Computation for Mali licious Adversaries and an Honest Majority Jun - - PowerPoint PPT Presentation

β–Ά
computation for mali licious
SMART_READER_LITE
LIVE PREVIEW

Computation for Mali licious Adversaries and an Honest Majority Jun - - PowerPoint PPT Presentation

Dec 30, 2023 141 likes β€’703 views

Hig igh-Throughput Secure Three-Party Computation for Mali licious Adversaries and an Honest Majority Jun Furukawa*, Yehuda Lindell**, Ariel Nof** and Or Weinstein** *NEC corporation, Israel **Bar-Ilan University, Israel Eurocrypt 2017

slide-1
SLIDE 1

Hig igh-Throughput Secure Three-Party Computation for Mali licious Adversaries and an Honest Majority

Jun Furukawa*, Yehuda Lindell**, Ariel Nof** and Or Weinstein**

**Bar-Ilan University, Israel *NEC corporation, Israel

Eurocrypt 2017

slide-2
SLIDE 2

Secure Three-Party Computation wit ith an Honest Majority

𝑔(𝑦1, 𝑦2, 𝑦3) 𝑦1 𝑦2 𝑦3

slide-3
SLIDE 3

Secure Three-Party Computation wit ith an Honest Majority

𝑔(𝑦1, 𝑦2, 𝑦3) 𝑦1 𝑦2 𝑦3

slide-4
SLIDE 4

Secure Three-Party Computation wit ith an Honest Majority

𝑔(𝑦1, 𝑦2, 𝑦3) 𝑦1 𝑦2 𝑦3

  • Functionality is represented

by a Boolean circuit

  • Security with abort
slide-5
SLIDE 5

High-Throughput Secure Three-Party Computation

with an Honest Majority

slide-6
SLIDE 6

High-Throughput Secure Three-Party Computation

with an Honest Majority

f 𝑒𝑑𝑒𝑏𝑠𝑒 π‘’π‘“π‘œπ‘’

How much time it takes to compute a function?

slide-7
SLIDE 7

High-Throughput Secure Three-Party Computation

with an Honest Majority Latency

f 𝑒𝑑𝑒𝑏𝑠𝑒 π‘’π‘“π‘œπ‘’

How much time it takes to compute a function?

slide-8
SLIDE 8

High-Throughput Secure Three-Party Computation

with an Honest Majority Latency

f 𝑒𝑑𝑒𝑏𝑠𝑒 π‘’π‘“π‘œπ‘’

How much time it takes to compute a function?

f 1 𝑑𝑓𝑑 f f f f f f f f

How many functions can we compute in one sec?

slide-9
SLIDE 9

High-Throughput Secure Three-Party Computation

with an Honest Majority Latency Throughput

f 𝑒𝑑𝑒𝑏𝑠𝑒 π‘’π‘“π‘œπ‘’

How much time it takes to compute a function?

f 1 𝑑𝑓𝑑 f f f f f f f f

How many functions can we compute in one sec?

slide-10
SLIDE 10

Low Latency VS. High-Throughput

High-Throughput Low Latency

slide-11
SLIDE 11

Low Latency VS. High-Throughput

High-Throughput Low Latency

  • Constant rounds of

communication

𝑄

1

𝑄2

β€œthe garbled-circuit approach”

slide-12
SLIDE 12

Low Latency VS. High-Throughput

High-Throughput

  • Low bandwidth
  • Simple Computations

Low Latency

  • Constant rounds of

communication

𝑄

1

𝑄2 𝑄

1

𝑄2

β€œthe garbled-circuit approach” β€œthe secret-sharing approach”

slide-13
SLIDE 13

Low Latency VS. High-Throughput

High-Throughput

  • Low bandwidth
  • Simple Computations

Low Latency

  • Constant rounds of

communication

𝑄

1

𝑄2 𝑄

1

𝑄2

β€œthe garbled-circuit approach” β€œthe secret-sharing approach”

slide-14
SLIDE 14

The Starting Point: The Semi-honest protocol of [AFLNO16 16]

  • Based on replicated secret sharing
  • Requires 1 bit of communication sent by each party

per AND gate.

  • Speed: compute over 7 billion AND gates per second
  • Concretely, over 1,300,000 AES operations per second
slide-15
SLIDE 15

From Semi-Honest to Malicious adversary ry

  • Sharing the inputs
  • Emulating the circuit
  • Output Reconstruction
slide-16
SLIDE 16

From Semi-Honest to Malicious adversary ry

  • Sharing the inputs
  • Emulating the circuit
  • Output Reconstruction

How to force the corrupted party to share its inputs β€œcorrectly”? How to verify AND gates were computed correctly? How to verify that the output was reconstructed correctly?

slide-17
SLIDE 17

From Semi-Honest to Malicious adversary ry

  • Sharing the inputs
  • Emulating the circuit
  • Output Reconstruction

How to force the corrupted party to share its inputs β€œcorrectly”? How to verify AND gates were computed correctly? How to verify that the output was reconstructed correctly?

slide-18
SLIDE 18

Verification of AND Gates

A β€œmultiplication triple” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 β‹… 𝑐

slide-19
SLIDE 19

Verification of AND Gates

A β€œmultiplication triple” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 β‹… 𝑐

Let 𝑦 , 𝑧 , 𝑨 be a triple generated by computing an AND gate Let 𝑏 , 𝑐 , 𝑑 be a random triple

slide-20
SLIDE 20

Verification of AND Gates

A β€œmultiplication triple” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 β‹… 𝑐

Let 𝑦 , 𝑧 , 𝑨 be a triple generated by computing an AND gate Let 𝑏 , 𝑐 , 𝑑 be a random triple

slide-21
SLIDE 21

Verification of AND Gates

A β€œmultiplication triple” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 β‹… 𝑐

Let 𝑦 , 𝑧 , 𝑨 be a triple generated by computing an AND gate Let 𝑏 , 𝑐 , 𝑑 be a random triple If 𝑏 , 𝑐 , 𝑑 is a β€œvalid” triple, then we can use 𝑏 , 𝑐 , 𝑑 to detect cheating in 𝑦 , 𝑧 , 𝑨 with probability 1.

slide-22
SLIDE 22

Verification of AND Gates

A β€œmultiplication triple” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 β‹… 𝑐

Let 𝑦 , 𝑧 , 𝑨 be a triple generated by computing an AND gate Let 𝑏 , 𝑐 , 𝑑 be a random triple If 𝑏 , 𝑐 , 𝑑 is a β€œvalid” triple, then we can use 𝑏 , 𝑐 , 𝑑 to detect cheating in 𝑦 , 𝑧 , 𝑨 with probability 1.

Sub-protocol β€œtriple verification without opening”

Communication: 2 bits per each party

slide-23
SLIDE 23

The Protocol

On-line protocol

  • 1. Share the inputs
  • 2. Run the Semi-honest

protocol

  • 3. Verify all ANDs gates
  • 4. Reconstruct Output

3 bits per AND gate

slide-24
SLIDE 24

The Protocol

On-line protocol

  • 1. Share the inputs
  • 2. Run the Semi-honest

protocol

  • 3. Verify all ANDs gates
  • 4. Reconstruct Output

Output 𝑢 triples

3 bits per AND gate

slide-25
SLIDE 25

The Protocol

On-line protocol

  • 1. Share the inputs
  • 2. Run the Semi-honest

protocol

  • 3. Verify all ANDs gates
  • 4. Reconstruct Output

Pre-processing protocol

Output 𝑢 triples

3 bits per AND gate

slide-26
SLIDE 26

The Protocol

On-line protocol

  • 1. Share the inputs
  • 2. Run the Semi-honest

protocol

  • 3. Verify all ANDs gates
  • 4. Reconstruct Output

Pre-processing protocol

Output 𝑢 triples

?

3 bits per AND gate

slide-27
SLIDE 27

Generation of f Random Multiplication Triples

  • 𝑏 , [𝑐] are generated without any interaction!
  • [𝑑] is computed using the semi-honest protocol
slide-28
SLIDE 28

Generation of f Random Multiplication Triples

  • 𝑏 , [𝑐] are generated without any interaction!
  • [𝑑] is computed using the semi-honest protocol

1 bit of communication!

slide-29
SLIDE 29

Generation of f Random Multiplication Triples

  • 𝑏 , [𝑐] are generated without any interaction!
  • [𝑑] is computed using the semi-honest protocol

How to verify that the triple is valid?

1 bit of communication!

slide-30
SLIDE 30

Generation of f Random Multiplication Triples

. . .

slide-31
SLIDE 31

Generation of f Random Multiplication Triples

. . .

Random permutation

slide-32
SLIDE 32

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

slide-33
SLIDE 33

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

If one of the

  • pened triples is

incorrect, the honest parties will detect it and abort

slide-34
SLIDE 34

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

slide-35
SLIDE 35

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘

slide-36
SLIDE 36

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ Verify the first triple in each bucket using 𝜸 βˆ’ 𝟐 triples

. . .

slide-37
SLIDE 37

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ Verify the first triple in each bucket using 𝜸 βˆ’ 𝟐 triples

. . . If one of the buckets is β€œmixed”, the honest parties will detect it and abort

slide-38
SLIDE 38

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ Verify the first triple in each bucket using 𝜸 βˆ’ 𝟐 triples

. . .

slide-39
SLIDE 39

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ Verify the first triple in each bucket using 𝜸 βˆ’ 𝟐 triples

. . .

slide-40
SLIDE 40

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ Verify the first triple in each bucket using 𝜸 βˆ’ 𝟐 triples

. . .

slide-41
SLIDE 41

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ Verify the first triple in each bucket using 𝜸 βˆ’ 𝟐 triples

. . .

slide-42
SLIDE 42

Generation of f Random Multiplication Triples

. . .

Random permutation Open C triples

. . .

Split into N buckets of equal size 𝐢1 𝐢2 𝐢𝑂 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ 𝛾 π‘’π‘ π‘—π‘žπ‘šπ‘“π‘‘ Verify the first triple in each bucket using 𝜸 βˆ’ 𝟐 triples

. . .

Overall: 𝑡 + πŸ’π‘« + πŸ‘π‘Ά 𝜸 βˆ’ 𝟐 = 𝑢 πŸ’πœΈ βˆ’ πŸ‘ + πŸ“π‘« bits

slide-43
SLIDE 43

The Balls & Buckets Game

𝑏𝑛𝑓(𝐡, 𝑂, 𝐢, 𝐷) 1. chooses 𝑂𝛾 + 𝐷 balls, where each ball can be bad or good 1.

Cost of the pre-processing: 𝑢 πŸ’πœΈ βˆ’ πŸ‘ + πŸ‘π‘«

slide-44
SLIDE 44

The Balls & Buckets Game

𝐷𝐷), 𝐢𝐢𝑂𝑂, , 𝐡𝐡𝐻𝑏𝑛𝑓(𝑓(𝐡, 𝑂, 𝐢, 𝐷)

  • 1. chooses 𝑂𝛾 + 𝐷 balls, where each ball can be

bad or good 1.

Cost of the pre-processing: 𝑢 πŸ’πœΈ βˆ’ πŸ‘ + πŸ‘π‘«

slide-45
SLIDE 45

The Balls & Buckets Game

𝐷𝐷 balls, where each ball can be bad or good 1. The adversary 𝐡 chooses 𝑂𝛾 + 𝐷 balls, where each ball can be bad or good 2. chooses 𝑂𝛾 + 𝐷 balls, where each ball can be bad or good 1.

Cost of the pre-processing: 𝑢 πŸ’πœΈ βˆ’ πŸ‘ + πŸ‘π‘«

slide-46
SLIDE 46

The Balls & Buckets Game

𝐷𝐷 balls, where each ball can be bad or good

  • 1. C balls are randomly chosen and opened.
  • If a bad ball was opened – the adversary loses

1.

Cost of the pre-processing: 𝑢 πŸ’πœΈ βˆ’ πŸ‘ + πŸ‘π‘«

slide-47
SLIDE 47

The Balls & Buckets Game

𝐷𝐷 balls, where each ball can be bad or good

  • 1. C balls are randomly chosen and opened.
  • If a bad ball was opened – the adversary loses
  • 2. The balls are being randomly thrown into N buckets of size 𝛾
  • If all the buckets are fully good or fully bad, then the adversary wins

Cost of the pre-processing: 𝑢 πŸ’πœΈ βˆ’ πŸ‘ + πŸ‘π‘«

slide-48
SLIDE 48

The Balls & Buckets Game

𝐷𝐷 balls, where each ball can be bad or good

  • 1. C balls are randomly chosen and opened.
  • If a bad ball was opened – the adversary loses
  • 2. The balls are being randomly thrown into N buckets of size 𝛾
  • If all the buckets are fully good or fully bad, then the adversary wins

Cost of the pre-processing: 𝑢 πŸ’πœΈ βˆ’ πŸ‘ + πŸ‘π‘«

The goal: Given a statistical parameter 𝝉 and number of triples 𝑢 to generate, find 𝜸, 𝑫 of minimal size such that: 𝑸𝒔 𝑩 𝒙𝒋𝒐𝒕 ≀ πŸ‘βˆ’π‰

slide-49
SLIDE 49

The Balls & Buckets Game

The goal: Given a statistical parameter 𝝉 and number of triples 𝑢 to generate, find 𝜸, 𝑫 of minimal size such that: 𝑸𝒔 𝑩 𝒙𝒋𝒐𝒕 ≀ πŸ‘βˆ’π‰ Tiny OT Our Work 𝛾 4 3 𝐷 65,536 3 𝑁 = 𝑂𝛾 + 𝐷 4,259,840 3,154,731 𝑢 = πŸ‘πŸ‘πŸ, 𝝉 = πŸ“πŸ

slide-50
SLIDE 50

Summary ry & Efficiency

On-line protocol

  • 1. Share the inputs
  • 2. Run the Semi-honest

protocol

  • 3. Verify all ANDs gates
  • 4. Reconstruct Output

Pre-processing protocol

  • 1. Generate 𝑂𝛾 + 𝐷 triples
  • 2. Open 𝐷 triples
  • 3. Split into buckets and use 𝛾 βˆ’ 1

triples to verify one triple

Output 𝑢 triples

Parameters: 𝑂 = 220, 𝛾 = 3, 𝐷 = 3 7 bits per AND gate 3 bits per AND gate

slide-51
SLIDE 51

Efficiency Comparison

Communication (bits) Number of AES Computations MRZ[15] 85N 3N Our protocol 10N N/5

N = number of AND gates

slide-52
SLIDE 52

Efficiency Comparison

Communication (bits) Number of AES Computations MRZ[15] 85N 3N Our protocol 10N N/5

Three-party with honest majority at the cost of semi-honest Yao

N = number of AND gates

slide-53
SLIDE 53

More Im Improvements & Im Implementation

β€œOptimized Honest-Majority MPC for Malicious Adversaries – Breaking the 1-Billion-Gate Barrier” (To appear in IEEE S&P 2017)

  • Reduction of communication from 10 bits to 7 bits only!
  • This is achieved by better combinatorics that allows to use a bucket of size 2

(instead of 3)

  • Cache-efficient shuffling
  • Implementation
  • Basic implementation: 503,766,615 AND gates/sec
  • With optimizations: 1,152,751,967 AND gates/sec
slide-54
SLIDE 54

nofarie@cs.biu.ac.il