Privacy-preserving computation over a large and small ring

Abstract

The invention relates to a cryptographic system (010) performing a cryptographic secure multi-party computation, using secret sharing over a large ring and over a small ring. A first set of parties generates a mask value; inputs a binary representation of (part of) the mask value over the small ring; and inputs the mask value over the large ring. The parties determine a masked value over the large ring by masking an input value according to the mask value; and open the masked value to a second subset of the parties, such that the first set of parties do not learn the input value. The second set of parties inputs a binary representation of (part of) the masked value into the multi-party computation over the small ring. The parties perform a computation over the small ring on the binary representation of (part of) the masked value and the mask value.

Description

[0001] PRIVACY-PRESERVING COMPUTATION OVER A LARGE AND SMALL RING

[0002] FIELD OF THE INVENTION

[0003] The invention relates to cryptographic systems for performing a privacypreserving computation on secret data. The invention further relates to cryptographic devices for use in such systems; to corresponding computer-implemented methods; and to a computer-readable medium.

[0004] BACKGROUND OF THE INVENTION

[0005] There is a growing demand for privacy enhancing technologies (PETs), e.g., data processing techniques that intrinsically protect the privacy of the data they operate on. For example, with the cryptographic technique of secure multi-party computation (MPC), multiple parties can perform a computation on their joint input using a distributed cryptographic protocol, such that each party learns nothing beyond the output of computation and his own (private) input.

[0006] One reason for the growing demand for PETs is that citizens are becoming increasingly dependent on the digital information stored about them by various companies and institutions. Because of this increasing dependence, the consequences of a breach of personal data are getting increasingly severe. And due to the worldwide surge of cybercrime and nation-state-sponsored cyber espionage, the risk of a data breach has increased sharply in recent years. Also, data-based collaborations between separate entities (like companies, hospitals, local governments) usually implies that personal data is copied between the entities, which poses the risk of uncontrolled spreading of data, in particular personal information. PETs can enable data collaboration between entities without the need for sharing the data in clear-text form. Another factor driving demand for PETs is the emergence of legal frameworks for data protection, such as the European GDPR and the Californian CCPA legislation, and their mandatory compliance. In the context of such frameworks, PETs are valuable as technical safeguards, and typically provide concrete instantiations of abstract legal notions.

[0007] In cryptographic secure multi-party computation (MPC), a computation is performed in a distributed way between multiple parties in such a way that the inputs, intermediate values, and / or outputs of the computation remain hidden from the parties performing the computation. Such values that remain hidden from the parties may be referred to as the secret values of the MPC. In particular, in multi-party computation, secret values may be distributed among the cryptographic devices as secret shares, also referred to herein simply as "shares". The shares of the respective parties may have the property that a limited number of parties, up to a given threshold, does not know the secret value. However, a number of parties that exceeds the threshold may be able to derive the secret value. The values that are shared are typically defined over a mathematical ring: a set of values with an addition operation and a multiplication operation. Although the term "secret share" is most commonly used for MPC techniques using so-called arithmetic secret sharing, also other MPC techniques such as garbled circuits are considered herein to operate on secret shares, in line with the paper "ABY - A Framework for Efficient Mixed- Protocol Secure Two-Party Computation" cited below.

[0008] For reasons of computational efficiency, when performing a computation using MPC it can be beneficial to perform different parts of the computation over different rings. For example, addition and multiplication of numbers can be performed efficiently over a ring in which these numbers can be represented directly. To perform for example an arithmetic comparison, such as a greater-than comparison, it can however be more efficient to use a binary representation of that number with bits for example in the ring {0, 1}.

[0009] The paper "ABY - A Framework for Efficient Mixed-Protocol Secure Two- Party Computation" by D. Demmler et al., proceedings NFSS'15 provides MPC techniques in the two-party setting to convert between an additive sharing of a value modulo 2Ak; and boolean and Yao sharings of the bits of the value, e.g., in the ring {0, 1}. The paper "ABY3: A Mixed Protocol Framework for Machine Learning" by P. Mohassel and P. Rindal, proceedings CCS'18, provides MPC techniques in the three-party setting to convert between replicated secret sharings of a value modulo 2Ak; and replicated and Yao sharings of the bits of the value, e.g., in the ring {0, 1}.

[0010] SUMMARY OF THE INVENTION

[0011] It would be desirable to provide cryptographic techniques to perform a multiparty computation involving computations over a large and a small ring, that have a wider applicability and / or an improved efficiency in terms of communication and / or computation.

[0012] In accordance with a first aspect of the invention, a cryptographic system for performing a privacy-preserving computation is provided, as defined by claim 1. In accordance with a further aspect of the invention, a cryptographic system for performing a privacy-preserving computation is provided, as defined by claim 12. In accordance with further aspects of the invention, cryptographic devices are provided for use in such systems, as defined by claims 10 and 13, respectively. In accordance with further aspects of the invention, cryptographic methods are provided of performing such a privacy-preserving computation, as defined by claims 11 and 14, respectively. In accordance with an aspect of the invention, a computer-readable medium is provided, as defined by claim 15.

[0013] Various embodiments relate to a multi-party computation that uses secret sharing over a large ring R1 and over a small ring R2. Here, the terms "large" and "small" are meant to signify that the ring R1 has more elements than the ring R2. The large ring is not restricted to being the ring of integers modulo 2Ak, and in fact, it is preferred to use the field of integers modulo a prime p.

[0014] The small ring can be the ring {0,1}. For example, the multi-party computation over the small ring can use an additive or replicated sharing, or can be performed using garbled circuits using a Yao sharing as defined e.g. in "ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation" by D. Demmler ef al. (incorporated herein insofar as the definition of Yao sharing is concerned). However, the small ring is not restricted to being the ring {0,1}, and in fact, in many embodiments, the field of four elements GF4 is used. In particular, interestingly, by not using integers modulo 2Ak and ring {0,1}, the provided techniques may be used in combination with Shamir secret sharing, as discussed in more detail elsewhere. Various examples for the large and small rings are given throughout this specification.

[0015] Various embodiments relate to converting a secret-sharing of an input value over the large ring, to the small ring.

[0016] Interestingly, the conversion may make use of a mask value that is known by a first subset of one or more of the cryptographic devices that participate in the multi-party computation; but not by one or more other cryptographic devices. The cryptographic devices of the first subset may generate the mask value, and may input the mask value into the multi-party computation over the large ring. The cryptographic devices may further input a binary representation of at least part of the mask value, e.g., the lower k bits of the mask value for a given k, into the multi-party computation over the small ring. Accordingly, a representation of (part of) the same mask value, both over the small ring, and over the small ring, may be obtained. Interestingly, by letting the mask value be input by device(s) that know the value, it may be avoided to perform a distributed random generation, a conversion of the mask value from the small ring to the large ring or the other way around, or the like.

[0017] Having obtained the sharings of the mask value, the cryptographic devices may, using the multi-party computation over the large ring, determine a masked value by masking the input value according to the mask value. Typically, the masking may be performed by addition or subtraction of the mask value to or from the input value, or by another form of masking that can be evaluated efficiently over the large ring. Interestingly, since the mask value may be known only to the first subset of the cryptographic devices, the masked value may statistically hide the input value at least to other devices that do not belong to this subset. This may allow the cryptographic devices to open the masked value to one or more of the devices, in such a way that the first set of devices do not learn the input value. In particular, the mask value may be opened to a second subset of the cryptographic devices that is disjoint from the first set of devices. This way, the devices of the first subset may not learn information about the input value since the mask value is not opened to them; and the devices of the second subset may not learn information about the input value since the input value is not known to them. Another option is to apply a further masking with a mask unknown to devices of the first subset: this way, it is possible to open the mask value to a second subset of devices that is not disjoint with the first subset, e.g., it is possible to open the masked value to all devices.

[0018] Thus, an opening of the masked value to the second subset of devices may be performed, without revealing the input value to the cryptographic devices. This can be sufficient in the threshold one setting, where devices of the multi-party computation are assumed not to collude with each other. This is the preferred setting for the provided techniques. To make the multi-party computation resistant against colluding attackers, the opening of the masked value may be performed such that any set of cryptographic devices of size up to the threshold, or any other set of possibly colluding attackers according to the attacker model of the multi-party computation, does not learn the input value. For example, multiple masks may be used as discussed in more detail elsewhere in this specification.

[0019] Because the devices of the second subset may learn the masked value, these devices may determine a binary representation of at least part of the masked value, for example the lowest k bits for a given ; and may input the binary representation into the multi-party computation over the small ring. Accordingly, interestingly, a secret-sharing of the binary representation may be obtained, without the need to perform a bit decomposition of the masked value under the multi-party computation.

[0020] As a result of the conversion, the cryptographic devices involved in the multiparty computation may obtain binary representations of at least part of the masked value and of at least part of the mask value; for example, of their lower k bits, as secret-shares over the small ring. The devices can use these representations to compute a binary representation of the input value. This provides an efficient conversion to this binary representation. Interestingly, it is also possible to perform various other computations using the multi-party computation over the small ring, bypassing the computation of the binary representation of the input value, as discussed in more detail elsewhere. The number of bits of the mask value and the masked value to be input into the multi-party computation over the small ring, may be selected based on a known upper bound k on the bit length of the input value. However, it is also possible to set k equal to the bit length of the large ring, e.g., the binary representations may be of the full mask value and the full masked value.

[0021] The provided conversion techniques are advantageous for various reasons. The conversion is efficient, because it avoids for example computing on secret shares of the bits of the masking value or masked value in the large ring. Further, since the size of the part of the mask value that is input into the small ring, may be selected based on the bit length of the input, an efficient conversion may be obtained in particularly for relatively small inputs, say, with bit length at most half or at most a quarter of the bit length of the large ring. The conversion can use a different secret-sharing scheme than additive or replicated secret sharing, and / or can use a different ring than the ring of integers modulo 2Ak. In particular, because it is not needed to use the ring of integers modulo 2Ak, it is possible to use the provided techniques in combination with Shamir secret sharing. Indeed, Shamir secret sharing cannot be used directly in combination with the ring of integers modulo 2Ak, since this ring is not a field.

[0022] In particular, it may be noted that the techniques of "ABY3: A Mixed Protocol Framework for Machine Learning" cannot be used as efficiently with a modulus other than 2Ak. In particular, the used addition circuit would need to be replaced by a bitwise computation of a modular addition according to this modulus. Interestingly, the provided conversion techniques allow such a modular addition to be avoided in many cases, since the masked value may be chosen such that the computation of the masked value from the input value does not involve a modular reduction.

[0023] Optionally, the second set of devices may be disjoint from the first set of devices. This way, the second set of devices may learn the masked value but not the mask value. This is one way of achieving that the devices from the second set do not learn the input value.

[0024] However, other ways of achieving this are possible as well. For example, the input value may be further masked according to a further mask value, generated by a third subset of the cryptographic devices such that the first and third subsets of the cryptographic devices do not overlap. This way, since the masked value may be masked both by the mask value and the further mask value, the masked value may leak the input neither to the first subset of cryptographic devices nor to the third subset of cryptographic devices, and in particular, the masked value can be opened to all of the cryptographic devices. In this latter example, the devices of the third subset may input a binary representation of at least part of the further mask value into the multi-party computation over the small ring; and may input the further mask value into the multi-party computation over the large ring. The cryptographic devices may then perform a computation on the binary representations of at least part of the masked value, the mask value, and the further mask value, for example, to compute a binary representation of the input value by unmasking the input according to the mask value and the further mask value.

[0025] Optionally, the input value may be masked by performing an arithmetic addition or subtraction based on the input value and the mask value. The arithmetic addition or subtraction may be the addition or subtraction operation of the large ring. Such a masking can be implemented particularly efficiently in the large ring. For example, it compares favourably to performing an XOR with bits of the mask value in the large ring, which may use computation and / or communication scaling both in the size of the ring and the size of the mask value. Also the unmasking, or other follow-up computation in the small ring, can be performed reasonably efficiently when using addition or subtraction.

[0026] Optionally, the large ring may be a prime field, for example, of at least 30, at least 60, or at least 90 bits. It is noted that various existing techniques use as the large ring the integers modulo a power of two, which is not a field. In particular, the secret sharing over the large ring may be a Shamir secret sharing, which may use a field. Interestingly, in the prime field setting, the provided techniques are particularly beneficial in terms of efficiency, since both the conversion and the follow-up computation on the binary representations of the mask value and the masked value, can be implemented without a modular addition or subtraction being performed on the bitwise representations of numbers.

[0027] Optionally, the small ring may be the ring of two elements, the field of four elements, or the field of eight elements. For example, the ring of two elements {0,1} may be used in combination with additive or replicated secret sharing. The ring of two elements is beneficial because of computational, communication, and storage efficiency. Using the field GF4 of four elements is advantageous because it can be combined with Shamir secret sharing, for example with three cryptographic devices; while still providing the same or similar performance as {0,1} in terms of communication and storage. The field GF8 of eight elements provides similar advantages and can be used for example in combination with Shamir secret sharing with more than three cryptographic devices.

[0028] Optionally, the mask value and / or the binary representation of (the part of) the mask value may be input by the devices of the first subset by a local computation. Instead or in addition, the binary representation of (the part of) the masked value may be input to the second subset using a local computation. As is known per se, depending on the secret- sharing scheme used, it is possible for a subset of parties to input a value into the multi-party computation by a local computation, e.g., without communication being needed between the cryptographic devices, e.g., by fixing the shares of the parties that are not in the subset, and computing the remaining shares based on the fixed shares and the value to be shared. The number of devices of the first and / or second subset may be chosen such that a local computation input is possible, e.g., two out of three devices, three out of five devices, etc, in the case of honest-majority multi-party computation.

[0029] Optionally, the mask value may be generated such that it statistically hides the input value for devices that do not know the mask value. For example, if the bit length k of the mask value is smaller than the bit size of the large ring, then the mask value may be generated as a ( + / )-bit random value in order to statistically hide the input value, where I is a statistical security parameter. Interestingly, it may suffice to only include the lower k bits in the binary representations of the mask and masked value that are input. The mask value may be configured such that applying the masking does not involve a modulo reduction in the large ring. This way, unmasking over the small ring, as well as other follow-up computations, may be implemented relatively efficiently. Adding additional bits for statistical security is not needed when the mask value itself already hides the input value, e.g., if the mask value is selected uniformly randomly from the large ring.

[0030] Optionally, as the computation that is performed over the binary representations of (parts of) the masked value and the mask value, the masked value may be unmasked according to the mask value. For example, the unmasking may comprise performing the addition or subtraction operation of the large ring on bits over the small ring. For this, techniques that are known per se such as ripple carry add can be used. Interestingly, by performing subtraction as masking, the unmasking may be implemented as addition, avoiding the need to perform subtraction on bits.

[0031] Optionally, as the computation that is performed over the binary representations of (parts of) the masked value and mask value, an equality comparison of the mask value and the masked value may be performed. The equality comparison may be performed by comparing the respective bits of the binary representations, and outputting whether the respective bits are the same. Accordingly, the equality comparison can be performed efficiently by avoiding unmasking.

[0032] Optionally, as the computation that is performed over the binary representations of (parts of) the masked value and the mask value, an arithmetic comparison of the mask value and the masked value may be performed. The output of the arithmetic comparison may represent one or more of: whether the input value is greater than; greater-than-equal; less than; or less-than-equal than a constant, e.g., than zero. Interestingly, by performing the comparison directly on the binary representations of (parts of) the mask value and the masked value, also in this case, a particularly efficient implementation may be obtained by avoiding the need to unmask the masked value.

[0033] Various embodiments relate to converting a secret-sharing of a binary representation of an input value over the small ring, to the large ring. This conversion can be performed analogously to the conversion in the other direction. Unless otherwise noted, options available for the large-ring-to-small-ring conversion, such as the choice of the large and small ring; the selection of first, second, and / or third subsets of devices; the use of addition or subtraction as a masking operation; and the use of local computation inputs, apply to the small-ring-to-large-ring conversion as well.

[0034] To perform the small-ring-to-large-ring conversion, the cryptographic devices of a first subset may generate a mask value. For example, the mask value may be generated as a random -bit value, where k is an upper bound on the bit length of the input value. Interestingly, since this conversion may be performed without statistically hiding masking, any value of k, from 1 up to and including the bit length of the large ring, may be possible. The cryptographic devices of the first subset may input a binary representation of the mask value into the multi-party computation over the small ring; and may input the mask value into the multi-party computation over the large ring, for example, using local computation inputs. As above, letting the mask be input by devices that know the value itself, may make it unnecessary to determine the mask in a less efficient way, e.g., by generating the mask bits randomly in a distributed way.

[0035] Using the multi-party computation over the small ring, a masked value may be determined by masking the input value according to the binary representation of the mask value, for example by performing the addition or subtraction operation of the large ring as a binary circuit in the large ring. When using addition or subtraction, the masking may optionally output a carry value representing whether the masking resulted in an overflow or underflow.

[0036] The masked value may then be opened to a second subset of the devices, such that the first set of devices do not learn the input value. For example, as also discussed for the large-ring-to-small-ring conversion, the second subset of the devices may be disjoint from the first set of devices, or the masking may involve a further mask value known by a third subset of the devices.

[0037] Having obtained the bits of the masked value, the cryptographic devices of the second subset may input the masked value into the multi-party computation over the large ring. Interestingly, by letting the masked value be input by a set of devices that know the value, as opposed e.g. to performing a multi-party computation protocol that leaves the masked value hidden, an efficient conversion may be obtained, while the masking may ensure that the masked value does not reveal information about the input value to any device.

[0038] Using the multi-party computation over the large ring, a secret sharing of the input value may be computed based on the masked value and the mask value. For example, an arithmetic addition or subtraction over the large ring may be performed, optionally using a carry value. The carry value, which may provide partial information about the input value, may be converted from the small ring to the large ring without revealing it to any device.

[0039] Similarly to the conversion in the other direction, the provided small-to-large- ring conversion has a number of advantages. It is efficient by avoiding operations on bits in the large ring, and because it scales largely in the size of the input instead of the size of the large ring. Further, no particular secret sharing scheme or large ring size may be needed, e.g., the provided techniques may be applied in combination with a large ring whose size is not a power of two, and / or in combination with Shamir secret sharing. Also, the need to perform modular addition or subtraction over bits in the small ring, can be avoided.

[0040] It will be appreciated by those skilled in the art that two or more of the above- mentioned embodiments, implementations, and / or optional aspects of the invention may be combined in any way deemed useful. Modifications and variations of any system and / or any computer readable medium, which correspond to the described modifications and variations of a corresponding computer-implemented method, can be carried out by a person skilled in the art on the basis of the present description, and the other way round as well.

[0041] BRIEF DESCRIPTION OF THE DRAWINGS

[0042] These and other aspects of the invention will be apparent from and elucidated further with reference to the embodiments described by way of example in the following description and with reference to the accompanying drawings, in which:

[0043] Fig. 1 shows a cryptographic device;

[0044] Fig. 2 shows a cryptographic system;

[0045] Fig. 3 shows a detailed example of converting an input value;

[0046] Fig. 4 shows a detailed example of performing an arithmetic addition;

[0047] Fig. 5 shows a detailed example of converting an input value;

[0048] Fig. 6 shows a detailed example of performing an equality comparison;

[0049] Fig. 7 shows a detailed example of performing an arithmetic comparison;

[0050] Fig. 8 shows a detailed example of converting an input value;

[0051] Fig. 9 shows a computer-implemented method;

[0052] Fig. 10 shows a computer-implemented method; Fig. 11 shows a computer-readable medium comprising data.

[0053] It should be noted that the figures are purely diagrammatic and not drawn to scale. In the figures, elements which correspond to elements already described may have the same reference numerals.

[0054] DETAILED DESCRIPTION OF EMBODIMENTS

[0055] Fig. 1 shows a cryptographic device 100 for use in a cryptographic system as described herein, e.g., in Fig. 2. The cryptographic system may be for performing a privacypreserving computation on secret data. The computation may be performed as a cryptographic secure multi-party computation between multiple cryptographic devices, including device 100. The multi-party computation may use secret sharing over a large ring and over a small ring. The large ring may have more elements than the small ring. The set of multiple cryptographic devices may comprise a first subset of devices and a second subset of devices. Cryptographic device 100 may be comprised in the first subset; the second subset; neither; or both.

[0056] The device 100 may comprise a data interface 120 for accessing data 030 representing a secret-sharing of an input value over the large ring. Instead or in addition, data interface 120 may be for accessing data 030 representing a secret-sharing of a binary representation of at least part of an input value over the small ring. For example, as also illustrated in Fig. 1 , the input interface may be constituted by a data storage interface 120 which may access the data 030 from a data storage 021. For example, the data storage interface 120 may be a memory interface or a persistent storage interface, e.g., a hard disk or an SSD interface, but also a personal, local or wide area network interface such as a Bluetooth, ZigBee or Wi-Fi interface or an ethernet or fibreoptic interface. The data storage 021 may be an internal data storage of the system 100, such as a hard drive or SSD, but also an external data storage, e.g., a network-accessible data storage. In some embodiments, respective data may each be accessed from or distributed across different data storages, e.g., via a different subsystem of the data storage interface 120. Each subsystem may be of a type as is described above for data storage interface 120.

[0057] The device 100 may further comprise a processor subsystem 140 which may be configured to, during operation of the system 100, perform a conversion from the large ring to the small ring. To this end, processor subsystem 140 may be configured to obtain as input of the multi-party computation from the first subset of the cryptographic devices: a binary representation of at least part of a mask value in the small ring, and the mask value in the large ring. Further, processor subsystem 140 may be configured to, using the multi-party computation over the large ring, determine a masked value by masking the input value 040 according to the mask value. Processor subsystem 140 may be further configured to open the masked value to the second subset of the devices, such that the first set of devices do not learn the input value. Processor subsystem 140 may be further configured to obtain as input of the multi-party computation from the second subset of the cryptographic devices: a binary representation of at least part of the masked value over the small ring. Processor subsystem 140 may be further configured to perform a computation on the binary representations of at least part of the masked value and the mask value, using the multiparty computation over the small ring; for example, a computation of a binary representation of the input.

[0058] Instead or in addition, the processor subsystem 140 may be configured to, during operation of the system 100, perform a conversion from the small ring to the large ring. To this end, the processor subsystem 140 may be configured to obtain as input of the multi-party computation from the first subset of the cryptographic devices: a mask value in the large ring, and a binary representation of the mask value in the small ring. Processor subsystem 140 may be further configured to, using the multi-party computation over the small ring, determine a masked value by masking the input value 040 according to the binary representation of the mask value. Processor subsystem 140 may be further configured to open the masked value to the second subset of the devices, such that the first set of devices do not learn the input value. Processor subsystem 140 may be further configured to obtain as input of the multi-party computation from the second subset of the cryptographic devices: the masked value in the large ring. Processor subsystem 140 may be further configured to compute, using the multi-party computation, a secret sharing of the input value based on the masked value and the mask value.

[0059] As also discussed with respect to Fig. 3, the device 100 may be further configured to provide inputs to the multi-party computation, e.g., to input the input value 040 in the large ring and / or the binary representation of the input value 040 in the small ring. Instead or in addition, the device 100 may be further configured to obtain outputs from the multi-party computation, e.g., to obtain the input value as a binary representation in the small ring or as a value in the large ring, or to obtain a value derived therefrom.

[0060] The system 100 may also comprise a communication interface 180 configured for communication 126 with at least one further cryptographic device of the cryptographic system. Communication interface 180 may internally communicate with processor subsystem 140 via data communication 125. Communication interface 180 may be arranged for direct communication with the other devices, e.g., using USB, IEEE 1394, or similar interfaces. As illustrated in the figure, communication interface 180 may also communicate over a computer network 099, for example, a wireless personal area network, an internet, an intranet, a LAN, a WLAN, etc. For instance, communication interface 180 may comprise a connector, e.g., a wireless connector, an Ethernet connector, a Wi-Fi, 4G or 4G antenna, a ZigBee chip, etc., as appropriate for the computer network. Communication interface 180 may be an internal communication interface, e.g., a bus, an API, a storage interface, etc.

[0061] In general, each device described in this specification, including but not limited to the system 100 of Fig. 1 may be embodied as, or in, a single device or apparatus, such as a workstation or a server. The device may be an embedded device. The device or apparatus may comprise one or more microprocessors which execute appropriate software. For example, the processor subsystem of the respective system may be embodied by a single Central Processing Unit (CPU), but also by a combination or system of such CPUs and / or other types of processing units. The software may have been downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash. Alternatively, the processor subsystem of the respective system may be implemented in the device or apparatus in the form of programmable logic, e.g., as a Field-Programmable Gate Array (FPGA). In general, each functional unit of the respective system may be implemented in the form of a circuit. The respective system may also be implemented in a distributed manner, e.g., involving different devices or apparatuses, such as distributed local or cloud-based servers.

[0062] Fig. 2 shows a cryptographic system 010 for performing a privacy-preserving computation as a cryptographic secure multi-party computation. The computation may comprise performing a large-ring-to-small-ring conversion and / or small-ring-to-large-ring conversion, as described in more detail elsewhere. The cryptographic system 010 may in general comprise multiple input devices, multiple different cryptographic devices, and at least one result device, where the sets of input, cryptographic, and result devices may overlap with each other. As illustrated, the devices typically communicate over a computer network 099, e.g., the internet or a local network.

[0063] In particular, shown in the figure are three cryptographic devices CP1 , 221 ; CP2, 222; and CP3, 223. The cryptographic devices may be based on cryptographic device 100 of Fig. 1. The number of cryptographic devices that is used can vary depending on the particular technique used for the multi-party computation and the security properties which are desired. For example, the number of cryptographic devices CPi can be two, three, or more.

[0064] The cryptographic devices CPi may be configured to perform a secure multiparty computation (also known per se as multi-party computation, secure computation, or MPC). Throughout this specification, the cryptographic devices participating in a multi-party computation may also be referred to as "parties" of the multi-party computation. Generally, a multi-party computation may be a distributed protocol between the cryptographic devices for performing a computation in a privacy-preserving way. Depending on the specific technique used, MPC may ensure privacy and / or correctness of the computation against an attacker that eavesdrops or controls one or more (but typically not all) of the cryptographic devices. As known per se, any computation can be performed as a multi-party computation (in other words, “under the multi-party computation”), but concrete computational and communication efficiency can in general greatly depend on how exactly the computation is performed.

[0065] In particular, the multi-party computation can be performed based on secret sharing, in particular arithmetic secret sharing such as Shamir secret sharing, replicated secret sharing, or additive secret sharing. For example, the multi-party computation can be based on the techniques described in Shamir, “How to Share a Secret”, Communications ACM, 1979; Ben-Or, Goldwasser, Wigderson, “Completeness Theorems for NonCryptographic Fault-Tolerant Distributed Computation (Extended Abstract)”, Proceedings of the 20th Annual ACM Symposium on Theory of Computing, 1988; Chaum, Crepeau, Damgaard, “Multiparty Unconditionally Secure Protocols (Extended Abstract)”, Proceedings of the 20th Annual ACM Symposium on Theory of Computing, 1988; Ito, Saito, Nishizeki, “Secret sharing scheme realizing general access structure”, Electronics and Communications in Japan (Part III: Fundamental Electronic Science), 1989; Damgaard, Pastro, Smart, Zakarias, “Multiparty Computation from Somewhat Homomorphic Encryption”, proceedings CRYPTO 2012.

[0066] The multi-party computation over the large ring can be performed according to the above-described techniques, or can alternatively be based on garbled circuits, e.g., see Yao, “Protocols for Secure Computations (Extended Abstract)”, 23rd Annual Symposium on Foundations of Computer Science, Chicago, 1982;

[0067] Various higher-level operations such as sorting and fixed-point arithmetic can be performed based on such basic multi-party computation protocols as discussed e.g. in M. Keller, "MP-SPDZ: A Versatile Framework for Multi-Party Computation", proceedings ACM CCS 2020; or as implemented in MPyC, see https: / / github.com / lschoe / mpyc.

[0068] The multi-party computation may be configured to perform operations on so called sharings, or secret shares, of values. A secret share may be a distributed representation of an input, intermediate, or output value of the MPC. A limited number of shares, up to a certain threshold t, may not allow deriving the represented value. The threshold may be configurable, with different techniques supporting different possible threshold. For example, the multi-party computation may be an honest majority MPC, where the threshold t is strictly smaller than half the number of parties n, e.g., 1 / 2 (n - 1). Or, the multi-party computation can be a full-threshold MPC, where the threshold can be higher, e.g., n - 1. Examples of sharings are arithmetic sharing, such as Shamir secret sharing or replicated secret sharing; XOR sharing; or Yao sharing. It is stressed that the term secret sharing in this specification also includes Yao sharings, e.g., secret values of an MPC computation performed using garbled circuits, as also done in “ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation”.

[0069] Generally, the values of a secret sharing may be defined over a mathematical ring, e.g., a set endowed with two binary operations called addition and multiplication such that the ring is an abelian group with respect to the addition operator, and the multiplication operator is associative, is distributive over the addition operation, and has a multiplicative identity element.

[0070] In particular, the techniques described herein may use secret sharing over a large ring and over a small ring. The large ring can for example have at least 2A30, at least 2A60, or at least 2A90 elements. The large ring can be a prime field, e.g., the integers modulo p where p is a prime. In this case, for example, Shamir secret sharing can be used.

[0071] The small ring can for example be the ring F2 of two integers {0,1}, the field GF4, or the field GF8. For example, the field GF4 can be used with Shamir secret sharing, e.g., with three parties. As is known per se, the field GF4 may be interpreted as an extension field of F2: F2[x] / (xA2+x+1) with the 4 elements: 0, 1, x and x+1. Bits may be embedded in GF4 by representing them by values 0 and 1. Interestingly the XOR operation on bits may correspond to the addition of their GF4 embeddings and may thus typically be computed efficiently under secret-sharing e.g. without communication. As an alternative to using GF4, also the field GF8 can be used with Shamir secret sharing, e.g., with five parties.

[0072] For example, the provided techniques may be used in the honest-majority setting, e.g., with 3 parties and a threshold of 1; or with 5 parties and a threshold of 2. In such a case, as is known per se and as is also discussed elsewhere, pseudo-random secret sharing can be used by a subset of two of the three, or three of the five, parties to input a value into the multi-party computation without communication; this can be used for example to input the mask value and / or the masked value into the multi-party computation.

[0073] For efficiency, the provided techniques are preferably used in combination with passively secure multi-party computation. For the same reason, an honest majority is preferred, although full-threshold multi-party computation can also be used in principle.

[0074] Generally, a value that is computed on by the MPC but that is represented among the parties in such a way that no single party, more generally no unqualified set of parties, can derive the value from that representation, is referred to as a secret value, or private value, of the MPC. A secret value can be a secret sharing. For example, a secret value can be a secret input, a secret output, or a secret intermediate value. Here, a secret input may be known in the plain by the party inputting it, and known only in a secret representation by the cryptographic devices CPi; and similarly, a secret output may be learned in the plain by the party receiving it as output, but may be known only in a secret representation by the cryptographic devices CPi. A private intermediate value may be known only to the cryptographic devices CPi, and only as a secret representation. By processing values using secret representations, the data can be kept secret, at least as long as the underlying assumptions of the multi-party computation (e.g., a number and / or type of corruptions of the cryptographic devices) are satisfied.

[0075] Also shown in the figure are a number of input devices INP1 , 211; INP2, 212; up to INPk, 213. The input devices may input respective input data for the computation. The input devices 211-213 may use the hardware configuration discussed in Fig. 1. The number of input devices can be two, at most or at least three, or at most or at least five, for example. In many cases, the sets of inputs devices INPi and cryptographic devices CPi may wholly or partially overlap. For example, the set of input devices may be a subset or a superset of the set of cryptographic devices, or may be exactly the same.

[0076] Further shown is a result device RES, 230. The result device RES may obtain a result of the MPC based on the performed privacy-preserving computation. It is also possible for multiple respective result devices to obtain multiple respective results of the multi-party computation. Although illustrated as a separate device in the figure, the result device(s) RES can be the same devices as an input device INPi and / or cryptographic device CPi. Generally, the result device may be implemented using the hardware configuration discussed with respect to Fig. 1.

[0077] Many known multi-party computation techniques are defined per se for the case where the input and result devices INPi and RES form a subset of the set of cryptographic devices CPi that perform the MPC. To use such techniques in a setting where an input and / or result device does not perform the MPC itself, an input device can for example determine a secret representation, e.g., a secret sharing, and distribute it among the computation devices. Similarly, a result device can for example receive a secret representation, e.g., respective secret shares, of an output from the computation devices and derive the output from the secret representation. It is also possible to use specific techniques for letting an external party provide inputs to and / or obtain outputs from a multiparty computation. For example, the techniques from the following reference can be used: T. P. Jakobsen, J. B. Nielsen, and C. Orlandi. “A framework for outsourcing of secure computation”, proceedings CCSW’14. In the figures discussed below, generally, solid boxes may be used to represent secret values of the multi-party computation, e.g., secret-shared values over a large or small ring. Dotted boxes may be used to represent values that are known by one, more, or all of the cryptographic devices that perform the multi-party computation. Operations shown in the figure may, depending on the operation and as also explained in more detail below, be executed by one, more, or all of the cryptographic devices.

[0078] Fig. 3 shows a detailed, yet non-limiting, example of converting an input value from a large ring to a small ring using multi-party computation. The multi-party computation in this example comprises a part LR, 340, that uses secret sharing over a large ring, and a part SR, 350, that uses secret sharing over a small ring, where the large ring has more elements than the small ring. As also discussed elsewhere, the large ring can for example be a prime field, e.g., with at least a 30-bit or a 30-field field size. The secretsharing over the large ring LR may be an arithmetic secret sharing, such as a multiplicative secret sharing like Shamir, additive, or replicated; as also described with respect to Fig. 2. The small ring can e.g. be the field GF2 (i.e., the unique ring of two elements), or the field GF4 or GF8. Here, the secret sharing can for example be additive, replicated, or Shamir; or Yao sharing, in which case computation SR may be performed using garbled circuits.

[0079] Shown in the figure is a secret-sharing INP, 310, of an input value over the large ring. The input value may have a bit-length k. In some embodiments, the input value is an input value with headroom, e.g., the bit-length k may be smaller than bit-length of the large ring size by a statistical security parameter, e.g., by at least 30 or at least 40 bits. In other embodiments, the input value can be an arbitrary element of the large ring.

[0080] Further shown in the figure is a mask generation operation Gen, 301. Operation Gen may be performed by a first subset of the cryptographic devices in order to generate a mask value. In the case where the input value has headroom, the mask value may comprise a lower part rlow, 321 ; and a higher part rhi; 322. The lower part rlow may be for masking the input value and the higher part rhi may be for statistically hiding the input value. For example, the lower part rlow may be greater than or equal to k bits, and the higher part rhi may be I bits, where I is set to the statistical security parameter. The mask value may be defined for example as rlow + 2A / * rhi in this case. As is known per se, in this case, the mask can statistically hide the input INP according to the statistical security parameter, without modular reduction over the large ring LR. See for example, S.J.A. de Hoogh, "Design of large scale applications of secure multiparty computation: secure linear programming", PhD thesis, Eindhoven University of Technology, 2012. Bits of the lower and higher part may be randomly generated. In other examples, the mask value may comprise just the lower part rlow, with this value e.g. being generated randomly over the large ring.

[0081] If the first subset comprises multiple devices, then, for example, respective device may generate the mask value locally by pseudo-randomly deriving the value from a previously shared seed; or one device may generate the value and send it to the other devices, for example.

[0082] The figure further shows an input operation Inp1, 341 , 351. In the input operation Inp1 , the first subset of cryptographic devices may input a binary representation rO, ..., rk-1, 325, of the lower part rlow of the mask value into the multi-party computation SR over the small ring. Further, the first subset of devices may input the mask value rlh, 323, into the multi-party computation LR over the large ring.

[0083] Interestingly, the inputting Inp1 may be performed using a local computation, e.g., without involving communication between the cryptographic devices. To this end, the devices that are not in the first subset may fix their shares independently from the input, e.g., by setting them to zero, and the devices that are in the subset, may compute their shares from the fixed shares and the value to be input. Inputs by local computation are known per se for example from R. Cramer et al., "Share Conversion, Pseudorandom Secret-Sharing and Applications to Secure Computation", proceedings TCC'05. For example, in the three- party honest-majority case, two out of three parties can locally input a value by fixing the third share, for example, to zero, and computing their unique shares that result in a valid sharing of the value to be shared. Three out of three parties can locally input a value by consistently selecting any valid sharing of the value, e.g., by setting all shares to be equal to the value in the case of Shamir secret sharing.

[0084] Further shown is a masking operation Mask, 342. In this operation, the cryptographic devices may determine a masked value IM, 331 , by masking the input value INP according to the mask value rlh. In principle, any masking operation can be used such that the masked value IM statistically or perfectly hides the input value INP without knowledge of the mask value rlh. It is preferred to use arithmetic addition or subtraction, since this operation is efficient to compute in the large ring LR; and also relatively efficient to compute in the small ring SR. Depending on the follow-up computation (as also discussed below), it can be convenient to use addition or subtraction. In particular, the masked value may be computed using arithmetic addition as IM = INP + 2Ak * (rhi + 2) + rlow, where the mask value is 2Ak * (rhi + 2) + rlow. Another possibility is to compute the masked value using arithmetic subtraction as IM = INP - rlow + 2Ak * (rhi + 2), where the mask value is rlow - 2Ak * (rhi + 2). In particular, by including the term 2A(k+ 1 ) in the above computation, it may conveniently be guaranteed that IM is positive even when subtracting the mask, or, equivalently, its lower k bits may be interpreted as a signed integer using two's complement.

[0085] Also shown is an opening operation Open, 343, in which the masked value IM may be opened IM, 332 to a second subset of the cryptographic devices. In this example, the second set of devices may be disjoint from the first set of devices that has performed the input operation Inp1. In this way, the first set of devices may not learn the input value INP as a result of the opening operation Open.

[0086] Also shown is a further input operation Inp2, 354, in which the second subset of devices may input a binary representation imO, imk-1, 333 of at least part of the masked value IM into the multi-party computation over the small ring. For example, when the input value has headroom, the lower k bits of the masked value may be input, where k is the bit length of the input value INP; or otherwise, the full masked value may be input.

[0087] Also shown is a computation operation Comp, 355. In this operation, the cryptographic devices may perform a computation on the binary representation r0,...,rk-1 of at least part of the masked value and the binary representation imO,..., imk-1 of at least part of the mask value, using the multi-party computation SR over the small ring.

[0088] One possible computation Comp is an unmasking of the masked value IM according to the mask value rlow to obtain a binary representation of the input value INP. Interestingly, for this operation, it may suffice to use only the lower k bits of the mask value and the masked values, since the higher bits may not be needed to recover the input value. For example, if the masking operation Mask is arithmetic addition over the large ring, then the computation Comp may be an arithmetic subtraction; if the masking operation is an arithmetic subtraction, then the computation may be an arithmetic addition, etc. It is known per se to perform such operations on bit-wise representations under multi-party computation. See Fig. 4 for an example.

[0089] Interestingly, as an alternative to the above, various other computations Comp may be performed that do not involve recomputing the input INP, such as performing an equality comparison or an arithmetic comparison. Some examples are discussed with respect to Fig. 5 and Fig. 6.

[0090] The techniques of this figure can for example be applied in the setting of three-party honest majority multi-party computation. In this case, for example, two of the three devices can generate Gen and input Inp1 the mask rlow.rhi. The third device can learn Open and input Inp2 the masked input IM. In this case, interestingly, the mask rlow.rhi can be input Inp by a local computation. It is also possible for one of the devices to generate and input the mask, and for the other two devices to learn and input the masked input. In this case, interestingly, the masked input imO,..., imk-1 can be input by a local computation. As another example, the techniques of this figure can be applied in the setting of two-party full-threshold multi-party computation. In this case, one of the devices can generate and input the mask, and the other party can learn and input them masked input. More generally, the techniques of this figure can be applied in a multi-party computation setting with a threshold of one.

[0091] Fig. 4 shows a detailed, yet non-limiting, example of performing an arithmetic addition on sharings of bits. The arithmetic addition may be used for example as, or as part of, the computation on binary representations of Fig. 3.

[0092] The example of this figure illustrates performing the addition by using a ripple carry adder. This example is advantageous in terms of amount of communication and computation, since it may scale linearly in the bit length of the values to be added. In this example, the arithmetic addition does not involve modulo reduction. This addition can for example be used in the setting of Fig. 3 for inputs with headroom.

[0093] This example shows a first -bit input ak-1 , 401, ..., aO, 402; and a second k- bit input bk-1 , 411, ..., bO, 412. To perform arithmetic addition in terms of the bits of the input, a full adder FAdd, 420, may be used. The full adder may be applied to respective pairs of inputs bits, with an optional carry bit as input and a carry bit and output bit as output. For example, the full adder FAdd may be applied to the lower bits aO, bO to obtain a lower output bit oO, 422, and a lower carry bit cO, 433. The full adder may be applied to subsequent pairs of input bits and carry outputs of the previous full adder. Finally, the full adder may be applied to the high input bits ak-1 , bk-1 and the previous carry output ck-2 to obtain final output bit ok-1 and carry bit ck-1. The full adder FAdd can be represented as a binary circuit, and can accordingly be performed under multi-party computation on secretshares of the respective bits, as is known per se.

[0094] The techniques described herein can also be combined with other implementations of arithmetic addition in terms of bits. In an embodiment, arithmetic addition may be performed by using a logarithmic-depth addition network, such as a network using carry pre-compute. Such a network may be evaluated under multi-party computation using a logarithmic number of rounds of communication, thereby reducing the latency of the multiparty computation. In particular, the inventors realized that it is advantageous to use the Sklansky addition network, as is known per se from algorithmics. In the setting of multi-party computation, using the Sklansky addition network is advantageous, since it has logarithmic depth and only logarithmic overhead in terms of communication and computation. Another advantageous possibility is to use the Ladner-Fischer addition network. This network is advantageous for multi-party computation since it also has logarithmic depth (but with more rounds than Sklansky), but constant overhead in terms of communication and computation.

[0095] The arithmetic addition can also be a modular addition, e.g., an arithmetic addition with modulo reduction. This can be used for example in combination with the techniques of Fig. 3 when the input does not have headroom, in which case an arithmetic addition in the large ring, with modulo reduction over the size of the large ring, may be used. Modular addition can be performed by performing a regular addition, and then performing a modulo correction. Modulo correction of sum x for modulus m can be implemented by obliviously selecting x or x-m based on a selection bit. In particular, to compute x-m, the (known) modulus m may be converted to -m using two's complement, and -m may be added to x to get x-m in two's complement. Interestingly, it may be derived from the result x-m whether x is larger than m, and accordingly, whether x or x-m is selected. Namely, the most significant bit, or the final extra carry in the addition, may denote whether the result is positive or negative, and may accordingly provide the selection bit indicating whether x or x- m is used. This way, modular addition may be implemented in terms of 2 regular additions and a multiplication, using 2*log(k)+1 rounds and k*(2*log(k)+1) bits of communication.

[0096] Fig. 5 shows a detailed, yet non-limiting, example of converting an input value from a large ring to a small ring. This example is based on the example of Fig. 3, and unless otherwise noted, various options described for that figure also apply in this case.

[0097] In particular, similar to Fig. 3, the figure shows a mask value rlow.rhi, 521, 522, that may be generated by a first subset of the cryptographic devices. The mask value rlh, 523 may be input Inp, 541 into a multi-party computation LR, 540, over a large ring; and a binary representation r0,..„rk-1, 525 of at least part rlow of the input value may be input Inp, 551, into a multi-party computation SR, 550, over a small ring. In a masking operation Mask, 542', the cryptographic devices may, using the multi-party computation LR over the large ring, mask an input value (not shown) according to the mask value rlh. These operations may be performed as described with respect to Fig. 3.

[0098] Interestingly, in the example illustrated in this figure, the input value may be further masked with a further mask value rlow'.rlhi', 521 , 522. The further mask value rlow', rhi', 522 may be generated by a further set of cryptographic devices. The further set of cryptographic devices may be disjoint from the first set of cryptographic devices that have input the mask value rlh. The further set of cryptographic devices may input Inp1 ', 51 T, the further mask value rlh', 523 into the multi-party computation LR over the large ring. Further, the further set of cryptographic devices may input Inp1 ', 55T, a binary representation r0',...,rk-1', 525', of at least part rlow' of the further mask value into the multi-party computation SR over the small ring. For the inputting Inp1 ' of the further set of cryptographic devices, the same implementation options exist as for the inputting by the first set of cryptographic devices, as discussed with respect to Fig. 3.

[0099] In order to mask the input value with the further mask value rlh', masking operation Mask, 542' may be performed. This operation may be based on the masking operation of Fig. 3 and may be adapted such that the masked input IM, 53T is produced by further masking the input according to the further mask value rlh'. For example, masking operation Mask may add or subtract masks rlh, rlh'. It is not necessary to use the same masking operation both masks, e.g., one mask may be added and the other subtracted.

[0100] As discussed with respect to Fig. 3, the masked value IM may be opened to a second subset of the devices (not shown), such that the first set of devices do not learn the input value. The cryptographic devices of the second subset may input (not shown) a binary representation of at least part of the masked value into the multi-party computation over the small ring. Interestingly, since the masked value may be masked according to a further mask value rlh' that is not known to the devices of the first set of devices, the masked value can for example be opened to all cryptographic devices. In this case, the cryptographic devices can input the binary representation by treating the binary representation as a non-secret value of the multi-party computation. In the case of Shamir secret sharing, for example, the cryptographic devices may set the share of a bit of the binary representation, to the bit itself.

[0101] Further shown is a computation operation Comp, 555'. In this operation, the cryptographic devices may perform, using the multi-party computation SR over the small ring, a computation on the binary representation of at least part of the masked value IM, the binary representation r0,...,rk-1 of at least part of the mask value, and the binary representation r0',...,rk-1' of at least part of the further mask value. The computation Comp may e.g. comprise unmasking the masked value according to the binary representations to obtain a representation of the input in the multi-party computation SR over the small ring.

[0102] Generally, the first set of cryptographic devices who input Inp the mask value, and the further set of cryptographic devices who input Inp' the further mask value, may be disjoint. The second set of cryptographic devices can overlap arbitrarily with either of the other sets, and can in particular comprise all cryptographic devices. For example, in the three-party setting, the first set can be a single or two devices; the further set can be a single or both remaining devices; and the second set can be all devices.

[0103] A concrete example where the input does not have headroom is as follows. In this example, the large ring is a 64-bit prime F64, and the small ring is the field GF(4); but other choices for the two rings are also possible. The input value can in this example be an arbitrary value x_64 in F64. Two devices can generate random mask r0_64 and further mask r1_64 in F64 locally with also a representation in GF(4) as r0_4 and r1_4. The devices may secret share the mask and further mask. As part of the masking over the large ring, an overall mask r_64 = r0_64 + r1_64 may be computed. As part of the computation over the small ring, a representation of the overall mask over GF(4) may be computed by performing a bit-wise implementation of modular addition as discussed e.g. with respect to Fig. 4, e.g., r_4 = ModAdd(rO_4, r1_4, p64) with p64 the modulus of F64. The masked value c_64 = x_64 - r_64 over the large ring may be opened and interpreted in GF(4) as its binary representation c_4. The computation over the small ring may comprise computing a representation x_4 = ModAdd(c_4, r_4, p64) of the input x_64 over the small ring.

[0104] Interestingly, this technique may be implemented fully in terms of inputs, outputs and computation, and can accordingly work with any multi-party computation technique. The use of two masks rlh, rlh' may correspond to a secret-sharing threshold of one, e.g., honest-majority three-party computation or full-threshold two-party computation.

[0105] It is also possible to use more masks to provide security against colluding attackers, e.g., in a multi-party computation that uses a higher threshold or other attacker model, e.g., the set of masks and parties inputting them may be configured such that, for each set of attacker parties that can collude according to the attacker model, there is at least one mask generated by a party not in the set. E.g., for each set of parties, a mask may be generated by the parties of the complement of the set, or by a subset of those parties. For example, in the three-party honest majority setting, the sets of attackers may be {1}, {2}, {3}, with complements {2,3}, {1,3}, {1 ,2}, respectively, so it can be sufficient for any two individual parties to generate respective masks since the two parties cover all the complements. In the five-party threshold two setting, for example, masks by three individual parties may suffice, and more generally, respective masks by a number of respective individual parties greater than the threshold, e.g., equal to the threshold plus one, may be used.

[0106] Fig. 6 shows a detailed, yet non-limiting, example of performing an equality comparison of an input value against zero. The input value may be a value from a large ring. The output may be a boolean value from the small ring indicating whether or not the input value is equal to zero. By applying the techniques of the present figure to the difference of two input values form the large ring, an equality comparison of the two input values to each other may be implemented.

[0107] The figure shows an example of a computation operation Comp, 655 that may be used in combination with the techniques of Fig. 3. Computation operation Comp may be performed over a binary representation imO,..., 635, of at least part of a masked value and over a binary representation r0,..., 625, of at least part of a mask value, using a multi-party computation a small ring. By performing the computation as illustrated, an equality comparison of the input value corresponding to masked input value imi and mask value ri, may be performed. In the example of this figure, the masking operation may be such that the mask value is equal to the masked value if and only if the input value is zero. Examples of such masking operations are arithmetic addition and subtraction.

[0108] In such a case, the computation Comp may perform the equality comparison by determining whether respective bits of the mask and masked value are equal. If the respective bits are equal, the mask may be equal to the masked value, and accordingly, the input value may be zero.

[0109] An example of determining whether the respective bits are equal, is shown. The figure shows an XNOR operation XNOR, 650, being applied to respective bits of the binary representations, to determine respective equality outputs EQO, ..., 641. The XNOR operation may determine a bit O representing whether respective input bits 11 , I2 are equal to each other and may be computed, e.g., in Z2 or GF(4), as 0=1+11+12. The figure further shows a reduction operation RED, 660. The reduction operation may be applied to the equality outputs EQO, ..., 641 to determine whether their logical AND is true. This can be done by using the reduction operation RED to determine respective AN Ds of respective pairs of equality outputs EQO, ..., until a single equality output EQO is left. The single equality output EQO may be output as the result of the quality comparison. Interestingly, the reduction can be performed in a number of rounds logarithmic in the bit lengths of the input.

[0110] Interestingly, in this example, the equality comparison can be performed without unmasking the masked input in the small ring, by instead directly computing on the masked value and the mask value. Thereby, a particularly efficient implementation of the equality comparison may be obtained.

[0111] It is noted that the equality comparison can also be performed in combination with the techniques of Fig. 5. In this case, the binary representation of the masked input imO,... can for example be compared against a binary representation of the overall mask rO,... obtained by adding the mask and the further mask as discussed with respect to that figure. Also in this case, an efficiency improvement is obtained compared to fully unmasking the masked value according to the mask value and the further mask value.

[0112] Fig. 7 shows a detailed, yet non-limiting, example of performing an arithmetic comparison of an input value against zero. The input value may be a value from a large ring. This example can be used with masking by arithmetic addition or subtraction. By applying the techniques of the present figure to the difference of two input values form the large ring, an arithmetic comparison of the two input values to each other may be implemented. The output of the arithmetic comparison may be one or more values indicating one or more of: whether the input value is greater than zero; whether the input value is greater than or equal to zero; whether the input value is less than zero; and whether the input value is less than or equal to zero. The output value can for example comprise one or more indicator bits corresponding to one or more of the above conditions; or the output value can for example be a ternary comparison output indicating whether the input is smaller than, equal to, or larger than zero. The number of possible outputs can for example be two or three. Here, the terms "positive" and "negative" may correspond to intervals in the large ring, e.g., in the ring of integers modulo a modulus M, values between 0 and half the modulus may be interpreted as being positive, and values between half the modulus and the modulus may be interpreted as being negative.

[0113] Interestingly, the inventors realized that arithmetic comparison of the input value to zero may be implemented by performing an arithmetic comparison of the masked value to the mask value, thereby avoiding an explicit unmasking. Specifically, the figure shows an example of a computation operation Comp, 755 that may be used in combination with the techniques of Fig. 3. Computation operation Comp may be performed over a binary representation imO,..., 635, of at least part of a masked value and over a binary representation r0,..., 625, of at least part of a mask value, using a multi-party computation a small ring, and may comprise arithmetically comparing the binary representations of the mask value and the masked value.

[0114] As illustrated, the arithmetic comparison may be performed by performing a bit-wise comparison <=B, 750 on respective pairs of bits of the mask r0,... and masked value imO,... to obtain respective equality comparison outputs EQO,..., 641 , and arithmetic comparison outputs LTO,... 642. By way of illustration, less-than is used as the arithmetic comparison output in this example, but it is also possible to use a different type of arithmetic comparison output, e.g., greater-than or greater-than-equal. For example, an equality comparison output EQO,... of bits 11, I2 may be computed, e.g., in Z2 or GF(4), as 1+11+12. An arithmetic comparison output LTO,... may be computed e.g. as ~I1 & I2 = (1 - 11) * I2.

[0115] The outputs of the bit-wise comparison <=B may be pairwise reduced for a number of times in a reduction operation Red, 760, to obtain an overall comparison output. For example, a pair of consecutive equality comparison outputs EQO, EQ1 and arithmetic comparison outputs LTO, LT1 , may be reduced into reduced comparison output, e.g., EQO AND EQ1 and reduced arithmetic comparison output, e.g., LTO XOR (EQO AND LT1), or equivalent.

[0116] The above operations <=B, Red can be used to implement an arithmetic comparison on positive values. There are various ways to apply this to input values, which may be negative. One way is to apply the comparison to translations of the masked input value and the mask value. For example, for a k-bit input value I from [-2A(k-1 ), 2A(k-1)); a k- bit mask M from [0, 2Ak); and a masked input (l+M), the arithmetic comparison l<=0 may be computed as (l+M) <= M and accordingly as (l+M) + 2A(k-1) <= M + 2A(k-1). Here, due to the translation, both the left-hand side and the right-hand side may be positive.

[0117] Interestingly, it is also possible, and more efficient, to perform an unsigned comparison of the least significant k-1 bits, and to invert the equality and / or arithmetic comparison outputs if the most significant bits of the mask value and the masked value are different, e.g., by computing LTO XOR rk-1 XOR imk-1.

[0118] Given a reduced equality comparison output EQO and arithmetic comparison output LTO, an overall output may be determined. For example, an output indicating whether the input value is greater-than-equal zero may be obtained as NOT LTO; an output indicating whether the input value is less-than-equal zero may be obtained as LTO OR EQO; etcetera.

[0119] Fig. 8 shows a detailed, yet non-limiting, example of converting an input value from a small ring to a large ring. This example is analogous to the example of Fig. 3, and various options discussed with respect to that figure, for example with regard to the choice of a small and large ring, also apply here.

[0120] In particular, the figure shows a multi-party computation comprising a part SR, 850 that uses secret sharing over a large ring, and a part LR, 840, that uses secret sharing over a small ring. The terms "large" and "small" refer to situations in which the large ring has more elements than the small ring. As an example, the large ring can be a prime field of at least 30 or at least 60 bits. As an example, the small ring can be Z2 or GF(4).

[0121] As shown in the figure, the cryptographic devices of the multi-party computation may be configured to obtain a secret-sharing of a binary representation IO,...,lk- 1 , 810, of an input value, e.g., I0 + 2*11 + ..., over the small ring SR.

[0122] Further shown in the figure is a generation operation Gen, 801. In this operation, a first subset of the cryptographic devices that perform the multi-party computation, may generate a mask value r, 821 . The mask value may have a bit length k larger than or equal to a maximum bit length of the input value. The mask value may be a randomly generated k-bit value, or, if k is equal to the bit length of the large ring, then r may be a randomly generated element of the large ring.

[0123] Further shown is an input operation Inp1 , 851 , 841. In this operation, the cryptographic devices of the first subset may input a binary representation r0,...,rk-1 , 825 of the mask value into the multi-party computation SR over the small ring. Further, the devices may input the mask value r, 823, into the multi-party computation LR over the large ring. Input operation Inp1 may be implemented as discussed with respect to Fig. 3, e.g., there can be one or two cryptographic devices in the first subset, and inputting by local computation can be used.

[0124] Further shown is a masking operation Mask, 852. In this operation, the cryptographic devices of the multi-party computation may, using the multi-party computation SR over the small ring, determine a masked value im0,...,imk-1 , 831 by masking the input value IO,...,lk-1 according to the binary representation of the mask value r0,...,rk-1.

[0125] As also discussed elsewhere, the masking operation can be an arithmetic addition or subtraction in the large ring, for example, performed in terms the binary representation, as discussed with respect to Fig. 4. For example, it is possible for masking operation Mask to perform modular arithmetic addition or subtraction over the large ring, computed using the multi-party computation SR in the small ring. Interestingly, however, the inventors realized that such modular arithmetic in the small-ring MPC SR can optionally be avoided by performing an arithmetic addition or subtraction without modulo reduction, that additionally outputs a carry value c, 832. For example, given k-bit inputs, a k-bit output and a carry bit may be output as secret values in the small ring.

[0126] Also shown is an opening operation Open, 843, in which the masked value im0,...,imk-1 may be opened im, 833, to a second subset of the devices that perform the multi-party computation, e.g., the devices of the second subset may learn the bits and reconstruct the input, e.g., im = imO + 2*im1 + .... The opening Open may be performed such that the first set of devices do not learn the input value. For example, analogously to Fig. 3, the first set of devices that performs the input Inp1 may be disjoint from the second set of devices that performs the opening Open. Or, analogously to Fig. 5, a further masking may be performed according to a further mask by a further set of devices that is disjoint from the first set of devices. Interestingly, when using a carry value c, this carry value may remain secret to the second subset of cryptographic devices since this value can depend statistically on the input value IO,...,l-k-1.

[0127] Further shown is an input operation Inp2, 844, in which the cryptographic devices of the second subset may to input the masked value im, 835 into the multi-party computation LR over the large ring. This input can be a local input, depending on the number of parties in the second set of cryptographic devices.

[0128] When using a carry value c, also for this value a representation c, 834, over the target ring LR may be determined. To avoid opening this value, a conversion Conv, 855,845 may be performed that does not reveal the carry value c to any of the cryptographic devices. Techniques for performing such a conversion from a small ring to a large ring are known per se in the art. One way to perform the conversion is for example to have the devices from the first set, in input operation Inp1, generate a random bit r' both in the small ring and in the large ring. Then, r' XOR c can be opened for example by the second set of cryptographic devices; who can input the result into the multi-party computation LR over the large ring. Carry value c may be computed in the large ring as XOR(r', c) = r' + c - 2*r'*c.

[0129] Also shown is an unmasking operation Unm, 846. In this operation, a secret sharing I, 811 of the input value IO, ...,lk-1 over the large ring may be computed based on the masked value im and the mask value r, optionally also using the carry c, e.g., as I = im - r without carry, or as I = im - r + 2Ak*c with carry. Interestingly, hereby, a representation of the input value IO, ...,lk-1 in the large ring may be obtained with a number of operations in the large ring LR that is independent of the bit length of the input. It may be noted that the above techniques can be used for any bit length k, e.g., the present techniques also apply if there is no headroom in the large ring.

[0130] Fig. 9 shows a block-diagram of a cryptographic method 900 of performing a privacy-preserving computation. The privacy-preserving computation may be performed by a cryptographic device as a secure multi-party computation between multiple cryptographic devices comprising the cryptographic device.

[0131] For example, the cryptographic device can be device 100 of Fig. 1. However, this is not a limitation, in that the method 900 may also be performed using another system, apparatus or device. The method 900 may further comprise the carrying out of the secure multi-party computation by the other cryptographic devices. For example, the method 900 may be carried out by a cryptographic system, e.g., cryptographic system 010 of Fig. 2. The method 900 may be computer-implemented.

[0132] The multi-party computation may use secret sharing over a large ring and over a small ring. The large ring may have more elements than the small ring. The set of multiple cryptographic devices may comprise a first subset of devices and a second subset of devices.

[0133] The method comprises, in an operation titled "COMMUNICATE", communicating 910 with at least one further cryptographic device of the cryptographic system.

[0134] The method comprises, in an operation labelled "ACCESS INPUT", accessing 920 data representing a secret-sharing of an input value over the large ring.

[0135] The method comprises, in an operation labelled "SHARE MASK", obtaining 930 as input of the multi-party computation from the first subset of the cryptographic devices: a binary representation of at least part of a mask value in the small ring, and the mask value in the large ring. The method comprises, in an operation labelled "MASK", using the multiparty computation over the large ring, determining 940 a masked value by masking the input value according to the mask value.

[0136] The method comprises, in an operation labelled "OPEN MASKED", opening 950 the masked value to the second subset of the devices, such that the first set of devices do not learn the input value.

[0137] The method comprises, in an operation labelled "INPUT MASKED", obtaining 960 as input of the multi-party computation from the second subset of the cryptographic devices: a binary representation of at least part of the masked value over the small ring.

[0138] The method comprises, in an operation labelled "COMPUTE", performing 970 a computation on the binary representation of at least part of the masked value and the mask value, using the multi-party computation over the small ring.

[0139] Fig. 10 shows a block-diagram of a cryptographic method 1000 of performing a privacy-preserving computation. The privacy-preserving computation may be performed by a cryptographic device as a secure multi-party computation between multiple cryptographic devices comprising the cryptographic device.

[0140] For example, the cryptographic device can be device 100 of Fig. 1. However, this is not a limitation, in that the method 1000 may also be performed using another system, apparatus or device. The method 1000 may further comprise the carrying out of the secure multi-party computation by the other cryptographic devices. For example, the method 1000 may be carried out by a cryptographic system, e.g., cryptographic system 010 of Fig. 2. The method 1000 may be computer-implemented.

[0141] The multi-party computation may use secret sharing over a large ring and over a small ring. The large ring may have more elements than the small ring. The set of multiple cryptographic devices may comprise a first subset of devices and a second subset of devices.

[0142] The method comprises, in an operation titled "COMMUNICATE", communicating 1010 with at least one further cryptographic device of the cryptographic system.

[0143] The method comprises, in an operation titled "ACCESS INPUT", accessing 1020 data representing a secret-sharing of a binary representation of an input value over the small ring.

[0144] The method comprises, in an operation titled "OBTAIN MASK", obtaining 1030 as input of the multi-party computation from the first subset of the cryptographic devices: a mask value in the large ring, and a binary representation of the mask value in the small ring. The method comprises, in an operation titled "MASK", using the multi-party computation over the small ring, determining 1040 a masked value by masking the input value according to the binary representation of the mask value

[0145] The method comprises, in an operation titled "OPEN", opening 1050 the masked value to the second subset of the devices, such that the first set of devices do not learn the input value.

[0146] The method comprises, in an operation titled "INPUT MASKED", obtaining 1060 as input of the multi-party computation from the second subset of the cryptographic devices: the masked value in the large ring.

[0147] The method comprises, in an operation titled "COMPUTE", computing 1070, using the multi-party computation, a secret sharing of the input value based on the masked value and the mask value.

[0148] It will be appreciated that, in general, the operations of method 900 of Fig. 9 and / or method 1000 of Fig. 10 may be performed in any suitable order, e.g., consecutively, simultaneously, or a combination thereof, subject to, where applicable, a particular order being necessitated, e.g., by input / output relations. It is also possible to combine the two methods in a single multi-party computation, e.g., to perform a multi-party computation over a small ring based on a masked input value according to method 900 and thereby obtain a binary representation of a further value; and to convert the further value to the large ring according to method 1000. In this case, the first and second subsets of devices used in methods 900 and 1000 can be different.

[0149] The method(s) may be implemented on a computer as a computer implemented method, as dedicated hardware, or as a combination of both. As also illustrated in Fig. 11 , instructions for the computer, e.g., executable code, may be stored on a computer readable medium 1100, e.g., in the form of a series 1110 of machine-readable physical marks and / or as a series of elements having different electrical, e.g., magnetic, or optical properties or values. The medium 1100 may be transitory or non-transitory. Examples of computer readable mediums include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Fig. 11 shows an optical disc 1100.

[0150] The instructions may be instructions for one or more particular devices of the cryptographic system. In particular, the instructions may comprise instructions for a cryptographic device to perform a small-to-large-ring or large-to-small-ring conversion.

[0151] Examples, embodiments or optional features, whether indicated as nonlimiting or not, are not to be understood as limiting the invention as claimed. It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or stages other than those stated in a claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Expressions such as “at least one of’ when preceding a list or group of elements represent a selection of all or of any subset of elements from the list or group. For example, the expression, “at least one of A, B, and C” should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

CLAIMS1. A cryptographic system (010) for performing a privacy-preserving computation on secret data, wherein the cryptographic system comprises multiple cryptographic devices (100, 221 ,221 , 223), wherein the multiple cryptographic devices are configured to perform the computation as a cryptographic secure multi-party computation between the multiple cryptographic devices, wherein the multi-party computation uses secret sharing over a large ring and over a small ring, wherein the large ring has more elements than the small ring, wherein the set of multiple cryptographic devices comprises a first subset of devices and a second subset of devices, wherein: the cryptographic devices are configured to obtain a secret-sharing of an input value over the large ring; the cryptographic devices of the first subset are configured to generate a mask value; to input a binary representation of at least part of the mask value into the multiparty computation over the small ring; and to input the mask value into the multi-party computation over the large ring; the cryptographic devices are configured to, using the multi-party computation over the large ring, determine a masked value by masking the input value according to the mask value; and to open the masked value to the second subset of the devices, such that the first set of devices do not learn the input value; the cryptographic devices of the second subset are configured to input a binary representation of at least part of the masked value into the multi-party computation over the small ring; the cryptographic devices are configured to perform a computation on the binary representation of at least part of the masked value and the mask value, using the multi-party computation over the small ring.

2. The cryptographic system (010) of claim 1 , wherein the second set of devices is disjoint from the first set of devices.

3. The cryptographic system (010) of any one of the preceding claims, wherein the cryptographic devices are configured to mask the input value by performing an arithmetic addition or subtraction based on the input value and the mask value.

4. The cryptographic system (010) of any one of the preceding claims, wherein:the large ring is a prime field, and / or the small ring is the ring of two elements, the field of four elements, or the field of eight elements.

5. The cryptographic system (010) of any one of the preceding claims, wherein the mask value and / or the binary representation of at least part of the mask value and / or the binary representation of at least part of the masked value is input using a local computation.

6. The cryptographic system (010) of any one of the preceding claims, wherein the cryptographic devices of the first subset are configured to generate a mask value that statistically hides the input value.

7. The cryptographic system (010) of any one of the preceding claims, wherein the cryptographic devices are configured to unmask the masked value according to the mask value.

8. The cryptographic system (010) of any one of claims 1-6, wherein the cryptographic devices are configured to perform an equality comparison of the mask value and the masked value.

9. The cryptographic system (010) of any one of claims 1-6, wherein the cryptographic devices are configured to perform an arithmetic comparison of the mask value and the masked value.

10. A cryptographic device (100, 221-223) for use in the cryptographic system (010) comprising multiple cryptographic devices according to any one of claims 1-9, wherein the cryptographic device is for performing a privacy-preserving computation as a cryptographic secure multi-party computation between the multiple cryptographic devices, wherein the multi-party computation uses secret sharing over a large ring and over a small ring, wherein the large ring has more elements than the small ring, wherein the set of multiple cryptographic devices comprises a first subset of devices and a second subset of devices, wherein the cryptographic device comprises: a communication interface (180) configured for communication with at least one further cryptographic device of the cryptographic system; a data interface (120) for accessing data (040) representing a secret-sharing of an input value over the large ring;a processor subsystem (140) configured to: obtain as input of the multi-party computation from the first subset of the cryptographic devices: a binary representation of at least part of a mask value in the small ring, and the mask value in the large ring; using the multi-party computation over the large ring, determine a masked value by masking the input value according to the mask value; and open the masked value to the second subset of the devices, such that the first set of devices do not learn the input value; obtain as input of the multi-party computation from the second subset of the cryptographic devices: a binary representation of at least part of the masked value over the small ring; perform a computation on the binary representation of at least part of the masked value and the mask value, using the multi-party computation over the small ring.

11. A cryptographic method (900) of performing a privacy-preserving computation, wherein the privacy-preserving computation is performed by a cryptographic device as a secure multi-party computation between multiple cryptographic devices comprising the cryptographic device, wherein the multi-party computation uses secret sharing over a large ring and over a small ring, wherein the large ring has more elements than the small ring, wherein the set of multiple cryptographic devices comprises a first subset of devices and a second subset of devices, wherein the method comprises: communicating (910) with at least one further cryptographic device of the cryptographic system; accessing (920) data representing a secret-sharing of an input value over the large ring; obtaining (930) as input of the multi-party computation from the first subset of the cryptographic devices: a binary representation of at least part of a mask value in the small ring, and the mask value in the large ring; using the multi-party computation over the large ring, determining (940) a masked value by masking the input value according to the mask value; and opening (950) the masked value to the second subset of the devices, such that the first set of devices do not learn the input value; obtaining (960) as input of the multi-party computation from the second subset of the cryptographic devices: a binary representation of at least part of the masked value over the small ring;performing (970) a computation on the binary representation of at least part of the masked value and the mask value, using the multi-party computation over the small ring.

12. A cryptographic system (010) for performing a privacy-preserving computation on secret data, wherein the cryptographic system comprises multiple cryptographic devices (100, 221 ,221 , 223), wherein the multiple cryptographic devices are configured to perform the computation as a cryptographic secure multi-party computation between the multiple cryptographic devices, wherein the multi-party computation uses secret sharing over a large ring and over a small ring, wherein the large ring has more elements than the small ring, wherein the set of multiple cryptographic devices comprises a first subset of devices and a second subset of devices, wherein: the cryptographic devices are configured to obtain a secret-sharing of a binary representation of an input value over the small ring; the cryptographic devices of the first subset are configured to generate a mask value; to input a binary representation of the mask value into the multi-party computation over the small ring; and to input the mask value into the multi-party computation over the large ring; the cryptographic devices are configured to, using the multi-party computation over the small ring, determine a masked value and by masking the input value according to the binary representation of the mask value; and to open the masked value to the second subset of the devices, such that the first set of devices do not learn the input value; the cryptographic devices of the second subset are configured to input the masked value into the multi-party computation over the large ring; the cryptographic devices are configured to compute a secret sharing of the input value over the large ring based on the masked value and the mask value.

13. A cryptographic device (100, 221-223) for use in the cryptographic system (010) comprising multiple cryptographic devices according to claim 12, wherein the cryptographic device is for performing a privacy-preserving computation as a cryptographic secure multi-party computation between the multiple cryptographic devices, wherein the multi-party computation uses secret sharing over a large ring and over a small ring, wherein the large ring has more elements than the small ring, wherein the set of multiple cryptographic devices comprises a first subset of devices and a second subset of devices, wherein the cryptographic device comprises: a communication interface (180) configured for communication with at least one further cryptographic device of the cryptographic system;a data interface (120) for accessing data (040) representing a secret-sharing of a binary representation of an input value over the small ring a processor subsystem (140) configured to: obtain as input of the multi-party computation from the first subset of the cryptographic devices: a mask value in the large ring, and a binary representation of the mask value in the small ring; using the multi-party computation over the small ring, determine a masked value by masking the input value according to the binary representation of the mask value; and open the masked value to the second subset of the devices, such that the first set of devices do not learn the input value; obtain as input of the multi-party computation from the second subset of the cryptographic devices: the masked value in the large ring; compute, using the multi-party computation, a secret sharing of the input value based on the masked value and the mask value.

14. A cryptographic method (1000) of performing a privacy-preserving computation, wherein the privacy-preserving computation is performed by a cryptographic device as a secure multi-party computation between multiple cryptographic devices comprising the cryptographic device, wherein the multi-party computation uses secret sharing over a large ring and over a small ring, wherein the large ring has more elements than the small ring, wherein the set of multiple cryptographic devices comprises a first subset of devices and a second subset of devices, wherein the method comprises: communicating (1010) with at least one further cryptographic device of the cryptographic system; accessing (1020) data representing a secret-sharing of a binary representation of an input value over the small ring obtaining (1030) as input of the multi-party computation from the first subset of the cryptographic devices: a mask value in the large ring, and a binary representation of the mask value in the small ring; using the multi-party computation over the small ring, determining (1040) a masked value by masking the input value according to the binary representation of the mask value; and open the masked value to the second subset of the devices, such that the first set of devices do not learn the input value; obtaining (1050) as input of the multi-party computation from the second subset of the cryptographic devices: the masked value in the large ring;computing (1060), using the multi-party computation, a secret sharing of the input value based on the masked value and the mask value.

15. A transitory or non-transitory computer-readable medium (1100) comprising data (1110) representing instructions which, when executed by a processor system, cause the processor system to perform the cryptographic method of claim 11 and / or claim 14.

Images