Upload File

non-interactive secure computation from one-way functions · secure two party computation p 1 p 2...

  • Home
  • Documents
  • Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of
21
Non-Interactive Secure Computation from One-Way Functions Saikrishna Badrinarayanan Abhishek Jain (UCLA) (JHU) Rafail Ostrovsky Ivan Visconti (UCLA) (University of Salerno)

Upload: others

Post on 20-Jul-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Non-InteractiveSecureComputationfromOne-WayFunctions

SaikrishnaBadrinarayanan Abhishek Jain(UCLA) (JHU)

Rafail Ostrovsky IvanVisconti(UCLA) (UniversityofSalerno)

Page 2: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

SecureTwoPartyComputation

P1 P2

Inputx Inputy

Functionf

Goal:Bothpartieswishtorunaprotocolattheendofwhichtheybothlearntheoutputofthefunctionontheirjointinputs.

Page 3: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

SecureTwoPartyComputation

P1 P2

Inputx Inputy

Functionf

Security:Informally,adversaryshouldnotlearnanythingaboutyotherthanf(x,y)!

Page 4: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

UC-SecureComputation[Canetti01]

P1 P2Inputx1 Inputx2

P3Inputz3

Inputy1

Inputy3

Inputz2

P4

Inputw4

Inputw2

Manysessionsareexecutedinparallel

Functionf

Functiong Functionp

Page 5: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

UC-SecureComputation[Canetti01]

P1 P2Inputx1 Inputx2

P3Inputz3

Inputy1

Inputy3

Inputz2

P4

Inputw4

Inputw2

Informally,adversaryshouldnotlearnanythingotherthanfunctionoutputs!

Functionf

Functiong Functionp

Page 6: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Continued..

• Numerousapplications• Unfortunately,impossibletoconstructwithoutasetup

assumption!

Page 7: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

SetupAssumptions• CommonReferenceString[Canetti-Lindell-

Ostrovsky-Sahai 02]

• PhysicalAssumptions– HardwareTokens[Katz07]

– PhysicallyUncloneable Functions(PUFs)

Focusofthispaper

Page 8: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

HardwareTokens[Katz07]

• Apieceofhardwarethatcanevaluateanyfunction(embeddedinsideit)oninputqueries.

• Physicalmanifestationofidealobfuscation?• Difference:Needthehardwareobjectinhandtobeableto

queryandrecoveroutput.

Inputx Outputf(x)Functionf

Page 9: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

TypesofHardwareTokens

• Stateless:– Honesttokendoesnothaveanymemoryacrossinvocations.

• Stateful:– Tokencanmaintainmemory.– Hardertodesignsuchtokens.– Easiertodesignprotocolsusingthem.

Focusofthistalk

Challenge:Adversarialtokenscanbestateful!

Page 10: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

MotivatingScenario

Input:DNADatax

Encrypt(x)

Encryptf(x)

Decryptandlearnf(x)=listofrelativesGoal:Alicewantstopublishanencryptionofher

privateDNAdatatoanorganizationthatcancomputethesetofrelativesofagivenDNAsample.

Securityrequirement:Alice’sprivatedataandcompany’sdatashouldbehidden.

Reusablemessage

Input:DNAmatchingalgorithm

Page 11: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Non-interactivesecurecomputation(NISC)[IKOPS’11]

• Formalizesthescenariointhepreviousslide.

Input:xEncrypt(x)

Input:y

Encryptf(x,y)

Decryptandlearnf(x,y)

Securityrequirement:asinstandardtwopartycomputation

Reusablemessageforinputx

Page 12: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Priorwork

• [IKOPS11]:NISCinOTHybridmodel.• [AMPR14,MR17]: NISCinCRSmodelfromOT+onewayfunctions.

• [CJS14]:UC-secureNISCinGlobalRandomOraclemodelfromOT+onewayfunctions.

• [BGISW17]:NISCinplainmodelfromsub-exponentiallysecureOT+onewayfunctions.

Page 13: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Question

• CanweachieveNISCfromtheminimalassumptionofOne-WayFunctions?

• Further,canweachieveUCsecurity?

Page 14: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

OurResult

• UC-securenon-interactivesecurecomputationassumingone-wayfunctionsusingasinglestatelesshardwaretoken.

• Optimalintermsofassumptionsandnumberoftokens.

• AchievesUCsecurityunlikeallpriorworkexceptCJS14.

Page 15: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

OurResults:Corollary

• TwomessageUC-securetwopartycomputationwherebothpartiesreceiveoutput,assumingonewayfunctions usingasinglestatelesshardwaretoken.

Page 16: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Techniques

Page 17: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Tokendirection:Priorworks

Receiver:inputxSender:inputy

.

.

.

Issuesinoursetting:1. Needafreshtokenforeachnewinteractionwitha

fixedreusablereceivermessage.2. Allpriorworksrequireatleast tworoundsof

interactionaftersendertoken.

Inallpriorworks,tokensentbythesender.

Page 18: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Solution:TokenfromReceiver

Receiver:inputxSender:inputy

message

Reusablex

Page 19: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

MainChallenge:ResettingAttacks

1. Howtopreventsenderfromresettingthetokenandtryingdifferentinputsy?

2. Needthereceivertoauthenticatethesender’sinputtothetokenbeforeitprocessedbythetoken.

3. Butthatwilltakeatleast2rounds!

Solution:1. Weallowthesendertoresetthetoken!2. However,tokeniscarefullydesignedtoperformonly

“encrypted”computationthatislaterdecryptedbythereceiver.

3. Hence,evenontryingdifferentinputs,senderdoesn’tlearnanythingmeaningfulfromthetoken.

Page 20: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

OtherChallenges

• Selectiveabortattacks.• Subliminalchannelinformationthroughtoken.

• AchievingstraightlinesimulationtogetUCsecurity.

• Pleaserefertothepaperformoredetails!https://eprint.iacr.org/2018/1020

Page 21: Non-Interactive Secure Computation from One-Way Functions · Secure Two Party Computation P 1 P 2 Input x Input y Function f Goal: Both parties wish to run a protocol at the end of

Secure Multiparty Computation of Approximations

School on Secure Multiparty Computation · 2017. 4. 12. · Roadmap o Yao’s millionaire’s problem -triggered fundamental area of secure computation o Generic secure 2-party computation

Secure Computation Over Encrypted Data Liangliang Xiao

Scaling Secure Computation

Secure Multi-party Computation Minimizing Online Rounds

LevioSA: Lightweight Secure Arithmetic Computation · In this work, we design, optimize, and implement an actively secure protocol for secure two-party arithmetic computation. A distinctive

APPLICATIONS OF SECURE MULTIPARTY COMPUTATION

Secure Computation Against Adaptive Auxiliary Informationpeople.csail.mit.edu › abhishek › papers › AAI.pdf · Secure Computation Against Adaptive Auxiliary Information Elette

A Secure Computation Framework for SDNs · 2017. 11. 23. · • A novel approach for provably secure computation for multi-controller architecture in SDN." • Techniques from Secure

1 Making Computation Faster and Communication Secure ... · Making Computation Faster and Communication Secure: Quantum Solution The main stumbling block of quantum information, computation,

Secure Multi-Party Computation - KTHbuc/PPC/Slides/kreitz-pet-course-mpc.pdfTheclassicexamples(MentalPoker) Gunnar Kreitz Secure Multi-Party Computation Background Secure Computation

Introduction to Secure Multiparty Computation techniques

Oram And Secure Computation

Introduction to Secure Multi-Party Computation

Secure Multiparty Computation – Basic Cryptographic Methods

Cross-Domain Secure Computation

Secure Multiparty Computation

Limits of Practical Sublinear Secure Computation · Limits of Practical Sublinear Secure Computation Elette Boyle? Yuval Ishai?? Antigoni Polychroniadou? ? ? Abstract. Secure computations

Secure Computation for random access machines

Automating Efficient RAM-Model Secure Computation · using some secure computation subprotocol. In particular, SC-U is a secure computation protocol that securely evaluates the universal

Faster Secure Two-Party Computation Using …...Yan Huang David Evans Jonathan Katz Lior Malka Faster Secure Two-Party Computation Using Garbled Circuits Secure Two-Party Computation

Secure Computation (Lecture 3 & 4) Arpita Patra. Recap >> Why secure computation? >> What is secure (multi-party) computation (MPC)? >> Secret Sharing

Secure Computation for Business Data

Knowledge-Oriented Secure Multiparty Computation

Application-Scale Secure Multiparty Computation

Secure Computation EWSCS, Lecture 1

Introduction to Secure Multi-Party Computation

Secure&Computation: Why,%How%and%When

Zero-Knowledge Proofs for Secure Computation

Secure Computation ORAM - Rutgers Universityarchive.dimacs.rutgers.edu/Workshops/RAM/Slides/jarecki.pdf · Secure Computation ORAM The Case of 3-Party Computation AC’15: Sky Faber,

Hidden Diversity and Secure Multiparty Computation

On Homomorphic Encryption and Secure Computation

Secure Multi-party Computation

The Round Complexity of Secure Computation Against Covert ...The Round Complexity of Secure Computation Against Covert Adversaries ... secure computation. Roughly, the ideal world

Secure Computation Over Encrypted Data