Special issue on advanced techniques for cloud data storage and collaborative systems

A private set intersection (PSI) protocol is a protocol to get the intersection of two sets, each of which belongs to one party, without disclosing extra information of each party’s set to the other party. In this paper, we propose a novel semi-honest PSI protocol without using any encryption primitive in a semi-honest security model. Specifically, we first slice all elements in the set and inject dummy slices. Then we utilize the greatest common divisor (GCD) to find the common parts of the two parties’ slice set product, which is the product of all slices. Finally, we filter the elements by utilizing the GCD to find out the intersection. Different from most previous PSI protocols, we get the intersection by calculation rather than comparison.Our protocol has many advantages over other state-of-the-art PSI protocols, such as robust security against quantum attacks, low communication cost, high computation efficiency when the bandwidth is low, etc. Through extensive experiments, we find the optimum parameters in our setting and demonstrate the performance of our protocol. Different from previous PSI protocols, the communication cost of our protocol varies with the cardinality of the intersection. In comparison, the communication cost of our protocol is the lowest, which gains an over \(200\%\) improvement than the communication-optimized PSI protocol spot-low (Pinkas et al., CRYPTO’19). In addition, the running time of our protocol is the lowest when the communication bandwidth is about 1 Mbps.KeywordsPSIGCDLow communication costs

A private set intersection (PSI) protocol allows two parties to compute the intersection of their input sets privately. Most of the previous PSI protocols only output the result to one party and the other party gets nothing from running the protocols. However, a mutual PSI protocol in which both parties can get the output is highly desirable in many applications. A major obstacle in designing a mutual PSI protocol is how to ensure fairness. In this paper we present the first fair mutual PSI protocol which is efficient and secure. Fairness of the protocol is obtained in an optimistic fashion, i.e. by using an offline third party arbiter. In contrast to many optimistic protocols which require a fully trusted arbiter, in our protocol the arbiter is only required to be semi-trusted, in the sense that we consider it to be a potential threat to both parties’ privacy but believe it will follow the protocol. The arbiter can resolve disputes without knowing any private information belongs to the two parties. This feature is appealing for a PSI protocol in which privacy may be of ultimate importance.

A private set intersection (PSI) protocol enables two parties to privately compute the intersection of their inputs. Most of its previous versions are unilateral, that is, only one party can learn the intersection and the other learns nothing. Many applications require that both parties can obtain the final result. What's more, all of the previous PSI protocols are based on traditional PKI. In this paper, we first present the cryptographic primitive of identity-based symmetric private set intersection (IBSPSI) protocol and give the first construction. To get an efficient construction, we propose an identity-based proxyre-encryption scheme using combined public keys(IBR-CPK), which is the first identity-based proxy re-encryption without pairing. Our IBR-CPK scheme almost as efficient as traditional ECC. It is not only ensures the privacy of the information during the transmission process but also holds perfect additive homomorphism. The IBSPSI protocol that we construct based on IBR-CPK efficiently solves the unilateral PSI problem and simplifies the certificate management. We prove that our IBSPSI protocol achieves perfect privacy in the semi-honest model.

Private set intersection (PSI) is a specific application problem in the field of secure multi-party computation. It allows the participants to compute set intersection collaboratively without learning any additional information about the sets. It is a building block for many real-world privacy-related applications. The state-of-the-art PSI protocol is mainly based on Random Oblivious Transfer (ROT) and cuckoo hash. It is efficient enough in computation but needs high communication cost and high network bandwidth. In this paper, we describe a novel PSI protocol based on ROT and balance hash under semi-honest adversary model. Experiments demonstrate that our protocol has better performance than the cuckoo hash based PSI at the expense of leaking a part of the indexes of hash bucket. We have proved that the impact of information leakage on security is almost negligible. In addition, for the purpose of reducing the communication overhead, we utilize cuckoo filter to optimize our protocol.

This paper introduces certified sets to the private set intersection problem. A private set intersection protocol allows Alice and Bob to jointly compute the set intersection function without revealing their input sets. Since the inputs are private, malicious participants may choose their sets arbitrarily and may use this flexibility to affect the result or learn more about the input of an honest participant. With certified sets, a trusted party ensures the inputs are valid and binds them to each participant. The strength of the malicious model with certified inputs increases the applicability of private set intersection to real world problems. With respect to efficiency the new certified set intersection protocol improves existing malicious model private set intersection protocols by a constant factor.Keywordsprivate set intersectionsecure two-party computationcertified sets

National Statistical Offices (NSOs) collect extensive data on the international activities of firms within their borders. However, they typically lack information about the foreign partners with whom these firms trade. Linking import data from one NSO to corresponding export data from a partner NSO could significantly enhance statistics on firms’ international operations. While technically feasible, such linkage is legally constrained by strict privacy laws. Private set intersection (PSI) protocols may help address privacy concerns but require unique identifiers to avoid linkage errors. To overcome this limitation, we propose a PSI protocol with three innovations. First, we estimate the rates of linkage error by modeling the number of links from a given record. Second, we adjust an estimated population mean according to the estimated linkage accuracy. Lastly, our adjustment explicitly accounts for this accuracy without assuming a particular relationship among the target variables.

Over the last decade, pairing-based cryptography has found a wide range of interesting applications, both in cryptography and in computer/network security. It often yields the most elegant (if not always the most efficient) techniques. This talk overviews several topics to which pairing-based methods either have not been applied, or where they have not reached their potential. The first topic is “privacy-preserving set operations”, such as private set intersection (PSI) protocols. Despite lots of prior work, state-of-the-art (in terms of efficiency) PSI is grounded in more mundane non-pairing-based number theoretic settings. This is puzzling, since the same does not hold with closely related secret handshakes and affiliation-hiding key exchange (AH-AKE) techniques. The second topic is more applied: “security in unattended wireless sensor networks” (UWSNs). We discuss certain unique security issues occurring in UWSNs, overview some protection measures, and consider whether pairing-based cryptography has some applications in this context. The third topic is “privacy in mobile ad hoc networks” (MANETs). The central goal is to achieve privacy-preserving (i.e., tracking-resistant) mobility in the presence of malicious insiders, while maintaining security. Since security is based on authentication, which is, in turn, usually based on identities, routing and packet forwarding are very challenging. Pairing-based cryptography might offer some useful techniques for reconciling security and privacy in this context. Finally, we consider the topic of “secure code attestation for embedded devices” where the main challenge is: how an untrusted (and possibly compromised) device can convince a trusted verifier that it runs appropriate code. After discussing current approaches, once again, consider whether pairing techniques can be of use.

Adaptively code-correlation robustness functions and its applications to private set intersection

We instantiate the hash-then-evaluate paradigm for pseudorandom functions (PRFs), textsf{PRF}(k,x):=textsf{wPRF}(k,textsf{RO}(x)), which builds a PRF textsf{PRF} from a weak PRF textsf{wPRF} via a public pre-processing random oracle textsf{RO}. In applications to secure multiparty computation (MPC), only the low-complexity textsf{wPRF} performs secret-depending operations. Our construction replaces textsf{RO} by f(k_textsf{H},textsf{elf}(x)), where f is a non-adaptive PRF and the key k_textsf{H} is public and thus known to the distinguishing adversary. We show that, perhaps surprisingly, several existing weak PRF candidates are plausibly also secure when their inputs are generated by f(k_textsf{H},textsf{elf}(.)). Firstly, analogous cryptanalysis applies (because pseudorandomness of f implies good statistical properties) and/or secondly an attack against the weak PRF with such pseudorandom inputs generated by f would imply surprising results such as key agreement from the hardness of the high-noise version of the Learning Parity with Noise (LPN) when implementing both textsf{wPRF} and f from this assumption. Our simple transformation of replacing textsf{RO}(cdot ) public pre-processing by f(k_textsf{H},textsf{elf}(x)) public pre-processing applies to the entire family of PRF-style functions. Specifically, we obtain results for oblivious PRFs, which are a core building block for password-based authenticated key exchange (PAKE) and private set intersection (PSI) protocols, and we also obtain results for pseudorandom correlation functions (PCF), which are a key tool for silent oblivious transfer (OT) extension.

Private set intersection (PSI) allows participants to securely compute the intersection of their inputs, which has a wide range of applications such as privacy-preserving contact tracing of COVID-19. Most existing PSI protocols were based on asymmetric/symmetric cryptosystem. Therefore, keys-related operations would burden these systems. In this paper, we transform the problem of the intersection of sets into the problem of finding roots of polynomials by using point-value polynomial representation, blind polynomials’ point-value pairs for secure transportation and computation with the pseudorandom function, and then propose an efficient PSI protocol without any cryptosystem. We optimize the protocol based on the permutation-based hash technique which divides a set into multisubsets to reduce the degree of the polynomial. The following advantages can be seen from the experimental result and theoretical analysis: (1) there is no cryptosystem for data hiding or encrypting and, thus, our design provides a lightweight system; (2) with set elements less than 212, our protocol is highly efficient compared to the related protocols; and (3) a detailed formal proof is given in the semihonest model.

In 2021, Apple proposed a mechanism to detect child-sexual-abuse-material (CSAM) in end-to-end encrypted content uploaded to iCloud. This mechanism leveraged a private set intersection (PSI) protocol to recover a decryption key for encrypted data that matched against a blocklist of hashes curated by Apple. However, the proposal faced widespread criticism as it completely trusted Apple to create the blocklist without any oversight. Furthermore, due to technical reasons, a third-party could not verify that the blocklist was limited to checking for CSAM material. Unfortunately, this meant that the blocklist could be easily manipulated for surveillance and censorship, and due to the lack of trust in a self-interested organization, this proposal was not implemented This thesis posits that in order to increase trust in a blocklisted content moderation system, it is necessary to involve multiple, independent parties in creation of the blocklist. In particular, we envision a setting where a group of trusted auditors, e.g., law enforcement, and child safety groups, publish a common (obfuscated) blocklist of content that storage providers can check against. Such blocklists are not uncommon, e.g., the NCMEC and FBI have published lists of missing children and persons. Having a common blocklist curated by multiple parties with different interests, will build more trust in the system than individual blocklists published by self-interested service providers. This idea poses several technical challenges such as: i) ensuring that the blocklist is unforgeable and can be authenticated by clients, ii) ensuring that the service providers do not learn any information about non-CSAM content, and iii) keeping the blocklist confidential from the clients. This thesis proposes a novel crypto-graphic primitive, a randomizable set-homomorphic signature, that simultaneously achieves all of these goals. A set homomorphic signature allows us to represent an arbitrarily large blocklist with a compact digest that can be authenticated using the auditors’ public keys. We provide a RSA-based construction, and use it to design a content moderation protocol for encrypted file stores. The protocol is optimal in terms of client-side compute, communication and storage costs. Additionally, we prove security of the protocol and provide benchmarks on a public cloud infrastructure.

We describe a lightweight protocol for oblivious evaluation of a pseudorandom function (OPRF) in the presence of semihonest adversaries. In an OPRF protocol a receiver has an input r; the sender gets output s and the receiver gets output F(s; r), where F is a pseudorandom function and s is a random seed. Our protocol uses a novel adaptation of 1-out-of-2 OT-extension protocols, and is particularly efficient when used to generate a large batch of OPRF instances. The cost to realize m OPRF instances is roughly the cost to realize 3:5m instances of standard 1-out-of-2 OTs (using state-of-the-art OT extension). We explore in detail our protocol's application to semihonest secure private set intersection (PSI). The fastest state-of- the-art PSI protocol (Pinkas et al., Usenix 2015) is based on efficient OT extension. We observe that our OPRF can be used to remove their PSI protocol's dependence on the bit-length of the parties' items. We implemented both PSI protocol variants and found ours to be 3.1{3.6 faster than Pinkas et al. for PSI of 128-bit strings and sufficiently large sets. Concretely, ours requires only 3.8 seconds to securely compute the intersection of 220-size sets, regardless of the bitlength of the items. For very large sets, our protocol is only 4:3 slower than the insecure naive hashing approach for PSI.

The development of IoT devices has driven technological advancements across industries, especially in healthcare. IoT devices have brought many conveniences to patients, such as symptom matching, the real-time acquisition of health data, and online diagnosis. However, the development of the Internet of Things also brings security and privacy challenges, which have attracted the attention of many scholars. In symptom matching, patients can communicate with patients similar to themselves through symptom matching, exchange treatment experiences, and encourage each other. However, matching in plaintext will pose a huge threat to user privacy, such as discrimination, which in turn affects job hunting, etc. Therefore, this paper proposes a symptom-matching scheme for IoT devices based on the Diffie–Hellman key agreement. Specifically, we construct and formally define the Switching Threshold Label Private Set Intersection (STLPSI) protocol based on the Diffie–Hellman key agreement and apply it for medical symptom matching. Our protocol can not only set the threshold of the same symptoms, but also patients who meet the threshold can obtain one another’s contact information. Furthermore, our scheme does not rely on any trusted third parties. Through security analysis and experiments, our scheme is shown to be effective in preserving privacy during symptom matching.

Efficient multi-party private set intersection protocols for large participants and small sets

Private Set Intersection (PSI), which is a hot topic in recent years, has been extensively utilized in credit evaluation, medical system and so on. However, with the development of big data era, the existing traditional PSI cannot meet the application requirements in terms of performance and scalability. In this work, we proposed two secure and effective PSI (SE-PSI) protocols on scalable datasets by leveraging deterministic encryption and Bloom Filter. Specially, our first protocol focuses on high efficiency and is secure under a semi-honest server, while the second protocol achieves security on an economic-driven malicious server and hides the set/intersection size to the server. With experimental evaluation, our two protocols need only around 15 and 24 seconds respectively over one million-element datasets. Moreover, as a novelty, a multi-round mechanism is proposed for the two protocols to improve the efficiency. The implementation demonstrates that our two-round mechanism can enhance efficiency by almost twice than two basic protocols.