Tomography-based Overlay Network Monitoring Yan Chen, David Bindel , Randy H. Katz
Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans,...
-
Upload
braiden-criddle -
Category
Documents
-
view
223 -
download
3
Transcript of Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans,...
Private Set Intersection:
Are Garbled Circuits Better than Custom Protocols?
Yan Huang, David Evans, Jonathan KatzUniversity of Virginia, University of Maryland
www.MightBeEvil.org
Motivation --- Common Acquaintances
http://www.mightbeevil.com/mobile/
EUROCRYPT 2004
CRYPTO 2005TCC 2008
Financial Crypto 2010
Custom Protocols Generic Protocols
e.g., Garbled Circuit
Protocols
Cannot be easily composed with other secure computations
Designed around specific crypto assumptions and primitives
New Design and security proofs need to be done for
every individual scheme.
Uses generic and flexible cryptographic primitives
Can securely compute arbitrary function
Security proofs automatically derived
from the generic proof.
Garbled Circuits & Oblivious Transfers
Y. Huang, D. Evans, J. Katz, L. Malka, Faster Secure Computation Using Garbled Circuits, USENIX Security 2011.
And Gate 1
Enca10,
b11(x10)
Enca11,b11(x1
1)
Enca11,b10(x1
0)
Enca10,b10(x1
0)
Or Gate 2
Encx00,
x11(x21)
Encx01,x11(x21
)
Encx01,x10(x21
)
Encx00,x10(x20
)
AND
a0 b0
x0
AND
a1 b1
x1
OR
x2
…Andrew Yao, 1982/1986
Alice Bob
Oblivious Transfer Protocol
Rabin, 1981; Even, Goldreich, and Lempel, 1985; Naor and Pinkas 2001, Ishai et al., 2003
Free-XOR technique, Kolesnikov and Shneider, 2008
Threat Model
Semi-Honest Adversary: follows the protocol as specified, but tries to learn more from the protocol execution transcript
Generic PSI Protocols Overview
– the number of bits used to denote a set element – the size of the sets
Protocols Cost in non-XOR gates
Best for
Bitwise-AND (BWA) Small element space
Pairwise-Comparison (PWC)
Sort-Compare-Shuffle-WN (SCS-WN) Large element space
Generic PSI Protocols Overview
– the number of bits used to denote a set element – the size of the sets
Protocols Cost in non-XOR gates
Best for
Bitwise-AND (BWA) Small element space
Pairwise-Comparison (PWC)
Sort-Compare-Shuffle-WN (SCS-WN) Large element space
PSI: Needn’t be Complex
[ 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0] [ 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0]
ANDANDAND . . .Bitwise-AND
. . .
Encode set elements as bit vectors
Recessive genes: { 5283423, 1425236, 839523, … }
Recessive genes: { 5823527, 839523, 169325, … }
[ PAH, PKU, CF, … ]
BWA Performance
8 9 10 11 12 13 14 15 160
0.5
1
1.5
2
2.5
3
OT Circuit
σ
Tim
e (s
econ
ds)
What if the element space is large?
Sort
-Com
pare
-Shu
ffle Sort: Take
advantage of total order of elements
Compare adjacent elements
Shuffle to hide positions
Sort
-Com
pare
-Shu
ffle Sort: Take
advantage of total order of elements
Compare adjacent elements
Shuffle to hide positions
Bito
nic
Sorti
ng1
4
9
7
5
4
3
2
1
5
4
4
3
9
2
7
1
3
2
4
5
9
4
7
1
2
3
4
4
5
7
9
1
2
3
4
4
5
7
9
Sorting Networks and their Applications, Ken Batcher, 1968
CMPFilter
CMPFilter
CMPFilter …
CMP3Filter
CMP3Filter
CMP3Filter
Can’t reveal results yet! Position leaks information.
Journal of the ACM, January 1968
Waksman Network
Same circuit can generate any permutation: select a random permutation, and pick swaps
gates( log 1)
3
n n n
FreeGates to generate and evaluate
Private Set Intersection Protocol
( log 1)
3
n n n
– the number of bits used to denote a set element – the size of the sets
SCS-WN Protocol Results
32-bit values
1
10
100Theoretical Projection
Experimental Observation
Set Size (each set)
Seco
nds
( log 1)[2 log(2 ) (3 1)( 1) (2 1) ]
3
n n nn n n rate
ultra-short short medium long ultra-long0
200
400
600
800
1000
1200
1400
1600
1800
2000
10.9 62.4126.0
369.0
1972.0
51.5 57.1 61.5 97.3 122.710.5 11.8 12.4 18.6 22.7
[DT10] One-more-DL-basedSCS-WN (σ=160)SCS-WN (σ=32)
Tim
e (s
econ
ds)
Relating Performance to Security
(1024, 160) (2048, 224) (3072, 256) (7680, 384) (15360, 512)
80 112 128 192 256
DL Key-sizes:
Symmetric:
Generic protocols offer many advantagesComposabilityFlexibility on hardness assumptionsDesign costPerformance
Conclusion
Q & A?