Non-Interactive Verifiable Computing August 5, 2009 Bryan Parno Carnegie Mellon University Rosario...
-
Upload
diane-watts -
Category
Documents
-
view
212 -
download
0
Transcript of Non-Interactive Verifiable Computing August 5, 2009 Bryan Parno Carnegie Mellon University Rosario...
Non-InteractiveNon-InteractiveVerifiable ComputingVerifiable Computing
August 5, 2009
Bryan ParnoCarnegie Mellon University
Rosario Gennaro, Craig GentryIBM Research
2
Desire for Computing on Demand
• Instead of buying hardware, pay for computing power– Pay for exactly what you use– Quickly scale up/down
• Work done by:– Volunteers (SETI@Home, Folding@Home)– Companies (Amazon, GoGrid, etc)
Is the result correct?Is the result correct?
3
Verifiable Computation Intuition
F(·),x
1.Checks Proof (y)
2.Accepts y = F(x)
y F(x), Proof (y)F
x
Fx
Must be cheaper than computing F
Must be cheaper than computing F
4
Outline
• Introduction
• Prior work
• Definitions
• Preliminary Approaches
• Scheme & Proof Sketch
5
Prior Work• Secure Hardware
– Coprocessor, TPM, etc. [SW ’99, SZJvD ‘04, MPPRI ‘08,…]
• Specific Functions– Lookups, search on graphs, etc. [NN ’98, GTTCC ’01,…]
• General Functions– Kilian ‘92 & Micali ’94
• Worker does polynomial amount of work• Interactive (Non-interactive with random oracle or CRS)• Computational security
– GTR ‘08 (previous talk)• Interactive, with O(d) rounds• Requires uniform circuits• Secure against an all-powerful worker
6
Our Contribution
• Generic (works for any F)
• Intuitive and Efficient– Does not use ZKPs or PCPs
• Non-interactive
• Preserves input privacy
7
Outline
• Introduction
• Prior work
• Definitions
• Preliminary Approaches
• Scheme & Proof Sketch
8
• A Verifiable Computation (VC) scheme consists of 4 algorithms:
– KeyGen(F, λ) → PK, SK
– ProbGenSK(x) → σx
– ComputePK(σx) → σy
– VerifySK(σy) → y or
May reveal y or keep it private
Defining Verifiable Computing
Correctness:y = F(x)
Correctness:y = F(x)
May reveal x or keep it private
9
• A Verifiable Computation (VC) scheme consists of 4 algorithms:
– KeyGen(F, λ) → PK, SK
– ProbGenSK(x) → σx
– ComputePK(σx) → σy
– VerifySK(σy) → y or
Defining Verifiable Computing
Efficiency:Efficiency:
O(|F|)
O(|x|)
O(|y|)
O(|F|)
10
SecurityPK, SK ← KeyGen(F, λ)
ProbGenSK(·)
x σx
y ← VerifySK(σy)y ≠ and
y ≠ F(x)
PK
(x,σy)
Adversary wins if:
11
Outline
• Introduction
• Prior Work
• Definitions
• Preliminary Approaches– Fully-homomorphic encryption– MPC
• Scheme & Proof Sketch
12
Is Fully-Homomorphic Encryption Sufficient?
• Full homomorphism allows multiplication and addition of encrypted data
• Naïve scheme:
1. Encrypt inputs
2. Ask worker to apply F(·) homomorphically
3. Decrypt results
4. ???
5. Profit!This is insecure!This is insecure!
13
Fully-Homomorphic Encryption is Insufficient!
F(A, B, C) = (A * B) + C
EK(A), EK(B), EK(C)
(EK(A) + EK(B)) * EK(C)
EK((A+B)*C)
Result decrypts correctly
But (A+B)*C ≠ (A*B)+C !As usual,
Secrecy ≠ IntegrityAs usual,
Secrecy ≠ Integrity
14
Can Multi-Party Computation Help?
• MPC protocols are typically at least as expensive as the original computation
• Key Insight: We can convert Yao’s Garbled Circuit Scheme
into a 1-time Verifiable Computation
A 1-time Verifiable Computation is still not efficient
But we can fix that!
15
Refresher on Yao’s Circuits: Overview
A B
Goal: - Compute Y ← F(A,B) - Without revealing A or B
F → CG(C), G(A)
G(B)Oblivious Transfer
G(A) G(B)
G(C)
G(Y)G(Y)
Y
Note: Assumes honest-but-curious parties
16
Yao’s Circuit Construction
g
A B
Z
A B Z
0 0 g(0,0)
0 1 g(0,1)
1 0 g(1,0)
1 1 g(1,1)
A B Z
a0 b0 zg(0,0) Ea (Eb (zg(0,0)))
a0 b1 zg(0,1) Ea (Eb (zg(0,1)))
a1 b0 zg(1,0) Ea (Eb (zg(1,0)))
a1 b1 zg(1,1) Ea (Eb (zg(1,1)))
a0 a1 b0 b1
z0 z1
0
0
1
1 1
1
0
0
ai, bi, zi {0,1}λR
G(g)
Alice sends Bob:1. G(g)2. a0 or a1
3. b0 or b1
Via Oblivious Transfer
17
Yao’s Circuit Computation
Db (Da (Ea (Eb (zg(0,0)))))
Db (Da (Ea (Eb (zg(0,1)))))
Db (Da (Ea (Eb (zg(1,0)))))
Db (Da (Ea (Eb (zg(1,1)))))
• Given a0 and b1 Bob computes:
0
0
1
1 1
1
0
0
0
0
0
0
1
1
1
1
• Bob returns zg(0,1) to Alice
• Alice maps zg(0,1) to g(0,1)
g
A B
Z
a0 a1 b0 b1
z0 z1
18
Making Yao 1-time Verifiable
x
F → CG(C), G(x) G(x)
G(C)
G(y)G(y)Verify G(y) is“correct”
19
Verifying the Computation of aYao Circuit
• Bob returns z
• Alice accepts Bob’s response if:
z = z0
orz = z1
• Security Intuition:– Encryption scheme guarantees
secrecy of incorrect zi
– Since z0 and z1 are randomly chosen,
probability of a correct guess is 2-λ
g
A B
Z
a0 a1 b0 b1
z0 z1
ai, bi, zi {0,1}λR
No longer assumes honest-but-curious worker!
^
^
^
20
Yao is Not Outsourceable• Constructing the Yao circuit takes time O(C)
• Reusing the same circuit for a different input allows adversary to recycle previous output
• Constructing a new circuit is as expensive as computing F
21
Outline
• Introduction
• Prior Work
• Definitions
• Preliminary Approaches
• Scheme & Proof Sketch
22
Our Scheme: Overview• Intuition: Use fully-homomorphic encryption to make
Yao circuits reusable
• Build the garbled Yao circuit G(C) as before
• For each input x, Alice gives out EncryptK(G(x))– Chooses a new key K for the fully-homomorphic scheme– Encrypts the Yao wire values G(x) corresponding to x
• Adversary uses homomorphism to evaluate G(C) and obtain an encryption of the output wire values:
EncryptK(G(y))
Intuition: Per-input key prevents output reuseIntuition: Per-input key prevents output reuseProvides input privacy too!Provides input privacy too!
23
KeyGen(F, λ): Represent F as circuit CRun Yao on CPK ← G(C) SK ← ai, bi, zi {0,1}λ
ProbGenSK(x)PKε, SKε ← GenKeyε(λ)
σx ← (PKε, Enc(PKε, ai),
Enc(PKε, bi),…)
ComputePK(σx)Construct a circuit D representing Yao’s decryption function
Apply D homomorphically to get σy
VerifySK(σy)Use SKε to decrypt σy
If result is not one of zi, return Else return y
Garble the circuit computing F.Public key is the garbled circuitSecret key is the labels.
Create a new key for the homomorphic encryption scheme.Encrypt the correct input wire values
Use ε’s homomorphism to obtain an encryption of the correct output wire value
Check that decrypted output matches a valid output wire label
24
Proof Sketch
• Intuition
– Yao is a secure 1-time verifiable computation
– Multiple executions don’t help the attacker• In each execution, labels are encrypted with a
different instance of a semantically secure scheme
25
Performance
• Garble the circuit C once O(|C|)
• Garble each input X O(|X|)
• Verify each output Y O(|Y|)
Amortized cost:Size of Input + Size of Output
Amortized cost:Size of Input + Size of Output
Client:
• Homomorphically “decrypt” O(|C|)through the circuit
Worker:
26
Conclusions & Open Problems• Growth of computing-as-a-resource will
require verifiability of results
• Combining Yao with fully-homomorphic encryption yields a (theoretically) efficient, non-interactive protocol
• Can we construct a verifiable computation scheme using “regular” homomorphic encryption?
• Can we create a verifiable computation with non-repudiation?
27
Thank [email protected]