ALISA PANKOVA Efficient Multiparty Computation Secure against Covert and Active Adversaries

316 Pages·2017·3.09 MB·English

A DISSERTATIONES
L
MATHEMATICAE
I
S
A UNIVERSITATIS
P TARTUENSIS
A
114
N
K
O
V
A

E ALISA PANKOVA
f
fi
c
i
e
n
t Efficient Multiparty Computation
M
u Secure against Covert and
l
t
i
p
a Active Adversaries
r
t
y
C
o
m
p
u
t
a
t
i
o
n
S
e
c
u
r
e
a
g
a
i
n
s
t
C
o
v
e
r
t
a
n
d
A
c
t
i
v
e
A
d
v
e
r
s
a
r
i
e
s
Tartu 2017
1
ISSN 1024-4212
ISBN 978-9949-77-443-2
DISSERTATIONES MATHEMATICAE UNIVERSITATIS TARTUENSIS
114
DISSERTATIONES MATHEMATICAE UNIVERSITATIS TARTUENSIS
114

ALISA PANKOVA

Efficient Multiparty Computation
Secure against Covert and
Active Adversaries
Institute of Computer Science, Faculty of Science and Technology, University of
Tartu,Estonia
DissertationisacceptedforthecommencementofthedegreeofDoctorofPhilos-
ophy (PhD) on Mayi4, 2017 by the Council of the Institute of Computer Science,
UniversityofTartu.
Supervisor:
Ph.D PeeterLaud
CyberneticaAS
Tartu,Estonia
Dr.Tech SvenLaur
UniversityofTartu
Tartu,Estonia
Opponents:
PhD JoëlAlwen
InstituteofScienceandTechnologyAustria
Klosterneuburg,Austria
PhD JunFurukawa
NECCorporationAmerica
Herzliya,Israel
ThepublicdefensewilltakeplaceonJunei22,2017at10:15inLiivi2-403.
ThepublicationofthisdissertationwasfinancedbyInstituteofComputerScience,
UniversityofTartu.

ISSN1024-4212
ISBN978-9949-77-443-2i(print)
ISBN978-9949-77-444-9i(PDF)
Copyright: AlisaPankova,2017
UniversityofTartuPress
www.tyk.ee
Contents
Abstract 9
1 Introduction 10
1.1 SecureMultipartyComputation . . . . . . . . . . . . . . . . . . 10
1.2 AssumptionsofSecureMultipartyComputation . . . . . . . . . . 11
1.3 ClaimsofThisThesis . . . . . . . . . . . . . . . . . . . . . . . . 12
1.4 OutlineandAuthor’sContributions. . . . . . . . . . . . . . . . . 13
2 Preliminaries 15
2.1 MultipartyComputation . . . . . . . . . . . . . . . . . . . . . . 15
2.2 SecurityofMultipartyComputation . . . . . . . . . . . . . . . . 16
2.2.1 Secrets . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.2.2 Adversary . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.2.3 BasicsofUniversalComposability . . . . . . . . . . . . . 17
2.2.4 LanguagesforSecureComputation . . . . . . . . . . . . 21
2.3 BasicsandNotation . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.3.1 TypesofIndistinguishability . . . . . . . . . . . . . . . . 22
2.3.2 DigitalSignatures . . . . . . . . . . . . . . . . . . . . . 25
2.3.3 MessageAuthenticationCodes . . . . . . . . . . . . . . . 26
2.3.4 HashFunctionsandMerkleTree . . . . . . . . . . . . . . 27
2.3.5 FiniteFieldsandtheSchwarz-ZippelLemma . . . . . . . 28
2.3.6 LinearProgramming . . . . . . . . . . . . . . . . . . . . 28
2.4 LinearSecretSharingSchemes . . . . . . . . . . . . . . . . . . . 29
2.4.1 AdditiveSharing . . . . . . . . . . . . . . . . . . . . . . 29
2.4.2 LinearThresholdSharing . . . . . . . . . . . . . . . . . 29
2.4.3 PermutationSharing . . . . . . . . . . . . . . . . . . . . 31
2.5 CorrelatedRandomness . . . . . . . . . . . . . . . . . . . . . . . 31
2.6 Commitments . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.7 VerifiableComputation . . . . . . . . . . . . . . . . . . . . . . . 34
2.7.1 LinearProbabilisticallyCheckableProofs . . . . . . . . . 34
2.7.2 VerificationasQuadraticArithmeticProgram . . . . . . . 35
5
2.7.3 LPCPforQuadraticArithmeticPrograms . . . . . . . . . 37
3 RelatedWork 40
3.1 ActivelyandCovertlySecureMultipartyComputation . . . . . . 40
3.1.1 ANoteonCovertAdversaries . . . . . . . . . . . . . . . 40
3.1.2 CompilersfromPassivetoActiveSecurity . . . . . . . . 41
3.1.3 ActiveSecurityforanyNumberofCorruptedParties . . . 41
3.1.4 ActiveSecuritywithanHonestMajority. . . . . . . . . . 45
3.1.5 PassiveSecuritywithanHonestMajority . . . . . . . . . 47
3.2 MultipleAdversaryModels . . . . . . . . . . . . . . . . . . . . . 48
3.2.1 CollusionPreservingComputation . . . . . . . . . . . . . 49
3.2.2 LocalUniversalComposability. . . . . . . . . . . . . . . 49
3.3 PrivateConditionalsinSMCPrograms . . . . . . . . . . . . . . . 50
4 VerifiableSMCwithanHonestMajority 51
4.1 ChapterOverview . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.2 TheIdealFunctionalityforVerifiableHonestMajoritySMC . . . 52
4.3 TheProtocolforVerifiable3-PartySMCwithoneCorruptedParty 53
4.3.1 BuildingBlocks . . . . . . . . . . . . . . . . . . . . . . 55
4.3.2 ProtocolImplementingF . . . . . . . . . . . . . . . . 58
pre
4.3.3 ProtocolImplementingF . . . . . . . . . . . . . . . 61
verify
4.4 GeneralizationtoVerifiablen-PartySMCwithanHonestMajority 66
4.4.1 BuildingBlocks . . . . . . . . . . . . . . . . . . . . . . 66
4.4.2 GeneralizationofΠ . . . . . . . . . . . . . . . . . . 67
verify
4.5 SecurityProofsforn-PartyVerifiableSMCwithanHonestMajority 70
4.5.1 EnsuringMessageDelivery . . . . . . . . . . . . . . . . 71
4.5.2 LinearlyHomomorphicCommitments . . . . . . . . . . . 79
4.5.3 GeneratingUniformlyDistributedRandomness . . . . . . 87
4.5.4 GenerationofPrecomputedTuples . . . . . . . . . . . . . 91
4.5.5 VerificationofCircuitComputation . . . . . . . . . . . . 102
4.5.6 TheMainProtocolforVerifiableSMC. . . . . . . . . . . 112
4.5.7 ProofoftheMainTheorem. . . . . . . . . . . . . . . . . 119
4.5.8 AnotherProtocolforVerification . . . . . . . . . . . . . 122
4.6 Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
4.6.1 AdditionalCircuitOperations . . . . . . . . . . . . . . . 129
4.6.2 ReducingtheNumberofBitDecompositions . . . . . . . 130
4.6.3 InputandOutputParties . . . . . . . . . . . . . . . . . . 132
4.6.4 Auditability . . . . . . . . . . . . . . . . . . . . . . . . . 133
4.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
4.7.1 Implementation . . . . . . . . . . . . . . . . . . . . . . . 133
4.7.2 TheTotalCostofCovertlySecureProtocols . . . . . . . . 135
6
4.7.3 State-of-the-art Complexity of Actively Secure Integer
MultiplicationandAES . . . . . . . . . . . . . . . . . . 138
4.7.4 EstimatingtheCostofotherSharemindProtocols . . . . . 140
4.8 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
5 ProtectingDatafromHonestParties 144
5.1 ChapterOverview . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.2 AttacksthatWeWanttoCover . . . . . . . . . . . . . . . . . . . 146
5.3 WeakCollusionPreservation . . . . . . . . . . . . . . . . . . . . 147
5.3.1 Intuition . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
5.3.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 149
5.3.3 TechnicalDetails . . . . . . . . . . . . . . . . . . . . . . 152
5.3.4 RelationswithGeneralizedUniversalComposability . . . 154
5.3.5 CapturingInformationLeakagetoanHonestParty . . . . 155
5.3.6 CompositionTheorem . . . . . . . . . . . . . . . . . . . 156
5.3.7 RelationstotheExistingNotions . . . . . . . . . . . . . . 160
5.3.8 ApplicabilityoftheWCPModel . . . . . . . . . . . . . . 167
5.4 ProtocolTransformationsforAchievingtheWCPSecurity . . . . 171
5.4.1 PassiveAdversaries . . . . . . . . . . . . . . . . . . . . . 171
5.4.2 Fail-StopAdversaries . . . . . . . . . . . . . . . . . . . . 172
5.4.3 CovertAdversaries . . . . . . . . . . . . . . . . . . . . . 187
5.4.4 ActiveAdversaries . . . . . . . . . . . . . . . . . . . . . 206
5.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
6 OptimizationofSMCProgramswithPrivateConditionals 218
6.1 ChapterOverview . . . . . . . . . . . . . . . . . . . . . . . . . . 218
6.2 ProgrammingLanguageforSMC . . . . . . . . . . . . . . . . . . 219
6.3 ComputationalCircuits . . . . . . . . . . . . . . . . . . . . . . . 221
6.3.1 CircuitDefinition . . . . . . . . . . . . . . . . . . . . . . 221
6.3.2 CircuitEvaluation . . . . . . . . . . . . . . . . . . . . . 223
6.3.3 TransformingaProgramtoaCircuit . . . . . . . . . . . . 224
6.4 OptimizationoftheCircuit . . . . . . . . . . . . . . . . . . . . . 225
6.4.1 TheWeakestPreconditionofaGate . . . . . . . . . . . . 225
6.4.2 InformalDescriptionoftheOptimization . . . . . . . . . 228
6.4.3 Notation. . . . . . . . . . . . . . . . . . . . . . . . . . . 230
6.4.4 SubcircuitsasGates . . . . . . . . . . . . . . . . . . . . 232
6.4.5 SimpleGreedyHeuristics . . . . . . . . . . . . . . . . . 233
6.4.6 ReductiontoanIntegerLinearProgrammingTask . . . . 238
6.4.7 CircuitTransformation . . . . . . . . . . . . . . . . . . . 245
6.5 FormalConstructionsandProofs . . . . . . . . . . . . . . . . . . 248
6.5.1 CircuitComposition . . . . . . . . . . . . . . . . . . . . 248
7
6.5.2 TransformationsofProgramstoCircuits . . . . . . . . . . 250
6.5.3 CorrectnessoftheWPGeneratingAlgorithm . . . . . . . 256
6.5.4 CorrectnessoftheSubcircuitPartitioningAlgorithm . . . 258
6.5.5 CorrectnessoftheGreedyAlgorithms . . . . . . . . . . . 260
6.5.6 CorrectnessoftheReductiontoILP . . . . . . . . . . . . 261
6.5.7 CorrectnessoftheCircuitTransformation . . . . . . . . . 265
6.6 ImplementationandEvaluation . . . . . . . . . . . . . . . . . . . 275
6.7 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
6.8 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Conclusion 280
AppendixA OptimizedSamplePrograms 281
AppendixB RunningTimesofProgramsafterOptimization 289
Bibliography 293
Acknowledgments 306
Kokkuvõte(SummaryinEstonian) 307
ListofOriginalPublications 309
CurriculumVitae 310
Elulookirjeldus 311
8
ABSTRACT
Securemultipartycomputationisoneofthemostimportantemploymentsofmod-
ern cryptography, bringing together elegant mathematical solutions to build up
useful practical applications. It allows several distinct data owners to perform
arbitrary collaborative computation on their private data without leaking any in-
formationtoeachother.
Thesecurityofmultipartycomputationoftenreliesonassumptionsaboutthe
behaviour of parties. A passively secure protocol is secure as long as all parties
followitsrules. Acovertlysecureprotocolworksunderassumptionthatnoparty
willcheatifitwillbedetectedbytheotherparties. Anactivelysecureprotocolis
abletotolerateanybehaviourofcorruptedparties.
This thesis presents a generic method for turning passively secure multiparty
protocolstocovertlyoractivelysecureones,assumingthatthemajorityofparties
is honest. The method is optimized for three party computation over rings of
residueclassesZ ,whichhasproventobequiteanefficientmodel,makinglarge
2n
real-worldapplicationsfeasible.
In this thesis, we also study a new adversarial goal in multiparty protocols.
The goal is to manipulate the view of some honest party in such a way, that this
honest party learns the private data of some other honest party. The adversary
itself might not learn this data at all. Such attacks are significant because they
createaliabilitytothefirsthonestpartytocleanitssystemsfromthesecondhonest
party’sdata,whichmaybeahighlynon-trivialtaskinpractice.
Finally, this thesis addresses the problem of excessive computation in secure
multiparty applications. In some cases, the parties need to make a decision, in
whichdirectiontheircomputationshouldproceedfurther. Ifthisdecisiondepends
on private data, then the parties are not allowed to know which computational
branch has been chosen, so in general the parties need to execute all of them. If
the number of branches is large, the computational overhead may be enormous,
as most of the intermediate results will not be needed for the final answer. This
thesisproposesanoptimizationthatreducesthisoverhead.
9
CHAPTER 1
INTRODUCTION
1.1 Secure Multiparty Computation
Securemultipartycomputationisamethodologythatallowsseveralpartiestopro-
cessprivatedatacollaborativelywithoutrevealingthedatatoanyparty. Thedata
areprotectedbyencryptionorsomeothersimilarmethodsuchassecretsharing.
Somepossiblescenariosofsecuremultipartycomputationarethefollowing:
• Aclientusesexternalresources(e.g. acloud)toprocessdatacollectedfrom
multipledataowners. Thedatashouldbeprotectedfromboththeresource
controllerandtheclient.
• Multipleclientscollaboratetoprocessdataprovidedbythemselves,protect-
ingtheirowndatafromeachother.
• Multipleclientscollaboratetoprocessdataprovidedbymultipledataown-
ers. Thedatashouldbeprotectedfromeachclient.
First research results on secure multiparty computation have been published
in 1980-s [104]. Numerous theoretical solutions and implementation prototypes
havebeenproposedsincethattime[47,8,75]. Ittooktimeforsecuremultiparty
computation to become practical, and the first really big application of secure
multipartycomputationonrealdatawasDanishsugarbeetauction[19]thattook
place in 2008, where the task of sugar beet providers and their customer was to
agreeonthesellingprice.
Much work on practical use of secure multiparty computation on real data
has been accomplished since that time. A secure system for jointly collecting
andanalyzingprivatefinancialdatawasimplementedanddeployedin2011[18].
A tax fraud detection system that works with private data has been implemented
and evaluated in 2014 [11]. The relationship between working during university
10