Putting the Online Phase on a Diet: Covert Security from Short MACs

Abstract

An important research direction in secure multi-party computation (MPC) is to improve the efficiency of the protocol. One idea that has recently received attention is to consider a slightly weaker security model than full malicious security – the so-called setting of covert security. In covert security, the adversary may cheat but only is detected with certain probability. Several works in covert security consider the offline/online approach, where during a costly offline phase correlated randomness is computed, which is consumed in a fast online phase. State-of-the-art protocols focus on improving the efficiency by using a covert offline phase, but ignore the online phase. In particular, the online phase is usually assumed to guarantee security against malicious adversaries. In this work, we take a fresh look at the offline/online paradigm in the covert security setting. Our main insight is that by weakening the security of the online phase from malicious to covert, we can gain significant efficiency improvements during the offline phase. Concretely, we demonstrate our technique by applying it to the online phase of the well-known TinyOT protocol (Nielsen et al., CRYPTO ’12). The main observation is that by reducing the MAC length in the online phase of TinyOT to t bits, we can guarantee covert security with a detection probability of $1- \frac{1}{2^t}$. Since the computation carried out by the offline phase depends on the MAC length, shorter MACs result in a more efficient offline phase and thus speed up the overall computation. Our evaluation shows that our approach reduces the communication complexity of the offline protocol by at least 35% for a detection rate up to $\frac{7}{8}$. In addition, we present a new generic composition result for analyzing the security of online/offline protocols in terms of concrete security.

Appendices

Appendix

Discussion of Constraints on Online Protocol

In this section, we discuss the constraints on the online protocol used in our theorem. These constraints emerged from technical issues and it is unclear how to prove our deterrence replacement theorem in a more generic setting. Recall that in our proof $\mathcal {S}$ uses the simulator $\mathcal {S}_1$ which exists since $\pi _\textsf{on}$ is covertly secure in the $\mathcal {F}_\textsf{off}^1$-hybrid world.

First, the hybrid functionality $\mathcal {F}_\textsf{off}$ needs to be called directly at the beginning. This enables the simulator $\mathcal {S}$ to react to the adversary’s cheating decision in the offline phase, i.e., its input to $\mathcal {F}_\textsf{off}$, right at the start of the simulation. More specifically, $\mathcal {S}$ uses the black-box simulator $\mathcal {S}_1$ in case the adversary does not cheat and simulates on its own in case there is a cheating attempt. If there would be protocol interactions before the call to $\mathcal {F}_\textsf{off}$, $\mathcal {S}$ would have to decide whether it simulates this interactions itself or via $\mathcal {S}_1$. This means that the adversary’s input to $\mathcal {F}_\textsf{off}$ could require $\mathcal {S}$ to change its decision, e.g., require $\mathcal {S}$ to simulate the following steps itself while $\mathcal {S}$ initially used $\mathcal {S}_1$ for the earlier steps. This leads to a problem as $\mathcal {S}$ uses $\mathcal {S}_1$ in a black-box way, and hence, can only use it for all or none of the protocol steps. Rewinding does not solve the problem as a change in the simulation of the steps before the call to $\mathcal {F}_\textsf{off}$ can influence the adversary’s input to $\mathcal {F}_\textsf{off}$, and hence, $\mathcal {S}$’s decision to simulate the steps afterwards based on $\mathcal {S}_1$ or not.

Second, we require that in case $\mathcal {F}_\textsf{off}$ outputs $\textsf{corrupted}$, the protocol $\pi _\textsf{on}$ instructs the parties to output $\textsf{corrupted}$ as well. This is due to some subtle detail in the security proof. As $\mathcal {S}_1$ runs in a world, in which cheating in the offline phase is not possible, $\mathcal {S}_1$ does not know how to deal with undetected cheating. Further, we treat the protocol $\pi _\textsf{on}$ in a black-box way. Due to these facts, the only way for $\mathcal {S}$ to simulate the case of undetected cheating is to follow the actual protocol. To do so in a consistent way, $\mathcal {S}$ has to get the input of the honest parties. Hence, $\mathcal {S}$ has to notify the ideal covert functionality $\mathcal {F}_\textsf{on}^{\epsilon _\textsf{on}}$ about the cheating attempt in the offline phase. In case of detected cheating, $\mathcal {F}_\textsf{on}^{\epsilon _\textsf{on}'}$ sends $\textsf{corrupted}$ to the honest parties and thus the honest parties output $\textsf{corrupted}$ in the ideal world. In order to achieve indistinguishability between the ideal world and the real world, $\pi _\textsf{on}$ needs to instruct the honest parties to output $\textsf{corrupted}$ in the real world, too.

Finally, we emphasize that known offline/online protocols (SPDZ [DPSZ12], TinyOT [NNOB12], authenticated garbling [WRK17a, WRK17b]) either directly fulfill the aforementioned requirements or can easily be adapted to do so.

Comparison of Theorem 1 with [AL07]

Aumann and Lindell [AL07] presented a sequential composition theorem for the (strong) explicit cheat formulation. The theorem shows that a protocol $\pi$ that is covertly secure in an $(\mathcal {F}_1^{\epsilon _1}, \ldots , \mathcal {F}_{p(n)}^{\epsilon _{p(n)}})$-hybrid world with deterrence factor $\epsilon _\pi$, i.e., parties have access to a polynomial number of functionalities $\mathcal {F}_1, \ldots , \mathcal {F}_{p(n)}$ with deterrence factor $\epsilon _1, \ldots , \epsilon _{p(n)}$, respectively, is also covertly secure with deterrence $\epsilon _\pi$ if functionality $\mathcal {F}_i$ is replaced by a protocol $\pi _i$ that realizes $\mathcal {F}_i$ with deterrence factor $\epsilon _i$ for $i \in \{1, \ldots , p(n)\}$. This theorem allows to analyze the security of a protocol in a hybrid model and replace the hybrid functionalities with subprotocols afterwards. Aumann and Lindell already noted that the computation of the deterrence factor $\epsilon _\pi$ needs to take all the deterrence factors of the subprotocols into account. However, the theorem does not make any statement about how the individual deterrence factors influence the deterrence factor of the overall protocol and neither analyzes the effect of changing some of the deterrence factors $\epsilon _i$.

Out theorem takes on step further and addresses the aforementioned drawbacks. In particular, it allows to analyze the security of a protocol in a simple hybrid world, in which the hybrid functionality is associated with deterrence factor 1. As there is no successful cheating in the hybrid functionality, a proof in this hybrid world is expected to be much simpler. The same holds for the calculation of the overall deterrence factor. Once having proven a protocol to be secure in the simple hybrid world, our theorem allows to derive the security and the deterrence factor of the same protocol in the hybrid world, in which the offline phase is associated with some smaller deterrence factor, $\epsilon ' \in [0,1]$.