Fast Cut-and-Choose-Based Protocols for Malicious and Covert Adversaries

Abstract

In the setting of secure two-party computation, two parties wish to securely compute a joint function of their private inputs, while revealing only the output. One of the primary techniques for achieving efficient secure two-party computation is that of Yao's garbled circuits (FOCS 1986). In the semi-honest model, where just one garbled circuit is constructed and evaluated, Yao's protocol has proven itself to be very efficient. However, a malicious adversary who constructs the garbled circuit may construct a garbling of a different circuit computing a different function, and this cannot be detected (due to the garbling). In order to solve this problem, many circuits are sent and some of them are opened to check that they are correct while the others are evaluated. This methodology, called cut-and-choose, introduces significant overhead, both in computation and in communication, and is mainly due to the number of circuits that must be used in order to prevent cheating.In this paper, we present a cut-and-choose protocol for secure computation based on garbled circuits, with security in the presence of malicious adversaries, that vastly improves on all previous protocols of this type. Concretely, for a cheating probability of at most 2 −40 , the best previous works send between 125 and 128 circuits. In contrast, in our protocol 40 circuits alone suffice (with some additional overhead). Asymptotically, we achieve a cheating probability of 2 −s where s is the number of garbled circuits, in contrast to the previous best of 2 −0.32s . We achieve this by introducing a new cut-and-choose methodology with the property that in order to cheat, all of the evaluated circuits must be incorrect, and not just the majority as in previous works. The security of our protocol relies on the Decisional Diffie-Hellman assumption.

TumbleBit: An Untrusted Bitcoin-Compatible Anonymous Payment Hub

“…We do so by applying the cut-and-choose technique and exploiting the blinding properties of RSA. (We follow the blueprint of Lindell's recent work [33]. Roughly, a malicious party can only cheat if all of the "opened" values are correct and all of the "hidden" ones are incorrect.…”

My Genome Belongs to Me: Controlling Third Party Computation on Genomic Data

“…Applications and practical instantiations of Yao's garbled circuits can be found in [13,29,32,56]. Much work has been going on recently related to optimizations and better security for garbled circuits that can be found in [22,33,34,48,49,[51][52][53]71].…”

Efficient k-out-of-n oblivious transfer scheme with the ideal communication cost

“…The technique of cut-and-choose has been regarded as a useful basic block to construct the two-party protocols against malicious adversaries, and formalized and proven secure by Lindell and Pinkas [24]. A number of cut-and-choose oblivious transfer protocols [25,26,23,16] have focused on reducing the concrete overhead of the cut-and-choose approach. Kolesnikov and Kumaresan [19] proposed an efficient cut-and-choose OT scheme and its variants with small concrete communication overhead in an OT-hybrid model.…”