Secure comparison protocol based on semi-honest model

Abstract

The application designs a security comparison protocol based on a semi-honest model. The main idea is that the DGK comparison protocol is improved based on zero-knowledge proof and homomorphic encryption algorithm, and the DGK comparison protocol only suitable for the semi-honest model is improved to be suitable for the scene where malicious participants exist, wherein a semi-honest judge is introduced, and the judge calculates the exclusive or part in the protocol in four rounds, and the calculation task originally given to the participants is transferred to the semi-honest judge for calculation, and the judge verifies the zero-knowledge proof for the participants and correctly executes the protocol. Finally, the security analysis shows that the scheme can provide good ciphertext privacy for the participants, and the judge cannot obtain any privacy information about the ciphertext of the participants in the participation process.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of privacy protection, and relates to a secure comparison protocol. BACKGROUND

[0002] In recent years, the in-depth popularization of the Internet has provided a huge development opportunity for secure comparison protocols. Since 1982, Yao Jiezhi proposed the "millionaire problem": how do two millionaires compare who is richer without revealing the wealth value. The proposal of the millionaire problem has attracted widespread attention from scholars. In 1982, Yao first proposed a secure comparison protocol to solve this problem, which was extended by Goldreich and Micali and Wigderson. The secure comparison protocol is a basic module in secure multi-party computation. The secure comparison protocol refers to the ability of participants to secretly compare the size relationship of the input values of both parties without revealing their privacy. The secure comparison protocol is widely used in privacy protection auction, machine learning and electronic voting and other real life fields. In 2008, Damgard et al. proposed the DGK comparison protocol, which formed an effective solution to the millionaire problem: by using an encryption algorithm with the property of additive homomorphism to calculate each bit, the size of the input of both parties can be compared without revealing the privacy, and the protocol has better communication efficiency. However, in the DGK comparison protocol calculation process, the comparison operation in the protocol can only be performed by the two participants, and if there is a malicious participant, the protocol will not be able to execute correctly, that is, the protocol is only secure in the semi-honest participant model. However, in many real-life scenarios, participants are not allowed to perform independent calculations, that is, it is difficult to have a semi-honest participant. Therefore, the scene studied in this paper is a third-party integer comparison protocol, that is, after the participants input their own integers, the comparison calculation task is given to the third party, but the third party cannot obtain the data privacy information, and can only obtain the final comparison result. This paper improves the DGK comparison protocol through zero-knowledge proof and homomorphic encryption technology, so that the improved protocol is not only suitable for the malicious participant model, but also ensures the privacy of the input of the participants. SUMMARY

[0003] This chapter improves the DGK comparison protocol which is only suitable for the semi-honest model into a multi-party comparison protocol suitable for the malicious participant model by introducing a third judge through zero-knowledge proof. The comparison calculation task in the original DGK protocol is given to the third judge. At this time, as long as the semi-honest judge correctly executes the protocol, the size relationship of the privacy input of both parties can be correctly compared without revealing any privacy:

[0004] Step one: homomorphic multiplication. Participants A and B need to encrypt their own plaintext information with a specific encryption algorithm. Then participant B needs to send his encrypted ciphertext E(m b,i ) to participant A. Participant A, after receiving the ciphertext of participant B, performs an exponential operation on the ciphertext of participant B with his own plaintext.

[0005] Step two: homomorphic addition. Participant A performs multiplication operation on the ciphertext of participant B as in the previous stage, so as to achieve the purpose of homomorphic addition. Finally, C a+b and C a*b are obtained. The two results are sent to the judge C.

[0006] Step three: oblivious transfer stage. The judge C decrypts C a+b and C a*b to obtain the addition value and multiplication value of the plaintext of participants A and B, and then calculates the XOR value between the plaintext values Finally, the key comparison bit is found, and the ciphertext value of the key comparison bit {C a,t ', C b,t '} is obtained through the "L transfer 1" oblivious transfer protocol, and the comparison result C * is calculated.

[0007] Step four: result verification. Participants A and B jointly decrypt the comparison result C * . If the decryption result is 0, it proves that m a <m b . BRIEF DESCRIPTION OF DRAWINGS

[0008] Figure 1 Encryption and homomorphic multiplication stage of participants A and B

[0009] Figure 2 Homomorphic addition stage of participant A on the ciphertext of B

[0010] Figure 3 Oblivious transfer stage of the judge C DETAILED DESCRIPTION

[0011] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all embodiments.

[0012] The specific steps of the present application are as follows:

[0013] Step one: homomorphic multiplication. Participants A and B need to encrypt their own plaintext information with a specific encryption algorithm. The ciphertext of participant A after encryption is Similarly, the ciphertext of participant B after encryption is Then participant B needs to send his encrypted ciphertext E(m b,i ) to participant A. Participant A receives the ciphertext from participant B and performs an exponentiation with his own plaintext to get the ciphertext and submits the zero-knowledge proof of the first stage of submission.

[0014] Step two: homomorphic addition. A multiplies the ciphertext of B with his own to get Here A needs to Pedersen commitment bind the submitted C a,i C b,i and send C a+b and C a*b to the judge C. C receives the addition value and multiplication value of each bit of A and B, and then calculates the XOR value according to the following formula.

[0015]

[0016] Find the first l sequence number with XOR value of 1 in order, and mark it as t. At this time, the t-bit sequence number is the key comparison sequence number.

[0017] Step three: A and B generate a joint public key y' = y1*y2 by combining their public keys, and then generate ciphertexts The judge C inputs t. A and B input all C a,i ' and C b,i ', and perform OT protocol calculation. The judge C finally gets the ciphertext of the two key bits of C a,t ' and C b,t '. C * = g*C a,t *C b,t ' can get the value of 1+m a,t -m b,t . Then send C * to A and B for verification.

[0018] Step four: result verification. A and B jointly decrypt C * . If there is 0 in the result, it proves that m a <m b .

Claims

1. A security comparison method based on a semi-honest model, the specific steps being as follows: Step one: participants A and B encryption algorithm encrypt their own plaintext information; The encrypted ciphertext of the participant A is The encrypted ciphertext of the participant B is Then the participant B sends the encrypted ciphertext E(m b,i ) of himself to the participant A; After receiving the ciphertext of the participant B, the participant A performs the exponential operation on the ciphertext of the participant B with his own plaintext, and finally obtains the ciphertext and submits the zero-knowledge proof of the first stage of the submission Step two: A multiplies the ciphertext of B with its own ciphertext to get A sends the submitted C to B a,i C b,i B performs Pedersen commitment binding; and sends C a+b to C a*b C sends to the referee C; C calculates the XOR value after getting the addition value and multiplication value of each bit of A and B: Find the first XOR value of 1 from the sequence number, and mark it as t; at this time, the t-bit sequence number is the key comparison sequence number; Step three: A and B combine their respective public keys to generate a joint public key y'=yl*y2, and A and B use the joint public key y' to generate ciphertexts Judge C inputs t; A and B input all C a,i ' and C b,i ', compute via OT protocol; judge C gets C a,t ' and C b,t ' two key bits of ciphertext; C * = g * C a,t * C b,t ', get 1 + m a,t -m b,t value; then send C * to A and B for verification; Step four: A and B decrypt C * If there is a 0 in the result, then m a <m b .

Images