Secure Two-party Computation Protocol Research Articles

Low Communication-Cost PSI Protocol for Unbalanced Two-Party Private Sets

Two-party private set intersection (PSI) plays a pivotal role in secure two-party computation protocols. The communication cost in a PSI protocol is normally influenced by the sizes of the participating parties. However, for parties with unbalanced sets, the communication costs of existing protocols mainly depend on the size of the larger set, leading to high communication cost. In this paper, we propose a low communication-cost PSI protocol designed specifically for unbalanced two-party private sets, aiming to enhance the efficiency of communication. For each item in the smaller set, the receiver queries whether it belongs to the larger set, such that the communication cost depends solely on the smaller set. The queries are implemented by private information retrieval which is constructed with trapdoor hash function. Our investigation indicates that in each instance of invoking the trapdoor hash function, the receiver is required to transmit both a hash key and an encoding key to the sender, thus incurring significant communication cost. In order to address this concern, we propose the utilization of a seed hash key, a seed encoding key, and a Latin square. By employing these components, the sender can autonomously generate all the necessary hash keys and encoding keys, obviating the multiple transmissions of such keys. The proposed protocol is provably secure against a semihonest adversary under the Decisional Diffie–Hellman assumption. Through implementation demonstration, we showcase that when the sizes of the two sets are 28 and 214, the communication cost of our protocol is only 3.3% of the state-of-the-art protocol and under 100 Kbps bandwidth, we achieve 1.46x speedup compared to the state-of-the-art protocol. Our source code is available on GitHub: https://github.com/TAN-OpenLab/Unbanlanced-PSI.

Breaking and Fixing Garbled Circuits When a Gate has Duplicate Input Wires

Garbled circuits are a fundamental cryptographic primitive that allows two or more parties to securely evaluate an arbitrary Boolean circuit without revealing any information beyond the output using a constant number of communication rounds. Garbled circuits have been introduced by Yao (FOCS’86) and generalized to the multi-party setting by Beaver, Micali and Rogaway (STOC’90). Since then, several works have improved their efficiency by providing different garbling schemes and several implementations exist. Starting with the seminal Fairplay compiler (USENIX Security’04), several implementation frameworks decoupled the task of compiling the function to be evaluated into a Boolean circuit from the engine that securely evaluates that circuit, e.g., using a secure two-party computation protocol based on garbled circuits. In this paper, we show that this decoupling of circuit generation and evaluation allows a subtle attack on several prominent garbling schemes. It occurs when violating the implicit assumption on the circuit that gates have different input wires which is most often not explicitly specified in the respective papers. The affected garbling schemes use separate calls to a deterministic encryption function for the left and right input wire of a gate to derive pseudo-random encryption pads that are XORed together. When a circuit contains a gate where the left and right input wire are the same, these two per-wire encryption pads cancel out and we demonstrate that this can result in a complete break of privacy. We show how the vulnerable garbling schemes can be fixed easily.

Clustered Federated Multitask Learning on Non-IID Data With Enhanced Privacy

Federated learning is a machine learning prgadigm that enables the collaborative learning among clients while keeping the privacy of clients’ data. Federated multitask learning (FMTL) deals with the statistic challenge of non-independent and identically distributed (IID) data by training a personalized model for each client, and yet requires all the clients to be always online in each training round. To eliminate the limitation of full-participation, we explore multitask learning associated with model clustering, and first propose a clustered FMTL to achieve the multual-task learning on non-IID data, while simultaneously improving the communication efficiency and the model accuracy. To enhance its privacy, we adopt a general dual-server architecture and further propose a secure clustered FMTL by designing a series of secure two-party computation protocols. The convergence analysis and security analysis is conducted to prove the correctness and security of our methods. Numeric evaluation on public data sets validates that our methods are superior to state-of-the-art methods in dealing with non-IID data while protecting the privacy.

Efficient Privacy-Preserving Inference Outsourcing for Convolutional Neural Networks

Inference outsourcing enables model owners to deploy their machine learning models on cloud servers to serve users. In this paradigm, the privacy of model owners and users should be considered. Existing solutions focus on Convolutional Neural Networks (CNNs) but their efficiency is much lower than GALA, which is a solution that only protects user privacy. Furthermore, these solutions adopt approximations that reduce the model accuracy and thus require model owners to retrain the models. In this paper, we present an efficient CNN inference outsourcing solution that protects the privacy of both model owners and users. Specifically, we design secure two-party computation protocols based on two non-colluding cloud servers, which calculate with additive secret shares of the model and the user’s input. Our protocols avoid the expensive permutation operations in linear calculations and approximations in non-linear calculations. We implement our solution on realistic CNNs and experimental results show that our solution is even 2–4 times faster than GALA.

Privacy‐preserving CNN feature extraction and retrieval over medical images

Online medicine diagnosis based on pathological images has been regarded as a pervasive method due to the advances in electronic healthcare and Internet of Things (IoT), however, it also causes storage and computing stress on the local IoT devices. To solve this problem, a nature way is to outsource images to cloud servers. Unfortunately, a range of security and privacy issues arise while delegating both storage and computing to the untrusted external servers. In this paper, we present a privacy-preserving feature extraction and retrieval scheme over medical images, which allows images storage and processing on two separate cloud servers. We share the images using secret sharing technology and design a set of secure two-party computation protocols between the two cloud servers. Then a privacy-preserving convolutional neural networks (CNN) framework is constructed to achieve feature extraction, classification and retrieval of images in the encrypted domain. We analyse and evaluate our scheme in terms of both security and efficiency. The results indicate that the proposed secure protocols in our scheme can significantly reduce the computation overhead while protecting the privacy of images as well as the data generated during execution on cloud servers and final results. The performance of our scheme in image feature extraction, classification and retrieval is at a similar level comparable to the scheme based on original CNN in plaintext.

Secure Two-Party Computation Based on Fast Cut-and-Choose Bilateral Oblivious Transfer

In secure two-party computation, each party has its input and wants to jointly compute a function from which it obtains the output corresponding to its respective inputs. For achieving security against a malicious adversary, an effective approach is using cut-and-choose, which requires the circuit constructor P1 to construct S copies of the circuit C (C is used to compute the function F). The circuit evaluator P2 selects S∕2 circuits to open for the check. If these S∕2 circuits are correctly constructed, P2 assumes that the remaining S∕2 circuits are also correctly constructed and uses the remaining circuits to compute. However, this method introduces significant computational complexity and interactive rounds, mainly due to more circuits that must be used for security purposes and the need for multiple interactions to transmit the keys. In this paper, regarding the issue above, we present a novel secure two-party computation protocol, and it can achieve security against the malicious adversary. Concretely, we still use the idea of cut-and-choose but improve the cut-and-choose oblivious transfer (CCOT) of the usual secure two-party computation protocol into cut-and-choose bilateral oblivious transfer (CCBOT) and propose a variant of it that we call batch single-choice CCBOT, which makes our protocol only needs two rounds of interaction to complete the transmission of all keys and 28Sl of exponentiations. In addition, we use a check mechanism to prevent the case that p1 cheats, but P2 is powerless. Our proposed protocol with an error probability of 2–s of P1 significantly optimizes the communication rounds and computation overheads, solves the selective failure attack, and ensures the consistency of the input.

Dispelling myths on superposition attacks: formal security model and attack analyses

With the emergence of quantum communication, it is of folkloric belief that the security of classical cryptographic protocols is automatically broken if the Adversary is allowed to perform superposition queries and the honest players forced to perform actions coherently on quantum states. Another widely held intuition is that enforcing measurements on the exchanged messages is enough to protect protocols from these attacks. However, the reality is much more complex. Security models dealing with superposition attacks only consider unconditional security. Conversely, security models considering computational security assume that all supposedly classical messages are measured, which forbids by construction the analysis of superposition attacks. To fill in the gap between those models, Boneh and Zhandry have started to study the quantum computational security for classical primitives in their seminal work at Crypto’13, but only in the single-party setting. To the best of our knowledge, an equivalent model in the multiparty setting is still missing. In this work, we propose the first computational security model considering superposition attacks for multiparty protocols. We show that our new security model is satisfiable by proving the security of the well-known One-Time-Pad protocol and give an attack on a variant of the equally reputable Yao Protocol for Secure Two-Party Computations. The post-mortem of this attack reveals the precise points of failure, yielding highly counter-intuitive results: Adding extra classical communication, which is harmless for classical security, can make the protocol become subject to superposition attacks. We use this newly imparted knowledge to construct the first concrete protocol for Secure Two-Party Computation that is resistant to superposition attacks. Our results show that there is no straightforward answer to provide for either the vulnerabilities of classical protocols to superposition attacks or the adapted countermeasures.

A new entropic criterion model in rational secure two-party computation

Rational secure two-party computation is one of the important researches in cryptography. Since the purpose of rational parties is to maximize their own utilities, the parties prefer to use a mixed strategy, which will cause a change in entropy. Some protocols solved the problems of fairness and security by using entropy function and utility function respectively. However, the cost of ensuring protocol security by setting a really high utility function is often higher than the value of the protocol itself, and the protocol is only suitable for a single privacy requirement. In this paper, we propose a secure two-party computation protocol based on entropic criterion and set the corresponding security entropic threshold according to different privacy requirements. Secure entropy is used as a method to evaluate the security of two parties in different scenes. Furthermore, we explore the relationship between secure entropy and utility function, then to select the optimal utility function within the range of secure entropic threshold. The model we proposed is more flexible and universal. Furthermore, the security state of the model is well predicted.

High performance logistic regression for privacy-preserving genome analysis

BackgroundIn biomedical applications, valuable data is often split between owners who cannot openly share the data because of privacy regulations and concerns. Training machine learning models on the joint data without violating privacy is a major technology challenge that can be addressed by combining techniques from machine learning and cryptography. When collaboratively training machine learning models with the cryptographic technique named secure multi-party computation, the price paid for keeping the data of the owners private is an increase in computational cost and runtime. A careful choice of machine learning techniques, algorithmic and implementation optimizations are a necessity to enable practical secure machine learning over distributed data sets. Such optimizations can be tailored to the kind of data and Machine Learning problem at hand.MethodsOur setup involves secure two-party computation protocols, along with a trusted initializer that distributes correlated randomness to the two computing parties. We use a gradient descent based algorithm for training a logistic regression like model with a clipped ReLu activation function, and we break down the algorithm into corresponding cryptographic protocols. Our main contributions are a new protocol for computing the activation function that requires neither secure comparison protocols nor Yao’s garbled circuits, and a series of cryptographic engineering optimizations to improve the performance.ResultsFor our largest gene expression data set, we train a model that requires over 7 billion secure multiplications; the training completes in about 26.90 s in a local area network. The implementation in this work is a further optimized version of the implementation with which we won first place in Track 4 of the iDASH 2019 secure genome analysis competition.ConclusionsIn this paper, we present a secure logistic regression training protocol and its implementation, with a new subprotocol to securely compute the activation function. To the best of our knowledge, we present the fastest existing secure multi-party computation implementation for training logistic regression models on high dimensional genome data distributed across a local area network.

Efficient Server-Aided Secure Two-Party Computation in Heterogeneous Mobile Cloud Computing

With the ubiquity of mobile devices and rapid development of cloud computing, mobile cloud computing (MCC) has been considered as an essential computation setting to support complicated, scalable and flexible mobile applications by overcoming the physical limitations of mobile devices with the aid of cloud. In the MCC setting, since many mobile applications (e.g., map apps) interacting with cloud server and application server need to perform computation with the private data of users, it is important to realize secure computation for MCC. In this article, we propose an efficient server-aided secure two-party computation (2PC) protocol for MCC. This is the first work that considers collusion between a malicious garbled circuit evaluator and a semi-honest server while ensuring privacy and correctness. Also, it can guarantee fairness when collusion does not exist. The security analysis shows that our protocol can securely compute any function f(x, y) against different types of adversaries in the malicious model. Also, the experimental performance analysis shows that this work outperforms the previous works for at least 10 times with the same security level.

On the Power of Secure Two-Party Computation

Ishai, Kushilevitz, Ostrovsky and Sahai (STOC 2007; SIAM J Comput 39(3):1121–1152, 2009) introduced the powerful “MPC-in-the-head” technique that provided a general transformation of information-theoretic MPC protocols secure against passive adversaries to a ZK proof in a “black-box” way. In this work, we extend this technique and provide a generic transformation of any semi-honest secure two-party computation (2PC) protocol (with mild adaptive security guarantees) in the so-called oblivious-transfer hybrid model to an adaptive ZK proof for any $$\textsf {NP}$$ language, in a “black-box” way assuming only one-way functions. Our basic construction based on Goldreich–Micali–Wigderson’s 2PC protocol yields an adaptive ZK proof with communication complexity proportional to quadratic in the size of the circuit implementing the $$\textsf {NP}$$ relation. Previously such proofs relied on an expensive Karp reduction of the $$\textsf {NP}$$ language to Graph Hamiltonicity [Lindell and Zarosim (TCC 2009; J Cryptol 24(4):761–799, 2011)]. As an application of our techniques, we show how to obtain a ZK proof with an “input-delayed” property for any $$\textsf {NP}$$ language without relying on expensive Karp reductions that is black box in the underlying one-way function. Namely, the input-delayed property allows the honest prover’s algorithm to receive the actual statement to be proved only in the final round. We further generalize this to obtain a “commit-and-prove” protocol with the same property where the prover commits to a witness w in the second message and proves a statement x regarding the witness w in zero-knowledge where the statement is determined only in the last round. This improves a previous construction of Lapidot and Shamir (Crypto 1990) that was designed specifically for the Graph Hamiltonicity problem and relied on the underlying primitives in a non-black-box way. Additionally, we provide a general transformation to construct a randomized encoding of a function f from any 2PC protocol that securely computes a related functionality (in a black-box way) from one-way functions. We show that if the 2PC protocol has mild adaptive security guarantees (which are satisfied by both the Yao’s and GMW’s protocol), then the resulting randomized encoding can be decomposed to an offline/online encoding.

Security and Efficiency Enhanced Revocable Access Control for Fog-Based Smart Grid System

With the popularity of smart grids, plentiful of smart devices have been put into use, such as smart meters and power assets. Due to limited computation capabilities and storage spaces of these devices, the collected data need to be “outsourced” towards the data server for processing and storage. The data owners, therefore, lose direct control over these “outsourced” data, leading to significant security issues of the users’ data. In this paper, aiming at solving this problem, we propose a multi-authority Ciphertext Policy Attribute-based Encryption (CP-ABE) scheme with revocation for the fog-based smart grid system. Specifically, in order to achieve attribute revocation without requiring users to be always online, we use the DH (Diffie-Hellman) tree to distribute the group key statelessly, which also solves the problem of collusion attack initiated by revoked user and valid user. To improve security of our proposed scheme, we remove the trusted key authority (KA) by using a secure two-party computation (2PC) protocol between the KA and the cloud service provider to generate user private key. To improve efficiency of our proposed scheme, we combine user and attribute revocation, and outsource complex calculations to fog nodes. Furthermore, our proposed scheme uses attribute group key and leaf private key together to protect user proxy key, which reduces the storage overhead of the system and improves the security. Both security analysis and experimental results demonstrate that our proposed scheme can balance the security objectives with the efficiency.

Cut-and-choose bilateral oblivious transfer protocol based on DDH assumption

In secure two-party computation protocols, the cut-and-choose paradigm is used to prevent the malicious party who constructs the garbled circuits from cheating. In previous realization of the cut-and-choose technique on the garbled circuits, the delivery of the random keys is divided into multiple stages. Thus, the round complexity is high and the consistency of cut-and-choose challenge should be proved. Based on DDH assumption, we build a so-called cut-and-choose bilateral oblivious transfer protocol, which transfers all necessary keys of garbled circuits in one process. Specifically, in our oblivious transfer protocol, the sender inputs two pairs $$(k_0^1,k_1^1)$$ , $$(k_0^2,k_1^2)$$ and a bit $$\tau$$ ; the receiver inputs two bits $$\sigma$$ and j. After the protocol execution, the receiver obtains $$k_{\tau }^1,k_{\sigma }^2$$ for $$j=1$$ , and $$k_0^1,k_1^1,k_0^2,k_1^2$$ for $$j=0$$ . The protocol inherit the cut-and-choose OT protocol in Lindell and Pinkas (Proceedings of the 8th conference on theory of cryptography, Springer, 2011), and can be applied into the state-of-the-art cut-and-choose secure two party computation protocol without any obstacles. By the cut-and-choose bilateral oblivious transfer protocol, the cut-and-choose challenge j is no need to be opened anymore, therefore the consistency proof of j is omitted, and the round complexity of secure two-party computation protocol can be decreased.

E-SC: Collusion-Resistant Secure Outsourcing of Sequence Comparison Algorithm

The sequence comparison of large-scale string-typed data is fundamental in computer science and other computational disciplines. Its development has been promoted into an emerging outsourcing service by the almost unlimited powerful computing and storage capabilities from public clouds. The privacy preservation and effective utility of the outsourced sensitive information are key requirements now facing this service. All of the secure two-party computation protocols in existing solutions, however, cannot be free from the assumption of non-colluding servers under multi-server models, and thus fail to defend against some attacks from cloud service providers. For this reason, we present encrypted sequence comparison (E-SC), the first security system that works by executing encrypted sequence comparison under a single-server model. Two character sequences are encrypted by end users before outsourcing, while the encrypted character sequences are compared directly by a single cloud server to return their similarity results. To accomplish this goal, novel computable encryption algorithms are designed in this paper. Then, a collusion-resistant outsourcing is achieved using non-interactive padding, partition, and expansion mechanisms. Results of simulation experiments demonstrate that the client-side overhead is quadratic in the input number of salt values, along with an optimal server-side performance. Also, the overall runtime of our E-SC system is positively correlated with its security level, which is more practical in realistic applications.

Enhanced security model and efficient construction for direct anonymous attestation

Direct anonymous attestation (DAA) is a cryptographic scheme which enables the remote authentication of a trusted platform whilst preserving privacy under the user's control. In this paper, we first present the enhanced security model for DAA, in which more precise security notions demanded from DAA are defined than that in any previous model. Then we propose a novel approach for constructing an efficient DAA scheme: we design a secure two-party computation protocol for the join/issue protocol of DAA, and construct the DAA scheme concretely under the q-SDH assumption, DL assumption and XDH assumption. Based on the enhanced security model, we prove that our DAA scheme meets user-controlled anonymity, user-controlled traceability and non-frameability in the random oracle model. Finally, compared with other existing DAA schemes, our DAA scheme has better performance.

Enhanced security model and efficient construction for direct anonymous attestation

Direct anonymous attestation (DAA) is a cryptographic scheme which enables the remote authentication of a trusted platform whilst preserving privacy under the user's control. In this paper, we first present the enhanced security model for DAA, in which more precise security notions demanded from DAA are defined than that in any previous model. Then we propose a novel approach for constructing an efficient DAA scheme: we design a secure two-party computation protocol for the join/issue protocol of DAA, and construct the DAA scheme concretely under the q-SDH assumption, DL assumption and XDH assumption. Based on the enhanced security model, we prove that our DAA scheme meets user-controlled anonymity, user-controlled traceability and non-frameability in the random oracle model. Finally, compared with other existing DAA schemes, our DAA scheme has better performance.

Private proximity detection for convex polygons

Proximity detection is an emerging technology in Geo-Social Networks that notifies mobile users when they are in proximity. Nevertheless, users may be unwilling to participate in such applications if they are required to disclose their exact locations to a centralized server and/or their social friends. To this end, private proximity detection protocols allow any two parties to test for proximity while maintaining their locations secret. In particular, a private proximity detection query returns only a boolean result to the querier and, in addition, it guarantees that no party can derive any information regarding the other party's location. However, most of the existing protocols rely on simple grid decompositions of the space and assume that two users are in proximity when they are located inside the same grid cell. In this paper, we extend the notion of private proximity detection, and propose a novel approach that allows a mobile user to define an arbitrary convex polygon on the map and test whether his friends are located therein. Our solution employs a secure two-party computation protocol and is provably secure. We implemented our method on handheld devices and illustrate its efficiency in terms of both computational and communication cost.

An Efficient Protocol for Secure Two-Party Computation in the Presence of Malicious Adversaries

We show an efficient secure two-party protocol, based on Yao’s construction, which provides security against malicious adversaries. Yao’s original protocol is only secure in the presence of semi-honest adversaries, and can be transformed into a protocol that achieves security against malicious adversaries by applying the compiler of Goldreich, Micali, and Wigderson (the “GMW compiler”). However, this approach does not seem to be very practical as it requires using generic zero-knowledge proofs. Our construction is based on applying cut-and-choose techniques to the original circuit and inputs. Security is proved according to the ideal/real simulation paradigm, and the proof is in the standard model (with no random oracle model or common reference string assumptions). The resulting protocol is computationally efficient: the only usage of asymmetric cryptography is for running \(O(1)\) oblivious transfers for each input bit (or for each bit of a statistical security parameter, whichever is larger). Our protocol combines techniques from folklore (like cut-and-choose) along with new techniques for efficiently proving consistency of inputs. We remark that a naive implementation of the cut-and-choose technique with Yao’s protocol does not yield a secure protocol. This is the first paper to show how to properly implement these techniques, and to provide a full proof of security. Our protocol can also be interpreted as a constant-round black-box reduction of secure two-party computation to oblivious transfer and perfectly hiding commitments, or a black-box reduction of secure two-party computation to oblivious transfer alone, with a number of rounds which is linear in a statistical security parameter. These two reductions are comparable to Kilian’s (20th STOC, 1988) reduction, which uses OT alone but incurs a number of rounds which is linear in the depth of the circuit.

Removing escrow from ciphertext policy attribute-based encryption

Attribute-based encryption (ABE) is a promising cryptographic primitive for fine-grained access control of distributed data. In ciphertext policy attribute-based encryption (CP-ABE), each user is associated with a set of attributes and data are encrypted with access policies on attributes. A user is able to decrypt a ciphertext if and only if his attributes satisfy the access policy embedded in the ciphertext. However, key escrow is inherent in ABE systems. A curious key generation center in that construction has the power to decrypt every ciphertext. We found that most of the existing ABE schemes depending on a single key authority suffer from the key escrow problem. In this study, we propose a novel CP-ABE key issuing architecture that solves the key escrow problem. The proposed scheme separates the power of issuing user keys into two parties: the key generation center and the attribute authority. In the proposed construction, the key generation center and the attribute authority issue different parts of secret key components to users through a secure two-party computation protocol such that none of them can determine the whole set of keys of users individually. We demonstrate how the proposed key issuing protocol can be applied in the existing CP-ABE scheme and resolve the key escrow problem.

Secure Two-Party Computation via Cut-and-Choose Oblivious Transfer

Protocols for secure two-party computation enable a pair of parties to compute a function of their inputs while preserving security properties such as privacy, correctness and independence of inputs. Recently, a number of protocols have been proposed for the efficient construction of two-party computation secure in the presence of malicious adversaries (where security is proven under the standard simulation-based ideal/real model paradigm for defining security). In this paper, we present a protocol for this task that follows the methodology of using cut-and-choose to boost Yao’s protocol to be secure in the presence of malicious adversaries. Relying on specific assumptions (DDH), we construct a protocol that is significantly more efficient and far simpler than the protocol of Lindell and Pinkas (Eurocrypt 2007) that follows the same methodology. We provide an exact, concrete analysis of the efficiency of our scheme and demonstrate that (at least for not very small circuits) our protocol is more efficient than any other known today.