Witness encryption (WE) is a recent powerful encryption paradigm, which allows to encrypt a message using the description of a hard problem (a word in an NP-language) and someone who knows a solution to this problem (a witness) is able to efficiently decrypt the ciphertext. Recent work thereby focuses on constructing WE for NP complete languages (and thus NP). While this rich expressiveness allows flexibility w.r.t. applications, it makes existing instantiations impractical. Thus, it is interesting to investigate practical WE schemes for subsets of NP that are still expressive enough for many cryptographic applications.
We show that WE schemes can be generically constructed from smooth projective hash functions (SPHFs). In terms of concrete instantiations of SPHFs (and thus WE), we target languages of statements proven in the popular Groth-Sahai (GS) proof framework. This allows us to provide a novel way to encrypt. In particular, encryption is with respect to a GS proof and efficient decryption can only be done by the respective prover. The so obtained constructions are entirely practical and only require standard assumptions such as DLIN or DDH.
To illustrate our techniques, we propose an elegant fully ad-hoc solution to the following seeming paradox. Assume a whistleblower, say Edwarda, wants to leak authoritative secrets while staying anonymous. Therefore, she signs the leaked documents using a ring signature, which hides her identity unconditionally among other carefully selected people in a potentially huge ad-hoc group. But how should one confidentially reply to the unknown (anonymous) whistleblower. In brief, we demonstrate how to encrypt a message using only a ring signature such that solely the anonymous signer can decrypt and read the reply.
↧