The Exact Round Complexity of Secure Computation Antigoni - - PowerPoint PPT Presentation

▶
the exact round complexity
SMART_READER_LITE
LIVE PREVIEW

The Exact Round Complexity of Secure Computation Antigoni - - PowerPoint PPT Presentation

Dec 20, 2022 194 likes •751 views

The Exact Round Complexity of Secure Computation Antigoni Polychroniadou (Aarhus University) joint work with Sanjam Garg, Pratyay Mukherjee (UC Berkeley), Omkant Pandey (Drexel University) Background: Secure Multi-Party Computation x 1 f(x 1 ,

slide-1
SLIDE 1

The Exact Round Complexity

  • f

Secure Computation

Antigoni Polychroniadou (Aarhus University)

joint work with Sanjam Garg, Pratyay Mukherjee (UC Berkeley), Omkant Pandey (Drexel University)

slide-2
SLIDE 2

Background: Secure Multi-Party Computation

x1 x2 x3 x4 y4 y3 y2 y1 f(x1, x2, x3, x4) = (y1, y2 ,y3 ,y4 )

Adversary: PPT Static

x1 x1

π

Malicious Goal: Correctness: Everyone computes f(x1,…,x4) Security: Nothing else but the output is revealed

slide-3
SLIDE 3

Motivating Questions

Lower bounds on the round complexity of secure protocols. Construct optimal round secure protocols.

slide-4
SLIDE 4

State of the Art: Information-Theoretic Setting

Communication Complexity Round Complexity O(n|C|) O(depthC)

slide-5
SLIDE 5

State of the Art: Information-Theoretic Setting

Communication Complexity Round Complexity Ω(n|C|) [DNPR16] Ω(depthC) [DNPR16] Novel approach must be found to construct O(1) round protocols (that beat the complexities

  • f BGW, CCD, GMW,

SPDZ etc.)

slide-6
SLIDE 6

State of the Art: Computational Setting

Communication Complexity Round Complexity <<|C| 2PC MPC

FHE

slide-7
SLIDE 7

State of the Art: Computational Setting

Round Complexity 2PC MPC 5 rounds [KO04,ORS15] O(1)* *[BMR90,KOS03,Pas04,DI05,DI06,PPV08,IPS08,Wee10,Goy11,LP11,GLOV12]

No CRS No Preprocessing

slide-8
SLIDE 8

State of the Art: Computational Setting

What is the exact round complexity of secure MPC?

Round Complexity 2PC MPC 5 rounds [KO04,ORS15] O(1)

slide-9
SLIDE 9

Standard Communication Model for MPC

Simultaneous Message Exchange Channel

slide-10
SLIDE 10

Standard Communication Model for MPC

Simultaneous Message Exchange Channel

slide-11
SLIDE 11

Standard Communication Model for MPC

Simultaneous Message Exchange Channel

slide-12
SLIDE 12

Standard Communication Model for MPC

Simultaneous Message Exchange Channel

slide-13
SLIDE 13

Communication Model for 2PC

Non-Simultaneous Message Exchange Channel

There are mutual dependencies between the two messages

slide-14
SLIDE 14

State of the Art: Computational Setting

What is the exact round complexity of secure MPC? How many simultaneous message exchange rounds are necessary for 2PC?

Round Complexity 2PC MPC 5 rounds [KO04] O(1)

slide-15
SLIDE 15

Our Results

  • (3-round Impossibility):

There does not exist a 3-round protocol for the two-party coin-flipping functionality. Round Complexity 2PC MPC 5 rounds [KO04] O(1)

slide-16
SLIDE 16

Our Results

Suppose that there exists a k-round NMCOM scheme; then

  • (2PC): there exists a max(4, k + 1)-round protocol for securely realizing every two-

party functionality.

1 k-round NMCOM

Round Complexity 2PC MPC max(4,k+1)1 O(1)

The use of NMCOM is not a coincidence [LPV09,Goy11,LP11,LPTV10,GLOV12]

slide-17
SLIDE 17

Suppose that there exists a k-round NMCOM scheme; then

  • (2PC): there exists a max(4, k + 1)-round protocol for securely realizing every two-

party functionality;

  • (MPC): there exists a max(4, k + 1)-round protocol for securely realizing the multi-

party coin-flipping functionality.

1 k-round NMCOM

Round Complexity 2PC MCF* max(4,k+1)1 max(4,k+1)

Our Results

slide-18
SLIDE 18

Suppose that there exists a k-round NMCOM scheme; then

  • (2PC): there exists a max(4, k + 1)-round protocol for securely realizing every two-

party functionality;

  • (MPC): there exists a max(4, k + 1)-round protocol for securely realizing the multi-

party coin-flipping functionality.

1 k-round NMCOM

Round Complexity 2PC MCF* max(4,k+1)1 max(4,k+1)

Our Results

Four rounds are both necessary and sufficient for both the results based on 3-round NMCOMs [PPV08,GPR16,COSV16].

slide-19
SLIDE 19

Outline

  • 1. Lower bound on the two-party coin-flipping.
  • 2. 4-round 2PC protocol.
slide-20
SLIDE 20

Our Results

Theorem 1. There does not exist a 3-round protocol for the two- party coin-flipping functionality

  • for tossing ω(log λ) coins,
  • with a black-box simulation,
  • in the simultaneous message exchange model.

where λ is the security parameter

slide-21
SLIDE 21

Proof (sketch)

Rescheduled Suppose that there exists a protocol which realizes simulatable coin- flipping in 3 rounds. Contradict the result of [KO04]

slide-22
SLIDE 22

Proof (sketch)

Rescheduled Suppose that there exists a protocol which realizes simulatable coin- flipping in 3 rounds. Contradict the result of [KO04]

slide-23
SLIDE 23

Proof (sketch)

Rescheduled Suppose that there exists a protocol which realizes simulatable coin- flipping in 3 rounds. Contradict the result of [KO04]

slide-24
SLIDE 24

Proof (sketch)

P1 P2

Rescheduled Contradict the result of [KO04] Suppose that there exists a protocol which realizes simulatable coin- flipping in 3 rounds.

m1 m2 m3 m2 m3 m1

slide-25
SLIDE 25

Our Results

Theorem 2. There does not exist a 4-round protocol for the two- party coin-flipping functionality

  • for tossing ω(log λ) coins,
  • with a black-box simulation,
  • in the simultaneous message exchange model,
  • with at least one unidirectional round.
slide-26
SLIDE 26

Our Results

Theorem 2. There does not exist a 4-round protocol for the two- party coin-flipping functionality

  • for tossing ω(log λ) coins,
  • with a black-box simulation,
  • in the simultaneous message exchange model,
  • with at least one unidirectional round.
slide-27
SLIDE 27

Our Approach for 2PC

Starting point: Katz-Ostrovsky (KO) protocol [KO04] which is a 4-round protocol for only one-sided functionalities and 5-round for two sided functionalities.

5-round [KO04]:

Is it still 5 rounds with simultaneous transmission?

slide-28
SLIDE 28

Our Approach for 2PC

Starting point: Katz-Ostrovsky (KO) protocol [KO04] which is a 4-round protocol for only one-sided functionalities and 5-round for two sided functionalities.

Is it still 5 rounds with simultaneous transmission? Such a 4-round protocol fails due to Theorem 2.

4-round attempt:

slide-29
SLIDE 29

Our Approach for 2PC

Must use the simultaneous message exchange channel in each round; Run two executions of a 4-round protocol (in which only one party learns the output) in “opposite” directions. Fails due to malleability and input consistency issues.

slide-30
SLIDE 30

Simultaneous Executions 3-round NMCOM … 4-round 2PC

Our Approach for 2PC

slide-31
SLIDE 31

Theorem 3.

max(4, k + 1)-round 2PC protocols

TDP + k-round (parallel) NMCOM  max(4, k + 1)-round 2PC protocol

  • with black-box simulation,
  • in the presence of a

malicious adversary,

  • in the simultaneous

message exchange model.

slide-32
SLIDE 32

3-round Parallel NMCOM 4-round 2PC Protocol

Tools for our 2PC Protocol

Garble Circuits Input-delayed ZK Argument* Semi-Honest OT Input-delayed WIPOK Equicoval COM

slide-33
SLIDE 33

4-round 2PC Protocol

Tools for our 2PC Protocol

Garble Circuits Input-delayed ZK Argument* Semi-Honest OT Equicoval COM Input-delayed WIPOK 3-round Parallel NMCOM

slide-34
SLIDE 34

Garble Circuit Construction [Yao80]

Boolean Circuit C Garbled Circuit GC

Pairs of λ-bit keys x1 x2 x2 x3 Z1,0, Z1,1 Z2,0, Z2,1 Z3,0, Z3,1 Z4,0, Z4,1 GC

slide-35
SLIDE 35

Garble Circuit Construction [Yao80]

Boolean Circuit C Garbled Circuit GC

Pairs of λ-bit keys x1 x2 x2 x3 GC Z1,1 Z2,0 Z2,1 Z3,0 Z3,1 Z4,1 Z1,0 Z4,0

Decoder

slide-36
SLIDE 36

Semi-Honest Secure 2PC

slide-37
SLIDE 37

Semi-Honest Secure 2PC

slide-38
SLIDE 38

3-round SH 2PC:

S1 S2 S3

( , , )

S3 S2 S1

slide-39
SLIDE 39

Our 2PC Protocol

slide-40
SLIDE 40

Our 2PC Protocol

slide-41
SLIDE 41

3-round ΠWIPOK:

p1 p2 p3

( , , )

4-round ΠFS:

fs1 fs2 fs3

( , , , )

fs4

3-round NMCOM:

nm1 nm2 nm3

( , , )

3-round SH 2PC:

S1 S2 S3

( , , )

Our 2PC Protocol

slide-42
SLIDE 42

Our 2PC Protocol

fs1 fs3 fs2 fs4 p2 p1 p3 nm1 nm3 nm2

r’

S1 S’2 S1 CGC CZ GC

slide-43
SLIDE 43

Our 2PC Protocol

fs1 fs3 fs2 fs4 p2 p1 p3 nm1 nm3 nm2

r’

S1 S’2 S1 CGC CZ GC

slide-44
SLIDE 44

Proof Systems

  • 3-round ΠWIPOK public-coin, witness-indistinguishable proof-
  • f-knowledge [FLS99] for NP (st1 ∧st2)
  • 4-round ΠFS zero-knowledge argument-of knowledge protocol

[FS90] for NP (thm) based on NMCOM and ΠWIPOK. 1st ΠWIPOK: V sets t1=f(w1), t2=f(w2) and proves knowledge of a w for t1 ∨ t2 2nd ΠWIPOK: P proves knowledge of a witness to thm ∨(t1∨ t2 )

slide-45
SLIDE 45

Proof Systems

  • 3-round ΠWIPOK public-coin, witness-indistinguishable proof-
  • f-knowledge [FLS99] for NP (st1 ∧st2)
  • 4-round ΠFS zero-knowledge argument-of knowledge protocol

[FS90] for NP (thm) based on NMCOM and ΠWIPOK. 1st ΠWIPOK: V sets t1=nmσ1, t2=nmσ2 and proves knowledge of a w for t1 ∨ t2 2nd ΠWIPOK: P proves knowledge of a witness to thm ∨(t1 ∨ t2 )

Crucial Change

slide-46
SLIDE 46

Proof Systems

  • 3-round ΠWIPOK public-coin, witness-indistinguishable proof-
  • f-knowledge [FLS99] for NP (st1 ∧st2)
  • 4-round ΠFS zero-knowledge argument-of knowledge protocol

[FS90] for NP (thm ∧ thm’ ) based on NMCOM and ΠWIPOK. 1st ΠWIPOK: V sets t1=nmσ1, t2=nmσ2 and proves knowledge of a w for t1 ∨ t2 2nd ΠWIPOK: P proves knowledge of a witness to thm ∨(t1∨ t2 )

Input-Delayed Proof Systems

slide-47
SLIDE 47

Our 2PC Protocol

fs1 fs3 fs2 fs4 p2 p1 p3 nm1 nm3 nm2

r’

S1 S’2 S1 CGC CZ GC

Simulation Soundness

slide-48
SLIDE 48

4-round 2PC Protocol

Tools for our Coin-Flipping Protocol

Input delayed ZK Argument* Extractable COM Equicoval COM 3-round Parallel NMCOM

slide-49
SLIDE 49

Conclusion

  • (3-round Impossibility):

There does not exist a 3-round protocol for the two-party coin-flipping functionality. Round Complexity 2PC MPC 5 rounds [KO04] O(1)

slide-50
SLIDE 50

Suppose that there exists a k-round NMCOM scheme; then

  • (2PC): there exists a max(4, k + 1)-round protocol for securely realizing every two-

party functionality;

  • (MPC): there exists a max(4, k + 1)-round protocol for securely realizing the multi-

party coin-flipping functionality.

1 k-round NMCOM

Round Complexity 2PC MCF* max(4,k+1)1 max(4,k+1)

Conclusion

Four rounds are both necessary and sufficient for both the results based on the 3-round NMCOM of [GPR16].

slide-51
SLIDE 51

Theorem [GMPP16]

4-round 2PC protocols

TDP + k-round (parallel) NMCOM  max(4, k + 1)-round 2PC protocol

  • with black-box simulation,
  • in the presence of a

malicious adversary,

  • in the simultaneous

message exchange model.

 4-round 2PC protocol TDP 3-round NMCOM [COSV16] [GMPP16]:

+

Complexity Revereging  4-round 2PC protocol TDP [HPV16]:

+

OWF Adaptive OWF 2-round NMCOM [PVV08]

slide-52
SLIDE 52

 5-round MPC protocol TDP [GMPP16]:

+

 4-round MPC protocol* TDP [HPV16]:

+

iO  6-round MPC protocol TDP [GMPP16]:

+

LWE iO

4-round MPC protocols

slide-53
SLIDE 53

Open Problems

Semi-Honest ΟΤ O(1) rounds [BMR90…] 4 rounds [GMW87+AIK05] LWE 6 rounds [this work] 2 rounds [MW15] iO 4 rounds [HPV16] 2 rounds [GGHR14] MPC protocols Crypto Assumption Plain Model CRS Model

Can we get optimal-round static MPC protocols from different/weaker assumptions?

slide-54
SLIDE 54

Thank you!