Automatic Protocol Selection in Secure Two-Party Computations

Abstract

Abstract. Performance of secure computation is still often an obstacle to its practical adaption. There are different protocols for secure computation that compete for the best performance. In this paper we propose automatic protocol selection which selects a protocol for each operation resulting in a mix with the best performance so far. Based on an elaborate performance model, we propose an optimization algorithm and an efficient heuristic for this selection problem. We show that our mixed protocols achieve the best performance on a set of use cases. Furthermore, our results underpin that the selection problem is so complicated and large in size, that a programmer is unlikely to manually make the optimal selection. Our proposed algorithms nevertheless can be integrated into a compiler in order to yield the best (or near-optimal) performance.

Efficient secure computation optimization

“…All of these protocols can be integrated securely using a type system as shown by [25]. This choice can be quite difficult for the programmer and [27] introduced a compiler technique that automatically chooses the best protocol.…”

“…Third, as in [27] the compiler can perform the optimization. This has first been introduced in [23].…”

Wysteria: A Programming Language for Generic, Mixed-Mode Multiparty Computations

“…Its input language, TASTYL, requires explicit specification of communication between parties, as well as the means of secure computation, whereas in our approach, such concerns are handled automatically (during runtime compilation of generated circuits). Kerschbaum et al [29] explore automatic selection of mixed protocols consisting of garbled circuits and homomorphic encryption. Jif/Split enables writing multi-party computations in Java as (conceptually) single-threaded programs [30].…”

Domain-polymorphic language for privacy-preserving applications

“…When developing an application making use of SMC techniques, we may want to use more than one technique simultaneously, and/or we may want to defer the choice of particular SMC techniques to a later stage of development. The main reason for this is efficiency -different operations may be fastest using different techniques, even when considering the costs of translating between data representations [9]. Confidentiality policies may compound this issue, stating that different pieces of data must be treated with techniques providing protection against different kinds of adversaries (passive vs. active; the size of coalitions it's able to form).…”