Encryption in the Plain Model Giulio Malavolta Abhishek Jain - - PowerPoint PPT Presentation

β–Ά
encryption in the plain model
SMART_READER_LITE
LIVE PREVIEW

Encryption in the Plain Model Giulio Malavolta Abhishek Jain - - PowerPoint PPT Presentation

Dec 20, 2023 883 likes β€’1.88k views

Multi-key Fully-Homomorphic Encryption in the Plain Model Giulio Malavolta Abhishek Jain Zhengzhong Jin Prabhanjan Ananth Carnegie Mellon University Johns Hopkins University of California, Johns Hopkins University of California,

slide-1
SLIDE 1

Multi-key Fully-Homomorphic Encryption in the Plain Model

Prabhanjan Ananth

Abhishek Jain

Zhengzhong Jin

Giulio Malavolta

Johns Hopkins University Johns Hopkins University

Carnegie Mellon University University of California, Berkeley

University of California, Santa Barbara

slide-2
SLIDE 2

Multi-key Fully-Homomorphic Encryption [LTV12]

slide-3
SLIDE 3

Multi-key Fully-Homomorphic Encryption [LTV12]

slide-4
SLIDE 4

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹―

Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

slide-5
SLIDE 5

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

slide-6
SLIDE 6

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

slide-7
SLIDE 7

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

slide-8
SLIDE 8

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

slide-9
SLIDE 9

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

slide-10
SLIDE 10

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

β‹―

slide-11
SLIDE 11

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

β‹―

slide-12
SLIDE 12

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) β‹―

Recovery:

slide-13
SLIDE 13

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

(Compact)

β‹―

Recovery:

slide-14
SLIDE 14

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

(Compact)

  • Security: adversary can learn nothing beyond 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂).

β‹―

Recovery:

slide-15
SLIDE 15

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) β‹―

Recovery:

  • (Implicit) Reusability: decryption can run for different ,

without re-generating the public keys/ciphertexts.

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

slide-16
SLIDE 16

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢 β‹―

  • (Implicit) Reusability: decryption can run for different ,

without re-generating the public keys/ciphertexts.

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) 𝐷′ 𝐷′(𝑛1, 𝑛2, … , 𝑛𝑂)

slide-17
SLIDE 17

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

β‹―

  • (Implicit) Reusability: decryption can run for different ,

without re-generating the public keys/ciphertexts.

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) 𝐷′ 𝐷′(𝑛1, 𝑛2, … , 𝑛𝑂)

slide-18
SLIDE 18

Multi-key Fully-Homomorphic Encryption [LTV12]

β‹― 𝑛1 𝑛2 𝑛𝑂

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Decryption Protocol:

β‹―

Recovery:

  • (Implicit) Reusability: decryption can run for different ,

without re-generating the public keys/ciphertexts.

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) 𝐷′ 𝐷′(𝑛1, 𝑛2, … , 𝑛𝑂) 𝐷′(𝑛1, 𝑛2, … , 𝑛𝑂)

slide-19
SLIDE 19

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

MK-FHE with 1-Round Decryption [MW16]

Decryption Protocol

β‹―

slide-20
SLIDE 20

1-round Decryption:

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

MK-FHE with 1-Round Decryption [MW16]

β‹―

slide-21
SLIDE 21

1-round Decryption:

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂) πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

MK-FHE with 1-Round Decryption [MW16]

β‹― 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Public Recovery:

slide-22
SLIDE 22

Applications

slide-23
SLIDE 23

Applications

  • 2-round multiparty computation [MW16]
  • Spooky encryption [DHRW16]
  • Homomorphic secret sharing [BGI16, BGI17]
  • obfuscation & functional encryption combiners [AJNSY16, AJS17]
  • Multiparty obfuscation [HIJKSY17]
  • Homomorphic time-lock puzzles [MT19,BDGM19]
  • Ad-hoc multi-input functional encryption [ACFGOT20]
  • ……
slide-24
SLIDE 24

Applications

  • 2-round multiparty computation [MW16]
  • Spooky encryption [DHRW16]
  • Homomorphic secret sharing [BGI16, BGI17]
  • obfuscation & functional encryption combiners [AJNSY16, AJS17]
  • Multiparty obfuscation [HIJKSY17]
  • Homomorphic time-lock puzzles [MT19,BDGM19]
  • Ad-hoc multi-input functional encryption [ACFGOT20]
  • ……
slide-25
SLIDE 25

Prior works on

Multi-key FHE with 1-round decryption

  • [CM15, MW16, BP16, PS16] need a trusted setup.
  • [DHRW16] sub-exponentially secure indistinguishable obfuscation.
slide-26
SLIDE 26

In In th the e pl plain in mode del, l, do does es Mu Mult lti-key key FHE HE wi with h 1-rou

  • und

nd de decrypti yption

  • n ex

exis ist?

slide-27
SLIDE 27

Our Results

slide-28
SLIDE 28

Our Results

1.

  • 1. Mu

Mult lti-key key FH FHE wi with th 1-ro roun und d dec ecry ryption ption in in th the e pla lain in mo model el from m Learn arning ing wit ith Err rror

  • r (LWE)

WE), , Rin ing-LWE, LWE, and De Decisio isiona nal l Sm Small ll Pol

  • lyn

ynomial

  • mial Ratio

tio prob

  • blem

lem.

  • O(1)-party

arty Multi lti-key ey FH FHE from m only ly LWE. E.

slide-29
SLIDE 29

Our Results

1.

  • 1. Mu

Mult lti-key key FH FHE wi with th 1-ro roun und d dec ecry ryption ption in in th the e pla lain in mo model el from m Learn arning ing wit ith Err rror

  • r (LWE)

WE), , Rin ing-LWE, LWE, and De Decisio isiona nal l Sm Small ll Pol

  • lyn

ynomial

  • mial Ratio

tio prob

  • blem

lem.

  • O(1)-party

arty Multi lti-key ey FH FHE from m only ly LWE. E. 2.

  • 2. Mult

ltipar iparty ty Homo momor morphic hic Encryp ryptio tion (a weaker er notio ion n of MK MK-FH FHE) E) from

  • m LWE.

E.

slide-30
SLIDE 30

β‹― 𝑛1 𝑛2 𝑛𝑂 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Public Recovery:

β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

slide-31
SLIDE 31

β‹― 𝑛1 𝑛2 𝑛𝑂 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹―

Public Recovery:

𝐷, β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

slide-32
SLIDE 32

β‹― 𝑛1 𝑛2 𝑛𝑂 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹―

Public Recovery:

  • It implies 2-round reusable multiparty computation with compact

communication complexity.

𝐷, β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

slide-33
SLIDE 33

β‹― 𝑛1 𝑛2 𝑛𝑂 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

slide-34
SLIDE 34

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷

slide-35
SLIDE 35

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷

slide-36
SLIDE 36

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷

Public Recovery:

𝐷, β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

slide-37
SLIDE 37

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷

Public Recovery:

𝐷, β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

  • Reusability: public keys can be reused for different circuits.
  • Compactness: communication complexity is independent of the circuit.
slide-38
SLIDE 38

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷

Public Recovery:

𝐷, β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

𝐷′ 𝐷′ 𝐷′

  • Reusability: public keys can be reused for different circuits.
  • Compactness: communication complexity is independent of the circuit.
slide-39
SLIDE 39

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷

Public Recovery:

𝐷, β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

𝐷′ 𝐷′ 𝐷′

  • Reusability: public keys can be reused for different circuits.
  • Compactness: communication complexity is independent of the circuit.
slide-40
SLIDE 40

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

Ciphertexts: Public Keys:

Multiparty Homomorphic Encryption: A weakening of MK-FHE

Partial Decryption:

β‹― 𝐷 𝐷

Public Recovery:

  • It implies 2-round Multiparty Computation.

𝐷, β†’ 𝐷 𝑛1, 𝑛2, … , 𝑛𝑂 Partial Decryptions

𝐷′ 𝐷′ 𝐷′

  • Reusability: public keys can be reused for different circuits.
  • Compactness: communication complexity is independent of the circuit.
slide-41
SLIDE 41

Our Approach

slide-42
SLIDE 42

Our Approach

2-round MPC Multi-key FHE [MW16]

slide-43
SLIDE 43

Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

slide-44
SLIDE 44

Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

𝑛1 𝑛2 𝑛𝑂 𝐷

1st Round: 2nd Round:

β‹― 𝐷 𝐷 β‹―

slide-45
SLIDE 45

Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

𝑛1 𝑛2 𝑛𝑂 𝐷

1st Round: 2nd Round:

β‹― 𝐷 𝐷 β‹―

  • Reusability: 1st round is reusable.
  • See Also:
  • [BL20], from bilinear maps.
  • [BGMM20], from DDH or

Succinct 1st msg MPC

slide-46
SLIDE 46

Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

𝑛1 𝑛2 𝑛𝑂 𝐷

1st Round: 2nd Round:

β‹― 𝐷 𝐷 β‹― 𝐷′

Another 2nd Round:

𝐷′ 𝐷′ β‹― β‹―

  • Reusability: 1st round is reusable.
  • See Also:
  • [BL20], from bilinear maps.
  • [BGMM20], from DDH or

Succinct 1st msg MPC

slide-47
SLIDE 47

Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

𝑛1 𝑛2 𝑛𝑂 𝐷

1st Round: 2nd Round:

β‹― 𝐷 𝐷 β‹― 𝐷′

Another 2nd Round:

𝐷′ 𝐷′ β‹― β‹―

  • Reusability: 1st round is reusable.
  • See Also:
  • [BL20], from bilinear maps.
  • [BGMM20], from DDH or

Succinct 1st msg MPC

slide-48
SLIDE 48

1-time MPC Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

𝑛1 𝑛2 𝑛𝑂 𝐷

1st Round: 2nd Round:

β‹― 𝐷 𝐷 β‹― 𝐷′

Another 2nd Round:

𝐷′ 𝐷′ β‹― β‹―

  • Reusability: 1st round is reusable.
  • See Also:
  • [BL20], from bilinear maps.
  • [BGMM20], from DDH or

Succinct 1st msg MPC

slide-49
SLIDE 49

1-time MPC Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

Succinctness Property

𝑛1 𝑛2 𝑛𝑂 𝐷

1st Round: 2nd Round:

β‹― 𝐷 𝐷 β‹― 𝐷′

Another 2nd Round:

𝐷′ 𝐷′ β‹― β‹―

  • Reusability: 1st round is reusable.
  • See Also:
  • [BL20], from bilinear maps.
  • [BGMM20], from DDH or

Succinct 1st msg MPC

slide-50
SLIDE 50

1-time MPC Reusable MPC Multi-key FHE

Our Approach

2-round MPC Multi-key FHE [MW16]

Succinctness Property

𝑛1 𝑛2 𝑛𝑂 𝐷

1st Round: 2nd Round:

β‹― 𝐷 𝐷 β‹― 𝐷′

Another 2nd Round:

𝐷′ 𝐷′ β‹― β‹―

  • Reusability: 1st round is reusable.
  • See Also:
  • [BL20], from bilinear maps.
  • [BGMM20], from DDH or

Succinct 1st msg MPC

slide-51
SLIDE 51

Reusable MPC β†’ Multi-key FHE

slide-52
SLIDE 52

Reusable MPC β†’ Multi-key FHE

  • [LTV12] is in plain mode, but has a multi-round decryption protocol.
slide-53
SLIDE 53

Reusable MPC β†’ Multi-key FHE

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

  • [LTV12] is in plain mode, but has a multi-round decryption protocol.

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Multi-round Decryption:

β‹―

slide-54
SLIDE 54

Reusable MPC β†’ Multi-key FHE

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts: Public Keys:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

  • [LTV12] is in plain mode, but has a multi-round decryption protocol.

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Multi-round Decryption:

β‹―

  • Run reusable MPC for Dec(β‹…).
slide-55
SLIDE 55

Reusable MPC β†’ Multi-key FHE

β‹― 𝑛1 𝑛2 𝑛𝑂 𝐷 𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Ciphertexts:

πͺπ₯𝟐 πͺπ₯2 πͺπ₯𝑢

  • [LTV12] is in plain mode, but has a multi-round decryption protocol.

𝐷(𝑛1, 𝑛2, … , 𝑛𝑂)

Reusable MPC 2nd Round

β‹― 𝑑𝑙1 𝑑𝑙1 𝑑𝑙𝑂

Public Keys & Reusable MPC 1st Round

  • Run reusable MPC for Dec(β‹…).
slide-56
SLIDE 56

Our Approach

1-time MPC Reusable MPC Multi-key FHE

Succinctness Property

slide-57
SLIDE 57

Our Approach

1-time MPC Reusable MPC Multi-key FHE

Succinctness Property

slide-58
SLIDE 58

Reusable MPC: A Self-Synthesis Approach

slide-59
SLIDE 59

Reusable MPC: A Self-Synthesis Approach

1-time MPC 2-times MPC

slide-60
SLIDE 60

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC

slide-61
SLIDE 61

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

slide-62
SLIDE 62

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

1st Round:

slide-63
SLIDE 63

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

1st Round:

𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 :

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

slide-64
SLIDE 64

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

1st Round:

𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 :

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

2nd round:

slide-65
SLIDE 65

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

1st Round:

𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 :

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

2nd round:

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

slide-66
SLIDE 66

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

1st Round:

𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 :

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

2nd round:

1st time

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

slide-67
SLIDE 67

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

1st Round:

𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 :

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

2nd round:

1st time 2nd time

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

slide-68
SLIDE 68

Reusable MPC: A Self-Synthesis Approach

  • Use 1-time MPC to generate 2 sets of fresh new 1st round messages

1-time MPC 2-times MPC β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

1st Round:

𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 :

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

Need the 3rd round to compute 𝐷

2nd round:

1st time 2nd time

β‹― β‹― 𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

slide-69
SLIDE 69

Round Compression to Rescue

slide-70
SLIDE 70

Round Compression to Rescue

  • Garble the 3rd round next message function Next𝑗to compress to 2 rounds.
slide-71
SLIDE 71

Round Compression to Rescue

  • Garble the 3rd round next message function Next𝑗to compress to 2 rounds.

1st round 2nd round 𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 : β‹― β‹―

𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

β‹―

slide-72
SLIDE 72

Round Compression to Rescue

  • Garble the 3rd round next message function Next𝑗to compress to 2 rounds.

π»π‘π‘ π‘π‘šπ‘“(Next1 ) π»π‘π‘ π‘π‘šπ‘“(Next2 ) π»π‘π‘ π‘π‘šπ‘“(Next𝑂 )

1st round 2nd round 𝑯 π’πŸ, π’πŸ‘, … , 𝒏𝑢 : β‹― β‹―

𝑛1 𝑛2 𝑛𝑂 𝑛1 𝑛2 𝑛𝑂

β‹―

𝑛1 𝑛2 𝑛𝑂

𝑛1 𝑛2

𝑛𝑂

β‹―

Label( Label( ) )

slide-73
SLIDE 73

Full-Fledged Tree-Based Approach

slide-74
SLIDE 74

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:
slide-75
SLIDE 75

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

Recursively apply the self-synthesis

slide-76
SLIDE 76

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

1

slide-77
SLIDE 77

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC

Recursively apply the self-synthesis

1 1

slide-78
SLIDE 78

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

1 1

slide-79
SLIDE 79

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

β‹― β‹―

1 1

slide-80
SLIDE 80

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

β‹― β‹―

Given 𝐷, walk down the tree according to 𝐷. 1 1

slide-81
SLIDE 81

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

β‹― β‹―

e.g. 𝐷 = 01 …

Given 𝐷, walk down the tree according to 𝐷. 1 1

slide-82
SLIDE 82

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

β‹― β‹―

e.g. 𝐷 = 01 …

Given 𝐷, walk down the tree according to 𝐷. 1-time MPC 1 1

slide-83
SLIDE 83

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

β‹― β‹―

e.g. 𝐷 = 01 …

Given 𝐷, walk down the tree according to 𝐷. 1-time MPC 1-time MPC 1 1

slide-84
SLIDE 84

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

β‹― β‹―

e.g. 𝐷 = 01 …

Given 𝐷, walk down the tree according to 𝐷. 1-time MPC

1-time MPC

1-time MPC 1 1

slide-85
SLIDE 85

Full-Fledged Tree-Based Approach

  • From 2-times usable to reusable:

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

Recursively apply the self-synthesis

β‹― β‹―

e.g. 𝐷 = 01 …

Given 𝐷, walk down the tree according to 𝐷. 1-time MPC

1-time MPC

1-time MPC 1 1

  • Eval. 𝑫
slide-86
SLIDE 86

Time Complexity Blow Up

1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

β‹― β‹―

slide-87
SLIDE 87

Time Complexity Blow Up

  • For 1-time MPC in plain model,

Time(1st Round) β‰ˆ 𝐷 β‹… π‘žπ‘π‘šπ‘§ πœ‡ 1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

β‹― β‹―

slide-88
SLIDE 88

Time Complexity Blow Up

  • For 1-time MPC in plain model,

Time(1st Round) β‰ˆ 𝐷 β‹… π‘žπ‘π‘šπ‘§ πœ‡ 1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

β‹― β‹―

slide-89
SLIDE 89

Time Complexity Blow Up

  • For 1-time MPC in plain model,

Time(1st Round) β‰ˆ 𝐷 β‹… π‘žπ‘π‘šπ‘§ πœ‡ 1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

β‹― β‹―

𝐷 πœ‡

slide-90
SLIDE 90

Time Complexity Blow Up

  • For 1-time MPC in plain model,

Time(1st Round) β‰ˆ 𝐷 β‹… π‘žπ‘π‘šπ‘§ πœ‡ 1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

β‹― β‹―

𝐷 πœ‡ 𝐷 πœ‡2

slide-91
SLIDE 91

Time Complexity Blow Up

  • For 1-time MPC in plain model,

Time(1st Round) β‰ˆ 𝐷 β‹… π‘žπ‘π‘šπ‘§ πœ‡ 1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

β‹― β‹―

𝐷 πœ‡ 𝐷 πœ‡2 𝐷 πœ‡3

slide-92
SLIDE 92

Time Complexity Blow Up

  • For 1-time MPC in plain model,

Time(1st Round) β‰ˆ 𝐷 β‹… π‘žπ‘π‘šπ‘§ πœ‡ 1-time MPC 1-time MPC 1-time MPC

1-time MPC 1-time MPC 1-time MPC 1-time MPC

β‹― β‹―

Time(Root node) is exponential in πœ‡

𝐷 πœ‡ 𝐷 πœ‡2 𝐷 πœ‡3

slide-93
SLIDE 93

Necessary Condition for Recursion

1-time MPC

Succinct MPC Succinct MPC

Succinct MPC Succinct MPC Succinct MPC Succinct MPC

β‹― β‹―

slide-94
SLIDE 94

Necessary Condition for Recursion

  • Succinct 1-time MPC:

Time(1st Round) is independent of 𝐷 .

1-time MPC

Succinct MPC Succinct MPC

Succinct MPC Succinct MPC Succinct MPC Succinct MPC

β‹― β‹―

slide-95
SLIDE 95

Necessary Condition for Recursion

  • Succinct 1-time MPC:

Time(1st Round) is independent of 𝐷 .

1-time MPC

Succinct MPC Succinct MPC

Succinct MPC Succinct MPC Succinct MPC Succinct MPC

β‹― β‹―

  • [MW16] satisfies succinctness,

but in CRS model.

slide-96
SLIDE 96

Necessary Condition for Recursion

  • Succinct 1-time MPC:

Time(1st Round) is independent of 𝐷 .

1-time MPC

Succinct MPC Succinct MPC

Succinct MPC Succinct MPC Succinct MPC Succinct MPC

β‹― β‹―

  • [MW16] satisfies succinctness,

but in CRS model.

CRS CRS CRS CRS CRS CRS

Plain Model

slide-97
SLIDE 97
  • In fact succinct 1-time MPC

in preprocessing model suffices.

Necessary Condition for Recursion

  • Succinct 1-time MPC:

Time(1st Round) is independent of 𝐷 .

1-time MPC

Succinct MPC Succinct MPC

Succinct MPC Succinct MPC Succinct MPC Succinct MPC

β‹― β‹―

  • [MW16] satisfies succinctness,

but in CRS model.

CRS CRS CRS CRS CRS CRS

Plain Model

slide-98
SLIDE 98

Thank you!