Two-Round Adaptively Secure Protocols from Standard Assumptions Fabrice Benhamouda (IBM) Huijia (Rachel) Lin (UCSB) Antigoni Polychroniadou (Cornell Tech) Muthuramakrishnan Venkitasubramaniam (University of Rochester)

Secure Multi-Party Computation UC f(x1, x2, x3, x4) = (y1, y2 ,y3 ,y4 ) x1 x1 x1 y4 y1 x4 Goal: Correctness: Everyone computes f(x1,…,x4) Security: Nothing else but the output is revealed Adversary PPT Malicious Adaptive x2 y3 y2 x3

Static vs. Adaptive Adversaries Static Corruption … Corrupt only on the onset of π … … Adaptive Corruption Corrupt adaptively during the execution of π …

Static vs. Adaptive Adversaries Dealer secret shares s among O(√n) random parties and publishes the set of such parties s=(s1,s2) s1 s2 Static vs. Adaptive Learns s

Adaptive Corruption of all parties Crucial in the composition of protocols. If adversary corrupts all m parties in πinner, where m<n, security of πouter should still hold. n-party protocol πouter m-party protocol πinner

Adaptive vs. Semi-Adaptive Adversaries Semi-Adaptive Corruption … Static corruption of one party and adaptive corruption of the other party …

State-of-the-art for Malicious MPC In the CRS model State-of-the-art for Malicious MPC Static Adaptive 2 rounds [BL18,GS18] O(depth) rounds [CLOS02] Partial Solutions for constant-round adaptive protocols: Using Indist. Obf. [GP15,DKR15,CGP15]

State-of-the-art for Malicious MPC In the CRS model State-of-the-art for Malicious MPC Static Adaptive 2 rounds [BL18,GS18] O(1) rounds [CPV17] Partial Solutions for constant-round adaptive protocols: Using Indist. Obf. [GP15,DKR15,CGP15]

From standard assumptions Our Goal 2-round adaptive MPC From standard assumptions 2-round adaptive OT

2-round malicious adaptive UC MPC Our Results Theorem (informal) O(1)-round malicious adaptive MPC + 2-round malicious adaptive OT 2-round malicious adaptive UC MPC  Corollary (informal) LWE/QR/DDH  2-round malicious adaptive UC OT LWE/QR/DDH  2-round malicious adaptive UC MPC

Arbitrary round static MPC Tools for Static 2-round MPC [BL18] Arbitrary round static MPC Garbled circuits Arbitrary round malicious static MPC 2-round malicious static OT NIZK

EquivocalGarbled circuits Tools for Adaptive 2-round MPC EquivocalGarbled circuits Constant round malicious adaptive MPC 2-round malicious adaptive OT ? 3-round adaptive malicious MPC from DDH [ABP17] 2-round adaptive malicious OT from iO [GP15]

Adaptive 2-round Oblivious Transfer 2-round malicious adaptive OT 3 2-round semi-adaptive malicious OT 2 2-round sender-semi-adaptive malicious OT 1 sender & receiver oblivious sampleability 2-round static malicious OT with: LWE/QR/DDH

Adaptive 2-round Oblivious Transfer 2-round malicious adaptive OT 3 2-round semi-adaptive malicious OT 2 This talk 2-round sender-semi-adaptive malicious OT 1 sender & receiver oblivious sampleability 2-round static malicious OT with: LWE/QR/DDH

 2-round Sender-semi-adaptive Malicious OT Theorem (informal) UC static malicious OT with sender oblivious sampleability sender-semi-adaptive malicious UC OT 

Definition: 2-round OT R S OT1(b) OT2(m0,m1) m0,m1 b Goal: mb In an OT protocol we have a sender and a receiver mb Goal: The Sender should not learn b The Receiver should not learn m1-b

R S 2-round Sender-semi-adaptive Malicious OT OT1(b) OT2(m0,m1) m0,m1 Building block: Let OT=(OT1, OT2) be a UC static malicious OT m0,m1 b R S OT1(b) OT2(m0,m1)

Not possible to explain OT2 for m1-b 2-round Sender-semi-adaptive Malicious OT Building block: Let OT=(OT1, OT2) be a UC static malicious OT m0,m1 b R S OT1(b) Sim OT2(mb) Problem Not possible to explain OT2 for m1-b

R S Sim 2-round Sender-semi-adaptive Malicious OT OT1(b) OT2(m0,0) Building block: Let OT=(OT1, OT2) be a UC static malicious OT with Sender Sampleability m0,m1 b=0 R S OT1(b) Sim OT2(m0,0) OT2(m0,1) Problem Not possible to obliviously sample one-out-of-two OT2 wrt. m0 in the real world

R S 2-round Sender-semi-adaptive Malicious OT OT1(b) OT2($,m1) Building block: Let OT=(OT1, OT2) be a UC static malicious OT with Sender Sampleability m0,m1 b=0 S R OT1(b) OT2($,m1) OT2(m0,$) OT2(.) OT2(.)

R S Sim 2-round Sender-semi-adaptive Malicious OT OT1(b) OT2($,0) Building block: Let OT=(OT1, OT2) be a UC static malicious OT with Sender Sampleability m0,m1 b=0 S R OT1(b) Sim OT2($,0) OT2(m0,$) OT2($,1) OT2(.)

R S 2-round Sender-semi-adaptive Malicious OT OT1(b) OT2($,m1) Building block: Let OT=(OT1, OT2) be a UC static malicious OT with Sender Sampleability m0,m1 b=0 S R OT1(b) OT2($,m1) OT2(m0,$) OT2(.) OT2(.)

R S 2-round Sender-semi-adaptive Malicious OT OT1(b) OT2($,m1) Building block: Let OT=(OT1, OT2) be a UC static malicious OT with Sender Sampleability m0,m1 b=0 S R OT1(b) OT2($,m1) OT2(m0,$) OT2(.) OT2(.) Problem with correctness Which OT output is the right one?

R S 2-round Sender-semi-adaptive Malicious OT OT1(b) OT2($,rm1) Building block: Let OT=(OT1, OT2) be a UC static malicious OT with Sender Sampleability m0,m1 b=0 S R OT1(b) OT2($,rm1) OT2(rm0,$) OT2(.) OT2(.) rm0, rm1

Adaptive 2-round Oblivious Transfer 2-round malicious adaptive OT 3 2-round semi-adaptive malicious OT 2 This talk 2-round sender-semi-adaptive malicious OT 1 sender & receiver oblivious sampleability 2-round static malicious OT with: LWE/QR/DDH

oblivious sampleability Adaptive 2-round Oblivious Transfer Hash proof systems with projection key oblivious sampleability 2-round malicious adaptive OT 3 Encryption scheme with ciphertext oblivious sampleability 2-round semi-adaptive malicious OT 2 This talk 2-round sender-semi-adaptive malicious OT 1 sender & receiver oblivious sampleability 2-round static malicious OT with: LWE/QR/DDH

sender-semi-adaptive oblivious sampleability Adaptive 2-round Oblivious Transfer 2-round malicious adaptive OT 3 2-round semi-adaptive malicious OT 2 2-round sender-semi-adaptive malicious OT with oblivious sampleability Equivocal garbled circuits This talk 2-round sender-semi-adaptive malicious OT 1 sender & receiver oblivious sampleability 2-round static malicious OT with: Non-interactive equivocal commitment LWE/QR/DDH

Adaptive 2-round Oblivious Transfer 2-round malicious adaptive OT 3 2-round semi-adaptive malicious OT 2 2-round semi-adaptive malicious OT This talk 2-round sender-semi-adaptive malicious OT 1 Augmented non-committing encryption sender & receiver oblivious sampleability 2-round static malicious OT with: LWE/QR/DDH

From standard assumptions Our Results 2-round adaptive MPC From standard assumptions 2-round adaptive OT LWE/QR/DDH  2-round malicious adaptive UC OT LWE/QR/DDH  2-round malicious adaptive UC MPC

Open Problems Efficient adaptive 2-round MPC Adaptive Laconic Function evaluation 4-round adaptive MPC in the plain model

Thank you!

Transformation 3 Tools 3 2-round semi-adaptive malicious OT Augmented 2-round malicious adaptive OT 3 2-round semi-adaptive malicious OT Augmented non-committing encryption

R S 2-round Malicious Adaptive OT OT2(b) pk0,pk1 OT2(m0+r0) OT2(m1+r1) m0,m1 b S R OT2(b) pk0,pk1 OT2(m0+r0) OT2(m1+r1) NCE(pk0,r0) OT2(pk1,r1)