JNCF 2017 2017/01/20 Private Multi-party Matrix Multiplication and - - PowerPoint PPT Presentation

▶
jncf 2017
SMART_READER_LITE
LIVE PREVIEW

JNCF 2017 2017/01/20 Private Multi-party Matrix Multiplication and - - PowerPoint PPT Presentation

Jan 31, 2023 228 likes •839 views

1 2 JNCF 2017 2017/01/20 Private Multi-party Matrix Multiplication and Trust Computations Jean-Guillaume Dumas 1 ; Pascal Lafourcade 2 ; Jean-Baptiste Orfila 1 ; Maxime Puys 1 1 Public Key Infrastructure Alice wants to securely reach a

slide-1
SLIDE 1

Private Multi-party Matrix Multiplication and Trust Computations

Jean-Guillaume Dumas1 ; Pascal Lafourcade2 ; Jean-Baptiste Orfila1 ; Maxime Puys1

1

JNCF 2017

2017/01/20

1 2

slide-2
SLIDE 2

Public Key Infrastructure

2

 Alice wants to securely reach a website

(e.g. using « https »)

Alice google.com

Public key Private key

slide-3
SLIDE 3

Public Key Infrastructure

3

 Problem : Fake website !

Alice google.com ɢoogle.com

slide-4
SLIDE 4

Public Key Infrastructure

4

 Certificates are delivered

by a certification authority (CA)

google.com CA_1

Id: google.com Pub key: … Sign: CA1

slide-5
SLIDE 5

Public Key Infrastructure

5

 Alice checks the certificate

Alice google.com ɢoogle.com

Id: google.com Pub key: … Sign: CA1 Id: ɢoogle.com Pub key: … Sign: CA_Fake Id: CA1 Pub key: … Sign: CA1 CA_1 => OK CA_FAKE => KO

slide-6
SLIDE 6

PKI_A

Trust between CA

6

CA_A

PKI_B

CA_B

PKI_C

CA_C User2 User1

slide-7
SLIDE 7

PKI_A

Trust between CA

7

CA_A

PKI_B

CA_B

PKI_C

CA_C User2 User1

slide-8
SLIDE 8

Network trust evaluation

8

 Trust value between nodes

3/10 5/10 9/10 4/10 6/10 7/10

1 4 2 5 3

8/10

slide-9
SLIDE 9

Network trust evaluation

9

 Trust evaluation between P1 and P5 ?

3/10 5/10 9/10 4/10 6/10 7/10

1 4 2 5 3

8/10 ?

slide-10
SLIDE 10

Trust Model [Jøsang 2007]

10

 Trust metric:

 T = (Trust, Distrust, Uncertainty)

 Trust Aggregation:

 Direct evaluation: Positive Experiences Negative Experiences 1 – Trust - Distrust

1 2

slide-11
SLIDE 11

Trust Model [Jøsang 2007]

11

 Trust metric:

 T = (Trust, Distrust, Uncertainty)

 Trust Aggregation (monoids based):

Sequential (‘x’) Parallel (‘+’)

Positive Experiences Negative Experiences 1 – Trust - Distrust

1 2 3 1 2 . . . .

slide-12
SLIDE 12

Matrix representation

12

 From a graph…

…To a matrix

 Trust aggregation [Dumas, Hossayni, 2012]

 k: longest path between vertices  Ak converges to global trust

T14 T12 T25 T45 T53 T32 T13

1 4 2 5 3

T12 T13 T14 ? T25 T32 T45 T53

A =

slide-13
SLIDE 13

Securely computing trust

13

 How to securely compute matrix product ?  Conditions:

 n players  1 secret input per player (i.e. the row)  1 common computation (i.e. Ak)

slide-14
SLIDE 14

Outline

14

1.

Introduction

2.

A secure multiparty dot product problem

a.

State of the art

b.

Definitions and tools

c.

Data repartition problem

3.

A new dot product protocol

DSDP

4.

Security strenghtening of the DSDP protocol

a.

1 player corruption

b.

Collusion attacks

c.

Random Ring Order

5.

Conclusion

slide-15
SLIDE 15

Secure dot product: State of the Art

15

 Usual approach:

 [Du et al. 2001]; [Amirbekyan et al. 2007]; [Wang et al. 2008];  ...

T12 T13 T14

Row: All values owned by 1 player Column: All values owned by 1 player

U = V = UT. V

slide-16
SLIDE 16

Homomorphic Encryptions

16

 Homomorphic Encryptions:

 Ek(m1) Ek(m2) = Ek(m1+m2)  Ek(m1)m2 = Ek(m1.m2)

 e.g. Cryptosystems of Paillier, Benaloh, Naccache-Stern…

 Paillier’s cryptosystem:

Ciphering/Deciphering based on modular exponentiations (« RSA like ») Cleartext space depends on each player’s parameters

 Benaloh’s cryptosystem:

Deciphering: computing an ‘‘easy’’ discrete log Common cleartext space

slide-17
SLIDE 17

Dot product

17

 Data repartition:

UT. V

T12 T13 T14

Row: All values owned by 1 player Column: 1 secret value per player

U = V =

slide-18
SLIDE 18

Security notions

18

 Protocol must achieve…

 Correctness  Privacy  Safety

 …despite adversaries…

 Curious-but-honnest  Malicious

 …Capable of cooperating

slide-19
SLIDE 19

State of the Art

19

 MPWP: [Dolev et al. ’10]

 Securely computing weighted average  Benaloh’s cryptosystem  Communications cost: O(n3)

 P-MPWP: (1st contribution)

 Adaptation w/ Paillier’s cryptosystem  Reduction of the communications: O(n2)

 DSDP: (2nd contribution)

 Paillier’s cryptosystem  Communications cost: O(n)  Less security properties are verified

slide-20
SLIDE 20

Distributed Secure Dot Product (DSDP)

20

 0. Data repartition

P1 P2 P3 u1 u2 u3 v2 v3

slide-21
SLIDE 21

Distributed Secure Dot Product (DSDP)

21

 1. Protection of P2 and P3 inputs -> ciphering

P1 P2 P3 u1 u2 u3 v2 v3 v2 v3

slide-22
SLIDE 22

Distributed Secure Dot Product (DSDP)

22

 2. Data exchange

P1 P2 P3 u1 u2 u3 v2 v3

slide-23
SLIDE 23

Distributed Secure Dot Product (DSDP)

23

 3. Homomorphic operations

P1 P2 P3 v2 v3 u2 u3

slide-24
SLIDE 24

Distributed Secure Dot Product (DSDP)

24

 3. Homomorphic operations

P1 P2 P3 v2 v3 u2 u3

slide-25
SLIDE 25

Distributed Secure Dot Product (DSDP)

25

 4. P1 data protection: adding randomness

P1 P2 P3 v2 v3 u2 u3 r2 r3

slide-26
SLIDE 26

Distributed Secure Dot Product (DSDP)

26

 4. P1 data protection: homomorphic operations

P1 P2 P3 v2 v3 u2 u3 r2 r3 + +

slide-27
SLIDE 27

Distributed Secure Dot Product (DSDP)

27

 5. Data exchange

P1 P2 P3 v2 v3 u2 u3 r2 r3 + +

slide-28
SLIDE 28

Distributed Secure Dot Product (DSDP)

28

 6. Deciphering

P1 P2 P3 v2 v3 u2 u3 r2 r3 + +

slide-29
SLIDE 29

Distributed Secure Dot Product (DSDP)

29

 7. Reciphering with next player’s key

P1 P2 P3 v2 v3 u2 u3 r2 r3 + +

slide-30
SLIDE 30

Distributed Secure Dot Product (DSDP)

30

 8. Homomorphic operation

P1 P2 P3 v2 v3 u2 u3 r2 r3 + +

slide-31
SLIDE 31

Distributed Secure Dot Product (DSDP)

31

 8. Homomorphic operation

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + +

slide-32
SLIDE 32

Distributed Secure Dot Product (DSDP)

32

 9. Data exchange

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + +

slide-33
SLIDE 33

Distributed Secure Dot Product (DSDP)

33

 10. Deciphering

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + +

slide-34
SLIDE 34

Distributed Secure Dot Product (DSDP)

34

 11. Reciphering with master player’s key

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + +

slide-35
SLIDE 35

Distributed Secure Dot Product (DSDP)

35

 12. Data exchange

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + +

slide-36
SLIDE 36

Distributed Secure Dot Product (DSDP)

36

 13. Removing randomness

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + +

slide-37
SLIDE 37

Distributed Secure Dot Product (DSDP)

37

 14. Adding missing data

P1 P2 P3 v2 v3 u2 u3 + + u1 u1

slide-38
SLIDE 38

Distributed Secure Dot Product (DSDP)

38

 Properties:

 Correctness  Security against one semi-honest adversary  Safety  O(n) communications

 Automatic security verification

 ProVerif

slide-39
SLIDE 39

DSDP

39

 Normal case

P1 P2 P3 v2 v3 u2 u3 r2 r3 + +

slide-40
SLIDE 40

x2

DSDP: P3 is compromised

40

 Modified data sent from P3 instead of P1

P1 P2 P3 v2 v3 x3 y2 y3 + +

slide-41
SLIDE 41

DSDP: P3 is compromised

41

 Counter-measure:

Signatures

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + P1

slide-42
SLIDE 42

DSDP: P1 is compromised

42

 Attack: replacing u3 and r3

P1 P2 P3 v2 u2 x3 r2 +

slide-43
SLIDE 43

u2 x3 r2 + +

DSDP: P1 is compromised

43

Only v2 is unknown!

P1 P2 P3 v2

slide-44
SLIDE 44

DSDP: Counter-measure

44

 Zero-Knowledge

Proof of non trivial affine transform

v2 u2 r2 + g g u2 g r2 P2 P1

slide-45
SLIDE 45

DSDP: Counter-measure

45

 Zero-Knowledge

Proof of non trivial affine transform

v2 u2 r2 + g u2 g r2 g v2 .

=?=

g u2 g r2 P2 P1 Non trivial values

=?=

slide-46
SLIDE 46

DSDP: Collusion Attack 1

46

 Normal case:

P1 P2 P3 v2 v3 u2 u3 r2 r3 + + + P4 v2 v3 u2 u3 r2 r3 + + + v4 u4 r4 + + v2 u2 r2 +

slide-47
SLIDE 47

u2

DSDP: P1 and P3 corrupted

47

 P3 extra data exchange:

P1 P2 P3 P4 v2 v3 u3 r2 r3 + + +

slide-48
SLIDE 48

DSDP: Collusion Attacks

48

 Attacks conditions:

 P1 corrupted  Honest player rounded by corrupted ones

Problem: players’ location!  Counter-measure: Random Ring Order (RRO)

 Players are randomly placed  d protocol repetitions

using masked secrets

slide-49
SLIDE 49

DSDP: Random Ring Order

49

 Masked secret: vi = vi,1 + vi,2  Round 1:

P1 P2 P3 v2,1 v3,1 u2 u3 r2 r3 + + + v2,1 u2 r2 +

slide-50
SLIDE 50

DSDP: Random Ring Order

50

 Masked secret: vi = vi,1 + vi,2  Round 2:

P1 P3 P2 v3,2 v2,2 u3 u2 r3’ r2’ + + + v3,2 u3 r3’ +

slide-51
SLIDE 51

DSDP: Random Ring Order

51

 Masked secret: vi = vi,1 + vi,2  Last step:

P1 P3 P2 v3,2 v2,2 u3 u2 + v2,1 v3,1 u2 u3 + +

slide-52
SLIDE 52

DSDP: Random Ring Order

52

 Masked secret: vi = vi,1 + vi,2  Last step:

P1 P3 P2 v3,2 v2,2 u3 u2 + v2,1 v3,1 u2 u3 + +

slide-53
SLIDE 53

DSDP: Random Ring Order

53

 Masked secret: vi = vi,1 + vi,2  At the end:

P1 P3 P2 v2 v3 u2 u3 +

slide-54
SLIDE 54

Security of RRO

54

 Attacks successful if:

Adversaries are well-placed at each round

 Probabilist security:

 #{Malicious Players} < #{Honests Players}

=> d=O(log n) rounds (in average)

 Guaranteed security:

 Even in the worst case(#{Malicious} = n-2)

=> d = O(n*s) rounds, with s bits of security

slide-55
SLIDE 55

Dot Product Protocols Comparison

55

slide-56
SLIDE 56

 Applying dot-product protocols

to matrix product

Applicable to monoids of trust Inputs privacy

Private trust computation

56

T12 T13 T14 ? T23 ? T25 ? T35 ? T45 ? T53 T12 T13 T14 T15 T23 T24 T25 T31 T35 T4 3 T45 T52 T53

k converges Global Trust

slide-57
SLIDE 57

Conclusion

57

 Dot product protocols:

 O(n2) secure against malicious adv.  O(n) secure against honnest-but-curious adv.  O(nlog(n)) trade-off speed/security (RRO)  O(n2s) to obtain guaranted security (RRO)

 From dot-product computations:

 -> Matrix product  -> Trust computations

 Application:

 Trust between certification authorities

slide-58
SLIDE 58

Perspectives

58

 Comparison w/ a « dual » protocol  Currently:

 Paillier’s cryptosystem  Efficiency with others cryptosystems ?

(Naccache-Stern…)

 Matrix Multiplication:

 DSDP: O(n3)

Reducing to O(nw) ?

slide-59
SLIDE 59

59

Thank you!

slide-60
SLIDE 60

60

?