Multi-Party Computation in Presence of Corrupted Majorities Dominik - - PowerPoint PPT Presentation

▶
multi party computation in presence of corrupted
SMART_READER_LITE
LIVE PREVIEW

Multi-Party Computation in Presence of Corrupted Majorities Dominik - - PowerPoint PPT Presentation

Sep 19, 2022 202 likes •1.05k views

Multi-Party Computation in Presence of Corrupted Majorities Dominik Raub Institute of Theoretical Computer Science ETH Zrich on joint work with R. Knzler, J. Mller-Quade, C. Lucas, U. Maurer, M. Fitzi Metaguse, 2009/10/04 Multi-Party

slide-1
SLIDE 1

Multi-Party Computation in Presence of Corrupted Majorities

Dominik Raub

Institute of Theoretical Computer Science ETH Zürich

  • n joint work with
  • R. Künzler, J. Müller-Quade, C. Lucas, U. Maurer, M. Fitzi

Mäetaguse, 2009/10/04

slide-2
SLIDE 2

Multi-Party Computation (MPC)

F

slide-3
SLIDE 3

Multi-Party Computation (MPC)

F

  • Voting
  • Auctions
  • Who is richest?

⇒ privacy, correctness required

slide-4
SLIDE 4

Multi-Party Computation (MPC)

F R π π π π π

≈

slide-5
SLIDE 5

Multi-Party Computation (MPC)

F R π π π π π

≈

Generally encompasses:

  • Secure or authenticated channels
  • Optionally BC or PKI
  • CRS for UC setting
slide-6
SLIDE 6

Multi-Party Computation (MPC)

F R π π π π π

≈

D I/O I/O 0/1

∀

slide-7
SLIDE 7

MPC: Active Adversary

F D R I/O I/O 0/1

∃

S

∀ ∀

A π π

≈

slide-8
SLIDE 8

MPC: Passive Adversary

F D R I/O I/O 0/1

∃

S

∀ ∀

A π π

≈

π π π forward I/O

slide-9
SLIDE 9

MPC: Semi-Honest Adversary

F D R I/O I/O 0/1

∃

S

∀ ∀

A π π

≈

π π π xi → xi' yi → yi'

slide-10
SLIDE 10

Security Properties for MPC

  • Correctness: protocol computes intended result
  • Privacy: nobody learns more than intended
  • Robustness: everybody receives intended result
  • Fairness: everybody receives result, or nobody
  • Agreement (on abort): all honest parties receive

their result or notification of failure

slide-11
SLIDE 11

Security Paradigms for MPC

  • Abort Security: agreement, privacy, correctness
  • Fair Security: fairness, privacy, correctness
  • Full Security: robustness, privacy, correctness
  • IT Security: tolerates unbounded adversaries
  • CO Security: tolerates computationally bounded

adversaries

slide-12
SLIDE 12

Limitations for MPC with BC

  • Fair security only for t < n/2 corrupted [Cle86]
  • IT security only for t < n/2 [Kil00]
  • Full security for t1 and abort security for t2 only if

t1 + t2 < n [IKLP06], [Kat07]

  • No IT full security for general MPC for t ≥ n/2

⇒ Which functions can be computed with IT full security for t ≥ n/2 ? ⇒ Weaker assumptions, graceful degradation?

slide-13
SLIDE 13

Limitations for MPC with BC

  • Fair security only for t < n/2 corrupted [Cle86]
  • IT security only for t < n/2 [Kil00]
  • Full security for t1 and abort security for t2 only if

t1 + t2 < n [IKLP06], [Kat07]

  • No IT full security for general MPC for t ≥ n/2

⇒ Which functions can be computed with IT full security for t ≥ n/2 ? ⇒ Weaker assumptions, graceful degradation?

slide-14
SLIDE 14

Computability of Functions

Security Adversary Resources Fair? Computable f IT passive yes semi-honest yes active yes

  • auth. BC
  • auth. BC
  • auth. BC

Fbc

a c t

Fbc

pa s

Fbc

s h

slide-15
SLIDE 15

Computability of Functions

Security Adversary Resources Fair? Computable f IT passive yes semi-honest yes active yes

  • auth. BC
  • auth. BC
  • auth. BC

Fbc

a c t

Fbc

pa s

Fbc

s h

⊃ ⊃

slide-16
SLIDE 16

Computability of Functions

Security Adversary Resources Fair? Computable f IT passive yes semi-honest yes active yes

  • auth. BC
  • auth. BC
  • auth. BC

Fbc

a c t

Fbc

pa s

Fbc

s h

⊃ ⊃

  • Today: only symmetric functions
  • Then:
slide-17
SLIDE 17

Computability of Functions

Security Adversary Resources Fair? Computable f IT passive yes semi-honest yes active yes LT active no no PKI no

  • auth. BC
  • auth. BC
  • auth. BC
  • auth. BC
  • auth. chan.

Fbc

a c t

Fbc

pa s

Fbc

s h

Fbc

l t s

Fa

ut l t s

Fi

ns

;pki

l t s

⊃ ⊃

  • Long-term (LT) security

– Computational assumptions only during protocol run

slide-18
SLIDE 18

Computability of Functions

Security Adversary Resources Fair? Computable f IT passive yes semi-honest yes active yes LT active no no PKI no

  • auth. BC
  • auth. BC
  • auth. BC
  • auth. BC
  • auth. chan.

Fbc

a c t

Fbc

pa s

Fbc

s h

Fbc

l t s

Fa

ut l t s

Fi

ns

;pki

l t s

⊃ ⊃ =

  • Long-term (LT) security

– Computational assumptions only during protocol run

slide-19
SLIDE 19

Computability of Functions

Security Adversary Resources Fair? Computable f IT passive yes semi-honest yes active yes LT active no no PKI no

  • auth. BC
  • auth. BC
  • auth. BC
  • auth. BC
  • auth. chan.

Fbc

a c t

Fbc

pa s

Fbc

s h

Fbc

l t s

Fa

ut l t s

Fi

ns

;pki

l t s

⊃ ⊃ =

  • “=”: modified [GMW87]-Compiler

– computationally forces semi-honest behavior – maintains IT security against semi-honest adversary

slide-20
SLIDE 20

Passively Computable Functions Fbc

pa s

Input:

slide-21
SLIDE 21

Passively Computable Functions Fbc

pa s

Input:

slide-22
SLIDE 22

Passively Computable Functions Fbc

pa s

Input:

slide-23
SLIDE 23

Passively Computable Functions Fbc

pa s

Input:

slide-24
SLIDE 24

Passively Computable Functions Fbc

pa s

Input:

slide-25
SLIDE 25

Passively Computable Functions Fbc

pa s

Input:

slide-26
SLIDE 26

Passively Computable Functions Fbc

pa s

Input:

slide-27
SLIDE 27

Actively Computable Functions Fbc

a c t

slide-28
SLIDE 28

Actively Computable Functions Fbc

a c t

slide-29
SLIDE 29

Actively Computable: Example

slide-30
SLIDE 30

Summary: Computability

  • Characterization of computable function classes

– : decomposability – : decomposability after removing redundancy – : decomposability after removing redundancy,

exchange property (input for every strategy)

  • Characterization of long-term security:

Fbc

a c t

Fbc

pa s

Fbc

s h

Fi

ns

;pk

i l t s

= Fa

ut l t s = Fbc l t s= Fbc s h

slide-31
SLIDE 31

Limitations for MPC with BC

  • Fair security only for t < n/2 corrupted [Cle86]
  • IT security only for t < n/2 [Kil00]
  • Full security for t1 and abort security for t2 only if

t1 + t2 < n [IKLP06], [Kat07]

  • No IT full security for general MPC for t ≥ n/2

⇒ Which functions can be computed with IT full security for t ≥ n/2 ? ⇒ Weaker assumptions, graceful degradation?

>

slide-32
SLIDE 32

Limitations for MPC with BC

  • Fair security only for t < n/2 corrupted [Cle86]
  • IT security only for t < n/2 [Kil00]
  • Full security for t1 and abort security for t2 only if

t1 + t2 < n [IKLP06], [Kat07]

  • No IT full security for general MPC for t ≥ n/2

⇒ Which functions can be computed with IT full security for t ≥ n/2 ? ⇒ Weaker assumptions, graceful degradation? ⇒ Hybrid-secure MPC (HMPC)

>

slide-33
SLIDE 33

Optimal Hybrid MPC (with BC)

R π π π π π Goal: For any ρ < n/2

  • IT full security for t ≤ ρ
  • IT fair security for t < n/2
  • CO abort security for t < n-ρ

>

slide-34
SLIDE 34

Optimal Hybrid MPC (with BC)

R π π π π π [GMW87], [CLOS01]: can be IT protected Goal: For any ρ < n/2

  • IT full security for t ≤ ρ
  • IT fair security for t < n/2
  • CO abort security for t < n-ρ

>

slide-35
SLIDE 35

Optimal Hybrid MPC (with BC)

R π π π π π Trusted ⇒ IT fairness, correctness Goal: For any ρ < n/2

  • IT full security for t ≤ ρ
  • IT fair security for t < n/2
  • CO abort security for t < n-ρ

>

slide-36
SLIDE 36

Optimal Hybrid MPC (with BC)

R

R'

π π π π π [Cha89]: emulate! ⇒ honest for t < n/2 [RB89] ⇒ t < n/2: IT fair, correct ⇒ t ≥ n/2: CO private, correct Trusted ⇒ IT fairness, correctness

>

slide-37
SLIDE 37

Optimal Hybrid MPC (with BC)

R

R'

π π π π π [Cha89]: emulate! ⇒ honest for t < n/2 [RB89] ⇒ t < n/2: IT fair, correct ⇒ t ≥ n/2: CO private, correct Use sharing qualifying all sets of emulated and n-ρ actual parties ⇒ t ≤ ρ: IT robust, correct ⇒ t < n/2: IT fair, correct ⇒ t < n-ρ: CO private, correct

>

slide-38
SLIDE 38

Optimal Hybrid MPC (with BC)

R

R'

π π π π π xi = xides ⊕ xiem (xides) (xiem) Share inputs ⇒ t < n/2: IT privacy ⇒ t ≥ n/2: no correctness

>

slide-39
SLIDE 39

Optimal Hybrid MPC (with BC)

R

R'

π π π π π xi = xides ⊕ xiem (ci,oi) = comH(xiem) (xides,ci) (xiem,oi) Share and commit ⇒ no robustness

  • r

⇒ no correctness for t ≥ n/2

>

slide-40
SLIDE 40

Optimal Hybrid MPC (with BC)

R

R'

π π π π π xi = xides ⊕ xiem (ci,oi) = comH(xiem) (xides,ci) (xiem,oi) complaint? input xi Share, commit, complain ⇒ t ≤ ρ: IT full security ⇒ t < n/2: IT fair security ⇒ t < n-ρ: CO abort security

>

slide-41
SLIDE 41

Optimal Hybrid MPC (with BC)

R

R'

π π π π π xi = xides ⊕ xiem (ci,oi) = comH(xiem) (xides,ci) (xiem,oi) complaint? input xi Share, commit, complain ⇒ t ≤ ρ: IT full security ⇒ t < n/2: IT fair security ⇒ t < n-ρ: CO abort security

πρ

>

slide-42
SLIDE 42

Summary: Hybrid Security

  • We provide optimal HMPC protocols and

matching tight bounds for the setting

– with BC

slide-43
SLIDE 43

Summary: Hybrid Security

  • We provide optimal HMPC protocols and

matching tight bounds for the setting

– with BC – without BC but with PKI – without BC or PKI

  • We treat possibly inconsistent PKIs
  • We consider signature forgery separately from
  • ther (computational) assumptions
slide-44
SLIDE 44

Conclusions

  • Characterization of computable function classes
  • Characterization of long-term security
  • Optimal HMPC protocols and matching tight

bounds

slide-45
SLIDE 45
slide-46
SLIDE 46

Passively Computable Functions Fbc

pa s

Input:

slide-47
SLIDE 47

Hybrid MPC (HMPC)

  • Different guarantees depending on t:

– For t ≤ lr full (robust) security – For t ≤ lf fair security – For t ≤ L abort security

  • While tolerating:

– For t ≤ tc computationally unbounded adversaries – For t ≤ tσ signature forgery – For t ≤ tp inconsistent PKIs

⇒ Graceful degradation

slide-48
SLIDE 48

Summary: Hybrid Security

  • We provide HMPC protocols for the setting

– with BC under the bounds

tc < n/2 ∧ lr ≤ lf ≤ L ∧ lf < n/2 ∧ lr + L < n

– without BC but with PKI under the bounds

tc < n/2 ∧ lr ≤ lf ≤ L ∧ lf < n/2 ∧ lr + L < n ∧ 2 tσ + L < n ( ∧

tp > 0

⇒ tp + 2 L < n)

– without BC or PKI under the bounds

tc < n/2 ∧ lr ≤ lf ≤ L ∧ lf < n/2 ∧ ( lr > 0 ⇒ lr + 2 L < n)

  • Our bounds are tight, given lr ≥ tp, tσ
slide-49
SLIDE 49

Limitations for HMPC with BC

  • IT security for t ≤ tc only if tc < n/2 [Kil00]
  • Fair security for t ≤ lf only if lf < n/2 [Cle86]
  • Full security for t≤lr and abort security for t≤L
  • nly if lr+L < n [IKLP06], [Kat07]
  • Therefore:

tc < n/2 ∧ lr ≤ lf ≤ L ∧ lf < n/2 ∧ lr+L < n (1)

slide-50
SLIDE 50

Hybrid MPC without BC or PKI

  • Fair security for t ≤ lf only if lf < n/2 [Cle86]
  • IT security for t ≤ tc only if tc < n/2 [Kil00]
  • Full security for t ≤ lr and abort security for t ≤ L
  • nly if lr > 0 ⇒ lr+2L < n [FHHW03]
  • Protocol πρ with the BC from [FHHW03]

achieves bound tc < n/2 ∧ lr ≤ lf ≤ L ∧ lf < n/2 ∧ (lr > 0 ⇒ lr+2L < n) (2)

  • Improves over [FHHW03] for ρ=0, which

makes no guarantees for t > n/2

slide-51
SLIDE 51

Limits for MPC without BC, with PKI

  • Tolerate inconsistent PKI for t ≤ tp
  • Tolerate signature forgery for t ≤ tσ
  • We achieve the following bounds

tc < n/2 ∧ lr ≤ lf ≤ L ∧ lf < n/2 ∧ lr+L < n 2 ∧ tσ+L < n ∧ (tp > 0 ⇒ tp+2L < n) (3) and prove them necessary for lr ≥ tp, tσ

slide-52
SLIDE 52

Hybrid MPC without BC, with PKI

  • Protocol πρ with a hybrid BC (HBC) for bounds

2tσ+T < n ∧ (tp > 0 ⇒ tp+2T < n) achieves bound (3) (where BC secure for t ≤ T)

  • For tp > 0 treated in [FHW04]
  • For tp = 0 and 2tσ+T < n we provide an HBC

protocol achieving full BC

– For t = 0 unconditionally – For t ≤ tσ conditional on PKI consistency – For t ≤ T conditional on unforgeability and PKI

consistency

slide-53
SLIDE 53

BC with extended validity (BCEV)

  • For 2tσ+T < n and tp = -1 BCEV achieves:

– For t ≤ tσ full broadcast – For t ≤ T validity, conditional on unforgeability

slide-54
SLIDE 54

BC with extended validity (BCEV)

  • For 2tσ+T < n and tp = -1 BCEV achieves:

– For t ≤ tσ full broadcast – For t ≤ T validity, conditional on unforgeability

>

slide-55
SLIDE 55

BCEV: Validity for t ≤ T

>

slide-56
SLIDE 56

BCEV: Validity for t ≤ T

validity: Ps honest

>

slide-57
SLIDE 57

BCEV: Validity for t ≤ T

validity: Ps honest = (m,σs(m))

>

slide-58
SLIDE 58

BCEV: Validity for t ≤ T

validity: Ps honest for Pj honest = ((m,σs(m)), ?) = (m,σs(m))

>

slide-59
SLIDE 59

holds always (for xi=m)

BCEV: Validity for t ≤ T

validity: Ps honest for Pj honest = ((m,σs(m)), ?) = (m,σs(m))

>

slide-60
SLIDE 60

holds always (for xi=m)

BCEV: Validity for t ≤ T

validity: Ps honest for Pj honest = ((m,σs(m)), ?) = (m,σs(m)) holds for t > tσ (and xi=m)

>

slide-61
SLIDE 61

secure for t ≤ t

σ < n/3

holds always (for xi=m)

BCEV: Validity for t ≤ T

validity: Ps honest for Pj honest = ((m,σs(m)), ?) = (m,σs(m)) holds for t > tσ (and xi=m)

>

slide-62
SLIDE 62

secure for t ≤ t

σ < n/3

holds always (for xi=m)

BCEV: Validity for t ≤ T

validity: Ps honest for Pj honest = ((m,σs(m)), ?) = (m,σs(m)) holds for t > tσ (and xi=m) holds for t ≤ tσ (and m=0)

>

slide-63
SLIDE 63

BCEV: Consistency for t ≤ tσ

>

slide-64
SLIDE 64

BCEV: Consistency for t ≤ tσ

secure for t ≤ t

σ < n/3

>

slide-65
SLIDE 65

BCEV: Consistency for t ≤ tσ

secure for t ≤ t

σ < n/3

Siv

= Sjv

>

slide-66
SLIDE 66

BCEV: Consistency for t ≤ tσ

secure for t ≤ t

σ < n/3

all decisions here identical Siv

= Sjv

>

slide-67
SLIDE 67

BCEV: Consistency for t ≤ tσ

secure for t ≤ t

σ < n/3

all decisions here identical identical Sjv Siv

= Sjv

>

slide-68
SLIDE 68

BCEV: Consistency for t ≤ tσ

secure for t ≤ t

σ < n/3

all decisions here identical

j ∈ Siv,0 ⇔ j ∈ Siv

for Pj honest identical Sjv Siv

= Sjv

>

slide-69
SLIDE 69

Hybrid Broadcast (HBC)

  • For 2tσ+T < n and tp = 0 HBC achieves

– For t = 0 full BC – For t ≤ tσ full BC, conditional on PKI consistency – For t ≤ T full BC, conditional on unforgeability and

PKI consistency

  • Protocol idea:

– Attempt detectable precomputation of a new PKI

[FHHW03]; fall back to existing PKI

– Run an HBC for 2tσ+T < n and tp = -1 constructed

from BCEV and DS

slide-70
SLIDE 70

Hybrid Broadcast (HBC) for tp = -1

>

slide-71
SLIDE 71

HBC: Security for t ≤ tσ

>

slide-72
SLIDE 72

HBC: Security for t ≤ tσ

BC for t ≤ tσ

>

slide-73
SLIDE 73

HBC: Security for t ≤ tσ

BC for t ≤ tσ holds for t ≤ tσ

>

slide-74
SLIDE 74

HBC: Consistency for tσ < t ≤ T

>

slide-75
SLIDE 75

HBC: Consistency for tσ < t ≤ T

BC for t > tσ

>

slide-76
SLIDE 76

HBC: Consistency for tσ < t ≤ T

BC for t > tσ consistent for t > tσ

>

slide-77
SLIDE 77

HBC: Consistency for tσ < t ≤ T

BC for t > tσ consistent for t > tσ if holds then ...

>

slide-78
SLIDE 78

HBC: Consistency for tσ < t ≤ T

BC for t > tσ consistent for t > tσ also holds for same v if holds then ...

>

slide-79
SLIDE 79

HBC: Validity for tσ < t ≤ T

>

slide-80
SLIDE 80

HBC: Validity for tσ < t ≤ T

BC for t > tσ guarantees validity

>

slide-81
SLIDE 81

HBC: Validity for tσ < t ≤ T

BC for t > tσ can only hold for v = m guarantees validity

>

slide-82
SLIDE 82

HBC: Validity for tσ < t ≤ T

BC for t > tσ can only hold for v = m guarantees validity can only hold for v = m

>

slide-83
SLIDE 83

HBC: Validity for tσ < t ≤ T

BC for t > tσ can only hold for v = m di = m guarantees validity can only hold for v = m

>