Simple BlackBox Constructions of Adaptively Secure Protocols Seung

Simple, Black-Box Constructions of Adaptively Secure Protocols Seung Geol Choi Columbia University joint work with Dana Dachman-Soled (Columbia University), Tal Malkin (Columbia University), and Hoeteck Wee (Queens College, CUNY)

Outline • Motivation • Our Work • Our Compiler – Comp 2

Outline • Motivation • Our Work • Our Compiler – Comp 3

Criteria of adversarial corruption in Multi-party Computation (MPC) • Semi-honest vs. Malicious – semi-honest: corrupted parties should behave honestly – malicious: they can behave arbitrarily • How many parties can be corrupted? – Honest majority vs. honest minority. • Static vs. Adaptive – static: adv corrupts parties at the outset – adaptive [CFGN 96]: during the protocol adaptively

Adaptively Secure OT - Simulator Sender (s 0, s 1) Receiver r No Corruption sr Corrupt Sender m 1 m 2 m 3 Output Bad Simulation Pick (s 0, s 1), r, rand for S & R randomly and execute the protocol honestly w/ these values. Given the actual input (s 0’, s 1’), Sim is unable to patch rand for S consistent w/ the transcript & the input

MPC (malicious majority) and OT -- Roughly • Non-black-box – Basically everything is known: use ZK, e. g. , – Static: from semi-honest OT [GMW 87] (stand-alone) – Adaptive: from semi-honest OT with FCOM [CLOS 02] (UC) • Black-box – Static: from semi-honest OT [K 88, IKLP 06, H 08] (standalone) – Adaptive: from malicious OT [IPS 08] (UC) But, malicious OT [B 98, CLOS 02, KO 04] has non-black-box access to the underlying primitive.

Goal • Achieve MPC – adaptive, malicious majority – black-box (BB) access to lower primitives • Of theoretical interest • Arguably more efficient: avoid general NP reductions incurred by ZK proofs. – constant-round

Outline • Motivation • Our Work • Our Compiler – Comp 8

Main Result UC, adaptive semi-honest bit OT • Black-box Compiler UC, adaptive • constant multiplicative blow-up in rounds malicious string OT Improvement over [IKLP 06, H 08] : in FCOM hybrid UC and adaptive

BB Implications – UC & Adaptive DDH RSA Factoring LWE [IPS 08] Trapdoor [CDMW 09, constant-round simulatable CLOS 02] semi-honest bit OT cryptosystem this work: malicious string OT in FCOM hybrid • in FCOM hybrid - MPC allowing corruption of any number of parties - constant-round MPC allowing corruption of n-1 parties

Our MPC Construction • FCOM hybrid: Can be combined with existing results under various setup – e. g. , [CLOS 02, BCNP 04, CDPW 07, K 07]. Usually start by how to UC realize FCOM. #rounds for n, (n-1) corruptions hybrid [CLOS 02] O(depth) FCOM [IPS 08] O(depth) O(1) FOT ours O(depth) O(1) FCOM BB/non-BB BB BB

BB Implications - Stand-alone DDH RSA Factoring LWE [IPS 08] [PW 09] UC, adaptive, Trapdoor [CDMW 09, constant-round simulatable CLOS 02] semi-honest bit OT cryptosystem this work: malicious string OT in FCOM hybrid • stand-alone, UC, adaptive in FCOM hybrid - MPC allowing corruption of any number of parties - constant-round MPC allowing [PW 09] corruption of n-1 parties - constant-round malicious string OT

Our Work - Summary Compiler UC, adaptive semi-honest bit OT UC, adaptive malicious string OT in FCOM hybrid MPC • Adaptively secure MPC: UC in FCOM hybrid / stand-alone - allowing corruption of any number of parties - allowing corruption of n-1 parties in constant-round String OT stand-alone, adaptive constant-round malicious string OT

Outline • Motivation • Our Work • Our Compiler – Comp 14

Previous Work: Stand-alone & Static case Haitner [H 08] semi-honest bit OT e. TDP, homomorphic enc defensible bit OT Ishai, Kushilevitz, Lindell, and Petrank [IKLP 06] malicious OT [K 88] MPC

Our Compiler - 1 • Basically, [H 08]+[IKLP 06]. • Insight – View [H 08] + [IKLP 06] as GMW Compiler • With ZK proof replaced with cut-and-choose technique. – Our presentation doesn’t need the notion of defensible OT.

Our Compiler - 2 • Has two modules – Comp: boost receiver-side security (for string) – OT-Reversal [WW 06]: reverse the role of sender and receiver (for bit) semi-honest [H 08] : Commit input & randomness at the outset Our Compiler [IKLP 06] Starting protocol Apply Comp Apply OT-Reversal Parallel executions Apply Comp sender receiver semi-honest defensible semi-honest malicious defensible malicious semi-honest defensible malicious

Outline • Motivation • Our Work • Our Compiler – Comp 18

Comp(¦) I. Run con-tossing in the well using FCOM [H 08] to fix R’s input & rand for Phase II. Run 2 n executions of ¦ in parallel w/ R using input & rand generated in Phase I. III. R opens commitments in Phase I for n random OT execs. IV. Apply combiner to the rest of n executions. [IKLP 06] Cut & Choose

UC Security in Comp • Straight-line simulation – Extract receiver’s input in a straight-line manner w/ info from Phase I.

Adaptively Secure OT - Simulator Sender (s 0, s 1) Receiver r No Corruption sr Corrupt Sender m 1 m 2 m 3 Output Upon corruption, Sim has to patch rand for S consistent w/ the transcript & the given input

Simulation in Comp – Achieving Adaptive Security Use adaptive security of ¦: Guaranteed as long as R behaves honestly 1. Extract R’s input & rand. in Phase I w/ FCOM 2. For i-th OT execution ¦i: • Run simulator for ¦i (SIMi) until the R behaves consistently w/ the commitments. • Inconsistent R: “corrupt S” on SIMi (input & rand of S in ¦i is fixed ). Follow spec. of ¦ w/ this fixed info. 3. Patching the S’s overall rand. • If R behaved honestly in some ¦j, can patch using SIMj : with high probability there is at least one such j.

Conclusion Compiler UC, adaptive semi-honest bit OT UC, adaptive malicious string OT in FCOM hybrid MPC • Adaptively secure MPC: UC in FCOM hybrid / stand-alone - allowing corruption of any number of parties - allowing corruption of n-1 parties in constant-round String OT stand-alone, adaptive constant-round malicious string OT

Thank you