1 Secure Multi-party Computation Minimizing Online Rounds Seung Geol Choi Columbia University Joint work with Ariel Elbaz(Columbia University) Tal Malkin(Columbia University) Moti Yung (Columbia University & Google)

2 Outline Motivation Our Results –First Protocol –Second Protocol Conclusion

3 Multi-party Computing with Encrypted Data (MPCED) P1P1 P2P2 PnPn … x y external parties Considered implicitly in [FH96,JJ00,CDN01] many computations on encrypted database dynamic data contribution from external parties

4 Round-complexity of protocols Critical measure on the efficiency There are constant-round MPC protocols, but the exact constant is big. Focus on online round-complexity –Possibly allow any poly-time preprocessing independent of the function of interest and input. –Minimization of turn-around time –Preprocessing can be handled separately, e.g., by cloud computing

5 Outline Motivation Our Results –First Protocol –Second Protocol Conclusion

6 Previous Work Adaptive/Static#rounds#corrupt [CLOS02]AdaptiveO(d)< n [DN03]Adaptive (Arithm.)O(d)<n [DI05]Adaptive2 const < n/5 < n/2 [DIK08+]Adaptiveconst< n/2 [IPS08]Adaptiveconst< n Yes, for static case Can we do it in one or two rounds for <n corruption?

7 Our Results Two protocols for MPCED with small online round complexity w/ preprocessing –one-round protocol P 1 –Two-round protocol P 2 (Depending on the case, P 2 has more efficient preprocessing than P 2 ). Static and <n corruption Uses ElGamal encryption –extendable to any threshold homomorphic encryption schemes.

8 Outline Motivation Our Results –First Protocol –Second Protocol Conclusion

9 First Protocol Takes one round General Idea: Modify Yao’s protocol –Garble a universal circuit instead of a given circuit –Replace OT w/ one-round equivalent step using homomorphism.

10 Preprocessing Generate a Garbled Circuit for a Universal Circuit [V76,KS08] Overall, follow Yao’s technique except input wire keys.

11 l0l0 l1l1 r0r0 r1r1 E l 0, r 0 (k 1 ) E l 1, r 0 (k 1 ) E l 0, r 1 (k 1 ) E l 1, r 1 (k 0 ) k0k0 k1k1 Yao’s Garbled Circuit NAND

12 l0l0 l1l1 r0r0 r1r1 E l 0, r 0 (k 1 ) E l 1, r 0 (k 1 ) E l 0, r 1 (k 1 ) E l 1, r 1 (k 0 ) k0k0 k1k1 l0l0 l1l1 r0r0 r1r1 E l 0, r 0 (k 1 ) E l 1, r 0 (k 1 ) E l 0, r 1 (k 1 ) E l 1, r 1 (k 0 ) k0k0 k1k1 l0l0 l1l1 r0r0 r1r1 E l 0, r 0 (k 1 ) E l 1, r 0 (k 1 ) E l 0, r 1 (k 1 ) E l 1, r 1 (k 0 ) k0k0 k1k1 Yao’s Garbled Circuit NAND Once keys of the input wires in the entire circuit are determined, can compute the circuit locally.

13 Preprocessing - 2 Input wires –Pick a random h for global use: hidden –Keys in each input wire j, say w j 0 and w j 1, should satisfy w j 1 = w j 0 * h –publish H = E y (h) –publish E y (w j 0 ) for each input wire j

14 Encrypted Input Data E y (h b ) for Boolean input b – If b = 0, publish E y (1) – If b = 1, re-randomize H

15 Online Stage Given –input wire: W 0 = E y (w 0 ) –Input data: C = E y (h b ) Decrypt W 0 * C –Note W 0 * C = E y (w 0 *h b ) = E y (w b ) Requires only a single round

16 First Protocol: Summary Use garbled universal circuit with augmented manipulation in the input wires Replace OT procedure in Yao with threshold decryption using homomorphism Needs a single online round

17 Outline Motivation Our Results –First Protocol –Second Protocol Conclusion

18 Second Protocol Takes two rounds. Natural extension of two-party case [CEJMY07] Idea –Preprocessing: garble individual gates Independent of a circuit or input –Online stage: construct wires between garbled gates and inputs

19 Preprocessing Garbled NAND gates Bunch of fresh ElGamal key pairs: (pk, E y (sk)) NAND 1yx x > y

20 Garbled NAND gates with fresh ElGamal key pairs Intermediate gates: NAND + keys top-level gates: IDENTITY + keys

21 Online stage Construct wires between garbled gates and inputs –How? Use CODE (explained next)

22 Conditional Oblivious Decryption Exposure (CODE) Functionality –Assumes parties share the private key for y –Input: three ciphertexts C in, C out, C key, a key z –Output: E z (M key ) if M in  M out, E z (random) otherwise E y (g) E y (1)E y (100) C out C in C key Output: E z (random) E y (1) E y (100) C out C in C key Output: E z (100) Can be implemented w/ homomorphic enc in 2 rounds.

23 Online Stage – Run CODEs Run CODE in parallel for each C in, C out, C key tuple. NAND x encrypted under z = pkL * pkR: E z (skL)... Not encrypted z =1: skR Then, locally computes the circuit using CODE outputs inductively.

24 Online Stage – After Running CODE... E z (skL) skR E pkL*pkR (sk) Decrypt Final column Using sk

25 Summary : Second Protocol Preprocessing –Garbled NAND gates, fresh ElGamal keys Online Stage –Run 2-round CODE protocols in parallel

26 Summary Second Protocol –online #round: two –No blow-up of gates –2n-round explicit preprocessing: efficient when n is very small (when n is big, use generic protocols) First Protocol –online #rounds: one –Logarithmic blow-up of gates –No explicit preprocessing: should use generic protocols such as [IPS08].

27 Outline Motivation Our Results –First Protocol –Second Protocol Conclusion

28 Multi-party Computing with Encrypted Data (MPCED) P1P1 P2P2 PnPn … x y external parties Considered implicitly in [FH96,JJ00,CDN01] many computations on encrypted database dynamic data contribution from external parties

29 Our Results Two protocols for MPCED with small online round complexity w/ preprocessing –one-round protocol P 1 –Two-round protocol P 2 (Depending on the case, P 2 has more efficient preprocessing than P 2 ). Static and <n corruption

30 Thank you