SMCL A Domain-Specific Programming Language for Secure Multiparty - - PowerPoint PPT Presentation

▶
smcl
SMART_READER_LITE
LIVE PREVIEW

SMCL A Domain-Specific Programming Language for Secure Multiparty - - PowerPoint PPT Presentation

Mar 07, 2023 14 likes •288 views

SMCL A Domain-Specific Programming Language for Secure Multiparty Computation Janus Dam Nielsen and Michael I. Schwartzbach June 14, 2007 Janus Dam Nielsen - PLAS 2007 1/27 Overview Secure Multiparty Computation SMCL Concepts An

slide-1
SLIDE 1

SMCL

A Domain-Specific Programming Language for Secure Multiparty Computation

June 14, 2007 Janus Dam Nielsen - PLAS 2007 Janus Dam Nielsen and Michael I. Schwartzbach 1/27

slide-2
SLIDE 2

Overview

  • Secure Multiparty Computation
  • SMCL Concepts
  • An example
  • Security - what, why
  • Efficiency
  • Future Work
  • Conclusion

June 14, 2007 Janus Dam Nielsen - PLAS 2007 2/27

slide-3
SLIDE 3

Secure Multiparty Computation

  • n parties P1,...,Pn wish to jointly compute the

computable function: f(x1,...,xn)

  • Party Pi only knows the input value xi which

must be kept secret from the other parties.

  • Even if some adversary has power to corrupt

some subset of the parties

June 14, 2007 Janus Dam Nielsen - PLAS 2007 3/27

slide-4
SLIDE 4

The Millionaire’s Example

Alice Bob Trent SMC

June 14, 2007 Janus Dam Nielsen - PLAS 2007 4/27

slide-5
SLIDE 5

SMC Solves Problems

  • Auctions
  • Distributed Voting
  • Matchmaking
  • Benchmarking

June 14, 2007 Janus Dam Nielsen - PLAS 2007 5/27

slide-6
SLIDE 6

Overview

  • Secure Multiparty Computation
  • SMCL Concepts
  • An example
  • Security - what, why
  • Efficiency
  • Future Work
  • Conclusion

June 14, 2007 Janus Dam Nielsen - PLAS 2007 6/27

slide-7
SLIDE 7

Conceptual Model

Clients Server

June 14, 2007 Janus Dam Nielsen - PLAS 2007 7/27

slide-8
SLIDE 8

Values

Public & Secret values Private values

Booleans Integers Records Booleans Secret booleans Integers Secret integers Records

Clients: Server:

Client identity Secret client identity

June 14, 2007 Janus Dam Nielsen - PLAS 2007 8/27

slide-9
SLIDE 9

Communication

Clients: Server:

Tunnels:

Asynchronous

Functions:

Synchronous Primitive types only Data encrypted Secret data - shared and encrypted put and get functions Primitive types only Invoked by server

Tunnels:

Accessed via client identity put and get functions

June 14, 2007 Janus Dam Nielsen - PLAS 2007 9/27

slide-10
SLIDE 10

Client Identity

Clients: Server:

Groups of clients:

A set of clients All of the same kind Iterated using a for loop Uniform treatment of clients Secrecy of client identity Specified externally

June 14, 2007 Janus Dam Nielsen - PLAS 2007 10/27

slide-11
SLIDE 11

Overview

  • Secure Multiparty Computation
  • SMCL Concepts
  • An example
  • Security - what, why
  • Efficiency
  • Future Work
  • Conclusion

June 14, 2007 Janus Dam Nielsen - PLAS 2007 11/27

slide-12
SLIDE 12

SMCL

declare server Max: declare client Millionaires: function void main(int[] args) { } function void main(int[] args) { } sint max = 0; sclient rich; function void tell(bool b) { if (b) { display("You are the richest!"); } else { display("Make more money!"); } } foreach (client c in mills) { c.tell(open(c==rich|rich)); } group of Millionaires mills; foreach (client c in mills) { } if (netWorth >= max) { max = netWorth; rich = c; } tunnel of sint netWorth; function void ask() { netWorth.put(readInt()); } ask(); sint netWorth = c.netWorth.take();

The Millionaire’s Example

June 14, 2007 Janus Dam Nielsen - PLAS 2007 11/27

slide-13
SLIDE 13

Overview

  • Secure Multiparty Computation
  • SMCL Concepts
  • An example
  • Security - what, why
  • Efficiency
  • Future Work
  • Conclusion

June 14, 2007 Janus Dam Nielsen - PLAS 2007 13/27

slide-14
SLIDE 14

Security

  • Identity property
  • Commutative property
  • Adversary may:
  • Observe physical

state of the server

  • Not observe private

and secret values

June 14, 2007 Janus Dam Nielsen - PLAS 2007

Clients Server

14/27

slide-15
SLIDE 15

Adversary Traces

  • A sequence of states
  • f an entire

computation

  • Secret values are

masked out

  • Private state of

clients not available

  • No declassification

P S P’ S’ T P S P S S P

1 2 1 2

June 14, 2007 Janus Dam Nielsen - PLAS 2007 15/27

slide-16
SLIDE 16

Adversary Traces (cont’)

June 14, 2007 Janus Dam Nielsen - PLAS 2007 16/27

slide-17
SLIDE 17

Identity Property

P’ S’ S’ T T1

2 2 1

P S1 P S2 P’’

  • p’ = p’’ - Low equiv.
  • Traces must be

identical

  • Prevents attacks

which are a function of the trace (e.g. timing)

  • Requires basic
  • perations

independent of arguments

June 14, 2007 Janus Dam Nielsen - PLAS 2007 17/27

slide-18
SLIDE 18

Commutative Property

  • Soundness of secret

representation

T1 P

1

P’

1

P’ S1 P P’ S’

1

T2 P

June 14, 2007 Janus Dam Nielsen - PLAS 2007 18/27

slide-19
SLIDE 19

Ensuring Security

  • Carefully crafted semantics
  • Static analysis of well-typed SMCL

programs

June 14, 2007 Janus Dam Nielsen - PLAS 2007 19/27

slide-20
SLIDE 20

Semantics

  • Conditionals are a

source of differences in trace

  • Execute both

branches

  • Termination
  • Public side-effects?

x = b*y + (1-b)*z if (b) { x = y; x = z; } else { }

June 14, 2007 Janus Dam Nielsen - PLAS 2007 20/27

slide-21
SLIDE 21

Hoistability

  • Branches must agree on public side-effects
  • Assignment to public variables
  • Communication
  • Function calls
  • While loops and recursion with secret condition - not

allowed

June 14, 2007 Janus Dam Nielsen - PLAS 2007 21/27

slide-22
SLIDE 22

Semantic Security

S S’ P S’’

  • Ideal computations are

inefficient

  • Prove that a pragmatic

version reveals same information as the ideal version

  • Assist the

programmer

Ideal computation

  • pen(e|x,y,z)

June 14, 2007 Janus Dam Nielsen - PLAS 2007 22/27

slide-23
SLIDE 23

Overview

  • Secure Multiparty Computation
  • SMCL Concepts
  • An example
  • Security - what, why
  • Efficiency
  • Future Work
  • Conclusion

June 14, 2007 Janus Dam Nielsen - PLAS 2007 23/27

slide-24
SLIDE 24

Efficiency

(parties, threshold) ideal pragmatic public (3,1) 12 sec 30 ms < 1 ms (5,2) 17 sec 65 ms < 1 ms (7,3) 30 sec 132 ms < 1 ms sint x = 17; sint a = 42; sint b = -5; sint c = 87; sint p = a*(x*x) + b*x +c sint sign = 0; int output; if (p<0) sign = -1; if (p>0) sign = 1;

  • utput = open(sign|p);

Ideal

int x = 17; sint a = 42; sint b = -5; sint c = 87; sint p = open(a*(x*x) + b*x +c|a,b,c) sint sign = 0; int output; if (p<0) sign = -1; if (p>0) sign = 1;

  • utput = sign;

Pragmatic

June 14, 2007 Janus Dam Nielsen - PLAS 2007 24/27

slide-25
SLIDE 25

Future Work

  • Formalize Adversary traces
  • Dynamic groups
  • Secret compound datatypes
  • More elaborate examples

June 14, 2007 Janus Dam Nielsen - PLAS 2007 25/27

slide-26
SLIDE 26

Conclusion

  • A DSL for SMC
  • High-level abstractions
  • Strong security guaranties
  • Useful in practice

June 14, 2007 Janus Dam Nielsen - PLAS 2007 26/27

slide-27
SLIDE 27

Questions?

June 14, 2007 Janus Dam Nielsen - PLAS 2007 27/27