TC: Large: Collaborative Research: Practical Secure Two-Party Computation: Techniques, Tools, and Applications

许多引人注目的应用程序都需要计算，这些计算需要来自两个或更多个人的敏感数据。例如，随着个人基因组测序成本的迅速下降，许多遗传学应用很快就会应用到个人手中，比如将S的一个基因组与一项研究中不同参与者的基因组进行比较，以确定哪种治疗可能最有效。这种比较可能具有巨大的价值，但由于个人和研究参与者的隐私问题，目前是不可行的。需要的是一种在不暴露任何一方私人投入的情况下产生比较结果的方法。这个项目的最终目标是使隐私保护计算变得足够实用和可访问，以便在个性化遗传学、医学研究和隐私保护生物识别等应用程序中常规使用。这个问题的理论解决方案，即安全多方计算，几十年来一直是已知的，包括由Andrew姚开发的基于篡改电路的通用解决方案。然而，由于其广泛的内存使用和计算成本，乱码电路方法传统上被认为更多地被认为是理论上的好奇，而不是构建隐私保护应用程序的实用机制。然而，密码技术和新实现方法的最新发展正开始改变这一点，并承认可扩展的、实用的安全计算的可能性。该项目正在设计方法，通过积极地流水线化电路生成和评估来避免与乱码电路评估相关的存储器瓶颈，并探索各种技术来减小乱码电路的大小。在实践中限制安全计算使用的另一个问题是，标准协议需要假设一个诚实但好奇的对手总是遵循指定的协议。该项目正在开发处理恶意对手的新技术，通过使用新的加密工具来改进标准的剪切选择和提交证明方法，并探索一种替代模型，在该模型中，可验证的可信方生成电路，但不信任任何私人数据。该项目还在开发技术，以审计可以从安全计算结果中推断的信息。另一个目标是通过开发编程工具来基于信息流分析和程序分区在高级别定义安全计算，从而使开发人员更容易访问安全计算。

Many compelling applications involve computations that require sensitive data from two or more individuals. For example, as the cost of personal genome sequencing rapidly plummets many genetics applications will soon be within reach of individuals such as comparing one?s genome with the genomes of different groups of participants in a study to determine which treatment is likely to be most effective. Such comparisons could have tremendous value, but are currently infeasible because of the privacy concerns both for the individual and study participants. What is needed is a way to produce the result of the comparison without exposing either party's private inputs. The ultimate aim of this project is to make privacy-preserving computation practical and accessible enough to be used routinely in applications such as personalized genetics, medical research, and privacy-preserving biometrics.Theoretical solutions to this problem, known as secure multi-party computation, have been known for several decades, including a general solution developed by Andrew Yao based on garbled circuits. Because of its extensive memory use and computational cost, however, the garbled circuits approach has traditionally been considered more of a theoretical curiosity than a practical mechanism for building privacy-preserving applications. Recent developments in cryptographic techniques and new implementation approaches are beginning to change this, however, and admit the possibility of scalable, practical secure computation. This project is designing methods for avoiding the memory bottleneck associated with garbled circuit evaluation by aggressively pipelining circuit generation and evaluation, and exploring a variety of techniques for reducing the size of garbled circuits. Another issue the limits the use of secure computation in practice is the need for standard protocols to assume an honest-but-curious adversary who always follows the specified protocol. This project is developing new techniques for dealing with malicious adversaries, improving the standard cut-and-choose and commit-and-prove approaches by using new cryptographic tools and exploring an alternate model in which a verifiable trusted party generates the circuit but is not trusted with any private data. The project is also developing techniques to audit the information that can be inferred from the result of a secure computation. Another goal is to make secure computation more accessible to developers by developing programming tools for defining secure computations at a high level, based on information-flow analysis and program partitioning.