Communication Complexity of Private Simultaneous Messages, Revisited - - PowerPoint PPT Presentation

▶
communication complexity of private simultaneous messages
SMART_READER_LITE
LIVE PREVIEW

Communication Complexity of Private Simultaneous Messages, Revisited - - PowerPoint PPT Presentation

Oct 24, 2022 278 likes •1.32k views

Communication Complexity of Private Simultaneous Messages, Revisited Manoj Mishra Department of Electrical Engineering - Systems Tel Aviv University Joint work with Benny Applebaum (TAU), Thomas Holenstein (Google), Ofer Shayevitz (TAU)

slide-1
SLIDE 1

Communication Complexity of Private Simultaneous Messages, Revisited

Manoj Mishra

Department of Electrical Engineering - Systems Tel Aviv University

Joint work with Benny Applebaum (TAU), Thomas Holenstein (Google), Ofer Shayevitz (TAU)

slide-2
SLIDE 2

Information-Theoretic Secure Function Evaluation

  • Users are computationally unbounded.
slide-3
SLIDE 3

Information-Theoretic Secure Function Evaluation

  • Users are computationally unbounded.
  • Completeness results: Any function can be computed, under various

adversarial settings.

slide-4
SLIDE 4

Information-Theoretic Secure Function Evaluation

  • Users are computationally unbounded.
  • Completeness results: Any function can be computed, under various

adversarial settings.

  • Big Open Problem: What is the Communication Complexity of

unconditionally secure function evaluation

  • in general (worst case) ?
  • for explicit functions ?
slide-5
SLIDE 5

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

x y

slide-6
SLIDE 6

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

x y f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
slide-7
SLIDE 7

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

x y f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness
slide-8
SLIDE 8

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

x y f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness
  • Perfect privacy: doesn’t learn x, y
slide-9
SLIDE 9

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness
  • Perfect privacy: doesn’t learn x, y

x, R y, R

  • R ∈ {0, 1}∗
slide-10
SLIDE 10

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness
  • Perfect privacy: doesn’t learn x, y

x, R y, R

  • R ∈ {0, 1}∗

MA MB

slide-11
SLIDE 11

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
slide-12
SLIDE 12

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Minimal model for secure computation
slide-13
SLIDE 13

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Minimal model for secure computation
  • Closely related to: Randomized Encodings/Garbled Circuits, Functional

Encryption, Conditional Disclosure of Secrets(C.D.S.)

slide-14
SLIDE 14

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Communication upper bound:
slide-15
SLIDE 15

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Communication upper bound:
  • For any f : O(2k/2) (Beimel et al., TCC, 2014)
slide-16
SLIDE 16

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Communication upper bound:
  • For any f : O(2k/2) (Beimel et al., TCC, 2014)
  • Polynomial in formula-size of f (FKN, STOC 1994)
slide-17
SLIDE 17

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Communication upper bound:
  • For any f : O(2k/2) (Beimel et al., TCC, 2014)
  • Polynomial in formula-size of f (FKN, STOC 1994)
  • Communication lower bound: 3k − O(1) (FKN, STOC 1994)
slide-18
SLIDE 18

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Communication upper bound:
  • For any f : O(2k/2) (Beimel et al., TCC, 2014)
  • Polynomial in formula-size of f (FKN, STOC 1994)
  • Communication lower bound: 3k − O(1) (FKN, STOC 1994)
  • f random
slide-19
SLIDE 19

Private Simultaneous Messages (P.S.M.) (Feige,Kilian,Naor, STOC, 1994)

A B C

  • x, y ∈ {0, 1}k

f (x, y)

  • f : {0, 1}k × {0, 1}k → {0, 1}
  • Pefect correctness

x, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Perfect privacy: (MA, MB) ∼ Mz
  • Communication upper bound:
  • For any f : O(2k/2) (Beimel et al., TCC, 2014)
  • Polynomial in formula-size of f (FKN, STOC 1994)
  • Communication lower bound: 3k − O(1) (FKN, STOC 1994)
  • f random
  • Weak Privacy : hide the last bit of x
slide-20
SLIDE 20

P.S.M : Questions

A B C x, R y, R MA MB f (x, y) Q1. How do we improve the lowerbound, even for non-explicit functions ?

slide-21
SLIDE 21

P.S.M : Questions

A B C x, R y, R MA MB f (x, y) Q1. How do we improve the lowerbound, even for non-explicit functions ? Q2. How do we get non-trivial lowerbounds for explicit functions ?

slide-22
SLIDE 22

P.S.M : Questions

A B C x, R y, R MA MB f (x, y) Q1. How do we improve the lowerbound, even for non-explicit functions ? Q2. How do we get non-trivial lowerbounds for explicit functions ?

  • Q3. What combinatorial/algebraic properties of a function make it expensive

(in communication) to compute securely ?

slide-23
SLIDE 23

Main Results

  • Counterexample to FKN’s Lowerbound:
  • reveals a gap in the proof.
  • original proof: works for weak privacy + revealing non-private inputs.
slide-24
SLIDE 24

Main Results

  • Counterexample to FKN’s Lowerbound:
  • reveals a gap in the proof.
  • original proof: works for weak privacy + revealing non-private inputs.
  • New proof of a lowerbound:
  • in terms of combinatorial properties of f : X × Y → Z.
  • Corollary : for a random f , PSM(f ) ≥ 3k − O(log k).
slide-25
SLIDE 25

Main Results

  • Counterexample to FKN’s Lowerbound:
  • reveals a gap in the proof.
  • original proof: works for weak privacy + revealing non-private inputs.
  • New proof of a lowerbound:
  • in terms of combinatorial properties of f : X × Y → Z.
  • Corollary : for a random f , PSM(f ) ≥ 3k − O(log k).
  • Lowerbound for explicit boolean functions:
  • ∃ poly-sized circuit family {fk} of boolean functions with

PSM(fk) ≥ 3k − O(log k).

  • Partially resolves an open problem from Data, Prabhakaran, Prabhakaran

(CRYPTO, 2014).

slide-26
SLIDE 26

Main Results

  • Counterexample to FKN’s Lowerbound:
  • reveals a gap in the proof.
  • original proof: works for weak privacy + revealing non-private inputs.
  • New proof of a lowerbound:
  • in terms of combinatorial properties of f : X × Y → Z.
  • Corollary : for a random f , PSM(f ) ≥ 3k − O(log k).
  • Lowerbound for explicit boolean functions:
  • ∃ poly-sized circuit family {fk} of boolean functions with

PSM(fk) ≥ 3k − O(log k).

  • Partially resolves an open problem from Data, Prabhakaran, Prabhakaran

(CRYPTO, 2014).

  • Lowerbounds extend to imperfect P.S.M.s.
slide-27
SLIDE 27

Main Results

  • Counterexample to FKN’s Lowerbound:
  • reveals a gap in the proof.
  • original proof: works for weak privacy + revealing non-private inputs.
  • New proof of a lowerbound:
  • in terms of combinatorial properties of f : X × Y → Z.
  • Corollary : for a random f , PSM(f ) ≥ 3k − O(log k).
  • Lowerbound for explicit boolean functions:
  • ∃ poly-sized circuit family {fk} of boolean functions with

PSM(fk) ≥ 3k − O(log k).

  • Partially resolves an open problem from Data, Prabhakaran, Prabhakaran

(CRYPTO, 2014).

  • Lowerbounds extend to imperfect P.S.M.s.
  • Applications:
  • First explicit lowerbounds for Conditional Disclosure of Secret (C.D.S).
  • Tight lowerbound for inner-product predicate.
slide-28
SLIDE 28

Revisiting P.S.M. Lowerbound

A B C x, R y, R MA MB f (x, y)

  • x,y∈ {0, 1}k
  • f : {0, 1}k × {0, 1}k → {0, 1}
  • R ∈ {0, 1}∗

Theorem (FKN’s Lowerbound)

If f satisfies three requirements, then perfect correctness and weak privacy requires PSM(f ) ≥ 3k − O(1).

slide-29
SLIDE 29

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

slide-30
SLIDE 30

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1

r1

slide-31
SLIDE 31

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1

r1 r2

slide-32
SLIDE 32

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1

r1 r2

slide-33
SLIDE 33

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3

slide-34
SLIDE 34

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3

slide-35
SLIDE 35

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Communication: log |MA| + log |MB|

slide-36
SLIDE 36

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Mechanism:

slide-37
SLIDE 37

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Mechanism:

  • Lowerbound number of r’s
slide-38
SLIDE 38

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Mechanism:

  • Lowerbound number of r’s
  • Lowerbound size of each image set
slide-39
SLIDE 39

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Mechanism:

  • Lowerbound number of r’s
  • Lowerbound size of each image set
  • Upperbound size of overlap between

two image sets

slide-40
SLIDE 40

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Assumption 1 on f :

slide-41
SLIDE 41

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Assumption 1 on f :

  • f non-degenerate:
slide-42
SLIDE 42

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Assumption 1 on f :

  • f non-degenerate:
  • x = x′ ⇒ f (x, ·) = f (x′, ·)
slide-43
SLIDE 43

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Assumption 1 on f :

  • f non-degenerate:
  • x = x′ ⇒ f (x, ·) = f (x′, ·)
  • Simarly for y = y ′
slide-44
SLIDE 44

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Assumption 1 on f :

  • f non-degenerate:
  • x = x′ ⇒ f (x, ·) = f (x′, ·)
  • Simarly for y = y ′

Consequence:

slide-45
SLIDE 45

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Assumption 1 on f :

  • f non-degenerate:
  • x = x′ ⇒ f (x, ·) = f (x′, ·)
  • Simarly for y = y ′

Consequence:

  • r is one-to-one
slide-46
SLIDE 46

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Useful Edge (x, y):

slide-47
SLIDE 47

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Useful Edge (x, y):

  • f (x, y) = f (x, y)
slide-48
SLIDE 48

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Useful Edge (x, y):

  • f (x, y) = f (x, y)
  • x : x with last bit inverted
slide-49
SLIDE 49

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Useful Edge (x, y):

  • f (x, y) = f (x, y)
  • x : x with last bit inverted

Assumption 2 on f :

slide-50
SLIDE 50

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Useful Edge (x, y):

  • f (x, y) = f (x, y)
  • x : x with last bit inverted

Assumption 2 on f :

  • Half of the edges are useful
slide-51
SLIDE 51

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Useful Edge (x, y):

  • f (x, y) = f (x, y)
  • x : x with last bit inverted

Assumption 2 on f :

  • Half of the edges are useful

Consequence:

slide-52
SLIDE 52

Revisiting P.S.M. Lowerbound

x1 x2 xK y1 y2 yK X Y · · · ·

1 1 1

a1 a2 . . . . . . aJ b1 b2 . . . . . . . bL MA MB

1 1 1 1 1 1 1 1 1

r1 r2 r3 Useful Edge (x, y):

  • f (x, y) = f (x, y)
  • x : x with last bit inverted

Assumption 2 on f :

  • Half of the edges are useful

Consequence:

  • Image set has half of f ’s edges
slide-53
SLIDE 53

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r

slide-54
SLIDE 54

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r Non-trivial Overlaps a b x r x ˜ r y r ˜ r

slide-55
SLIDE 55

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r Non-trivial Overlaps a b x r x ˜ r y r ˜ r

X ′ ◦ 0 X ′ ◦ 1 Y

Complementary Similar Rectangles Truth Table of f

slide-56
SLIDE 56

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r Non-trivial Overlaps a b x r x ˜ r y r ˜ r

X ′ ◦ 0 X ′ ◦ 1 Y

Complementary Similar Rectangles Assumption 3 on f : Size ≤ 2 · 2k Truth Table of f

slide-57
SLIDE 57

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r Non-trivial Overlaps a b x r x ˜ r y r ˜ r Unaccounted Overlaps a b x r ˜ x ˜ r y r ˜ y ˜ r

slide-58
SLIDE 58

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r Non-trivial Overlaps a b x r x ˜ r y r ˜ r Unaccounted Overlaps a b x r ˜ x ˜ r y r ˜ y ˜ r Implication:

slide-59
SLIDE 59

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r Non-trivial Overlaps a b x r x ˜ r y r ˜ r Unaccounted Overlaps a b x r ˜ x ˜ r y r ˜ y ˜ r Implication:

  • Reveal all inputs not required to be private.
slide-60
SLIDE 60

Revisiting P.S.M. Lowerbound

Trivial Overlaps a b x r ˜ r y r ˜ r Non-trivial Overlaps a b x r x ˜ r y r ˜ r Unaccounted Overlaps a b x r ˜ x ˜ r y r ˜ y ˜ r Implication:

  • Reveal all inputs not required to be private.
  • Potentially higher communication cost
slide-61
SLIDE 61

Counterexample to P.S.M. Lowerbound

f (x, y) = < L(x), y >, L(x) := T0 · x[1 : k − 1] ◦ 0, x[k] = 0 T1 · x[1 : k − 1] ◦ 1, x[k] = 1

  • ,

T0, T1, T0 + T1 : full rank

slide-62
SLIDE 62

Counterexample to P.S.M. Lowerbound

f (x, y) = < L(x), y >, L(x) := T0 · x[1 : k − 1] ◦ 0, x[k] = 0 T1 · x[1 : k − 1] ◦ 1, x[k] = 1

  • ,

T0, T1, T0 + T1 : full rank A B C x, R y, R

slide-63
SLIDE 63

Counterexample to P.S.M. Lowerbound

f (x, y) = < L(x), y >, L(x) := T0 · x[1 : k − 1] ◦ 0, x[k] = 0 T1 · x[1 : k − 1] ◦ 1, x[k] = 1

  • ,

T0, T1, T0 + T1 : full rank A B C x, R y, R L(x)

slide-64
SLIDE 64

Counterexample to P.S.M. Lowerbound

f (x, y) = < L(x), y >, L(x) := T0 · x[1 : k − 1] ◦ 0, x[k] = 0 T1 · x[1 : k − 1] ◦ 1, x[k] = 1

  • ,

T0, T1, T0 + T1 : full rank A B C x, R y, R L(x)

  • PSM for < ·, · >
slide-65
SLIDE 65

Counterexample to P.S.M. Lowerbound

f (x, y) = < L(x), y >, L(x) := T0 · x[1 : k − 1] ◦ 0, x[k] = 0 T1 · x[1 : k − 1] ◦ 1, x[k] = 1

  • ,

T0, T1, T0 + T1 : full rank A B C x, R y, R L(x)

  • PSM for < ·, · >

MA MB

< L(x), y >

slide-66
SLIDE 66

Counterexample to P.S.M. Lowerbound

f (x, y) = < L(x), y >, L(x) := T0 · x[1 : k − 1] ◦ 0, x[k] = 0 T1 · x[1 : k − 1] ◦ 1, x[k] = 1

  • ,

T0, T1, T0 + T1 : full rank A B C x, R y, R L(x)

  • PSM for < ·, · >

MA MB

< L(x), y >

  • Communication: 2k + 2 bits
slide-67
SLIDE 67

New Proof for a Communication Lowerbound

A B C

  • x ∈ X, y ∈ Y, R ∈ {0, 1}∗

x, R y, R MA MB f (x, y)

  • f : X × Y → Z
  • Pefect correctness
  • Perfect privacy
slide-68
SLIDE 68

Key idea of the proof

x0 x1 . xJ y0 y1 . . yK X Y a0 a1 a2 . . . a ˜

J

b0 b1 b2 . . b ˜

K

MA MB

slide-69
SLIDE 69

Key idea of the proof

x0 x1 . xJ y0 y1 . . yK X Y a0 a1 a2 . . . a ˜

J

b0 b1 b2 . . b ˜

K

MA MB µ ∽ X × Y

slide-70
SLIDE 70

Key idea of the proof

x0 x1 . xJ y0 y1 . . yK X Y a0 a1 a2 . . . a ˜

J

b0 b1 b2 . . b ˜

K

MA MB µ ∽ X × Y (X, Y )

slide-71
SLIDE 71

Key idea of the proof

x0 x1 . xJ y0 y1 . . yK X Y a0 a1 a2 . . . a ˜

J

b0 b1 b2 . . b ˜

K

MA MB µ ∽ X × Y (X, Y ) R

slide-72
SLIDE 72

Key idea of the proof

x0 x1 . xJ y0 y1 . . yK X Y a0 a1 a2 . . . a ˜

J

b0 b1 b2 . . b ˜

K

MA MB µ ∽ X × Y (X, Y ) (X ′, Y ′) R

slide-73
SLIDE 73

Key idea of the proof

x0 x1 . xJ y0 y1 . . yK X Y a0 a1 a2 . . . a ˜

J

b0 b1 b2 . . b ˜

K

MA MB µ ∽ X × Y (X, Y ) (X ′, Y ′) R R′

slide-74
SLIDE 74

Main Result

Theorem

Let f : X × Y → Z be non-degenerate and let µ be a distribution on X × Y. Then, PSM(f ) ≥ log(1/α(µ)) + H∞(µ) − log(1/β(µ)) − 1.

slide-75
SLIDE 75

Main Result

Theorem

Let f : X × Y → Z be non-degenerate and let µ be a distribution on X × Y. Then, PSM(f ) ≥ log(1/α(µ)) + H∞(µ) − log(1/β(µ)) − 1. α(µ) := Volume of disjoint, Similar Rectangles := max

(R1,R2: similar, disjoint) {min(µ(R1), µ(R2))}

R1 R2 X Y Truth Table of f

slide-76
SLIDE 76

Main Result

Theorem

Let f : X × Y → Z be non-degenerate and let µ be a distribution on X × Y. Then, PSM(f ) ≥ log(1/α(µ)) + H∞(µ) − log(1/β(µ)) − 1. H∞(µ) := Min. Entropy of µ

slide-77
SLIDE 77

Main Result

Theorem

Let f : X × Y → Z be non-degenerate and let µ be a distribution on X × Y. Then, PSM(f ) ≥ log(1/α(µ)) + H∞(µ) − log(1/β(µ)) − 1. β(µ) := Volume of Useful Edges := Pr[(X, Y ) = (X ′, Y ′)|f (X, Y ) = f (X ′, Y ′)]

slide-78
SLIDE 78

Special cases

Theorem (Boolean function)

For non-degenerate f : X × Y → {0, 1}, PSM(f ) ≥ 2(log |X| + log |Y|) − log M − 3.

slide-79
SLIDE 79

Special cases

Theorem (Boolean function)

For non-degenerate f : X × Y → {0, 1}, PSM(f ) ≥ 2(log |X| + log |Y|) − log M − 3. M := max

(R1,R2: similar, disjoint)|R1|

slide-80
SLIDE 80

Special cases

Theorem (Boolean function)

For non-degenerate f : X × Y → {0, 1}, PSM(f ) ≥ 2(log |X| + log |Y|) − log M − 3.

Proof.

Use µ : uniform distribution.

slide-81
SLIDE 81

Special cases

Theorem (Boolean function)

For non-degenerate f : X × Y → {0, 1}, PSM(f ) ≥ 2(log |X| + log |Y|) − log M − 3.

Corollary (Random function)

For a random, boolean f : {0, 1}k × {0, 1}k → {0, 1}, w.h.p., PSM(f ) ≥ 3k − 2 log k − 1.

slide-82
SLIDE 82

Special cases

Theorem (Boolean function)

For non-degenerate f : X × Y → {0, 1}, PSM(f ) ≥ 2(log |X| + log |Y|) − log M − 3.

Corollary (Random function)

For a random, boolean f : {0, 1}k × {0, 1}k → {0, 1}, w.h.p., PSM(f ) ≥ 3k − 2 log k − 1.

Proof.

W.h.p., M ≤ k2 · 2k.

slide-83
SLIDE 83

Special cases

Theorem (Boolean function)

For non-degenerate f : X × Y → {0, 1}, PSM(f ) ≥ 2(log |X| + log |Y|) − log M − 3.

Corollary (Random function)

For a random, boolean f : {0, 1}k × {0, 1}k → {0, 1}, w.h.p., PSM(f ) ≥ 3k − 2 log k − 1.

Theorem (Explicit functions)

∃

  • fk : {0, 1}k × {0, 1}k → {0, 1}
  • k for which PSM(fk) ≥ 3k − O(log k)
slide-84
SLIDE 84

Special cases

Theorem (Boolean function)

For non-degenerate f : X × Y → {0, 1}, PSM(f ) ≥ 2(log |X| + log |Y|) − log M − 3.

Corollary (Random function)

For a random, boolean f : {0, 1}k × {0, 1}k → {0, 1}, w.h.p., PSM(f ) ≥ 3k − 2 log k − 1.

Theorem (Explicit functions)

∃

  • fk : {0, 1}k × {0, 1}k → {0, 1}
  • k for which PSM(fk) ≥ 3k − O(log k)

Proof.

Suffices to sample fk from poly(k)-wise independent distribution.

slide-85
SLIDE 85

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y
  • s ∈ {0, 1}

(x, y) x, s y

slide-86
SLIDE 86

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y

y s iff h(x, y) = 1 (x, y) x, s

  • s ∈ {0, 1}
  • h : X × Y → {0, 1}
slide-87
SLIDE 87

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y

y x, s

  • s ∈ {0, 1}
  • h : X × Y → {0, 1}

s iff h(x, y) = 1 (x, y)

  • Pefect correctness
  • Perfect privacy
slide-88
SLIDE 88

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y
  • s ∈ {0, 1}
  • h : X × Y → {0, 1}

s iff h(x, y) = 1 (x, y)

  • Pefect correctness
  • Perfect privacy

x, s, R y, R

  • R ∈ {0, 1}∗
slide-89
SLIDE 89

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y
  • s ∈ {0, 1}
  • h : X × Y → {0, 1}

s iff h(x, y) = 1 (x, y)

  • Pefect correctness
  • Perfect privacy

x, s, R y, R

  • R ∈ {0, 1}∗

MA MB

slide-90
SLIDE 90

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y
  • s ∈ {0, 1}
  • h : X × Y → {0, 1}

s iff h(x, y) = 1 (x, y)

  • Pefect correctness
  • Perfect privacy

x, s, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Useful applications: unconditionally private information retrieval (P.I.R.),

priced O.T., secret sharing for graph-based access structures, attribute-based encryption

slide-91
SLIDE 91

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y
  • s ∈ {0, 1}
  • h : X × Y → {0, 1}

s iff h(x, y) = 1 (x, y)

  • Pefect correctness
  • Perfect privacy

x, s, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Communication lowerbound :
  • Ω(log k) for several explicit predicates (Gay et al., CRYPTO, 2015)
slide-92
SLIDE 92

Conditional Disclosure of a Secret (C.D.S.)

A B C

  • x ∈ X, y ∈ Y
  • s ∈ {0, 1}
  • h : X × Y → {0, 1}

s iff h(x, y) = 1 (x, y)

  • Pefect correctness
  • Perfect privacy

x, s, R y, R

  • R ∈ {0, 1}∗

MA MB

  • Communication lowerbound :
  • Ω(log k) for several explicit predicates (Gay et al., CRYPTO, 2015)
  • k − o(k) for some non-explicit predicate (Applebaum et al., CRYPTO,

2017)

slide-93
SLIDE 93

C.D.S. Lowerbound

Theorem

For predicate h : X × Y → {0, 1}, CDS(h) ≥ 2 log |h−1(0)| − log M − log |X| − log |Y| − 1 .

slide-94
SLIDE 94

C.D.S. Lowerbound

Theorem

For predicate h : X × Y → {0, 1}, CDS(h) ≥ 2 log |h−1(0)| − log M − log |X| − log |Y| − 1 . |h−1(0)| := Number of 0-inputs of h

slide-95
SLIDE 95

C.D.S. Lowerbound

Theorem

For predicate h : X × Y → {0, 1}, CDS(h) ≥ 2 log |h−1(0)| − log M − log |X| − log |Y| − 1 . M := Size of largest 0-monochromatic rectangle of h All 0’s X Y Truth Table of h

slide-96
SLIDE 96

C.D.S. Lowerbound : Special Cases

Corollary (CDS for Inner Product)

For predicate h(x, y) =< x, y >, x, y ∈ {0, 1}k, CDS(h) ≥ k − 3 − o(1).

slide-97
SLIDE 97

C.D.S. Lowerbound : Special Cases

Corollary (CDS for Inner Product)

For predicate h(x, y) =< x, y >, x, y ∈ {0, 1}k, CDS(h) ≥ k − 3 − o(1). Remarks:

  • Tight bound.
  • Previous bound: Ω(log k).
slide-98
SLIDE 98

C.D.S. Lowerbound : Special Cases

Corollary (CDS for Inner Product)

For predicate h(x, y) =< x, y >, x, y ∈ {0, 1}k, CDS(h) ≥ k − 3 − o(1). Remarks:

  • Tight bound.
  • Previous bound: Ω(log k).

Corollary (CDS for Random predicate)

For a random predicate h : {0, 1}k × {0, 1}k → {0, 1}, w.h.p., CDS(h) ≥ k − 4 − o(1).

slide-99
SLIDE 99

Summary

We revisited the P.S.M. lowerbound of Feige, Kilian, Naor(FKN) (STOC, 1994) and proved the following results:

slide-100
SLIDE 100

Summary

We revisited the P.S.M. lowerbound of Feige, Kilian, Naor(FKN) (STOC, 1994) and proved the following results:

  • Counterexample: an f whose P.S.M. communicates only 2k + 2 bits.
slide-101
SLIDE 101

Summary

We revisited the P.S.M. lowerbound of Feige, Kilian, Naor(FKN) (STOC, 1994) and proved the following results:

  • Counterexample: an f whose P.S.M. communicates only 2k + 2 bits.
  • New proof: leads to a 3k − O(log k) lowerbound for a random function.
slide-102
SLIDE 102

Summary

We revisited the P.S.M. lowerbound of Feige, Kilian, Naor(FKN) (STOC, 1994) and proved the following results:

  • Counterexample: an f whose P.S.M. communicates only 2k + 2 bits.
  • New proof: leads to a 3k − O(log k) lowerbound for a random function.
  • Lowerbound for explicit functions: existance of a poly-sized circuit family

{fk}k with lowerbound of {3k − O(log k)}k.

slide-103
SLIDE 103

Summary

We revisited the P.S.M. lowerbound of Feige, Kilian, Naor(FKN) (STOC, 1994) and proved the following results:

  • Counterexample: an f whose P.S.M. communicates only 2k + 2 bits.
  • New proof: leads to a 3k − O(log k) lowerbound for a random function.
  • Lowerbound for explicit functions: existance of a poly-sized circuit family

{fk}k with lowerbound of {3k − O(log k)}k.

  • C.D.S. lowerbound: simple combinatorial criterion for establishing linear

Ω(k) lowerbounds, tight lowerbound for inner product predicate.