Foundations of Cryptography.ppt

Foundations of CryptographyLecture 15: Oblivious Transfer and Secure Function Evaluation Lecturer: Moni Naor Recap of last week’s lecture Malleability vs. Semantic Security Chosen Ciphertext Attacks: CCA1: Preprocessing (Lunch break) Postprocessing Approaches for achieving malleability and resistance to CCA: Independent keys Proofs of consistency Cramer-Shoup Cryptosystem Applications Interactive Authentication Auctions Combinations Motivation for Zero-knowledge Can turn any protocol that works well when the parties are benign (but curious) into one that works well when the parties are malicious Need further property: proof of knowledge Possible to extract the witness from a successful prover Honest but curious model Parties follow the protocol Never erase information General principle: design you protocol assuming the players are honest-but-curious Translate the protocol into one resilient against malicious players Use zero-knowledge (POK) for all language in NP as a compiler Secure Function Evaluation (SFE) Major and exciting topic of research in last quarter century How to distributively compute a function f(X1, X2 , …,Xn), where Xj known to party j. Parties learn only the final output The Millionaires Problem Ideal Solution for the Millionaires Problem Secure Function Evaluation(Informal) Definition Second Price Auctions - Vickrey Problems with applying the Revelation Principle Utility functions (value of item) contain sensitive information Participants might cheat simply to avoid leaking this information Hal Varian: “Even if current information can be safeguarded, records of past behavior can be extremely valuable, since historical data can be used to estimate the willingness to pay” “...what should be the appropriate technological and social safeguards to deal with this problem?” This lecture: technological safeguards via cryptography f(X1, X2 , …,Xn) = (i, xj) , where xi = maxk xk and xj = maxk ? i xk Major Result [Yao,GMW] SFE M