Annual International Conference on the Theory and Applications of Cryptographic Techniques

EUROCRYPT 2010: Advances in Cryptology – EUROCRYPT 2010 pp 423-444

Bounded Key-Dependent Message Security

  • Boaz Barak
  • Iftach Haitner
  • Dennis Hofheinz
  • Yuval Ishai
Conference paper

DOI: 10.1007/978-3-642-13190-5_22

Volume 6110 of the book series Lecture Notes in Computer Science (LNCS)
Cite this paper as:
Barak B., Haitner I., Hofheinz D., Ishai Y. (2010) Bounded Key-Dependent Message Security. In: Gilbert H. (eds) Advances in Cryptology – EUROCRYPT 2010. EUROCRYPT 2010. Lecture Notes in Computer Science, vol 6110. Springer, Berlin, Heidelberg


We construct the first public-key encryption scheme that is proven secure (in the standard model, under standard assumptions) even when the attacker gets access to encryptions of arbitrary efficient functions of the secret key. Specifically, under either the DDH or LWE assumption, and for arbitrary but fixed polynomials L and N, we obtain a public-key encryption scheme that resists key-dependent message (KDM) attacks for up to N(k) public keys and functions of circuit size up to L(k), where k denotes the size of the secret key. We call such a scheme bounded KDM secure. Moreover, we show that our scheme suffices for one of the important applications of KDM security: ability to securely instantiate symbolic protocols with axiomatic proofs of security.

We also observe that any fully homomorphic encryption scheme that additionally enjoys circular security and circuit privacy is fully KDM secure in the sense that its algorithms can be independent of the polynomials L and N as above. Thus, the recent fully homomorphic encryption scheme of Gentry (STOC 2009) is fully KDM secure under certain non-standard hardness assumptions.

Finally, we extend an impossibility result of Haitner and Holenstein (TCC 2009), showing that it is impossible to prove KDM security against a family of query functions that contains exponentially hard pseudorandom functions if the proof makes only a black-box use of the query function and the adversary attacking the scheme. This shows that the non-black-box use of the query function in our proof of security is inherent.


KDM/clique/circular security fully homomorphic encryption formal security 
Download to read the full conference paper text

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Boaz Barak
    • 1
  • Iftach Haitner
    • 2
  • Dennis Hofheinz
    • 3
  • Yuval Ishai
    • 4
  1. 1.Princeton University 
  2. 2.Microsoft Research 
  3. 3.Karlsruhe Institute of Technology 
  4. 4.Technion and UCLA