missing notes

Author: ianhajra

lectures/2026/2026-03-18.tex

@@ -0,0 +1,119 @@
+%!TEX root = ../notes.tex
+\section{March 18, 2026}
+\label{20260318}
+
+\subsection{Hardware Secure Module (HSM)}
+
+In Intel SGX, you can do arbitrary computations. However, HSM can only do restricted computations, for example, encryption/decryption. Alice can have an HSM that encrypts a message and she sends the encryption to Bob who has an HSM to decrypt the message. Another example is an HSM that takes in a ciphertext, decrypts it, then re-encrypts it with a new secret key.
+
+This is used in places like Visa and a lot of bank systems. This is because they do not want to store the key anywhere, so that the user can only interact with the HSM like a black box without seeing the key.
+
+\textit{How does an encrypt/decrypt HSM pair agree on a key?} The encrypt HSM (Alice) randomly samples $k_1, k_2, k_3$ such that $k_1 \oplus k_2 \oplus k_3 = k$. Then the 3 of them will be mailed to the decrypt HSM (Bob) using 3 different carriers, and the decrypt HSM will reconstruct the key $k$ on its own.
+
+\subsection{Secure Multi-Party Computation}
+
+\subsubsection{2-Party Computation}
+
+We've seen this before, but it is whensome parties want to compute the output of some function on their individual inputs, without revealing their own inputs.
+
+\begin{example}
+    Alice and Bob just returned from a date, and want to figure out if they each want a second date. Alice has some choice bit $x$ and Bob some choice bit $y$. They want to jointly compute $f(x, y) = x\land y$.
+\end{example}
+\begin{example}
+    Alice and Bob want to compare riches (who is richer?). They compute
+    \[f(x, y) = \begin{cases}
+            0 & \text{if }x>y    \\
+            1 & \text{otherwise}
+        \end{cases}\]
+\end{example}
+\begin{example}
+    Alice and Bob meet for the first time and want to see if they have friends in common. They have sets of friends $X,Y$, and compute
+    \[f(X, Y) = X\cap Y.\]
+    There are variants of this which only give cardinality of $X\cap Y$, etc.
+\end{example}
+
+\Graphic{images/2023-03-16/2pc.png}{0.6}
+
+In general, this is when two parties have inputs $x, y$ and want to compute some function $f(x, y)$ on them.
+
+Use cases include:
+\begin{itemize}
+    \item Password breach alert (Chrome/Firefox/Azure/iOS Keychain) runs a set intersection on your passwords and server leaked passwords.
+    \item Privacy-preserving contact tracing for COVID-19 (Apple and Google). We want to know if we have contact but not who had contact with.
+    \item Ads conversion measurements/personalized advertising (Google/Meta). We want to match conversions without either party knowing who converted.
+\end{itemize}
+
+\subsubsection{Multiple Parties!}
+The general case of this is Secure Multi-Party Computation (MPC)
+
+\Graphic{images/2023-03-16/mpc.png}{0.4}
+
+This is when we have some parties $P_i$ and want to compute input on $f(x_i, \cdots, x_n)$.
+
+Here are some applications:
+\begin{itemize}
+    \item Privacy-preserving Inventory Matching (J.P. Morgan)
+    \item Distributed key management (Unbound/Coinbase)
+    \item Federated learning (used in Google Keyboard Search Suggestion). We want to run machine learning, federated amongst multiple devices. However, we don't want to leak the actual training data from users.
+    \item Auctions (Danish sugar beet auction). Nobody should reveal their bid in the clear.
+    \item Also deployed in Boston area to analyze the wage gap between genders without revealing the individual salaries.
+    \item Study/Analysis on Medical Data. Every institution has limited data, but they cannot openly share that data due to regulations. How could they jointly do analysis on this data without revealing the data.
+    \item Fraud Detection (banks). Users might have cards at multiple banks, they want to jointly detect fraud but do not want to share their transactions.
+\end{itemize}
+
+When we normally talk about cryptography, we talk about `slowing down' the system (crypto makes everything slower). In the case of MPC, though, we've enabled new features that were not otherwise possible without these tools.
+
+\subsection{Definition}
+Our setting is that we have $n$ parties $P_1, \dots, P_n$ with private inputs $x_1, \dots, x_n$. They want to jointly compute $f(x_1, \dots, x_n)$.
+
+In terms of communication infrastructure: we usually assume point-to-point channels between each pair $(p_i, p_j)$. We know how to do this (key exchange, authenticated encryption, etc). Sometimes, we also assume a reliable broadcast channel where every other party gets information.
+
+There is a single adversary that can ``corrupt'' a subset of the parties (at most $t$).
+
+\emph{What properties do we want out of this system?} Here are some common security properties we might want:
+\begin{description}
+    \item[Correctness.] The function is computed correctly.
+    \item[Privacy.] Only the output is revealed.
+    \item[Independence of Inputs.] Parties cannot choose their inputs depending on others' inputs.
+\end{description}
+Also with security guarantees:
+\begin{description}
+    \item[Security with Abort.] The adversary may ``abort'' the protocol. This prevents honest parties from receiving the output. This is the weakest model.
+    \item[Fairness.] If one party receives the output, then all parties will receive the output.
+    \item[Guaranteed Output Delivery (GOD):] Honest parties \emph{always} receive output. Even if adversarial parties leave, the honest parties will simply continue the protocol.
+\end{description}
+
+We also have some characterizations of adversaries:
+\begin{itemize}
+    \item Allowed adversarial behavior:
+          \begin{itemize}
+              \item Semi-honest (or passive/honest-but-curious): They follow the protocol description honestly, but they try to extract more information by inspecting the transcript. This is the weaker model.
+              \item Malicious/active: These adversaries can deviate arbitrarily from protocol description.
+          \end{itemize}
+    \item Adversary's computing power:
+          \begin{itemize}
+              \item Unbounded computing power: this gives us information-theoretic (IT) security.
+              \item PPT bounded: this gives us computational security.
+          \end{itemize}
+\end{itemize}
+
+If you're interested, you can look into the literature of how to define security for MPCs. The idea is similar to that of ZK proofs---everything an adversary can do (see the transcript) can be simulated by a simulator who only has the input and output.
+
+
+\subsubsection{Feasibility Results}
+In the computational security setting, if we have a fundamental building block, a semi-honest oblivious transfer (OT), we can get semi-honest MPC for any function $t<n$. At a high level, using zero-knowledge proofs to enforce correctness of the protocol, we can convert any semi-honest MPC into a malicious MPC.
+
+In terms of information-theoretic (IT) security. We can also get semi-honest and malicious MPC for any function with $t < \frac{n}{2}$. We call this an \ul{honest majority}. This is a necessary bound, we cannot do any better than this.
+
+\subsection{Oblivious Transfer}
+\begin{definition}[Oblivious Transfer]
+    An \ul{oblivious transfer} is a protocol in which a sender, with messages $m_0, m_1\in\{0, 1\}^l$ gives a choice to the receiver to receive either $m_0, m_1$.
+
+    Given a choice bit from the receiver $b\in\{0,1\}$, the receiver gets $m_b$ and the sender also gets no information about the messeage transferred.
+
+    \Graphic{images/2023-03-21/ot.png}{0.6}
+\end{definition}
+
+We'll learn about constructions of OT later, but we black-box its implementation until later.
+
+Using a semi-honest OT, we can use Yao's Garbled Circuit to construct semi-honest 2PC for any function. We can also use the GMW compiler to compile this into a semi-honest MPC for any function. We'll focus on the first approach in this lecture, but we'll learn GMW in the following lectures.

lectures/2026/2026-03-30.tex

@@ -0,0 +1,105 @@
+%!TEX root = ../notes.tex
+\section{March 30, 2026}
+\label{20260330}
+
+\subsection{Multi-Party Computation - Big Picture}
+
+There are two different levels of MPC: either semi-honest or malicious. Semi-honest means that the adversary follows the protocol, but tries to extract more information. Malicious means that the adversary deviates from the protocol to extract information.
+
+If we have an oblivious transfer (OT) that is secure against semi-honest adversaries, we can use it with Yao's garbled circuit to achieve semi-honest 2-party computation for any function. Then, with the cut-and-choose with commitments, we can achieve malicious 2-party computation. We will discuss this next.
+
+\begin{align*}
+    \text{Semi-honest OT}\ & \underset{\text{Yao's Garbled Circuits}}{\implies}\ \text{Semi-honest 2PC for any function} \\
+    & \underset{\text{Cut-and-choose with commitments}}{\implies}\ \text{Malicious 2PC for any function}
+\end{align*}
+
+In the last part of this lecture, we will discuss how to use semi-honest OT with GMW to achieve semi-honest multi-party computation, which can be extended to malicious MPC.
+
+\begin{align*}
+    \text{Semi-honest OT} \ & \underset{\text{GMW}}{\implies} \text{Semi-honest MPC for any function}\\
+    & \underset{\text{GMW Compiler with ZKP}}{\implies} \text{Malicious MPC for any function}
+\end{align*}
+
+Recall the definition of Oblivious Transfer.
+
+\begin{definition}[Oblivious Transfer]
+    An \ul{oblivious transfer} is a protocol in which a sender, with messages $m_0, m_1\in\{0, 1\}^l$ gives a choice to the receiver to receive either $m_0, m_1$.
+
+    Given a choice bit from the receiver $b\in\{0,1\}$, the receiver gets $m_b$ and the sender also gets no information about the message transferred.
+
+    % \Graphic{images/2023-03-21/ot.png}{0.6}
+
+    \pseudocodeblock{
+        \textbf{Sender} \< \< \textbf{Receiver}\\
+        \text{Input: } m_0, m_1 \in \{ 0 , 1\}^{\ell} \< \< \text{Input: } b \in \{0, 1\}\\
+        \< \sendmessageright*{ } \< \\
+        \< \sendmessageleft*{ }\< \\
+        \< \sendmessageright*{ }\< \\
+        \< \sendmessageleft*{ } \< \\
+        \text{Output: }\perp \< \< \text{Output: }m_b
+    }
+\end{definition}
+
+\subsection{GMW}
+
+There is another method of multi-party computation that does not used garbled circuits called the Goldreich-Micali-Wigderson (GMW) protocol.
+
+Throughout the protocol, we keep the invariant that for each wire $w$, if the value of the wire is $v^w \in\{0, 1\}$, then the parties hold an \ul{additive secret share} of $v^w$. Each party $P_i$ holds a random share $v_i^w\in\{0,1\}$ such that
+\[\bigoplus_{i=1}^n v_i^w = v^w\]
+and we keep this invariant throughout the entire circuit. \footnote{Recall that $\oplus$ means addition modulo 2. You can check that this also gives the XOR operation.}
+
+We need to be able to preserve this invariant throughout \textsf{AND} and \textsf{XOR} gates. The \textsf{XOR} case is easy, since \textsf{XOR} is completely commutative and associative, so each party can locally \textsf{XOR} their shares $c_i := a_i\oplus b_i$ for $c := a\oplus b$.
+
+We'll address the \textsf{AND} case later, but we can do this. We'll proceede gate-by-gate for everyone to compute the result. Each party will publish their local shares, and everyone will \textsf{XOR} the result together to get the final result.
+
+\begin{remark}
+    \textbf{(Frequently asked)} Why do we only consider AND and XOR gates? This is because every other gate (NOT, OR, NAND) can be constructed using only AND and XOR gates. Gates like this are considered \textbf{complete}.
+\end{remark}
+
+\subsubsection{AND Gates}
+We now address the \textsf{AND} gates. We have $\bigoplus^n_{i=1}a_i = a$ and $\bigoplus^n_{i=1}b_i = b$.
+
+We want a set of $\left\{ c_i \right\}$ s.t. $\bigoplus^n_{i=1}c_i = c = a \cdot b$ (multiplication of bits is \textsf{AND}). But
+\begin{align*}
+    a\cdot b
+     & = \left( \sum^n_{i=1}a_i \right)\cdot \left( \sum^n_{i=1}b_i \right)\pmod{2}                \\
+     & = \left( \sum^n_{i=1}a_i \cdot b_i \right) + \left( \sum_{i\neq j}a_i \cdot b_j \right)\pmod{2}
+\end{align*}
+The first sum is easy and computed locally, but the second sum requires parties to communicate. We do something called \ul{resharing}.
+
+\textbf{Goal:} Between $P_i, P_j$, we want random $r_i, r_j\in\{0, 1\}$ such that $r_i + r_j = a_i \cdot b_j \pmod{2}$.
+
+$P_i$ will randomly sample $r_i\sampledfrom \left\{ 0, 1 \right\}$. We can use OT to allow $P_j$ to learn $r_j$ such that $r_i + r_j = a_i\cdot b_j\pmod{2}$ without revealing $a_i$ or $r_i$.
+
+$P_i$ will be the sender, $P_j$ is the receiver. $P_j$'s choice bit is $b_j$. Then the messages will be
+\begin{align*}
+    m_0 & = (a_i\cdot 0) - r_i = r_i \mod 2\\
+    m_1 & = (a_i\cdot 1) - r_i = a_i + r_i \mod 2
+\end{align*}
+such that $r_i, r_j$ are two shares of $a_i\cdot b_j$.
+
+\pseudocodeblock{
+    \textbf{Party i} \< \< \textbf{Party j}\\
+    \text{Input: } a_i \in \{ 0 , 1\} \< \< \text{Input: } b_j \in \{0, 1\} \\
+    r_i \sample \{0, 1\} \< \< \\
+    \text{Prepare both possibilities for }r_j \< \< \\
+    \< \sendmessageleft*{} \< \\
+    \< \sendmessageright*{\text{Use OT with choice bit }b_j} \< \\
+    \< \< \text{Receive } r_j\\
+    \text{Output: }r_i \in \{0, 1\}\< \< \text{Output: }r_j \in \{0, 1\}
+}
+
+\subsubsection{Complexities}
+Computational complexity is $O(\#\mathsf{AND}\cdot n)$ for each party, since each XOR gate takes constant number of operations and each AND gates requires a constant number of operations for each other party.
+
+For communication complexity, each party needs to communicate to every other party for every \textsf{AND} gate. For each XOR gate, we do not need to communicate. So the communication complexity is $O(n \cdot \#\mathsf{AND})$ per party.
+
+The round complexity is the depth of the AND gates in circuit. Each party needs to communicate to every other party for each AND gate, but some of these AND gates can be done in parallel (if they do not depend on each other). Thus, the round complexity is $O(\text{depth of AND gates})$.
+
+\begin{center}
+\begin{tabular}{c|c} 
+Computational Complexity & $O(\#\mathsf{AND}\cdot n)$ per party\\
+Communication Complexity & $O(n^2\cdot \#\mathsf{AND})$\\
+Round Complexity & $O(\text{depth of AND gates})$
+\end{tabular}
+\end{center}