[PPT] - On the Security and Privacy of delegated computation Anca Nitulescu PowerPoint Presentation

SLIDE 1

Anca Nitulescu DI ENS - Cascade

On the Security and Privacy of delegated computation

SLIDE 2

Outline

2

Cloud Computation Security requirements Arguments of Knowledge SNARK Definition, Construction Quantum SNARKs Difficulties Applications Open Problems Conclusions

Directions SNARKs

Cryptography Primitives

Motivation Introduction

SLIDE 3

Cryptography

3

Much of the cryptography used today

ffers security properties for data and

communication.

Aspects in information security:

data confidentiality
authentication
data integrity

What about computations?

SLIDE 4

Cryptographic Primitives

4

Primitives = algorithms with basic cryptographic properties
Theoretical work in cryptography
Tools used to build more complicated cryptographic protocols
Provide one functionality at the time:

privacy authentication integrity Encryption schemes Digital signatures

Hash functions

compute a ciphertext to confirm the author compute a reduced hash hide a message

f a message

for a message (e.g. SHA-256)

SLIDE 5

Privacy

5

m

Encryption schemes m → C = Enc(m) C → M = Dec(C)

m

SLIDE 6

Privacy

6

C = Enc (m) m = Dec(C)

C m C

Encryption schemes m → C = Enc(m) C → M = Dec(C)

SLIDE 7

Privacy

7

C’ = Enc (m’) m’ = Dec(C’)

C’ m’

Encryption schemes m → C = Enc(m) C → M = Dec(C)

C’

SLIDE 8

Authenticity

8

σ=Sig(m)

m

Signature schemes m → σ=Sig(m) Ver(σ) → accept/reject

σ=

SLIDE 9

Authenticity

9

Signature schemes m → σ=Sig(m) Ver(σ) → accept/reject

Ver(σ)

SLIDE 10

Data Integrity

10

m

Attack on Integrity Adversary: intercepts the message

SLIDE 11

Data Integrity

11

m’

Attack on Integrity Adversary: changes the message

SLIDE 12

Data Integrity

12

One-Way Hash Functions m → H = Hash(m)

H → ?m’ H = Hash(m’)

m H

m

H = Hash(m)

H

SLIDE 13

13 13

User Server

?

? ?

Delegate Computation to Cloud

data

SLIDE 14

14 14

x

f(x)=y

Delegate Computation to Cloud

Server

data

User

SLIDE 15

Integrity of Delegated Computation?

15 15

trust the server / ask for a proof y, π

data

SLIDE 16

CLOUD - Available for Everything

16

Store documents, photos, videos, etc Ask queries

n the data

Share them with colleagues, friends, family Process the data

SLIDE 17

Outsourced Processing

17

The Cloud Provider:

knows the content
performs the computations

Claims to

identify users
apply access rights
safely store the data
securely process the data
answer correct our queries
protect privacy

SLIDE 18

Risks

18

For economical reasons, by accident, or attacks

data can get deleted
results of computation can be modified
one can use your private data to analyze and sell/negotiate

the information

SLIDE 19

Delegated Computation - Requirements

19

Confidentiality Medical Record Integrity Verify Computation Result

SLIDE 20

Delegated Computation - Requirements

20

Confidentiality

Fully Homomorphic Encryption

SLIDE 21

Delegated Computation - Requirements

21

Integrity Proof of Knowledge

π

SLIDE 22

22

Fast Sound

Properties for the new tool

Succinct

SLIDE 23

Lewis Carroll

23

Nir Bitansky Ran Canetti Alessandro Chiesa Shafi Goldwasser Huijia Lin

Lewis Carroll

SLIDE 24

Non-Interactive proofs

24

f(x)=y

Verifier Prover

data

x y, π

f(x)=y

crs

f

SLIDE 25

Algorithms of a SNARK

25

Algorithms

SLIDE 26

SNARK: Succinct Non-interactive ARgument of Knowledge

26

Non-Interactivity

no exchange between prover and verifier

Zero-Knowledge

does not leak information about the witness

Succinctness

proof size independent

f NP witness size

Efficiency

verification easier than computing f

SNARK

SLIDE 27

Argument of Knowledge Property

27

extractor

SNARK

crs, aux crs, aux Adversary

SLIDE 28

SNARK: Overview of Toolchain

28

Circuit for f(x)

SLIDE 29

SNARK: Overview of Toolchain

29

Circuit for f(x)

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP/ QAP

SLIDE 30

SNARK: Overview of Toolchain

30

Circuit for f(x) Evaluate in a point t(s), p(s), h(s)

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP/ QAP

SLIDE 31

SNARK: Overview of Toolchain

31

Circuit for f(x) Evaluate in a point t(s), p(s), h(s) Verify

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP/ QAP Verify the proof t(s)h(s)=p(s)

? h(s) p(s)

SLIDE 32

From Functions to Circuits

32

Circuit for f(x)

f(x1 , x2)=y x1

x2 y

0/1 C(x1 ,x2,y)

SLIDE 33

Step 1. Linearization of logic gates

33

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

a b c a b c a b c 0 0 0 0 0 0 0 0 0 0 1 1 0 1 0 0 1 1 1 0 1 1 0 0 1 0 1 1 1 1 1 1 1 1 1 0 – a – b + 2c ∈ {0,1} a + b – 2c ∈ {0,1} a + b + c ∈ {0,2}

a b c a b c a b c OR gate AND gate XOR gate

SLIDE 34

Step 2. Matrix equation for circuit

34

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

OR gate AND gate XOR gate Output gate

– a – b + 2c ∈ {0,1} a + b – 2c ∈ {0,1} a + b + c ∈ {0,2} 3 – 3c ∈ {0,1}

V

δ

+

∈ {0,2}d

αa + βb +γc + δ ∈ {0,2}

a

SLIDE 35

Step 2. Matrix equation for circuit

35

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

OR gate AND gate XOR gate Output gate

– a – b + 2c ∈ {0,1} a + b – 2c ∈ {0,1} a + b + c ∈ {0,2} 3 – 3c ∈ {0,1}

V

a

δ

+

。

=

– δ

+

2

V

δ

+

∈ {0,2}d

a

V

a

αa + βb +γc + δ ∈ {0,2}

SLIDE 36

Step 2. Matrix equation for circuit

36

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

OR gate AND gate XOR gate Output gate

– a – b + 2c ∈ {0,1} a + b – 2c ∈ {0,1} a + b + c ∈ {0,2} 3 – 3c ∈ {0,1}

。

= 1

。

=

– δ 2 – 1

V

a

δ

+

V

a +

δ

V

a +

– 1 δ

V

a +

SLIDE 37

Step 3. Polynomial Problem SSP

37

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

。

= 1

– 1 δ

V

a +

– 1 δ

V

a +

SLIDE 38

Step 3. Polynomial Problem SSP

38

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

。

= 1

– 1 δ

V

a +

– 1 δ

V

a +

SLIDE 39

Step 3. Polynomial Problem SSP

39

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

。

= 1

– 1 δ

V

a +

– 1 δ

V

a +

SLIDE 40

Step 3. Polynomial Problem SSP

40

SSP

Find h(x) t(x)h(x)=p(x)

Compile to SSP

SSP:

。

= 1

– 1 δ

V

a +

– 1 δ

V

a +

SLIDE 41

Proving on top of SSP: Setup

41

Evaluate in a point t(s), p(s), h(s)

SSP:

Prover: Evaluate the solution in a random unknown point s Preprocessing: Publish all necessary powers of s (hidden from the Prover)

SLIDE 42

Proving on top of SSP: Setup

42

Evaluate in a point t(s), p(s), h(s)

SSP:

Enc(s) Enc(s2) Enc(sd)

SLIDE 43

Proving on top of SSP: Setup

43

Evaluate in a point t(s), p(s), h(s)

SSP:

Enc(s) Enc(s2) Enc(sd)

Encoding:

linear-only homomorphic (affine)
quadratic root detection
image verification

SLIDE 44

Proving on top of SSP: Setup

44

Evaluate in a point t(s), p(s), h(s)

SSP:

Enc(s) Enc(s2) Enc(sd)

c r s

SLIDE 45

Proving on top of SSP: Prover

45

Evaluate in a point t(s), p(s), h(s)

Prover

SSP:

Enc(s) Enc(s2) Enc(sd)

= Σ pj Enc(sj) = Σ hj Enc(sj)

crs

Enc(p(s)) Enc(h(s))

SLIDE 46

Proving on top of SSP: Prover

46

Evaluate in a point t(s), p(s), h(s)

Enc(p(s)) Enc(h(s))

SSP:

Enc(s) Enc(s2) Enc(sd)

crs

π

Proof

= ,

SLIDE 47

Proving on top of SSP: Verifier

47

Enc(p(s)) Enc(h(s))

Verifier

Verify Verify the proof t(s)h(s)=p(s)

? h(s) p(s)

SSP:

Enc(s) Enc(s2) Enc(sd)

crs

π

SLIDE 48

Proving on top of SSP: Verifier

48

Enc(p(s))

= (Σ ai Enc(vi(s)))2 -1 ? = Enc(p(s))/ Enc(t(s)) ?

Verify Verify the proof t(s)h(s)=p(s)

? h(s) p(s)

Enc(h(s))

SSP:

Enc(s) Enc(s2) Enc(sd)

crs Verifier

SLIDE 49

Security: Types of encodings

49

Public Verifiable Encoding:

affine operation using crs
quadratic root detection using crs
image verification using crs

Designated Verifiable Encoding:

affine operation using crs
quadratic root detection needs sk
image verification using crs

Prover Verifier

crs

crs sk

Prover Verifier

Enc Enc Dec

SLIDE 50

Security: Publicly Verifiable Encoding

SSP:

crs

gs gs2 gsd

crs Prover

SLIDE 51

Security: Publicly Verifiable Encoding

SSP:

gs gs2

crs

gsd

?

Verifier crs crs Prover

SLIDE 52

Security: Designated Verifiable Encoding

52

crs Prover

SSP:

Epk(s) Epk(s2)

crs

Encryption: Decryption:

Epk(sd)

SLIDE 53

Security: Designated Verifiable Encoding

53

Verifier crs

SSP:

Epk(s) Epk(s2)

crs

Encryption: Decryption:

sk

Epk(sd) Epk(p(s)) Epk(h(s))

π

?

SLIDE 54

SNARKs: Further Directions

54

based on DLog in EC groups not quantum resistant publicly-verifiable zero-knowledge

Standard SNARKs

based on lattice assumptions designated-verifiable zero-knowledge

Post-Quantum SNARKs

SLIDE 55

Post-Quantum SNARKs from Lattice-based Encodings

55

Encryption: Decryption:

e r r

r

SLIDE 56

Post-Quantum SNARKs from Lattice-based Encodings

56

Encryption: Decryption:

e r r

r

Es(m1+m2

)

Es(m1

)

error error

Es(m2

)

error

SLIDE 57

Post Quantum SNARKs from Lattice-based Encodings

57

SSP:

crs Esk(si

)

Encryption: Decryption:

error

SLIDE 58

SNARKs: Further Directions

58

based on DLog in EC groups not quantum resistant publicly-verifiable zero-knowledge

Standard SNARKs

based on lattice assumptions designated-verifiable zero-knowledge

Post-Quantum SNARKs

post-quantum SNARKs ???

Publicly Verifiable

for computations over ciphertexts prove integrity of the result efficiently

SNARKs with privacy for the data

SLIDE 59

SNARKs for computations on encrypted data

59

Integrity Proof of Knowledge Confidentiality

Fully Homomorphic Encryption

π

SLIDE 60

More trustful Cloud

60

Access from Anywhere Storage guarantees: emergency backup Integrity of the computations Privacy for your data

SLIDE 61