Security - Telenor

Figure 1 This figure illustrates
the general principle of privacy
homomorphisms. The
plaintext is x, the encryption
function E, decryption function
D, and f is a function applied
to plaintext data. The function
f' is the counterpart of f, when
applied to encrypted data
40
f
x
f(x)
E
D
E(x)
f`
f`(E(x))=E(f(x))
2. interact with its environment using either
encrypted or plaintext messages, or a combination
of both;
3. sign certain data in complete confidentiality
while executing on a potentially malicious
host; and
4. support encrypted Turing-universal computation.
If one looks at these requirements, it should
become clear that what is actually needed is the
ability to apply operations to encrypted data. This
problem was originally studied in the form of privacy
homomorphisms for databases. The concept
of privacy homomorphisms is a good idea, and
addresses many of the requirements above as
long as strong encryption is not a requirement.
In spite of this, the concept could be central to
solving the above problem. The few subsequent
approaches in the field have to some degree
based themselves on the privacy homomorphism
concept, even if the resulting system is strictly
speaking not a privacy homomorphism.
5.2.1 Privacy Homomorphisms
Let S and S' be non-empty sets with the same
cardinality. A bijection E : S → S' is the encryption
function, with its inverse D being the corresponding
decryption function. Denote an algebraic
system for cleartext operations by
U = (S; f 1 , ..., f k ; p 1 , ..., p l , s 1 , ..., s m ),
where the f i :S g i → S are functions with arity g i ,
the p i are predicates with arity h i , and the s i are
distinct constants in S. Denote U’s counterpart
for operation with encrypted data by:
C = (S'; f' 1 , ..., f' k ; p' 1 , ..., p' l ; s' 1 , ..., s' m ),
where each f' i corresponds to f i , and each p' i corresponds
to p i , and each s' i corresponds to s i .
Thus f' i has arity g i and p' i has arity h i .
A mapping E is called a privacy homomorphism
if it satisfies the following conditions:
1. For all f i and f' i :
f’ i (a’ i , ..., a’ gi ) =
E K (f i (D K (a’ 1 ), ..., D K (a’ gi ))),
where a’ 1 , ..., a’ gi ∈ S’, and K is a symmetric
encryption key.
2. For all p i and p' i :
p’ i (a’ 1 , ..., a’ gi ) if and only if
p i (D K (a’ 1 ), ..., D K (a’ hi )).
3. For all s i and s' i D K (s' i ) = s i .
Although this is elegant, it has an inherent weakness,
summarized in theorem 3.1 in [5]. In
essence, it is impossible to have a secure encryption
function E for an algebraic system like U
when that system has a predicate p i inducing
a total order on the constants s 1 , ..., s m , and it
somehow is possible to determine the encrypted
version of each constant. The following example
is from the proof of the theorem in [5].
EXAMPLE 5. Take a plaintext system where
si =i∈ N for all 1 ≤i ≤m.
Let one function be
addition (written +), and one predicate be the
relation less-than-or-equal-to (written ≤).
The
corresponding function applied to encrypted
data is written +', and the corresponding predicate
is written ≤'.
If the cryptanalyst knows 1 and
1', it is possible to decrypt any c' to c by doing a
binary search using +', 1', and ≤'.
5.2.2 Computing with
Encrypted Functions
The privacy homomorphism is revisited in work
by Sander and Tschudin [7]. They mention two
potential candidates for encrypted computation:
1. polynomials encrypted with a particular type
of privacy homomorphism; and
2. rational function composition, where one
rational function is used to encrypt another.
Only the first scheme, called non-interactive
evaluation of encrypted functions, is detailed in
their work. Sander and Tschudin present a simple
protocol demonstrating how it could work.
The protocol is as follows:
1. Alice encrypts f.
2. Alice creates a program P(E(f)) which implements
E(f).
3. Alice sends P(E(f)) to Bob.
Telektronikk 3.2000