Permutable Cut-and-Choose Oblivious Transfer and Its Application

The Yao’s protocol based on garbled circuits is the foundation of secure two-party computation protocols, and Oblivious Transfer (OT), as a important tool in modern cryptography, plays a crucial role in transmitting garbled keys in the Yao’s protocol. In the past decades, considerable attentions have been paid to the Cut-and-Choose technique which is applied to OT protocols to prevent malicious P 1 (called circuit generator) from constructing wrong garbled circuits. Additionally, Bilateral OT becomes a focus point, which can simultaneously transmit P 1 ’s and P 2 ’s (called circuit evaluator) garbled keys to guarantee input consistency of two parties and improve transmission efficiency. As can be seen, some Cut-and-Choose Bilateral OT (CCBOT) protocols have been proposed. Since CCBOT has emerged, the probability of malicious P 1 constructing wrong garbled circuits without being found becomes lower and the input consistency problem is properly resolved too. However, the security of most CCBOT protocols are facing challenges since they are based on the Decisional Diffie-Hellman (DDH) assumption, Quadratic Residues (QR) assumption and Decisional Composite Residuosity (DCR) assumption. In this paper, we present a novel CCBOT protocol with the security against malicious adversaries based on the Computational Diffie-Hellman (CDH) assumption, and analysize the correctness, efficiency and security of the constructed protocol. Besides, we analysize the cheating probability of P 1 in the CCBOT and extend the CCBOT to Single-Choice CCBOT to make the protocol more applicable.

Oblivious transfer (OT) is an important cryptographic primitive. In this paper, we propose a practical server-aided k-out-of-n oblivious transfer (\(OT_n^k\)) protocol based on the Decisional Diffie-Hellman (DDH) assumption. Our construction is the first one that is applicable in cloud computing environment. Unlike the original OT which only contains the receiver R and sender S, the server-aided OT setting also contains cloud servers who provide a vast amount of computational resources, therefore the sender and receiver can outsource the computational work to the cloud servers. In the proposed protocol, the receiver R sends only two group elements to the sender S, and S sends 2n group elements back to R. The computation cost of R and S is the most efficient comparing with other known schemes. In our protocol, the receiver R computes \(2k+3\) modular exponentiations and the sender computes 2.5n modular exponentiations. The communication rounds of the protocol is three, including one extra round from the receiver R to the cloud servers. The choices of the receiver R is protected against the sender S and cloud servers, meanwhile, the input values of S which are not chosen are still secret to R.

Oblivious Transfer (OT) is one of the most fundamental cryptographic primitives with wide-spread application in general secure multi-party computation (MPC) as well as in a number of tailored and special-purpose problems of interest such as private set intersection (PSI), private information retrieval (PIR), contract signing to name a few. Often the instantiations of OT require prohibitive communication and computation complexity. OT extension protocols are introduced to compute a very large number of OTs referred to as extended OTs at the cost of a small number of OTs referred to as seed OTs. We present a fast OT extension protocol for small secrets in the active setting. Our protocol when used to produce 1-out-of-n OTs outperforms all the known actively secure OT extensions. Our protocol is built on the semi-honest secure extension protocol of Kolesnikov and Kumaresan of CRYPTO'13 (referred to as KK13 protocol henceforth) which is the best known OT extension for short secrets.

Distributed networks remarkably enhance the convenience of network connectivity. How to achieve efficient cooperative computation while preserving data privacy is a challenge in the scenario of distributed networks. Secure computation, as the key technology of information security and privacy protection in the distributed networks, attracts more and more attention. In the paper, we develop the protocols of secure two-party computation in the presence of malicious adversaries which are constructed with homomorphic probabilistic cryptosystem, and propose four honest-verifier zero-knowledge proof protocols to detect two cheating behaviours of the malicious adversary. The proposed protocols are more targeted than the existing work. The analysis shows that the proposed protocols are complete, sound and zero-knowledge. As an application, we show how to use our protocols in a secure two-party protocol to detect cheating, which can make it secure in the presence of malicious adversaries.

We propose an efficient adaptive oblivious transfer protocol with hidden access policies. This scheme allows a receiver to anonymously recover a message from a database which is protected by hidden attribute based access policy if the receiver's attribute set satisfies the associated access policy implicitly. The proposed scheme is secure in the presence of malicious adversary under the q-Strong Diffie-Hellman (SDH), q-Power Decisional Diffie-Hellman (PDDH) and Decision Bilinear Diffie-Hellman (DBDH) assumption in full-simulation security model. The scheme covers disjunction of attributes. The proposed protocol outperforms the existing similar schemes in terms of both communication and computation.

Motivated by the recent progress in improving efficiency of secure computation, we study cut-and-choose oblivious transfer--a basic building block of state-of-the-art constant round two-party secure computation protocols that was introduced by Lindell and Pinkas TCC 2011. In particular, we study the question of realizing cut-and-choose oblivious transfer and its variants in the OT-hybrid model. Towards this, we provide new definitions of cut-and-choose oblivious transfer and its variants that suffice for its application in cut-and-choose techniques for garbled circuit based two-party protocols. Furthermore, our definitions conceptually simplify previous definitions including those proposed by Lindell Crypto 2013, Huang et al., Crypto 2014, and Lindell and Riva Crypto 2014. Our main result is an efficient realization under our new definitions of cut-and-choose OT and its variants with small concrete communication overhead in an OT-hybrid model. Among other things this implies that we can base cut-and-choose OT and its variants under a variety of assumptions, including those that are believed to be resilient to quantum attacks. By contrast, previous constructions of cut-and-choose OT and its variants relied on DDH and could not take advantage of OT extension. Also, our new definitions lead us to more efficient constructions for multistage cut-and-choose OT--a variant proposed by Huang et al.i¾?Crypto 2014 that is useful in the multiple execution setting.

We provide new two-round multiparty secure computation (MPC) protocols assuming the minimal assumption that two-round oblivious transfer (OT) exists. If the assumed two-round OT protocol is secure against semi-honest adversaries (in the plain model) then so is our two-round MPC protocol. Similarly, if the assumed two-round OT protocol is secure against malicious adversaries (in the common random/reference string model) then so is our two-round MPC protocol. Previously, two-round MPC protocols were only known under relatively stronger computational assumptions. Finally, we provide several extensions.

In this paper, a new implementation of universally composable, 1-out-of-2 oblivious transfer in the presence of static adversaries is presented and analyzed. Our scheme is constructed from the state-of-the-art Bresson-Catalano-Pointcheval’s double trap-door public-key encryption scheme, where a trapdoor string comprises a master key and local keys. The idea behind our implementation is that the master key is used to extract input messages of a corrupted sender (as a result, a simulator designated for the corrupted sender is constructed) while the local keys are used to extract input messages of a corrupted receiver (as a result, a simulator designated for the corrupted receiver is defined). We show that the proposed oblivious transfer protocol realizes universally composable security in the presence of static adversaries in the common reference model assuming that the decisional Diffie-Hellman problem over a squared composite modulus of the form N =pq is hard.KeywordsOblivious transfersimulatoruniversally composable

Key-exchange protocols have been overlooked as a possible means for implementing oblivious transfer (OT). In this article, we present protocols for mutual exchange of secrets, 1-out-of-2 OT and coin-flipping similar to the Diffie-Hellman protocol using the idea of obliviously exchanging encryption keys. Since the Diffie-Hellman scheme is widely used, our protocol may provide a useful alternative to the conventional methods for implementation of oblivious transfer and a useful primitive in building larger cryptographic schemes.

This paper presents communication efficient protocols for oblivious transfer (OT) using elliptic curve cryptography (ECC). ECC provides better security than RSA for the same key length and is known to have faster implementations. We provide protocols for 1-out-of-2 and 1-out-of-n oblivious transfer in which the latter requires the sender to send only n+2 elements over the network and the receiver sends only one messages over the network.

In this chapter we carry out an in-depth study of the problem of constructing efficient protocols for oblivious transfer (as introduced in Section 3.2.2). Oblivious transfer is one of the most important building blocks in cryptography, and is very useful for constructing secure protocols. We demonstrate this by showing how to achieve secure pseudorandom function evaluation using oblivious transfer.KeywordsSecurity ParameterOblivious TransferFull SimulationPseudorandom FunctionAuxiliary InputThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Committed Oblivious Transfer (COT) is a useful cryptographic primitive that combines the functionalities of bit commitment and oblivious transfer. In this paper, we introduce an extended version of COT (ECOT) which additionally allows proofs of relations among committed bits, and we construct an efficient protocol that securely realizes an ECOT functionality in the universal-composability (UC) framework. Our construction is more efficient than previous (non-UC) constructions of COT, involving only a constant number of exponentiations and communication rounds. Using the ECOT functionality as a building block, we construct efficient UC protocols for general two-party and multi-party functionalities, each gate requiring a constant number of ECOT’s.

Secure Two-Party Computation (STC) allows two mutually untrusting parties to securely evaluate a function on their private inputs. While tremendous progress has been made towards reducing processing overheads, STC still incurs significant communication overhead that is in fact prohibitive when no high-speed network connection is available, e.g., when applications are run over a cellular network. In this paper, we consider the fundamental problem of securely computing a minimum and its argument, which is a basic building block in a wide range of applications that have been proposed as STCs, e.g., Nearest Neighbor Search, Auctions, and Biometric Matchings. We first comprehensively analyze and compare the communication overhead of implementations of the three major STC concepts, i.e., Yao’s Garbled Circuits, the Goldreich-Micali-Wigderson protocol, and Homomorphic Encryption. We then propose an algorithm for securely computing minima in the semi-honest model that, compared to current state-of-the-art, reduces communication overheads by 18 % to 98 %. Lower communication overheads result in faster runtimes in constrained networks and lower direct costs for users.

In this paper, a new notion which we call private data deduplication protocol, a deduplication technique for private data storage is introduced and formalized. Intuitively, a private data deduplication protocol allows a client who holds a private data proves to a server who holds a summary string of the data that he/she is the owner of that data without revealing further information to the server. Our notion can be viewed as a complement of the state-of-the-art public data deduplication protocols of Halevi et al [7]. The security of private data deduplication protocols is formalized in the simulation-based framework in the context of two-party computations. A construction of private deduplication protocols based on the standard cryptographic assumptions is then presented and analyzed. We show that the proposed private data deduplication protocol is provably secure assuming that the underlying hash function is collision-resilient, the discrete logarithm is hard and the erasure coding algorithm can erasure up to α-fraction of the bits in the presence of malicious adversaries in the presence of malicious adversaries. To the best our knowledge this is the first deduplication protocol for private data storage.

We instantiate the hash-then-evaluate paradigm for pseudorandom functions (PRFs), textsf{PRF}(k,x):=textsf{wPRF}(k,textsf{RO}(x)), which builds a PRF textsf{PRF} from a weak PRF textsf{wPRF} via a public pre-processing random oracle textsf{RO}. In applications to secure multiparty computation (MPC), only the low-complexity textsf{wPRF} performs secret-depending operations. Our construction replaces textsf{RO} by f(k_textsf{H},textsf{elf}(x)), where f is a non-adaptive PRF and the key k_textsf{H} is public and thus known to the distinguishing adversary. We show that, perhaps surprisingly, several existing weak PRF candidates are plausibly also secure when their inputs are generated by f(k_textsf{H},textsf{elf}(.)). Firstly, analogous cryptanalysis applies (because pseudorandomness of f implies good statistical properties) and/or secondly an attack against the weak PRF with such pseudorandom inputs generated by f would imply surprising results such as key agreement from the hardness of the high-noise version of the Learning Parity with Noise (LPN) when implementing both textsf{wPRF} and f from this assumption. Our simple transformation of replacing textsf{RO}(cdot ) public pre-processing by f(k_textsf{H},textsf{elf}(x)) public pre-processing applies to the entire family of PRF-style functions. Specifically, we obtain results for oblivious PRFs, which are a core building block for password-based authenticated key exchange (PAKE) and private set intersection (PSI) protocols, and we also obtain results for pseudorandom correlation functions (PCF), which are a key tool for silent oblivious transfer (OT) extension.