Two-party Computation Research Articles

Fast Cut-and-Choose-Based Protocols for Malicious and Covert Adversaries

In the setting of secure two-party computation, two parties wish to securely compute a joint function of their private inputs, while revealing only the output. One of the primary techniques for achieving efficient secure two-party computation is that of Yao's garbled circuits (FOCS 1986). In the semi-honest model, where just one garbled circuit is constructed and evaluated, Yao's protocol has proven itself to be very efficient. However, a malicious adversary who constructs the garbled circuit may construct a garbling of a different circuit computing a different function, and this cannot be detected (due to the garbling). In order to solve this problem, many circuits are sent and some of them are opened to check that they are correct while the others are evaluated. This methodology, called cut-and-choose, introduces significant overhead, both in computation and in communication, and is mainly due to the number of circuits that must be used in order to prevent cheating. In this paper, we present a cut-and-choose protocol for secure computation based on garbled circuits, with security in the presence of malicious adversaries, that vastly improves on all previous protocols of this type. Concretely, for a cheating probability of at most $$2^{-40}$$2-40, the best previous works send between 125 and 128 circuits. In contrast, in our protocol 40 circuits alone suffice (with some additional overhead). Asymptotically, we achieve a cheating probability of $$2^{-s}$$2-s where $$s$$s is the number of garbled circuits, in contrast to the previous best of $$2^{-0.32s}$$2-0.32s. We achieve this by introducing a new cut-and-choose methodology with the property that in order to cheat, all of the evaluated circuits must be incorrect, and not just the majority as in previous works. The security of our protocol relies on the decisional Diffie---Hellman assumption.

Privacy-Preserving Multi-Class Support Vector Machine for Outsourcing the Data Classification in Cloud

Emerging cloud computing infrastructure replaces traditional outsourcing techniques and provides flexible services to clients at different locations via Internet. This leads to the requirement for data classification to be performed by potentially untrusted servers in the cloud. Within this context, classifier built by the server can be utilized by clients in order to classify their own data samples over the cloud. In this paper, we study a privacy-preserving (PP) data classification technique where the server is unable to learn any knowledge about clients’ input data samples while the server side classifier is also kept secret from the clients during the classification process. More specifically, to the best of our knowledge, we propose the first known client-server data classification protocol using support vector machine. The proposed protocol performs PP classification for both two-class and multi-class problems. The protocol exploits properties of Pailler homomorphic encryption and secure two-party computation. At the core of our protocol lies an efficient, novel protocol for securely obtaining the sign of Pailler encrypted numbers.

Secure quantum private query with real-time security check

As a class of one-sided two-party computation, unconditionally secure symmetrically private information retrieval (SPIR) is impossible. So the study of quantum symmetrically private information retrieval (QSPIR), i.e., quantum private query (QPQ) with an interesting degree of security is desirable. Known QPQ protocols [Phys. Rev. Lett. 100 (23) (2008) 230502; Phys. Rev. A 84 (2) (2011) 022313; Phys. Rev. A 83 (2011) 022301; Opt. Exp. 20 (16) (2012) 17411–17420] are claimed to be cheat-sensitive, especially not real-time. It is natural to ask whether we can design a QPQ protocol with real-time security check. In this paper, we introduce an untrusted third party and propose a framework of one-sided two-party quantum computation protocols with real-time security check. For clarity and without loss of generality, we demonstrate a concrete QPQ example under this framework by improving Gao et al's protocol [Opt. Exp. 20 (16) (2012) 17411–17420]. We discuss the security of the protocol and show that it really has real-time security check. The proposed framework paves the way for the design of one-sided two-party quantum computation protocols.

Secure linear system computation in the presence of malicious adversaries

In this paper, we study the system of linear equation problems in the two-party computation setting. Consider that P 1 holds an m × m matrix M 1 and an m-dimensional column vector B 1. Similarly, P 2 holds M 2 and B 2. Via executing a secure linear system computation, P 1 gets the output x (or ⊥) conditioned on (M 1 + M 2)x = (B 1 + B 2), and the rank of matrix M 1 + M 2, while P 2 gets nothing. This also can be used to settle other cooperative linear system problems. We firstly design an efficient protocol to solve this problem in the presence of malicious adversaries, then propose a simple way to modify our protocol for having a precise functionality, in which the rank of matrix M 1+M 2 is not necessary. We note that our protocol is more practical than these existing malicious secure protocols. We also give comparisons with other protocols and extensions to similar functions.

On the Efficiency of Classical and Quantum Secure Function Evaluation

We provide bounds on the efficiency of secure one-sided output two-party computation of arbitrary finite functions from trusted distributed randomness in the statistical case. From these results we derive bounds on the efficiency of protocols that use different variants of OT as a black-box. When applied to implementations of OT, these bounds generalize most known results to the statistical case. Our results hold in particular for transformations between a finite number of primitives and for any error. In the second part we study the efficiency of quantum protocols implementing OT. While most classical lower bounds for perfectly secure reductions of OT to distributed randomness still hold in the quantum setting, we present a statistically secure protocol that violates these bounds by an arbitrarily large factor. We then prove a weaker lower bound that does hold in the statistical quantum setting and implies that even quantum protocols cannot extend OT. Finally, we present two lower bounds for reductions of OT to commitments and a protocol based on string commitments that is optimal with respect to both of these bounds.

An Efficient Protocol for Secure Two-Party Computation in the Presence of Malicious Adversaries

We show an efficient secure two-party protocol, based on Yao’s construction, which provides security against malicious adversaries. Yao’s original protocol is only secure in the presence of semi-honest adversaries, and can be transformed into a protocol that achieves security against malicious adversaries by applying the compiler of Goldreich, Micali, and Wigderson (the “GMW compiler”). However, this approach does not seem to be very practical as it requires using generic zero-knowledge proofs. Our construction is based on applying cut-and-choose techniques to the original circuit and inputs. Security is proved according to the ideal/real simulation paradigm, and the proof is in the standard model (with no random oracle model or common reference string assumptions). The resulting protocol is computationally efficient: the only usage of asymmetric cryptography is for running \(O(1)\) oblivious transfers for each input bit (or for each bit of a statistical security parameter, whichever is larger). Our protocol combines techniques from folklore (like cut-and-choose) along with new techniques for efficiently proving consistency of inputs. We remark that a naive implementation of the cut-and-choose technique with Yao’s protocol does not yield a secure protocol. This is the first paper to show how to properly implement these techniques, and to provide a full proof of security. Our protocol can also be interpreted as a constant-round black-box reduction of secure two-party computation to oblivious transfer and perfectly hiding commitments, or a black-box reduction of secure two-party computation to oblivious transfer alone, with a number of rounds which is linear in a statistical security parameter. These two reductions are comparable to Kilian’s (20th STOC, 1988) reduction, which uses OT alone but incurs a number of rounds which is linear in the depth of the circuit.

Experimental Unconditionally Secure Bit Commitment

Quantum physics allows for unconditionally secure communication between parties that trust each other. However, when the parties do not trust each other such as in the bit commitment scenario, quantum physics is not enough to guarantee security unless extra assumptions are made. Unconditionally secure bit commitment only becomes feasible when quantum physics is combined with relativistic causality constraints. Here we experimentally implement a quantum bit commitment protocol with relativistic constraints that offers unconditional security. The commitment is made through quantum measurements in two quantum key distribution systems in which the results are transmitted via free-space optical communication to two agents separated with more than 20 km. The security of the protocol relies on the properties of quantum information and relativity theory. In each run of the experiment, a bit is successfully committed with less than 5.68×10(-2) cheating probability. This demonstrates the experimental feasibility of quantum communication with relativistic constraints.

Privacy-preserving self-helped medical diagnosis scheme based on secure two-party computation in wireless sensor networks.

With the continuing growth of wireless sensor networks in pervasive medical care, people pay more and more attention to privacy in medical monitoring, diagnosis, treatment, and patient care. On one hand, we expect the public health institutions to provide us with better service. On the other hand, we would not like to leak our personal health information to them. In order to balance this contradiction, in this paper we design a privacy-preserving self-helped medical diagnosis scheme based on secure two-party computation in wireless sensor networks so that patients can privately diagnose themselves by inputting a health card into a self-helped medical diagnosis ATM to obtain a diagnostic report just like drawing money from a bank ATM without revealing patients' health information and doctors' diagnostic skill. It makes secure self-helped disease diagnosis feasible and greatly benefits patients as well as relieving the heavy pressure of public health institutions.

Improving Security and Efficiency in Attribute-Based Data Sharing

With the recent adoption and diffusion of the data sharing paradigm in distributed systems such as online social networks or cloud computing, there have been increasing demands and concerns for distributed data security. One of the most challenging issues in data sharing systems is the enforcement of access policies and the support of policies updates. Ciphertext policy attribute-based encryption (CP-ABE) is becoming a promising cryptographic solution to this issue. It enables data owners to define their own access policies over user attributes and enforce the policies on the data to be distributed. However, the advantage comes with a major drawback which is known as a key escrow problem. The key generation center could decrypt any messages addressed to specific users by generating their private keys. This is not suitable for data sharing scenarios where the data owner would like to make their private data only accessible to designated users. In addition, applying CP-ABE in the data sharing system introduces another challenge with regard to the user revocation since the access policies are defined only over the attribute universe. Therefore, in this study, we propose a novel CP-ABE scheme for a data sharing system by exploiting the characteristic of the system architecture. The proposed scheme features the following achievements: 1) the key escrow problem could be solved by escrow-free key issuing protocol, which is constructed using the secure two-party computation between the key generation center and the data-storing center, and 2) fine-grained user revocation per each attribute could be done by proxy encryption which takes advantage of the selective attribute group key distribution on top of the ABE. The performance and security analyses indicate that the proposed scheme is efficient to securely manage the data distributed in the data sharing system.

Constant-round adaptive zero-knowledge proofs for NP

Secure two-party computation allows two parties with private inputs to securely compute some function of their inputs, even in the presence of a malicious adversary. In this work, we revisit zero-knowledge proofs and focus on adaptive adversaries, which could corrupt an arbitrary number of parties and adaptively determine who and when to corrupt during the computation phase.Previous constructions could realize adaptive zero-knowledge proofs for all languages in NP (Lindell and Zarosim TCC’09) at the cost of a high round-complexity, i.e., super-constant number of rounds. In this work, assuming the existence of constant-round statistically hiding commitment schemes, we build efficient adaptive zero-knowledge proofs for all languages in NP, which only require constant number of communication rounds. The system is also a proof of knowledge. The construction relies on an adaptive instance-dependent commitment scheme, and the proof of security requires only the use of black-box techniques and is presented according to the real/ideal simulation paradigm.

Secure Hamming distance based record linkage with malicious adversaries

Record linkage aims at finding the matching records from two or multiple different databases. Many approximate string matching methods in privacy-preserving record linkage have been presented. In this paper, we study the problem of secure record linkage between two data files in the two-party computation setting. We note that two records are linked when all the Hamming distances between their attributes are smaller than some fixed thresholds. We firstly construct two efficient secure protocols for computing the powers of an encrypted value and implementing zero test on an encrypted value, then present an efficient protocol within constant rounds for computing the Hamming distance based record linkage in the presence of malicious adversaries by transferring these two protocols. We also discuss the extension of our protocol for settling the Levenshtein distance based record linkage problem.

Distributing trusted third parties

Trusted Third Parties (TTPs) are widely employed in various scenarios for providing fairness guarantees (e.g., in fair exchange or e-commerce protocols, including secure two-party computation), for distributing secrets (e.g., in authentication or secret-sharing protocols, as well as group signatures), and for creating trust (e.g., as certificate authorities). Such wide use of TTPs, as well as the trust requirement that is put on them make them a prime target for distributed systems and cryptography research. There are some well-known and proven solutions to the problem of distributing the trust put on TTPs: byzantine agreement or secure multi-party computation techniques can be employed to distribute the job of any TTP to multiple parties, tolerating up to half or one-third of those parties being malicious. Such techniques are not widely-employed in practice possibly due to their quadratic complexity or inter-operation requirements. This brings up the question of distributing TTPs in a much more efficient way, possibly via using autonomous agents, who do not directly communicate with each other. In this paper, we present various known techniques for distributing the trust put on TTPs. Then, we concentrate on using multiple autonomous parties, who do not communicate with each other at all, to realize a single TTP. We discuss the role of synchrony in such attempts, and conclude with some open questions.

Oblivious and fair server-aided two-party computation

We show efficient, practical (server-aided) secure two-party computation protocols ensuring privacy, correctness and fairness in the presence of malicious (Byzantine) faults. Our requirements from the server are modest. To ensure privacy and correctness, we only assume a circuit evaluation service, executing an initialisation program provided by both parties. To ensure fairness, we further assume a trusted-decryption service, providing decryption service using a known public key. Our fairness-ensuring protocol is optimistic, i.e., the decryption service is invoked only in case of faults.Both of these trusted services are feasible in practice, and may be useful for additional tasks; both can also be distributed, with linear overhead, for redundancy. We believe that the protocols are sufficiently efficient, to allow deployment, in particular for financial applications. We also propose applications which constitute natural candidates to benefit from our protocols.

Privacy-Preserving Biometric Identification Using Secure Multiparty Computation: An Overview and Recent Trends

This article presents a tutorial overview of the application of techniques of secure two-party computation (also known as secure function evaluation) to biometric identification. These techniques enable to compute biometric identification algorithms while maintaining the privacy of the biometric data. This overview considers the main tools of secure two-party computations such as homomorphic encryption, garbled circuits (GCs), and oblivious transfers (OTs) and intends to give clues on the best practices to secure a biometric identification protocol. It also presents recent trends in privacy-preserving biometric identification that aim at making it usable in real-life applications.

Fairness in the presence of semi-rational parties in rational two-party secure computation

Reputation is commonly used in game theory for mutual cooperation. Assuming that parties value their reputation as well as their payoffs just like people in the real world, this paper considers reputation assumptions when defining the utilities. The new utility consists of two parts: the reputation part and payoff part. The parties are redefined according to the new utility definition. Besides, to represent a more realistic adversary model, a new adversary named semi-rational party is proposed. The semi-rational parties behave like the combination of rational and covert parties. At last, a rational two-party secure computation protocol is constructed. The proof of fairness in the presence of the semi-rational party is stressed in this paper.

Secure computation of functionalities based on Hamming distance and its application to computing document similarity

This paper examines secure two-party computation of functions, which depend only on the Hamming distance of the inputs of the two parties. We present efficient protocols for computing these functions. In particular, we present protocols which are secure in the sense of full simulatability against malicious adversaries. We then show applications of HDOT. These include protocols for checking similarity between documents without disclosing additional information about them these protocols are based on algorithms of Broder et al. for computing document similarity based on the Jaccard measure. Another application is a variant of symmetric private information retrieval SPIR, which can be used if the server's database contains N entries, at most N / logN of which have individual values, and the rest are set to some default value. The receiver does not learn whether it receives an individual value or the default value. This variant of PIR is unique since it can be based on the existence of OT alone.

High-performance secure multi-party computation for data mining applications

Secure multi-party computation (MPC) is a technique well suited for privacy-preserving data mining. Even with the recent progress in two-party computation techniques such as fully homomorphic encryption, general MPC remains relevant as it has shown promising performance metrics in real-world benchmarks. Sharemind is a secure multi-party computation framework designed with real-life efficiency in mind. It has been applied in several practical scenarios, and from these experiments, new requirements have been identified. Firstly, large datasets require more efficient protocols for standard operations such as multiplication and comparison. Secondly, the confidential processing of financial data requires the use of more complex primitives, including a secure division operation. This paper describes new protocols in the Sharemind model for secure multiplication, share conversion, equality, bit shift, bit extraction, and division. All the protocols are implemented and benchmarked, showing that the current approach provides remarkable speed improvements over the previous work. This is verified using real-world benchmarks for both operations and algorithms.

Equally contributory privacy-preserving k-means clustering over vertically partitioned data

In recent years, there have been numerous attempts to extend the k-means clustering protocol for single database to a distributed multiple database setting and meanwhile keep privacy of each data site. Current solutions for (whether two or more) multiparty k-means clustering, built on one or more secure two-party computation algorithms, are not equally contributory, in other words, each party does not equally contribute to k-means clustering. This may lead a perfidious attack where a party who learns the outcome prior to other parties tells a lie of the outcome to other parties. In this paper, we present an equally contributory multiparty k-means clustering protocol for vertically partitioned data, in which each party equally contributes to k-means clustering. Our protocol is built on ElGamal's encryption scheme, Jakobsson and Juels's plaintext equivalence test protocol, and mix networks, and protects privacy in terms that each iteration of k-means clustering can be performed without revealing the intermediate values.

Removing escrow from ciphertext policy attribute-based encryption

Attribute-based encryption (ABE) is a promising cryptographic primitive for fine-grained access control of distributed data. In ciphertext policy attribute-based encryption (CP-ABE), each user is associated with a set of attributes and data are encrypted with access policies on attributes. A user is able to decrypt a ciphertext if and only if his attributes satisfy the access policy embedded in the ciphertext. However, key escrow is inherent in ABE systems. A curious key generation center in that construction has the power to decrypt every ciphertext. We found that most of the existing ABE schemes depending on a single key authority suffer from the key escrow problem. In this study, we propose a novel CP-ABE key issuing architecture that solves the key escrow problem. The proposed scheme separates the power of issuing user keys into two parties: the key generation center and the attribute authority. In the proposed construction, the key generation center and the attribute authority issue different parts of secret key components to users through a secure two-party computation protocol such that none of them can determine the whole set of keys of users individually. We demonstrate how the proposed key issuing protocol can be applied in the existing CP-ABE scheme and resolve the key escrow problem.

Privacy-preserving Judgment of the Intersection for Convex Polygons

As the basic issues of computational geometry, intersection and union of convex polygons can solve lots of problems, such as economy and military affairs. And privacy-preserving judgment of the intersection and union for convex polygons are most popular issues for information security. Traditional method of making the polygons public does not satisfy the requirements of personal privacy. In this paper, a method to compute intersection and union of convex polygons in secure two-party computation (STC) model has been considered, both proportionate partition and unproportionate partition cases are studied. Scan line algorithm is used to figure out the geometry matter, while secret comparison protocol is used for saving the privacy, a series of protocols for this matter is proposed, which combines computational geometry and secure multi-party computation (SMC) technique to achieve the functionality of cooperation calculation without leaking so much privacy. At last, the security, complexity and applicability analysis of the protocols are also discussed.