Course Business Homework 5 Extended Practice Final Released Next Week

Course Business Homework 5 Extended Practice Final Released Next Week
Due on Gradescope Practice Final Released Next Week Homework 4 Statistics Minimum Value 72.00 Maximum Value 110.00 Range 38.00 Average 94.93 Median 96.00 Standard Deviation 12.02

Cryptography CS 555 Oblivious Transfer Yao’s Garbled Circuits
Week 15: Oblivious Transfer Yao’s Garbled Circuits Zero-Knowledge Proofs Readings: Katz and Lindell Chapter 10 & Chapter , 11.4 Fall 2018

Oblivious Transfer (OT)
1 out of 2 OT Alice has two messages m0 and m1 At the end of the protocol Bob gets exactly one of m0 and m1 Alice does not know which one Oblivious Transfer with a Trusted Third Party b m0 1 out of 2 OT m1 mb

Bellare-Micali 1-out-of-2-OT protocol
Oblivious Transfer without a Trusted Third Party g is a generator for a prime order group Gq in which CDH problem is hard m0 b c m1 𝑧0,𝑧1 𝐶 0 = 𝑔 𝑟 0 ,𝐻 𝑧 0 𝑟 0 ⊕ 𝑚 0 𝐶 1 = 𝑔 𝑟 1 ,𝐻 𝑧 1 𝑟 1 ⊕ 𝑚 1 c R Gq k R Zq 𝑧 𝑏 = 𝑔 𝑘 , 𝑧 1−𝑏 =𝑐 𝑔 −𝑘 Bob can decrypt Cb 𝑧 𝑏 𝑟 𝑏 = 𝑔 𝑘 𝑟 𝑏

CS 380S Yao’s Protocol Vitaly Shmatikov

Yao’s Protocol Compute any function securely
… in the semi-honest model First, convert the function into a boolean circuit AND AND Alice’s inputs NOT Bob’s inputs AND OR OR z z x y z x y z AND OR Truth table: 1 Truth table: 1 1 x y 1 x y 1 1 1 1 1 1 1 1

Alice prepares “garbled” version C’ of C
AND AND Alice’s inputs NOT Bob’s inputs AND OR OR Overview: Alice prepares “garbled” version C’ of C Sends “encrypted” form x’ of her input x Allows Bob to obtain “encrypted” form y’ of his input y via OT Bob can compute from C’,x’,y’ the “encryption” z’ of z=C(x,y) Bob sends z’ to Alice and she decrypts and reveals to him z Crucial properties: Bob never sees Alice’s input x in unencrypted form. Bob can obtain encryption of y without Alice learning y. Neither party learns intermediate values. Remains secure even if parties try to cheat.

Intuition c AND a b

Intuition a b c AND b a a b

1: Pick Random Keys For Each Wire
Next, evaluate one gate securely Later, generalize to the entire circuit Alice picks two random keys for each wire One key corresponds to “0”, the other to “1” 6 keys in total for a gate with 2 input wires k0z, k1z z AND Alice x y Bob k0x, k1x k0y, k1y

2: Encrypt Truth Table Alice encrypts each row of the truth table by encrypting the output-wire key with the corresponding pair of input-wire keys z k0z, k1z AND Alice x y Bob k0x, k1x k0y, k1y Ek0x(Ek0y(k0z)) x y z Ek0x(Ek1y(k0z)) Encrypted truth table: Original truth table: 1 Ek1x(Ek0y(k0z)) 1 1 1 1 Ek1x(Ek1y(k1z))

3: Send Garbled Truth Table
Alice randomly permutes (“garbles”) encrypted truth table and sends it to Bob Does not know which row of garbled table corresponds to which row of original table z k0z, k1z AND Alice x y Bob k0x, k1x k0y, k1y Ek1x(Ek0y(k0z)) Ek0x(Ek0y(k0z)) Ek0x(Ek1y(k0z)) Ek0x(Ek1y(k0z)) Garbled truth table: Ek1x(Ek0y(k0z)) Ek1x(Ek1y(k1z)) Ek1x(Ek1y(k1z)) Ek0x(Ek0y(k0z))

4: Send Keys For Alice’s Inputs
Alice sends the key corresponding to her input bit Keys are random, so Bob does not learn what this bit is k0z, k1z z Learns Kb’x where b’ is Alice’s input bit, but not b’ (why?) AND Alice x y Bob k0x, k1x If Alice’s bit is 1, she simply sends k1x to Bob; if 0, she sends k0x k0y, k1y Ek1x(Ek0y(k0z)) Ek0x(Ek1y(k0z)) Garbled truth table: Ek1x(Ek1y(k1z)) Ek0x(Ek0y(k0z))

5: Use OT on Keys for Bob’s Input
Alice and Bob run oblivious transfer protocol Alice’s input is the two keys corresponding to Bob’s wire Bob’s input into OT is simply his 1-bit input on that wire z Knows Kb’x where b’ is Alice’s input bit and Kby where b is his own input bit k0z, k1z AND Alice x y Bob k0x, k1x Run oblivious transfer Alice’s input: k0y, k1y Bob’s input: his bit b Bob learns kby What does Alice learn? k0y, k1y Ek1x(Ek0y(k0z)) Ek0x(Ek1y(k0z)) Garbled truth table: Ek1x(Ek1y(k1z)) Ek0x(Ek0y(k0z))

6: Evaluate Garbled Gate
Using the two keys that he learned, Bob decrypts exactly one of the output-wire keys Bob does not learn if this key corresponds to 0 or 1 Why is this important? z Knows Kb’x where b’ is Alice’s input bit and Kby where b is his own input bit k0z, k1z AND Alice x y Bob k0x, k1x Suppose b’=0, b=1 Ek1x(Ek0y(k0z)) k0y, k1y This is the only row Bob can decrypt. He learns K0z Ek0x(Ek1y(k0z)) Garbled truth table: Ek1x(Ek1y(k1z)) Ek0x(Ek0y(k0z))

7: Evaluate Entire Circuit
In this way, Bob evaluates entire garbled circuit For each wire in the circuit, Bob learns only one key It corresponds to 0 or 1 (Bob does not know which) Therefore, Bob does not learn intermediate values (why?) Bob tells Alice the key for the final output wire and she tells him if it corresponds to 0 or 1 Bob does not tell her intermediate wire keys (why?) AND OR NOT Alice’s inputs Bob’s inputs

Different Circuits 𝑓 𝐴 𝑥,𝑦 and 𝑓 𝐵 𝑥,𝑦 ?
(Regular Protocol for 𝑓 𝐴 ): Alice Garbles circuit 𝐶 𝐴 computing 𝑓 𝐴 and Bob evaluates garbled circuit 𝐶 𝐴 ′ and sends Alice garbled output 𝑧 𝐴 ′. Alice can ungarble the output 𝑧 𝐴 ′ to obtain 𝑧 𝐴 = 𝑓 𝐴 𝑥,𝑦 but does not send this value to Bob. (Swap Roles) Bob garbles circuit 𝐶 𝐵 computing 𝑓 𝐵 . Alice evaluates garbled circuit 𝐶 𝐵 ′ and sends Bob the garbled output 𝑧 𝐵 ′. Bob can ungarble the output 𝑧 𝐵 ′ to obtain 𝑧 𝐵 = 𝑓 𝐵 𝑥,𝑦 but does not send this value to Alice.

Security (Semi-Honest Model)
Security: Assuming that Alice and Bob are both semi-honest (follow the protocol) then there exist PPT simulators 𝑆 𝐴 and 𝑆 𝐵 s.t. 𝐴𝑛 𝑛∈ℕ ≡ 𝐶 𝑆 𝐴 𝑛,𝑥, 𝑓 𝐴 𝑥,𝑦 𝑛∈ℕ 𝐵𝑛 𝑛∈ℕ ≡ 𝐶 𝑆 𝐵 𝑛,𝑦, 𝑓 𝐵 𝑥,𝑦 𝑛∈ℕ Remark: Simulator 𝑆 𝐴 is only shown Alice’s output 𝑓 𝐴 𝑥,𝑦 (similarly, 𝑆 𝐵 is only shown Bob’s output 𝑓 𝐵 𝑥,𝑦 ) Theorem (informal): If the oblivious transfer protocol is secure, and the underlying encryption scheme is CPA-secure then Yao’s protocol is secure in the semi-honest adversary model.

Security (Semi-Honest Model)
Security: Assuming that Alice and Bob are both semi-honest (follow the protocol) then there exist PPT simulators 𝑆 𝐴 and 𝑆 𝐵 s.t. 𝐴𝑛 𝑛∈ℕ ≡ 𝐶 𝑆 𝐴 𝑛,𝑥, 𝑓 𝐴 𝑥,𝑦 𝑛∈ℕ 𝐵𝑛 𝑛∈ℕ ≡ 𝐶 𝑆 𝐵 𝑛,𝑦, 𝑓 𝐵 𝑥,𝑦 𝑛∈ℕ Simulating Bob’s View (Intuition): Garble the circuit following the honest algorithm Alice would use Pick a random input x’ for Alice Send Bob garbled circuits, plus garbled keys for x’ Allow Bob to obtain garbled keys for his input y via OT Bob obtains garbled output 𝑧 𝐴 ′ of 𝑓 𝐴 𝑥′,𝑦 but cannot distinguish from garbled key for 𝑓 𝐴 𝑥,𝑦

Brief Discussion of Yao’s Protocol
Function must be converted into a circuit For many functions, circuit will be huge If m gates in the circuit and n inputs from Bob, then need 4m encryptions and n oblivious transfers Oblivious transfers for all inputs can be done in parallel Yao’s construction gives a constant-round protocol for secure computation of any function in the semi-honest model Number of rounds does not depend on the number of inputs or the size of the circuit!

Fully Malicious Security?
Alice could initially garble the wrong circuit C(x,y)=y. Given output of C(x,y) Alice can still send Bob the output f(x,y). Can Bob detect/prevent this? Fix: Assume Alice and Bob have both committed to their input: cA=com(xlrA) and cB=com(ylrB). Alice and Bob can use zero-knowledge proofs to convince other party that they are behaving honestly. Example: After sending a message A Alice proves that the message she just sent is the same message an honest party would have sent with input x s.t. cA=com(xlrA) Here we assume that Alice and Bob have both committed to correct inputs (Bob might use y which does not represent his real vote etc… but this is not a problem we can address with cryptography)

Fully Malicious Security (Sketch)
Assume Alice and Bob have both committed to their input: cA=com(xlrA) and cB=com(ylrB). Here we assume that Alice and Bob have both committed to correct inputs (Bob might use y which does not represent his real vote etc… but this is not a problem we can address with cryptography) Alice has cB and can unlock cA Bob has cA and can unlock cB Alice sets Cf = GarbleCircuit(f,r). Alice sends to Bob. Alice convinces Bob that Cf = GarbleCircuit(f,r) for some r (using a zero-knowledge proof) For each original oblivious transfer if Alice’s inputs were originally x0,x1 Alice and Bob run OT with y0,y1 where yi=EncK(xi) Bob uses a zero-knowledge proof to convince Alice that he received the correct yi (e.g. matching his previous commitment cB) Alice sends K to Bob who decrypts yi to obtain xi

This statistic is not differentially private 
Course Feedback This statistic is not differentially private  What did you like? What could be improved? Your feedback is valuable!

CS 555:Week 15: Zero-Knowledge Proofs

Computational Indistinguishability
Consider two distributions Xℓ and Yℓ (e.g., over strings of length ℓ). Let D be a distinguisher that attempts to guess whether a string s came from distribution Xℓ or Yℓ. The advantage of a distinguisher D is 𝐴𝑑𝑣 𝐷,ℓ = 𝑃𝑟 𝑠←Xℓ 𝐷 𝑠 =1 − 𝑃𝑟 𝑠←Yℓ 𝐷 𝑠 =1 Definition: We say that an ensemble of distributions 𝑋𝑛 𝑛∈ℕ and 𝑌𝑛 𝑛∈ℕ are computationally indistinguishable if for all PPT distinguishers D, there is a negligible function negl(n), such that we have 𝐴𝑑𝑣 𝐷,𝑛 ≤𝑛𝑒𝑔𝑙(𝑛)

Computational Indistinguishability
Notation: 𝑋𝑛 𝑛∈ℕ ≡ 𝐶 𝑌𝑛 𝑛∈ℕ means that the ensembles are computationally indistinguishable. Consider two distributions Xℓ and Yℓ (e.g., over strings of length ℓ). Let D be a distinguisher that attempts to guess whether a string s came from distribution Xℓ or Yℓ. The advantage of a distinguisher D is 𝐴𝑑𝑣 𝐷,ℓ = 𝑃𝑟 𝑠←Xℓ 𝐷 𝑠 =1 − 𝑃𝑟 𝑠←Yℓ 𝐷 𝑠 =1 Definition: We say that an ensemble of distributions 𝑋𝑛 𝑛∈ℕ and 𝑌𝑛 𝑛∈ℕ are computationally indistinguishable if for all PPT distinguishers D, there is a negligible function negl(n), such that we have 𝐴𝑑𝑣 𝐷,𝑛 ≤𝑛𝑒𝑔𝑙(𝑛)

P vs NP P problems that can be solved in polynomial time
NP --- problems whose solutions can be verified in polynomial time Examples: SHORT-PATH, COMPOSITE, 3SAT, CIRCUIT-SAT, 3COLOR, DDH Input: 𝐴=𝑔 𝑥 1 , B= 𝑔 𝑥 2 and Z Goal: Decide if Z= 𝑔 𝑥 1 𝑥 2 or Z≠ 𝑔 𝑥 1 𝑥 2 . NP-Complete --- hardest problems in NP (e.g., all problems can be reduced to 3SAT) Witness A short (polynomial size) string which allows a verify to check for membership DDH Witness: x1,x2.

Zero-Knowledge Proof Two parties: Prover P (PPT) and Verifier V (PPT)
(P is given witness for claim e.g., ) Completeness: If claim is true honest prover can always convince honest verifier to accept. Soundness: If claim is false then Verifier should reject with probability at least ½. (Even if the prover tries to cheat) Zero-Knowledge: Verifier doesn’t learn anything about prover’s input from the protocol (other than that the claim is true). Formalizing this last statement is tricky Zero-Knowledge: should hold even if the attacker is dishonest!

Zero-Knowledge Proof Trans(1n,V’,P,x,w,rp,rv) transcript produced when V’ and P interact V’ is given input X (the problem instance e.g., 𝑋=𝑔 𝑥 ) P is given input X and w (a witness for the claim e.g., w=x) V’ and P use randomness rp and rv respectively Security parameter is n e.g., for encryption schemes, commitment schemes etc… 𝑿𝒏= Trans(1n,V’,P,x,w) is a distribution over transcripts (over the randomness rp,rv) (Blackbox Zero-Knowledge): There is a PPT simulator 𝑆 such that for every V’ (possibly cheating) S, with oracle access to V’, can simulate 𝑋𝑛 without a witness w. Formally, 𝑋𝑛 𝑛∈ℕ ≡ 𝐶 𝑆 𝑉′(.) 𝑥, 1 𝑛 𝑛∈ℕ

Simulator S is not given witness w
Zero-Knowledge Proof Trans(1n,V’,P,x,w,rp,rv) transcript produced when V’ and P interact V’ is given input x (the problem instance e.g., 𝐴=𝑔 𝑥 1 , B= 𝑔 𝑥 2 and 𝑧𝑏 ) P is given input x and w (a witness for the claim e.g., x1 and x2) V’ and P’ use randomness rp and rw respectively Security parameter is n e.g., for encryption schemes, commitment schemes etc… 𝑿𝒏= Trans(1n,V’,P’,x,w) is a distribution over transcripts (over the randomness rp,rw) (Blackbox Zero-Knowledge): There is a PPT simulator 𝑆 such that for every V’ (possibly cheating) S, with oracle access to V’, can simulate 𝑋𝑛 without a witness w. Formally, 𝑋𝑛 𝑛∈ℕ ≡ 𝐶 𝑆 𝑉′(.) 𝑥, 1 𝑛 𝑛∈ℕ Simulator S is not given witness w Oracle V’(x,trans) will output the next message V’ would output given current transcript trans

Zero-Knowledge Proof for Discrete Log Solution
𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x s.t. 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Claim: There is some integer x such that 𝐴=𝑔 𝑥

𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Correctness: If Alice and Bob are honest then Bob will always accept

Case 1: Challenge (c=0) 𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Correctness: If Alice and Bob are honest then Bob will always accept

Case 2: Challenge (c=1) 𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Correctness: If Alice and Bob are honest then Bob will always accept

𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Soundness: If 𝐴≠ 𝑔 𝑥 for some x then (honest) Bob will reject w.p. ½ (even if Alice cheats)

Assume that AB=C, now If 𝑩= 𝒈 𝒚 𝐚𝐧𝐝 𝑪= 𝒈 𝒙+𝒚 for some x,y then 𝑨= 𝒈 𝒙 Zero-Knowledge Proof for Discrete Log Solution 𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Soundness: If 𝐴≠ 𝑔 𝑥 for some x then (honest) Bob will reject w.p. ½ (even if Alice cheats) Case 1: 𝑨 ′ ≠ 𝒈 𝒚 →𝑷𝒓 𝒓𝒆𝒋𝒆𝒄𝒕 ≥𝑷𝒓 𝒄=𝟎 = 𝟏 𝟐

Case 1: for all r 𝑩≠ 𝒈 𝒓 →𝑷𝒓 𝒓𝒆𝒋𝒆𝒄𝒕 ≥𝑷𝒓 𝒄=𝟎 = 𝟏 𝟐 Assume that AB=C, now If 𝑩= 𝒈 𝒚 𝐚𝐧𝐝 𝑪= 𝒈 𝒙+𝒚 for some x,y then 𝑨= 𝒈 𝒙 Zero-Knowledge Proof for Discrete Log Solution 𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Soundness: If 𝐴≠ 𝑔 𝑥 for some x then (honest) Bob will reject w.p. ½ (even if Alice cheats)

Case 2: for all r 𝑪≠ 𝒈 𝒓 →𝑷𝒓 𝒓𝒆𝒋𝒆𝒄𝒕 ≥𝑷𝒓 𝒄=𝟏 = 𝟏 𝟐 Assume that AB=C, now If 𝑩= 𝒈 𝒚 𝐚𝐧𝐝 𝑪= 𝒈 𝒙+𝒚 for some x,y then 𝑨= 𝒈 𝒙 Zero-Knowledge Proof for Discrete Log Solution 𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (prover); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Bob (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑩= 𝒈 𝒓 𝒂𝒏𝒅 𝑨𝑩=𝑪 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑪= 𝒈 𝒓 𝑎𝑛𝑑 𝑨𝑩=𝑪 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Soundness: If 𝐴≠ 𝑔 𝑥 for some x then (honest) Bob will reject w.p. ½ (even if Alice cheats)

𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄=𝑽′(𝑨, 𝑩,𝑪 )∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (honest); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Dishonest (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅=𝑽′(𝑨, 𝑩,𝑪 ,𝒄,𝒓) Transcript: 𝑽𝒊𝒆𝒘 𝑽′ = 𝐴, 𝐵,𝐶 ,𝑐,𝑟,𝑑

𝑩= 𝒈 𝒚 , 𝑪= 𝒈 𝒙+𝒚 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄=𝑽′(𝑨, 𝑩,𝑪 )∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚+𝑥 𝑖𝑓 𝑐=1 Alice (honest); x 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Dishonest (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅=𝑽′(𝑨, 𝑩,𝑪 ,𝒄,𝒓) Zero-Knowledge: For all PPT V’ exists PPT Sim s.t 𝑽𝒊𝒆𝒘 𝑽′ ≡ 𝐶 Sim 𝑉′(.) 𝐴

𝑩= 𝒈 𝒚 ,𝑪=𝑨𝑩 if b=0 𝑩= 𝐶 𝐴 ,𝑪= 𝒈 𝒚 𝒐𝒕𝒉𝒆𝒓𝒘𝒊𝒔𝒆 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄=𝑽′(𝑨, 𝑩,𝑪 )∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝒃 ⊥ 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Simulator Cheat bit b, 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Dishonest (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅=𝑽′(𝑨, 𝑩,𝑪 ,𝒄,𝒓) Zero-Knowledge: For all PPT V’ exists PPT Sim s.t 𝑽𝒊𝒆𝒘 𝑽′ ≡ 𝐶 Sim 𝑉′(.) 𝐴

𝑩= 𝒈 𝒚 ,𝑪=𝑨𝑩 if b=0 𝑩= 𝐶 𝐴 ,𝑪= 𝒈 𝒚 𝒐𝒕𝒉𝒆𝒓𝒘𝒊𝒔𝒆 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄=𝑽′(𝑨, 𝑩,𝑪 )∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝒃 ⊥ 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Simulator Cheat bit b, 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Dishonest (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅=𝑽′(𝑨, 𝑩,𝑪 ,𝒄,𝒓) Zero-Knowledge: Simulator can produce identical transcripts (Repeat until 𝑟≠⊥)

𝑩= 𝒈 𝒚 ,𝑪=𝑨𝑩 if b=0 𝑩= 𝐶 𝐴 ,𝑪= 𝒈 𝒚 𝒐𝒕𝒉𝒆𝒓𝒘𝒊𝒔𝒆 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄=𝑽′(𝑨, 𝑩,𝑪 )∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝒃 ⊥ 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Simulator Cheat bit b, 𝐴=𝑔 𝑥 , 𝐵=𝑔 𝑦 , (random y) Dishonest (verifier); 𝐴=𝑔 𝑥 , 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅=𝑽′(𝑨, 𝑩,𝑪 ,𝒄,𝒓) Zero-Knowledge: If 𝐴=𝑔 𝑥 for some x then 𝑽𝒊𝒆𝒘 𝑽′ ≡ 𝐶 Sim 𝑉′(.) 𝐴

Zero-Knowledge Proof for Square Root mod N
𝑀= 𝑧𝑦 2 𝑚𝑜𝑑 𝑁 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚𝑥 𝑖𝑓 𝑐=1 Alice (prover); X 𝑧=𝑥 2 mod N (random y) Bob (verifier); 𝑧 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑴= 𝒛𝒓 𝟐 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑴= 𝒓 𝟐 𝑚𝑜𝑑 𝑁 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Completeness: If Alice knows x such 𝑧=𝑥 2 mod N then Bob will always accept

𝑀= 𝑧𝑦 2 𝑚𝑜𝑑 𝑁 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚𝑥 𝑖𝑓 𝑐=1 Alice (prover); X 𝑧=𝑥 2 mod N (random y) Bob (verifier); 𝑧 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑴= 𝒛𝒓 𝟐 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑴= 𝒓 𝟐 𝑚𝑜𝑑 𝑁 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Soundness: If 𝑧≠ 𝑥 2 for some x then (honest) Bob will reject w.p. ½ (even if Alice cheats)

𝑀= 𝑧𝑦 2 𝑚𝑜𝑑 𝑁 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒄∈ 𝟎,𝟏 Response 𝒓= 𝒚 𝒊𝒇 𝒄=𝟎 𝒚𝑥 𝑖𝑓 𝑐=1 Alice (prover); X 𝑧=𝑥 2 mod N (random y) Bob (verifier); 𝑧 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝟏 𝒊𝒇 𝒄=𝟎 𝒂𝒏𝒅 𝑴= 𝒛𝒓 𝟐 mod N 𝟏 𝒊𝒇 𝒄=𝟏 𝒂𝒏𝒅 𝑴= 𝒓 𝟐 mod N 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Zero-Knowledge: How does the simulator work?

Zero-Knowledge Proof vs. Digital Signature
Digital Signatures are transferrable E.g., Alice signs a message m with her secret key and sends the signature 𝜎 to Bob. Bob can then send (m,𝜎) to Jane who is convinced that Alice signed the message m. Are Zero-Knowledge Proofs transferable? Suppose Alice (prover) interacts with Bob (verifier) to prove a statement (e.g., z has a square root modulo N) in Zero-Knowledge. Let 𝑽𝒊𝒆𝒘 𝑽 be Bob’s view of the protocol. Suppose Bob sends 𝑽𝒊𝒆𝒘 𝑽 to Jane. Should Jane be convinced of the statement (e.g., z has a square root modulo N)>

Non-Interactive Zero-Knowledge Proof (NIZK)
M1,…Mk where 𝑀𝑖= 𝑦 𝑖 2 𝑧 𝑚𝑜𝑑 𝑁 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆𝒔 𝒄= 𝒄𝟏,….,𝒄𝒌 =𝑯(M1,…Mk) Responses r1,…,rk where 𝒓𝒊= 𝒚𝒊 𝒊𝒇 𝒄𝒊=𝟎 𝒚𝒊𝑥 𝑖𝑓 𝑐𝑖=1 Alice (prover); X 𝑧=𝑥 2 mod N (random 𝑦1,…,𝑦𝑘) Bob (verifier); 𝑧 𝑫𝒆𝒄𝒊𝒔𝒊𝒐𝒏 𝒅= 𝒊 𝒅𝒊 𝒘𝒉𝒆𝒓𝒆 𝒅𝒊= 𝟏 𝒊𝒇 𝒄𝒊=𝟎 𝒂𝒏𝒅 𝑴𝒊= 𝒓 𝒊 𝟐 𝒛 mod N 𝟏 𝒊𝒇 𝒄𝒊=𝟏 𝒂𝒏𝒅 𝑴𝒊= 𝒓 𝒊 𝟐 mod N 𝑜𝑡ℎ𝑒𝑟𝑤𝑖𝑠𝑒 Simulator Power: Can program the random oracle

NIZK Security (Random Oracle Model)
Simulator is given statement to proof (e.g., 𝑧 has a square root modulo N) Simulator must output a proof 𝜋′𝑧 and a random oracle H’ Distinguisher D World 1 (Simulated): Given z, 𝜋′𝑧 and oracle access to H’ World 2 (Honest): Given z, 𝜋𝑧 (honest proof) and oracle access to H Advantage: ADVD= 𝑃𝑟 𝐷 𝐻 z, 𝜋𝑧 =1 −𝑃𝑟 𝐷 𝐻′ z, 𝜋′𝑧 =1 Zero-Knowledge: Any PPT distinguisher D should have negligible advantage. NIZK proof 𝜋𝑧 is transferrable (contrast with interactive ZK proof)

Zero-Knowledge Proof for all NP
CLIQUE Input: Graph G=(V,E) and integer k>0 Question: Does G have a clique of size k? CLIQUE is NP-Complete Any problem in NP reduces to CLIQUE A zero-knowledge proof for CLIQUE yields proof for all of NP via reduction Prover: Knows k vertices v1,…,vk in G=(V,E) that form a clique

C D 𝜎 𝐺 E H G F A B J I L K Commitment to 𝐴 𝜎 𝐺 𝐶𝑜𝑚 0, 𝑟 𝐴,𝐴 ⋯ 𝐶𝑜𝑚 1, 𝑟 𝐴,𝐿 ⋮ ⋱ ⋮ 𝐶𝑜𝑚 1, 𝑟 𝐿,𝐴 ⋯ 𝐶𝑜𝑚 0, 𝑟 𝐿,𝐿 Adjacency matrix 𝐴 𝜎 𝐺 0 ⋯ 1 ⋮ ⋱ ⋮ 1 ⋯ 0 A L A L A A L L

C Zero-Knowledge Proof for all NP D E H G F A B Prover: Knows k vertices v1,…,vk in G=(V,E) that for a clique Prover commits to a permutation 𝜎 over V Prover commits to the adjacency matrix 𝐴 𝜎 𝐺 of 𝜎(G) Verifier sends challenge c (either 1 or 0) If c=0 then prover reveals 𝜎 and adjacency matrix 𝐴 𝜎 𝐺 Verifier confirms that adjacency matrix is correct for 𝜎(G) If c=1 then prover reveals the submatrix formed by first rows/columns of 𝐴 𝜎 𝐺 corresponding to 𝜎 𝑣 1 ,…,𝜎 𝑣 𝑘 Verifier confirms that the submatrix forms a clique. J I L K

Completeness: Honest prover can always make honest verifier accept Soundness: If prover commits to adjacency matrix 𝐴 𝜎 𝐺 of 𝜎(G) and can reveal a clique in submatrix of 𝐴 𝜎 𝐺 then G itself contains a k- clique. Proof invokes binding property of commitment scheme. Zero-Knowledge: Simulator cheats and either commits to wrong adjacency matrix or cannot reveal clique. Repeat until we produce a successful transcript. Indistinguishability of transcripts follows from hiding property of commitment scheme.

Secure Multiparty Computation (Adversary Models)
Semi-Honest (“honest, but curious”) All parties follow protocol instructions, but… dishonest parties may be curious to violate privacy of others when possible Fully Malicious Model Adversarial Parties may deviate from the protocol arbitrarily Quit unexpectedly Send different messages It is much harder to achieve security in the fully malicious model Convert Secure Semi-Honest Protocol into Secure Protocol in Fully Malicious Mode? Tool: Zero-Knowledge Proofs Prove: My behavior in the protocol is consistent with honest party

CS 555:Week 15: Hot Topics

O((log N)2(log log N)(log log log N))
Shor’s Algorithm Quantum Algorithm to Factor Integers Running Time O((log N)2(log log N)(log log log N)) Building Quantum Circuits is challenging, but... RSA is broken if we build a quantum computer Current record: Factor 21=3x7 with Shor’s Algorithm Source: Experimental Realisation of Shor’s Quatum Factoring Algorithm Using Quibit Recycling (

Quantum Resistant Crypto
Symmetric key primitives are believed to be safe …but Grover’s Algorithm does speed up brute-force attacks significantly ( 2 𝑛 𝑣𝑠 2 𝑛 ) Solution: Double Key Lengths Integer Factoring, Discrete Log and Elliptic Curve Discrete Log are not safe All public key encryption algorithms we have covered RSA, RSA-OAEP, El-Gamal,….

Post Quantum Cryptography
Symmetric key primitives are believed to be safe …but Grover’s Algorithm does speed up brute-force attacks significantly ( 2 𝑛 𝑣𝑠 2 𝑛 ) Solution: Double Key Lengths Hashed Based Signatures Lamport Signatures and extensions Lattice Based Cryptography is a promising approach for Quantum Resistant Public Key Crypto Ring-LWE NTRU

Fully Homomorphic Encryption (FHE)
Idea: Alice sends Bob 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 1 ,…, 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑛 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 + 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑗 = 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 + 𝑥 𝑗 and 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 × 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑗 = 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 × 𝑥 𝑗 Bob cannot decrypt messages, but given a circuit C can compute 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝐶 𝑥 1 ,… ,𝑥 𝑛 Proposed Application: Export confidential computation to cloud (Lecture by Shai Halevi)

Fully Homomorphic Encryption (FHE)
Idea: Alice sends Bob 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 1 ,…, 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑛 Bob cannot decrypt messages, but given a circuit C can compute 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝐶 𝑥 1 ,… ,𝑥 𝑛 We now have candidate constructions! Encryption/Decryption are polynomial time …but expensive in practice. Proved to be CPA-Secure under plausible assumptions Remark 1: Partially Homomorphic Encryption schemes cannot be CCA-Secure. Why not? (Lecture by Shai Halevi)

Partially Homomorphic Encryption
Plain RSA is multiplicatively homomorphic 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 × 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑗 = 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 × 𝑥 𝑗 But not additively homomorphic Pallier Cryptosystem 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 × 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑗 = 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 + 𝑥 𝑗 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑥 𝑖 𝑘 = 𝐸𝑛𝑐 𝑃𝐾 𝐴 𝑘× 𝑥 𝑗 Not same as FHE, but still useful in multiparty computation

Program Obfuscation (Theoretical Cryptography)
Idea: Alice obfuscates a circuit C and sends C to Bob Bob can run C, but cannot learn “anything else” Lots of applications… Indistinguishability Obfuscation Theoretically Possible In the sense that 𝑓 𝑛 = 𝑛 is technically polynomial time Secure Hardware Module (e.g., SGX) can be viewed as a way to accomplish this in practice Must trust third party (e.g., Intel) (Lecture by Amit Sahai)

Differential Privacy

Release Aggregate Statistics?
Question 1: How many people in this room have cancer? Question 2: How many students in this room have cancer? The difference (A1-A2) exposes my answer!

Differential Privacy: Definition
n people Neighboring datasets: Replace x with x’ Name CS Prof? … STD? Name CS Prof? … STD? J Blocki … Bjork … ??? [DMNS06, DKMMN06] D D’

Differential Privacy vs Cryptography
𝜀 is not negligibly small. We are not claiming that, when D and D’ are neighboring datasets, 𝑨𝒍𝒈(𝑫) ≡ 𝐶 𝑨𝒍𝒈(𝑫′) Otherwise, we would have 𝑨𝒍𝒈(𝑿) ≡ 𝐶 𝑨𝒍𝒈(𝒀′) for any two data-sets X and Y. Why? Cryptography Insiders/Outsiders Only those with decryption key(s) can reveal secret Multiparty Computation: Alice and Bob learn nothing other than f(x,y)

Traditional Differential Privacy Mechanism
Theorem: Let D= 𝑥 1 ,…, 𝑥 𝑛 ∈ 0,1 𝑛 A 𝑥 1 ,…, 𝑥 𝑛 = 𝑖=1 𝑛 𝑥 𝑖 + Lap 1 𝜀 , satisfies 𝜀,0 -differential privacy. (True Answer, Noise)

Resources $99 Free PDF:

Password Storage and Key Derivation Functions
jblocki, Username jblocki Salt 89d978034a3f6 Hash 85e23cfe0021f584e3db87aa72630a9a2345c062 As a motivating example consider an adversary who breaks into an authentication server and steals a users crptographic hash value. The adversary can execute an offline attack against the password by comparing the hash value with the hashes of likely password guesses. The adversary is limited only by the resources that he is willing to invest cracking the passwords. SHA1( d978034a3f6)=85e23cfe0021f584e3db87aa72630a9a2345c062 +

Offline Attacks: A Common Problem
Password breaches at major companies have affected millions billions of user accounts. Unfortunately, offline dictionary attacks are quite common. Password breaches at major companies have affected millions of users.

Goal: Moderately Expensive Hash Function
Fast on PC and Expensive on ASIC? This motivates the need for moderately hard functions. The basic idea is to build a password hash function that is moderately expensive to compute to limit the number of guesses that an adversary would be willing to try. An honest server only needs to compute the function once during a typical authentication session. However, the adversary potentially has an advantage in this game. While the honest server must typically evaluate the function on standard hardware, the adversary could use potentially reduce the cost per password guess by developing customized hardware (GPUs, FPGAs, ASICs) to evaluate the password hash function. Thus, we want to ensure that the cost to evaluate this function is equitable across platforms.

Attempt 1: Hash Iteration
BCRYPT PBKDF2 100,000 SHA256 computations (iterative) Estimated Cost on ASIC: $1 per billion password guesses [BS14]

The Challenge Cost SHA256 Standard Patience Units USD $ User Patience
Time Disclaimer: This slide is entirely for humorous effect.

Memory Hard Function (MHF)
Intuition: computation costs dominated by memory costs vs. Data Independent Memory Hard Function (iMHF) Memory access pattern should not depend on input In this work we study a special type of memory hard function called data-independent memory hard functions. As the name suggests the memory access pattern will not depend on the input making the functions resistant to side-channel attacks.

(2013-2015) We recommend that you use Argon2…

(2013-2015) We recommend that you use Argon2…
There are two main versions of Argon2, Argon2i and Argon2d. Argon2i is the safest against side-channel attacks ( )

Depth-Robustness: The Key Property
Necessary [AB16] and sufficient [ABP16] for secure iMHFs

Question Are existing iMHF candidates based on depth- robust DAGs?

Answer: No

Can we build a secure iMHF?
Github:

Course Business Homework 5 Extended Practice Final Released Next Week

Similar presentations

Presentation on theme: "Course Business Homework 5 Extended Practice Final Released Next Week"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Course Business Homework 5 Extended Practice Final Released Next Week

Similar presentations

Presentation on theme: "Course Business Homework 5 Extended Practice Final Released Next Week"— Presentation transcript:

Similar presentations

About project

Feedback