Improved Delegation of Computation Using Fully Homomorphic Encryption

Chung, Kai-Min; Kalai, Yael Tauman; Vadhan, Salil

doi:10.1007/978-3-642-14623-7_26

Cited by 269 publications

(198 citation statements)

References 24 publications

(30 reference statements)

Supporting

Mentioning

198

Contrasting

Order By: Relevance

“…A standard security caveat that applies to many non-interactive protocols in the public key model (cf. [29,27,12,9]) is that re-using the same receiver's public key for multiple sender messages may be problematic if the sender can learn the receiver's output on these messages. Indeed, the standard (UC-)security guarantee of our protocols only applies when an independent receiver message is used in each session.…”

Section: Our Resultsmentioning

confidence: 99%

Efficient Non-interactive Secure Computation

Ishai

Kushilevitz

Ostrovsky

et al. 2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Suppose that a receiver R wishes to publish an encryption of her secret input x so that every sender S, holding an input y, can reveal f (x, y) to R by sending her a single message. This should be done while simultaneously protecting the secrecy of y against a corrupted R and preventing a corrupted S from having an unfair influence on the output of R beyond what is allowed by f .When the parties are semi-honest, practical solutions can be based on Yao's garbled circuit technique. However, for the general problem when the parties, or even S alone, may be malicious, all known polynomial-time solutions are highly inefficient. This is due in part to the fact that known solutions make a non-black-box use of cryptographic primitives, e.g., for providing non-interactive zero-knowledge proofs of statements involving cryptographic computations on secrets.Motivated by the above question, we consider the problem of secure two-party computation in a model that allows only parallel calls to an ideal oblivious transfer (OT) oracle with no additional interaction. We obtain the following results.-Feasibility. We present the first general protocols in this model which only make a black-box use of a pseudorandom generator (PRG). All previous OTbased protocols either make a non-black-box use of cryptographic primitives or require multiple rounds of interaction. -Efficiency. We also consider the question of minimizing the asymptotic number of PRG calls made by such protocols. We show that polylog(κ) calls are sufficient for each gate in a (large) boolean circuit computing f , where κ is a statistical security parameter guaranteeing at most 2 −κ simulation error of a malicious sender. Furthermore, the number of PRG calls per gate can be made constant by settling for a relaxed notion of security which allows a malicious S to arbitrarily correlate the event that R detects cheating with the input of R. This improves over the state of the art also for interactive constant-round black-box protocols, which required Ω(κ) PRG calls per gate, even with similar relaxations of the notion of security.Combining the above results with 2-message (parallel) OT protocols in the CRS model, we get the first solutions to the initial motivating question which only make a black-box use of standard cryptographic primitives.

show abstract

Section: Our Resultsmentioning

confidence: 99%

Efficient Non-interactive Secure Computation

Ishai

Kushilevitz

Ostrovsky

et al. 2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…After the execution of algorithm Setup by the pharmaceutical company (which is done once), the only action required by each patient is executing an algorithm to encrypt the input which takes constant time. This property again is not achievable in recent works on verifiable computation in the secret key setting (e.g., [1,9,10,15]), where every patient would have to do separate expensive preprocessing based on his secret key.…”

Section: E Input and Output Privacymentioning

confidence: 94%

“…Verifiable computation in the secret key setting (SVC). Recent works on verifiable computation [1,10,15] achieve efficient verification of general boolean circuits, but in the secret key model. Therefore they are inherently inadequate for the setting of signatures, which are required to be publicly verifiable.…”

Section: Related Workmentioning

confidence: 99%

“…This enables the doctor to analyze verifiable computations across patients in a private way (i.e., only the doctor will learn information about the patients data). Note that this was not feasible in recent works on verifiable computation in the secret key setting (e.g., [1,9,10,15]), where a doctor would only be able to analyze his data; 2. Consider now a different scenario where a every patient would like to execute function f in a verifiable fashion on his genome data without revealing the output to anyone else.…”

Section: E Input and Output Privacymentioning

confidence: 99%

See 1 more Smart Citation

Signatures of Correct Computation

Papamanthou

Shi

Tamassia

2013

Lecture Notes in Computer Science

131

View full text Add to dashboard Cite

We introduce Signatures of Correct Computation (SCC), a new model for verifying dynamic computations in cloud settings. In the SCC model, a trusted source outsources a function f to an untrusted server, along with a public key for that function (to be used during verification). The server can then produce a succinct signature σ vouching for the correctness of the computation of f , i.e., that some result v is indeed the correct outcome of the function f evaluated on some point a. There are two crucial performance properties that we want to guarantee in an SCC construction: (1) verifying the signature should take asymptotically less time than evaluating the function f ; and (2) the public key should be efficiently updated whenever the function changes.We construct SCC schemes (satisfying the above two properties) supporting expressive manipulations over multivariate polynomials, such as polynomial evaluation and differentiation. Our constructions are adaptively secure in the random oracle model and achieve optimal updates, i.e., the function's public key can be updated in time proportional to the number of updated coefficients, without performing a linear-time computation (in the size of the polynomial).We also show that signatures of correct computation imply Publicly Verifiable Computation (PVC), a model recently introduced in several concurrent and independent works. Roughly speaking, in the SCC model, any client can verify the signature σ and be convinced of some computation result, whereas in the PVC model only the client that issued a query (or anyone who trusts this client) can verify that the server returned a valid signature (proof) for the answer to the query. Our techniques can be readily adapted to construct PVC schemes with adaptive security, efficient updates and without the random oracle model.

show abstract

“…It is only in the past few years, however, that candidate FHE schemes have been proposed. The first scheme was constructed by Gentry [Gen09a], and his work inspired a tremendous amount of research showing efficiency improvements to his scheme (e.g., [SS10]), realizations of FHE based on different assumptions (e.g., [vDGHV10,BV11b,BV11a,BGV12,Bra12]), implementations of FHE (e.g., [SV10,GH11]), and new applications of FHE (e.g., [GGP10,CKV10]). We omit further details since they are not directly relevant to our work.…”

Section: Fully Homomorphic Encryptionmentioning

confidence: 99%

Feasibility and Infeasibility of Adaptively Secure Fully Homomorphic Encryption

Katz

Thiruvengadam

Zhou

2013

Public-Key Cryptography – PKC 2013

View full text Add to dashboard Cite

Fully homomorphic encryption (FHE) is a form of public-key encryption that enables arbitrary computation over encrypted data. The past few years have seen several realizations of FHE under different assumptions, and FHE has been used as a building block in many cryptographic applications.Adaptive security for public-key encryption schemes is an important security notion that was proposed by Canetti et al. over 15 years ago. It is intended to ensure security when encryption is used within an interactive protocol, and parties may be adaptively corrupted by an adversary during the course of the protocol execution. Due to the extensive applications of FHE to protocol design, it is natural to understand whether adaptively secure FHE is achievable.In this paper we show two contrasting results in this direction. First, we show that adaptive security is impossible for FHE satisfying the (standard) compactness requirement. On the other hand, we show a construction of adaptively secure FHE that is not compact, but which does achieve circuit privacy.

show abstract

Improved Delegation of Computation Using Fully Homomorphic Encryption

Cited by 269 publications

References 24 publications

Efficient Non-interactive Secure Computation

Efficient Non-interactive Secure Computation

Signatures of Correct Computation

Feasibility and Infeasibility of Adaptively Secure Fully Homomorphic Encryption

Contact Info

Product

Resources

About