Diogenes: Lightweight Scalable RSA Modulus Generation with a Dishonest Majority
Diogenes: Lightweight Scalable RSA Modulus Generation with a Dishonest Majority
复制标题
Diogenes：轻量级可扩展 RSA 模数生成与不诚实的多数
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Ruihan Wang
中科院分区：
文献类型：
--
作者：
Megan Chen;Carmit Hazay;Yuval Ishai;Yuriy Kashnikov;Daniele Micciancio;Tarik Riviere;Abhi Shelat;Muthuramakrishnan Venkitasubramaniam;Ruihan Wang
在这项工作中，我们设计并实现了第一个协议的分布式生成的RSA模数，可以支持成千上万的缔约方，并提供安全的主动腐败的任意数量的缔约方。简而言之，我们首先为这个规模设计了一个高度优化的协议，该协议可以防止被动损坏，然后使用轻量级简洁的零知识证明来增强其安全性，以抵御主动损坏。我们的协议实现了“可识别的中止”的安全性，其中损坏的一方被识别时，协议中止，并支持公共verifiability.Our协议的被动corruptions扩展了陈等的最近的工作。（NIPPTO 2020），反过来，是基于在Boneh-Franklin协议（NIPPTO 1997，J. ACM，2001）的原始工作中引入的蓝图。具体来说，我们减少了采样模数的任务，以确保分布式乘法，我们通过一个有效的阈值加性同态加密方案的基础上环LWE假设实现。这导致协议中的（摊销）每方通信成本在参与方数量上呈几何级数增长。为了最大限度地减少各方所做的工作，我们使用了一个“可公开验证”的协调器，它连接到所有各方，只对公共数据进行计算。我们实现了我们协议的被动和主动变体，并使用2到4,000个参与方进行了实验。这是第一个可以扩展到1,000多个参与方的MPC协议的实现。为了在1,000方中生成2048位模数，我们的被动协议在6分钟内执行，主动变体在25分钟内运行。
In this work, we design and implement the first protocol for distributed generation of an RSA modulus that can support thousands of parties and offers security against active corruption of an arbitrary number of parties. In a nutshell, we first design a highly optimized protocol for this scale that is secure against passive corruptions, and then amplify its security to withstand active corruptions using lightweight succinct zero-knowledge proofs. Our protocol achieves security with "identifiable abort," where a corrupted party is identified whenever the protocol aborts, and supports public verifiability.Our protocol against passive corruptions extends the recent work of Chen et al. (CRYPTO 2020) that, in turn, is based on the blueprint introduced in the original work of Boneh-Franklin protocol (CRYPTO 1997, J. ACM, 2001). Specifically, we reduce the task of sampling a modulus to secure distributed multiplication, which we implement via an efficient threshold additively homomorphic encryption scheme based on the Ring-LWE assumption. This results in a protocol where the (amortized) per-party communication cost grows logarithmically in the number of parties. In order to minimize the work done by the parties, we employ a "publicly verifiable" coordinator that is connected to all parties and only performs computations on public data.We implemented both the passive and the active variants of our protocol and ran experiments using 2 to 4,000 parties. This is the first implementation of any MPC protocol that can scale to more than 1,000 parties. For generating a 2048-bit modulus among 1,000 parties, our passive protocol executed in under 6 minutes and the active variant ran in under 25 minutes.