Design of large scale applications of secure multiparty computation : secure linear programming Citation for published version (APA): Hoogh, de, S. J. A. (2012). Design of large scale applications of secure multiparty computation : secure linear programming. Technische Universiteit Eindhoven. https://doi.org/10.6100/IR735328 DOI: 10.6100/IR735328 Document status and date: Published: 01/01/2012 Document Version: Publisher’s PDF, also known as Version of Record (includes final page, issue and volume numbers) Please check the document version of this publication: • A submitted manuscript is the version of the article upon submission and before peer-review. There can be important differences between the submitted version and the official published version of record. People interested in the research are advised to contact the author for the final version of the publication, or visit the DOI to the publisher's website. • The final author version and the galley proof are versions of the publication after peer review. • The final published version features the final layout of the paper including the volume, issue and page numbers. Link to publication General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal. If the publication is distributed under the terms of Article 25fa of the Dutch Copyright Act, indicated by the “Taverne” license above, please follow below link for the End User Agreement: www.tue.nl/taverne Take down policy If you believe that this document breaches copyright please contact us at: [email protected] providing details and we will investigate your claim. Download date: 09. Oct. 2021 Design of Large Scale Applications of Secure Multiparty Computation: Secure Linear Programming CIP-DATA LIBRARY TECHNISCHE UNIVERSITEIT EINDHOVEN c 2012 by Sebastiaan de Hoogh. Design of Large Scale Applications of Secure Multiparty Computation: Secure Linear Pro- gramming / door Sebastiaan de Hoogh. { Eindhoven: Technische Universiteit Eindhoven, 2012. Proefschrift. { ISBN 978-90-386-3203-2 NUR 919 Subject headings: Cryptology, multiparty computation, cryptographic protocols, linear programming, algorithms. Printed by Printservice TU/e. Cover: Het Paleis. Design by Brigitte Gedike Design of Large Scale Applications of Secure Multiparty Computation: Secure Linear Programming PROEFSCHRIFT ter verkrijging van de graad van doctor aan de Technische Universiteit Eindhoven, op gezag van de rector magnificus, prof.dr.ir. C.J. van Duijn, voor een commissie aangewezen door het College voor Promoties in het openbaar te verdedigen op donderdag 30 augustus 2012 om 16.00 uur door Sebastiaan Jacobus Antonius de Hoogh geboren te Dongen Dit proefschrift is goedgekeurd door de promotor: prof.dr.ir. H.C.A. van Tilborg Copromotor: dr.ir. L.A.M. Schoenmakers A catalogue record is available from the Eindhoven University of Technology Library ISBN: 978-90-386-3203-2 Design of Large Scale Applications of Secure Multiparty Computation: Secure Linear Programming Summary Secure multiparty computation is a basic concept of growing interest in modern cryp- tography. It allows a set of mutually distrusting parties to perform a computation on their private information in such a way that as little as possible is revealed about each private input. The early results of multiparty computation have only theoretical significance since they are not able to solve computationally complex functions in a reasonable amount of time. Nowadays, efficiency of secure multiparty computation is an important topic of cryptographic research. As a case study we apply multiparty computation to solve the problem of secure lin- ear programming. The results enable, for example in the context of the EU-FP7 project SecureSCM, collaborative supply chain management. Collaborative supply chain manage- ment is about the optimization of the supply and demand configuration of a supply chain. In order to optimize the total benefit of the entire chain, parties should collaborate by pooling their sensitive data. With the focus on efficiency we design protocols that securely solve any linear program using the simplex algorithm. The simplex algorithm is well studied and there are many variants of the simplex algorithm providing a simple and efficient solution to solving linear programs in practice. However, the cryptographic layer on top of any variant of the simplex algorithm imposes restrictions and new complexity measures. For example, hiding the number of iterations of the simplex algorithm has the consequence that the secure implementations have a worst case number of iterations. Then, since the simplex algorithm has exponentially many iterations in the worst case, the secure implementations have exponentially many iterations in all cases. To give a basis for understanding the restrictions, we review the basic theory behind the simplex algorithm and we provide a set of cryptographic building blocks used to implement secure protocols evaluating basic variants of the simplex algorithm. We show how to balance between privacy and efficiency; some protocols reveal data about the internal state of the simplex algorithm, such as the number of iterations, in order to improve the expected running times. For the sake of simplicity and efficiency, the protocols are based on Shamir's secret sharing scheme. We combine and use the results from the literature on secure random number generation, secure circuit evaluation, secure comparison, and secret indexing to construct efficient building blocks for secure simplex. The solutions for secure linear programming in this thesis can be split into two categories. On the one hand, some protocols evaluate the classical variants of the simplex algorithm in which numbers are truncated, while the other protocols evaluate the variants of the simplex algorithms in which truncation is avoided. On the other hand, the protocols can be separated by the size of the tableaus. Theoretically there is no clear winner that has both the best security properties and the best performance. The rounding errors due to truncations may cause the simplex algorithm to become unstable leading to incorrect results. To securely determine correctness of the output of the protocols we show how to extract a certificate from the output and how to securely prove correctness of the result given this certificate. The protocols for extracting and verifying the certificates are, compared to protocols evaluating the simplex algorithm, very efficient. We extend and generalize the ideas of using certificates to build efficient universally verifiable protocols, i.e., protocols allowing anyone to check correctness of the output without revealing the private results. Examples of universally verifiable protocols are, typically, relatively expensive protocols in which every transmitted message is accompanied by a noninteractive zero-knowledge proof. If the protocol evaluates a function of which a certificate of correctness can be efficiently extracted, then the protocol will be universally verifiable if the validation of the certificate is universally verifiable. In addition to the case study on secure linear programming we discuss proofs of re- stricted shuffles. The scenario is as follows: given a list of encrypted data, some party permutes the list in such a way that nobody learns the permutation applied to the list. Then, the party proves in zero-knowledge that the resulting list consists of encryptions of the same list where the entries are permuted. The party proves in addition that the applied permutation satisfies some restrictions. We apply a result from the literature that provides zero-knowledge protocols for any permutation group represented as an automor- phism group of some graph. In order to instantiate the protocols we provide hypergraphs of which the automorphism group is represented by either a rotation, an affine transfor- mation, or a M¨obius transformation. Contents Summary v Contents vii 1 Introduction1 2 Cryptographic Primitives9 2.1 Basic Primitives . .9 2.1.1 Indistinguishability . 10 2.1.2 Secret Sharing . 10 2.1.3 Commitment Schemes . 13 2.2 Zero-Knowledge Proofs . 13 2.2.1 Σ-protocols . 14 2.2.2 Noninteractive zero-knowledge proofs . 18 2.3 Multiparty Computation Model . 20 2.3.1 Real Model . 20 2.3.2 Ideal Model . 21 2.3.3 Hybrid Model . 22 2.3.4 Multiparty Computation from Shamir Secret Sharing . 23 3 Linear Optimization 27 3.1 Linear Programming . 27 3.1.1 Simplex Algorithm . 29 3.1.2 Interior Point Methods . 35 3.1.3 Initial Feasible Solution . 38 3.1.4 Verification of the Result . 40 3.2 Implementations of the Simplex Iterations . 43 3.2.1 Large Tableau Simplex . 44 3.2.2 Small Tableau Simplex . 54 3.2.3 Revised Simplex . 55 3.3 Implementations of the Simplex Initializations . 58 3.3.1 Standard two-phase Simplex . 59 3.3.2 Two-Phase Simplex with One Artificial Variable . 67 3.3.3 Big-M Method . 69 vii viii Contents 4 Building Blocks for Secure Linear Programming 75 4.1 Statistical Security . 76 4.2 Efficient Primitives for Shamir Secret Sharing . 78 4.2.1 Encoding Signed Integers as Prime Field Elements . 78 4.2.2 Noninteractive Random Number Generation . 79 4.2.3 Efficient Arithmetic for Shamir Secret Sharing . 83 4.3 Arithmetic Circuits for Prefix and k-ary Operations . 86 4.3.1 Multiplication . 88 4.3.2 Prefix-Or . 90 4.3.3 Bitwise Comparison . 90 4.3.4 Bitwise Addition . 93 4.3.5 Bit Decomposition . 95 4.4 Integer Comparison . 96 4.4.1 Equality Tests . 96 4.4.2 Less Than Zero Tests . 98 4.5 Fixed Point Arithmetic .