Hashing Garbled Circuits for Free Xiong Fan, Chaya Ganesh and - - PowerPoint PPT Presentation

▶
hashing garbled circuits for free
SMART_READER_LITE
LIVE PREVIEW

Hashing Garbled Circuits for Free Xiong Fan, Chaya Ganesh and - - PowerPoint PPT Presentation

Dec 07, 2022 104 likes •2.01k views

Hashing Garbled Circuits for Free Xiong Fan, Chaya Ganesh and Vladimir Kolesnikov Motivation Garbled circuits (GC) main technique for secure computation Motivation Garbled circuits (GC) main technique for secure computation Primitive in

slide-1
SLIDE 1

Hashing Garbled Circuits for Free

Xiong Fan, Chaya Ganesh and Vladimir Kolesnikov

slide-2
SLIDE 2

Motivation

Garbled circuits (GC) – main technique for secure computation

slide-3
SLIDE 3

Motivation

Garbled circuits (GC) – main technique for secure computation Primitive in its own right

slide-4
SLIDE 4

Motivation

Garbled circuits (GC) – main technique for secure computation Primitive in its own right Hashing Garbled circuits

slide-5
SLIDE 5

Motivation

Garbled circuits (GC) – main technique for secure computation Primitive in its own right Hashing Garbled circuits

Cut-and-choose for GC-based 2PC

slide-6
SLIDE 6

Motivation

Garbled circuits (GC) – main technique for secure computation Primitive in its own right Hashing Garbled circuits

Cut-and-choose for GC-based 2PC Private certified functions

slide-7
SLIDE 7

Motivation

Garbled circuits (GC) – main technique for secure computation Primitive in its own right Hashing Garbled circuits

Cut-and-choose for GC-based 2PC Private certified functions Encrypted database – Blind seer

slide-8
SLIDE 8

Motivation

Natural way – Generate GC, then hash

slide-9
SLIDE 9

Motivation

Natural way – Generate GC, then hash GC = Garble(C), h = SHA(GC)

slide-10
SLIDE 10

Motivation

Natural way – Generate GC, then hash GC = Garble(C), h = SHA(GC) Relative cost of fixed-key cipher garbling and hashing

slide-11
SLIDE 11

Motivation

Natural way – Generate GC, then hash GC = Garble(C), h = SHA(GC) Relative cost of fixed-key cipher garbling and hashing Fast hardware AES implementations, fast garbling, SHA bottleneck

slide-12
SLIDE 12

Motivation

Hashing GC costs up to 6× or more of GC generation

slide-13
SLIDE 13

Motivation

Hashing GC costs up to 6× or more of GC generation Free hash – hashing GC at no additional cost during GC generation

slide-14
SLIDE 14

Motivation

Hashing GC costs up to 6× or more of GC generation Free hash – hashing GC at no additional cost during GC generation Eliminating GC hashing cost significantly improves performance in GC applications

slide-15
SLIDE 15

Private policy credentials

Attribute-based credential

slide-16
SLIDE 16

Private policy credentials

Attribute-based credential Prover’s input satisfies a certain policy

slide-17
SLIDE 17

Private policy credentials

Attribute-based credential Prover’s input satisfies a certain policy Verifier’s policy is private

slide-18
SLIDE 18

Private policy credentials

Attribute-based credential Prover’s input satisfies a certain policy Verifier’s policy is private Cut-and-choose approach reveals the policy function

slide-19
SLIDE 19

Private policy credentials

Attribute-based credential Prover’s input satisfies a certain policy Verifier’s policy is private Cut-and-choose approach reveals the policy function Certificate Authority (CA) setting – CA certifies the policy function

slide-20
SLIDE 20
slide-21
SLIDE 21

Certificate Authority (sk, vk) Verifier Prover

slide-22
SLIDE 22

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn

slide-23
SLIDE 23

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri )

slide-24
SLIDE 24

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) Private policy function

slide-25
SLIDE 25

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) Private policy function

Randomness generated using si as seed

slide-26
SLIDE 26

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) hi = H ( GCi )

slide-27
SLIDE 27

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) hi = H ( GCi )

i = Sign( hi || di, sk)

slide-28
SLIDE 28

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) hi = H ( GCi )

i = Sign( hi || di, sk)

( si , i )

slide-29
SLIDE 29

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) hi = H ( GCi )

i = Sign( hi || di, sk)

( si , i ) GCi , di = Garble( f ; Ri )

slide-30
SLIDE 30

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) hi = H ( GCi )

i = Sign( hi || di, sk)

( si , i ) ( GCi , di , i ) GCi , di = Garble( f ; Ri )

slide-31
SLIDE 31

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) hi = H ( GCi )

i = Sign( hi || di, sk)

( si , i ) hi = H ( GCi ) GCi , di = Garble( f ; Ri ) ( GCi , di , i )

slide-32
SLIDE 32

Certificate Authority (sk, vk) Verifier Prover

s1, s2, …. , sn GCi , di = Garble( f ; Ri ) hi = H ( GCi )

i = Sign( hi || di, sk)

( si , i ) hi = H ( GCi ) If Verify ( hi || di , i , vk) ≠ 1,

abort

GCi , di = Garble( f ; Ri ) ( GCi , di , i )

slide-33
SLIDE 33

Hashing in cut-and-choose

Send hash of GCs in cut-and-choose protocols (GMS’08)

slide-34
SLIDE 34

Hashing in cut-and-choose

Send hash of GCs in cut-and-choose protocols (GMS’08) P1 uses a seed si to construct GCi

slide-35
SLIDE 35

Hashing in cut-and-choose

Send hash of GCs in cut-and-choose protocols (GMS’08) P1 uses a seed si to construct GCi Sends h1, · · · hn, hi = H(GCi)

slide-36
SLIDE 36

Hashing in cut-and-choose

Send hash of GCs in cut-and-choose protocols (GMS’08) P1 uses a seed si to construct GCi Sends h1, · · · hn, hi = H(GCi) If GCi is a check circuit, reveal si

slide-37
SLIDE 37

Hashing in cut-and-choose

Send hash of GCs in cut-and-choose protocols (GMS’08) P1 uses a seed si to construct GCi Sends h1, · · · hn, hi = H(GCi) If GCi is a check circuit, reveal si P2 reconstructs GCi from si and verifies hi for check circuit

slide-38
SLIDE 38

Hashing in cut-and-choose

Send hash of GCs in cut-and-choose protocols (GMS’08) P1 uses a seed si to construct GCi Sends h1, · · · hn, hi = H(GCi) If GCi is a check circuit, reveal si P2 reconstructs GCi from si and verifies hi for check circuit Using a CR hash trades off computation for communication

slide-39
SLIDE 39

Hashing in cut-and-choose

Send hash of GCs in cut-and-choose protocols (GMS’08) P1 uses a seed si to construct GCi Sends h1, · · · hn, hi = H(GCi) If GCi is a check circuit, reveal si P2 reconstructs GCi from si and verifies hi for check circuit Using a CR hash trades off computation for communication Can free hash be used instead?

slide-40
SLIDE 40

Summary of results

Definition of GC hash security

slide-41
SLIDE 41

Summary of results

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15]

slide-42
SLIDE 42

Summary of results

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation

slide-43
SLIDE 43

Summary of results

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-44
SLIDE 44

Garbling scheme

Tuple of algorithms (Garble, Encode, Eval, Decode) Garble(C) = ( ˆ C, e, d) Encode(x, e) = ˆ x Eval( ˆ C, ˆ x) = ˆ z Decode(ˆ z, d) = z Security properties:

Correctness: z = C(x)

slide-45
SLIDE 45

Garbling scheme

Tuple of algorithms (Garble, Encode, Eval, Decode) Garble(C) = ( ˆ C, e, d) Encode(x, e) = ˆ x Eval( ˆ C, ˆ x) = ˆ z Decode(ˆ z, d) = z Security properties:

Correctness: z = C(x) Privacy: ( ˆ C, ˆ x, d) reveals nothing beyond C(x)

slide-46
SLIDE 46

Garbling scheme

Tuple of algorithms (Garble, Encode, Eval, Decode) Garble(C) = ( ˆ C, e, d) Encode(x, e) = ˆ x Eval( ˆ C, ˆ x) = ˆ z Decode(ˆ z, d) = z Security properties:

Correctness: z = C(x) Privacy: ( ˆ C, ˆ x, d) reveals nothing beyond C(x) Authenticity: given ( ˆ C, ˆ x), hard to find z′ such that decode(z′, d) ∈ {C(x), ⊥}

slide-47
SLIDE 47

Garbling scheme

Tuple of algorithms (Garble, Encode, Eval, Decode) Garble(C) = ( ˆ C, e, d) Encode(x, e) = ˆ x Eval( ˆ C, ˆ x) = ˆ z Decode(ˆ z, d) = z Security properties:

Correctness: z = C(x) Privacy: ( ˆ C, ˆ x, d) reveals nothing beyond C(x) Authenticity: given ( ˆ C, ˆ x), hard to find z′ such that decode(z′, d) ∈ {C(x), ⊥} Verifiability: Additional algorithm Ve, Ve(C, ˆ C, e, d) ∈ {0, 1}

slide-48
SLIDE 48

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-49
SLIDE 49

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-50
SLIDE 50

GC hash definition

Take advantage of the input to hash being a Garbled Circuit

slide-51
SLIDE 51

GC hash definition

Take advantage of the input to hash being a Garbled Circuit GC hash definition weaker than standard collision resistance

slide-52
SLIDE 52

GC hash definition

Take advantage of the input to hash being a Garbled Circuit GC hash definition weaker than standard collision resistance Given a correctly generated garbled circuit and hash (GC, h)

slide-53
SLIDE 53

GC hash definition

Take advantage of the input to hash being a Garbled Circuit GC hash definition weaker than standard collision resistance Given a correctly generated garbled circuit and hash (GC, h)

If A finds GC such that H( GC) = H(GC)

slide-54
SLIDE 54

GC hash definition

Take advantage of the input to hash being a Garbled Circuit GC hash definition weaker than standard collision resistance Given a correctly generated garbled circuit and hash (GC, h)

If A finds GC such that H( GC) = H(GC) Then, w.h.p, the garbled circuit property of GC is broken

slide-55
SLIDE 55

GC hash definition

Take advantage of the input to hash being a Garbled Circuit GC hash definition weaker than standard collision resistance Given a correctly generated garbled circuit and hash (GC, h)

If A finds GC such that H( GC) = H(GC) Then, w.h.p, the garbled circuit property of GC is broken

  • GC will fail to evaluate
slide-56
SLIDE 56

C

slide-57
SLIDE 57

GC, GC, e, e, d, h C

slide-58
SLIDE 58

H(GC) = H(GC) = h C GC, GC, e, e, d, h

slide-59
SLIDE 59

H(GC) = H(GC) = h Ve(C, GC, d, e ) = accept C GC, GC, e, e, d, h

slide-60
SLIDE 60

GC, GC, e, e, d, h C De( Eval( GC, En( e, x), d) ) = 丄 for all x , w.h.p H(GC) = H(GC) = h Ve(C, GC, d, e ) = accept GC, GC, e, e, d, h

slide-61
SLIDE 61

C De( Eval( GC, En( e, x), d) ) = 丄 for all x , w.h.p H(GC) = H(GC) = h Ve(C, GC, d, e ) = accept GC, GC, e, e, d, h

slide-62
SLIDE 62

C De( Eval( GC, En( e, x), d) ) = 丄 for all x , w.h.p

Same decoding information d

H(GC) = H(GC) = h Ve(C, GC, d, e ) = accept GC, GC, e, e, d, h

slide-63
SLIDE 63

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-64
SLIDE 64

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-65
SLIDE 65

GC hash construction

Intertwine hash generation and verification with GC generation and evaluation

slide-66
SLIDE 66

GC hash construction

Intertwine hash generation and verification with GC generation and evaluation Attempt 1: H(GC) = ⊕iGRi

slide-67
SLIDE 67

a b c d e

slide-68
SLIDE 68

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

slide-69
SLIDE 69

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C1 ) GT1

slide-70
SLIDE 70

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C1 ) E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 ) GT1 GT2

slide-71
SLIDE 71

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C1 ) E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

GC = (GT1, GT2)

GT1 GT2

slide-72
SLIDE 72

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C1 ) E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

⊕

h =

GC = (GT1, GT2)

GT1 GT2

slide-73
SLIDE 73

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C1 ) E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

⊕

h =

GC = (GT1, GT2) H(GC) = h

GT1 GT2

slide-74
SLIDE 74

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h

GT1 GT2 E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-75
SLIDE 75

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2)

GT1 GT2 E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-76
SLIDE 76

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

GT1 GT2 E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-77
SLIDE 77

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

GT1 GT2 E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-78
SLIDE 78

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

Inactive row

GT1 GT2 E C0, D0 ( E0 ) E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-79
SLIDE 79

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

GT1 GT2 E C0, D0( E0) ⊕ Δ E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-80
SLIDE 80

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ ⊕ Δ

GT1 GT2 E C0, D0( E0) ⊕ Δ E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-81
SLIDE 81

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

E A0, B0 ( C0 ) E A0, B1 ( C0 ) E A1, B0 ( C0 ) E A1, B1 ( C0 )

⊕

h =

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ✔

GT1 GT2 E C0, D0( E0) ⊕ Δ E C0, D1 ( E1 ) E C1, D0 ( E1 ) E C1, D1 ( E1 )

slide-82
SLIDE 82

GC hash construction

Make each gate’s output wire label depend on all entries of GT

slide-83
SLIDE 83

GC hash construction

Make each gate’s output wire label depend on all entries of GT XOR hash correction involves modifying an active GT entry

slide-84
SLIDE 84

GC hash construction

Make each gate’s output wire label depend on all entries of GT XOR hash correction involves modifying an active GT entry This affects the computed output wire label of the gate

slide-85
SLIDE 85

GC hash construction

Make each gate’s output wire label depend on all entries of GT XOR hash correction involves modifying an active GT entry This affects the computed output wire label of the gate Does this suffice?

slide-86
SLIDE 86

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

slide-87
SLIDE 87

A0, A1 B0, B1 D0, D1 tC0, tC1 tE0, tE1 C0, C1 E0, E1

slide-88
SLIDE 88

A0, A1 B0, B1 D0, D1 tC0, tC1 tE0, tE1 C0, C1 E0, E1

Temporary wire labels

slide-89
SLIDE 89

A0, A1 B0, B1 tC0, tC1 D0, D1 tE0, tE1

E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 ) GT1 GT2

C0, C1 E0, E1

slide-90
SLIDE 90

A0, A1 B0, B1 tC0, tC1 D0, D1 tE0, tE1

GT1 GT2

C0, C1 E0, E1

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

slide-91
SLIDE 91

A0, A1 B0, B1 D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h

slide-92
SLIDE 92

A0, A1 B0, B1 D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

slide-93
SLIDE 93

A0, A1 B0, B1 D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

Fixes Δ for h But tC0 ⊕ GT1 = Cb ?

slide-94
SLIDE 94

A0, A1 B0, B1 D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

slide-95
SLIDE 95

D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

A0, A1 B0, B1

slide-96
SLIDE 96

D0, D1

⊕

h =

GT1 GT2

E A0, B0 ( tC0 ) ⊕ Δ

E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ

A0, A1 B0, B1

slide-97
SLIDE 97

D0, D1

⊕

h =

GT1 GT2

E A0, B0 ( tC0 ) ⊕ Δ

E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ⊕ Δ⊕ Δ

A0, A1 B0, B1

slide-98
SLIDE 98

D0, D1

⊕

h =

GT1 GT2

E A0, B0 ( tC0 ) ⊕ Δ

E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ✔

A0, A1 B0, B1

slide-99
SLIDE 99

D0, D1

⊕

h =

GT1 GT2

E A0, B0 ( tC0 ) ⊕ Δ

E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ✔ tC0 ⊕ GT1 = C0

A0, A1 B0, B1

slide-100
SLIDE 100

D0, D1

⊕

h =

GT1 GT2

E A0, B0 ( tC0 ) ⊕ Δ

E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC0 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

Cb = tCb ⊕ GT1 Eb = tEb ⊕ GT2

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h ĜC = (ĜT1, GT2) H(ĜC) = h ✔ tC0 ⊕ GT1 = C0 ✔

A0, A1 B0, B1

slide-101
SLIDE 101

GC hash construction

A modifies a GT entry, and corrects it within the same table

slide-102
SLIDE 102

GC hash construction

A modifies a GT entry, and corrects it within the same table Works since the “fix” for broken hash also fixes the translation from temporary to real wire label

slide-103
SLIDE 103

GC hash construction

A modifies a GT entry, and corrects it within the same table Works since the “fix” for broken hash also fixes the translation from temporary to real wire label Use GT rows for computing wire label and hash in different ways

slide-104
SLIDE 104

GC hash construction

A modifies a GT entry, and corrects it within the same table Works since the “fix” for broken hash also fixes the translation from temporary to real wire label Use GT rows for computing wire label and hash in different ways The “fix” for hash will no longer keep the wire label valid

slide-105
SLIDE 105

A0, A1 B0, B1 C0, C1 D0, D1 E0, E1

slide-106
SLIDE 106

A0, A1 B0, B1 D0, D1 tC0, tC1 tE0, tE1 C0, C1 E0, E1

slide-107
SLIDE 107

A0, A1 B0, B1 D0, D1 tC0, tC1 tE0, tE1 C0, C1 E0, E1

Temporary wire labels

slide-108
SLIDE 108

A0, A1 B0, B1 tC0, tC1 D0, D1 tE0, tE1

E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 ) GT1 GT2

C0, C1 E0, E1

slide-109
SLIDE 109

A0, A1 B0, B1 tC0, tC1 D0, D1 tE0, tE1

E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 ) GT1 GT2

C0, C1 E0, E1

Cb = tCb ⊕ f (GT1) Eb = tEb ⊕ f (GT2)

slide-110
SLIDE 110

A0, A1 B0, B1 D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h = GT1⊕GT2 Cb = tCb ⊕ f (GT1) Eb = tEb ⊕ f (GT2)

slide-111
SLIDE 111

A0, A1 B0, B1 D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h = GT1⊕GT2 R1 R2 R3 R4 Cb = tCb ⊕ f (GT1) Eb = tEb ⊕ f (GT2)

slide-112
SLIDE 112

A0, A1 B0, B1 D0, D1

⊕

h =

GT1 GT2 E A0, B0 ( tC0 ) E A0, B1 ( tC0 ) E A1, B0 ( tC0 ) E A1, B1 ( tC1 ) E C0, D0 ( tE0 ) E C0, D1 ( tE1 ) E C1, D0 ( tE1 ) E C1, D1 ( tE1 )

tC0, tC1 tE0, tE1 C0, C1 E0, E1

GC = (GT1, GT2) H(GC) = h = GT1⊕GT2 f (GT) = ⊕ Ri

<< i

R1 R2 R3 R4 Cb = tCb ⊕ f (GT1) Eb = tEb ⊕ f (GT2)

slide-113
SLIDE 113

GC hash construction

Use GT rows as XOR pads in a different manner for computing the GC hash and for offsetting the wire values

slide-114
SLIDE 114

GC hash construction

Use GT rows as XOR pads in a different manner for computing the GC hash and for offsetting the wire values Fix for the hash will not simultaneously keep the wire label valid, w.h.p.

slide-115
SLIDE 115

GC hash construction

Use GT rows as XOR pads in a different manner for computing the GC hash and for offsetting the wire values Fix for the hash will not simultaneously keep the wire label valid, w.h.p. GC = ˆ GC, H(GC) = H( ˆ GC), evaluation of ˆ GC will fail

slide-116
SLIDE 116

GC hash construction

Bit shifting – fast and easy to implement

slide-117
SLIDE 117

GC hash construction

Bit shifting – fast and easy to implement In general, functions fi such that, if

4

  • i=1

Ri =

4

  • i=1
  • Ri

for Ri = Ri Then, w.h.p.,

4

  • i=1

fi(Ri) =

4

  • i=1

fi( Ri)

slide-118
SLIDE 118

GC hash construction

Bit shifting – fast and easy to implement In general, functions fi such that, if

4

  • i=1

Ri =

4

  • i=1
  • Ri

for Ri = Ri Then, w.h.p.,

4

  • i=1

fi(Ri) =

4

  • i=1

fi( Ri) (i.e. if GC is changed s.t. XOR of GT rows is the same, then w.h.p. XOR of f(GT) will change)

slide-119
SLIDE 119

Assumptions

Instantiate key derivation functions

slide-120
SLIDE 120

Assumptions

Instantiate key derivation functions H(X, i) = π(K) ⊕ K, K = 2x ⊕ i (π an ideal cipher, instantiated with 128-bit AES with randomly chosen key)

slide-121
SLIDE 121

Assumptions

Instantiate key derivation functions H(X, i) = π(K) ⊕ K, K = 2x ⊕ i (π an ideal cipher, instantiated with 128-bit AES with randomly chosen key) Davies-Meyer meets the guarantees of the random permutation model

slide-122
SLIDE 122

Assumptions

Instantiate key derivation functions H(X, i) = π(K) ⊕ K, K = 2x ⊕ i (π an ideal cipher, instantiated with 128-bit AES with randomly chosen key) Davies-Meyer meets the guarantees of the random permutation model Free-XOR – DM is correlation-robust

slide-123
SLIDE 123

Assumptions

Instantiate key derivation functions H(X, i) = π(K) ⊕ K, K = 2x ⊕ i (π an ideal cipher, instantiated with 128-bit AES with randomly chosen key) Davies-Meyer meets the guarantees of the random permutation model Free-XOR – DM is correlation-robust Hash security

slide-124
SLIDE 124

Assumptions

Instantiate key derivation functions H(X, i) = π(K) ⊕ K, K = 2x ⊕ i (π an ideal cipher, instantiated with 128-bit AES with randomly chosen key) Davies-Meyer meets the guarantees of the random permutation model Free-XOR – DM is correlation-robust Hash security

Collision resistance of DM

slide-125
SLIDE 125

Assumptions

Instantiate key derivation functions H(X, i) = π(K) ⊕ K, K = 2x ⊕ i (π an ideal cipher, instantiated with 128-bit AES with randomly chosen key) Davies-Meyer meets the guarantees of the random permutation model Free-XOR – DM is correlation-robust Hash security

Collision resistance of DM Can be achieved assuming DM is an ideal cipher

slide-126
SLIDE 126

Half-gate garbling

ZRE’15 – state-of-the-art in garbling

slide-127
SLIDE 127

Half-gate garbling

ZRE’15 – state-of-the-art in garbling Compatible with free-XOR

slide-128
SLIDE 128

Half-gate garbling

ZRE’15 – state-of-the-art in garbling Compatible with free-XOR 2 ciphertexts for AND gate

slide-129
SLIDE 129

Half-gate garbling

ZRE’15 – state-of-the-art in garbling Compatible with free-XOR 2 ciphertexts for AND gate Free hash for half-gates garbling?

slide-130
SLIDE 130

a b c

slide-131
SLIDE 131

a b c Garbler knows one of the values in the clear Generator half-gate

slide-132
SLIDE 132

a b c Evaluator knows one of the values in the clear Evaluator half-gate

slide-133
SLIDE 133

a b c a ⊕ r b c1 r b c2

slide-134
SLIDE 134

a b c a ⊕ r b c1 r b c2

r chosen by the garbler Evaluator learns a ⊕ r in the clear

slide-135
SLIDE 135

a b c a ⊕ r b c1 r b c2 Evaluator half-gate Generator half-gate

slide-136
SLIDE 136

a b c a ⊕ r b c1 r b c2

c1 ⊕ c2

slide-137
SLIDE 137

a b c a ⊕ r b c1 r b c2

c1 ⊕ c2 = ( (a ⊕ r) ⋀ b ) ⊕ (r ⋀ b)

slide-138
SLIDE 138

a b c a ⊕ r b c1 r b c2

c1 ⊕ c2 = ( (a ⊕ r) ⋀ b ) ⊕ (r ⋀ b) = a ⋀ b

slide-139
SLIDE 139

a b c a ⊕ r b c1 r b c2

slide-140
SLIDE 140

a b c a ⊕ r b c1 r b c2

EB ⊕ R ( C2 ) EB ⊕ R ( C1 )

slide-141
SLIDE 141

a b c a ⊕ r b c1 r b c2

EB ⊕ R ( C2 ) EB ⊕ R ( C1 ) EB ⊕ R ( C1 ) EB ⊕ R ( C2 )

slide-142
SLIDE 142

a b c a ⊕ r b c1 r b c2

EB ⊕ R ( C2 ) EB ⊕ R ( C1 ) EB ⊕ R ( C1 ) EB ⊕ R ( C2 ) C1 ⊕ C2

slide-143
SLIDE 143

a b c a ⊕ r b c1 r b c2

EB ⊕ R ( C2 ) EB ⊕ R ( C1 ) EB ⊕ R ( C1 ) EB ⊕ R ( C2 ) C1 ⊕ C2 No inactive row

slide-144
SLIDE 144

Hashing in half-gate garbling

Observation – Both ciphertexts decrypted and used to compute output wire label

slide-145
SLIDE 145

Hashing in half-gate garbling

Observation – Both ciphertexts decrypted and used to compute output wire label Modifying a garbled row causes unpredictable change in

  • utput wire label
slide-146
SLIDE 146

Hashing in half-gate garbling

Observation – Both ciphertexts decrypted and used to compute output wire label Modifying a garbled row causes unpredictable change in

  • utput wire label

Simpler hash construction

slide-147
SLIDE 147

Hashing in half-gate garbling

Observation – Both ciphertexts decrypted and used to compute output wire label Modifying a garbled row causes unpredictable change in

  • utput wire label

Simpler hash construction h = H(GC) = XOR of all ciphertexts

slide-148
SLIDE 148

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-149
SLIDE 149

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-150
SLIDE 150

Implementation

Our construction Garble + SHA justGarble Standard Garbling 31.1 226.7 29 Half-gates 26.8 157.7 25.3 AES circuit garbled, numbers in cycles per gate libgarble, AES-NI integrated The configuration: 2.3 GHz Core i5-2410M processor with 4 GB RAM

slide-151
SLIDE 151

Implementation

Our construction Garble + SHA justGarble Standard Garbling 31.1 226.7 29 Half-gates 26.8 157.7 25.3 AES circuit garbled, numbers in cycles per gate libgarble, AES-NI integrated The configuration: 2.3 GHz Core i5-2410M processor with 4 GB RAM

slide-152
SLIDE 152

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-153
SLIDE 153

Overview

Definition of GC hash security Hashed garbling constructions – standard garbling and half-gates [ZRE’15] Implementation and evaluation Impact – Applications of free hash

slide-154
SLIDE 154

CR hash vs free hash

CR hash

slide-155
SLIDE 155

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC)

slide-156
SLIDE 156

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating

slide-157
SLIDE 157

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

slide-158
SLIDE 158

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

Free hash

slide-159
SLIDE 159

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

Free hash

P1 commits to GC GC via h = hG(GC)

slide-160
SLIDE 160

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

Free hash

P1 commits to GC GC via h = hG(GC) GC can be good or cheating

slide-161
SLIDE 161

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

Free hash

P1 commits to GC GC via h = hG(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

slide-162
SLIDE 162

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

Free hash

P1 commits to GC GC via h = hG(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation P1 can open {good,cheating} → broken (fail evaluation)

slide-163
SLIDE 163

CR hash vs free hash

CR hash

P1 commits to GC GC via h = H(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation

Free hash

P1 commits to GC GC via h = hG(GC) GC can be good or cheating Once h fixed, P1 cannot change cheating/good designation P1 can open {good,cheating} → broken (fail evaluation) When can P2 abort? (cf. selective failure)

slide-164
SLIDE 164

Covert secure protocols

Covert model – a party can deviate from the protocol, but is caught with a fixed probability, the deterrence factor

slide-165
SLIDE 165

Covert secure protocols

Covert model – a party can deviate from the protocol, but is caught with a fixed probability, the deterrence factor Introduced in AL’07, public verifiability (PVC) studied in AO’12, KM’15

slide-166
SLIDE 166

Covert secure protocols

Covert model – a party can deviate from the protocol, but is caught with a fixed probability, the deterrence factor Introduced in AL’07, public verifiability (PVC) studied in AO’12, KM’15 Cheating P1 can turn a good evaluation circuit into a broken

  • ne
slide-167
SLIDE 167

Covert secure protocols

Covert model – a party can deviate from the protocol, but is caught with a fixed probability, the deterrence factor Introduced in AL’07, public verifiability (PVC) studied in AO’12, KM’15 Cheating P1 can turn a good evaluation circuit into a broken

  • ne

P2 can safely abort – independent of input

slide-168
SLIDE 168

Covert secure protocols

Covert model – a party can deviate from the protocol, but is caught with a fixed probability, the deterrence factor Introduced in AL’07, public verifiability (PVC) studied in AO’12, KM’15 Cheating P1 can turn a good evaluation circuit into a broken

  • ne

P2 can safely abort – independent of input Deterrence improvement for the same communication complexity

slide-169
SLIDE 169

Covert secure protocols

Covert model – a party can deviate from the protocol, but is caught with a fixed probability, the deterrence factor Introduced in AL’07, public verifiability (PVC) studied in AO’12, KM’15 Cheating P1 can turn a good evaluation circuit into a broken

  • ne

P2 can safely abort – independent of input Deterrence improvement for the same communication complexity Total execution time improved for the same deterrence

slide-170
SLIDE 170

Covert secure protocols – improving performance

Total number Number of Circuits Time

  • f circuits

check circuits sent** (in secs) AL’07 10 9 10 3510 AL’07+free hash 10 9 1 1260 KM’15 10 9 10 3510 KM’15+free hash 10 9 1 1260

Execution time estimates with deterrence of ǫ = 0.9.

slide-171
SLIDE 171

Covert secure protocols – improving performance

Total number Number of Circuits Time

  • f circuits

check circuits sent** (in secs) AL’07 10 9 10 3510 AL’07+free hash 10 9 1 1260 KM’15 10 9 10 3510 KM’15+free hash 10 9 1 1260

Execution time estimates with deterrence of ǫ = 0.9. GC generation for a circuit with 1 billion gates – 95 seconds (per JustGarble paper).

slide-172
SLIDE 172

Covert secure protocols – improving performance

Total number Number of Circuits Time

  • f circuits

check circuits sent** (in secs) AL’07 10 9 10 3510 AL’07+free hash 10 9 1 1260 KM’15 10 9 10 3510 KM’15+free hash 10 9 1 1260

Execution time estimates with deterrence of ǫ = 0.9. GC generation for a circuit with 1 billion gates – 95 seconds (per JustGarble paper). Communication: assuming 1Gbps channel – send 1 billion bits/sec.

slide-173
SLIDE 173

Covert secure protocols – improving performance

Total number Number of Circuits Time

  • f circuits

check circuits sent** (in secs) AL’07 10 9 10 3510 AL’07+free hash 10 9 1 1260 KM’15 10 9 10 3510 KM’15+free hash 10 9 1 1260

Execution time estimates with deterrence of ǫ = 0.9. GC generation for a circuit with 1 billion gates – 95 seconds (per JustGarble paper). Communication: assuming 1Gbps channel – send 1 billion bits/sec. Time to send a circuit of 1 billion gates is 256 seconds (assuming half gates and 2 × 128 bits per gate).

slide-174
SLIDE 174

Covert secure protocols – improving performance

Total number Number of Circuits Time

  • f circuits

check circuits sent** (in secs) AL’07 10 9 10 3510 AL’07+free hash 10 9 1 1260 KM’15 10 9 10 3510 KM’15+free hash 10 9 1 1260

Execution time estimates with deterrence of ǫ = 0.9. GC generation for a circuit with 1 billion gates – 95 seconds (per JustGarble paper). Communication: assuming 1Gbps channel – send 1 billion bits/sec. Time to send a circuit of 1 billion gates is 256 seconds (assuming half gates and 2 × 128 bits per gate). ** In AL07 and KM15 cheaper to send GC than to compute SHA (GC)

slide-175
SLIDE 175

Other applications

Apply to maliciously secure protocols?

slide-176
SLIDE 176

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

slide-177
SLIDE 177

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

Cheating punishment relies on at least one evaluation circuit being “good”

slide-178
SLIDE 178

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

Cheating punishment relies on at least one evaluation circuit being “good” P1 can open the good evaluation circuit as a “broken” one

slide-179
SLIDE 179

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

Cheating punishment relies on at least one evaluation circuit being “good” P1 can open the good evaluation circuit as a “broken” one P2 cannot tell if decoding failure due to selective failure or hash failure

slide-180
SLIDE 180

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

Cheating punishment relies on at least one evaluation circuit being “good” P1 can open the good evaluation circuit as a “broken” one P2 cannot tell if decoding failure due to selective failure or hash failure This prevents input recovery

slide-181
SLIDE 181

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

Cheating punishment relies on at least one evaluation circuit being “good” P1 can open the good evaluation circuit as a “broken” one P2 cannot tell if decoding failure due to selective failure or hash failure This prevents input recovery

Does not apply to dual-execution protocols (HKE’13, KMR’15)

slide-182
SLIDE 182

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

Cheating punishment relies on at least one evaluation circuit being “good” P1 can open the good evaluation circuit as a “broken” one P2 cannot tell if decoding failure due to selective failure or hash failure This prevents input recovery

Does not apply to dual-execution protocols (HKE’13, KMR’15)

Open all “good” evaluation circuits as “broken” ones

slide-183
SLIDE 183

Other applications

Apply to maliciously secure protocols? Does not apply to state-of-the-art protocol of Lin’13

Cheating punishment relies on at least one evaluation circuit being “good” P1 can open the good evaluation circuit as a “broken” one P2 cannot tell if decoding failure due to selective failure or hash failure This prevents input recovery

Does not apply to dual-execution protocols (HKE’13, KMR’15)

Open all “good” evaluation circuits as “broken” ones PSI output leaks information

slide-184
SLIDE 184

What else?

Can be used in majority-based protocols

slide-185
SLIDE 185

What else?

Can be used in majority-based protocols Calculation of optimal ratio when check circuits are cheaper – in the paper

slide-186
SLIDE 186

What else?

Can be used in majority-based protocols Calculation of optimal ratio when check circuits are cheaper – in the paper Applicability in amortized settings?

slide-187
SLIDE 187

What else?

Can be used in majority-based protocols Calculation of optimal ratio when check circuits are cheaper – in the paper Applicability in amortized settings? Hash security when A changes the topology of the circuit?

slide-188
SLIDE 188

Thank you!

Thank You!