Pushing the Communication Barrier in 2PC using Lookup Tables Ghada Dessouky*, Farinaz Koushanfar, Ahmad-Reza Sadeghi*, Thomas Schneider*, Shaza Zeitouni*, and Michael Zohner* *Technische Universität Darmstadt University of California, San Diego
Secure 2PC Page 2
Secure 2PC Page 2
Secure 2PC This work: semi-honest (passive) security Page 2
Applications of Secure 2PC Sugar Beet Auction [BCD+9] Page 3
Applications of Secure 2PC Sugar Beet Auction [BCD+9] Face Recognition [EFG+9] Page 3
Applications of Secure 2PC Sugar Beet Auction [BCD+9] Face Recognition [EFG+9] Blind En/Decryption [Dyadic] AES Page 3
Applications of Secure 2PC Sugar Beet Auction [BCD+9] Face Recognition [EFG+9] Blind En/Decryption [Dyadic] Stable Matching [DES6] AES Page 3
Generic Secure 2PC Two prominent techniques: Yao's protocol and GMW Both evaluate Boolean circuits securely XOR gates are free AND gates cost sym. crypto / comm. Difference: round complexity Yao is constant round GMW requires interaction per AND gate Page 4
Practical Improvements Million AND gates/sec Speed of 2PC Implementations 4 3 2 24 2 2 23 25 26 Currently: 3 million ANDs/s per thread, however: We have hit a comm. lower-bound per AND for Yao [ZRE5] Run-time for GMW often is mostly network latency Page 5
Lookup Tables Page 6
Our Contributions Develop lookup table (LUT)-based protocols Tool support for generating LUT circuits Evaluation and comparison (Paper: improve building blocks & comm. for GMW) Page 7
Lookup Table Protocols Page 8
oon Oblivious Transfer Bob obliviously obtains one of N messages s.t. Alice does not learn Bob's choice Bob does not learn Alice's other messages Most efficient protocol oon OT: [KK3] Page 9
Intuition of the Protocols Use [KK3] oon OT to perform table lookups Page
LUT Protocols We develop two LUT protocols based on [KK3] OT Online Phase LUT (OP-LUT) Setup Phase LUT (SP-LUT) Pre-Computation Communication [Bytes] Communication [Bytes] OP-LUT SP-LUT 2 3 4 5 6 7 8 Online OP-LUT SP-LUT 2 3 4 5 6 7 8 Number of Inputs Number of Inputs Page
Generating LUT Circuits Page 2
Tool Support for LUTs Generating LUT circuits is difficult and error-prone Automation is required Idea: FPGAs internally operate on single output LUTs Use ABC logic syntesis to generate single output LUTs Add post-processing to improve efficiency Page 3
Combining LUTs FPGAs only support single output LUTs We combine LUTs with similar inputs to improve efficiency SP-LUT Communication: 52 bits SP-LUT Communication: 38 bits Page 4
Extracting XORs Since XORs are free, we can extract them Example Page 5
Comparison Page 6
Communication Mostly: SP-LUT < GMW < OP-LUT < Yao Boolean circuits perform better for sequential structures LUT circuits perform best for tree based structures Page 7
Communication Mostly: SP-LUT < GMW < OP-LUT < Yao Boolean circuits perform better for sequential structures LUT circuits perform best for tree based structures Page 7
Communication Mostly: SP-LUT < GMW < OP-LUT < Yao Boolean circuits perform better for sequential structures LUT circuits perform best for tree based structures Page 7
Interaction Rounds Yao is constant round Mostly: SP-LUT < OP-LUT < GMW Exception: Multiplication with Ripple-carry addition Page 8
Interaction Rounds Yao is constant round Mostly: SP-LUT < OP-LUT < GMW Exception: Multiplication with Ripple-carry addition Page 8
Empirical Evaluation AES encryption of blocks using 4 threads LAN ( GBit network,.2 ms latency) WAN (28 MBit network, 22ms latency).8.6.4.2.8.6.4.2 AES Evaluations in WAN 6 5 Yao GMW OP-LUT SP-LUT Run-Time [s] Run-Time [s] AES Evaluations in LAN Yao GMW OP-LUT SP-LUT 4 3 2 Setup Online Total Setup Online Total Page 9
Conclusion Communication is bottleneck in 2PC Developed LUT protocols based on oon OT Tool chain for compiling LUT circuits Showed that LUT protocols can improve communication Page 2
Thank you for your attention Page 2
From oo2 OT to oon OT [IKNP3] [KK3] oo2 OT oon OT
Our Results
oon OT Extension [KK3]....... Hamming distance............ Codewords with HD..
From oo2 OT to oon OT oon OT can be obtained from logn oo2 OTs Example oo4:
From oon OT to oo2 OT ( Surprising insight: reducing oon OT to single bit oo2 OT saves communication,,, ) Best for N=6: Requires 32 bits instead of 52 bits