Private Function Evaluation Payman Mohassel University of Calgary Talks given at Bristol and Aarhus Universities Joint work with Saeed Sadeghian Secure Function Evaluation P2, x2 P1, x1 P3, x3 P5, x5 P4, x4 Correctness: honest parties learn the correct output Privacy: Nothing but the final output is leaked Parties learn f(x1,β¦,xn) 2 Private vs. Secure Function Evaluation π₯π β― π₯2 π₯1 , π π₯π , π β― π₯2 , π π₯1 , π π(ππ , β¦ , ππ ) π(ππ , β¦ , ππ ) β― β― Our Setup β’ Function π o Boolean circuits o Arithmetic circuits β’ Settings we consider o Two-party o Multiparty β’ Dishonest majority β’ Semi-honest adversaries π₯π β― π₯2 π₯1 , π π(ππ , β¦ , ππ ) β― Motivation β’ Why Hide the Function? o Private functions β’ Proprietary, intellectual property o Sensitive functions β’ Revealing vulnerabilities o Output of SFE leaks information β’ Hiding the function potentially helps β’ Prevents dictionary attacks on input β’ Interactive program obfuscation o If interaction is possible PFE yields efficient program obfuscation Is PFE Hard? β’ Not really! β’ All SFE feasibility results extend to PFE o Using Universal Circuits β’ The only interesting questions are efficiency questions Universal Circuits C Universal Circuit C(x) x Universal Circuits β’ Boolean o For a circuit C with g gates o [Valiantβ 76]: 19π log π + β¦ (good for large circuits) β’ Building it seems complicated o [KSβ 08]: 1.5π log 2 π + 2.5π log π + β― (good for small circuits ) β’ Arithmetic o For a circuit C with g gates and depth d o [Razβ 08]: π ππ 4 gates, i.e. π π5 in the worst case PFE Constructions β’ Two-party setting o Universal Circuit + Yaoβs protocol β’ π(πlogπ) or π(πlog 2 π) symmetric ops + π(π) OTs o [KMβ 11]: Homomorphic Enc + Yaoβs protocol β’ π π public-key ops + π π symmetric ops β’ Multi-party setting o Universal Circuit + GMW protocol β’ π π‘ 2 πlogπ OTs β’ Arithmetic circuits o Universal Circuit + HE-based MPC [CDNβ 01] o π(π5 ) public-key ops Efficiency Questions β’ Asymptotic Efficiency o Can we design PFE with linear complexity in all standard settings? β’ Practical Efficiency o o o o Constant factors are important Symmetric ops superior to public-key ops β¦ Can we improve practical efficiency of universal circuit approach? Our Framework Hiding the Circuit β’ What is leaked o Number of gates o Input size o Output size β’ What is private o Functionality of gates o Topology of the circuit One can hide circuit size using an FHE-based construction Private Gate Evaluation β’ Inputs are shared o π₯ = π₯1 β π₯2 o π¦ = π¦1 β π¦2 β’ Gate function o π = π΄ππ·, ππ , πππ o π = +,× o Known only to π1 π₯2 , π¦2 π₯1 , π¦1 , π π(π, π) π§1 β’ Output is shared o π§ = π§1 β π§2 Actual sharing mechanism depends on the protocol π§2 Circuit Topology β’ Topology captured using a mapping π πͺ π1 π3 π4 π3 π2 π2 π3 π3 π4 π4 π5 π5 π6 π7 π8 π6 π5 π9 π6 π10 π4 π7 π5 π8 π6 π1 π1 π2 π2 π1 π9 π10 CTH Functionality β’ Inputs are shared Map π πͺ o π₯ = π₯1 β π₯2 β’ Mapping o ππ known by π1 only β’ Outputs are shared o π₯ = π₯1β² β π₯2β² β’ Query types o Map: done internally o Reveal: reveal result of map o On-demand mapping π₯ = π₯1 β π₯2 π₯β²1 β π₯ β² 2 = π₯ π¦ = π¦1 β π¦2 π¦β²1 β π¦ β² 2 = π¦ π₯β²β²1 β π₯ β²β² 2 = π₯ Reveal PGE + CTH CTH π1 π π π3 π π4 π π5 π π6 ππ Map π π PGE π ππ ππ ππ ππ ππ ππ ππ ππ PGE ππ PGE ππ PGE ππ PGE Reveal π5 π6 Topological order π2 π π1 π2 π1 π2 π3 π4 π3 π4 π5 π6 π5 π6 π7 π8 π9 π10 Instantiating PGE PGE for GMW π₯2 , π¦2 π₯1 , π¦1 , π π1 π1 π2 π₯2 , π¦2 1-out-of-4 OT π3 π2 π(π, π) π4 π§1 g π π ππ ππ π§2 g x y z 0 0 π1 = π π₯1 β 0, π¦1 β 0 β π§1 0 0 g(0,0) 0 1 π2 = π π₯1 β 0, π¦1 β 1 β π§1 0 1 g(0,1) 1 0 π3 = π π₯1 β 1, π¦1 β 0 β π§1 1 0 g(1,0) 1 1 π4 = π π₯1 β 1, π¦1 β 1 β π§1 1 1 g(1,1) PGE for AC β’ β’ β’ β’ π, π β π π = π1 + π2 , π = π1 + π2 π = π1 + π2 , π = (π + π) ππ π = (π × π) πΈππ is an additively homomrphic encryption πΈππππ π2 , πΈππππ π2 , πΈππππ (π2 π2 ) π1 , π1 , ππ π1 (If +) (If ×) πβπ π1 β π1 + π1 β π π1 β π π2 , π2 , ππ, π π π2 πΆ = πΈππππ (π2 + π2 + π) πΆ = πΈππππ (π1 π1 + π2 π1 + π1 π2 + π2 π2 β π1 ) π2 β π·πππ π (πΆ) PGE for Garbled Circuit β’ We kind of cheat! o We assume all gates are NAND gates β’ Sharing associated with Yao o To share a value π₯ o π2 holds (π0 , π1 ) o π1 holds ππ₯ β’ π2 sends a garbled table to π1 β’ π1 decrypts one row of the table Instantiating CTH Oblivious Mapping β’ Assume inputs are ready Oblivious mapping π1 Ο: π β [π] π2 π1 π‘1 π‘2 . . . π‘π π1 π2 . . . ππ ππβ1 ππβ1 ππβ1 1 2 π π πͺ π1 β π‘1 π2 β π‘2 π3 β π‘3 π4 β π‘4 π2 β π‘1 β π‘2 . . . β π‘π π3 π1 β π‘5 π4 π5 β π‘6 π5 β π‘7 π5 π6 π6 β π‘8 π6 β π‘9 π4 β π‘10 Oblivious Mapping β’ Using any MPC o inefficient o Not clear it has the on-demand property o [HEKβ12] implements Waksman using Yaoβs protocol β’ Using singly HE o Linear complexity o Requires public-key operations β’ Using oblivious transfer o Not linear o But better concrete efficiency (OT extension) HE-based ππ, π π π π‘1 π‘2 . . . π‘π πΈππππ (π1 ) πΈππππ (π2 ) . . . πΈππππ (ππ ) π1 πΈππππ (ππβ1 1 β π‘1 ) πΈππππ (ππβ1 2 β π‘2 ) . . . πΈππππ (ππβ1 π β π‘π ) Easy to make on-demand π2 π1 π2 . . . ππ Permutation Networks Switches selection bit Permutation Network 0 β¦ π π π π β¦ 1 π π β¦ π π β¦ [Waksmanβ 68]: any permutation π: π β [π] can be implemented using a permutation network of size ππππ π β π + 1 The permutation is determined using ππππ π β π + 1 selection bits Switching Networks β’ Our mapping is not a permutation β’ Need one more switch type 0 π π π π 0 π π π π 1 π π 1 π π π π π π Mapping from SN π1 π2 . . . ππ π π . . . π Waksman network mππππ β π + 1 π1 π π π2 π π3 π4 . . . π ππ 1 π1 π1 1 π1 π1 0 π1 π2 Waksman network . . . + π + πππππ β π + 1 Oblivious Switch 1 π, π π2 π π1 π3 π2 π4 (π1 β π3 , π2 β π4 ) (π1 β π4 , π2 β π3 ) π1 π 1-out-of-2 OT π β π1 , π β π2 π =0β π =1β (π β π1 ) β π1 β π3 = π β ππ (π β π2 ) β π2 β π4 = π β ππ (π β π2 ) β π2 β π3 = π β ππ (π β π1 ) β π1 β π4 = π β ππ Oblivious Switch 2 π, π π2 π π1 π3 π2 π4 (π1 β π3 , π2 β π4 ) (π1 β π3 , π1 β π4 ) π1 1-out-of-2 OT π π β π1 , π β π2 π =0β π =1β (π β π1 ) β π1 β π3 = π β ππ (π β π2 ) β π2 β π4 = π β ππ (π β π1 ) β π1 β π3 = π β ππ (π β π1 ) β π1 β π4 = π β ππ Oblivious SN Evaluation MAP π β π1 0 π1 ππ 3 β π3 π2 π4 1 π3 π4 π5 ππ β π6 6 1 π β π‘7 π6 π β π7 π7 π5 π8 π β π7 β π‘7 Reveal Oblivious SN Evaluation β’ One OT per switch o O(mlog m) OTs total β’ On-demand o All OTs done offline o Only Xoring online β’ Practical when using OT extension β’ Constant round Oblivious Mapping ο CTH Functionality β’ GMW or Arithmetic Circuits o Inputs to mapping are ADDITIVE- or XOR-shared o (MAP) Each party ππ runs an oblivious mapping with π1 β’ ππ uses his vector of shares as input β’ π1 uses his mapping and blinding vector π‘π o (Reveal) Each party obtains his blinded βmappedβ vector of shares o π1 maps his own vector of shares and XOR/SUBTRACTs π‘π s to adjust values. β’ Yaoβs Protocol o Slightly more involved due to βweird sharingβ mechanism Summary of Results β’ First Multiparty PFE with linear complexity o GMW + HE-Based oblivious mapping β’ First Arithmetic PFE with linear complexity o [CDN 01] + HE-based oblivious mapping β’ More efficient two-party PFE with linear complexity o Yao + HE-based oblivious mapping o Subsumes and improves construction of [KMβ11] β’ More practical PFE o Yao/GMW + OT-based oblivious mapping + OT extension Future Work Other Security Notions β’ Security against stronger adversaries o Covert, malicious o Can we still achieve linear complexity? β’ PFE in the information theoretic setting o Our OT-based solution seems generalizable to IT setting o But linear PFE is open β’ Can we hide circuit size without using FHE? o or use FHE in a limited way, or use somewhat FHE? Round Complexity of PFE β’ Can we do PFE non-interactively? o Our Yao-based protocol requires at least 3 messages o SFE can be done in two messages β’ Can we achieve constant round multiparty PFE with linear complexity? o We only know it for two-party case β’ Can we achieve constant round arithmetic PFE? o Without switching to a Boolean circuit PFE for Practice β’ PFE with good concrete + asymptotic efficiency o E.g. designing OT-based oblivious mapping with linear complexity β’ Can PFE help improve efficiency of SFE? o Idea: β’ One party embeds his input in the circuit β’ Shrinks the circuit significantly β’ Circuit structure leaks information β’ We use PFE to hide the structure β’ PFE for RAM programs Thank you!
© Copyright 2026 Paperzz