Faster Malicious 2-party Secure Computation with Online/Offline Dual Execution. Peter Rindal Mike Rosulek

Transcription

1 Faster Malicious 2-part Secure Computation with Online/Oline Dual Eecution Peter Rindal Mike Rosulek

2 2 Part Computation Real Protocol (, ) Ideal Functionalit (, )

3 2 Part Computation Real Protocol (, ) Secure against malicious adversaries De (simpliied): S Real π,, S S(,, (, ))

4 Applications 2-part Secure Computation Applications Private database quering Database, (, ) Quer Joint machine learning Datasets,, Model = (, ) Secure auctions Bids, Winning bid = (, )

5 Yao s Protocol garbled Yao OT, garble (, ), garbled (, ) (, ) de = garbled, Bob knows Securit properties: Privac Alice learn no more than (, ) Authenticit Alice can not guess an output encoding other than (, )

6 Yao s Protocol g g() Yao g Problems with malicious Adversaries The circuit ma not be correctl constructed E.g. g Ma violate privac and correctness Not alwas detectable

7 Dual Eecution [MohasselFranklin06], B Yao (, ) (, ) Yao, A First Yao secure against Alice. Second Yao secure against Bob

8 Dual Eecution [MohasselFranklin06] (, ) Yao A,,, B B (, ) Yao, A, AB Eq?, AB Deine common encoding: es / no de z AB = z A z B

9 Dual Eecution [MohasselFranklin06] g Yao A, g, B B g (, ) Yao, A g AB Eq?, AB Deine common encoding: de z AB = z A z B es / no Leaks a single bit!? g =, Guaranteed Correctness

10 Improved Dual Eecution [KolesnikovMohasselRivaRosulek15] (, ) AB Eq? (, ) AB Send s circuits Check some or correctness es / no

11 Improved Dual Eecution [KolesnikovMohasselRivaRosulek15] g 1 g z 1 AB, (, ) AB Eq? PSI (, ) AB Intersection Send s circuits Check some or correctness (, ) Use Private Set Intersection (PSI) to reconcile

12 Improved Dual Eecution [KolesnikovMohasselRivaRosulek15] g 1 g 2 g z 1 AB, z 2 AB Eq? PSI (, ) AB Intersection Send s circuits Check some or correctness (, ) or Use Private Set Intersection (PSI) to reconcile

13 Improved Dual Eecution [KolesnikovMohasselRivaRosulek15] g 1 g 2 g z 1 AB, z 2 AB (, ) AB Eq? PSI Send s circuits (, ) or Leaks a bit i all eval. Circuit are bad: Check some or correctness i g i, Use Private Set Intersection (PSI) to reconcile Pr leak a bit = 2 s

14 Online Oline [LindellRiva14,NeilsenOrlandi08,RRosulek16] Want to perorm N eecutions o Construct enough circuits or all N eecutions

15 Online Oline [LindellRiva14,NeilsenOrlandi08,RRosulek16] Want to perorm N eecutions o Construct enough circuits or all N eecutions Check some or correctness

16 Online Oline [LindellRiva14,NeilsenOrlandi08,RRosulek16] Want to perorm N eecutions o Construct enough circuits or all N eecutions Check some or correctness Randoml map the rest into bins Bin size o s log N instead o s E.g. 10 improvement

17 Online Oline [LindellRiva14,NeilsenOrlandi08,RRosulek16] Want to perorm N eecutions o Construct enough circuits or all N eecutions Check some or correctness Randoml map the rest into bins Bin size o s log N instead o s E.g. 10 improvement

18 Online Oline [LindellRiva14,NeilsenOrlandi08,RRosulek16] Want to perorm N eecutions o Construct enough circuits or all N eecutions Check some or correctness Randoml map the rest into bins Bin size o s log N instead o s E.g. 10 improvement

19 Online Oline [LindellRiva14,NeilsenOrlandi08,RRosulek16] PSI (, ) Use one bin per evaluation

20 Challenge #1: Input Consistenc [RRosulek16] How to ensure Bob used the same in all circuits? PSI

21 Challenge #1: Input Consistenc [RRosulek16] How to ensure Bob used the same in all circuits? Circuit generated b Alice Bob receives input via OT [eas] PSI

22 Challenge #1: Input Consistenc [RRosulek16] How to ensure Bob used the same in all circuits? Circuit generated b Alice Bob receives input via OT [eas] PSI Circuit generated b Bob [hard]

23 Challenge #1: Input Consistenc [RRosulek16] How to ensure Bob used the same in all circuits? Circuit generated b Alice Bob receives input via OT [eas] PSI Circuit generated b Bob [hard] In the oline, Bob tells Alice the relationship between the two arrows Alice check in the cut and choose

24 Challenge #1: Input Consistenc [RRosulek16] How to ensure Bob used the same in all circuits? Circuit generated b Alice Bob receives input via OT [eas] PSI Circuit generated b Bob [hard] In the oline, Bob tells Alice the relationship between the two arrows Alice check in the cut and choose Consistent with the relationship at least o one o Bob s circuits uses Requires no crpto operations

25 Challenge #2: Private Set Intersection (PSI) [RRosulek16] Build PSI rom Private Equalit Test Fastest PSI protocol [PinkasSchneiderZohner14] PSI X Y

26 Challenge #2: Private Set Intersection (PSI) [RRosulek16] Build PSI rom Private Equalit Test Fastest PSI protocol [PinkasSchneiderZohner14] Issues: Not malicious secure in general Can not be simulated PSI X Y

27 Challenge #2: Private Set Intersection (PSI) [RRosulek16] Build PSI rom Private Equalit Test Fastest PSI protocol [PinkasSchneiderZohner14] Issues: Not malicious secure in general Can not be simulated E: singleton set PSI { a X = b a c

28 Challenge #2: Private Set Intersection (PSI) [RRosulek16] Build PSI rom Private Equalit Test Fastest PSI protocol [PinkasSchneiderZohner14] Issues: Not malicious secure in general Can not be simulated E: singleton set PSI { a X = b b c a

29 Challenge #2: Private Set Intersection (PSI) [RRosulek16] Build PSI rom Private Equalit Test Fastest PSI protocol [PinkasSchneiderZohner14] Issues: Not malicious secure in general Can not be simulated E: singleton set PSI { a X = b c c b a

30 Challenge #2: Private Set Intersection (PSI) [RRosulek16] Build PSI rom Private Equalit Test [PinkasSchneiderZohner14] Fastest PSI protocol Issues: Not malicious secure in general Can not be simulated PSI E: singleton set Ideal: Bob onl knows one valid PSI input (, ) Simulator doesn t need to etract Bob input! Just test i it contains (, ) z 1 z 2 z 3 (, )

31 Perormance Function [RRosulek16] [LindellRiva15] [DamgårdZakarias15] Oline Online Oline Online Oline Online AES 5. 1 ms 1. 3 ms 74 ms 7 ms high? 6 ms SHA ms 8. 1 ms 206 ms 33 ms - - Amortized cost or N = 1,024 evaluations Amazon c4.8large = 36 core, 64GB RAM Statistical securit κ = 40 Maimum throughput: 0.26 ms / AES block (3800+ Hz) [DamgårdZakarias15] report 0.4 ms

32 Total Protocol Times or AES 100,000,000 [PSSW] 18 min 1,000,000 10,000 [KSS] 3.4 sec [FN] 0.8 sec [LR15] 81 ms 100 [RR16] 6 ms

33 Total Protocol Times or AES 100,000,000 [PSSW] 18 min 1,000,000 10,000 [KSS] 3.4 sec [FN] 0.8 sec [LR15] 81 ms 100 [RR16] 6 ms

34 Total Protocol Times or AES 100,000,000 [PSSW] 18 min 64-node cluster Consumer GPU 1,000,000 10,000 [KSS] 3.4 sec [FN] 0.8 sec AWS c4.8large [LR15] 81 ms 100 [RR16] 6 ms

35 Summar Online-oline dual eecution Faster 2PC with malicious securit to date: 1.3ms AES Some securit advantages over classic cut-and-choose Future Work: Hbrid protocols: combine [RRosulek16] with [DamgårdZakarias15] ast oline unction independent oline Transer advances rom online-oline to single eecution setting

36 The End Thanks Faster Malicious 2-part Secure Computation with Online/Oline Dual Eecution github.com/osu-crpto/batchduale Peter Rindal Mike Rosulek