Size-Hiding Computation for Multiple Parties Kazumasa Shinagawa 1,2 - PowerPoint PPT Presentation

Size-Hiding Computation for Multiple Parties Kazumasa Shinagawa 1,2 Koji Nuida 2,3 Takashi Nishide 1 Goichiro Hanaoka 2 Eiji Okamoto 1 1: University of Tsukuba, 2: AIST, 3: JST PRESTO 1

Secure Multiparty Computation l Each party 𝑄 " has some private input 𝑦 " l The parties wish to compute a function 𝑧 = 𝑔(𝑦 ( , ⋯, 𝑦 + ) without revealing the inputs l Consider the single output, semi-honest, 𝑜 − 1 corruption 𝑦 0 𝑦 ( 𝑦 4 𝑦 1 𝑦 2 𝑦 3 2

Size-Hiding Computation l can hide some of input/output-sizes from some of parties l Each private size can be hidden from different set of parties l It is known that some of size-hiding is impossible in general l Which type of size-hiding is possible in general? This Talk complete characterization for the feasibility (assuming the existence of FHE) 3

Set Intersection l Police has a list of terrorists 𝑌 l Company has a list of customers 𝑍 l Police wants to compute 𝑌 ∩ 𝑍 without revealing |𝑌| l Naïve approach: Padding l Padding is inefficient Compute 𝑌 ∩ 𝑍 𝑌 𝑍 4

Millionaire Problem l Aliens: “Which planet has the largest population?” l The population is related to the military power l The input-size is also related to the military power l Padding doesn’t work ∵ The largest population in the universe is too large 5

NEW NEW NEW NEW NEW NEW NEW NEW Outline l Notations l Classification for two-party [LNO13] l Classification for multiparty u Almost all sizes cannot be hidden l Strong secure channel (SSC) model u It is implementable by steganography l Classification for multiparty in SSC model u Many sizes can be hidden in SSC model 6

Notations : 𝑄 9 can know |𝑦 " | 𝑗 ¡ ¡𝑘 : who must not know the output size ・ A size-hiding class ¡1 ¡2 ü 𝑄 0 must not know |𝑦 ( | ü 𝑄 1 must not know the output-size 3 Def. A class is feasible if general MPC is possible 7

Two-party Cases [LNO13] Hiding two or more sizes is infeasible in two-party case Private Private |𝑦 0 |, |𝑧| 2 ¡1 nothing ¡1 ¡2 𝑦 0 ¡1 ¡2 1 |𝑦 0 |, |𝑧| ¡2 |𝑧| 2 ¡1 ¡1 |𝑦 ( , |𝑦 0 ¡2 2 |𝑦 ( , |𝑦 0 , |𝑧| ¡1 Feasible Infeasible 8

NEW NEW NEW NEW NEW NEW NEW NEW Outline l Notations l Classification for two-party [LNO13] l Classification for multiparty u Almost all sizes cannot be hidden l Strong secure channel (SSC) model u It is implementable by steganography l Classification for multiparty in SSC model u Many sizes can be hidden in SSC model 9

Multiparty Cases (Our Result) Our result in standard model Even in MPC, it is infeasible to hide two sizes l The infeasibility is proven by techniques of [LNO13] l The protocol for hiding |𝑦 ( | u The parties invoke KeyGen for threshold FHE u Each party 𝑄 " sends 𝐹𝑜𝑑(𝑦 " ) to 𝑄 ( u 𝑄 ( computes [𝑧] and broadcast it u They invoke Decryption 10

Limitation of standard channel 3 Infeasible Infeasible 2 2 1 1 (with additional party) 𝑄 ( cannot send 𝐹𝑜𝑑(𝑦 ( ) 𝑄 1 can know 𝑦 ( and 𝑦 0 but 𝑄 0 cannot send 𝐹𝑜𝑑(𝑦 0 ) ∵ channel may leak the number of communication bits 11

Strong Secure Channel (SSC) Secure channel model 𝑛 |𝑛| Adv ? SSC model 𝑛′ l It is implementable by steganography 12

NEW NEW NEW NEW NEW NEW NEW NEW Outline l Notations l Classification for two-party [LNO13] l Classification for multiparty u Almost all sizes cannot be hidden l Strong secure channel (SSC) model u It is implementable by steganography l Classification for multiparty in SSC model u Many sizes can be hidden in SSC model 13

Our Result in SSC model l Complete classification in SSC model l Maximum number of private sizes is 𝑜 # of private sizes 1 2 3 4 … ❌ ❌ ❌ Secure channel … ✔ ✔ / ❌ ✔ / ❌ ✔ / ❌ SSC model … ✔ 14

Case 1 When the output-size is public 15

Case 1 (public output-size) l Suppose the output-size is public l Size-hiding computation is feasible in SSC model ⇔ for every and ¡ ¡𝑗 ¡ ¡𝑘 ∃ or : ¡ ¡𝑗 ¡ ¡𝑘 ¡ ¡𝑗 ¡ ¡𝑘 or ¡ ¡𝑙 ¡ ¡𝑗 ¡ ¡𝑙 ¡ ¡𝑘 Infeasible Feasible! 16

Main Idea for Construction l Invoke Sharing Protocols for 𝑄 ( , 𝑄 0 , 𝑄 1 [𝑦] : FHE ciphertext Sharing Protocol for 𝑄 ( : ¡2 ¡3 𝑄 1 sends to 𝑄 ( : [1 ¡𝑦 1 ] 𝑄 0 sends to 𝑄 ( : ¡1 [1 ¡0 J K L J M ¡𝑦 0 ] If 𝑦 ( ≥ 𝑦 0 Otherwise [0 ¡0 J K ] Longest input One of them can obtain all flagged ciphertexts! → [𝑔(𝑦 ( , 𝑦 0 , 𝑦 1 )] can be computed 17

Infeasibility (Reduced to [LNO13]) ¡3 ¡2 ¡3 ¡2 P B P A ¡1 ¡4 ¡1 ¡4 𝐺 𝑦 ( ,𝑦 0 ,𝑦 1 ,𝑦 2 l Suppose the class is feasible l Let 𝐺 𝑦 ( , 𝑦 0 , 𝑦 1 ,𝑦 2 = 𝑔 𝑦 ( , 𝑦 0 l Two private sizes (in two-party) is feasible l It contradicts [LNO13] 18

Case 2 When the output-size is private 19

Case 2 (private output-size) l Suppose the output-size is private l Size-hiding computation is feasible in SSC model ⇔ for every ü The party can know all input-sizes; and ü ∃ : Feasible! Infeasible 20

Main Idea for Construction (1) 3 4 + ¡1 ¡2 FHE MPC l 𝑄 1 , 𝑄 2 are not involved in KeyGen ∵ 𝑄 1 , 𝑄 2 must not join threshold Decryption of 𝒛 l 𝑄 1 , 𝑄 2 do Evaluation , and obtain 𝑧 with zero paddings Thanks to the padding, they can do this without knowing |𝑧| 21

Main Idea for Construction (2) 3 4 l 𝑄 ( , 𝑄 0 do KeyGen l 𝑄 1 , 𝑄 2 get encrypted input-shares l 𝑄 1 , 𝑄 2 do Evaluate using MPC ¡1 ¡2 l 𝑄 ( , 𝑄 0 do threshold Decryption If 𝑄 ( , 𝑄 1 or 𝑄 2 is honest 𝑄 0 are corrupted Security by MPC FHE does not work If 𝑄 1 , 𝑄 ( or 𝑄 0 is honest 2 are corrupted 𝑄 Security by FHE MPC does not work FHE or MPC guarantee the security! 22

Infeasibility (Reduced to [LNO13]) P B 2 2 3 1 3 1 P A 𝐺 𝑦 ( ,𝑦 0 ,𝑦 1 l Suppose the class is feasible l Let 𝐺 𝑦 ( , 𝑦 0 , 𝑦 1 = 𝑔 𝑦 ( , 𝑦 0 l Two private sizes (in two-party) is feasible l It contradicts [LNO13] 23

Conclusion l Hiding two is infeasible (standard model) l SSC model is rich for size-hiding l Some of them are still infeasible Thank you for your attention! 24

Q&A l How to implement SSC by steganography? u A party can hide message of an arbitrary length Adv ? Q3&5?9A8K7#*AS4W356 25

Q&A l How to implement SSC by steganography? u A party can hide message of an arbitrary length Adv ? Q3&5?9A8K7#*AS4W356 26

Conclusion Background l [LNO13] constructed size-hiding protocol for two parties l They also proved the strong limitation This work l We introduce the strong secure channel (SSC) model l We construct size-hiding protocols in the SSC model l We also prove the (weaker) limitation for the SSC model Thank you for your attention! 27

Set Intersection l Police has a list of terrorists 𝑌 l Company has a list of customers 𝑍 l Police wish to compute 𝑌 ∩ 𝑍 without revealing |𝑌| l Naïve approach, Padding, is inefficient ・ Millionaire Problem (Population version) l Aliens: “Which planet has the largest population?” l The population is related to the military power l Its size is also related to the military power l Padding doesn’t work since the upper-bound is too large 28