The Cut-and-Choose Game and its Application to Cryptographic - PowerPoint PPT Presentation

The Cut-and-Choose Game and its Application to Cryptographic Protocols Ruiyu Zhu, Yan Huang, Jonathan Katz, abhi shelat Northeastern Indiana University U. Maryland University

What is Cut-and-Choose

What is Cut-and-Choose

Applications of Cut-and-Choose • Secure Computation – LP, Eurocrypt 07 SS, EuroCrypt 11 Brandão, AsiaCrypt 13 AMPR, Crypto14 Lindell, Crypto 13 HKE, Crypto13 • Zero-knowledge-proof – Blum, ICM 86 • Fair exchange of digital currency – BBSU, FC 12 • Secure delegation of computation – CKV, Crypto 10

Applications of Cut-and-Choose • Secure Computation – LP, Eurocrypt 07 SS, EuroCrypt 11 Brandão, AsiaCrypt 13 AMPR, Crypto14 Lindell, Crypto 13 HKE, Crypto13 • Zero-knowledge-proof – Blum, ICM 86 • Fair exchange of digital currency – BBSU, FC 12 • Secure delegation of computation – CKV, Crypto 10

Cut-and-Choose in Secure Computation Garbled Garbled Garbled Garbled Garbled Circuits Circuits Circuits Circuits Circuits Eval Chk

Three Flavors of Cut-and-choose • SingleCut – Secure if at least one evaluation-circuit is correct. Lindell, Crypto 13 HKE, Crypto 13 Brandão, AsiaCrypt 13 AMPR, Crypto 14 • MajorityCut PR, – Secure if the majority of evaluation-circuits are correct. SS’ EuriCrypto 11 LP, EuroCrypt07 Woodruff, EuroCrypt 07 LP, SCN 08 LP, JoP12 • BatchedCut – Amortizing cost over multiple executions. NO, TCC09 FJN+, EuroCrypt13 LR, Crypto 14

Three Flavors of Cut-and-choose • SingleCut – Secure if at least one evaluation-circuit is correct. Lindell, Crypto 13 HKE, Crypto 13 Brandão, AsiaCrypt 13 AMPR, Crypto 14 • MajorityCut – Secure if the majority of evaluation-circuits are correct. SS’ EuriCrypto 11 LP, EuroCrypt07 Woodruff, EuroCrypt 07 LP, SCN 08 LP, JoP12 • BatchedCut – Amortizing cost over multiple executions. NO, TCC09 FJN+, EuroCrypt13 LR, Crypto 14

Existing SingleCut Strategy Lindell, Crypto 13 Garbled Garbled Garbled Garbled Garbled Circuits Circuits Circuits Circuits Circuits Chk Eval Chk Eval Eval Expected cost: checking cost × 𝑡 2 + evaluation cost× 𝑡 2 𝑡 :the security parameter

The Cost Gap Checking Evaluation Garbled Seed Hash Garbled Circuit Circuit Bandwidth Cost Ratio 10 7 ~10 8 Time Cost Ratio 2 ~ 30 16 bytes 32 bytes

Our Key Intuition Evaluate less and check more . Use mixed-strategies : determine the number of evaluation-circuits probabilistically from a custom distribution. Use linear programming to find optimal parameters.

Problem Formulation Want to minimize 𝔽[cost(𝑠, 𝑇 =?@A )] “For all cheating strategies” Subject to: Pr failure 𝑇 =?@A , 𝑇 <=> ≤ 𝜁, ∀𝑇 <=> Upper-bound on the security failure rate 𝜁 Cost ratio 𝑠 𝑇 <=> Generator’s strategy 𝑇 =?@A Evaluator’s strategy

Problem Formulation Want to minimize 𝔽[cost(𝑠, 𝑇 =?@A )] “For all cheating strategies” Subject to: Pr failure 𝑇 =?@A , 𝑇 <=> ≤ 𝜁, ∀𝑇 <=> Upper-bound on the security failure rate 𝜁 Cost ratio 𝑠 𝑻 𝒉𝒇𝒐 Generator’s strategy 𝑻 𝒇𝒘𝒃𝒎 Evaluator’s strategy

𝑇 <=> and 𝑇 =?@A in SingleCut 𝑜 The total number of circuits A random variable over {0,1} > 𝑇 <=> A random variable over {0,1} > 𝑇 =?@A

𝑇 <=> and 𝑇 =?@A in SingleCut My only choices I could map are which circuits between binary to form improperly. string and strategy 0 1 0 1 1 1 1 0 1 0 Garbled Garbled Garbled Garbled Garbled Circuits Circuits Circuits Circuits Circuits Failure: 𝑇 <=> = 𝑇 =?@A So could I 0 1 0 1 1 Chk Eval Chk Eval Eval 0 1 0 1 1

Expected Cost of SingleCut # of circuits to evaluate > > > > > 𝔽[cost 𝑠, 𝑇 =?@A ] = U(𝑗𝑠 + 𝑜 − 𝑗 X 1)𝑦 Z 𝔽[cost 𝑠, 𝑇 =?@A ] = U(𝑗𝑠 + 𝑜 − 𝑗 X 1)𝑦 Z 𝔽[cost 𝑠, 𝑇 =?@A ] = U(𝑗𝑠 + 𝑜 − 𝑗 X 1)𝑦 Z 𝔽[cost 𝑠, 𝑇 =?@A ] = U(𝑗𝑠 + 𝑜 − 𝑗 X 1)𝑦 Z 𝔽[cost 𝑠, 𝑇 =?@A ] = U(𝑗𝑠 + 𝑜 − 𝑗 X 1)𝑦 Z Z[\ Z[\ Z[\ Z[\ Z[\ Total # of circuits Total number of circuits 𝑜 𝑦 Z Probability of evaluating 𝑗 circuits

Constraints on 𝑦 Z (because it’s a probability distribution) 𝑦 Z ≥ 0 > U 𝑦 Z = 1 Z[\ Total number of circuits 𝑜 𝑦 Z Probability of evaluating 𝑗 circuits

Pr failure 𝑇 =?@A , 𝑇 <=> ≤ 𝜁 Security ∀ 𝑇 <=> , Pr 𝑇 =?@A = 𝑇 <=> ≤ 𝜁 Holds Probability that evaluator picks any ∀𝑏 ∈ 0,1 > , Pr(𝑇 =?@A = 𝑏) ≤ 𝜁 SPECIFIC strategy a is bounded by 𝜁 .

∀𝑏 ∈ 0,1 > , Pr (𝑇 =?@A = 𝑏) ≤ 𝜁 𝑦 Z ≤ 𝑜 𝑦 Z ≤ 𝑜 𝑦 Z ≤ 𝑜 𝑦 Z ≤ 𝑜 𝑦 Z ≤ 𝑜 ⋅ 𝜁 ⋅ 𝜁 ⋅ 𝜁 ⋅ 𝜁 ⋅ 𝜁 𝑗 𝑗 𝑗 𝑗 𝑗 Each pure strategy can be picked with probability at most 𝜁 . There are > Z pure strategies that evaluate 𝑗 circuits.

Recap Minimize: > U(𝑗𝑠 + 𝑜 − 𝑗)𝑦 Z Z[\ Subject to: 𝑦 Z ≥ 0 > U 𝑦 Z = 1 Z[\ 𝑦 Z ≤ 𝜁 𝑜 𝑗

Fractional Knapsack Problem Unit Cost: 𝑜 𝑠 + 𝑜 − 1 2𝑠 + 𝑜 − 2 𝑜𝑠 𝑜 𝑜 𝑜 𝑜 Units 0 1 2 𝑜 A greedy algorithm Capacity: solves it in linear 1/𝜁 units time.

Find the Best 𝑜 • Exhaustively search every 𝑜 Achievable with the SingleCut strategy of Required by the [Lindell, Crypto13]. Range of 𝑜 security parameter 𝜁 1 𝑠 + 1 1 log d log d 𝜁 2 𝜁 to find the one with minimal cost. • Limitation: 𝑜 is publicly fixed. Followup at: https://github.com/Opt-Cut-N-Choose

Sample SingleCut Strategy for AES 𝒐 = 𝟓𝟏 𝒐 = 𝟑𝟑𝟕𝟖 𝒋 𝒚 𝒋 as % 𝒋 𝒚 𝒋 as % Classical Strategy Our technique 9.09 X 10 lmm 9.09 X 10 lmm 0 0 2.06 X 10 lo ⋯ ⋯ 1 11.9 X 10 \ 2.34 X 10 l7 19 2 12.5 X 10 \ 1.77 X 10 lm 20 3 99.8 X 10 \ ⋯ ⋯ 4 9.09 X 10 lmm 40 Save 77.5% b/w Bandwidth cost ratio: 𝑠 = 4533 For AES

Improvements on SingleCut 80% 60% Savings 40% 20% 0% 10 0 10 1 10 4 10 2 10 3 Cost Ratio r cost this work Savings=1− cost best prior work

Improvements on SingleCut 80% 60% Savings AES 40% fp-multiply 20% 0% 10 0 10 1 10 4 10 2 10 3 Cost Ratio r

Formulation for MajorityCut Minimize: > U(𝑗𝑠 + 𝑜 − 𝑗)𝑦 Z Z[\ Subject to: 𝑦 Z ≥ 0 > U 𝑦 Z = 1 Z[\ }~• (>,d€) 𝑦 Z X 𝑜 − 𝑐 / 𝑜 U ≤ 𝜁 𝑗 − 𝑐 𝑗 Z[€ See the paper for details.

Sample MajorityCut Strategy 𝒐 = 𝟐𝟖𝟔 𝒋 𝒚 𝒋 as % 𝒋 𝒚 𝒋 as % Classical Strategy 𝒐 = 𝟐𝟑𝟓 Our technique 1 X 10 l7 7 17 1.23 9 X 10 l7 9 19 5.36 𝒋 𝒚 𝒋 as % 7 X 10 lƒ 11 21 20.9 4.54 X 10 ld 23 13 72.2 43 100 15 0.25 Save 26.6% time Time cost ratio: 𝑠 = 10

Improvements on MajorityCut 100% 80% 60% Savings 40% 20% 0% 10 0 10 2 10 4 10 6 10 8 Cost ratio r cost this work Savings=1− cost best prior work

Improvements on MajorityCut 100% 80% 60% Savings AES 40% fp-multiply 20% 0% 10 0 10 2 10 4 10 6 10 8 Cost ratio r

Improvements on BatchedCut 50% N=100 40% N is the size N=200 of the circuit. N=10000 30% Savings 20% 10% 0% 10 0 10 1 10 2 10 3 10 4 10 5 Cost ratio r cost this work Savings=1− cost best prior work

Conclusion Cut-and-choose protocols should be appropriately configured based on the security requirement and the cost ratio benchmarked at run-time. The game solvers are available at https://github.com/cut-n-choose. Ruiyu Zhu: zhu52@indiana.edu