Size Matters! Size-Hiding Private Set Intersection 1 Emiliano De Cristofaro University of California, Irvine Asiacrypt 2010 Rump Session December 7, 2010.

Presentation on theme: "Size Matters! Size-Hiding Private Set Intersection 1 Emiliano De Cristofaro University of California, Irvine Asiacrypt 2010 Rump Session December 7, 2010."— Presentation transcript:

Size Matters! Size-Hiding Private Set Intersection 1 Emiliano De Cristofaro University of California, Irvine Asiacrypt 2010 Rump Session December 7, 2010 To appear in PKC11 – ePrint 2010/220

Private Set Intersection CLIENT S = {s 1, …, s w } SERVER One-Way Private Set-Intersection C= {c 1, …, c v } { c i | c i C S } Airline with Passenger ListDHS with Terror Watchlist 2 w v

Sometimes, size matters… Client Server DHS: Terror Watch List <--- Airline : Passenger List CDC: Contagious disease patients <--- Schools: Kids Observe: 1. Size of clients set is sensitive We need to hide set size. 2. The client is forcing the server to run PSI. In PSI, server overhead also depends on the size of clients set. We would like the server to do work proportional only to the size of his set. Note: Size is private and size fluctuations are private Size also affects communication overhead Padding doesnt work (exposes upper bound and fluctuations) 3

SHI-PSI X R c n/2 X = g Rc*PCH SERVER (s 1, …, s w ) CLIENT (c 1, …, c v ) PCH = hc 1 … hc v PCH i = PCH / hc i R s n/2 Z = g Rs Z, { y 1,…,y w } Public Input: n, g, H(), F() computation mod n Client obtains c i in C S if: y' i in {y' 1,…,y' v } {y 1,…,y w } K j = X R s /hs j y j = F (K j ) K i = Z R c *PCH i y i = F (K i ) 4 (n,e,d) <- RSA.Kgen() g generator of QR_n

SHI-PSI Features Surprising result 2PC has always assumed that input sizes *need* to be revealed The only size-hiding protocol was ZK sets (different problem) Security Semi-honest players, RSA in ROM Minimal Communication Complexity: O(w) [v.s. O(w+v) in PSI] Computation Complexity: Server O(w) modular exponentiations [v.s. O(w+v) in PSI] It does not depend on client input size!!! Client O(v·logv) modular exponentiations [v.s. O(v) in PSI] Optimal if Client is imposing computation on the Server 5

Conclusion We presented the first PSI construct that hides the set size Efficient protocol (improved communication overhead!) … and … Graduating Summer 2011 (i.e., looking for a job ) Emiliano De Cristofaro UC IRVINE http://www.ics.uci.edu/~edecrist 6

Download ppt "Size Matters! Size-Hiding Private Set Intersection 1 Emiliano De Cristofaro University of California, Irvine Asiacrypt 2010 Rump Session December 7, 2010."

Similar presentations