基于可重随机化混淆电路的可验证计算

Yao的混淆电路可用于客户端将函数计算外包给服务器,并可验证其正确性.然而,混淆电路仅能使用1次.Gennaro 等人组合使用全同态加密和混淆电路,可实现客户端和服务器在多次输入上重用混淆电路.但是,所有已知的全同态加密在效率的提高上似乎仍有很大的空间,并且需要较强的困难性假设.另一方面,Gennaro 等人的方案只能在敌手不能对客户端发起任何数量的验证查询这种较弱的模型下被证明是安全的.部分同态加密的困难性假设要弱于全同态加密,虽然只支持数量有限的同态操作,但比全同态加密运行速度更快、更加紧凑.提出了一个使用加同态加密的可验证计算方案.它基于DDH 假设,能够容忍任意数量的恶意验证查询,采用的主要技术是可重随机化的混淆电路.该技术可以实现重随机化的混淆电路分布与原有的混淆电路分布在计算上是不可区分的.另外,也给出了一种使用可重随机化的混淆电路构造密码转置防火墙方案,称为可重用密码转置防火墙.也就是说,混淆电路可生成1 次,接下来,密码转置防火墙可安全地重随机化和重用多次.

Yao’s garbled circuit allows a client to outsource a function computation to a server with verifiablity. Unfortunately, the garbled circuit suffers from a one-time usage. The combination of fully homomorphic encryption (FHE) and garbled circuits enables the client and the server to reuse the garbled circuit with multiple inputs (Gennaro et al.). However, there still seems to be a long way to go for improving the efficiency of all known FHE schemes and it need much stronger security assumption. On the other hand, the construction is only proven to be secure in a weaker model where an adversary can not issue any number of verification queries to the client. Somewhat homomorphic encryption schemes, whose assumptions are much weaker than the FHE schemes, support a limited number of homomorphic operations. However, they can be much faster and more compact than the FHE schemes. In this work, a verifiable computation scheme is presented which can tolerate any number of malicious verification queries with additively homomorphic encryption. The proposed technique comes from the construction of re-randomizable garbled circuits in which the distribution of the original garbled circuit is computationally indistinguishable from the re-randomized garbled circuit. The proposed scheme is based on the decisional Diffie-Hellman (DDH) assumption. A technique solution is also given to construct cryptographic reverse firewalls, which is called reusable cryptographic reverse firewalls, using re-randomizable garbled circuits. Namely, the solution allows garbled circuits to be generated once and then securely re-randomized for many times on cryptographic reverse firewalls.