Black-box obfuscation

Short description: Proposed cryptographic primitive

In cryptography, black-box obfuscation was a proposed cryptographic primitive which would allow a computer program to be obfuscated in a way such that it was impossible to determine anything about it except its input and output behavior. Black-box obfuscation has been proven to be impossible, even in principle.

Impossibility

The unobfuscatable programs

Barak et al. constructed a family of unobfuscatable programs, for which an efficient attacker can always learn more from any obfuscated code than from black-box access.

Broadly, they start by engineering a special pair of programs that cannot be obfuscated together. For some randomly selected strings [math]\displaystyle{ \alpha, \beta }[/math] of a fixed, pre-determined length [math]\displaystyle{ k }[/math], define one program to be one that computes

[math]\displaystyle{ C_{\alpha, \beta}(x) := \begin{cases} \beta & \text{if }x = \alpha\\ 0 & \text{otherwise} \end{cases} }[/math]

and the other program to one that computes

[math]\displaystyle{ D_{\alpha, \beta}(X) := \begin{cases} 1 & \text{if }X(\alpha) = \beta\text{ and }X\text{ runs in time}\leq\text{poly}(k)\\ 0 & \text{otherwise} \end{cases}. }[/math]

(Here, [math]\displaystyle{ D_{\alpha, \beta} }[/math] interprets its input as the code for a Turing machine. The second condition in the definition of [math]\displaystyle{ D_{\alpha, \beta} }[/math] is to prevent the function from being uncomputable.)

If an efficient attacker only has black-box access, Barak et al. argued, then the attacker only has an exponentially small chance of guessing the password [math]\displaystyle{ \alpha }[/math], and so cannot distinguish the pair of programs from a pair where [math]\displaystyle{ C_{\alpha, \beta} }[/math] is replaced by some program [math]\displaystyle{ Z }[/math] that always outputs "0". However, if the attacker has access to any obfuscated implementations [math]\displaystyle{ C'_{\alpha, \beta}, D'_{\alpha, \beta} }[/math] of [math]\displaystyle{ C_{\alpha, \beta}, D_{\alpha, \beta} }[/math], then the attacker will find [math]\displaystyle{ D'_{\alpha, \beta}(C'_{\alpha, \beta}) = 1 }[/math] with probability 1, whereas the attacker will always find [math]\displaystyle{ D'_{\alpha, \beta}(Z) = 0 }[/math] unless [math]\displaystyle{ \beta = 0 }[/math] (which should happen with negligible probability). This means that the attacker can always distinguish the pair [math]\displaystyle{ (C'_{\alpha, \beta}, D'_{\alpha, \beta}) }[/math] from the pair [math]\displaystyle{ (Z, D'_{\alpha, \beta}) }[/math] with obfuscated code access, but not black-box access. Since no obfuscator can prevent this attack, Barak et al. conclude that no black-box obfuscator for pairs of programs exists.

To conclude the argument, Barak et al. define a third program to implement the functionality of the two previous:

[math]\displaystyle{ F_{\alpha, \beta}(b, x):= \begin{cases} C_{\alpha, \beta}(x) &\text{if } b = 0\\ D_{\alpha, \beta}(x) &\text{if } b = 1\\ \end{cases}. }[/math]

Since equivalently efficient implementations of [math]\displaystyle{ C_{\alpha, \beta}, D_{\alpha, \beta} }[/math] can be recovered from one of [math]\displaystyle{ F_{\alpha, \beta} }[/math] by hardwiring the value of [math]\displaystyle{ b }[/math], Barak et al. conclude that [math]\displaystyle{ F_{\alpha, \beta} }[/math] cannot be obfuscated either, which concludes their argument.

Impossible variants of black-box obfuscation and other types of unobfuscable programs

In their paper, Barak et al. also prove the following (conditional to appropriate cryptographic assumptions):

• There are unobfuscatable circuits.
• There is no black-box approximate obfuscator.
• There are unobfuscatable, secure, probabilistic private-key cryptosystems.
• There are unobfuscatable, secure, deterministic digital signature schemes.
• There are unobfuscatable, secure, deterministic message authentication schemes.
• There are unobfuscatable, secure pseudorandom functions.
• For many protocols that are secure in the random oracle model, the protocol becomes insecure if the random oracle is replaced with an artificial cryptographic hash function; in particular, Fiat-Shamir schemes can be attacked.
• There are unobfuscatable circuits in TC0 (that is, constant-depth threshold circuits).
• There are unobfuscatable sampling algorithms (in fact, these cannot be obfuscated approximately).
• There is no secure software watermarking scheme.

Weaker variants

In their original paper exploring black-box obfuscation, Barak et al. defined two weaker notions of cryptographic obfuscation which they did not rule out: indistinguishability obfuscation and extractability obfuscation (which they called "differing-inputs obfuscation".) Informally, an indistinguishability obfuscator should convert input programs with the same functionality into output programs such that the outputs cannot be efficiently related to the inputs by a bounded attacker, and an extractability obfuscator should be an obfuscator such that if the efficient attacker could relate the outputs to the inputs for any two programs, then the attacker could also produce an input such that the two programs being obfuscated produce different outputs. (Note that an extractability obfuscator is necessarily an indistinguishability obfuscator.)

(As of 2020), a candidate implementation of indistinguishability obfuscation is under investigation. In 2013, Boyle et al. explored several candidate implementations of extractability obfuscation.