Efficient Secure Two-Party Exponentiation

Abstract

Abstract. We present a new framework to design secure two-party computation protocols for exponentiation over integers and over ZQ where Q is a publicly-known prime. Using our framework, we realize efficient protocols in the semi-honest setting. Assuming the base is non-zero, and the exponent is at most Q/2 for the ZQ case, our protocols consist of at most 5 rounds (each party sending 5 messages) and the total communication consists of a small constant number (≤ 18) of encrypted/encoded elements in ZQ. Without these assumptions, our protocols are still more efficient than a protocol recently proposed by Damgård et al. in TCC 2006 (24 vs. > 114 rounds, ≈ 279 +12t for an error rate of 2 −t vs. > 110 log secure multiplications, where is the bit length of the shares).Our protocols are constructed from different instantiations of our framework with different assumptions (homomorphic encryption or oblivious transfers) to achieve different advantages. Our key idea is to exploit the properties of both additive and multiplicative secret sharing. We also propose efficient transformation protocols between these sharings, which might be of independent interest.

Differentially private data aggregation with optimal utility

“…There exist SMPCs based on other techniques (homomorphic encryption, oblivious transfer, etc.) that do not assume an honest majority (e.g., [31,42]), but that are currently less efficient. Nevertheless, since PrivaDA is parameterized over the underlying arithmetic SMPCs, it can take immediate advantage of the rapid progress in this research field.…”

“…The SMPC protocols we adopt for the realization of our approach are based on secret sharing: such SMPCs are secure in the malicious setting (i.e., the computation parties may try to deviate from the protocol) but, for certain arithmetic operations, they assume the majority of the computation parties not to collude. We could in principle adopt other kinds of SMPC protocols that do not require this assumption [11,31,42], but they are currently less efficient.…”

Memory and Round-Efficient MPC Primitives in the Pre-Processing Model from Unit Vectorization

“…Our modular exponentiation protocol works over the ring Z 2 ℓ . In contrast, to our knowledge, all the existing protocols for modular exponentiations are defined over finite fields [2,17,29,36]. The state-of-the-art exponentiation protocol proposed in [2] has constant round complexity with respect to the input bit-length, and requires 13 rounds if working in the two-party setting.…”