I was reading about the construction of IO using MIFE and compact FE . I am just curious to know what are the consequences if there exists an IO.

  • $\begingroup$ I think this question is too broad to answer, and answers would be based heavily on opinions because "consequences in general" is all but specific. $\endgroup$
    – tylo
    Mar 16 '17 at 10:54
  • $\begingroup$ But I can't find any answer in wiki nor in Crypto.SE. I understand it's consequences on FE but what are there any crypto results that are solely based on IO? $\endgroup$
    – user38956
    Mar 16 '17 at 11:52
  • $\begingroup$ What research have you done? I'm asking because sharing research efforts helps everyone! Tell us what research you did, what you found, and why it didn’t meet your needs. That shows users you took time trying to help yourself, it saves us from reiterating obvious answers, and (most important) it helps you to get more relevant on-point answers. In case of doubt, you can start by searching this site for related Q&As that might shed light on your question. At worst it will help you frame “a better question”; at best it might even answer it. $\endgroup$
    – e-sushi
    Mar 18 '17 at 15:39

I think this is a very huge question. IO has been proved that it is a very strong tool in cryptography in constructing various cryptographic primitives, such as two-round secure computation, deniable encryption, universal samplers and so on. Also, researchers are still exploring its applications. I think currently the more intriguing problem is how to build IO from standard assumptions.


Indistinguishability Obfuscation (iO) is a quite powerful tool, but its implications alone are really hard to tackle - as so often, the combination of different primitives enables us to do new and exciting things.

But before going into details, I am not sure if this is clear to you:

  • If you can use an algorithm $A$ (in your question that would be compact functional encryption) to get some interesting property $P$ (this would be the construction of iO), then this has no consequences for $A$ itself besides the obvious - that you can use $A$ to get property $B$.
  • Even if $P=NP$ is true, then iO would still exist. But it is also known, that public key cryptography and oneway functions would not exist. Generally speaking, $P=NP$ would be a nightmare for cryptography, because we would loose almost all of our building blocks. However, any construction/property from iO alone would still have to hold in a world where $P=NP$ - and the meaning of "security" is severely restricted there (or phrased differently: a lot of our current definitions would be invalid).

Regarding the general construction of IO in general, I suggest reading Survey on Cryptographic Obfuscation (2015, Horváth), which gives a decent overview. But here is a problem with iO:

The elephant in the room - Multilinear Maps:

The first construction by Garg et.al.in 2013 based ona primitive called multilinear maps - with a nice definition of their security. From that they build iO, but there was a problem: Multilinear maps in the way they defined them did not exist - and as far as a I know we only have constructions for limited versions of multilinear maps. So while their construction of iO is actually secure, we don't know if their assumptions actually hold for any construction.

In Obfuscation without the Vulnerabilities of Multilinear Maps (2016, Garg et.al.) this issue is adressed quite elaborately and proposes iO with multilinear maps without the known vulnerabilities. There are also other constructions of iO out there, but there are still open questions.

As for the current state of research: The topic is still relatively new and it is not fully explored. With iO we can achieve interesting constructions, for example deniable encryption, functional encryption, non-interactive zero knowledge arguments, etc. But all of those require some other assumption (which would be invalid in a world with $P=NP$) and build upon constructions with those. And as far as I know we don't have a construction which just uses standard assumptions.

The only way to get to know all the current research is by reading all related publications on the major conferences, I don't think there is any shortcut.