Distributed Oblivious RAM for Secure Two-Party Computation
|
|
|
- Kerry Edwards
- 5 years ago
- Views:
Transcription
1 Seminar in Distributed Computing Distributed Oblivious RAM for Secure Two-Party Computation Steve Lu & Rafail Ostrovsky Philipp Gamper Philipp Gamper
2 Yao s millionaires problem Two millionaires 1 wish to know who is richer 1 in the following, Alice and Bob Philipp Gamper
3 Yao s millionaires problem Two millionaires 1 wish to know who is richer They do not want share any information about each others wealth 1 in the following, Alice and Bob Philipp Gamper
4 Yao s millionaires problem Two millionaires 1 wish to know who is richer They do not want share any information about each others wealth How can they carry out such a conversation? 1 in the following, Alice and Bob Philipp Gamper
5 Oblivious transfer (OT) Alice has two messages m 0 and m 1, Bob has a bit b Bob wishes to receive m b, without Alice learning b Alice wants Bob receiving only either of the two messages Philipp Gamper
6 Oblivious transfer (OT) Alice has two messages m 0 and m 1, Bob has a bit b Bob wishes to receive m b, without Alice learning b Alice wants Bob receiving only either of the two messages Philipp Gamper
7 Oblivious transfer (OT) Alice has two messages m 0 and m 1, Bob has a bit b Bob wishes to receive m b, without Alice learning b Alice wants Bob receiving only either of the two messages Philipp Gamper
8 Oblivious transfer (OT) Alice has two messages m 0 and m 1, Bob has a bit b Bob wishes to receive m b, without Alice learning b Alice wants Bob receiving only either of the two messages Philipp Gamper
9 Oblivious transfer (OT) Alice has two messages m 0 and m 1, Bob has a bit b Bob wishes to receive m b, without Alice learning b Alice wants Bob receiving only either of the two messages Philipp Gamper
10 Oblivious transfer (OT) Alice has two messages m 0 and m 1, Bob has a bit b Bob wishes to receive m b, without Alice learning b Alice wants Bob receiving only either of the two messages Philipp Gamper
11 Oblivious transfer (OT) Alice has two messages m 0 and m 1, Bob has a bit b Bob wishes to receive m b, without Alice learning b Alice wants Bob receiving only either of the two messages Philipp Gamper
12 Boolean circuits AND-gate and its corresponding truth table u v w Philipp Gamper
13 Garbled circuits garble input / output wires by assigning keys / labels to them u v w ku 0 kv 0 kw 0 ku 0 kv 1 kw 0 ku 1 kv 0 kw 0 ku 1 kv 1 kw 1 2 Enc a,b (x) = Enc a(enc b (x)) Philipp Gamper
14 Garbled circuits garble input / output wires by assigning keys / labels to them encrypt 2 output wire using the keys of the input wires u v w ku 0 kv 0 kw 0 ku 0 kv 1 kw 0 ku 1 kv 0 kw 0 ku 1 kv 1 kw 1 u v w ku 0 kv 0 Enc k 0 u,kv 0(k w 0 ) ku 0 kv 1 Enc k 0 u,kv 1(k w 0 ) ku 1 kv 0 Enc k 1 u,kv 0(k w 0 ) ku 1 kv 1 Enc k 1 u,kv 1(k w 1 ) 2 Enc a,b (x) = Enc a(enc b (x)) Philipp Gamper
15 Garbled circuits garble input / output wires by assigning keys / labels to them encrypt 2 output wire using the keys of the input wires randomly permute the resulting truth table u v w ku 0 kv 0 kw 0 ku 0 kv 1 kw 0 ku 1 kv 0 kw 0 ku 1 kv 1 kw 1 u v w ku 0 kv 1 Enc k 0 u,kv 1(k w 0 ) ku 1 kv 1 Enc k 1 u,kv 1(k w 1 ) ku 1 kv 0 Enc k 1 u,kv 0(k w 0 ) ku 0 kv 0 Enc k 0 u,kv 0(k w 0 ) 2 Enc a,b (x) = Enc a(enc b (x)) Philipp Gamper
16 Garbled circuits evaluate the circuit gate by gate to obtain the encrypted output c d w Enc k 0 u,kv 0 (k c 0) Enc kx 0 (k 0,k0 y d ) Enc kc 0 (k,k0 w 0 ) d Enc k 0 u,kv 1 (k c 0) Enc kx 0 (k 0,k1 y d ) Enc kc 0 (k,k1 w 0 ) d Enc k 1 u,kv 0 (k c 0) Enc kx 1 (k 0,k0 y d ) Enc kc 1 (k,k0 w 0 ) d Enc k 1 u,kv 1 (k c 1) Enc kx 1 (k 1,k1 y d ) Enc kc 1 (k,k1 w 1 ) d Philipp Gamper
17 Garbled circuits evaluate the circuit gate by gate to obtain the encrypted output c d w Enc k 0 u,kv 0 (k c 0) Enc kx 0 (k 0,k0 y d ) Enc kc 0 (k,k0 w 0 ) d Enc k 0 u,kv 1 (k c 0) Enc kx 0 (k 0,k1 y d ) Enc kc 0 (k,k1 w 0 ) d Enc k 1 u,kv 0 (k c 0) Enc kx 1 (k 0,k0 y d ) Enc kc 1 (k,k0 w 0 ) d Enc k 1 u,kv 1 (k c 1) Enc kx 1 (k 1,k1 y d ) Enc kc 1 (k,k1 w 1 ) d Philipp Gamper
18 Garbled circuits evaluate the circuit gate by gate to obtain the encrypted output c d w Enc k 0 u,kv 0 (k c 0) Enc kx 0 (k 0,k0 y d ) Enc kc 0 (k,k0 w 0 ) d Enc k 0 u,kv 1 (k c 0) Enc kx 0 (k 0,k1 y d ) Enc kc 0 (k,k1 w 0 ) d Enc k 1 u,kv 0 (k c 0) Enc kx 1 (k 0,k0 y d ) Enc kc 1 (k,k0 w 0 ) d Enc k 1 u,kv 1 (k c 1) Enc kx 1 (k 1,k1 y d ) Enc kc 1 (k,k1 w 1 ) d Philipp Gamper
19 Garbled circuits evaluate the circuit gate by gate to obtain the encrypted output c d w Enc k 0 u,kv 0 (k c 0) Enc kx 0 (k 0,k0 y d ) Enc kc 0 (k,k0 w 0 ) d Enc k 0 u,kv 1 (k c 0) Enc kx 0 (k 0,k1 y d ) Enc kc 0 (k,k1 w 0 ) d Enc k 1 u,kv 0 (k c 0) Enc kx 1 (k 0,k0 y d ) Enc kc 1 (k,k0 w 0 ) d Enc k 1 u,kv 1 (k c 1) Enc kx 1 (k 1,k1 y d ) Enc kc 1 (k,k1 w 1 ) d Philipp Gamper
20 Garbled circuits evaluate the circuit gate by gate to obtain the encrypted output c d w Enc k 0 u,kv 0 (k c 0) Enc kx 0 (k 0,k0 y d ) Enc kc 0 (k,k0 w 0 ) d Enc k 0 u,kv 1 (k c 0) Enc kx 0 (k 0,k1 y d ) Enc kc 0 (k,k1 w 0 ) d Enc k 1 u,kv 0 (k c 0) Enc kx 1 (k 0,k0 y d ) Enc kc 1 (k,k0 w 0 ) d Enc k 1 u,kv 1 (k c 1) Enc kx 1 (k 1,k1 y d ) Enc kc 1 (k,k1 w 1 ) d Output translation [(0, k 0 w ), (1, k 1 w )] Philipp Gamper
21 A solution to the millionaires problem 1. Alice generates a garbled full adder circuit that outputs the carry flag 2. Alice sends the circuit to Bob along with her encrypted input 3. Bob receives his encrypted inputs using oblivious transfer 4. Bob evaluates the circuit gate by gate to obtain his output 5. Alice and Bob communicate to learn the output Philipp Gamper
22 Oblivious RAM (ORAM) Philipp Gamper
23 Oblivious RAM (ORAM) Def (informal): The sequence of memory access of an oblivious RAM reveals no information about the input, beyond the running time for the input Philipp Gamper
24 Trivial ORAM for every operation scan through entire memory obviously hides the access pattern BUT causes O(n) overhead Philipp Gamper
25 The square root solution Philipp Gamper
26 The square root solution - initialization randomly permute memory cells 1 to n + n using a PRF π(i) Philipp Gamper
27 The square root solution - i-th step (i = 1, v = 3) Philipp Gamper
28 The square root solution - i-th step (i = 1, v = 3) 1. simulate n memory accesses by reading cells n + n + 1 to n + 2 n Philipp Gamper
29 The square root solution - i-th step (i = 1, v = 3) 1. simulate n memory accesses by reading cells n + n + 1 to n + 2 n 2. if v-th cell was found, access next dummy cell π(n + i) else retrieve it from π(v) Philipp Gamper
30 The square root solution - i-th step (i = 1, v = 3) 1. simulate n memory accesses by reading cells n + n + 1 to n + 2 n 2. if v-th cell was found, access next dummy cell π(n + i) else retrieve it from π(v) 3. keep the value of the v-th cell in the n + n + i-th cell Philipp Gamper
31 The square root solution - i-th step (i = 2, v = n) Philipp Gamper
32 The square root solution - i-th step (i = 2, v = n) first access to cell v, retrieve from π(v) after simulating n memory accesses Philipp Gamper
33 The square root solution - i-th step (i = 2, v = n) first access to cell v, retrieve from π(v) after simulating n memory accesses keep the value of the v-th cell in the n + n + i-th cell Philipp Gamper
34 The square root solution - i-th step (i = 3, v = 3) Philipp Gamper
35 The square root solution - i-th step (i = 3, v = 3) the v-th cell has been read before, access dummy cell π(n + i) Philipp Gamper
36 The square root solution - i-th step (i = 3, v = 3) the v-th cell has been read before, access dummy cell π(n + i) after n queries the cache is full Philipp Gamper
37 The square root solution - i-th step (i = 3, v = 3) the v-th cell has been read before, access dummy cell π(n + i) after n queries the cache is full reshuffling called oblivious sorting required Philipp Gamper
38 Oblivious sorting Def (informal): A sorting algorithm is called oblivious iff the sequence of compare operations is independent of the input. The general, very informal idea of oblivious sorting is as follows assign random tags to each memory cell sort the cells according to the tag e.g., Bubble Sort is oblivious, while Quick Sort is not Philipp Gamper
39 The square root solution - Analysis Overhead to perform n queries each query requires n memory accesses there are n queries per round, what requires n n = n memory accesses n-rounds n-queries results in n i=1 n = n n, thus O(n n) oblivious sorting requires O(nlog(n)), and O( nlog(n)n) in total the overall overhead is O( nlog(n)) Philipp Gamper
40 The square root solution - Analysis Overhead to perform n queries each query requires n memory accesses there are n queries per round, what requires n n = n memory accesses n-rounds n-queries results in n i=1 n = n n, thus O(n n) oblivious sorting requires O(nlog(n)), and O( nlog(n)n) in total the overall overhead is O( nlog(n)) Hence the ORAM simulation is dominated by the oblivious sorting Philipp Gamper
41 Secure two party computation using ORAM Philipp Gamper
42 ORAM using a hierarchical data structure Philipp Gamper
43 ORAM using a hierarchical data structure the idea remains the same as in the square root solution 1. fetch some records in order to obtain (v, x) 2. check whether x has been found or not 3. retrieve directly from π(v) or do dummy access respectively 4. re-encrypt x and store back 5. reshuffle if cache, i.e., the root bucket, becomes full Philipp Gamper
44 The query (simplified) first query to cell v Philipp Gamper
45 The query (simplified) always traverse tree until reaching a leaf Philipp Gamper
46 The query (simplified) re-insert cell v in the next empty cell in the root bucket Philipp Gamper
47 The query (simplified) further queries to cell v Philipp Gamper
48 The query (simplified) again fetch until reaching a leaf node Philipp Gamper
49 The query (simplified) insert dummy cell, as v is already in the root bucket Philipp Gamper
50 The reshuffling (simplified) reshuffling required, if the root bucket becomes full Philipp Gamper
51 The reshuffling (simplified) all cells of the root bucket are pushed down to the 2nd-level Philipp Gamper
52 The reshuffling (simplified) while reshuffling level j, two new hash functions are chosen Philipp Gamper
53 The reshuffling (simplified) if j + 1-th level becomes full, it is reshuffled as well Philipp Gamper
54 The reshuffling (simplified) if the 2nd to i-th level are half full, level i eventually becomes full Philipp Gamper
55 The reshuffling (simplified) hence, the i + 1-th level ends up half full Philipp Gamper
56 Key ingredients levels are alternating distributed on the two server avoid oblivious sorting use tagging, that is PRF (i, e i, v), where e is the epoch, i the level and v the index of the record Cuckoo hashing with a stash to cause the buckets overflowing with negligible probability Philipp Gamper
57 Analysis O(log(n)) computational overhead, if using a buckets of size 3 log(n)/log(log(n)) O(1) client storage two servers using O(n) storage each negligible probability of an attacker is able to distinguish between two query sequences Philipp Gamper
58 Secure two party computation Two parties wish to compute some function f (x, y) on their inputs x and y Philipp Gamper
59 Secure two party computation Two parties wish to compute some function f (x, y) on their inputs x and y let both parties play the role of one server each the client is shared between the two parties using secret sharing only build atomic opration on the ORAM in circuits simulate the underlying circuit of f using ORAM communicate to learn the output Philipp Gamper
60 Conclusion Philipp Gamper
61 Conclusion we have seen a multi-server model for oblivious RAM using O(1) client and O(n) server storage resulting in a only O(log(n)) computational overhead a two-party secure RAM computation protocol, that is more efficient than existing construction Philipp Gamper
62 References Towards a theory of software protection and simulation by oblivious RAMs Oded Goldreich Protocols for secure computations Andrew Chi-Chih Yao Software protection and simulation on oblivious RAMs Oded Goldreich, Rafail Ostrovsky Efficient computation on oblivious rams Rafail Ostrovsky Private information storage Rafail Ostrovsky, VictorShoup More robust hashing: Cuckoo hashing with a stash Adam Kirsch, Michael Mitzenmacher, and Udi Wieder Philipp Gamper
Benny Pinkas Bar Ilan University
Winter School on Bar-Ilan University, Israel 30/1/2011-1/2/2011 Bar-Ilan University Benny Pinkas Bar Ilan University 1 Extending OT [IKNP] Is fully simulatable Depends on a non-standard security assumption
Lectures 1&2: Introduction to Secure Computation, Yao s and GMW Protocols
CS 294 Secure Computation January 19, 2016 Lectures 1&2: Introduction to Secure Computation, Yao s and GMW Protocols Instructor: Sanjam Garg Scribe: Pratyush Mishra 1 Introduction Secure multiparty computation
Multiparty Computation
Multiparty Computation Principle There is a (randomized) function f : ({0, 1} l ) n ({0, 1} l ) n. There are n parties, P 1,...,P n. Some of them may be adversarial. Two forms of adversarial behaviour:
A Practical Universal Circuit Construction and Secure Evaluation of Private Functions
A Practical Universal Circuit Construction and, Bell Labs, Murray Hill, NJ, USA http://www.cs.toronto.edu/~vlad/, University of Erlangen-Nuremberg, Germany http://thomaschneider.de Financial Cryptography
Communication Complexity and Secure Function Evaluation
Communication Complexity and Secure Function Evaluation arxiv:cs/0109011v1 [cs.cr] 9 Sep 2001 Moni Naor Kobbi Nissim Department of Computer Science and Applied Mathematics Weizmann Institute of Science,
1 Secure two-party computation
CSCI 5440: Cryptography Lecture 7 The Chinese University of Hong Kong, Spring 2018 26 and 27 February 2018 In the first half of the course we covered the basic cryptographic primitives that enable secure
CS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky. Lecture 10
CS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky Lecture 10 Lecture date: 14 and 16 of March, 2005 Scribe: Ruzan Shahinian, Tim Hu 1 Oblivious Transfer 1.1 Rabin Oblivious Transfer
Lecture 3,4: Multiparty Computation
CS 276 Cryptography January 26/28, 2016 Lecture 3,4: Multiparty Computation Instructor: Sanjam Garg Scribe: Joseph Hui 1 Constant-Round Multiparty Computation Last time we considered the GMW protocol,
Keyword Search and Oblivious Pseudo-Random Functions
Keyword Search and Oblivious Pseudo-Random Functions Mike Freedman NYU Yuval Ishai, Benny Pinkas, Omer Reingold 1 Background: Oblivious Transfer Oblivious Transfer (OT) [R], 1-out-of-N [EGL]: Input: Server:
Cut-and-Choose Yao-Based Secure Computation in the Online/Offline and Batch Settings
Cut-and-Choose Yao-Based Secure Computation in the Online/Offline and Batch Settings Yehuda Lindell Bar-Ilan University, Israel Technion Cryptoday 2014 Yehuda Lindell Online/Offline and Batch Yao 30/12/2014
Lecture 38: Secure Multi-party Computation MPC
Lecture 38: Secure Multi-party Computation Problem Statement I Suppose Alice has private input x, and Bob has private input y Alice and Bob are interested in computing z = f (x, y) such that each party
Computing on Encrypted Data
Computing on Encrypted Data COSIC, KU Leuven, ESAT, Kasteelpark Arenberg 10, bus 2452, B-3001 Leuven-Heverlee, Belgium. August 31, 2018 Computing on Encrypted Data Slide 1 Outline Introduction Multi-Party
i-hop Homomorphic Encryption Schemes
i-hop Homomorphic Encryption Schemes Craig Gentry Shai Halevi Vinod Vaikuntanathan March 12, 2010 Abstract A homomorphic encryption scheme enables computing on encrypted data by means of a public evaluation
Oblivious Transfer and Secure Multi-Party Computation With Malicious Parties
CS 380S Oblivious Transfer and Secure Multi-Party Computation With Malicious Parties Vitaly Shmatikov slide 1 Reminder: Oblivious Transfer b 0, b 1 i = 0 or 1 A b i B A inputs two bits, B inputs the index
ECS 189A Final Cryptography Spring 2011
ECS 127: Cryptography Handout F UC Davis Phillip Rogaway June 9, 2011 ECS 189A Final Cryptography Spring 2011 Hints for success: Good luck on the exam. I don t think it s all that hard (I do believe I
On i-hop Homomorphic Encryption
No relation to On i-hop Homomorphic Encryption Craig Gentry, Shai Halevi, Vinod Vaikuntanathan IBM Research 2 This Work is About Connections between: Homomorphic encryption (HE) Secure function evaluation
Secure Multi-Party Computation. Lecture 17 GMW & BGW Protocols
Secure Multi-Party Computation Lecture 17 GMW & BGW Protocols MPC Protocols MPC Protocols Yao s Garbled Circuit : 2-Party SFE secure against passive adversaries MPC Protocols Yao s Garbled Circuit : 2-Party
Are you the one to share? Secret Transfer with Access Structure
Are you the one to share? Secret Transfer with Access Structure Yongjun Zhao, Sherman S.M. Chow Department of Information Engineering The Chinese University of Hong Kong, Hong Kong Private Set Intersection
A New Approach to Practical Active-Secure Two-Party Computation
A New Approach to Practical Active-Secure Two-Party Computation Jesper Buus Nielsen 1,,, Peter Sebastian Nordholt 1,, Claudio Orlandi 2,, Sai Sheshank Burra 3 1 Aarhus University 2 Bar-Ilan University
Fundamental MPC Protocols
3 Fundamental MPC Protocols In this chapter we survey several important MPC approaches, covering the main protocols and presenting the intuition behind each approach. All of the approaches discussed can
Universal Blind Quantum Computing
Universal Blind Quantum Computing Elham Kashefi Laboratoire d Informatique de Grenoble Joint work with Anne Broadbent Montreal Joe Fitzsimons Oxford Classical Blind Computing Fundamentally asymmetric unlike
6.892 Computing on Encrypted Data October 28, Lecture 7
6.892 Computing on Encrypted Data October 28, 2013 Lecture 7 Lecturer: Vinod Vaikuntanathan Scribe: Prashant Vasudevan 1 Garbled Circuits Picking up from the previous lecture, we start by defining a garbling
Circuit ORAM: On Tightness of the Goldreich-Ostrovsky Lower Bound
Circuit ORAM: On Tightness of the Goldreich-Ostrovsky Lower Bound Xiao Shaun Wang wangxiao@cs.umd.edu University of Maryland T-H. Hubert Chan hubert@cs.hku.hk University of Hong Kong November 27, 2016
The Laws of Cryptography Zero-Knowledge Protocols
26 The Laws of Cryptography Zero-Knowledge Protocols 26.1 The Classes NP and NP-complete. 26.2 Zero-Knowledge Proofs. 26.3 Hamiltonian Cycles. An NP-complete problem known as the Hamiltonian Cycle Problem
Lecture th January 2009 Fall 2008 Scribes: D. Widder, E. Widder Today s lecture topics
0368.4162: Introduction to Cryptography Ran Canetti Lecture 11 12th January 2009 Fall 2008 Scribes: D. Widder, E. Widder Today s lecture topics Introduction to cryptographic protocols Commitments 1 Cryptographic
Advanced Implementations of Tables: Balanced Search Trees and Hashing
Advanced Implementations of Tables: Balanced Search Trees and Hashing Balanced Search Trees Binary search tree operations such as insert, delete, retrieve, etc. depend on the length of the path to the
CS Communication Complexity: Applications and New Directions
CS 2429 - Communication Complexity: Applications and New Directions Lecturer: Toniann Pitassi 1 Introduction In this course we will define the basic two-party model of communication, as introduced in the
A Multi-dimensional Yao s Millionaire Protocol
CERIAS Tech Report 2001-09 A Multi-dimensional Yao s Millionaire Protocol Mikhail Atallah, Wenliang Du Center for Education and Research in Information Assurance and Security & Department of Computer Sciences,
SecureML: A System for Scalable Privacy-Preserving Machine Learning
SecureML: A System for Scalable Privacy-Preserving Machine Learning Payman Mohassel Yupeng Zhang Abstract Machine learning is widely used in practice to produce predictive models for applications such
Extending Oblivious Transfers Efficiently
Extending Oblivious Transfers Efficiently Yuval Ishai Technion Joe Kilian Kobbi Nissim Erez Petrank NEC Microsoft Technion Motivation x y f(x,y) How (in)efficient is generic secure computation? myth don
Authentication. Chapter Message Authentication
Chapter 5 Authentication 5.1 Message Authentication Suppose Bob receives a message addressed from Alice. How does Bob ensure that the message received is the same as the message sent by Alice? For example,
CSA E0 312: Secure Computation September 09, [Lecture 9-10]
![CSA E0 312: Secure Computation September 09, [Lecture 9-10]](/thumbs/90/104357577.jpg "CSA E0 312: Secure Computation September 09, [Lecture 9-10]")
CSA E0 312: Secure Computation September 09, 2015 Instructor: Arpita Patra [Lecture 9-10] Submitted by: Pratik Sarkar 1 Summary In this lecture we will introduce the concept of Public Key Samplability
Differentially Private Oblivious RAM
Sameer Wagh, Paul Cuff, and Prateek Mittal Differentially Private Oblivious RAM arxiv:1601.03378v4 [cs.cr] 10 Jan 2018 Abstract: In this work, we investigate if statistical privacy can enhance the performance
Foundations of Differentially Oblivious Algorithms
Foundations of Differentially Oblivious Algorithms T-H. Hubert Chan Kai-Min Chung Bruce Maggs Elaine Shi February 15, 2018 Abstract It is well-known that a program s memory access pattern can leak information
A New Approach to Practical Secure Two-Party Computation. Jesper Buus Nielsen Peter Sebastian Nordholt Claudio Orlandi Sai Sheshank
A New Approach to Practical Secure Two-Party Computation Jesper Buus Nielsen Peter Sebastian Nordholt Claudio Orlandi Sai Sheshank Secure Two-Party Computation Alice has an input a {0,1} * Bob has an input
Question 1. The Chinese University of Hong Kong, Spring 2018
CSCI 5440: Cryptography The Chinese University of Hong Kong, Spring 2018 Homework 2 Solutions Question 1 Consider the following encryption algorithm based on the shortlwe assumption. The secret key is
1 Basic Number Theory
ECS 228 (Franklin), Winter 2013, Crypto Review 1 Basic Number Theory This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Statistically-secure ORAM with Õ(log 2 n) Overhead
Statistically-secure ORAM with Õ(log 2 n) Overhead Kai-Min Chung 1, Zhenming Liu 2, and Rafael Pass 3 1 Institute of Information Science, Academia Sinica, Taiwan. kmchung@iis.sinica.edu.tw 2 Department
Malicious Security. 6.1 Cut-and-Choose. Figure 6.1: Summary of malicious MPC protocols discussed in this chapter.
6 Malicious Security So far, we have focused on semi-honest protocols which provide privacy and security only against passive adversaries who follow the protocol as specified. The semi-honest threat model
Circular Range Search on Encrypted Spatial Data
Circular Range Search on Encrypted Spatial Data Boyang Wang, Ming Li, Haitao Wang and Hui Li Department of Computer Science, Utah State University, Logan, UT, USA State Key Laboratory of Integrated Service
Discrete Logarithm Problem
Discrete Logarithm Problem Finite Fields The finite field GF(q) exists iff q = p e for some prime p. Example: GF(9) GF(9) = {a + bi a, b Z 3, i 2 = i + 1} = {0, 1, 2, i, 1+i, 2+i, 2i, 1+2i, 2+2i} Addition:
Public Key Encryption with Conjunctive Field Keyword Search
Public Key Encryption with Conjunctive Field Keyword Search Dong Jin PARK Kihyun KIM Pil Joong LEE IS Lab, POSTECH, Korea August 23, 2004 Contents 1 Preliminary 2 Security Model 3 Proposed Scheme 1 4 Proposed
Lecture 16: Communication Complexity
CSE 531: Computational Complexity I Winter 2016 Lecture 16: Communication Complexity Mar 2, 2016 Lecturer: Paul Beame Scribe: Paul Beame 1 Communication Complexity In (two-party) communication complexity
Additive Conditional Disclosure of Secrets
Additive Conditional Disclosure of Secrets Sven Laur swen@math.ut.ee Helsinki University of Technology Motivation Consider standard two-party computation protocol. x f 1 (x, y) m 1 m2 m r 1 mr f 2 (x,
Efficient Constant Round Multi-Party Computation Combining BMR and SPDZ
Efficient Constant Round Multi-Party Computation Combining BMR and SPDZ Yehuda Lindell Benny Pinkas Nigel P. Smart vishay Yanai bstract Recently, there has been huge progress in the field of concretely
Report on PIR with Low Storage Overhead
Report on PIR with Low Storage Overhead Ehsan Ebrahimi Targhi University of Tartu December 15, 2015 Abstract Private information retrieval (PIR) protocol, introduced in 1995 by Chor, Goldreich, Kushilevitz
A New Approach to Practical Active-Secure Two-Party Computation
A New Approach to Practical Active-Secure Two-Party Computation Jesper Buus Nielsen 1, Peter Sebastian Nordholt 1, Claudio Orlandi 1, Sai Sheshank Burra 2 1 Aarhus University, Denmark 2 Indian Institute
CPSC 467b: Cryptography and Computer Security
Outline Authentication CPSC 467b: Cryptography and Computer Security Lecture 18 Michael J. Fischer Department of Computer Science Yale University March 29, 2010 Michael J. Fischer CPSC 467b, Lecture 18
Cryptography and Security Final Exam
Cryptography and Security Final Exam Serge Vaudenay 29.1.2018 duration: 3h no documents allowed, except one 2-sided sheet of handwritten notes a pocket calculator is allowed communication devices are not
Fast Cut-and-Choose Based Protocols for Malicious and Covert Adversaries
Fast Cut-and-Choose Based Protocols for Malicious and Covert Adversaries Yehuda Lindell Dept. of Computer Science Bar-Ilan University, Israel lindell@biu.ac.il February 8, 2015 Abstract In the setting
Introduction to Cryptography
B504 / I538: Introduction to Cryptography Spring 2017 Lecture 12 Recall: MAC existential forgery game 1 n Challenger (C) k Gen(1 n ) Forger (A) 1 n m 1 m 1 M {m} t 1 MAC k (m 1 ) t 1 m 2 m 2 M {m} t 2
Locally Decodable and Updatable Non-Malleable Codes and Their Applications
Locally Decodable and Updatable Non-Malleable Codes and Their Applications Dana Dachman-Soled University of Maryland danadach@ece.umd.edu Feng-Hao Liu University of Maryland fenghao@cs.umd.edu Hong-Sheng
Faster Malicious 2-party Secure Computation with Online/Offline Dual Execution
Faster Malicious 2-party Secure Computation with Online/Offline Dual Execution Peter Rindal Mike Rosulek June 17, 2016 Abstract We describe a highly optimized protocol for general-purpose secure two-party
communication complexity lower bounds yield data structure lower bounds
communication complexity lower bounds yield data structure lower bounds Implementation of a database - D: D represents a subset S of {...N} 2 3 4 Access to D via "membership queries" - Q for each i, can
CIS 6930/4930 Computer and Network Security. Topic 5.2 Public Key Cryptography
CIS 6930/4930 Computer and Network Security Topic 5.2 Public Key Cryptography 1 Diffie-Hellman Key Exchange 2 Diffie-Hellman Protocol For negotiating a shared secret key using only public communication
Optimizing Authenticated Garbling for Faster Secure Two-Party Computation
Optimizing Authenticated Garbling for Faster Secure Two-Party Computation Jonathan Katz University of Maryland jkatz@cs.umd.edu Samuel Ranellucci University of Maryland George Mason University samuel@umd.edu
Introduction to Modern Cryptography Lecture 11
Introduction to Modern Cryptography Lecture 11 January 10, 2017 Instructor: Benny Chor Teaching Assistant: Orit Moskovich School of Computer Science Tel-Aviv University Fall Semester, 2016 17 Tuesday 12:00
1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Introduction to Cryptography Lecture 13
Introduction to Cryptography Lecture 13 Benny Pinkas June 5, 2011 Introduction to Cryptography, Benny Pinkas page 1 Electronic cash June 5, 2011 Introduction to Cryptography, Benny Pinkas page 2 Simple
A survey on quantum-secure cryptographic systems
A survey on quantum-secure cryptographic systems Tomoka Kan May 24, 2018 1 Abstract Post-quantum cryptography refers to the search for classical cryptosystems which remain secure in the presence of a quantum
QUANTUM COMMUNICATIONS BASED ON QUANTUM HASHING. Alexander Vasiliev. Kazan Federal University
QUANTUM COMMUNICATIONS BASED ON QUANTUM HASHING Alexander Vasiliev Kazan Federal University Abstract: In this paper we consider an application of the recently proposed quantum hashing technique for computing
Blazing Fast 2PC in the Offline/Online Setting with Security for Malicious Adversaries
Blazing Fast 2PC in the Offline/Online Setting with Security for Malicious Adversaries Yehuda Lindell Ben Riva June 21, 2016 Abstract Recently, several new techniques were presented to dramatically improve
On the Communication Complexity of Secure Function Evaluation with Long Output
On the Communication Complexity of Secure Function Evaluation with Long Output Pavel Hubáček Daniel Wichs Abstract We study the communication complexity of secure function evaluation (SFE). Consider a
CPA-Security. Definition: A private-key encryption scheme
CPA-Security The CPA Indistinguishability Experiment PrivK cpa A,Π n : 1. A key k is generated by running Gen 1 n. 2. The adversary A is given input 1 n and oracle access to Enc k, and outputs a pair of
L7. Diffie-Hellman (Key Exchange) Protocol. Rocky K. C. Chang, 5 March 2015
L7. Diffie-Hellman (Key Exchange) Protocol Rocky K. C. Chang, 5 March 2015 1 Outline The basic foundation: multiplicative group modulo prime The basic Diffie-Hellman (DH) protocol The discrete logarithm
One-Round Secure Computation and Secure Autonomous Mobile Agents
One-Round Secure Computation and Secure Autonomous Mobile Agents (Extended Abstract) Christian Cachin 1, Jan Camenisch 1, Joe Kilian 2, and Joy Müller 1 Abstract. This paper investigates one-round secure
Communication Complexity
Communication Complexity Jaikumar Radhakrishnan School of Technology and Computer Science Tata Institute of Fundamental Research Mumbai 31 May 2012 J 31 May 2012 1 / 13 Plan 1 Examples, the model, the
Garbled RAM From One-Way Functions
Garbled RAM From One-Way Functions Sanjam Garg Steve Lu Rafail Ostrovsky Alessandra Scafuro Abstract Yao s garbled circuit construction is a fundamental construction in cryptography and recent efficiency
Verification of the TLS Handshake protocol
Verification of the TLS Handshake protocol Carst Tankink (0569954), Pim Vullers (0575766) 20th May 2008 1 Introduction In this text, we will analyse the Transport Layer Security (TLS) handshake protocol.
On Everlasting Security in the Hybrid Bounded Storage Model
On Everlasting Security in the Hybrid Bounded Storage Model Danny Harnik Moni Naor Abstract The bounded storage model (BSM) bounds the storage space of an adversary rather than its running time. It utilizes
Message Authentication
Motivation Message Authentication 15-859I Spring 2003 Suppose Alice is an ATM and Bob is a Ban, and Alice sends Bob messages about transactions over a public channel Bob would lie to now that when he receives
Lecture 5, CPA Secure Encryption from PRFs
CS 4501-6501 Topics in Cryptography 16 Feb 2018 Lecture 5, CPA Secure Encryption from PRFs Lecturer: Mohammad Mahmoody Scribe: J. Fu, D. Anderson, W. Chao, and Y. Yu 1 Review Ralling: CPA Security and
CS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky. Lecture 7
CS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky Lecture 7 Lecture date: Monday, 28 February, 2005 Scribe: M.Chov, K.Leung, J.Salomone 1 Oneway Trapdoor Permutations Recall that a
THE RANK METHOD AND APPLICATIONS TO POST- QUANTUM CRYPTOGRAPHY
THE RANK METHOD AND APPLICATIONS TO POST- QUANTUM CRYPTOGRAPHY Mark Zhandry - Stanford University Joint work with Dan Boneh Classical Cryptography Post-Quantum Cryptography All communication stays classical
Faster Maliciously Secure Two-Party Computation Using the GPU Full version
Faster Maliciously Secure Two-Party Computation Using the GPU Full version Tore Kasper Frederiksen, Thomas P. Jakobsen, and Jesper Buus Nielsen July 15, 2014 Department of Computer Science, Aarhus University
MASCOT: Faster Malicious Arithmetic Secure Computation with Oblivious Transfer
MASCOT: Faster Malicious Arithmetic Secure Computation with Oblivious Transfer Tore Frederiksen Emmanuela Orsini Marcel Keller Peter Scholl Aarhus University University of Bristol 31 May 2016 Secure Multiparty
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation Yehuda Lindell Dept. of Computer Science and Applied Math. The Weizmann Institute of Science Rehovot 76100, Israel. lindell@wisdom.weizmann.ac.il
Efficient Set Intersection with Simulation-Based Security
Efficient Set Intersection with Simulation-Based Security Michael J. Freedman Carmit Hazay Kobbi Nissim Benny Pinkas September 4, 2014 Abstract We consider the problem of computing the intersection of
Attribute-based Encryption & Delegation of Computation
Lattices and Homomorphic Encryption, Spring 2013 Instructors: Shai Halevi, Tal Malkin Attribute-based Encryption & Delegation of Computation April 9, 2013 Scribe: Steven Goldfeder We will cover the ABE
2 Message authentication codes (MACs)
CS276: Cryptography October 1, 2015 Message Authentication Codes and CCA2 Instructor: Alessandro Chiesa Scribe: David Field 1 Previous lecture Last time we: Constructed a CPA-secure encryption scheme from
c Copyright 2016 Caleb Horst
c Copyright 2016 Caleb Horst Communication and Round Balanced Oblivious FSM Evaluation Caleb Horst A thesis submitted in partial fulfillment of the requirements for the degree of Master of Science University
Edinburgh Research Explorer
Edinburgh Research Explorer Garbled Quantum Computation Citation for published version: Kashefi, E & Wallden, P 2017, 'Garbled Quantum Computation' Cryptography, vol. 1, no. 1, 6, pp. 1-30. DOI: 10.3390/cryptography1010006
Oblivious Evaluation of Multivariate Polynomials. and Applications
The Open University of Israel Department of Mathematics and Computer Science Oblivious Evaluation of Multivariate Polynomials and Applications Thesis submitted as partial fulfillment of the requirements
Lecture 28: Public-key Cryptography. Public-key Cryptography
Lecture 28: Recall In private-key cryptography the secret-key sk is always established ahead of time The secrecy of the private-key cryptography relies on the fact that the adversary does not have access
On Adaptively Secure Multiparty Computation with a Short CRS [SCN 16] Ran Cohen (Tel Aviv University) Chris Peikert (University of Michigan)
![On Adaptively Secure Multiparty Computation with a Short CRS [SCN 16] Ran Cohen (Tel Aviv University) Chris Peikert (University of Michigan)](/thumbs/86/93628417.jpg "On Adaptively Secure Multiparty Computation with a Short CRS [SCN 16] Ran Cohen (Tel Aviv University) Chris Peikert (University of Michigan)")
On Adaptively Secure Multiparty Computation with a Short CRS [SCN 16] Ran Cohen (Tel Aviv University) Chris Peikert (University of Michigan) Secure Multiparty Computation (MPC) Ideal World/ Functionality
Cuckoo Hashing with a Stash: Alternative Analysis, Simple Hash Functions
1 / 29 Cuckoo Hashing with a Stash: Alternative Analysis, Simple Hash Functions Martin Aumüller, Martin Dietzfelbinger Technische Universität Ilmenau 2 / 29 Cuckoo Hashing Maintain a dynamic dictionary
k-nearest Neighbor Classification over Semantically Secure Encry
k-nearest Neighbor Classification over Semantically Secure Encrypted Relational Data Reporter:Ximeng Liu Supervisor: Rongxing Lu School of EEE, NTU May 9, 2014 1 2 3 4 5 Outline 1. Samanthula B K, Elmehdwi
Solutions to the Mathematics Masters Examination
Solutions to the Mathematics Masters Examination OPTION 4 Spring 2007 COMPUTER SCIENCE 2 5 PM NOTE: Any student whose answers require clarification may be required to submit to an oral examination. Each
From Secure MPC to Efficient Zero-Knowledge
From Secure MPC to Efficient Zero-Knowledge David Wu March, 2017 The Complexity Class NP NP the class of problems that are efficiently verifiable a language L is in NP if there exists a polynomial-time
Lecture 9 and 10: Malicious Security - GMW Compiler and Cut and Choose, OT Extension
CS 294 Secure Computation February 16 and 18, 2016 Lecture 9 and 10: Malicious Security - GMW Compiler and Cut and Choose, OT Extension Instructor: Sanjam Garg Scribe: Alex Irpan 1 Overview Garbled circuits
Evaluating 2-DNF Formulas on Ciphertexts
Evaluating 2-DNF Formulas on Ciphertexts Dan Boneh, Eu-Jin Goh, and Kobbi Nissim Theory of Cryptography Conference 2005 Homomorphic Encryption Enc. scheme is homomorphic to function f if from E[A], E[B],
SECURE IDENTITY-BASED ENCRYPTION IN THE QUANTUM RANDOM ORACLE MODEL. Mark Zhandry Stanford University
SECURE IDENTITY-BASED ENCRYPTION IN THE QUANTUM RANDOM ORACLE MODEL Mark Zhandry Stanford University Random Oracle Model (ROM) Sometimes, we can t prove a scheme secure in the standard model. Instead,
Lecture 16 Chiu Yuen Koo Nikolai Yakovenko. 1 Digital Signature Schemes. CMSC 858K Advanced Topics in Cryptography March 18, 2004
CMSC 858K Advanced Topics in Cryptography March 18, 2004 Lecturer: Jonathan Katz Lecture 16 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Digital Signature Schemes In this lecture, we introduce
Meeting Scheduling Guaranteeing n/2-privacy and Resistant to Statistical Analysis (Applicable to any DisCSP)
Meeting Scheduling Guaranteeing n/2-privacy and Resistant to Statistical Analysis (Applicable to any DisCSP) Marius Călin Silaghi Florida Institute of Technology, Computer Sciences Department Abstract
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Notes 23 (rev. 1) Professor M. J. Fischer November 29, 2005 1 Oblivious Transfer Lecture Notes 23 In the locked
Computer Science A Cryptography and Data Security. Claude Crépeau
Computer Science 308-547A Cryptography and Data Security Claude Crépeau These notes are, largely, transcriptions by Anton Stiglic of class notes from the former course Cryptography and Data Security (308-647A)
Cryptography: A Fairy Tale for Mathematicians and Starring Mathematicians!
Cryptography: A Fairy Tale for Mathematicians and Starring Mathematicians! University of California, Berkeley Mathematics Undergraduate Student Association October 27, 2014 Why Crypto? So why on earth
Fully Homomorphic Encryption over the Integers
Fully Homomorphic Encryption over the Integers Many slides borrowed from Craig Marten van Dijk 1, Craig Gentry 2, Shai Halevi 2, Vinod Vaikuntanathan 2 1 MIT, 2 IBM Research Computing on Encrypted Data
Lecture 14: Secure Multiparty Computation
600.641 Special Topics in Theoretical Cryptography 3/20/2007 Lecture 14: Secure Multiparty Computation Instructor: Susan Hohenberger Scribe: Adam McKibben 1 Overview Suppose a group of people want to determine
Quantum Wireless Sensor Networks
Quantum Wireless Sensor Networks School of Computing Queen s University Canada ntional Computation Vienna, August 2008 Main Result Quantum cryptography can solve the problem of security in sensor networks.