New Advances in Secure RAM Computation Sanjam Garg University of - - PowerPoint PPT Presentation

β–Ά
new advances in secure
SMART_READER_LITE
LIVE PREVIEW

New Advances in Secure RAM Computation Sanjam Garg University of - - PowerPoint PPT Presentation

Dec 04, 2022 177 likes β€’390 views

New Advances in Secure RAM Computation Sanjam Garg University of California, Berkeley Based on joint works with Steve Lu, Payman Mohassel, Charalampos Papamanthou, Rafail Ostrovsky and Alessandra Scafuro Yaos garbled circuits Server User

slide-1
SLIDE 1

New Advances in Secure RAM Computation

Sanjam Garg University of California, Berkeley Based on joint works with Steve Lu, Payman Mohassel, Charalampos Papamanthou, Rafail Ostrovsky and Alessandra Scafuro

slide-2
SLIDE 2

Yao’s garbled circuits

User Server

𝐷 𝐷 𝐷(𝑦) 𝑦 𝑦

slide-3
SLIDE 3

RAM analogue of Garbled circuits

User Server

𝑄, 𝑦 𝑄, 𝑦 𝑄(𝑦)

If the running time of the program 𝑄 is π‘ˆ then the corresponding circuit is of size π‘ˆ3.

Communication complexity and computational complexity of both parties grows with π‘ˆ3.

slide-4
SLIDE 4

More Ambitious: Garbled RAM

[LO13,GHLORW14]

User Server

𝑄𝑗, 𝑦𝑗 𝑄𝑗, 𝑦𝑗 𝑄𝑗(𝑦𝑗)

Garbled circuits lead to a solution where the communication and computational cost per program grows with database size.

  • Size of garbled database is 𝑃

𝐸

  • Communication and computation cost grows in 𝑃

π‘ˆ

𝑗

slide-5
SLIDE 5

More Ambitious: Garbled RAM

[LO13,GHLORW14]

User Server

𝑄𝑗, 𝑦𝑗 𝑄𝑗, 𝑦𝑗 𝑄𝑗(𝑦𝑗)

Garbled circuits lead to a solution where the communication and computational cost per program grows with database size.

  • Full-security: Server learns nothing but the output
  • Unprotected Memory Access (UMA): Server learns

access pattern.

ORAM [Goldreich-Ostrovsky]

slide-6
SLIDE 6

Putting in context – Secure Computation

  • Traditional protocols – have large round complexity
  • Linear in running time [OS97, GKKKMR12 …]
  • Seeking an analogue of Yao’s garbled circuits
  • Non-interactive
slide-7
SLIDE 7

Landscape: Garbled RAM

  • Heuristic construction from OWFs [LO13]
  • Circularity Issue
  • Fixed using IBE [GHLORS14]
  • Construction from OWFs [GLOS15]
  • Using only black-box use of OWFs[GLO15]
  • OWF can’t be modeled as a random oracle
  • Not talk about succinct constructions based on iO

[CHJV14, BGT14, LP14, KLW15, CH15, CCCLLZ15...]

slide-8
SLIDE 8

Outline of the rest of the talk

  • RAM model
  • LO13 approach
  • Technical bottleneck in realizing black-box

construction

  • High level idea of black-box construction [GLO15]
  • Extensions [GMP15,GM15,GGMP15,GP15]
slide-9
SLIDE 9

RAM Model

CPU step 1 CPU step 2 CPU step 3 read 1 next index read 2 next index read 3 next index

Writes require additional work but let’s ignore that!

slide-10
SLIDE 10

LO13 approach

CPU step 1 CPU step 2 CPU step 3 read 1 next index read 2 next index read 3 next index

Use garbled circuits!

slide-11
SLIDE 11

LO13 approach

CPU step 1 CPU step 2 CPU step 3 read 1 next index read 2 next index read 3 next index

How do reads work? Access pattern is revealed!

1) Somehow encrypt memory 2) translate table

slide-12
SLIDE 12

LO13 approach

CPU step 1 CPU step 2 CPU step 3 read 1 next index read 2 next index read 3 next index

STEP 1: garbling/encrypting of the memory

  • PRF key K to garble

𝑐𝑗 𝑗 𝑄𝑆𝐺𝐿(𝑗, 𝑐𝑗)

slide-13
SLIDE 13

LO13 approach

CPU step 1 CPU step 2 CPU step 3 read 1 next index read 2 next index read 3 next index

STEP 2: translate table

  • PRF key K to garble

K K K

𝑐𝑗 𝑗 𝑄𝑆𝐺𝐿(𝑗, 𝑐𝑗) π‘˜ 𝑑0, 𝑑1

πΉπ‘œπ‘‘(𝑄𝑆𝐺𝐿 π‘˜, 0 , 𝑑0) πΉπ‘œπ‘‘(𝑄𝑆𝐺𝐿 π‘˜, 1 , 𝑑1)

slide-14
SLIDE 14

Technical Bottleneck in Black-Box

  • The data needs to be encrypted so that the server

doesn’t learn it!

  • CPU step garbled circuits need to decrypt the read

values internally

  • Need of black-box use of cryptography seems

inherent

slide-15
SLIDE 15

GLO15 high level idea

  • Garbled memory comprises of a collection of

garbled circuits with data values hardwired in them

  • Read implemented by a sub-routine call
  • Control flow is passed to memory circuits
slide-16
SLIDE 16

GLO15 – for one read only

𝑐1 𝑐2

π‘˜, 𝑑0, 𝑑1 ………

slide-17
SLIDE 17

GLO15 – for one read only

𝑐1 𝑐2

π‘˜, 𝑑0, 𝑑1 ………

Say π‘˜ = 2 Outputs 𝑑𝑐2

Memory no longer useful!

slide-18
SLIDE 18

……… ……… ……… ………

GLO15 – for 𝑛 reads only

𝑐1 𝑐2

π‘˜, 𝑑0, 𝑑1 ………

Say π‘˜ = 2 Outputs 𝑑𝑐2

……… How many backups? How do we connect them?

Assume uniform memory accesses.

slide-19
SLIDE 19

Conclusion and Open Problems

  • Secure Computation for RAM programs

Round Efficient And Black Box

  • Important for crypto for big data
  • Theoretically practical secure computation.
slide-20
SLIDE 20

Thanks!