[PPT] - The Cut-and-Choose Game and its Application to Cryptographic PowerPoint Presentation

SLIDE 1

The Cut-and-Choose Game and its Application to Cryptographic Protocols

Ruiyu Zhu, Yan Huang, Jonathan Katz, abhi shelat

Indiana University Northeastern University

U. Maryland

SLIDE 2

What is Cut-and-Choose

SLIDE 3

What is Cut-and-Choose

SLIDE 4

Applications of Cut-and-Choose

Secure Computation

–

Zero-knowledge-proof

–

Fair exchange of digital currency

–

Secure delegation of computation

–

BBSU, FC 12 Blum, ICM 86 CKV, Crypto 10 Lindell, Crypto 13 HKE, Crypto13 AMPR, Crypto14 Brandão, AsiaCrypt 13 SS, EuroCrypt 11 LP, Eurocrypt 07

SLIDE 5

Applications of Cut-and-Choose

Secure Computation

–

Zero-knowledge-proof

–

Fair exchange of digital currency

–

Secure delegation of computation

–

BBSU, FC 12 Blum, ICM 86 CKV, Crypto 10 Lindell, Crypto 13 HKE, Crypto13 AMPR, Crypto14 Brandão, AsiaCrypt 13 SS, EuroCrypt 11 LP, Eurocrypt 07

SLIDE 6

Cut-and-Choose in Secure Computation

Eval Chk Garbled Circuits Garbled Circuits Garbled Circuits Garbled Circuits Garbled Circuits

SLIDE 7

Three Flavors of Cut-and-choose

SingleCut

– Secure if at least one evaluation-circuit is correct.

MajorityCut PR,

– Secure if the majority of evaluation-circuits are correct.

BatchedCut

– Amortizing cost over multiple executions.

Lindell, Crypto 13 HKE, Crypto 13 AMPR, Crypto 14 Brandão, AsiaCrypt 13 LR, Crypto 14 NO, TCC09 FJN+, EuroCrypt13 LP, EuroCrypt07 LP, JoP12 LP, SCN 08 Woodruff, EuroCrypt 07 SS’ EuriCrypto 11

SLIDE 8

Three Flavors of Cut-and-choose

SingleCut

– Secure if at least one evaluation-circuit is correct.

MajorityCut

– Secure if the majority of evaluation-circuits are correct.

BatchedCut

– Amortizing cost over multiple executions.

Lindell, Crypto 13 HKE, Crypto 13 AMPR, Crypto 14 Brandão, AsiaCrypt 13 LR, Crypto 14 NO, TCC09 FJN+, EuroCrypt13 LP, EuroCrypt07 LP, JoP12 LP, SCN 08 Woodruff, EuroCrypt 07 SS’ EuriCrypto 11

SLIDE 9

Garbled Circuits Garbled Circuits Garbled Circuits Garbled Circuits Garbled Circuits

Existing SingleCut Strategy

Expected cost: checking cost × 𝑡 2 + evaluation cost× 𝑡 2

Lindell, Crypto 13

Eval Chk Eval Chk Eval 𝑡:the security parameter

SLIDE 10

Garbled Circuit Garbled Circuit

The Cost Gap

Seed Hash

Checking Evaluation Time Cost Ratio

2 ~ 30

Bandwidth Cost Ratio 107~108

16 bytes 32 bytes

SLIDE 11

Our Key Intuition

Evaluate less and check more. Use mixed-strategies: determine the number

f evaluation-circuits probabilistically from a

custom distribution. Use linear programming to find optimal parameters.

SLIDE 12

Problem Formulation

Want to minimize

𝜁 Upper-bound on the security failure rate 𝑠 Cost ratio 𝑇<=> Generator’s strategy 𝑇=?@A Evaluator’s strategy

𝔽[cost(𝑠, 𝑇=?@A)] Subject to: Prfailure 𝑇=?@A, 𝑇<=> ≤ 𝜁, ∀𝑇<=>

“For all cheating strategies”

SLIDE 13

Prfailure 𝑇=?@A, 𝑇<=> ≤ 𝜁, ∀𝑇<=>

Problem Formulation

Subject to: Want to minimize

𝜁 Upper-bound on the security failure rate 𝑠 Cost ratio 𝑻𝒉𝒇𝒐 Generator’s strategy 𝑻𝒇𝒘𝒃𝒎 Evaluator’s strategy

𝔽[cost(𝑠, 𝑇=?@A)]

“For all cheating strategies”

SLIDE 14

𝑇<=> and 𝑇=?@A in SingleCut

𝑜 The total number of circuits 𝑇<=> A random variable over {0,1}> 𝑇=?@A A random variable over {0,1}>

SLIDE 15

𝑇<=> and 𝑇=?@A in SingleCut

Garbled Circuits Garbled Circuits Garbled Circuits Garbled Circuits Garbled Circuits 1 1 1 1 1 1 Eval Chk Eval Chk Eval My only choices are which circuits to form improperly. I could map between binary string and strategy So could I

Failure: 𝑇<=> = 𝑇=?@A