zippel lemma, we get that the zero-testing oracle outputs "zero", on input a non-zero polynomial, with probability at most:

q RKFn 2 k + k + n p .
This concludes the proof of Theorem 7.3.2.

Remark 7.3.4. We never use the properties of the straddling set system S 0 in this proof. These properties are only used in our proof under non-interactive assumptions in Section 7.4.2.

We obtain the following immediate corollary. Proof of Corollary 7.3.5. We just consider an intermediate game where we simulate everything as before except the zero-testing oracle which always outputs "non-zero" unless its input is zero, as a polynomial. This game is indistinguishable from both RKPRFReal F and RKPRFRand F according to Theorem 7.3.2 (up to the bounds in this lemma). Thus, we have:

Adv rka-prf Φ ⊕ ,F (A ) ≤ q M q RKFn 2 k + 2q M (k + n) p ,
and Corollary 7.3.5 follows.

Security under Non-Interactive Assumptions

Two Non-Interactive Assumptions

We use two assumptions that we call the (k, n, X, Y )-XY-DDH assumption, which is roughly a generalization of the standard DDH assumption, and the (k, n)-Sel-Prod assumption. We show in Sections 7.5 and 7.6 that both these assumptions are secure in the generic multilinear map model, and even that an adversary against these assumptions cannot generate encodings of zero. Hence, contrary to most assumptions considered on multilinear maps (e.g., classical DDH-like assumptions and the multilinear subgroup assumption [GLW14; GLSW15]), these assumptions are therefore plausible at least with two current instantiations of multilinear maps [CLT13; GGH15].

To ensure the impossibility of generating encodings of zero, in these two assumptions, we restrict the adversary's capabilities as follows: it is only provided parameters mm.pp, so it can only run MM.Add, MM.Mult, and MM.ZeroTest (and of course use the elements generated by the assumption), but we do not allow the adversary to generate new encodings of a chosen scalar. In particular, this forces us to let the assumption contains the group elements ẑi 1 ,i 2 ,b 1 ,b 2 . It is straightforward to get rid of these additional elements by allowing the adversary to generate any element of the multilinear map, at the cost of getting an implausible assumption under current instantiations of multilinear maps.

Finally, our assumption implicitly contains a list L of a polynomial number of encodings of random values at non-zero indices, indices being implicit parameters of the assumption. We could avoid this artifact with the previous proposition as well, or by giving a sufficient number of encodings of 0 and 1, but once again, in that case, the assumption would most likely not hold with currently known multilinear maps instantiations. We believe this is a small prize to pay to get plausible assumptions, as the resulting assumptions are still non-interactive.

Adv (k,n,X,Y )-XY-DDH (D) := Pr (k, n, X, Y )-XY-DDHReal D ⇒ 1 - Pr (k, n, X, Y )-XY-DDHRand D ⇒ 1 ,
where the games (k, n, X, Y )-XY-DDHReal D and (k, n, X, Y )-XY-DDHRand D are defined in Figure 7. 1. This assumption is very close to the classical DDH assumption with indices, with two main differences: the presence of elements ẑi 1 ,i 2 ,b 1 ,b 2 which are necessary to prove our construction and the implicit presence of encodings of random values at non-zero indices (list L described previously) instead of a polynomial number of encodings of 0 and 1. Without the elements ẑi 1 ,i 2 ,b 1 ,b 2 , the proof of this assumption in the generic multilinear map model would be completely straightforward. The difficulty of the proof is to deal with these elements.

In the security proof of our construction, this assumption is used in a similar way as the DDH assumption in the proof of the Naor-Reingold pseudorandom function.

Adv (k,n)-Sel-Prod (D) := Pr (k, n)-Sel-ProdReal D ⇒ 1 -Pr (k, n)-Sel-ProdRand D ⇒ 1 ,
where the games (k, n)-Sel-ProdReal D and (k, n)-Sel-ProdRand D are defined in Figure 7.1.

Intuitively, under this assumption, we can replace the encodings âi,K i ⊕s i at index from the first partition of the straddling set, used in the computation of the output with relation s, to encodings of uniformly random scalars at index from the second partition. In particular, doing this change, we no longer need to know the key K to simulate correctly the output, but only the relations s for each query.

Remark 7.4.3. For the sake of simplicity, we do not explicitly specify the noise level in our assumptions. It can easily be made to work with our proof.

Security of our Construction

In this whole section, we set S = k i=0 S i and S = k i=1 S i , so S = S 0 • S . Please refer to Section 7.2.2 for notation. Theorem 7.4.4 (Security Under Non-Interactive Assumptions). Assuming the (k, n)-Sel-Prod and the (k, n, S i -1 i=1 S 0,1,i , S 0,1,i )-XY-DDH assumptions hold, then F is an XOR-related-key secure pseudorandom function.

Moreover, the running time of this reduction is polynomial in n and in the running time of the adversary.

We provide a sketch of the proof before describing the full proof below.

Proof Overview. The proof follows a sequence of hybrid games. The first hybrid corresponds exactly to RKPRFReal F , while the last game corresponds to RKPRFRand F . Here is how we , we use encodings γi,b of a i,K i ⊕b with index S 0,1,i BitCommit i,K i ⊕b . That is, we use the second partition S 0,1 of the straddling set S 0 instead of the first one (S 0,0 ) to reach top-level index (which contains S 0 ). Also, we now compute the output using only the relation s instead of the key K. More precisely, the output on a query (s, x) is computed as:

(k, n, X, Y )-XY-DDHReal D (k, n, X, Y )-XY-DDHRand D proc Initialize (mm.sp, mm.pp) $ ← MM.Setup(1 κ , U ) d 0 , d 1 , e $ ← Z p d0 ← [d 0 ] X ; d1 ← [d 1 ] X ê0 ← [ed 0 ] XY ; ê1 ← [ed 1 ] XY For i 1 , i 2 ∈ {1, . . . , k} and b 1 , b 2 ∈ {0, 1} ẑi 1 ,i 2 ,b 1 ,b 2 ← [1] BitFill i 1 ,i 2 ,b 1 ,b 2 Return (L, mm.pp, d0 , d1 , ê0 , ê1 , (ẑ i 1 ,i 2 ,b 1 ,b 2 )) proc Finalize(b) Return b proc Initialize (mm.sp, mm.pp) $ ← MM.Setup(1 κ , U ) d 0 , d 1 , e 0 , e 1 $ ← Z p d0 ← [d 0 ] X ; d1 ← [d 1 ] X ê0 ← [e 0 ] XY ; ê1 ← [e 1 ] XY For i 1 , i 2 ∈ {1, . . . , k} and b 1 , b 2 ∈ {0, 1} ẑi 1 ,i 2 ,b 1 ,b 2 ← [1] BitFill i 1 ,i 2 ,b 1 ,b 2 Return (L, mm.pp, d0 , d1 , ê0 , ê1 , (ẑ i 1 ,i 2 ,b 1 ,b 2 )) proc Finalize(b) Return b (k, n)-Sel-ProdReal D (k, n)-Sel-ProdRand D proc Initialize (mm.sp, mm.pp) $ ← MM.Setup(1 κ , U ) K $ ← {0, 1} k For i ∈ {1, . . . , k} and b ∈ {0, 1} a i,b $ ← Z p ; γ i,K i ⊕b ← a i,b âi,b ← [a i,b ] S 0,0,i BitCommit i,b γi,K i ⊕b ← [γ i,K i ⊕b ] S 0,1,i BitCommit i,K i ⊕b For i 1 , i 2 ∈ {1, . . . , k} and b 1 , b 2 ∈ {0, 1} ẑi 1 ,i 2 ,b 1 ,b 2 ← [1] BitFill i 1 ,i 2 ,b 1 ,b 2 Return (L, mm.pp, (â i,b ), (γ i,b ), (ẑ i 1 ,i 2 ,b 1 ,b 2 )) proc Finalize(b) Return b proc Initialize (mm.sp, mm.pp) $ ← MM.Setup(1 κ , U ) For i ∈ {1, . . . , k} and b ∈ {0, 1} a i,b $ ← Z p ; γ i,b $ ← Z p âi,b ← [a i,b ] S 0,0,i BitCommit i,b γi,b ← [γ i,b ] S 0,1,i BitCommit i,b For i 1 , i 2 ∈ {1, . . . , k} and b 1 , b 2 ∈ {0, 1} ẑi 1 ,i 2 ,b 1 ,b 2 ← [1] BitFill i 1 ,i 2 ,b 1 ,b 2 Return (L, mm.pp, (â i,b ), (γ i,b ), (ẑ i 1 ,i 2 ,b 1 ,b 2 )) proc
MM.Extract( k i=1 γi,s i n j=1 ĉj,x j k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K i 1 ,K i 2 ) ,
which can be computed without knowing K. This does not change anything regarding the output (thanks to the extraction), so these two games are indistinguishable. However, using the (k, n)-Sel-Prod assumption, we can now switch the encodings γi,b to encodings of fresh random scalars γ i,b ∈ Z p . The rest of the proof is very similar to the proof of the Naor-Reingold pseudorandom function. We do k + n hybrid games, where in the j-th hybrid, we just switch products of encodings j i=1 γi,s i to encodings of uniformly fresh random values using the XY-DDH assumption with the proper indices. These modifications are done in a lazy fashion to obtain a polynomial-time reduction.

Proof of Theorem 7.4.4. The proof is based on the games in Figure 7.2 and Figure 7.3. We consider the games in this order:

G 0 , G 1 , G 2 , G 3 , G 4,2 , . . . , G 4,k , G 5,1 , . . . , G 5,n .
For the sake of simplicity, and as already mentioned in Remark 7.4.3, we assume that the multilinear map is clean and the representation is unique. In particular, these assumptions allow us to avoid using an extractor and to assume that two equivalent games are perfectly indistinguishable (and not only statistically indistinguishable). Our proof could be easily adapted to avoid this assumption. Game G 0 . This game exactly corresponds to RKPRFReal F :

Pr RKPRFReal A F ⇒ 1 = Pr [ G 0 ⇒ 1 ] .
Game G 1 . In this game, outputs of RKFn(φ s , x) are generated using γi,s i instead of âi,K i ⊕s i , where: Game G 3 . In this game, we just slightly change the indices of γ1,0 and γ1,1 , so that combining elements γi,b and ĉj,x j directly leads to a top-level encoding (without any need of the ẑi 1 ,i 2 ,b 1 ,b 2 's). As elements γ1,0 and γ1,1 are never directly revealed to the adversary, this game is perfectly indistinguishable from the previous one, so:

Pr [ G 2 ⇒ 1 ] = Pr [ G 3 ⇒ 1 ] .
We also call this game: Game G 4,0 .

Game G 4,i . In this game, i i=1 γi,s i are replaced by independent random elements for each tuple (s 1 , . . . , s i ) ∈ {0, 1} i queried by the adversary (so only for polynomially many such tuples). Game G 4,i is indistinguishable from Game G 4,i -1 , under the (k, n, S i -1 i=1 S 0,1,i , S 0,1,i )-XY-DDH assumption. More precisely, we can construct an adversary B i running in time similar to A such that:

Pr G 4,i -1 ⇒ 1 -Pr [ G 2 ⇒ 1 ]
≤ q RKFn • Adv (k,n,S i -1 i=1 S 0,1,i ,S 0,1,i )-XY-DDH (B i ) . (7.1)

The reduction is immediate from the definition of the (k, n, S i -1 i=1 S 0,1,i , S 0,1,i )-XY-DDH assumption. We also call Game G 4,k , Game G 5,0 .

Game G 5,j . In this game, k i=1 γi,s i j j=1 bi,x i are also replaced by independent random elements for each tuple (s 1 , . . . , s k , x 1 , . . . , x j ) ∈ {0, 1} k+j queried by the adversary (so only for polynomially many such tuples). Game G 5,j is indistinguishable from Game G 5,j -1 , under the (k, n, S j -1 j=1 X j , X j )-XY-DDH assumption. More precisely, we can construct an adversary C j running in time similar to A such that:

Pr G 4,i -1 ⇒ 1 -Pr [ G 2 ⇒ 1 ] ≤ q RKFn • Adv (k,n,S j -1 j=1 X j ,X j )-XY-DDH (C j ) .
Once again, the proof is immediate from the definition of the (k, n, S j -1 j=1 X j , X j )-XY-DDH assumption.

Finally, we remark that Game G 5,n is exactly RKPRFRand A F and therefore:

Pr [ G 5,n ⇒ 1 ] = Pr RKPRFRand A F ⇒ 1 .
By summing all the previous bounds, we obtain the following bound:

Adv rka-prf Φ ⊕ ,F (A ) ≤ Adv (k,n)-Sel-Prod (D)+ k i =2
q RKFn • Adv (k,n,S i -1 i=1 S 0,1,i ,S 0,1,i )-XY-DDH (B i )+ n j =1

q RKFn • Adv • if the index of P does not contain S 0 , there exists a polynomial Q in the formal variables ĉi,b for i ∈ {1, . . . , k} and b ∈ {0, 1}, together with some string β ∈ {0, 1}, some tuple K ∈ {0, 1, * } k and some set Z ⊆ {(i 1 , i 2 ) | 1 ≤ i 1 < i 2 ≤ k} × {0, 1} 2 such that:

P = Q • k i=1 K i = * âβ i i,K i • (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 ;
• if the index of P does contain S 0 , there exist two polynomials Q 0 and Q 1 in the formal variables ĉi,b for i ∈ {1, . . . , k} and b ∈ {0, 1}, together with some string β ∈ {0, 1}, some tuple K ∈ {0, 1, * } k and some set Z ⊆ {(i 1 , i 2 ) | 1 ≤ i 1 < i 2 ≤ k} × {0, 1} 2 such that:

P =     Q 0 • k i=1 K i = * â0 i,K i + Q 1 • k i=1 K i = * â1 i,K i     • (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 ;
in both case, in addition the index set of P is not U ;

2. prof(P ) is a set containing at least 2 and at most q non-partial profiles: prof(P ) = {K 1 , . . . , K q }, with q ≤ q; in which case, there exists polynomials Q 1,0 , Q 1,1 , . . . , Q q ,0 , Q q ,1 in the formal variables ĉi,b for i ∈ {1, . . . , k} and b ∈ {0, 1}, such that:

P = q =1 Q ,0 • k i=1 â0 i,K ,i k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K ,i 1 ,K ,i 2 + Q ,1 • k i=1 â1 i,K ,i k i 1 =1 k i 2 =i 1 +1
ẑi 1 ,i 2 ,K ,i 1 ,K ,i 2 .

In addition, when the index set of P does not contain S = k i=1 S i , then necessarily q = 1.

Furthermore prof(P ) and the above decompositions of P can be efficiently computed (i.e., in a time polynomial in κ and q). The proof is by induction over the expression of the polynomials formed by the adversary. We first need to introduce some intermediate lemmata.

Lemma 7.6.5 (Impossibility to add partial terms). Let t 1 and t 2 be two monomials, such that prof(t 1 ) = ⊥ and prof(t 2 ) = ⊥. If prof(t 1 ) or prof(t 2 ) is partial and prof(t 1 ) = prof(t 2 ), then t 1 and t 2 do not have the same index set.

Proof of Lemma 7.6.5. We can assume without loss of generality that, for a fixed bit b ∈ {0, 1} and some i ∈ {1, . . . , k}, prof(t 1 ) i = b and prof(t 2 ) i = b. Hence, as prof(t 2 ) i = b and as prof(t 2 ) = ⊥, t 2 cannot contain a factor of âi,b , ẑi,i ,b,b or ẑi ,i,b ,b for any i ∈ {1, . . . , k} and b ∈ {0, 1}. We now prove Lemma 7.6.5 by contradiction. The possible cases are the following:

• Suppose t 1 contains a factor of âi,b . Then its index set was formed using BitCommit i,b = S i,b,i . Since t 2 does not contain a factor of âi,b , its index set was not formed using BitCommit i,b = S i,b,i . Therefore, if t 1 and t 2 have the same index set, by definition of a straddling set, this index set has to contain the whole set S i . However, for every i ∈ {1, . . . , k} with i = i , the only encodings that contain S i,b,i , for any b ∈ {0, 1}, are ẑi,i ,b,b and ẑi ,i,b ,b for some b ∈ {0, 1}. This implies that t 1 contains a factor of ẑi,i ,b,b or ẑi ,i,b ,b for some b ∈ {0, 1}, for every i ∈ {1, . . . , k} and similarly, that t 2 contains a factor of ẑi,i ,1-b,b or ẑi ,i,b ,1-b for some b ∈ {0, 1} and for every i ∈ {1, . . . , k}. This contradicts the fact that at least one of the two profiles is partial.

• Suppose t 1 does not contain any factor of âi,b but does contain a factor of ẑi,i ,b,b or ẑi ,i,b ,b for some i ∈ {1, . . . , k} and some b ∈ {0, 1}. Then, its index set was formed using BitFill i,i ,b,b = S i,b,i S i ,b ,i or BitFill i ,i,b ,b = S i ,b ,i S i,b,i , so in particular using S i,b,i . Then, one can apply the same argument than in the previous case to exclude this case.

Lemma 7.6.5 immediately follows.

Similarly to the above lemma, we can prove the following three lemmata. As their proofs are very similar, we only give brief intuitions. Lemma 7.6.6 (Impossibility to add ⊥-profile and non-⊥-profile). Let t 1 and t 2 be two monomials. If prof(t 1 ) = ⊥ and prof(t 2 ) = ⊥, then t 1 and t 2 do not have the same index set.

Proof of Lemma 7.6.6. The technique is similar to the proof of Lemma 7.6.5, thus we just provide the main ideas. As prof(t 1 ) = ⊥, there exists i ∈ {1, . . . , k} such that t 1 incorporates both 0 and 1 as its i-th bit, and prof(t 2 ) i ∈ {0, 1, * }. Assume prof(t 2 ) i = * . Then t 2 does not contain any âi,b nor ẑi,i ,b,b nor ẑi ,i,b ,b , for any b, b , i , so its index set cannot be form with any of the S i,b,i , for any b, i , while t 1 is formed using at least one such index. Then t 1 and t 2 do not have the same index set. Assuming now that prof(t 2 ) i = b, one can reiterate the same technique with some index S i ,1-b,i that cannot be used to form its index set. Lemma 7.6.6 follows.

Lemma 7.6.7. Let Q 1 , Q 2 be two polynomials in the formal variables ĉi,b , for i ∈ {1, . . . , k} and b ∈ {0, 1}, β 1 , β 2 two bit strings in {0, 1} k , K 1 , K 2 two tuples in {0, 1, * } k , and Z 1 , Z 2 two subsets of {(i 1 , i 2 ) | 1 ≤ i 1 < i 2 ≤ k} × {0, 1} 2 . Let P 1 and P 2 be the two polynomials defined by

P = Q k i=1 K ,i = * âβ i,K ,i (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 ,
for ∈ {1, 2}. If the index of P 1 and P 2 is the same but does not contains S = k i=1 S i nor S 0 , then K 1 = K 2 and Z 1 = Z 2 . The latter condition (on the index not containing S ) is in particular satisfied when the profile of P 1 (and so of P 2 too) is ⊥ or contains a partial profile.

Proof of Lemma 7.6.7. Once again, the proof is similar to that of Lemma 7.6.5. The fact that the index of P 1 (and P 2 ) does not contain S nor S 0 guarantees that there exists i ∈ {1, . . . , k} such that S i is not contained in this index, and S 0 is not contained either. For any such i, as the indices of P 1 and P 2 are the same, they have to contain exactly the same S i,b,i 's from S i (since they do not contain S i ).

Lemma 7.6.8. Let Q 1,0 , Q 1,1 , Q 2,0 , Q 2,1 be four polynomials in the formal variables ĉi,b , for i ∈ {1, . . . , k} and b ∈ {0, 1}, K 1 , K 2 two tuples in {0, 1, * } k , and Z 1 , Z 2 two subsets of {(i 1 , i 2 ) | 1 ≤ i 1 < i 2 ≤ k} × {0, 1} 2 . Let P 1 and P 2 be the two polynomials defined by

P =      Q ,0 k i=1 K ,i = * â0 i,K ,i + Q ,1 k i=1 K ,i = * â1 i,K ,i      • (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 ,
for ∈ {1, 2}. If the index of P 1 and P 2 is the same but does not contains S = k i=1 S i nor S 0 , then K 1 = K 2 and Z 1 = Z 2 . The latter condition (on the index not containing S ) is in particular satisfied when the profile of P 1 (and so of P 2 too) is ⊥ or contains a partial profile.

Proof of Lemma 7.6.8. The proof is similar to that of Lemma 7.6.7.

We now have every tool to prove Lemma 7.6.4.

Proof of Lemma 7.6.4. In this proof, the integers i, i 1 , i 2 are in {1, . . . , k} and b is a bit. We set S = k i=1 S i . Furthermore: • Q and Q always denote polynomials in the formal variables ĉi,b ,

• β and β always denot bit strings in {0, 1} k ,

• K and K always denote tuples in {0, 1, * } k , and

• Z and Z always denote subsets of {(i 1 , i 2 ) | 1 ≤ i 1 < i 2 ≤ k} × {0, 1} 2 .
We prove the above lemma by induction on the sequence of formal polynomials P formed by the adversary A via oracle queries. Let P denote a newly formed polynomial. We consider the following cases:

• Suppose P = t with t being a monomial: clearly, either prof(P ) = ⊥, or it is a singleton containing either a partial profile or a non-partial profile. Moreover, as a monomial, it is straightforward that it has the expected form detailed in the statement of Lemma 7.6.4 (with q = 1 in the third case).

• Suppose P = P 1 + P 2 with P 1 , P 2 some polynomials already formed. We have three possible cases:

1. prof(P 1 ) =⊥ or prof(P 2 ) =⊥: immediately, we have also prof(P ) =⊥, by definition of the profile of a polynomial. Furthermore, we necessarily have prof(P 1 ) = prof(P 2 ) =⊥, otherwise, the formal expansion of P 1 + P 2 would contain one monomial of profile ⊥ and another one of profile different than ⊥, which is impossible according to Lemma 7.6.6. We consider two sub-cases:

the index of P 1 (and also of P 2 ) does not contains S 0 . By induction hypothesis, there exists two polynomials Q 1 and Q 2 , two strings β 1 and β 2 , two tuples K 1 and K 2 , and two sets Z 1 and Z 2 , such that:

P = Q k i=1 K ,i = * âβ ,i i,K ,i (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 , Chapter 7
7.6 Security of the Sel-Prod Assumption in the Generic Multilinear Map Model 133 for ∈ {1, 2}. According to Lemma 7.6.7, this implies that K 1 = K 2 and Z 1 = Z 2 and that P = P 1 + P 2 has the expected form. the index of P 1 (and also of P 2 ) contains S 0 . We conclude again using Lemma 7.6.8 and the induction hypothesis.

2. prof(P 1 ) or prof(P 2 ) is a singleton containing one partial profile. We have necessarily prof(P 2 ) = prof(P 1 ), otherwise P 1 and P 2 cannot be added via Lemma 7.6.5, since there must exist two monomials t 1 and t 2 in the formal expansion of P 1 and P 2 respectively such that prof(t 1 ) = prof(t 2 ) and with prof(t 1 ) or prof(t2) being partial. We can conclude this case similarly to the previous case.

3. both prof(P 1 ) and prof(P 2 ) are sets containing at least 2 non-partial profiles.

Then prof(P ) = prof(P 1 ) ∪ prof(P 2 ) and does not contain any partial profile. Furthermore, if the index of P (which is the same as the one of P 1 and P 2 ) contains S , it is straightforward that P has the expected form, with q = |prof(P )| ≤ |prof(P 1 )| + |prof(P 2 )|.

It remains to show that if the index of P does not contain S , P has the expected form with q = 1. By hypothesis induction, as the indexes of P 1 and P 2 do not contain S : there exists two polynomials Q 1 and Q 2 , two tuples K 1 and K 2 , and two sets Z 1 and Z 2 , such that prof(P 1 ) = {K 1 } and prof(P 2 ) = {K 2 }, such that:

P = Q k i=1 K ,i = * âi,K ,i (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 ,
for ∈ {1, 2}. According to Lemma 7.6.7, this implies that K 1 = K 2 and Z 1 = Z 2 and this clearly implies that P = P 1 + P 2 has the expected form.

• Suppose P = P 1 P 2 with P 1 , P 2 some formal polynomials already formed. Once again, we have three possible cases:

1. prof(P 1 ) = ⊥ or prof(P 2 ) = ⊥: immediately, we have also prof(P ) = ⊥. We assume without losss of generality that prof(P 1 ) = ⊥.

Let us show that necessarily prof(P 2 ) is either ⊥ or a singleton containing a partial profile. Otherwise the index of P 2 would contain S , which implies that the index of P 1 cannot contain any element in S and that P 1 = Q for some polynomial Q. But in that case, the profile of P 1 would be {( * , . . . , * )} =⊥ which is impossible.

We now consider two sub-cases:

the index of P does not contain S 0 , in this case, P 1 nor P 2 can contain S 0 either. By induction hypothesis, there exist two strings β 1 , β 2 , two polynomials Q 1 and Q 2 , two tuples K 1 and K 2 , and two sets Z 1 and Z 2 , such that:

P = Q k i=1 K ,i = * âβ ,i i,K ,i (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 ,
for ∈ {1, 2}; thus P 1 P 2 has clearly the expected form.

the index of P does contain S 0 . Clearly, at most one polynomial among P 1 and P 2 has an index containing S 0 . Using the induction hypothesis, it is easy to see that there exist two strings β 1 , β 2 , two polynomial Q 0 and Q 1 , one tuple K , and one set Z, such that:

P =     Q 0 • k i=1 K i = * âβ 1,i i,K i + Q 1 • k i=1 K i = * âβ 1,i i,K i     • (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 .
To conclude, we just need to prove that β 1 , β 2 ∈ {(0, . . . , 0), (1, . . . , 1)}. This directly comes from the property of straddling sets, the existence of the above polynomial P implies that (S 0,β 0,1 ,1 , . . . , S 0,β 0,k ,k ) and (S 0,β 1,1 ,1 , . . . , S 0,β 1,k ,k ) are two partitions of S 0 .

2. none of the index of P 1 and P 2 contains S . The profiles prof(P 1 ) and prof(P 2 ) are singletons, and the profile prof(P ) is either ⊥ or a singleton containing the merge of the two profiles contained in prof(P 1 ) and prof(P 2 ). We conclude similarly to the previous case.

3. P 1 or P 2 contains S . We assume without loss of generality that the index of P 1 contains S . This implies that the index of P 2 cannot contain any element of S and so that there exists a polynomial Q such that P 2 = Q. We therefore get that prof(P ) = prof(P 1 ) is a set of non-partial profiles. Furthermore, using the induction hypothesis on P 1 , it is straightforward to see that P has the expected form (with the same number of terms q as P 1 ).

Security of the Sel-Prod Assumption

Theorem 7.6.9 (Impossibility of constructing encodings of zero). Let k and n be two positive integers. In the generic multilinear map model with oracle M , for any adversary D making at most q M queries to the oracle M , we have:

Pr (k, n)-Sel-ProdReal D ⇒ an encoding of 0 ≤ q M q M 2 k + k + n p and Pr (k, n)-Sel-ProdRand D ⇒ an encoding of 0 ≤

q 2 M 2 k + 2q M (k + n) p .
Proof of Theorem 7.6.9. Once again, we consider the two cases separately.

(k, n)-Sel-Prod. The proof is similar to the case RKPRFRand F of the proof of Theorem 7. (k, n)-Sel-Prod. Similarly to the case RKPRFReal F of the proof of Theorem 7.3.2, we just need to prove that any non-zero polynomial P remains non-zero when it remains non-zero when ẑi 1 ,i 2 ,b 1 ,b 2 is replaced by 1 and γi,b = â1 i,b is replaced by a i,K i ⊕b where K is a random bit string in {0, 1}. We call this replacement: the partial evaluation.

According to Lemma 7.6.4, we have three possible cases (we use the notation of this lemma):

• P has the following form:

P = Q • k i=1 K i = * âβ i i,K i • (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 .
In this case, the polynomial clearly remains non-zero after the partial evaluation.

• P has the following form:

P =     Q 0 • k i=1 K i = * â0 i,K i + Q 1 • k i=1 K i = * â1 i,K i     • (i 1 ,i 2 ,b 1 ,b 2 )∈Z ẑi 1 ,i 2 ,b 1 ,b 2 .
In this case, since P contains S 0 , we have that K ∈ {0, 1} k and thus if this polynomial P is zero adter the partial evaluation, then for any i{1, . . . , k}, a i,K i = a i,K i ⊕K i , i.e., K = K ⊕ K , or in other words K = 0. This happens with probability 1/2 k .

• P has the following form:

P = q =1 Q ,0 • k i=1 â0 i,K ,i k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K ,i 1 ,K ,i 2 + Q ,1 • k i=1 â1 i,K ,i k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K ,i 1 ,K ,i 2 .
If Q ,0 is zero for all , then P is clearly still non-zero after the partial evaluation. Let us now suppose without loss of generality that Q ,0 = 0. Let us suppose that P becomes the zero polynomial after the partial evaluation. The first (for any order) monomial of the term

Q 1,0 • k i=1 â0 i,K 1,i k i 1 =1 k i 2 =i 1 +1
ẑi 1 ,i 2 ,K 1,i 1 ,K 1,i 2 needs to be canceled by one of the monomials of the terms for some :

Q ,1 • k i=1 â1 i,K ,i k i 1 =1 k i 2 =i 1 +1 ẑi 1 ,i 2 ,K ,i 1 ,K ,i 2 .
This implies that for some ∈ {1, . . . , q }, K 1 = K ⊕ K . This happens with probability at most q M . Therefore probability that a non-zero polynomial P generated by the adversary D remains non-zero when ẑi 1 ,i 2 ,b 1 ,b 2 is replaced by 1 and γi,b is replaced by a i,K i ⊕b where K is a random bit string in {0, 1}, is at most q 2 M /2 K (as the adversary D generates at most M polynomials). We conclude as usual using the Schwarz-Zippel lemma and an hybrid argument.

Similarly to Corollary 7.3.5 and Corollary 7.6.10, we have the following corollary. Corollary 7.6.10 (Security in the generic multilinear map model). Let k and n be two positive integers. In the generic multilinear map model with oracle M , for any adversary D making at most q M queries to the oracle M , we have: Proof of Corollary 7.6.10. We just consider an intermediate game where we simulate everything as before except the zero-testing oracle which always outputs "non-zero" unless its input is zero, as a polynomial. Thus, we have Adv (k,n)-Sel-Prod (D) ≤ 2q M |U | p , and Corollary 7.6.10 easily follows.

Chapter 8

Chapter 8

Conclusion and Open Questions

Conclusion

One of the main contribution of this thesis is to introduce an algebraic framework to analyze the security of certain forms of pseudorandom functions or extensions. Specifically, the PLP theorem and its weaker variant the LIP theorem allow us to translate in a very simple fashion the security of pseudorandom functions (or associated primitives) into simple algebraic properties. This leads to different applications for pseudorandom functions in the standard as well as in the related-key setting, but also for aggregate or multilinear pseudorandom functions. In particular, thanks to the generality of the PLP theorem, we are able to provide constructions with weaker assumptions or, in the case of related-key security, that handles larger classes of related-key deriving functions.

Concerning the related-key setting, we also define new frameworks to tranform a pseudorandom function into a related-key secure version. In particular, we repair and extend the Bellare-Cash framework, which allows us to both recover and strengthen previously known results in this area.

However, despite these new results, we have not been able to construct a related-key secure pseudorandom function for real-world classes, such as XOR relations, using any of these frameworks. Hence, we target this problem in the last part of this thesis, and provide the first provably-secure pseudorandom function for XOR relations, assuming the existence of a weak form of multilinear maps. Unfortunately, this is a strong assumption, and this result should be only seen as a proof of concept.

Open Questions

There are still several open problems that should be tackled in this area. Despite significant progress over the last three years, we are still far from solving any of them. Here is a non-exhaustive list of open questions that we would love to solve at some point.

A first series of questions is related to our main result, the PLP theorem. We would be interested in showing that it can be extended to more advanced primitives or to different assumptions. Here are a few examples of open questions.

  1 where the probability is over the choices of a ∈ Z p , g ∈ G, and the random coins used by the adversary, and where DL G is described in Figure 2.1. Strong Discrete Logarithm. For d ≥ 2, we define the advantage of an adversary A against the d-strong discrete logarithm (d-SDL) problem in G as: Adv d-sdl G (A ) := Pr d-SDL A G ⇒ 1 where the probability is over the choices of a ∈ Z p , g ∈ G, and the random coins used by the adversary, and where d-SDL G is described in Figure 2.1.

Figure 2 . 1 :

 21 Figure 2.1: Games defining the DL and d-SDL problems in G

1 -

 1 1 where the probabilities are over the choices of a, z ∈ Z p , g ∈ G, and the random coins used by the adversary, and where DDHReal G and DDHRand G are described in Figure 2.2. DDHI. For d ≥ 1, the advantage of an adversary D against the d-DDHI problem in G is defined as: Adv d-ddhi G (D) := Pr d-DDHIReal D G ⇒ Pr d-DDHIRand D G ⇒ 1 where the probabilities are over the choices of a, z ∈ Z p , g ∈ G, and the random coins used by the adversary, and where d-DDHIReal G and d-DDHIRand G are described in Figure 2.2.

1 ]Figure 2 . 2 :

 122 Figure 2.2: Games defining the DDH and d-DDHI problems in G

Figure 2 . 4 : 2 . 3 . 3 .

 24233 Figure 2.4: Security games for collision-resistant hash functions and pseudorandom functions

n i=1 1 aTheorem 2 . 3 . 5 .

 1235 i +x i g . Once again, we often use the notation BMR(•, •) to denote BMR.Eval pp (•, •). Assuming the d-DDHI assumption holds in G, BMR is a pseudorandom function.

Figure 2 . 5 :

 25 Figure 2.5: Security games for aggregate pseudorandom functions

Theorem 2 . 3 . 8 .

 238 Assuming the sub-exponential hardness of the DDH problem in G, NR is an (S , Γ)-aggregate pseudorandom function.

Figure 2 . 6 :

 26 Figure 2.6: Security games for multilinear pseudorandom function

Definition 3 . 1 . 1 .

 311 [Related-Key Secure Pseudorandom Function] Let F = (F.Setup, F.Eval)

Figure 3 . 1 :

 31 Figure 3.1: Security games for related-key pseudorandom functions

Figure 3 . 2 :

 32 Figure 3.2: Games defining the uniformity of a key-transformer

Figure 3 . 3 :

 33 Figure 3.3: Security games for Φ-key-collision of a pseudorandom function F (left) and for Φ-statistical-key-collision of Fun(K × D, R) (right)

Theorem 3 . 4 . 2 (

 342 Bellare-Cash Framework, Extended). Let M = (M.Setup, M.Eval) be a pseudorandom function whose key space, domain, and range are denoted K, D, R, respectively. Let Φ be a class of related-key deriving functions that contains the identity function id. Let KT be a key-transformer for (M, Φ), and let #" ω ∈ D m be a strong key fingerprint for M . Let D = D × R m and let H: D → S be a hash function that is compatible with (KT, M, Φ, #" ω ). Define F = (F.Setup, F.Eval) as F.Setup = M.Setup and:

  then condition ( * ) ensures that w a = w b . Hence once again, (x a , w a ) = (x b , w b ), and then Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Adv cr H (C ) . In game G 5 , we use the key-transformer KT to compute M (φ(K), •) via oracle calls to M (K, •). The correctness property of the key-transformer implies Pr [ Succ 4 ] = Pr [ Succ 5 ] .

Figure 3 . 4 :

 34 Figure 3.4: Games for the proof of Theorem 3.4.2

Lemma 3 . 5 . 1 .

 351 Assuming the DDH assumption holds in G, NR * is a pseudorandom function.

Figure 3 . 5 :

 35 Figure 3.5: Games for the proof of Lemma 3.5.3

Theorem 3 . 5 . 5 .

 355 Assuming DDH holds in G, the construction obtained with the above ingredients by applying Theorem 3.4.2 is a Φ aff -related-key secure pseudorandom function.

Figure 3 . 6 :

 36 Figure 3.6: Security games for unique-input-related-key pseudorandom functions

Figure 3 . 7 :

 37 Figure 3.7: Games for the proof of Theorem 3.6.2

  then condition ( * ) ensures that w a = w b . Hence once again, (x a , w a ) = (x b , w b ), and then Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Adv cr H (C ) . In game G 5 , instead of returning the value M (φ(K), h), we always return a random value. To show that games G 4 and G 5 are indistinguishable, we design an adversary B against the (S, Φ)-unique-input-related-key pseudorandom function security of M such that Pr [ Succ 4 ] ≤ Pr [ Succ 5 ] + Adv ui-rka-prf M,S,Φ (B) . Adversary B starts by initializing sets D ← ∅, E ← ∅, G ← ∅. Then B runs A . When the latter makes an RKFn-query (φ, x), B responds as follows. For i = 1, . . . , | #"

Theorem 3 . 6 . 3 .

 363 Let M be a pseudorandom function and Φ be a class of RKD functions. Assuming there exists an S-uniform key-transformer KT for (M, Φ), then M is an (S, Φ)-unique-input-related-key secure pseudorandom function under the pseudorandom function security of M .Moreover, the running time of the reduction is polynomial in the running time of the adversary and of the key-transformer.

Figure 3

 3 Figure 3.8: Games defining the S-uniformity of a key-transformer KT proc Initialize / / G 0

  We design an adversary B attacking the pseudorandom function security of M such that Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Adv prf M (B) . Adversary B runs A . When the latter makes an RKFn-query (φ, x), adversary B responds via If x ∈ S then y $ ← R Else y ← KT Fn (φ, x) Return y where Fn is B's own oracle. When A halts with output b, B halts with output 1b. Then Pr PRFReal B M ⇒ 1 = Pr [ Succ 3 ] and Pr PRFRand B M ⇒ 1 = Pr [ Succ 4 ] . Finally, in game G 5 , instead of using the key-transformer KT to compute M (φ(K), •) via oracle calls to M (K, •), we use M directly. The correctness property of the key-transformer implies that Pr [ Succ 4 ] = Pr [ Succ 5 ] .

Contents 4 . 1

 41 The Matrix-Decisional-Diffie-Hellman Assumptions . . . . . . . . . 54 4.2 A New Family of Matrix-Diffie-Hellman Assumptions . . . .

Definition 4 . 1 . 1 (

 411 MDDH-Assumption). For D ,k an efficiently samplable distribution over Z ×k p , with > k, the advantage of an adversary D against D ,k -MDDH problem G is defined as:

  and the random coins used by the adversary, and where D ,k -MDDHReal G and D ,k -MDDHRand G are described in Figure 4.1.

Figure 4 . 1 :

 41 Figure 4.1: Games defining the D ,k -MDDH problem in G Specifying the distribution D ,k , the MDDH assumption can catch most of classical assumptions, such as DDH, DLin, k-Lin, . . . . For instance, setting D ,k to be the distribution of matrices of the form

Figure 4 . 2 :

 42 Figure 4.2: Games defining the (D ,k , Q)-MDDH problem in G

  where the probabilities are over the choice of Γ $ ← E 1,d , w, c $ ← Z p , and the random coins used by the adversary, and where E 1,(d, ) -MDDHReal G and E 1,(d, ) -MDDHRand G are described in Figure 4.3.

Figure 4 . 3 :

 43 Figure 4.3: Games defining the E 1,(d, ) -MDDH problem in G Hence, this assumption simply states that, given [Γ] with Γ $ ← E 1,d -MDDH and the first coordinates of [Γ • w], with w $ ← Z p , it is hard to distinguish the + 1 coordinate of [Γ • w] from a uniformly random group element.The following lemma follows immediately from a standard hybrid argument.

Lemma 4 . 3 . 1 .Figure 4 . 4 :

 43144 Figure 4.4: Games for the proof of Lemma 4.3.1 Clearly, we have H 0 ≡ E 1,d -MDDHRand and H d ≡ E 1,d -MDDHReal. Moreover, let D be an adversary against the E 1,d -MDDH problem in G. It is straightforward to construct an adversary A such that Pr [ H ⇒ 1 ] -Pr [ H -1 ⇒ 1 ] ≤ Adv

Lemma 4 . 3 . 2 .

 432 Assuming d-DDHI holds in G, then so does E 1,(d,d) -MDDH. Proof of Lemma 4.3.2. Let D be an adversary against the E 1,(d,d) -MDDH problem in G so it has a tuple Z = ([bw] , [abw] , . . . , a d bw , z) where z = a d+1 bw or z is a random group element [c]. Then it chooses α, β $ ← Z p at random and computes the tuple X ∈ Z d+1×1 p by letting X = X α +1 • X β for = 0, . . . , d -1 and X d = z α • X β d . Hence, for = 0, . . . , d -1, it is clear that X = (αa + β)a b . If z = a d+1 , we have X d = (αa + β)a d b . If z = [c] with c $ ← Z p , then X d = (αc + βa d )b . Let us fix a, c ∈ Z p and let b = αa + β and c = αc + βa d . Then, [Γ] and [X] form exactly an E 1,(d,d) -MDDH tuple if and only if for any fixed b , c ∈ Z p , there is a unique (α, β) ∈ Z p such that b = αa + β and c = αc + βa d . Hence, we need the determinant of the matrix a 1 c a d to be non-zero. This determinant is D = a d+1c so it is non-zero if and only if c = a d+1 . Since c is by definition uniformly random in Z p , we have D = 0 with probability p-1 p . To finish the proof, we simply need to explain how adversary A can get such a tuple X from its d-DDHI tuple. Let ([1] , [a] , . . . , a d , x) ∈ G d+2 be a d-DDHI tuple. Then the tuple (( a d , a d-1 , . . . , [a] , [1]), x) is such a tuple since h = a d is a random generator (with overwhelming probability) of G (since [1] is a random generator) and 1 a is random in Z * p , so we have a d-j = h ( 1 a ) j

Figure 5 . 1 :Lemma 5 . 1 . 1 . 1 p

 515111 Figure 5.1: TestLin procedure

Definition 5 . 2 . 1 (

 521 Polynomial Linear Pseudorandomness Security). The advantage of an adversary D against the (n, d, k, m)-PLP security of G is defined as:Adv (n,d,k,m)-plp G (D) := Pr (n, d, k, m)-PLPReal D G ⇒ 1 -Pr (n, d, k, m)-PLPRand D G ⇒ 1 ,with D being restricted to make queries P ∈ Z p [T 1 , . . . , T n ] ≤d that satisfy Condition 1 (when k = 1) or Condition 2 (when k ≥ 2), with the probability being over the choice of #" A, B, and the random coins used by the adversary, and where games (n, d, k, m)-PLPReal G and (n, d, k, m)-PLPRand G are defined in Figure 5.2.

Figure 5 . 2 :

 52 Figure 5.2: Security games for (n, d, k, m)-PLP in a group G Then, our main result states that the (n, d, k, m)-PLP security holds in G assuming the hardness of the E k,d -MDDH problem in G, as detailed below.

Theorem 5 . 2 . 2 ( 5 5. 2

 52252 PLP). Assuming E k,d -MDDH holds in G, so does the (n, d, k, m)-PLP security. Moreover, the running time of this reduction is polynomial (in n, d, k, m, and the Chapter Formal Security Notion and Main Result 73 running time of the adversary).

  uniformly random values, which let us go to the next hybrid game. At the end, we have that the two games defining the (n, d, k, m)-PLP security are indistinguishable under the E k,d -MDDH. A detailed proof is provided in Section 5.3.

Figure 5 . 3 :

 53 Figure 5.3: Security games for (n, d, k, m)-LIP in a group G

Figure 5 . 4 :

 54 Figure 5.4: Games G 0,j and G 1,j for the proof of the PLP theorem

6. 1 . 1 . 1 .

 111 Extended NR Let #" w = (w 0 , . . . , w n ) ∈ Z n+1 p

Lemma 6 . 1 . 1 .

 611 Assuming DDH holds in G, WNR #"

Lemma 6 . 1 . 3 .

 613 Assuming d-DDHI holds in G, WBMR #"

Theorem 6 . 2 . 3 .

 623 Let M = (M.Setup, M.Eval) be a pseudorandom function whose key space, domain, and range are respectively Z n p , D, and G, where p and G are publicly revealed by M.Setup, and such that M ( #" a , x) = [P x ( #" a )]. Let Φ ⊆ Z p [T 1 , . . . , T n ] be a class of RKD functions. Let d be a upper bound for the maximum degree in any indeterminate of polynomials in {help 1 , . . . , help } ∪ {P x, #" φ | x ∈ S, #" φ ∈ Φ}. Define F = (F.Setup, F.Eval) as F.Setup = M.Setup and:

Figure 6 . 2 : 3 Game G 3

 6233 Figure 6.2: Games for the proof of Theorem 6.2.3

  and then Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Adv cr h (C ) . In game G 5 , instead of returning the value M ( #" φ ( #" a ), t), we always return a random value. To show that games G 4 and G 5 are indistinguishable, we design an adversary B against the (n, d)-LIP security of G such that Pr [ Succ 4 ] ≤ Pr [ Succ 5 ] + Adv (n,d)-lip G (B) . Adversary B starts by querying polynomial 1 to [b] and returns it as the generator used for the PRF to A . Next, it initializes sets D ← ∅, E ← ∅, G ← ∅. Then B queries help 1 , . . . , help such that Help Φ ( #" a ) = ([help 1 ( #" a ) • b] , . . . , [help ( #" a ) • b]). Afterwards, it runs A . When the latter makes an RKFn-query ( #" φ , x), B responds as follows. First, it computes

  1) now follows by combining the bounds arising in the different game hops.

2 . 4 .

 24 Adversary B receives a d-SDL tuple ([1] , [a] , . . . , a d ) where a $ ← Z p and where [1]. Adversary B then picks j $ ← {1, . . . , n} at random. B start by picking b at random in Z p and by sending [b] to A as the generator being part of public parameters of the PRF construction. Then B picks a i $ ← Z p for i = 1, . . . , n, i = j at random. Implicitly, B sets a j = a.

Figure 6 . 3 :

 63 Figure 6.3: Game defining the extended Φ-key-collision security off M with helper function Help.

Figure 6 . 4 :

 64 Figure 6.4: Security game for extended (S, Φ)-unique-input-related-key pseudorandom function security of a pseudorandom function M with helper function HelpUsing these new tools, we obtain the following framework, which generalizes our previous frameworks.

  storage of used RKD functions and values of key-commitment com in sets D and E respectively and sets flag 1 to true if the same value of com arises for two different RKD functions. Since this storage does not affect the values returned by RKFn Pr [ Succ 1 ] = Pr [ Succ 0 ] .

Figure 6 . 5 :

 65 Figure 6.5: Games for the proof of Theorem 6.2.10

When←

  A halts, C searches for a, b satisfying 1 ≤ a < b ≤ j such that h a = h b and, if it finds them, outputs (x a , com a ), (x b , com b ) and halts. The pairs (x a , com a ) and (x b , com b ) are distinct. Indeed, consider two cases: first, if φ a = φ b then since A never repeats an oracle query, x a = x b hence (x a , com a ) = (x b , com b ). Second, if φ a = φ b , then condition ( * ) ensures that com a = com b . Hence once again, (x a , com a ) = (x b , com b ), and then Pr [ Succ 3 ] ≤ Pr [ Succ 4 ] + Adv cr H (C ) . In game G 5 , instead of returning the value M (φ(K), h), we always return a random value. To show that games G 4 and G 5 are indistinguishable, we design an adversary B against the extended (S, Φ)-unique-input-related-key pseudorandom function security of M such that Pr [ Succ 4 ] ≤ Pr [ Succ 5 ] + Adv ext-ui-prf-rka Φ,S,M (B) . Adversary B starts by initializing sets D ← ∅, E ← ∅, G ← ∅. Then B gets helper information help Φ = Help Φ (K), then runs A . When the latter makes an RKFn-query (φ, x), B responds as follows. First, it computes com = Com(φ(K)) using its helper information. Then, B checks if com ∈ E and φ ∈ D. If they do, B picks com $ ComSp\E at random. B then sets D ← D ∪ {φ} and E ← E ∪ {com}. Next, B computes h ← H(x, com) and checks if h ∈ G. If it does, B picks h $ ← S\G at random. Notice that this step guarantees that all values h are in S and are all distinct as long as A makes at most |S| queries. Finally,

  where A C,b is the polynomial x∈{0,1} n |C(x)=b n i=1 T x i i for any C ∈ ROF n and b ∈ {0, 1}. Efficient Evaluation of A C,b . One can efficiently compute A C,b recursively as follows:

Lemma 6 . 3 . 1 .

 631 Assuming DDH holds in G, NR is an (S rof , Γ rof )-aggregate pseudorandom function.

  NR or AGGPRFRand NR , which is almost straightforward by definition of the PLP security. On the one hand, it is clear that if B's oracle responds to a query P by [P ( #" a ) • b], then A gets exactly the (standard or aggregate) values of the Naor-Reingold PRF defined with the generator g = [1] and with the key (b, a 1 , . . . , a n ) ∈ Z n+1 p

Lemma 6 . 4 . 1 .

 641 Assuming DDH holds in G, CH is a multilinear pseudorandom function.

.Lemma 6 . 4 . 2 .

 642 4.1. Let us denote by CH sym this symmetric construction, whose key space and domain are respectively Z p and (Z p ) n Assuming n-DDHI holds in G, CH sym is a symmetric multilinear pseudorandom function.

Construction 7 . 1 . 2 (

 712 Construction of Straddling Set Systems). . Let k be a fixed integer and let S = {1, . . . , 2k -1}. Then, the following partitions form a k-straddling set system over S : S 0 = (S 0,1 , . . . , S 0,k ) = ({1}, {2, 3}, {4, 5}, . . . , {2k -4, 2k -3}, {2k -2, 2k -1}) S 1 = (S 1,1 , . . . , S 1,k ) = ({1, 2}, {3, 4}, . . . , {2k -3, 2k -2}, {2k -1}) .

  Formally, we let U = {1, . . . , k + n} be the set of indices for a multilinear map, {a i,b } i∈[k],b∈{0,1} and {c j,b } j∈[n],b∈{0,1} be random scalars in Z p and âi,b = [a i,b ] {i} be the encoding of a i,b at index index i and ĉj,b = [c j,b ] {j+k} be the encoding of c j,b at index level j + k. We then consider the function whose evaluation is:

  b 1 ,b 2 all have distinct indices. Therefore, the polynomials Q all have distinct indices too. No monomial in two different Q of the sum Q (when forgetting the indices) can therefore cancel out, otherwise this would mean that the adversary can construct two equal monomials (without ẑi,b ) with two different indices. This is impossible as, except for ẑi,b , two distinct handles correspond to two fresh variables (or in other words, all the handles except ẑi,b are encodings of scalars chosen uniformly and independently at random).

Corollary 7 . 3 . 5 (

 735 Security in the generic multilinear map model). F is an XOR-related-key secure pseudorandom function in the generic multilinear map model.

Definition 7 . 4 . 1 (

 741 (k, n, X, Y )-XY-DDH). Let k and n be two positive integers. Let X and Y be two non-empty and disjoint indices in the index set U of our construction in Section 7.2.2. The advantage of an adversary D against the (k, n, X, Y )-XY-DDH problem is:

Finalize(b) Return b Figure 7 . 1 :

 b71 Figure 7.1: Games defining the XY-DDH and Sel-Prod problems

Game G 2 .

 2 âi,b = [a i,b ] S 0,0,i BitCommit i,b γi,b = [a i,K i ⊕b ] S 0,1,i BitCommit i,b .This game is perfectly indistinguishable from the previous one, so:Pr [ G 0 ⇒ 1 ] = Pr [ G 1 ⇒ 1 ]. In this game, γi,b are now chosen uniformly at random and independently of the public parameters âi,b . It is immediate to see that games G 1 and G 2 are indistinguishable under the (k, n)-Sel-Prod assumption. More precisely, we can construct an adversary D running in time similar to A such that:Pr [ G 1 ⇒ 1 ] -Pr [ G 2 ⇒ 1 ] ≤ Adv (k,n)-Sel-Prod (D) .

(k,n,S j - 1 j=1 2 ← [ 1 ] 2 ← [ 1 ] 1 ,i 2 ,b 1 ,b 2 ← [ 1 ]Figure 7 . 2 : 2 ← [ 1 ] 2 ← [ 1 ]Figure 7 . 3 :

 121211212172212173 Figure 7.2: Games G 0 , G 1 , G 2 , G 3 for the proof of Theorem 7.4.4

3 . 2

 32 and to the case (k, n, X, Y )-XY-DDHRand of the proof of Theorem 7.5.1.

Question 8. 1 .

 1 Figures

2.3.2.1 Definition Definition 2.3.2

  (Pseudorandom Function). A pseudorandom function is defined by a tuple of two polynomial-time algorithms F = (F.Setup, F.Eval) such that:

  •, •) to denote CH.Eval pp (•, •).

	Theorem 2.3.11. Assuming the DDH assumption holds in G, CH is a multilinear pseudo-
	random function.

Definition 2.4.1 (Formal Symbol). A formal symbol is a bitstring in {0, 1} * . Distinct variables

  denote distinct bitstrings, and we call a fresh formal symbol any bitstring in {0, 1} * that has not already been assigned to a formal symbol.

Definition 2.4.2 (Index

  Sets). An index set is a set of formal symbols called indices.Please note that for the index set S = ∅, [x] ∅ is simply the scalar x ∈ Z p .

	• MM.Encode takes as inputs secret parameters mm.sp, a scalar x ∈ Z p , and an index set S ⊆ U and outputs:
	MM.Encode(mm.sp, x, S) → [x] S ;
	• MM.Add takes as inputs public parameters mm.pp and two encodings with same index set S ⊆ U and outputs:
	MM.Add(mm.pp, [x] S , [y] S ) → [x + y] S ;
	• MM.Mult takes as inputs public parameters mm.pp and two encodings with index sets S 1 , S 2 ⊆ U respectively and outputs:
	MM.Mult(mm.pp, [x] S 1 , [y] S 2 ) →	[xy] S 1 ∪S 2 if S 1 ∪ S 2 ⊆ U ⊥ otherwise	;
	• MM.ZeroTest takes as inputs public parameters mm.pp and a top-level encoding (with index set U ) and outputs:
	MM.ZeroTest(mm.pp, [x] S ) →	"zero" "non-zero" otherwise if S = U and x = 0	;
	• MM.Extract takes public parameters mm.pp and a top-level encoding [x] U as inputs and outputs a canonical and random representation of [x] U .
	Remark 2.4.4. The MM.Extract algorithm is needed for our pseudorandom function, con-structed in Chapter 7, to be deterministic with all currently known instantiations of multilinear maps [GGH13; CLT13; GGH15; CLT15]. Indeed, in these instantiations, the same group element has many different representations, and the extraction procedure enables to extract a unique representation from any top-level group element (i.e., of index U ). This extraction is necessary for our proof under non-interactive assumptions in Section 7.4.2 to work.
	Definition 2.4.3 (Multilinear Map). A multilinear map is defined by a tuple of six algo-rithms (MM.Setup, MM.Encode, MM.Add, MM.Mult, MM.ZeroTest, MM.Extract) with the fol-
	lowing properties:
	• MM.Setup takes as inputs the security parameter κ in unary and an index set U , termed the top-level index set, and generates public parameters mm.pp, secret parameters mm.sp,
	and a prime number p;

For our proofs in the generic multilinear map model, this is not required. For this reason, our generic multilinear map model does not support extraction for the sake of simplicity. Actually, this only strengthens the result, as before extraction, the adversary still has to possibility to add top-level group elements while extracted values are not necessarily homomorphic.

Definition 2.4.5 (Generic

  Multilinear Map Oracle). A generic multilinear map oracle is a stateful oracle M that responds to queries as follows: • On a query MM.Setup(1 κ , U ), M generates a prime number p and parameters mm.pp, mm.sp as fresh nonces chosen uniformly at random from {0, 1} κ . It also initializes an internal table T ← [] that it uses to store queries and handles. It finally returns (mm.pp, mm.sp, p) and set internal state so that subsequent MM.Setup queries fail. On a query MM.Add(z, h 1 , h 2 ), with z, h 1 , h 2 ∈ {0, 1} κ , it checks that z = mm.pp, that h 1 and h 2 are handles in T which are mapped to values (x 1 , S 1 ) and (x 2 , S 2 ) such that S 1 = S 2 = S ⊆ U , and returns ⊥ if the check fails. If it passes, it generates a fresh handle h 1} κ , adds h → (x 1 + x 2 , S) to T , and returns h. • On a query MM.Mult(z, h 1 , h 2 ), with z, h 1 , h 2 ∈ {0, 1} κ , it checks z = mm.pp, that h 1 and h 2 are handles in T which are mapped to values (x 1 , S 1 ) and (x 2 , S 2 ) such that S 1 ∪ S 2 ⊆ U , and returns ⊥ if the check fails. If it passes, it generates a fresh handle h 1} κ , adds h → (x 1 x 2 , S 1 ∪ S 2 ) to T , and returns h.

	• On a query MM.Encode(z, x, S), with z ∈ {0, 1} κ and x ∈ Z p , it checks that z = mm.sp and S ⊆ U and outputs ⊥ if the check fails, otherwise it generates a fresh handle h $ ← {0, 1} κ , adds h → (x, S) to T , and returns h.
	• $ ← {0, • On a query MM.ZeroTest(z, h), with z, h ∈ {0, 1} κ , it checks z = mm.pp, that h is a handle in T such that it is mapped to a value (x, U ), and returns ⊥ if the check fails. If it passes, it returns "zero" if x = 0 and "non-zero" otherwise.

$ ← {0,

3.1 Definition and Security Model

  . . . . . . . . . . . . . . . . . . . . .

30 3.2 First Impossibility and Feasibility Results

  . . . . . . . . . . . . . . . 31 3.2.1 Impossibility Results . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3.2.2 Feasibility Results . . . . . . . . . . . . . . . . . . . . . . . . . . .

31 3.3 The Central Role of Pseudorandom Functions .

  . . . . . . . . . . .

32 3.4 The Bellare-Cash Framework, Revisited .

	3	. . . . . . . . . . . . . . . 33 3.4.1 Additional Notions . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 3.4.2 Dealing with Key-Collisions . . . . . . . . . . . . . . . . . . . . . . 34 3.4.3 The (Extended) Framework . . . . . . . . . . . . . . . . . . . . . . 35

.5 Application: Related-Key Security for Affine Relations

  . . . . . . . 41 3.5.1 Ingredients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 3.5.2 Putting Everything Together . . . . . . . . . . . . . . . . . . . . .

44 3.6 Further Generalization of the Bellare-Cash Framework .

	3	. . . . . . 44 3.6.1 Relaxing the Requirements of the Framework . . . . . . . . . . . . . 44 3.6.2 From Malleability to Unique-Input-Related-Key Security . . . . . . . 49

.7 Application: Related-Key Security for Affine Relations. .

  . . . . . 52

	-29 -

55 4.3 Connexion with Standard Assumptions

  . . . . . . . . . . . . . . . . . . . . 56 4.3.1 Summary of Relations . . . . . . . . . . . . . . . . . . . . . . . . . 56 4.3.2 Relation with the DDHI Assumption . . . . . . . . . . . . . . . . . 56 4.

4 Security in the Generic Multilinear Group Model

  . . . . . . . . . . 58 4.4.1 Definitions: Monomial Order and Leading Commutative Monomials . 58 4.4.2 Main Lemma . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 4.4.3 Putting Everything Together . . . . . . . . . . . . . . . . . . . . .

65

-53 -

Table 4 .

 4 assumption is implied by the DDH assumption when k = 1 and by the U k -MDDH for k ≥ 2. Also, for k = 1 and d ≥ 2, the E k,d -MDDH assumption is implied by the d-DDHI assumption, as detailed below. Finally, we show in Section 4.4, that for the remaining cases (k ≥ 2, d ≥ 2), the E k,d -MDDH assumption holds in the generic k-linear group model. These security results are summarized in Table4.1.

1: Security of E k,d -MDDH

.

  Informally, in the (standard) generic group model, an adversary is only able to perform group operations. That is, given a multiplicative group G of order p and group elements [a] , [b], an adversary can compute elements of the form [a + b] or [a • α] with α ∈ Z p , but not [a • b]. The generic k-linear group model is a generalization of this model. In this model, the adversary is more powerful as it has access to a k-linear map. That is, it can now compute, given [a 1 ] , . . . , [a k+1 ], a group element whose discrete logarithm is a 1 • • • a k , so the product of k of the a i 's, but cannot compute a group element whose discrete logarithm is

5.1 Intuition and Subtleties

  . . . . . . . . . . . . . . . . . . . . . . . . . 68 5.1.1 Intuition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 5.1.2 Procedure for Testing Linear Dependence . . . . . . . . . . . . . . . 68 5.1.3 Extension to Weaker Assumptions . . . . . . . . . . . . . . . . . . . 70 5.1.4 On the Representation of Multivariate Polynomials . . . . . . . . . . 70 5.

2 Formal Security Notion and Main Result

  . . . . . . . . . . . . . . . 72 5.2.1 Formal Definition of the Polynomial Linear Pseudorandomness Security 72 5.2.2 The PLP Theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 5.2.3 Immediate Corollary: the LIP Theorem . . . . . . . . . . . . . . . . 73 5.

3 Proof of Theorem 5.2.2

  . . . . . . . . . . . . . . . . . . . . . . . . . . 74 5.3.1 Decomposition Lemmata . . . . . . . . . . . . . . . . . . . . . . . 74 5.3.2 The Main Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . .

75

-67 -

  are computationally indistinguishable from the group elements: [T 1 , . . . , T n ] ≤d , Z p ) being a random linear function from the vector space Z p [T 1 , . . . , T n ] ≤d (with d the maximum degree of P 1 , . . . , P q in any indeterminate T i ) to the base field Z p . Our main theorem (Theorem 5.2.2) shows that this security notion holds under the E 1,d -MDDH assumption (and thus also under DDH for d = 1 and d-DDHI for d ≥ 2).

[U (P 1 )] , . . . , [U (P q )] , with U $ ← L(Z p

  z 1 ,...,z j =

		N P,j ν=1	C P,j,ν • c P,j,ν,z 1 ,...,z j	(5.3)
	C P,j,z 1 ,...,z j =	N P,j+1 ν=1	d i=0	C P,j+1,ν • A i

j+1 • c P,j+1,ν,z 1 ,...,z j ,i .

(5.4)

Proof of Theorem 5.2.2. We write N the maximum of the N P,j 's and M = (d + 1)

• q • N • m.

Let A be an adversary against the (n, d, k, m)-PLP security of G that makes q oracle queries. We prove a first statement under the (E k,d , M )-MDDH assumption, which denotes the M -fold E k,d -MDDH assumption. We can then use random self-reducibility to obtain our statement under the E k,d -MDDH assumption. Please refer to Chapter 4 for formal definitions of this intermediate assumption and of random self-reducibility.

More precisely, we first design an adversary B against the (E k,d , N )-MDDH problem such that:

2 Applications to Related-Key Security

assumption). Please refer to Table

4

.1 on page 56 for a summary of the relations. Contents 6.1 Applications to Standard Pseudorandom Functions . . . . . . . . . 82 6.1.1 Extended Number-Theoretic Pseudorandom Functions . . . . . . . . 82 6.1.2 Simple Proofs of Security . . . . . . . . . . . . . . . . . . . . . . . 83 6.. . . . . . . . . . . . . . . . . 85 6.2.1 Direct Constructions . . . . . . . . . . . . . . . . . . . . . . . . . . 86 6.2.2 Constructions From Unique-Input-Related-Key Security, Algebraically 87 6.2.3 Other Applications to Related-Key Security . . . . . . . . . . . . . . 97 6.2.4 Extension to Weaker Assumptions . . . . . . . . . . . . . . . . . . . 100 6.2.5 A Further Generalization of the Framework . . . . . . . . . . . . . .

100 6.3 Applications to Aggregate Pseudorandom Functions

  . . . . . . . . . 106 6.3.1 Read-Once Formula Aggregation . . . . . . . . . . . . . . . . . . . 106 6.3.2 Impossibility Results . . . . . . . . . . . . . . . . . . . . . . . . . . 108 6.3.3 Extension to Weaker Assumptions . . . . . . . . . . . . . . . . . . . 109 6.

4 Applications to Multilinear Pseudorandom Functions

  . . . . . . . .

	109 6.4.1 Cohen-Holmgren Construction . . . . . . . . . . . . . . . . . . . . . 109 6.4.2 Symmetric Multilinear Pseudorandom Functions . . . . . . . . . . . 110 6.4.3 Skew-Symmetric Multilinear Pseudorandom Function . . . . . . . . . 111 6.4.4 Extension to Weaker Assumptions . . . . . . . . . . . . . . . . . . . 111
	-81 -

Linearly Independence Properties for Section 6.2.3.1 and Section 6.2.3.2

	For Univariate Polynomials. Let P #" φ ,x (

  2 ,b 1 ,b 2 -please refer to the construction in Section 7.2.2 for details. This variant characterization follows the formalization from [Zim15, Appendix B]. are actually "noisy" variants of our formal definition. That is, each encoding includes a random error term, and similarly to what happens for lattice-based constructions, this error term grows when performing operations (addition or multiplication).

	of multilinear maps
	Actual Instantiations of Multilinear Maps. While Definition 2.4.3 is a very natural definition and is what we actually would like as a multilinear map, up to now, we still do not know any such construction. Known constructions [GGH13; CLT13; GGH15; CLT15]

  al.[START_REF] Badrinarayanan | Postzeroizing Obfuscation: New Mathematical Tools, and the Case of Evasive Circuits[END_REF]. ((Non-trivial) encoding of zero). An adversary A in the generic multilinear map model with multilinear map oracle M returns a (non-trivial) encoding of zero if it returns a handle h (output by M ) such that h corresponds to the element 0 in M 's table and the polynomial corresponding to the handle is not identically null. Security in the Generic Multilinear Map Model 119 queries to the oracle M and q RKFn queries to the oracle RKFn, we have:

	7.3 Pr PRFReal A F ⇒ an encoding of 0 ≤ q M	q RKFn 2 k +	k + n p
	and
	Pr PRFRand A F ⇒ an encoding of 0 ≤ q M	k + n p	.
	Proof of Theorem 7.3.2. We first introduce a technical lemma.
	Lemma 7.3.3. Let k and n be two positive integers. Let U be the index defined in Sec-tion 7.2.2. Let ẑi 1
	Definition 7.3.1 Theorem 7.3.2 (Impossibility of constructing encodings of zero). In the	Chapter 7
	generic multilinear map model with oracle M , for any adversary A making at most q M

  3.3. Let T denote the index set of t 1 and t 2 . For i = 1, . . . , k, one can interstect T with S i . As T cannot contain S i (since it cannot contain S i,b,i for any b ∈ {0, 1} as it is not contained in any index set of any ẑi 1 ,i 2 ,b 1 ,b 2 ), we have T ∩ S i = S i . Therefore, for any (i 1

  2 ,b 1 ,b 2 , and Z are distinct subsets of {(i 1 , i 2 ) | 1 ≤ i 1 < i 2 ≤ k} × {0, 1} 2 (L might be exponential in q M ,but that does not matter for what follows).Let us now show that if P is not the zero polynomial, then when replacing ẑi 1 ,i 2 ,b 1 ,b 2 by 1, the resulting polynomial is still a non-zero polynomial. From Lemma 7.3.3, one can assume that elements

2.2 Classical Computational Assumptions

2.3 Cryptographic Primitives

2.4 Multilinear Maps and the Generic Multilinear Map Model

3.4 The Bellare-Cash Framework, Revisited

3.5 Application: Related-Key Security for Affine Relations

3.6 Further Generalization of the Bellare-Cash Framework

We suppose that the aggregate pseudorandomness security property holds non-uniformly. When S is expressive enough, we can also do the proof when this security property holds uniformly, see [CGV15, Section

2.2] for details.

We just need to prove that this monomial M does not appear in any other polynomial 1,j k , with (s σ (k) , . . . , s σ (1) ) lower or equal to (s σ(k) , . . . , s σ (1) ) for the lexicographic order (we write it (s σ (k) , . . . , s σ (1) ) (s σ(k) , . . . , s σ(1) )) and

where σ is defined similarly to σ. This will implies that R((Q s,i,j ) s,i,j ) = 0 (as it contains the above monomial M which does not get canceled out by other terms), which is impossible.

Let us suppose that Q s 1 ,1,j 1 • • • Q s k ,1,j k contains the monomial M , with (s σ (k) , . . . , s σ (1) ) (s σ(k) , . . . , s σ (1) ). We first remark that none of the terms in the "left" part of Q s,i,j :

contain monomials multiple of X ,i,j for i ≤ k -1 (from the definition of the monomial order on R). The monomial LM(P

divides the monomial M and can only come from the "right" part of one Q s r ,1,jr , because of Y k-1,j which is only present one time in the monomial M . As in addition,

)), we get that s σ (k) = s σ(k) and j σ (k) = j σ(k) . We can continue like that by induction and prove that s σ (k-1) = s σ(k-1) , j σ (k-1) = j σ(k-1) , . . . , 1) , and j σ (1) = j σ (1) . We finally get that

That was we wanted to prove.

Third, let us conclude by showing all the other cases come down to the first two cases after performing some permutation. More precisely, let σ be a permutation of {1, . . . , k}. Let Σ ∈ Z k×k p be the corresponding permutation matrix: Σ i,j = 1 if and only if σ(j) = i, and Σ i,j = 0 otherwise. We also set:

so that:

Let R be the polynomial R where U s,i,j is replaced by U s,σ(i),j . We have:

Therefore, as R((Q s,i,j ) s,i,j ) = 0, we have R ((Q s,i,j ) s,i,j ) = 0. And it is clear that R = 0 if and only if R = 0.

Let us now show that R contain no monomial

This will prove that R = 0. To do that, let us suppose by contradiction that R contains such monomial M . We consider two cases: Chapter 7

Chapter 7 A Provably-Secure Pseudorandom Function For XOR-Relations

In this chapter, we construct the first XOR-related-key secure pseudorandom function that is provably-secure, assuming the existence of a weak form of multilinear maps. As the existence of multilinear maps is still an important controversial matter, this result should mainly be seen as a proof of concept.

However, despite recent devastating attacks against current multilinear maps, we prove that none of these attacks affect the security of our construction. Then, an important contribution of this work is also to explore a different way to prove security of multilinear-map-based constructions by taking attacks into account. In particular, as our construction is secure even with current instantiations, we only require a weak form of multilinear maps, and hope that such a weak form might exist under on standard assumptions.

Security of the XY-DDH Assumption in the Generic

Multilinear Map Model Theorem 7.5.1 (Impossibility of constructing encodings of zero). Let k and n be two positive integers. Let X and Y be two non-empty and disjoint indices from the index set U of our construction in Section 7.2.2. In the generic multilinear map model with oracle M , for any adversary D making at most q M queries to the oracle M , we have:

Proof of Theorem 7. 5

four polynomials over all the formal variables except d0 , d1 , ê0 , ê1 , because indices prevent the multiplication of two of the variables d0 , d1 , ê0 , ê1 . Furthemore at least one of the polynomials Proof of Corollary 7.5.2. We just consider an intermediate game where we simulate everything as before except the zero-testing oracle which always outputs "non-zero" unless its input is zero, as a polynomial. Then, we have:

and Corollary 7.5.2 easily follows.

Chapter 7

7.6 Security of the Sel-Prod Assumption in the Generic Multilinear Map Model 129

Security of the Sel-Prod Assumption in the Generic Multilinear Map Model

The proof of the Sel-Prod assumption is subtle and first requires the introduction of the notion of profiles and some lemmata.

Proof Ingredient: Index Sets and Profiles

We adapt the proof in [Zim15, Section 3.4] to our case. In the whole section, monomials and polynomials are over the formal variables âi,b , γi,b , ĉj,b , ẑi 1 ,i that prof(t 1 ) = ⊥ and prof(t 2 ) = ⊥. We say that:

• the profile prof(t 1 ) is partial if prof(t 1 ) i = * for some i ∈ {1, . . . , k};

• the profiles prof(t 1 ) and prof(t 2 ) conflict if there exists i ∈ {1, . . . , k} such that prof(t 1 ) i , prof(t 2 ) i ∈ {0, 1} and prof(t 1 ) i = prof(t 2 ) i .

We also define the merge of two non-conflicting profiles prof(t 1 ) and prof(t 2 ) as the tuple (b 1 , . . . , b n ) such that:

Definition 7.6.3 (Profile of a polynomial). Let P be a polynomial. The profile of a polynomial P is:

• ⊥ if some monomial in the formal expansion (without cancellation) of P has a profile ⊥;

• the set {prof(t) | t is in the formal expansion of P } otherwise.

Let us now characterize the polynomials that appears in Sel-Prod.

Lemma 7.6.4 (Characterization of polynomials in Sel-Prod). Let A be an adversary in the generic multinear map model, making at most q queries to the multilinear map oracle M , and returning a handle h corresponding to some polynomial P . Then, P satisfies one of these two conditions:

Abstract

In this thesis, we study the algebraic structure underlying number-theoretic pseudorandom functions. Specifically, we define an algebraic framework that translates the pseudorandomness of a particular form of functions into a simple algebraic property. The resulting generic framework encompasses most of existing constructions and naturally extends to related primitives, such as related-key secure, aggregate, and multilinear pseudorandom functions.

This framework holds under a family of MDDH assumptions, that contains especially different classical assumptions, such as DDH, DLin, or k-Lin. Therefore, setting accordingly the parameters in the constructions, our framework can be used to construct secure pseudorandom functions (or related primitives) whose security holds under these assumptions.

Finally, we also study more specifically the case of related-key security. On the one hand, we propose a fix and some extensions to the Bellare-Cash framework and then build pseudorandom functions secure against larger classes of attacks. On the other hand, we construct the first pseudorandom function provably secure against XOR attacks. The latter construction relies on the existence of a weak form of multilinear maps.