Output-Compressing Randomized Encodings and Applications

We consider randomized encodings (RE) that enable encoding a Turing machine Π and input x into its “randomized encoding” Π̂(x) in sublinear, or even polylogarithmic, time in the running-time of Π(x), independent of its output length. We refer to the former as sublinear RE and the latter as compact RE. For such efficient RE, the standard simulation-based notion of security is impossible, and we thus consider a weaker (distributional) indistinguishability-based notion of security: Roughly speaking, we require indistinguishability of Π̂0(x0) and Π̂0(x1) as long as Π0, x0 and Π1, x1 are sampled from some distributions such that Π0(x0),Time(Π0(x0)) and Π1(x1),Time(Π1(x1)) are indistinguishable. We show the following: • Impossibility in the Plain Model: Assuming the existence of subexponentially secure one-way functions, subexponentially-secure sublinear RE does not exists. (If additionally assuming subexponentially-secure iO for circuits we can also rule out polynomially-secure sublinear RE.) As a consequence, we rule out also puncturable iO for Turing machines (even those without inputs). • Feasibility in the CRS model and Applications to iO for circuits: Subexponentiallysecure sublinear RE in the CRS model and one-way functions imply iO for circuits through a simple construction generalizing GGM’s PRF construction. Additionally, any compact (even with sublinear compactness) functional encryption essentially directly yields a sublinear RE in the CRS model, and as such we get an alternative, modular, and simpler proof of the results of [AJ15, BV15] showing that subexponentially-secure sublinearly compact FE implies iO. We further show other ways of instantiating sublinear RE in the CRS model (and thus also iO): under the subexponential LWE assumption, it suffices to have a subexponentially secure FE schemes with just sublinear ciphertext (as opposed to having sublinear encryption time). • Applications to iO for Unbounded-input Turing machines: Subexponentiallysecure compact RE for natural restricted classes of distributions over programs and inputs (which are not ruled out by our impossibility result, and for which we can give candidate constructions) imply iO for unbounded-input Turing machines. This yields the first construction of iO for unbounded-input Turing machines that does not rely on (public-coin) differing-input obfuscation. ∗University of California at Santa Barbara, Email: [email protected]. Work supported in part by a NSF award CNS-1514526. †Cornell University, Email: [email protected]. Work supported in part by a Microsoft Faculty Fellowship, Google Faculty Award, NSF Award CNS-1217821, NSF Award CCF-1214844, AFOSR Award FA9550-15-1-0262 and DARPA and AFRL under contract FA8750-11-2-0211. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the US Government. ‡Cornell University, Email: [email protected]. §Cornell University, Email: [email protected].