Andrew LindellAladdin Knowledge Systems and Bar-Ilan University04/09/08 CRYP-202
Legally-Enforceable Legally-Enforceable Fairness in Secure Fairness in Secure Two-Party ComputationTwo-Party Computation
Insert presenter logo here on slide master
Secure Multiparty Computation
A set of parties with private inputs wish to compute some joint function of their inputs
Parties wish to preserve some security properties. E.g., privacy and correctness» Example: secure election protocol
Security must be preserved in the face of adversarial behavior by some of the participants, or by an external party
Insert presenter logo here on slide master
Security Requirements
Privacy» Parties can learn their designated output and nothing more
• My private vote in an election is not revealed
Correctness» The correct function is computed
• The candidate with the majority vote is elected
Independence of inputs» Parties cannot make their inputs depend on others
Fairness» If one party receives output, then all receive output
Insert presenter logo here on slide master
Fairness
Cleve (1986) showed that it is impossible for two parties to fairly toss a coin» Can be extended to other functionalities as well
Intuition behind proof» Assume that can compute fairly with m rounds» Consider an adversary that doesn’t send its last message» By the requirement of fairness, the other party still receives
output• Thus, this last message is not needed
and the protocol can be made m–1 rounds
Insert presenter logo here on slide master
Impossibility of Fairness (continued)
By induction, all messages can be removed, and so we are left with an empty protocol
But only trivial functions can be computed without interaction!
Conclusion: fairness cannot be achieved
Warning» This intuition is not exact,
and the real situation is more involved
Insert presenter logo here on slide master
Fairness – Alternatives
Gradual release [BG,GL]» The output is released slowly, so that no party has too much
advantage in guessing it
Optimistic computation [M,ASW,CC]» An online trusted party is assumed to be in place» If no one cheats, the trusted party is not needed» If fairness is breached by cheating, the
trusted party is invoked to help restore fairness
Insert presenter logo here on slide master
A New Approach
Similar to the optimistic model, but use existing legal and financial infrastructure
Assume that digital signature law is in place and recognized» Digitally-signed cheques are enforced
Insert presenter logo here on slide master
Concurrent Signatures – Prior Work
Problem of fair exchange of signatures Fundamental observation by Chen, Kudla and Paterson
» A signature can only be enforced by revealing it (e.g., in a court)
Their idea» First, one party receives only a keystone (useless by itself)
» Then, the other party receives the full signature it is supposed to
» Given the keystone and the other signature, the first party can derive its full signature
Construction under specific assumptions and using a random oracle
Insert presenter logo here on slide master
Achieving Concurrent Signatures
To motivate our method, we show how to achieve concurrent signatures» With general assumptions and no random oracle
Requirement:» P1 should receive a signature on m1, denoted 1=Sign(m1).
» P2 should receive a signature on m2, denoted2=Sign(m2).
The protocol:» The parties use a secure two-party computation protocol
• First, P1 receives1=Sign(m1,2)
• Then, P2 receives2=Sign(m2)
Insert presenter logo here on slide master
Achieving Concurrent Signatures
Reminder» P1 receives1=Sign(m1,2)
» P2 receives2=Sign(m2)
If P1 aborts after receiving 1, then P2 may not receive its signature 2
» In order to enforce 1, P1 has to present it (e.g., to a court)
» But, this reveals 2, restoring fairness
Remark» This is not perfect, but it is very good...
Insert presenter logo here on slide master
Secure Two-Party Protocol – Background
Requirement:» P1 and P2 have inputs x and y
» P1 and P2 should receive f(x,y), for some function f
Notation» A cheque from P1 to P2 is a digitally signed message:
• Stating whom the recipient is• Stating how much money should be transferred• Containing an additional field for arbitrary text
Insert presenter logo here on slide master
Our Protocol for Secure 2-Party Computation
Phase 1: The parties use a secure two-party computation protocol:» P1 receives a signed cheque chq1 for $10,000 from P2
• This cheque contains another cheque chq2 for $10,000 for P2 from P1
• The cheque chq2 is encrypted so that only P2 can decrypt
• The cheque chq2 contains the output value f(x,y)
Phase 2» P1 sends the encrypted chq2 to P2
» P2 decrypts, obtains f(x,y) and sends it back to P1
chq1
chq2
f(x,y)
Insert presenter logo here on slide master
Our Protocol for Secure 2-Party Computation
Party P2Party P1 x y
x y
Secure computation subprotocol
chq1
Contains encrypted counter-cheque chq2 for P2 (with output)
Contains encrypted counter-cheque chq2 for P2 (with output)
chq2, f(x,y)
Decrypt, and obtain f(x,y)
f(x,y)
Output f(x,y)Output f(x,y)
Insert presenter logo here on slide master
Early Aborting
If either party aborts before the end of phase 1» No one learns anything and so
fairness is preserved
If P1 aborts after receiving chq1
» It hasn’t learned the output and so fairness is preserved
» If it tries to cash chq1, P2 will obtain chq2 and will counter it (so P2 won’t lose money)
x y
chq1 chq2, f(x,y)
f(x,y)
Insert presenter logo here on slide master
Early Aborting
If P2 aborts after receiving chq2
» P2 has learned f(x,y) and P1 hasn’t, so fairness is breached
» But P1 has a cheque from P2 and so can force P2 to either present f(x,y) or pay!
Conclusion:» P2 can breach fairness, but only by
paying the cheque• Setting the sum high enough makes this
unlikely
x y
chq1 chq2, f(x,y)
f(x,y)
Insert presenter logo here on slide master
A Comparison to the Optimistic Model
Optimistic model» Guarantees fairness always» Fairness is obtained immediately» Requires “special” infrastructure and trust
Our solution» Uses existing infrastructure in society (that is trusted)» Fairness is not immediate (need to wait for courts, bank…)» Adversary can choose to breach fairness for a high enough
price
Insert presenter logo here on slide master
Summary
We introduced a different approach to fairness
Future challenges» Construct efficient protocols according to our approach
» Make the world a fairer place• Although this may be out of the
scope of this work
Insert presenter logo here on slide master
Legal Notice
© Copyright 2008 Aladdin Knowledge Systems Ltd. All rights reserved.
Aladdin, Aladdin Knowledge Systems, the Aladdin Knowledge Systems logo, eToken and eSafe are trademarks of Aladdin Knowledge Systems Ltd. covered by patents www.aladdin.com/patents; other patents pending.
You may not copy, reproduce (or the like), or use in any other way whatsoever, whether directly or indirectly, any of the materials represented and/or disclosed herein without the express written consent of Aladdin.
Some of the information contained herein may be proprietary information of Aladdin or third parties and all text, images, graphics, trademarks, service marks, logos, trade names and other materials which are part of this communication are subject to intellectual property rights of Aladdin or third parties. The information herein is provided “as is” without any warranty, express or implied (by statute or otherwise), of any kind whatsoever. Aladdin does not undertake any obligation to update the information herein and it does not assume responsibility for errors or omissions.
Top Related