One-Sided Adaptively Secure Two-Party Computation

Abstract

Adaptive security is a strong security notion that captures additional security threats that are not addressed by static corruptions. For instance, it captures real-world scenarios where "hackers" actively break into computers, possibly while they are executing secure protocols. Studying this setting is interesting from both theoretical and practical points of view. A primary building block in designing adaptively secure protocols is a non-committing encryption (NCE) that implements secure communication channels in the presence of adaptive corruptions. Current constructions require a number of public key operations that grows linearly with the length of the message. Furthermore, general two-party protocols require a number of NCE calls that dependents both on the circuit size and the security parameter.In this paper we study the two-party setting in which at most one of the parties is adaptively corrupted, and demonstrate the feasibility of (1) NCE with constant number of public key operations for large message spaces. (2) Oblivious transfer with constant number of public key operations for large sender's input spaces, and (3) constant round secure computation protocols with an overall number of public key operations that is linear in the circuit size. Our study demonstrates that such primitives indeed exist in the presence of single corruptions without erasures, while this is not known for fully adaptive security under standard assumptions (where both parties may get corrupted). Our results are shown in the UC setting with a CRS setup.

Adaptively Secure Computation with Partial Erasures

“…The proof from [HP14] is shown in the one-sided setting where either the sender or the receiver are corrupted, but not both. In case both parties are corrupted it seems infeasible to prove security since the parties are required to use fake keys/ciphertexts for equivocation, but at the same time explain the keys and ciphertexts as valid.…”

“…In this section we prove that a slightly modified version of the NCE construction from [HP14] is NCE with partial erasures, which only requires a constant number of PKE operations per polynomiallength message. This construction is built on two IND-CPA secure primitives with an additional equivocation property.…”

“…In particular, known constructions induce overhead of O(1) public-key operations for every transmitted bit [CFGN96, DN00, CDSMW09], while our protocol implies a constant number of such operations per polynomial-length message. Our construction is a slightly modified version of the NCE construction that appears in [HP14].…”

“…In the full version of the paper, we further instantiate our modified enhanced dual-mode PKE with a special type of NCES that requires an extra property. Finally, we build such an NCES based on a construction taken from [HP14] under the hardness of the DCR assumption. Combined together, these results imply semi-adaptive string OT using a constant number of PKE operations for exponential size message domains.…”

Two-Round Adaptively Secure MPC from Indistinguishability Obfuscation

“…In the case where all but one of the parties can be corrupted, [36,34] and [35,27] including the concurrent work of [18], propose constant round two-party and multi-party protocols, respectively. On the other hand, round complexity of all know adaptively secure protocols secure against an arbitrary number of corruptions grows (see, e.g.…”