Presentation is loading. Please wait.

Presentation is loading. Please wait.

Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans, Jonathan Katz University of Virginia, University of.

Similar presentations


Presentation on theme: "Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans, Jonathan Katz University of Virginia, University of."— Presentation transcript:

1 Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans, Jonathan Katz University of Virginia, University of Maryland www.MightBeEvil.org

2 Motivation --- Common Acquaintances http://www.mightbeevil.com/mobile/

3 EUROCRYPT 2004 CRYPTO 2005 TCC 2008 Financial Crypto 2010

4 Custom Protocols Generic Protocols e.g., Garbled Circuit Protocols Cannot be easily composed with other secure computations Designed around specific crypto assumptions and primitives New Design and security proofs need to be done for every individual scheme. Uses generic and flexible cryptographic primitives Can securely compute arbitrary function Security proofs automatically derived from the generic proof.

5 Garbled Circuits & Oblivious Transfers Y. Huang, D. Evans, J. Katz, L. Malka, Faster Secure Computation Using Garbled Circuits, USENIX Security 2011. And Gate 1 Enc a1 0, b 1 1 (x1 0 ) Enc a1 1,b1 1 (x1 1 ) Enc a1 1,b1 0 (x1 0 ) Enc a1 0,b1 0 (x1 0 ) Or Gate 2 Enc x0 0, x 1 1 (x2 1 ) Enc x0 1,x1 1 (x2 1 ) Enc x0 1,x1 0 (x2 1 ) Enc x0 0,x1 0 (x2 0 ) AND a0a0 b0b0 x0x0 a1a1 b1b1 x1x1 OR x2x2 … Andrew Yao, 1982/1986 Alice Bob Oblivious Transfer Protocol Rabin, 1981; Even, Goldreich, and Lempel, 1985; Naor and Pinkas 2001, Ishai et al., 2003 Rabin, 1981; Even, Goldreich, and Lempel, 1985; Naor and Pinkas 2001, Ishai et al., 2003 Free-XOR technique, Kolesnikov and Shneider, 2008

6 Threat Model Semi-Honest Adversary: follows the protocol as specified, but tries to learn more from the protocol execution transcript

7 Generic PSI Protocols Overview ProtocolsCost in non- XOR gates Best for Bitwise-AND (BWA) Small element space Pairwise-Comparison (PWC) Sort-Compare-Shuffle-WN (SCS-WN) Large element space

8 Generic PSI Protocols Overview ProtocolsCost in non- XOR gates Best for Bitwise-AND (BWA) Small element space Pairwise-Comparison (PWC) Sort-Compare-Shuffle-WN (SCS-WN) Large element space

9 PSI: Needn’t be Complex [ 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0] [ 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0] AND... Bitwise-AND... Encode set elements as bit vectors Recessive genes: { 5283423, 1425236, 839523, … } Recessive genes: { 5823527, 839523, 169325, … } [ PAH, PKU, CF, … ]

10 BWA Performance What if the element space is large?

11 Sort-Compare-Shuffle Sort: Take advantage of total order of elements Compare adjacent elements Shuffle to hide positions

12 Sort-Compare-Shuffle Sort: Take advantage of total order of elements Compare adjacent elements Shuffle to hide positions

13 Bitonic Sorting 1 4 9 7 5 4 3 2 1 5 4 4 3 9 2 7 1 3 2 4 5 9 4 7 1 2 3 4 4 5 7 9 1 2 3 4 4 5 7 9 Sorting Networks and their Applications, Ken Batcher, 1968

14 CMP Filter CMP Filter CMP Filter …

15 CMP3 Filter CMP3 Filter CMP3 Filter

16 Can’t reveal results yet! Position leaks information.

17 Journal of the ACM, January 1968

18 Waksman Network Same circuit can generate any permutation: select a random permutation, and pick swaps gates

19 Free Gates to generate and evaluate Private Set Intersection Protocol

20 SCS-WN Protocol Results 32-bit values

21 Relating Performance to Security (1024, 160)(2048, 224)(3072, 256)(7680, 384)(15360, 512) 80112128192256 DL Key-sizes: Symmetric:

22 Generic protocols offer many advantages Composability Flexibility on hardness assumptions Design cost Performance Conclusion

23 Q & A?


Download ppt "Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans, Jonathan Katz University of Virginia, University of."

Similar presentations


Ads by Google