Three-Party Garbled Circuit Protocol for Active Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing garbled circuit protocols for secure multiparty computation are only passively secure, making them vulnerable if one party deviates from the protocol, and methods to achieve active security, such as cut-and-choose, are computationally expensive or unsuitable for bandwidth-constrained mobile devices.
Innovation Solution
A three-party variant of Yao's garbled circuit system is implemented, where a mobile device and two servers collaborate to securely compute an arbitrary function without any party learning the other's data, using a keyed PseudoRandom Function and garbled circuits to split cryptographic keys, ensuring active security without the need for complex operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard cut-and-choose method is used to achieve active security in garbled circuits, then security against arbitrary deviations is improved, but computational cost increases significantly
Solution Approach 1:
The protocol segments the garbled circuit evaluation into multiple independent batches, where the circuit creator generates multiple garbled circuits and the evaluator selects which ones to evaluate. This segmentation allows the system to achieve active security through statistical sampling rather than complex verification of each individual circuit, significantly reducing computational overhead while maintaining security guarantees.
Solution Approach 2:
The circuit creator performs preliminary actions by generating multiple garbled circuits in advance and providing commitments to all of them before the evaluator makes its selection. This preliminary generation and commitment process allows the evaluator to later verify that no circuits were substituted or modified, achieving active security without requiring complex verification during the actual evaluation phase.
2Reliability
If three-party protocol with high bandwidth constraints is used, then active security is achieved, but suitability for mobile devices deteriorates
Solution Approach 1:
The protocol extracts the heavy computational and communication burden from the mobile device by assigning the generation of multiple garbled circuits and the selection process to the server side. The mobile device only needs to participate in the Oblivious Transfer protocol and receive the final result, significantly reducing its bandwidth requirements and making the protocol suitable for mobile environments while maintaining active security through the server's computational power.
3Ease of operation
If mobile device holds master secret data, then authentication functionality is enabled, but security upon device loss deteriorates
Solution Approach 1:
The master secret key is segmented into multiple shares using secret sharing schemes, with each share stored in different locations (mobile device, server, or hardware security modules). The authentication functionality remains enabled as long as sufficient shares are available, but if the mobile device is lost, the authentication can still proceed using the remaining shares, thereby maintaining both functionality and security upon device loss.
Solution Approach 2:
The protocol introduces intermediary elements such as hardware security modules (HSMs) or trusted execution environments (TEEs) that hold portions of the secret key. These intermediaries act as mediators that can provide authentication capabilities without requiring the mobile device to hold the complete master secret, thereby enabling authentication functionality while improving security posture against device loss through distributed key management.
Data Source
AI summary
The subject matter discloses a computerized system, comprising a computerized device communicating with a third party server, that comprises a memory unit that stores a representation of a Boolean circuit and a processing unit for calculating a result of the Boolean circuit according to a string used as input for the Boolean circuit and calculating a first predefined function on the result of the Boolean circuit. The system also comprises a first auxiliary server communicating with the computerized device, the first auxiliary server comprises a processing unit for calculating a second predefined function on the result of the Boolean circuit received from the computerized device and a second auxiliary server communicating with the computerized device comprises a processing unit for comparing the result of the first predefined function and the result of the second predefined function.