Secure Computation of Constant-Depth Circuits with Applications to Database Search Problems

Abstract

Abstract. Motivated by database search problems such as partial match or nearest neighbor, we present secure multiparty computation protocols for constant-depth circuits. Specifically, for a constant-depth circuit C of size s with an m-bit input x, we obtain the following types of protocols.-In a setting where k ≥ poly log(s) servers hold C and a client holdsx, we obtain a protocol in which the client privately learns C(x) by communicatingÕ(m) bits with each server. -In a setting where x is arbitrarily distributed between k ≥ poly log(s) parties who all know C, we obtain a secure protocol for evaluatingBoth types of protocols tolerate t = k/poly log(s) dishonest parties and their computational complexity is nearly linear in s. In particular, the protocols are optimal "up to polylog factors" with respect to communication, local computation, and minimal number of participating parties. We then apply the above results to obtain sublinear-communication secure protocols for natural database search problems. For instance, for the partial match problem on a database of n points in {0, 1} m we get a protocol with k ≈ 1 2 log n servers,Õ(m) communication, and nearly linear server computation. Applying previous protocols to this problem would either require Ω(nm) communication,Ω(m) servers, or superpolynomial computation.

On the power of rewinding simulators in functional encryption

“…The functionality inner-product over Z 2 (IP, for short) 9 is defined in the following way. It is a family of predicates with key space K n and index space I n consisting of binary strings of length n, and for any k ∈ K n , x ∈ I n the predicate IP(k, x) = 1 if and only if i∈[n] k i · x i = 0 mod 2.…”

How to Garble Arithmetic Circuits

“…This variant of the composition lemma is valid provided that there exist a universal simulator and universal decoder that work for all the r g 's. In this case, we say that the collection h rg (x; r h ) rg is a universal encoding [7] of g rg rg . Several known constructions of REs are universal.…”

“…We say that an REf (x; r, w) of f (x) has public coins w if part of the output off consists of the coins w, i.e., if we can writef (x; r, w) = (w, g(x, r, w)) for some function g. Moreover, we require a simulator Sim of a similar form; namely, given y (supposedly y = f (x)) and internal randomness (ρ, w), the output of Sim(y; ρ, w) can be written as (w, h(y, ρ, w)) for some function h. The notion of public coins RE has appeared in [7]. The public coins w can be chosen once and for all and be reused in different instantiations of REs as we will show in Facts 3.1-3.3 below.…”

“…It starts with a trivial encoding of the identity function C 0 . In 7 The construction can be generalized by letting each Bi compute any "simple" arithmetic function that can be handled by the generalized affinization gadgets of Corollary 5.5 (e.g., an arithmetic NC 1 circuit or a sequence of polynomial-size arithmetic branching programs). This generalization can give useful efficiency tradeoffs, see Section 7.3 below.…”

Multi-party Indirect Indexing and Applications

“…Barkol and Ishai [2] design a communication-efficient secure multiparty protocol in which m parties share an input x, and all hold the same constantdepth circuit C. Parties then privately compute C(x). Let x = σ be an index shared between the parties and let circuit C hard-code elements of a database ∆ and return the x-th element as its output.…”