Channels of Small Log-Ratio Leakage and Characterization of Two-Party Differentially Private Computation

Abstract

Consider a ppt two-party protocol Π = (A, B) in which the parties get no private inputs and obtain outputs O A , O B ∈ {0, 1}, and let V A and V B denote the parties' individual views.The leakage of Π is the amount of information a party obtains about the event O A = O B ; that is, the leakage ǫ is the maximum, over P ∈ {A, B}, of the distance betweenTypically, this distance is measured in statistical distance, or, in the computational setting, in computational indistinguishability. For this choice, Wullschleger [TCC '09] showed that if ǫ ≪ α then the protocol can be transformed into an OT protocol.We consider measuring the protocol leakage by the log-ratio distance (which was popularized by its use in the differential privacy framework). The log-ratio distance between X, Y over domain Ω is the minimal ǫ ≥ 0 for which, for every v ∈ Ω, log Pr[X=v] PrIn the computational setting, we use computational indistinguishability from having log-ratio distance ǫ. We show that a protocol with (noticeable) accuracy α ∈ Ω(ǫ 2 ) can be transformed into an OT protocol (note that this allows ǫ ≫ α). We complete the picture, in this respect, showing that a protocol with α ∈ o(ǫ 2 ) does not necessarily imply OT. Our results hold for both the information theoretic and the computational settings, and can be viewed as a "fine grained" approach to "weak OT amplification".We then use the above result to fully characterize the complexity of differentially private twoparty computation for the XOR function, answering the open question put by Goyal, Khurana, Mironov, Pandey, and Sahai [ICALP '16] and Haitner, Nissim, Omri, Shaltiel, and Silbak [FOCS '18]. Specifically, we show that for any (noticeable) α ∈ Ω(ǫ 2 ), a two-party protocol that computes the XOR function with α-accuracy and ǫ-differential privacy can be transformed into an OT protocol. This improves upon Goyal et al. that only handle α ∈ Ω(ǫ), and upon Haitner et al. who showed that such a protocol implies (infinitely-often) key agreement (and not OT). Our characterization is tight since OT does not follow from protocols in which α ∈ o(ǫ 2 ), and extends to functions (over many bits) that "contain" an "embedded copy" of the XOR function.

Computational Two-Party Correlation: A Dichotomy for Key-Agreement Protocols

“…A recent subsequent work by Haitner, Mazor, Shaltiel and Silbak [19] improved on the above result. They showed that a non-trivial differentially private protocol for computing XOR can be used to construct a standard oblivious transfer protocol (without the infinitely often).…”

“…Achieving external privacy is typically much simpler than the full-fledged notion of Definition 6.1. In particular, functionalities such as XOR (with external privacy) can by implemented using key-agreement protocols, this is in contrast to the full-fledged notion of differential privacy Definition 6.1 that requires oblivious transfer (as was recently shown in [19]).…”

“…(This question can be asked for various ranges of accuracy and differential privacy parameters). For the differentially private XOR functionality this question was fully resolved by the resent subsequent work of Haitner, Mazor, Shaltiel and Silbak [19]. Where they showed that any non-trivial DP-XOR can be used to construct an oblivious transfer protocol (without the infinitely often), moreover, this result also applies for sub constant leakage and accuracy.…”

Pure Differential Privacy from Secure Intermediaries

“…Our protocol primarily differs in the first step: our aggregator's security guarantee is defined in terms of a metric based on likelihood ratios rather than statistical distance. This alternative metric was also studied in prior work by Haitner, Mazor, Shaltiel, and Silbak [29]. There, the authors construct oblivious transfer from an agreement primitive.…”

On the Complexity of Two-Party Differential Privacy

“…Recent works have made progress on understanding this question for computing Boolean functions, for example, showing that differential private protocol for computing the XOR function with non-trivial accuracy requires the existence of oblivious transfer [23]. Much less progress was made, however, towards understanding the complexity of more natural statistical tasks (e.g., estimating the inner product).…”