Secure Two-Party Computation with Reusable Bit-Commitments, via a Cut-and-Choose with Forge-and-Lose Technique
Secure Two-Party Computation with Reusable Bit-Commitments, via a Cut-and-Choose with Forge-and-Lose Technique
复制标题
DOI：
10.1007/978-3-642-42045-0_23
复制
发表时间：
2013-12
期刊：
影响因子：
--
通讯作者：
L. Brandao
中科院分区：
文献类型：
--
作者：
L. Brandao
安全的两方计算（S2 PC）协议允许双方在其组合的私有输入上进行计算，就像由可信的第三方作为中介一样。在恶意模型中，这可以通过对乱码电路（C& C-GC）的选择来实现，其中一些GC被验证是否正确，而其余的则被评估以确定电路输出。本文提出了一种新的基于C&C-GCs的S2 PC协议，在效率和适用性方面具有显著的优势。首先，与要求大多数评估GC正确的先前协议相比，新协议只要求至少一个评估GC是正确的。在实践中，这将使GC总数减少到大约三分之一，但统计安全目标相同。这是通过使用基于位承诺的newforge-and-losetechnique和陷门来增强C&C来实现的。第二，新协议的输出包括所有电路输入和输出位的可重用XOR同态位承诺，从而使得能够以反应方式有效链接几个S2 PC。该协议具有额外的有趣特性（这可能允许新的比较权衡），例如需要少量的求幂，使用2-out-of-1类型的不经意传输，以及使用C&C结构来统计地验证输入线密钥的一致性。
Asecure two-party computation(S2PC) protocol allows two parties to compute over their combined private inputs, as if intermediated by a trusted third party. In the malicious model, this can be achieved with acut-and-choose of garbled circuits(C&C-GCs), where some GCs areverifiedfor correctness and the remaining areevaluatedto determine the circuit output. This paper presents a new C&C-GCs-based S2PC protocol, with significant advantages in efficiency and applicability. First, in contrast with prior protocols that require a majority ofevaluatedGCs to be correct, the new protocol only requires that at least oneevaluatedGC is correct. In practice this reduces the total number of GCs to approximately one third, for the same statistical security goal. This is accomplished by augmenting the C&C with a newforge-and-losetechnique based on bit commitments with trapdoor. Second, the output of the new protocol includes reusable XOR-homomorphic bit commitments of all circuit input and output bits, thereby enabling efficient linkage of several S2PCs in a reactive manner. The protocol has additional interesting characteristics (which may allow new comparison tradeoffs), such as needing a low number of exponentiations, using a 2-out-of-1 type of oblivious transfer, and using the C&C structure to statistically verify the consistency of input wire keys.