Laconic Conditional Disclosure of Secrets and Applications
Laconic Conditional Disclosure of Secrets and Applications
复制标题
简洁有条件地披露秘密和应用
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Giulio Malavolta
中科院分区：
文献类型：
--
作者：
Nico Döttling;Sanjam Garg;Vipul Goyal;Giulio Malavolta
在一个有条件的秘密披露（CDS）中，验证者V想要向证明者P透露一个消息m，条件是x是某个NP语言L的可接受实例。一个诚实的证明者（持有相应的见证者w）总是在交互结束时获得消息m。另一方面，如果x ≠ L，我们要求没有PPT P* 可以学习消息m。我们介绍简洁的CDS，两轮CDS协议的最佳计算成本的验证V和最佳的通信成本。更具体地说，验证者的计算和整体通信随着多（|X|; λ; log（T）），其中λ是安全参数，T是用于检查x ≤ L（给定w）的验证时间。我们得到简洁的CDS结构的标准假设下，如CDH或LWE。Laconic CDS是一个强大的工具，可以恶意化半诚实协议，同时保留其计算和通信复杂性。为了证实这一说法，我们考虑非交互式安全计算的设置：Alice希望在她的网页上发布一个与私有大输入x相对应的简短摘要，以便（可能有许多）Bob，使用私有输入y，可以向Alice发送一条短消息，允许她学习C（x; y）（其中C是公共电路）。该协议必须是可重用的，因为Bob可以在同一个摘要上执行任意多个执行。在这方面，我们得到以下新的影响。1)UC安全Bob优化的2 PC：我们得到了一个UC安全协议，其中Bob的计算成本和协议的通信成本随着poly（|X|; |y|; λ; d），其中d是计算电路C的深度。2)恶意简洁函数求值：接下来，我们继续讨论Alice的输入x很大的设置。在这种情况下，UC安全协议的通信成本必须随着|X|.因此，以实现更好的效率为目标，我们认为恶意安全的概念较弱。对于这种设置，我们获得了一个协议，其中Bob的计算成本和协议的通信成本随着poly（|y|; λ; d），其中d是计算电路C的深度。
In a Conditional Disclosure of Secrets (CDS) a verifier V wants to reveal a message m to a prover P conditioned on the fact that x is an accepting instance of some NP-language L. An honest prover (holding the corresponding witness w) always obtains the message m at the end of the interaction. On the other hand, if x ∉ L we require that no PPT P* can learn the message m. We introduce laconic CDS, a two round CDS protocol with optimal computational cost for the verifier V and optimal communication cost. More specifically, the verifier’s computation and overall communication grows with poly(|x|; λ; log(T)), where λ is the security parameter and T is the verification time for checking that x ∊ L (given w). We obtain constructions of laconic CDS under standard assumptions, such as CDH or LWE. Laconic CDS serves as a powerful tool for maliciousifying semi-honest protocols while preserving their computational and communication complexities. To substantiate this claim, we consider the setting of non-interactive secure computation: Alice wants to publish a short digest corresponding to a private large input x on her web page such that (possibly many) Bob, with a private input y, can send a short message to Alice allowing her to learn C(x; y) (where C is a public circuit). The protocol must be reusable in the sense that Bob can engage in arbitrarily many executions on the same digest. In this context we obtain the following new implications. 1) UC Secure Bob-optimized 2PC: We obtain a UC secure protocol where Bob’s computational cost and the communication cost of the protocol grows with poly(|x|; |y|; λ; d), where d is the depth of the computed circuit C. 2) Malicious Laconic Function Evaluation: Next, we move on to the setting where Alice’s input x is large. For this case, UC secure protocols must have communication cost growing with |x|. Thus, with the goal of achieving better efficiency, we consider a weaker notion of malicious security. For this setting, we obtain a protocol for which Bob’s computational cost and the communication cost of the protocol grows with poly(|y|; λ; d), where d is the depth of the computed circuit C.