and Related Models AMOS BEIMEL, BEN GURION UNIVERSITY, ISRAEL EYAL - PowerPoint PPT Presentation

The Complexity of PSM Protocols and Related Models AMOS BEIMEL, BEN GURION UNIVERSITY, ISRAEL EYAL KUSHILEVITZ, TECHNION, ISRAEL PNINA NISSIM, BEN GURION UNIVERSITY, ISRAEL

Overview • Introduction • Ideas of Our Construction • Conclusion

Private Simultaneous Messages (PSM) model [FKN94,IK97] • Simplest communication pattern. r r r • Shared randomness. • Each party sends one message. • Correctness: the referee learns 𝑔(𝑦 1 , … , 𝑦 𝑙 ) . • Security: the referee learns nothing else. • Communication complexity: the length of the messages. Goal: compute 𝑔(𝑦 1 , … , 𝑦 𝑙 )

Motivation • PSM is an interesting problem on its own • Simplest model of secure computation – no interaction. • PSM implies interesting cryptographic primitives as: • Protocols for conditional disclosure of secrets (CDS). • Generalized oblivious transfer. • Several generalizations of PSM have been studied: • Non-interactive MPC [BGIKMP14]. • Ad-hoc PSM protocols [BGIK16, BIK17].

Our results – PSM protocols for arbitrary functions 𝑂 𝑙 → {0,1} • Function 𝑔 ∶ • [FKN] – Every function has a PSM protocol with communication 𝑃(𝑂 𝑙−1 ) . Num. of parties Previous works Our Work 𝑃(𝑂 1/2 ) [BIKK] 2 𝑃(𝑂 2 ) [FKN] 𝑃(𝑂) 3 𝑃(𝑂 3 ) [FKN] 𝑃(𝑂 5/3 ) 4 𝑃(𝑂 4 ) [FKN] 𝑃(𝑂 7/3 ) 5 𝑃(𝑙 3 ∙ 𝑂 𝑙/2 ) 𝑃(𝑂 𝑙−1 ) [FKN] 𝑙 ≥ 6 Our protocols for 𝑙 ≥ 6 can handle long outputs with the same message length.

Our results More results: • PSM protocols for functions with inputs of different sizes • A PSM for 𝑙 parties from a PSM for 𝑢 parties ( 𝑢 < 𝑙 ) • Applications • Ad-hoc PSM protocols • Homogenous distribution designs • Non-interactive MPC protocols • Conditional disclosure of secrets implies Secret-sharing schemes for homogenous access structures (independently by Liu and Vaikuntanathan STOC 2018)

Overview • Introduction • Ideas of Our Construction • Conclusion

The cube approach A technique from private information retrieval of CGKS98. Starting point – view a function 𝑔: 𝑂 𝑙 → 0,1 as an ℓ - dimensional cube for some ℓ . For a set 𝑇 and an element 𝑗 : 𝑇 ⊕ {𝑗} = ቊ𝑇 ∪ 𝑗 , 𝑗 ∉ 𝑇 𝑇\{𝑗}, 𝑗 ∈ 𝑇

The cube approach – 2 dimensions 𝑇 1 , 𝑇 2 ⊆ 𝑂 𝑏(𝑇 1 , 𝑇 2 ) =⊕ 𝑏∈𝑇 1 ,𝑐∈𝑇 2 𝑔(𝑏, 𝑐) 𝑦 𝑔(𝑦, 𝑧) Fact: 𝑧 𝑔 𝑦, 𝑧 = 𝑏(𝑇 1 , 𝑇 2 ) ⊕ 𝑏(𝑇 1 ⊕ {𝑦}, 𝑇 2 ) ⊕ 𝑏(𝑇 1 , 𝑇 2 ⊕ {𝑧}) ⊕ 𝑏(𝑇 1 ⊕ {𝑦}, 𝑇 2 ⊕ {𝑧}) 𝑧 𝑦

A 2-Party PSM Protocol for 𝑔: 𝑂 × 𝑂 → {0,1} • View 𝑔 as a 2-dimensional cube. 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝑏 00 = 𝑏(𝑇 1 , 𝑇 2 ) 𝑏 10 = 𝑏(𝑇 1 ⊕ 𝑦 1 , 𝑇 2 ) 𝐐 𝟑 𝐐 𝟐 referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐, 𝑇 1 ⊕ {𝑦 1 } referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝑏 01 = 𝑏(𝑇 1 , 𝑇 2 ⊕ {𝑦 2 }) 𝐐 𝟑 𝐐 𝟐 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐, 𝑇 1 ⊕ {𝑦 1 } referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐, 𝑇 1 ⊕ {𝑦 1 } 𝑏 01 ⊕ 𝑐, 𝑇 2 ⊕ {𝑦 2 } referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐, 𝑇 1 ⊕ {𝑦 1 } 𝑏 01 ⊕ 𝑐, 𝑇 2 ⊕ {𝑦 2 } 𝑏 𝑇 1 ⊕ 𝑦 1 , 𝑇 2 ⊕ 𝑦 2 ? referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐, 𝑇 1 ⊕ {𝑦 1 } 𝑏 01 ⊕ 𝑐, 𝑇 2 ⊕ {𝑦 2 } referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐, 𝑇 1 ⊕ {𝑦 1 } 𝑏 01 ⊕ 𝑐, 𝑇 2 ⊕ {𝑦 2 } Computes 𝑏 11 = 𝑏 𝑇 1 ⊕ 𝑦 1 , 𝑇 2 ⊕ 𝑦 2 . referee

A 2-Party PSM Protocol 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑇 1 , 𝑇 2 ⊆ 𝑆 𝑂 , 𝑐 ∈ {0,1} 𝑦 1 𝑦 2 𝐐 𝟑 𝐐 𝟐 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐, 𝑇 1 ⊕ {𝑦 1 } 𝑏 01 ⊕ 𝑐, 𝑇 2 ⊕ {𝑦 2 } 𝑔 𝑦 1 , 𝑦 2 = 𝑏 00 ⊕ 𝑏 10 ⊕ 𝑐 ⊕ 𝑏 01 ⊕ 𝑐 ⊕ 𝑏 11 referee

A 2-Party PSM Protocol for 𝑔: 𝑂 × 𝑂 → {0,1} • The communication complexity of this protocol is 𝑃(𝑂) . • The same complexity as the protocol of [FKN] . • There is a more efficient PSM protocol with communication 1 𝑃(𝑂 2 ) [BIKK].

A 𝑙 -Party PSM Protocol PSM protocol for function 𝑔: 𝑂 𝑙 → {0,1} using the cube approach. 𝑦 𝑙 𝑦 𝑙 𝑦 1 𝑦 𝑙 2+1 2 … … 𝐐 𝟐 𝐐 𝒍/𝟑 𝐐 𝒍/𝟑+𝟐 𝐐 𝒍

A 𝑙 -Party PSM Protocol We view 𝑔 as a 2-dimensional cube. 𝑧 2 𝑧 1 𝑦 𝑙 𝑦 𝑙 𝑦 1 𝑦 𝑙 2+1 2 … … 𝐐 𝟐 𝐐 𝒍/𝟑 𝐐 𝒍/𝟑+𝟐 𝐐 𝒍

A 𝑙 -Party PSM Protocol The common randomness: 𝑇 1 , 𝑇 2 ⊆ 𝑆 [𝑂 𝑙/2 ] 𝑧 2 𝑧 1 𝑦 𝑙 𝑦 𝑙 𝑦 1 𝑦 𝑙 2+1 2 … … 𝐐 𝟐 𝐐 𝒍/𝟑 𝐐 𝒍/𝟑+𝟐 𝐐 𝟑

A 𝑙 -Party PSM Protocol 4 Cubes: 1. 𝑏 00 = 𝑏(𝑇 1 , 𝑇 2 ) 2. 𝑏 10 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ) 3. 𝑏 01 = 𝑏 𝑇 1 , 𝑇 2 ⊕ 𝑧 2 4. 𝑏 11 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ⊕ 𝑧 2 )

A 𝑙 -Party PSM Protocol 4 Cubes: 1. 𝑏 00 = 𝑏(𝑇 1 , 𝑇 2 ) – Party 𝑄 1 computes 𝑏 00 . 𝑷(𝟐) 2. 𝑏 10 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ) 3. 𝑏 01 = 𝑏 𝑇 1 , 𝑇 2 ⊕ 𝑧 2 4. 𝑏 11 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ⊕ 𝑧 2 )

Computing 𝑏(𝑇 1 ⊕ {𝑧 1 }, 𝑇 2 ) 𝑧 2 𝑧 1 𝑦 𝑙 𝑦 𝑙 𝑦 1 𝑦 𝑙 2+1 2 … … 𝐐 𝟐 𝐐 𝒍/𝟑 𝐐 𝒍/𝟑+𝟐 𝐐 𝟑 Use a k/2-party PSM for this function

A 𝑙 -Party PSM Protocol 4 Cubes: 1. 𝑏 00 = 𝑏(𝑇 1 , 𝑇 2 ) 𝑷(𝟐) 𝑷(𝒍𝑶 𝒍/𝟑−𝟐 ) 2. 𝑏 10 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ) 𝑷(𝒍𝑶 𝒍/𝟑−𝟐 ) 3. 𝑏 01 = 𝑏 𝑇 1 , 𝑇 2 ⊕ 𝑧 2 4. 𝑏 11 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ⊕ 𝑧 2 )

A 𝑙 -Party PSM Protocol 4 Cubes: 1. 𝑏 00 = 𝑏(𝑇 1 , 𝑇 2 ) 𝑷(𝟐) 𝑷(𝒍𝑶 𝒍/𝟑−𝟐 ) 2. 𝑏 10 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ) 𝑷(𝒍𝑶 𝒍/𝟑−𝟐 ) 3. 𝑏 01 = 𝑏 𝑇 1 , 𝑇 2 ⊕ 𝑧 2 4. 𝑏 11 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ⊕ 𝑧 2 ) – Use a PSM to send 𝑇 1 ⊕ 𝑧 1 and 𝑇 2 ⊕ 𝑧 2 to referee.

A 𝑙 -Party PSM Protocol 4 Cubes: 1. 𝑏 00 = 𝑏(𝑇 1 , 𝑇 2 ) 𝑷(𝟐) 𝑷(𝒍𝑶 𝒍/𝟑−𝟐 ) 2. 𝑏 10 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ) 𝑷(𝒍𝑶 𝒍/𝟑−𝟐 ) 3. 𝑏 01 = 𝑏 𝑇 1 , 𝑇 2 ⊕ 𝑧 2 𝑷(𝒍 𝟒 𝑶 𝒍/𝟑 ) 4. 𝑏 11 = 𝑏(𝑇 1 ⊕ 𝑧 1 , 𝑇 2 ⊕ 𝑧 2 ) The referee can compute 𝑔(𝑧 1 , 𝑧 2 ) which is the xor of the 4 cubes. Communication and randomness complexity 𝑷 𝒍 𝟒 𝑶 𝒍/𝟑 .

The cube approach – summary Num. of Num. of parties (𝑙) dimensions (ℓ) [BIKK14] 2 4 3,4,5 3 𝑙 ≥ 6 2 The number of dimensions for functions in which the domain of inputs are not the same depends on the domains.

Overview • Introduction • Ideas of Our Construction • Conclusion

Conclusion and open problems • Main result: a PSM protocol for an arbitrary function 𝑔: 𝑂 𝑙 → 0,1 . • Our construction is based on the cube approach, which is technique from PIR. • Can we use other techniques from PIR to improve the complexity of PSM protocols? • [LVW18] efficient CDS protocols • Can we improve the complexity of PSM protocols in other ways?

Thank you!