Bandwidth-Optimized Secure Two-Party Computation of Minima

Abstract

Secure Two-Party Computation (STC) allows two mutually untrusting parties to securely evaluate a function on their private inputs. While tremendous progress has been made towards reducing processing overheads, STC still incurs significant communication overhead that is in fact prohibitive when no high-speed network connection is available, e.g., when applications are run over a cellular network. In this paper, we consider the fundamental problem of securely computing a minimum and its argument, which is a basic building block in a wide range of applications that have been proposed as STCs, e.g., Nearest Neighbor Search, Auctions, and Biometric Matchings. We first comprehensively analyze and compare the communication overhead of implementations of the three major STC concepts, i.e., Yao’s Garbled Circuits, the Goldreich-Micali-Wigderson protocol, and Homomorphic Encryption. We then propose an algorithm for securely computing minima in the semi-honest model that, compared to current state-of-the-art, reduces communication overheads by 18 % to 98 %. Lower communication overheads result in faster runtimes in constrained networks and lower direct costs for users.

A Min and Argmin with Shared Inputs

In Sect. 3, we define the secure min/argmin problem as a building block within another secure computation. This definition neglects those parts of the overheads which are due to sharing inputs between client and server. We thus shortly discuss a second version of the problem where $\mathcal {C}$ and $\mathcal {S}$ each hold half of the inputs and the client obtains the output.

Table 4. Communication complexity [bit] and rounds for the second problem definition, i.e., min and argmin computation with shared inputs.

For GCs, $\mathcal {S}$ sends its garbled inputs to $\mathcal {C}$, amounting to nlt bit of communication. $\mathcal {C}$ obtains its own inputs via correlated OT from $\mathcal {S}$ at a cost of 2nlt bit. These overheads are halved for Kolesnikov’09 [22] where the arguments are implicit and not part of the inputs as well as for Huang’11 where the arguments are encrypted in the backtracking tree. Sharing inputs in GMW-based approaches requires only 2nl bit, i.e., 1 bit per input bit. Again, this overhead is halved for the restricted (arg)min circuit of Schneider’13 [31]. For both Erkin’s protocol and ours, only $\mathcal {C}$’s inputs need to be sent to $\mathcal {S}$ in encrypted form, requiring 2nT bit of communication. We summarize the overall complexity in Table 4.

Table 5. Communication overhead [MiB] for varying security levels and input sizes. All numbers are theoretical estimates.

We implement and evaluate this second (arg)min problem. As before, we observe an implementation overhead of at most 3 % compared to the complexities in Table 4. Only the measurements for ABY-YAO significantly deviate by 14 % and 27 % coupled with a large standard deviation in the send traffic. Since this renders the measurements incomparable, we present only a comparison of the theoretical communication overhead in Table 5. The results are qualitatively very similar to the results for our initial problem definition (Table 2 in Subsect. 5.1). Furthermore, the processing required for sharing the inputs is very low in all approaches. Thus, for our second problem definition, we expect qualitatively very similar results to those presented in Subsect. 5.2.