[PDF] Top 20 Two-round secure MPC from Indistinguishability Obfuscation

... The model for protocol execution. The model of computation consists of the parties running an instance of a protocol Π, an adversary A that controls the communication among the parties, and an environment Z that controls ... See full document

... proposing two equivalent circuits and and efficient challenger has no direct way to verify ...iO from falsifiable assumptions would imply our results for the case of poly- nomially secure ... See full document

... [6]. Two patches [13, 5] were proposed very soon after the CLT was ...these two patches were still ...a secure and efficient multilinear map is still a worthwhile ... See full document

... preserves two of the guarantees of the invariant signatures: 1) it is invariant in the sense that for every verification key VK and message M , C = VK(M ) can be opened to a unique bit b, due to the binding of the ... See full document

... are two variants of our scheme, depending on the security of the underlying ...[GW09] from semi-static to adaptive security also applies to private broadcast, and we therefore obtain an ... See full document

... Indistinguishability obfuscation for Turing machines has been constructed in the works of Boyle, Chung and Pass [BCP14] and Ananth et ...differing-inputs obfuscation (diO) which extends iO to ... See full document

... of indistinguishability obfuscation, positioning it as a central hub for almost all known cryptographic tasks, and as an extremely powerful building block for new cryptographic tasks resolv- ing ... See full document

... Program obfuscation has been a longstanding goal in cryptography, though for many years general solutions seemed ...eral indistinguishability obfuscation (iO) candidate by Garg, Gentry, Halevi, ... See full document

... These two distributions are computationally indistinguishable even if an adversary knows the corresponding secret decryption keys sk and sk 0 , the point ω, and the opening ...this indistinguishability to ... See full document

... efficient MPC protocols [3, 4, 5, 10, 14, 15]. In this paradigm, an MPC protocol is divided into two phases, a circuit-independent offline phase and a circuit-dependent online ...triple from ... See full document

... obtaining obfuscation (and they do not imply the aGDDH as- sumption), the weak notion of semantical security suffices for obtaining witness encryption [GGSW13]— roughly speaking, the notion of witness encryption ... See full document

... of two-round MPC, many chal- lenges still ...protocols from [GS18, BL18] inherently make a non-black-box use of the underlying OT ...of two-round MPC discussed ...using ... See full document

... Program obfuscation [Had00, BGI + 01] concerns with the problem of making a computer pro- gram “unintelligible” while still preserving its ...program obfuscation remained an elusive goal for several ... See full document

... differs from one work to another: [GS17] use bilinear maps, [GS18b] use two-round oblivious transfer, [BL18, GMS18] use two-round oblivious oblivious transfer and additionally garbled ... See full document

... 13b] from multilinear maps and by Gorbunov, Vaikuntanathan and Wee [GVW13] from the learning with errors [Reg05] ...selectively secure; requiring complexity leveraging for adaptive security. In ... See full document

... point obfuscation, that is, virtual black-box and virtual ...CCA secure public-key encryption schemes from an IND-CPA secure encryption scheme using MB-AIPO with computationally hard-to-invert ... See full document

... In two lemmas we prove that this middle hybrid is indistinguishable from both real execution and ...step two we consider the case of adaptive inputs choice, thus proving the theorem ... See full document

... first round, and the current transcript of the underlying MPC ...first round, but also to the transcript as it develops in the second round, the obfuscations themselves must also generate ... See full document

... follows from the global proof of knowledge property of WIUA, that the witness of each WIUA is well-defined, therefore, we can refer to the machine M committed in Phase 1, the statement q committed in Phase 2, and ... See full document

... this approach is that it achieves the goal and has no a priori bound on the input size. However, knowledge assumptions are generally considered to be a more risky class of assumptions and Garg, Gentry, Halevi and Wichs ... See full document