Function Secret Sharing

Abstract

Function Secret Sharing (FSS), introduced by Boyle et al. (Eurocrypt 2015), provides a way for additively secret-sharing a function from a given function family F. More concretely, an m-party FSS scheme splits a function f : {0, 1} n → G, for some abelian group G, into functions f1, . . . , fm, described by keys k1, . . . , km, such that f = f1 + . . . + fm and every strict subset of the keys hides f . A Distributed Point Function (DPF) is a special case where F is the family of point functions, namely functions f α,β that evaluate to β on the input α and to 0 on all other inputs.FSS schemes are useful for applications that involve privately reading from or writing to distributed databases while minimizing the amount of communication. These include different flavors of private information retrieval (PIR), as well as a recent application of DPF for large-scale anonymous messaging.We improve and extend previous results in several ways:• Simplified FSS constructions. We introduce a tensoring operation for FSS which is used to obtain a conceptually simpler derivation of previous constructions and present our new constructions.• Improved 2-party DPF. We reduce the key size of the PRG-based DPF scheme of Boyle et al. roughly by a factor of 4 and optimize its computational cost. The optimized DPF significantly improves the concrete costs of 2-server PIR and related primitives.• FSS for new function families. We present an efficient PRG-based 2-party FSS scheme for the family of decision trees, leaking only the topology of the tree and the internal node labels. We apply this towards FSS for multi-dimensional intervals. We also present a general technique for extending FSS schemes by increasing the number of parties.• Verifiable FSS. We present efficient protocols for verifying that keys (k * 1 , . . . , k * m ), obtained from a potentially malicious user, are consistent with some f ∈ F.

You May Also Like... Privacy: Recommendation Systems Meet PIR

“…To this end, the construction associates with each layer of the tree shares one λ-bit CW, the two least-significant bits of which are special toggle bits that help the evaluator decide to which nodes it should "apply" the CW. The precise details of how to generate and apply CWs (and toggle bits) goes beyond what is needed to understand our MUX and DeMUX constructions; for brevity, we omit those details here and direct interested readers to Gilboa and Ishai [20] and Boyle et al [9]. For our purposes, it suffices to know that 1. each node (in each tree share) is associated with its own flag bit that is determined by a combination of the toggle bits and node labels produced by the PRG output together with the CW for the preceding layer;…”

“…In this section we provide the security proofs for MPC subprotocols used in this paper. These proofs rely on the simulatability of DPFs (see [9] for the proofs that DPFs are secure).…”

Practical and Provably Secure Distributed Aggregation: Verifiable Additive Homomorphic Secret Sharing

“…+ f m (x), for any input x. The notion of verifiable FSS (VFSS) [11] is introduced by Boyle et al In particular, VFSS consists of interactive protocols that verify the consistency of some function f ∈ F with keys (k * 1 , . .…”

“…which are generated by a potentially malicious user. However, VFSS [11] is applicable in the setting of multiple servers and one client. On the contrary, VHSS can be applied when multiple clients (multi-input) outsource the joint computation to multiple servers.…”

A Bit More Than a Bit Is More Than a Bit Better

“…In the 2-server setting, several works have employed (2, 2)-DPFs to achieve low upload costs [8,12,17], while Angel, Chen, Laine, and Setty [2] proposed a novel technique to obtain low upload costs in single-server FHE-based PIR using so-called plaintext slot permutations. For > 2 servers, there does not appear to be any prior work that provides upload costs scaling sublinearly in r .…”