SLIDE 1
Preprocessing Based Verification
- f Multiparty Protocols
with an Honest Majority 20.07.17
Peeter Laud Alisa Pankova Roman Jagomägis
1 / 10
Secure Multiparty Computation
2 / 10
Preprocessing Based Verification of Multiparty Protocols with an - - PowerPoint PPT Presentation
Preprocessing Based Verification of Multiparty Protocols with an - - PowerPoint PPT Presentation
Preprocessing Based Verification of Multiparty Protocols with an Honest Majority 20.07.17 Alisa Pankova Roman Jagomgis Peeter Laud 1 / 10 Secure Multiparty Computation 2 / 10 Secure Multiparty Computation 2 / 10 Secure Multiparty
SLIDE 2
SLIDE 3
Secure Multiparty Computation
2 / 10
SLIDE 4
Secure Multiparty Computation
2 / 10
SLIDE 5
Secure Multiparty Computation
2 / 10
SLIDE 6
Secure Multiparty Computation
◮ Passive adversary: all parties follow the protocol.
2 / 10
SLIDE 7
Secure Multiparty Computation
◮ Passive adversary: all parties follow the protocol. ◮ Active adversary: corrupted parties may cheat.
2 / 10
SLIDE 8
Secure Multiparty Computation
◮ Passive adversary: all parties follow the protocol. ◮ Active adversary: corrupted parties may cheat.
2 / 10
SLIDE 9
Secure Multiparty Computation
◮ Passive adversary: all parties follow the protocol. ◮ Active adversary: corrupted parties may cheat.
2 / 10
SLIDE 10
Secure Multiparty Computation
◮ Passive adversary: all parties follow the protocol. ◮ Active adversary: corrupted parties may cheat.
2 / 10
SLIDE 11
Secure Multiparty Computation
◮ Passive adversary: all parties follow the protocol. ◮ Active adversary: corrupted parties may cheat. ◮ Covert adversary: will not cheat if it will be caught.
2 / 10
SLIDE 12
Verifiable MPC with Honest Majority
◮ Execution: run the passively secure protocol.
3 / 10
SLIDE 13
Verifiable MPC with Honest Majority
◮ Execution: run the passively secure protocol. ◮ Verification: each party proves that it followed the protocol.
3 / 10
SLIDE 14
Verifiable MPC with Honest Majority
◮ Preprocessing: generate correlated randomness. ◮ Execution: run the passively secure protocol. ◮ Verification: each party proves that it followed the protocol.
3 / 10
SLIDE 15
Verifiable MPC with Honest Majority
◮ Preprocessing: generate correlated randomness. ◮ Execution: run the passively secure protocol. ◮ Verification: each party proves that it followed the protocol.
3 / 10
SLIDE 16
Execution Phase
◮ Run the initial passively secure protocol. ◮ Each message m is provided with a sender’s signature σm.
4 / 10
SLIDE 17
Execution Phase
◮ Run the initial passively secure protocol. ◮ Each message m is provided with a sender’s signature σm.
4 / 10
SLIDE 18
Execution Phase
◮ Run the initial passively secure protocol. ◮ Each message m is provided with a sender’s signature σm.
4 / 10
SLIDE 19
Execution Phase
◮ Run the initial passively secure protocol. ◮ Each message m is provided with a sender’s signature σm. ◮ If Alice refuses to send (m, σm) Bob asks Chris to deliver it. ◮ If Alice or Bob is corrupt, (m, σm) is already known to the
attacker anyway.
4 / 10
SLIDE 20
Verification phase
Each party (the prover P) proves its honesty to the other parties (the verifiers V1 and V2) . All relevant values of P are shared among V1 and V2:
◮ Message m:
m + 0 or 0 + m
◮ Input x:
x1 + x2
◮ Correlated randomness r:
r1 + r2 known by P, shared in the preprocessing phase. All shares are signed by the prover.
5 / 10
SLIDE 21
Verification phase (reproducing computation of P)
6 / 10
SLIDE 22
Verification phase (reproducing computation of P)
◮ P takes precomputed correlated randomness
(e.g. Beaver triples (a, b, c) s.t. c = a · b).
6 / 10
SLIDE 23
Verification phase (reproducing computation of P)
◮ P takes precomputed correlated randomness
(e.g. Beaver triples (a, b, c) s.t. c = a · b).
◮ P sends hints to V1 and V2.
6 / 10
SLIDE 24
Verification phase (reproducing computation of P)
◮ P takes precomputed correlated randomness
(e.g. Beaver triples (a, b, c) s.t. c = a · b).
◮ P sends hints to V1 and V2. ◮ V1 and V2 use the hints to reproduce computation of P.
6 / 10
SLIDE 25
Verification phase (reproducing computation of P)
◮ P takes precomputed correlated randomness
(e.g. Beaver triples (a, b, c) s.t. c = a · b).
◮ P sends hints to V1 and V2. ◮ V1 and V2 use the hints to reproduce computation of P. ◮ V1 and V2 verify the hints.
6 / 10
SLIDE 26
Verification phase (reproducing computation of P)
◮ P takes precomputed correlated randomness
(e.g. Beaver triples (a, b, c) s.t. c = a · b).
◮ P sends hints to V1 and V2. ◮ V1 and V2 use the hints to reproduce computation of P. ◮ V1 and V2 verify the hints. ◮ V1 and V2 check if they get committed messages of P.
6 / 10
SLIDE 27
Verification phase (reproducing computation of P)
◮ P takes precomputed correlated randomness
(e.g. Beaver triples (a, b, c) s.t. c = a · b).
◮ P sends hints to V1 and V2. ◮ V1 and V2 use the hints to reproduce computation of P. ◮ V1 and V2 verify the hints. ◮ V1 and V2 check if they get committed messages of P.
6 / 10
SLIDE 28
Verification phase (checking if z = 0)
◮ V1 and V2 exchange h1 = H(z1) and h2 = H(−z2),
and check h1 = h2.
7 / 10
SLIDE 29
Verification phase (checking if z = 0)
◮ V1 and V2 exchange h1 = H(z1) and h2 = H(−z2),
and check h1 = h2.
◮ If h1 = h2, they send h1 and h2 to P.
7 / 10
SLIDE 30
Verification phase (checking if z = 0)
◮ V1 and V2 exchange h1 = H(z1) and h2 = H(−z2),
and check h1 = h2.
◮ If h1 = h2, they send h1 and h2 to P. ◮ P has right to complain against one verifier (e.g V1).
7 / 10
SLIDE 31
Verification phase (checking if z = 0)
◮ V1 and V2 exchange h1 = H(z1) and h2 = H(−z2),
and check h1 = h2.
◮ If h1 = h2, they send h1 and h2 to P. ◮ P has right to complain against one verifier (e.g V1). ◮ V1 opens its shares of P commitments with all signatures.
7 / 10
SLIDE 32
Verification phase (checking if z = 0)
◮ V1 and V2 exchange h1 = H(z1) and h2 = H(−z2),
and check h1 = h2.
◮ If h1 = h2, they send h1 and h2 to P. ◮ P has right to complain against one verifier (e.g V1). ◮ V1 opens its shares of P commitments with all signatures. ◮ V2 repeats the computation of V1, getting h1.
7 / 10
SLIDE 33
Preprocessing Phase
◮ The prover P generates correlated randomness
(e.g. Beaver triples in a certain ring Zm).
8 / 10
SLIDE 34
Preprocessing Phase
◮ The prover P generates correlated randomness
(e.g. Beaver triples in a certain ring Zm).
◮ It additively shares the randomness among V1 and V2.
8 / 10
SLIDE 35
Preprocessing Phase
◮ The prover P generates correlated randomness
(e.g. Beaver triples in a certain ring Zm).
◮ It additively shares the randomness among V1 and V2. ◮ V1 and V2 run cut-and-choose and pairwise checks
to verify that correlation holds (e.g. that a · b = c).
8 / 10
SLIDE 36
Preprocessing Phase
◮ The prover P generates correlated randomness
(e.g. Beaver triples in a certain ring Zm).
◮ It additively shares the randomness among V1 and V2. ◮ V1 and V2 run cut-and-choose and pairwise checks
to verify that correlation holds (e.g. that a · b = c).
8 / 10
SLIDE 37
Preprocessing Phase (other preprocessed tuples)
◮ We also have other types of preprocessed tuples:
◮ Trusted bits b ∈ {0, 1} shared over Z2m. ◮ Characteristic vector tuple (r,
b) (i.e br = 0 iff i = r).
◮ Rotation tuple (r,
a, b) s.t the vector b is a rotated by r.
◮ Permutation tuple (π,
a, b) s.t b = π( a).
◮ Their generation and verification is analogous.
9 / 10
SLIDE 38
Summary
◮ We proposed a generic method for achieving covert
security under honest majority assumption.
◮ Applying it to Sharemind SMC platform, we get efficient
actively secure protocols with identifiable abort.
◮ The overhead of the execution phase is insignificant. ◮ In practice, the bottleneck of active security is generation
- f preprocessed tuples.
10 / 10