Complexity of Multi-party Computation Problems: The Case of 2-Party Symmetric Secure Function Evaluation

Abstract

In symmetric secure function evaluation (SSFE), Alice has an input x, Bob has an input y, and both parties wish to securely compute f (x, y). We show several new results classifying the feasibility of securely implementing these functions in several security settings. Namely, we give new alternate characterizations of the functions that have (statistically) secure protocols against passive and active (standalone), computationally unbounded adversaries. We also show a strict, infinite hierarchy of complexity for SSFE functions with respect to universally composable security against unbounded adversaries. That is, there exists a sequence of functions f 1 , f 2 , . . . such that there exists a UC-secure protocol for f i in the f j -hybrid world if and only if i ≤ j.The main new technical tool that unifies our unrealizability results is a powerful protocol simulation theorem, which may be of independent interest. Essentially, in any adversarial setting (UC, standalone, or passive), f is securely realizable if and only if a very simple (deterministic) "canonical" protocol for f achieves the desired security. Thus, to show that f is unrealizable, one need simply demonstrate a single attack on a single simple protocol.

Exploring the Limits of Common Coins Using Frontier Analysis of Protocols

“…We then use the combinatorial characterizations of Symmetric Secure Function Evaluation (SSFE) functionalities (obtained using frontier analysis) from [16] to extend the result to arbitrary SSFE functionalities (instead of just XOR). Further, using an extension of a result in [12], we extend this to arbitrary SFE functionalities by associating a symmetric SFE with every general SFE that has a secure protocol using a source of common randomness.…”

“…The analysis of protocols in [6,1,14] also have some elements of a frontier analysis, but of a rudimentary form which was sufficient for analysis of perfect security. In [16] frontier analysis was explicitly introduced and used to prove several protocol impossibility results and characterizations. [13] also presented similar results and used somewhat similar techniques (but relied on analyzing the protocol by rounds, instead of frontiers, and suffered limitations on the round complexity of the protocols for which the impossibility could be shown).…”

“…It is well-known that there is no standalone-secure (or UC-secure) protocol for F xor in the plain model (cf. the complete characterization of [13,16]). Also note that standalone security is a special case of UC security.…”

“…The full proof is given in Appendix B.1. The main novelty in this proof (compared to the techniques in [16]) is the nature of the frontier we consider, in a semi-honest protocol. For semi-honest security, F xor does not have a canonical order for what information must be revealed by the two parties.…”

“…In deriving the impossibility results our analysis crucially relies on the communication and information structure of protocols. We build on the "frontier analysis" paradigm in [8,16,17], but significantly extend its power, among other things, to enable analyzing protocols for arbitrary randomized functionalities, and protocols using randomized functionalities.…”