Private Function Evaluation

Payman Mohassel & Saeed Sadeghian University of Calgary

2

Secure Function Evaluation

Parties learn f(x1,…,xn)

P1, x1

P2, x2

P5, x5

P4, x4

P3, x3

Correctness:honest parties learn the correct output

Privacy:Nothing but the final output is leaked

…

Private vs. Secure Function Evaluation

𝒇 (𝒙𝟏 ,…, 𝒙𝒏)

𝒇 (𝒙𝟏 ,…, 𝒙𝒏)

SFEPFE

Why Hide The Function?

• Private functionso Proprietary, intellectual propertyo E.g., medical diagnosis, error reporting systems …

• Sensitive functionso Revealing vulnerabilitieso E.g. IDS containing zero-day signatures

• In SFE output leaks infoo Hiding the function can helpo Prevents dictionary attacks

Hide Everything Fully Homomorphic Encryption

𝑃2 𝑃1

𝑥 𝑦 , 𝑓𝐸 (𝑥 )

𝐸 ( 𝑓 (𝑥 , 𝑦 ))

𝑓 (𝑥 , 𝑦)Also hides size of and

Relaxation

• leako Function/circuit sizeo Input size

• But o More efficient primitiveso Milder assumptions

Is PFE Hard?• Not really!

• All SFE feasibility results extend to PFEo Using Universal Circuits

• The only interesting questions are efficiency questions

Universal CircuitsC Universal Circuit

x

C(x)

Universal Circuits• Boolean

o For a circuit C with g gateso [Valiant’ 76]: (good for large circuits)

• Actually building it seems complicatedo [KS’ 08]: (good for small circuits )

• Arithmetico For a circuit C with g gates and depth d o [Raz’ 08]: gates, i.e. in the worst caseo Or use a Boolean circuit

PFE Constructions• Two-party setting

o Universal Circuit + Yao’s protocol• or symmetric ops + OTs

o [KM’ 11]: Singly Homomorphic Enc + Yao’s protocol • public-key ops + symmetric ops

• Multi-party settingo Universal Circuit + GMW protocol

• OTs

• Arithmetic circuitso Universal Circuit + HE-based MPC [CDN’ 01]o public-key ops

Efficiency Questions• Asymptotic Efficiency

o Can we design PFE with linear complexity in all standard settings?

o The multiparty caseo The malicious case

• Practical Efficiencyo Can we improve practical efficiency of universal

circuit approach?o Constant factors are important

What Does UC Hide?

• Function of each gate

• Topology of circuit

Our Framework

Private Gate Evaluation

• Inputs are shared

o

• Gate function

o Known only to

• Output is shared

𝒈 (𝒙 , 𝒚 )

𝑧1 𝑧 2

Actual sharing mechanism depends on the protocol

Circuit Topology• Topology captured using an extended permutation 𝑖1

𝑖2𝑖3𝑖4

𝑖5𝑖6𝑖7𝑖8

𝑖9𝑖10

𝑜1𝑜2

𝑜3𝑜4 𝑜6

𝑜5

𝑖1𝑖2𝑖3𝑖4𝑖5𝑖6𝑖7𝑖8𝑖9𝑖10

𝝅𝑪

CTH Functionality

• Inputs are shared

• Mappingo known by only

• Outputs are shared

• Query typeso Map: done internallyo Reveal: reveal result of mapo On-demand mapping

𝑥=𝑥1⊕𝑥2𝑥 ′ ′ 1⊕𝑥 ′ ′2=𝑥

𝑦=𝑦1⊕ 𝑦2𝑦 ′ 1⊕ 𝑦 ′2=𝑦

Map

Reveal

𝝅𝑪𝑥 ′ 1⊕𝑥 ′2=𝑥

PGE + CTH𝑖1𝑖2𝑖3𝑖4

𝑖5𝑖6𝑖7𝑖8

𝑖9𝑖10

𝑜1𝑜2

𝑜3𝑜4 𝑜6

𝑜5CTH

PGE

PGE

PGE

PGE

PGE

Topological order𝑜5

𝑜5

𝑜6

𝑜6

𝟏

𝟐

𝟕

𝟑

𝑜1

𝑜2

𝑜3

𝑜4 𝟒

𝟓𝟔

𝟖

𝟗𝟏𝟎

𝟏𝟏

𝟏𝟐

𝟏𝟑𝟏𝟒

𝟏𝟓

𝟏𝟖𝟏𝟔𝟏𝟕𝟏𝟗𝟐𝟎

𝟐𝟏

RevealMap PGE

Instantiating PGE

PGE for GMW

g x y z0 0 g(0,0

)0 1 g(0,1

)1 0 g(1,0

)1 1 g(1,1

)

𝒈 (𝒙 , 𝒚 )

𝑧1 𝑧 2

g0 00 11 01 1

𝑃1 𝑃2

𝑥2 , 𝑦 21-out-of-4 OT

PGE for AC

• is an additively homomrphic encryption

𝑃1

𝑎1 ,𝑏1 ,𝑝𝑘 𝑃2𝑎2 ,𝑏2 ,𝑝𝑘 ,𝑠𝑘𝐸𝑛𝑐𝑝𝑘 (𝑎2 ) ,𝐸𝑛𝑐𝑝𝑘 (𝑏2 ) ,𝐸𝑛𝑐𝑝𝑘(𝑎2𝑏2)

(If )

(If )

𝐶=𝐸𝑛𝑐𝑝𝑘(𝑎2+𝑏2+𝑟 )

𝑐2←𝐷𝑒𝑐𝑠𝑘(𝐶)

𝑐1←𝐅 𝐶=𝐸𝑛𝑐𝑝𝑘(𝑎1𝑏1+𝑎2𝑏1+𝑎1𝑏2+𝑎2𝑏2−𝑐1)

Instantiating CTH

Oblivious Extended Perm.

• Assume inputs are ready

𝝅𝑪

𝑃1

π

𝑃2(𝑡1𝑡2...𝑡𝑚

)(𝑎𝜋− 1 (1 )⊕𝑡1𝑎𝜋− 1 (2 )⊕𝑡 2

.

.

.𝑎𝜋−1 (𝑚 )⊕𝑡𝑚❑

)(𝑎1𝑎2...𝑎𝑛

)𝑎1

𝑎2

𝑎3

𝑎4𝑎5𝑎6

𝑎1⊕𝑡 1

𝑎1⊕𝑡 5

𝑎2⊕𝑡 2𝑎3⊕𝑡3

𝑎4⊕𝑡 4

𝑎5⊕𝑡6𝑎5⊕𝑡7

𝑎6⊕𝑡 9𝑎6⊕𝑡8

OEP• Using any MPC

o Inefficiento Not on-demand

• Using singly HE o Linear complexityo Requires public-key ops

• Using oblivious transfero Not linearo But better concrete efficiency (OT extension)

HE-based

𝑃1 𝑃2

𝐸𝑛𝑐𝑝𝑘(𝑎1)𝐸𝑛𝑐𝑝𝑘(𝑎2)

𝐸𝑛𝑐𝑝𝑘(𝑎𝑛)

𝐸𝑛𝑐𝑝𝑘(𝑎¿¿𝜋− 1 (1 )⊕𝑡¿¿1)¿𝐸𝑛𝑐𝑝𝑘(𝑎𝜋− 1 (2 )⊕𝑡¿¿2)¿ .¿ ..

𝐸𝑛𝑐𝑝𝑘(𝑎¿¿𝜋−1 (𝑚 )⊕𝑡 ¿¿𝑚)❑¿¿

.

.

. (𝑎1𝑎2...𝑎𝑛

)(𝑡1𝑡2...𝑡𝑚

)𝝅❑

Easy to make on-demand

𝑝𝑘 ,𝑠𝑘

Permutation Networks

𝑎𝑏

1

𝑎𝑏

0𝑎𝑏

𝑎𝑏

…

…

…

…

[Waksman’ 68]: any permutation can be implemented using a permutation network of size

The permutation is determined using selection bits

Permutation NetworkSwitchesselection bit

EP Networks• Need one more switch type

𝑎𝑏

1

𝑎𝑏

0𝑎𝑏

𝑎𝑏 𝑎

𝑏

1

𝑎𝑏

0𝑎𝑏

𝑎𝑎

EP Networks

Waksman network

Waksman network

𝑎1𝑎2...𝑎𝑛

𝑑𝑑...𝑑

𝑎1𝑑𝑑𝑎2𝑑𝑎3𝑎4...𝑑𝑎𝑛

1𝑎1𝑎1 1

𝑎1𝑎1 0 𝑎1

.

.

.

m 𝑙𝑜𝑔𝑚−𝑚+1+𝑚+𝑚𝑙𝑜𝑔𝑚−𝑚+1

Oblivious Switch

𝑟1𝑟2

𝑟3𝑟 4

𝑃1

𝑎 ,𝑏𝑃2

𝑠

¿ 𝑠1-out-of-2 OT

𝑎⊕𝑟1 ,𝑏⊕𝑟 2

𝑠=0→ (𝑎⊕𝑟1)⊕ (𝑟1⊕𝑟 3 )=𝒂⊕𝒓 𝟑

(𝑏⊕𝑟 2)⊕ (𝑟 2⊕𝑟 4 )=𝒃⊕𝒓 𝟒

𝑠=1→(𝑏⊕𝑟2)⊕ (𝑟 2⊕𝑟 3 )=𝒃⊕𝒓𝟑

(𝑎⊕𝑟 1)⊕ (𝑟1⊕𝑟4 )=𝒂⊕𝒓 𝟒

OEP

𝑟1𝑟2

𝑟3𝑟 4 𝑟3

𝑟 4𝑟5𝑟6

0

1

𝑟6𝑟5

𝑟7𝑟8

1

𝑎⊕𝑟1 𝑎⊕𝑟3

𝑎⊕𝑟6

𝑎⊕𝑟7

MAP

Reveal

𝑎⊕𝑟 7⊕𝑡7𝑎⊕ 𝑡7

𝑃1

(𝑡1𝑡2...𝑡𝑚

)(𝑠1𝑡2...𝑠𝑘

)𝑃2

(𝑎1𝑎2...𝑎𝑛

)

π

Efficiency• One OT per switch

o O(nlogn) OTs total

• Practical thanks to OT extension

• Fast online phaseo OTs done offline

• Constant round

Instantiations• First Multiparty PFE with linear complexity

o GMW + HE-Based OEP

• First Arithmetic PFE with linear complexityo [CDN 01] + HE-based OEP

• More efficient two-party PFE with linear complexityo Yao + HE-based OEPo Subsumes and improves construction of [KM’11]

• More practical PFEo Yao/GMW + OT-based OEP + OT extension

Yao-based PFE𝑖1𝑖2

𝑖3𝑖4

𝑖5𝑖6𝑖7𝑖8

𝑖9𝑖10

𝑜1𝑜2

𝑜3𝑜4 𝑜6

𝑜5

𝑃1

𝑃2¿(𝑡1𝑡2........𝑡 20

)

OEP

)

))

)

Open Questions

Stronger Security• Linear PFE with malicious security

o Recently solved! [Mohassel-Sadeghian-Smart 2014]

• Linear PFE with IT securityo Our linear solution relies on HE-based OEP

• Hide circuit size without FHE?o Use FHE in a limited way?o Use somewhat FHE?

PFE for Practice• Linear PFE with good concrete efficiency

o OEP with linear symmetric-key Opso Can use free-XOR if you leak number of XOR gates

• Can PFE help improve efficiency of SFE?o An Idea:

• One party embeds his input in the circuit• Shrinks the circuit significantly• Circuit structure leaks information • Use PFE to hide the structure

• PFE for RAM programs

Thank you!