Paper 2019/1353
Laconic Conditional Disclosure of Secrets and Applications
Nico Döttling, Sanjam Garg, Vipul Goyal, and Giulio Malavolta
Abstract
In a Conditional Disclosure of Secrets (CDS) a verifier V wants to reveal a message m to a prover P conditioned on the fact that x is an accepting instance of some NPlanguage L. An honest prover (holding the corresponding witness w) always obtains the message m at the end of the interaction. On the other hand, if x is not in L we require that no PPT P* can learn the message m. We introduce laconic CDS, a two round CDS protocol with optimal computational cost for the verifier V and optimal communication cost. More specifically, the verifier's computation and overall communication grows with poly(x,\lambda,log(T)), where \lambda is the security parameter and T is the verification time for checking that x is in L (given w). We obtain constructions of laconic CDS under standard assumptions, such as CDH or LWE. Laconic CDS serves as a powerful tool for "maliciousifying" semihonest protocols while preserving their computational and communication complexities. To substantiate this claim, we consider the setting of noninteractive secure computation: Alice wants to publish a short digest corresponding to a private large input x on her web page such that (possibly many) Bob, with a private input y, can send a short message to Alice allowing her to learn C(x,y) (where C is a public circuit). The protocol must be reusable in the sense that Bob can engage in arbitrarily many executions on the same digest. In this context we obtain the following new implications. (1) UC Secure Boboptimized 2PC: We obtain a UC secure protocol where Bob's computational cost and the communication cost of the protocol grows with poly(x,y,\lambda, d), where d is the depth of the computed circuit C. (2) Malicious Laconic Function Evaluation: Next, we move on to the setting where Alice's input x is large. For this case, UC secure protocols must have communication cost growing with x. Thus, with the goal of achieving better efficiency, we consider a weaker notion of malicious security. For this setting, we obtain a protocol for which Bob's computational cost and the communication cost of the protocol grows with poly(y,\lambda, d), where d is the depth of the computed circuit C.
Metadata
 Available format(s)
 Category
 Foundations
 Publication info
 Published elsewhere. Minor revision. IEEE Foundations of Computer Science (FOCS) 2019
 Contact author(s)

giulio malavolta @ hotmail it
nico doettling @ gmail com
sanjamg @ berkeley edu
vipul @ cmu edu  History
 20191127: received
 Short URL
 https://ia.cr/2019/1353
 License

CC BY
BibTeX
@misc{cryptoeprint:2019/1353, author = {Nico Döttling and Sanjam Garg and Vipul Goyal and Giulio Malavolta}, title = {Laconic Conditional Disclosure of Secrets and Applications}, howpublished = {Cryptology ePrint Archive, Paper 2019/1353}, year = {2019}, note = {\url{https://eprint.iacr.org/2019/1353}}, url = {https://eprint.iacr.org/2019/1353} }