Efficient Two-Round OT Extension and Silent Non-Interactive Secure Computation

Abstract

We consider the problem of securely generating useful instances of two-party correlations, such as many independent copies of a random oblivious transfer (OT) correlation, using a small amount of communication. This problem is motivated by the goal of secure computation with silent preprocessing, where a low-communication input-independent setup, followed by local ("silent") computation, enables a lightweight "non-cryptographic" online phase once the inputs are known.Recent works of Boyle et al. (CCS 2018, Crypto 2019) achieve this goal with good concrete efficiency for useful kinds of two-party correlations, including OT correlations, under different variants of the Learning Parity with Noise (LPN) assumption, and using a small number of "base" oblivious transfers. The protocols of Boyle et al. have several limitations. First, they require a large number of communication rounds. Second, they are only secure against semi-honest parties. Finally, their concrete efficiency estimates are not backed by an actual implementation. In this work we address these limitations, making three main contributions: • Eliminating interaction. Under the same assumption, we obtain the first concretely efficient 2-round protocols for generating useful correlations, including OT correlations, in the semi-honest security model. This implies the first efficient 2-round OT extension protocol of any kind and, more generally, protocols for non-interactive secure computation (NISC) that are concretely efficient and have the silent preprocessing feature.

Indistinguishability obfuscation from well-founded assumptions

“…Recently, the LPN assumption has led to a wide variety of applications (see for example, [11,14,22,35,36,63,73,88]). A comprehensive review of known attacks on LPN over large fields, for the parameter settings we are interested in, was given in [35,37].…”

“…In this work, we use the LPN assumption over a large field. This assumption has been used in a various works (see for example, [11,14,22,35,36,63,73,88]). We adopt the following definition from [35].…”

Linear Complexity Private Set Intersection for Secure Two-Party Protocols

“…In recent works, it was shown that the number of rounds can be 2 instead of 3 for an OT extension protocol by executing some of the computations in the offline phase of the protocol [3,4]. In our solution, we don't consider the preprocessing operations and so we don't use these constructions in our protocols.…”

“…The value P 2 learns is always random and indistinguishable; but, this random value is equal to r if and only if y ∈ X. 3 Following this part, the parties run a secure functional equality testing protocol, where at the end of the protocol P 2 learns the function result of the equality relation, which is also the function result of the membership relation. We make use of the PSM protocol of Ciampi-Orlandi [5] for secure functional equality testing by reducing the number of items of the sender set to one.…”

Innocent until proven guilty: Privacy-preserving search over a central CODIS criminal database from the field

“…Because the correlations are input-independent, they can be precomputed without knowledge of the client's query or the server's database. These OT correlations can be generated efficiently using a technique called OT extension in a separate input-independent preprocessing step 30 (this can even be done with low communication using a recent approach called silent OT extension 31 ). Alternatively, they can be generated ahead of time by a trusted dealer or a secure hardware platform (observe that in both of these settings, the party generating the correlations does not need to know anything about the query or the database entries).…”