An optimal distributed discrete log protocol with applications to homomorphic secret sharing

Itai Dinur; Nathan Keller; Ohad Klein

doi:10.1007/978-3-319-96878-0_8

An optimal distributed discrete log protocol with applications to homomorphic secret sharing

Itai Dinur, Nathan Keller, Ohad Klein

Department of Mathematics

Ben-Gurion University of the Negev

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

9 Scopus citations

Abstract

The distributed discrete logarithm (DDL) problem was introduced by Boyle et al. at CRYPTO 2016. A protocol solving this problem was the mainÂ tool used in the share conversion procedure of their homomorphic secret sharing (HSS) scheme which allows non-interactive evaluation of branching programs among two parties over shares of secret inputs. Let g be a generator of a multiplicative group G. Given a random group element g^x and an unknown integer (formula presented) for a small M, two parties A and B (that cannot communicate) successfully solve DDL if (formula presented). Otherwise, the parties err. In the DDL protocol of Boyle et al., A and B run in time T and have error probability that is roughly linear in M/T. Since it has a significant impact on the HSS scheme’s performance, a major open problem raised by Boyle et al. was to reduce the error probability as a function of T. In this paper we devise a new DDL protocol that substantially reduces the error probability to O(M· T^-2). Our new protocol improves the asymptotic evaluation time complexity of the HSS scheme by Boyle et al. on branching programs of size S from O(S²) to O(S^3/2). We further show that our protocol is optimal up to a constant factor for all relevant cryptographic group families, unless one can solve the discrete logarithm problem in a short interval of length R in time (formula presented). Our DDL protocol is based on a new type of random walk that is composed of several iterations in which the expected step length gradually increases. We believe that this random walk is of independent interest and will find additional applications.

Original language	English
Title of host publication	Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings
Editors	Hovav Shacham, Alexandra Boldyreva
Publisher	Springer Verlag
Pages	213-242
Number of pages	30
ISBN (Print)	9783319968773
DOIs	https://doi.org/10.1007/978-3-319-96878-0_8
State	Published - 2018
Event	38th Annual International Cryptology Conference, CRYPTO 2018 - Santa Barbara, United States Duration: 19 Aug 2018 → 23 Aug 2018

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	10993 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	38th Annual International Cryptology Conference, CRYPTO 2018
Country/Territory	United States
City	Santa Barbara
Period	19/08/18 → 23/08/18

Bibliographical note

Publisher Copyright:
© International Association for Cryptologic Research 2018.

Funding

This research was supported by the European Research Council under the ERC starting grant agreement no. 757731 (LightCrypt) and by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office. The first author was additionally supported by the Israeli Science Foundation through grant No. 573/16. The authors would like to thanks Elette Boyle, Niv Gilboa, Yuval Ishai and Yehuda Lindell for discussions and helpful suggestions regarding this work. This research was supported by the European Research Council under the ERC starting grant agreement no. 757731 (LightCrypt) and by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office. The first author was additionally supported by the Israeli Science Foundation through grant No. 573/16.

Funders	Funder number
Israeli Science Foundation	573/16
United States-Israel Binational Science Foundation
Horizon 2020 Framework Programme
European Commission	757731
Israel Science Foundation

Keywords

Discrete logarithm
Discrete logarithm in a short interval
Fully homomorphic encryption
Homomorphic secret sharing
Random walk
Share conversion

Access to Document

10.1007/978-3-319-96878-0_8

Cite this

Dinur, I., Keller, N., & Klein, O. (2018). An optimal distributed discrete log protocol with applications to homomorphic secret sharing. In H. Shacham, & A. Boldyreva (Eds.), Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings (pp. 213-242). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10993 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-319-96878-0_8

Dinur, Itai ; Keller, Nathan ; Klein, Ohad. / An optimal distributed discrete log protocol with applications to homomorphic secret sharing. Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings. editor / Hovav Shacham ; Alexandra Boldyreva. Springer Verlag, 2018. pp. 213-242 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{88a0875c89a849c58c5c9ba40ed6051c,

title = "An optimal distributed discrete log protocol with applications to homomorphic secret sharing",

abstract = "The distributed discrete logarithm (DDL) problem was introduced by Boyle et al. at CRYPTO 2016. A protocol solving this problem was the main{\^A} tool used in the share conversion procedure of their homomorphic secret sharing (HSS) scheme which allows non-interactive evaluation of branching programs among two parties over shares of secret inputs. Let g be a generator of a multiplicative group G. Given a random group element gx and an unknown integer (formula presented) for a small M, two parties A and B (that cannot communicate) successfully solve DDL if (formula presented). Otherwise, the parties err. In the DDL protocol of Boyle et al., A and B run in time T and have error probability that is roughly linear in M/T. Since it has a significant impact on the HSS scheme{\textquoteright}s performance, a major open problem raised by Boyle et al. was to reduce the error probability as a function of T. In this paper we devise a new DDL protocol that substantially reduces the error probability to O(M· T-2). Our new protocol improves the asymptotic evaluation time complexity of the HSS scheme by Boyle et al. on branching programs of size S from O(S2) to O(S3/2). We further show that our protocol is optimal up to a constant factor for all relevant cryptographic group families, unless one can solve the discrete logarithm problem in a short interval of length R in time (formula presented). Our DDL protocol is based on a new type of random walk that is composed of several iterations in which the expected step length gradually increases. We believe that this random walk is of independent interest and will find additional applications.",

keywords = "Discrete logarithm, Discrete logarithm in a short interval, Fully homomorphic encryption, Homomorphic secret sharing, Random walk, Share conversion",

author = "Itai Dinur and Nathan Keller and Ohad Klein",

note = "Publisher Copyright: {\textcopyright} International Association for Cryptologic Research 2018.; 38th Annual International Cryptology Conference, CRYPTO 2018 ; Conference date: 19-08-2018 Through 23-08-2018",

year = "2018",

doi = "10.1007/978-3-319-96878-0_8",

language = "אנגלית",

isbn = "9783319968773",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "213--242",

editor = "Hovav Shacham and Alexandra Boldyreva",

booktitle = "Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings",

address = "גרמניה",

}

Dinur, I, Keller, N & Klein, O 2018, An optimal distributed discrete log protocol with applications to homomorphic secret sharing. in H Shacham & A Boldyreva (eds), Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10993 LNCS, Springer Verlag, pp. 213-242, 38th Annual International Cryptology Conference, CRYPTO 2018, Santa Barbara, United States, 19/08/18. https://doi.org/10.1007/978-3-319-96878-0_8

An optimal distributed discrete log protocol with applications to homomorphic secret sharing. / Dinur, Itai; Keller, Nathan; Klein, Ohad.
Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings. ed. / Hovav Shacham; Alexandra Boldyreva. Springer Verlag, 2018. p. 213-242 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10993 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - An optimal distributed discrete log protocol with applications to homomorphic secret sharing

AU - Dinur, Itai

AU - Keller, Nathan

AU - Klein, Ohad

N1 - Publisher Copyright: © International Association for Cryptologic Research 2018.

PY - 2018

Y1 - 2018

N2 - The distributed discrete logarithm (DDL) problem was introduced by Boyle et al. at CRYPTO 2016. A protocol solving this problem was the mainÂ tool used in the share conversion procedure of their homomorphic secret sharing (HSS) scheme which allows non-interactive evaluation of branching programs among two parties over shares of secret inputs. Let g be a generator of a multiplicative group G. Given a random group element gx and an unknown integer (formula presented) for a small M, two parties A and B (that cannot communicate) successfully solve DDL if (formula presented). Otherwise, the parties err. In the DDL protocol of Boyle et al., A and B run in time T and have error probability that is roughly linear in M/T. Since it has a significant impact on the HSS scheme’s performance, a major open problem raised by Boyle et al. was to reduce the error probability as a function of T. In this paper we devise a new DDL protocol that substantially reduces the error probability to O(M· T-2). Our new protocol improves the asymptotic evaluation time complexity of the HSS scheme by Boyle et al. on branching programs of size S from O(S2) to O(S3/2). We further show that our protocol is optimal up to a constant factor for all relevant cryptographic group families, unless one can solve the discrete logarithm problem in a short interval of length R in time (formula presented). Our DDL protocol is based on a new type of random walk that is composed of several iterations in which the expected step length gradually increases. We believe that this random walk is of independent interest and will find additional applications.

AB - The distributed discrete logarithm (DDL) problem was introduced by Boyle et al. at CRYPTO 2016. A protocol solving this problem was the mainÂ tool used in the share conversion procedure of their homomorphic secret sharing (HSS) scheme which allows non-interactive evaluation of branching programs among two parties over shares of secret inputs. Let g be a generator of a multiplicative group G. Given a random group element gx and an unknown integer (formula presented) for a small M, two parties A and B (that cannot communicate) successfully solve DDL if (formula presented). Otherwise, the parties err. In the DDL protocol of Boyle et al., A and B run in time T and have error probability that is roughly linear in M/T. Since it has a significant impact on the HSS scheme’s performance, a major open problem raised by Boyle et al. was to reduce the error probability as a function of T. In this paper we devise a new DDL protocol that substantially reduces the error probability to O(M· T-2). Our new protocol improves the asymptotic evaluation time complexity of the HSS scheme by Boyle et al. on branching programs of size S from O(S2) to O(S3/2). We further show that our protocol is optimal up to a constant factor for all relevant cryptographic group families, unless one can solve the discrete logarithm problem in a short interval of length R in time (formula presented). Our DDL protocol is based on a new type of random walk that is composed of several iterations in which the expected step length gradually increases. We believe that this random walk is of independent interest and will find additional applications.

KW - Discrete logarithm

KW - Discrete logarithm in a short interval

KW - Fully homomorphic encryption

KW - Homomorphic secret sharing

KW - Random walk

KW - Share conversion

UR - http://www.scopus.com/inward/record.url?scp=85052384386&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-96878-0_8

DO - 10.1007/978-3-319-96878-0_8

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85052384386

SN - 9783319968773

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 213

EP - 242

BT - Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings

A2 - Shacham, Hovav

A2 - Boldyreva, Alexandra

PB - Springer Verlag

T2 - 38th Annual International Cryptology Conference, CRYPTO 2018

Y2 - 19 August 2018 through 23 August 2018

ER -

Dinur I, Keller N, Klein O. An optimal distributed discrete log protocol with applications to homomorphic secret sharing. In Shacham H, Boldyreva A, editors, Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings. Springer Verlag. 2018. p. 213-242. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-96878-0_8

An optimal distributed discrete log protocol with applications to homomorphic secret sharing

Abstract

Publication series

Conference

Bibliographical note

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this