Efficient Private Matching and Set Intersection Mike Freedman

Efficient Private Matching and Set Intersection Mike Freedman, NYU Kobbi Nissim, MSR Benny Pinkas, HP Labs EUROCRYPT 2004

A Story… Is there any chance we might be compatible? Maybe… We could see if we have similar interests? I don’t really like to give personal information Have you heard of “secure function evaluation” ? I don’t want to waste my entire night…

Making SFE more efficient… 1. Improvements to generic primitives (SFE, OT) 2. Improvements in specific protocol examples We could see if we have similar interests? Have you heard of “secure function evaluation” ? I don’t want to waste my entire night…

Secure Function Evaluation Input: Output: X As if… X Y F(x, y) and nothing else F(x, y) Y F(x, y) What if such trustworthy barkeeps don’t exist?

Proving SFE Protocols… Real World X Y ≈ Views X Y Ideal World F(x, y) Can consider semi-honest and malicious models

Our Specific Scenario Client Server Input: X = x 1 … xk Y = y 1 … yk n Shared interests music) nothing Output: X Y(research, only n Dating, genetic compatibility, etc. n Credit card rating n Terrorist watch list (CAPS II)

Related work n Generic constructions [Yao, GMW, BGW, CCD] n n Diffie-Hellman based solutions [FHH 99, EGS 03] n n n Represent function as a circuit with combinatorial gates Concern is size of circuit (as communication is O(|C|) Simplest uses k 2 comparisons Insecure against malicious adversaries Considered in the “random oracle” model Our work: O(k ln ln k) overhead. n n “Semi-honest” adversaries – in standard model “Malicious” adversaries – in RO model

This talk… n Overview n Basic protocol in semi-honest model n Efficient Improvements n Extending protocol to malicious model n Other results…

Basic tool: Homomorphic Encryption n Semantically-secure public-key encryption n Given Enc(M 1), Enc(M 2) can compute, without knowing decryption key, n n Enc(M 1+M 2) = Enc(M 1) · Enc(M 2) n Enc(c · M 1) = [Enc(M 1)] c , for any constant c Examples: El Gamal variant, Paillier, DJ

The Protocol n Client (C) defines a polynomial of degree k whose roots are his inputs x 1, …, xk P(y) = (x 1 -y)(x 2 -y)…(xk-y) = a 0 + a 1 y +…+ akyk n C sends to server (S) homomorphic encryptions of polynomial’s coefficients Enc(a 0), …, Enc(ak) Enc( P(y) ) = Enc( a 0 + a 1 · y 1 + … + ak · yk ) Enc(a 0) · Enc (a 1) y 1 · … · Enc (ak) yk

The Protocol n S uses homomorphic properties to compute, y, ry ← random Enc( ry · P(y) + y ) if y X Y Enc (y) otherwise Enc (random) n S sends (permuted) results back to C n C decrypts results, identifies y’s

Variant protocols…cardinality Enc( ry · P(y) + 1 ) if y X Y Enc (1) otherwise Enc (random) n Computes size of intersection: # Enc (1) n Others… Output 1 iff | X Y | > t

Security (semi-honest case) n n Client’s privacy n S only sees semantically-secure enc’s n Learning about C’s input = breaking enc’s Server’s privacy (proof via simulation) n n Client gets X Y in ideal (TTP) model Given that, can compute E(y)’s and E(rand)’s and thus simulate real model

Efficiency n Communication is O(k) ü C sends k coefficients ü S sends k evaluations on polynomial n Computation ü Client encrypts and decrypts k values û Server: y Y, computes Enc(ry·P(y)+y), using k exponentiations 2 n Total O(k ) exponentiations n

Improving Efficiency (1) n Inputs typically from a “small” domain of D values. Represented by log D bits (… 20) n Use Horner’s rule P(y)= a 0 + y (a 1+…y (an-1+yan). . . ) n n That is, exponents are only log D bits Overhead of exponentiation is linear in | exponent | → “Improve” by factor of | modulus | / log D e. g. , 1024 / 20 ≈ 50

Improving Efficiency (2): Hashing x 1 x 2 x 3 x 4 x 5 x 6 x 7 … xk-1 xk H(·) … B P M 1 n n n P 2 P 3 PB C uses PRF H(·) to hash inputs to B bins Let M bound max # of items in a bin Client defines B polynomials of deg M. Each poly encodes x’s mapped to its bin + enough “other” roots

Improving Efficiency (2): Hashing P 1 P 2 P 3 PB H y, i ← H(y), ry ← rand Enc( ry · Pi(y) + y ) n n Client sends B polynomials and H to server. For every y, S computes H(y) and evaluates the single corresponding poly of degree M

Overhead with Hashing n Communication: B · M (# bins · # items per) n Server: k·M short exp’s, ( Pi(y) ) k full exp’s ( ry·Pi(y) + y ) n How to make M small as possible? n Choose most balanced hash function

Balanced allocations [ABKU] n H: Choose two bins, map to emptier bin n B = k / ln ln k → xi H(·) M = O (ln ln k) M 5 [BM] n Communication: O(k) n Server: k ln ln k short exp, k full exp in practice

This talk… n Overview n Basic protocol in semi-honest model n Efficient Improvements n Extending protocol to malicious model n Other results…

Malicious Adversaries n Malicious clients n n Without hashing is trivial: Ensure a 0 ≠ 0 With hashing Verify that total # of roots (in all B poly’s) is k n Solution using cut-and-choose n Exponentially small error probability n n n Still standard model Malicious servers n Privacy…easy: S receives semantically-secure encryptions

Security against Malicious Server n Correctness: Ensure that there is an input of k items corresponding to S’s actions n Problem: Server can compute ry·P(y) + y’ n Solution: Server uses RO to commit to seed, then uses resulting randomness to “prove” correctness of encryption

Security against Malicious Server y, s ← rand, r ← H 1(s) [e, h] ← [ Enc ( r 1·P(y) + s ) , H 2 (r 2, y) ] Deterministic s* ← Dec (e), r* ← H 1(s*) ? x, s. t. e = Enc ( r*1·P(x) + s* ) h = H 2 (r*2, x)

Other results and open problems n Approximating size of intersection (scalar product) n n Requires Ω(k) communication Provide secure approximation protocol n PM protocol extends efficiently to multiple parties n Malicious-party protocol in standard model? n Fuzzy Matching? n n Databases are not always accurate or full Report iff entries match in t out of V “attributes”

Questions?