Secure Computation using Leaky Correlations (Asymptotically Optimal Constructions) Alexander R. Block 1 , Divya Gupta 2 , Hemanta K. Maji 1 , Hai H. Nguyen 1 1 Purdue University, {block9,hmaji,nguye245}@purdue.edu 2 Microsoft Research, Banaglore, India, divya.gupta@microsoft.com 1 / 21
Correlated Private Randomness (Correlation) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r B r A Phase 2 / 21
Correlated Private Randomness (Correlation) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r B r A Phase Online m Bob Phase 1 m Alice 2 2 / 21
Correlated Private Randomness (Correlation) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r A r B Phase Online m Bob Phase 1 m Alice 2 OT Example Parties can use ( r A , r B ) to generate multiple samples of Oblivious Transfer in an online protocol, which can then be used to securely compute any circuit. 2 / 21
Correlated Private Randomness (Correlation) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r B r A Phase Online m Bob Phase 1 m Alice 2 Notes The preprocessing phase is independent of the functionality or the inputs fed to the functionality by the parties. Secret shares ( r A , r B ) are vulnerable to arbitrary leakage attacks . 2 / 21
Correlated Private Randomness (Correlation) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r B r A Phase L Alice ( r B ) Online m Bob Phase 1 m Alice 2 Notes The preprocessing phase is independent of the functionality or the inputs fed to the functionality by the parties. Secret shares ( r A , r B ) are vulnerable to arbitrary leakage attacks . 2 / 21
Correlated Private Randomness (Correlation) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r A r B Phase L Bob ( r A ) Online m Bob Phase 1 m Alice 2 Questions Given such leakage attacks, how can we securely use the initial preprocessing? 2 / 21
Correlation Extractors (CorrExt) Introduced by Ishai, Kushilevitz, Ostrovsky, and Sahai at FOCS 2009 [IKOS09] to address leakage attacks Take leaky correlations as input and produce secure independent copies of oblivious transfer ( OT ) (or Randomized OT s) 3 / 21
( n, m, t, ε ) -Correlation Extractor for ( R A , R B ) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r A r B Phase 4 / 21
( n, m, t, ε ) -Correlation Extractor for ( R A , R B ) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r A r A r B r B Phase n -bits 4 / 21
( n, m, t, ε ) -Correlation Extractor for ( R A , R B ) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r A r A r B r B Phase n -bits sender corruption Leakage t -bit t -bit or Phase leakage leakage receiver corruption 4 / 21
( n, m, t, ε ) -Correlation Extractor for ( R A , R B ) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r A r A r B r B Phase n -bits sender corruption Leakage t -bit t -bit or Phase leakage leakage receiver corruption m Bob ε -Secure 1 Online Phase m Alice 2 4 / 21
( n, m, t, ε ) -Correlation Extractor for ( R A , R B ) ( r A , r B ) ∼ ( R A , R B ) Preprocessing r A r A r B r B Phase n -bits sender corruption Leakage t -bit t -bit or Phase leakage leakage receiver corruption m Bob ε -Secure 1 Online Phase m Alice 2 Fresh ROT · · · · · · · · · ROT 1 ROT 2 ROT m Output Phase 4 / 21
Correlation Extractors (CorrExt): which ( R A , R B ) ? Random Oblivious Transfer ( ROT ): m ( i ) 0 , m ( i ) $ 1 , c ( i ) ← { 0 , 1 } ROT n/ 2 ( m ( i ) 0 , m ( i ) ( c ( i ) , m ( i ) 1 ) ∈ { 0 , 1 } n c ( i ) ) ∈ { 0 , 1 } n 5 / 21
Correlation Extractors (CorrExt): which ( R A , R B ) ? Random Oblivious Transfer ( ROT ): m ( i ) 0 , m ( i ) $ 1 , c ( i ) ← { 0 , 1 } ROT n/ 2 ( m ( i ) 0 , m ( i ) ( c ( i ) , m ( i ) 1 ) ∈ { 0 , 1 } n c ( i ) ) ∈ { 0 , 1 } n � � Random Oblivious Linear-function Evaluation ( ROLE F ): $ a ( i ) , b ( i ) , x ( i ) ← F � n/ 2 � ROLE F ( a ( i ) , b ( i ) ) ∈ F n ( x ( i ) , z ( i ) ) ∈ F n z ( i ) := a ( i ) x ( i ) + b ( i ) 5 / 21
Correlation Extractors (CorrExt): which ( R A , R B ) ? Random Oblivious Transfer ( ROT ): m ( i ) 0 , m ( i ) $ 1 , c ( i ) ← { 0 , 1 } ROT n/ 2 ( m ( i ) 0 , m ( i ) ( c ( i ) , m ( i ) 1 ) ∈ { 0 , 1 } n c ( i ) ) ∈ { 0 , 1 } n � � Random Oblivious Linear-function Evaluation ( ROLE F ): $ a ( i ) , b ( i ) , x ( i ) ← F � n/ 2 � ROLE F ( a ( i ) , b ( i ) ) ∈ F n ( x ( i ) , z ( i ) ) ∈ F n z ( i ) := a ( i ) x ( i ) + b ( i ) � � Note ROT ≡ ROLE GF [2] since m c = ( m 1 − m 0 ) c + m 0 . 5 / 21
Prior Work and Our Contribution Result Correlation # m t ε ROT n/ 2 2 − Θ( n ) [IKOS09] Θ( n ) Θ( n ) 4 n ROT n/ 2 2 − gn/m ( 1 / 4 − g ) n 2 poly log n [GIMS15] 6 / 21
Prior Work and Our Contribution Result Correlation m t ε # ROT n/ 2 2 − Θ( n ) [IKOS09] Θ( n ) Θ( n ) 4 n ROT n/ 2 2 − gn/m ( 1 / 4 − g ) n 2 poly log n [GIMS15] 3 IP GF [2] n � 2 − gn � 1 ( 1 / 2 − g ) n 2 3 The inner-product correlation IP n / lg | K | � � K is a correlation in which each party n / lg | K | such that their vectors are orthogonal. gets a vector in K 6 / 21
Prior Work and Our Contribution Result Correlation m t ε # ROT n/ 2 2 − Θ( n ) [IKOS09] Θ( n ) Θ( n ) 4 n ROT n/ 2 2 − gn/m ( 1 / 4 − g ) n 2 poly log n [GIMS15] GF [2] n � � 2 − gn IP 1 ( 1 / 2 − g ) n 2 n / lg | K | � n 1 − o (1) 2 − gn � [BMN17] IP K ( 1 / 2 − g ) n 2 6 / 21
Prior Work and Our Contribution Result Correlation m t ε # ROT n/ 2 2 − Θ( n ) [IKOS09] Θ( n ) Θ( n ) 4 ROT n/ 2 2 − gn/m n / poly log n ( 1 / 4 − g ) n 2 [GIMS15] GF [2] n � 2 − gn � IP 1 ( 1 / 2 − g ) n 2 n / lg | K | � n 1 − o (1) 2 − gn [BMN17] � ( 1 / 2 − g ) n 2 IP K ROT n/ 2 Our Work � n / 2 lg | F | � ROLE F 7 / 21
Prior Work and Our Contribution Result Correlation m t ε # ROT n/ 2 2 − Θ( n ) [IKOS09] Θ( n ) Θ( n ) 4 ROT n/ 2 2 − gn/m n / poly log n ( 1 / 4 − g ) n 2 [GIMS15] GF [2] n � 2 − gn � IP 1 ( 1 / 2 − g ) n 2 n / lg | K | � n 1 − o (1) 2 − gn [BMN17] � ( 1 / 2 − g ) n 2 IP K ROT n/ 2 2 − Θ( n ) Θ( n ) Θ( n ) 2 Our Work � n / 2 lg | F | � 2 − Θ( n ) Θ( n ) Θ( n ) 2 ROLE F 7 / 21
Prior Work and Our Contribution Result Correlation m t ε # ROT n/ 2 2 − Θ( n ) [IKOS09] Θ( n ) Θ( n ) 4 ROT n/ 2 2 − gn/m n / poly log n ( 1 / 4 − g ) n 2 [GIMS15] GF [2] n � 2 − gn � 1 ( 1 / 2 − g ) n 2 IP � n / lg | K | � n 1 − o (1) 2 − gn [BMN17] ( 1 / 2 − g ) n 2 IP K ROT n/ 2 2 − Θ( n ) Θ( n ) Θ( n ) 2 Our Work � n / 2 lg | F | 2 − Θ( n ) � ROLE F Θ( n ) Θ( n ) 2 n / lg | K | � 2 − gn � [BMN18] IP K Θ( n ) ( 1 / 2 − g ) n 2 7 / 21
Prior Work and Our Contribution Result Correlation m t ε # ROT n/ 2 2 − Θ( n ) [IKOS09] Θ( n ) Θ( n ) 4 ROT n/ 2 2 − gn/m n / poly log n ( 1 / 4 − g ) n 2 [GIMS15] GF [2] n � 2 − gn � 1 ( 1 / 2 − g ) n 2 IP � n / lg | K | � n 1 − o (1) 2 − gn [BMN17] ( 1 / 2 − g ) n 2 IP K ROT n/ 2 2 − Θ( n ) Θ( n ) Θ( n ) 2 Our Work � n / 2 lg | F | 2 − Θ( n ) � ROLE F Θ( n ) Θ( n ) 2 n / lg | K | � 2 − gn � [BMN18] IP K Θ( n ) ( 1 / 2 − g ) n 2 Notes In an ongoing work, we reduce the communication complexity of our extractors from Θ( n log n ) to Θ( n ) . 7 / 21
Main Results Theorem (Asymptotically Optimal Correlation Extractor for ROT ) ∃ a 2-message ( n, m, t, ε ) -correlation extractor for ROT n/ 2 such that ε = 2 − Θ( n ) m = Θ( n ) t = Θ( n ) 8 / 21
Main Results Theorem (Asymptotically Optimal Correlation Extractor for ROT ) ∃ a 2-message ( n, m, t, ε ) -correlation extractor for ROT n/ 2 such that ε = 2 − Θ( n ) m = Θ( n ) t = Θ( n ) The technical heart of this theorem is another correlation extractor for � � . ROLE F 8 / 21
Main Results Theorem (Asymptotically Optimal Correlation Extractor for ROT ) ∃ a 2-message ( n, m, t, ε ) -correlation extractor for ROT n/ 2 such that ε = 2 − Θ( n ) m = Θ( n ) t = Θ( n ) The technical heart of this theorem is another correlation extractor for � � . ROLE F Theorem (Asymptotically Optimal Correlation Extractor for � � ROLE F ) For all large enough constant sized fields F ( e.g., | F | = 64) � n/ 2 lg | F | � ∃ a 2-message ( n, m, t, ε ) -correlation extractor for ROLE F such that ε = 2 − Θ( n ) m = Θ( n ) t = Θ( n ) 8 / 21
Comparison of Concrete Efficiency I � � We compare our CorrExt for ROLE F with the [BMN17] CorrExt for � n / lg | K | � . IP K 9 / 21
Comparison of Concrete Efficiency I � � We compare our CorrExt for ROLE F with the [BMN17] CorrExt for � n / lg | K | � . IP K The [BMN17] CorrExt achieves highest production rate when 2 n/ 4 � 4 � � � using IP GF , and achieves leakage rate t/n = (1 / 4 − g ) . 2 16 � � � � We shall use ROLE for F = GF as a comparison. F 9 / 21
Recommend
More recommend
