Linear Complexity Private Set Intersection for Secure Two-Party Protocols

Abstract

In this paper, we propose a new private set intersection (PSI) protocol that computes the following functionality. The two parties (P1 and P2) input two sets of items (X and Y , respectively) and one of the parties outputs a function of the intersection (f (X ∩ Y )). This functionality is generally required when the PSI protocol is used as a part of a larger secure two-party secure computation. Pinkas et al. presented a PSI protocol at Eurocrypt 2019 for this functionality, which has linear complexity only in communication. While there are PSI protocols with linear computation and communication complexities in the classical PSI setting where the intersection itself is revealed to one party, to the best of our knowledge, there is no PSI protocol, which outputs a function of the intersection and satisfies linear complexity in both communication and computation. We present the first PSI protocol that outputs only a function of the intersection with linear communication and computation complexities. While creating the protocol, as a side contribution, we provide a one-time oblivious programmable pseudo-random function based on garbled Bloom filters. We also implemented our protocol and provide performance results.

Circuit-PSI With Linear Complexity via Relaxed Batch OPPRF

“…We construct Circuit-PSI protocols with communication and computational costs linear in n (this asymptotically matches recent work [27]). We demonstrate that our protocols are concretely better than the state-of-the-art [43] (which in turn outperforms [27]) -as an example, our protocol is ≈ 2.3× more communication efficient and 2.3 − 2.8× faster (in LAN/WAN settings) than [43], when P 0 's and P 1 's sets comprise of 2 22 elements. We also extend our protocol to support computing functions on intersection of input sets with associated payloads.…”

“…Security Model. Following prior works on Circuit-PSI [16,25,27,[42][43][44], we provide security against static probabilistic polynomial time (PPT) semi-honest adversaries in the real/ideal simulation paradigm [23,34]. A static semi-honest (or, honest-but-curious) adversary A corrupts either P 0 or P 1 at the beginning of the protocol and tries to learn as much as possible from the protocol execution while following the protocol specifications honestly.…”

“…In circuit PSI [16,25,27,[42][43][44], the task is to compute a function f on the intersection of two sets, S 0 and S 1 .…”

“…We summarize the communication cost of PSTY and compare them with our schemes in Table 2 for varying input set sizes n and for inputs of arbitrary bitlength. Similar to PSTY, and unlike circuit-PSI protocols proposed in [16,25,27,42,44], the communication cost of our protocols is independent of the bitlength of elements in the input sets and depends only on the size of the input sets. As can be observed from the table, our protocol C-PSI 2 is ≈ 2.3× more communication efficient than PSTY (while C-PSI 1 is ≈ 1.5× more efficient).…”

“…Finally, unlike PSTY and our protocols, the recent linear computation protocol of [27] has a communication cost that varies with bit-length. For = 32 and 64, C-PSI 2 is ≈ 8.8 − 12.7× more communication efficient than their protocol; see [27,Table 3].…”