Hig igh-Throughput Secure Three-Party Computation for Mali licious Adversaries and an Honest Majority Jun Furukawa*, Yehuda Lindell**, Ariel Nof** and Or Weinstein** *NEC corporation, Israel **Bar-Ilan University, Israel Eurocrypt 2017
Secure Three-Party Computation wit ith an Honest Majority 𝑦 1 𝑦 2 𝑔(𝑦 1 , 𝑦 2 , 𝑦 3 ) 𝑦 3
Secure Three-Party Computation wit ith an Honest Majority 𝑦 1 𝑦 2 𝑔(𝑦 1 , 𝑦 2 , 𝑦 3 ) 𝑦 3
Secure Three-Party Computation wit ith an Honest Majority 𝑦 1 𝑦 2 𝑔(𝑦 1 , 𝑦 2 , 𝑦 3 ) 𝑦 3 • Functionality is represented by a Boolean circuit • Security with abort
High-Throughput Secure Three-Party Computation with an Honest Majority
High-Throughput Secure Three-Party Computation with an Honest Majority 𝑢 𝑡𝑢𝑏𝑠𝑢 𝑢 𝑓𝑜𝑒 f How much time it takes to compute a function?
High-Throughput Secure Three-Party Computation with an Honest Majority 𝑢 𝑡𝑢𝑏𝑠𝑢 𝑢 𝑓𝑜𝑒 f How much time it takes to compute a function? Latency
High-Throughput Secure Three-Party Computation with an Honest Majority 1 𝑡𝑓𝑑 f f f f f f f f f 𝑢 𝑡𝑢𝑏𝑠𝑢 𝑢 𝑓𝑜𝑒 f How much time it takes to How many functions can we compute a function? compute in one sec? Latency
High-Throughput Secure Three-Party Computation with an Honest Majority 1 𝑡𝑓𝑑 f f f f f f f f f 𝑢 𝑡𝑢𝑏𝑠𝑢 𝑢 𝑓𝑜𝑒 f How much time it takes to How many functions can we compute a function? compute in one sec? Latency Throughput
Low Latency VS. High-Throughput High-Throughput Low Latency
Low Latency VS. High-Throughput High-Throughput Low Latency • Constant rounds of communication 𝑄 1 𝑄 2 “ the garbled-circuit approach ”
Low Latency VS. High-Throughput High-Throughput Low Latency • Low bandwidth • Constant rounds of • Simple Computations communication 𝑄 𝑄 1 1 𝑄 2 𝑄 2 “ the secret-sharing approach ” “ the garbled-circuit approach ”
Low Latency VS. High-Throughput High-Throughput Low Latency • Low bandwidth • Constant rounds of • Simple Computations communication 𝑄 𝑄 1 1 𝑄 2 𝑄 2 “ the secret-sharing approach ” “ the garbled-circuit approach ”
The Starting Point: The Semi-honest protocol of [AFLNO16 16] • Based on replicated secret sharing • Requires 1 bit of communication sent by each party per AND gate. • Speed: compute over 7 billion AND gates per second • Concretely, over 1,300,000 AES operations per second
From Semi-Honest to Malicious adversary ry • Sharing the inputs • Emulating the circuit • Output Reconstruction
From Semi-Honest to Malicious adversary ry How to force the corrupted party to share its • Sharing the inputs inputs “ correctly ” ? How to verify AND gates were computed • Emulating the circuit correctly? How to verify that the output was • Output Reconstruction reconstructed correctly?
From Semi-Honest to Malicious adversary ry How to force the corrupted party to share its • Sharing the inputs inputs “ correctly ” ? How to verify AND gates were computed • Emulating the circuit correctly? How to verify that the output was • Output Reconstruction reconstructed correctly?
Verification of AND Gates A “ multiplication triple ” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 ⋅ 𝑐
Verification of AND Gates A “ multiplication triple ” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 ⋅ 𝑐 Let 𝑦 , 𝑧 , 𝑨 be a triple generated by computing an AND gate Let 𝑏 , 𝑐 , 𝑑 be a random triple
Verification of AND Gates A “ multiplication triple ” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 ⋅ 𝑐 Let 𝑦 , 𝑧 , 𝑨 be a triple generated by computing an AND gate Let 𝑏 , 𝑐 , 𝑑 be a random triple
Verification of AND Gates A “ multiplication triple ” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 ⋅ 𝑐 Let 𝑦 , 𝑧 , 𝑨 be a triple generated If 𝑏 , 𝑐 , 𝑑 is a “ valid ” triple, then we by computing an AND gate can use 𝑏 , 𝑐 , 𝑑 to detect cheating Let 𝑏 , 𝑐 , 𝑑 be a random triple in 𝑦 , 𝑧 , 𝑨 with probability 1.
Verification of AND Gates A “ multiplication triple ” is a triple of shares 𝑏 , 𝑐 , 𝑑 such that 𝑑 = 𝑏 ⋅ 𝑐 Let 𝑦 , 𝑧 , 𝑨 be a triple generated If 𝑏 , 𝑐 , 𝑑 is a “ valid ” triple, then we by computing an AND gate can use 𝑏 , 𝑐 , 𝑑 to detect cheating Let 𝑏 , 𝑐 , 𝑑 be a random triple in 𝑦 , 𝑧 , 𝑨 with probability 1. Sub-protocol “ triple verification without opening ” Communication: 2 bits per each party
The Protocol On-line protocol 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates 4. Reconstruct Output 3 bits per AND gate
The Protocol On-line protocol 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates Output 𝑶 triples 4. Reconstruct Output 3 bits per AND gate
The Protocol Pre-processing protocol On-line protocol 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates Output 𝑶 triples 4. Reconstruct Output 3 bits per AND gate
The Protocol Pre-processing protocol On-line protocol ? 1. Share the inputs 2. Run the Semi-honest protocol 3. Verify all ANDs gates Output 𝑶 triples 4. Reconstruct Output 3 bits per AND gate
Generation of f Random Multiplication Triples • 𝑏 , [𝑐] are generated without any interaction! • [𝑑] is computed using the semi-honest protocol
Generation of f Random Multiplication Triples • 𝑏 , [𝑐] are generated without any interaction! 1 bit of communication! • [𝑑] is computed using the semi-honest protocol
Generation of f Random Multiplication Triples • 𝑏 , [𝑐] are generated without any interaction! 1 bit of communication! • [𝑑] is computed using the semi-honest protocol How to verify that the triple is valid?
Generation of f Random Multiplication Triples . . .
Generation of f Random Multiplication Triples Random permutation . . .
Generation of f Random Multiplication Triples Random Open C permutation triples . . .
Generation of f Random Multiplication Triples Random Open C permutation triples If one of the opened triples is incorrect, the honest parties will detect it and abort . . .
Generation of f Random Multiplication Triples Random Open C permutation triples . . .
Generation of f Random Multiplication Triples Split into N Random Open C buckets of permutation triples equal size 𝐶 1 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . 𝐶 2 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . . . 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 𝐶 𝑂
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using 𝜸 − 𝟐 triples 𝐶 1 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . 𝐶 2 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . . . . . . 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 𝐶 𝑂
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using 𝜸 − 𝟐 triples 𝐶 1 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . If one of the . buckets is “ mixed ” , 𝐶 2 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 the honest parties . . . will detect it and . . abort . . 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 𝐶 𝑂
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using 𝜸 − 𝟐 triples 𝐶 1 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . 𝐶 2 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . . . . . . 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 𝐶 𝑂
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using 𝜸 − 𝟐 triples 𝐶 1 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . 𝐶 2 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . . . . . . 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 𝐶 𝑂
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using 𝜸 − 𝟐 triples 𝐶 1 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . 𝐶 2 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . . . . . . 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 𝐶 𝑂
Generation of f Random Multiplication Triples Verify the Split into N Random Open C first triple in buckets of permutation triples each bucket equal size using 𝜸 − 𝟐 triples 𝐶 1 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . 𝐶 2 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 . . . . . . . 𝛾 𝑢𝑠𝑗𝑞𝑚𝑓𝑡 𝐶 𝑂
Recommend
More recommend
