TinyKeys: A New Approach to Efficient Multi-Party Computation - - PowerPoint PPT Presentation

▶
tinykeys
SMART_READER_LITE
LIVE PREVIEW

TinyKeys: A New Approach to Efficient Multi-Party Computation - - PowerPoint PPT Presentation

Dec 17, 2022 393 likes •760 views

TinyKeys: A New Approach to Efficient Multi-Party Computation Carmit Hazay , Emmanuela Orsini, Peter Scholl and Eduardo Soria-Vazquez Based on slides prepared by Peter Scholl and Eduardo Soria-Vazquez Secure Multi-Party Computation (MPC)

slide-1
SLIDE 1

Carmit Hazay, Emmanuela Orsini, Peter Scholl and Eduardo Soria-Vazquez

TinyKeys: A New Approach to Efficient Multi-Party Computation

Based on slides prepared by Peter Scholl and Eduardo Soria-Vazquez

slide-2
SLIDE 2

Secure Multi-Party Computation (MPC)

Goal: Compute f(a,b,c,d) a b c d

Secure computation has many applications

  • Auctions with private bids
  • Privacy-preserving data mining
  • Private health records
  • Cryptographic key protection
  • Secure statistical analyses
  • Smart city research – gender inequity
  • …
slide-3
SLIDE 3

MPC - Past and Present

Feasibility results: Back to the 80’s [Yao86,GMW87,BGW88,CCD88,Kilian88,RB89,BMR90] Broad focus on improving efficiency in past decade: Two-party setting [LP07,KS08,NO09,IKOPS11,NNOB12,HKK+14,ZRE15,RR16,GLNP15,WMK17, WRK17,HIV17,KRRW18], Multi-party setting [IPS08-09,DPSZ12,DKL+13,LPSY15,WRK17b,HSS17,KPR18,CGHIKLN18]

a b c d

slide-4
SLIDE 4

Properties of MPC Protocols

Computational model: Boolean/arithmetic circuits, RAM Adversary model:

Passive (semi-honest) or active (malicious) Threshold 𝒖 (number of corrupted parties)

Efficiency:

Computation/ communication complexity Round complexity

slide-5
SLIDE 5

Corruption Thresholds vs Communication Complexity of Practical MPC

n/2 n − 1 O(nlog n) O(n2k)

??? n parties k-bit security

Corruptions: Efficiency:

Can we design concretely efficient MPC protocols where each honest party can be leveraged to increase efficiency?

slide-6
SLIDE 6

Main Question

Can we trade off the number of corrupt parties for a more efficient, practical protocol?

slide-7
SLIDE 7

Motivation: Large Scale, Dishonest Majority

Large number of users want to conduct surveys, auctions, statistical analysis, measure network activity, etc.

MPC between all users Committee- based MPC

Dishonest Majority: More parties ⇒ More trustworthy

slide-8
SLIDE 8

MPC Setting in This Talk

Preprocessing Online a b c d

corr. rand.

Main focus:

  • Concrete efficiency for large numbers of parties

(e.g. 𝑜 in 10s, 100s) Adversary:

  • Static, passive
  • Dishonest majority (𝑢 > 𝑜/2)

Model of Computation:

  • Boolean circuits
  • Preprocessing phase
slide-9
SLIDE 9

Our Results

New dishonest majority protocols exploiting more honest parties:

  • 1. Passive GMW-style MPC based on OT

Up to 25x less communication compared with 𝑜 − 1 corruptions

  • 2. Passive constant-round BMR-style MPC based on garbled circuits

Up to 7x reduction in GC size and communication cost

Best improvements with 20+ parties when 70-90% are corrupt

slide-10
SLIDE 10

The TinyKeys Technique

slide-11
SLIDE 11

= ෍

𝑗

𝐼𝑗 +

Warm-up: Distributed Encryption

…

Enc

, … , , =

𝜆 𝜆 𝜆 𝜆 𝜆 𝜆

≈

slide-12
SLIDE 12

Distributed Encryption: Can We Do Better?

… …

slide-13
SLIDE 13

Distributed Encryption with TinyKeys

…

Enc

, … , , = = ෍

𝑗

𝐼𝑗 +

ℓ ℓ ℓ ℓ ℓ ℓ

… ℓ

≈

slide-14
SLIDE 14

Breaking Security

𝐼1 + ⋯ + 𝐼ℎ ≈

2ℓ keys

ℓ ℓ

+ ෍

𝑘=ℎ+1 .. 𝑜

𝐼

𝑘

ℓ

slide-15
SLIDE 15

Breaking Security

𝐼1 + ⋯ + 𝐼ℎ ≈

1

×

Length 2ℓ, Hamming Weight 1 𝐼1 0 𝐼1 2ℓ − 1 …

ℓ ℓ

slide-16
SLIDE 16

Breaking Security

𝐼1 + ⋯ + 𝐼ℎ ≈

ℓ

𝐼1 0 𝐼1 2ℓ − 1 …

Length 2ℓ, Hamming Weight 1

1

×

Length 2ℓ, Hamming Weight 1 𝐼1 0 𝐼1 2ℓ − 1 … 𝑓1

slide-17
SLIDE 17

Breaking Security

𝐼1 + ⋯ + 𝐼ℎ ≈

ℓ

1

×

Length 2ℓ, Hamming Weight 1 𝐼1 0 𝐼1 2ℓ − 1 … 𝐼𝑗 0 𝐼𝑗 2ℓ − 1 …

Length 2ℓ, Hamming Weight 1

⋮ 𝑓1

slide-18
SLIDE 18

Breaking Security

𝐼1 + ⋯ + 𝐼ℎ ≈

ℓ

1

×

Length 2ℓ, Hamming Weight 1 𝐼1 0 𝐼1 2ℓ − 1 … 𝐼ℎ 0 𝐼ℎ 2ℓ − 1 …

Length 2ℓ, Hamming Weight 1

⋮ 𝑓1

slide-19
SLIDE 19

Breaking Security

≈

𝐼1 0 𝐼1 2ℓ − 1 …

Length 2ℓ, Hamming Weight 1

⋮

1

×

Length 2ℓ, Hamming Weight 1 𝐼ℎ 0 𝐼ℎ 2ℓ − 1 … 𝑓ℎ 𝑓1 𝐼ℎ 0 𝐼ℎ 2ℓ − 1 … 2ℓ 2ℓ

𝐼

slide-20
SLIDE 20

Breaking Security

Adv wins: Given 𝐼 and y = He, distinguish y from random

≈

𝐼1 0 𝐼1 2ℓ − 1 …

Length 2ℓ, Hamming Weight 1

⋮ 𝑓ℎ 𝑓1 𝐼ℎ 0 𝐼ℎ 2ℓ − 1 … 2ℓ 2ℓ y =

𝐼

slide-21
SLIDE 21

Breaking Security: Regular Syndrome Decoding

e

Sample random 𝐼 ∈ 0,1 𝑠×𝑛, and regular 𝑓 ∈ {0,1}𝑛 of weight ℎ Adv wins: Given 𝐼 and y = He, find 𝑓 𝐼

𝑠

y =

m = ℎ ⋅ 2ℓ h blocks

Length 2ℓ, Hamming Weight 1

⇔ distinguish y from random

≈

slide-22
SLIDE 22

Hardness of Regular Syndrome Decoding

  • Used for SHA-3 candidate FSB [Augot Finiasz Sendrier 03]
  • Not much easier than syndrome decoding ⇔ LPN
  • Params: Message length 𝑠, key length ℓ, #honest ℎ
  • Statistically hard for small 𝑠/large ℎ

[Saa07] [BM17] [MO15] [NCB11] [BLN+09] [Kir11] [CJ04] [FS09] [MMT11] [BJMM12] [BLP08] [BLP11] [MS09]

slide-23
SLIDE 23

TinyKeys: A Little Honesty Goes a Long Way

(Tiny)GMW

  • Key length: ℓ ≥ 1

(Tiny)BMR

  • Key length: ℓ ≥ 5
  • Many challenges:
  • High Fan-Out
  • Enabling FreeXOR

OT

slide-24
SLIDE 24

(Tiny)GMW

slide-25
SLIDE 25

P7

P8

P6 P5 P4 P3 P1 P2

Quick Recap of GMW

1-out-2 Bit OT

xi ∈ {0,1} r, r + yj ∈ {0,1} r + xi · yj 𝑦1, 𝑧1 𝑦2, 𝑧2 𝑦3, 𝑧3 𝑦4, 𝑧4 𝑦5, 𝑧5 𝑦6, 𝑧6 𝑦7, 𝑧7 𝑦8, 𝑧8 𝑦 = 𝑦1 + … + 𝑦𝑜 ∈ {0,1} 𝑧 = 𝑧1 + … + 𝑧𝑜 ∈ {0,1} 𝑦 ∧ 𝑧 = 𝑦1 + ⋯ + 𝑦𝑜 · 𝑧1 + ⋯ + 𝑧𝑜 𝑦 + 𝑧 = 𝑦1 + 𝑧1) + … + (𝑦𝑜 + 𝑧𝑜 + r r + xi · yj

slide-26
SLIDE 26

“IKNP” OT Extension

𝜆 × 1-out-2 OTs

  • n 𝜆-bit strings

r × 1-out-2 Bit OTs

PRG, hash + r𝜆 bits comm. 𝐜 ∈ 0,1 r X0

1, X1 1 , … , X0 r, X1 r ∈ 0,1 2

Xb1

1 , … , Xbr r

[Ishai Kilian Nissim Petrank 03]

ℓ ℓ

Shrink the keys! L 𝐜 ≈ H + 𝐜

with Short Keys!

2ℓ keys

slide-27
SLIDE 27

Sharings

  • f zero:

x1 x2 xh k1,j k2,j kh,j H1 k1,j + x1 H2 k2,j + x2 Hh kh,j + xh ෍

i=1..h

Hi ki,j + xi yj ⋯ Ph P

1

P

2

P

j

s1,j + s2,j + sh,j + + s1,j + s2,j + sh,j ෍

i

sij = 0 x ∧ y = x1 + ⋯ + xn · y1 + ⋯ + yn = ෍

j=1..n

(x1+ ⋯ +xn) · yj + + sij

H1 + ⋯ + Hh

+

ℓ ℓ

Leaky OT

+ ෍

j=1..n

(s1,j+ ⋯ +sn,j) · yj

≈ ≈ ≈ ≈

Using leaky OT for GMW-Style MPC

slide-28
SLIDE 28

500 1000 1500 2000 2500 3000 10 20 30 40 50 60 70 80 90 100

  • Comm. (bits/AND triple)

# honest parties

Standard [DKSSZZ17] Committee TinyKeys

GMW: Communication Cost of Producing a Single Triple (200 Parties)

slide-29
SLIDE 29

(Tiny)BMR

slide-30
SLIDE 30

Garbling an AND Gate with Yao

u v w 1 1 1 1 1 u v w

slide-31
SLIDE 31

Garbling an AND Gate with Yao

Randomly permute entries Invariant: evaluator learns one key per wire throughout the circuit

A0, A1 B0, B1 C0, C1

EA0,B0 C0 EA0,B1(C0) EA1,B0 C0 EA1,B1(C1)

  • Pick two random keys for each wire
  • Encrypt the truth table of each gate
slide-32
SLIDE 32

Distributed Garbling [BMR90]

(A0

1, … , A0 n), (A1 1, … , A1 n)

EA0,B0 C0 EA0,B1(C0) EA1,B0 C0 EA1,B1(C1)

(B0

1, … , B0 n), (B1 1, … , B1 n)

(B0

1, … , B0 n), (B1 1, … , B1 n)

H 1 A1 B1 ⊕ ⋯ ⊕ H n | An||Bn) ⊕ (C1, … , Cn)

Shrink the keys!

nℓ

Each P

i gets A0 i , A1 i ∈ 0,1 k etc

Use distributed encryption: EA,B C = For hash function H ∶ 0,1 ∗ → 0,1 nk

ℓ

slide-33
SLIDE 33

BMR with Short Keys

Reusing keys reduces security in regular syndrome decoding problem for:

High fan-out Free-xor

Solution:

Splitter gates [Tate Xu 03] – can be garbled for free Local free-XOR offsets

𝐸0, 𝐸1 𝐹0, 𝐹1

slide-34
SLIDE 34

BMR: Communication Cost of Garbling an AND Gate (100 Parties)

1000 2000 3000 4000 5000 6000 10 20 30 40 50 60 70 80 90

Comms (kbit) # honest parties

Standard Short keys

Comparison with [Ben-Efraim Lindell Omri 16]

slide-35
SLIDE 35

Conclusion and Future Directions

New technique for distributing trust (more honesty ⇒ shorter keys) Improved protocols with 20+ parties

GMW: Up to 25x in communication (vs multi-party [DKSSZZ17]) BMR: Up to 7x in communication (vs [BLO16])

Follow-up work: Active Security – TinyKeys for TinyOT (Asiacrypt ’18) Future challenges: Optimizations, more cryptanalysis (conservative parameters atm)

slide-36
SLIDE 36

Thank you! Questions?

https://ia.cr/2017/214 [Full version] TinyKeys: A New Approach to Efficient Multi-Party Computation Carmit Hazay, Emmanuela Orsini, Peter Scholl and Eduardo Soria-Vázquez Paper: