Cryptology ePrint Archive: Report 2015/797

What Security can we Achieve in 4-Rounds?

Carmit Hazay and Muthuramakrishnan Venkitasubramaniam

Abstract: In this paper we study the question of what security is achievable for stand-alone two-party computation in four rounds. Our starting point point is the Katz-Ostrovsky lower bound [KatzO04] which determines that the exact round complexity of achieving secure two-party computation with black-box simulation is five. To get around this lower bound we consider two relaxations of the standard simulation-based security definition, where each relaxation implies a different security guarantee.

Specifically, we analyze our four-round protocols in the presence of malicious non-aborting adversaries (i.e. which do not abort prematurely) for which we obtain full simulation security and malicious aborting adversaries for which we obtain 1/p-security (which implies that the simulation fails with probability at most 1/p+\ngl) while guaranteeing full privacy against both parties. We realize the coin-tossing and oblivious transfer functionalities under these relaxations, and present protocols with different security guarantees. We also provide a tight characterization of when 1/p-security is achievable where full privacy is expected.

Category / Keywords: cryptographic protocols / Secure Computation, Coin-Tossing, Oblivious Transfer, Round Complexity

Date: received 8 Aug 2015, last revised 17 Oct 2015

Contact author: carmit hazay at biu ac il

Available format(s): PDF | BibTeX Citation

Note: The revised version of October 17,2015 includes a new protocol for oblivious transfer that achieves the strongest security notion achievable in three rounds, namely, it provides full privacy against both parties and 1/p security against a malicious sender. It also includes a new result that proves optimality of this new construction by providing a matching lower bound.

Version: 20151017:174823 (All versions of this report)

Short URL: ia.cr/2015/797

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]