Secure Multi-Party Computation Gunnar Kreitz KTH Royal Institute - PowerPoint PPT Presentation

Background Secure Computation Security Model Generic Protocol Applications Secure Multi-Party Computation Gunnar Kreitz KTH – Royal Institute of Technology gkreitz@kth.se October 4 2012 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Ingredients ◮ n parties ◮ n inputs (one per party) ◮ A function f ( x 1 , . . . , x n ) to compute Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Goal (intuitive) ◮ Parties learn f ( x 1 , . . . , x n ) ◮ Noone learns anything more Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Example time! Let’s pick a function Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications The classic examples (Millionaire’s Problem) Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications The classic examples (Mental Poker) Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications The classic examples (Dining Cryptographers) Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Example time! Σ x i Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Private Summation (cont’d) ◮ The protocol does one round of input randomization ( blinding ) ◮ Then, any (non-private) summation protocol is run on the blinded inputs ◮ The blinding preserves the sum of the inputs ◮ Information-theoretically secure Photo by Mirko Tobias Schaefer http://www.flickr.com/photos/gastev/2960556197/ , CC BY 2.0 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Summation Protocol by Example 2 x ′ 1 = x 1 − r 12 − r 13 + r 21 + r 31 x ′ 2 = x 2 + r 12 − r 21 − r 23 + r 32 1 x ′ 3 = x 3 + r 13 + r 23 − r 31 − r 32 3 Gunnar Kreitz Secure Multi-Party Computation

� Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Summation Protocol by Example 2 r 12 x ′ 1 = x 1 − r 12 − r 13 + r 21 + r 31 x ′ 2 = x 2 + r 12 − r 21 − r 23 + r 32 1 x ′ 3 = x 3 + r 13 + r 23 − r 31 − r 32 3 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Summation Protocol by Example 2 x ′ 1 = x 1 − r 12 − r 13 + r 21 + r 31 x ′ 2 = x 2 + r 12 − r 21 − r 23 + r 32 1 x ′ 3 = x 3 + r 13 + r 23 − r 31 − r 32 r 13 � 3 Gunnar Kreitz Secure Multi-Party Computation

� Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Summation Protocol by Example 2 r 21 x ′ 1 = x 1 − r 12 − r 13 + r 21 + r 31 x ′ 2 = x 2 + r 12 − r 21 − r 23 + r 32 1 x ′ 3 = x 3 + r 13 + r 23 − r 31 − r 32 3 Gunnar Kreitz Secure Multi-Party Computation

� Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Summation Protocol by Example 2 x ′ 1 = x 1 − r 12 − r 13 + r 21 + r 31 x ′ 2 = x 2 + r 12 − r 21 − r 23 + r 32 1 r 23 x ′ 3 = x 3 + r 13 + r 23 − r 31 − r 32 3 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Summation Protocol by Example 2 x ′ 1 = x 1 − r 12 − r 13 + r 21 + r 31 x ′ 2 = x 2 + r 12 − r 21 − r 23 + r 32 1 � x ′ 3 = x 3 + r 13 + r 23 − r 31 − r 32 r 31 3 Gunnar Kreitz Secure Multi-Party Computation

� Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Summation Protocol by Example 2 x ′ 1 = x 1 − r 12 − r 13 + r 21 + r 31 x ′ 2 = x 2 + r 12 − r 21 − r 23 + r 32 1 r 32 x ′ 3 = x 3 + r 13 + r 23 − r 31 − r 32 3 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Problem Statement (sketch) Security Model Famous examples Generic Protocol Example protocol Applications Private Summation Protocol ◮ Each party P i with input x i proceeds as follows: 1. Send random r i , j to each neighbor P j 2. Wait for r j , i from each neighbor P j 3. Compute � � x ′ i = x i + r j , i − r i , j P j neighbor P j neighbor ◮ We could now publish x ′ i and still remain private! Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications How to proceed? ◮ Do we develop protocols for each and every f ? ◮ (Are they all this simple?) ◮ How do we define security? Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications Security definitions ◮ Noone should learn anything but result ◮ Noone should be able to affect computation in an untoward way Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications A Trusted Third Party ◮ Is there someone we all trust? ◮ Can send measurements to the Trusted Third Party ◮ She performs computation and tells everyone result ◮ Given a Trusted Third Party, problem is easy Photo by Matt J. Rider http://www.flickr.com/photos/mjrindewitt/4759429254/ , CC BY NC SA 2.0 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications Sometimes There is no Trusted Third Party Photo by Tayrawr Fortune http://www.flickr.com/photos/missfortune/4088429354/ , CC BY NC ND 2.0 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications Secure? What do we mean by security? ◮ In an ideal world, we have a trusted third party ◮ We want our protocols to be as secure as the ideal world ◮ Cheating parties must not: ◮ learn more than they do in the ideal world ◮ be able to do more than they can in the ideal world Photo by Thomas Hawk http://www.flickr.com/photos/thomashawk/115213351/ , CC BY NC 2.0 Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications What is an attack? Functionality: � i x i (mod p ). Adversary corrupts party 1. ◮ Adversary learns x 1 ? ◮ Adversary learns x 10 ? ◮ Adversary learns sum of all other parties’ input? ◮ Adversary learns � i < n / 2 x i ? ◮ Adversary learns sum, everyone else gets random value? No (pick random x 1 ). ◮ Adversary ensures result is c ? Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications What is an attack? Functionality: � i x i (mod p ). Adversary corrupts party 1. ◮ Adversary learns x 1 ? No. ◮ Adversary learns x 10 ? ◮ Adversary learns sum of all other parties’ input? ◮ Adversary learns � i < n / 2 x i ? ◮ Adversary learns sum, everyone else gets random value? No (pick random x 1 ). ◮ Adversary ensures result is c ? Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications What is an attack? Functionality: � i x i (mod p ). Adversary corrupts party 1. ◮ Adversary learns x 1 ? No. ◮ Adversary learns x 10 ? ◮ Adversary learns sum of all other parties’ input? ◮ Adversary learns � i < n / 2 x i ? ◮ Adversary learns sum, everyone else gets random value? No (pick random x 1 ). ◮ Adversary ensures result is c ? Gunnar Kreitz Secure Multi-Party Computation

Background Secure Computation Security Model Generic Protocol Applications What is an attack? Functionality: � i x i (mod p ). Adversary corrupts party 1. ◮ Adversary learns x 1 ? No. ◮ Adversary learns x 10 ? Yes. ◮ Adversary learns sum of all other parties’ input? ◮ Adversary learns � i < n / 2 x i ? ◮ Adversary learns sum, everyone else gets random value? No (pick random x 1 ). ◮ Adversary ensures result is c ? Gunnar Kreitz Secure Multi-Party Computation