Concurrently Secure Protocols Huijia (Rachel) Lin Rafael Pass MIT - - PowerPoint PPT Presentation

▶
concurrently secure protocols
SMART_READER_LITE
LIVE PREVIEW

Concurrently Secure Protocols Huijia (Rachel) Lin Rafael Pass MIT - - PowerPoint PPT Presentation

Jun 13, 2023 125 likes •1.12k views

Black-Box Constructions of Concurrently Secure Protocols Huijia (Rachel) Lin Rafael Pass MIT & BU Cornell Secure MPC Secure MPC Goal: Allow a set of distrustful parties to compute ANY function f on their own Secure MPC Goal: Allow a set

slide-1
SLIDE 1

Black-Box Constructions of Concurrently Secure Protocols

Huijia (Rachel) Lin MIT & BU Rafael Pass Cornell

slide-2
SLIDE 2

Secure MPC

slide-3
SLIDE 3

Secure MPC

Goal: Allow a set of distrustful parties to compute ANY function f on their own

slide-4
SLIDE 4

Secure MPC

Goal: Allow a set of distrustful parties to compute ANY function f on their own

slide-5
SLIDE 5

Secure MPC

Goal: Allow a set of distrustful parties to compute ANY function f on their own Correctness

What to get---the outputs

Privacy

What to hide---the private inputs

slide-6
SLIDE 6

Secure MPC

Goal: Allow a set of distrustful parties to compute ANY function f on their own Correctness

What to get---the outputs

Privacy

What to hide---the private inputs

Even when no honest majority

slide-7
SLIDE 7

IDEAL REAL

Simulation Paradigm

slide-8
SLIDE 8

IDEAL REAL

Simulation Paradigm

“as correct & private as”

slide-9
SLIDE 9

IDEAL REAL

Simulation Paradigm

“as correct & private as”

slide-10
SLIDE 10

IDEAL REAL

AR

Simulation Paradigm

“as correct & private as”

slide-11
SLIDE 11

IDEAL REAL

AR

AI

Simulation Paradigm

“as correct & private as”

slide-12
SLIDE 12

IDEAL REAL

AR

AI

Simulation Paradigm

“as correct & private as”

Simulator

slide-13
SLIDE 13

IDEAL REAL

AR

AI x2 y2 x2y2

Simulation Paradigm

x1 y1 x1 y1

“as correct & private as”

Correctness: The output of every player in ideal is the same as in real

Simulator

slide-14
SLIDE 14

IDEAL REAL

AR

AI x2 y2 x2y2

Simulation Paradigm

x1 y1 x1 y1

“as correct & private as”

Correctness: The output of every player in ideal is the same as in real Privacy: The simulator can learn whatever the adv learns

Simulator

slide-15
SLIDE 15

IDEAL REAL

AR

AI x2 y2 x2y2

Simulation Paradigm

x1 y1 x1 y1

“as correct & private as”

Correctness: The output of every player in ideal is the same as in real Privacy: The simulator can learn whatever the adv learns

Simulator

slide-16
SLIDE 16

IDEAL REAL

AR

AI x2 y2 x2y2

Simulation Paradigm

x1 y1 x1 y1

“as correct & private as”

Correctness: The output of every player in ideal is the same as in real Privacy: The simulator can learn whatever the adv learns

Simulator

In this talk, we focus on static malicious corruption

slide-17
SLIDE 17

The Concurrent Model

slide-18
SLIDE 18

The Concurrent Model

MANY sets of players executing MANY different protocols all at once

[DDN, DNS, GK, Fe, KPR, RK, CKPR, KP, PRS, C...and many others]

slide-19
SLIDE 19

The Concurrent Model

MANY sets of players executing MANY different protocols all at once

[DDN, DNS, GK, Fe, KPR, RK, CKPR, KP, PRS, C...and many others]

slide-20
SLIDE 20

IDEAL REAL

Concurrent Security (informally)

Many executions of different protocols Many executions with INDEPENDENT trusted parties

slide-21
SLIDE 21

IDEAL REAL

Concurrent Security (informally)

Many executions of different protocols Many executions with INDEPENDENT trusted parties

Universal Composibility (UC) [Can00]

slide-22
SLIDE 22

IDEAL REAL

Concurrent Security (informally)

Many executions of different protocols Many executions with INDEPENDENT trusted parties

Universal Composibility (UC) [Can00]

Impossible [CF01, CKF03]

slide-23
SLIDE 23

IDEAL REAL

Super Polynomial Time Simulation (SPS)

slide-24
SLIDE 24

IDEAL REAL

Super Polynomial Time Simulation (SPS)

— SPS [Pas03, BS05, LPV09, GGJS12]

slide-25
SLIDE 25

IDEAL REAL

Super Polynomial Time Simulation (SPS)

— SPS [Pas03, BS05, LPV09, GGJS12]

slide-26
SLIDE 26

IDEAL REAL

Super Polynomial Time Simulation (SPS)

— SPS [Pas03, BS05, LPV09, GGJS12] — Angel-based Security Model [PS04, MMY06] — UC with super-poly helpers [CLP10]

slide-27
SLIDE 27

IDEAL REAL

Super Polynomial Time Simulation (SPS)

— SPS [Pas03, BS05, LPV09, GGJS12]

Feasibility Results Only

— Angel-based Security Model [PS04, MMY06] — UC with super-poly helpers [CLP10]

slide-28
SLIDE 28

Super Polynomial time (SPS) Security

Feasibility Results Only Due to the Non-Black-Box constructions (Lots of Karp reductions)

slide-29
SLIDE 29

Super Polynomial time (SPS) Security

Feasibility Results Only Naturally, Solution: Black-box Constructions (No Karp reductions)

slide-30
SLIDE 30

Super Polynomial time (SPS) Security

Feasibility Results Only Naturally, Solution: Black-box Constructions (No Karp reductions) Efficient Protocols

slide-31
SLIDE 31

BB MPC Protocols

slide-32
SLIDE 32

In the stand alone setting---Solved!

O(1) round BB MPC, f/ minimal assumption semi-honest OT [Kil88,IPS08,IKLP06,Hai08,Wee10,Goy11]

BB MPC Protocols

slide-33
SLIDE 33

In the stand alone setting---Solved!

O(1) round BB MPC, f/ minimal assumption semi-honest OT [Kil88,IPS08,IKLP06,Hai08,Wee10,Goy11]

In the concurrent setting

Only unconditionally secure UC protocols f/ strong set-ups e.g. Ideal OT [Kil88,IPS08], hardware tokens [GISVW10]

BB MPC Protocols

slide-34
SLIDE 34

Can we have BB concurrently secure protocols in the plain model?

In the stand alone setting---Solved!

O(1) round BB MPC, f/ minimal assumption semi-honest OT [Kil88,IPS08,IKLP06,Hai08,Wee10,Goy11]

In the concurrent setting

Only unconditionally secure UC protocols f/ strong set-ups e.g. Ideal OT [Kil88,IPS08], hardware tokens [GISVW10]

BB MPC Protocols

slide-35
SLIDE 35

Our Result (informal) : BB construction of concurrently secure MPC protocols

  • In the plain model
  • Based on minimal assumption Semi-Honest OT
  • Security in the UC with super-poly helper model
  • Implies super-polynomial time simulation security
  • Closed under universal composition

Yes!

slide-36
SLIDE 36

Our Result (informal) : BB construction of concurrently secure MPC protocols

  • In the plain model
  • Based on minimal assumption Semi-Honest OT
  • Security in the UC with super-poly helper model
  • Implies super-polynomial time simulation security
  • Closed under universal composition

Yes!

How?

slide-37
SLIDE 37
slide-38
SLIDE 38

Any Functionality Ideal Oblivious Transfer Box FOT

[Kil88,IPS08,GMW87,BGW88]:

Unconditional UC-security

slide-39
SLIDE 39

Any Functionality Ideal Oblivious Transfer Box FOT

[Kil88,IPS08,GMW87,BGW88]:

Unconditional UC-security

Stand-alone Semi-honest OT SH-OT

BB

slide-40
SLIDE 40

Any Functionality Ideal Oblivious Transfer Box FOT

[Kil88,IPS08,GMW87,BGW88]:

Unconditional UC-security

Stand-alone Semi-honest OT SH-OT

BB

[IKLP06,Hai08,Wee10,Goy11]

Stand-Alone Security

slide-41
SLIDE 41

Any Functionality Ideal Oblivious Transfer Box FOT

[Kil88,IPS08,GMW87,BGW88]:

Unconditional UC-security This work

Stand-alone Semi-honest OT SH-OT

BB UC with Super-Poly Helper

[IKLP06,Hai08,Wee10,Goy11]

Stand-Alone Security

slide-42
SLIDE 42

Any Functionality Ideal Oblivious Transfer Box FOT

[Kil88,IPS08,GMW87,BGW88]:

Unconditional UC-security This work

Stand-alone Semi-honest OT SH-OT

BB

The main tool: BB CCA-Secure Commitments [CLP10]

UC with Super-Poly Helper

[IKLP06,Hai08,Wee10,Goy11]

Stand-Alone Security

slide-43
SLIDE 43

CCA-Secure Commitments

slide-44
SLIDE 44

CCA-Secure Commitments

The commitment analogue of CCA2 encryption.

slide-45
SLIDE 45

CCA-Secure Commitments

A

C(x) C(y1)

O

C(y2) C(y3)

The commitment analogue of CCA2 encryption.

slide-46
SLIDE 46

CCA-Secure Commitments

A

C(x) C(y1)

O is a committed-value oracle If valid com, y = the committed value Else if invalid com, y = bot

O

C(y2) C(y3)

y1 y2 y3

The commitment analogue of CCA2 encryption.

slide-47
SLIDE 47

CCA-Secure Commitments

A

C(x) C(y1)

O is a committed-value oracle If valid com, y = the committed value Else if invalid com, y = bot

O

C(y2) C(y3)

y1 y2 y3

The commitment analogue of CCA2 encryption.

Note: Original definition in [CLP10] considers a decommitment oracle. (with black-box construction, we can only achieve the weaker notion.)

slide-48
SLIDE 48

CCA-Secure Commitments

A

C(x) C(y1)

Chosen-Commitment-Attack (CCA) security:

Either A forwards the left commitment to the right Or LHS is hiding --- view of A indistinguishable

O

C(y2) C(y3)

y1 y2 y3

The commitment analogue of CCA2 encryption.

slide-49
SLIDE 49

Concurrent Non-Malleable Commitments

A

C(x) C(y1) C(y2) C(y3)

slide-50
SLIDE 50

Concurrent Non-Malleable Commitments

A

C(x) C(y1)

Non-Malleability

Either A copies the left commitment to the right Or x and (y1, y2, y3) independent

  • -- view of A + (y1, y2, y3) indistinguishable

C(y2) C(y3)

slide-51
SLIDE 51

Concurrent Non-Malleable Commitments

A

C(x) C(y1)

Non-Malleability

Either A copies the left commitment to the right Or x and (y1, y2, y3) independent

  • -- view of A + (y1, y2, y3) indistinguishable

C(y2) C(y3)

O

y1 y2 y3

slide-52
SLIDE 52

Concurrent Non-Malleable Commitments

A

C(x) C(y1)

Non-Malleability

Either A copies the left commitment to the right Or x and (y1, y2, y3) independent

  • -- view of A + (y1, y2, y3) indistinguishable

C(y2) C(y3)

CCA security  Non-Malleability

O

y1 y2 y3

slide-53
SLIDE 53

Theorem 1: OWF  BB construction of CCA commitments

slide-54
SLIDE 54

Theorem 1: OWF  BB construction of CCA commitments Theorem 2: CCA commitments + SH-OT  BB implementation of FOT

slide-55
SLIDE 55

Theorem 1: OWF  BB construction of CCA commitments Theorem 2: CCA commitments + SH-OT  BB implementation of FOT Proof: [CLP10]---Non-BB CCA commitments + [PW08]---BB trapdoor commitments + [CDMW08,09]---Cut & choose for consistency

slide-56
SLIDE 56

Theorem 1: OWF  BB construction of CCA commitments Theorem 2: CCA commitments + SH-OT  BB implementation of FOT Proof: [CLP10]---Non-BB CCA commitments + [PW08]---BB trapdoor commitments + [CDMW08,09]---Cut & choose for consistency

slide-57
SLIDE 57

Theorem 2: CCA commitments + SH-OT  BB implementation of FOT

slide-58
SLIDE 58

Theorem 2: CCA commitments + SH-OT  BB implementation of FOT

  • 1. CCA is the right notion for BB concurrent MPC protocols
slide-59
SLIDE 59

Theorem 2: CCA commitments + SH-OT  BB implementation of FOT

  • 1. CCA is the right notion for BB concurrent MPC protocols
  • 2. Assuming “AES” is a CCA commitment

 Efficient Constant-round BB concurrent MPC protocols

slide-60
SLIDE 60

Theorem 2: CCA commitments + SH-OT  BB implementation of FOT

  • 1. CCA is the right notion for BB concurrent MPC protocols
  • 2. Assuming “AES” is a CCA commitment

 Efficient Constant-round BB concurrent MPC protocols

slide-61
SLIDE 61

Theorem 2: CCA + SH-OT  BB implementation of FOT,

slide-62
SLIDE 62

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-63
SLIDE 63

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

R(b) S (m0m1)

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-64
SLIDE 64

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-65
SLIDE 65

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Want: Enforce R behave honestly in OTs

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-66
SLIDE 66

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Want: Enforce R behave honestly in OTs

ZK proof R acts honestly

Theorem 2: CCA + mS-OT  BB implementation of FOT

Non-BB Solution

slide-67
SLIDE 67

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Want: Enforce R behave honestly in OTs

BB Solution: Cut & Choose

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-68
SLIDE 68

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Want: Enforce R behave honestly in OTs

T [2n], |T| = n

BB Solution: Cut & Choose

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-69
SLIDE 69

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Want: Enforce R behave honestly in OTs

Open Randomness in OTk for k  T T [2n], |T| = n

BB Solution: Cut & Choose

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-70
SLIDE 70

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Open Randomness in OTk for k  T T [2n], |T| = n

BB Solution: Cut & Choose

Cut & Choose  R behave honestly in most OTs [IKLP06,Wee10]

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-71
SLIDE 71

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs OT Combiner

Open Randomness in OTk for k  T T [2n], |T| = n

BB Solution: Cut & Choose

Cut & Choose  R behave honestly in most OTs [IKLP06,Wee10]

Theorem 2: CCA + mS-OT  BB implementation of FOT

slide-72
SLIDE 72

Malicious Sender OT (ms-OT)---OT secure for malicious sender & SH receiver

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs

Open Randomness in OTk for k  T T [2n], |T| = n

BB Solution: Cut & Choose

Theorem 2: CCA + mS-OT  BB implementation of FOT

To prove security against a malicious sender, Simulator needs to bias the set T to be cut

slide-73
SLIDE 73

To prove security against a malicious sender, Simulator needs to bias the set T to be cut

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs BB Solution: Cut & Choose

Theorem 2: CCA + mS-OT  BB implementation of FOT

r’

  • pen to r

ExtCom(r) Open Randomness in OTk for k  T

slide-74
SLIDE 74

To prove security against a malicious sender, Simulator needs to bias the set T to be cut

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs BB Solution: Cut & Choose

Theorem 2: CCA + mS-OT  BB implementation of FOT

r’

  • pen to r

ExtCom(r) Open Randomness in OTk for k  T

T = r XOR r’

slide-75
SLIDE 75

Using Coin Tossing, Simulator can bias the set T to be cut

OT1 OTk

R(b) S (m0m1)

OT2n

2n ms-OT executions with random inputs BB Solution: Cut & Choose

Theorem 2: CCA + mS-OT  BB implementation of FOT

r’

  • pen to r

ExtCom(r) Open Randomness in OTk for k  T

T = r XOR r’

slide-76
SLIDE 76

Informally, SH-OT + Coin-Tossing  Ideal OT in stand-alone setting [IKLP06,Wee10]

slide-77
SLIDE 77

In the concurrent setting,

Main issue: simulation-sound coin tossing

slide-78
SLIDE 78

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

slide-79
SLIDE 79

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

slide-80
SLIDE 80

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

slide-81
SLIDE 81

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

42

slide-82
SLIDE 82

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

42 42

slide-83
SLIDE 83

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

42 42

Random!

slide-84
SLIDE 84

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

Informally, SH-OT + simulation sound coin tossing  Ideal OT in concurrent setting r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

42 42

Random!

slide-85
SLIDE 85

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

Informally, SH-OT + simulation sound coin tossing  Ideal OT in concurrent setting r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

42 42

Random!

slide-86
SLIDE 86

In the concurrent setting,

Main issue: simulation-sound coin tossing No adv can bias the coin tossing results, even when the simulator is doing so

Informally, SH-OT + simulation sound coin tossing  Ideal OT in concurrent setting r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

r’

  • pen to r

ExtCom(r)

42 42

Random!

slide-87
SLIDE 87

Concurrent Coin Tossing from CCA

slide-88
SLIDE 88

Concurrent Coin Tossing from CCA

r’

  • pen to r

ExtCom(r)

slide-89
SLIDE 89

Concurrent Coin Tossing from CCA

r’

  • pen to r

CCACom(r)

slide-90
SLIDE 90

Concurrent Coin Tossing from CCA

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

slide-91
SLIDE 91

Concurrent Coin Tossing from CCA

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

Simulator can bias coins, by using oracle to break CCACom from adv

O

slide-92
SLIDE 92

Concurrent Coin Tossing from CCA

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

Simulator can bias coins, by using oracle to break CCACom from adv The adv cannot bias coins, as the CCACom from honest player is still hiding

O

slide-93
SLIDE 93

Concurrent Coin Tossing from CCA

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

r’

  • pen to r

CCACom(r)

Simulator can bias coins, by using oracle to break CCACom from adv The adv cannot bias coins, as the CCACom from honest player is still hiding

O

Theorem 2: CCA + SH-OT  BB implementation of FOT

slide-94
SLIDE 94

Our Result (informal) : BB construction of concurrently secure MPC protocols

  • In the plain model
  • Assuming Semi-Honest Oblivious Transfer protocols
  • Security in the UC with super-poly helper model [CLP10]
  • Implies SPS security
  • Closed under universal composition
slide-95
SLIDE 95

Our Result (informal) : BB construction of concurrently secure MPC protocols

  • In the plain model
  • Assuming Semi-Honest Oblivious Transfer protocols
  • Security in the UC with super-poly helper model [CLP10]
  • Implies SPS security
  • Closed under universal composition

BB CCA Commitments

slide-96
SLIDE 96

Our Result (informal) : BB construction of concurrently secure MPC protocols

  • In the plain model
  • Assuming Semi-Honest Oblivious Transfer protocols
  • Security in the UC with super-poly helper model [CLP10]
  • Implies SPS security
  • Closed under universal composition

BB CCA Commitments

slide-97
SLIDE 97

Our Result (informal) : BB construction of concurrently secure MPC protocols

  • In the plain model
  • Assuming Semi-Honest Oblivious Transfer protocols
  • Security in the UC with super-poly helper model [CLP10]
  • Implies SPS security
  • Closed under universal composition

BB CCA Commitments

O(n)-round, better round-complexity?

slide-98
SLIDE 98

Thank you!