Privacy Preservation through Secure Multi-party Computation: Towards Implementation Paolo Palmieri , Olivier Pereira UCL Crypto Group Universit´ e Catholique de Louvain (Belgium) Provable Privacy Workshop – July 2012 UCL Crypto Group Privacy with SMC: Implementation? - July 2012 1 Microelectronics Laboratory
Outline of the Talk 1. Secure Multi-party Computation 2. New channel models 3. Towards implementation UCL Crypto Group Privacy with SMC: Implementation? - July 2012 2 Microelectronics Laboratory
Outline of the Talk 1. Secure Multi-party Computation 2. New channel models 3. Towards implementation UCL Crypto Group Privacy with SMC: Implementation? - July 2012 2 Microelectronics Laboratory
Secure 2-party computation Problem suggested by Yao in 1982 [Yao82]. Cryptography for mutually distrusting parties. UCL Crypto Group Privacy with SMC: Implementation? - July 2012 3 Microelectronics Laboratory
Secure 2-party computation Problem suggested by Yao in 1982 [Yao82]. Cryptography for mutually distrusting parties. The parties. . . ◮ . . . want to jointly compute some value based on individually held secret bits of information; ◮ . . . do not wish to reveal their secrets to one another in the process. UCL Crypto Group Privacy with SMC: Implementation? - July 2012 3 Microelectronics Laboratory
Secure 2-party computation Problem suggested by Yao in 1982 [Yao82]. Cryptography for mutually distrusting parties. The parties. . . ◮ . . . want to jointly compute some value based on individually held secret bits of information; ◮ . . . do not wish to reveal their secrets to one another in the process. Our focus is on security against computationally unbounded adversaries, in the information theoretic model. UCL Crypto Group Privacy with SMC: Implementation? - July 2012 3 Microelectronics Laboratory
Oblivious Transfer Oblivious Transfer [Rab81] is a fundamental primitive for multi-party computation. ◮ many fashions of OT, all proved to be equivalent [Cr´ e87]. UCL Crypto Group Privacy with SMC: Implementation? - July 2012 4 Microelectronics Laboratory
Oblivious Transfer Oblivious Transfer [Rab81] is a fundamental primitive for multi-party computation. ◮ many fashions of OT, all proved to be equivalent [Cr´ e87]. 1-out-of-2 OT : the sender (Sam) has two bits b 0 , b 1 and wants to transmit only one to the receiver (Rachel), while she wants to select the desired bit s without Sam knowing her choice. s b 0 , b 1 S OT R b s UCL Crypto Group Privacy with SMC: Implementation? - July 2012 4 Microelectronics Laboratory
The Importance of Noise Oblivious Transfer cannot be achieved on a clear channel in the information theoretic model. Even a quantum channel proved to be useless for the purpose [May97]. Solution: noisy channels . UCL Crypto Group Privacy with SMC: Implementation? - July 2012 5 Microelectronics Laboratory
The Importance of Noise Oblivious Transfer cannot be achieved on a clear channel in the information theoretic model. Even a quantum channel proved to be useless for the purpose [May97]. Solution: noisy channels . Open questions: ◮ most efficient/realistic channel models? ◮ what properties should noise have? UCL Crypto Group Privacy with SMC: Implementation? - July 2012 5 Microelectronics Laboratory
Outline of the Talk 1. Secure Multi-party Computation 2. New channel models 3. Towards implementation UCL Crypto Group Privacy with SMC: Implementation? - July 2012 6 Microelectronics Laboratory
Traditional constructions OT can be built on almost any noisy channel [CMW04]. However most constructions are based on the Binary Symmetric Channel (BSC). 1 − p 0 0 p p 1 1 1 − p UCL Crypto Group Privacy with SMC: Implementation? - July 2012 7 Microelectronics Laboratory
Traditional constructions OT can be built on almost any noisy channel [CMW04]. However most constructions are based on the Binary Symmetric Channel (BSC). 1 − p 0 0 p p 1 1 1 − p ◮ First protocol proposed in 1988 [CK88]. ◮ Unfair Noisy Channel (UNC) [DKS99, DFMS04]. ◮ Weak Binary Symmetric Channel (WBSC) [Wul09]. UCL Crypto Group Privacy with SMC: Implementation? - July 2012 7 Microelectronics Laboratory
Delays & Packet Loss In [PP10] we proposed to build OT over channels that model real network characteristics: ◮ packet delays (wireless) and reorderings (wired); ◮ lost packets. UCL Crypto Group Privacy with SMC: Implementation? - July 2012 8 Microelectronics Laboratory
Delays & Packet Loss In [PP10] we proposed to build OT over channels that model real network characteristics: ◮ packet delays (wireless) and reorderings (wired); ◮ lost packets. ◮ Binary Discrete-time t Channel u Delaying Channel t 0 (BDDC); c 1 , c 2 u 0 c 2 ◮ Delaying-Erasing Channel t 1 Pr ( p ) c 3 , c 4 (DEC). u 1 c 1 , c 3 , c 4 UCL Crypto Group Privacy with SMC: Implementation? - July 2012 8 Microelectronics Laboratory
Outline of the Talk 1. Secure Multi-party Computation 2. New channel models 3. Towards implementation UCL Crypto Group Privacy with SMC: Implementation? - July 2012 9 Microelectronics Laboratory
Protocol - preparation Protocol inspired by the one proposed in [CK88]. Preliminary work Sam creates two sets of bit strings C and C ′ . | C | = | C ′ | = n UCL Crypto Group Privacy with SMC: Implementation? - July 2012 10 Microelectronics Laboratory
Protocol - preparation Protocol inspired by the one proposed in [CK88]. Preliminary work Sam creates two sets of bit strings C and C ′ . | C | = | C ′ | = n Each string in any of the two sets is composed of: c i ∈ C = ��� . . . ����� . . . �� UCL Crypto Group Privacy with SMC: Implementation? - July 2012 10 Microelectronics Laboratory
Protocol - preparation Protocol inspired by the one proposed in [CK88]. Preliminary work Sam creates two sets of bit strings C and C ′ . | C | = | C ′ | = n Each string in any of the two sets is composed of: ◮ the string identifier e : e i in c i ∈ C is unique in { C ∪ C ′ } . e i � �� � c i ∈ C = ��� . . . �� ��� . . . �� UCL Crypto Group Privacy with SMC: Implementation? - July 2012 10 Microelectronics Laboratory
Protocol - preparation Protocol inspired by the one proposed in [CK88]. Preliminary work Sam creates two sets of bit strings C and C ′ . | C | = | C ′ | = n Each string in any of the two sets is composed of: ◮ the string identifier e : e i in c i ∈ C is unique in { C ∪ C ′ } . ◮ the sequence number i : i in c i ∈ C is unique in C and shared by c ′ i ∈ C ′ ; e i i � �� � � �� � c i ∈ C = ��� . . . �� ��� . . . �� UCL Crypto Group Privacy with SMC: Implementation? - July 2012 10 Microelectronics Laboratory
Protocol - communication 1 1. At time t 0 Sam sends to Rachel C over a BDDC; C S R BDDC UCL Crypto Group Privacy with SMC: Implementation? - July 2012 11 Microelectronics Laboratory
Protocol - communication 1 1. At time t 0 Sam sends to Rachel C over a BDDC; 2. At t 1 Sam sends the set C ′ ; C ′ S R BDDC UCL Crypto Group Privacy with SMC: Implementation? - July 2012 11 Microelectronics Laboratory
Protocol - communication 1 1. At time t 0 Sam sends to Rachel C over a BDDC; 2. At t 1 Sam sends the set C ′ ; 3. At u 0 Rachel receives the strings of C not delayed; ??? S R BDDC UCL Crypto Group Privacy with SMC: Implementation? - July 2012 11 Microelectronics Laboratory
Protocol - communication 1 1. At time t 0 Sam sends to Rachel C over a BDDC; 2. At t 1 Sam sends the set C ′ ; 3. At u 0 Rachel receives the strings of C not delayed; 4. At u 1 Rachel receives the strings of C delayed once and those of C ′ not delayed. Then she keeps listening; ??? S R BDDC UCL Crypto Group Privacy with SMC: Implementation? - July 2012 11 Microelectronics Laboratory
Protocol - communication 1 1. At time t 0 Sam sends to Rachel C over a BDDC; 2. At t 1 Sam sends the set C ′ ; 3. At u 0 Rachel receives the strings of C not delayed; 4. At u 1 Rachel receives the strings of C delayed once and those of C ′ not delayed. Then she keeps listening; 5. Rachel divides the sequence numbers received into two sets I s and I 1 − s . For all those in I s , the corresponding c has not been delayed; I s , I 1 − s S R clear channel UCL Crypto Group Privacy with SMC: Implementation? - July 2012 11 Microelectronics Laboratory
Protocol - communication 2 6. Sam receives I s and I 1 − s and chooses a universal hash function f . For each set I j he computes g j : � � e j 1 � . . . � e j with e j 1 , . . . , e j g j = 2 ∈ E j . n n 2 where e i ∈ E j ⇔ i ∈ I j . f , ( f ( g 0 ) ⊕ b 0 ) , ( f ( g 1 ) ⊕ b 1 ) S R clear channel UCL Crypto Group Privacy with SMC: Implementation? - July 2012 12 Microelectronics Laboratory
Protocol - communication 2 6. Sam receives I s and I 1 − s and chooses a universal hash function f . For each set I j he computes g j : � � e j 1 � . . . � e j with e j 1 , . . . , e j g j = 2 ∈ E j . n n 2 where e i ∈ E j ⇔ i ∈ I j . 7. Rachel computes her guess for b s : b s = f ( g s ) ⊕ ( f ( g s ) ⊕ b s ) S The End! R UCL Crypto Group Privacy with SMC: Implementation? - July 2012 12 Microelectronics Laboratory
Recommend
More recommend
