Closure, Amortization, Lower-bounds, and Separations Benny - - PowerPoint PPT Presentation

Conditional Disclosure of Secrets: Amplification, Closure, Amortization, Lower-bounds, and Separations

Benny Applebaum Barak Arkis Pavel Raykov Prashant Nalini Vasudevan

Conditional Disclosure of Secrets [GIKM00]

A 𝑔: 0,1 𝑜 × 0,1 𝑜 → {0,1} C B 𝑦 𝑧

Randomness 𝑠 Secret 𝑡

𝑛𝐵 𝑛𝐶 𝑦, 𝑧 𝜺-Correctness: If 𝑔 𝑦, 𝑧 = 1, then for any 𝑡, Pr 𝐷 𝑦, 𝑧, 𝑛𝐵, 𝑛𝐶 = 𝑡 > 1 − δ 𝝑-Privacy: If 𝑔 𝑦, 𝑧 = 0, then for any 𝑡, Δ 𝑇𝑗𝑛 𝑦, 𝑧 ; 𝑛𝐵, 𝑛𝐶 < 𝜗 Communication: 𝑛𝐵 + |𝑛𝐶| Randomness: |𝑠|

Connections and Applications

• Attribute-Based Encryption. [Att14,Wee14]
• Secret-sharing for certain graph-based access structures.
• Light-weight alternative to zero-knowledge proofs in some settings. [AIR01]
• Data privacy in information-theoretic PIR. [GIKM00]
• A minimal model of multi-party computation.

What Was Known Earlier

Upper bounds:

• Communication 2𝑃( 𝑜 log 𝑜) for any predicate on 𝑜-bit inputs. [LVW17]
• Communication 𝑃(𝜏) for predicates with size-𝜏 branching programs or span
• programs. [IW14,AR16]

Lower bounds:

• Explicit predicate that requires Ω(log 𝑜) bits of communication. [GKW15]
• Same predicate requires Ω

𝑜 bits for linear CDS. [GKW15]

Distribution of (𝑛𝐵, 𝑛𝐶):

• input (𝑦, 𝑧), 𝑡 = 0: 𝑛𝐵, 𝑛𝐶 𝑦,𝑧
• input (𝑦, 𝑧), 𝑡 = 1: 𝑛𝐵, 𝑛𝐶 𝑦,𝑧

1

CDS and Statistical Difference

A C B 𝑦 𝑧

Randomness 𝑠 Secret 𝑡

𝑛𝐵 𝑛𝐶 𝑦, 𝑧 𝜺-Correctness: If 𝑔 𝑦, 𝑧 = 1, then for any 𝑡, Pr 𝐷 𝑦, 𝑧, 𝑛𝐵, 𝑛𝐶 = 𝑡 > 1 − δ ≡ Δ 𝑛𝐵, 𝑛𝐶 𝑦,𝑧 ; 𝑛𝐵, 𝑛𝐶 𝑦,𝑧

1

> 1 − 2𝜀 𝝑-Privacy: If 𝑔 𝑦, 𝑧 = 0, then for any 𝑡, Δ 𝑇𝑗𝑛 𝑦, 𝑧 ; 𝑛𝐵, 𝑛𝐶 < 𝜗 ≡ Δ 𝑛𝐵, 𝑛𝐶 𝑦,𝑧 ; 𝑛𝐵, 𝑛𝐶 𝑦,𝑧

1

< 2𝜗

Separations

Explicit function 𝑄𝐷𝑝𝑚: 0,1 4n log 𝑜 × 0,1 2n log 𝑜 → 0,1 that has:

• CDS complexity: 𝑃(log 𝑜)
• Randomized communication complexity: Ω(𝑜1/3)
• Linear CDS complexity: Ω(𝑜1/6)

Inspired by oracle separations between SZK and other classes [Aar12], and the Pattern Matrix method [She11].

Collision Problems

𝑨 ℎ𝑨: 0,1 log 𝑜 → 0,1 log 𝑜 ℎ𝑨 𝑗 = 𝑗𝑢ℎ block in 𝑨

𝑜 log 𝑜 log 𝑜 𝑜 blocks

𝐷𝑝𝑚 𝑨 = ቐ 0 if ℎ𝑨 is 1−to−1 1 if ℎ𝑨 is 2−to−1 ⋅ ⋅ ⋅ ⇒ ℎ𝑨(𝑗) is uniformly distributed ⇒ ℎ𝑨(𝑗) is far from uniform

Collision Problems

0 0 1 0 1 0 1 0 0 1 1 1 1 0 0 1

𝑄𝐷𝑝𝑚 𝑦, 𝑧 = 𝐷𝑝𝑚(𝑦 𝑧 ) 𝑆 𝑄𝐷𝑝𝑚 > Ω(𝑜1/3) ([Amb05,Kut05] + [She11]) 𝑦 𝑧 𝑦[𝑧] ⋅ ⋅ ⋅ ⋅ ⋅ ⋅ ⋅ ⋅ ⋅

3 2 2 4 1 1 1

4𝑜 log 𝑜 𝑜 log 𝑜

linCDS 𝑄𝐷𝑝𝑚 > Ω(𝑜1/6) (left + [GKW15])

Collision Problems

0 0 1 0 1 0 1 0 0 1 1 1 1 0 0 1

𝑧 𝑦[𝑧] ⋅ ⋅ ⋅ ⋅ ⋅ ⋅ ⋅ ⋅ ⋅

3 2 2 4 1 1 1

A B

log 𝑜 𝑜 blocks

C Use PSM [FKN94] to send:

• ℎ𝑦 𝑧 (𝑗) if 𝑡 = 0
• 𝑠 ← 0,1 log 𝑜 if 𝑡 = 1

If 𝑄𝐷𝑝𝑚 𝑦, 𝑧 = 0, both are the same distribution, else they are far apart. 𝑦 𝑦, 𝑧 𝑗 𝑡

Closure

CDS for each of

𝑔

1, … , 𝑔 𝑛

Comm: 𝑢1, … , 𝑢𝑛 Rand : 𝜍1, … , 𝜍𝑛

CDS for

ℎ(𝑔

1, … , 𝑔 𝑛)

Comm: 𝜏 ⋅ 𝑞𝑝𝑚𝑧(𝑢𝑗, 𝜍𝑗) Rand : 𝜏 ⋅ 𝑞𝑝𝑚𝑧(𝑢𝑗, 𝜍𝑗) ℎ - Boolean formula over 0,1 𝑛 of size 𝜏 Construction uses transformations for Statistical Difference [SV03,Oka96], and PSM protocols [FKN94].

Amplification

CDS for 𝑔

𝑙-bit secret Corr: 2−Ω(𝑙) Priv: 2−Ω(𝑙) Comm: 𝑃(𝑙𝑢)

CDS for 𝑔

Single-bit secret Corr: 0.1 Priv: 0.1 Comm: 𝑢 Construction uses constant-rate ramp secret-sharing schemes [CCGdHV07]. Incomparable version follows from the Polarization Lemma [SV03].

Lower Bound

There exists a predicate 𝑔: 0,1 𝑜 × 0,1 𝑜 → {0,1} for which any perfect (single-bit) CDS requires communication at least 0.99𝑜. Proven by reduction to the PSM lower bound of [FKN94]. Earlier bound was explicit, Ω(log 𝑜) bits. [GKW15]

Amortization

For any predicate 𝑔: 0,1 𝑜 × 0,1 𝑜 → {0,1} and 𝑛 > 222𝑜, there is a perfect CDS protocol for 𝑔 with 𝑛-bit secrets with communication complexity 𝑃(𝑛𝑜). Proven using techniques from the amortization of branching programs [Pot16]. 𝑛-fold repetition of best known general protocol [LVW17]: 𝑛 ⋅ 2𝑃( 𝑜 log 𝑜)

Summary

We prove the following properties of CDS:

• Lower Bounds: Non-explicit, Ω(𝑜).
• Separation: From insecure communication and linear CDS.
• Amortization: 𝑃(𝑜) per bit of secret, if there are more than 222𝑜 bits.
• Closure: Under composition with formulas.
• Amplification: Of correctness and privacy from constant to 2−Ω(𝑙) with

𝑃(𝑙) blowup. To note:

• Connections with Statistical Difference and SZK.
• Barriers to PSM lower bounds.