Synchronous Constructive Cry ryptography Chen-Da Ueli Liu-Zhang - - PowerPoint PPT Presentation

β–Ά
synchronous constructive cry ryptography
SMART_READER_LITE
LIVE PREVIEW

Synchronous Constructive Cry ryptography Chen-Da Ueli Liu-Zhang - - PowerPoint PPT Presentation

Dec 30, 2022 290 likes β€’956 views

Synchronous Constructive Cry ryptography Chen-Da Ueli Liu-Zhang Maurer ETH Zurich ETH Zurich TCC 2020 R rounds R rounds Nave randomness generation 1 2 6

slide-1
SLIDE 1

Synchronous Constructive Cry ryptography

Chen-Da Liu-Zhang

ETH Zurich

TCC 2020

Ueli Maurer

ETH Zurich

slide-2
SLIDE 2
slide-3
SLIDE 3

𝑐

slide-4
SLIDE 4

𝑐 R rounds

slide-5
SLIDE 5

𝑐 𝑐 𝑐 𝑐 𝑐 𝑐 R rounds

slide-6
SLIDE 6

𝑐 𝑐 𝑐 𝑐 𝑐 𝑐 R rounds 𝑐6 𝑐3 𝑐2 𝑐5 𝑐4 𝑐1

NaΓ―ve randomness generation

slide-7
SLIDE 7

𝑐 𝑐 𝑐 𝑐 𝑐 𝑐 R rounds 𝑐6 𝑐3 𝑐2 𝑐5 𝑐4 𝑐1

NaΓ―ve randomness generation

ΰ»„

𝑗

𝑐𝑗

slide-8
SLIDE 8

Composable Security

Many existing composable frameworks [PW94,C01,N03,MR11,KT13,…]

Modularization Composition Clean guarantees

slide-9
SLIDE 9

Generality vs Simplicity

slide-10
SLIDE 10

Can we design a simple framework for a meaningful restricted setting?

Generality vs Simplicity

slide-11
SLIDE 11

Can we design a simple framework for a meaningful restricted setting?

Generality vs Simplicity

Precision Formal Verification Teaching

slide-12
SLIDE 12

Our Focus

  • Inf. Theoretic

Synchronous Computational Asynchronous Adaptive Static Permissioned Permissionless

slide-13
SLIDE 13
  • Inf. Theoretic

Synchronous Computational Asynchronous Adaptive Static Permissioned Permissionless

Future Extension

slide-14
SLIDE 14

Composable Synchronous Models

Current models* are built on top of asynchronous model

  • 1. Extra functionalities
  • 2. Activation token
  • 3. Message scheduling

Our goal: minimal framework

  • 1. Intuitive descriptions
  • 2. Simple proofs

*[Can01,Nie03,HofMul04,KMTZ13]

slide-15
SLIDE 15

Specifications

Ξ¦

slide-16
SLIDE 16

Specifications

Ξ¦ 𝒯

slide-17
SLIDE 17

Specifications

Ξ¦ 𝒯

slide-18
SLIDE 18

Constructions

𝒯 β„›2 β„›1

Recipe 𝜌

+

β„› ՜

𝜌 𝒯, or equivalently, 𝜌(β„›) βŠ† 𝒯

slide-19
SLIDE 19

Constructive Cryptography

𝑆

1 2 3 4

Ξ¦ resources

*[Mau11,MR11,MR16]

slide-20
SLIDE 20

Constructive Cryptography

𝑆

1 2 3 4

Φ resources Σ converters 𝜌

*[Mau11,MR11,MR16]

slide-21
SLIDE 21

Multi-Party Constructive Cryptography

𝑆

1 2 3 4

𝒬 = {1, … , π‘œ} Protocol 𝜌 = (𝜌1, … , πœŒπ‘œ)

slide-22
SLIDE 22

Multi-Party Constructive Cryptography

𝑆 𝜌1

1 2 3 4

𝜌4 𝜌3 𝒬 = {1, … , π‘œ} Protocol 𝜌 = (𝜌1, … , πœŒπ‘œ) 𝜌2

slide-23
SLIDE 23

Multi-Party Constructive Cryptography

𝑆 𝜌1

1 2 3 4

𝜌4 𝜌3 𝒬 = {1, … , π‘œ} Protocol 𝜌 = (𝜌1, … , πœŒπ‘œ) βˆ€πΌ βŠ† 𝑄 ℛ𝐼

{π𝑗 | π‘—βˆˆπΌ}𝒯𝐼

𝜌2

slide-24
SLIDE 24

Multi-Party Constructive Cryptography

𝒬 = {1, … , π‘œ} Protocol 𝜌 = (𝜌1, … , πœŒπ‘œ) β„› 1,3,4 𝜌1

1 2 3 4

𝜌4 βŠ† 𝒯{1,3,4}

1 3 4 2

𝜌3 βˆ€πΌ βŠ† 𝑄 ℛ𝐼

{π𝑗 | π‘—βˆˆπΌ}𝒯𝐼

slide-25
SLIDE 25

Multi-Party Constructive Cryptography

𝒬 = {1, … , π‘œ} Protocol 𝜌 = (𝜌1, … , πœŒπ‘œ) β„› 1,3,4 𝜌1

1 2 3 4

𝜌4 βŠ† 𝜌3 βˆ€πΌ βŠ† 𝑄 ℛ𝐼

{π𝑗 | π‘—βˆˆπΌ}𝒯𝐼

Ξ¦

slide-26
SLIDE 26

Multi-Party Constructive Cryptography

Traditional simulation-based notion

β„› 1,3,4 𝜌1

1 2 3 4

𝜌4 βŠ† 𝑇

1 3 4 2

𝜌3 𝜏

slide-27
SLIDE 27

Multi-Party Constructive Cryptography

Traditional simulation-based notion

β„› 1,3,4 𝜌1

1 2 3 4

𝜌4 βŠ† 𝑇

1 3 4 2

𝜌3 𝜏 𝒯{1,3,4}

slide-28
SLIDE 28

Multi-Party Constructive Cryptography

Traditional simulation-based notion

β„› 1,3,4 𝜌1

1 2 3 4

𝜌4 βŠ† 𝑇

1 3 4 2

𝜌3 βˆ— 𝒯{1,3,4} = {𝜏2𝑇 | 𝜏 ∈ Ξ£}

slide-29
SLIDE 29

Synchronous Systems

𝑆

Resource

slide-30
SLIDE 30

Synchronous Systems

𝑆

Resource

slide-31
SLIDE 31

Synchronous Systems

𝑆

Resource

slide-32
SLIDE 32

Synchronous Systems

𝑆

Resource

𝜌

Converter

slide-33
SLIDE 33

Synchronous Systems

𝜌

Converter

𝑆

Resource

slide-34
SLIDE 34

Synchronous Systems

𝜌

Converter

𝑆

Resource

slide-35
SLIDE 35

Synchronous Systems

𝜌

Converter

𝑆

Resource

slide-36
SLIDE 36

Synchronous Systems

𝜌 𝑆

slide-37
SLIDE 37

Synchronous Systems

𝜌 𝑆

slide-38
SLIDE 38

Round Structure

Round 𝑠

Send Receive

slide-39
SLIDE 39

Round Structure

Round 𝑠

Leakage Send Send Receive Receive

Honest Dishonest

𝑠. 𝑏 𝑠. 𝑐

slide-40
SLIDE 40

Authenticated Channel with Upper Bound Ξ”

𝑛

  • Honest parties are guaranteed to get

𝑛 after Ξ” rounds

Round 𝑙 Round 𝑙 + Ξ” AUTH Round 𝑙

slide-41
SLIDE 41

Authenticated Channel with Upper Bound Ξ”

𝑛

  • Honest parties are guaranteed to get

𝑛 after Ξ” rounds

  • Dishonest parties are guaranteed to

get 𝑛 in the same round

Round 𝑙 AUTH Round 𝑙 Round 𝑙 + Ξ”

slide-42
SLIDE 42

Authenticated Channel with Upper Bound Ξ”

𝑛

Round 𝑙 AUTH

βˆ—

  • Honest parties are guaranteed to get

𝑛 after Ξ” rounds

  • Dishonest parties do not have any

guarantee 𝒝𝒱𝒰ℋΔ,π‘Ž= πœŒπ‘Ž AUTHΞ” | 𝜌 ∈ Ξ£

Round 𝑙 + Ξ” π‘Ž

slide-43
SLIDE 43

Broadcast

𝑛

Validity: If sender is honest, all honest receivers output 𝑛 Consistency: All honest receivers output the same 𝑛’

Round 𝑙 Round π‘š

slide-44
SLIDE 44

Broadcast

β„¬π’Ÿπ‘™,π‘š,𝐼= 𝑆 | βˆƒπ‘€ βˆ€π‘„

π‘˜ ∈ 𝐼 π‘§π‘˜ π‘š = 𝑀 ∧ 𝑄 𝑑 ∈ 𝐼 ՜ 𝑀 = 𝑦𝑑 𝑙 Consistency Validity

Validity: If sender is honest, all honest receivers output 𝑛 (at round π‘š) Consistency: All honest receivers output the same 𝑛’ (at round π‘š)

𝑛

Round 𝑙 Round π‘š

slide-45
SLIDE 45

Broadcast

β„¬π’Ÿπ‘™,π‘š,𝐼= 𝑆 | βˆƒπ‘€ βˆ€π‘„

π‘˜ ∈ 𝐼 π‘§π‘˜ π‘š = 𝑀 ∧ 𝑄 𝑑 ∈ 𝐼 ՜ 𝑀 = 𝑦𝑑 𝑙

Let 𝜌 = (𝜌1, … , πœŒπ‘œ) be a (standard) broadcast protocol that takes Ξ” rounds

  • Validity: If 𝑄

𝑑 ∈ 𝐼, all honest parties obtain 𝑛 at round 𝑙 + Ξ”

  • Consistency: All honest parties obtain the same value at round 𝑙 + Ξ”

Standard proof 𝜌𝐼π’ͺℰ𝒰 βŠ† β„¬π’Ÿπ‘™,𝑙+Ξ”,𝐼

slide-46
SLIDE 46

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

*see also arithmetic black-box [DN03]

slide-47
SLIDE 47

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽1

slide-48
SLIDE 48

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽1 𝐽1 𝐽1 𝐽1 𝐽1 𝐽1

slide-49
SLIDE 49

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽1 𝐽2

slide-50
SLIDE 50

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽2 𝐽1 𝐽2 𝐽2 𝐽2 𝐽2

slide-51
SLIDE 51

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽1 𝐽2 𝐽3 𝐽4 …

slide-52
SLIDE 52

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽1 𝐽2 𝐽3 𝐽4 …

slide-53
SLIDE 53

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽1 𝐽2 𝐽3 𝐽4 …

slide-54
SLIDE 54

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽1 𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)
slide-55
SLIDE 55

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1

slide-56
SLIDE 56

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1

slide-57
SLIDE 57

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1 v

slide-58
SLIDE 58

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1 v

slide-59
SLIDE 59

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1 v

slide-60
SLIDE 60

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1 v v

slide-61
SLIDE 61

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1 v w

slide-62
SLIDE 62

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1 v w v+w

slide-63
SLIDE 63

Computer Resource

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

𝐽2 𝐽3 𝐽4 …

Instruction I:

  • 1. (input, i, p)
  • 2. (output,i,p)
  • 3. (add,p1,p2,p3)
  • 4. (mult,p1,p2,p3)

𝐽1 v w v+w vβˆ™w

slide-64
SLIDE 64

MPC as Computer

ins … 1 2 3 4 n Instructions Values

1 2 3 4 5 …

[BGW88] [Mau06]

β„¬π’Ÿ, π’ͺℰ𝒰

slide-65
SLIDE 65

Conclusions

  • Simple model for synchronous protocols
  • Parties are honest/dishonest
  • Information-theoretic statements
  • Flexible to capture property-based formalizations
slide-66
SLIDE 66

Full version: https://eprint.iacr.org/2020/1226

Credits: Icons: https://www.flaticon.com/