Output-Compressing Randomized Encodings and Applications

We consider randomized encodings (RE) that enable encoding a Turing machine P and input x into its “randomized encoding” \hat{P(x)} in sublinear, or even polylogarithmic, time in the running-time of P(x), independent of its output length. We refer to the former as sublinear RE and the latter as compact RE. For such efficient RE, the standard simulation-based notion of security is impossible, and we thus consider a weaker (distributional) indistinguishability-based notion of security: Roughly speaking, we require indistinguishability of \hat{P0(x0)} and \hat{P0(x1)} as long as P0, x0 and P1, x1 are sampled from some distributions such that P0(x0), Time(P0(x0)) and P1(x1), Time(P1(x1)) are indistinguishable.

We first observe that compact RE is equivalent to a variant of the notion of indistinguishability obfuscation (iO)—which we refer to as puncturable iO—for the class of Turing machines without inputs. For the case of circuits, puncturable iO and iO are equivalent (and this fact is implicitly used in the powerful “punctured program” paradigm by Sahai and Waters [SW14]).

We next show the following:

1. Impossibility in the Plain Model: Assuming the existence of one-way functions, subexponentially-secure sublinear RE does not exists. (If additionally assuming subexponentially-secure iO for circuits we can also rule out polynomially-secure sublinear RE.) As a consequence, we rule out also puncturable iO for Turing machines (even those without inputs).

2. Feasibility in the CRS model and Applications to iO for circuits: Subexponentially-secure sublinear RE in the CRS model and one-way functions imply iO for circuits through a simple construction generalizing GGM’s PRF construction. Additionally, any succinct (even with sublinear succinctness) functional encryption essentially directly yields a sublinear RE in the CRS model, and as such we get an alternative, modular, and simpler proof of the results of [AJ15, BV15] showing that subexponentially-secure sublinearly succinct FE implies iO.

3. Applications to iO for Unbounded-input Turing machines: Subexponentially-secure compact RE for natural restricted classes of distributions over programs and inputs (which are not ruled out by our impossibility result, and for which we can give candidate constructions) imply iO for unbounded-input Turing machines. This yields the first construction of iO for unbounded-input Turing machines that does not rely on (public-coin) differing-input obfuscation.