Nothing Refreshes Like a RePSI: Reactive Private Set Intersection

Abstract

Private Set Intersection (PSI) is a popular cryptographic primitive that allows two parties, a client and a server, to compute the intersection of their private sets, so that the client only receives the output of the computation, while the server learns nothing besides the size of the client's set. A common limitation of PSI is that a dishonest client can progressively learn the server's set by enumerating it over different executions. Although these "oracle attacks" do not formally violate security according to traditional secure computation definitions, in practice, they often hamper real-life deployment of PSI instantiations, especially if the server's set does not change much over multiple interactions. In a first step to address this problem, this paper presents and studies the concept of Reactive PSI (RePSI). We model PSI as a reactive functionality, whereby the output depends on previous instances, and use it to limit the effectiveness of oracle attacks. We introduce a general security model for RePSI in the (augmented) semi-honest model and a construction which enables the server to control how many inputs have been used by the client across several executions. In the process, we also present the first construction of a Size-Hiding PSI (SHI-PSI) protocol in the standard model, which may be of independent interest.

Secure and efficient multiparty private set intersection cardinality

“…Later, Rindal and Rosulek [50] proposed a PSI employing dual execution. In the following, the concept of Reactive PSI was introduced by Cerulli et al [8]. In [11], Ciampi and Orlandi presented PSI protocol based on special purpose oblivious transfer (OT).…”

Practical Multi-Party Private Set Intersection Protocols

“…In this paper, we focus on a specific MPC problem, namely Private Set Intersection (PSI), which aims at calculating the intersection of two or more sets without revealing the set items of the involved parties or in certain settings, even the set sizes. The problem in the two-party setting has attracted significant attention from the research community in the last decades [1], [2], [3], [4], [5], [6], [7], [8], [9]. Some of these protocols have been extended to the multi-party setting, commonly referred to as Multi-party Private Set Intersection (MPSI).…”

“…b) Criminal activities on smart roads: In our EU project SECREDAS 1 , we aim at enabling autonomous vehicles on smart roads. Achieving this goal will have an enormous impact on changing transportation in general, including but not limited to reducing traffic jams and thus CO2 emission, better planning for building roads, and most importantly, improving safety.…”

“…1 https://www.ecsel.eu/projects/secredas A. Related work PSI protocols have been thoroughly studied, and some works are already fast enough to compute the intersection of large sets in the order of seconds [1], [2]. There are also many other works that compute the private intersection of multiple sets (MPSI) [19], [20], [13], [21], [22], [23], [24], [17].…”

Post‐quantum protocol for computing set intersection cardinality with linear complexity

“…The authors of [29 ] proposed PSI compatible with unequal set sizes. The concept of reactive PSI was introduced by Cerulli et al [30 ]. In the following, Ciampi and Orlandi [31 ] constructed an oblivious transfer (OT)‐based PSI protocol.…”