new exact on the round complexity landscape of secure...

OnTheRoundComplexityLandscapeofSecureComputation

ArpitaPatra

IndianInstituteofScience

TPMPC2019

Exact▲

JointworkwithDivya RaviandSwatiSingla

Roadmap

HonestMajority DishonestMajority

Best-of-Both-World

- guaranteedoutputdelivery(god)- fairness(fn)

- unanimousabort(ua)- selectiveabort(sa)

- god|uafn |ua

Plain (nosetup) Public (CRS)

Private (CRS+PKI)

P2P+BCChannel

MPC

x2

x3

x4

x1

Setup:- n partiesP1,....,Pn ;t are corruptedbyacentralizedadv

- Acommonn-inputfunctionf(x1,x2,..xn)- Pi hasprivate inputxi

- Correctness:Computef(x1,x2,..xn)- Privacy:Nothingmorethanfunctionoutputshouldberevealed

Goals:

- HonestMajority- DishonestMajority

CorruptionThreshold:

DegreeofRobustness- Guaranteedoutputdelivery (god)- Strongest

Adversarycannotpreventhonestpartiesfromgettingoutput

- Fairness(fn)Ifadversarygetsoutput,allgettheoutput

- Securitywithunanimousabort(ua)

Eitherallornoneofthehonestpartiesgetoutput(maybeunfair)

- Securitywithselectiveabort(sa) - weakest

Adversaryselectivelydeprivessomehonestpartiesoftheoutput

yy y y y y

┴ ┴ ┴ ┴┴┴

yy y y

yyy yyy

yy

y yyy ┴ ┴

┴ ┴ ┴ ┴

HonestMajority

Best-of-Both-World(BoBW)MPCM1:Protocolsofonetypebreakdownintheothersetting.

M3:Importantapplications(voting,federatedlearning)

F1:(god|ua)[IKLP06,K07,IKKLP11]:n,t,s:t<n/2,s+t<n(elsenopolynomialtimeprotocolexists)

- AHMprotocolisnolongerprivateandcorrectinDMsetting- ADMprotocolcannotachievegod/fn evenwhenasinglepartyiscorrupt

- Privacyviolationiscompletenoatanycost- Yet,guaranteedoutputcomputationiscalledfor(asmuchastheoreticallypossible)

F2:fn |ua [LRM10]

+Honestpresenceisstronger

IdealFeasibility:n,t,s:t<n/2ands<n

F3:god|ua (s+1residual)[IKLP06]F4:god|ua (1/psecurity)[K07,IKKLP11]

F5:god|ua (semi-honest)[IKLP06][PR19]

M2:Donotcareabouthowtheadversaryisgoingtostrike.Sleepwell.

TheRoundComplexityLandscape

HonestMajority(t<n/2) DishonestMajority(s<n)

Best-of-Both-World

P2P+BCChannel

Guaranteed(god)

fairness(fn)

unabort(ua)

seabort(sa)

Private

2

2

Public

3

3

Plain

3

3

[GIKR02,PR18JLS15]

Private

2

2

Public

2

2

Plain

4

4

[HLP12GS18,BL18]

god uafn ua

Private Public Plain

LB:r-round(fn|ua)-BoBW protocolreducesto(r-1)-roundOT.

n,t<n/2,s<n

n,t<n/2,t+s<n

3 3 5

Selectiveabort

*

UB:rroundua dishonestmajorityimplies(r+1)-round(fn|ua)-BoBW

+[HH+18,BG+18]:sa ua



Best-of-Both-World

P2P+BCChannel

Guaranteed(god)

fairness(fn)

unabort(ua)

seabort(sa)

Private

2

2

Public

3

3

Plain

3

3

[GIKR02,PR18JLS15]

Private

2

2

Public

2

2

Plain

4

4

[HLP12GS18,BL18]

god uafn ua

Private Public Plainn,t<n/2,t+s<n

3 3 52 3 4

LB:Public+3roundsA)s≤ t:Degenerateston/3≤ t≤ n/2;[PR18]

n t s n t s

B)s> t: NewLB



Best-of-Both-World

P2P+BCChannel

Guaranteed(god)

fairness(fn)

unabort(ua)

seabort(sa)

Private

2

2

Public

3

3

Plain

3

3

[GIKR02,PR18JLS15]

Private

2

2

Public

2

2

Plain

4

4

[HLP12GS18,BL18]

god uafn ua


3 3 52 3 4/5(?)

UB1,2:Seriesofcompilersstartingfroma2-roundua inDMintheBC-onlysetting[GS18,BL18].

UB3:Non-optimal(possibly)yetmostchallenging



Best-of-Both-World

P2P+BCChannel

Guaranteed(god)

fairness(fn)

unabort(ua)

seabort(sa)

Private

2

2

Public

3

3

Plain

3

3

[GIKR02,PR18JLS15]

Private

2

2

Public

2

2

Plain

4

4

[HLP12GS18,BL18]

god uafn ua


3 3 52 3 4/5

BoBW arenotdemanding-max{DM,HM}

+(1/0)

- Identifiabilitywhenabort- Commonrandomstring

LowerBoundsfor(fn|ua)-BoBWMPCAssume4-round(fn|ua)with3parties 3-roundOTbetween2-parties

Anyr-round(fn|ua)-BoBWimplies(r-1)-roundOT

P3

P2

P1

(HM) t=1:fn (DM) s=2:ua

𝑓 𝑚%,𝑚( , 𝑐, 𝑟+ , 𝑟, = ( 𝑚/ +𝑟+ + 𝑟, , 𝑚/, 𝑚/)

PRPS

𝑓𝑂𝑇 𝑚%, 𝑚( , 𝑐 = (⊥,𝑚/)

LowerBoundsfor(fn|ua)-BoBWMPCAssume4-round(fn|ua)with3parties 3-roundOTbetween2-parties


P3

P2

P1

(HM)t=1:fn (DM)s=2:ua

𝑓 𝑚%,𝑚( , 𝑐, 𝑟+ , 𝑟, = ( 𝑚/ +𝑟+ + 𝑟, , 𝑚/, 𝑚/)

P3

P2

P1

𝑓𝑂𝑇 𝑚%, 𝑚( , 𝑐 = (⊥,𝑚/)

C1:View{P2,P3}=outputbyR3

PRPS

EmulateP1untilR3 EmulateP2 andP3

untilR3

𝑚%,𝑚(

Pick𝑟+, 𝑟,

𝑐

UseoutputcompofΣ1byP2 andP3

Σ1

A.Correctness:C1B.CorruptPR:Cases=2C.CorruptPS:Caset=1

fn

LowerBoundsfor(fn|ua)-BoBWMPC3-roundsimultaneous-messageOT 3-roundalternatingOT


PRPS

𝑚%,𝑚( 𝑐

M1SM1

R

M2R M2

S

M3SM3

R

PRPSM1

S

M1R M2

R

M3SM2

S

𝑚%,𝑚( 𝑐

PSdoesnotneedoutputandthereforelastroundmessageofPR

Reschedulingmessages

Toleranttorushing:Anhonestpartiesmessagedoesnotdependoncorruptpartiesinthesameround.

[GGMP14,CCGJO19]

UpperBoundsfor(fn|ua)-BoBW Anyrroundua dishonest-majorityimplies(i.t) (r+1)-round(fn|ua)-BoBW

r-roundua DMprotocol

P1

P2

P4

y1

y2

y4

M12

K12

M13

K14

P3 y3K13

Authenticatedt-sharing

P5 y5K15

M14 M15

(a,b)

=ay1 +b


n-partyr-roundua DMprotocol

Broadcast&Verify

rrounds 1round

A.(HM)t=2:fnAuthenticated2-sharing

P1

P2

P4

y1

y2

y4

P3 y3

P5 y5

y2

y1 /⏊

/⏊

y4

y3

y5

y

y

y

y

y



Broadcast&Verify

rrounds 1round

A.(HM)t=2:fnAuthenticated2-sharing

⏊

⏊

P1

P2

P4

y1

y2

P3

P5

⏊

y2

y1 /⏊

/⏊

⏊

⏊

⏊

⏊

⏊

⏊

⏊

⏊



Broadcast&Verify

rrounds 1round

A.(HM)t=2:fn

B.(DM)s=3:ua?

Authenticated2-sharing

y5

y4

P1

P2

P4 y4

P3 y3

P5 y5

y3

⏊

⏊

⏊

⏊

⏊

⏊

y

y

y



Broadcast&Verify

rrounds 1round

A.(HM)t=1:fn

B.(DM)s=2:ua?


y5

y4

P1

P2

P4

y1

y2

y4

P3 y3

P5 y5

y3

y2

y1

y

⏊

y

y

y



Broadcast&Verify

rrounds 1round

A.(HM)t=1:fn

B.(DM)s=2:ua?


y5

y4

P1

P2

P4

y1

y2

y4

P3 y3

P5 y5

y3

y2

y1



P1

P2

P4

y1

y2

y4

a5(x)

K12

K14

P3 y3K13

Authenticated2-sharing[P10]

P5 y5

K1 , a5(K1)

a5(0)=y5

K2 , a5(K2)

(god|ua)-BoBW:Overview(3-round+CRS|2-roundPKI)

2-roundua

dis-majSemi-maliciousBroadcast-only

*Semi-malicious:Betweensemi-honestandmalicious- foreveryroundrthereisaninputandrandomcoinsthatexplainsitsbehaviouruntilroundr

- Canabort

3-round(god|ua)-BoBWSemi-maliciousBroadcast-only

2-round(god|ua)-BoBWSemi-maliciousBroadcast-only

PKI

2-round(god|ua)-BoBWSemi-maliciousBroadcast-onlyP-2-PChannels

GCofnext-messagefunction

Secret-sharingofthelabelsusings-

sharing

2-round(god|ua)-BoBW

MaliciousBroadcast-only

PKI+CRS

NIZK[AJL+12]



CRS

NIZK[AJL+12]

(god|ua)-BoBW:Overview(5-round+Plain)


Semi-maliciousBroadcast-only


Delayed-semi-maliciousBroadcast-only



BL18-likecompiler

Theproofwasextremelychallenging

Conclusion

Wealmost settledtheexactroundcomplexityoftwo(actuallythree)importantclassesofBoBW protocols

?)4-round(god |ua)-BoBw inPlainmodel?

??)RoundcomplexityoftheotherclassofBoBW protocols?

new exact on the round complexity landscape of secure...

Documents