Topology-Hiding Communication from Minimal Assumptions

Abstract

Topology-hiding broadcast (THB) enables parties communicating over an incomplete network to broadcast messages while hiding the topology from within a given class of graphs. THB is a central tool underlying general topology-hiding secure computation (THC) (Moran et al. TCC’15). Although broadcast is a privacy-free task, it was recently shown that THB for certain graph classes necessitates computational assumptions, even in the semi-honest setting, and even given a single corrupted party. In this work, we investigate the minimal assumptions required for topology-hiding communication: both Broadcast or Anonymous Broadcast (where the broadcaster’s identity is hidden). We develop new techniques that yield a variety of necessary and sufficient conditions for the feasibility of THB/THAB in different cryptographic settings: information theoretic, given existence of key agreement, and given existence of oblivious transfer. Our results show that feasibility can depend on various properties of the graph class, such as connectivity, and highlight the role of different properties of topology when kept hidden, including direction, distance, and/or distance-of-neighbors to the broadcaster. An interesting corollary of our results is a dichotomy for THC with a public number of at least three parties, secure against one corruption: information-theoretic feasibility if all graphs are 2-connected; necessity and sufficiency of key agreement otherwise.

Appendices

Appendix A: UC Framework

We present a highly informal overview of the UC framework and refer the reader to [10] for further details. The framework is based on the real/ideal paradigm for arguing about the security of a protocol.

The real model An execution of a protocol $\pi$ in the real model consists of n ppt interactive Turing machines (ITMs) $\textsf{P} _1,\ldots ,\textsf{P} _n$ representing the parties, along with two additional ITMs: an adversary $\mathcal A$, describing the behavior of the corrupted parties and an environment $\mathcal Z$, representing the external network environment in which the protocol operates. The environment gives inputs to the honest parties, receives their outputs, and can communicate with the adversary at any point during the execution. It is known that security against the dummy adversary (that forwards every message it sees to the environment and acts according to the environment’s instructions) is sufficient to achieve security against arbitrary adversaries. Throughout, we consider synchronous protocols that proceeds in rounds (this can be formally modeled using the functionality [10], or using the synchronous framework of [23]) and semi-honest (passive) security (where corrupted parties continue following the protocol, but reveal their internal state to the adversary). We will consider both static corruptions (where $\mathcal A$ chooses the corrupted parties at the onset of the protocol) and adaptive corruptions (where $\mathcal A$ can dynamically corrupt parties based on information gathered during the computation), and will explicitly mention at any section which type of corruptions are considered. An t-adversary can corrupt up to t parties during the protocol.

The ideal model A computation in the ideal model consists of n dummy parties $\tilde{\textsf{P}}_1,\ldots ,\tilde{\textsf{P}}_n$, an ideal-model adversary (simulator) $\textsf {Sim}$, an environment $\mathcal Z$, and an ideal functionality . As in the real model, the environment gives inputs to the honest (dummy) parties, receives their outputs, and can communicate with the ideal-model adversary at any point during the execution. The dummy parties act as channels between the environment and the ideal functionality, meaning that they send the inputs received from $\mathcal{Z}$ to and vice versa. The ideal functionality defines the desired behavior of the computation. receives the inputs from the dummy parties, executes the desired computation, and sends the output to the parties. The ideal-model adversary does not see the communication between the parties and the ideal functionality; however, $\textsf {Sim}$ can corrupt dummy parties (statically or dynamically) and may communicate with according to its specification.

Security definition We present the definition for static and semi-honest adversaries.

We say that a protocol $\pi$ UC-realizes (with computational security) an ideal functionality in the presence of static semi-honest t-adversaries, if for any ppt static semi-honest t-adversary $\mathcal{A}$ and any ppt environment $\mathcal{Z}$, there exists a ppt ideal-model t-adversary ${\textsf {Sim}}$ such that the output distribution of $\mathcal{Z}$ in the ideal-model computation of with $\textsf {Sim}$ is computationally indistinguishable from its output distribution in the real-model execution of $\pi$ with $\mathcal A$.

We say that a protocol $\pi$ UC-realizes (with information-theoretic security) an ideal functionality if the above holds even for computationally unbounded $\mathcal A$, $\mathcal Z$, and $\textsf {Sim}$. In that case, the requirement is for the output distribution of $\mathcal{Z}$ in the ideal-model computation to be statistically close to its output distribution in the real-model execution. If the environment’s outputs are identically distributed, we say that $\pi$ UC-realizes with perfect security.

The hybrid model The -hybrid model is a combination of the real and ideal models, it extends the real model with an ideal functionality . The parties communicate with each other in exactly the same way as in the real model; however, they can also interact with as in the ideal model. An important property of the UC framework is that the ideal functionality in an -hybrid model can be replaced with a protocol that UC-realizes . The composition theorem of Canetti [10] states the following.

Theorem A.1

([10], informal) Let $\rho$ be a protocol that UC-realizes in the presence of adaptive semi-honest t-adversaries, and let $\pi$ be a protocol that UC-realizes in the -hybrid model in the presence of adaptive semi-honest t-adversaries. Then, for any ppt adaptive semi-honest t-adversary $\mathcal{A}$ and any ppt environment $\mathcal{Z}$, there exists a ppt adaptive semi-honest t-adversary ${\textsf {Sim}}$ in the -hybrid model such that the output distribution of $\mathcal{Z}$ when interacting with the protocol $\pi$ and $\textsf {Sim}$ is computationally indistinguishable from its output distribution when interacting with the protocol $\pi ^\rho$ (where every call to is replaced by an execution of $\rho$) and $\mathcal A$ in the real model.

Appendix B: DC-Nets are Topology-Hiding: From THB to THAB

In this section, we show that t-THB implies t-THAB with respect to classes of n-node graphs that are $(t+1)$-connected. Recall that in Sects. 5.1 and 6.2 we showed a separation between t-THB and t-THAB over non- $(t+1)$-connected graphs.

Our starting point is the Dining-Cryptographers Network that was introduced by Chaum [12] with the aim of transforming a broadcast primitive into an anonymous broadcast channel, secure in the semi-honest setting. The procedure works as follows on a (public, connected) incomplete network of point-to-point secure channels, where an anonymous party holds as input a bit $b_{\textsf{BC}}$ to be broadcast and all other parties hold a dummy input bit set to zero. Each party starts by sending a random message to each of its neighbors and keeps the sum of all these outgoing messages. Each party then adds to this sum the messages it received in the previous round, one per neighbor. This new sum is now used as a one-time pad to mask the party’s input; we call this ciphertext the party’s randomized input. These randomized inputs sum to the broadcast bit. Note that the key observation is that so long as a passive adversary cannot corrupt a vertex-cut of the graph, the adversary learns nothing (other than the value of $b_{\textsf{BC}}$) about the honest parties’ inputs, even if additionally given the list of randomized inputs. It is therefore safe for the parties to broadcast their randomized inputs to reconstruct the output $b_{\textsf{BC}}$.

Correctness follows by inspection. Let us recall the high-level idea of why the broadcaster is anonymous. Consider any non-empty proper subset of the vertices $S\subset V$ such that the union of their closed neighborhoods is connected. At the end of the input randomization phase, the partial sum of the inputs in S (i.e.,  the indicator of the event “the broadcaster is in S”) is secret shared among the randomized inputs of S and the shares the parties in S sent to the parties in $V\setminus S$. Therefore to learn anything about the partial sum of the inputs in S, the adversary has to corrupt the set Z of vertices at the frontier of S, i.e.,  the vertices in $V\setminus S$ which are neighbors of S. Given any set Z of at most t corruptions, the adversary can isolate the set of players $S=V\setminus Z$, but no other one because the graph is $(t+1)$-connected. For this specific set, the adversary is not learning anything he should not as he knows if the broadcaster is corrupted or not, i.e.,  in Z or in S.

We make the simple observation that if the underlying broadcast primitive is topology hiding, and if the number and identity of the parties participating in the protocol is publicly known (so they have a way of knowing in which order they can broadcast the randomized inputs), then the anonymous broadcast protocol is topology hiding. Indeed, the input randomization phase is purely information local and cannot leak the topology of the graph, while the reconstruction phase inherits the topology-hiding properties of the broadcast primitive used.

Recall that for $n\in {\mathbb {N}}$ we denote by the class of connected graphs with exactly n nodes.

Theorem B.1

Let $n\in {\mathbb {N}}$, and let be a class of $(t+1)$-connected graphs. Then, the existence of a t-THB protocol with respect to ${\mathcal {G}}$ implies a t-THAB protocol with respect to ${\mathcal {G}}$.

Remark B.2

Note that Theorem B.1 can be strengthened in two ways. Firstly, if a slight variation on the DC-net protocol is run on an arbitrary class of $(t+1)$-connected graphs (where the set of players/vertices is not known a priori), then correctness and privacy of input are still guaranteed and the only leakage³⁰ about the topology is the set of players participating in the protocol. In fact it can be strengthened, so only the number of players participating in the protocol is leaked. Secondly, if the parties set their input arbitrarily (rather than all non-broadcasters setting theirs to 0), the DC-net protocol actually constructs a t-secure sum protocol from a broadcast primitive, which is also topology-hiding.

Appendix C: Statistically Secure, Round-Inefficient THB on Oriented-5-Path

In this appendix, we justify our remark that the class from Sect. 4.1 admits an unconditionally $\varepsilon$-statistically 1-secure $1/\varepsilon$-round topology-hiding broadcast protocol, via a more general lemma. In particular, we observe that the following delayed-flooding protocol is $\varepsilon$-statistically secure for any graph class for which the flooding protocol can be simulated given distance (i.e.,  only distance need be hidden).³¹ The core idea is quite straightforward: If the usual flooding protocol only leaks distance (via the round in which the broadcast bit is received), then by simply having the broadcaster delay flooding for a random number of rounds, this leakage is diluted.

Fig. 33

$\varepsilon$-Delayed Flooding Protocol: A simple, inefficient, distance-hiding broadcast protocol

Lemma C.1

Let $0<\varepsilon \le 1$. Let ${\mathcal {G}}$ be a class of graphs such that each node can always deduce a unique neighbor through which they are connected to the broadcaster and let d be an upper bound on distance of any node from .³²

Then, the $\varepsilon$-Delayed Flooding Protocol (defined in Fig. 33) is an $\varepsilon$-statistically 1-secure topology-hiding broadcast protocol with round complexity $d(1+1/\varepsilon )$.

Proof

Let $\Delta = d/\varepsilon$ be the upper bound on the random delay, and let $R=d/\varepsilon +d$ be the upper bound on round complexity, as defined in Fig. 33.

We begin by observing that the $\varepsilon$-Delayed Flooding Protocol will deliver the broadcast message to all nodes because for any choice of delay $r\in [\Delta ]$, since $r+ d \le R$. (Recall d is an upper bound on the distance from the broadcaster.) So, the protocol is, in fact, perfectly correct.

It remains to show $\varepsilon$-statistical security. Let v be the corrupt node with neighborhood ${\mathcal {N}(v)}$. By the properties of ${\mathcal {G}}$, this means that there exists a fixed $u\in {\mathcal {N}(v)}$ such that u is a bridge to in all graphs $G\in {\mathcal {G}}$ such that $\mathcal {N}_{G}(v) ={\mathcal {N}(v)}$.

Because the protocol follows the same message pattern as the naïve flooding protocol and ${\mathcal {G}}$ consists of trees, we can represent the distribution of the view of v on any graph $G\in {\mathcal {G}}$ as the tuple $p(G)=(p_1(G),\ldots ,p_{R}(G))$ where $p_i$ is the probability v receives the broadcast message in round i (for $i\in [R]$) and $p_\bot$ is the probability v sees nothing.

Observe that if v is distance $d_v$ from in any graph $G\in {\mathcal {G}}$, the view of v in G is simply the broadcast message at round $r_v=r+d_v$, where r is a random variable distributed uniformly over $[\Delta ]$. Thus, we have that $p_1(G)=\cdots =p_{d_v}(G)=p_{\Delta -(d-d_v)+1}(G)=\cdots =p_{\Delta }(G)=0$, and that $p_{d_v+1}(G)=\cdots =p_R(G)=1/(\Delta -(d-d_v))$.

The simulator ${\textsf {Sim}}$ works by sampling $r\leftarrow [\Delta ]$ and sending the broadcast message m in round $r+d/2$ from the neighbor u, specified above. We can write the distribution of the simulated view as the tuple $\tilde{p}=(\tilde{p}_1,\ldots ,\tilde{p}_R,\tilde{p}_\bot )$ where $\tilde{p}_1=\cdots =\tilde{p}_{d/2}=\tilde{p}_{R-d/2+1}=\cdots =\tilde{p}_{R}=0$ and $\tilde{p}_{d/2+1}=\cdots =\tilde{p}_{R-d/2}=1/\Delta$.

Thus, we can explicitly compute the statistical difference as $\frac{|d/2-d_v|}{\Delta }\le \frac{d/2}{\Delta } \le \varepsilon /2$. We can therefore deduce that under the simulation notion we have security $\varepsilon /2$ and under the indistinguishability-based definition (Definition 2.4), we have statistical security $\varepsilon$.

$\square$