TC: Large: Collaborative Research: Practical Secure Two-Party Computation: Techniques, Tools, and Applications

许多引人注目的应用程序涉及需要来自两个或更多人的敏感数据的计算。例如，随着个人基因组测序成本的迅速下降，许多遗传学应用将很快在个人可以承受的范围内，例如比较一个？S基因组与一项研究中不同组参与者的基因组进行比较，以确定哪种治疗可能最有效。这种比较可能具有巨大的价值，但由于个人和研究参与者的隐私问题，目前是不可行的。我们需要的是一种方法，在不暴露任何一方私人投入的情况下产生比较结果。该项目的最终目标是使保护隐私的计算变得实用和易于访问，以便在个性化遗传学、医学研究和保护隐私的生物识别技术等应用中经常使用。这个问题的理论解决方案，即所谓的安全多方计算，已经有几十年的历史了，其中包括Andrew Yao基于乱码电路开发的通用解决方案。然而，由于其大量的内存使用和计算成本，乱码电路方法传统上被认为是一种理论好奇心，而不是构建隐私保护应用程序的实际机制。然而，最近加密技术的发展和新的实现方法开始改变这种情况，并承认可扩展的、实用的安全计算的可能性。该项目旨在通过积极的流水线电路生成和评估来设计避免与乱码电路评估相关的内存瓶颈的方法，并探索各种减少乱码电路尺寸的技术。在实践中限制安全计算使用的另一个问题是，需要标准协议来假设一个诚实但好奇的对手总是遵循指定的协议。该项目正在开发用于处理恶意对手的新技术，通过使用新的加密工具改进标准的切割-选择和提交-证明方法，并探索另一种模型，其中可验证的受信任方生成电路，但不受任何私有数据的信任。该项目还在开发审计可以从安全计算结果推断出的信息的技术。另一个目标是通过开发编程工具，基于信息流分析和程序划分，在高层次上定义安全计算，从而使开发人员更容易访问安全计算。

Many compelling applications involve computations that require sensitive data from two or more individuals. For example, as the cost of personal genome sequencing rapidly plummets many genetics applications will soon be within reach of individuals such as comparing one?s genome with the genomes of different groups of participants in a study to determine which treatment is likely to be most effective. Such comparisons could have tremendous value, but are currently infeasible because of the privacy concerns both for the individual and study participants. What is needed is a way to produce the result of the comparison without exposing either party's private inputs. The ultimate aim of this project is to make privacy-preserving computation practical and accessible enough to be used routinely in applications such as personalized genetics, medical research, and privacy-preserving biometrics.Theoretical solutions to this problem, known as secure multi-party computation, have been known for several decades, including a general solution developed by Andrew Yao based on garbled circuits. Because of its extensive memory use and computational cost, however, the garbled circuits approach has traditionally been considered more of a theoretical curiosity than a practical mechanism for building privacy-preserving applications. Recent developments in cryptographic techniques and new implementation approaches are beginning to change this, however, and admit the possibility of scalable, practical secure computation. This project is designing methods for avoiding the memory bottleneck associated with garbled circuit evaluation by aggressively pipelining circuit generation and evaluation, and exploring a variety of techniques for reducing the size of garbled circuits. Another issue the limits the use of secure computation in practice is the need for standard protocols to assume an honest-but-curious adversary who always follows the specified protocol. This project is developing new techniques for dealing with malicious adversaries, improving the standard cut-and-choose and commit-and-prove approaches by using new cryptographic tools and exploring an alternate model in which a verifiable trusted party generates the circuit but is not trusted with any private data. The project is also developing techniques to audit the information that can be inferred from the result of a secure computation. Another goal is to make secure computation more accessible to developers by developing programming tools for defining secure computations at a high level, based on information-flow analysis and program partitioning.