Overdrive: Making SPDZ Great Again Marcel Keller, Valerio Pastro, - - PowerPoint PPT Presentation

▶
overdrive making spdz great again
SMART_READER_LITE
LIVE PREVIEW

Overdrive: Making SPDZ Great Again Marcel Keller, Valerio Pastro, - - PowerPoint PPT Presentation

Jun 28, 2023 393 likes •778 views

Eurocrypt 2018 Overdrive: Making SPDZ Great Again Marcel Keller, Valerio Pastro, and Dragos Rotaru University of Bristol, Yale University, KU Leuven 1 M. Keller, V. Pastro, Dragos Rotaru imec-Cosic, Dept. Electrical Engineering Whats all

slide-1
SLIDE 1
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 1

Eurocrypt 2018

Overdrive: Making SPDZ Great Again

Marcel Keller, Valerio Pastro, and Dragos Rotaru

University of Bristol, Yale University, KU Leuven

slide-2
SLIDE 2
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 2

What’s all the fuss about?

Dragos Rotaru 2

Goal: Compute F(a, b, c)

a c b

slide-3
SLIDE 3
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 3

Security Model

Dragos Rotaru 3

  • Many parties (up to N)
  • Malicious adversary
  • Dishonest majority of corrupted parties
slide-4
SLIDE 4
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 4

Security Model

Dragos Rotaru 4

  • Many parties (up to N)
  • Malicious adversary
  • Dishonest majority of corrupted parties
slide-5
SLIDE 5
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 5

Malicious MPC protocols

Preprocessing phase Online phase

Inputs PKC SPDZ, TinyOT, BDOZa, MASCOT

slide-6
SLIDE 6
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 6

Secret share then authenticate

𝑦1 𝑦2 𝑦3 𝑦 α𝑦 γ(𝑦)2 γ(𝑦)1 γ(𝑦)3

+ + + +

= =

α1 α2 α3 α

+ +

=

slide-7
SLIDE 7
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 7

Secret share then authenticate

(𝑦 + 𝑧)1 (𝑦 + 𝑧)2 (𝑦 + 𝑧)3 𝑦 + 𝑧

α(𝑦 + 𝑧)

γ(𝑦 + 𝑧)2 γ(𝑦 + 𝑧)1 γ(𝑦 + 𝑧)3

+ + +

= =

α1 α2 α3 α

+ +

=

+

slide-8
SLIDE 8
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 8

Secret share then authenticate

But we want to multiply!

slide-9
SLIDE 9
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 9

Let’s do it – what do we need?

Dragos Rotaru 9

slide-10
SLIDE 10
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 10

Let’s do it – what do we need?

Dragos Rotaru 10

slide-11
SLIDE 11
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 11

Let’s do it – what do we need?

Dragos Rotaru 11

slide-12
SLIDE 12
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 12

Let’s do it – what do we need?

Dragos Rotaru 12

slide-13
SLIDE 13
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 13

What we have done

13

Fastest triple generation!

slide-14
SLIDE 14
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 14

How to multiply shared inputs with triples (Beaver’s Trick)

slide-15
SLIDE 15
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 15

How to multiply shared inputs with triples (Beaver’s Trick)

slide-16
SLIDE 16
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 16

Revisit, improve, revisit…

SPDZ-1 (DPSZ’12) SPDZ-2 (DKL+’13) MASCOT (KOS’16) BDOZa (BDOZ’11)

Semi-homomorphic encryption Depth-1 SHE (Dedicated BGV) Depth-1 SHE (NTL), ZK Proof

Triple Sacrificing technique

slide-17
SLIDE 17
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 17

Revisit, improve, revisit…

SPDZ-1 (DPSZ’12) SPDZ-2 (DKL+’13) MASCOT (KOS’16) BDOZa (BDOZ’11)

Semi-homomorphic encryption Depth-1 SHE (Dedicated BGV) Depth-1 SHE (NTL), ZK Proof

Triple Sacrificing technique High Gear Low Gear

slide-18
SLIDE 18
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 18

Revisit, improve, revisit…

SPDZ-1 (DPSZ’12) SPDZ-2 (DKL+’13) MASCOT (KOS’16) BDOZa (BDOZ’11)

Semi-homomorphic encryption Depth-1 SHE (Dedicated BGV) Depth-1 SHE (NTL), ZK Proof

Triple Sacrificing technique High Gear Low Gear

slide-19
SLIDE 19
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 19

LAN Timings

slide-20
SLIDE 20
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 20

LAN Timings

slide-21
SLIDE 21
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 21

Revisit, improve, revisit…

SPDZ-1 (DPSZ’12) SPDZ-2 (DKL+’13) MASCOT (KOS’16) BDOZa (BDOZ’11)

Semi-homomorphic encryption Depth-1 SHE (Dedicated BGV) Depth-1 SHE (NTL), ZK Proof

Triple Sacrificing technique High Gear Low Gear

slide-22
SLIDE 22
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 22

SPDZ-1 recap

Enc(a[1]) Enc(b[1]) Enc(a[2]) Enc(b[2]) Enc(a[3]) Enc(b[3])

slide-23
SLIDE 23
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 23

SPDZ-1 recap

Enc(a[1]) Enc(b[1]) Enc(a[2]) Enc(b[2]) Enc(a[3]) Enc(b[3])

slide-24
SLIDE 24
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 24

SPDZ-1 recap

Enc(a[1]) Enc(b[1]) Enc(a[2]) Enc(b[2]) Enc(a[3]) Enc(b[3]) C =

slide-25
SLIDE 25
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 25

SPDZ-1 recap

Enc(a[1]) Enc(b[1]) Enc(a[2]) Enc(b[2]) Enc(a[3]) Enc(b[3]) C[1] C[2] C[3]

+ +

C =

=

C

  • Parties may lie about their plaintext - incorrect decryption,

reveal info about secret keys.

  • Need to add ZK proofs for bounding the plaintext
slide-26
SLIDE 26
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 26

How to 0-knowledge

I know my eX! Not sure. Let’s verify!

Prover: x Verifier: f(x)

Commitment f’(r) Challenge: E Response: r+E(x)

slide-27
SLIDE 27
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 27

How to 0-knowledge

I know my eX!

I have negligible doubts.

Prover: x Verifier: f(x)

Commitment f’(r) Challenge: E Response: r+E(x)

  • f’(r+E(x)) = f’(r)+E(f(x))
  • r+E(x) is bounded
  • r >> x, r/x is called slack
slide-28
SLIDE 28
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 28

To slack or not to slack

  • ZKPoPk: to prove that x < B we need an encryption scheme

which supports plaintexts < B * slack Slack is:

  • ~2^50 for 40-bit security
  • ~2^100 for 128-bit security

Well, that’s a big ciphertext.

slide-29
SLIDE 29
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 29

To slack or not to slack

  • ZKPoPk: to prove that x < B we need an encryption scheme

which supports plaintexts < B * slack Slack is:

  • ~2^50 for 40-bit security
  • ~2^100 for 128-bit security
  • Improve the ZK slack analysis.
  • With depth-1 BGV the slack becomes tiny tiny because
  • f the modulus switching.

Well, that’s a big ciphertext.

slide-30
SLIDE 30
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 30

Some ciphertexts need no slack

slide-31
SLIDE 31
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 31

High Gear: SPDZ-1 with global proof

V(P(Alice) +P(Bob)) V(P(Bob)) V(P(Charlie) V(P(Alice)) V(P(Charlie)) V(P(Alice)) V(P(Bob)) V(P(Bob)+P(Charlie)) V(P(Alice)+P(Charlie))

slide-32
SLIDE 32
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 32

High Gear: SPDZ-1 with global proof

slide-33
SLIDE 33
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 33

Low Gear vs High Gear, the tipping point

224k Triples/s

64 CPUs, 488Gb RAM, 25Gb Network

6 parties

slide-34
SLIDE 34
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 34

100 party Vickrey Auction

AWS m3.2xlarge 8 CPUs, 30Gb RAM, 10Gb Network

slide-35
SLIDE 35
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 35

Code lives on the internetz

https://github.com/bristolcrypto/SPDZ-2

  • In the Low Gear protocol we assumed semi-

homomorphic BGV is a linear only encryption scheme.

  • Can you create ciphertexts which decrypt to non-linear

plaintexts without the KS info? Known as linear target malleability [BCI+13] or linear only encryption [BISW17].

Open problem alert:

slide-36
SLIDE 36
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 36

Thank you!

slide-37
SLIDE 37
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 37

  • Questions?

Thank you!

slide-38
SLIDE 38
  • M. Keller, V. Pastro, Dragos Rotaru

imec-Cosic, Dept. Electrical Engineering 38

  • SCALE (Secure Computation Algorithms from Leuven)
  • We do a better analysis of the ZK proofs involved.
  • Pre-processing phase coupled with the online phase.
  • Compiler is documented, people can read how to use it.
  • Others bells and whistles.

Tiny advert: SCALE at TPMPC