Checkpoint the party/runtime stack before share-program and malicious-mode work.
Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
parent
695f8e84f7
commit
0d22946a0e
1835 changed files with 170291 additions and 2849 deletions
847
party/iknp_deal.hpp
Normal file
847
party/iknp_deal.hpp
Normal file
|
|
@ -0,0 +1,847 @@
|
|||
/// @file party/iknp_deal.hpp
|
||||
/// @brief Two-party IKNP setup for every tape `dist_ds.hpp` takes from p2.
|
||||
/// @details p0 and p1 sample the same pad correlations the dealer would, write
|
||||
/// them into a local inbox, and then run the existing walk. p2 is not
|
||||
/// connected. Covered tapes: additive carry, point (reveal and
|
||||
/// oblivious hash, wildcard, half-tree, extractable), comparison
|
||||
/// (edge, value-word, blocked suffix, verifiable hash), and interval
|
||||
/// containment.
|
||||
|
||||
#ifndef LIBDPF_PARTY_IKNP_DEAL_HPP__
|
||||
#define LIBDPF_PARTY_IKNP_DEAL_HPP__
|
||||
|
||||
#include <cstddef>
|
||||
#include <cstdint>
|
||||
#include <cstring>
|
||||
#include <stdexcept>
|
||||
#include <type_traits>
|
||||
#include <utility>
|
||||
#include <vector>
|
||||
|
||||
#include "hedley/hedley.h"
|
||||
|
||||
#include "dist_ds.hpp"
|
||||
#include "dpf/iknp.hpp"
|
||||
|
||||
namespace dpf
|
||||
{
|
||||
namespace party
|
||||
{
|
||||
namespace iknp_deal
|
||||
{
|
||||
|
||||
using net::role;
|
||||
using net::trio;
|
||||
|
||||
struct tape
|
||||
{
|
||||
std::vector<std::uint8_t> bytes;
|
||||
|
||||
template <typename T>
|
||||
void put(net::msg tag, const T & value)
|
||||
{
|
||||
static_assert(std::is_trivially_copyable_v<T>);
|
||||
append(tag, &value, sizeof(T));
|
||||
}
|
||||
|
||||
template <typename T>
|
||||
void put_vec(net::msg tag, const T * data, std::size_t n)
|
||||
{
|
||||
static_assert(std::is_trivially_copyable_v<T>);
|
||||
append(tag, data, n * sizeof(T));
|
||||
}
|
||||
|
||||
void append(net::msg tag, const void * payload, std::size_t n)
|
||||
{
|
||||
if (n > 0xffffffffu)
|
||||
throw std::invalid_argument("iknp tape frame");
|
||||
const auto len = static_cast<std::uint32_t>(n);
|
||||
const auto t = net::to_u16(tag);
|
||||
std::uint8_t hdr[6];
|
||||
std::memcpy(hdr, &len, 4);
|
||||
std::memcpy(hdr + 4, &t, 2);
|
||||
bytes.insert(bytes.end(), hdr, hdr + 6);
|
||||
if (n != 0)
|
||||
{
|
||||
const auto * p = static_cast<const std::uint8_t *>(payload);
|
||||
bytes.insert(bytes.end(), p, p + n);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
struct cursor
|
||||
{
|
||||
const iknp::material * mat = nullptr;
|
||||
std::size_t block = 0;
|
||||
std::size_t bit = 0;
|
||||
std::size_t b2a = 0;
|
||||
std::size_t cw = 0;
|
||||
std::size_t zero = 0;
|
||||
std::vector<dist::ring_zero_share_msg> zeros;
|
||||
|
||||
dist::and_share_msg take_block()
|
||||
{
|
||||
const auto & s = mat->blocks.at(block++);
|
||||
dist::and_share_msg m;
|
||||
m.a = s.a;
|
||||
m.b = s.b;
|
||||
m.c = s.c;
|
||||
return m;
|
||||
}
|
||||
|
||||
dist::bit_and_pad_msg take_bit()
|
||||
{
|
||||
const auto & s = mat->bits.at(bit++);
|
||||
return dist::bit_and_pad_msg{s.a, s.b, s.c};
|
||||
}
|
||||
|
||||
dist::b2a_pad_msg take_b2a()
|
||||
{
|
||||
const auto & s = mat->b2a.at(b2a++);
|
||||
return dist::b2a_pad_msg{s.r, s.add};
|
||||
}
|
||||
|
||||
dist::cw_pad_msg take_cw()
|
||||
{
|
||||
const auto & s = mat->cws.at(cw++);
|
||||
dist::cw_pad_msg m;
|
||||
m.rand = s.rand;
|
||||
m.gamma = s.gamma;
|
||||
m.bit = s.bit;
|
||||
return m;
|
||||
}
|
||||
|
||||
dist::ring_zero_share_msg take_zero()
|
||||
{
|
||||
return zeros.at(zero++);
|
||||
}
|
||||
|
||||
void done() const
|
||||
{
|
||||
if (mat == nullptr)
|
||||
return;
|
||||
if (block != mat->blocks.size() || bit != mat->bits.size()
|
||||
|| b2a != mat->b2a.size() || cw != mat->cws.size()
|
||||
|| zero != zeros.size())
|
||||
throw std::runtime_error("iknp tape did not consume every pad");
|
||||
}
|
||||
};
|
||||
|
||||
inline int me_of(role self)
|
||||
{
|
||||
if (self == role::p0)
|
||||
return 0;
|
||||
if (self == role::p1)
|
||||
return 1;
|
||||
throw std::invalid_argument("iknp parties are p0 and p1");
|
||||
}
|
||||
|
||||
inline void exchange_zeros(trio & net, int me,
|
||||
const std::vector<std::uint64_t> & masks, cursor & cur)
|
||||
{
|
||||
cur.zeros.resize(masks.size());
|
||||
const role peer = me == 0 ? role::p1 : role::p0;
|
||||
for (std::size_t i = 0; i < masks.size(); ++i)
|
||||
{
|
||||
if (me == 0)
|
||||
{
|
||||
const auto r = dist::random_ring_word(masks[i]);
|
||||
cur.zeros[i].share = r;
|
||||
net.send_to(peer, net::msg::ring_vector, detail::dcf_impl::neg_m(r, masks[i]));
|
||||
}
|
||||
else
|
||||
{
|
||||
cur.zeros[i].share = net.recv_from<std::uint64_t>(peer, net::msg::ring_vector);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
inline void barrier(trio & net, role self)
|
||||
{
|
||||
const role peer = self == role::p0 ? role::p1 : role::p0;
|
||||
const std::uint8_t ready = 1;
|
||||
(void)net.exchange_with(peer, ready, net::msg::delta);
|
||||
}
|
||||
|
||||
inline simde__m128i sample_root(int me)
|
||||
{
|
||||
const auto r = dpf::uniform_sample<simde__m128i>();
|
||||
return me == 0 ? dpf::unset_lo_bit(r) : dpf::set_lo_bit(r);
|
||||
}
|
||||
|
||||
inline dist::level_pad_msg take_level(cursor & cur, int me)
|
||||
{
|
||||
const auto cw = cur.take_cw();
|
||||
const auto first = cur.take_block();
|
||||
const auto second = cur.take_block();
|
||||
dist::level_pad_msg m;
|
||||
m.cw = cw;
|
||||
if (me == 0)
|
||||
{
|
||||
m.mine = first;
|
||||
m.theirs = second;
|
||||
}
|
||||
else
|
||||
{
|
||||
m.mine = second;
|
||||
m.theirs = first;
|
||||
}
|
||||
return m;
|
||||
}
|
||||
|
||||
struct demand
|
||||
{
|
||||
std::size_t blocks = 0;
|
||||
std::size_t bits = 0;
|
||||
std::size_t b2a = 0;
|
||||
std::size_t cws = 0;
|
||||
std::vector<std::uint64_t> zero_masks;
|
||||
};
|
||||
|
||||
inline void add_point(demand & d, std::size_t depth, std::size_t n_leaf,
|
||||
bool oblivious_hash, bool leaf_b2a)
|
||||
{
|
||||
d.cws += depth;
|
||||
d.blocks += depth * 2 + n_leaf;
|
||||
if (oblivious_hash)
|
||||
d.bits += depth * dist::hash_level_and_count();
|
||||
if (leaf_b2a)
|
||||
d.b2a += n_leaf * 128;
|
||||
}
|
||||
|
||||
inline void add_comparison(demand & d, std::size_t depth, std::size_t prefix,
|
||||
std::size_t cmp_block, std::size_t cmp_q, std::size_t cmp_h,
|
||||
bool verifiable, bool oblivious, bool edge, std::uint64_t mask)
|
||||
{
|
||||
d.cws += depth;
|
||||
d.blocks += depth * 2;
|
||||
if (oblivious && edge && prefix > 1)
|
||||
d.bits += prefix - 1;
|
||||
if (oblivious)
|
||||
{
|
||||
if (cmp_block == 0)
|
||||
{
|
||||
const std::size_t nlev = prefix < depth ? prefix : depth;
|
||||
d.bits += nlev * 128;
|
||||
d.b2a += nlev * 129;
|
||||
}
|
||||
if (cmp_block > 0 && cmp_q > 0 && cmp_h > 0 && cmp_h <= depth)
|
||||
{
|
||||
d.bits += 1;
|
||||
d.b2a += 3;
|
||||
}
|
||||
if (verifiable)
|
||||
d.bits += depth * dist::hash_level_and_count();
|
||||
}
|
||||
d.zero_masks.push_back(mask);
|
||||
}
|
||||
|
||||
template <std::size_t NLeaf>
|
||||
void emit_point(tape & out, cursor & cur, int me, std::size_t depth,
|
||||
bool half, bool oblivious_hash, bool leaf_b2a)
|
||||
{
|
||||
static_assert(NLeaf >= 1, "leaf mux sends at least one pad");
|
||||
if (half)
|
||||
out.put(net::msg::dpf_key, sample_root(me));
|
||||
for (std::size_t level = 0; level < depth; ++level)
|
||||
{
|
||||
out.put(net::msg::beaver_tape, take_level(cur, me));
|
||||
if (oblivious_hash)
|
||||
{
|
||||
const std::size_t n = dist::hash_level_and_count();
|
||||
std::vector<dist::bit_and_pad_msg> hash(n);
|
||||
for (std::size_t i = 0; i < n; ++i)
|
||||
hash[i] = cur.take_bit();
|
||||
out.put_vec(net::msg::beaver_tape, hash.data(), hash.size());
|
||||
}
|
||||
}
|
||||
dist::leaf_pad_msg<NLeaf> lanes{};
|
||||
for (std::size_t i = 0; i < NLeaf; ++i)
|
||||
lanes.lanes[i] = cur.take_block();
|
||||
out.put(net::msg::beaver_tape, lanes);
|
||||
if (leaf_b2a)
|
||||
{
|
||||
std::vector<dist::b2a_pad_msg> pads(NLeaf * 128);
|
||||
for (auto & p : pads)
|
||||
p = cur.take_b2a();
|
||||
out.put_vec(net::msg::beaver_tape, pads.data(), pads.size());
|
||||
}
|
||||
}
|
||||
|
||||
inline void emit_comparison(tape & out, cursor & cur, int me, std::size_t depth,
|
||||
std::size_t prefix, std::size_t cmp_block, std::size_t cmp_q,
|
||||
std::size_t cmp_h, bool verifiable, bool oblivious, bool edge, bool half)
|
||||
{
|
||||
if (half)
|
||||
out.put(net::msg::dpf_key, sample_root(me));
|
||||
if (oblivious && edge && prefix > 1)
|
||||
{
|
||||
std::vector<dist::bit_and_pad_msg> edge_pads(prefix - 1);
|
||||
for (auto & p : edge_pads)
|
||||
p = cur.take_bit();
|
||||
out.put_vec(net::msg::beaver_tape, edge_pads.data(), edge_pads.size());
|
||||
}
|
||||
for (std::size_t level = 0; level < depth; ++level)
|
||||
{
|
||||
out.put(net::msg::beaver_tape, take_level(cur, me));
|
||||
if (oblivious)
|
||||
{
|
||||
if (cmp_block == 0 && level < prefix)
|
||||
{
|
||||
dist::cmp_level_obliv_msg msg{};
|
||||
for (std::size_t i = 0; i < 128; ++i)
|
||||
{
|
||||
const auto bit = cur.take_bit();
|
||||
const auto b2 = cur.take_b2a();
|
||||
msg.bits[i] = dist::word_bit_for(bit, b2);
|
||||
}
|
||||
msg.ai = cur.take_b2a();
|
||||
out.put(net::msg::beaver_tape, msg);
|
||||
}
|
||||
if (cmp_block > 0 && cmp_q > 0 && level + 1 == cmp_h)
|
||||
{
|
||||
dist::suffix_obliv_msg msg{};
|
||||
msg.and_pad = cur.take_bit();
|
||||
for (int i = 0; i < 3; ++i)
|
||||
msg.b2a[i] = cur.take_b2a();
|
||||
out.put(net::msg::beaver_tape, msg);
|
||||
}
|
||||
if (verifiable)
|
||||
{
|
||||
const std::size_t n = dist::hash_level_and_count();
|
||||
std::vector<dist::bit_and_pad_msg> hash(n);
|
||||
for (std::size_t i = 0; i < n; ++i)
|
||||
hash[i] = cur.take_bit();
|
||||
out.put_vec(net::msg::beaver_tape, hash.data(), hash.size());
|
||||
}
|
||||
}
|
||||
}
|
||||
out.put(net::msg::beaver_tape, cur.take_zero());
|
||||
}
|
||||
|
||||
template <typename Concrete, typename Leaf>
|
||||
void exchange_wildcard(trio & net, int me, dist::wildcard_leaf_pad_msg<Concrete, Leaf> & pad)
|
||||
{
|
||||
const role peer = me == 0 ? role::p1 : role::p0;
|
||||
Concrete mine_out = dpf::uniform_sample<Concrete>();
|
||||
Leaf mine_vec = dist::random_leaf<Leaf>();
|
||||
Leaf peer_vec = net.exchange_with(peer, mine_vec, net::msg::ring_vector);
|
||||
Leaf cross_for_peer = dpf::multiply_leaf(peer_vec, mine_out);
|
||||
Leaf cross = net.exchange_with(peer, cross_for_peer, net::msg::ring_vector);
|
||||
Leaf zero{};
|
||||
if (me == 0)
|
||||
{
|
||||
zero = dist::random_leaf<Leaf>();
|
||||
const Leaf neg = dpf::subtract_leaf<Concrete>(Leaf{}, zero);
|
||||
net.send_to(peer, net::msg::ring_vector, neg);
|
||||
}
|
||||
else
|
||||
{
|
||||
zero = net.recv_from<Leaf>(peer, net::msg::ring_vector);
|
||||
}
|
||||
pad.output_blind = mine_out;
|
||||
pad.vector_blind = mine_vec;
|
||||
pad.peer_vector_blind = peer_vec;
|
||||
pad.cross = cross;
|
||||
pad.zero_leaf = zero;
|
||||
}
|
||||
|
||||
inline void install(trio & net, role self, tape & out, cursor & cur)
|
||||
{
|
||||
cur.done();
|
||||
barrier(net, self);
|
||||
net.install_inbox(std::move(out.bytes));
|
||||
}
|
||||
|
||||
template <typename InteriorPRG, typename InputT, typename OutputT,
|
||||
bool ObliviousHash, bool Additive>
|
||||
void prepare_point(trio & net, role self)
|
||||
{
|
||||
const int me = me_of(self);
|
||||
using dpf_type = utils::dpf_type_t<InteriorPRG, InteriorPRG, InputT, OutputT,
|
||||
verifiable>;
|
||||
using tree = dpf::tree_traits<InteriorPRG>;
|
||||
constexpr std::size_t depth = dpf_type::depth;
|
||||
constexpr std::size_t lg = dpf_type::lg_outputs_per_leaf;
|
||||
constexpr std::size_t n_leaf = dist::leaf_and_slots(lg);
|
||||
constexpr bool leaf_b2a = lg > 0
|
||||
&& !utils::has_characteristic_two_v<dpf::concrete_type_t<OutputT>>
|
||||
&& (!dpf::is_wildcard_v<OutputT> || ObliviousHash);
|
||||
demand d;
|
||||
if constexpr (Additive)
|
||||
d.bits += utils::bitlength_of_v<InputT> - 1;
|
||||
add_point(d, depth, n_leaf, ObliviousHash, leaf_b2a);
|
||||
const role peer = self == role::p0 ? role::p1 : role::p0;
|
||||
auto mat = iknp::sample(net.to(peer), me, d.blocks, d.bits, d.b2a, d.cws);
|
||||
cursor cur;
|
||||
cur.mat = &mat;
|
||||
tape out;
|
||||
if constexpr (Additive)
|
||||
{
|
||||
constexpr std::size_t nbits = utils::bitlength_of_v<InputT>;
|
||||
for (std::size_t i = 0; i + 1 < nbits; ++i)
|
||||
out.put(net::msg::beaver_tape, cur.take_bit());
|
||||
}
|
||||
emit_point<n_leaf>(out, cur, me, depth, tree::is_half_tree, ObliviousHash,
|
||||
leaf_b2a);
|
||||
if constexpr (dpf::is_wildcard_v<OutputT>)
|
||||
{
|
||||
using concrete = dpf::concrete_type_t<OutputT>;
|
||||
using leaf_type = dpf::leaf_node_t<typename dpf_type::exterior_node, concrete>;
|
||||
dist::wildcard_leaf_pad_msg<concrete, leaf_type> pad{};
|
||||
exchange_wildcard<concrete, leaf_type>(net, me, pad);
|
||||
out.put(net::msg::beaver_tape, pad);
|
||||
}
|
||||
install(net, self, out, cur);
|
||||
}
|
||||
|
||||
template <typename InteriorPRG, typename ExteriorPRG, typename InputT,
|
||||
bool Oblivious, typename Spec, typename ...Tags>
|
||||
void prepare_comparison(trio & net, role self, const Spec & spec,
|
||||
const Tags & ...tags)
|
||||
{
|
||||
const int me = me_of(self);
|
||||
using pair_type = dist::comparison_pair_t<InteriorPRG, ExteriorPRG, InputT,
|
||||
Spec, Tags...>;
|
||||
using key_type = typename pair_type::first_type::key_type;
|
||||
using tree = dpf::tree_traits<InteriorPRG>;
|
||||
(void)std::initializer_list<int>{((void)tags, 0)...};
|
||||
dcf_runtime_spec runtime{};
|
||||
bool found = false;
|
||||
detail::incr::collect_cmp_one(runtime, found, spec);
|
||||
if (!found)
|
||||
throw std::invalid_argument("dist comparison keygen needs one comparison");
|
||||
if (runtime.prefix == 0)
|
||||
runtime.prefix = utils::bitlength_of_v<InputT>;
|
||||
if constexpr (Oblivious)
|
||||
{
|
||||
if (is_paint_kind(runtime.kind))
|
||||
throw std::invalid_argument(
|
||||
"oblivious comparison does not support paint kinds");
|
||||
}
|
||||
const bool edge = runtime.kind == cmp_kind::leq || runtime.kind == cmp_kind::gt;
|
||||
demand d;
|
||||
add_comparison(d, key_type::depth, runtime.prefix, key_type::cmp_block,
|
||||
key_type::cmp_q, key_type::cmp_h, key_type::is_verifiable, Oblivious,
|
||||
edge, runtime.mask);
|
||||
const role peer = self == role::p0 ? role::p1 : role::p0;
|
||||
auto mat = iknp::sample(net.to(peer), me, d.blocks, d.bits, d.b2a, d.cws);
|
||||
cursor cur;
|
||||
cur.mat = &mat;
|
||||
exchange_zeros(net, me, d.zero_masks, cur);
|
||||
tape out;
|
||||
emit_comparison(out, cur, me, key_type::depth, runtime.prefix,
|
||||
key_type::cmp_block, key_type::cmp_q, key_type::cmp_h,
|
||||
key_type::is_verifiable, Oblivious, edge, tree::is_half_tree);
|
||||
install(net, self, out, cur);
|
||||
}
|
||||
|
||||
template <typename InteriorPRG, typename ExteriorPRG, typename InputT,
|
||||
bool Reveal, typename Beta>
|
||||
void prepare_ic(trio & net, role self, const ic_pack<Beta> & spec)
|
||||
{
|
||||
const int me = me_of(self);
|
||||
using input_type = std::decay_t<InputT>;
|
||||
const auto inner = detail::ic_impl::inner_lt(spec);
|
||||
const std::uint64_t gmask = detail::ic_impl::group_mask_of<Beta>();
|
||||
constexpr std::size_t nbits = utils::bitlength_of_v<input_type>;
|
||||
using pair_type = dist::comparison_pair_t<InteriorPRG, ExteriorPRG,
|
||||
input_type, decltype(inner)>;
|
||||
using key_type = typename pair_type::first_type::key_type;
|
||||
using tree = dpf::tree_traits<InteriorPRG>;
|
||||
dcf_runtime_spec runtime{};
|
||||
bool found = false;
|
||||
detail::incr::collect_cmp_one(runtime, found, inner);
|
||||
if (!found)
|
||||
throw std::invalid_argument("dist comparison keygen needs one comparison");
|
||||
if (runtime.prefix == 0)
|
||||
runtime.prefix = nbits;
|
||||
constexpr bool oblivious = !Reveal;
|
||||
if constexpr (oblivious)
|
||||
{
|
||||
if (is_paint_kind(runtime.kind))
|
||||
throw std::invalid_argument(
|
||||
"oblivious comparison does not support paint kinds");
|
||||
}
|
||||
demand d;
|
||||
if constexpr (oblivious)
|
||||
{
|
||||
d.bits += dist::ic_gamma_and_count(nbits);
|
||||
d.bits += dist::ic_correction_and_count(nbits);
|
||||
d.b2a += 4;
|
||||
}
|
||||
const bool edge = runtime.kind == cmp_kind::leq || runtime.kind == cmp_kind::gt;
|
||||
add_comparison(d, key_type::depth, runtime.prefix, key_type::cmp_block,
|
||||
key_type::cmp_q, key_type::cmp_h, key_type::is_verifiable, oblivious,
|
||||
edge, runtime.mask);
|
||||
if constexpr (Reveal)
|
||||
{
|
||||
d.zero_masks.push_back(gmask);
|
||||
d.zero_masks.push_back(gmask);
|
||||
}
|
||||
else
|
||||
{
|
||||
d.zero_masks.push_back(gmask);
|
||||
}
|
||||
const role peer = self == role::p0 ? role::p1 : role::p0;
|
||||
auto mat = iknp::sample(net.to(peer), me, d.blocks, d.bits, d.b2a, d.cws);
|
||||
cursor cur;
|
||||
cur.mat = &mat;
|
||||
exchange_zeros(net, me, d.zero_masks, cur);
|
||||
tape out;
|
||||
if constexpr (oblivious)
|
||||
{
|
||||
const std::size_t gamma_n = dist::ic_gamma_and_count(nbits);
|
||||
const std::size_t corr_n = dist::ic_correction_and_count(nbits);
|
||||
std::vector<dist::bit_and_pad_msg> gamma(gamma_n), corr(corr_n);
|
||||
for (auto & p : gamma)
|
||||
p = cur.take_bit();
|
||||
for (auto & p : corr)
|
||||
p = cur.take_bit();
|
||||
std::vector<dist::b2a_pad_msg> b2(4);
|
||||
for (auto & p : b2)
|
||||
p = cur.take_b2a();
|
||||
out.put_vec(net::msg::beaver_tape, gamma.data(), gamma.size());
|
||||
out.put_vec(net::msg::beaver_tape, corr.data(), corr.size());
|
||||
out.put_vec(net::msg::beaver_tape, b2.data(), b2.size());
|
||||
}
|
||||
emit_comparison(out, cur, me, key_type::depth, runtime.prefix,
|
||||
key_type::cmp_block, key_type::cmp_q, key_type::cmp_h,
|
||||
key_type::is_verifiable, oblivious, edge, tree::is_half_tree);
|
||||
out.put(net::msg::beaver_tape, cur.take_zero());
|
||||
if constexpr (Reveal)
|
||||
out.put(net::msg::beaver_tape, cur.take_zero());
|
||||
install(net, self, out, cur);
|
||||
}
|
||||
|
||||
} // namespace iknp_deal
|
||||
|
||||
/// @brief Two-party point keygen. Same walk as `dist_with_point_key`; pads
|
||||
/// come from IKNP instead of p2.
|
||||
/// @details Ideal (semi-honest): p0/p1 input XOR or additive shares of α and
|
||||
/// payload β; each outputs its verifiable DPF key. With
|
||||
/// `RevealPoint`, the tree prefix (and packed wildcard lane when
|
||||
/// applicable) may be opened. Without it, α, peer seeds, peer
|
||||
/// payload shares, and path-opening pad bits stay hidden.
|
||||
/// \complexity Same tree walk as `dist_with_point_key`, plus one IKNP
|
||||
/// `sample`. With tape length `T = Θ(n)` on a reveal point
|
||||
/// (or `T = Θ(n · hash_level_and_count())` when oblivious),
|
||||
/// `sample` does two Chou–Orlandi base sessions of `κ = 128`
|
||||
/// OTs on P-256 and two OT-extension directions of cost
|
||||
/// `Θ(κ T)` bits, then the usual `n` Doerner–Shelat opens.
|
||||
/// Dealer `make_dpf` is still 0 rounds / 0 bytes; Half-Tree
|
||||
/// §5.2 (ePrint 2022/1431) is a different `n+3`-round COT/OLE
|
||||
/// hybrid this path does not implement.
|
||||
/// \rounds Base OT + extension (constant rounds) then the usual per-level
|
||||
/// DS exchanges; no p2.
|
||||
/// \communication IKNP seed OT and extension rows (`Θ(κ T)` bits), then
|
||||
/// the same peer messages as the dealer walk (no dealer
|
||||
/// frames).
|
||||
/// \preprocessing IKNP replaces the dealer tape; there is no offline p2.
|
||||
template <typename InteriorPRG = dpf::prg::aes128,
|
||||
typename ExteriorPRG = InteriorPRG,
|
||||
bool RevealPoint = false,
|
||||
typename InputT,
|
||||
typename OutputT,
|
||||
typename Fn0,
|
||||
typename Fn1>
|
||||
HEDLEY_WARN_UNUSED_RESULT
|
||||
auto dist_with_point_key_iknp(
|
||||
trio & net, role self, InputT x0, InputT x1, OutputT beta, Fn0 && on0,
|
||||
Fn1 && on1, bool already_encoded = false, bool additive = false)
|
||||
{
|
||||
using opened_type = point_key_opened<InputT>;
|
||||
using dpf_type = utils::dpf_type_t<InteriorPRG, ExteriorPRG, InputT,
|
||||
OutputT, verifiable>;
|
||||
constexpr bool wild_lane = RevealPoint && dpf::is_wildcard_v<OutputT>
|
||||
&& dpf_type::lg_outputs_per_leaf > 0;
|
||||
if (additive && already_encoded)
|
||||
throw std::invalid_argument(
|
||||
"additive DS input is converted to XOR shares; it is not pre-opened");
|
||||
if (self == role::p2)
|
||||
throw std::invalid_argument("iknp point keygen has no dealer");
|
||||
if (additive)
|
||||
iknp_deal::prepare_point<InteriorPRG, InputT, OutputT, !RevealPoint, true>(
|
||||
net, self);
|
||||
else
|
||||
iknp_deal::prepare_point<InteriorPRG, InputT, OutputT, !RevealPoint, false>(
|
||||
net, self);
|
||||
if (additive)
|
||||
{
|
||||
if (self == role::p0)
|
||||
x0 = dist::additive_to_xor_share<role::p0>(net, x0);
|
||||
else
|
||||
x1 = dist::additive_to_xor_share<role::p1>(net, x1);
|
||||
}
|
||||
if constexpr (RevealPoint)
|
||||
{
|
||||
auto finish = [](auto result) {
|
||||
opened_type out;
|
||||
out.opened_prefix = result.opened_prefix;
|
||||
if constexpr (wild_lane)
|
||||
out.opened_lane = result.opened_lane;
|
||||
return out;
|
||||
};
|
||||
if (self == role::p0)
|
||||
{
|
||||
auto result = dist::point_party<InteriorPRG, ExteriorPRG, InputT,
|
||||
OutputT, role::p0, false, true>(net, x0, beta, already_encoded);
|
||||
std::forward<Fn0>(on0)(result.dpf_key);
|
||||
return std::optional<opened_type>(finish(std::move(result)));
|
||||
}
|
||||
auto result = dist::point_party<InteriorPRG, ExteriorPRG, InputT,
|
||||
OutputT, role::p1, false, true>(net, x1, beta, already_encoded);
|
||||
std::forward<Fn1>(on1)(result.dpf_key);
|
||||
return std::optional<opened_type>(finish(std::move(result)));
|
||||
}
|
||||
else
|
||||
{
|
||||
if (self == role::p0)
|
||||
std::forward<Fn0>(on0)(dist::point_party<InteriorPRG, ExteriorPRG,
|
||||
InputT, OutputT, role::p0, false, false>(
|
||||
net, x0, beta, already_encoded));
|
||||
else
|
||||
std::forward<Fn1>(on1)(dist::point_party<InteriorPRG, ExteriorPRG,
|
||||
InputT, OutputT, role::p1, false, false>(
|
||||
net, x1, beta, already_encoded));
|
||||
}
|
||||
}
|
||||
|
||||
/// @brief Two-party extractable point keygen.
|
||||
template <typename InteriorPRG = dpf::prg::aes128,
|
||||
typename ExteriorPRG = InteriorPRG,
|
||||
typename InputT,
|
||||
typename OutputT,
|
||||
typename Fn0,
|
||||
typename Fn1>
|
||||
void dist_with_extractable_point_key_iknp(trio & net, role self, InputT x0,
|
||||
InputT x1, OutputT beta, Fn0 && on0, Fn1 && on1)
|
||||
{
|
||||
static_assert(!dpf::is_wildcard_v<OutputT>,
|
||||
"extractable socket gen does not reconstruct a wildcard lane");
|
||||
if (self == role::p2)
|
||||
throw std::invalid_argument("iknp point keygen has no dealer");
|
||||
iknp_deal::prepare_point<InteriorPRG, InputT, OutputT, false, false>(
|
||||
net, self);
|
||||
if (self == role::p0)
|
||||
{
|
||||
on0(dist::point_party<InteriorPRG, ExteriorPRG, InputT, OutputT,
|
||||
role::p0, true>(net, x0, beta));
|
||||
}
|
||||
else
|
||||
{
|
||||
on1(dist::point_party<InteriorPRG, ExteriorPRG, InputT, OutputT,
|
||||
role::p1, true>(net, x1, beta));
|
||||
}
|
||||
}
|
||||
|
||||
/// @brief Two-party comparison keygen.
|
||||
template <typename InteriorPRG = dpf::prg::aes128,
|
||||
typename ExteriorPRG = InteriorPRG,
|
||||
bool Reveal = false,
|
||||
typename InputT,
|
||||
typename Spec,
|
||||
typename Fn0,
|
||||
typename Fn1,
|
||||
typename ...Tags>
|
||||
auto dist_with_cmp_key_iknp(trio & net, role self, InputT x0, InputT x1,
|
||||
const Spec & spec, Fn0 && on0, Fn1 && on1, const Tags & ...tags)
|
||||
-> std::conditional_t<Reveal, std::optional<InputT>, suppressed_point>
|
||||
{
|
||||
if (self == role::p2)
|
||||
throw std::invalid_argument("iknp comparison keygen has no dealer");
|
||||
iknp_deal::prepare_comparison<InteriorPRG, ExteriorPRG, InputT, !Reveal>(
|
||||
net, self, spec, tags...);
|
||||
if constexpr (Reveal)
|
||||
{
|
||||
if (self == role::p0)
|
||||
{
|
||||
auto result = dist::comparison_party<role::p0, InteriorPRG,
|
||||
ExteriorPRG, false, true>(net, x0, spec, tags...);
|
||||
std::forward<Fn0>(on0)(result.dpf_key);
|
||||
return result.opened_point;
|
||||
}
|
||||
auto result = dist::comparison_party<role::p1, InteriorPRG,
|
||||
ExteriorPRG, false, true>(net, x1, spec, tags...);
|
||||
std::forward<Fn1>(on1)(result.dpf_key);
|
||||
return result.opened_point;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (self == role::p0)
|
||||
{
|
||||
std::forward<Fn0>(on0)(dist::comparison_party<role::p0, InteriorPRG,
|
||||
ExteriorPRG, false, false>(net, x0, spec, tags...));
|
||||
}
|
||||
else
|
||||
{
|
||||
std::forward<Fn1>(on1)(dist::comparison_party<role::p1, InteriorPRG,
|
||||
ExteriorPRG, false, false>(net, x1, spec, tags...));
|
||||
}
|
||||
return {};
|
||||
}
|
||||
}
|
||||
|
||||
/// @brief Two-party interval keygen.
|
||||
template <typename InteriorPRG = dpf::prg::aes128,
|
||||
typename ExteriorPRG = InteriorPRG,
|
||||
bool Reveal = false,
|
||||
typename InputT,
|
||||
typename Beta,
|
||||
typename Fn0,
|
||||
typename Fn1>
|
||||
auto dist_with_ic_key_iknp(trio & net, role self, InputT r0, InputT r1,
|
||||
const ic_pack<Beta> & spec, Fn0 && on0, Fn1 && on1)
|
||||
-> std::conditional_t<Reveal, std::optional<std::decay_t<InputT>>,
|
||||
suppressed_point>
|
||||
{
|
||||
using input_type = std::decay_t<InputT>;
|
||||
using out_beta = concrete_type_t<Beta>;
|
||||
detail::ic_impl::check_input<input_type>();
|
||||
detail::ic_impl::check_bounds<input_type>(spec);
|
||||
if constexpr (detail::cmp_group_info<Beta>::custom)
|
||||
{
|
||||
throw std::invalid_argument(
|
||||
"dist interval keygen currently supports <=64-bit ring payloads");
|
||||
if constexpr (Reveal)
|
||||
return std::nullopt;
|
||||
else
|
||||
return {};
|
||||
}
|
||||
else
|
||||
{
|
||||
if (self == role::p2)
|
||||
throw std::invalid_argument("iknp interval keygen has no dealer");
|
||||
const auto inner_spec = detail::ic_impl::inner_lt(spec);
|
||||
const std::uint64_t gmask = detail::ic_impl::group_mask_of<Beta>();
|
||||
const std::uint64_t nmask = detail::ic_impl::input_mask_of<input_type>();
|
||||
iknp_deal::prepare_ic<InteriorPRG, ExteriorPRG, input_type, Reveal>(
|
||||
net, self, spec);
|
||||
const input_type mine = self == role::p0 ? r0 : r1;
|
||||
std::uint64_t delta = 0;
|
||||
std::uint64_t fval = 0;
|
||||
if constexpr (!is_wildcard_v<Beta>)
|
||||
{
|
||||
delta = detail::dcf_impl::beta_delta_u64(
|
||||
spec.if_true, spec.if_false, gmask);
|
||||
fval = detail::dcf_impl::beta_to_u64_simple(spec.if_false, gmask);
|
||||
}
|
||||
if constexpr (Reveal)
|
||||
{
|
||||
const role peer = self == role::p0 ? role::p1 : role::p0;
|
||||
const input_type theirs =
|
||||
net.exchange_with(peer, mine, net::msg::delta);
|
||||
const input_type r = utils::xor_input_shares(mine, theirs);
|
||||
const std::uint64_t r_bits = detail::ic_impl::bits_of(r);
|
||||
input_type gamma = detail::ic_impl::gamma_of(r);
|
||||
utils::flip_msb_if_signed_integral(gamma);
|
||||
const std::uint64_t cr = detail::ic_impl::correction(
|
||||
r_bits, spec.lo, spec.hi, nmask, gmask);
|
||||
const std::uint64_t absorb =
|
||||
(detail::ic_impl::mul_mask(delta, cr, gmask) + fval) & gmask;
|
||||
const auto recv_side_shares = [&]() {
|
||||
const auto z0 =
|
||||
net.recv_from<dist::ring_zero_share_msg>(role::p2, net::msg::beaver_tape);
|
||||
const auto z1 =
|
||||
net.recv_from<dist::ring_zero_share_msg>(role::p2, net::msg::beaver_tape);
|
||||
const std::uint64_t side = self == role::p1 ? 1ULL : 0ULL;
|
||||
const std::uint64_t dshare = is_wildcard_v<Beta>
|
||||
? 0ULL : (z0.share + side * delta) & gmask;
|
||||
const std::uint64_t cshare = is_wildcard_v<Beta>
|
||||
? 0ULL : (z1.share + side * absorb) & gmask;
|
||||
const std::uint64_t dcoeff = is_wildcard_v<Beta>
|
||||
? (z0.share + side) & gmask : 0ULL;
|
||||
const std::uint64_t ccoeff = is_wildcard_v<Beta>
|
||||
? (z1.share + side * cr) & gmask : 0ULL;
|
||||
return std::array<std::uint64_t, 4>{
|
||||
dshare, cshare, dcoeff, ccoeff};
|
||||
};
|
||||
if (self == role::p0)
|
||||
{
|
||||
auto inner = dist::comparison_party<role::p0, InteriorPRG,
|
||||
ExteriorPRG, true>(net, gamma, inner_spec);
|
||||
const auto shares = recv_side_shares();
|
||||
using raw_key = typename decltype(inner)::key_type;
|
||||
auto key = detail::ic_impl::make_side<0, raw_key, input_type,
|
||||
out_beta>(std::move(inner), spec.lo, spec.hi, nmask, gmask,
|
||||
shares[0], shares[1], shares[2], shares[3]);
|
||||
on0(std::move(key));
|
||||
}
|
||||
else
|
||||
{
|
||||
auto inner = dist::comparison_party<role::p1, InteriorPRG,
|
||||
ExteriorPRG, true>(net, gamma, inner_spec);
|
||||
const auto shares = recv_side_shares();
|
||||
using raw_key = typename decltype(inner)::key_type;
|
||||
auto key = detail::ic_impl::make_side<1, raw_key, input_type,
|
||||
out_beta>(std::move(inner), spec.lo, spec.hi, nmask, gmask,
|
||||
shares[0], shares[1], shares[2], shares[3]);
|
||||
on1(std::move(key));
|
||||
}
|
||||
return r;
|
||||
}
|
||||
else
|
||||
{
|
||||
input_type gamma_share{};
|
||||
std::uint64_t cr_share = 0;
|
||||
if (self == role::p0)
|
||||
{
|
||||
auto got = dist::ic_gamma_and_correction<0, input_type>(net,
|
||||
mine, spec.lo, spec.hi, nmask, gmask);
|
||||
gamma_share = got.first;
|
||||
cr_share = got.second;
|
||||
}
|
||||
else
|
||||
{
|
||||
auto got = dist::ic_gamma_and_correction<1, input_type>(net,
|
||||
mine, spec.lo, spec.hi, nmask, gmask);
|
||||
gamma_share = got.first;
|
||||
cr_share = got.second;
|
||||
}
|
||||
const std::uint64_t absorb_share = is_wildcard_v<Beta>
|
||||
? 0ULL
|
||||
: (detail::ic_impl::mul_mask(delta, cr_share, gmask)
|
||||
+ (self == role::p1 ? fval : 0ULL)) & gmask;
|
||||
const std::uint64_t cr_coeff_share =
|
||||
is_wildcard_v<Beta> ? cr_share : 0ULL;
|
||||
const auto recv_delta = [&]() {
|
||||
const auto z0 =
|
||||
net.recv_from<dist::ring_zero_share_msg>(role::p2, net::msg::beaver_tape);
|
||||
const std::uint64_t side = self == role::p1 ? 1ULL : 0ULL;
|
||||
const std::uint64_t dshare = is_wildcard_v<Beta>
|
||||
? 0ULL : (z0.share + side * delta) & gmask;
|
||||
const std::uint64_t dcoeff = is_wildcard_v<Beta>
|
||||
? (z0.share + side) & gmask : 0ULL;
|
||||
return std::array<std::uint64_t, 2>{dshare, dcoeff};
|
||||
};
|
||||
if (self == role::p0)
|
||||
{
|
||||
auto inner = dist::comparison_party<role::p0, InteriorPRG,
|
||||
ExteriorPRG, false, false>(net, gamma_share, inner_spec);
|
||||
const auto d = recv_delta();
|
||||
using raw_key = typename decltype(inner)::key_type;
|
||||
auto key = detail::ic_impl::make_side<0, raw_key, input_type,
|
||||
out_beta>(std::move(inner), spec.lo, spec.hi, nmask, gmask,
|
||||
d[0], absorb_share, d[1], cr_coeff_share);
|
||||
on0(std::move(key));
|
||||
}
|
||||
else
|
||||
{
|
||||
auto inner = dist::comparison_party<role::p1, InteriorPRG,
|
||||
ExteriorPRG, false, false>(net, gamma_share, inner_spec);
|
||||
const auto d = recv_delta();
|
||||
using raw_key = typename decltype(inner)::key_type;
|
||||
auto key = detail::ic_impl::make_side<1, raw_key, input_type,
|
||||
out_beta>(std::move(inner), spec.lo, spec.hi, nmask, gmask,
|
||||
d[0], absorb_share, d[1], cr_coeff_share);
|
||||
on1(std::move(key));
|
||||
}
|
||||
return {};
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} // namespace party
|
||||
} // namespace dpf
|
||||
|
||||
#endif // LIBDPF_PARTY_IKNP_DEAL_HPP__
|
||||
Loading…
Add table
Add a link
Reference in a new issue