The distributed discrete logarithm (DDL) problem was introduced by Boyle et al. at CRYPTO 2016. A protocol solving this problem was the mainÂ tool used in the share conversion procedure of their homomorphic secret sharing (HSS) scheme which allows non-interactive evaluation of branching programs among two parties over shares of secret inputs. Let g be a generator of a multiplicative group G. Given a random group element gx and an unknown integer (formula presented) for a small M, two parties A and B (that cannot communicate) successfully solve DDL if (formula presented). Otherwise, the parties err. In the DDL protocol of Boyle et al., A and B run in time T and have error probability that is roughly linear in M/T. Since it has a significant impact on the HSS scheme’s performance, a major open problem raised by Boyle et al. was to reduce the error probability as a function of T. In this paper we devise a new DDL protocol that substantially reduces the error probability to O(M· T-2). Our new protocol improves the asymptotic evaluation time complexity of the HSS scheme by Boyle et al. on branching programs of size S from O(S2) to O(S3/2). We further show that our protocol is optimal up to a constant factor for all relevant cryptographic group families, unless one can solve the discrete logarithm problem in a short interval of length R in time (formula presented). Our DDL protocol is based on a new type of random walk that is composed of several iterations in which the expected step length gradually increases. We believe that this random walk is of independent interest and will find additional applications.
|Title of host publication||Advances in Cryptology – CRYPTO 2018 - 38th Annual International Cryptology Conference, 2018, Proceedings|
|Editors||Hovav Shacham, Alexandra Boldyreva|
|Number of pages||30|
|State||Published - 2018|
|Event||38th Annual International Cryptology Conference, CRYPTO 2018 - Santa Barbara, United States|
Duration: 19 Aug 2018 → 23 Aug 2018
|Name||Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)|
|Conference||38th Annual International Cryptology Conference, CRYPTO 2018|
|Period||19/08/18 → 23/08/18|
Bibliographical noteFunding Information:
This research was supported by the European Research Council under the ERC starting grant agreement no. 757731 (LightCrypt) and by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office.
The first author was additionally supported by the Israeli Science Foundation through grant No. 573/16.
The authors would like to thanks Elette Boyle, Niv Gilboa, Yuval Ishai and Yehuda Lindell for discussions and helpful suggestions regarding this work. This research was supported by the European Research Council under the ERC starting grant agreement no. 757731 (LightCrypt) and by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office. The first author was additionally supported by the Israeli Science Foundation through grant No. 573/16.
© International Association for Cryptologic Research 2018.
- Discrete logarithm
- Discrete logarithm in a short interval
- Fully homomorphic encryption
- Homomorphic secret sharing
- Random walk
- Share conversion