Oblivious Transfer (OT) Alice (sender) has n secrets Alice wants to give k secrets to

Bob Bob wants the secrets but does not

want Alice to know which secrets he has

Oblivious Transfer 2 to 1

OT basics Use of Modular Arithmetic

OT design Direct Extension of PKE

OT application Secure Function Evaluation Secure Auction

OT – Coin Toss (The basics) Alice generates 2 primes and computes their

product, p, which is sent to Bob Bob Performs primality tests to ensure Alice is

playing fair. Bob guesses a number 0 < n < p as a factor of p Chances are he guesses wrong but Bob computes

m = n^2 mod p and sends this to Alice. Alice knows the original number, p, and she looks

for all numbers less than p that generate a remainder of m. This can be done fairly easily using the Chinese Remainder Theorem

OT – Coin Toss Cont Alice will find at least 1 pair of such numbers,

she will then send 1 of the pairs, p , to Bob. O = n + p. He will then calculate the gcd(O,p) This will yield either a trivial result or a factor

of p which Bob will send to Alice. There is a 50% chance that Alice sends the

nontrivial p to Bob. Bob has a slight advantage in that he picks the

original n, but there is a negligible chance that Bob randomly pick an n that factors p. [Peterson]

Original OT The transfer is somewhat like a simple game

played with a locked box requiring two different keys. A sender transfers the locked box to a recipient, who finds one key that partially unlocks the box. The sender has both keys and, without seeing what the recipient has done, must now pass on one of the two keys. Depending on which key is sent, the recipient will either succeed or fail in opening the box. Although the sender's choice controls the outcome, the sender never knows which choice to make to guarantee a certain result.

The Heart of OT Sender remains unsure of outcome We want more

Want to share secrets not just have a fair (50% chance) to come out with a prime factor of a number.

OT - PKE Alice generates two public-key/private-key key

pairs. Bob chooses a key in a symmetric encryption

algorithm (3DES, for example). He chooses one of Alice’s public keys and encrypts his DES key with it. He sends the encrypted key to Alice without telling her which of her public keys he used.

Alice decrypts Bob’s key twice, once with each of her private keys. In one of the cases, she uses the correct key and successfully decrypts Bob’s DES key. In the other case, she uses the wrong key and only manages to generate a meaningless heap of bits that nonetheless look like a random DES key.

OT – PKE cont Alice encrypts both of her messages, each

with a different one of the DES keys she generated in the previous step (one real and one meaningless) and sends both of them to Bob.

Bob gets one of Alice’s messages encrypted with the proper DES key and the other one encrypted with the gibberish DES key. When Bob decrypts each of them with his DES key, he can read one of them; the other just looks like gibberish to him.

Conclusion of PKE – OT Success:

Bob now knows one of Alice’s secrets although doesn’t know which.

Disadvantage: Bob does not know if he has Alice’s

first or second secret and has no way of finding out.

Secure Function Evaluation

Application of OT

What is Secure Function Evaluation (SFE)? Our goal is to compute f(x1, …, xn), the

output, while at the same time limiting the information that each party gains about the other parties values (ideally, at the end, each party knows their input, and the output of the function, and no other information about their opponent that isn’t inherent in the function definition)

Some Uses for SFE The Millionaires problem… two millionaires

wish to determine who has the most money with out revealing their exact net worth

Voting f(x1, …, xn) returns 0 if candidate one gets more votes, 1 if candidate two, etc

Auctions f(x1, …, xn) = (i, n) for maximum bid Database computations Database queries

Important Considerations in Defining a SFE system What type of adversary? (Passive v.

Active, Adaptive v. Non-Adaptive) What type of network are the

parties connected to? (Pairwise Secure, Broadcast, Authenticated)

What guarantees do you hope to achieve? (Correctness, Privacy)

Known Results for SFE If Trapdoor Permutations exist:

Any function evaluation can be computed securely against a passive (honest-but-curious) adversary

Any function evaluation can be computed securely against an active adversary controlling at most one half of the parties

SFE over insecure networks: any f can be computed securely against an active

adversary if parties used pairwise channels and there are two-thirds majority of honest parties [BGW, CCD]

any f can be computed securely using a broadcast channel against an active adversary who has corrupted less than half of the parties

Computing a Function Bob and Alice share a Boolean circuit they wish to

compute Alice’s input is a1 b1; Bob’s input is a2 b2 Define a = a1 a2; b = b1 b2 We want a c1, c2 for Alice, Bob, resp., subject to

c1 + c2 = (a1 + a2)(b1 + b2) Alice chooses c1 in {0,1} at random and prepares n

possible c2 outputs for bob (based on the n possible secrets Bob might have)

Alice and Bob perform OT and now they have c1 and c2 values subject to the above constraints

Bob and Alice are now able to evaluate any Boolean circuit

Two-Party Secure Function Evaluation A assigns each wire i two random values (Wi

0, Wi1)

corresponding to 0 and 1 Used as pseudo-random keys (e.g. 80 bits)

Wire values denoted as ai (0 or 1) A assigns a “garble” function to each wire: i: ai ->

ci (Wi

bi,ci) denotes the garbled value of wire i Gate function denoted as ak=g(ai,aj) A creates a table Tg which enables computation of

garbled output of g: (Wkbk,ck) from garbled inputs

(Wibi,ci) and (Wj

bj,cj)

Two-Party Secure Function Evaluation The table does not disclose any information about the

output of g for other inputs Does not reveal input or output values Assume |FK(x)| = |Wk

bk|+1 The table contains n entries:

For B to use the table B knows (Wi

bi,ci), (Wjbj,cj)

Finds (ci,cj) in the table Performs XOR with entry in the table to compute

garbled output (Wkg(bi,bj),ck)

Recall that A xor B xor C xor B xor C = A Garbled output from garbled inputs and table

Two-Party Secure Function Evaluation For each input wire, B and A engage in

oblivious transfer A is the sender, B is the chooser

A sends the gate tables to B A sends a translation table from the

garbled values of the output wires to output bits

By the end of the oblivious transfer stages, B has enough information to compute f(x)

Two-Party Secure Function Evaluation Security of gates

Every masking value (FW(ci)) is used only once Without knowledge of the correct key, masking values

look random Overhead

Communication is performed in one back and forth round

A can prepare the circuit in advance (one table for each of m gates)

Computation: one oblivious transfer for each input bit (n)

A and B must perform n exponentiations B must evaluate f

Negligible compared to oblivious transfer

SFE - Fairplay Fairplay consists of two parts:

a language SFDL (Secure Function Definition Language) that describes the SFE paradigm

a compiler that creates a one-pass Boolean circuit in a language called SHDL (Secure Hardware Definition Language)

Bob and Alice then are able to securely evaluate the circuit

Compiling SFDL SFDL is compiled into a Boolean

circuit using an SFDL – SHDL compiler. The SHDL circuit must have

“obliviousness” built in to it: No registers, loops, gotos Every gate used exactly once For array indexing a multiplexer is built

with all values of i hardwired in

And Finally… There are Alice

and Bob programs who take as input a SHDL circuit and carry out the secure computation protocol

SFDL Program Structure First one must declare global constants and

types, followed by a sequence of functions. Functions must precede any functions that call

it. Recursion and global variables are forbidden. The last function must be the output function. Variable assignments are as one would expect,

operators include addition, subtraction, Boolean operators, and standard comparison operators.

If-then and if-then-else are supported All loops must have a definite number of

iterations that are known in advance.

SFDL Compiler Reads in SFDL program, transforms it,

outputs program in SHDL format. Compiler performs the following steps:

Parsing Function inlining and loop unfolding Transformation into single-bit operations Array access handling Single variable assignments Optimization (in terms of circuit size)

And Then… An oblivious transfer is needed for every

input wire of the circuit. Bob sends m “garbled” circuits to Alice,

Alice randomly chooses one circuit to be evaluated, and Bob reveals remaining m-1 circuits. Bob can be caught cheating with probability 1-1/m.

The two implemented OT methods are based on the Diffie-Hellman problem.

Results Authors performed tests

on four functions: AND – bitwise and on Alice

and Bob’s inputs Billionaires – 32 bit input

for Bob and Alice, which it compares

Keyed Database Search – Bob has a keyed database, Alice retrieves items by specifying its key

Median – finds median of two sorted arrays

What’s the Point? Secure Auction System GOAL:

Keep bids secret from auctioneer Auctioneer only needs to know

identification of highest bidder clearing price

Need a third entity “Auction issuer” Create protocol where neither auctioneer nor auction

issuer have full information about bidders and bids Assumption: auctioneer and auction issuer do not

collude

Auctions Auction consists of three types of entities

Bidders, auctioneer, auction issuer Protocol

Auctioneer advertises details of auction Rules, times, AI

AI creates an encryption scheme for each bidder to use Bidders submit encrypted bids to the auctioneer, using

the AI’s encryption scheme AI generates a program to compute the outcome of the

auction based upon the encrypted bids, then sends circuit and output translation table to auctioneer

Auctioneer uses inputs and program to compute outcome of auction

Secure Function Evaluation for Auctions Auctioneer must compute f(x1,…,xn) = result of auction =

<i,p> i = winner p = clearing price

AI constructs circuit to compute auction result and garbles it

Auctioneer advertises auction and AI’s public key (P. OT) Each bidder engages in a 1-of-2 proxy oblivious transfer (for

each bit) AI is sender (garbled input bit value-pairs) Bidder is the chooser Auctioneer is proxy

Note that the auction issuer doesn’t receive any inputs Auctioneer computes outcome of auction

AI provides output translation table

Future Work Improve performance Security against malicious parties Fair termination Reactive secure computation Integrating other SFE primitives Multi-party computation

Acknowledgments By Dahlia Malkhi, Noam Nisan,

Benny Pinkas, and Yaron Sella (SFE)

Ivars Peterson (OT – Coin Toss)