More efficient oblivious transfer and extensions for faster secure computation

Abstract

Abstract. Protocols for secure computation enable parties to compute a joint function on their private inputs without revealing anything but the result. A foundation for secure computation is oblivious transfer (OT), which traditionally requires expensive public key cryptography. A more efficient way to perform many OTs is to extend a small number of base OTs using OT extensions based on symmetric cryptography. In this work we present optimizations and efficient implementations of OT and OT extensions in the semi-honest model. We propose a novel OT protocol with security in the standard model and improve OT extensions with respect to communication complexity, computation complexity, and scalability. We also provide specific optimizations of OT extensions that are tailored to the secure computation protocols of Yao and GoldreichMicali-Wigderson and reduce the communication complexity even further. We experimentally verify the efficiency gains of our protocols and optimizations. By applying our implementation to current secure computation frameworks, we can securely compute a Levenshtein distance circuit with 1.29 billion AND gates at a rate of 1.2 million AND gates per second. Moreover, we demonstrate the importance of correctly implementing OT within secure computation protocols by presenting an attack on the FastGC framework.

Privacy-Preserving Interdomain Routing at Internet Scale

“…OT guarantees that the sender does not learn the receiver's choice s, while the receiver only learns m s and nothing about m 1−s . OT can be computed efficiently using OT extension [28,29].…”

“…The main advantage of the GMW protocol is that it allows to precompute all (symmetric) cryptographic operations in a setup phase that is independent of both the function that is being evaluated and the inputs to the function. Each AND gate needs as precomputation two Oblivious Transfers (OTs) [28,29] on random inputs, which are used to precompute a multiplication triple that consists of random bits a 0 , a 1 [29]. We heavily utilize this precomputation.…”

Toward Practical Secure Stable Matching

“…The preference vectors altogether, will form a preference matrix. Thus we have one preference matrix for the women's group and one for men's in which each row represents the preference vector of each member of that group, see Figure 2 for an example: If woman #1 ranks the men as [1,2,0], this means that she prefers man #1 over man #2 and so on. Therefore the preference matrix is of size |W | × K w for women and |M | × K m for men.…”

“…We also use garbling with a fixed-key blockcipher [3] together with the half gates technique [40] for efficient evaluation of AND gates. For OT required in the initial data exchange of the GC protocol, we use the OT Extension method [2,14]. We use TinyGarble [32], an automated framework for generating optimized Boolean circuits for the GC which is based on logic synthesis tools.…”

Dishonest Majority Multi-Party Computation for Binary Circuits

“…The offline phase is then executed efficiently using a variant of the OT extension protocol of [12]. For a detailed discussion on OT extension see [2,12,13]. In this work we shall take OT extension as a given sub-procedure.…”