A Survey on Private Set Intersection Presented by Hongrui Cui - PowerPoint PPT Presentation

A Survey on Private Set Intersection Presented by Hongrui Cui RickFreeman@sjtu.edu.cn October 17, 2019 Cui Hongrui (SJTU) PSI October 17, 2019 1 / 27

Overview Introduction 1 PSI Literature Notations The Core of PSI Semi-Honest PSI 2 Cuckoo Hashing The Paradigm of [PSZ14] Malicious PSI 3 Malicious PSI via Dual Execution Multiparty PSI 4 Multiparty PSI from OPPRF Cui Hongrui (SJTU) PSI October 17, 2019 2 / 27

Content Introduction 1 PSI Literature Notations The Core of PSI Semi-Honest PSI 2 Cuckoo Hashing The Paradigm of [PSZ14] Malicious PSI 3 Malicious PSI via Dual Execution Multiparty PSI 4 Multiparty PSI from OPPRF Cui Hongrui (SJTU) PSI October 17, 2019 3 / 27

Private Set Intersection Research Background ◮ Multiparty computation of set intersection Functionality Classification ◮ Security: Semi-Honest/Malicious ◮ Players: Two Party/Multi Party ◮ Output: Plain Intersection/Post-Processing Cui Hongrui (SJTU) PSI October 17, 2019 4 / 27

Literature of Private Set Intersection Paper Parties Security Building Blocks [PSZ14] 2 Semi-Honest OT(OPRF) [HEK12] 2 Semi-Honest GC,GMW [CHLR18] 2 Hybrid (leveled-)FHE [RR17] 2 Malicious OT(OPRF) [KMP + 17] n Semi-Honest OT(OPPRF) Table: Comparison of Different Private Set Intersection Protocols Cui Hongrui (SJTU) PSI October 17, 2019 5 / 27

Notations PSI Notations: ◮ X , Y ⊂ { 0 , 1 } σ : Input sets ◮ X ∗ , Y ∗ ⊂ { 0 , 1 } λ +log( | X | )+log( | Y | ) : Processed input sets ◮ � m − OT k � v : k instances of m -choose-1 oblivious transfer on v -bit 1 strings ◮ F PSM : Private set membership protocol (i.e. y ∈ X ) Cui Hongrui (SJTU) PSI October 17, 2019 6 / 27

Notations Cuckoo Hashing Notations: ◮ B : Hash table “bins” ◮ m ∈ N : Hash table size ◮ h 1 , h 2 , h 3 : { 0 , 1 } ∗ → [ m ]: Hash function Cui Hongrui (SJTU) PSI October 17, 2019 7 / 27

A Na¨ ıve PSI Protocol Compute Intersection on Hashed Values Sender Receiver X ∗ := { H ( x ) | x ∈ X } − − − − − − − − − − − → Output X ∩ Y := { y ∈ Y | H ( y ) ∈ X ∗ } X ∩ Y (optionally) ← − − − − − − − − − − Output X ∩ Y Cui Hongrui (SJTU) PSI October 17, 2019 8 / 27

A Na¨ ıve PSI Protocol Why Na¨ ıve ◮ Hashed set X ∗ has the same entropy as X ◮ This entropy is usually low ◮ Feasible brute-force attack Cui Hongrui (SJTU) PSI October 17, 2019 9 / 27

A Na¨ ıve PSI Protocol Why Na¨ ıve ◮ Hashed set X ∗ has the same entropy as X ◮ This entropy is usually low ◮ Feasible brute-force attack When the entropy is acceptable (e.g. 80 bits), this is secure. Cui Hongrui (SJTU) PSI October 17, 2019 9 / 27

Content Introduction 1 PSI Literature Notations The Core of PSI Semi-Honest PSI 2 Cuckoo Hashing The Paradigm of [PSZ14] Malicious PSI 3 Malicious PSI via Dual Execution Multiparty PSI 4 Multiparty PSI from OPPRF Cui Hongrui (SJTU) PSI October 17, 2019 10 / 27

Semi-Honest PSI ◮ 2-Party Semi-Honest PSI receives most attention ◮ State-of-the-art only incurs 1 − 10 times overhead Cui Hongrui (SJTU) PSI October 17, 2019 11 / 27

Cuckoo Hashing Cuckoo Hashing ◮ A special hashing function ◮ Using eviction to resolve collision Cui Hongrui (SJTU) PSI October 17, 2019 12 / 27

Cuckoo Hashing Insertion ◮ Let i = 1, compute index l = h i ( x ) ◮ If B [ l ] = ⊥ , then insert � x , i � ◮ If not, insert anyway $ ◮ Let � y , j � be the original content, let x := y i ← [3] \ { j } , goto step 1 If the process iterates more than t times, put the item in a stash s . Cui Hongrui (SJTU) PSI October 17, 2019 13 / 27

Cuckoo Hashing Insertion ◮ Let i = 1, compute index l = h i ( x ) ◮ If B [ l ] = ⊥ , then insert � x , i � ◮ If not, insert anyway $ ◮ Let � y , j � be the original content, let x := y i ← [3] \ { j } , goto step 1 If the process iterates more than t times, put the item in a stash s . Lookup ◮ For inserted item x , there are only 3 + | s | possible locations Cui Hongrui (SJTU) PSI October 17, 2019 13 / 27

Cuckoo Hashing Receiver: "Thin" Table Sender: "Thick" Table Cuckoo Hashing with h 1 ; h 2 Regular Hashing with h 1 ; h 2 T 1 [1] T 2 [1] . . . . . . T 1 [ h 1 ( x )] T 2 [ h 1 ( x )] . . . . . . T 1 [ h 2 ( x )] T 2 [ h 2 ( x )] . . . . . . T 1 [ m ] T 2 [ m ] Figure: Cuckoo Hash Table Cui Hongrui (SJTU) PSI October 17, 2019 14 / 27

The Paradigm of [PSZ14] F PSI ≤ F PSM ◮ Receiver does cuckoo hashing, while the sender does regular hashing ◮ They then perform m instances of F PSM ( m = | B | ) Cui Hongrui (SJTU) PSI October 17, 2019 15 / 27

The Paradigm of [PSZ14] F PSI ≤ F PSM ◮ Receiver does cuckoo hashing, while the sender does regular hashing ◮ They then perform m instances of F PSM ( m = | B | ) Discussion ◮ Most works in the semi-honest model follow this paradigm ◮ Various means to implement F PSM , e.g. OT, FHE, GC/GMW ◮ Cuckoo Hashing may be inherently unsuitable for malicious world Cui Hongrui (SJTU) PSI October 17, 2019 15 / 27

Set Membership from Oblivious Transfer OT as OPRF ◮ F PSM from Oblivious PRF is quite easy � 2 σ ◮ (One-Time) Oblivious PRF can be considered some � − ROT 1 ◮ OT-Extension can efficiently implement this primitive Cui Hongrui (SJTU) PSI October 17, 2019 16 / 27

A Brief Review on OT-Extension The idea is to “bootstrap” a large number of OT instances from a small number of base OT’s. Sender Receiver $ $ ← { 0 , 1 } m × v ← { 0 , 1 } v T 0 , T 1 b b j � 2 � − − − − − − − − → − OT v ( T 0 , j , T 1 , j ) ← − − − − − − − − − − − − − m T b , j 1 ← − − − − − − − − − C i = T i o ⊕ T i 1 ⊕ ECC( w i ) ← − − − − − − − − − − − − − Q i = T i b ⊕ s · C i Output ( s , Q i ) Output H ( i || T i 0 ) Cui Hongrui (SJTU) PSI October 17, 2019 17 / 27

Set Membership from Homomorphic Encryption Naive Approach Sender Receiver Enc( pk , y ) ← − − − − − − − − − − − − − c =Eval( r · � x ∈ X ( y − x )) $ ← R q − − − − − − − − − − − − − − → r Output 1 if Dec( sk , c ) = 0 Output 0 otherwise Cui Hongrui (SJTU) PSI October 17, 2019 18 / 27

Set Membership from Homomorphic Encryption Naive Approach Sender Receiver Enc( pk , y ) ← − − − − − − − − − − − − − c =Eval( r · � x ∈ X ( y − x )) $ ← R q − − − − − − − − − − − − − − → r Output 1 if Dec( sk , c ) = 0 Output 0 otherwise Several Optimizations ◮ Batching: reduce communication by n / d ◮ Partitioning: reduce polynomial degree by α ◮ Windowing: reduce circuit depth logarithmally ◮ Pre-Processing: reduce circuit depth by 1 Cui Hongrui (SJTU) PSI October 17, 2019 18 / 27

Set Membership from General Framework The main advantage is arbitrary post-processing can be applied (by concatenation of circuits), but shuffling the output may be needed. Cui Hongrui (SJTU) PSI October 17, 2019 19 / 27

Content Introduction 1 PSI Literature Notations The Core of PSI Semi-Honest PSI 2 Cuckoo Hashing The Paradigm of [PSZ14] Malicious PSI 3 Malicious PSI via Dual Execution Multiparty PSI 4 Multiparty PSI from OPPRF Cui Hongrui (SJTU) PSI October 17, 2019 20 / 27

Malicious PSI via Dual Execution Ideas of [RR17]: Sender Receiver Randomly Permute X Randomly Permute Y x − − − − − − − − → F OPRF [ x ] i k i − − − − − − − − → ← − − − − − − − − − y ← − − − − − − − − F OPRF k ′ [ y ] ′ i ← − − − − − − − − i − − − − − − − − − → Q := { [ x ] i , j =[ x ] i ⊕ [ x ] ′ j } − − − − − − − − − − − − − − − − → Output X ∩ Y = { y |∃ i , [ y ] i ⊕ [ y ] ′ j ∈ Q } Cui Hongrui (SJTU) PSI October 17, 2019 21 / 27

Optimizations It is possible to use regular hashing to reduce the quadratic complexity: ◮ Assuming n bins, log( n ) items per bin, the complexity is n log( n ) 2 ◮ Cuckoo hashing cannot be used here Cui Hongrui (SJTU) PSI October 17, 2019 22 / 27

Content Introduction 1 PSI Literature Notations The Core of PSI Semi-Honest PSI 2 Cuckoo Hashing The Paradigm of [PSZ14] Malicious PSI 3 Malicious PSI via Dual Execution Multiparty PSI 4 Multiparty PSI from OPPRF Cui Hongrui (SJTU) PSI October 17, 2019 23 / 27

Multiparty PSI The authors of [KMP + 17] proposed a simple protocol for semi-honest, multiparty PSI: ◮ Zero-Sharing ◮ Reconstruction Cui Hongrui (SJTU) PSI October 17, 2019 24 / 27

Multiparty PSI The authors of [KMP + 17] proposed a simple protocol for semi-honest, multiparty PSI: ◮ Zero-Sharing ◮ Reconstruction The protocol heavily uses the Oblivious Programmable PRF functionality, which can be implemented from F OPRF and polynomial interpolation. Cui Hongrui (SJTU) PSI October 17, 2019 24 / 27