We propose Phecda, a new framework to produce quantum-resistant transparent zkSNARKs in the Random Oracle Model. Phecda features a novel multi-linear polynomial commitment scheme and a novel VOLE-in-the-Head zero-knowledge argument, offering a versatile solution for verifying many real-world computations. In particular, we invent a novel AES verification circuit, which, combined with Phecda, allows to verify 1024 blocks of AES in the counter-mode in 10ms using a single-thread program running on a Linux PC.

This paper revisits Virgo, a well-known transparent zero-knowledge proof system that has been used in many subsequent studies. Through our analysis, we uncover previously overlooked limitations and several exploitable security vulnerabilities within Virgo’s zkVPD protocol design and implementation. We subsequently address these issues and improve Virgo’s zkVPD protocol. Our improvements feature simplified but more efficient VPD and zkVPD algorithms, offering enhanced support for computations over binary fields and their extension fields.

We explore a new approach to construct zero-knowledge proofs by combining ideas from the succinct proof system GKR, the Fully Linear PCP (FLPCP), and MPC-in-the-Head ZKPoK. Our discovery contributes to the state-of-the-art of ZKP in two aspects: (1) Methodology: We demonstrate a way to build transparent ZK proofs from simplified variant of FLPCP and KKW. The resulting proofs are practically efficient (O(|C|)-time prover, O(log(|C|)-time verifier, O(log(|C|))-bandwidth where |C| is the number of polynomial gates), and work readily for circuits defined with polynomial gates over any finite field. (2) Applications: We present efficient (interactive) identification schemes, ring identification schemes, (non-interactive) digital signatures and ring signatures, all based on the standard AES ciphersuite. We also show the first practically efficient verifiable symmetric-key encryption scheme, based on counter-mode AES.

Domain Name System (DNS) is known to present privacy concerns. To this end, decentralized blockchains have been used to host DNS records, so that users can synchronize with the blockchain to maintain a local DNS database and resolve domain names locally. However, existing blockchain-based solutions either do not guarantee a domain name is controlled by its "true" owner; or have to resort to DNSSEC, a not yet widely adopted protocol, for verifying ownership. In this paper, we present DNSonChain, a new blockchain-based naming service compatible with DNS. It allows domain owners to claim their domain ownership on the blockchain where DNS records are hosted. The core function of DNSonChain is to validate the domain ownership in a decentralized manner. We propose a majority vote mechanism that randomly selects multiple participants (i.e., voters) in the system to vote for the authority of domain ownership. To provide resistance to attacks from fraudulent voters, DNSonChain requires two rounds of voting processes. Our security analysis shows that DNSonChain is robust against several types of security failures, able to recover from various attacks. We implemented a prototype of DNSonChain as an Ethereum decentralized application and evaluate it on an Ethereum Testnet.

Hashing garbled circuits is an important, albeit expensive, bandwidth- saving technique that can be an order-of-magnitude slower than generating garbled circuits. In a recent work, Fan et al. (EURO- CRYPT, 2017) proposed a method to produce GC-hashes with- out any calls to expensive collision-resistant hash functions. They showed experimentally that the overhead of hashing GCs can be eliminated almost entirely. In this paper, we identify several security flaws in their approach. (1) We show some fundamental weakness in the notion of hash-security, which makes it impossible to support any existing malicious GC-hash-based cut-and-choose protocols. (2) Although the concept of hash-security could be useful in certain scenarios, we show (with concrete attacks) that the Free-Hash construction given in their paper is not really hash-secure. As a positive result of this work, we propose and formalize the concept of hash-enabled garbling and show how an actively-secure 2PC protocol can be constructed with black-box use of any hash- enabled garbling scheme. This is the first time when the use of GC-hashes in any cut-and-choose protocols is formally examined and rigorously proved secure. Our protocol allows to leverage GC- hashes to save bandwidth while minimizing the cut-and-choose duplication factor, i.e., using s (instead of 3s) copies of GCs to achieve 2-s statistical security.

Secure string-comparison by some non-linear metrics such as edit-distance and its variations is an important building block of many applications including patient genome matching and text-based intrusion detection. Despite the significance of these string metrics, computing them in a provably secure manner is very expensive. In this paper, we improve the performance of secure computation of these string metrics without sacrificing security, generality, composability, and accuracy. We explore a new design methodology that allows us to reduce the asymptotic cost by a factor of O(log n) (where n denotes the input string length). In our experiments, we observe up to an order-of-magnitude savings in time and bandwidth compared to the best prior results. We extended our semi-honest protocols to work in the malicious model, which is by-far the most efficient actively-secure protocols for computing these string metrics.

The theoretical idea of using FHE to realize MPC has been there for over a decade. Existing threshold (and multi-key) FHE schemes were constructed by modifying and analyzing a traditional single-key FHE in a case-by-case manner, thus technically highly-demanding. This work explores a new approach to build threshold FHE (thereby MPC schemes) through tailoring generic MPC protocols to the base FHE scheme while requiring no effort in FHE redesign. We applied our approach to two representative Ring-LWE-based FHE schemes: CKKS [37, 38] and GHS [54, 55], producing GMPFHE-CKKS and GMPFHE-GHS. We developed MPC protocols based on GMPFHECKKS and GMPFHE-GHS which are secure against any number of passive but colluding adversaries. The online cost of our MPC protocol is O(|C |), as opposed to O(|C | · n2) for existing MPC protocols, and our offline cost is independent of |C |. We experimentally show that the GMPFHE-CKKS-based MPC protocol offers unparalleled amortized performance on multi-party neural network evaluation.

We present a new efficient two-party secure computation protocol which allows the honest party to catch dishonest behavior (if any) with a publicly-verifiable, non-repudiable proof without sacrificing the honest party's secret. Comparing to the best existing protocol of its kind, ours requires a substantially simpler judge algorithm and is able to process circuit evaluator's input-wires two orders of magnitude faster. Further, we propose an automated, decentralized judge implemented as a blockchain smart-contract. As a killer application of combining our two-party PVC protocol with our decentralized judge, we proposed the concept of financially-secure computation, which can be useful in many practical scenarios where it suffices to consider rational adversaries. We experimentally evaluated our prototype implementation, demonstrated the 2PC protocol is highly efficient and the judge is very affordable to protect users against rational attackers.

Programmers of cryptographic applications written in C need to avoid common mistakes such as sending private data over public channels or improperly ordering protocol steps. These secrecy, integrity, and sequencing policies can be cumbersome to check with existing general-purpose tools. We have developed a novel means of specifying and uncovering violations of these policies that allows for a much lighter-weight approach than previous tools. We embed the policy annotations in C's type system via a source-to-source translation and leverage existing C compilers to check for policy violations, achieving high performance and scalability. We show through case studies of recent cryptographic libraries and applications that our work is able to express detailed policies for large bodies of C code and can find subtle policy violations. We show formal connections between the policy annotations and an information flow type system and prove a noninterference guarantee of our design.

Existing actively-secure MPC protocols require either linear rounds or linear space. Due to this fundamental space-round dilemma, no existing MPC protocols is able to run large-scale computations without significantly sacrificing performance. To mitigate this issue, we developed nanoPI, which is practically efficient in terms of both time and space. Our protocol is based on WRK but introduces interesting and necessary modifications to address several important programmatic and cryptographic challenges. A technique that may be of independent interest (in transforming other computation-oriented cryptographic protocols) is a staged execution model, which we formally define and realize using a combination of lightweight static and dynamic program instrumentation. Our techniques are integrated in nanoPI, an open-source tool for efficiently building and running actively-secure extreme-scale MPC applications. We demonstrate the unprecedented scalability and performance of nanoPI by building and running a suit of bench- mark applications, including an actively-secure four-party logistical regression (involving 4.7 billion ANDs and 8.9 billion XORs) which finished in less than 28 hours on four small-memory machines.

Existing actively-secure MPC protocols require either linear rounds or linear space. Due to this fundamental space-round dilemma, no existing MPC protocols is able to run large-scale computations without significantly sacrificing performance. To mitigate this issue, we developed nanoPI, which is practically efficient in terms of both time and space. Our protocol is based on WRK [44, 45] but introduces interesting and necessary modifications to address several important programmatic and cryptographic challenges. A technique that may be of independent interest (in transforming other computation-oriented cryptographic protocols) is a staged execution model, which we formally define and realize using a combination of lightweight static and dynamic program instrumentation. We demonstrate the unprecedented scalability and performance of nanoPI by building and running a suit of benchmark applications, including an actively-secure four-party logistical regression (involving 4.7 billion ANDs and 8.9 billion XORs) which finished in less than 28 hours on four small-memory machines. Our integrated framework nanoPI is open-sourced at https: // github. com/ nanoPIMPC/ nanoPI.

Programmers often need to enforce high-level policies on their cryptographic applications written in C; for instance, that private data is not sent over public channels, trusted data is not modified by untrusted functions, and that the ordering of protocol steps is maintained. These secrecy, integrity, and sequencing policies can be cumbersome to check with existing general-purpose tools. We have developed a novel means of specifying and checking these policies that allows for a much lighter-weight approach than previous tools; requiring less work from programmers. Further, we have modeled our policy annotations as an information flow type system and proved a noninterference guarantee. We embed the policy annotations in C's type system via a source-to-source translation and leverage existing C type checkers to enforce our policies, achieving high performance and scalability. We show through case studies of cryptographic libraries from both industry and recent literature that our work expresses detailed policies for large bodies of C code with little annotation burden, and finds subtle implementation bugs.

Programmers often need to enforce high-level policies on their cryptographic applications written in C; for instance, that private data is not sent over public channels, trusted data is not modified by untrusted functions, and that the ordering of protocol steps is maintained. These secrecy, integrity, and sequencing policies can be cumbersome to check with existing general-purpose tools. We have developed a novel means of specifying and checking these policies that allows for a much lighter-weight approach than previous tools; requiring less work from programmers. Further, we have modeled our policy annotations as an information flow type system and proved a noninterference guarantee. We embed the policy annotations in C's type system via a source-to-source translation and leverage existing C type checkers to enforce our policies, achieving high performance and scalability. We show through case studies of cryptographic libraries from both industry and recent literature that our work expresses detailed policies for large bodies of C code with little annotation burden, and finds subtle implementation bugs.

This paper considers the problem of running a long-term on-demand service for executing actively-secure computations. We examined state-of-the-art tools and implementations for actively-secure computation and identified a set of key features indispensable to offer meaningful service like this. Since no satisfactory tools exist for the purpose, we developed Pool, a new tool for building and executing actively-secure computation protocols at extreme scales with nearly zero offline delay. With Pool, we are able to obliviously execute, for the first time, reactive computations like ORAM in the malicious threat model. Many technical benefits of Pool can be attributed to the concept of pool-based cut-and-choose. We show with experiments that this idea has significantly improved the scalability and usability of JIMU, a state-of-the-art LEGO protocol.

Cost-aware cut-and-choose game is a fundamental technique that has many cryptographic applications. Best existing solutions of this game assumed for simplicity that the number of challenges is publicly known. This paper considers an extension of this game where the number of challenges can be picked probabilistically and hidden to the adversary. Although this small change leads to a linear program with infinitely many variables and constraints, we discover a surprising efficiency solver — using only O(n) space and O(n) time where n is the upper-bound on the number of challenges allowed in the strategy space. We then prove that n is bounded for any fixed cost ratio, implying the optimality of our solution extends to the strategy space that allow any number of challenges. As two interesting applications of our game solver, we demonstrate its value in constructing an actively secure two-party computation protocol and an optimal prefix-free code for encryptions.

LEGO-style cut-and-choose is known for its asymptotic efficiency in realizing actively-secure computations. The dominant cost of LEGO protocols is due to wire-soldering — the key technique enabling to put independently generated garbled gates together in a bucket to realize a logical gate. Existing wire-soldering constructions rely on homomorphic commitments and their security requires the majority of the garbled gates in every bucket to be correct. In this paper, we propose an efficient construction of LEGO protocols that does not use homomorphic commitments but is able to guarantee security as long as at least one of the garbled gate in each bucket is correct. Additionally, the faulty gate detection rate in our protocol doubles that of the state-of-the-art LEGO constructions. We have implemented our protocol and our experiments on several benchmark applications show that the performance of our approach is highly competitive in comparison with existing implementations.

LEGO-style cut-and-choose is known for its asymptotic efficiency in realizing actively-secure computations. The dominant cost of LEGO protocols is due to wire-soldering—the key technique enabling to put independently generated garbled gates together in a bucket to realize a logical gate. Existing wire-soldering constructions rely on homomorphic commitments and their security requires the majority of the garbled gates in every bucket to be correct. In this paper, we propose an efficient construction of LEGO protocols that does not use homomorphic commitments but is able to guarantee security as long as at least one of the garbled gate in each bucket is correct. Additionally, the faulty gate detection rate in our protocol doubles that of the state-of-the-art LEGO constructions. With moderate additional cost, our approach can even detect faulty gates with probability 1, which enables us to run cut- and-choose on larger circuit gadgets rather than individual AND gates. We have implemented our protocol and our experiments on several benchmark applications show that the performance of our approach is highly competitive in comparison with existing implementations.

Edit distance is an important non-linear metric that has many applications ranging from matching patient genomes to text-based intrusion detection. Depends on the application, related string-comparison metrics, such as weighted edit distance, Needleman-Wunsch distance, longest common subsequences, and heaviest common subsequences, can usually fit better than the basic edit distance. When these metrics need to be calculated on sensitive input strings supplied by mutually distrustful parties, it is more desirable but also more challenging to compute them in privacy-preserving ways. In this paper, we propose efficient secure computation protocols for private edit distance as well as several generalized applications including weighted edit distance (with potentially content-dependent weights), longest common subsequence, and heaviest common subsequence. Our protocols run 20+ times faster and use an order-of-magnitude less bandwidth than their best previous counterparts. Alongside, we propose a garbling scheme that allows free arithmetic addition, free multiplication with constants, and low-cost comparison/minimum for inputs of restricted relative-differences. Moreover, the encodings (i.e. wire-labels) in our garbling scheme can be converted from and to encodings used by traditional binary circuit garbling schemes with light to moderate costs. Therefore, while being extremely efficient on certain kinds of computations, the new garbling scheme remains composable and capable of handling generic computational tasks.

We consider novel integration of blockchain technology and several contemporary cryptographic protocols to strengthen the Healthcare IT infrastructure. The blockchain technology is distinguished by its two interweaving themes openness and decentralization. Its openness allows anyone in the world to contribute to its execution, hence shoveling the system’s operational cost to a swamp of well-motivated volunteering contributors. Meanwhile, its decentralized architecture alleviates many security and reliability issues that have been plaguing the trusted third party paradigm for a long time. These valuable properties would be well-suited for managing healthand medical-data with high security and reliability requirements. We will discuss a few representative applications in § 2. Patient care is witnessing the coming of its digital era: massive health data are collected routinely using wearable health devices and clinical records are also becoming electronic. Electronic health records (EHRs) come with many applications. For examples, it is much easier for clinical practitioners to learn the complete health history of a patient moving from one city to another or transferring between hospitals to another from the EHRs; it will also be convenient for physicians to devise proper, evidence-based therapeutic approach to specfic patients based on the EHRs of patients with the same diseases; finally, biomedical researchers may exploit EHRs to build predictive models for early diagnosis of diseases and to discover novel methods for effective disease treatment. Despite these obvious advantages, EHR data are still of limited use in practice, largely due to security and privacy concerns. In recent years, cryptogrpahic approaches have been used in biomedical informatics to enable privacy-preserving sharing and analysis of sensitive health data Naveed et al. [10]. But the blockchain technology has yet been considered for health applications. In this whitepaper, we lay out several scinarioes in that blockchain technology can be used alone or combined with other cryptogrpahic protocols to enhance the privacy protection when human health data are used. Secure Multiparty Computation. Secure multiparty computation enables a set of mutuallydistrustful parties to jointly compute any agreed-on target function over their private inputs. It is a prominent enabling-technique behind collaborative computing over encrypted data, promising many important applications such as privacy-preserving biometric identification and personal genome comparison (e.g., to match patients with donors). While the theoretical feasibility results of secure computation was discovered in the 1980s [4, 14], many theoretical [6, 7] as well as implementational [1, 5, 8, 12, 15] advancements have been made throughout the years. A state-of-the-art secure computation implementation can compute the edit distance between whole human-genomes