We consider indistinguishability obfuscation ( \(\textsf{i}\mathcal {O}\) ) for multi-output circuits \(C :\{0,1\}^n \rightarrow \{0,1\}^n\) of size s, where s is the number of AND/OR/NOT gates in C. Under the worst-case assumption that \(\textsf{NP} \nsubseteq \textsf{BPP}\) , we establish that there is no efficient indistinguishability obfuscation scheme that outputs circuits of size \(s + o(s/\log s)\) . In other words, to be secure, an efficient \(\textsf{i}\mathcal {O}\) scheme must incur an \(\varOmega (s/\log s)\) additive overhead in the size of the obfuscated circuit. The hardness assumption under which this negative result holds is minimal, since an optimal \(\textsf{i}\mathcal {O}\) scheme with no circuit size overhead exists if \(\textsf{NP} \subseteq \textsf{BPP}\) . Expanding on this result, we also rule out \(\textsf{i}\mathcal {O}\) for single-output database-aided circuits with an arbitrary polynomial overhead in circuit size. This strengthens an impossibility result by Goldwasser and Rothblum [GR07], which considered circuits with access to an exponential-length database that the obfuscator has oracle access to; in contrast, our impossibility result holds even w.r.t. polynomial-size databases and even w.r.t. obfuscators that may run in time polynomial in the size of the database (and thus may read the whole database). The proof of our main result builds on a connection between obfuscation and meta-complexity put forward by Mazor and Pass [MP24], and on the \(\textsf{NP} \) -hardness of circuit minimization for multi-output circuits established by Loff, Ilango, and Oliveira [ILO20], together with other techniques from cryptography and complexity theory.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Lower Bounds on the Overhead of Indistinguishability Obfuscation

  • Zhenjian Lu,
  • Noam Mazor,
  • Igor C. Oliveira,
  • Rafael Pass

摘要

We consider indistinguishability obfuscation ( \(\textsf{i}\mathcal {O}\) ) for multi-output circuits \(C :\{0,1\}^n \rightarrow \{0,1\}^n\) of size s, where s is the number of AND/OR/NOT gates in C. Under the worst-case assumption that \(\textsf{NP} \nsubseteq \textsf{BPP}\) , we establish that there is no efficient indistinguishability obfuscation scheme that outputs circuits of size \(s + o(s/\log s)\) . In other words, to be secure, an efficient \(\textsf{i}\mathcal {O}\) scheme must incur an \(\varOmega (s/\log s)\) additive overhead in the size of the obfuscated circuit. The hardness assumption under which this negative result holds is minimal, since an optimal \(\textsf{i}\mathcal {O}\) scheme with no circuit size overhead exists if \(\textsf{NP} \subseteq \textsf{BPP}\) . Expanding on this result, we also rule out \(\textsf{i}\mathcal {O}\) for single-output database-aided circuits with an arbitrary polynomial overhead in circuit size. This strengthens an impossibility result by Goldwasser and Rothblum [GR07], which considered circuits with access to an exponential-length database that the obfuscator has oracle access to; in contrast, our impossibility result holds even w.r.t. polynomial-size databases and even w.r.t. obfuscators that may run in time polynomial in the size of the database (and thus may read the whole database). The proof of our main result builds on a connection between obfuscation and meta-complexity put forward by Mazor and Pass [MP24], and on the \(\textsf{NP} \) -hardness of circuit minimization for multi-output circuits established by Loff, Ilango, and Oliveira [ILO20], together with other techniques from cryptography and complexity theory.