240 likes | 384 Views
P rivate S et I ntersection: Are Garbled Circuits Better than Custom Protocols?. Yan Huang, David Evans, Jonathan Katz University of Virginia, University of Maryland. www.MightBeEvil.org. Motivation --- Common Acquaintances. http://www.mightbeevil.com/mobile/. Financial Crypto 2010.
E N D
Private Set Intersection:Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans, Jonathan Katz University of Virginia, University of Maryland www.MightBeEvil.org
Motivation --- Common Acquaintances http://www.mightbeevil.com/mobile/
Financial Crypto 2010 EUROCRYPT 2004 TCC 2008 CRYPTO 2005
Generic Protocols Custom Protocols Designed around specific cryptoassumptions and primitives Uses generic and flexible cryptographic primitives Cannot be easily composedwith other secure computations Can securely compute arbitrary function New Designand security proofsneed to be done for every individual scheme. Security proofs automatically derived from the generic proof. e.g., Garbled Circuit Protocols
Garbled Circuits & Oblivious Transfers a1 Alice a0 b1 Bob b0 Y. Huang, D. Evans, J. Katz, L. Malka, Faster Secure Computation Using Garbled Circuits, USENIX Security 2011. Oblivious Transfer Protocol AND AND x1 x0 OR Andrew Yao, 1982/1986 x2 Free-XOR technique, Kolesnikov and Shneider, 2008 … Rabin, 1981; Even, Goldreich, and Lempel, 1985; Naorand Pinkas 2001, Ishai et al., 2003
Threat Model Semi-Honest Adversary: follows the protocol as specified, but tries to learn more from the protocol execution transcript
Generic PSI Protocols Overview – the number of bits used to denote a set element – the size of the sets
Generic PSI Protocols Overview – the number of bits used to denote a set element – the size of the sets
PSI: Needn’t be Complex Recessive genes: { 5283423, 1425236, 839523, … } Recessive genes: { 5823527, 839523, 169325, … } Encode set elements as bit vectors [ PAH, PKU, CF, … ] [ 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0] [ 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0] . . . AND AND AND . . . Bitwise-AND
BWA Performance What if the element space is large?
Sort-Compare-Shuffle Sort: Take advantage of total order of elements Compare adjacent elements Shuffle to hide positions
Sort-Compare-Shuffle Sort: Take advantage of total order of elements Compare adjacent elements Shuffle to hide positions
Bitonic Sorting 1 1 1 1 1 2 2 4 2 4 3 3 3 3 9 4 4 2 4 7 5 4 5 4 5 4 5 4 5 4 7 9 9 7 3 7 9 7 9 2 Sorting Networks and their Applications, Ken Batcher, 1968
… CMP Filter CMP Filter CMP Filter
CMP3 Filter CMP3 Filter CMP3 Filter
Waksman Network Same circuit can generate any permutation: select a random permutation, and pick swaps gates
Private Set Intersection Protocol Gates to generate and evaluate Free – the number of bits used to denote a set element – the size of the sets
SCS-WN Protocol Results 32-bit values
Relating Performance to Security DL Key-sizes: (1024, 160) (2048, 224) (3072, 256) (7680, 384) (15360, 512) Symmetric: 80 112 128 192 256
Conclusion Generic protocols offer many advantages Composability Flexibility on hardness assumptions Design cost Performance