A distributed function secret sharing key generation method

Abstract

The present application provides a distributed function secret sharing key generation method to solve the problems of dependence on a trusted third party and the limitation of not supporting arithmetic sharing operation in the existing secret sharing key generation scheme, which is a solution for efficient distributed key generation based on improved function secret sharing between two parties without a trusted third party. The protocol designed by the present application supports arithmetic sharing input and output, and by optimizing the communication process, the calculation and communication overheads in the distributed key generation process are greatly reduced under the premise of ensuring the security and accuracy of the calculation. By designing an efficient two-party computation 2PC protocol, the need for a trusted third party is completely removed, allowing participants to directly generate keys for distributed point function DPF and distributed comparison function DCF through the two-party computation protocol, significantly improving the security and practicality of key generation, and being especially suitable for scenarios without a trusted third party.

Description

Technical Field

[0001] This invention relates to information security technology, and in particular to a distributed function secret sharing key generation technology. Technical Background

[0002] Distributed Function Secret Sharing (FSS) key generation is widely used in privacy-preserving computing, machine learning, biometrics, and scientific computing. Its core components include the Distributed Point Function (DPF) and the Distributed Comparison Function (DCF). The DPF is used to collaboratively determine value matching under secret sharing, while the DCF performs data comparison under secret sharing. Together, they form a crucial foundation for secure joint computation. For example, FSS can be used to achieve privacy-preserving distributed computation among different entities in satellite collision prediction, or to distribute the processing of complex activation functions in machine learning, thereby ensuring data privacy.

[0003] Existing FSS key generation protocols face three main problems: First, existing solutions typically rely on a trusted third party to generate keys offline, but finding a universally trusted third party is difficult in reality. Second, most existing third-party-free protocols only support Boolean sharing, not arithmetic sharing, limiting their applicability in many application scenarios involving arithmetic operations. Key generation schemes that address these issues will further expand the application scope of secure computing in everyday service scenarios. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a solution for efficient distributed key generation based on improved function secret sharing in the absence of a trusted third party, addressing the limitations of existing secret sharing key generation schemes that rely on trusted third parties and do not support arithmetic sharing operations.

[0005] The technical solution adopted by this invention to solve the above-mentioned technical problems is a method for generating a distributed function secret sharing key, comprising the following steps:

[0006] Both communicating parties P b The input lengths held respectively are Share target value The output length when matching conditions is Shared output value The communication participant is denoted as P. b Where b∈{0,1} is the participant number, denoted by P 1-b Indicates the other party involved in the communication, <α> b Indicates communication participant P b The target value α, <β> b Indicates communication participant Pb The output value β;

[0007] Both communicating parties P b Call the bit decomposition protocol respectively Share target value Convert to Boolean sharing Indicates communication participant P b Regarding the Boolean sharing of the target value α, B represents Boolean sharing;

[0008] Both communicating parties P b Each starts with a string {0,1} of length λ, consisting of 0 and 1. λ A seed of a spanning tree is randomly sampled from the data. And set the flag value corresponding to the seed. The seed's position in the DPF spanning tree, where the superscript i,j represents the seed of the j-th node in the i-th level. j∈[2 i ];

[0009] Both communicating parties P b Each iteration iterates through each level i, performing the outer loop steps to obtain... The corrected character CW i ;

[0010] Both communicating parties P b Set variables Through pseudo-random group elements functions and seeds The l-th arithmetic sharing intermediate value of each is calculated.

[0011] Both communicating parties P b Each statistics Arithmetic sharing of the median value The sum of w is obtained b ,as well as The flag value corresponding to each seed The sum of these values ​​yields the total value t. b ;

[0012] Both communicating parties P b Each will set the total flag value t b Input a pre-agreed restricted comparison protocol In the process, they received the shared content from each other. And send it to the other party, and receive the shared content sent by the other party. Calculate the actual value of the shared content

[0013] Both communicating parties P bThen, using their respective arithmetic methods, they share the sum of the intermediate values ​​w. b Share output values The two output lengths are calculated as follows: median value and

[0014] Both communicating parties P b Each of the median values and and shared content Input now Bitwise Arithmetic Sharing Multiplexing Protocol Obtain the intermediate value of the key And sent to another party P 1-b A represents arithmetic sharing; obtain the key value.

[0015] Both communicating parties P b Using seeds as well as The corrected character CW i and key value W CW Concatenate to construct secret sharing key k b , in, for The corrected character CW i , || indicates string concatenation.

[0016] More specifically, a specific correction word CW was designed for the Distributed Comparison Function (DCF). i Steps to obtain the information.

[0017] This invention, through the design of an efficient two-party computation (2PC) protocol, completely eliminates the need for a trusted third party, allowing participants to directly generate keys for Distributed Point Function (DPF) and Distributed Comparison Function (DCF) via the two-party computation protocol. It offers significant advantages in applications such as privacy-preserving computation, machine learning training and inference, and biometric recognition, ensuring that participants can securely and efficiently share computational results without trusting a third party, while simultaneously protecting the privacy of their respective data.

[0018] The beneficial effects of this invention are that it significantly improves the security and practicality of key generation, especially suitable for scenarios without a trusted third party. Compared with existing state-of-the-art solutions, this protocol supports arithmetic sharing of input and output, and by optimizing the communication process, it greatly reduces the computational and communication overhead in the distributed key generation process while ensuring the security and accuracy of the computation. Detailed Implementation

[0019] The cryptographic protocols and specific implementation methods involved in this invention are based on the following existing basic algorithms:

[0020] 1) Secret sharing: Secret sharing includes two schemes: arithmetic secret sharing and Boolean secret sharing.

[0021] For arithmetic sharing, if in the ring Share content x, one party randomly selects The value r in the middle, and will Send to the other party. Typically, x in an arithmetic share is represented as... and Where p is a large prime number. The remainder ring modulo p is represented by the superscript A, which indicates an arithmetic share, and the subscript indicates the owner number. The numbers of the communicating parties are identified using 0 and 1. In the embodiment, represents a certain sharing value of A, where A is the target value for sharing.

[0022] For Boolean sharing, if the shared content x is in the ring... In the middle, both parties respectively hold and And satisfy ⊕ indicates XOR. The superscript B indicates Boolean share, and the subscript indicates the owner number.

[0023] In this embodiment, the participating party is denoted as P. b Where b∈{0,1} is the participant number, denoted by P 1-b This refers to the other party involved.

[0024] 2) Function Secret Sharing (FSS): Function Secret Sharing (FSS) is a secure computation scheme that secretly divides a function into two parts. Participants can obtain the secret shared value of the function based on the public input. This scheme is implemented using an algorithm pair (Gen; Eval), where Gen is the key generation algorithm and Eval is the evaluation algorithm.

[0025] Key generation algorithm Gen(1) λ The process receives the security parameter λ and the objective function f as input, and is called by a trusted third party to generate two keys k0 and k1, which are then distributed to P0 and P1 respectively.

[0026] Evaluation algorithm Eval(b,k) b ,x)→f b (x) is invoked by the computer, participant P b Result f b (x), satisfying f0(x)+f1(x)=f(x).

[0027] 3) GGM Tree: The GGM tree is a binary tree structure based on a pseudo-random generator (PRG), used to construct pseudo-random functions and implement secure computation protocols, such as the Distributed Point Function (DPF) and the Distributed Comparison Function (DCF). DPF compares the function input value x with the target value α for equality. DCF compares the function input value x with the target value α for magnitude. The GGM tree starts from the root node s0 and expands layer by layer through the pseudo-random generator G(·) to a binary string G(s0) of twice the length. Each node generates two child nodes, where the left node represents the first half of G(s0) and the right node represents the second half of G(s0), where G represents the PRG. Each layer of expansion progressively generates a complete binary tree based on the 0 or 1 path bits. Each node contains a label and control bits to ensure consistent judgment of path nodes among the participants. For the "special path" containing the target value α, the control bits of each node are set to 1; for other paths, the control bits are 0. In DPF and DCF, the GGM tree uses these labels and control bits to encode the target value, enabling participants to independently compute the pseudo-random function f0(x) + f1(x) = f(x). The correction of the control bits ensures that all parties agree on the input, thus optimizing security and communication efficiency. Correction Word: The correction word is used to adjust the labels and control bits of nodes in the GGM tree to ensure that the generated tree structure satisfies the invariant properties of DPF or DCF. The correction word typically includes correction terms for each level and a final correction word, used to correct nodes that deviate from the target path, ensuring that the output meets the computational requirements of the distributed function.

[0028] 4) Black-box protocol: The following black-box protocol can safely and correctly obtain the corresponding output given the input. It will be used in subsequent algorithms. When making a call, the subscript XXX is used to represent the protocol name, and the superscript Y is determined according to the actual function's functionality.

[0029] a) B2A: B2A (Arithmetic to Boolean) agreement Convert Boolean sharing to Bitwise arithmetic sharing. Protocol input is Boolean sharing. The output is the corresponding arithmetic sharing.

[0030] b) Multiplexer Protocol (MUX): MUX (Multiplexer) protocol accomplish Bit-Boolean sharing multiplexing function; accomplish Bitwise arithmetic shares multiplexing functionality. The input is Boolean sharing And a selection bit <c> B ∈{0,1}. The output is Boolean sharing Satisfy: If c = 0, then z i =x i Otherwise, the result is z i =y i This function is achieved through two parallel Conditional Oblivious Transfers (COT).

[0031] The input is Partial Arithmetic Sharing { <x> l ,<y> l }, and a selection bit

[0032] <c> B ∈{0,1}. The output is Partial Arithmetic Sharing { <z> l }, satisfying: if c = 0, then z i =x i Otherwise, the result is z i =y i This function is achieved through two parallel Conditional Oblivious Transfers (COT).

[0033] c) AND protocol: AND protocol AND The Boolean shared values ​​of x held by both communicating parties.

[0034] <x> B and <y> B After calculation according to the protocol, the result is obtained. <z> B , satisfying z = x ∧ y, where ∧ represents the AND operation.

[0035] d) Bit Decomposition Protocol: The bit decomposition protocol implements the bit decomposition function, that is, decomposing the input shared value into its corresponding Boolean bit shares. Party P b holds a shared value with a length of After the protocol calculation, P b obtains such that y[i] = x[i], where x[i] represents the i-th bit in .

[0036] e) function is a function that maps a random 0-1 string {0, 1} * to a pseudo-random group element , abbreviated as Specifically, generates an element in the group through the pseudo-random generator PRG .

[0037] Based on the above protocol, the present invention proposes a method for generating a secret sharing key of a distributed function. Through the following protocol process, the present invention constructs an efficient and secure multi-party computing framework, ensuring the accuracy of distributed computing while protecting data privacy.

[0038] Restricted Comparison Π CCMP

[0039] Input: P b holds x b , where the difference between x0 and x1 is 1;

[0040] Output: P b obtains where, if x0 < x1, then otherwise y represents the true value of the shared content.

[0041] 1. Each party P b decomposes x b into the high-order bit h b and the low-order bit l b ;

[0042] 2. Each party P b sets and

[0043] 3. Each party P b calculates the intermediate result of the Boolean share

[0044] 4. Each participant P b Final output Distributed Point Function (DPF) Key Generation Input: P b The length of the input is Share target value The output length when matching conditions is Shared output value Output: P b Obtain DPF key k b .

[0045] 1.P b Call enter Get Boolean sharing

[0046] 2.P b From {0,1} λ Sample a random seed And set its flag value This indicates the position of the seed in the spanning tree, where the superscript (0,0) represents the seed of the 0th node in the 0th level;

[0047] 3. Regarding Execute outer loop step 3-16:

[0048] 4.P b Seeds Inputting a pseudo-random generator G yields Reuse Assign a value to the concatenation of the following four values, that is Where j∈[2 i ];

[0049] 5.P b Calculate the value and correction word for each layer:

[0050] 6. For p∈{0,1}, traverse j∈[2... i ], P b Set intermediate value Indicates that for set j Perform XOR;

[0051] 7. For p∈{0,1}, P b Set intermediate value

[0052] 8.P b Call enter Obtain the intermediate value

[0053] 9.P b Set intermediate value And the median value

[0054] 10.P b send To P 1-b To reconstruct σ i ,τ i,0 ,τ i,1 ;

[0055] 11. For j∈[2 i ], Execute inner loop steps 11-14:

[0056] 12.P b set up A←B means assigning a value to A using B;

[0057] 13.P b set up and

[0058] 14. Complete the traversal of j and end the inner loop step;

[0059] 15.P b Set correction word CW i =σ i ||τ i,0 ||τ i,1 Correction of the character CW i The goal is to ensure that the last bit of the random string obtained by each node follows the path of the target control bits, that is, the value of the control bits on the correct path is all 1;

[0060] 16. Complete the traversal of i to obtain... The corrected character CW i End the outer loop step;

[0061] 17. Regarding P b Calculate the median value of arithmetic sharing

[0062] 18.P b set up

[0063] 19.P b Call Input t b ,get

[0064] 20.P b set up

[0065] 21.P b set up

[0066] 22.P b Call enter get Right now This can make P b By sharing the true value of content g Choose one as output Then Send to the recipient, and finally construct the key value.

[0067] 23.P b set up

[0068] 24. Return k b .

[0069] Distributed Comparison Function (DCF) Key Generation

[0070] Input: P b The length of the input is Share target value The output length when matching conditions is Shared output value

[0071] Output: P b Obtain DCF key k b .

[0072] 1.P b Call enter Get Boolean sharing

[0073] 2.P b From {0,1} λ Sample a random seed and set V α =0;

[0074] 3. Regarding Execute outer loop step 3-17:

[0075] 4.P b set up Where j∈[2 i ], and for p∈0,1,

[0076]

[0077] 5. For p∈0,1,P b set up

[0078] 6. For p∈0,1,P b set up

[0079] 7.P b Call enter get

[0080] 8.P b set up and

[0081] 9.P b send To P 1-b To reconstruct σ i ,τ i,0 ,τ i,1 ;

[0082] 10. For j∈[2 i+1 ], P b set up

[0083] 11.P b Call Get (V) CW V α );

[0084] 12.P b Set CW i =σ i ||V CW ||τ i,0 ||τ i,1 ;

[0085] 13. For j∈[2 i ], Execute inner loop steps 13-16:

[0086] 14.P b set up

[0087] 15.P b set up and

[0088] 16. Complete the traversal of j and end the inner loop step;

[0089] 25. Complete the traversal of i, and end the outer loop steps;

[0090] 26. Regarding P b Calculate the median value of arithmetic sharing

[0091] 27.P b set up

[0092] 28.P b Call Input t b ,get

[0093] 29.P b set up

[0094] 30.P b set up

[0095] 31.P b Call enter Right now This can make P b By sharing the true value of content g Choose one as output Then Send to the recipient, and finally construct the key value.

[0096] 32.P b send To P 1-b To reconstruct W CW ;

[0097] 33.P b set up

[0098] 17. Return k b .

[0099] Public Correction Character Generation Input: P b The tree level i to which the correction word is applied, the input vector v for the pseudo-random generator, the control vector t for indicating the branch direction or state vector of each level or each node, and the Boolean share of the input value at the i-th bit. Output sharing when matching positions Output the bit length of β: P b Obtain the common correction word V of the i-th layer CW And the updated V α ;

[0100] 1.P b calculate Where the left and right children are p∈0,1;

[0101] 2.P b set up and call Input t b Get

[0102] 3.P b Call enter Obtain the intermediate value of the additional correction word CW for each layer.

[0103] 4.P b set up

[0104] 5.P b Call enter Get

[0105] α[i] represents the i-th element of α. express Arithmetic sharing of bits below 0;

[0106] 6.P b set up

[0107] 7.P b Call enter Get Among them; that is This can make P b By sharing the true value of content g Choose one as output Then Send to the recipient P 1-b Finally, the intermediate value is constructed.

[0108]

[0109] 9.P b Call enter Get

[0110] 10.P b set up

[0111] 11.P b Will Send to P 1-b To reconstruct V α ;

[0112] 12. Return (V) CW V α ).< / z> < / z> < / c> < / c>

Claims

1. A method for generating a secret sharing key for a distributed function, characterized in that, Includes the following steps: Both communicating parties P b Each holds an input length of l in Share target value The output length when matching conditions is l out Shared output value The communication participant is denoted as P. b Where b∈{0,1} is the participant number, denoted by P 1-b Indicates the other party involved in the communication, <α> b Indicates communication participant P b The target value α, <β> b Indicates communication participant P b The output value β; Both communicating parties P b Call the bit decomposition protocol respectively Share target value Convert to Boolean sharing Indicates communication participant P b Regarding the Boolean sharing of the target value α, B represents Boolean sharing; Both communicating parties P b Each starts with a string {0,1} of length λ, consisting of 0 and 1. λ A seed of a spanning tree is randomly sampled from the data. And set the flag value corresponding to the seed. This indicates the position of the seed in the DPF spanning tree, where the superscript i,j represents the seed of the j-th node in the i-th level, i∈[l... in ],j∈[2 i ]; Both communicating parties P b Each iteration iterates through each level i, performing the outer loop steps to obtain l. in The corrected character CW i ; Both communicating parties P b Set variables Through pseudo-random group elements functions and seeds The l-th arithmetic sharing intermediate value of each is calculated. Both communicating parties P b Each statistics Arithmetic sharing of the median value The sum of w is obtained b ,as well as The flag value corresponding to each seed The sum of these values ​​yields the total value t. b ; Both communicating parties P b Each will set the total flag value t b Input a pre-agreed restricted comparison protocol In the process, each person receives their own shared content. And send it to the other party, and receive the shared content sent by the other party. Calculate the actual value of the shared content Both communicating parties P b Then, using their respective arithmetic methods, they share the sum of the intermediate values ​​w. b Share output values Calculate the two output lengths of l out median value and Both communicating parties P b Each of the median values and and shared content Enter l out Bitwise Arithmetic Sharing Multiplexing Protocol Obtain the intermediate value of the key And sent to another party P 1-b A represents arithmetic sharing; obtain the key value. Both communicating parties P b Using seeds and l in The corrected character CW i and key value W CW Concatenate to construct secret sharing key k b , in, For l in The corrected character CW i , || indicates string concatenation; Among them, restricted comparison protocol for: Both communicating parties P b Each will t b Decomposed into high-order h b and low position l b ;t b Indicates participant P b Input to restricted comparison protocol Data; Both communicating parties P b Each sets two intermediate values ​​z0 and z1 for Boolean sharing. and Both communicating parties P b Applications and Protocols Calculate the intermediate results of each Boolean sharing. Both communicating parties P b Each receives a restricted comparison protocol Output of shared content 2. The method as described in claim 1, characterized in that, For a distributed point function (DPF), the two communicating parties P b Each iteration iterates through each level i, performing the outer loop steps to obtain l. in The corrected character CW i The specific steps are as follows: For i∈[l] in ], the two communicating parties P b Each of them put the seeds Inputting a pseudo-random generator G yields intermediate values Then use intermediate values For seeds and and corresponding flag values and Assign values ​​to the connections. Traversing j∈[2 i ]; P b Calculate the value and correction word for each layer: For left and right child labels p∈{0,1}, P b Set intermediate value in, Indicates that under set j Perform XOR; set intermediate value P b enter and Up to λ-bit Boolean sharing multiplexing function Input to get intermediate value in This represents the Boolean share of the i-th bit of the target value α; P b Using intermediate values Calculate the intermediate value and median value P b Send intermediate value To P 1-b Receive intermediate values ​​sent by the other party Reconstructing the intermediate value σ i ,τ i,0 ,τ i,1 ; For j∈[2] i The inner loop begins executing steps to update the seed. and and corresponding flag values and P b calculate Update calculate Complete the iteration over j, and end the inner loop step; P b Calculate the corrected word CW i =σ i ||τ i,0 ||τ i,1 ; After completing the traversal of i, we obtain l. in The corrected character CW i End the outer loop step.

3. The method as described in claim 1, characterized in that, For the Distributed Comparison Function (DCF), the communicating parties P b Each iteration iterates through each level i, performing the outer loop steps to obtain l. in The corrected character CW i The specific steps are as follows: For i∈[l] in ], the two communicating parties P b Each of them put the seeds Inputting a pseudo-random generator G yields intermediate values Then use intermediate values Q i+1,2j ||Q i+1,2j+1 Assignment, Where j∈[2 i ]; Reusing the obtained Q i+1,2j+p right Assignment, where Given a string of length λ, where p ∈ {0, 1}, × indicates the concatenation symbol for the string length; P b Both communicating parties calculate the intermediate value by performing an XOR operation on set j. and median value p∈{0,1}; P b Both communicating parties will each give the intermediate value and median value Input to λ-bit Boolean shared multiplexing function In the middle, the intermediate value is obtained. P b Using intermediate values Calculate the intermediate value and median value P b Send intermediate value To P 1-b Receive the executive producer sent by the other party Reconstructing the intermediate value σ i ,τ i,0 ,τ i,1 ; For j∈[2] i+1 ], P b Set the input vector v for the pseudo-random generator and the control vector t for indicating the branch direction or state vector, where Will V α Input common correction word generation protocol ComputeCW, ComputeCW output (V CW V α ), where V CW For public correction, V α For the median value, input the median value V of ComputeCW. α Initially set to 0; P b Set correction word CW i =σ i ||V CW ||τ i,0 ||τ i,1 ; For j∈[2] i The inner loop begins executing steps to update the seed. and and corresponding flag values and P b calculate Update calculate Complete the iteration over j, and end the inner loop step; Complete the iteration over i, then end the outer loop steps.

4. The method as described in claim 3, characterized in that, Will V α Input common correction word generation protocol ComputeCW, ComputeCW output (V CW V α The specific process is as follows: For left and right child labels p∈{0,1}, P b For set j, use pseudo-random group elements The function and the input vector v are used to calculate the intermediate value. P b The intermediate value is calculated by summing the values ​​of set j. The intermediate value t b Input-restricted comparison protocol middle, Output and share content P b Will and Enter l out Bitwise Arithmetic Sharing Multiplexing Protocol Obtain the intermediate value P b Update the intermediate value again P b Will <α[i]> b Enter l out Bitwise Arithmetic Sharing Multiplexing Protocol Obtain the intermediate value Indicate l out Arithmetic sharing of bits below 0; P b Using intermediate values V α and Calculate the intermediate value and P b median value and and shared content Enter l out Bitwise Arithmetic Sharing Multiplexing Protocol Obtain the intermediate value And sent to another party P 1-b Then based on the received Construct intermediate values P b Shared content Enter l out Bit-Boolean Conversion Arithmetic Sharing Protocol Get shared content P b Calculate the intermediate value And sent to another party P 1-b Then based on the received Construct intermediate values P b ComputeCW output (V CW V α ).

Images