Gilad Asharov Gilad Asharov parties, each has some private input, - - PowerPoint PPT Presentation

β–Ά
gilad asharov gilad asharov
SMART_READER_LITE
LIVE PREVIEW

Gilad Asharov Gilad Asharov parties, each has some private input, - - PowerPoint PPT Presentation

Dec 23, 2023 217 likes β€’1.28k views

Gilad Asharov Gilad Asharov parties, each has some private input, wish to compute a function on their joint inputs average of salaries, auctions, private database query, private data mining parties, each has some private input, wish

slide-1
SLIDE 1

Gilad Asharov

slide-2
SLIDE 2

Gilad Asharov

slide-3
SLIDE 3

π‘œ parties, each has some private input, wish to compute a function on their joint inputs

– average of salaries, auctions, private database query, private data mining

slide-4
SLIDE 4

π‘œ parties, each has some private input, wish to compute a function on their joint inputs

– average of salaries, auctions, private database query, private data mining

Security should be preserved even when some

  • f the parties are corrupted

– correctness, privacy, independence of inputs and.. fairness

slide-5
SLIDE 5

If the adversary learns the output, then all parties should learn also

– In some sense, parties receive outputs simultaneously

slide-6
SLIDE 6

If the adversary learns the output, then all parties should learn also

– In some sense, parties receive outputs simultaneously

slide-7
SLIDE 7

If the adversary learns the output, then all parties should learn also

– In some sense, parties receive outputs simultaneously

slide-8
SLIDE 8
  • Complete fairness can be achieved in

multiparty with honest majority [GMW87,BGW88,CCD88,RB89,Be91]

  • What about no honest majority?

– Special case: Two party setting?

slide-9
SLIDE 9
  • Beginning of execution – no

knowledge about the outputs

  • End of execution – full

knowledge about it

  • Protocols proceed in rounds
  • The parties cannot exchange

information simultaneously

f(x,y) f(x,y)

slide-10
SLIDE 10
  • Beginning of execution – no

knowledge about the outputs

  • End of execution – full

knowledge about it

  • Protocols proceed in rounds
  • The parties cannot exchange

information simultaneously

  • There must be a point when a

party knows more than the

  • ther

abort

slide-11
SLIDE 11
  • Take a fair protocol
  • Remove the last round
  • > still fair protocol
  • Continue the process..
  • We stay with an empty

protocol

slide-12
SLIDE 12
  • Take a fair protocol
  • Remove the last round
  • > still fair protocol
  • Continue the process..
  • We stay with an empty

protocol

slide-13
SLIDE 13
  • Take a fair protocol
  • Remove the last round
  • > still fair protocol
  • Continue the process..
  • We stay with an empty

protocol

slide-14
SLIDE 14
  • Take a fair protocol
  • Remove the last round
  • > still fair protocol
  • Continue the process..
  • We stay with an empty

protocol

slide-15
SLIDE 15
  • In 1986, Cleve showed that fairness is

impossible in general (two party)

slide-16
SLIDE 16
  • In 1986, Cleve showed that fairness is

impossible in general (two party)

  • The coin-tossing functionality is impossible:

– both parties agree on the same uniform bit – no party can bias the result

slide-17
SLIDE 17
  • In 1986, Cleve showed that fairness is

impossible in general (two party)

  • The coin-tossing functionality is impossible:

– both parties agree on the same uniform bit – no party can bias the result

  • Implies that the boolean XOR

function is also impossible

slide-18
SLIDE 18
  • Since 1986, the accepted belief was that

nothing non-trivial can be computed fairly

slide-19
SLIDE 19
  • Since 1986, the accepted belief was that

nothing non-trivial can be computed fairly

  • Many notions of partial fairness

– Gradual release , Probabilistic fairness, Optimistic exchange, fairness at expectation [BeaverGoldwasser89][GoldwasserLevin90] [BonehNaor2000][Micali98]…

slide-20
SLIDE 20
  • Since 1986, the accepted belief was that

nothing non-trivial can be computed fairly

  • Many notions of partial fairness

– Gradual release , Probabilistic fairness, Optimistic exchange, fairness at expectation [BeaverGoldwasser89][GoldwasserLevin90] [BonehNaor2000][Micali98]…

  • Even two definitions of security – one with

fairness, one without

  • For two decades – no results on complete

fairness

slide-21
SLIDE 21

Gordon, Hazay, Katz and Lindell [STOC08] showed that there exist some non-trivial functions that can be computed with complete fairness!

slide-22
SLIDE 22

Gordon, Hazay, Katz and Lindell [STOC08] showed that there exist some non-trivial functions that can be computed with complete fairness!

slide-23
SLIDE 23

Gordon, Hazay, Katz and Lindell [STOC08] showed that there exist some non-trivial functions that can be computed with complete fairness!

y2 y1 1 x1 1 x2 1 1 x3

slide-24
SLIDE 24
  • A fundamental question:

What functions can and cannot be securely computed with complete fairness?

slide-25
SLIDE 25
  • A fundamental question:

What functions can and cannot be securely computed with complete fairness?

  • Impossibility: Cleve
slide-26
SLIDE 26
  • A fundamental question:

What functions can and cannot be securely computed with complete fairness?

  • Impossibility: Cleve
  • Only few examples of functions that are

possible

slide-27
SLIDE 27
  • A Full Characterization of Functions that

Imply Fair Coin Tossing and Ramifications to Fairness A, Lindell and Rabin [TCC 2013]

  • Towards Characterizing Complete Fairness

in Secure Two-Party Computing A [TCC 2014]

slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30

Set Membership

– X input: 𝑇 βŠ† Ξ© (possible inputs: 2 Ξ© ) – Y input: πœ• ∈ Ξ© (possible inputs: |Ξ©|) – The function 𝑔 𝑇, πœ• = πœ• ∈ 𝑇?

slide-31
SLIDE 31

Set Membership

– X input: 𝑇 βŠ† Ξ© (possible inputs: 2 Ξ© ) – Y input: πœ• ∈ Ξ© (possible inputs: |Ξ©|) – The function 𝑔 𝑇, πœ• = πœ• ∈ 𝑇?

Private Evaluation of a Boolean Function

– X input: 𝑕 ∈ F (𝐺 = {𝑕: Ξ© β†’ 0,1 }) – Y input: 𝑧 ∈ Ξ© – The function 𝑔 𝑕, 𝑧 = 𝑕 𝑧

slide-32
SLIDE 32

Private Matchmaking:

– X holds set of preferences (β€œwhat I am looking for”) – Y holds a profile (β€œwho I am”) – Output: Does Y match X

slide-33
SLIDE 33

Private Matchmaking:

– X holds set of preferences (β€œwhat I am looking for”) – Y holds a profile (β€œwho I am”) – Output: Does Y match X

𝑩 βŠ† π‘ͺ:

– X holds 𝐡 βŠ† Ξ© – Y holds 𝐢 βŠ† Ξ© – Output: 𝐡 βŠ† 𝐢?

slide-34
SLIDE 34

Private Matchmaking:

– X holds set of preferences (β€œwhat I am looking for”) – Y holds a profile (β€œwho I am”) – Output: Does Y match X

𝑩 βŠ† π‘ͺ:

– X holds 𝐡 βŠ† Ξ© – Y holds 𝐢 βŠ† Ξ© – Output: 𝐡 βŠ† 𝐢?

Set Disjointness:

– X holds 𝐡 βŠ† Ξ© – Y holds 𝐢 βŠ† Ξ© – Output: 𝐡 ∩ 𝐢 = βˆ…?

slide-35
SLIDE 35

1 𝟏 𝟏 𝟏 1 𝟏 𝟏 1 𝟏 1 1 𝟐 𝟐 𝟐 1 𝟏 𝟐 1 𝟐 1 1 𝟏 𝟐 𝟐 1 𝟐 𝟐 1 𝟏 1

slide-36
SLIDE 36

1 𝟏 𝟏 𝟏 1 𝟏 𝟏 1 𝟏 1 1 𝟐 𝟐 𝟐 1 𝟏 𝟐 1 𝟐 1 1 𝟏 𝟐 𝟐 1 𝟐 𝟐 1 𝟏 1

Impossible

𝐡 = 𝐢

implies coin-tossing [ALR13]

slide-37
SLIDE 37

1 𝟏 𝟏 𝟏 1 𝟏 𝟏 1 𝟏 1 1 𝟐 𝟐 𝟐 1 𝟏 𝟐 1 𝟐 1 1 𝟏 𝟐 𝟐 1 𝟐 𝟐 1 𝟏 1

Impossible

𝐡 = 𝐢

implies coin-tossing [ALR13]

Possible

𝐡 βŠ† 𝐢

slide-38
SLIDE 38

1 𝟏 𝟏 𝟏 1 𝟏 𝟏 1 𝟏 1 1 𝟐 𝟐 𝟐 1 𝟏 𝟐 1 𝟐 1 1 𝟏 𝟐 𝟐 1 𝟐 𝟐 1 𝟏 1

Impossible

𝐡 = 𝐢

implies coin-tossing [ALR13]

Possible

𝐡 βŠ† 𝐢

Unknown

not coin-tossing not [GHKL08]*

slide-39
SLIDE 39

Asharov, Lindell, Rabin

A Full Characterization of Functions that Imply Fair Coin Tossing and Ramifications to Fairness

slide-40
SLIDE 40

The coin-tossing functionality is impossible: 𝑔 πœ‡, πœ‡ = 𝑉, 𝑉

(𝑉 is the uniform distribution over {0,1}) – both parties agree on the same uniform bit – no party can bias the result

slide-41
SLIDE 41

The coin-tossing functionality is impossible: 𝑔 πœ‡, πœ‡ = 𝑉, 𝑉

(𝑉 is the uniform distribution over {0,1}) – both parties agree on the same uniform bit – no party can bias the result

Which Boolean functions are ruled out by this impossibility? Which functions imply fair coin-tossing?

Question:

slide-42
SLIDE 42

Assume a fair protocol for the XOR function How can we use it to toss a coin?

Question:

slide-43
SLIDE 43

Assume a fair protocol for the XOR function How can we use it to toss a coin? Each party chooses a uniform bit, then XOR them

Question: Answer:

slide-44
SLIDE 44

1 1

π‘ž1 π‘ž2 π‘Ÿ1 π‘Ÿ2

distribution over the inputs of X distribution over the inputs of Y

Pr⁑ [π‘π‘£π‘’π‘žπ‘£π‘’ = 1]=

slide-45
SLIDE 45

1 1

π‘ž1 π‘ž2 π‘Ÿ1 π‘Ÿ2

distribution over the inputs of X distribution over the inputs of Y

Pr⁑ [π‘π‘£π‘’π‘žπ‘£π‘’ = 1]=

1 1 1 2 1 2 = 1 2 1 2

slide-46
SLIDE 46

1 1

π‘ž1 π‘ž2 π‘Ÿ1 π‘Ÿ2

distribution over the inputs of X distribution over the inputs of Y

Pr⁑ [π‘π‘£π‘’π‘žπ‘£π‘’ = 1]=

1 1 1 2 1 2 = 1 2 1 2 π‘Ÿ1 π‘Ÿ2 π‘Ÿ1 π‘Ÿ2 = 1 2

slide-47
SLIDE 47

1 1

π‘ž1 π‘ž2 π‘Ÿ1 π‘Ÿ2

distribution over the inputs of X distribution over the inputs of Y

Pr⁑ [π‘π‘£π‘’π‘žπ‘£π‘’ = 1]=

1 1 1 2 1 2 = 1 2 1 2 π‘Ÿ1 π‘Ÿ2 π‘Ÿ1 π‘Ÿ2 = 1 2 1 1 0 1/2 1/2

slide-48
SLIDE 48

1 1

π‘ž1 π‘ž2 π‘Ÿ1 π‘Ÿ2

distribution over the inputs of X distribution over the inputs of Y

Pr⁑ [π‘π‘£π‘’π‘žπ‘£π‘’ = 1]=

1 1 1 2 1 2 = 1 2 1 2 π‘Ÿ1 π‘Ÿ2 π‘Ÿ1 π‘Ÿ2 = 1 2 1 1 π‘ž1 π‘ž2 1/2 1/2 = 1 2 1/2 1/2 = π‘ž1 π‘ž2

slide-49
SLIDE 49

if there exist probability vectors 𝒒 = π‘ž1, … , π‘žπ‘› , 𝒓 = π‘Ÿ1, … , π‘Ÿβ„“ and ⁑0 < πœ€ < 1 s.t: ⁑𝒒⁑ β‹… 𝑁

𝑔 = πœ€ β‹… πŸβ„“ AND 𝑁 𝑔 β‹… π’“π‘ˆ = πœ€ β‹… πŸπ‘› π‘ˆ

π’ˆ is 𝜺 balanced

slide-50
SLIDE 50

if there exist probability vectors 𝒒 = π‘ž1, … , π‘žπ‘› , 𝒓 = π‘Ÿ1, … , π‘Ÿβ„“ and ⁑0 < πœ€ < 1 s.t: ⁑𝒒⁑ β‹… 𝑁

𝑔 = πœ€ β‹… πŸβ„“ AND 𝑁 𝑔 β‹… π’“π‘ˆ = πœ€ β‹… πŸπ‘› π‘ˆ

π’ˆ is 𝜺 balanced If 𝑔 is πœ€-balanced then it implies fair coin-tossing Theorem

slide-51
SLIDE 51

1 1 1 1 1 1 1 1 1 1 1 1 1

(left-balanced, right-unbalanced)

slide-52
SLIDE 52

1 1 1 1 1 1 1 1 1 1 1 1 1

(left-balanced, right-unbalanced)

1 1 1 1 π‘ž 1 βˆ’ π‘ž = π‘ž 1 βˆ’ π‘ž 1

slide-53
SLIDE 53

if 𝑔 is not πœ€-balanced for any 0 < πœ€ < 1, then it does not imply coin tossing* Theorem

slide-54
SLIDE 54

if 𝑔 is not πœ€-balanced for any 0 < πœ€ < 1, then it does not imply coin tossing* Theorem

  • We show that for any coin-tossing protocol in the 𝑔-hybrid

model, there exists an adversary that can bias the result

slide-55
SLIDE 55

if 𝑔 is not πœ€-balanced for any 0 < πœ€ < 1, then it does not imply coin tossing* Theorem

  • We show that for any coin-tossing protocol in the 𝑔-hybrid

model, there exists an adversary that can bias the result

  • Unlike Cleve – here we do have something simultaneously.

A completely different argument is given

slide-56
SLIDE 56

if 𝑔 is not πœ€-balanced for any 0 < πœ€ < 1, then it does not imply coin tossing* Theorem

  • We show that for any coin-tossing protocol in the 𝑔-hybrid

model, there exists an adversary that can bias the result

  • Unlike Cleve – here we do have something simultaneously.

A completely different argument is given

  • Caveat: the adversary is inefficient
slide-57
SLIDE 57

if 𝑔 is not πœ€-balanced for any 0 < πœ€ < 1, then it does not imply coin tossing* Theorem

  • We show that for any coin-tossing protocol in the 𝑔-hybrid

model, there exists an adversary that can bias the result

  • Unlike Cleve – here we do have something simultaneously.

A completely different argument is given

  • Caveat: the adversary is inefficient
  • However, impossibility holds also when the parties have

OT-oracle (and so commitments, ZK, etc.)

slide-58
SLIDE 58

Asharov

slide-59
SLIDE 59

Gordon, Hazay, Katz and Lindell [STOC08] presented a general protocol and proved that a particular function can be computed using this protocol

slide-60
SLIDE 60

Gordon, Hazay, Katz and Lindell [STOC08] presented a general protocol and proved that a particular function can be computed using this protocol What functions can be computed using this protocol?

Question:

slide-61
SLIDE 61
  • Almost all functions with |X|β‰  𝐙 :

can be computed using the protocol

  • Almost all functions with 𝐘 = |𝐙|:

cannot be computed using the protocol

– If the function has monochromatic input, it may be possible even if π‘Œ = 𝑍

  • Characterization of [GHKL08] is not tight!

– There are functions that are left unknown

slide-62
SLIDE 62
  • Special round π‘—βˆ—
  • Until round π‘—βˆ— - the outputs are random and

uncorrelated (𝑔 𝑦, 𝑧 , 𝑔 𝑦 , 𝑧 )

  • Starting at π‘—βˆ— - the outputs are correct
  • At π‘—βˆ—, Px learns before Py
slide-63
SLIDE 63
  • Special round π‘—βˆ—
  • Until round π‘—βˆ— - the outputs are random and

uncorrelated (𝑔 𝑦, 𝑧 , 𝑔 𝑦 , 𝑧 )

  • Starting at π‘—βˆ— - the outputs are correct
  • At π‘—βˆ—, Px learns before Py
  • Security:

– Py is always the second to receive output

  • Simulation is possible for all functions

– Px is always the first to receive output

  • Simulation is possible only for some functions
slide-64
SLIDE 64

Trusted Party

slide-65
SLIDE 65

Trusted Party 𝑧

slide-66
SLIDE 66

Trusted Party 𝑧

𝑦⁑

slide-67
SLIDE 67

Trusted Party 𝑧

𝑦⁑

𝑔(𝑦, 𝑧)

slide-68
SLIDE 68

Trusted Party 𝑧

𝑦⁑ 𝑔(𝑦, 𝑧)

𝑔(𝑦, 𝑧)

slide-69
SLIDE 69

1/3

Before π‘—βˆ— : 𝑔(𝑦 , 𝑧)

1/3 1/3

(2

3⁑, 2 3)

slide-70
SLIDE 70

Before π‘—βˆ— : 𝑔(𝑦 , 𝑧)

(2

3 + πœ—, 2 3)

slide-71
SLIDE 71

Before π‘—βˆ— : 𝑔(𝑦 , 𝑧)

(2

3 + πœ—, 2 3)

1/3βˆ’Ο΅ 1/3 1/3+Ο΅

slide-72
SLIDE 72

Before π‘—βˆ— : 𝑔(𝑦 , 𝑧)

(2

3 + πœ—, 2 3)

1/3βˆ’Ο΅ 1/3 1/3+Ο΅

slide-73
SLIDE 73

y2 y1 1 x1 1/2 1 x2 1/2 1/2) (1/2, Before π‘—βˆ— : 𝑔(𝑦 , 𝑧)

slide-74
SLIDE 74

y2 y1 1 x1 1/2 1 x2 1/2

1/2) (1/2, 1/2) (1/2+𝝑

Before π‘—βˆ— : 𝑔(𝑦 , 𝑧)

slide-75
SLIDE 75

y2 y1 1 x1 1/2 1/2 1 x2 1/2 1/2+πœ—

1/2) (1/2, 1/2) (1/2+𝝑

Before π‘—βˆ— : 𝑔(𝑦 , 𝑧)

slide-76
SLIDE 76

(1 βˆ’ π‘ž, π‘ž) (1 βˆ’ π‘ž1, 1 βˆ’ π‘ž2)

slide-77
SLIDE 77

(1 βˆ’ π‘ž, π‘ž) (1 βˆ’ π‘ž1, 1 βˆ’ π‘ž2)

slide-78
SLIDE 78

(1 βˆ’ π‘ž, π‘ž) (1 βˆ’ π‘ž1, 1 βˆ’ π‘ž2)

slide-79
SLIDE 79

1) General for multiparty computation: β€œThe power of the ideal adversary”

– Geometric representation

2) Specific for the [GHKL08] protocol: Adding more rounds – less to correct!

slide-80
SLIDE 80

REAL Before π’‹βˆ—: 𝑔(𝑦 , 𝑧) for uniform 𝑦 (1/3,1/3,1/3) β‡’(2/3, 2/3)

𝐹 𝑆 = 5 𝐹 𝑆 = 100

slide-81
SLIDE 81

All points that the simulator needs are inside some β€œball”

  • The center – the output distribution of REAL
  • The radius – a function of number of rounds
slide-82
SLIDE 82

All points that the simulator needs are inside some β€œball”

  • The center – the output distribution of REAL
  • The radius – a function of number of rounds
slide-83
SLIDE 83
  • Let 𝑔: 𝑦1, … , 𝑦ℓ Γ— 𝑧1, … , 𝑧𝑛 β†’ {0,1}
  • Consider the β„“ points π‘Œ1, … , π‘Œβ„“ in ℝ𝑛 (the β€œrows” of the

matrix)

slide-84
SLIDE 84
  • Let 𝑔: 𝑦1, … , 𝑦ℓ Γ— 𝑧1, … , 𝑧𝑛 β†’ {0,1}
  • Consider the β„“ points π‘Œ1, … , π‘Œβ„“ in ℝ𝑛 (the β€œrows” of the

matrix)

If the geometric object defined by β‘β‘π‘Œ1, … , π‘Œβ„“ ∈ ℝ𝑛 is

  • f dimension 𝑛,

Then the function is full-dimensional Definition

slide-85
SLIDE 85

If 𝑔 is of full-dimension, then it can be computed with complete fairness Theorem

slide-86
SLIDE 86

If 𝑔 is of full-dimension, then it can be computed with complete fairness

  • We use the protocol of [GHKL08]

Theorem Proof:

slide-87
SLIDE 87

If 𝑔 is of full-dimension, then it can be computed with complete fairness

  • We use the protocol of [GHKL08]
  • We show that all the points that the simulator needs are

inside a small β€œball”

Theorem Proof:

slide-88
SLIDE 88

If 𝑔 is of full-dimension, then it can be computed with complete fairness

  • We use the protocol of [GHKL08]
  • We show that all the points that the simulator needs are

inside a small β€œball”

  • The ball is embedded inside the geometric object defined by

the function

Theorem Proof:

slide-89
SLIDE 89

y3 y2 y1 1 x1 1 x2 1 x3 1 1 1 x4

slide-90
SLIDE 90
  • In ℝ2 - all points do not lie on a single LINE
  • In ℝ3 - all points do not lie on a single PLANE
  • …
  • In ℝ𝑛 - all points do not lie on a single HYPERPLANE
  • In ℝ2 - 𝑨1, 𝑨2

βˆƒ π‘Ÿ1, π‘Ÿ2, πœ€ ∈ ℝ s.t. π‘Ÿ1𝑨1 + π‘Ÿ2𝑨2 = πœ€?

  • In ℝ3 - (𝑨1, 𝑨2, 𝑨3)

βˆƒ π‘Ÿ1, π‘Ÿ2, π‘Ÿ3, πœ€ ∈ ℝ⁑ s.t. π‘Ÿ1𝑨1 + π‘Ÿ2𝑨2 + π‘Ÿ3𝑨3 = πœ€?

Not Full-Dimensional

slide-91
SLIDE 91
  • Full-dimensional function
  • The function is right-unbalanced:

– For every non-zero 𝒓 ∈ ℝ𝑛, πœ€ ∈ ℝ it holds that: 𝑁

𝑔 β‹… 𝒓 β‰  πœ€ β‹… 𝟐

slide-92
SLIDE 92
  • Full-dimensional function
  • The function is right-unbalanced:

– For every non-zero 𝒓 ∈ ℝ𝑛, πœ€ ∈ ℝ it holds that: 𝑁

𝑔 β‹… 𝒓 β‰  πœ€ β‹… 𝟐

Easy to Check Criterion: No solution 𝒓 for: 𝑁

𝑔 β‹… 𝒓 = 𝟐

Only trivial solution for: 𝑁

𝑔 β‹… 𝒓 = 𝟏

slide-93
SLIDE 93

Balanced with respect to probability vector: IMPOSSIBLE!

slide-94
SLIDE 94

Balanced with respect to probability vector: IMPOSSIBLE!

Unbalanced with respect to arbitrary vectors: FAIR!

slide-95
SLIDE 95

Balanced with respect to probability vector: IMPOSSIBLE!

Unbalanced with respect to probability vector, balanced with respect to arbitrary vectors:

  • If the hyperplanes do not contain the origin:

cannot be computed using [GHKL08]

(with particular simulation strategy)

  • If the hyperplanes contain the origin:

not characterized (sometimes the GHKL protocol is possible)

Unbalanced with respect to arbitrary vectors: FAIR!

slide-96
SLIDE 96

CONCLUSIONS

slide-97
SLIDE 97

Pd: The probability that a 0/1 matrix is singular?

slide-98
SLIDE 98
  • Pd: The probability that a 0/1

matrix is singular?

– Conjecture: (1/2+o(1))d

(roughly the probability to have two rows that are the same)

– Komlos (67): 0.999𝑒 – Tao and Vu [STOC 05]: (3/4+o(1))d – Best known today [Vu and Hood 09]: (1/√2+o(1))d

slide-99
SLIDE 99
  • Pd: The probability that a 0/1

matrix is singular?

– Conjecture: (1/2+o(1))d

(roughly the probability to have two rows that are the same)

– Komlos (67): 0.999𝑒 – Tao and Vu [STOC 05]: (3/4+o(1))d – Best known today [Vu and Hood 09]: (1/√2+o(1))d

slide-100
SLIDE 100
  • Pd: The probability that a 0/1

matrix is singular?

– Conjecture: (1/2+o(1))d

(roughly the probability to have two rows that are the same)

– Komlos (67): 0.999𝑒 – Tao and Vu [STOC 05]: (3/4+o(1))d – Best known today [Vu and Hood 09]: (1/√2+o(1))d

d Pd 1 0.5 5 0.627 10 0.297 15 0.047 20 0.0025 25 0.0000689 30 0.0000015

slide-101
SLIDE 101
  • The 𝑒 + 1 random 0/1-points in ℝ𝑒 defines full-

dimensional geometric object?

  • 1- Pd (tends to 1)
  • 𝑒 points in ℝ𝑒 define hyperplane that passes

through 0,1?

  • 4Pd (tends to 0)
slide-102
SLIDE 102
  • The 𝑒 + 1 random 0/1-points in ℝ𝑒 defines full-

dimensional geometric object?

  • 1- Pd (tends to 1)
  • 𝑒 points in ℝ𝑒 define hyperplane that passes

through 0,1?

  • 4Pd (tends to 0)
  • Almost all functions with |X|β‰  𝑍 :

can be computed with complete fairness

  • Almost all functions with π‘Œ = |𝑍|:

cannot be computed with [GHKL08] framework

slide-103
SLIDE 103
  • 𝒆 Γ— 𝒆 functions with monochromatic

input

–Define hyperplanes that pass through 0 or 1 –Almost always – possible

  • Asymmetric functions

–𝑔 𝑦, 𝑧 = 𝑔

1, 𝑔 2

–If 𝑔

1 or 𝑔 2 are full-dimensional β‡’ possible!

  • Non-binary outputs π’ˆ: 𝒀 Γ— 𝒁 β†’ 𝚻

–General criteria, holds when π‘Œ /|𝑍| > Ξ£ βˆ’ 1

y1 y2 x1 1 x2 1 x3 1 1 x4 2 x5 1 2

slide-104
SLIDE 104
  • The characterization is not complete
  • We have a better understanding of the

β€œpower” of the ideal world adversary

  • We have no real understanding of the β€œpower”
  • f the real-world adversary
  • Open problem:

– Finalize the characterization! – Almost all functions with π‘Œ = 𝑍 are unknown

slide-105
SLIDE 105
  • The characterization is not complete
  • We have a better understanding of the

β€œpower” of the ideal world adversary

  • We have no real understanding of the β€œpower”
  • f the real-world adversary
  • Open problem:

– Finalize the characterization! – Almost all functions with π‘Œ = 𝑍 are unknown

Thank you!