1. Strong Conditional Oblivious Transfer and Computing on Intervals Vladimir Kolesnikov Joint work with Ian F. Blake University of Toronto

2. Motivation for the Greater Than Predicate A: I would like to buy tickets to Cheju Island. B: My prices are so low, I cannot tell them! Tell me how much money you have (x), and if it’s more than my price (y), I’d sell it to you for y. A: We better securely evaluate Greater Than (GT). HAHA!! I’ll set y := x – 0.01 GT Uses: Auction systems Secure database mining Computational Geometry

3. Previous work on GT Yao’s Two Millionaires Yao’s Garbled Circuit Rogaway, 1991 Naor, Pinkas, Sumner, 1999 Lindell, Pinkas, 2004 Sander, Young, Yung, 1999 Fischlin, 2001 Many others

4. Our Model B: Let’s be Semi-Honest. That means we will not deviate from our protocol. We can, however, try to learn things we aren’t supposed to by observing our communication. A: Also, I will have unlimited computation power. B: That sounds complicated. Most efficient solutions won’t work (e.g. garbled circuit). A: Let’s do it in one round – I hate waiting!

5. Tools – Homomorphic Encryption Encryption scheme, such that: Given E(m 1 ), E(m 2 ) and public key, allows to compute E(m 1 ­ m 2 ) Additively homomorphic ( ­ = +) schemes Large plaintext group We will need: The Paillier scheme satisfies our requirements

6. Oblivious Transfer (OT) Input: bit b Input: secrets s 0, s 1 Learn: s b Learn: nothing

7. Input: x Input: y, secrets s 0, s 1 Learn: Learn: nothing Strong Conditional OT (SCOT) Predicate Q(x,y) s Q(x,y)

8. Q-SCOT COT of Di Crescenzo, Ostrovsky, Rajagopalan, 1999 OT Secure evaluation of Q(x,y) Is a generalization of:

9. The GT-SCOT Protocol x 1, …, x n s 0, s 1, y 1, …, y n pub, pri x 1, …, x n pub x 1 -y 1, …, x n -y n x 1 © y 1, …, x n © y n x © y = (x-y) 2 =x-2xy+y d = f =   0 = 0,  i = 2  i-1 +f i f = 0 0 1 0 0 1 1 0 …  = 0 0 0 1 2 4 9 19 38 …   i = d i + r i (  i -1)  = -1-1 0 1 3 8 18 37 … r  = r 1 r 2 0 r 3 r 4 r 5 r 6 r 7 … d+r  = t 1 t 2 d i t 3 t 4 t 5 t 6 t 7 …  i = ½ ((s 1 -s 0 )  i +s 1 +s 0 )  ) sjsj

10. Interval-SCOT x x 1, x 2, s 0, s 1 2 D S a 1 2 R D S s 0 = a 1 +b 1 = a 2 +b 2 s 1 = a 2 +b 1 GT-SCOT(a 1 |a 2 ? x<x 1 ) GT-SCOT(b 1 |b 2 ? x<x 2 ) a i +b j

11. Union of Intervals-SCOT x I 1,…, I k, s 0, s 1 2 D S I-SCOT(s 11 |s 10 ? x 2 I 1 )  i s i? s 1 =  i s i1 s 1 -s 0 = s i1 -s i0 I-SCOT(s k1 |s k0 ? x 2 I k )

12. Conclusions General and composable definition of SCOT SCOT solutions (GT, I, UI)  Simple and composable  Orders of magnitude improvement in communication (loss in computational efficiency in some cases)  Especially efficient for transferring larger secrets ( e.g. ¼ 1000 bits )

13. Resource Comparison