RPM: Robust Anonymity at Scale

Lu, Daihui; Kate, Aniket

doi:10.56553/popets-2023-0057

Cited by 3 publications

(5 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Towards offline communication, setting T = 2 10 only sometimes achieves the best communication among all candidates of our protocol. As we can see, setting T = 2 6 , T = 2 8 and T = 2 8 result in the least communication over n = 2 12 , 2 14 , and 2 16 , respectively. We stress this is because d = 10 does not divide n for these cases: the parties use tuples of dimension 2 10 to shuffle the middle layers of the Benes network with less than 10 layer, which essentially makes a waste.…”

Section: Communication Table IV Reports Communication Overheadmentioning

confidence: 80%

“…Secret-shared shuffle protocols are essential in many secure computation tasks, including oblivious sorting [46][47][48][49], private set intersection/union [9,[50][51][52] and private function evaluation [53,54], anonymous communication [2,16], oblivious RAM/database [8,55], and private data analysis [10,12,56].…”

Section: Related Workmentioning

confidence: 99%

“…A common approach thus is to employ SSS to shuffle the dataset first before doing the actual analysis. • Anonymous communication [2,16]. End-to-end encrypted communication has become widespread.…”

Section: Introductionmentioning

confidence: 99%

“…Many anonymous communication systems adopt the Mixnet-based approach [17] using verifiable shuffle, which is computationally expensive due to the involved zero-knowledge proofs to achieve public verifiability [18,19]. Recently, there has been another line of anonymous communication systems [2,16,20] based on SSS in a distributed-trust setting. In these systems, there are multiple servers, each holding a secret share of the data shared by senders, and the servers collaboratively shuffle the data and conduct integrity checks.…”

Section: Introductionmentioning

confidence: 99%

“…These systems achieve much better performance in general, with the price of introducing a non-collusion assumption: verifiability is not public, but if the number of corrupted servers is below a threshold, then any party can still be convinced of correct shuffling when the protocol ends without abort. The non-collusion assumption allows more efficient design and is assumed by many metadatahiding systems [2,16,21,22], among which [22] are already deployed by Mozilla [23]. • Shuffle model of differential privacy [24][25][26][27]: When collecting data from end users, local differential privacy is often used such that the users locally add noise to their data before submitting.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Secret-Shared Shuffle with Malicious Security

Song,

Yin,

Bai

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

A secret-shared shuffle (SSS) protocol permutes a secret-shared vector using a random secret permutation. It has found numerous applications, however, it is also an expensive operation and often a performance bottleneck. Chase et al. (Asiacrypt'20) recently proposed a highly efficient semi-honest two-party SSS protocol known as the CGP protocol. It utilizes purposely designed pseudorandom correlations that facilitate a communication-efficient online shuffle phase. That said, semihonest security is insufficient in many real-world application scenarios since shuffle is usually used for highly sensitive applications. Considering this, recent works (CANS'21, NDSS'22) attempted to enhance the CGP protocol with malicious security over authenticated secret sharings. However, we find that these attempts are flawed, and malicious adversaries can still learn private information via malicious deviations. This is demonstrated with concrete attacks proposed in this paper. Then the question is how to fill the gap and design a maliciously secure CGP shuffle protocol. We answer this question by introducing a set of lightweight correlation checks and a leakage reduction mechanism. Then we apply our techniques with authenticated secret sharings to achieve malicious security. Notably, our protocol, while increasing security, is also efficient. In the two-party setting, experiment results show that our maliciously secure protocol introduces an acceptable overhead compared to its semi-honest version and is more efficient than the state-of-the-art maliciously secure SSS protocol from the MP-SPDZ library.

show abstract

Section: Communication Table IV Reports Communication Overheadmentioning

confidence: 80%