Private Set Intersection for Unequal Set Sizes with Mobile Applications

Kiss, Ágnes; Liu, Jian; Schneider, Thomas; Asokan, N.; Pinkas, Benny

doi:10.1515/popets-2017-0044

Cited by 71 publications

(53 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…All these PSI protocols have super-linear complexity and many of them were compared experimentally in [PSZ18]. PSI protocols have also been evaluated on mobile devices, e.g., in [HCE11,ADN+13,CADT14,KLS+17]. PSI protocols with input sets of different sizes were studied in [KLS+17,PSZ18,RA18].…”

Section: Psimentioning

confidence: 99%

“…A careful analysis reveals that those protocols require O(n) comparisons to process all items that were mapped to the Cuckoo hash table, and an additional s • n comparisons to process the s = ω(1) items that were mapped to the stash. We note that the concurrent and independent work of [FNO18] proposes to use a PSI protocol for unbalanced set sizes, such as in the work of [KLS+17], to reduce the complexity of handling the stash from ω(n) to O(n) in PSI protocols. However, their idea can only be applied when the output is the intersection itself.…”

Section: A Linear Communication Protocolmentioning

confidence: 99%

See 1 more Smart Citation

Efficient Circuit-Based PSI with Linear Communication

Pinkas

Schneider

Tkachenko

et al. 2019

Lecture Notes in Computer Science

Self Cite

109

View full text Add to dashboard Cite

We present a new protocol for computing a circuit which implements the private set intersection functionality (PSI). Using circuits for this task is advantageous over the usage of specific protocols for PSI, since many applications of PSI do not need to compute the intersection itself but rather functions based on the items in the intersection. Our protocol is the first circuit-based PSI protocol to achieve linear communication complexity. It is also concretely more efficient than all previous circuit-based PSI protocols. For example, for sets of size 2 20 it improves the communication of the recent work of Pinkas et al. (EURO-CRYPT'18) by more than 10 times, and improves the run time by a factor of 2.8x in the LAN setting, and by a factor of 5.8x in the WAN setting. Our protocol is based on the usage of a protocol for computing oblivious programmable pseudo-random functions (OPPRF), and more specifically on our technique to amortize the cost of batching together multiple invocations of OPPRF.

show abstract

Section: Psimentioning

confidence: 99%

Section: A Linear Communication Protocolmentioning

confidence: 99%

Efficient Circuit-Based PSI with Linear Communication

Pinkas

Schneider

Tkachenko

et al. 2019

Lecture Notes in Computer Science

Self Cite

109

View full text Add to dashboard Cite

show abstract

“…, y N , but the result is still too large. While more advanced PSI protocols exist that improve on these results asymptotically, they are unfortunately not yet practical for this C3 setting [30,31]. Practical C3 schemes therefore relax the security requirements, allowing the protocol to leak some information about the client's queried (u, w) but hopefully not too much.…”

Section: Overviewmentioning

confidence: 99%

Protocols for Checking Compromised Credentials

Pal

Ali³

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches. Recently, some web services, such as HaveIBeenPwned (HIBP) and Google Password Checkup (GPC), have started providing APIs to check for breached passwords. We refer to such services as compromised credential checking (C3) services. We give the first formal description of C3 services, detailing different settings and operational requirements, and we give relevant threat models.One key security requirement is the secrecy of a user's passwords that are being checked. Current widely deployed C3 services have the user share a small prefix of a hash computed over the user's password. We provide a framework for empirically analyzing the leakage of such protocols, showing that in some contexts knowing the hash prefixes leads to a 12x increase in the efficacy of remote guessing attacks. We propose two new protocols that provide stronger protection for users' passwords, implement them, and show experimentally that they remain practical to deploy.

show abstract

“…In the subsequent year, Debnath and Dutta proposed a sequence of PSI protocols in [18,19,20] employing a Bloom filter retaining linear complexity. In [45], Kiss et al transformed four existing PSI protocols into the precomputation form such that in the setup phase the communication is linear only in the size of the larger input set, while in the online phase the communication is linear in the size of the smaller input set. (v) Other Paradigm Based PSI: Utilizing fully homomorphic encryption, Chen et al [9] build a PSI in the honest-but-curious setting.…”

Section: Related Workmentioning

confidence: 99%

Secure and efficient multiparty private set intersection cardinality

Debnath¹,

Stănică²,

Kundu³

et al. 2021

Advances in Mathematics of Communications

View full text Add to dashboard Cite

In the field of privacy preserving protocols, Private Set Intersection (PSI) plays an important role. In most of the cases, PSI allows two parties to securely determine the intersection of their private input sets, and no other information. In this paper, employing a Bloom filter, we propose a Multiparty Private Set Intersection Cardinality (MPSI-CA), where the number of participants in PSI is not limited to two. The security of our scheme is achieved in the standard model under the Decisional Diffie-Hellman (DDH) assumption against semi-honest adversaries. Our scheme is flexible in the sense that set size of one participant is independent from that of the others. We consider the number of modular exponentiations in order to determine computational complexity. In our construction, communication and computation overheads of each participant is O(vmaxk) except that the complexity of the designated party is O(v 1), where vmax is the maximum set size, v 1 denotes the set size of the designated party and k is a security parameter. Particularly, our MSPI-CA is the first that incurs linear complexity in terms of set size, namely O(nvmaxk), where n is the number of participants. Further, we extend our MPSI-CA to MPSI retaining all the security attributes and other properties. As far as we are aware of, there is no other MPSI so far where individual computational cost of each participant is independent of the number of participants. Unlike MPSI-CA, our MPSI does not require any kind of broadcast channel as it uses star network topology in the sense that a designated party communicates with everyone else.

show abstract

Private Set Intersection for Unequal Set Sizes with Mobile Applications

Cited by 71 publications

References 42 publications

Efficient Circuit-Based PSI with Linear Communication

Efficient Circuit-Based PSI with Linear Communication

Protocols for Checking Compromised Credentials

Secure and efficient multiparty private set intersection cardinality

Contact Info

Product

Resources

About