Two-Round Multiparty Secure Computation from Minimal Assumptions

We construct a four round secure multip arty computation (MPC) protocol in the plain model that achieves security against any dishonest majority. The security of our protocol relies only on the existence of four round oblivious transfer. This culminates the long line of research on constructing round-efficient MPC from minimal assumptions (at least w.r.t. black-box simulation).

The last decade has seen an explosion in the number of new secure multi-party computation (MPC) protocols that enable collaborative computation on sensitive data. No single MPC protocol is optimal for all types of computation. As a result, researchers have created hybrid-protocol compilers that translate a program into a hybrid protocol that mixes different MPC protocols. Hybrid-protocol compilers crucially rely on accurate cost models, which are handwritten by the compilers' developers, to choose the correct schedule of protocols. In this paper, we propose CostCO, the first automatic MPC cost modeling framework. CostCO develops a novel API to interface with a variety of MPC protocols, and leverages domain-specific properties of MPC in order to enable efficient and automatic cost-model generation for a wide range of MPC protocols. CostCO employs a two-phase experiment design to efficiently synthesize cost models of the MPC protocol's runtime as well as its memory and network usage. We verify CostCO's modeling accuracy for several full circuits, characterize the engineering effort required to port existing MPC protocols, and demonstrate how hybrid-protocol compilers can leverage CostCO's cost models.

Adaptively secure multiparty computation is an essential and fundamental notion in cryptography. In this work we focus on the basic question of constructing a multiparty computation protocol secure against a malicious, adaptive adversary in the stand-alone setting without assuming an honest majority, in the plain model. It has been believed that this question can be resolved by composing known protocols from the literature. We show that in fact, this belief is fundamentally mistaken. In particular, we show:Round inefficiency is unavoidable when using black-box simulation: There does not exist any $$o\frac{n}{\log {n}}$$ round protocol that adaptively securely realizes a natural n-party functionality with a black-box simulator. Note that most previously known protocols in the adaptive security setting relied on black-box simulators.A constant round protocol using non-black-box simulation: We construct a constant round adaptively secure multiparty computation protocol in a setting without honest majority that makes crucial use of non-black box techniques. Taken together, these results give the first resolution to the question of adaptively secure multiparty computation protocols with a malicious dishonest majority in the plain model, open since the first formal treatment of adaptive security for multiparty computation in 1996.

The demanding need to perform privacy-preserving computations among multiple data owners has led to the prosperous development of secure multi-party computation (MPC) protocols. MPC offers protocols for parties to jointly compute a function over their inputs while keeping those inputs private. To date, MPC has been widely adopted in various real-world, privacy-sensitive sectors, such as healthcare and finance. Moreover, to ease the adoption of MPC, industrial and academic MPC compilers have been developed to automatically translate programs describing arbitrary MPC procedures into low-level MPC executables. Compiling high-level descriptions into high-efficiency MPC executables is challenging: the compilation often involves converting high-level languages into several intermediate representations (IR), e.g., arithmetic or boolean circuits, optimizing the computation/communication cost, and picking proper MPC protocols (and underlying virtual machines) for a particular task and threat model. Various optimizations and heuristics are employed during the compilation procedure to improve the efficiency of the generated MPC executables. Despite the prosperous adoption of MPC compilers by industrial vendors and academia, a principled and systematic understanding of the correctness of MPC compilers does not yet exist. To fill this critical gap, this paper introduces MT-MPC, a metamorphic testing (MT) framework specifically designed for MPC compilers to effectively uncover erroneous compilations. Our approach proposes three metamorphic relations (MRs) that are tailored for MPC programs to mutate high-level MPC programs (compiler inputs). We then examine if MPC compilers yield semantics-equivalent MPC executables regarding the original and mutated MPC programs by comparing their execution results. Real-world MPC compilers exhibit a high level of engineering quality. Nevertheless, we detected 4,772 inputs that can result in erroneous compilations in three popular MPC compilers available on the market. While the discovered error-triggering inputs do not cause the MPC compilers to crash directly, they can lead to the generation of incorrect MPC executables, jeopardizing the underlying dependability of the computation. With substantial manual effort and help from the MPC compiler developers, we uncovered thirteen bugs in these MPC compilers by debugging them using the error-triggering inputs. Our proposed testing frameworks and findings can be used to guide developers in their efforts to improve MPC compilers.

We study a model of fairness in secure computation in which an adversarial party that aborts on receiving output is forced to pay a mutually predefined monetary penalty. We then show how the Bitcoin network can be used to achieve the above notion of fairness in the two-party as well as the multiparty setting (with a dishonest majority). In particular, we propose new ideal functionalities and protocols for fair secure computation and fair lottery in this model.One of our main contributions is the definition of an ideal primitive, which we call \(\mathcal{F}_{\mathrm{CR}}^\star\) (CR stands for “claim-or-refund”), that formalizes and abstracts the exact properties we require from the Bitcoin network to achieve our goals. Naturally, this abstraction allows us to design fair protocols in a hybrid model in which parties have access to the \(\mathcal{F}_{\mathrm{CR}}^\star\) functionality, and is otherwise independent of the Bitcoin ecosystem. We also show an efficient realization of \(\mathcal{F}_{\mathrm{CR}}^\star\) that requires only two Bitcoin transactions to be made on the network.Our constructions also enjoy high efficiency. In a multiparty setting, our protocols only require a constant number of calls to \(\mathcal{F}_{\mathrm{CR}}^\star\) per party on top of a standard multiparty secure computation protocol. Our fair multiparty lottery protocol improves over previous solutions which required a quadratic number of Bitcoin transactions.KeywordsFair exchangeSecure computationBitcoin

With the rise of practical Secure Multi-party Computation (MPC) protocols, compilers have been developed that create Boolean or Arithmetic circuits for MPC from functionality descriptions in a high-level language. Previous compilers focused on the creation of size-minimal circuits. However, many MPC protocols, such as GMW and SPDZ, have a round complexity that is dependent on the circuit’s depth. When deploying these protocols in real world network settings, with network latencies in the range of tens or hundreds of milliseconds, the round complexity quickly becomes a significant performance bottleneck.

Motivated by the recent progress in improving efficiency of secure computation, we study cut-and-choose oblivious transfer--a basic building block of state-of-the-art constant round two-party secure computation protocols that was introduced by Lindell and Pinkas TCC 2011. In particular, we study the question of realizing cut-and-choose oblivious transfer and its variants in the OT-hybrid model. Towards this, we provide new definitions of cut-and-choose oblivious transfer and its variants that suffice for its application in cut-and-choose techniques for garbled circuit based two-party protocols. Furthermore, our definitions conceptually simplify previous definitions including those proposed by Lindell Crypto 2013, Huang et al., Crypto 2014, and Lindell and Riva Crypto 2014. Our main result is an efficient realization under our new definitions of cut-and-choose OT and its variants with small concrete communication overhead in an OT-hybrid model. Among other things this implies that we can base cut-and-choose OT and its variants under a variety of assumptions, including those that are believed to be resilient to quantum attacks. By contrast, previous constructions of cut-and-choose OT and its variants relied on DDH and could not take advantage of OT extension. Also, our new definitions lead us to more efficient constructions for multistage cut-and-choose OT--a variant proposed by Huang et al.i¾?Crypto 2014 that is useful in the multiple execution setting.

In the setting of secure two-party computation, two parties wish to securely compute a function of their joint private inputs. The theoretical foundations of this problem were laid down in the 1980s, and it has been heavily studied due to its generality and many applications. However, until recently, secure computation was considered a theoretical problem of purely theoretical interest. This has changed, and progress on the question of efficient secure computation has been extraordinarily fast in the past five years. In this talk, we survey some of this recent progress and describe the main techniques used for obtaining fast two-party computation, based on Yao’s garbled circuit protocol. We will present the main algorithmic/protocol improvements, as well as implementation issues that have turned out to be a big factor in obtaining concrete efficiency. In addition, we will relate to the settings of semi-honest, covert and malicious adversaries, and will describe the challenges that arise for each along with the solutions and major open questions.

Oblivious transfer (OT) is a significant primitive with wide use in secure two-party computation, private set intersection private and other cryptographic schemes. In the past ten years, different variants of OT primitive like cut-and-choose OT (CCOT) and outsourced OT (OOT), have been proposed so as to satisfy various emerging models. In this paper, we firstly propose and formalize a new primitive called permutable cut-and-choose OT (PCCOT) which generalizes the original CCOT functionality. Furthermore, we construct an efficient PCCOT protocol in the presence of malicious adversaries using the Decisional Diffie-Hellman (DDH) hard assumption. It is worth mentioning that we apply the PCCOT primitive to the efficient construction of secure wildcard pattern matching (WPM) protocol. The WPM functionality allows a party to determine the locations of its pattern with wildcard characters occurs in a long text of another party while revealing nothing to either party in addition to the length of their own inputs. Our proposed secure WPM protocol via PCCOT is secure against semi-honest adversary with 2 rounds and has identical communication cost as the the state-of-the-art scheme.

Secure multi-party computation (MPC) is a fundamental problem in secure distributed computing. An MPC protocol allows a set of $n$ mutually distrusting parties to carry out any joint computation of their private inputs, without disclosing any additional information about their inputs. MPC with information-theoretic security provides the strongest security guarantees and remains secure even against computationally unbounded adversaries. Perfectly-secure MPC protocols is a class of information-theoretically secure MPC protocols, which provides all the security guarantees in an error-free fashion. The focus of this work is perfectly-secure MPC. Known protocols are designed assuming either a synchronous or asynchronous communication network. It is well known that perfectly-secure synchronous MPC protocol is possible as long as adversary can corrupt any $t_s < n/3$ parties. On the other hand, perfectly-secure asynchronous MPC protocol can tolerate up to $t_a < n/4$ corrupt parties. A natural question is does there exist a single MPC protocol for the setting where the parties are not aware of the exact network type and which can tolerate up to $t_s < n/3$ corruptions in a synchronous network and up to $t_a < n/4$ corruptions in an asynchronous network. We design such a best-of-both-worlds perfectly-secure MPC protocol, provided $3t_s + t_a < n$ holds. For designing our protocol, we design two important building blocks, which are of independent interest. The first building block is a best-of-both-worlds Byzantine agreement (BA) protocol tolerating $t < n/3$ corruptions and which remains secure, both in a synchronous as well as asynchronous network. The second building block is a polynomial-based best-of-both-worlds verifiable secret-sharing (VSS) protocol, which can tolerate up to $t_s$ and $t_a$ corruptions in a synchronous and in an asynchronous network respectively.

Oblivious transfer (OT) is a primitive of great importance in two-party and multi-party computation. We introduce a general construction of universally composable (UC) oblivious transfer protocols based on lossy cryptosystems in the common reference string (CRS) model, yielding protocols under several assumptions. In order to achieve this, we show that for most known lossy encryption constructions it is possible to distinguish between lossy and injective public keys given the corresponding secret key, similarly to dual-mode encryption in messy mode. Furthermore, we adapt the techniques of our general construction to obtain the first UC secure OT protocol based on the McEliece assumptions, which are coding theory based assumptions that until now have resisted quantum attacks, thus introducing the first UC secure OT protocol based on coding assumptions. However, differently from previous results based on dual-mode encryption, our scheme does not require a trapdoor for opening lossy ciphertexts, relying instead on CRS manipulation and cut-and-choose techniques to construct the simulators. In both constructions we circumvent the need for universally composable string commitment schemes, which are required by previous black-box compilers.

Demand for distributed computational infrastructure is growing in order to offer low latency connections to end users. The fragmenting infrastructure complicates the resource allocation process. As the number of infrastructure providers grows, points of presence are resource constrained compared to the cloud, they have diverse availability profiles, and diverse connectivity properties. Existing resource allocation approaches require providers share intimate details about their infrastructure to support the placement process, or rely on third party aggregators. Such solutions introduce strong assumptions of trust and collaboration. In this work we present Angler, the first system to allocate resources from dark pools, meaning the capacity and requests of the distributed pool of resources are unknown. Angler leverages cryptographic protocols for secure function evaluation, namely the WRK secure multiparty computation (MPC) protocol [76]. While MPC protocols can have large overheads compared to plaintext function evaluation, an end-to-end approach to the system design subverts the expensive overheads. Specifically, Angler combines a tuned implementation of a maliciously secure MPC protocol, a tailored distributed hash table, and a systematic effort to make the best allocation decision within a response time envelope. Angler is only 2x slower than resource allocation with no privacy when arbitrating among 8 providers, taking less than a second.

Secure multiparty computation protocol based on homomorphic encryption and its application in blockchain

Oblivious Transfer (OT) is one of the most fundamental cryptographic primitives with wide-spread application in general secure multi-party computation (MPC) as well as in a number of tailored and special-purpose problems of interest such as private set intersection (PSI), private information retrieval (PIR), contract signing to name a few. Often the instantiations of OT require prohibitive communication and computation complexity. OT extension protocols are introduced to compute a very large number of OTs referred to as extended OTs at the cost of a small number of OTs referred to as seed OTs. We present a fast OT extension protocol for small secrets in the active setting. Our protocol when used to produce 1-out-of-n OTs outperforms all the known actively secure OT extensions. Our protocol is built on the semi-honest secure extension protocol of Kolesnikov and Kumaresan of CRYPTO'13 (referred to as KK13 protocol henceforth) which is the best known OT extension for short secrets.

One-sided leakage-resilient privacy only two-message oblivious transfer