On the Local Leakage Resilience of Linear Secret Sharing Schemes Linear Secret Sharing Schemes Akshay Degwekar (MIT) Joint with Fabrice Benhamouda (IBM Research), Yuval Ishai (Technion) and Tal Rabin (IBM Research)
Leakage attacks can be devastating Proposed Solution: Secret Sharing, MPC Proposed Solution: Secret Sharing, MPC A few full corruptions All the servers? All the servers? Partial leak from all
Leakage Resilient Cryptography [ISW03, MR04, DP07, DP08, AGV09, NS09, FRR+10, [ISW03, MR04, DP07, DP08, AGV09, NS09, FRR+10, BKKV10, LLW11, BGJK12, DF12, BDL14, BGK14, GR15, DLZ15, GIMSS16 … ] - Strong leakage models - Specially-designed schemes - Specially-designed schemes
Additive Shamir Are standard Are standard Secret Sharing Schemes Leakage Resilient? Leakage Resilient?
Limited General Results Secret Sharing generically protects against weak forms of leakage. [DDF14] Noisy Leakage [BIVW16] Low approximate degree leaks [BIVW16] Low approximate degree leaks
Leakage Model: Local Leakage … … Leak any partial Leak any partial information about state. Restricted form of Only Computation Leaks[Micali-Reyzin04, GR12, BDL14], Bounded Comm. Leakage [GIMSS16]
Is Local Leakage reasonable? Local: Justified by physical separation Local: Justified by physical separation Shrinking: Timing, power, selective failures give limited information limited information Adversarial
Additive Secret Sharing Shamir Secret Sharing Completely random Shares are evaluations Shares are evaluations Threshold: Degree + 1 points to reconstruct
Is Additive Secret Sharing Local Leakage Resilient? A. Not Necessarily. One bit each leaks one bit of the secret!
How about Shamir ? Guruswami-Wootters 16: One bit per server A. Not secure. Convert to additive. can reconstruct the whole secret! Regenerating Codes: When a server goes Lagrange Interpolation down, minimum communication you need to reconstruct.
Results Overview Leakage Resilience of Additive & Shamir Secret Sharing Application: Leakage Resilience of GMW protocol Application: Local Share Conversion
Results: Additive Secret Sharing Thm . Thm .
Results: Shamir Secret Sharing Thm . Thm .
GW16: Reconstruct secret 1 bit of secret leaked Full Break Full Break n/2 degree t ?? Conjecture .
0 0 0 Random Secret 6 6 6 6 6 6 1 1 1 1 1 1 5 5 5 2 2 2 4 4 4 3 3 3 6 2 4 0 1 5 3 Generalizes to const. servers
Application: MPC Honest-but-Curious GMW w/ preprocessed Beaver Triples Goldreich-Micali-Wigderson87, Beaver91 Secret Shared Inputs Preprocessing Beaver Triples for product gates Computation Computation Addition: Locally Add Shares Addition: Locally Add Shares Multiplication: Use Beaver Triples
Application: MPC Thm .
Byproduct : On Local Share Conversion [Beimel-Ishai-Kushilevitz-Orlov12] Locally convert secret under one scheme to related secret under other scheme related secret under other scheme Lagrange Coefficients.
Byproduct : On Local Share Conversion Homomorphic Secret Sharing (Boyle-Gilboa-Ishai16) To get 3-server HSS:
Techniques 0 0 0 0 4 1 4 4 4 1 1 1 2 3 2 2 2 3 3 3 No subgroups No subgroups Some Some information. 2 4 0 1 3
Techniques
Summary Application : Honest-but-Curious GMW is leakage resilient. Application : Local Share Conversion Impossibility results.
Usually in Leakage Resilience [Cite many works on leakage. ] Here: Here: Given existing schemes, Given existing schemes, how Leakage Resilient are they?
Results: Thm . Thm . Thm .
Q: How Leakage Resilient are - Shamir & Additive Secret Sharing? - Shamir & Additive Secret Sharing? - GMW & BGW style MPC Protocols? Why? Why? - Exist and are Used. - Useful Properties: Homomorphisms.
Is Additive Secret Sharing Local Leakage Resilient? A. Not always. … … One bit each leaks one bit of the secret! Guruswami-Wootters16: For Shamir, one bit each allows full reconstruction of secret.
Techniques To show: 0 0 0 4 1 4 1 4 1 Pr[ ] 3 3 2 2 3 3 2 2 3 3 2 2 secret = 1 secret = 1 secret = 0 secret = 0
Application : Honest-but-Curious GMWs w/ preprocessed Beaver Triples Secret Share Inputs Secret Share Inputs Preprocess Beaver Triples for product gates: Compute: Addition: Locally Add Shares
Techniques Secret: 10 = 11 + 01 + 00 00 01 00 01 00 01 00 01 00 01 00 01 Attack: Leak lsb(share) Attack: Leak lsb(share) 10 11 10 11 10 11 lsb(secret) = sum of leaks Leak reveals: Share’s coset 00 01 00 01 00 01 00 01 The coset is a group. The coset is a group. 10 11 10 11 Learn secret’s coset.
Recommend
More recommend
