TY - JOUR

T1 - The Communication Complexity of Private Simultaneous Messages, Revisited

AU - Applebaum, Benny

AU - Holenstein, Thomas

AU - Mishra, Manoj

AU - Shayevitz, Ofer

N1 - Publisher Copyright:
© 2019, International Association for Cryptologic Research.

PY - 2020/7/1

Y1 - 2020/7/1

N2 - Private simultaneous message (PSM) protocols were introduced by Feige, Kilian, and Naor (STOC ’94) as a minimal non-interactive model for information theoretic three-party secure computation. While it is known that every function f: { 0 , 1 } k× { 0 , 1 } k→ { 0 , 1 } admits a PSM protocol with exponential communication of 2 k/2 (Beimel et al., TCC ’14), the best known (non-explicit) lower-bound is 3 k- O(1) bits. To prove this lower-bound, FKN identified a set of simple requirements, showed that any function that satisfies these requirements is subject to the 3 k- O(1) lower-bound, and proved that a random function is likely to satisfy the requirements. We revisit the FKN lower-bound and prove the following results: (Counterexample) We construct a function that satisfies the FKN requirements but has a PSM protocol with communication of 2 k+ O(1) bits, revealing a gap in the FKN proof. (PSM lower-bounds) We show that by imposing additional requirements, the FKN argument can be fixed leading to a 3 k- O(log k) lower-bound for a random function. We also get a similar lower-bound for a function that can be computed by a polynomial-size circuit (or even polynomial-time Turing machine under standard complexity-theoretic assumptions). This yields the first non-trivial lower-bound for an explicit Boolean function partially resolving an open problem of Data, Prabhakaran, and Prabhakaran (Crypto ’14, IEEE Information Theory ’16). We further extend these results to the setting of imperfect PSM protocols which may have small correctness or privacy error. (CDS lower-bounds) We show that the original FKN argument applies (as is) to some weak form of PSM protocols which are strongly related to the setting of Conditional Disclosure of Secrets (CDS). This connection yields a simple combinatorial criterion for establishing linear Ω(k) -bit CDS lower-bounds. As a corollary, we settle the complexity of the inner-product predicate resolving an open problem of Gay, Kerenidis, and Wee (Crypto ’15).

AB - Private simultaneous message (PSM) protocols were introduced by Feige, Kilian, and Naor (STOC ’94) as a minimal non-interactive model for information theoretic three-party secure computation. While it is known that every function f: { 0 , 1 } k× { 0 , 1 } k→ { 0 , 1 } admits a PSM protocol with exponential communication of 2 k/2 (Beimel et al., TCC ’14), the best known (non-explicit) lower-bound is 3 k- O(1) bits. To prove this lower-bound, FKN identified a set of simple requirements, showed that any function that satisfies these requirements is subject to the 3 k- O(1) lower-bound, and proved that a random function is likely to satisfy the requirements. We revisit the FKN lower-bound and prove the following results: (Counterexample) We construct a function that satisfies the FKN requirements but has a PSM protocol with communication of 2 k+ O(1) bits, revealing a gap in the FKN proof. (PSM lower-bounds) We show that by imposing additional requirements, the FKN argument can be fixed leading to a 3 k- O(log k) lower-bound for a random function. We also get a similar lower-bound for a function that can be computed by a polynomial-size circuit (or even polynomial-time Turing machine under standard complexity-theoretic assumptions). This yields the first non-trivial lower-bound for an explicit Boolean function partially resolving an open problem of Data, Prabhakaran, and Prabhakaran (Crypto ’14, IEEE Information Theory ’16). We further extend these results to the setting of imperfect PSM protocols which may have small correctness or privacy error. (CDS lower-bounds) We show that the original FKN argument applies (as is) to some weak form of PSM protocols which are strongly related to the setting of Conditional Disclosure of Secrets (CDS). This connection yields a simple combinatorial criterion for establishing linear Ω(k) -bit CDS lower-bounds. As a corollary, we settle the complexity of the inner-product predicate resolving an open problem of Gay, Kerenidis, and Wee (Crypto ’15).

KW - Conditional disclosure of secrets

KW - Information theoretic security

KW - Private simultaneous messages

UR - http://www.scopus.com/inward/record.url?scp=85073832320&partnerID=8YFLogxK

U2 - 10.1007/s00145-019-09334-y

DO - 10.1007/s00145-019-09334-y

M3 - ???researchoutput.researchoutputtypes.contributiontojournal.article???

AN - SCOPUS:85073832320

SN - 0933-2790

VL - 33

SP - 917

EP - 953

JO - Journal of Cryptology

JF - Journal of Cryptology

IS - 3

ER -