1 / 30

APPROXIMATE DEGREE AND BOUNDED INDISTINGUISHABILITY

This workshop, held in Chennai in January 2019, focuses on secure multiparty computation, exploring the concept of approximate degree and bounded indistinguishability in global computation to prevent local leakage. Discussions delve into scenarios where local closeness implies global closeness, addressing factors like visual cryptography, secret sharing schemes, and quantum query complexities. The event also examines the relationship between indistinguishability and independence in various cryptographic scenarios, proposing potential conjectures and conclusions regarding the connection between local closeness and AC0-security in cryptographic systems.

marshalla
Download Presentation

APPROXIMATE DEGREE AND BOUNDED INDISTINGUISHABILITY

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Andrej Bogdanov Chinese University of Hong Kong APPROXIMATE DEGREE AND BOUNDED INDISTINGUISHABILITY CAALM workshop, Chennai | January 2019

  2. 💰💰 💰💰 💰💰 💰💰 💰 💰💰 💰💰

  3. secure multiparty computation [Yao, Ben Or et al., Chaumet al.]

  4. allows global computation • prevents local leakage Is this reasonable? Is this the best we can do?

  5. Bounded indistinguishability (X1,…, Xn) and (Y1,…, Yn) are k-close if all their projections on size-k subsets are identical Example (X1, X2, X3) uniform s.t.X1 + X2 + X3 = 0 (Y1, Y2, Y3) uniform s.t.Y1 + Y2 + Y3 = 1

  6. When does local closeness imply global closeness? ⨁ AC0 ROF AND NC0

  7. I. THE BINARY ALPHABET

  8. (X1,…, Xn), (Y1,…, Yn) are bit sequences m, n: {0, 1}n→R their p.m.f.s • f = m–n local global f ∑ f(x) p(x) = 0 ∑ f(x) f(x) small for all p of degree ≤ k

  9. ∑ f(x) f(x) small ∑ f(x) p(x) = 0 for all p of degree ≤ k • approximate • if there f has • degree ≤ k • exists p: Rn → Rof degree ≤ k such that • |f(x) – p(x)| ≤ e for allxin {0, 1}n

  10. f cannot distinguish any k-close X, Y if • and only if degef≤k

  11. Approximate degree of AND xd xd Td(x) degeAND=Q(√ n log 1/e) [Nisan-Szegedy]

  12. visual cryptography [Naor, Shamir]

  13. secret sharing scheme secret = or shares = or 1 1 0 0 reconstruction function = AND

  14. How to share g(x) = ES[Pi∈Sxi]2 x ∈{–1, 1}n S |S| ≤ (n –√n)/2 To share bit b, sample x w/p ∝ g(x) | Pxi = b

  15. ∑ f(x) AND(x)large ∑ f(x) p(x) = 0 • f = Pi∈Sxi ES[Pi∈Sxi]2/Z for all p of degree ≤ k S • f(1n) = 1/Z • Z = ∑ES[Pi∈Sxi]2 • = Pr[S]

  16. degree ≤ query complexity exact ≤ deterministic approximate ≤ randomized ≤ 2x quantum

  17. Grover: deg≈AND = O(√n) Reichardt: deg≈ ∀ROF = O(√n) open: Is deg≈ ∀ROF = W(√n)?

  18. Composition f … g g ? deg≈f ∘ g ≥ deg≈f deg≈g

  19. Composition deg≈ ∀ROF2 = W(√n) [Sherstov, Bun-Thaler, …] deg≈ ∀ROFd = 2-O(d) √n [Ben-David et al.]

  20. ? deg≈ ∃AC0 = W(n) ? deg≈ ∃DNF = W(n) deg≈ ∃AC0d = n1 – 2 -W(d) [Bun-Thaler] deg≈ ∀kDNF = O(n1 – 1/k) [Sherstov]

  21. Imperfect security If X, Yare symmetricand k-close, then they are (K, e-O(k /K))-close for K ≤ n/4. 2 advantage [Williamson] 0 n coalition size k = √n

  22. Classical vs. quantum If f requires k queries, then it requires W(k1/6) quantum queries [Nisan-Szegedy, Bealset al.] If X, Y are (k, 0.01)-close, are they (k1/10, 0.1)-quantum close?

  23. Indistingushability vs. independence Polylog-wise independence fools AC0… [Braverman] …but √-wise indistingushability doesn’t

  24. Indistingushability vs. independence Common use: x = As for linear code A Conjecture: If As and Bs are polylog-close, are they AC0-close?

  25. II. LARGER ALPHABETS

  26. There are W(n)-close X, Ythat are separated by some AC0 function [B.-Ishai-Viola-Williamson] Alphabet size exponential in n Conjecture: W(n) <n– 1

  27. Ramp secret sharing There are X, Ythat are 49%n-close but AC0-far by any size 51%n coalitions Here gap is necessary

  28. For specific distributions originating in crypto, local closeness sometimes does imply AC0-security. [Ishaiet al., Faust et al., Rothblum]

  29. CONCLUSION

More Related