Niv Gilboa

Computationally private information retrieval (extended abstract)

Private information ret rieval (PIR) schemes enable a user to access k replicated copies of a database (k z 2), and privately retrieve one of the n bits of data stored in the databases. This means that the queries give each individual database no partial information (in the information theoretic sense) on the identity of the item retrieved by the user. Today, the best two database scheme (k = 2) has communication complexity O(TZ1/3), while for any constant number, k, the best k database scheme has communication complexity 0(nl/(2k-lJ). The motivation for the present work is the question whether this complexity can be reduced if one is willing to achieve computational privacy, rather than information theoretic privacy. (This means that privacy is guaranteed only with respect to databases that are restricted to polynomial time computations. ) We answer this question affirmatively, and ●Computer Science Dept., Technion, Haifa, Israel. Email: bennytlcs.technion.ac.il. Supported by Technion V.P. R Fund – E. and M. Mendelson Research Fund. tComputer Science Dept., Technion, Haifa, Israel. Email: gilboa@cs. technion. ac.il Niv Gilboat show that the computational approach leads to substantial savings. For every ~ > 0, we present a two database computational PIR scheme whose communication complexity is O(n’). This improved efficiency is achieved by a combination of a novel balancing technique, together with careful application of pseudo random generators. Our schemes preserve some desired properties of previous solutions. In particular, all our schemes use only one round of communication, they are fairly simple, they are memoryless, and the database contents is stored in its plain form, without any encoding.

Two Party RSA Key Generation

We present a protocol for two parties to generate an RSA key in a distributed manner. At the end of the protocol the public key: a modulus N = PQ, and an encryption exponent e are known to both parties. Individually, neither party obtains information about the decryption key d and the prime factors of N: P and Q. However, d is shared among the parties so that threshold decryption is possible.

Function Secret Sharing

Motivated by the goal of securely searching and updating distributed data, we introduce and study the notion of function secret sharing (FSS). This new notion is a natural generalization of distributed point functions (DPF), a primitive that was recently introduced by Gilboa and Ishai (Eurocrypt 2014). Given a positive integer \(p\ge 2\) and a class \(\mathcal F\) of functions \(f:\{0,1\}^n\rightarrow \mathbb G\), where \(\mathbb G\) is an Abelian group, a \(p\)-party FSS scheme for \(\mathcal F\) allows one to split each \(f\in \mathcal F\) into \(p\) succinctly described functions \(f_i:\{0,1\}^n\rightarrow \mathbb G\), \(1\le i\le p\), such that: (1) \(\sum _{i=1}^p f_i=f\), and (2) any strict subset of the \(f_i\) hides \(f\). Thus, an FSS for \(\mathcal F\) can be thought of as method for succinctly performing an “additive secret sharing” of functions from \(\mathcal F\). The original definition of DPF coincides with a two-party FSS for the class of point functions, namely the class of functions that have a nonzero output on at most one input.

Distributed Point Functions and their Applications

For x,y ∈ {0,1}*, the point function P x,y is defined by P x,y (x) = y and P x,y (x′) = 0|y| for all x′ ≠ x. We introduce the notion of a distributed point function (DPF), which is a keyed function family F k with the following property. Given x,y specifying a point function, one can efficiently generate a key pair (k 0,k 1) such that: (1) \(F_{k_0}\oplus F_{k_1}=P_{x,y}\), and (2) each of k 0 and k 1 hides x and y. Our main result is an efficient construction of a DPF under the (minimal) assumption that a one-way function exists.

Breaking the Circuit Size Barrier for Secure Computation Under DDH

Under the Decisional Diffie-Hellman DDH assumption, we present a 2-out-of-2 secret sharing scheme that supports a compact evaluation of branching programs on the shares. More concretely, there is an evaluation algorithm

Group-Based Secure Computation: Optimizing Rounds, Communication, and Computation

\mathsf{Eval}

Foundations of Homomorphic Secret Sharing

with a single bit of output, such that if an input