Function Secret Sharing

Abstract

Motivated by the goal of securely searching and updating distributed data, we introduce and study the notion of function secret sharing (FSS). This new notion is a natural generalization of distributed point functions (DPF), a primitive that was recently introduced by Gilboa and Ishai (Eurocrypt 2014). Given a positive integer p ≥ 2 and a class F of functions f : {0, 1} n → G, where G is an Abelian group, a p-party FSS scheme for F allows one to split each f ∈ F into p succinctly described functions fi : {0, 1} n → G, 1 ≤ i ≤ p, such that: (1) p i=1 fi = f , and (2) any strict subset of the fi hides f . Thus, an FSS for F can be thought of as method for succinctly performing an "additive secret sharing" of functions from F . The original definition of DPF coincides with a twoparty FSS for the class of point functions, namely the class of functions that have a nonzero output on at most one input.We present two types of results. First, we obtain efficiency improvements and extensions of the original DPF construction. Then, we initiate a systematic study of general FSS, providing some constructions and establishing relations with other cryptographic primitives. More concretely, we obtain the following main results:-Improved DPF. We present an improved (two-party) DPF construction from a pseudorandom generator (PRG), reducing the length of the key describing each fi from O(λ • n log 2 3 ) to O(λn), where λ is the PRG seed length. -Multi-party DPF. We present the first nontrivial construction of a p-party DPF for p ≥ 3, obtaining a near-quadratic improvement over a naive construction that additively shares the truth-table of f . This constrcution too can be based on any PRG. -FSS for simple functions. We present efficient PRG-based FSS constructions for natural function classes that extend point functions, including interval functions and partial matching functions. -A study of general FSS. We show several relations between general FSS and other cryptographic primitives. These include a construction of general FSS via obfuscation, an indication for the

Partitioned Data Security on Outsourced Sensitive and Non-Sensitive Data

“…Inputs: w: the query value. Outputs: SB a and NSB b : one sensitive bin and one non-sensitive bin to be retrieved for answering w. Variables: found ← false 1 Function retrieve bins(q(w )) begin 2 for (i, j) ∈ (0, SB − 1), (0, |SB | − 1) do if w = SB i [j] then 3 return SB i and NSB j ; found ← true; break 4 if found = true then 5 for (i, j) ∈ (0, NSB − 1), (0, |NSB | − 1) do 6 if w = NSB i [j] then return NSB i and SB j ; break 7 Retrieve the desired tuples from the cloud by sending encrypted values of the bin SB i (or SB j ) and clear-text values of the bin NSB j (or NSB i ) to the cloud…”

“…The last two decades have witnessed the development of secure and privacy-preserving encryption-based [1]- [3] or secret-sharing-based [4]- [7] techniques to realize the database as a service model. Despite significant progress, a cryptographic approach that is both secure (i.e., no leakage of sensitive data to the adversary) and efficient (in terms of time) simultaneously has proved to be very challenging.…”

“…The authors are thankful to the PC chairs, vicechairs, and reviewers for helping in improving the presentation of the paper. distributed point functions (DPF) [6], and function secretsharing (FSS) [7] are a few examples of such techniques. Such methods often limit the type of operations one can perform while imposing high overhead in terms of communication.…”

Exploiting Data Sensitivity on Partitioned Data

“…Inputs: w: the query value. Outputs: SB a and NSB b : one sensitive bin and one non-sensitive bin to be retrieved for answering w. Variables: found ← false 1 Function retrieve bins(q(w )) begin 2 for (i, j) ∈ (0, SB − 1), (0, |SB | − 1) do if w = SB i [j] then 3 return SB i and NSB j ; found ← true; break end end 4 if found = true then 5 for (i, j) ∈ (0, NSB − 1), (0, |NSB | − 1) do 6 if w = NSB i [j] then return NSB i and SB j ; break end end end 7 Retrieve the desired tuples from the cloud by sending encrypted values of the bin SB i (or SB j ) and clear-text values of the bin NSB j (or NSB i ) to the cloud end Algorithm 2 provides a way to retrieve the bins. Thus, by following Algorithm 2, Table 2 shows that the adversary cannot know the query value w or find a value that is shared between the two sets, when answering to the above-mentioned three queries.…”

“…Secret-sharing [41] based techniques. E.g., distributed point function [22], function secret-sharing [7], functional secret-sharing [30], accumulating-automata [18,19], OBSCURE [32], and others [20,33,31]. 3.…”