1. slide 1 Many thanks to Vitaly Shmatikov of the University of Texas, Austin for providing these slides. Introduction to Secure Multi-Party Computation

2. slide 2 Motivation uGeneral framework for describing computation between parties who do not trust each other uExample: elections N parties, each one has a “Yes” or “No” vote Goal: determine whether the majority voted “Yes”, but no voter should learn how other people voted uExample: auctions Each bidder makes an offer –Offer should be committing! (can’t change it later) Goal: determine whose offer won without revealing losing offers

3. slide 3 More Examples uExample: distributed data mining Two companies want to compare their datasets without revealing them –For example, compute the intersection of two lists of names uExample: database privacy Evaluate a query on the database without revealing the query to the database owner Evaluate a statistical query on the database without revealing the values of individual entries Many variations

4. slide 4 A Couple of Observations uIn all cases, we are dealing with distributed multi-party protocols A protocol describes how parties are supposed to exchange messages on the network uAll of these tasks can be easily computed by a trusted third party The goal of secure multi-party computation is to achieve the same result without involving a trusted third party

5. slide 5 How to Define Security? uMust be mathematically rigorous uMust capture all realistic attacks that a malicious participant may try to stage uShould be “abstract” Based on the desired “functionality” of the protocol, not a specific protocol Goal: define security for an entire class of protocols

6. slide 6 Functionality uK mutually distrustful parties want to jointly carry out some task uModel this task as a function f: ({0,1}*) K  ({0,1}*) K uAssume that this functionality is computable in probabilistic polynomial time K inputs (one per party); each input is a bitstring K outputs

7. slide 7 Ideal Model uIntuitively, we want the protocol to behave “as if” a trusted third party collected the parties’ inputs and computed the desired functionality Computation in the ideal model is secure by definition! AB x1x1 f 2 (x 1,x 2 )f 1 (x 1,x 2 ) x2x2

8. slide 8 Slightly More Formally uA protocol is secure if it emulates an ideal setting where the parties hand their inputs to a “trusted party,” who locally computes the desired outputs and hands them back to the parties [Goldreich-Micali-Wigderson 1987] AB x1x1 f 2 (x 1,x 2 )f 1 (x 1,x 2 ) x2x2

9. slide 9 Adversary Models uSome of protocol participants may be corrupt If all were honest, would not need secure multi-party computation uSemi-honest (aka passive; honest-but-curious) Follows protocol, but tries to learn more from received messages than he would learn in the ideal model uMalicious Deviates from the protocol in arbitrary ways, lies about his inputs, may quit at any point uFor now, we will focus on semi-honest adversaries and two-party protocols

10. slide 10 Correctness and Security uHow do we argue that the real protocol “emulates” the ideal protocol? uCorrectness All honest participants should receive the correct result of evaluating function f –Because a trusted third party would compute f correctly uSecurity All corrupt participants should learn no more from the protocol than what they would learn in ideal model What does corrupt participant learn in ideal model? –His input (obviously) and the result of evaluating f

11. slide 11 Simulation uCorrupt participant’s view of the protocol = record of messages sent and received In the ideal world, view consists simply of his input and the result of evaluating f uHow to argue that real protocol does not leak more useful information than ideal-world view? uKey idea: simulation If real-world view (i.e., messages received in the real protocol) can be simulated with access only to the ideal- world view, then real-world protocol is secure Simulation must be indistinguishable from real view

12. slide 12 Technicalities uDistance between probability distributions A and B over a common set X is ½ * sum X (|Pr(A=x) – Pr(B=x)|) uProbability ensemble A i is a set of discrete probability distributions Index i ranges over some set I uFunction f(n) is negligible if it is asymptotically smaller than the inverse of any polynomial  constant c  m such that |f(n)| m

13. slide 13 Notions of Indistinguishability uSimplest: ensembles A i and B i are equal uDistribution ensembles A i and B i are statistically close if dist(A i,B i ) is a negligible function of i uDistribution ensembles A i and B i are computationally indistinguishable (A i  B i ) if, for any probabilistic polynomial-time algorithm D, |Pr(D(A i )=1) - Pr(D(B i )=1)| is a negligible function of i No efficient algorithm can tell the difference between A i and B i except with a negligible probability

14. slide 14 SMC Definition (1 st Attempt) uProtocol for computing f(X A,X B ) betw. A and B is secure if there exist efficient simulator algorithms S A and S B such that for all input pairs (x A,x B ) … uCorrectness: (y A,y B )  f(x A,x B ) Intuition: outputs received by honest parties are indistinguishable from the correct result of evaluating f uSecurity:view A (real protocol)  S A (x A,y A ) view B (real protocol)  S B (x B,y B ) Intuition: a corrupt party’s view of the protocol can be simulated from its input and output uThis definition does not work! Why?

15. slide 15 Randomized Ideal Functionality uConsider a coin flipping functionality f()=(b,-) where b is random bit f() flips a coin and tells A the result; B learns nothing uThe following protocol “implements” f() 1. A chooses bit b randomly 2. A sends b to B 3. A outputs b uIt is obviously insecure (why?) uYet it is correct and simulatable according to our attempted definition (why?)

16. slide 16 SMC Definition uProtocol for computing f(X A,X B ) betw. A and B is secure if there exist efficient simulator algorithms S A and S B such that for all input pairs (x A,x B ) … uCorrectness: (y A,y B )  f(x A,x B ) uSecurity:(view A (real protocol), y B )  (S A (x A,y A ), y B ) (view B (real protocol), y A )  (S B (x B,y B ), y A ) Intuition: if a corrupt party’s view of the protocol is correlated with the honest party’s output, the simulator must be able to capture this correlation uDoes this fix the problem with coin-flipping f?

17. slide 17 Oblivious Transfer (OT) [Rabin 1981] uFundamental SMC primitive AB b 0, b 1 bibi i = 0 or 1 A inputs two bits, B inputs the index of one of A’s bits B learns his chosen bit, A learns nothing –A does not learn which bit B has chosen; B does not learn the value of the bit that he did not choose Generalizes to bitstrings, M instead of 2, etc.

18. slide 18 One-Way Trapdoor Functions uIntuition: one-way functions are easy to compute, but hard to invert (skip formal definition for now) We will be interested in one-way permutations uIntution: one-way trapdoor functions are one-way functions that are easy to invert given some extra information called the trapdoor Example: if n=pq where p and q are large primes and e is relatively prime to  (n), f e,n (m) = m e mod n is easy to compute, but it is believed to be hard to invert Given the trapdoor d=e -1 mod  (n), f e,n (m) is easy to invert because f e,n (m) d = (m e ) d = m mod n

19. slide 19 Hard-Core Predicates uLet f: S  S be a one-way function on some set S uB: S  {0,1} is a hard-core predicate for f if B(x) is easy to compute given x  S If an algorithm, given only f(x), computes B(x) correctly with prob > ½+ , it can be used to invert f(x) easily –Consequence: B(x) is hard to compute given only f(x) Intuition: there is a bit of information about x s.t. learning this bit from f(x) is as hard as inverting f uGoldreich-Levin theorem B(x,r)=r  x is a hard-core predicate for g(x,r) = (f(x),r) –f(x) is any one-way function, r  x=(r 1 x 1 )  …  (r n x n )

20. slide 20 Oblivious Transfer Protocol uAssume the existence of some family of one-way trapdoor permutations A B Chooses his input i (0 or 1) Chooses random r 0,r 1, x, y not i Computes y i = F(x) Chooses a one-way permutation F and corresponding trapdoor T F r 0, r 1, y 0, y 1 b 0  (r 0  T(y 0 )), b 1  (r 1  T(y 1 )) Computes m i  (r i  x) = (b i  (r i  T(y i )))  (r i  x) = (b i  (r i  T(F(x))))  (r i  x) = b i

21. slide 21 y 0 and y 1 are uniformly random regardless of A’s choice of permutation F (why?). Therefore, A’s view is independent of B’s input i. Proof of Security for B AB Chooses random r 0,1, x, y not i Computes y i = F(x) F r 0, r 1, y 0, y 1 b 0  (r 0  T(y 0 )), b 1  (r 1  T(y 1 )) Computes m i  (r i  x)

22. slide 22 Proof of Security for A (Sketch) SimB Random r 0,1, x, y not i y i = F(x) F r 0, r 1, y 0, y 1 b 0  (r 0  T(y 0 )), b 1  (r 1  T(y 1 )) uNeed to build a simulator whose output is indistinguishable from B’s view of the protocol Chooses random F, random r 0,r 1, x, y not i computes y i = F(x), sets m i =b i  (r i  T(y i )), random m not i Knows i and b i (why?) The only difference between simulation and real protocol: In simulation, m not i is random (why?) In real protocol, m not i =b not i  (r not i  T(y not i ))

23. slide 23 Proof of Security for A (Cont’d) uWhy is it computationally infeasible to distinguish random m and m’=b  (r  T(y))? b is some bit, r and y are random, T is the trapdoor of a one-way trapdoor permutation u(r  x) is a hard-core bit for g(x,r)=(F(x),r) This means that (r  x) is hard to compute given F(x) uIf B can distinguish m and m’=b  (r  x’) given only y=F(x’), we obtain a contradiction with the fact that (r  x’) is a hard-core bit Proof omitted

24. slide 24 Yao’s Protocol

25. slide 25 1 00 0 Yao’s Protocol uCompute any function securely … in the semi-honest model uFirst, convert the function into a boolean circuit AND xy z Truth table: xyz 0 10 1 00 11 1 00 0 OR xy z Truth table: xyz 0 11 1 01 11 ANDORAND NOT ORAND Alice’s inputs Bob’s inputs

26. slide 26 1: Pick Random Keys For Each Wire uNext, evaluate one gate securely Later, generalize to the entire circuit uAlice picks two random keys for each wire One key corresponds to “0”, the other to “1” 6 keys in total for a gate with 2 input wires AND x y z k 0z, k 1z Alice Bob k 0x, k 1x k 0y, k 1y

27. slide 27 2: Encrypt Truth Table uAlice encrypts each row of the truth table by encrypting the output-wire key with the corresponding pair of input-wire keys AND x y z k 0z, k 1z Alice Bob k 0x, k 1x k 0y, k 1y 1 00 0 Original truth table: xyz 0 10 1 00 11 Encrypted truth table: E k 0x (E k 0y (k 0z )) E k 0x (E k 1y (k 0z )) E k 1x (E k 0y (k 0z )) E k 1x (E k 1y (k 1z ))

28. slide 28 3: Send Garbled Truth Table uAlice randomly permutes (“garbles”) encrypted truth table and sends it to Bob AND x y z k 0z, k 1z Alice Bob k 0x, k 1x k 0y, k 1y Garbled truth table: E k 0x (E k 0y (k 0z )) E k 0x (E k 1y (k 0z )) E k 1x (E k 0y (k 0z )) E k 1x (E k 1y (k 1z )) E k 0x (E k 0y (k 0z )) E k 0x (E k 1y (k 0z )) E k 1x (E k 0y (k 0z )) E k 1x (E k 1y (k 1z )) Does not know which row of garbled table corresponds to which row of original table

29. slide 29 4: Send Keys For Alice’s Inputs uAlice sends the key corresponding to her input bit Keys are random, so Bob does not learn what this bit is AND x y z k 0z, k 1z Alice Bob k 0x, k 1x k 0y, k 1y If Alice’s bit is 1, she simply sends k 1x to Bob; if 0, she sends k 0x Learns K b’x where b’ is Alice’s input bit, but not b’ (why?) Garbled truth table: E k 0x (E k 0y (k 0z )) E k 0x (E k 1y (k 0z )) E k 1x (E k 0y (k 0z )) E k 1x (E k 1y (k 1z ))

30. slide 30 5: Use OT on Keys for Bob’s Input uAlice and Bob run oblivious transfer protocol Alice’s input is the two keys corresponding to Bob’s wire Bob’s input into OT is simply his 1-bit input on that wire AND x y z k 0z, k 1z Alice Bob k 0x, k 1x k 0y, k 1y Run oblivious transfer Alice’s input: k 0y, k 1y Bob’s input: his bit b Bob learns k by What does Alice learn? Knows K b’x where b’ is Alice’s input bit and K by where b is his own input bit Garbled truth table: E k 0x (E k 0y (k 0z )) E k 0x (E k 1y (k 0z )) E k 1x (E k 0y (k 0z )) E k 1x (E k 1y (k 1z ))

31. slide 31 6: Evaluate Garbled Gate uUsing the two keys that he learned, Bob decrypts exactly one of the output-wire keys Bob does not learn if this key corresponds to 0 or 1 –Why is this important? AND x y z k 0z, k 1z Alice Bob k 0x, k 1x k 0y, k 1y Knows K b’x where b’ is Alice’s input bit and K by where b is his own input bit Garbled truth table: E k 0x (E k 0y (k 0z )) E k 0x (E k 1y (k 0z )) E k 1x (E k 0y (k 0z )) E k 1x (E k 1y (k 1z )) Suppose b’=0, b=1 This is the only row Bob can decrypt. He learns K 0z

32. An Important Aside uWhy is it that Bob can only decrypt one row of the garbled circuit? Use encryption scheme that has an elusive range and Use encryption scheme that has an efficiently verifiable range uElusive Range: Roughly, the probability that an encryption under one key is in the range of an encryption under another key is negligible. uEfficiently Verifiable Range: A user, given a key, can efficiently verify whether ciphertext is in the range of that key. slide 32

33. Example (Lindell, Pinkas paper) uF = {f k } a family of psuedorandom functions with f k : {0,1} n -> {0,1} 2n for k in {0,1} n uFor x in {0,1} n, r a random n bit string, define E k (x) = (r, f k (r) XOR x0 n ) x0 n is the concatenation of x and n bit string of 0s uElusive range: the low order n bits of f k (r) are revealed (and fixed) by the XOR. The odds of having two keys giving that same low order n bits is 1/2 n uVerifiable range: Given r and a key k, it is trivial to verify that ciphertext is in the range of E k. slide 33

34. slide 34 uIn this way, Bob evaluates entire garbled circuit For each wire in the circuit, Bob learns only one key It corresponds to 0 or 1 (Bob does not know which) –Therefore, Bob does not learn intermediate values (why?) uBob tells Alice the key for the final output wire and she tells him if it corresponds to 0 or 1 Bob does not tell her intermediate wire keys (why?) 7: Evaluate Entire Circuit ANDOR AND NOT OR AND Alice’s inputs Bob’s inputs

35. slide 35 Brief Discussion of Yao’s Protocol uFunction must be converted into a circuit For many functions, circuit will be huge uIf m gates in the circuit and n inputs, then need 4m encryptions and n oblivious transfers Oblivious transfers for all inputs can be done in parallel uYao’s construction gives a constant-round protocol for secure computation of any function in the semi-honest model Number of rounds does not depend on the number of inputs or the size of the circuit! –Though the size of the data transferred does!