Forecasting Run-Times of Secure Two-Party Computation

Abstract

Secure computation (SC) are cryptographic protocols that enable multiple parties to perform a joint computation while retaining the privacy of their inputs. It is current practice to evaluate the performance of SC protocols using complexity approximations of computation and communication. Due to the disparate complexity measures and constants this approach fails at reliably predicting the performance. We contribute a performance model (PM) for forecasting runtimes of secure two-party computations. We show the correctness of our PM by an empirical study on the problem of secure division which is relevant for many real world SCs, e.g., k-means clustering or supply chain optimization. We show that our PM can be used to make an optimal selection of an algorithm and cryptographic protocol combination, as well as to determine the implicit security tradeoffs. The predictions of our PM can be used to design or select more efficient or more secure protocols.Index Terms-Multi-party Computation Performance Model Security 2011 Eighth International Conference on Quantitative Evaluation of SysTems 978-0-7695-4491-5/11 $26.00

Automatic Protocol Selection in Secure Two-Party Computations

“…Our results are based on the performance model framework of [54] for forecasting runtimes of secure twoparty computations based on garbled circuits and homomorphic encryption. In §4.1 we provide a summary of this framework and extend it in §4.2 to cover conversion between the protocols.…”

“…However, as this protocol also favors Boolean circuits, but differently from garbled circuits has a non-constant number of rounds, we chose garbled circuits in our work. Furthermore, this and other protocols can be integrated into our main approach by extending the performance model of [54] accordingly.…”

“…Both protocols are generic, i.e., they can securely implement any ideal functionality. Nevertheless they have different performance characteristics as shown by the performance evaluations in [20,54]. Throughout the paper we name the two parties Alice A and Bob B.…”

“…Since the protocol can be composed from sub-protocols of both protocol types -garbled circuits and homomorphic encryption -we need to be able to assess their performance while taking care of additional conversion costs. We base our cost model on the model of [54] which can (reasonably) reliably forecast the protocol run-time and communication for both types of protocols. The accuracy of the forecast mainly determines the effectiveness of our approach.…”

“…We apply these to three use cases from the literature: secure joint economic lot-size, biometric identification, and data mining. We use the evaluation of their implementation in the intermediate language of [54] to test three hypotheses:…”