Can a Public Blockchain Keep a Secret?

Benhamouda, Fabrice; Gentry, Craig; Gorbunov, S.; Halevi, Shai; Krawczyk, Hugo; Fu, Chenglong; Rabin, Tal; Reyzin, Leonid

doi:10.1007/978-3-030-64375-1_10

Cited by 58 publications

(47 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our initial motivation for studying RPIR came from a recent work of Benhamouda et al [2] (BGG+) about maintaining secret values on public blockchains. In that work they construct a scalable evolving-committee proactive secret-sharing (ECPSS) scheme, that allows dynamicallychanging small committees to maintain a secret over a public blockchain.…”

Section: Computing On Public Blockchainsmentioning

confidence: 99%

“…To do better, we can try to delegate the nomination task to previous committees, who would emulate an honest nominator via secure MPC. Roughly, the function computed by the committeeselection procedure of [2] is Nominate(n-public keys, randomness) = k re-randomized keys.…”

Section: Computing On Public Blockchainsmentioning

confidence: 99%

“…This time, the circuit size depends only on k, not on the total number n of keys. Putting all these ideas together we get: Theorem (informal): In the model of [2], there exists a scalable ECPSS scheme tolerating any fraction f < 1/2 of corrupted parties.…”

Section: Computing On Public Blockchainsmentioning

confidence: 99%

“…Of course, once we have the committees we can again let them compute on secrets rather than just pass them along, hence we have: Theorem (informal): In the model of [2], there exists a scalable secure MPC scheme tolerating any fraction f < 1/2 of corrupted parties.…”

Section: Computing On Public Blockchainsmentioning

confidence: 99%

“…In Section 3 we describe some constructions of RPIR in the noninteractive setting, and efficient constructions of batch-RPIR with weak security. In Section 4 we describe the application of batch RPIR with weak security to the architecture of Benhamouda et al [2] for large-scale MPC. Motivated by this application, we study in Section 5 more efficient constructions of batch-RPIR.…”

Section: Organizationmentioning

confidence: 99%

See 4 more Smart Citations

Random-Index PIR and Applications

Gentry¹,

Halevi²,

Magri

et al. 2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Private information retrieval (PIR) lets a client retrieve an entry from a database without the server learning which entry was retrieved. Here we study a weaker variant that we call random-index PIR (RPIR), where the retrieved index is an output rather than an input of the protocol, and is chosen at random. RPIR is clearly weaker than PIR, but it suffices for some interesting applications and may be realized more efficiently than full-blown PIR.We report here on two lines of work, both tied to RPIR but otherwise largely unrelated. The first line of work studies RPIR as a primitive on its own. Perhaps surprisingly, we show that RPIR is in fact equivalent to PIR when there are no restrictions on the number of communication rounds. On the other hand, RPIR can be implemented in a "noninteractive" setting (with preprocessing), which is clearly impossible for PIR. For two-server RPIR we even show a truly noninteractive solution, offering information-theoretic security without any pre-processing.The other line of work, which was the original motivation for our work, uses RPIR to improve on the recent work of Benhamouda et al. (TCC'20) for maintaining secret values on public blockchains. Their solution depends on a method for selecting many random public keys from a PKI while hiding most of the selected keys from an adversary. However, the method they proposed is vulnerable to a double-dipping attack, limiting its resilience. Here we observe that a RPIR protocol, where the client is implemented via secure MPC, can eliminate that vulnerability. We thus get a secrets-on-blockchain protocol (and more generally large-scale MPC), resilient to any fraction f < 1/2 of corrupted parties, resolving the main open problem left from the work of Benhamouda et al.As the client in this solution is implemented via secure MPC, it really brings home the need to make it as efficient as possible. We thus strive to explore whatever efficiency gains we can get by using RPIR rather than PIR. We achieve more gains by using batch RPIR where multiple indexes are retrieved at once. Lastly, we observe that this application can make do with a weaker security guarantee than full RPIR, and show that this weaker variant can be realized even more efficiently. We discuss one protocol in particular, that may be attractive for practical implementations.

show abstract

Section: Computing On Public Blockchainsmentioning

confidence: 99%

Section: Computing On Public Blockchainsmentioning

confidence: 99%

Section: Computing On Public Blockchainsmentioning

confidence: 99%

Section: Computing On Public Blockchainsmentioning

confidence: 99%

Section: Organizationmentioning

confidence: 99%

See 3 more Smart Citations

Random-Index PIR and Applications

Gentry¹,

Halevi²,

Magri

et al. 2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

Zero‐knowledge‐based distributed auditing protocol

Far

Asaar

Haghbin

2022

Security and Privacy

View full text Add to dashboard Cite

Blockchain-based data outsourcing has attracted a huge deal of attention in recent years. However, key management and reliance on pre-defined or randomly-selected third-party auditors (TPAs) are still challenging owing to refusing to collaborate or break auditing policies. Additionally, it is impossible to store secrets in smart contracts (SCs) for signing or auditing. Thus, in the present study, a zero-knowledge (ZK)-based distributed auditing protocol (DAP) is provided. In this protocol, a user-based key generation mechanism offers users security against curious authorities based on no TPA causing them to reveal no knowledge about under-auditing data. Based on Pointcheval's and Sanders's signature scheme, as a ZK-based randomizable signature applied in an SC to handle the auditing process, the proposed DAP provides confidential transactions and user accountability. Evaluation indicates that the proposed ZK-based DAP is efficient for the user side and it is the fastest DAP in the blockchain.

show abstract