Privacy-preserving concatenation

Abstract

The invention relates to a cryptographic system (010) for performing a privacy-preserving computation on secret data using cryptographic secure computation The computation comprises a concatenation of multiple strings. Strings are represented by a length and a list of padded symbols. The length and the padded symbols are secret values of the secure computation. First, respective padding indicators are obtained for the respective padded symbols of the string, as secret values of the secure computation. Then, a stable sort is performed of the padded symbols of the multiple strings according to the padding indicators for the multiple strings to obtain a list of sorted symbols. The list of sorted symbols is output.

Description

[0001] PRIVACY-PRESERVING CONCATENATION

[0002] FIELD OF THE INVENTION

[0003] The invention relates to a cryptographic system for performing a privacypreserving computation on secret data. The invention further relates to a cryptographic device for use in such a system; to a corresponding computer-implemented method; and to a computer-readable medium.

[0004] BACKGROUND OF THE INVENTION

[0005] There is a growing demand for privacy enhancing technologies (PETs), i.e., data processing techniques that intrinsically protect the privacy of the data they operate on. For example, with the cryptographic technique of secure multi-party computation (MPC), multiple parties can perform a computation on their joint input using a distributed cryptographic protocol, such that each party learns nothing beyond the output of computation and his own (private) input.

[0006] One reason for the growing demand for PETs is that citizens are becoming increasingly dependent on the digital information stored about them by various companies and institutions. Because of this increasing dependence, the consequences of a breach of personal data are getting increasingly severe. And due to the worldwide surge of cybercrime and nation-state-sponsored cyber espionage, the risk of a data breach has increased sharply in recent years. Also, data-based collaborations between separate entities (like companies, hospitals, local governments) usually implies that personal data is copied between the entities, which poses the risk of uncontrolled spreading of data, in particular personal information. PETs can enable data collaboration between entities without the need for sharing the data in clear-text form. Another factor driving demand for PETs is the emergence of legal frameworks for data protection, such as the European GDPR and the Californian CCPA legislation, and their mandatory compliance. In the context of such frameworks, PETs are valuable as technical safeguards, and typically provide concrete instantiations of abstract legal notions.

[0007] Specifically, multi-party computation (MPC) is a cryptographic technique in which a computation is performed in a distributed way between multiple cryptographic devices in such a way that the inputs, intermediate values, and / or outputs of the computation remain hidden from the parties performing the computation. Such values that remain hidden from the parties may be referred to as the secret values of the MPC. In general, a secret value of the MPC may have the property that a limited number of parties, up to a given threshold, does not know the secret value. However, a number of parties that exceeds the threshold may be able to derive the secret value. A secret value can for example be a threshold encryption, of which the decryption key is distributed among the parties; or a secret sharing, also referred to herein simply as a sharing. A sharing may be defined as a distributed representation of a value into shares of the respective parties such that a limited number of the shares, up to the given threshold, does not allow deriving the represented value. Although the term "secret share" is most commonly used for MPC techniques using so-called arithmetic secret sharing, also other MPC techniques such as garbled circuits are considered herein to operate on secret shares. In multi-party computation, through the use of secret values and of various protocols that allow performing operations on secret values, e.g., in secret-shared or threshold encrypted form, various computations can be performed, while keeping underlying values hidden from the parties that perform them, thus providing privacy-preserving computation.

[0008] Another known technique for performing privacy-preserving computation is homomorphic encryption (HE). Homomorphic encryption may be used as a privacyenhancing technology by providing data to a cryptographic device in encrypted form; letting the device perform a computation on the data while keeping the data encrypted; and letting the device output the result of the computation in encrypted form; thus providing privacypreserving computation. Homomorphic encryption can for example be levelled fully homomorphic encryption or fully homomorphic encryption (FHE).

[0009] Multi-party computation and homomorphic encryption may collectively be referred to as cryptographic secure computation. The two techniques have in common that they allow a computation to be performed by one or more cryptographic devices that do not learn the values of the data that they are computing on. The design of efficient cryptographic secure computation protocols for implementing specific operations is the topic of a significant amount of research. Some of this research is specific to MPC or HE; other results may make black-box use of primitives that are available both in the MPC setting and in the HE setting, such as a secure comparison; and may accordingly apply to both settings.

[0010] In particular, a secure computation may involve operations on strings, where a string may be represented by a list of symbols, e.g., characters. For example, the symbols may be secret values of the secure computation. In such a case, the string may be stored as an oblivious array, as disclosed in M. Keller and P. Scholl, "Efficient, Oblivious Data Structures for MPC", Cryptology ePrint Archive, Paper 2014 / 137. In this case, the length of the string is assumed to be public information, but it is possible to perform various operations on the string in a privacy-preserving way, such as retrieving a character of the string at a secret location, and appending a character to string. In particular, a concatenation of two strings may be realized using the techniques of that paper by respectively retrieving the characters of the second string and adding them to the first string. SUMMARY OF THE INVENTION

[0011] It would be desirable to provide efficient techniques for performing a privacypreserving computation that involves string concatenation, in which also the lengths of one or more of the input strings can remain secret.

[0012] In accordance with a first aspect of the invention, a cryptographic system for performing a privacy-preserving computation is provided, as defined by claim 1. In accordance with further aspects of the invention, a cryptographic device for use in such a system; and a cryptographic method of performing such a privacy-preserving computation are provided, as defined by claims 13 and 14, respectively. In accordance with an aspect of the invention, a computer-readable medium is provided, as defined by claim 15.

[0013] Various embodiments relate to a cryptographic secure computation, such as a secure multi-party computation (MPC) or a homomorphic encryption (HE) computation, that involves a concatenation of two or more strings. Generally, the term string may refer to a sequence of zero or more symbols. The symbols can be characters. For example, the characters may be encoded using ASCII, extended ASCII, or another fixed-length encoding, such as UTF-32. However, the techniques provided herein are not restricted to characters and also work for strings comprising other types of symbols, such as numeric values.

[0014] Interestingly, one or more of the strings which are to be concatenated, may have a length that is a secret value of the secure computation; in other words, the cryptographic device(s) that carry out the secure computation, may not know the length of the string. Such a string may be represented by its length, as a secret value of the secure computation; and by a list of padded symbols of the string, where the list of padded symbols comprises the symbols of the string, padded up to a maximum length by adding respective padding symbols. The maximum length is typically known to the cryptographic device(s). Accordingly, the length of the string may remain secret to the extent that the cryptographic device(s) know that its length is at most the maximum length, but not more.

[0015] For example, the string 'ABC may be represented with a maximum length of 6 by its length, 3, and the list of padded symbols 'ABC000'. In this example, the symbol 'O' is used as a padding symbol, but in general, any padding symbol can be used and it is also not necessary to use the same padding symbol repeatedly, e.g., 'ABC123' can be another list of padded symbols for representing the string 'ABC of length 3. Also, it is also not necessary to append the padding symbols at the end, e.g., the padding symbols can also be prepended. It is however preferred for the non-padding symbols to be contiguous in the list of padded symbols, such that the length and list of padded symbols define the represented string.

[0016] Unfortunately, when using a secret length, string concatenation becomes challenging. For example, to concatenate the string 'ABC, represented by length 3 and list of padded symbols 'ABC000' with the string 'DEF', represented by length 3 and list of padded symbols 'DEFO', it is not possible to simply concatenate the list of padded symbols, because this would leave padding symbols in between the non-padding symbols. Also the use of an oblivious array does not provide a direct solution since this only hides the symbols but not the length.

[0017] Interestingly, however, the inventors realized that the concatenation of multiple strings may be implemented in terms of a stable sort. As is known from the literature, a stable sort of a list of values according to an ordering may preserve the order of values that are equal according to the ordering.

[0018] Namely, the inventors realized that a concatenation may be implemented efficiently as a secure computation by performing a stable sort of the padded symbols of the input strings, where the padded symbols are sorted according to whether or not they are padding symbols. To this end, respective padding indicators may be obtained for the respective padded symbols of the string, as secret values of the secure computation. Using padding indicators, concatenation can e.g. be implemented by performing a stable sort on pairs (S, I), where S is a padded symbol and I is a padding symbol indicating whether or not the symbol is a padding symbol. The sort may be performed according to an ordering defined by the padding symbols.

[0019] Interestingly, sorting may result in a list of padded symbols in which the nonpadding symbols of the input strings are located contiguously, e.g., at the beginning or the end. For example, by ordering an indicator I indicating a non-padding symbol before ordering an indicator I indicating a padding symbol, the sorting may result in an ordering of the padded symbols in which the non-padding symbols are ordered before the non-padding symbols. Moreover, by using a stable sort, the order of the symbols in the input strings, but also the order of the input strings relative to each other, may be preserved.

[0020] For example, in order to concatenate the strings 'ABC and 'DEF' in the above example, a stable sort may be performed of the pairs ('A', 1), ('B', 1), ('C, 1), ('O', 0), ('O', 0), ('O', 0), ('D', 1), ('E', 1), ('F', 1), ('O', 0). The stable sort may place the symbols 'A', 'B', 'C, 'D', ' E', 'F' before the padding symbols, and may preserve the order of the symbols, thus leading to pairs ('A', 1), ('B', 1), ('C, 1), ('D', 1), ('E', 1), ('F', 1), ('O', 0), ('O', 0), ('O', 0), ('O', 0), where the sorted symbols correspond to a list of padded symbols representing the concatenation of the input strings. The list of sorted symbols may be output, e.g., together with a secret length computed e.g. by summing up the input lengths, to provide a representation of the output string as a list of secret padded symbols and a secret length.

[0021] To perform the sorting, various techniques can be used that are known from the literature per se, for example, in the MPC setting from K. Jonsson et al., "Secure MultiParty Sorting and Applications", Cryptology ePrint Archive, Paper 2011 / 122. In particular, by using a generic sorting algorithm, the concatenation of more than two strings may be performed in such a way that the performance does not depend on the number of strings that are concatenated, but only on the sum of the lengths of the respective lists of padded symbols for the inputs.

[0022] Interestingly, since the padding indicators are typically binary, efficient sorting techniques may be used that are specifically designed for that case, such as binary key sort as disclosed in the MPC setting in K. Hamada et al., "Oblivious Radix Sort: An Efficient Sorting Algorithm for Practical Secure Multi-party Computation", Cryptology ePrint Archive, Paper 2014 / 121.

[0023] It may be noted that, for a specific string with a secret length, the representation may contain zero padding symbols, in particular, if the length of the string is equal to the maximum length. In such a case, the provided techniques work while keeping the fact that the string has maximum length, hidden to the cryptographic devices. In other cases, a string may have one or more padding symbols; also this may remain hidden to the devices.

[0024] Generally, the discussed techniques may be used to concatenate any number of strings, for example, at least three, or at least five. At least one of the strings to be concatenated may have a secret length. It is also possible to include one or more strings in the concatenation that do not have a secret length; also such a string may be represented by a list of padded symbols, for example, having zero padding symbols. In this case, the length may be a public value and accordingly also padding indicators may be public and can be computed without using secure computation.

[0025] Optionally, a padding indicator for a symbol may indicate whether the symbol is a padding symbol. This way, the stable sort may be implemented as a generic stable sort of pairs of a symbol and a corresponding padding indicator. However, it is also possible for the padding indicator to indicate whether the symbol is a first padding symbol; or whether the symbol is a last non-padding symbol. This representation of the padding indicator can be more convenient for performing a merge sort, for example, as also discussed elsewhere in this specification.

[0026] Optionally, the respective padding indicators for a string may be computed from the length of the string under the secure computation. For example, the length may be represented as an integer. To compute the padding indicators, a unit vector representation of the length of the string may be determined. For this, techniques may be used that are known per se, e.g., for the MPC setting, see S.J.A. de Hoogh, "Design of large scale applications of secure multiparty computation: secure linear programming", PhD thesis, Eindhoven University of Technology, 2012. Interestingly, from such a unit vector representation, the padding indicators may be determined efficiently, e.g., respective padding indicators that indicate whether a symbol is a padding symbol, may be computed by computing a prefix sum of the unit vector representation. Specifically, in the MPC setting, to determine the unit vector representation of the length of the string, an additive secret sharing of the length of the string between two of the parties of the MPC may be used. The first party may compute a first remainder of a division based on the first additive secret-share and the length of the unit vector representation, and to provide a vector representation of the first remainder as a secret input to the secure computation. The second party may compute a second remainder of a division based on the second additive secret-share and the length of the unit vector representation, and provide a vector representation of the second remainder as a secret input to the secure computation. The unit vector representation may then be determined by computing, under the MPC, a matrix-vector product based on the vector representations of the first and second remainders. As discussed in more detail elsewhere in this specification, this way, the unit vector representation may be computed particularly efficiently.

[0027] Optionally, the concatenation may be used to apply a substitution table to an input string. To this end, multiple substitution strings may be determined for the input string, and the multiple substitution strings may be concatenated. In particular, the substitution table may comprise respective substitutions of an input string by a substitution string, where e.g. the substitution strings may have not all have the same length, or at least may not be known to the parties to have the same length. For example, at least one substitution string may be longer than the corresponding input string. It is possible that the substitution strings are at least as long as the input strings, but this is not needed. In any case, the provided techniques provide a particularly efficient implementation of applying the substitution table, since e.g. oblivious shifts that depend on the difference between the lengths of the input string and the substitution string, may be avoided.

[0028] Optionally, a substitution string for an input symbol may be determined by obliviously selecting the substitution string from the substitution table based on the input symbol. The input substrings of the substitution table may be single characters. For a character not included in the substitution table, a default substitution may be performed, e.g., where the character is substituted by itself or by a fixed substitution. Applying the substitution table may be implemented as performing a concatenation of respective substitution strings corresponding to the respective input characters. In this case, the provided concatenation techniques are particularly beneficial, since a relatively large amount of strings may be concatenated.

[0029] Optionally, a set of symbols may be filtered out from an input string by substituting the set of symbols with the empty string. For example, an input symbol may be substituted by a variable-length string corresponding to the symbol itself, having length one, or the empty string, having length zero. Also in this case, a relatively large amount of concatenations may take place, making the proposed concatenation advantageous. Optionally, by applying a substitution table, a conversion may be performed from a variable-width string encoding to a fixed-width string encoding, or from a fixed-width string encoding to a variable-width string encoding. For example, the fixed-width string encoding may be UTF-32. The variable-width string encoding may be variable-width Unicode encoding, such as UTF-8 or UTF-16. The conversion may support all characters of the encoding, or only a subset.

[0030] Optionally, the stable sort may be performed using multi-party computation by, under the MPC: computing respective target indices for respective padded symbols; shuffling the respective target indices and padded symbols; opening the shuffled target indices; and ordering the shuffled padded symbols according to the shuffled target indices. As also detailed elsewhere in this specification, interestingly, this stable sort may be implemented particularly efficiently under secure computation, for example with an efficiency that is linear in the number of padded symbols. In particular, when the padding indicators are binary, the computation of the target indices for the respective padded symbols may be computed efficiently under the secure computation in terms of the efficient operations of addition, subtraction, and multiplication.

[0031] Optionally, the stable sort may be performed as a stable merge sort. A stable merge sort may be implemented by repeatedly performing a stable merge of pairs of already-sorted substrings. Interestingly, such a stable merge may be implemented particularly efficiently when using binary padding indicators. In particular, padding indicators may be used that indicate whether a symbol is the first padding symbol; whether the symbol is the last non-padding symbol; whether the symbol is the last padding symbol; or whether the symbol is the first non-padding symbol (e.g., when using a preprended padding). In particular, an output symbol may be determined based on the corresponding symbol from the first substring; and based on obliviously selecting a symbol from the second substring based on a corresponding padding indicator of the first substring. In particular, the output symbol may be computed as an inner product, which can in many cases be implemented particularly efficiently when using multi-party computation, e.g., at the cost of a multiplication.

[0032] In particular, interestingly, the stable merge sort can be implemented particularly efficiently when used for concatenation, because the list of padded symbols corresponding to an input string is already sorted. Accordingly, the merge sort does not need to use individual symbols as base case, but can instead use the input strings as base cases. In particular, a stable merge of two adjacent input strings may be performed to obtain a merge result; a further stable merge may be applied to the merge result; and so on.

[0033] Optionally, when using MPC, the merge sort may be performed on bitwise secret sharings of the multiple strings. This is a particularly beneficial combination because merge sort can be implemented efficiently in terms of bitwise operations without the need for arithmetic operations for computing target indices, and the like. Optionally, in addition to the list of sorted symbols, also the length of the concatenation of the multiple strings may be output. Accordingly, a representation of the concatenated result in terms of secret padded outputs and a secret length may be obtained.

[0034] It will be appreciated by those skilled in the art that two or more of the above- mentioned embodiments, implementations, and / or optional aspects of the invention may be combined in any way deemed useful. Modifications and variations of any system and / or any computer readable medium, which correspond to the described modifications and variations of a corresponding computer-implemented method, can be carried out by a person skilled in the art on the basis of the present description, and the other way round as well.

[0035] BRIEF DESCRIPTION OF THE DRAWINGS

[0036] These and other aspects of the invention will be apparent from and elucidated further with reference to the embodiments described by way of example in the following description and with reference to the accompanying drawings, in which:

[0037] Fig. 1 shows a cryptographic device;

[0038] Fig. 2 shows a cryptographic system;

[0039] Fig. 3 shows a detailed example of concatenating multiple strings;

[0040] Fig. 4 shows a detailed example of determining a substitution string;

[0041] Fig. 5 shows a detailed example of performing a stable sort;

[0042] Fig. 6 shows a detailed example of performing a stable sort;

[0043] Fig. 7 shows a detailed example of computing a unit vector representation;

[0044] Fig. 8 shows a computer-implemented method;

[0045] Fig. 9 shows a computer-readable medium comprising data.

[0046] It should be noted that the figures are purely diagrammatic and not drawn to scale. In the figures, elements which correspond to elements already described may have the same reference numerals.

[0047] DETAILED DESCRIPTION OF EMBODIMENTS

[0048] Fig. 1 shows a cryptographic device 100 for use in a cryptographic system as described herein, e.g., in Fig. 2. The cryptographic system may be for performing a privacypreserving computation on secret data. The computation may be performed as a cryptographic secure computation between one or more cryptographic devices, including device 100, for example using multi-party computation (MPC) or homomorphic encryption (HE). The privacy-preserving computation may comprise a concatenation of multiple strings.

[0049] The device 100 may comprise a data interface 120 for accessing data 030 representing the multiple strings to be concatenated. A string of the multiple strings may be represented by a length and a list of padded symbols. The length and the padded symbols may be secret values of the secure computation. For example, the length may be represented as a single integer, as a one-hot encoding, or the like. A padded symbol may be represented as a single integer, as a binary encoding, or the like. The number of strings 030 to be concatenated can be at most or at least 3, at most or at least 10, or at most or at least 50, for example. A length of a string can be at most or at least 10, or at most or at least 50 symbols, for example. The combined lengths of the input strings 030 can be at most or at least 10, at most or at least 100, or at most or at least 1000, for example.

[0050] For example, as also illustrated in Fig. 1, the input interface may be constituted by a data storage interface 120 which may access the data 030 from a data storage 021. For example, the data storage interface 120 may be a memory interface or a persistent storage interface, e.g., a hard disk or an SSD interface, but also a personal, local or wide area network interface such as a Bluetooth, ZigBee or Wi-Fi interface or an ethernet or fiberoptic interface. The data storage 021 may be an internal data storage of the system 100, such as a hard drive or SSD, but also an external data storage, e.g., a network- accessible data storage. In some embodiments, respective data may each be accessed from or distributed across different data storages, e.g., via a different subsystem of the data storage interface 120. Each subsystem may be of a type as is described above for data storage interface 120.

[0051] The device 100 may further comprise a processor subsystem 140 which may be configured to, during operation of the system 100, perform the concatenation of multiple strings 030 under the secure computation. To this end, the processor subsystem 140 may be configured to obtain respective padding indicators for the respective padded symbols of the string as secret values of the secure computation. Further, processor subsystem 140 may be configured to perform a stable sort of the padded symbols of the multiple strings according to the padding indicators for the multiple strings to obtain a list of sorted symbols. Processor subsystem 140 may be further configured to output the list of sorted symbols.

[0052] As also discussed with respect to Fig. 2, the device 100 may be further configured to provide inputs to the secure computation, e.g., to input one or more strings to be concatenated, e.g. by secret-sharing, encrypting, or otherwise masking them. The inputs may be obtained via an input interface of the system, such as an interface to a keyboard, mouse or similar, or an internal input interface (not shown). Instead or in addition, the device 100 may be further configured to obtain outputs from the secure computation, e.g., to obtain the concatenated string a result of a further secure computation applied to the concatenated string. The outputs may be output via an output interface, e.g., an interface to a screen or similar, or an internal output interface.

[0053] The system 100 may also comprise a communication interface 180 configured for communication 126 with at least one further cryptographic device of the cryptographic system. Communication interface 180 may internally communicate with processor subsystem 140 via data communication 125. Communication interface 180 may be arranged for direct communication with the other devices, e.g., using USB, IEEE 1394, or similar interfaces. As illustrated in the figure, communication interface 180 may also communicate over a computer network 099, for example, a wireless personal area network, an internet, an intranet, a LAN, a WLAN, etc. For instance, communication interface 180 may comprise a connector, e.g., a wireless connector, an Ethernet connector, a Wi-Fi, 4G or 4G antenna, a ZigBee chip, etc., as appropriate for the computer network. Communication interface 180 may be an internal communication interface, e.g., a bus, an API, a storage interface, etc.

[0054] In general, each device described in this specification, including but not limited to the system 100 of Fig. 1 may be embodied as, or in, a single device or apparatus, such as a workstation or a server. The device may be an embedded device. The device or apparatus may comprise one or more microprocessors which execute appropriate software. For example, the processor subsystem of the respective system may be embodied by a single Central Processing Unit (CPU), but also by a combination or system of such CPUs and / or other types of processing units. The software may have been downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash. Alternatively, the processor subsystem of the respective system may be implemented in the device or apparatus in the form of programmable logic, e.g., as a Field-Programmable Gate Array (FPGA). In general, each functional unit of the respective system may be implemented in the form of a circuit. The respective system may also be implemented in a distributed manner, e.g., involving different devices or apparatuses, such as distributed local or cloud-based servers.

[0055] Fig. 2 shows a cryptographic system 010 for performing a privacy-preserving computation as a cryptographic secure computation. The computation may comprise a concatenation of multiple strings, as described in more detail elsewhere. The cryptographic system 010 may in general comprise multiple input devices, one or more cryptographic devices, and at least one result device, where the sets of input, cryptographic, and result devices may overlap with each other. As illustrated, the devices typically communicate over a computer network 099, e.g., the internet or a local network.

[0056] In particular, as illustrated in the figure, the cryptographic secure computation may be a cryptographic secure multi-party computation. In such a case, there may be multiple cryptographic devices. For example, the figure shows three cryptographic devices CP1 , 221 ; CP2, 222; and CP3, 223. The number of cryptographic devices that is used can vary depending on the particular technique used for the multi-party computation and the security properties which are desired. For example, the number of cryptographic devices CPi can be two, three, or more. Although the cryptographic devices of the cryptographic system are typically distinct devices, e.g., operated by different organizational entities, it is also possible to combine the different cryptographic devices into a single device, for example, for performing the multi-party computation as a so-called MPC-in-the-Head, see, e.g., Y. Ishai et al., “Zero-knowledge from secure multiparty computation”, proceedings STOC 2007.

[0057] The cryptographic devices CPi may be configured to perform a secure multiparty computation (also known per se as multi-party computation, secure computation, or MPC). Generally, a multi-party computation may be a distributed protocol between the cryptographic devices for performing a computation in a privacy-preserving way. Depending on the specific technique used, MPC may ensure privacy and / or correctness of the computation against an attacker that eavesdrops or controls one or more (but typically not all) of the cryptographic devices. As known per se, any computation can be performed as a multi-party computation (in other words, “under the multi-party computation”), but concrete computational and communication efficiency can in general greatly depend on how exactly the computation is performed.

[0058] In particular, the multi-party computation can be performed based on one of the following techniques:

[0059] - based on secret sharing, in particular arithmetic secret sharing such as Shamir secret sharing, replicated secret sharing, or additive secret sharing. For example, the multi-party computation can be based on the techniques described in Shamir, “How to Share a Secret”, Communications ACM, 1979; Ben-Or, Goldwasser, Wigderson, “Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computation (Extended Abstract)”, Proceedings of the 20th Annual ACM Symposium on Theory of Computing, 1988; Chaum, Crepeau, Damgaard, “Multiparty Unconditionally Secure Protocols (Extended Abstract)”, Proceedings of the 20th Annual ACM Symposium on Theory of Computing, 1988; Ito, Saito, Nishizeki, “Secret sharing scheme realizing general access structure”, Electronics and Communications in Japan (Part III: Fundamental Electronic Science), 1989; Damgaard, Pastro, Smart, Zakarias, “Multiparty Computation from Somewhat Homomorphic Encryption”, proceedings CRYPTO 2012;

[0060] - based on garbled circuits, e.g., see Yao, “Protocols for Secure Computations (Extended Abstract)”, 23rd Annual Symposium on Foundations of Computer Science, Chicago, 1982;

[0061] - based on oblivious transfer, e.g., see Goldreich, Micali, Wigderson, “How to Play any Mental Game or A Completeness Theorem for Protocols with Honest Majority”, Proceedings of the 19th Annual ACM Symposium on Theory of Computing, 1987;

[0062] - based on threshold homomorphic encryption, e.g., see Cramer, Damgaard, Nielsen, “Multiparty Computation from Threshold Homomorphic Encryption”, proceedings EUROCRYPT 2001; - based on fully homomorphic encryption, e.g., see Nigel P. Smart, "Practical and Efficient FHE-based MPC", proceedings IMACC 2023;

[0063] - based on any combination of the above, e.g., see Demmler, Schneider, Zohner, “ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation”, proceedings NDSS 2015.

[0064] The multi-party computation may be configured to perform operations on so called sharings, or secret shares, of values. A secret share may be a distributed representation of an input, intermediate, or output value of the MPC. A limited number of shares, up to a certain threshold t, may not allow deriving the represented value. The threshold may be configurable, with different techniques supporting different possible threshold. For example, the multi-party computation may be an honest majority MPC, where the threshold t is strictly smaller than half the number of parties n, e.g., 1 / 2 (n - 1). Or, the multi-party computation can be a full-threshold MPC, where the threshold can be higher, e.g., n - 1. Examples of sharings are arithmetic sharing, such as Shamir secret sharing or replicated secret sharing; XOR sharing; or Yao sharing. It is stressed that the term secret sharing in this specification also includes Yao sharings, e.g., secret values of an MPC computation performed using garbled circuits, as also done in “ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation”.

[0065] As an alternative to using multi-party computation, homomorphic encryption (HE) may be used; for example, levelled homomorphic encryption or fully homomorphic encryption. In this case, the computation can be performed by a single cryptographic device CPi; but it is also possible for respective parts of the computation to be performed by multiple respective devices. The cryptographic device(s) CPi may obtain input data in encrypted form; perform a computation while keeping the input data encrypted; and output data also in encrypted form. E.g., the homomorphic encryption can use one of the following techniques:

[0066] - fully homomorphic encryption based on programmable bootstrapping, see, e.g., Chillotti; Gama; Georgieva; Malika Izabachene. "Faster Fully Homomorphic Encryption: Bootstrapping in less than 0.1 Seconds" (2016);

[0067] - levelled homomorphic encryption, see, e.g.: Cheon; Kim; Kim; Song, Yongsoo (2017). "Homomorphic encryption for arithmetic of approximate numbers" (ASIACRYPT 2017).

[0068] A value that is computed on by the secure computation, e.g., the multi-party computation or homomorphic encryption; but that is represented among the parties in such a way that no single party, more generally no unqualified set of parties, can derive the value from that representation, is referred to as a secret value, or private value, of the secure computation. In the case of MPC, a secret value can be a secret sharing, but it is also possible e.g. to use a threshold encryption. In the case of HE, a secret value can be an encryption. For example, a secret value can be a secret input, a secret output, or a secret intermediate value. Here, a secret input may be known in the plain by the party inputting it, and known only in a secret representation by the cryptographic device(s) CPi; and similarly, a secret output may be learned in the plain by the party receiving it as output, but may be known only in a secret representation by the cryptographic device(s) CPi. A private intermediate value may be known only to the cryptographic device(s) CPi, and only as a secret representation. By processing values using secret representations, the data can be kept secret, at least as long as the underlying assumptions of the cryptographic technique (e.g., a number and / or type of corruptions of the cryptographic devices) are satisfied.

[0069] For example, a length or a padded symbol of a string may be represented as a single secret value representing the length or padded symbol, or as multiple values that together represent the length or the padded symbol, e.g., by a one-hot encoding of the length or of a binary representation of the padded symbol.

[0070] Various higher-level operations such as sorting and integer comparison can be performed based on such basic computation protocols as discussed e.g. in the MPC setting in M. Keller, "MP-SPDZ: A Versatile Framework for Multi-Party Computation", proceedings ACM CCS 2020; as implemented in the MPC setting in MPyC, see https: / / github.com / lschoe / mpyc; or as implemented in the FHE setting in concrete, see, e.g., https: / / github.com / zama-ai / concrete.

[0071] Also shown in the figure are a number of input devices INP1 , 211; INP2, 212; up to INPk, 213. The input devices may input respective input data for the string concatenation, e.g., respective sets of zero, one, or more input strings. The input devices 211-213 may use the hardware configuration discussed in Fig. 1. The number of input devices can be two, at most or at least three, or at most or at least five, for example. In many cases, the sets of inputs devices INPi and cryptographic devices CPi may wholly or partially overlap. For example, the set of input devices may be a subset or a superset of the set of cryptographic devices, or may be exactly the same.

[0072] Further shown is a result device RES, 230. The result device RES may obtain a result of the MPC based on the performed privacy-preserving computation. For example, the result device RES may obtain the concatenated string, or a value derived from it. It is also possible for multiple respective result devices to obtain multiple respective results of the secure computation. Although illustrated as a separate device in the figure, the result device(s) RES can be the same devices as an input device INPi and / or cryptographic device CPi. Generally, the result device may be implemented using the hardware configuration discussed with respect to Fig. 1.

[0073] In the homomorphic encryption setting, the input device(s) INP may provide inputs to the cryptographic device(s) in encrypted form. The result device(s) may obtain outputs from the cryptographic device(s) in encrypted form. In the multi-party computation setting, many known techniques are defined per se for the case where the input and result devices INPi and RES form a subset of the set of cryptographic devices CPi that perform the MPC. To use such techniques in a setting where an input and / or result device does not perform the MPC itself, an input device can for example determine a secret representation, e.g., a secret sharing, and distribute it among the computation devices. Similarly, a result device can for example receive a secret representation, e.g., respective secret shares, of an output from the computation devices and derive the output from the secret representation. It is also possible to use specific techniques for letting an external party provide inputs to and / or obtain outputs from a multi-party computation. For example, the techniques from the following reference can be used: T. P. Jakobsen, J. B. Nielsen, and C. Orlandi. “A framework for outsourcing of secure computation”, proceedings CCSW’14.

[0074] Fig. 3 shows a detailed, yet non-limiting, example of performing a concatenation of multiple strings under secure computation.

[0075] By way of example, this figure shows three strings to be concatenated. The strings are represented by a length and a list of padded symbols. In this example, both the length and the padded symbols are secret values of the secure computation.

[0076] In particular, the figure shows a string "A", represented by length value 341 and by list of padded symbols 331. In this example, the string is padded on the right by zeroes, up to a maximum length of 3. The maximum length can be selected based on domain knowledge or configured by the user, for example. In this example, the number of padding symbols is two but in general any number of padding symbols, from 0 up to the maximum length, is possible. The figure further shows a string "THE", represented by length value 342 and list of padded symbols 332. In this case, there is one padding symbol on the right. Finally, the figure shows an empty string represented by length value 343 and list of padded symbols 336, in this example consisting solely of padding symbols.

[0077] In order to concatenate the strings, padding indicators may be used. This figure shows respective padding indicators 361 for respective padded symbols 331; respective padding indicators 362 for respective padded symbols 332; and respective padding indicators 363 for respective padded symbols 333. In this example, the value 1 is used to indicate that a symbol is a symbol of the string, and the value 0 is used to indicate that a symbol is a padding symbol. Other representations are possible, e.g., the roles of the values 0 and 1 can be swapped. A padding indicator can also indicate a first or last padding or non-padding symbol, which can be beneficial for particular types of sorting as discussed with respect to Fig. 6. It is preferred for the padding indicators to have only two possible values, in view of applying an efficient stable sort, as also discussed elsewhere.

[0078] In this example, the padding indicators 361 , 362, 363, may be determined from the respective length values 341 , 342, 343 in an operation ToUV, 350, based on computing a unit vector representation of the length value 341-343 under the secure computation. For example, for the first length 341, having a maximum value of three, a length-four unit vector may be determined indicating whether the length is zero, one, two, or three; in this example resulting in vector [0,1 , 0,0], Similarly, for length 342, vector [0,0, 0,1,0] may be determined; and for length 343, vector [1 ,0,0] may be determined.

[0079] The unit vector representations may for example be determined as disclosed in S.J.A. de Hoogh, "Design of large scale applications of secure multiparty computation: secure linear programming", PhD thesis, Eindhoven University of Technology, 2012 (incorporated herein by reference insofar as the ConvertUnary protocol is concerned); or based on secret vector representations of the first and second additive secret-shares as discussed in more detail elsewhere in this specification.

[0080] Based on a unit vector representation of the length, the padding indicators 361-363 may be determined. In this example, a padding indicator indicating whether or not the symbol is a padding symbol can be determined, e.g., based on computing a prefix sum of the unit vector. The / dh element of the prefix sum may be the sum of the first k elements of the input, for example. The prefix sum may be one if the symbol is a padding symbol and zero otherwise. By subtracting this prefix sum from one, a padding indicator may be obtained that is one if the symbol is not a padding symbol, as illustrated in this figure. Interestingly, especially when using multi-party computation based on secret sharing, the padding indicators may accordingly be determined efficiently from the unit vectors, e.g., without communication between the cryptographic devices.

[0081] Interestingly, string concatenation may be implemented by performing a sorting operation Sort, 370. As illustrated, the sort may be applied to the padded symbols of the multiple input strings, seen as a list of values V1 , 330. The sorting may be performed according to the padding indicators, which may accordingly form a list of keys K1 , 360 corresponding to the values.

[0082] In particular, the sorting may sort values V1 according to keys K1 , e.g., may sort key-value pairs K1,V1 according to an ordering defined by the keys K1. For example, keys indicating padding may be ordered after keys not indicating padding, in order to obtain an output in which the padding is appended, or the other way round in order to obtain an output in which the padding is prepended. The sorting may be a stable sort, meaning that for equal keys K1 , values V1 remain in the same order. This way, the sorting may preserve the relative ordering of the symbols of the input strings, but also the input strings themselves, and thereby result in ordered values V1S, 371, that represent a list of padded symbols of the concatenation of the input strings. The sorting may also result in sorted indicator values K1S, 372, but these may not be needed for concatenation per se.

[0083] To perform sorting Sort, various techniques that are known from the literature per se can be used. Interestingly, the sorting keys K1 are typically binary, allowing to use sorting techniques for that specific case. Two particularly beneficial techniques for sorting are discussed with respect to Figs. 5 and 6, respectively.

[0084] Although not shown in this figure, also the length of the output string V1S, 371 , may be computed under the secure computation, e.g. by computing a sum of the input lengths 341-343. It is also possible to compute the length based on the padding indicators, e.g., by computing a sum of the unsorted padding indicators K1 or the sorted padding indicators K1S. Either way, especially when multi-party computation using arithmetic secretsharing, the length can be determined efficiently.

[0085] Optionally, performing the concatenation may comprise checking, under the secure computation, whether the length of the output string V1S exceeds a given maximum length. If the length exceeds the maximum length, for example, a warning or error may be returned, and / or the output string V1S may be truncated to the maximum length. Interestingly, this way, an output string V1S may be returned that has a length that is smaller than the worst case, namely the sum of the lengths of the input strings. Still, the length of the output string can be kept hidden, apart from leaking whether the length exceeds the maximum. For example, when performing a conversion of Unicode codepoints to a UTF-8 encoding, the maximum length can be set to a maximum of at most or at least double the number of input codepoints, for example, as a configurable default. This way, the worst-case blow-up for this conversion, namely by a factor of four, can be avoided while in most cases providing a sufficient maximum length for the warning / error / truncation not to be triggered.

[0086] Fig. 4 shows a detailed, yet non-limiting, example of determining a substitution string under secure computation. Such a substitution string may be used to apply a substitution table to an input string. In particular, by determining respective substitution strings for respective symbols of an input string according to a substitution table as described with respect to this figure, and concatenating the determined substitution strings as described herein, the substitution table may be applied to the input string.

[0087] In particular, the figure shows an input character 410; in this example, the character ‘a’. The figure further shows a substitution table comprising one or more candidate characters 421 and their corresponding substitution strings 422, represented by lengths and lists of padded symbols. The lists of padded symbols may have the same length, e.g., corresponding to the maximum length of the substitution strings. The substitution strings however typically do not all have the same length. In particular, the figure shows a table in which the input character 'A' is substituted by the substitution string "Ae"; the input character ‘a’ is substituted by the substitution string "ae"; and the input character ‘E’ is substituted by the substitution string "E". The figure further shows a default substitution string 429 for input characters that do not match any of the candidate characters 'A', ‘a’, ‘E’. In this case, the default substitution string 429 is set to the input character 410 itself, but it is also possible to use a fixed default substitution string, for example. The contents (e.g., lengths and padded symbols) of the substitution table 421, 422, 429, can be secret, but this is not needed.

[0088] The figure further shows a comparison operation Cmp, 440, in which the input character 410 may be compared against respective candidate characters 421 of the substitution table to determine respective comparison outputs 450. For example, as illustrated in the figure, a comparison output of 1 may represent the input character 410 being equal to the candidate character 421. Optionally, a default comparison output 459 may be determined 1-Z, 455, indicating that the input character 410 matches none of the candidate input characters 421 , e.g., by computing one minus the sum of the comparison outputs 450. The comparison may be performed under secure computation using techniques that are known per se, e.g., from S.J.A. de Hoogh, "Design of large scale applications of secure multiparty computation: secure linear programming". It is also possible, for example, to obtain the comparison outputs by converting the input character 410 to a unit vector, as described for example with respect to Fig. 7, with the respective comparison outputs 450 corresponding to the respective indicator bits of the input character being equal to respective values. This latter possibility is particularly advantageous if the range of possible input characters 410 is relatively small, e.g., at most 50 or at most 256 values wide.

[0089] The comparison operation Cmp can deal with input symbols 410 that are padding symbols in various ways. If a fixed padding symbol is used, then the substitution table can for example map the padding symbol to the padding symbol. The comparison operation Cmp can also use the padding indicators to map padding input symbols to an appropriate output, e.g., an empty string.

[0090] It is also possible for the comparison operation Cmp to compare the input character 410 not to respective single candidate characters 421, but to respective sets of candidate characters. A set of candidate characters may represent one or more candidate characters. For example, the set of candidate characters may represent, or may include, a range of characters, e.g., set of uppercase characters A-Z, and / or the set of lowercase characters a-z. The comparison 440 for a range of characters can for example use one or more respective instances of a secure computation numeric comparison protocol as known per se to compare the input character to respective endpoints. The respective substitution strings 422 may be computed from the input character 410, wherein the computation may assume the character belongs to the set. For example, consider an operation to convert uppercase characters to lowercase; filter out lowercase characters; and keep the remaining characters intact. In that case, a first set of characters 421 may be defined corresponding to the range of uppercase characters A-Z, with corresponding substitution string 422 being equal to a string with length one and character value equal to the input character 410 plus the value 32. A second set of characters 421 may be defined corresponding to the range of lowercase characters a-z, with corresponding substitution string 422 being equal to a string with length zero. A default substitution string 429 may be used in this example which may be set to the input character 410 itself.

[0091] The figure also shows an oblivious selection operation OSel, 460, in which a substitution string 430 may be determined obliviously selecting the substitution string from the substitution strings 422, 429 based on the comparison outputs 450, 459. The oblivious selection may be performed by computing respective inner products of the comparison outputs with the lengths and padded symbols, respectively. For example, in this example, the output length may be determined as [0,1, 0,0] * [2, 2, 1,1] = 2, and similarly for the respective padded output symbols 'a', 'e'. Interestingly, in particular when MPC using secret sharing, such inner products may be computed efficiently under multi-party computation, regardless of whether or not the contents of the substitution table are secret.

[0092] String substitution according to substitution table as described herein may be used for various purposes. Although not shown in this figure, one or more substitutions 422, 429 may represent the empty string. In particular, the substitution table may be used to filter out a set of symbols from an input string, by substituting these symbols with the empty string. For example, the substitution table may map one or more symbols 421 to the empty string 422, and may have a default substitution 429 to the input symbol 410 itself. As another example, the substitution table may be used to perform a conversion from one, more, or all characters of a variable-width string encoding, such as UTF-8 or UTF-16, to a fixed-width string encoding, such as UTF-32, or the other way around. To support multi-symbol and / or variable length input strings in the substitution table, comparison operation Cmp may be configured to only match a symbol is it not part of a previous match, and otherwise map the symbol to the empty string.

[0093] As a specific example, string substitution according to a substitution table may be used to perform a conversion from a string of characters 410 encoded according to a fixed-width string encoding, e.g., as Unicode codepoints or as a UTF-32 encoding; to a substitution string representing a variable-width encoding of the string, e.g., a UTF-8 encoding or a UTF-16 encoding.

[0094] For example, for UTF-8, respective sets of characters 421 may represent whether the input character 410 maps to a one-byte, two-byte, three-byte, or four-byte UTF- 8 encoding. For example, a comparison output for the first set of characters, corresponding to one-byte encoding, may be determined by determining whether the input character 410 has a value of at most 0x7F. For this set of characters, the substitution string 422 may be set to an output string with length 1 and character equal to the input character 410. A comparison output for a second set of characters, corresponding to a two-byte encoding, may be determined by determining whether the input character 410 has a value of at least 0x80 and at most 0x7FF. For this set of characters, the substitution string 422 may be an output string with length 2, first character equal to the input character right-shifted by 6 bytes and XORed with bits 11000000, and second character equal to the lower 6 bits of the input character XORed with bits 10000000. Similarly, comparison outputs 450 and substitution strings 422 may be determined for the case that the output is a three-byte or a four-byte UTF-8 encoding, according to the following table:

[0095] Code point < > UTF-8 conversion (input character U+uvwxyz)

[0096] First c.p. Last c.p. Byte 1 Byte 2 Byte 3 Byte 4fa

[0097] U+0000 U+007F Oyyyzzzz N / A N / A N / A

[0098] U+0080 U+07FF 11 Oxxxyy 1 Oyyzzzz N / A N / A

[0099] U+0800 U+FFFF 111 Owwww 10xxxxyy 1 Oyyzzzz N / A

[0100] U+010000 U+10FFFF 1111 Ouvv 10vvwwww 10xxxxyy 1 Oyyzzzz

[0101] A conversion to UTF-16 may be similarly performed by determining whether the input character maps to a two-byte or a four-byte UTF-16 encoding, and determining substitution strings 422 for these two cases. The substitution strings can be represented as respective 16-bit values, respective bytes, or respective bits, for example.

[0102] Fig. 5 shows a detailed, yet non-limiting, example of performing a stable sort under secure computation. In this example, multi-party computation is used. In particular, the stable sort is applied to a list of padded symbols 530, e.g., list 330 of Fig. 3, and a list of padding indicators 560, e.g., list 360 of Fig. 3. In this example, by way of illustration, a value of 1 for a padding indicator indicates that the corresponding padded symbol is a nonpadding symbol of an input string, where a value of 0 indicates that the corresponding padded symbol is a padding symbol.

[0103] The figure further shows an operation Pos, 510, in which respective target indices 520 may be determined for respective padded symbols. A target index for a padded symbol may indicate a position of that symbol in the resulting list of padded symbols. Interestingly, since the padding indicators 560 in this example are binary, such a target index may be determined relatively efficiently under multi-party computation. For example, a target index t1 for a non-padding symbol can be computed e.g. as the sum ZP of the padding indicators 560 up to and not including the current symbol. A target index t2 for a padding symbol can be computed e.g. as the number of symbols L minus one minus the sum Z(1-P) of the negation (1-P) of the padding indicators up to and not including the current symbol. For a symbol that is either a padding symbol or a non-padding symbol as indicated by padding indicator P, the target index can be computed by obliviously selecting the target index t1 or the target index t2 based on the padding indicator, e.g., as t2 + P*(t1-t2). For example, the target indices 520 illustrated in the figure may be indicated as follows: position indicator P t1=ZP t2=L-1-Z(1-P) target index t2 + P*(t1-t2)

[0104] 0 1 0 8 0

[0105] 1 0 1 8 8

[0106] 2 0 1 7 7

[0107] 3 1 1 6 1

[0108] 4 1 2 6 2

[0109] 5 1 3 6 3

[0110] 6 0 4 6 6

[0111] 7 0 4 5 5

[0112] 8 0 4 4 4

[0113] Interestingly, this computation and its variations may be performed efficiently under multi-party computation, in particular when using arithmetic secret sharing, where a single multiplication per computed target index may suffice.

[0114] Further shown is a shuffle operation Shuff, 530, in which the padded symbols 530 and the target indices 520 may be shuffled according to a common secret shuffle unknown to any of the computation devices, thus providing shuffled padded symbols 541 and shuffled target indices 542.

[0115] To perform the shuffling under the multi-party computation, techniques may be used that are known per se, e.g., see S. Laur, "Round-efficient Oblivious Database Manipulation", Cryptology ePrint Archive, Paper 2011 / 429 (section 4, "Protocols for Oblivious Shuffle" being herein incorporated by reference). It is also possible to use the shuffle technique disclosed in European patent application EP23191521 titled "PRIVACYPRESERVING DATA PERMUTATION" and filed by Roseman Group B.V. (incorporated herein by reference, in particular the technique discussed with respect to Fig. 3).

[0116] The shuffled target indices 542 may be opened and may thereby become known to the parties, as illustrated with the dotted boxes in the figure. Interestingly, by shuffling the target indices, the target indices may be distributed as a random permutation in the view of the parties and may accordingly not reveal any information about the strings being concatenated.

[0117] Also shown is an ordering operation Order, 550, in which the shuffled padded symbols 541 may be ordered according to the shuffled target indices 542. The figure shows a resulting list of padded symbols 571 in which respective padded symbols 541 are located at the respective indicated target indices. The list of padded symbols 571 may correspond to sorted values V1S, 371 , of Fig. 3. It is noted that the technique as described in this figure can also determine sorted padding indicators K1S, 372, if so desired, by applying the shuffle Shuff and ordering Order also to the padding indicators 560. Interestingly, instead of using a shuffle Shuff that is unknown to all parties and an opening of the target indices to all parties, it is also possible to let a first subset of parties perform a shuffle that is known to this subset of parties, and let a second subset learn the target indices and perform the ordering Order, thereby improving efficiency.

[0118] For example, in the three-party setting, a first party may perform a shuffle and the second and third party may perform the reordering. For example, the first party may perform the shuffle such that the second and third party learn secret-shares of the resulting padded symbols 541 and target indices 542. This can, for example, be done based on the technique of Fig. 3 of EP23191521 by letting parties P2 and P3 re-randomize their shares 361 , 362 and party P2 sending its shares to party P1. The second and third parties can then open the target indices 542 and re-order their shares of the padded symbols 541 according to the target indices. The second and third parties can then convert the re-ordered padded symbols 541 as desired, e.g., to Shamir shares.

[0119] As another example, a first and second party may perform a shuffle known to these parties, and the third party may perform the ordering. For example, the first and second party may perform the shuffle according to the techniques of S. Laur, "Roundefficient Oblivious Database Manipulation", section 4.3. The first and second party may reveal the shuffled target indices 542 to the third party, and the third party may reorder the padded symbols 541 as described with respect to Fig. 3 of EP23191521 by using the reordering as the permutation chosen by party P2.

[0120] Fig. 6 shows a detailed, yet non-limiting, example of performing a stable sort under secure computation. In this example, the stable sort is performed by performing a stable merge sort. As is known per se, such a stable merge sort may be performed by repeatedly performing a stable merge Merge2, 620, in which two lists of already sorted values are merged, according to a divide-and-conquer operation D&C, 610.

[0121] Interestingly, as the inventors realized, in the case of string concatenation, the list of padded symbols that represent input strings are already sorted, and accordingly, the divide-and-conquer D&C can use these lists of padded symbols as a base case. For example, the divide-and-conquer can perform a stable merge of two of the multiple strings to obtain a merge result; and apply a further stable merge to the merge result. The figure illustrates the example where, using the example strings of Fig. 3 as input, the second and third strings 332, 333 have been merged to obtain merge result 632, and the stable merge Merge2 is applied to the first string 331, 631 and the merge result 632. More generally, the divide-and-conquer D&C can for example apply the merge Merge2 according to a binary tree structure in which the input strings are the leaf nodes.

[0122] The inventors realized that the stable merge Merge2 can be performed efficiently based on binary padding indicators. In particular, as illustrated in the figure, padding indicators may be used that indicate for a respective symbol whether the symbol is the first non-padding symbol or not. In particular, an output symbol 671 may be determined based on the corresponding symbol from the first substring 631; and based on obliviously selecting a symbol from the second substring 632 based on a corresponding padding indicator 661 of the first substring.

[0123] For example, the first output character may correspond to the first character of the first substring 631 if the first character is not the first non-padding character, and may correspond to the first character of the second substring otherwise. Similarly, the second output character may correspond to the second character of the first substring, to the first character of the second substring, or the second character of the second substring, as indicated by the second padding indicator and the first indicator.

[0124] For example, if padding symbols are zero, then in the above example, the stable merge Merge2 may be performed as follows, where the padded symbols 631 of the left substring are denoted [10,11 ,12]; the padded symbols 632 of the right substring are denoted [rO,r1 ,r2,r3,r4,r5]; and the padding indicators 661 of the left substring are denoted [p0,p1,p2]: position formula

[0125] 0 10 + pO*rO

[0126] 1 11 + p0*r1 + p1*rO

[0127] 2 I2 + p0*r2 + p1*r1 + p2*r0

[0128] 3 p0*r3 + p1*r2 + p2*r1 + (1-p0-p1-p2)*r0

[0129] 4 p0*r4 + p1*r3 + p2*r2 + (1-p0-p1-p2)*r1

[0130] 5 p0*r5 + p1*r4 + p2*r3 + (1-p0-p1-p2)*r2

[0131] 6 p1*r5 + p2*r4 + (1-p0-p1-p2)*r3

[0132] 7 p2*r5 + (1-p0-p1-p2)*r4

[0133] 8 (1-p0-p1-p2)*r5

[0134] In the above example, if padding symbols are not zero, then the character from the first substring can be selected based on whether or not it is a padding character, based on the padding indicators. It is also possible to use padding indicators indicating whether the symbol is the last padding symbol.

[0135] As shown in the figure, the stable merge Merge2 may also determine padding indicators 672 for the output. This can be done similarly to computing the output 671 itself. For example, as illustrated in the figure, output padding indicators that indicate the first padding symbol may be computed for the above example as follows, where the padding indicators 662 for the second string are denoted [qO,q1 ,q2,q3,q4,q5], and where q6:=1-q0- q1-q2-q3-q4-q5: position formula

[0136] 0 pO*qO

[0137] 1 pO*q1 + p1*qO

[0138] 2 p0*q2 + p1*q1 + p2*q0

[0139] 3 p0*q3 + p1*q2 + p2*q1 + (1-p0-p1-p2)*q0

[0140] 4 p0*q4 + p1*q3 + p2*q2 + (1-p0-p1-p2)*q1

[0141] 5 p0*q5 + p1*q4 + p2*q3 + (1-p0-p1-p2)*q2

[0142] 6 p0*q6 + p1*q5 + p2*q4 + (1-p0-p1-p2)*q3

[0143] 7 p1+q6 + p2*q5 + (1-p0-p1-p2)*q4

[0144] 8 p2*q6 + (1-p0-p1-p2)*q5

[0145] Other padding indicators may be used, e.g., in the above example, p0'=1-p0, p1'=1-p0-p1, etc. may be used indicating whether respective symbols are padding symbols.

[0146] The techniques discussed with respect to this figure can work in combination with secret sharing over any field or ring. Interestingly, this includes the padded symbols 631 , 632 and / or the padding indicators 661, 662 being represented in terms of bit-wise secret sharings. Namely, using binary padding indicators, it may be noted that the operations of the Merge2 operation as discussed above, remain valid if all values are bits. This is unlike the techniques of Fig. 5, for example, where a target index cannot be represented by a single bit-wise secret sharing.

[0147] Fig. 7 shows a detailed, yet non-limiting, example of computing a unit vector representation of a length value under secure computation, in this example, secure multiparty computation. This can be part of operation ToUV of Fig. 3, for example. Further details of this example can be found in European patent application EP24156154.7, filed by Roseman Group B.V (incorporated herein by reference).

[0148] In particular, the computation of the unit vector representation of the length value may be implemented as a computation of a remainder, in vector representation, of dividing the length value x by a divisor n. The divisor n may be the length of the unit vector to be determined, e.g., the maximum length of the string of which x is the length plus one.

[0149] This technique may be based on an additive secret-sharing of the input value x. Namely, the input value x may be secret-shared in the form of a first additive secret-share {x}i, 341 , and a second additive secret-share {x}2, 351 , forming an additive secret-sharing of the input value x modulo a modulus p, 330, e.g., {x}i + {x}2= x mod p. The first and the second additive share may be random, e.g., statistically independent of x, from the point of view of the respective parties holding the shares.

[0150] The value x may be assumed to be much smaller than the modulus p, e.g., by a factor 2A10, 2A20, or 2A30 (withAdenoting power), e.g., x may be a value with headroom as known per se in the multi-party computation literature. As is common per se in the field of multi-party computation, the provided techniques may have probabilistic correctness; in this case, with an error probability x / p, bounded by B / p where B is an upper bound on possible values of the input x.

[0151] If {x}i, {x}2is a random additive secret sharing, e.g., as obtained by conversion from a random multiplicative secret sharing, then the shares {x}i, {x}2may be considered random variables, uniform over [0, p).

[0152] Interestingly, as the inventors realized, if x « p, then the probability that {x}i < x is negligible. Hence, essentially, it can be expected that the sum {x}i + {x}2without modulo reduction wraps around the modulus p exactly once, e.g.,

[0153] {x}i + {x}2= X + p.

[0154] Re-arranging terms and reducing modulo n, one may obtain:

[0155] {x}i + {x}2- p = x; so

[0156] ({x}i + {x}2- p) mod n = x mod n (= x if x<n).

[0157] This latter equation shows that the value x may be equal to a remainder of dividing the value ({x}i + {x}2- p) by the divisor n. Accordingly, the value x mod n in vector representation, which may correspond to the unit vector representing the value x, may be computed by computing a vector representation of ({x}i + {x}2- p) mod n.

[0158] Interestingly, although the value x is secret, in the above expression, the inventors realized that the values {x}i, {x}2, -p to be reduced modulo n may all be known to at least one of the parties carrying out a multi-party computation. Accordingly, these values can be reduced modulo n in the plain without needing an interactive multi-party computation protocol. The value x mod n may then be computed based on these modulo-reduced values.

[0159] There are different possibilities for dealing with the value p in the above expression. For example, reducing the respective summands modulo n, in other words determining the remainder by division by n, one obtains:

[0160] (({x}i mod n) + ({x}2mod n) + (-p mod n)) mod n = x mod n.

[0161] Accordingly, x mod n may be computed by local computation of ({x}i mod n); ({x}2mod n); and (-p mod n); and adding three numbers that are at most n.

[0162] Preferably, however, the value p can also already be dealt with by incorporating it in one or both additive shares, e.g., by subtracting the modulus p from the first additive secret-share {x}i plus the second additive secret share {x}2prior to computing the remainders. For example, as illustrated in the figure, the value p can be incorporated in the second additive secret share to obtain value {x}2- p to be reduced modulo n:

[0163] (({x}i mod n) + (({x}2- p) mod n)) mod n = x mod n, such that x mod n can be computed by taking the modulo-n reduction of the sum of two values y = ({x}i mod n) and z = ({x}2- p) mod n) that are both smaller than n. Similarly, the value p can be incorporated in the first additive share, or partly in both shares. Turning to the figure, shown are a first additive secret-share {x}i, 741 of a first cryptographic device, and a second additive secret-share {x}2, 751 of a second cryptographic device, together forming an additive secret-sharing of the secret input value x modulo a modulus p, e.g., {x}i + {x}2= x mod p.

[0164] The figure further shows an operation ModN, 770, for computing a remainder of a division by a divisor n. As shown in the figure, the first cryptographic device may use operation ModN to compute a first remainder y, 749 of a division based on the first additive secret-share {x}i and the divisor n. The second cryptographic device may use operation ModN to compute a second remainder z, 759 of a division based on the second additive secret-share {x}2and the divisor n. As discussed, the inputs to ModN can be the additive secret shares themselves, optionally corrected to subtract modulus p from the sum of the two secret shares.

[0165] The figure further shows a secure multi-party computation MPC, 780, being carried out by a set of cryptographic devices. This set of devices typically includes the first and second cryptographic device, although in principle these latter devices could also be external input parties to the multi-party computation MPC.

[0166] The first and second cryptographic devices may provide the first remainder y and the second remainder z, respectively, as secret inputs to the multi-party computation MPC, for example, by secret-sharing them. Interestingly, the first and second cryptographic devices may provide the first and second remainder y, z, as secret inputs to the multi-party computation, in vector representations [yo], [yn-i] , 748 and [zo], [zn-i], 758. The vector representation of a value y, z, may have a non-zero entry at a location indicated by the value, for example, value 0 may be represented by a vector which has a non-zero entry only at the first location in the vector; the value 1 may be represented by a vector which has a non-zero entry only at the second location in the vector; etcetera. For example, the vectors may be unit vectors, e.g. in this case standard unit vectors, although this is not strictly needed. The length of the vector may be equal to the divisor n. It is also possible e.g. to use a vector representation where only n - 1 elements are stored and the nth element is defined implicitly, e.g., as 1 minus the sum of the other elements. For example, as illustrated in the figure, the values y, z, may be represented in the multi-party computation MPC by respective secret-shares for the respective elements of the vectors.

[0167] Interestingly, a remainder y, z may be input into the multi-party computation MPC more efficiently by involving a further cryptographic device. Without loss of generality, this is now illustrated for the second remainder z. Namely, the second cryptographic device may provide the representation of the second remainder z as a secret input to the multi-party computation together with a third cryptographic device. To this end, the second device can for example provide the second additive secret-share {x}2to the third cryptographic device for computing the second remainder z, or the second cryptographic device may directly provide the second remainder z to the third cryptographic device. Since the third cryptographic device may not know the first additive secret share {x}i, this may be done without affecting the secrecy of the secret input x. It is also possible for the second cryptographic device to directly provide the second remainder z to the third cryptographic device. In any case, when obtaining the additive shares from multiplicative shares, a rerandomization of the additive shares between the first and cryptographic devices may be performed to avoid that the secret additive share {x}2leaks information.

[0168] In any case, advantageously, the second and third cryptographic device may provide the vector representation z as input to the multi-party computation MPC more efficiently than the second cryptographic device itself, e.g., by computing their respective shares such that the share of the first cryptographic device is fixed, e.g., equal to zero. For example, the second cryptographic device may communicate z in numeric form to the third cryptographic device, whereafter the second and third cryptographic devices may input z into the multi-party computation in vector form without communication.

[0169] The resulting remainder 710 may be computed by computing a remainder of dividing the first additive secret-share plus the second additive secret-share minus the modulus by the divisor. In this example, also the resulting remainder 710 may be represented as a vector [xo], [xn-i]. This vector 710 may provide a unit vector representation of the input x, e.g., the length of a string.

[0170] Interestingly, when using vector representations, the resulting remainder [xj may be computed by computing a matrix-vector product MatMul, 785 based on the secret vector representations of the first remainder [yj and second remainder [zj. Namely, it may be observed that the operation that circularly shifts a length-n unit vector by a number of positions indicated by another length-n unit vector, can be interpreted as addition modulo n. Accordingly, the output of the matrix-vector multiplication may effectively be a vector representation of the sum of the first and second remainder.

[0171] This operation MatMul may be implemented by interpreting one of the vectors, e.g., the vector [zj, as a circular shift matrix, by means of constructing a matrix where the first row equals [zj and for the remaining rows it holds that every row is a circularly-shifted (by one position) copy of the previous row. This circular shift matrix representation for one of the remainders may be multiplied with the vector representation of the other remainder. This is illustrated in the figure by showing a circular shift matrix 757 for the second remainder 758. In particular, operation MatMul may compute the matrix-vector product y*Z of first remainder y and matrix representation Z of the second remainder. The matrix-vector product may also be computed as Zt*y, with Zt denoting the transpose of the circular shift matrix. It is similarly also possible to compute the matrix-vector product by interpreting the first remainder as a circular shift matrix and multiplying this matrix by the vector representation of the second remainder. In any case, performing matrix-vector multiplication MatMul under a multiparty computation MPC is known per se in the art, and can interestingly be performed especially efficiently on secret shares of a multiplicative secret sharing, by implementing an inner product in terms of a single resharing, as is known e.g., from "Design of large scale applications of secure multiparty computation: secure linear programming". Depending on the further use, it is also possible to further improve efficiency by not performing the resharing and thus outputting the resulting remainder 710 in product-shared form.

[0172] Preferably, performing the matrix-vector multiplication MatMul does not comprise explicitly representing all respective elements of the circular shift matrix in memory. Instead, the circular shift matrix may be accessed by translating an access of a certain cell of the circular shift matrix to an index in the corresponding vector representation of the remainder, and accessing the vector at this index. This way, the matrix-vector multiplication can be implemented using an amount of memory that only scales linearly in the divisor n. For example, such a matrix-vector multiplication can be implemented by using a nullary expression as supported e.g. by the eigen library, or the like.

[0173] Generally, the subtraction of the modulus in the computation of the resulting remainder may be accounted for in the first and / or second remainder, in which case the matrix multiplication output can directly result in the vector representation 710 of the resulting remainder. However, it is also possible to account for the modulus after performing the matrix-vector multiplication, by applying a public shift by (-p mod n) positions to the matrix-vector multiplication output.

[0174] In any case, interestingly, the resulting remainder 710 may be computed in vector representation in a relatively efficient way by means of the provided techniques; in particular, with a favorable communication complexity that is only linear in n.

[0175] As shown in the figure, the additive secret-shares {x}i, {x}2may be obtained by the first and second cryptographic devices obtaining respective multiplicative secretshares [x]i, 740, [x]2, 750, of the secret input value x, and applying a conversion operation Conv, 760, to compute the first additive secret-share {x}i and the second additive secretshare {x}2from the respective multiplicative secret-shares [x]i, [x]2. For example, in the case of Shamir secret-sharing, as is known per se, such a conversion may be performed by having the devices multiply (in the finite field Z / pZ) their Shamir share by the appropriate Lagrange coefficient.

[0176] Several variations are possible. For example, the correction with respect to modulus p can be performed by the first cryptographic device instead of the second cryptographic device.

[0177] The operations Conv, ModN, MPC may be repeated for several inputs x. In this case, it is advantageous to load-balance the work Conv, ModN of the pair of the first and second cryptographic devices among the overall set of cryptographic devices, e.g., to select respective pairs of cryptographic devices for respective inputs. For example, the cryptographic devices may compute a further secret representation of a further remainder based on an additive secret-share of a third cryptographic device, different from the first and second cryptographic devices. For example, when applying the operations to a vector of inputs, respective pairs of cryptographic devices may be selected for elements of the vector. Another way of selecting the pair of cryptographic devices applies when the cryptographic devices work by associating respective operations of the cryptographic secure multi-party computations with respective values of a program counter, as is done in the MPyC framework of B. Schoenmakers, for example. In such a case, the pair of cryptographic devices can be selected from the multiple cryptographic devices based on the program counter. This way, load balancing can be achieved without additional synchronization communication between the cryptographic devices.

[0178] Fig. 8 shows a block-diagram of a cryptographic method 1000 of performing a privacy-preserving computation. The privacy-preserving computation may be performed by a cryptographic device as a secure computation between one or more cryptographic devices comprising the cryptographic device. The privacy-preserving computation may comprise a concatenation of multiple strings.

[0179] For example, the cryptographic device can be device 100 of Fig. 1. However, this is not a limitation, in that the method 1000 may also be performed using another system, apparatus or device. The method 1000 may further comprise the carrying out of the secure computation by the other cryptographic devices. For example, the method 1000 may be carried out by a cryptographic system, e.g., cryptographic system 010 of Fig. 2. The method 1000 may be computer-implemented. Although the roles of multi-party computation parties are typically carried out by distinct devices, it is also possible to combine the roles of multiple parties in a single device, e.g., in a method of performing the privacy-computation as a MPC-in-the-Head.

[0180] The method may comprise, in an operation labeled "COMMUNICATE", communicating 1010 with at least one further cryptographic device of the one or more cryptographic devices. This operation may be omitted e.g. if there is only one cryptographic device.

[0181] The method may comprise, in an operation labeled "ACCESS", accessing 1020 data representing the multiple strings. A string of the multiple strings may be represented by a length and a list of padded symbols. The length and the padded symbols may be secret values of the secure computation.

[0182] The method may comprise, in an operation labeled "OBTAIN PADDING INDICATORS", obtaining 1030 respective padding indicators for the respective padded symbols of the string as secret values of the secure computation. The method may comprise, in an operation labeled "STABLE SORT", performing 1040 a stable sort of the padded symbols of the multiple strings according to the padding indicators for the multiple strings to obtain a list of sorted symbols. The method may comprise, in an operation labeled "OUTPUT", outputting 1050 the list of sorted symbols.

[0183] It will be appreciated that, in general, the operations of method 1000 of Fig. 8 may be performed in any suitable order, e.g., consecutively, simultaneously, or a combination thereof, subject to, where applicable, a particular order being necessitated, e.g., by input / output relations.

[0184] The method(s) may be implemented on a computer as a computer implemented method, as dedicated hardware, or as a combination of both. As also illustrated in Fig. 9, instructions for the computer, e.g., executable code, may be stored on a computer readable medium 1100, e.g., in the form of a series 1110 of machine-readable physical marks and / or as a series of elements having different electrical, e.g., magnetic, or optical properties or values. The medium 1100 may be transitory or non-transitory. Examples of computer readable mediums include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Fig. 11 shows an optical disc 1100.

[0185] The instructions may be instructions for one or more particular devices of the cryptographic system. In particular, the instructions may comprise instructions for a cryptographic device to perform a concatenation as described herein.

[0186] Examples, embodiments or optional features, whether indicated as nonlimiting or not, are not to be understood as limiting the invention as claimed.

[0187] It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or stages other than those stated in a claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Expressions such as “at least one of’ when preceding a list or group of elements represent a selection of all or of any subset of elements from the list or group. For example, the expression, “at least one of A, B, and C” should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

CLAIMS1. A cryptographic system (010) for performing a privacy-preserving computation on secret data, wherein the cryptographic system comprises one or more cryptographic devices (221-223), wherein the one or more cryptographic devices are configured to perform the computation as a cryptographic secure computation between the one or more cryptographic devices, wherein the computation comprises a concatenation of multiple strings, wherein the cryptographic devices are configured to, using the secure computation: obtain a representation of a string of the multiple strings, wherein the string is represented by a length and a list of padded symbols, wherein the length and the padded symbols are secret values of the secure computation; obtain respective padding indicators for the respective padded symbols of the string as secret values of the secure computation; perform, under the secure computation, a stable sort of the padded symbols of the multiple strings according to the padding indicators for the multiple strings to obtain a list of sorted symbols; output the list of sorted symbols.

2. The system (010) of claim 1, wherein a padding indicator for a symbol indicates whether the symbol is a padding symbol; whether the symbol is a first or last padding symbol; or whether the symbol is a first or last non-padding symbol.

3. The system (010) of claim 2, wherein the system is configured to compute the respective padding indicators under the secure computation based on computing a unit vector representation of the length of the string.

4. The system (010) of claim 3, wherein: the cryptographic secure computation is a cryptographic secure multi-party computation; a first and second cryptographic device of the one or more cryptographic devices are configured to respectively obtain a first and a second secret-share of the length of the string; the first cryptographic device is configured to compute a first remainder of a division based on the first additive secret-share and the length of the unit vector representation; and to provide a vector representation of the first remainder as a secret input to the secure computation;the second cryptographic device is configured to compute a second remainder of a division based on the second additive secret-share and the length of the unit vector representation; and to provide a vector representation of the second remainder as a secret input to the secure computation; the cryptographic devices are configured to, using the secure computation, compute the unit vector representation by computing a matrix-vector product based on the vector representations of the first and second remainders.

5. The system (010) of any preceding claim, wherein the system is configured to apply a substitution table to an input string by determining multiple substitution strings for the input string, and concatenating the multiple substitution strings.

6. The system (010) of claim 5, wherein the system is configured to determine a substitution string for an input symbol by obliviously selecting the substitution string from the substitution table based on the input symbol.

7. The system (010) of claim 5 or 6, wherein the system is configured to filter out a set of symbols from the input string by substituting the set of symbols with an empty string.

8. The system (010) of claim 5 or 6, wherein the system is configured to perform a conversion between a variable-width string encoding and a fixed-width string encoding.

9. The system (010) of any preceding claim, wherein the cryptographic secure computation is a cryptographic secure multi-party computation, and wherein the system is configured to perform the stable sort by, under the secure computation: computing respective target indices for respective padded symbols; shuffling the respective target indices and padded symbols; opening the shuffled target indices; and ordering the shuffled padded symbols according to the shuffled target indices.

10. The system (010) of any one of claims 1-8, wherein the system is configured to perform the stable sort by, under the secure computation, performing a stable merge of two of the multiple strings to obtain a merge result; and to apply a further stable merge to the merge result.

11. The system (010) of claim 10, wherein the stable sort is performed on bit-wise secret sharings of the multiple strings.

12. The system (010) of any preceding claim, wherein the cryptographic secure computation is a cryptographic secure multi-party computation or a homomorphic encryption computation.

13. A cryptographic device (100, 221-223) for use in the cryptographic system (010) comprising one or more cryptographic devices according to any one of claims 1-12, wherein the cryptographic device is for performing a privacy-preserving computation as a cryptographic secure computation between the one or more cryptographic devices, wherein the privacy-preserving computation comprises a concatenation of multiple strings, wherein the cryptographic device comprises: a data interface (120) for accessing data (040) representing the multiple strings, wherein a string of the multiple strings is represented by a length and a list of padded symbols, wherein the length and the padded symbols are secret values of the secure computation; a processor subsystem (140) configured to: obtain respective padding indicators for the respective padded symbols of the string as secret values of the secure computation; perform a stable sort of the padded symbols of the multiple strings according to the padding indicators for the multiple strings to obtain a list of sorted symbols; output the list of sorted symbols.

14. A cryptographic method (1000) of performing a privacy-preserving computation, wherein the privacy-preserving computation is performed by a cryptographic device as a secure computation between one or more cryptographic devices comprising the cryptographic device, wherein the privacy-preserving computation comprises a concatenation of multiple strings, wherein the method comprises: accessing (1020) data representing the multiple strings, wherein a string of the multiple strings is represented by a length and a list of padded symbols, wherein the length and the padded symbols are secret values of the secure computation; obtaining (1030) respective padding indicators for the respective padded symbols of the string as secret values of the secure computation; performing (1040) a stable sort of the padded symbols of the multiple strings according to the padding indicators for the multiple strings to obtain a list of sorted symbols; outputting (1050) the list of sorted symbols.

15. A transitory or non-transitory computer-readable medium (1100) comprising data (1110) representing instructions which, when executed by a processor system, cause the processor system to perform the cryptographic method of claim 14.

Images