In secure two-party computation protocols based on garbled circuit, oblivious transfer (OT) plays an important role in transferring the garbled keys of the participants. In addition to the traditional OT primitive, many other variants of OT have also been presented, such as outsourced oblivious transfer (OOT), cut-and-choose oblivious transfer (CCOT), cut-and-choose bilateral oblivious transfer (CCBOT), etc. These new primitives significantly improve the efficiency and feasibility of secure two-party computation protocols, mainly in optimising computational complexity and interactive rounds. Among these primitives, CCBOT proposed by Zhao et al. in TrustCom 2015 is a novel one and helps to minimize the round complexity of the outer secure two-party computation protocols. In addition, they constructed a CCBOT protocol based on homomorphic encryption scheme in the malicious model. However, their protocol uses the cut-and-choose technique to guarantee security against malicious adversaries, as a result the protocol has an error probability. The commitment scheme is also inevitably involved in their protocol. In this paper, we present a CCBOT protocol with the security against malicious adversaries based on the Decisional Diffie-Hellman (DDH) assumption. Our proposed protocol avoids using the cut-and-choose technique and commitment scheme. In terms of efficiency, our protocol is much more efficient than the previous protocol.
In secure two-party computation protocols based on garbled circuit, oblivious transfer (OT) plays an important role in transferring the garbled keys of the participants. In addition to the traditional OT primitive, many other variants of OT have also been presented, such as outsourced oblivious transfer (OOT), cut-and-choose oblivious transfer (CCOT), cut-and-choose bilateral oblivious transfer (CCBOT), etc. These new primitives significantly improve the efficiency and feasibility of secure two-party computation protocols, mainly in optimising computational complexity and interactive rounds. Among these primitives, CCBOT proposed by Zhao et al. in TrustCom 2015 is a novel one and helps to minimize the round complexity of the outer secure two-party computation protocols. In addition, they constructed a CCBOT protocol based on homomorphic encryption scheme in the malicious model. However, their protocol uses the cut-and-choose technique to guarantee security against malicious adversaries, as a result the protocol has an error probability. The commitment scheme is also inevitably involved in their protocol. In this paper, we present a CCBOT protocol with the security against malicious adversaries based on the Decisional Diffie-Hellman (DDH) assumption. Our proposed protocol avoids using the cut-and-choose technique and commitment scheme. In terms of efficiency, our protocol is much more efficient than the previous protocol.
The Yao's protocol based on garbled circuits is the foundation of secure two-party computation protocols, and Oblivious Transfer (OT), as a important tool in modern cryptography, plays a crucial role in transmitting garbled keys in the Yao's protocol. In the past decades, considerable attentions have been paid to the Cut-and-Choose technique which is applied to OT protocols to prevent malicious P1(called circuit generator) from constructing wrong garbled circuits. Additionally, Bilateral OT becomes a focus point, which can simultaneously transmit P1's and P2's (called circuit evaluator) garbled keys to guarantee input consistency of two parties and improve transmission efficiency. As can be seen, some Cut-and-Choose Bilateral OT (CCBOT) protocols have been proposed. Since CCBOT has emerged, the probability of malicious P1constructing wrong garbled circuits without being found becomes lower and the input consistency problem is properly resolved too. However, the security of most CCBOT protocols are facing challenges since they are based on the Decisional Diffie-Hellman (DDH) assumption, Quadratic Residues (QR) assumption and Decisional Composite Residuosity (DCR) assumption. In this paper, we present a novel CCBOT protocol with the security against malicious adversaries based on the Computational Diffie-Hellman (CDH) assumption, and analysize the correctness, efficiency and security of the constructed protocol. Besides, we analysize the cheating probability of P1in the CCBOT and extend the CCBOT to Single-Choice CCBOT to make the protocol more applicable.
Abstract. In secure two-party computation protocols, the cut-and-choose paradigm is used to prevent the malicious party who constructs the garbled circuits from cheating. In previous realization of the cut-and-choose technique on the garbled circuits, the delivery of the random keys is divided into multiple stages. Thus, the round complexity is high and the consistency of cut-and-choose challenge should be proved. In this paper, we introduce a new primitive called cut-and-choose bilateral oblivious transfer, which transfers all necessary keys of garbled circuits in one process. Specifically, in our oblivious transfer protocol, the sender inputs two pairs (x0, x1), (y0, y1) and a bit τ; the receiver inputs two bits σ and j. After the protocol execution, the receiver obtains xτ, yσ for j = 1, and x0, x1, y0, y1 for j = 0. By the introduction of this new primitive, the round complexity of secure two-party computation protocol can be decreased; the cut-and-choose challenge j is no need to be opened anymore, therefore the consistency proof of j is omitted. In addition, the primitive is of independent interest and could be useful in many cut-and-choose scenarios.
Oblivious transfer (OT) is a significant primitive with wide use in secure two-party computation, private set intersection private and other cryptographic schemes. In the past ten years, different variants of OT primitive like cut-and-choose OT (CCOT) and outsourced OT (OOT), have been proposed so as to satisfy various emerging models. In this paper, we firstly propose and formalize a new primitive called permutable cut-and-choose OT (PCCOT) which generalizes the original CCOT functionality. Furthermore, we construct an efficient PCCOT protocol in the presence of malicious adversaries using the Decisional Diffie-Hellman (DDH) hard assumption. It is worth mentioning that we apply the PCCOT primitive to the efficient construction of secure wildcard pattern matching (WPM) protocol. The WPM functionality allows a party to determine the locations of its pattern with wildcard characters occurs in a long text of another party while revealing nothing to either party in addition to the length of their own inputs. Our proposed secure WPM protocol via PCCOT is secure against semi-honest adversary with 2 rounds and has identical communication cost as the the state-of-the-art scheme.
Oblivious transfer is a fundamental tool in cryptographic protocols, especially in secure two-party computation. In TCC 2011, Lindell and Pinkas proposed a variant called cut-and-choose oblivious transfer, which did a great job in solving the selective failure attack in secure two-party computation protocols based on cut-and-choose paradigm. In this paper, we present a new primitive called cut-and-choose bilateral oblivious transfer. As an extension to cut-and-choose oblivious transfer, in addition to overcoming the selective failure attack, this primitive also makes a contribution to reducing the round number of the protocols that invoke it. This is very important in the scenarios where interactions between parties are limited. Besides, the application of this primitive in the outer protocols enables us to present a more modular and clean high-level description of the protocol framework. Furthermore, we believe that the new primitive is of independent research interest itself and could be useful in many cut-and-choose scenarios. Based on homomorphic encryption, we construct an efficient instantiation of this primitive in malicious model, and present a formal rigorous proof of its security under ideal/real simulation paradigm.
Oblivious transfer is a fundamental tool in cryptographic protocols, especially in secure two-party computation. In TCC 2011, Lindell and Pinkas proposed a variant called cut-and-choose oblivious transfer, which did a great job in solving the selective failure attack in secure two-party computation protocols based on cut-and-choose paradigm. In this paper, we present a new primitive called cut-and-choose bilateral oblivious transfer. As an extension to cut-and-choose oblivious transfer, in addition to overcoming the selective failure attack, this primitive also makes a contribution to reducing the round number of the protocols that invoke it. This is very important in the scenarios where interactions between parties are limited. Besides, the application of this primitive in the outer protocols enables us to present a more modular and clean high-level description of the protocol framework. Furthermore, we believe that the new primitive is of independent research interest itself and could be useful in many cut-and-choose scenarios. Based on homomorphic encryption, we construct an efficient instantiation of this primitive in malicious model, and present a formal rigorous proof of its security under ideal/real simulation paradigm.
In the setting of secure two-party computation, two parties wish to securely compute a joint function of their private inputs, while revealing only the output. One of the primary techniques for achieving efficient secure two-party computation is that of Yao’s garbled circuits (FOCS 1986). In the semi-honest model, where just one garbled circuit is constructed and evaluated, Yao’s protocol has proven itself to be very efficient. However, a malicious adversary who constructs the garbled circuit may construct a garbling of a different circuit computing a different function, and this cannot be detected (due to the garbling). In order to solve this problem, many circuits are sent and some of them are opened to check that they are correct while the others are evaluated. This methodology, called cut-and-choose, introduces significant overhead, both in computation and in communication, and is mainly due to the number of circuits that must be used in order to prevent cheating. In this paper, we present a cut-and-choose protocol for secure computation based on garbled circuits, with security in the presence of malicious adversaries, that vastly improves on all previous protocols of this type. Concretely, for a cheating probability of at most 2−40, the best previous works send between 125 and 128 circuits. In contrast, in our protocol 40 circuits alone suffice (with some additional overhead). Asymptotically, we achieve a cheating probability of 2−s where s is the number of garbled circuits, in contrast to the previous best of 2−0.32s. We achieve this by introducing a new cut-and-choose methodology with the property that in order to cheat, all of the evaluated circuits must be incorrect, and not just the majority as in previous works. The security of our protocol relies on the Decisional Diffie-Hellman assumption.