I'd like to find a mechanism to evaluate the SHA-256 compression function using multi-party computation, but I'm not sure what's possible given the current state of the art and would appreciate some pointers in the right direction.

Specifically, I have set of parties (which must be scalable to more than two!) who each will possess a share of a mutually-unknown secret key which cannot be revealed safely. Instead, I need to reveal the result of hashing the key XORed with some extra data; indeed, the entire point of the multi-party computation is to ensure that as long as there's one non-colluding party, the key cannot be derived. The most obvious approach seems be to use fully homomorphic encryption, but that is (usually?) a symmetric system where whatever key which can decrypts the output data could also decrypt the input, which must remain secret.

I have some design leeway, and while I prefer a low-communication solution, I might instead be able to use a protocol like MP-SPDZ's tinier FKOS15 implementation over a bitsliced boolean circuit -- except that I've tried three different circuits and can't get a test vector to work in any of them. (That part might just be because I suck. Pointers appreciated.)

I'm also tantalized by the idea that the fact that the compression function is itself constructed entirely from simple boolean operations (AND, XOR, NOT, and rotate right) might mean that it's in the set of functions which can be efficiently handled by the method described in Secure Computation on the Web: Computing without Simultaneous Interaction, but I have no idea if I'm barking up a sensible tree there.

Any input would be welcome, from implementation suggestions to avenues for further research!



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.