Concretely Efficient La Large-Sc Scale M MPC wi with th Acti - PowerPoint PPT Presentation

Concretely Efficient La Large-Sc Scale M MPC wi with th Acti tive Securi rity ty (or (or, Ti TinyKeys fo for Ti TinyOT) ) Carmit Hazay, Emmanuela Orsini, Peter Scholl and Eduardo Soria-Vazquez

La Large-Sc Scale MP MPC Current practical MPC doesn’t Growing number of users want to compute privately and jointly . scale well for large numbers of parties. Outsource? Fixed set Sample a of parties committee 1229 farmers +6000 relays (auction) (statistics) Eduardo Soria-Vazquez 2

MP MPC C setting in this talk Main focus: • Concrete efficiency for large numbers of parties Preprocessing (e.g. 𝑜 in 10s, 100s). Adversary: corr. • Static, active . rand. • Dishonest majority , but not full threshold ! a b • Assume ℎ > 1 honest parties to increase efficiency. Online Model of Computation: c d • Boolean circuits. • Preprocessing phase. Eduardo Soria-Vazquez 3

Ou Our resu sults New TinyOT-style protocol (actively secure, dishonest majority) exploiting more honest parties: v Up to 34x less communication compared with [WRK17]’s TinyOT with 𝑜 − 1 corruptions. v Up to 18x less communication compared with [WRK17]’s TinyOT mixed with committees ( ℎ > 1 honest parties). v Good improvements (2-6x less comm) with just 10% honest parties . Eduardo Soria-Vazquez 4

Ho How to to scale ale Tin inyOT

Th The Ti TinyOT pr protocol [NNOB12] • Based on additive secret sharing: 𝑦 = 𝑦 ) + 𝑦 + . • Multiplications computed using Beaver’s triples: ( 𝐲 , 𝐳 , 𝐲𝐳 ) . • Active security: Information-theoretic MACs (authenticated bits). Eduardo Soria-Vazquez 6

Th The Ti TinyOT pr protocol [NNOB12] • Based on additive secret sharing: 𝑦 = 𝑦 ) + 𝑦 + . • Multiplications computed using Beaver’s triples: ( 𝐲 , 𝐳 , 𝐲𝐳 ) . • Active security: Information-theoretic MACs (authenticated bits). 𝑛[𝑦 ) ] = 𝑙[𝑦 ) ] + 𝑦 ) · ∆ 𝑦 ) , 𝑛 𝑦 ) 𝑦 ) ∈ {0,1} ∆, 𝑙 𝑦 ) ∈ 0,1 )+4 𝑛 𝑦 ) ∈ 0,1 )+4 Eduardo Soria-Vazquez 7

Th The Ti TinyOT pr protocol [NNOB12] • Based on additive secret sharing: 𝑦 = 𝑦 ) + 𝑦 + . • Multiplications computed using Beaver’s triples: ( 𝐲 , 𝐳 , 𝐲𝐳 ) . • Active security: Information-theoretic MACs (authenticated bits). 𝑛[𝑦 + ] = 𝑙[𝑦 + ] + 𝑦 + · ∆ 𝑦 + , 𝑛 𝑦 + 𝑦 + ∈ {0,1} ∆, 𝑙 𝑦 + ∈ 0,1 )+4 𝑛 𝑦 + ∈ 0,1 )+4 Eduardo Soria-Vazquez 8

Mu Multi-Pa Party Ti TinyOT Eduardo Soria-Vazquez 9

Th The Ti TinyOT pr protocol [NNOB12] • Based on additive secret sharing: 𝑦 = 𝑦 ) + 𝑦 + . • Multiplications computed using Beaver’s triples: ( 𝐲 , 𝐳 , 𝐲𝐳 ) . • Active security: Information-theoretic MACs (authenticated bits). 𝑛[𝑦 ) ] = 𝑙[𝑦 ) ] + 𝑦 ) · ∆ 𝑦 ) + 1, 𝑛 𝑦 ) + ∆ 𝑦 ) ∈ {0,1} ∆, 𝑙 𝑦 ) ∈ 0,1 )+4 𝑛 𝑦 ) ∈ 0,1 )+4 Eduardo Soria-Vazquez 10

Th The Ti TinyOT pr protocol [NNOB12] • Based on additive secret sharing: 𝑦 = 𝑦 ) + 𝑦 + . • Multiplications computed using Beaver’s triples: ( 𝐲 , 𝐳 , 𝐲𝐳 ) . • Active security: Information-theoretic MACs (authenticated bits). 𝑛[𝑦 ) ] = 𝑙[𝑦 ) ] + 𝑦 ) · ∆ 𝑛 𝑦 ) + ∆ 𝑦 ) + 1, 𝑦 ) ∈ {0,1} ∆, 𝑙 𝑦 ) ∈ 0,1 ℓ ℓ ≪ 128 𝑛 𝑦 ) ∈ 0,1 ℓ Eduardo Soria-Vazquez 11

Th The Ti TinyOT pr protocol [NNOB12] • Based on additive secret sharing: 𝑦 = 𝑦 ) + 𝑦 + . • Multiplications computed using Beaver’s triples: ( 𝐲 , 𝐳 , 𝐲𝐳 ) . • Active security: Information-theoretic MACs (authenticated bits). 𝑛[𝑦 ) ] = 𝑙[𝑦 ) ] + 𝑦 ) · ∆ ∆, 𝑙 𝑦 ) ∈ 0,1 ℓ ℓ ≪ 128 𝑦 ) ∈ {0,1} ∆, 𝑙 𝑦 ) ∈ 0,1 ℓ ℓ · ℎ ≥ 𝑡 𝑛 𝑦 ) ∈ 0,1 ℓ Eduardo Soria-Vazquez 12

Co Commi mmittees s + + Ti TinyOT + + Short Keys Eduardo Soria-Vazquez 13

Co Commi mmittees s + + Ti TinyOT + + Short Keys Short keys h honest Additive shares 1 honest Eduardo Soria-Vazquez 14

The problem with short MACs Th 𝐳 ∈ 0,1 B 𝐲 ∈ 0,1 B 𝑠× Triple 𝑦 ) 𝑧 ) + 𝑡 ) , … , 𝑦 B 𝑧 B + 𝑡 B 𝑡 ) , … , 𝑡 B ( 𝐲 , 𝐳 , 𝐲𝐳 ) 𝑀 𝒛 ≈ 𝐼 ∆ + 𝒛 𝑧 ) , … , 𝑧 B ∈ {0,1} 𝑦 ) , … , 𝑦 B ∈ 0,1 ∆ ∈ 0,1 ℓ 𝑛 𝑦 ) , … , 𝑛 𝑦 B ∈ 0,1 ℓ 𝑙 𝑦 ) , … , 𝑙 𝑦 B ∈ 0,1 ℓ 𝑡 ) , … , 𝑡 B ∈ 𝒱( 0,1 ) Only 𝟑 ℓ possible values for 𝚬 ! ℓ as small as 1 ! Eduardo Soria-Vazquez 15

� Leakage gets worse… … 𝒛 𝟐 𝒛 𝒊 𝒚 𝒚 𝑠× Triple 𝑠× Triple , . . . , ( 𝐲 , 𝐳 , 𝐲𝐳 ) ( 𝐲 , 𝐳 , 𝐲𝐳 ) 𝑀 𝒛 𝟐 ≈ 𝐼 ∆ ) + 𝒛 𝟐 𝑀 𝒛 𝒊 ≈ 𝐼 ∆ X + 𝒛 𝒊 𝑀 𝒛 𝟐 + ⋯ + 𝒛 𝒊 = S 𝐼 ∆ 𝒋 + 𝒛 𝒋 ≈ VW) ..X Eduardo Soria-Vazquez 16

Wha What is s Ti TinyKeys? ? [HO HOSS18] 18] • New tool for large-scale MPC (more honesty ⇒ s horter keys). • Base security on the concatenation of honest parties’ keys. [BM17] [Kir11] [Saa07] [FS09] [BLN+09] • Security reduces to Regular Syndrome Decoding : [BJMM12] [MO15] [BLP08] • Not much easier than Syndrome Decoding ⇔ LPN. [MMT11] [CJ04] [NCB11] [MS09] [BLP11] • Params: # products 𝑠 , key length ℓ , # honest parties ℎ . • Statistically hard for small 𝑠 /large ℎ . Eduardo Soria-Vazquez 17

Wha Pr Problems with Ti What is s Ti TinyKeys? TinyKeys [H ? [HO HOSS18] [HOSS18] 18] 18] • New tool for large-scale MPC (more honesty ⇒ s horter keys). • Base security on the concatenation of honest parties’ keys. • Security reduces to Regular Syndrome Decoding : • Not much easier than syndrome decoding ⇔ LPN. • Params: # products 𝑠 , key length ℓ , # honest parties ℎ . • Params: # products 𝑠 , key length ℓ , # honest parties ℎ . • Statistically hard for small 𝑠 /large ℎ . Eduardo Soria-Vazquez 18

Problems with Ti Pr TinyKeys [H [HOSS18] 18] • Params: # products 𝒔 , key length ℓ , # honest parties ℎ . • A single ∆ can only be used to produce r triples! • Solution: Use different ones for every r triples: ∆ [^,B) , ∆ [B,+B) , … Secure method for switching: ∆ ^,B → ∆ , ∆ [B,+B) → ∆ , … • Best bucketing technique cannot apply (mult. overhead: 𝐶 ). • Solution: Use previous bucketing techniques (mult. overhead: B + ). • Still worth! 𝐶 ∈ {3,4} in practice. Eduardo Soria-Vazquez 19

Commu Co mmunication comp mplexity y (400 (400 part rties) s) 350 300 250 Comm. (megabits/AND triple) Standard [WRK17] 200 [WRK17] + Committee 150 This Work 100 50 0 1 10 20 30 40 50 60 70 80 90 100 110 120 # honest parties Eduardo Soria-Vazquez 20

Co Conclusi sion and fu future directions • First extension of TinyKeys [HOSS18] to the active setting . • Take-away: Large-scale requires different/new techniques (bucketing, MACs). • Improved TinyOT with 30+ parties. • Up to 18x in communication (vs multiparty [WRK17] + committees). • Significant improvements ( 2-6x ) with as little as 10% honest parties. Future challenges: • Optimize TinyKeys: More cryptanalysis (conservative parameters atm). • Adaptive adversaries? Actively secure TinyKeys-BMR [HOSS18]? Eduardo Soria-Vazquez 21

Th Thank you! Questions? Paper: https://ia.cr/2018/843 [Full version] Concretely Efficient Large-Scale MPC with Active Security (or, TinyKeys for TinyOT) Carmit Hazay, Emmanuela Orsini, Peter Scholl and Eduardo Soria-Vazquez Mail: eduardo.soria-vazquez@bristol.ac.uk Eduardo Soria-Vazquez 22