initial
This commit is contained in:
418
papers_txt/vole-constructions.txt
Normal file
418
papers_txt/vole-constructions.txt
Normal file
@@ -0,0 +1,418 @@
|
||||
(Vector) Oblivious Linear Evaluation:
|
||||
Basic Constructions and Applications
|
||||
Peter Scholl
|
||||
24 January 2022, Bar-Ilan Winter School
|
||||
This talk What is it?
|
||||
VOLE variants
|
||||
|
||||
|
||||
|
||||
OLE
|
||||
|
||||
|
||||
|
||||
What’s it good for?
|
||||
Conclusion (V)OLE
|
||||
|
||||
How do you build it? correlated
|
||||
randomness
|
||||
active security homomorphic encryption
|
||||
|
||||
|
||||
oblivious transfer
|
||||
|
||||
Oblivious PRF
|
||||
|
||||
Peter Scholl 3
|
||||
Oblivious linear evaluation (OLE)
|
||||
|
||||
Input: 𝑥 ∈ ℤ! Input:
|
||||
𝑎, 𝑏 ∈ ℤ!
|
||||
|
||||
⋮
|
||||
|
||||
Output: 𝑦 = 𝑎𝑥 + 𝑏
|
||||
|
||||
|
||||
|
||||
𝑥 ∈ ℤ! 𝑎, 𝑏 ∈ ℤ!
|
||||
OLE functionality
|
||||
𝑦 = 𝑎𝑥 + 𝑏
|
||||
5
|
||||
OLE is secret-shared multiplication
|
||||
Input: 𝑥 ∈ ℤ! Input:
|
||||
𝑎 ∈ ℤ!
|
||||
𝑥 𝑎, 𝑏 𝑏 ← ℤ!
|
||||
|
||||
OLE
|
||||
𝑦
|
||||
|
||||
|
||||
𝑦 − 𝑏 = 𝑎𝑥
|
||||
|
||||
|
||||
|
||||
|
||||
6
|
||||
Variants: random-OLE, vector-OLE
|
||||
|
||||
𝑥 ∈ ℤ! 𝑎, 𝑏 ∈ ℤ!
|
||||
OLE
|
||||
𝑦 = 𝑎𝑥 + 𝑏
|
||||
|
||||
|
||||
𝑥 ← ℤ! 𝑎, 𝑏 ← ℤ!
|
||||
𝑦 = 𝑎𝑥 + 𝑏 $-OLE
|
||||
|
||||
|
||||
𝑥 ∈ ℤ!
|
||||
⃗ 𝑏 ∈ ℤ"!
|
||||
𝑎,
|
||||
VOLE
|
||||
𝑦⃗ = 𝑎𝑥
|
||||
⃗ +𝑏
|
||||
7
|
||||
A few basic observations
|
||||
𝑛 × OLE ⇒ 1× VOLE (unconditional, passive security)
|
||||
⇐
|
||||
v VOLE is easier to build than 𝑛 × OLE
|
||||
|
||||
$-OLE ⇒ OLE (unconditional, send 3 ℤ! elem.)
|
||||
|
||||
v $-(V)OLE is enough
|
||||
Oblivious
|
||||
OLE ⇒ (unconditional)
|
||||
Transfer
|
||||
v Public-key crypto is necessary [IR 89]
|
||||
8
|
||||
Motivation: Secure Computation with
|
||||
Preprocessing
|
||||
[Beaver ’91]
|
||||
|
||||
|
||||
|
||||
|
||||
Correlated randomness Preprocessing
|
||||
|
||||
|
||||
𝑥 𝑦
|
||||
Online phase
|
||||
|
||||
• Information-theoretic
|
||||
𝑓(𝑥, 𝑦) • Cheap computation
|
||||
|
||||
Peter Scholl 9
|
||||
Example: multiplication triples from OLE
|
||||
|
||||
|
||||
𝑥, 𝑥 " , 𝑦, 𝑦′ 2x $-OLE 𝑎, 𝑎" , 𝑏, 𝑏′
|
||||
|
||||
|
||||
|
||||
𝑦 − 𝑏 = 𝑎𝑥
|
||||
𝑦 " − 𝑏′ = 𝑎" 𝑥 "
|
||||
|
||||
|
||||
𝑥 + 𝑎′ ⋅ 𝑥 ! + 𝑎 = 𝑥𝑥 ! + 𝑎𝑎! + 𝑎𝑥 + 𝑎! 𝑥′
|
||||
|
||||
𝑢 ⋅ 𝑣 = 𝑤
|
||||
|
||||
|
||||
10
|
||||
(V)OLE for correlated randomness
|
||||
v Scalar/vector triples, matrix triples
|
||||
○ Build from VOLE
|
||||
|
||||
v Multi-party correlations:
|
||||
○ From pairwise instances of (V)OLE
|
||||
○ Other approaches: depth-1 homomorphic encryption [DPSZ 12]
|
||||
|
||||
v Authenticated secret shares:
|
||||
○ Use VOLE to generate information-theoretic MACs
|
||||
○ Key part of SPDZ protocols [DPSZ 12, KOS 16, KPR 18, …] 11
|
||||
Application: Oblivious Pseudorandom Functions
|
||||
PRF 𝐹 Oblivious PRF
|
||||
|
||||
|
||||
𝑥 𝑏 ← 0,1
|
||||
𝐾 ← 0,1 !
|
||||
𝑦+ 𝐾 𝑥
|
||||
⋮
|
||||
Guess 𝑏 𝑦" = 𝐹(𝐾, 𝑥)
|
||||
𝑦# = $(𝑥) 𝐹(𝐾, 𝑥)
|
||||
𝐹(𝐾, 𝑦) remains
|
||||
pseudorandom for any 𝑦 ≠ 𝑥
|
||||
|
||||
|
||||
14
|
||||
Vector-OLE ⇒ Batch OPRF evaluation [BCGIKS 19]
|
||||
|
||||
𝑠 ← 𝔽1 𝑎2 ∈ 𝔽1
|
||||
VOLE
|
||||
𝑡2 = 𝑎2 𝑠 + 𝑏2 𝑏2 ← 𝔽1
|
||||
|
||||
Keys 𝐾2 : = 𝑠, 𝑡2 2 Output 𝐻(𝑏" )
|
||||
𝐹 𝐾, , 𝑎, ≔ 𝐻(𝑡, − 𝑎, 𝑠)
|
||||
|
||||
v Relaxed OPRF: related keys, leakage
|
||||
v Secure if 𝐻 is a random oracle
|
||||
• Or variant of correlation-robustness
|
||||
16
|
||||
Random Vector-OLE ⇒ Batch OPRF evaluation
|
||||
|
||||
𝑠 ← 𝔽1 𝑟2 ← 𝔽1
|
||||
$-VOLE
|
||||
𝑡2 ′ = 𝑟2 𝑠 + 𝑏2 𝑏2 ← 𝔽1
|
||||
|
||||
𝑑2 = 𝑎2 − 𝑟2
|
||||
𝑡2 = 𝑡23 + 𝑑2 𝑠
|
||||
Keys 𝐾2 : = 𝑠, 𝑡2 2 Output 𝐻(𝑏" )
|
||||
|
||||
|
||||
v Optimal communication: 1 𝔽1 element
|
||||
Ø (given $-VOLE)
|
||||
|
||||
17
|
||||
Applications of OPRF
|
||||
v Random 1-out-of-𝑞 OT
|
||||
○ Correlated randomness, e.g. masked truth tables [DKSSZZ 17]
|
||||
|
||||
v Password-authenticated key exchange, e.g. OPAQUE [JKX 18]
|
||||
○ Batch OPRF seems less useful
|
||||
|
||||
v Private set intersection
|
||||
○ Reducing use of public-key crypto [KKRT 16, KMPRT 17, …]
|
||||
○ With polynomial-based encoding [GPRTY 21, Sec 7.1]
|
||||
■ Simple protocol, communication: |input| 18
|
||||
Constructing VOLE, “non-silently”
|
||||
|
||||
|
||||
|
||||
19
|
||||
Taxonomy of VOLE protocols
|
||||
Oblivious Transfer Homomorphic Encryption
|
||||
|
||||
”Non-silent”
|
||||
𝑏 𝑠# , 𝑠$ 𝑥 𝑓(𝑥)
|
||||
OT Enc Eval Dec
|
||||
𝑠%
|
||||
|
||||
|
||||
|
||||
”Silent”
|
||||
|
||||
|
||||
v Mostly based on LPN
|
||||
v Require “seed” VOLEs +
|
||||
to bootstrap 20
|
||||
(V)OLE from Oblivious Transfer [Gilboa 99]
|
||||
𝑥 ∈ ℤ1 𝑎, 𝑏 ∈ ℤ1
|
||||
|
||||
𝑥$ 𝑏& , 𝑏& + 𝑎
|
||||
Bit-decompose 𝑥 = ∑9 22:8 𝑥 Sample 𝑏2 ∈ ℤ1 s.t.
|
||||
278 2
|
||||
OT 𝑏 = ∑2 22:8𝑏2 mod 𝑞
|
||||
𝑦$
|
||||
⋮
|
||||
𝑥' 𝑏' , 𝑏' + 𝑎
|
||||
OT
|
||||
𝑦'
|
||||
Repeat for VOLE
|
||||
[KOS 16]
|
||||
Output 𝑦 = ∑2 22:8𝑦2 𝑦2 = 𝑏2 + 𝑎𝑥2
|
||||
⇒ 𝑦 = 𝑏 + 𝑎𝑥
|
||||
21
|
||||
(V)OLE from Oblivious Transfer [Gilboa 99]
|
||||
v Perfectly secure
|
||||
|
||||
v Each output: 𝑚 = log 𝑞 calls to OT on 𝑚-bit strings
|
||||
○ Computational cost: cheap via OT extension [IKNP 03]
|
||||
○ Communication: ≥ 𝑚< bits
|
||||
|
||||
v Active security?
|
||||
|
||||
|
||||
|
||||
|
||||
22
|
||||
(V)OLE from Oblivious Transfer: active security?
|
||||
𝑥 ∈ ℤ1 𝑎, 𝑏 ∈ ℤ1
|
||||
|
||||
𝑥$ 𝑏& , 𝑏& + 𝑎
|
||||
Bit-decompose 𝑥 = ∑2 22:8𝑥2 Sample 𝑏2 ∈ ℤ1 s.t.
|
||||
OT Bob uses 𝑎" ≠𝑏𝑎:= ∑2 22:8 𝑏2 mod 𝑞
|
||||
𝑦$
|
||||
Output becomes 𝑦 + 𝑎" − 𝑎 𝑥$
|
||||
⋮
|
||||
𝑥' 𝑏' , 𝑏' + 𝑎
|
||||
OT
|
||||
𝑦'
|
||||
|
||||
|
||||
Output 𝑦 = ∑2 22:8𝑦2
|
||||
|
||||
23
|
||||
VOLE: lightweight correctness check
|
||||
𝑥, 𝑦2 𝑎2 , 𝑏2
|
||||
|
||||
|
||||
Goal: check that 𝑦2 = 𝑎2 𝑥 + 𝑏2 , for all 𝑖
|
||||
|
||||
Random challenges 𝜒# , … , 𝜒$ ∈ ℤ%
|
||||
𝑎∗ = - 𝜒$ 𝑎$ , 𝑏 ∗ = - 𝜒$ 𝑏$
|
||||
𝑎∗ , 𝑏 ∗ $ $
|
||||
+𝑎"%& +𝑏"%&
|
||||
𝑦 ∗ = ∑𝜒" 𝑦" +𝑦"%&
|
||||
Intuition:
|
||||
Check 𝑦 ∗ = 𝑎∗ 𝑥 + 𝑏 ∗ • To pass check when 𝑦& is incorrect, Bob must guess 𝜒&
|
||||
• Succeed with pr. 1/𝑝
|
||||
|
||||
24
|
||||
Problems with selective failure
|
||||
v Recall: corrupt Bob can induce error:
|
||||
𝑦 / = 𝑦 + 𝑎/ − 𝑎 𝑥0
|
||||
○ Error depends on secret bit 𝑥8!
|
||||
○ Even if VOLE is correct, leaks that 𝑥8 = 0
|
||||
|
||||
v Solutions:
|
||||
○ 1) Relaxed VOLE: allow small leakage on 𝑥 [KOS 16], [WYKW 21]
|
||||
○ 2) Privacy amplification via leftover hash lemma [KOS 16]
|
||||
|
||||
|
||||
25
|
||||
(V)OLE from OT: Summary
|
||||
v Simple protocol with lightweight computation
|
||||
○ Leveraging fast OT extension techniques
|
||||
|
||||
v Expensive communication
|
||||
○ At least 𝑚< bits, where 𝑚 = log 𝑞
|
||||
|
||||
v Active security almost for free
|
||||
○ If leakage on 𝑥 is OK
|
||||
|
||||
|
||||
|
||||
26
|
||||
VOLE from Homomorphic Encryption
|
||||
|
||||
|
||||
|
||||
|
||||
27
|
||||
Linearly homomorphic encryption
|
||||
vPKE scheme (𝐾𝑒𝑦𝐺𝑒𝑛, 𝐸𝑛𝑐, 𝐷𝑒𝑐), encrypts vectors over ℤ$
|
||||
|
||||
For 𝑎⃗ ∈ ℤ(! , write 𝑎⃗ ≔ Enc)* (𝑎)
|
||||
⃗
|
||||
|
||||
|
||||
|
||||
|
||||
vLinear homomorphism:
|
||||
⃗ for 𝑐⃗ ∈ ℤ$' , s.t.
|
||||
ØCan compute 𝑎⃗ + 𝑏 or 𝑐⃗ ⋅ [𝑎],
|
||||
|
||||
Dec 𝑎⃗ + 𝑏 = 𝑎⃗ + 𝑏
|
||||
Dec 𝑐⃗ ⋅ 𝑎⃗ = 𝑐⃗ ⋅ 𝑎⃗
|
||||
Component-wise
|
||||
product
|
||||
Peter Scholl 28
|
||||
Examples of Linearly Homomorphic
|
||||
Encryption
|
||||
More on Wednesday!
|
||||
vPaillier encryption
|
||||
ØEach ciphertext encrypts a ℤG element (𝑁 = 𝑝𝑞)
|
||||
|
||||
|
||||
vDDH
|
||||
ØElGamal in the exponent: poly-size plaintexts in ℤ
|
||||
ØClass groups: ℤ! for large prime 𝑝 [CL 15]
|
||||
|
||||
vRing Learning With Errors (RLWE) [LPR 10]
|
||||
ØNatively encrypts a vector in ℤ9
|
||||
!
|
||||
|
||||
|
||||
Peter Scholl 29
|
||||
Naïve VOLE from Linearly Homomorphic
|
||||
Encryption
|
||||
𝑥 ∈ ℤ! ⃗ 𝑏 ∈ ℤ9
|
||||
𝑎, !
|
||||
|
||||
𝑝𝑘, [𝑥]
|
||||
(
|
||||
𝑝𝑘, 𝑠𝑘 ← 𝐺𝑒𝑛(1 )
|
||||
|
||||
𝑦⃗ = 𝑎⃗ ⋅ 𝑥 + [𝑏]
|
||||
|
||||
𝑦⃗ = 𝐷𝑒𝑐)* ( 𝑦⃗ )
|
||||
|
||||
Security:
|
||||
• Alice: CPA security
|
||||
• Bob: circuit privacy
|
||||
|
||||
Peter Scholl 30
|
||||
Circuit privacy in homomorphic encryption
|
||||
vIn RLWE, message hidden by “noise”: message
|
||||
|
||||
extra noise ≫ 𝑎 ⋅ 𝑒 + 𝑏
|
||||
vAfter computing 𝑎⃗ ⋅ 𝑥 + [𝑏]:
|
||||
noise 𝑒𝑎 ⋅ 𝑒 + 𝑏
|
||||
ØNoise depends on 𝑎⃗ and 𝑏 (removed in decryption)
|
||||
|
||||
|
||||
vClassic solution:
|
||||
Optimization: ”Gentle noise flooding” [dCHIV 21]
|
||||
Ø“Noise flooding” • Encrypt 𝑡-out-of-𝑛 sharing of message
|
||||
ØRequires much larger ciphertexts • A few leaked coordinates don’t matter
|
||||
|
||||
|
||||
|
||||
Peter Scholl 31
|
||||
What about active security?
|
||||
vWhat can go wrong?
|
||||
ØAlice/Bob could send garbage ciphertexts…
|
||||
|
||||
|
||||
vWhat about correctness check as in OT?
|
||||
ØSelective failure is more subtle
|
||||
ØError may depend on ciphertext noise/secret key
|
||||
|
||||
|
||||
vSolution: zero-knowledge proofs
|
||||
ØAlice: proof of plaintext knowledge
|
||||
ØBob: proof of correct multiplication
|
||||
|
||||
Peter Scholl 32
|
||||
ZK proofs for homomorphic encryption
|
||||
vRLWE is more challenging than number-theoretic assumptions
|
||||
|
||||
vProof of plaintext knowledge
|
||||
ØNaïve sigma protocol: soundness ½
|
||||
ØVarious optimizations [BCS 19], amortization [BBG 19]
|
||||
ØStill computationally expensive, often need larger parameters
|
||||
|
||||
|
||||
vProof of correct multiplication
|
||||
ØEven worse! Tricky to amortize
|
||||
ØCan be avoided, assuming linear-only encryption [BISW 18, KPR 18]
|
||||
|
||||
Peter Scholl 33
|
||||
Conclusion: Basic constructions and applications
|
||||
v OLE and VOLE are core building blocks of secure computation
|
||||
○ Correlated randomness
|
||||
○ Special-purpose applications like OPRF, private set intersection
|
||||
○ Next talk: zero knowledge
|
||||
|
||||
v Non-silent protocols: OT, AHE
|
||||
○ Important, even if silent protocols win J
|
||||
○ Open question: improving RLWE parameters and efficiency
|
||||
■ Especially for active security
|
||||
34
|
||||
Thank you!
|
||||
|
||||
|
||||
|
||||
|
||||
Peter Scholl 35
|
||||
|
||||
Reference in New Issue
Block a user