and Related Models AMOS BEIMEL, BEN GURION UNIVERSITY, ISRAEL EYAL - - PowerPoint PPT Presentation

β–Ά
and related models
SMART_READER_LITE
LIVE PREVIEW

and Related Models AMOS BEIMEL, BEN GURION UNIVERSITY, ISRAEL EYAL - - PowerPoint PPT Presentation

Dec 01, 2022 460 likes β€’796 views

The Complexity of PSM Protocols and Related Models AMOS BEIMEL, BEN GURION UNIVERSITY, ISRAEL EYAL KUSHILEVITZ, TECHNION, ISRAEL PNINA NISSIM, BEN GURION UNIVERSITY, ISRAEL Overview Introduction Ideas of Our Construction Conclusion

slide-1
SLIDE 1

The Complexity of PSM Protocols and Related Models

AMOS BEIMEL, BEN GURION UNIVERSITY, ISRAEL EYAL KUSHILEVITZ, TECHNION, ISRAEL PNINA NISSIM, BEN GURION UNIVERSITY, ISRAEL

slide-2
SLIDE 2

Overview

  • Introduction
  • Ideas of Our Construction
  • Conclusion
slide-3
SLIDE 3

Private Simultaneous Messages (PSM) model [FKN94,IK97]

  • Simplest communication pattern.
  • Shared randomness.
  • Each party sends one message.
  • Correctness: the referee learns

𝑔(𝑦1, … , 𝑦𝑙).

  • Security: the referee learns nothing

else.

  • Communication complexity:

the length of the messages.

r r r

Goal: compute 𝑔(𝑦1, … , 𝑦𝑙)

slide-4
SLIDE 4

Motivation

  • PSM is an interesting problem on its own
  • Simplest model of secure computation – no interaction.
  • PSM implies interesting cryptographic primitives as:
  • Protocols for conditional disclosure of secrets (CDS).
  • Generalized oblivious transfer.
  • Several generalizations of PSM have been studied:
  • Non-interactive MPC [BGIKMP14].
  • Ad-hoc PSM protocols [BGIK16, BIK17].
slide-5
SLIDE 5

Our results – PSM protocols for arbitrary functions

  • Function 𝑔 ∢

𝑂 𝑙 β†’ {0,1}

  • [FKN] – Every function has a PSM protocol with communication 𝑃(π‘‚π‘™βˆ’1).

Our Work 𝑃(𝑙3 βˆ™ 𝑂𝑙/2)

  • Num. of parties

Previous works 2 3 𝑃(𝑂2) [FKN] 4 𝑃(𝑂3) [FKN] 5 𝑃(𝑂4) [FKN] 𝑙 β‰₯ 6 𝑃(π‘‚π‘™βˆ’1) [FKN]

Our protocols for 𝑙 β‰₯ 6 can handle long outputs with the same message length.

𝑃(𝑂1/2) [BIKK] 𝑃(𝑂) 𝑃(𝑂5/3) 𝑃(𝑂7/3)

slide-6
SLIDE 6

Our results

More results:

  • PSM protocols for functions with inputs of different sizes
  • A PSM for 𝑙 parties from a PSM for 𝑒 parties (𝑒 < 𝑙)
  • Applications
  • Ad-hoc PSM protocols
  • Homogenous distribution designs
  • Non-interactive MPC protocols
  • Conditional disclosure of secrets implies Secret-sharing schemes

for homogenous access structures (independently by Liu and Vaikuntanathan STOC 2018)

slide-7
SLIDE 7

Overview

  • Introduction
  • Ideas of Our Construction
  • Conclusion
slide-8
SLIDE 8

The cube approach

A technique from private information retrieval of CGKS98. Starting point – view a function 𝑔: 𝑂 𝑙 β†’ 0,1 as an β„“- dimensional cube for some β„“. For a set 𝑇 and an element 𝑗 : 𝑇 βŠ• {𝑗} = α‰Šπ‘‡ βˆͺ 𝑗 , 𝑗 βˆ‰ 𝑇 𝑇\{𝑗}, 𝑗 ∈ 𝑇

slide-9
SLIDE 9

𝑇1, 𝑇2 βŠ† 𝑂

𝑏(𝑇1, 𝑇2) =βŠ•π‘βˆˆπ‘‡1,π‘βˆˆπ‘‡2 𝑔(𝑏, 𝑐)

Fact:

𝑔 𝑦, 𝑧 = 𝑏(𝑇1, 𝑇2) βŠ• 𝑏(𝑇1 βŠ• {𝑦}, 𝑇2) βŠ• 𝑏(𝑇1, 𝑇2 βŠ• {𝑧}) βŠ• 𝑏(𝑇1 βŠ• {𝑦}, 𝑇2 βŠ• {𝑧})

The cube approach – 2 dimensions

𝑦 𝑧

𝑔(𝑦, 𝑧)

𝑦 𝑧

slide-10
SLIDE 10

A 2-Party PSM Protocol for 𝑔: 𝑂 Γ— 𝑂 β†’ {0,1}

  • View 𝑔 as a 2-dimensional cube.

𝐐𝟐 ππŸ‘

𝑦1 𝑦2 referee

slide-11
SLIDE 11

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1}

referee

slide-12
SLIDE 12

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏00 = 𝑏(𝑇1, 𝑇2) 𝑏10 = 𝑏(𝑇1 βŠ• 𝑦1 , 𝑇2)

referee

slide-13
SLIDE 13

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏00 βŠ• 𝑏10 βŠ• 𝑐, 𝑇1 βŠ• {𝑦1} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1}

referee

slide-14
SLIDE 14

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏01 = 𝑏(𝑇1, 𝑇2 βŠ• {𝑦2}) 𝑏00 βŠ• 𝑏10 βŠ• 𝑐, 𝑇1 βŠ• {𝑦1}

referee

slide-15
SLIDE 15

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏00 βŠ• 𝑏10 βŠ• 𝑐, 𝑇1 βŠ• {𝑦1} 𝑏01 βŠ• 𝑐, 𝑇2 βŠ• {𝑦2} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1}

referee

slide-16
SLIDE 16

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏00 βŠ• 𝑏10 βŠ• 𝑐, 𝑇1 βŠ• {𝑦1} 𝑏01 βŠ• 𝑐, 𝑇2 βŠ• {𝑦2} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1}

referee 𝑏 𝑇1 βŠ• 𝑦1 , 𝑇2 βŠ• 𝑦2 ?

slide-17
SLIDE 17

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏00 βŠ• 𝑏10 βŠ• 𝑐, 𝑇1 βŠ• {𝑦1} 𝑏01 βŠ• 𝑐, 𝑇2 βŠ• {𝑦2} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1}

referee

slide-18
SLIDE 18

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏00 βŠ• 𝑏10 βŠ• 𝑐, 𝑇1 βŠ• {𝑦1} 𝑏01 βŠ• 𝑐, 𝑇2 βŠ• {𝑦2} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1}

Computes 𝑏11 = 𝑏 𝑇1 βŠ• 𝑦1 , 𝑇2 βŠ• 𝑦2 . referee

slide-19
SLIDE 19

A 2-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦2

𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1} 𝑏00 βŠ• 𝑏10 βŠ• 𝑐, 𝑇1 βŠ• {𝑦1} 𝑏01 βŠ• 𝑐, 𝑇2 βŠ• {𝑦2} 𝑇1, 𝑇2 βŠ†π‘† 𝑂 , 𝑐 ∈ {0,1}

𝑔 𝑦1, 𝑦2 = 𝑏00 βŠ• 𝑏10 βŠ• 𝑐 βŠ• 𝑏01 βŠ• 𝑐 βŠ• 𝑏11 referee

slide-20
SLIDE 20
  • The communication complexity of this protocol is 𝑃(𝑂).
  • The same complexity as the protocol of [FKN] .
  • There is a more efficient PSM protocol with communication

𝑃(𝑂

1 2) [BIKK].

A 2-Party PSM Protocol for 𝑔: 𝑂 Γ— 𝑂 β†’ {0,1}

slide-21
SLIDE 21

A 𝑙-Party PSM Protocol

𝐐𝟐 𝐐𝒍

𝑦1 𝑦𝑙

𝐐𝒍/πŸ‘

𝑦𝑙

2

𝐐𝒍/πŸ‘+𝟐

𝑦𝑙

2+1

… …

PSM protocol for function 𝑔: 𝑂 𝑙 β†’ {0,1} using the cube approach.

slide-22
SLIDE 22

A 𝑙-Party PSM Protocol

𝐐𝟐 𝐐𝒍

𝑦1 𝑦𝑙

𝐐𝒍/πŸ‘

𝑦𝑙

2

𝐐𝒍/πŸ‘+𝟐

𝑦𝑙

2+1

… …

𝑧1 𝑧2

We view 𝑔 as a 2-dimensional cube.

slide-23
SLIDE 23

A 𝑙-Party PSM Protocol

𝐐𝟐 ππŸ‘

𝑦1 𝑦𝑙

𝐐𝒍/πŸ‘

𝑦𝑙

2

𝐐𝒍/πŸ‘+𝟐

𝑦𝑙

2+1

… …

The common randomness: 𝑇1, 𝑇2 βŠ†π‘† [𝑂𝑙/2]

𝑧1 𝑧2

slide-24
SLIDE 24

A 𝑙-Party PSM Protocol

4 Cubes:

  • 1. 𝑏00 = 𝑏(𝑇1, 𝑇2)
  • 2. 𝑏10 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2)
  • 3. 𝑏01 = 𝑏 𝑇1, 𝑇2 βŠ• 𝑧2
  • 4. 𝑏11 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2 βŠ• 𝑧2 )
slide-25
SLIDE 25

A 𝑙-Party PSM Protocol

4 Cubes:

  • 1. 𝑏00 = 𝑏(𝑇1, 𝑇2) – Party 𝑄

1 computes 𝑏00.

  • 2. 𝑏10 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2)
  • 3. 𝑏01 = 𝑏 𝑇1, 𝑇2 βŠ• 𝑧2
  • 4. 𝑏11 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2 βŠ• 𝑧2 )

𝑷(𝟐)

slide-26
SLIDE 26

Computing

𝐐𝟐 ππŸ‘

𝑦1 𝑦𝑙

𝐐𝒍/πŸ‘

𝑦𝑙

2

𝐐𝒍/πŸ‘+𝟐

𝑦𝑙

2+1

… …

Use a k/2-party PSM for this function

𝑧1 𝑧2

𝑏(𝑇1 βŠ• {𝑧1}, 𝑇2)

slide-27
SLIDE 27

A 𝑙-Party PSM Protocol

4 Cubes:

  • 1. 𝑏00 = 𝑏(𝑇1, 𝑇2)
  • 2. 𝑏10 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2)
  • 3. 𝑏01 = 𝑏 𝑇1, 𝑇2 βŠ• 𝑧2
  • 4. 𝑏11 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2 βŠ• 𝑧2 )

𝑷(𝟐) 𝑷(𝒍𝑢𝒍/πŸ‘βˆ’πŸ) 𝑷(𝒍𝑢𝒍/πŸ‘βˆ’πŸ)

slide-28
SLIDE 28

A 𝑙-Party PSM Protocol

4 Cubes:

  • 1. 𝑏00 = 𝑏(𝑇1, 𝑇2)
  • 2. 𝑏10 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2)
  • 3. 𝑏01 = 𝑏 𝑇1, 𝑇2 βŠ• 𝑧2
  • 4. 𝑏11 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2 βŠ• 𝑧2 ) – Use a PSM to send 𝑇1 βŠ• 𝑧1

and 𝑇2 βŠ• 𝑧2 to referee. 𝑷(𝟐) 𝑷(𝒍𝑢𝒍/πŸ‘βˆ’πŸ) 𝑷(𝒍𝑢𝒍/πŸ‘βˆ’πŸ)

slide-29
SLIDE 29

A 𝑙-Party PSM Protocol

4 Cubes:

  • 1. 𝑏00 = 𝑏(𝑇1, 𝑇2)
  • 2. 𝑏10 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2)
  • 3. 𝑏01 = 𝑏 𝑇1, 𝑇2 βŠ• 𝑧2
  • 4. 𝑏11 = 𝑏(𝑇1 βŠ• 𝑧1 , 𝑇2 βŠ• 𝑧2 )

The referee can compute 𝑔(𝑧1, 𝑧2) which is the xor of the 4 cubes. Communication and randomness complexity 𝑷 π’πŸ’π‘Άπ’/πŸ‘ . 𝑷(𝟐) 𝑷(𝒍𝑢𝒍/πŸ‘βˆ’πŸ) 𝑷(𝒍𝑢𝒍/πŸ‘βˆ’πŸ) 𝑷(π’πŸ’π‘Άπ’/πŸ‘)

slide-30
SLIDE 30

The cube approach – summary

  • Num. of

parties (𝑙)

  • Num. of

dimensions (β„“) 2 4 3,4,5 3 𝑙 β‰₯ 6 2

[BIKK14]

The number of dimensions for functions in which the domain

  • f inputs are not the same depends on the domains.
slide-31
SLIDE 31

Overview

  • Introduction
  • Ideas of Our Construction
  • Conclusion
slide-32
SLIDE 32

Conclusion and open problems

  • Main result: a PSM protocol for an arbitrary function

𝑔: 𝑂 𝑙 β†’ 0,1 .

  • Our construction is based on the cube approach, which is technique

from PIR.

  • Can we use other techniques from PIR to improve the complexity of

PSM protocols?

  • [LVW18] efficient CDS protocols
  • Can we improve the complexity of PSM protocols in other ways?
slide-33
SLIDE 33

Thank you!