P rivate S et I ntersection: Are Garbled Circuits Better than Custom Protocols?

Private Set Intersection:Are Garbled Circuits Better than Custom Protocols? Yan Huang, David Evans, Jonathan Katz University of Virginia, University of Maryland www.MightBeEvil.org

Motivation --- Common Acquaintances http://www.mightbeevil.com/mobile/

Financial Crypto 2010 EUROCRYPT 2004 TCC 2008 CRYPTO 2005

Generic Protocols Custom Protocols Designed around specific cryptoassumptions and primitives Uses generic and flexible cryptographic primitives Cannot be easily composedwith other secure computations Can securely compute arbitrary function New Designand security proofsneed to be done for every individual scheme. Security proofs automatically derived from the generic proof. e.g., Garbled Circuit Protocols

Garbled Circuits & Oblivious Transfers a1 Alice a0 b1 Bob b0 Y. Huang, D. Evans, J. Katz, L. Malka, Faster Secure Computation Using Garbled Circuits, USENIX Security 2011. Oblivious Transfer Protocol AND AND x1 x0 OR Andrew Yao, 1982/1986 x2 Free-XOR technique, Kolesnikov and Shneider, 2008 … Rabin, 1981; Even, Goldreich, and Lempel, 1985; Naorand Pinkas 2001, Ishai et al., 2003

Threat Model Semi-Honest Adversary: follows the protocol as specified, but tries to learn more from the protocol execution transcript

Generic PSI Protocols Overview – the number of bits used to denote a set element – the size of the sets

PSI: Needn’t be Complex Recessive genes: { 5283423, 1425236, 839523, … } Recessive genes: { 5823527, 839523, 169325, … } Encode set elements as bit vectors [ PAH, PKU, CF, … ] [ 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0] [ 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0] . . . AND AND AND . . . Bitwise-AND

BWA Performance What if the element space is large?

Sort-Compare-Shuffle Sort: Take advantage of total order of elements Compare adjacent elements Shuffle to hide positions

Bitonic Sorting 1 1 1 1 1 2 2 4 2 4 3 3 3 3 9 4 4 2 4 7 5 4 5 4 5 4 5 4 5 4 7 9 9 7 3 7 9 7 9 2 Sorting Networks and their Applications, Ken Batcher, 1968

… CMP Filter CMP Filter CMP Filter

CMP3 Filter CMP3 Filter CMP3 Filter

Can’t reveal results yet! Position leaks information.

Journal of the ACM, January 1968

Waksman Network Same circuit can generate any permutation: select a random permutation, and pick swaps gates

Private Set Intersection Protocol Gates to generate and evaluate Free – the number of bits used to denote a set element – the size of the sets

SCS-WN Protocol Results 32-bit values

Relating Performance to Security DL Key-sizes: (1024, 160) (2048, 224) (3072, 256) (7680, 384) (15360, 512) Symmetric: 80 112 128 192 256

Conclusion Generic protocols offer many advantages Composability Flexibility on hardness assumptions Design cost Performance

Q & A?

P rivate S et I ntersection: Are Garbled Circuits Better than Custom Protocols?