AbstractMotivated by leakage-resilient secure computation of circuits with addition and multiplication gates, this work studies the leakage-resilience of linear secret-sharing schemes with a small reconstruction threshold against any bounded-size family of joint leakage attacks, i.e., the leakage function can leak global information from all secret shares.We first prove that, with high probability, the Massey secret-sharing scheme corresponding to a random linear code over a finite field F is leakage-resilient against any \(\ell \)-bit joint leakage family of size at most \(|{F}|^{k-2.01}/8^\ell \), where k is the reconstruction threshold. Our result (1) bypasses the bottleneck due to the existing Fourier-analytic approach, (2) enables secure multiplication of secrets, and (3) is near-optimal. We use combinatorial and second-moment techniques to prove the result.Next, we show that the Shamir secret-sharing scheme over a prime-order field F with randomly chosen evaluation places and with threshold k is leakage-resilient to any \(\ell \)-bit joint leakage family of size at most \(|{F}|^{2k-n-2.01}/(k!\cdot 8^\ell )\) with high probability. We prove this result by marrying our proof techniques for the first result with the existing Fourier analytical approach. Moreover, it is unlikely that one can extend this result beyond \(k/n\leqslant 0.5\) due to the technical hurdle for the Fourier-analytic approach. 

Leakage-resilient Linear Secret-sharing Against Arbitrary Bounded-size Leakage Family

. We study the local leakage resilience of Shamir’s secret sharing scheme. In Shamir’s scheme, a random polynomial f of degree t is sampled over a field of size p > n , conditioned on f (0) = s for a secret s . Any t shares ( i, f ( i )) can be used to fully recover f and thereby f (0). But, any t − 1 evaluations of f at non-zero coordinates are completely independent of f (0). Recent works ask whether the secret remains hidden even if say only 1 bit of information is leaked from each share, independently. This question is well motivated due to the wide range of applications of Shamir’s scheme. For instance, it is known that if Shamir’s scheme is leakage resilient in some range of parameters, then known secure computation protocols are secure in a local leakage model. Over characteristic-2 fields, the answer is known to be negative (e.g., Guruswami and Wootters, STOC ’16). Benhamouda, Degwekar, Ishai, and Rabin (CRYPTO ’18) were the first to give a positive answer assuming computation is done over prime-order fields. They showed that if t ≥ 0 . 907 n , then Shamir’s scheme is leakage resilient. Since then, there has been extensive efforts to improve the above threshold and after a series of works, the current record shows leakage resilience for t ≥ 0 . 78 n (Maji et al., ISIT ’22). All existing analyses of Shamir’s leakage resilience for general leakage functions follow a single framework for which there is a known barrier for any t ≤ 0 . 5 n . In

New Bounds on the Local Leakage Resilience of Shamir's Secret Sharing Scheme

. NIST aims to recommend best practices to make secret-sharing schemes like Shamir’s and the additive secret-sharing scheme more secure. The additive secret-sharing scheme’s security is completely broken by leaking one physical bit from every secret share – leaking their least significant bit (LSB) suffices. Shamir’s secret-sharing scheme inherits these vulnerabilities if its evaluation places are carelessly chosen. To further NIST’s efforts in this context, it is natural to wonder which evaluation places would make Shamir’s secret-sharing scheme robust to such attacks. Westudy Shamir secret-sharing schemes where the number of parties n equals the reconstruction threshold k . A random choice of evaluation places is known to be robust to such leakages with high probability. However, techniques to distinguish secure evaluation places from insecure ones are unknown. Our work introduces the following innovations.

Security of Shamir’s Secret-sharing against Physical Bit Leakage: Secure Evaluation Places

. Threshold secret sharing allows a dealer to split a secret s into n shares, such that any t shares allow for reconstructing s , but no t − 1 shares reveal any information about s . Leakage-resilient secret sharing requires that the secret remains hidden, even when an adversary additionally obtains a limited amount of leakage from every share. Benhamouda et al. (CRYPTO’18) proved that Shamir’s secret sharing scheme is one bit leakage-resilient for reconstruction threshold t ≥ 0 . 85 n and conjectured that the same holds for t = c · n for any constant 0 ≤ c ≤ 1. Nielsen and Simkin (EUROCRYPT’20) showed that this is the best one can hope for by proving that Shamir’s scheme is not secure against one-bit leakage when t = c · n/ log( n ). In this work, we strengthen the lower bound of Nielsen and Simkin. We consider noisy leakage-resilience, where a random subset of leakages is replaced by uniformly random noise. We prove a lower bound for Shamir’s secret sharing, similar to that of Nielsen and Simkin, which holds even when a constant fraction of leakages is replaced by random noise. To this end, we first prove a lower bound on the share size of any noisy-leakage-resilient sharing scheme. We then use this lower bound to show that there exist universal constants c 1 , c 2 , such that for infinitely many n it holds that Shamir’s secret sharing scheme is not noisy-leakage-resilient for t ≤ c 1 · n/ log( n ), even when a c 2 fraction of leakages are replaced by random noise.

Stronger Lower Bounds for Leakage-Resilient Secret Sharing

Secure multi-party computation (SMPC) allows mutually distrusted parties to evaluate a function jointly without revealing their private inputs. This technique helps organizations collaborate on a common goal without disclosing confidential or protected data. Despite its suitability for privacy-preserving computation, SMPC suffers from network-based performance limitations. Specifically, the SMPC parties perform the techniques in rounds, where they execute a local computation and then share their round output with the other parties. This network interchange creates a bottleneck as parties need to wait until the data propagates before resuming the execution. To reduce the SMPC execution time, we propose a pipelining-like approach for each round’s computation and communication by dividing the data and readjusting the execution order. Targeting deep learning applications, we propose strategies for the case of matrix multiplication, a core component of such applications. Our results on a distributed cloud deployment show a significant reduction in the SMPC execution time. 

Network-Efficient Pipelining-Based Secure Multiparty Computation for Machine Learning Applications

Innovative side-channel attacks have repeatedly exposed the secrets of cryptosystems. Benhamouda, Degwekar, Ishai, and Rabin (CRYPTO–2018) introduced local leakage resilience of secret-sharing schemes to study some of these vulnerabilities. In this framework, the objective is to characterize the unintended information revelation about the secret by obtaining independent leakage from each secret share. This work accurately quantifies the vulnerability of the additive secret-sharing scheme to local leakage attacks and its consequences for other secret-sharing schemes. Consider the additive secret-sharing scheme over a prime field among k parties, where the secret shares are stored in their natural binary representation, requiring λ bits – the security parameter. We prove that the reconstruction threshold k = ω (log λ ) is necessary to protect against local physical-bit probing attacks, improving the previous ω (log λ/ log log λ ) lower bound. This result is a consequence of accurately determining the distinguishing advantage of the “parity-of-parity” physical-bit local leakage attack proposed by Maji, Nguyen, Paskin-Cherniavsky, Suad, and Wang (EUROCRYPT–2021). Our lower bound is optimal because the additive secret-sharing scheme is perfectly secure against any ( k − 1)-bit (global) leakage and (statistically) secure against (arbitrary) one-bit local leakage attacks when k = ω (log λ ). Any physical-bit local leakage (1) physical-bit local leakage attacks on the Shamir secret-sharing scheme with adversarially-chosen evaluation places, and (2) local leakage attacks on the Massey secret-sharing scheme corresponding to any linear code. In particular, for Shamir’s secret-sharing scheme, the reconstruction threshold k = ω (log λ ) is necessary when the number of parties is n = O ( λ log λ ). Our analysis of the “parity-of-parity” attack’s distinguishing advantage establishes it as the best-known local leakage attack in these scenarios. Our work employs Fourier-analytic techniques to analyze the “parity-of-parity” attack on the additive secret-sharing scheme. We accurately estimate an exponential sum that captures the vulnerability of this secret-sharing scheme to the parity-of-parity attack, a quantity that is also closely related to the “discrepancy” of the Irwin-Hall probability distribution. Any findings and conclusions or recommendations expressed in this are those of the author(s) and do not necessarily reflect the views of the United or DARPA.

Tight Estimate of the Local Leakage Resilience of the Additive Secret-Sharing Scheme & Its Consequences

Polymath: Low-Latency MPC via Secure Polynomial Evaluations and Its Applications

In a seminal work, Ishai et al. (FOCS–2006) studied the viability of designing unconditionally secure protocols for key agreement and secure multi-party computation (MPC) using an anonymous bulletin board (ABB) as a building block. While their results establish the feasibility of key agreement and honest-majority MPC in the ABB model, the optimality of protocols with respect to their round and communication complexity is not studied. This paper enriches this study of unconditional security in the ABB model in multiple ways. We present a key agreement protocol with a novel combinatorial insight to offer a 200% throughput over the (FOCS–2006) study; i.e., using the same number of messages, we can (almost) double the bit-length of the agreed key. We also prove the near optimality of our approach. We offer unconditionally secure protocols for the binary erasure channel and string oblivious transfer functionalities. Our BEC and (chosen message) random string oblivious transfer protocols employ one-shot access to an ABB and a single message from a sender and a receiver. We demonstrate the round optimality of our BEC constructions. Furthermore, we present a non-interactive (random) string oblivious transfer protocol. Central to our technical contributions is the abstraction of a distributional variant of the random ABB functionality. Investigating the concrete efficiency of founding MPC from this primitive leads to fascinating new mathematical challenges in well-established MPC models, which will be of broader interest to the community.

Unconditional Security using (Random) Anonymous Bulletin Board

—The ofﬂine-online model is a leading paradigm for practical secure multi-party computation (MPC) protocol design that has successfully reduced the overhead for several prevalent privacy-preserving computation functionalities common to diverse application domains. However, the prohibitive overheads associated with secure comparison – one of these vital functionalities – often bottlenecks current and envisioned MPC solutions. Indeed, an efﬁcient secure comparison solution has the potential for signiﬁcant real-world impact through its broad applications. This work identiﬁes and presents SIM, a secure protocol for the functionality of interval membership testing . This security functionality, in particular, facilitates secure less-than-zero testing and, in turn, secure comparison. A key technical challenge is to support a fast online protocol for testing in large integer rings while keeping the precomputation tractable. Motivated by the map-reduce paradigm, this work introduces the innovation of (1) computing a sequence of intermediate functionalities on a partition of the input into input blocks and (2) securely aggregating the output from these intermediate outputs. This innovation allows control-ling the size of the precomputation through a granularity parameter representing these input blocks’ size – enabling application-speciﬁc automated compiler optimizations. To demonstrate our protocols’ efﬁciency, we implement and test their performance in a high-demand application: privacy-preserving machine learning. The benchmark results show that switching to our protocols yields signiﬁcant performance improvement, which indicates that using our protocol in a plug-and-play fashion can improve the performance of various security applications. Our new paradigm of protocol design may be of independent interest because of its potential for extensions to other functionalities of practical interest.

Albert Yu

Papers

Tight Estimate of the Local Leakage Resilience of the Additive Secret-Sharing Scheme & Its Consequences

Leakage-resilient Linear Secret-sharing Against Arbitrary Bounded-size Leakage Family

Polymath: Low-Latency MPC via Secure Polynomial Evaluations and Its Applications

Unconditional Security using (Random) Anonymous Bulletin Board

SIM: Secure Interval Membership Testing and Applications to Secure Comparison