Paper 2022/653

Fast Unbalanced Private Set Union from Fully Homomorphic Encryption

Abstract

Private set union (PSU) allows two parties to compute the union of their sets without revealing anything else. It has found numerous applications in practice. Recently, some computationally efficient PSU protocols have been designed for the balanced case, but a limitation with these protocols is the communication complexity, which scales (super)-linear in the size of the larger set. This is of particular concern when performing PSU in the unbalanced case, where one party is a constrained device holding a small set, and another is a large service provider holding a large set. In this work, we propose a generic construction of unbalanced PSU from leveled fully homomorphic encryption and a newly introduced protocol called permuted matrix private equality test. By instantiating the generic construction, we obtain two secure and fast unbalanced PSU protocols, whose communication complexity is linear in the size of the smaller set, and logarithmic in the larger set. We implement our protocols and compare them with the state-of-the-art PSU. Experiments show that our protocols are more efficient than all previous protocols in the unbalanced case. Especially, the larger difference between the size of two sets, the better our protocols perform. For input sets of size $2^{10}$ and $2^{20}$ with 128-bit length items, our PSU takes $2.767$ MB of communication to compute the union. Compared with the state-of-the-art PSU proposed by Zhang et al. (Usenix Security 2023), there are $37 \times$ reductions in communication and roughly $10 - 35 \times$ reductions in computational overhead depending on network environments.