Multi-Party Function Evaluation with Perfectly Private Audit Trail - PowerPoint PPT Presentation

Multi-Party Function Evaluation with Perfectly Private Audit Trail ´ Edouard Cuvelier & Olivier Pereira Universit´ e catholique de Louvain ICTEAM – Crypto Group 1348 Louvain-la-Neuve – Belgium UCL Crypto Group SDTA - December 2014 1 Microelectronics Laboratory

Privacy vs Verifiability – Two Extremes Public Auctions Sealed Bids Auctions Verifiability 100% Verifiablility 0% Privacy 0% Privacy 100% UCL Crypto Group SDTA - December 2014 2 Microelectronics Laboratory

Privacy vs Verifiability – Two Extremes Public Auctions Sealed Bids Auctions Verifiability 100% Verifiablility 0% Privacy 0% Privacy 100% How to conciliate Privacy and Verifiability ? UCL Crypto Group SDTA - December 2014 2 Microelectronics Laboratory

Objectives ◮ Generic - Evaluate any computable functions in a multi-party setting ◮ Privacy - Parties only trust a third party for privacy ◮ Verifiability - Guarantee correctness of the result ◮ Efficiency - Run in reasonable execution-time & memory-size on standard laptop UCL Crypto Group SDTA - December 2014 3 Microelectronics Laboratory

Outline 1. Motivations 2. Protocol description 3. Three test applications 4. Conclusion UCL Crypto Group SDTA - December 2014 4 Microelectronics Laboratory

Motivations A direct solution is the use of “Classic” Secure Multi-Party Computation... UCL Crypto Group SDTA - December 2014 5 Microelectronics Laboratory

“Classic” Secure Multi-Party Computation f ( x 1 , x 2 , x 3 ) Client 1 input : x 1 Client 2 Client 3 f ( x 1 , x 2 , x 3 ) f ( x 1 , x 2 , x 3 ) input : x 2 input : x 3 UCL Crypto Group SDTA - December 2014 6 Microelectronics Laboratory

Motivations I A direct solution is the use of “Classic” Secure Multi-Party Computation... Interesting features : ◮ No need of a trusted third party ◮ Allows to evaluate any arithmetic or boolean function [VIFF,Fairplay, Sharemind, TASTY] ◮ Existing implementations more and more efficient [SPDZ (Damg˚ ard et al. 13), BeDOZa (Bendlin et al. 10), TinyOT (Nielsen et al. 12)] UCL Crypto Group SDTA - December 2014 7 Microelectronics Laboratory

Motivations II In practice, it raises issues : ◮ Go from 3 clients to 3333 clients? ◮ Online infrastructure ◮ Clients need to agree on the algorithm to compute the function ◮ Still not efficient enough to solve complex functions (NP-hard problems) UCL Crypto Group SDTA - December 2014 8 Microelectronics Laboratory

Protocol Description Public Bulletin Board Com ( x 1 ) Client 1 Com ( x 2 ) Client 2 . . . . . . Com ( x n ) Client n Com ( x ) is a commitment on the value x (e.g. Com ( x ) = g x h r ). ◮ Com ( x ) is perfectly private (information theory) ◮ Com ( x ) is computationally binding UCL Crypto Group SDTA - December 2014 9 Microelectronics Laboratory

Protocol Description Public Bulletin Board Com ( x 1 ) Client 1 Enc ( x 1 ) f ( x 1 , · · · , x n ) Com ( x 2 ) Worker Client 2 and proof Enc ( x 2 ) . . . . . . Enc ( x n ) Com ( x n ) Client n Com ( x ) is a commitment on the value x (e.g. Com ( x ) = g x h r ). ◮ Com ( x ) is perfectly private (information theory) ◮ Com ( x ) is computationally binding UCL Crypto Group SDTA - December 2014 9 Microelectronics Laboratory

Protocol Description Public Bulletin Board Com ( x 1 ) Client 1 Enc ( x 1 ) f ( x 1 , · · · , x n ) Com ( x 2 ) Worker Client 2 and proof Enc ( x 2 ) . . . . . . Enc ( x n ) Com ( x n ) Client n Com ( x ) is a commitment on the value x (e.g. Com ( x ) = g x h r ). ◮ Com ( x ) is perfectly private (information theory) ◮ Com ( x ) is computationally binding UCL Crypto Group SDTA - December 2014 9 Microelectronics Laboratory

Advantages of the model I ◮ No communications between the clients C 3 C 4 C 3 C 4 C 2 C 5 C 2 C 5 versus Worker C 1 C 6 C 1 C 6 C 8 C 7 C 8 C 7 UCL Crypto Group SDTA - December 2014 10 Microelectronics Laboratory

Advantages of the model II ◮ No communications between the clients ◮ The Worker can use his own sophisticated algorithms without compromising his intellectual property when the verification is not the algorithm itself UCL Crypto Group SDTA - December 2014 11 Microelectronics Laboratory

Advantages of the model II ◮ No communications between the clients ◮ The Worker can use his own sophisticated algorithms without compromising his intellectual property when the verification is not the algorithm itself ◮ Gain in complexity when the proof is simpler to compute than the function itself UCL Crypto Group SDTA - December 2014 11 Microelectronics Laboratory

A word on Encryption-Commitment Commitment Consistent Encryption (CCEnc) Proposed at Esorics 13 (Cuvelier, Pereira & Peters) CCEnc = ( Gen , Enc , Dec , DerivCom , Open , Verify ) ! Ensure consistency between the commitment and the encryption ! UCL Crypto Group SDTA - December 2014 12 Microelectronics Laboratory

Efficient implementation over Elliptic Curve I G 1 , G 2 , G T different groups of same prime order q A bilinear map e : G 1 × G 2 → G T G 1 G 2 G T e ( h , g ) g h g a e ( g a , h ) = e ( g , h ) a h h b e ( g , h b ) = e ( g , h ) b g In our case : G 1 = E ( F p ), G 2 ⊂ E ′ ( F p 2 ) and G T ⊂ F p 12 where E is a BN-curve, E ′ the twisted curve ∼ E UCL Crypto Group SDTA - December 2014 13 Microelectronics Laboratory

Efficient implementation over Elliptic Curve II small m ∈ Z q additively homomorphic encryption & commitment G 1 G 2 G T h , h 1 = h x 1 g , g 1 UCL Crypto Group SDTA - December 2014 14 Microelectronics Laboratory

Efficient implementation over Elliptic Curve II small m ∈ Z q additively homomorphic encryption & commitment G 1 G 2 G T h , h 1 = h x 1 g , g 1 d = g r g m 1 UCL Crypto Group SDTA - December 2014 14 Microelectronics Laboratory

Efficient implementation over Elliptic Curve II small m ∈ Z q additively homomorphic encryption & commitment G 1 G 2 G T h , h 1 = h x 1 g , g 1 d = g r g m c 1 = h s 1 c 2 = h r h s 1 UCL Crypto Group SDTA - December 2014 14 Microelectronics Laboratory

Efficient implementation over Elliptic Curve II small m ∈ Z q additively homomorphic encryption & commitment G 1 G 2 G T h , h 1 = h x 1 g , g 1 d = g r g m c 1 = h s 1 c 2 = h r h s Dec sk ( c ) : DLog of 1 e ( g , c x 1 1 / c 2 ) · e ( d , h ) = e ( g , h 1 ) m Open sk ( c ) : a = c 2 / c x 1 1 Verif pk ( d , m , a ) : ? = e ( d / g m e ( g , a ) 1 , h ) UCL Crypto Group SDTA - December 2014 14 Microelectronics Laboratory

A word on the proof The Proof of correctness is an aggregation of proofs on intermediate assumptions ◮ performed on the commitment space ◮ the proofs are Zero-Knowledge Proofs of Knowledge (ZKPK) that are rendered Non-Interactive ◮ ZKPK needed for multiplication and for range proof ◮ efficient in our elliptic curves based setting UCL Crypto Group SDTA - December 2014 15 Microelectronics Laboratory

A word on the proof - multiplication proof From Damg˚ ard & Fujisaki 02 : Com 1 = g r 1 g x 1 1 , Com 2 = g r 2 g x 2 1 , Com 3 = g r 3 g x 3 1 we prove in NIZK that x 3 = x 1 x 2 1. Prove the knowledge of the openings of Com 1 , Com 2 , Com 3 2. Prove that Com 3 commits on the same value as Com 2 using base Com 1 ◮ online verification ◮ offline verification by using a precomputed multiplicative triplet [SPDZ] UCL Crypto Group SDTA - December 2014 16 Microelectronics Laboratory

A word on the proof - range proof Com ( x ) = g r g x 1 we prove in NIZK that x ∈ [0 , L [ , L ≤ 2 16 ◮ needed for branching operators ( < ) ◮ based on signature-pairing (Camenish et al. 08) ◮ amortized cost for small L ◮ trusted setup ◮ precomputation ◮ based binary decomposition L = 2 k + 1 and ZKPK 0 , 1 ◮ cost linear in k UCL Crypto Group SDTA - December 2014 17 Microelectronics Laboratory

A word on the proof - complexity M : 1 scalar multiplication over EC M p : 1 scalar multiplication over EC with precomputation ≈ 1 / 5M A : 1 addition over EC U : 1 integer in Z q Computation Verification Size Commitment 2M p + 1A 2M p + 1A 2 U ZKPK 0 , 1 4M p + 2A 2M + 3M p + 3A 4 U ZKPK dLog 4M p + 2A 2M + 4M p + 4A 4 U ZKPK consist 8M p + 3A 8M p + 3A 4 U ZKPK mul 6M p + 3A 4M + 5M p + 6A 6 U ZKPK range (2 k +1 ) 6 k M p + 3 k A (3 k − 1)M + 3 k M p + (4 k − 1)A 6 kU UCL Crypto Group SDTA - December 2014 18 Microelectronics Laboratory

1st application : Auctions x 1 x 2 x 3 x n Worker · · · Clients Bulletin Board Com ( x 1 ) Com ( x 2 ) Com ( x 3 ) Com ( x n ) · · · UCL Crypto Group SDTA - December 2014 19 Microelectronics Laboratory

1st application : Auctions x 1 x 2 x 3 x n Worker · · · optimal sorting O ( n log n ) x 3 x 7 x 1 x 10 · · · Clients Bulletin Board Com ( x 1 ) Com ( x 2 ) Com ( x 3 ) Com ( x n ) · · · UCL Crypto Group SDTA - December 2014 19 Microelectronics Laboratory

1st application : Auctions x 1 x 2 x 3 x n Worker · · · optimal sorting O ( n log n ) x 3 x 7 x 1 x 10 · · · Clients Com ( x 3 ) Com ( x 7 ) Com ( x 1 ) · · · Com ( x 10 ) Bulletin Board Com ( x 1 ) Com ( x 2 ) Com ( x 3 ) Com ( x n ) · · · UCL Crypto Group SDTA - December 2014 19 Microelectronics Laboratory