\documentclass[10pt]{article}

\usepackage[margin=0.75in]{geometry}
\usepackage{upquote}
\input{latexdefs}

\begin{document}

\newlength{\boxwidth}
\setlength{\boxwidth}{\textwidth}
\addtolength{\boxwidth}{-1cm}
\noindent\framebox[\textwidth]{
\begin{minipage}[t]{\boxwidth}
  {\bf CS 395T: Topics in Cryptography \hfill Spring 2022}  \\ [-0.3cm]
  \begin{center} 
    {\Large Problem Set 2}
  \end{center}
  {\bf Due:} May 6, 2022 at 11:59pm (Submit on Gradescope) \hfill
  {\bf Instructor:} David Wu
\end{minipage}}

\paragraph{Instructions.} You {\bf must} typeset your
solution in LaTeX using the provided template:
\begin{center}
  \url{https://www.cs.utexas.edu/~dwu4/courses/sp22/static/homework.tex}
\end{center}
You must submit your problem set
via \href{https://gradescope.com/}{Gradescope} (accessible through 
\href{https://canvas.utexas.edu/}{Canvas}). {\color{OliveGreen} {\bf Last updated:} \today.}

\paragraph{Collaboration Policy.} You may discuss your general approach
with other students, but you may not share written
documents. You should not search online for solutions to these problems.
If you do consult external sources, you must cite them in your submission.
You must include the names of all of your collaborators with your submission.
Refer to the \href{https://www.cs.utexas.edu/~dwu4/courses/sp22/info.html}{official course policies}
for the full details.

\paragraph{Instructions.} We will add problems to the problem set throughout the
semester (roughly 1 problem each week), with the last problem added at least a
week in advance of the due date. All problems are weighted equally. You
should submit solutions to at least 70\% of the problems (rounded down). If you
submit solutions to more than 70\% of the problems, we will drop the
lowest-scoring problems when computing your final homework score.
{\color{MidnightBlue} If you scribed {\em at least}
two lectures during the course of this semester, you only need to submit solutions to
at least 50\% of the problems (rounded down).}

\problem{ABE Key Delegation}
In an ABE scheme, secret keys are associated with
functions $f \colon \zo^\ell \to \zo$ and ciphertexts are associated
with an attribute-message pair $(x, \mu)$ where $x \in \zo^\ell$
and $\mu \in \zo$. A secret key $\sk_f$ for a function $f$ successfully
decrypts a ciphertext $\ct_{x, \mu}$ associated with $(x, \mu)$ if
$f(x) = 0$ (using the conventions for the construction from lecture).
We say that the scheme supports key delegation if the holder of a secret
key $\sk_f$ can generate a key for the function $(f \wedge g)$
where $(f \wedge g)(x) = 0$ if and only if $f(x) = 0 = g(x)$. Show
how to modify the key-generation algorithm for the ABE scheme from
class so that it additionally supports key delegation.
The key-delegation algorithm should only take the {\em master public key}
$\mpk$, the secret key $\sk_f$ associated with $f$, and the
function $g$ as input. It does {\em not} know the master secret key.
Prove the correctness of your key-delegation procedure. You do {\em not} need
to re-prove security of your modified ABE scheme, but the same type of argument
as used in lecture should still apply to your modified scheme.

\problem{Predicate Encryption and Functional Encryption}
In class, we showed how to construct a weak attribute-hiding predicate
encryption scheme from lattices. In this model, we require that the attribute
associated with a ciphertext be hidden only
if the adversary does not possess any keys that allow it to decrypt
the ciphertext. We say a predicate encryption scheme satisfies strong attribute-hiding
if the attribute remains hidden even given decryption keys that successfully decrypt
the ciphertext. Namely, in the semantic security game, the adversary's challenge is a tuple
$(x_0, \mu_0, x_1, \mu_1)$. The tuple is admissible if one of the following two properties hold:
\begin{itemize}
  \item $\mu_0 = \mu_1$ and $f(x_0) = f(x_1)$ for all key queries $f$ the adversary makes; or

  \item $f(x_0) = 1 = f(x_1)$ for all key queries $f$ the adversary makes.
\end{itemize}
Shows that a strong attribute-hiding predicate encryption scheme for general circuit predicates
implies a functional encryption scheme for general circuits. Your functional encryption scheme
should support circuits with {\em multi-bit} outputs (e.g., $C \colon \zo^n \to \zo^m$) and
be collusion resistant (i.e., the adversary can ask for any polynomial number of keys).
You only need to provide a high-level sketch of the security proof of your construction.

\problem{NIZK Proofs of Knowledge}
Recall that in a proof of knowledge, the soundness property is replaced by a stronger knowledge
property, which requires that for every
(possibly malicious) prover that convinces the verifier
of a statement with probability $\varepsilon > 0$, there exist an efficient extractor
that extracts the witness from the prover with probability $\varepsilon - \negl(\lambda)$.
In the common reference string model (CRS), the extractor gets to sample the CRS,
as long as it samples one that is computationally indistinguishable from an honestly-generated CRS.
Show that you can combine
any NIZK for $\ms{NP}$ in the CRS model together with a public-key encryption scheme
to obtain a NIZK proof of knowledge for $\ms{NP}$
in the CRS model. Describe your construction and then
give an {\em informal} sketch of the extractability and zero-knowledge properties.

\problem{Statistical Correlation Intractability from LWE} Recall the correlation-intractable hash
function based on $\SIS$. The hash key $\hk = (\bv, \Bm_1, \ldots, \Bm_\ell)$ where
$\bv \getsr \Zq^n$ and $\Bm_i \getsr \Zq^{n \times k}$. The hash function is then defined as
\[ \hash(\hk, x) \deq \Ginv(\bv + \Bm_{U_x} \Ginv(\tilde \gv)) \text{ where }
   \Bm_{U_x} \gets [\Bm_1 ~|~ \cdots ~|~ \Bm_\ell] \cdot \Hm_{U_x}, \]
and $\tilde \gv$ is the vector consisting of the elements of $\Gm$.
Show how to modify $\hk$ so the construction is {\em statistically} correlation-intractable
for any fixed and efficiently-computable function $f$. Namely, show how to sample a hash key
$\hk$ such that there does not {\em exist} any $x$ where $f(x) = \hash(\hk, x)$. The hash key
$\hk$ should be computationally indistinguishable (under the $\LWE$ assumption)
from the real hash key (where all components are uniform).\footnote{We often refer to this property
as {\em somewhere statistical correlation intractability.}}
Prove both the statistical correlation
intractability property and the hash key indistinguishability properties.

\problem{Correlation Intractability for Polynomial-Size Sets} In class, we showed how to construct
a correlation-intractable hash function for any efficiently-searchable relation $\calR$. Namely, the
relation $\calR$ has the property that for every
instance $x$, there is a unique $y \gets f(x)$ such that $\calR(x, y) = 1$. Suppose instead
that for every input $x$, there exists a set $S_x$ of size $\abs{S_x} = d$
where $\calR(x, y) = 1$ for every $y \in S_x$ (and $0$ otherwise). Here
$d = \poly(\lambda)$. Suppose moreover that there
exists an efficiently-computable function $g$ that takes as input $x$ and outputs the set $S_x$.
Show how to use a correlation-intractable hash function for an efficiently-searchable relation
to construct a correlation-intractable hash function for $\calR$. As usual,
the hash key for your construction should not depend on $g$ (but could depend on the size/depth of $g$).
Prove the security of your construction.

\problem{Multi-Key FHE and Homomorphic Secret Sharing} In class, we showed how to obtain
a 2-party HSS scheme from a multi-key FHE scheme. Explain why the approach we described in
class does not yield an HSS scheme for more than 2 parties. ({\bf Note:} We can construct $n$-party HSS
from multi-key FHE by boosting the 2-party construction, but this is beyond the scope 
of this question).

\paragraph{Optional Feedback.} Please answer the following
{\em optional} questions to help us design future problem sets.
You do not need to answer these questions.
However, we do encourage you to provide us feedback on how to improve the
course experience.
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item How long did you spend on this problem set?
  
  \item What was your favorite problem on this problem set? Why?

  \item What was your least favorite problem on this problem set? Why?

  \item Do you have any other feedback for this problem set?

  \item Do you have any other feedback on this course?
\end{enumerate}

\end{document}
