4
$\begingroup$

How can we use secure multiparty computation in evaluating one AES circuit, where the key would not be stored at one computer instead it would be divided into pieces and given to multiple servers. Is there any good reference to follow ?

$\endgroup$
10
$\begingroup$

If you only use secret sharing, then upon reconstruction the key could be stolen. Therefore, secure multiparty computation can be used. There are many different methods, depending on your setting. If you are interested in two-party computation with semi-honest adversaries then simple Yao works (e.g., http://eprint.iacr.org/2015/751.pdf); if you are interested in two-party computation with malicious adversaries and a single execution then http://eprint.iacr.org/2016/762.pdf is a good option; if you are interested in two-party computation with malicious adversaries and many executions then http://eprint.iacr.org/2015/987.pdf or http://eprint.iacr.org/2016/632.pdf; if you are interested in 3 party secure computation for malicious adversaries and with at most one party corrupted then http://eprint.iacr.org/2015/931.pdf is easy to implement but you can get much faster with http://eprint.iacr.org/2016/944.pdf; if you are interested in 3 party secure computation for semi-honest adversaries and with at most one corrupted then http://eprint.iacr.org/2016/768.pdf is by far the fastest; if you are interested in multiparty (more than 3 parties) and semi-honest then http://eprint.iacr.org/2011/257.pdf or http://eprint.iacr.org/2016/1066.pdf; if you are interested in multiparty (more than 3 parties) and malicious then http://eprint.iacr.org/2016/505.pdf. All of these are the state-of-the-art for their settings (but there are many other options) and the state-of-the-art is likely to change very quickly.

$\endgroup$
  • $\begingroup$ You're quite right about the state-of-the-art changing very quickly. In the hours since you posted this, the following fast 2PC implementation has appeared on eprint: eprint.iacr.org/2016/1069 $\endgroup$ – Mikero Nov 15 '16 at 15:46
  • $\begingroup$ Looks very interesting! $\endgroup$ – Yehuda Lindell Nov 15 '16 at 20:37
0
$\begingroup$

If you split the key into multiple parties (i.e: servers) you could apply Secret Sharing.

You would assign a different secret for each party, and for the reconstruction of the key, each party need to know the other's secrets to come up with the same key. An adversary could get the key if he collects all the secrets needed for the key calculation, so you need to exchange those secrets in a secure way.

$\endgroup$
  • 1
    $\begingroup$ Splitting the key up is just keeping it separate for storage, you can't encrypt or decrypt that way. $\endgroup$ – tylo Nov 15 '16 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.