Practical Secure Two-Party Computation

Abstract

Secure two-party computation allows two parties to cooperatively evaluate a function that takes both parties' private data as input without revealing any private information other than the outcome. Although secure computation has many important applications in various fields and a general theoretical solution has been known for decades, practical systems are rare due to the prohibitive performance overhead and the tremendous effort required to build such systems.The garbled circuit (i.e., Yao's circuit) technique enables secure computing of polynomial-time computable functions but has previously been thought to be too expensive for practical applications. We improved the efficiency of garbled circuits focusing on both execution and design aspects. Our implementation uses pipelining aggressively so the circuit execution runs with a nearly constant amount of memory and can scale to arbitrarily large circuits. To aid the efficient construction of circuits, we developed a library of component circuits that enables programmers to quickly create new ones by modular composition of existing ones. We integrated these ideas into a new framework that enables programmers to develope secure computation protocols from an existing insecure implementation while providing enough control over the circuit design to enable efficient implementation. To evaluate the effectiveness of our techniques and our new tools, we build several privacy-preserving applications which are secure against passive adversaries, including secure biometric identification, secure edit distance and Smith-Waterman, private encryption, and private set intersection.The secure guarantees of passively-secure protocols do not hold if an attacker goes "active" -by deviating from the protocol specification. To thwart active adversaries, we present a concrete design and implementation of protocols achieving security guarantees that are much stronger than are possible with passively-secure protocols, at minimal extra cost. We consider protocols in which a malicious adversary may learn a single (arbitrary) bit of additional information about the honest party's input. Correctness of the honest party's output is still guaranteed. Adapting prior work of Mohassel and Franklin, the basic idea in our protocols is to conduct two separate runs of a (specific) semi-honest, garbled-circuit protocol, with the parties swapping roles, followed by an inexpensive secure equality test. We provide a rigorous definition and prove that this protocol leaks no more than one additional bit against a malicious adversary. In addition, we propose some i Abstract ii heuristic enhancements to reduce the overall information a cheating adversary learns. Our experiments show that protocols meeting this security level can be implemented at a cost very close to protocols that only achieve semi-honest security. Our results indicate that this model enables the large-scale, practical applications possible within the semi-honest security model, while providing stronger security guarantees.We al...

Pushing the Communication Barrier in Secure Computation using Lookup Tables

“…Thereby, we overall require 2D(C) communication rounds in the online phase, where D(C) is the highest number of LUTs from any input to any output of the circuit. In order to reduce the number of communication rounds, we let both parties switch roles in the online phase after each communication round, similar to [Hua12]. More specifically, assume P 0 plays the sender and P 1 plays the receiver in the first round.…”

Chameleon

“…The secure computation framework of [46,Chapter 6] also utilizes correlated randomness. Beyond passive security and one STP, this framework also covers active security and multiple STPs.…”

“…The online phase is a two-party execution model that is run between two parties who wish to perform secure computation on their data. In the offline phase, a Semi-honest Third Party (STP) creates correlated randomness together with random seeds and provides it to the two parties as suggested in [46]. We describe how the STP can be implemented in §4.3 and its role in §5.2.…”

“…In Chameleon, the STP is only involved in the offline phase in order to generate correlated randomness [46]. It is not involved in the online phase and thus does not receive any information about the two parties' inputs nor the program being executed.…”

“…Utilizing the idea of correlated randomness [46], we present an efficient and fast protocol for Oblivious Transfer that is aided by the Semi-honest Third Party (STP). Our protocol comprises an offline phase (performed by the STP) and an online phase (performed by the two parties).…”