SLIDE 1
Privacy-Preserving Outsourcing by Distributed Verifiable Computation
Meilof Veeningen
Philips Research MPC 2016, Aarhus, May 30 2016
Philips Research
2
Privacy-Preserving Outsourcing by Distributed Verifiable - - PowerPoint PPT Presentation
Privacy-Preserving Outsourcing by Distributed Verifiable - - PowerPoint PPT Presentation
Privacy-Preserving Outsourcing by Distributed Verifiable Computation Meilof Veeningen Philips Research MPC 2016, Aarhus, May 30 2016 2 Philips Research 3 Philips Research 4 Philips Research 5 Philips Research 6 Philips Research
SLIDE 2
SLIDE 3
Philips Research
3
SLIDE 4
Philips Research
4
SLIDE 5
Philips Research
5
SLIDE 6
Philips Research
6
SLIDE 7
Outsourcing Computations on Sensitive Data (I)
Philips Research
7
x f(x) privacy? correctness?
SLIDE 8
Outsourcing Computations on Sensitive Data (I)
Philips Research
8
π¦ " π¦ # π¦ $
secure multiparty computation
π(π¦) $ π(π¦) # π(π¦) "
Jakobsen, Nielsen, Orlandi (CCSW β14): privacy and correctness with π β 1 actively corrupted workers
Can we achieve correctness even if all workers are corrupted?
SLIDE 9
Outsourcing & Correctness (But No Privacy)
Philips Research
9
SLIDE 10
Privacy + Correctness: A Generic Construction
Philips Research
10
π¦ " π¦ # π¦ $ π§ = π(π¦) $ π§ = π(π¦) # π§ = π(π¦) " π§,Proof(π§ = π π¦ ) $ π§, Proof(π§ = π π¦ ) # π§, Proof(π§ = π π¦ ) "
Question: can we efficiently construct these proofs with multi-party computation? Privacy: same as MPC protocol used Correctness: always!
SLIDE 11
Privacy + Correctness: Previous Work
Philips Research
11
- penings
Publicly Auditable SPDZ (Baum/DamgΓ₯rd/Orlandi) Preprocessing π¦ , π§ , π¦π§ +π3, π4, π34 Universally Verifiable CDN (de Hoogh/Schoenmakers/V.) ZK NIZK Certificate Validation β¦ (de Hoogh/Schoenmakers/V.) Paillier ElGamal Verification effort scales in computation size! Reason: existing work takes MPC as starting point!
SLIDE 12
Privacy + Correctness: Previous Work
Philips Research
12
- Instead of π§, Proof(π§ = π π¦ ) ":
β Baum/DamgΓ₯rd/Orlandi: SPDZ + Pedersen commitments = SPDZβ β de Hoogh/Schoenmakers/Veeningen: CDN + non-interactive proofs = CDNβ β de Hoogh/Schoenmakers/Veeningen: CDNβ + ElGamal encryption = CDNββ
- Because of MPC starting point, no efficient verification!
SLIDE 13
Today: π§, Proof(π§ = π π¦ ) can be efficient!
Philips Research
13
π¦ " π¦ # π¦ $ π§, PinocchioVC(π§ = π π¦ ) $ π§, PinocchioVC(π§ = π π¦ ) # π§, PinocchioVC(π§ = π π¦ ) "
- Theorem. (Schoenmakers/V/de
Vreede, ACNS β16) Privacy-preserving computation of Pinocchio VC: three workers each perform essentially the work of the original prover.
- Corollary. Verifiable Multi-Party
Computation with constant-time verification!
SLIDE 14
Outline
- Secret sharing MPC
- Pinocchio VC
- Secret sharing MPC + Pinocchio VC
Philips Research
14
SLIDE 15
Philips Research
15
Secret sharing MPC
SLIDE 16
Shamir secret sharing (2-out-of-3)
Philips Research
16
(3,π§< + π¨<) (2,π§@ + π¨@) (1,π§A + π¨A) π‘$ + π‘" π‘$ π§A π§@ π§< 1 2 3 π‘" (1,π§A) (2,π§@) (3, π§<) (1, π¨A) (2, π¨@) (3, π¨<) (1,π§Aπ¨A) (2,π§@π¨@) (3,π§<π¨<) π½π‘$ (1,π½π§D) (2,π½π§E) (3,π½π§F) π§ = ππ¦ + π‘$ ππ¦ + π‘" = ππ π¦" + ππ‘" + ππ‘$ π¦ + π‘$π‘" s$s" = 3(π§Dπ¨D) β 3(π§Eπ¨E) + (π§Fπ¨F) (3-out-of-3 sharing!) Animation: Sebastiaan de Hoogh
SLIDE 17
, π‘π’(π‘ + π’) π‘π’(π‘ + π’) $ π‘π’(π‘ + π’) " π‘π’(π‘ + π’) # π‘π’(π‘ + π’) $ π‘π’(π‘ + π’) " π‘π’(π‘ + π’) # π‘ + π’ $ π‘ + π’ " π‘ + π’ # π‘π’ $ π‘π’ " π‘π’ # π‘π’ # " π‘π’ # $ π‘π’ " $ π‘π’ " $ π‘π’ $ " π‘π’ $ # π‘π’ $ π‘π’ " π‘π’ # π‘ $, π’ $ π‘ ", π’ " π‘ #, π’ # π‘ $, π’ $ π‘ ", π’ " π‘ #, π’ # Goal: compute π§ = π‘ β π’ β (π‘ + π’) π¦ : 2-out-of-3 sharing of π¦ π¦ : 3-out-of-3 sharing of π¦ π‘, π’
Philips Research
17
MPC based on Shamir secret sharing
π‘π’ = 3 π‘π’ $ β 3 π‘π’ " + π‘π’ # π‘π’ M = 3 π‘π’ $ M β 3 π‘π’ " M + π‘π’ # M
SLIDE 18
Philips Research
18
Pinocchio VC
SLIDE 19
Pinocchio: Quadratic Arithmetic Programs
Prove that committed π¦ β satisfies equations π β π¦ β β π β π¦ β = (π β π¦ β) Example: π§ = π‘ β π’ β π‘ + π’ if and only if: βπ¨ βΆ Uπ‘ β π’ = π¨ π¨ β (π‘ + π’) = π§ 1 1 0 β π‘ π’ π¨ π§ β 0 1 1 1 0 β π‘ π’ π¨ π§ = 0 1 1 β π‘ π’ π¨ π§ E.g.: π‘ π’ π§ π¨ = 3 2 6 30 is a solution
Philips Research
19
βquadratic arithmetic programβ (QAP)
SLIDE 20
Pinocchio: From QAP to SNARK (I)
Philips Research
20
Prove that committed π¦ β satisfies equations π β π¦ β β π β π¦ β = π β π¦ β . Define πM π ,π
M π ,π M π by βcolumnwiseLagrange interpolationβ
1 1 0 β π‘ π’ π¨ π§ β 0 1 1 1 0 β π‘ π’ π¨ π§ = 0 1 1 β π‘ π’ π¨ π§ π$ 1 = 1, π$ 2 = 0 π$ π = 2 β π π
" 1 = 1, π " 2 = 1
π
" π = 1
β¦
value at 1 value at 2 Consider polynomial π3
β π = π$ π π‘+ π" π π’ + β― β π $ π π‘ + β― β π $ π π‘ + β― :
- In π = 1: π3
β 1 = π$ 1 π‘ + π" 1 π’ + β― β π $ 1 π‘ + β― β π $ 1 π‘ + β―
= π‘ β π’ β π¨
- In π = 2: π3
β 2 = π$ 1 π‘ + π" 1 π’ + β― β π $ 1 π‘ + β― β π $ 1 π‘ + β―
= π¨ β π‘ + π’ β π§ So π β π¦ β β π β π¦ β = π β π¦ β if and only if π3
β 1 = π3 β 2 = 0
if and only if π β 1 β π β 2 | π π if and only if there exists β π : π β 1 β π β 2 β β π = π3
β π
SLIDE 21
Pinocchio: From QAP to SNARK (II)
Philips Research
21
Example. 1 1 0 β π‘ π’ π¨ π§ β 0 1 1 1 0 β π‘ π’ π¨ π§ = 0 1 1 β π‘ π’ π¨ π§ π
$ π = π # π = 2 β π
π
" π = π ` π = π # π = π ` π = π $ π = π " π = 0
π
# π = π $ π = π ` π = π β 1
π
" π = 1
value at 1 value at 2 Claim: π‘ π’ π¨ π§ is solution iff there exists β π such that π β 1 π β 2 β π = π‘π
$ π + π’π " π + π¨π # π + π§π ` π
β π‘π
$ π + π’π " π + π¨π # π + π§π ` π
β π‘π
$ π + π’π " π + π¨π # π + π§π ` π
Claim: 3 2 6 30 is solution iff there exists β π such that π β 1 π β 2 β π = 3π
$ π + 2π " π + 6π # π + 30π ` π
β 3π
$ π + 2π " π + 6π # π + 30π ` π
β 3π
$ π + 2π " π + 6π # π + 30π ` π
Claim: 3 2 6 30 is solution iff there exists β π such that π β 1 π β 2 β π = 3π β 3π β 1 β 24π β 18 Claim: 3 2 6 30 is solution iff there exists β π such that π β 1 π β 2 β π = 9π" β 27π + 18
SLIDE 22
Pinocchio: From QAP to SNARK (III)
Lemma β 3 2 6 30 is solution iff there exists β π such that π β 1 π β 2 β π = 9π" β 27π + 18
Philips Research
22
9π" β 27π + 18 π" β 3π + 2 9 (π" β 3π + 2) 9 β β π = 9
SLIDE 23
Pinocchio: From QAP to SNARK (IV)
Philips Research
23
verification key: π fg$ β β¦β fgh prover: πi f prover/verifier: πj
k f 3klβ―
prover/verifier: πm
k f 3klβ―
prover/verifier: πn
k f 3klβ―
evaluation key: π, πf, πfo,β¦ evaluation/verification key: πjp(f),πmp(f), πn
p(f)
π πr πs π πr,πs = π(πt, πh) iff π β π = π β π π πt πh Magic crypto tool: pairing verifier: π π fg$ β β¦β fgh ,πi f = π πj
k f 3klβ―,πm k f 3klβ― β π πn k f 3klβ―,π
g$ ?
Ξ β 1 β β¦β Ξ β π β β Ξ = π
$ Ξ π¦$ + β―
β π
$ Ξ π¦$ + β― β π $ Ξ π¦$ + β―
β 1 π β 1 β β¦β π β π β β π = π
$ π π¦$ + β― β π $ π π¦$ + β― β π $ π π¦$ + β― β 1
Ξ: random, unknown Prove:
SLIDE 24
Pinocchio: From QAP to SNARK (V)
Philips Research
24
π‘, π’
- evaluate function: get π¨, π§
- compute πj
x f y, πm x f y, πn x f y
- compute β π = j z m z gn z
zg$ β β¦β (zgh)
- compute πi f
verify: π π fg$ β β¦β fgh , πi f = π(πj
k f {lj
- f |lj
} f 4 β πj x f y,
πm
k f {lm
- f |lm
} f 4 β πm x f y) β
π πn
k f {ln
- f |ln
} f 4 β πn x f y,π
g$
π§, πi f , πj
x f y,πm x f y, πn x f y
evaluation key: π, πf, πfo,β¦ πj
x f ,πm x f , πn x f
verification key: π fg$ β β¦β fgh πj
k f ,πm k f ,πn k f
πj
- f ,πm
- f ,πn
- f
πj
} f , πm } f , πn } f
SLIDE 25
Philips Research
25
Pinocchio VC Secret sharing MPC +
SLIDE 26
Trinocchio: Distributing the Pinocchio System (I)
Philips Research
26
- evaluate function: get π¨, π§
- compute πj
x f y, πm x f y, πn x f y
- compute β π = j z m z gn z
zg$ β β¦β (zgh)
- compute πi f
π‘, π’ π§, πi f , πj
x f y,πm x f y, πn x f y
π‘ , π’ π§ , πi f , πj
x f y , πm x f y , πn x f y
SLIDE 27
Trinocchio: Distributing the Pinocchio System (II)
Philips Research
27
prove π,πf, πfo,β¦,πj
x f ,πm x f , πn x f ,π‘, π’ :
π¨, π§ = π(π‘, π’) πj
x f y = exp
(πj
x f ,π¨)
πm
x f y = exp
(πm
x f ,π¨)
πn
x f y = exp(πn x f ,π¨)
π π = π
$ π π‘ + π " π π’ + π # π π¨ + π ` π π§ β π $ π π‘ + β―
β π
$ π π‘ + β―
β π =
β z zg$ β β¦β zgh
πi f = exp π, βΖ β exp πf,β$ β β¦β exp (πfββ¦k,βhg$) return π§, πi f , πj
x f y,πm x f y, πn x f y
SLIDE 28
Trinocchio: Distributing the Pinocchio System (II)
Philips Research
28
return π§ , πi f , πj
x f y , πm x f y , πn x f y
return π§, πi f , πj
x f y,πm x f y, πn x f y
πi f = exp π, βΖ β exp πf, β$ β β¦β exp (πfββ¦k, βhg$ ) πi f = exp π, βΖ β exp πf,β$ β β¦β exp (πfββ¦k,βhg$) β π =
β z zg$ β β¦β zgh
β π =
β z zg$ β β¦β zgh
Products of 2-out-of-3 shares give 3-out-of-3 shares π π = π
$ π
π‘ + π
" π
π’ + π
# π
π¨ + π
` π
π§ β π
$ π
π‘ + β― β π
$ π
π‘ + β― π π = π
$ π π‘ + π " π π’ + π # π π¨ + π ` π π§ β π $ π π‘ + β― β π $ π π‘ + β―
πn
x f y = exp(πn x f , π¨ )
πm
x f y = exp
(πm
x f , π¨ )
πj
x f y = exp
(πj
x f , π¨ )
πn
x f y = exp(πn x f ,π¨)
πm
x f y = exp
(πm
x f ,π¨)
πj
x f y = exp
(πj
x f ,π¨)
MPC computation of π gives internal wire values βfor freeβ π¨ , π§ = π( π‘ , π’ ) π¨, π§ = π(π‘, π’) prove π,πf, πfo,β¦,πj
x f ,πm x f , πn x f , π‘ , π’ :
prove π, πf, πfo, β¦,πj
x f ,πm x f , πn x f ,π‘, π’ :
Division by public polynomial is linear! Shamir reconstruction βin the exponentβ Only step in which the workers communicate!
SLIDE 29
Trinocchio: Distributing the Pinocchio System (III)
Philips Research
29
π§ , π π¦ β π¦ β π¦ β π‘ , π’
- Theorem. Privacy-preserving
computation of Pinocchio VC: three workers each perform essentially the work of the original prover. 275 s 275 s 275 s 6427 s 6427 s 6427 s 0.05 s
SLIDE 30
Extensions / Future Directions
Philips Research
30
π β π = 1
π = πΆ
$ + 2πΆ" +
β¦ + 2ΕπΆΕ 1 = πΆ
$ β 1 β πΆ $
β¦ 1 = πΆΕ β 1 β πΆΕ
QAP MPC nonzero test positivity test π ββ’ β± π = ππππ( ππ ) π = πg$ π πΆ$ , β¦, πΆ$ = πΆππ’πΈππ( π ) β¦
- Multiple inputters
- Auditable MPC
- Verifiability by certificate validation
- QAPs + MPC for particular tasks?
β Zero testing β Comparison β β¦
- Easily programmable distributed
verifiable computation
SLIDE 31