Topology-Hiding Computation for Large Diameter Graphs Adi Akavia - PowerPoint PPT Presentation

This Work: Results Result 3: Topology hiding broadcast for 1) cycles and 2) small-diameter graphs Topology hiding broadcast for small-circumference graphs Extensions: We define: A distributed algorithm is “ info-local ” if output of each party depends only on k-local neighborhood We show: Our reductions hold for arbitrary graph with “ info-local ” algorithm for spanning-tree neighbors

Remarks • Even with known overall topology , topology-hiding is still non-trivial – Example – Cycles: nodes order may be sensitive.

Remarks • Even with known overall topology , topology-hiding is still non-trivial – Example – Cycles: nodes order may be sensitive. • Voting  parallel broadcast: – voting & mix-networks inspiration

Tool: PKCR-encryption Public key encryption , which is: Given pk and c  [m] k 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative:

Tool: PKCR-encryption Public key encryption , which is: Given pk and c  [m] k 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative: PKCR-enc exists under DDH assumption.

Tool: PKCR-encryption Public key encryption , which is: Notation: Given pk and c  [m] k [m] k = Enc k (m) . 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative: PKCR-enc exists under DDH assumption.

Tool: PKCR-encryption Public key encryption , which is: Notation: Given pk and c  [m] k [m] k = Enc k (m) . 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative: – Public keys are a group with efficiently computable k 1 *k 2 , k – 1 PKCR-enc exists under DDH assumption.

Tool: PKCR-encryption Public key encryption , which is: Notation: Given pk and c  [m] k [m] k = Enc k (m) . 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative: – Public keys are a group with efficiently computable k 1 *k 2 , k – 1 – Given secret key sk can efficiently: PKCR-enc exists under DDH assumption.

Tool: PKCR-encryption Public key encryption , which is: Notation: Given pk and c  [m] k [m] k = Enc k (m) . 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative: – Public keys are a group with efficiently computable k 1 *k 2 , k – 1 – Given secret key sk can efficiently: a) Computed corresponding public-key pk(sk) . b) PKCR-enc exists under DDH assumption.

Tool: PKCR-encryption Public key encryption , which is: Notation: Given pk and c  [m] k [m] k = Enc k (m) . 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative: – Public keys are a group with efficiently computable k 1 *k 2 , k – 1 – Given secret key sk can efficiently: a) Computed corresponding public-key pk(sk) . b) AddLayer( [m] k , sk ) = [m] k*pk(sk) PKCR-enc exists under DDH assumption.

Tool: PKCR-encryption Public key encryption , which is: Notation: Given pk and c  [m] k [m] k = Enc k (m) . 1. Rerandomizable: Can produce fresh ciphertext c’  [m] k . 2. Privately key-commutative: – Public keys are a group with efficiently computable k 1 *k 2 , k – 1 – Given secret key sk can efficiently: a) Computed corresponding public-key pk(sk) . b) AddLayer( [m] k , sk ) = [m] k*pk(sk) c) DelLayer ( [m] k , sk ) = [m] k*pk(sk) -1 PKCR-enc exists under DDH assumption.

1 Our Techniques: 2 5 Topology-Hiding Voting on Cycles 4 3 Phase 1. Aggregate Encrypted Votes: Phase 2. Mix & Decrypt:

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: v 1 1 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: k 1 , v 1 1 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: k 1 , [v 1 ] k1 1 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 k 1 , [v 1 ] k1 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 k 1 , [v 1 ] k1 *k 2 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 k 1 *k 2 , [v 1 ] k1*k2 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 k 1 *k 2 , [v 1 ] k1*k2 [v 2 ] k1*k2 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 2 5 k 1 *k 2 , [v 1 ] k1*k2 [v 2 ] k1*k2 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 2 5 k=k 1 *k 2 *k 3 , [v 1 ] k [v 2 ] k [v 3 ] k 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 k=k 1 *…*k 4 *k 5 , [v 1 ] k … [ v 5 ] k 2 5 … 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 1. Aggregate Encrypted Votes: 1 k=k 1 *…*k 4 *k 5 , [v 1 ] k … [ v 5 ] k 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: 1 k=k 1 *…*k 4 *k 5 , [v 1 ] k … [v 5 ] k 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: 1 k=k 1 *…*k 4 *k 5 , [v 1 ] k … [v 5 ] k [v  (1) ] k … [v  (5) ] k 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: 1 k’ =k 1 *…*k 4 , [v  (1) ] k’ … [ v  (5) ] k’ 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: 1 2 5 k’ =k 1 *…*k 4 , [v  (1) ] k’ … [ v  (5) ] k’ 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: 1 2 5 … k‘ =k 1 *…*k 4 , [v  (1) ] k’ … [ v  (5) ] k’ 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: 1 k 1 , [v  ’ (1) ] k1 … [ v  ’ (5) ] k1 2 5 … k‘ =k 1 *…*k 4 , [v  (1) ] k’ … [ v  (5) ] k’ 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: 1 k 1 , [v  ’ (1) ] k1 … [ v  ’ (5) ] k1 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: k 1 , [v  ’ (1) ] k1 … [ v  ’ (5) ] k1 1 2 5 4 3

Our Techniques: Topology-Hiding Voting on Cycles Protocol Phase 2. Mix & Decrypt: v  ’’ (1) … v  ’’ (5) 1 2 5 4 3

Our Techniques: Reductions Toy Problem:

Our Techniques: Reductions 1 2 Toy Problem: 5 Settings: Arbitrary graph, 4 3

Our Techniques: Reductions 1 2 Toy Problem: 5 Settings: Arbitrary graph, with cycle traversing the nodes. 4 3

Our Techniques: Reductions 1 2 Toy Problem: 5 Settings: Arbitrary graph, with cycle traversing the nodes. 4 3 4 Nodes know their local-view on cycle.

Our Techniques: Reductions 1 2 Toy Problem: 5 Settings: Arbitrary graph, with cycle traversing the nodes. 4 3 4 Nodes know their local-view on cycle. Observe: Topology-hiding voting on cycle -traversal Topology-hiding voting on underlying graph .

Our Techniques: Reductions 1 2 Toy Problem: 5 Settings: Arbitrary graph, with cycle traversing the nodes. 4 3 4 Nodes know their local-view on cycle. Observe: Topology-hiding voting on cycle -traversal Topology-hiding voting on underlying graph . Reductions Outline (simplified) : 1. Find cycle-traversal (local views) while hiding topology 2. Run topology-hiding voting on this cycle -traversal

Finding Cycle-Traversal Questions: Does a cycle-traversal always exist?

Finding Cycle-Traversal Questions: Does a cycle-traversal always exist? Can it be found efficiently?

Finding Cycle-Traversal Questions: Does a cycle-traversal always exist? Can it be found efficiently? Can it be found topology-hiding?

Finding Cycle-Traversal Questions: Yes, in every Does a cycle-traversal always exist? (connected) graph. Can it be found efficiently? Can it be found topology-hiding?

Finding Cycle-Traversal Questions: Yes, in every Does a cycle-traversal always exist? (connected) graph. Yes, in every Can it be found efficiently? (connected) graph. Can it be found topology-hiding?

Finding Cycle-Traversal Questions: Yes, in every Does a cycle-traversal always exist? (connected) graph. Yes, in every Can it be found efficiently? (connected) graph. Yes, in trees . Can it be found topology-hiding?

Finding Cycle-Traversal Questions: Yes, in every Does a cycle-traversal always exist? (connected) graph. Yes, in every Can it be found efficiently? (connected) graph. Yes, in trees . Can it be found topology-hiding? Roughly , in small-circ .

Finding Cycle-Traversal in Trees Convert-to-Cycle ( N(v)=(u 1 ,…, u d )) Forward messages arriving from u i to u i+1

Finding Cycle-Traversal in Trees Convert-to-Cycle ( N(v)=(u 1 ,…, u d )) Forward messages arriving from u i to u i+1 a g b d e f c h

Finding Cycle-Traversal in Trees Convert-to-Cycle ( N(v)=(u 1 ,…, u d )) Forward messages arriving from u i to u i+1 a g b 1 2 4 d e f 3 c h

Finding Cycle-Traversal in Trees Convert-to-Cycle ( N(v)=(u 1 ,…, u d )) Forward messages arriving from u i to u i+1 a g b 1 2 4 d e f 3 c h

Finding Cycle-Traversal in Trees Convert-to-Cycle ( N(v)=(u 1 ,…, u d )) Forward messages arriving from u i to u i+1 a g b 1 2 4 d e f 3 c h

Finding Cycle-Traversal in Trees Convert-to-Cycle ( N(v)=(u 1 ,…, u d )) Forward messages arriving from u i to u i+1 a g b 1 2 4 d e f 3 c h

Finding Cycle-Traversal in Trees Convert-to-Cycle ( N(v)=(u 1 ,…, u d )) Forward messages arriving from u i to u i+1 a g b 1 2 4 d e f 3 c h