Multi-Party Private Set Operations from Predicative Zero-Sharing

In this work, we answer the above question affirmatively. Our technical route is: First, defining a predicate formula representation for any set formulas; Second, presenting a composable primitive — predicative zero-sharing — and its composition technique; Then, instantiating predicative zero-sharing as a primitive tailored for MPSO — membership zero-sharing — with lightweight building blocks; Finally, constructing a framework based on oblivious transfer (OT) and symmetric-key operations in the standard semi-honest model, which fully realizes not only the MPSO functionality, but also the extended MPSO-card and circuit-MPSO functionalities. Our contributions can be detailed as follows:

• Predicate Formula Representation. The first challenge in realizing MPSO is to identify a suitable representation for any set formulas, which determines the generality and practicality of the resulting framework. The prior work [36] represents set formulas using intersection, union, and element reduction operations, whose arbitrary compositions can only express a limited subset of set formulas, thereby restricting its generality. The follow-up work [10] adopts the naive representation based on intersection, union, and difference operations to achieve full generality. However, to support composability, it relies heavily on generic MPC, which significantly hinders practicality. In this work, we introduce a new representation called canonical predicate formula (CPF), which is designed with a particular structure to enable an MPSO framework achieving the best of both worlds: generality and practicality. Specifically, this representation is a subset of first-order set predicate formulas (which are first-order predicate formulas where each atomic proposition is a set membership predicate $x\in X_{i}$, connected by $\mathsf{AND}$, $\mathsf{OR}$ and $\mathsf{NOT}$ operators), defined as a disjunction of several subformulas that are in a certain form, representing a partition of the desired set. We prove that any set formulas can be transformed into CPF representations, and the number of subformulas in CPF dominates the performance of protocols.

• Predicative Zero-Sharing and Relaxation. The second challenge is to devise a composable primitive based on our predicate formula representation. We introduce a novel primitive called predicative zero-sharing, which is a family of protocols, each associated with a first-order predicate formula and encoding the truth-value of the formula on the parties’ inputs into a secret-sharing over a finite field among the parties. Specifically, if the formula is true, the parties hold a secret-sharing of 0, otherwise a secret sharing of a random value. We put forward a simpler simulation-based security definition for predicative zero-sharing protocols, which is composed of three requirements: correctness, privacy and independence, and give a rigorous proof of its equivalence to the standard security definition for a broader class of MPC protocols (predicative zero-sharing is its subset). This simpler security definition simplifies the security proof of our predicative zero-sharing protocols. Moreover, under this simpler security definition, we can relax the security of predicative zero-sharing by removing the independence requirement. This relaxed version of predicative zero-sharing admits the abstraction of much more MPC protocols, such as random oblivious transfer (ROT), equality-conditional randomness generation (ECRG) [35],¹¹1We found that the ECRG functionality satisfies the definition of predicative zero-sharing while the construction in [35] only achieves the security of relaxed predicative zero-sharing. This is because ECRG is a probabilistic functionality whereas [35] proved its security using the definition for deterministic functionalities. and so on. We present a composition technique to compose several relaxed predicative zero-sharing protocols into a single relaxed predicative zero-sharing protocol based on $\mathsf{AND}$ and $\mathsf{OR}$ operators. We also present a transformation technique to transform any relaxed predicative zero-sharing protocol into a standard version. Combining these two techniques, we can construct predicative zero-sharing for any first-order predicate formulas, from relaxed predicative zero-sharing associated with all literals (atomic propositions or their negations) within the formula.

• Membership Zero-Sharing. To enable the instantiation of predicative zero-sharing, we introduce membership zero-sharing, a particular class of predicative zero-sharing tailored for MPSO, by specifying the associated predicate formula as a first-order set predicate formula $Q$. In this setting, one party (denoted as $P_{\mathsf{pivot}}$) inputs an element and the other parties input sets. The output secret-sharing among the parties encodes whether $P_{\mathsf{pivot}}$’s input element, together with all input sets, satisfy $Q$. For example, consider $3$ parties where $P_{1}$ inputs an element $x$, $P_{2}$ inputs a set $X_{2}$, and $P_{3}$ inputs a set $X_{3}$. Suppose $Q$ is in the form of $x\in X_{2}\land x\notin X_{3}$, if $x\in X_{2}\setminus X_{3}$, $P_{1},P_{2},P_{3}$ hold a secret-sharing of 0, otherwise they hold a secret-sharing of a random value. Given that any first-order set predicate formula $Q$ is only composed of two types of literals — set membership predicates $x\in Y$ and the negations $x\notin Y$, by instantiating relaxed membership zero-sharing associated with $x\in Y$ and $x\notin Y$ respectively, we can build membership zero-sharing protocols for any first-order set predicate formulas, by following the recipe for predicative zero-sharing. Our instantiations are both built on lightweight components, including oblivious programmable pseudorandom function (OPPRF), batch secret-shared private membership test (batch ssPMT), and ROT. This contributes to the good efficiency of our framework.

• MPSO, MPSO-card and Circuit-MPSO. In analogy with MPSI (resp. MPSU) functionality to MPSI-card and circuit-MPSI (resp. MPSU-card and circuit-MPSU), we extend MPSO functionality into two new functionalities — MPSO-card and circuit-MPSO, where MPSO-card computes the resulting set’s cardinality and circuit-MPSO reveals secret shares of the resulting set, which can be further fed into generic MPC to compute arbitrary function on the resulting set. Based on the CPF representation for any set formulas and membership zero-sharing for any first-order set predicate formulas, we put forth a framework fully realizing MPSO, MPSO-card and circuit-MPSO functionalities. A high level of our framework proceeds as follows. We begin with the simplest case, where the desired set is a subset of the input set of the leader.²²2MPSI is a typical example of this case, as the intersection is a subset of any input sets. In this case, the leader acts as $P_{\mathsf{pivot}}$, and for each element in its input set, the leader invokes the membership zero-sharing associated with the CPF representation of the desired set, with the other parties inputting their sets. As a result, for each elements in the leader’s set that belongs to the desired set, the parties hold a secret-sharing of 0. Since all these elements exactly compose the desired set, the partiescan simply reconstruct all secret-sharings to the leader, who computes the resulting set by identifying all elements with corresponding secrets as 0. This construction can be optimized using the hashing to bins technique (see Figure). We extend this simplest case of our framework to achieve full MPSO functionality, by leveraging the structural properties of our CPF representation, which guarantee that the set represented by each subformula $Q_{i}$ in the CPF is a subset of some party $P_{j}$’s input set, and all these sets form a partition of the desired set. For each subformula $Q_{i}$, the parties invoke membership zero-sharing with $P_{j}$ acting as $P_{\mathsf{pivot}}$, and the invocation is similar to the simplest case. After the membership zero-sharing invocations for all subformulas, the union of all output secret-sharings encode a partition of the desired set. However, a straightforward reconstruction in this setting may reveal information through the order of secret-sharings, therefore, the parties have to invoke a multi-party secret-shared shuffle protocol to randomly permute and re-share all secret-sharings. Finally, the shuffled secret-sharings are reconstructed to the leader. Since the resulting set remains being secret-shared before the last reconstruction step, this MPSO protocol is easy to be extended to MPSO-card and circuit-MPSO protocols.

In addition to the above contributions, perhaps surprisingly, we also make independent contributions in the following sub-fields, by instantiating our framework to yield the aforementioned typical protocols:

• MPSI. The MPSI protocol from our framework has the best computation and communication complexity among all MPSI protocols based on OT and symmetric-key operations in the standard semi-honest model. Particularly, this is the first MPSI construction to achieve the optimal complexity that is on par with the naive solution (the leader’s computation and communication complexity are both $O(mn)$ and each client’s computation and communication complexity are both $O(n)$, where $n$ is the set size and $m$ is the number of parties) without extensive use of public-key operations, in standard semi-honest model. The previous MPSI protocol [38] with this optimal complexity is only secure in the weaker augmented semi-honest model. In this work, we close this gap. Our MPSI protocol is also highly efficient in the online phase, which requires only $8.9$ seconds and $738$ MB of communications for $10$ parties with sets of $2^{20}$ items each, regardless of the item length, while the state-of-the-art MPSI protocol [58] requires $32.9$ seconds and $1921$ MB of communications for their full protocol.

• MPSI-card, MPSI-card-sum and Circuit-MPSI. The MPSI-card and MPSI-card-sum protocols from our framework are the first MPSI-card and MPSI-card-sum constructions with the optimal computation and communication complexity in the standard semi-honest model. Our MPSI-card has $14.0-20.3\times$ lower communication than the state-of-the-art MPSI-card protocol [18]. We provide the first MPSI-card-sum implementation and it only doubles the computation and communication costs of our MPSI while realizing a richer functionality. Concretely, our MPSI-card requires only $9.2$ seconds while our MPSI-card-sum requires $16.7$ seconds in online phase for $10$ parties with sets of $2^{20}$ items each, regardless of the item length. Additionally, the circuit-MPSI protocol from our framework is the first circuit-MPSI construction in dishonest majority setting.

• MPSU. The MPSU protocol from our framework has the best computation and communication complexity among all MPSU protocols based on OT and symmetric-key operations in the standard semi-honest model. It could be seen as an instance of the secret-sharing based MPSU paradigm, which abstracts all existing MPSU protocols relying only on symmetric-key primitives [40, 19]. Our protocol achieves the optimal complexity of this paradigm for the first time (with $O(m^{2}n)$ computation and communication complexity of leader and $O(mn)$ computation and communication complexity of clients). Our MPSU protocol is comparable with the state-of-the-art MPSU protocol [19]. Concretely, it requires only $13.2$ seconds in online phase for $5$ parties, each holding $2^{20}$ items of $64$ bits.

• MPSU-card and circuit-MPSU. The MPSU-card and circuit-MPSU protocols from our framework are the only efficient constructions for MPSU-card and circuit-MPSU, with performance that is nearly the same as our MPSU protocol.

Despite the immense amount of existing works on the typical functionalities in this field, many are insecure against arbitrary collusion [39, 10, 55, 15, 40, 60, 25, 56], or have non-negligible false positives [6, 57]. We only focus on works achieving semi-honest security against arbitrary collusion without non-negligible false positives. Distribution of research attention among these works is extremely imbalanced: MPSI has been extensively studied [22, 36, 54, 53, 32, 38, 34, 27, 26, 41, 30, 8, 58], while MPSU only receives relatively little attention [36, 23, 24, 19]. MPSI-card [36, 18, 28] and MPSI-card-sum [18, 28] are extremely understudied sub-fields, with only a couple of secure MPSI-card protocol [36, 18, 28] and MPSI-card-sum protocol [18, 28] against arbitrary collusion. Even worse, no prior work has realized circuit-MPSI, MPSU-card, circuit-MPSU in the dishonest majority setting. We provide more details on the classic and state-of-the-art protocols below. A comprehensive theoretical comparison between related protocols and ours is provided in Appendix 0.A.

• MPSI. Freedman et al. [22] introduced the first MPSI protocol based on oblivious polynomial evaluation (OPE), which is implemented using AHE. Kisser and Song [36] proposed an MPSI protocol using the OPE technique along with the polynomial representations. These two protocols both require quadratic computation complexity with respect to the set size $n$ for each party, resulting in complete impracticality.

  Kolesnikov et al. [38] proposed two MPSI protocols in the augmented semi-honest model and standard semi-honest model, respectively. The former achieves the optimal complexity of MPSI, while it is only secure in the augmented semi-honest model. The latter fails to achieve optimal complexity as it requires the clients’ complexity to depend on the corruption threshold $t$. Garimella et al. [26] improved these protocols using oblivious key-value store (OKVS) [43, 26, 48, 9] and showed that the augmented semi-honest protocol actually enjoys malicious security. Following these works, Nevo et al. [41] proposed an efficient MPSI protocol in the malicious model, where the client’s communication complexity depends only on $n$ (while the computation complexity still depends on $t$).

  Inbar et al. [34] proposed two MPSI protocols in the augmented semi-honest and standard semi-honest model, based on OT and garbled Bloom filters. In these two protocols, each party’s computation complexity is $O(mn)$. The Ben-Efraim et al. [8] extended the former to the malicious model.

  Recently, Wu et al. [58] proposed two semi-honest MPSI protocols based on OPRF and OKVS. In these two protocols, the client’s complexity depends on $t$.

Let $m$ denote the number of parties. We use $P_{i}$ ($1\leq i\leq m$) to denote the parties, $X_{i}$ to represent the sets they hold, where each set has $n$ $l$-bit elements. $[x]=(x_{1},\cdots,x_{m})$ denotes an additive secret-sharing among $m$ parties, i.e., each $P_{i}$ holds a share $x_{i}$ such that $x_{1}+\cdots x_{m}=x$. $x\|y$ denotes the concatenation of two strings. We use $\lambda,\sigma$ as the computational and statistical security parameters respectively, and use $\overset{s}{\approx}$ (resp.$\overset{c}{\approx}$) to denote that two distributions are statistically (resp. computationally) indistinguishable. For a vector a, $a_{i}$ denotes the $i$-th component, $\mathsf{HW}(\textbf{a})$ denotes the hamming weight of a, $\mathsf{zero}(\textbf{a})$ denotes the number of 0 in a, and $\pi(\textbf{a})=(a_{\pi(1)},\cdots,a_{\pi(n)})$, where $\pi$ is a permutation over $n$ items. The notation $\textbf{a}\oplus\textbf{b}$ denotes a component-wise XOR, i.e., $(a_{1}\oplus b_{1},\cdots,a_{n}\oplus b_{n})$.

In this work, we consider semi-honest and static adversaries $\mathcal{A}$ with the capability to corrupt an arbitrary subset of parties. To capture the security of a protocol in the simulation-based model [29, 14], we use the following notations:

• •

  Let $f=(f_{1},\cdots,f_{m})$ be a probabilistic polynomial-time $m$-ary functionality and let $\Pi$ be a $m$-party protocol for computing $f$.

• •

  The view of $P_{i}$ ($1\leq i\leq m$) during an execution of $\Pi$ on all parties’ inputs $\textbf{x}=(x_{1},\cdots,x_{m})$ is denoted by $\mathsf{View}_{i}^{\Pi}(\textbf{x})$, including the $i$-th party’s input $x_{i}$, its internal random tape and all messages that it received.

• •

  The output of $P_{i}$ during an execution of $\Pi$ on x is denoted by $\mathsf{Output}_{i}^{\Pi}(\textbf{x})$. The joint output of parties is $\mathsf{Output}^{\Pi}(\textbf{x})=(\mathsf{Output}_{1}^{\Pi}(\textbf{x}),\cdots,\mathsf{Output}_{m}^{\Pi}(\textbf{x})).$

where $\textbf{x}_{\mathcal{A}}=(x_{i_{1}},\cdots,x_{i_{t}}),f_{\mathcal{A}}=(f_{i_{1}},\cdots,f_{i_{t}}),\mathsf{View}_{\mathcal{A}}^{\Pi}(\textbf{x})=(\mathsf{View}_{i_{1}}^{\Pi}(\textbf{x}),\cdots,\mathsf{View}_{i_{t}}^{\Pi}(\textbf{x}))$.

MPSO is a special case of secure multi-party computation (MPC). Figure 1 formally defines the typical ideal functionalities computing the intersection, intersection cardinality, intersection sum with cardinality, union, and union cardinality over the parties’ private sets.

Oblivious transfer (OT) [47] is a foundational primitive in MPC, the functionality of 1-out-of-2 random OT (ROT) is given in Figure 2.

Oblivious pseudorandom function (OPRF) [21, 17, 51] is a central primitive in the area of PSO. Kolesnikov et al. [37] introduced batched OPRF, which provides a batch of OPRF instances. In the $i$-th instance, the sender $\mathcal{S}$ learns a PRF key $k_{i}$, while the receiver $\mathcal{R}$ inputs $x_{i}$ and learns $\mathsf{PRF}(k_{i},x_{i})$.

Oblivious programmable pseudorandom function (OPPRF) [38, 45, 16, 51, 48] is an extension of OPRF, which lets $\mathcal{S}$ program a PRF $F$ so that it has specific uniform outputs for some specific inputs and pseudorandom outputs for all other inputs. This kind of PRF that outputs programmed values on a certain programmed set of inputs is called programmable PRF (PPRF) [45]. $\mathcal{R}$ evaluates OPPRF with no knowledge of whether it learns a programmed output of $F$ or just a pseudorandom value. The batch OPPRF functionality is given in Figure 3.

Batch secret-shared private membership test (batch ssPMT) [19] is a two-party protocol that implements multiple instances of ssPMT[16, 40] between a sender $\mathcal{S}$ and a receiver $\mathcal{R}$. Given a batch size of $B$, $\mathcal{S}$ inputs $B$ sets $X_{1},\cdots,X_{B}$, while $\mathcal{R}$ inputs $B$ elements $x_{1},\cdots,x_{B}$. As a result, $\mathcal{S}$ and $\mathcal{R}$ receive secret shares of a bit vector of size $B$, where the $i$-th bit is 1 if $x_{i}\in X_{i}$, 0 otherwise. The batch ssPMT functionality is given in Figure 4. Dong et al. [19] proposed an efficient construction with linear complexities, based on batch OPPRF and secret-shared private equality test (ssPEQT) [45, 16].

Multi-party secret-shared shuffle functionality works by randomly permuting the share vectors of all parties and then refreshing all shares, ensuring that the permutation remains unknown to any coalition of $m-1$ parties. The formal functionality is given in Figure 5. Eskandarian et al. [20] proposed an online-efficient protocol where the parties generate share correlations in the offline phase, so that the leader’s online complexity scales linearly with $n$ and $m$, while the clients’ online complexity scales linearly with $n$ and is independent of $m$.

The hashing to bins technique was introduced by Pinkas et al. [46, 44] to construct two-party PSI. At a high level, the receiver $\mathcal{R}$ uses hash functions $h_{1},h_{2},h_{3}$ to assign its items to $B$ bins via Cuckoo hashing [42], so that each bin has at most one item.³³3The Cuckoo hashing process uses eviction and the choice of bins for each item depends on the entire set. On the other hand, the sender $\mathcal{S}$ assigns each of its items $x$ to all bins $h_{1}(x),h_{2}(x),h_{3}(x)$ via simple hashing. This guarantees that for each item $x$ of $\mathcal{R}$, if $x$ is mapped into the $b$-th bin of Cuckoo hash table ($b\in\{h_{1}(x),h_{2}(x),h_{3}(x)\}$), and $x$ is in $\mathcal{S}$’s set, then the $b$-th of simple hash table certainly contains $x$.

We denote simple hashing with the following notation:

This expression represents hashing the items of $X$ into $B$ bins using simple hashing with hash functions $h_{1},h_{2},h_{3}:\{0,1\}^{*}\to[B]$. The output is a hash table denoted by $\mathcal{T}^{1},\cdots,\mathcal{T}^{B}$, where for each $x\in X$, $\mathcal{T}^{h_{i}(x)}\supseteq\{x\|i|i=1,2,3\}$.⁴⁴4Appending the index of the hash function is helpful for dealing with edge cases like $h_{1}(x)=h_{2}(x)=i$, which happen with non-negligible probability.

We denote Cuckoo hashing with the following notation:

This expression represents hashing the items of $X$ into $B$ bins using Cuckoo hashing with hash functions $h_{1},h_{2},h_{3}:\{0,1\}^{*}\to[B]$. The output is a Cuckoo hash table denoted by $\mathcal{C}^{1},\cdots,\mathcal{C}^{B}$, where for each $x\in X$ there is some $i\in\{1,2,3\}$ such that $\mathcal{C}^{h_{i}(x)}=\{x\|i\}$. Some Cuckoo hash positions are irrelevant, corresponding to empty bins. We use these symbols throughout subsequent sections.

We formalize the notion of the resulting sets that can be derived from any set formulas being computed over the parties’ private sets in the context of MPSO. We refer to these resulting sets as constructible sets.

In particular, if a constructible set $Y$ satisfies $Y\subseteq X_{i}$ for some $1\leq i\leq m$, we call it an $X_{i}$-constructible set (over $X_{1},\cdots,X_{m}$).

Any constructible set can be represented by a set predicate formula. This corresponding relationship is formalized in the following theorem.

We prove this theorem in Appendix 0.B.

We prove this theorem by showing how to construct $\psi$ in Appendix 0.C.

In order to illustrate Theorem 3.2, consider three constructible sets in the three-party setting: the intersection $Y=X_{1}\cap X_{2}\cap X_{3}$, the union $Y=X_{1}\cup X_{2}\cup X_{3}$ and a complex set formula $Y=((X_{1}\cap X_{2})\cup(X_{1}\cap X_{3}))\setminus(X_{1}\cap X_{2}\cap X_{3})$. We provide the respective CPF representation $\psi(x,X_{1},X_{2},X_{3})$ for each case below.

• Intersection. $\psi(x,X_{1},X_{2},X_{3})=(x\in X_{1})\land(x\in X_{2})\land(x\in X_{3})$. In this case, $\psi$ is a disjunction of one subformula $Q_{1}=\psi$, corresponding to the set $Y_{1}=Y$. $Q_{1}$ is set-separable with respect to $X_{1}$, $X_{2}$ and $X_{3}$. $Y_{1}$ itself is a partition of $Y$.

• Union. $\psi(x,X_{1},X_{2},X_{3})=(x\in X_{1})\lor((x\notin X_{1})\land(x\in X_{2}))\lor((x\notin X_{1})\land(x\notin X_{2})\land(x\in X_{3}))$. $\psi$ is a disjunction of three subformulas $Q_{1},Q_{2},Q_{3}$, where each $Q_{i}=(x\notin X_{1})\land\cdots\land(x\notin X_{i-1})\land(x\in X_{i})$ represents $Y_{i}=X_{i}\setminus(X_{1}\cup\cdots\cup X_{i-1})$. $Q_{i}$ is set-separable with respect to $X_{i}$. $\{Y_{1},Y_{2},Y_{3}\}$ is a partition of $Y$.

• Complex set formula. There are two CPF representations for this case:

  • –

    $\psi(x,X_{1},X_{2},X_{3})=((x\in X_{1})\land(x\in X_{2})\land(x\notin X_{3}))\lor((x\in X_{1})\land(x\in X_{3})\land(x\notin X_{2}))$. $\psi$ is a disjunction of two subformulas $Q_{1},Q_{2}$ with the corresponding sets $Y_{1}=X_{1}\cap X_{2}\setminus X_{3}$ and $Y_{2}=X_{1}\cap X_{3}\setminus X_{2}$. $Q_{1}$ is set-separable with respect to $X_{1}$ and $X_{2}$, while $Q_{2}$ is set-separable with respect to $X_{1}$ and $X_{3}$. $\{Y_{1},Y_{2}\}$ is a partition of $Y$.

  • –

    $\psi(x,X_{1},X_{2},X_{3})=(x\in X_{1})\land[((x\in X_{2})\land(x\notin X_{3}))\lor((x\in X_{3})\land(x\notin X_{2}))]$. $\psi$ is set-separable with respect to $X_{1}$, so it is a disjunction of one subformula $Q_{1}=\psi$, which obviously satisfies the definition of CPF representation.