SLIDE 1
Secure Multi-Party Computation
Lecture 15
Secure Multi-Party Computation Lecture 15 Must We Trust ? - - PowerPoint PPT Presentation
Secure Multi-Party Computation Lecture 15 Must We Trust ? - - PowerPoint PPT Presentation
Secure Multi-Party Computation Lecture 15 Must We Trust ? Must We Trust ? Can we have an auction without an auctioneer?! Must We Trust ? Can we have an auction without an auctioneer?! Must We Trust ? Can we
SLIDE 2
SLIDE 3
Can we have an auction without an auctioneer?!
Must We Trust ?
SLIDE 4
Can we have an auction without an auctioneer?!
Must We Trust ?
SLIDE 5
Can we have an auction without an auctioneer?!
Must We Trust ?
SLIDE 6
Can we have an auction without an auctioneer?!
Declared winning bid should be correct
Must We Trust ?
SLIDE 7
Can we have an auction without an auctioneer?!
Declared winning bid should be correct Only the winner and winning bid should be revealed
Must We Trust ?
SLIDE 8
Using data without sharing?
SLIDE 9
Hospitals which can’t share their patient records with anyone
Using data without sharing?
SLIDE 10
Hospitals which can’t share their patient records with anyone
But want to data-mine
- n combined data
Using data without sharing?
Data Mining Tool
SLIDE 11
X1 X4 X3 X2
f(X1, X2, X3, X4)
Secure Function Evaluation
SLIDE 12
A general problem
X1 X4 X3 X2
f(X1, X2, X3, X4)
Secure Function Evaluation
SLIDE 13
A general problem To compute a function
- f private inputs
without revealing information about the inputs
X1 X4 X3 X2
f(X1, X2, X3, X4)
Secure Function Evaluation
SLIDE 14
A general problem To compute a function
- f private inputs
without revealing information about the inputs
Beyond what is revealed by the function
X1 X4 X3 X2
f(X1, X2, X3, X4)
Secure Function Evaluation
SLIDE 15
Poker With No Dealer?
SLIDE 16
Poker With No Dealer?
SLIDE 17
Need to ensure
Poker With No Dealer?
SLIDE 18
Need to ensure
Cards are shuffled and dealt correctly
Poker With No Dealer?
SLIDE 19
Need to ensure
Cards are shuffled and dealt correctly Complete secrecy
Poker With No Dealer?
SLIDE 20
Need to ensure
Cards are shuffled and dealt correctly Complete secrecy No “cheating” by players, even if they collude
Poker With No Dealer?
SLIDE 21
Need to ensure
Cards are shuffled and dealt correctly Complete secrecy No “cheating” by players, even if they collude
No universally trusted dealer
Poker With No Dealer?
SLIDE 22
The Ambitious Goal
SLIDE 23
Without any trusted party, securely do
Distributed Data mining E-commerce Network Games E-voting Secure function evaluation ....
The Ambitious Goal
SLIDE 24
Without any trusted party, securely do
Distributed Data mining E-commerce Network Games E-voting Secure function evaluation ....
The Ambitious Goal
Any Task!
SLIDE 25
Emulating Trusted Computation
SLIDE 26
Emulating Trusted Computation
Encryption/Authentication allowed us to emulate a trusted channel
SLIDE 27
Emulating Trusted Computation
Encryption/Authentication allowed us to emulate a trusted channel Secure MPC: to emulate a source of trusted computation
SLIDE 28
Emulating Trusted Computation
Encryption/Authentication allowed us to emulate a trusted channel Secure MPC: to emulate a source of trusted computation Trusted means it will not “leak” a party’ s information to others
SLIDE 29
Emulating Trusted Computation
Encryption/Authentication allowed us to emulate a trusted channel Secure MPC: to emulate a source of trusted computation Trusted means it will not “leak” a party’ s information to others And it will not cheat in the computation
SLIDE 30
A Simple example
An auction, with Alice and Bob bidding
SLIDE 31
A Simple example
An auction, with Alice and Bob bidding Rules: A bid is an integer in the range [0,100] Alice can bid only even integers and Bob odd integers Person with the higher bid wins
SLIDE 32
A Simple example
An auction, with Alice and Bob bidding Rules: A bid is an integer in the range [0,100] Alice can bid only even integers and Bob odd integers Person with the higher bid wins Goal: find out the winning bid (winner & amount) without revealing anything more about the losing bid (beyond what is revealed by the winning bid)
SLIDE 33
A Simple example
Secure protocol: Count down from 100 At each even round Alice announces whether her bid equals the current count; at each odd round Bob does the same Stop if a party says yes
SLIDE 34
A Simple example
Secure protocol: Count down from 100 At each even round Alice announces whether her bid equals the current count; at each odd round Bob does the same Stop if a party says yes Dutch flower auction
SLIDE 35
A Simple example
Secure protocol: Count down from 100 At each even round Alice announces whether her bid equals the current count; at each odd round Bob does the same Stop if a party says yes Dutch flower auction What kind of security does this protocol get? (Later: “stand-alone” security)
SLIDE 36
SIM-Secure MPC
proto proto
Env REAL
SLIDE 37
SIM-Secure MPC
proto proto
Env REAL
i’face i’face
Env IDEAL
SLIDE 38
SIM-Secure MPC
proto proto
Env REAL
i’face i’face
Env IDEAL
F
F
SLIDE 39
SIM-Secure MPC
Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL
proto proto
Env REAL
i’face i’face
Env IDEAL
F
F
SLIDE 40
SIM-Secure MPC
Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL
proto proto
Env REAL
i’face i’face
Env IDEAL
F
F
SLIDE 41
SIM-Secure MPC
Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL
proto proto
Env REAL
i’face i’face
Env IDEAL
F
F
SLIDE 42
Trust Issues Considered
SLIDE 43
Trust Issues Considered
Protocol may leak a party’ s secrets
SLIDE 44
Trust Issues Considered
Protocol may leak a party’ s secrets Clearly an issue -- even if we trust everyone not to cheat in our protocol (i.e., honest-but-curious)
SLIDE 45
Trust Issues Considered
Protocol may leak a party’ s secrets Clearly an issue -- even if we trust everyone not to cheat in our protocol (i.e., honest-but-curious) Also, a liability for a party if extra information reaches it
SLIDE 46
Trust Issues Considered
Protocol may leak a party’ s secrets Clearly an issue -- even if we trust everyone not to cheat in our protocol (i.e., honest-but-curious) Also, a liability for a party if extra information reaches it Say in medical data mining
SLIDE 47
Trust Issues Considered
Protocol may leak a party’ s secrets Clearly an issue -- even if we trust everyone not to cheat in our protocol (i.e., honest-but-curious) Also, a liability for a party if extra information reaches it Say in medical data mining Protocol may give adversary illegitimate influence on the
- utcome
SLIDE 48
Trust Issues Considered
Protocol may leak a party’ s secrets Clearly an issue -- even if we trust everyone not to cheat in our protocol (i.e., honest-but-curious) Also, a liability for a party if extra information reaches it Say in medical data mining Protocol may give adversary illegitimate influence on the
- utcome
Say in poker, if adversary can influence hands dealt
SLIDE 49
Trust Issues Considered
Protocol may leak a party’ s secrets Clearly an issue -- even if we trust everyone not to cheat in our protocol (i.e., honest-but-curious) Also, a liability for a party if extra information reaches it Say in medical data mining Protocol may give adversary illegitimate influence on the
- utcome
Say in poker, if adversary can influence hands dealt SIM security covers these concerns
SLIDE 50
Trust Issues Considered
Protocol may leak a party’ s secrets Clearly an issue -- even if we trust everyone not to cheat in our protocol (i.e., honest-but-curious) Also, a liability for a party if extra information reaches it Say in medical data mining Protocol may give adversary illegitimate influence on the
- utcome
Say in poker, if adversary can influence hands dealt SIM security covers these concerns Because IDEAL trusted entity would allow neither
SLIDE 51
Adversary
SLIDE 52
Adversary
REAL-adversary can corrupt any set of players
SLIDE 53
Adversary
REAL-adversary can corrupt any set of players In security requirement IDEAL-world adversary should corrupt the same set of players
SLIDE 54
Adversary
REAL-adversary can corrupt any set of players In security requirement IDEAL-world adversary should corrupt the same set of players i.e., environment gets to know the set of corrupt players
SLIDE 55
Adversary
REAL-adversary can corrupt any set of players In security requirement IDEAL-world adversary should corrupt the same set of players i.e., environment gets to know the set of corrupt players More sophisticated notion: adaptive adversary which corrupts players dynamically during/after the execution
SLIDE 56
Adversary
REAL-adversary can corrupt any set of players In security requirement IDEAL-world adversary should corrupt the same set of players i.e., environment gets to know the set of corrupt players More sophisticated notion: adaptive adversary which corrupts players dynamically during/after the execution We’ll stick to static adversaries
SLIDE 57
Adversary
REAL-adversary can corrupt any set of players In security requirement IDEAL-world adversary should corrupt the same set of players i.e., environment gets to know the set of corrupt players More sophisticated notion: adaptive adversary which corrupts players dynamically during/after the execution We’ll stick to static adversaries Passive vs. Active adversary: Passive adversary gets only read access to the internal state of the corrupted players. Active adversary overwrites their state and program.
SLIDE 58
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment)
SLIDE 59
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment) Also called “Honest-But-Curious” adversary
SLIDE 60
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment) Also called “Honest-But-Curious” adversary Will require that simulator also corrupts passively
SLIDE 61
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment) Also called “Honest-But-Curious” adversary Will require that simulator also corrupts passively Simplifies several cases
SLIDE 62
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment) Also called “Honest-But-Curious” adversary Will require that simulator also corrupts passively Simplifies several cases e.g. coin-tossing [why?], commitment [coming up]
SLIDE 63
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment) Also called “Honest-But-Curious” adversary Will require that simulator also corrupts passively Simplifies several cases e.g. coin-tossing [why?], commitment [coming up] Oddly, sometimes security against a passive adversary is more demanding than against an active adversary
SLIDE 64
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment) Also called “Honest-But-Curious” adversary Will require that simulator also corrupts passively Simplifies several cases e.g. coin-tossing [why?], commitment [coming up] Oddly, sometimes security against a passive adversary is more demanding than against an active adversary Active adversary: too pessimistic about what guarantee is available even in the IDEAL world
SLIDE 65
Passive Adversary
Gets only read access to the internal state of the corrupted players (and can use that information in talking to environment) Also called “Honest-But-Curious” adversary Will require that simulator also corrupts passively Simplifies several cases e.g. coin-tossing [why?], commitment [coming up] Oddly, sometimes security against a passive adversary is more demanding than against an active adversary Active adversary: too pessimistic about what guarantee is available even in the IDEAL world e.g. 2-party SFE for OR, with output going to only one party (trivial against active adversary; impossible without computational assumptions against passive adversary)
SLIDE 66
More Example Functionalities
SLIDE 67
More Example Functionalities
Can consider “arbitrary” functionalities
SLIDE 68
More Example Functionalities
Can consider “arbitrary” functionalities i.e., arbitrary (PPT) program of the trusted party to be emulated
SLIDE 69
More Example Functionalities
Can consider “arbitrary” functionalities i.e., arbitrary (PPT) program of the trusted party to be emulated Some simple (but important) examples:
SLIDE 70
More Example Functionalities
Can consider “arbitrary” functionalities i.e., arbitrary (PPT) program of the trusted party to be emulated Some simple (but important) examples: Secure Function Evaluation
SLIDE 71
More Example Functionalities
Can consider “arbitrary” functionalities i.e., arbitrary (PPT) program of the trusted party to be emulated Some simple (but important) examples: Secure Function Evaluation e.g. Finding max, Oblivious Transfer (coming up)
SLIDE 72
More Example Functionalities
Can consider “arbitrary” functionalities i.e., arbitrary (PPT) program of the trusted party to be emulated Some simple (but important) examples: Secure Function Evaluation e.g. Finding max, Oblivious Transfer (coming up) Can be randomized: e.g. Coin-tossing
SLIDE 73
More Example Functionalities
Can consider “arbitrary” functionalities i.e., arbitrary (PPT) program of the trusted party to be emulated Some simple (but important) examples: Secure Function Evaluation e.g. Finding max, Oblivious Transfer (coming up) Can be randomized: e.g. Coin-tossing “Reactive” functionalities (maintains state over multiple rounds)
SLIDE 74
More Example Functionalities
Can consider “arbitrary” functionalities i.e., arbitrary (PPT) program of the trusted party to be emulated Some simple (but important) examples: Secure Function Evaluation e.g. Finding max, Oblivious Transfer (coming up) Can be randomized: e.g. Coin-tossing “Reactive” functionalities (maintains state over multiple rounds) e.g. Commitment (coming up)
SLIDE 75
Commitment
SLIDE 76
Commitment
Commit now, reveal later
SLIDE 77
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
SLIDE 78
IDEAL World
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
SLIDE 79
IDEAL World
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
SLIDE 80
IDEAL World
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
SLIDE 81
IDEAL World
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
Really?
SLIDE 82
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
Really?
SLIDE 83
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
Really?
SLIDE 84
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
F
COM
Really?
SLIDE 85
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
F up up
Really?
SLIDE 86
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
F up up
“COMMIT”
Really?
SLIDE 87
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
F up up
“COMMIT”
commit
COMMIT:
F
m m
Really?
SLIDE 88
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
F up
commit
COMMIT:
F
m m
Really?
Next Day
SLIDE 89
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
F up
“REVEAL”
up
commit
COMMIT:
F
m m
Really?
Next Day
SLIDE 90
IDEAL World 30 Day Free Trial
W e P r e d i c t S T O C K S ! !
Commitment
Commit now, reveal later
Intuitive properties: hiding and binding
F up
“REVEAL”
up
commit
COMMIT:
F
m m
reveal
m
REVEAL:
F
m
Really?
Next Day
SLIDE 91
Oblivious Transfer
W e P r e d i c t S T O C K S ! !
IDEAL World
SLIDE 92
Oblivious Transfer
Pick one out of two, without revealing which
W e P r e d i c t S T O C K S ! !
IDEAL World
SLIDE 93
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
W e P r e d i c t S T O C K S ! !
IDEAL World
SLIDE 94
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
W e P r e d i c t S T O C K S ! !
IDEAL World
SLIDE 95
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
W e P r e d i c t S T O C K S ! !
I need just
- ne
IDEAL World
SLIDE 96
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
W e P r e d i c t S T O C K S ! !
I need just
- ne
Sure
IDEAL World
SLIDE 97
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
W e P r e d i c t S T O C K S ! !
I need just
- ne
But can’t tell you which Sure
IDEAL World
SLIDE 98
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
F
OT
W e P r e d i c t S T O C K S ! !
I need just
- ne
But can’t tell you which Sure
IDEAL World
SLIDE 99
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
F
OT
W e P r e d i c t S T O C K S ! ! A:up, B:down
I need just
- ne
But can’t tell you which Sure
IDEAL World
SLIDE 100
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
F
OT
W e P r e d i c t S T O C K S ! ! A A:up, B:down
I need just
- ne
But can’t tell you which Sure
IDEAL World
SLIDE 101
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
F
OT
W e P r e d i c t S T O C K S ! ! A A:up, B:down
I need just
- ne
But can’t tell you which
up
Sure
IDEAL World
SLIDE 102
All 2 of them!
Oblivious Transfer
Pick one out of two, without revealing which
Intuitive property: transfer partial information “obliviously”
F
OT
W e P r e d i c t S T O C K S ! ! A A:up, B:down
I need just
- ne
x0 x1
F
b x
b
But can’t tell you which
up
Sure
IDEAL World
SLIDE 103
Can we REAL-ize them?
SLIDE 104
Can we REAL-ize them?
Are there protocols which securely realize these functionalities?
SLIDE 105
Can we REAL-ize them?
Are there protocols which securely realize these functionalities? Securely Realize: A protocol for the REAL world, so that SIM security definition satisfied
SLIDE 106
Can we REAL-ize them?
Are there protocols which securely realize these functionalities? Securely Realize: A protocol for the REAL world, so that SIM security definition satisfied Turns out SIM definition “too strong”
SLIDE 107
Can we REAL-ize them?
Are there protocols which securely realize these functionalities? Securely Realize: A protocol for the REAL world, so that SIM security definition satisfied Turns out SIM definition “too strong” Unless modified carefully...
SLIDE 108
Alternate Security Definitions
SLIDE 109
Alternate Security Definitions
Standalone security: environment is not “live”: interacts with the adversary before and after (but not during) the protocol
SLIDE 110
Alternate Security Definitions
Standalone security: environment is not “live”: interacts with the adversary before and after (but not during) the protocol Honest-majority security: adversary can corrupt only a strict minority of parties. (Not useful when only two parties involved)
SLIDE 111
Alternate Security Definitions
Standalone security: environment is not “live”: interacts with the adversary before and after (but not during) the protocol Honest-majority security: adversary can corrupt only a strict minority of parties. (Not useful when only two parties involved) Passive (a.k.a honest-but-curious) adversary: where corrupt parties stick to the protocol (but we don’ t want to trust them with information)
SLIDE 112
Alternate Security Definitions
Standalone security: environment is not “live”: interacts with the adversary before and after (but not during) the protocol Honest-majority security: adversary can corrupt only a strict minority of parties. (Not useful when only two parties involved) Passive (a.k.a honest-but-curious) adversary: where corrupt parties stick to the protocol (but we don’ t want to trust them with information) Functionality-specific IND definitions: usually leave out several attacks (e.g. input dependence, malleability, …)
SLIDE 113
Alternate Security Definitions
Standalone security: environment is not “live”: interacts with the adversary before and after (but not during) the protocol Honest-majority security: adversary can corrupt only a strict minority of parties. (Not useful when only two parties involved) Passive (a.k.a honest-but-curious) adversary: where corrupt parties stick to the protocol (but we don’ t want to trust them with information) Functionality-specific IND definitions: usually leave out several attacks (e.g. input dependence, malleability, …) Full-fledged SIM security, but protocols allowed to use a real trusted entity for a basic functionality
SLIDE 114
Alternate Security Definitions
Standalone security: environment is not “live”: interacts with the adversary before and after (but not during) the protocol Honest-majority security: adversary can corrupt only a strict minority of parties. (Not useful when only two parties involved) Passive (a.k.a honest-but-curious) adversary: where corrupt parties stick to the protocol (but we don’ t want to trust them with information) Functionality-specific IND definitions: usually leave out several attacks (e.g. input dependence, malleability, …) Full-fledged SIM security, but protocols allowed to use a real trusted entity for a basic functionality Modified SIM definitions (super-PPT adversary for ideal world)