381 lines
14 KiB
Markdown
381 lines
14 KiB
Markdown
# Bibliography {#bibliography}
|
||
|
||
Each paper is listed once. An ePrint number anywhere else in the manual
|
||
links here. **Used in** points back at the pages that rely on that paper.
|
||
|
||
ePrint PDFs that IACR posts are cached next to these pages.
|
||
Publisher PDFs from Springer, ACM, and USENIX are not.
|
||
|
||
[Point functions](@ref bib_sec_point) ·
|
||
[Generation and OT](@ref bib_sec_ot) ·
|
||
[Comparisons and proofs](@ref bib_sec_cmp) ·
|
||
[Three parties](@ref bib_sec_three) ·
|
||
[Grotto](@ref bib_sec_grotto) ·
|
||
[Protocols](@ref bib_sec_protocols)
|
||
|
||
## Point functions and trees {#bib_sec_point}
|
||
|
||
### Improvements and extensions {#bib_fss2018}
|
||
|
||
Elette Boyle, Niv Gilboa, and Yuval Ishai.
|
||
*Function Secret Sharing: Improvements and Extensions.*
|
||
ACM CCS 2016, pp. 1292–1303. Full version, 24 July 2018.
|
||
[ePrint 2018/707](https://eprint.iacr.org/2018/707) ·
|
||
<a href="boyle-gilboa-ishai-fss-improvements-eprint-2018-707.pdf">PDF</a>
|
||
|
||
The point-function key `make_dpf` follows. Remark 3.4 is the early-stop
|
||
packing: the last `ν = log2(λ / log2|G|)` levels are a lane inside the
|
||
leaf, not correction words.
|
||
|
||
**Used in** [First program](@ref basics) · [Evaluation](@ref evaluation) · [Guided tour](@ref tour_eval)
|
||
|
||
### Function Secret Sharing (2015) {#bib_fss2015}
|
||
|
||
Elette Boyle, Niv Gilboa, and Yuval Ishai.
|
||
*Function Secret Sharing.*
|
||
EUROCRYPT 2015, LNCS 9057, pp. 337–367.
|
||
<a href="https://doi.org/10.1007/978-3-662-46803-6_12">Publisher</a>
|
||
|
||
The `4n(λ+1)`-bit key named in the manual, as recorded in the
|
||
bibliography of ePrint 2018/707. This library does not generate that key.
|
||
|
||
**Used in** [First program](@ref basics) · [Evaluation](@ref evaluation)
|
||
|
||
### Half-Tree {#bib_halftree}
|
||
|
||
Xiaojie Guo, Kang Yang, Xiao Wang, Wenhao Zhang, Xiang Xie, Jiang Zhang, and Zheli Liu.
|
||
*Half-Tree: Halving the Cost of Tree Expansion in COT and DPF.*
|
||
[ePrint 2022/1431](https://eprint.iacr.org/2022/1431) ·
|
||
<a href="guo-yang-wang-zhang-xie-zhang-liu-half-tree-eprint-2022-1431.pdf">PDF</a>
|
||
|
||
`prg::aes128_ccr` selects their dealer point-key expand. Section 5.2 is
|
||
a different object: two-party key generation in the COT/OLE hybrid.
|
||
|
||
**Used in** [First program](@ref dpf_trees) · [Evaluation](@ref evaluation) · [Guided tour](@ref tour_trees)
|
||
|
||
### Information-theoretic DPF {#bib_itdpf}
|
||
|
||
Elette Boyle, Niv Gilboa, Yuval Ishai, and Victor I. Kolobov.
|
||
*Information-Theoretic Distributed Point Functions.*
|
||
[ePrint 2023/028](https://eprint.iacr.org/2023/028) ·
|
||
<a href="boyle-gilboa-ishai-kolobov-it-dpf-eprint-2023-028.pdf">PDF</a>
|
||
|
||
A statistically private 3-server DPF. `make_it_dpf3` is the additive
|
||
interface on a `uint8_t` domain, not the 2-party PRG key.
|
||
|
||
**Used in** [Multiparty](@ref multiparty) · [Three-server PIR](@ref app_pir3) · [Evaluation](@ref it_dpf3)
|
||
|
||
### Distributed point functions (2014) {#bib_dpf2014}
|
||
|
||
Niv Gilboa and Yuval Ishai.
|
||
*Distributed Point Functions and Their Applications.*
|
||
EUROCRYPT 2014, LNCS 8441, pp. 640–658.
|
||
<a href="https://doi.org/10.1007/978-3-642-55220-5_36">Publisher</a>
|
||
|
||
Two-server keyword PIR from a point function on the keyword.
|
||
|
||
**Used in** [Keyword PIR](@ref app_keyword)
|
||
|
||
## Generation and oblivious transfer {#bib_sec_ot}
|
||
|
||
### Scaling ORAM {#bib_ds}
|
||
|
||
Jack Doerner and abhi shelat.
|
||
*Scaling ORAM for Secure Computation.*
|
||
ACM CCS 2017, pp. 523–535.
|
||
[ePrint 2017/827](https://eprint.iacr.org/2017/827) ·
|
||
<a href="doerner-shelat-scaling-oram-eprint-2017-827.pdf">PDF</a>
|
||
|
||
The per-level correction-word opening. `geneval_*` uses that opening on
|
||
the public query and does not return their reusable key. Floram's secret
|
||
read and write are the same opening.
|
||
|
||
**Used in** [Dealer-free keygen](@ref dealer_free) · [Guided tour](@ref tour_ds) · [Floram](@ref app_floram)
|
||
|
||
### IKNP OT extension {#bib_iknp}
|
||
|
||
Yuval Ishai, Joe Kilian, Kobbi Nissim, and Erez Petrank.
|
||
*Extending Oblivious Transfers Efficiently.*
|
||
CRYPTO 2003, LNCS 2729, pp. 145–161.
|
||
<a href="https://doi.org/10.1007/978-3-540-45146-4_9">Publisher</a>
|
||
|
||
The semi-honest OT extension `dpf::iknp::sample` follows: κ base OTs,
|
||
then a correlation-robust hash of the transposed matrix. IKNP is these
|
||
four authors.
|
||
|
||
**Used in** [Dealer-free keygen](@ref dealer_free) · [Guided tour](@ref tour_iknp)
|
||
|
||
### Simplest OT {#bib_chou}
|
||
|
||
Tung Chou and Claudio Orlandi.
|
||
*The Simplest Protocol for Oblivious Transfer.*
|
||
LATINCRYPT 2015. Full version:
|
||
[ePrint 2015/267](https://eprint.iacr.org/2015/267) ·
|
||
<a href="chou-orlandi-simplest-ot-eprint-2015-267.pdf">PDF</a>
|
||
|
||
The P-256 base OT under `dpf::iknp` (`base_sender` / `base_receiver`).
|
||
|
||
**Used in** [Guided tour](@ref tour_iknp)
|
||
|
||
### AES S-box circuit {#bib_boyar}
|
||
|
||
Joan Boyar and René Peralta.
|
||
*A depth-16 circuit for the AES S-box.*
|
||
[ePrint 2011/332](https://eprint.iacr.org/2011/332) ·
|
||
<a href="boyar-peralta-aes-sbox-eprint-2011-332.pdf">PDF</a>
|
||
|
||
The 32-AND SubBytes used by `party/oblivious_hash.hpp`
|
||
(`aes_bp::and_count = 32`).
|
||
|
||
**Used in** [Guided tour](@ref tour_iknp) · [Evaluation](@ref evaluation)
|
||
|
||
## Comparisons, proofs, and products {#bib_sec_cmp}
|
||
|
||
### Mixed-mode FSS {#bib_dcf}
|
||
|
||
Elette Boyle, Nishanth Chandran, Niv Gilboa, Divya Gupta, Yuval Ishai, Nishant Kumar, and Mayank Rathee.
|
||
*Function Secret Sharing for Mixed-Mode and Fixed-Point Secure Computation.*
|
||
EUROCRYPT 2021, LNCS 12697, pp. 871–900.
|
||
[ePrint 2020/1392](https://eprint.iacr.org/2020/1392) ·
|
||
<a href="boyle-chandran-gilboa-gupta-ishai-kumar-rathee-mixed-mode-fss-eprint-2020-1392.pdf">PDF</a>
|
||
|
||
The distributed comparison function, and Figure 3's one-DCF public interval.
|
||
|
||
**Used in** [Comparisons](@ref comparisons) · [Evaluation](@ref evaluation) · [Guided tour](@ref tour_dcf)
|
||
|
||
### Verifiable FSS {#bib_vdpf}
|
||
|
||
Leo de Castro and Antigoni Polychroniadou.
|
||
*Lightweight, Maliciously Secure Verifiable Function Secret Sharing.*
|
||
EUROCRYPT 2022, pp. 150–179.
|
||
[ePrint 2021/580](https://eprint.iacr.org/2021/580) ·
|
||
<a href="de-castro-polychroniadou-verifiable-fss-eprint-2021-580.pdf">PDF</a>
|
||
|
||
The 4λ-bit correction seeds and 2λ-bit proof token, and §4's κ = 3
|
||
cuckoo packing. `make_multipoint` follows this GGM multi-point.
|
||
S&P 2025 (Boyle, Gilboa, Hamilis, Ishai, and Tu) packs those bucket
|
||
keys from a PCG seed. That packing is not a `multipoint_params` tweak
|
||
and is not implemented here.
|
||
|
||
**Used in** [Verifiability](@ref verifiability) · [Multipoint](@ref multipoint_keys) · [Keyword PIR](@ref app_keyword) · [PSI](@ref app_psi)
|
||
|
||
### ABY2.0 {#bib_aby2}
|
||
|
||
Arpita Patra, Thomas Schneider, Ajith Suresh, and Hossein Yalame.
|
||
*ABY2.0: Improved Mixed-Protocol Secure Two-Party Computation.*
|
||
USENIX Security 2021. Full version:
|
||
[ePrint 2020/1225](https://eprint.iacr.org/2020/1225) ·
|
||
<a href="patra-schneider-suresh-yalame-aby2-eprint-2020-1225.pdf">PDF</a>
|
||
|
||
One public reconstruction per newly opened wire.
|
||
|
||
**Used in** [Beaver triples](@ref beaver_triples) · [Guided tour](@ref tour_beaver)
|
||
|
||
### Beaver triples {#bib_beaver}
|
||
|
||
Donald Beaver.
|
||
*Efficient Multiparty Protocols Using Circuit Randomization.*
|
||
CRYPTO 1991, LNCS 576, pp. 420–432.
|
||
<a href="https://doi.org/10.1007/3-540-46766-1_34">Publisher</a>
|
||
|
||
The two-opening product triple, not the ABY2.0 session.
|
||
|
||
**Used in** [Beaver triples](@ref beaver_triples) · [Guided tour](@ref tour_beaver)
|
||
|
||
### Bit commitment {#bib_naor}
|
||
|
||
Moni Naor.
|
||
*Bit Commitment Using Pseudorandomness.*
|
||
Journal of Cryptology 4(2), 1991, pp. 151–158.
|
||
<a href="https://doi.org/10.1007/BF00196774">Publisher</a>
|
||
|
||
`dpf::ppvc` binds each DPF root with this string commitment:
|
||
`G(r) XOR A*rho`, under a public matrix `A`.
|
||
|
||
**Used in** [Programmable vectors](@ref ppvc_manual)
|
||
|
||
## Three evaluators {#bib_sec_three}
|
||
|
||
### Three-party DPF {#bib_dpf3}
|
||
|
||
Guy Zyskind, Avishay Yanai, and Alex "Sandy" Pentland.
|
||
*High-Throughput Three-Party DPFs with Applications to ORAM and Digital Currencies.*
|
||
[ePrint 2024/1658](https://eprint.iacr.org/2024/1658) ·
|
||
<a href="zyskind-yanai-pentland-three-party-dpf-eprint-2024-1658.pdf">PDF</a>
|
||
|
||
Figure 3: each evaluator key is a pair of (2,2)-VDPF+ keys.
|
||
|
||
**Used in** [Multiparty](@ref multiparty) · [Guided tour](@ref tour_dpf3) · [Three-server PIR](@ref app_pir3) · [(2,3) ledger](@ref app_ledger23)
|
||
|
||
## Grotto {#bib_sec_grotto}
|
||
|
||
### Grotto {#bib_grotto}
|
||
|
||
Kyle Storrier, Adithya Vadapalli, Allan Lyons, and Ryan Henry.
|
||
*Grotto: Screaming fast (2+1)-PC for Z<sub>2<sup>n</sup></sub> via (2,2)-DPFs.*
|
||
[ePrint 2023/108](https://eprint.iacr.org/2023/108) ·
|
||
<a href="storrier-vadapalli-lyons-henry-grotto-eprint-2023-108.pdf">PDF</a>
|
||
|
||
Prefix parity along one key, and Appendix D's degree-0 exact tables.
|
||
Offset Horner is not that piecewise-polynomial construction.
|
||
|
||
**Used in** [Grotto](@ref jet_and_ring) · [Guided tour](@ref tour_grotto)
|
||
|
||
## Protocols {#bib_sec_protocols}
|
||
|
||
### Duoram {#bib_duoram}
|
||
|
||
Adithya Vadapalli, Ryan Henry, and Ian Goldberg.
|
||
*Duoram: A Bandwidth-Efficient Distributed ORAM for 2- and 3-Party Computation.*
|
||
USENIX Security 2023.
|
||
<a href="https://www.usenix.org/conference/usenixsecurity23/presentation/vadapalli">USENIX</a>
|
||
|
||
The 3-party read and update: unit DPFs at a random index, a cyclic
|
||
shift by the opened offset, and a dot product with the memory.
|
||
|
||
**Used in** [3-party Duoram](@ref app_duoram)
|
||
|
||
### BitMore {#bib_bitmore}
|
||
|
||
Syed Mahbub Hafiz and Ryan Henry.
|
||
*A Bit More Than a Bit Is More Than a Bit Better.*
|
||
PoPETs 2019(4), pp. 112–131.
|
||
<a href="https://doi.org/10.2478/popets-2019-0061">Publisher</a>
|
||
|
||
Section 5.2 is the `2^L`-server query: `L` independent 1-bit DPFs,
|
||
one key per label bit.
|
||
|
||
**Used in** [BitMore](@ref app_bitmore)
|
||
|
||
### Prio {#bib_prio}
|
||
|
||
Henry Corrigan-Gibbs and Dan Boneh.
|
||
*Prio: Private, Robust, and Scalable Computation of Aggregate Statistics.*
|
||
NSDI 2017, pp. 259–282.
|
||
<a href="https://www.usenix.org/conference/nsdi17/technical-sessions/presentation/corrigan-gibbs">USENIX</a>
|
||
|
||
The frequency count is a one-hot encoding. `dpf::field64` is this
|
||
paper's Field64, via libprio.
|
||
|
||
**Used in** [Prio](@ref app_prio)
|
||
|
||
### Poplar {#bib_poplar}
|
||
|
||
Dan Boneh, Elette Boyle, Henry Corrigan-Gibbs, Niv Gilboa, and Yuval Ishai.
|
||
*Lightweight Techniques for Private Heavy Hitters.*
|
||
[ePrint 2021/017](https://eprint.iacr.org/2021/017)
|
||
|
||
The incremental DPF on prefixes of one secret string. EvaluateUntil is
|
||
`eval_until`. Mastic is this prefix walk with a weight payload.
|
||
|
||
**Used in** [Prio](@ref app_prio) · [I-DPF max and k-th](@ref app_idpf_agg) · [Mastic](@ref app_mastic) · [Guided tour](@ref tour_eval)
|
||
|
||
### Incremental aggregation {#bib_idpfagg}
|
||
|
||
Nan Cheng, Aikaterini Mitrokotsa, Feng Zhang, and Frank Hartmann.
|
||
*Efficient Two-Party Secure Aggregation via Incremental Distributed Point Function.*
|
||
[ePrint 2024/1190](https://eprint.iacr.org/2024/1190)
|
||
|
||
Communication tracks the bit length of the domain. The max and k-th
|
||
walks are `idpf_agg_max` and `idpf_agg_kth`.
|
||
|
||
**Used in** [I-DPF max and k-th](@ref app_idpf_agg)
|
||
|
||
### LLAMA {#bib_llama}
|
||
|
||
Kanav Gupta, Deepak Kumaraswamy, Nishanth Chandran, and Divya Gupta.
|
||
*LLAMA: A Low Latency Math Library for Secure Inference.*
|
||
[ePrint 2022/793](https://eprint.iacr.org/2022/793)
|
||
|
||
Offset comparison and spline gates.
|
||
|
||
**Used in** [LLAMA](@ref app_llama)
|
||
|
||
### Pika {#bib_pika}
|
||
|
||
Sameer Wagh.
|
||
*Pika: Secure Computation using Function Secret Sharing over Rings.*
|
||
PoPETs 2022(4), pp. 351–377.
|
||
<a href="https://doi.org/10.56553/popets-2022-0113">Publisher</a>
|
||
|
||
Figure 1 is the unit-DPF table lookup.
|
||
|
||
**Used in** [Pika](@ref app_pika)
|
||
|
||
### Express {#bib_express}
|
||
|
||
Saba Eskandarian, Henry Corrigan-Gibbs, Matei Zaharia, and Dan Boneh.
|
||
*Express: Lowering the Cost of Metadata-hiding Communication with Cryptographic Privacy.*
|
||
USENIX Security 2021, pp. 1775–1792.
|
||
<a href="https://www.usenix.org/conference/usenixsecurity21/presentation/eskandarian">USENIX</a>
|
||
|
||
Section 3.1 is the DPF mailbox write.
|
||
|
||
**Used in** [Express](@ref app_express) · [Sabre](@ref app_sabre)
|
||
|
||
### PRAC {#bib_prac}
|
||
|
||
Sajin Sasy, Adithya Vadapalli, and Ian Goldberg.
|
||
*PRAC: Round-Efficient 3-Party MPC for Dynamic Data Structures.*
|
||
[ePrint 2023/1897](https://eprint.iacr.org/2023/1897)
|
||
|
||
One incremental DPF replaces the `lg n` point keys of a binary search.
|
||
A wide leaf updates a heap node and both children.
|
||
|
||
**Used in** [PRAC](@ref app_prac)
|
||
|
||
### Splinter {#bib_splinter}
|
||
|
||
Frank Wang, Catherine Yun, Shafi Goldwasser, Vinod Vaikuntanathan, and Matei Zaharia.
|
||
*Splinter: Practical Private Queries on Public Data.*
|
||
NSDI 2017.
|
||
<a href="https://www.usenix.org/conference/nsdi17/technical-sessions/presentation/wang-frank">USENIX</a>
|
||
|
||
A unit DPF selects one public group. The server dots that selector with
|
||
a pre-aggregated column.
|
||
|
||
**Used in** [Splinter](@ref app_splinter)
|
||
|
||
### Waldo {#bib_waldo}
|
||
|
||
Emma Dauterman, Mayank Rathee, Raluca Ada Popa, and Ion Stoica.
|
||
*Waldo: A Private Time-Series Database from Function Secret Sharing.*
|
||
IEEE S&P 2022.
|
||
[ePrint 2021/1661](https://eprint.iacr.org/2021/1661)
|
||
|
||
Append-only unit DPFs, and a comparison inner product for a secret threshold.
|
||
|
||
**Used in** [Waldo](@ref app_waldo)
|
||
|
||
### Sabre {#bib_sabre}
|
||
|
||
Adithya Vadapalli, Kyle Storrier, and Ryan Henry.
|
||
*Sabre: Sender-Anonymous Messaging with Fast Audits.*
|
||
IEEE S&P 2022.
|
||
|
||
The write is Express's full-domain add. The audit is a verifiable DPF
|
||
proof instead of Express's `fp61` sketch.
|
||
|
||
**Used in** [Sabre](@ref app_sabre)
|
||
|
||
### Batched OPRF / PSI {#bib_kkrt}
|
||
|
||
Vladimir Kolesnikov, Ranjit Kumaresan, Mike Rosulek, and Ni Trieu.
|
||
*Efficient Batched Oblivious PRF with Applications to Private Set Intersection.*
|
||
ACM CCS 2016.
|
||
[ePrint 2016/799](https://eprint.iacr.org/2016/799)
|
||
|
||
Membership as an oblivious PRF. On this domain the PRF table is public
|
||
and each receiver element is a unit DPF.
|
||
|
||
**Used in** [Private set intersection](@ref app_psi)
|
||
|
||
### Private SUBLEQ {#bib_subleq}
|
||
|
||
Jiang and Henry.
|
||
MSc thesis, University of Calgary.
|
||
A subtract-and-branch instruction for private function evaluation.
|
||
The DPF work is a prepaid wildcard unit vector, rotated once the
|
||
address is opened.
|
||
|
||
**Used in** [MPC SUBLEQ](@ref app_subleq)
|