Quorums Quicken Queries: Efficient Asynchronous Secure Multiparty Computation

Recent years have seen a renaissance in secure multiparty computation (MPC), but unfortunately, the distributed computing community is in danger of missing out. In particular, while new MPC algorithms boast dramatic improvements in latency and communication costs, none of these algorithms offer significant improvements in the highly distributed case, where the number of players is large.

This is unfortunate, since MPC holds the promise of addressing many important problems in distributed computing. How can peers in Bittorrent auction off resources without hiring an auctioneer? How can we design a decentralized Twitter that enables provably anonymous broadcast of messages. How can we create deep learning algorithms over data spread among large clusters of machines?

In this paper, we take a first step towards solving MPC for large distributed systems. We describe algorithms that require each player to send a number of messages and perform an amount of computation that is $\tilde{O}(\frac{m}{n}+\sqrt{n})$, where $n$ is the number of players and $m$ is the number of gates in the circuit to be computed. This significantly improves over current algorithms, which require each player to both send a number of messages and perform computation that is $\Omega(nm)$. We now describe our model and problem.

We assume a Byzantine adversary controls an unknown subset of up to $t$ of the players. These players are bad (i.e. Byzantine) and the remaining players are good. The good players run our algorithm, but the bad players may deviate in an arbitrary manner. Our adversary is static, i.e. it must select the set of bad players at the start of our algorithm. The adversary is computationally unbounded. Thus, we make no cryptographic hardness assumptions.

In the asynchronous setting, the problem is challenging even with a trusted third party. In particular, the trusted party can not determine the difference between a message never being sent and a message being arbitrarily delayed, and so the $t$ bad players can always refrain from sending any messages to the trusted party. Thus, the trusted party must wait to receive $n-t$ inputs. Then it must compute the function $f$ using default values for the missing inputs, and send the output back to the players as well as the number of received inputs.¹¹1We send back only the number of inputs used, not the set of players whose inputs are used. This is required to ensure scalability; see Section 6. The goal of an asynchronous MPC protocol is to simulate the above scenario, without the trusted third party.

The function to be computed is presented as a circuit $C$ with $m$ gates. For convenience of presentation, we assume each gate has fan-in two and fan-out at most two. For any two gates $x$ and $y$ in $C$, if the output of $x$ is input to $y$, we say that $x$ is a child of $y$ and that $y$ is a parent of $x$. We also assume that all computations in the circuit occur over a finite field $\mathbb{F}$; The size of $\mathbb{F}$ depends on the specific function to be computed but must always be $\Omega(\log{n})$. All the inputs, outputs and messages sent during the protocol are elements of $\mathbb{F}$, and consequently, messages will be of size $\log|\mathbb{F}|$.

The study of secure computation started in 1982 with the seminal work of Yao [27]. Later Goldrich, Micali, and Wigderson [20] proposed the first generic scheme for solving a cryptographic notion of MPC. This work was followed by some unconditionally-secure schemes in late 1980s [6, 10, 26, 5, 21, 22, 4]. Unfortunately, these methods all have poor communication scalability that prevents their wide-spread use. In particular, if there are $n$ players involved in the computation and the function $f$ is represented by a circuit with $m$ gates, then these algorithms require each player to send a number of messages and perform a number of computations that is $\Omega(mn)$ (see [18, 19, 17]).

Recent years have seen exciting improvements in the cost of MPC when $m$ is much larger than $n$ [12, 14, 13]. For example, the computation and communication cost for the algorithm described by Damgård et al. in  [13] is $\tilde{O}(m)$ plus a polynomial in $n$. However, the additive polynomial in $n$ is large (e.g. $\Omega(n^{6})$) and so these new algorithms are only efficient for relatively small $n$. Thus, there is still a need for MPC algorithms that are efficient in both $n$ and $m$.

We first introduced the notion of using quorums for local communication to decrease the message cost in a brief announcement [15]. In that paper, we described a synchronous protocol with bit complexity of $\tilde{O}(\frac{m}{n}+\sqrt{n})$ per player that can tolerate a computationally unbounded adversary who controls up to $(\frac{1}{4}-\epsilon)$ fraction of the players for any fixed positive $\epsilon$. This paper improves our previous result by handling asynchronous communication. One important challenge in the asynchronous communication model is to ensure that at least $n-t$ inputs are committed to, before the circuit evaluation. To address this issue we introduce and solve the threshold counting problem.

Boyle, Goldwasser, and Tessaro [8] describe a synchronous cryptographic protocol to solve MPC problem that is also based on quorums. Their algorithm uses a fully homomorphic encryption (FHE) scheme and thus, tolerates a computationally-bounded adversary that can take control of up to ($\frac{1}{3}-\epsilon$) fraction of players for any fixed positive $\epsilon$. Their protocol requires each player to send $\operatorname{polylog}(n)$ messages of size $\tilde{O}(n)$ bits and requires $\operatorname{polylog}(n)$ rounds. Interestingly the cost of the protocol is independent of the circuit size.

We say an event occurs with high probability (w.h.p), if it occurs with probability at least $1-1/n^{c}$, for some $c>0$ and sufficiently large $n$. We assume all computations occur over a finite field $\mathbb{F}$. Every time we use a mask during the protocol, we assume the mask is a value chosen uniformly at random from $\mathbb{F}$.

We now describe protocols that we use as building blocks in this paper.

We briefly sketch the ideas behind our three results.

The players in each gate gadget run Hw-MPC among themselves to perform the gate operation. To make sure the computation is correct and secure, each gate gadget maintains the invariant that the value computed by the gadget is the value that the corresponding gate in the original circuit would compute, masked by a uniformly random element of the field. This random number is not known to any individual player. Instead, shares of it are held by the members of the output quorum. Thus, the output quorum can participate as an input quorum for the evaluation of any parent gate and provide the masked version of the inputs and shares of the mask.

This gate gadget computation is continued in the same way for all gates of the circuit until the final output of whole circuit is evaluated. This technique for evaluating a gate of the circuit using quorums, is illustrated in Figure 5.2 and the details are described in Section 5.1.

To give intuition, we first consider a naive approach for counting in asynchronous model. Assume a complete binary tree where each player sends its input to a unique leaf node when it is set to $1$. Then, for every node $v$, each child of $v$ sends $v$ a message showing the number of inputs it has received so far and it sends the updated message every time this number changes. The problem with this approach is that it is not load-balanced: each node at depth $i$ has $\frac{n}{2^{i}}$ descendants in the tree, and therefore, in the worst case, sends and receives $\frac{n}{2^{i}}$ messages. Thus, a child of the root sends $n/2$ messages to the root and receives the same number of messages from its children. To solve the load-balancing problem, we use a randomized approach which ensures w.h.p. that each leaf of the data structure receives at least $7\log n$ messages and does not communicate with its parent until it has done so. Subsequnt messages it receives are not forwarded to its parent but rather to other randomly chosen leaves to ensure a close to uniform distribution of the messages. The details of our algorithm are described in Section 5.1 and more formally in Algorithm 2. Theorem 1.2 describes the resource complexity of the algorithm.

Our algorithm makes use of a circuit graph, $G$, which is based on the circuit $C$ that computes $f$. We assume the gates of the circuit $C$ are numbered $1,2,\dots,m$, where the gate numbered 1 is the output gate. The circuit graph is a directed acyclic graph over $m+n$ nodes. There are $n$ of these nodes, one per player, that we call input nodes. There are $m$ remaining nodes, one per gate, that we call gate nodes. For every pair of gate nodes $x$ and $y$, there is an edge from $x$ to $y$ iff the output of the gate represented by node $x$ is an input to the gate represented by node $y$. Also, for any input node $z$ and gate node $y$, there is an edge from $z$ to $y$ if the player represented by gate node $z$ has an input that feeds into the gate represented by node $y$. Similar to our definition in $C$, for any two nodes $x$ and $y$ in $G$, if $x$ has an edge to $y$, we say that $x$ is a child of $y$ and that $y$ is a parent of $x$. Also, for a given node $v$, we will say the height of $v$ is the number of edges on the longest path from $v$ to any input node in $G$. For each node in $G$, we define the following variables. $Q_{v}$ is the quorum associated with node $v$. $y_{v}$ is the output of the gate corresponding to $v$. Finally, $r_{v}$ is a random mask and $\hat{y}_{v}$ is the masked output associated with node $v$, i.e.  $\hat{y}_{v}=y_{v}+r_{v}$.

We number the nodes of $G$ canonically in such a way that the input node numbered $i$ corresponds to player $p_{i}$. We refer to the node corresponding to the output gate as the output node.

Algorithm 1 consists of four parts. The first part is to run Create-Quorum in order to agree on $n$ good quorums. The second part of the algorithm is Input-Commitment in which, quorums form the count tree. Then, each player $p_{i}$ commits its input values to quorum $i$ at the leaf nodes of the count tree and finally the players in that quorum decide whether these values are part of the computation or not. The details of this part of the algorithm is described in Section 5.1. The third part of the algorithm is evaluation of the circuit, described in detail in Section 5.2). Finally, the output from the circuit evaluation is sent back to all the players by quorums arranged in a complete binary tree.

As described in the introduction, the goal of MPC is to simulate a trusted third party in computation of the circuit and then send back the computation result to the players. Let $S$ denote the set of players from whom input is received by the (simulated) trusted party. Recall that $|S|\geq n-t$.³³3We allow $|S|>n-t$ because the adversary is not limited to delivering one message at a time; two or more messages may be received simultaneously. Thus, for an arbitrary $S$ a description of $S$ requires $\Omega(n)$ bits, and cannot be sent back to the players using only a scalable amount of communication. Therefore, we relax the standard requirement that $S$ be sent back to the players. Instead, we require that at the end of the protocol each good player learns the output of $f$; whether or not their own input was included in $S$; and the size of $S$.

Also note that although we have not explicitly included this in Input-Commitment, it is very easy for the players to compute the size of the computation set $S$. Once each input quorum $Q_{i}$ has performed the 5/8-Majority step and agreed on the bit $b_{i}=\mathbf{1}_{i\in S}$ they can simply use an addition circuit to add these bits together and then disperse the result. This is an MPC, all of whose inputs are held by good players, since each input bit $b_{i}$ is jointly held by the entire quorum $Q_{i}$ and all the quorums are good. Thus the computation can afford to wait for all $n$ inputs and computes the correct sum.

In the protocol proposed in this paper, it may be the case that a player $p$ participates more than one time in the quorums performing a single instance of Hw-MPC. In such a case, we allow $p$ to play the role of more than one different players in the MPC, one for each quorum to which $p$ belongs. This ensures that the fraction of bad players in any instance of Hw-MPC is always less than $1/4$. Hw-MPC maintains privacy guarantees even in the face of gossiping coalitions of constant size. Thus, player $p$ will learn no information beyond the output and its own inputs after running this protocol.

We have described a Monte Carlo algorithm to perform asynchronous secure multiparty computation in an scalable manner. Our algorithms are scalable in the sense that they require each player to send $\tilde{O}(\frac{m}{n}+\sqrt{n})$ messages and perform $\tilde{O}(\frac{m}{n}+\sqrt{n})$ computations. They tolerate a static adversary that controls up to a $\frac{1}{8}-\epsilon$ fraction of the players, for $\epsilon$ any positive constant.

Many problems remain open including the following. Can we prove lower bounds for the communication and computation costs for Monte Carlo MPC? Can we implement and adapt our algorithm to make it practical for a MPC problem such as the beet auction problem described in [7]. Finally, can we prove upper and lower bounds for resource costs to solve MPC in the case where the adversary is dynamic, able to take over players at any point during the algorithm?

This work was supported by the NSF under grants CCR-0313160 and CAREER Award 0644058. We are grateful to Tom Hayes, Mahdi Zamani and the anonymous reviewers for useful suggestions and comments.