General Purpose Frameworks for Secure Multi-party Computation - - PowerPoint PPT Presentation

▶
general purpose frameworks for secure multi party
SMART_READER_LITE
LIVE PREVIEW

General Purpose Frameworks for Secure Multi-party Computation - - PowerPoint PPT Presentation

Oct 26, 2022 359 likes •887 views

General Purpose Frameworks for Secure Multi-party Computation Marcella Brett Daniel Steve Hemenway Hastings Noble Zdancewic University of Pennsylvania 1 / 26 Secure multi-party computation (MPC) MPC allows a group of mutually

slide-1
SLIDE 1

General Purpose Frameworks for Secure Multi-party Computation

Marcella Hastings Brett Hemenway Daniel Noble Steve Zdancewic University of Pennsylvania

1 / 26

slide-2
SLIDE 2

Secure multi-party computation (MPC)

MPC allows a group of mutually distrustful parties to compute a function on their joint inputs without revealing anything beyond the output.

2 / 26

slide-3
SLIDE 3

Secure multi-party computation (MPC)

MPC allows a group of mutually distrustful parties to compute a function on their joint inputs without revealing anything beyond the output.

Example: Danish sugar beet auction [BCD+08]

Parties: beet farmers, govern- ment buyer, research university Inputs: Beet prices, yields Outputs: Market clearing price

2 / 26

slide-4
SLIDE 4

Beyond Beets: MPC in practice

Blind auction [BCD+08]

3 / 26

slide-5
SLIDE 5

Beyond Beets: MPC in practice

Blind auction [BCD+08] Fraud detection [BJSV16]

3 / 26

slide-6
SLIDE 6

Beyond Beets: MPC in practice

Blind auction [BCD+08] Fraud detection [BJSV16] Parameter computation [BGM17]

3 / 26

slide-7
SLIDE 7

Beyond Beets: MPC in practice

Blind auction [BCD+08] Fraud detection [BJSV16] Parameter computation [BGM17] Financial statistics [BLV17]

3 / 26

slide-8
SLIDE 8

Beyond Beets: MPC in practice

Blind auction [BCD+08] Fraud detection [BJSV16] Parameter computation [BGM17] Financial statistics [BLV17] Government applications Private companies

3 / 26

slide-9
SLIDE 9

Motivating end-to-end frameworks for MPC

Custom one-off solutions are unsustainable

4 / 26

slide-10
SLIDE 10

Motivating end-to-end frameworks for MPC

Custom one-off solutions are unsustainable Protocols assumed impractical until Fairplay [MNPS04]

4 / 26

slide-11
SLIDE 11

Motivating end-to-end frameworks for MPC

Custom one-off solutions are unsustainable Protocols assumed impractical until Fairplay [MNPS04] Performance improvements rapidly advanced state-of-the-art OT extension [IKNP03] Free XOR gates [KS08] Half-gates [ZRE15] AES-NI

4 / 26

slide-12
SLIDE 12

Modern General-Purpose Frameworks

function description compiler runtime Framework function input function

  • utput

5 / 26

slide-13
SLIDE 13

Modern General-Purpose Frameworks

function description compiler runtime Framework function input function

  • utput

Who are frameworks designed for? What types of cryptographic settings do they use? Are they suitable for use in large-scale applications?

5 / 26

slide-14
SLIDE 14

Contributions

General purpose frameworks for secure multi-party computation [HHNZ19]

Survey

Surveyed 9 frameworks and 2 circuit compilers Recorded protocol, feature, implementation details Evaluated usability criteria

6 / 26

slide-15
SLIDE 15

Contributions

General purpose frameworks for secure multi-party computation [HHNZ19]

Survey

Surveyed 9 frameworks and 2 circuit compilers Recorded protocol, feature, implementation details Evaluated usability criteria

Open-source framework repository

Three sample programs in every framework Docker instances with complete build environments Documentation on compilation and execution

github.com/mpc-sok/frameworks

6 / 26

slide-16
SLIDE 16

Findings

Most frameworks are in good shape!

Diverse set of threat models and protocols Expressive high-level languages Accessible, open-source, and compilable

7 / 26

slide-17
SLIDE 17

Findings

Most frameworks are in good shape!

Diverse set of threat models and protocols Expressive high-level languages Accessible, open-source, and compilable

Room for improvement

Engineering limitations Barriers to usability

7 / 26

slide-18
SLIDE 18

Frameworks and protocol families

EMP-toolkit Obliv-C ObliVM TinyGarble ABY SCALE-MAMBA Sharemind PICCO Wysteria G a r b l e d c i r c u i t M u l t i

  • p

a r t y c i r c u i t b a s e d H y b r i d

8 / 26

slide-19
SLIDE 19

Frameworks and protocol families

EMP-toolkit Obliv-C ObliVM TinyGarble ABY SCALE-MAMBA Sharemind PICCO Wysteria G a r b l e d c i r c u i t M u l t i

  • p

a r t y c i r c u i t b a s e d H y b r i d

8 / 26

slide-20
SLIDE 20

Garbled circuit protocols

Introduced by [Yao82, Yao86]

garble evaluate function

  • utput

runtime Functions represented as Boolean circuits Typically semi-honest, 2-party Constant-round communication, volume ∝ circuit size

9 / 26

slide-21
SLIDE 21

Frameworks and protocol families

EMP-toolkit Obliv-C ObliVM TinyGarble ABY SCALE-MAMBA Sharemind PICCO Wysteria G a r b l e d c i r c u i t M u l t i

  • p

a r t y c i r c u i t b a s e d H y b r i d

10 / 26

slide-22
SLIDE 22

Multi-party circuit-based protocols

Introduced by [GMW87, BGW88, CCD88]

. . . . . . . . . Functions represented as Boolean or arithmetic circuits Data represented as linear secret shares Various threat models and protocol types (information-theoretic or cryptographic) Rounds, volume of communication ∝ multiplication gates

11 / 26

slide-23
SLIDE 23

Frameworks and protocol families

EMP-toolkit Obliv-C ObliVM TinyGarble ABY SCALE-MAMBA Sharemind PICCO Wysteria G a r b l e d c i r c u i t M u l t i

  • p

a r t y c i r c u i t b a s e d H y b r i d

12 / 26

slide-24
SLIDE 24

Frameworks and protocol families

EMP-toolkit Obliv-C ObliVM TinyGarble ABY SCALE-MAMBA Sharemind PICCO Wysteria G a r b l e d c i r c u i t M u l t i

  • p

a r t y c i r c u i t b a s e d H y b r i d

12 / 26

slide-25
SLIDE 25

Hybrid protocols

Integrates optimized subprotocols for common functions Bitwise operators in arithmetic settings Matrix operations Seamless front-end experience (no explicit protocol selection) Currently: One-to-one mapping from operations to protocols

slide-26
SLIDE 26

Hybrid protocols

Integrates optimized subprotocols for common functions Bitwise operators in arithmetic settings Matrix operations Seamless front-end experience (no explicit protocol selection) Currently: One-to-one mapping from operations to protocols

13 / 26

slide-27
SLIDE 27

Frameworks and protocol families

EMP-toolkit Obliv-C ObliVM TinyGarble ABY SCALE-MAMBA Sharemind PICCO Wysteria G a r b l e d c i r c u i t M u l t i

  • p

a r t y c i r c u i t b a s e d H y b r i d

14 / 26

slide-28
SLIDE 28

Frameworks and protocol families (2019)

EMP-toolkit Obliv-C ObliVM TinyGarble ABY HyCC ABY3 SCALE-MAMBA Sharemind PICCO EzPC JIFF MP- SPDZ FRESCO Wysteria G a r b l e d c i r c u i t M u l t i

  • p

a r t y c i r c u i t b a s e d H y b r i d

14 / 26

slide-29
SLIDE 29

Design decisions

Architecture: system structure and data representation Circuit model: representing data-independent paradigm Language accessibility: cryptographic abstraction level

15 / 26

slide-30
SLIDE 30

Design decisions: Data-independent construction

Should designers reveal “non-traditional” performance characteristics?

Circuits are a data-independent representation. Branching programs are flattened in this model. Non-expert users might not recognize this performance disparity.

16 / 26

slide-31
SLIDE 31

Data independence: Private conditionals

Should branching programs reveal atypical performance?

Obliv-C: traditional paradigm

  • bliv

int r e s u l t ;

  • bliv

i f ( a >= b) { r e s u l t = a ∗ a ; } else { r e s u l t = b ; }

17 / 26

slide-32
SLIDE 32

Data independence: Private conditionals

Should branching programs reveal atypical performance?

Obliv-C: traditional paradigm

  • bliv

int r e s u l t ;

  • bliv

i f ( a >= b) { r e s u l t = a ∗ a ; } else { r e s u l t = b ; }

EMP-toolkit: explicit branch selection

Bit a b i g g e r = a . geq (b ) ; Integer r e s u l t = b . s e l e c t ( a bigger , a ∗ a ) ;

17 / 26

slide-33
SLIDE 33

Data independence: Private conditionals

Should branching programs reveal atypical performance?

Obliv-C: traditional paradigm

  • bliv

int r e s u l t ;

  • bliv

i f ( a >= b) { r e s u l t = a ∗ a ; } else { r e s u l t = b ; }

EMP-toolkit: explicit branch selection

Bit a b i g g e r = a . geq (b ) ; Integer r e s u l t = b . s e l e c t ( a bigger , a ∗ a ) ;

Recommendation

Depends on your users, but data independence is a good paradigm

17 / 26

slide-34
SLIDE 34

Design decisions: Cryptographic abstraction level

Should the user have control over the underlying cryptographic representation?

Frigate: standard (C-style) abstraction

int r e s u l t = 0; for ( int i =0; i <LEN ; i++) { r e s u l t = r e s u l t + (A. data [ i ] ∗ B. data [ i ] ) ; }

18 / 26

slide-35
SLIDE 35

Design decisions: Cryptographic abstraction level

Should the user have control over the underlying cryptographic representation?

Frigate: standard (C-style) abstraction

int r e s u l t = 0; for ( int i =0; i <LEN ; i++) { r e s u l t = r e s u l t + (A. data [ i ] ∗ B. data [ i ] ) ; }

PICCO: custom primitive, high level abstraction

int r e s u l t = A @ B;

18 / 26

slide-36
SLIDE 36

Design decisions: Cryptographic abstraction level

Should the user have control over the underlying cryptographic representation?

ABY: Low-level access

share ∗A, ∗B; A = c i r c − >PutMULGate(A, B) ; A = c i r c − >P u t S p l i t t e r G a t e (A) ; for ( u i n t 3 2 t i = 1; i < LEN ; i++) { A− >s e t w i r e i d ( 0 , c i r c − >PutADDGate(A− >g e t w i r e i d (0) , A− >g e t w i r e i d ( i ) ) ) ; } A− >s e t b i t l e n g t h ( 1 ) ; share ∗ r e s u l t = c i r c − >PutOUTGate(A, ALL ) ;

19 / 26

slide-37
SLIDE 37

Software engineering

Complicated, non-trivial build systems

Set up certificate authority or PKI Compile specific OpenSSL version from source No dependency lists, manual search for compile errors Estimated time: 1-2 weeks per framework

20 / 26

slide-38
SLIDE 38

Software engineering

Complicated, non-trivial build systems

Set up certificate authority or PKI Compile specific OpenSSL version from source No dependency lists, manual search for compile errors Estimated time: 1-2 weeks per framework

Significant software projects

Cryptographic protocols Distributed communication Interfacing with other systems

20 / 26

slide-39
SLIDE 39

Documentation

Language documentation: How do I write secure code? Code samples: What does a working example look like? Code documentation: How does this example work? Online support: Where can I ask questions? Open-source: Can I run this without complex licensing?

Half the frameworks have no more than 3 of these

21 / 26

slide-40
SLIDE 40

Limited language documentation is frustrating

CBMC-GC: int mpc main ( int a l i c e , int bob ) { return a l i c e ∗ bob ; } $ make [...] Uncaught exception: Unknown literal: 33. Did you forget to return a value or assign a value to a OUTPUT variable?

22 / 26

slide-41
SLIDE 41

Limited language documentation is frustrating

CBMC-GC: Arguments must be called INPUT <var> int mpc main ( int INPUT alice , int INPUT bob ) { return INPUT alice ∗ INPUT bob ; } $ make [. . . ] Gates: 5648 with 1986 Non-XOR and 0 LUTs Depth: 151 with 32 Non-XOR

22 / 26

slide-42
SLIDE 42

Limited language documentation is frustrating

CBMC-GC: Arguments must be called INPUT <var> ObliVM: int main ( int a l i c e , int bob ){ secure int r e s u l t = a l i c e ∗ bob ; return r e s u l t ; } $ ./run-compiler 12345 multiply.lcc [ERROR] Error: Parsing Error Encountered ” ”alice” ”alice ”” at line 3, column 21. Was expecting one of: IDENTIFIER ... ”[” ... ”@” ... ”¡” ...

22 / 26

slide-43
SLIDE 43

Limited language documentation is frustrating

CBMC-GC: Arguments must be called INPUT <var> ObliVM: alice and bob are reserved keywords int main ( int aaaaa , int bbb ){ secure int r e s u l t = aaaaa ∗ bbb ; return r e s u l t ; } $ ./run-compiler 12345 multiply.lcc [INFO] The program type checks [INFO] Compiling mult3.lcc succeeds [INFO] Compilation finishes successfully.

22 / 26

slide-44
SLIDE 44

Limited language documentation is frustrating

CBMC-GC: Arguments must be called INPUT <var> ObliVM: alice and bob are reserved keywords Wysteria:

l e t r i c h e r = \x : ps . \w:W x nat . l e t b @ sec ( x ) = wfold x (w, 0 , \accum : nat . \p : ps . \n : nat . i f accum > n then accum else n ) in b l e t a l l = { ! Alice , ! Bob } in l e t w = ( wire ! A l i c e :10) ++ ( wire ! Bob :100) in r i c h e r a l l w

$ wysteria –i-am Alice –gmw-port 9000 examples/tutorial.wy File examples/fakemill.wy, line 1, character 16: syntax error at ‘:’

22 / 26

slide-45
SLIDE 45

Limited language documentation is frustrating

CBMC-GC: Arguments must be called INPUT <var> ObliVM: alice and bob are reserved keywords Wysteria: Language docs don’t account for parser limitations

l e t r i c h e r = \ ( x : ps { true }) . \ (w:W x nat ) . l e t tmp @ par ( x ) = l e t b @ sec ( x ) = l e t r e s u l t = wfold x [w ; 0 ; \ ( accum : nat ) . \ (p : ps { true }) . \ (n : nat ) . i f accum > n then accum else n ] in r e s u l t in b in wire x : tmp in l e t a l l = { ! Alice , ! Bob } in l e t w = ( wire ! A l i c e :10) ++ ( wire ! Bob :100) in r i c h e r a l l w

$ wysteria –i-am Alice –gmw-port 9000 examples/tutorial.wy done with type checking the program

22 / 26

slide-46
SLIDE 46

Limited language documentation is frustrating

CBMC-GC: Arguments must be called INPUT <var> ObliVM: alice and bob are reserved keywords Wysteria: Language docs don’t account for parser limitations EMP-toolkit: ∼1 comment per 600 lines of code

22 / 26

slide-47
SLIDE 47

Documentation appreciation and recommendations

Frameworks with excellent documentation

ABY: 35-page language guide; only slightly out-of-date SCALE-MAMBA: 100+ pages of documentation Sharemind: Auto-generated language guide online

23 / 26

slide-48
SLIDE 48

Documentation appreciation and recommendations

Frameworks with excellent documentation

ABY: 35-page language guide; only slightly out-of-date SCALE-MAMBA: 100+ pages of documentation Sharemind: Auto-generated language guide online

Two recommendations for maintainers

Multiple types of documentation drastically increase usability Online resources are sustainable and reduce workload Produces a living FAQ Allows users to interact

23 / 26

slide-49
SLIDE 49

Good news for usability

Documentation issues aren’t fundamental

IARPA HECTOR includes usability criteria

Recent frameworks focus on usability!∗

“JIFF is built to be highly flexible with a focus on usability [. . . ] designed so that developers need not be familiar with MPC techniques or know the details of cryptographic protocols in order to build secure applications.” HyCC makes “highly efficient hybrid MPC [. . . ] accessible for developers without cryptographic background.”

∗Claims made by authors may not be verified by the speaker. 24 / 26

slide-50
SLIDE 50

Future directions in MPC frameworks

Continued support for multiple settings

Extend frameworks with different threat models and protocols

Better integration of work in other disciplines

Heavy-duty circuit compilers (TinyGarble) Formal guarantees about front-ends (Wysteria, ObliVM)

Maintaining the repository

I’m continuing to add modern frameworks We accept pull requests!

25 / 26

slide-51
SLIDE 51

General Purpose Frameworks for Secure Multi-party Computation

Marcella Hastings Brett Hemenway Daniel Noble Steve Zdancewic University of Pennsylvania

github.com/mpc-sok/frameworks

26 / 26