is Practical gnes Kiss Thomas Schneider TU Darmstadt Eurocrypt - PowerPoint PPT Presentation

Valiant ’ s Universal Circuit is Practical Ágnes Kiss Thomas Schneider TU Darmstadt Eurocrypt 2016 May 11, 2016

Universal Circuit (UC) There is a Boolean circuit 𝑉𝐷 of size O 𝑜 log 𝑜 for which it holds that for any Boolean function 𝑔 of size 𝑜 𝑉𝐷 can be made to compute 𝑔. Leslie G. Valiant 1976 𝑔 𝑉𝐷 2

Universal Circuit (UC) There is a Boolean circuit 𝑉𝐷 of size O 𝑜 log 𝑜 for which it holds that for any Boolean function 𝑔 of size 𝑜 there exists a programming 𝑞 such that for any input 𝑦: 𝑉𝐷 𝑞, 𝑦 = 𝑔 𝑦 . 𝑦 𝑦 𝑞 Leslie G. Valiant 1976 𝑔(𝑦) 𝑉𝐷(𝑞, 𝑦) 2

UC Applications Verifiable Program obfuscation computation Attribute-based Private function encryption evaluation 3

Secure Function Evaluation 𝑔 𝑧 𝑦 𝑔(𝑦, 𝑧) 4

Secure Function Evaluation 𝑧 𝑦 SFE 𝑔 𝑔(𝑦, 𝑧) 4

Secure Function Evaluation 𝑧 𝑦 SFE 𝑔 𝑔(𝑦, 𝑧) 4

Secure Function Evaluation SFE 𝑧 𝑦 𝑔 𝑔(𝑦, 𝑧) 4

Secure Function Evaluation Boolean circuit 𝑧 𝑦 𝑔(𝑦, 𝑧) 𝐷 ➪ Yao’s Garbled Circuit Protocol ➪ Goldreich-Micali-Wigderson Protocol 4

Private Function Evaluation PFE 𝑔 𝑦 𝑔(𝑦) 𝑔(𝑦) 5

Private Function Evaluation PFE 𝐷 𝑣, 𝑤, 𝑙 𝑦 𝑔(𝑦) 𝑔(𝑦) 5

Private Function Evaluation 𝑉𝐷 𝑣,𝑤,𝑙 𝑞 𝑦 𝑉𝐷(𝑞, 𝑦) 𝑉𝐷(𝑞, 𝑦) 𝑔(𝑦) 𝑔(𝑦) 5

PFE Applications Software diagnostics Medical diagnostics Private search Private databases queries 6

UC Construction C (size: 𝑜 = 𝑣 + 𝑤 + 𝑙 ) 7

UC Construction C (size: 𝑜 = 𝑣 + 𝑤 + 𝑙 ) UC Generation 7

UC Construction C (size: 𝑜 = 𝑣 + 𝑤 + 𝑙 ) UC Generation Programming bits p Universal Circuit UC 7

Existing UC Constructions [Val76] [KS08] O(𝑜 log 2 𝑜) O(𝑜 log 𝑜) Size O(𝑜) O(𝑜 log 𝑜) Depth Implemented [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. [KS08] V. Kolesnikov, T. Schneider: A practical universal circuit construction and secure evaluation of private functions. In FC 2008 . 8

Valiant’s UC Construction 𝑜 G ENERATION Universal Graph UG Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Universal Graph UG Universal Circuit UC C [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Universal Circuit UC C G C [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Edge-embedding E Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. G C 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Edge-embedding E Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. G C 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Edge-embedding E Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. G C 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Edge-embedding E Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. G C 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Edge-embedding E Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. G C 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Edge-embedding E Programming bits p Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. 9

Valiant’s UC Construction C size ≤ 𝑜 𝑜 P ROGRAMMING G ENERATION Graph G C Universal Graph UG Edge-embedding E Programming bits p Universal Circuit UC [Val76] L. G. Valiant: Universal circuits (preliminary report). In STOC 1976. 9

Our Contributions Valiant’s universal circuit is practical. Refined size of UC compiler Embedding construction algorithm 10

UG Embedding Algorithm P ROGRAMMING Graph G C Universal Graph UG Edge-embedding E 11

Recursive UG Construction 𝑉𝐻 𝑜 2 1 𝑉𝐻 𝑉𝐻 𝑜 2 𝑜 2 ... 12

Recursive UG Construction 𝑉𝐻 𝑜 2 1 𝑉𝐻 𝑉𝐻 𝑜 2 𝑜 2 11 𝑉𝐻 12 22 21 𝑉𝐻 𝑉𝐻 𝑉𝐻 𝑜 4 𝑜 4 𝑜 4 𝑜 4 ... ... ... ... ... 12

Recursive UG Construction 𝑉𝐻 𝑜 2 1 𝑉𝐻 𝑉𝐻 𝑜 2 𝑜 2 11 𝑉𝐻 12 21 22 𝑉𝐻 𝑉𝐻 𝑉𝐻 𝑜 4 𝑜 4 𝑜 4 𝑜 4 111 𝑉𝐻 221 𝑉𝐻 211 𝑉𝐻 121 𝑉𝐻 112 222 212 𝑉𝐻 122 𝑉𝐻 𝑉𝐻 𝑉𝐻 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 12

Recursive UG Construction 𝑉𝐻 𝑜 2 1 𝑉𝐻 𝑉𝐻 𝑜 2 𝑜 2 11 𝑉𝐻 12 21 22 𝑉𝐻 𝑉𝐻 𝑉𝐻 𝑜 4 𝑜 4 𝑜 4 𝑜 4 111 𝑉𝐻 221 𝑉𝐻 211 𝑉𝐻 121 𝑉𝐻 112 222 212 𝑉𝐻 122 𝑉𝐻 𝑉𝐻 𝑉𝐻 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 12

Edge-Embedding G C 13

Edge-Embedding H 1 H 2 G C 13

Edge-Embedding H 1 H 2 G C G 1 G 2 13

Edge-Embedding H 1 H 2 G C G 1 G 2 H 11 H 12 H 21 H 22 13

Edge-Embedding H 1 H 2 H 11 H 12 H 21 H 22 13

Edge-Embedding H 1 H 2 H 11 H 12 H 21 H 22 G 11 G 12 G 21 G 22 13

Edge-Embedding H 1 H 2 H 11 H 12 H 21 H 22 H 122 H 211 H 212 H 221 H 222 H 111 H 121 H 112 13

Edge-Embedding H 1 H 2 H 11 H 12 H 21 H 22 H 122 H 211 H 212 H 221 H 222 H 111 H 121 H 112 13

Edge-Embedding H 1 H 2 H 11 H 12 H 21 H 22 H 122 H 211 H 212 H 221 H 222 H 111 H 121 H 112 13

Edge-Embedding G C H 1 H 2 H 11 H 12 H 21 H 22 H 122 H 211 H 212 H 221 H 222 H 111 H 121 H 112 14

Recursive UG Construction 𝑉𝐻 𝑜 2 1 𝑉𝐻 𝑉𝐻 𝑜 2 𝑜 2 11 𝑉𝐻 12 21 22 𝑉𝐻 𝑉𝐻 𝑉𝐻 𝑜 4 𝑜 4 𝑜 4 𝑜 4 111 𝑉𝐻 221 𝑉𝐻 211 𝑉𝐻 121 𝑉𝐻 112 222 212 𝑉𝐻 122 𝑉𝐻 𝑉𝐻 𝑉𝐻 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 𝑜 8 15

Our Contributions Valiant’s universal circuit is practical. Embedding UC compiler Refined size of algorithm construction 16

Size of Universal Graph Size of the universal graph Our upper bound Our lower bound Exact number of nodes 𝑜−2 + 5 𝑜−2 𝐺 𝑜 = 2𝐺 , if 𝑜 is even 2 2 𝑜−1 𝑜−3 + 5 𝑜−3 𝐺 𝑜 = 𝐺 + 𝐺 + 3 , if 𝑜 is odd 2 2 2 Size of original graph 17

Size of Universal Graph Size of the universal graph Our upper bound: 2.5𝑜 log 2 𝑜 − 9𝑜 + 5 log 2 𝑜 + 10 Our lower bound : 2.5𝑜 log 2 𝑜 − 4𝑜 + 2.5 log 2 𝑜 + 5 Exact number of nodes Size of original graph 17

Deviation of Estimated Size and Exact Size Devination in percentage 2.5𝑜 log 2 𝑜 − 6.5𝑜 + 3.75 log 2 𝑜 + 7.5 𝑜−2 + 5 𝑜−2 𝐺 𝑜 = 2𝐺 , if 𝑜 is even 2 2 𝑜−1 𝑜−3 + 5 𝑜−3 𝐺 𝑜 = 𝐺 + 𝐺 + 3 , if 𝑜 is odd 2 2 2 Size of original graph 18

Size of the UC Constructions [KS08] Size of the universal circuit 2860 Number of gates 19

Revised size of the UC Constructions Size of the universal circuit 2860 1070 Number of gates 19

PFE Comparison – Symmetric-Key Operations [KS08] construction Valiant’s construction (revised) Symmetric-key operations [MS13] OT-based protocol 7 103 19 656 27 429 43 874 (DES) (AES) (MD5) (MULT32) 20

PFE Comparison – Symmetric-Key Operations [KS08] construction Valiant’s construction (revised) Symmetric-key operations [MS13] OT-based protocol 7 103 19 656 27 429 43 874 (DES) (AES) (MD5) (MULT32) (size) [MS13]: P. Mohassel, S. S. Sadeghian. How to hide circuits in MPC an efficient framework for private function evaluation. In Eurocrypt 2013 . 20

Our Contributions Valiant’s universal circuit is practical. Embedding Refined size of UC compiler algorithm construction 21

UC Implementation 𝑔 SHDL C 0 [MNPS04] D. Malkhi, N. Nisan, B. Pinkas, Y. Sella. Fairplay-Secure Two-Party Computation System. In USENIX Security Symposium 2004 . 22

UC Implementation C size ≤ 𝑜 𝑔 C 0 3 1 ID 2 1 2 3 22

UC Implementation C size ≤ 𝑜 𝑔 C 0 Graph G C C G C 22

UC Implementation 𝑜 C size ≤ 𝑜 𝑔 C 0 Graph G C Universal Graph UG 22

UC Implementation 𝑜 C size ≤ 𝑜 𝑔 C 0 UC Compiler Graph G C Universal Graph UG Edge-embedding E 22