Efficient Constant-Round Multi-party Computation Combining BMR and SPDZ

Recently, there has been huge progress in the field of concretely efficient secure computation, even while providing security in the presence of malicious adversaries. This is especially the case in the two-party setting, where constant-round protocols exist that remain fast even over slow networks. However, in the multi-party setting, all concretely efficient fully-secure protocols, such as SPDZ, require many rounds of communication.

Distributed networks remarkably enhance the convenience of network connectivity. How to achieve efficient cooperative computation while preserving data privacy is a challenge in the scenario of distributed networks. Secure computation, as the key technology of information security and privacy protection in the distributed networks, attracts more and more attention. In the paper, we develop the protocols of secure two-party computation in the presence of malicious adversaries which are constructed with homomorphic probabilistic cryptosystem, and propose four honest-verifier zero-knowledge proof protocols to detect two cheating behaviours of the malicious adversary. The proposed protocols are more targeted than the existing work. The analysis shows that the proposed protocols are complete, sound and zero-knowledge. As an application, we show how to use our protocols in a secure two-party protocol to detect cheating, which can make it secure in the presence of malicious adversaries.

Gordon et al. recently showed that certain (non-trivial) functions can be computed with complete fairness in the two-party setting. Motivated by their results, we initiate a study of complete fairness in the multi-party case and demonstrate the first completely-fair protocols for non-trivial functions in this setting. We also provide evidence that achieving fairness is “harder” in the multi-party setting, at least with regard to round complexity.KeywordsSecurity ParameterIdeal WorldNegligible ProbabilityAuxiliary InputHonest PartyThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In this paper, we first demonstrate a gap between the security of verifiably committed signatures in the two-party setting and the security of verifiably committed signatures in the multi-party setting. We then extend the state-of-the-art security model of verifiably committed signatures in the two-party setting to that of multiparty setting. Since there exists trivial setup-driven solutions to multiparty verifiably committed signatures (e.g., two-signature based solutions, we propose solutions to the multi-party stand-alone verifiably committed signatures in the setup-free model, and show that our implementation is provably secure under the joint assumption that the underlying Zhu's signature scheme is secure against adaptive chosen-message attack, Fujisaki-Okamoto's commitment scheme is statistically hiding and computationally binding and Paillier's encryption is semantically secure and one-way as well as the existence of collision-free one-way hash functions.

In this paper, a new notion which we call private data deduplication protocol, a deduplication technique for private data storage is introduced and formalized. Intuitively, a private data deduplication protocol allows a client who holds a private data proves to a server who holds a summary string of the data that he/she is the owner of that data without revealing further information to the server. Our notion can be viewed as a complement of the state-of-the-art public data deduplication protocols of Halevi et al [7]. The security of private data deduplication protocols is formalized in the simulation-based framework in the context of two-party computations. A construction of private deduplication protocols based on the standard cryptographic assumptions is then presented and analyzed. We show that the proposed private data deduplication protocol is provably secure assuming that the underlying hash function is collision-resilient, the discrete logarithm is hard and the erasure coding algorithm can erasure up to α-fraction of the bits in the presence of malicious adversaries in the presence of malicious adversaries. To the best our knowledge this is the first deduplication protocol for private data storage.

We propose an efficient adaptive oblivious transfer protocol with hidden access policies. This scheme allows a receiver to anonymously recover a message from a database which is protected by hidden attribute based access policy if the receiver's attribute set satisfies the associated access policy implicitly. The proposed scheme is secure in the presence of malicious adversary under the q-Strong Diffie-Hellman (SDH), q-Power Decisional Diffie-Hellman (PDDH) and Decision Bilinear Diffie-Hellman (DBDH) assumption in full-simulation security model. The scheme covers disjunction of attributes. The proposed protocol outperforms the existing similar schemes in terms of both communication and computation.

Oblivious transfer (OT) is a significant primitive with wide use in secure two-party computation, private set intersection private and other cryptographic schemes. In the past ten years, different variants of OT primitive like cut-and-choose OT (CCOT) and outsourced OT (OOT), have been proposed so as to satisfy various emerging models. In this paper, we firstly propose and formalize a new primitive called permutable cut-and-choose OT (PCCOT) which generalizes the original CCOT functionality. Furthermore, we construct an efficient PCCOT protocol in the presence of malicious adversaries using the Decisional Diffie-Hellman (DDH) hard assumption. It is worth mentioning that we apply the PCCOT primitive to the efficient construction of secure wildcard pattern matching (WPM) protocol. The WPM functionality allows a party to determine the locations of its pattern with wildcard characters occurs in a long text of another party while revealing nothing to either party in addition to the length of their own inputs. Our proposed secure WPM protocol via PCCOT is secure against semi-honest adversary with 2 rounds and has identical communication cost as the the state-of-the-art scheme.

We propose two efficient universally composable adaptivek‐out‐of‐N protocols, secure in the presence of malicious adversary in static corruption model under the Decision Linear and q‐Strong Diffie–Hellman assumptions. Our second scheme additionally requires the hardness of Decision Bilinear Diffie‐Hellman problem. Non‐interactive Groth–Sahai proofs are employed for the verification of pairing product equations. More interestingly, our first scheme facilitates the receiver to verify the correctness of messages recovered. The proposed protocols exhibit significant computational and communication efficiency compared with existing similar schemes in the literature. Copyright © 2016 John Wiley & Sons, Ltd.

Web search has become an integral part of our lives and we use it daily for business and pleasure. Unfortunately, however, we unwittingly reveal a huge amount of private information about ourselves when we search the web. A look at a user's search terms over a period of a few months paints a frighteningly clear and detailed picture about the user's life. In this paper, we build on previous work by Castella-Roca et al. (Computer Communications 2009) and show how to achieve privacy in web searches efficiently and practically without resorting to full-blown anonymous routing. In contrast to previous work, our protocol is secure in the presence of malicious adversaries.

Secure two-party computation provides a way for two parties to compute a function, that depends on the two parties’ inputs, while keeping them private. Known since the 1980s, Yao’s garbled circuits appear to be a general solution to this problem, in the semi-honest model. Decades of optimizations have made this tool a very practical solution. However, it is well known that a malicious adversary could modify a garbled circuit before submitting it. Many protocols, mostly based on cut-&-choose, have been proposed to secure Yao’s garbled circuits in the presence of malicious adversaries. Nevertheless, how much an adversary can modify a circuit and make it still executable has not been studied yet. The main contribution of this paper is to prove that any modification made by an adversary is equivalent to adding/removing NOT gates arbitrarily in the original circuit, otherwise the adversary can get caught. Thereafter, we study some evaluation functions for which, even without using cut-&-choose, no adversary can gain more information about the inputs by modifying the circuit. We also give an improvement over most recent cut-&-choose solutions by requiring that different circuits of the same function are used instead of just one.

Efficient secure multiparty computation (SMPC) schemes over secret shares are presented. We consider scenarios in which the secrets are elements of a finite field, \(\mathbb {F}_{p}\), and are held and shared by a single participant, the user. Evaluation of any function \(f:\mathbb {F}_{p}^n\rightarrow \mathbb {F}_{p}\) is implemented in one round of communication by representing f as a multivariate polynomial. Our schemes are based on partitioning secrets to sums or products of random elements of the field. Secrets are shared using either (multiplicative) shares whose product is the secret or (additive) shares that sum up to the secret. Sequences of additions of secrets are implemented locally by addition of local shares, requiring no communication among participants, and so does sequences of multiplications of secrets. The shift to handle a sequence of additions from the execution of multiplications or vice versa is efficiently handled as well with no need to decrypt the secrets in the course of the computation. On each shift from multiplications to additions or vice versa, the current set of participants is eliminated, and a new set of participants becomes active. Assuming no coalitions among the active participants and the previously eliminated participants are possible, our schemes are information-theoretically secure with a threshold of all active participants. Our schemes can also be used to support SMPC of boolean circuits.

We study a model of fairness in secure computation in which an adversarial party that aborts on receiving output is forced to pay a mutually predefined monetary penalty. We then show how the Bitcoin network can be used to achieve the above notion of fairness in the two-party as well as the multiparty setting (with a dishonest majority). In particular, we propose new ideal functionalities and protocols for fair secure computation and fair lottery in this model.One of our main contributions is the definition of an ideal primitive, which we call \(\mathcal{F}_{\mathrm{CR}}^\star\) (CR stands for “claim-or-refund”), that formalizes and abstracts the exact properties we require from the Bitcoin network to achieve our goals. Naturally, this abstraction allows us to design fair protocols in a hybrid model in which parties have access to the \(\mathcal{F}_{\mathrm{CR}}^\star\) functionality, and is otherwise independent of the Bitcoin ecosystem. We also show an efficient realization of \(\mathcal{F}_{\mathrm{CR}}^\star\) that requires only two Bitcoin transactions to be made on the network.Our constructions also enjoy high efficiency. In a multiparty setting, our protocols only require a constant number of calls to \(\mathcal{F}_{\mathrm{CR}}^\star\) per party on top of a standard multiparty secure computation protocol. Our fair multiparty lottery protocol improves over previous solutions which required a quadratic number of Bitcoin transactions.KeywordsFair exchangeSecure computationBitcoin

Secure multiparty computation MPC allows a set of n parties to securely compute a function of their private inputs against an adversary corrupting up to t parties. Over the previous decade, the communication complexity of synchronous MPC protocols could be improved to $\mathcal{O}n$ per multiplication, for various settings. However, designing an asynchronous MPC AMPC protocol with linear communication complexity was not achieved so far. We solve this open problem by presenting two AMPC protocols with the corruption threshold t<n / 4. Our first protocol is statistically secure i.e.i¾?involves a negligible error in a completely asynchronous setting and improves the communication complexity of the previous best AMPC protocol in the same setting by a factor of i¾?n. Our second protocol is perfectly secure i.e.i¾?error free in a hybrid setting, where one round of communication is assumed to be synchronous, and improves the communication complexity of the previous best AMPC protocol in the hybrid setting by a factor of i¾?n 2. Like other efficient MPC protocols, we employ Beaver's circuit randomization approach Crypto '91 and prepare shared random multiplication triples. However, in contrast to previous protocols where triples are prepared by first generating two random shared values which are then multiplied distributively, in our approach each party prepares its own multiplication triples. Given enough such shared triples potentially partially known to the adversary, we develop a method to extract shared triples unknown to the adversary, avoiding communication-intensive multiplication protocols. This leads to a framework of independent interest.

Location-dependent services are services that adapt their behavior based on the locations of mobile devices. For many applications, it is critical that location-dependent services use trustworthy device locations, namely locations that are both accurate and recent. These properties are captured by a security goal called locale authentication whereby an entity can authenticate the physical location of a device, even in the presence of malicious adversaries. In this paper, we present a systematic technique for verifying that location discovery protocols satisfy this security goal. We base our work on the strand space theory which provides a framework for determining which security goals a cryptographic protocol achieves. We extend this theory with a metric that captures the geometric properties of time and space. We use the extended theory to prove that several prominent location discovery protocols including GPS do not satisfy the locale authentication goal. We also analyze a location discovery protocol that does satisfy the goal under some reasonable assumptions.

Adaptive Oblivious Transfer Protocol with Hidden Access Policy (AOT-HAP) is a well known cryptographic primitive that combines each message of a database with an access policy which is kept hidden. The database is held by a sender who encrypts each message of the database under its access policy and publishes encrypted database in which access policies are embedded implicitly. A receiver possesses an attribute set and recovers the message correctly if the attribute set satisfies the access policy implicitly. Otherwise, a garbage message is recovered by the receiver. In this paper, an efficient \(\mathsf{AOT{\text {-}}HAP}\) is presented. The proposed protocol realizes more expressive access policies, i.e., conjunction as well as disjunction of attributes. The proposed \(\mathsf{AOT{\text {-}}HAP}\) is secure assuming the hardness of standard assumptions in the presence of malicious adversary in full-simulation security model. It exhibits significant improvement over the existing similar schemes in terms of both communication and computation.KeywordsOblivious transferAccess policyAttribute based encryptionFull simulation security model