Graph Coloring Applied to Secure Computation in Non-Abelian Groups

Abstract

We study the natural problem of secure n-party computation (in the computationally unbounded attack model) of circuits over an arbitrary finite non-Abelian group (G, ·), which we call G-circuits. Besides its intrinsic interest, this problem is also motivating by a completeness result of Barrington, stating that such protocols can be applied for general secure computation of arbitrary functions. For flexibility, we are interested in protocols which only require black-box access to the group G (i.e. the only computations performed by players in the protocol are a group operation, a group inverse, or sampling a uniformly random group element). Our investigations focus on the passive adversarial model, where up to t of the n participating parties are corrupted.Our results are as follows. We initiate a novel approach for the construction of black-box protocols for G-circuits based on k-of-k threshold secret-sharing schemes, which are efficiently implementable over any black-box (non-Abelian) group G. We reduce the problem of constructing such protocols to a combinatorial coloring problem in planar graphs. We then give three constructions for such colorings. Our first approach leads to a protocol with optimal resilience t < n/2, but it requires exponen- * This paper is an extended version of [13,28]. © International Association for Cryptologic Research 2011 558 Y. Desmedt et al. tial communication complexity O( 2t+1 t 2 · N g ) group elements and round complexity O( 2t+1 t · N g ), for a G-circuit of size N g . Nonetheless, using this coloring recursively, we obtain another protocol to t-privately compute G-circuits with communication complexity Poly(n) · N g for any t ∈ O(n 1− ) where is any positive constant. For our third protocol, there is a probability δ (which can be made arbitrarily small) for the coloring to be flawed in term of security, in contrast to the first two techniques, where the colorings are always secure (we call this protocol probabilistic, and those earlier protocols deterministic). This third protocol achieves optimal resilience t < n/2. It has communication complexity O(n 5.056 (n + log δ −1 ) 2 · N g ) and the number of rounds is O(n 2.528 · (n + log δ −1 ) · N g ).

A subexponential construction of graph coloring for multiparty computation

“…To the best of our knowledge, the first constructions of black-box MPC of Gcircuits over non-Abelian groups were shown in [10], where three different constructions are illustrated. The idea behind the constructions is to reduce the problem of constructing a t-private n-party MPC protocol to a t-reliable n-coloring of planar graphs.…”

“…Recent years has seen a surge in interest in the cryptographic applications of non-Abelian groups [13,14]. A result from Barrington [2] that any function can be computed by the non-Abelian symmetric group S 5 [10], arises further interest in the study of secure MPC over non-Abelian groups. Following the trend, we are interested in secure MPC of circuits over a finite non-Abelian group (G, ·), where the group operations are performed by the circuit gates.…”

“…Note that unlike the setting of Abelian groups, a t-private protocol over a non-Abelian group should have an honest majority, i.e., t < n 2 [3]. A recent work from [10] showed for the first time the construction of black-box MPC of G-circuits over non-Abelian groups under the passive adversarial model. They reduce the problem of t-private n-party MPC protocol to a graph coloring problem over planar graphs.…”

“…The result is a notion of t-reliable n-coloring of a planar graph which is secure against an adversarial access of any t-color subset I of the n colors. The first of the three construction of graph colorings described in [10] is optimal, i.e., it can be used for any t < 2 ) and O( 2t+1 t ) respectively. 1 The same construction is used recursively to obtain a protocol that achieves polynomial complexity of construction for any t 2 O(n 1 ✏ ) where ✏ is any positive constant.…”

“…Unlike [10] where specific coloring constructions were given for small values of t, our construction is applicable to aribtrary t.…”