TY - GEN
T1 - Efficient batched oblivious PRF with applications to private set intersection
AU - Kolesnikov, Vladimir
AU - Kumaresan, Ranjit
AU - Rosulek, Mike
AU - Trieu, Ni
N1 - Publisher Copyright:
© 2016 ACM.
Copyright:
Copyright 2017 Elsevier B.V., All rights reserved.
PY - 2016/10/24
Y1 - 2016/10/24
N2 - We describe a lightweight protocol for oblivious evaluation of a pseudorandom function (OPRF) in the presence of semihonest adversaries. In an OPRF protocol a receiver has an input r; the sender gets output s and the receiver gets output F(s, r), where F is a pseudorandom function and s is a random seed. Our protocol uses a novel adaptation of 1-out-of-2 OT-extension protocols, and is particularly efficient when used to generate a large batch of OPRF instances. The cost to realize m OPRF instances is roughly the cost to realize 3.5m instances of standard 1-out-of-2 OTs (using state-of-the-art OT extension). We explore in detail our protocol's application to semihonest secure private set intersection (PSI). The fastest stateof-the-art PSI protocol (Pinkas et al., Usenix 2015) is based on efficient OT extension. We observe that our OPRF can be used to remove their PSI protocol's dependence on the bit-length of the parties' items. We implemented both PSI protocol variants and found ours to be 3.1-3.6× faster than Pinkas et al. for PSI of 128-bit strings and sufficiently large sets. Concretely, ours requires only 3.8 seconds to securely compute the intersection of 220-size sets, regardless of the bit length of the items. For very large sets, our protocol is only 4.3× slower than the insecure näive hashing approach for PSI.
AB - We describe a lightweight protocol for oblivious evaluation of a pseudorandom function (OPRF) in the presence of semihonest adversaries. In an OPRF protocol a receiver has an input r; the sender gets output s and the receiver gets output F(s, r), where F is a pseudorandom function and s is a random seed. Our protocol uses a novel adaptation of 1-out-of-2 OT-extension protocols, and is particularly efficient when used to generate a large batch of OPRF instances. The cost to realize m OPRF instances is roughly the cost to realize 3.5m instances of standard 1-out-of-2 OTs (using state-of-the-art OT extension). We explore in detail our protocol's application to semihonest secure private set intersection (PSI). The fastest stateof-the-art PSI protocol (Pinkas et al., Usenix 2015) is based on efficient OT extension. We observe that our OPRF can be used to remove their PSI protocol's dependence on the bit-length of the parties' items. We implemented both PSI protocol variants and found ours to be 3.1-3.6× faster than Pinkas et al. for PSI of 128-bit strings and sufficiently large sets. Concretely, ours requires only 3.8 seconds to securely compute the intersection of 220-size sets, regardless of the bit length of the items. For very large sets, our protocol is only 4.3× slower than the insecure näive hashing approach for PSI.
UR - http://www.scopus.com/inward/record.url?scp=84995387186&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84995387186&partnerID=8YFLogxK
U2 - 10.1145/2976749.2978381
DO - 10.1145/2976749.2978381
M3 - Conference contribution
AN - SCOPUS:84995387186
T3 - Proceedings of the ACM Conference on Computer and Communications Security
SP - 818
EP - 829
BT - CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security
PB - Association for Computing Machinery
T2 - 23rd ACM Conference on Computer and Communications Security, CCS 2016
Y2 - 24 October 2016 through 28 October 2016
ER -