Hig igh-Throughput Secure Three-Party Computation for Mali licious Adversaries and an Honest Majority Jun Furukawa*, Yehuda Lindell**, Ariel Nof** and Or Weinstein** *NEC corporation, Israel **Bar-Ilan University, Israel Eurocrypt 2017
Secure Three-Party Computation wit ith an Honest Majority π¦ 1 π¦ 2 π(π¦ 1 , π¦ 2 , π¦ 3 ) π¦ 3
Secure Three-Party Computation wit ith an Honest Majority π¦ 1 π¦ 2 π(π¦ 1 , π¦ 2 , π¦ 3 ) π¦ 3
Secure Three-Party Computation wit ith an Honest Majority π¦ 1 π¦ 2 π(π¦ 1 , π¦ 2 , π¦ 3 ) π¦ 3 β’ Functionality is represented by a Boolean circuit β’ Security with abort
High-Throughput Secure Three-Party Computation with an Honest Majority
High-Throughput Secure Three-Party Computation with an Honest Majority π’ π‘π’ππ π’ π’ πππ f How much time it takes to compute a function?
High-Throughput Secure Three-Party Computation with an Honest Majority π’ π‘π’ππ π’ π’ πππ f How much time it takes to compute a function? Latency
High-Throughput Secure Three-Party Computation with an Honest Majority 1 π‘ππ f f f f f f f f f π’ π‘π’ππ π’ π’ πππ f How much time it takes to How many functions can we compute a function? compute in one sec? Latency
High-Throughput Secure Three-Party Computation with an Honest Majority 1 π‘ππ f f f f f f f f f π’ π‘π’ππ π’ π’ πππ f How much time it takes to How many functions can we compute a function? compute in one sec? Latency Throughput
Low Latency VS. High-Throughput High-Throughput Low Latency
Low Latency VS. High-Throughput High-Throughput Low Latency β’ Constant rounds of communication π 1 π 2 β the garbled-circuit approach β
Low Latency VS. High-Throughput High-Throughput Low Latency β’ Low bandwidth β’ Constant rounds of β’ Simple Computations communication π π 1 1 π 2 π 2 β the secret-sharing approach β β the garbled-circuit approach β
Low Latency VS. High-Throughput High-Throughput Low Latency β’ Low bandwidth β’ Constant rounds of β’ Simple Computations communication π π 1 1 π 2 π 2 β the secret-sharing approach β β the garbled-circuit approach β
The Starting Point: The Semi-honest protocol of [AFLNO16 16] β’ Based on replicated secret sharing β’ Requires 1 bit of communication sent by each party per AND gate. β’ Speed: compute over 7 billion AND gates per second β’ Concretely, over 1,300,000 AES operations per second
From Semi-Honest to Malicious adversary ry β’ Sharing the inputs β’ Emulating the circuit β’ Output Reconstruction
From Semi-Honest to Malicious adversary ry How to force the corrupted party to share its β’ Sharing the inputs inputs β correctly β ? How to verify AND gates were computed β’ Emulating the circuit correctly? How to verify that the output was β’ Output Reconstruction reconstructed correctly?
From Semi-Honest to Malicious adversary ry How to force the corrupted party to share its β’ Sharing the inputs inputs β correctly β ? How to verify AND gates were computed β’ Emulating the circuit correctly? How to verify that the output was β’ Output Reconstruction reconstructed correctly?
Verification of AND Gates A β multiplication triple β is a triple of shares π , π , π such that π = π β π
Verification of AND Gates A β multiplication triple β is a triple of shares π , π , π such that π = π β π Let π¦ , π§ , π¨ be a triple generated by computing an AND gate Let π , π , π be a random triple
Verification of AND Gates A β multiplication triple β is a triple of shares π , π , π such that π = π β π Let π¦ , π§ , π¨ be a triple generated by computing an AND gate Let π , π , π be a random triple
Verification of AND Gates A β multiplication triple β is a triple of shares π , π , π such that π = π β π Let π¦ , π§ , π¨ be a triple generated If π , π , π is a β valid β triple, then we by computing an AND gate can use π , π , π to detect cheating Let π , π , π be a random triple in π¦ , π§ , π¨ with probability 1.
Verification of AND Gates A β multiplication triple β is a triple of shares π , π , π such that π = π β π Let π¦ , π§ , π¨ be a triple generated If π , π , π is a β valid β triple, then we by computing an AND gate can use π , π , π to detect cheating Let π , π , π be a random triple in π¦ , π§ , π¨ with probability 1. Sub-protocol β triple verification without opening β Communication: 2 bits per each party
The Protocol On-line protocol 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates 4. Reconstruct Output 3 bits per AND gate
The Protocol On-line protocol 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates Output πΆ triples 4. Reconstruct Output 3 bits per AND gate
The Protocol Pre-processing protocol On-line protocol 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates Output πΆ triples 4. Reconstruct Output 3 bits per AND gate
The Protocol Pre-processing protocol On-line protocol ? 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates Output πΆ triples 4. Reconstruct Output 3 bits per AND gate
Generation of f Random Multiplication Triples β’ π , [π] are generated without any interaction! β’ [π] is computed using the semi-honest protocol
Generation of f Random Multiplication Triples β’ π , [π] are generated without any interaction! 1 bit of communication! β’ [π] is computed using the semi-honest protocol
Generation of f Random Multiplication Triples β’ π , [π] are generated without any interaction! 1 bit of communication! β’ [π] is computed using the semi-honest protocol How to verify that the triple is valid?
Generation of f Random Multiplication Triples . . .
Generation of f Random Multiplication Triples Random permutation . . .
Generation of f Random Multiplication Triples Random Open C permutation triples . . .
Generation of f Random Multiplication Triples Random Open C permutation triples If one of the opened triples is incorrect, the honest parties will detect it and abort . . .
Generation of f Random Multiplication Triples Random Open C permutation triples . . .
Generation of f Random Multiplication Triples Split into N Random Open C buckets of permutation triples equal size πΆ 1 πΎ π’π πππππ‘ . . πΆ 2 πΎ π’π πππππ‘ . . . . πΎ π’π πππππ‘ πΆ π
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using πΈ β π triples πΆ 1 πΎ π’π πππππ‘ . . πΆ 2 πΎ π’π πππππ‘ . . . . . . . πΎ π’π πππππ‘ πΆ π
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using πΈ β π triples πΆ 1 πΎ π’π πππππ‘ . If one of the . buckets is β mixed β , πΆ 2 πΎ π’π πππππ‘ the honest parties . . . will detect it and . . abort . . πΎ π’π πππππ‘ πΆ π
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using πΈ β π triples πΆ 1 πΎ π’π πππππ‘ . . πΆ 2 πΎ π’π πππππ‘ . . . . . . . πΎ π’π πππππ‘ πΆ π
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using πΈ β π triples πΆ 1 πΎ π’π πππππ‘ . . πΆ 2 πΎ π’π πππππ‘ . . . . . . . πΎ π’π πππππ‘ πΆ π
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using πΈ β π triples πΆ 1 πΎ π’π πππππ‘ . . πΆ 2 πΎ π’π πππππ‘ . . . . . . . πΎ π’π πππππ‘ πΆ π
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using πΈ β π triples πΆ 1 πΎ π’π πππππ‘ . . πΆ 2 πΎ π’π πππππ‘ . . . . . . . πΎ π’π πππππ‘ πΆ π
Recommend
More recommend
Sambuz
Unleash a World of Digital PossibilitiesβBrowse, Share, and Explore Content Without Boundaries
