Simultaneous-Message and Succinct Secure Computation
摘要
We put forth a new primitive we call simultaneous-message and succinct (SMS) secure computation. An SMS scheme enables a minimal communication pattern for secure computation in the following scenario: Alice has a large private input X, Bob has a small private input y, and Charlie wants to learn f(X, y) for some public function f. Given a common reference string (CRS) setup phase, an SMS scheme for a function f is instantiated with two parties holding inputs X and y, and has the following structure: We obtain the following results. First, assuming Learning With Errors (LWE), we build an SMS scheme supporting evaluation of depth-d circuits, where Alice’s message is of size \(|f(X,y)|^{2/3} \cdot \textsf{poly}(\lambda ,d)\) , Bob’s message is of size \((|y| + |f(X,y)|^{2/3}) \cdot \textsf{poly}(\lambda ,d)\) , and \(\lambda \) is the security parameter. We can further extend this to support all functions by assuming the circular security of LWE. Second, assuming sub-exponentially secure indistinguishability obfuscation ( \(i\mathcal {O}\) ), along with other standard assumptions, we build an SMS scheme supporting arbitrary polynomial-sized batch functions of the form \((f(x_1,y),\ldots ,f(x_L, y))\) , for \(X = (x_1,\ldots ,x_L)\) . Alice’s and Bob’s messages in this construction are of size \(\textsf{poly}(\lambda )\) and \(\textsf{poly}(\lambda , |f|, \log L)\) , respectively. We show that SMS schemes have several immediate applications, including (1) a construction of trapdoor hash functions (TDH) (Döttling et al., Crypto’19) for the same class of functions as the one supported by the SMS scheme, (2) a generic compiler for obtaining rate-1 fully homomorphic encryption (FHE) from any non-compact FHE scheme, and (3) a generic compiler for correlation-intractable hash functions that are secure against all efficiently-searchable relations.