Efficient Set Operations in the Presence of Malicious Adversaries

Hazay, Carmit; Nissim, Kobbi

doi:10.1007/978-3-642-13013-7_19

Cited by 87 publications

(70 citation statements)

References 39 publications

(49 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We then show that several existing SFE constructions are either commit-first or can be efficiently transformed into one. Examples include variants of Yao's garbled circuit protocol, the oblivious polynomial evaluation of Hazay and Lindell [HL09], the private set intersection protocol of Hazay and Nissim [HN12], and the oblivious automaton evaluation of Gennaro et al [GHS10]. We also show that the GMW compiler [GMW87] outputs a commit-first protocol.…”

Section: Our Contributionmentioning

confidence: 85%

“…Their goal is for one or both parties to learn X ∩Y without revealing additional information about their sets. The PSI problem has been the focus of active research, and to date, many constructions with a variety of efficiency and security properties have been designed and implemented [FNP04,CKT10,HN12,HEK12].…”

Section: Psi Protocol Of Hazay and Nissimmentioning

confidence: 99%

“…Here, we focus on the protocol of Hazay and Nissim [HN12], since it is secure against malicious adversaries and we can easily show it to be a one-sided commit-first protocol as well. Once again, we do not describe the details of their construction but mostly focus on the components we need to prove the commit-first property.…”

Section: Psi Protocol Of Hazay and Nissimmentioning

confidence: 99%

“…The private set intersection protocol of [HN12] is one-sided commit-first with security against malicious adversaries.…”

Section: Psi Protocol Of Hazay and Nissimmentioning

confidence: 99%

See 3 more Smart Citations

Rate-Limited Secure Function Evaluation: Definitions and Constructions

Dagdelen

Mohassel

Venturi

2013

Public-Key Cryptography – PKC 2013

View full text Add to dashboard Cite

We introduce the notion of rate-limited secure function evaluation (RL-SFE). Loosely speaking, in an RL-SFE protocol participants can monitor and limit the number of distinct inputs (i.e., rate) used by their counterparts in multiple executions of an SFE, in a private and verifiable manner. The need for RL-SFE naturally arises in a variety of scenarios: e.g., it enables service providers to "meter" their customers' usage without compromising their privacy, or can be used to prevent oracle attacks against SFE constructions.We consider three variants of RL-SFE providing different levels of security. As a stepping stone, we also formalize the notion of commit-first SFE (CF-SFE) wherein parties are committed to their inputs before each SFE execution. We provide compilers for transforming any CF-SFE protocol into each of the three RL-SFE variants. Our compilers are accompanied with simulation-based proofs of security in the standard model and show a clear tradeoff between the level of security offered and the overhead required. Moreover, motivated by the fact that in many client-server applications clients do not keep state, we also describe a general approach for transforming the resulting RL-SFE protocols into stateless ones.As a case study, we take a closer look at the oblivious polynomial evaluation (OPE) protocol of Hazay and Lindell, show that it is commit-first, and instantiate efficient ratelimited variants of it.

show abstract

Section: Our Contributionmentioning

confidence: 85%

Section: Psi Protocol Of Hazay and Nissimmentioning

confidence: 99%

Section: Psi Protocol Of Hazay and Nissimmentioning

confidence: 99%

“…The private set intersection protocol of [HN12] is one-sided commit-first with security against malicious adversaries.…”

Section: Psi Protocol Of Hazay and Nissimmentioning

confidence: 99%

See 2 more Smart Citations

Rate-Limited Secure Function Evaluation: Definitions and Constructions

Dagdelen

Mohassel

Venturi

2013

Public-Key Cryptography – PKC 2013

View full text Add to dashboard Cite

show abstract

“…A number of organizations dealing with sensitive data such as healthcare providers, insurance companies, law enforcement agencies, and aviation security need to perform such an operation on their data. A large body of work has been studying the design of PSI protocols [11,20,16,18,6,17,9,19,8,1].…”

Section: Our Contributionmentioning

confidence: 99%

Fast Computation on Encrypted Polynomials and Applications

Mohassel

2011

Cryptology and Network Security

View full text Add to dashboard Cite

Abstract. In this paper, we explore fast algorithms for computing on encrypted polynomials. More specifically, we describe efficient algorithms for computing the Discrete Fourier Transform, multiplication, division, and multipoint evaluation on encrypted polynomials. The encryption scheme we use needs to be additively homomorphic, with a plaintext domain that contains appropriate primitive roots of unity. We show that some modifications to the key generation setups and working with variants of the original hardness assumptions one can adapt the existing homomorphic encryption schemes to work in our algorithms. The above set of algorithms on encrypted polynomials are useful building blocks for the design of secure computation protocols. We demonstrate their usefulness by utilizing them to solve two problems from the literature, namely the oblivious polynomial evaluation (OPE) and the private set intersection but expect the techniques to be applicable to other problems as well.

show abstract

Efficient privacy preserving matchmaking for mobile social networking

Wang

Hou

Xia

et al. 2014

Concurrency and Computation

View full text Add to dashboard Cite

SUMMARYDiscovering new friends who share common attributes, named as matchmaking, is one of the most popular applications in mobile social networking. The key security issue in matchmaking is to protect users' personal information. In this paper, we propose a novel privacy preserving matchmaking framework, which can help users to find new friends in mobile social networking without leaking their privacy information. A user (called initiator) can find the one who shares maximum number of common attributes with him (called best match) among nearby users (called candidates), and only exchange an attribute intersection set with the best match, while other candidates only know the size of the attribute intersection set mutually. The analysis and simulation results show that our protocol can resist both semi-honest and malicious attacks while providing efficient matchmaking functionality.

show abstract

Efficient Set Operations in the Presence of Malicious Adversaries

Cited by 87 publications

References 39 publications

Rate-Limited Secure Function Evaluation: Definitions and Constructions

Rate-Limited Secure Function Evaluation: Definitions and Constructions

Fast Computation on Encrypted Polynomials and Applications

Efficient privacy preserving matchmaking for mobile social networking

Contact Info

Product

Resources

About