{"attributeAssertions":[{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-00EC02811BB632","locator":"Figure 3, step 4, p. 11","note":"The receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":"one"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-00FD3748D0CD50","locator":"§1, p. 1; §2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"unbalanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-0122EDCA2BE06F","locator":"Figure 3, p. 15","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":["intersection"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-0141537FD0DECF","locator":"§1.1, p. 2; §2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":["semi_honest"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-017ADC6754C058","locator":"§2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-029760F9D2960D","locator":"abstract, p. 1; §6, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-02C24313F40676","locator":"Table 2, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":"balanced"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-033A1A4F79598C","locator":"§2.3, pp. 4–5; §3.1, p. 12","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":["Ring-LWE","One-More-Gap-DH"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-038A0ADEB7CC98","locator":"§5.1, pp. 10-11; footnote 11, p. 11","note":"A malicious server cannot affect the client's privacy here, the paper notes, but can break correctness","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":{"receiver":"malicious","sender":"semi_honest"}},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-03A637ECAEB290","locator":"Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":["intersection"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-03DCD5DD1B12DF","locator":"Figure 6, p. 37","note":"OPRF outputs of \\( \\lambda + \\log n_X + \\log n_Y \\) bits","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":["semi_honest"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-03E95B45F78D27","locator":null,"note":"No proof is given.","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"not_reported"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-04A697B1ABFD62","locator":"§2.3, p. 6; Theorem 2, p. 10; §7.2, p. 17","note":"IND-CPA additively homomorphic encryption, instantiated by Paillier or Damgård–Jurik; passively secure OLE","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":["DCR"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-04E06F022E16ED","locator":"§7.3, p. 17","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"unbalanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-04F9FBD16981DE","locator":"Protocol 3, Output, p. 22","note":"P2 only","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":"one"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-04FFA55C801E8B","locator":"§5, Security, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-05F0252D693B78","locator":"§5, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"balanced"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-05FD95E6A8CCB5","locator":"Theorem 7.1, p. 28; Theorem 5.4, p. 21","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-06217D533CA8DB","locator":"Table 2, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":"balanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-062246BD8979B7","locator":"Theorem 4, p. 14; Lemma 4, p. 14","note":"UC in the plain model; the cardinality test, noisy addition and OLE hybrids are functionalities, not models","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":["standard model"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-067156A753FF59","locator":"§2, p. 3","note":"Both sets padded to a known common size","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-08BDCF4C572A2C","locator":"§2.3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"multiparty"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-08E577EB303AC1","locator":"§2, p. 3","note":"Both sets padded to a known common size","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-09115AA64EEE9E","locator":"§2, p. 2","note":"The client; mutual PSI by two one-way runs","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":"one"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-092013DEBC723D","locator":"§3.1, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":["diffie_hellman","additively_homomorphic_encryption"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-092269FDE3C91F","locator":"Figure 6, p. 37","note":"OPRF outputs of \\( \\lambda + \\log n_X + \\log n_Y \\) bits","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":["semi_honest"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-09447797B2322F","locator":"Figure 10, step 4, p. 16","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":["intersection"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-096648DF3ACBF2","locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":["LPN"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-0976748198DD0A","locator":"§2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"one"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-09A8BF6BA424AA","locator":"§7.1, Two-party case, p. 29; §2.3, p. 6","note":"The functionality gives every party the output; the two-party protocol has only Alice decrypt and interpolate","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":"one"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-09B792CD0D506B","locator":"Abstract, p. 1; Figure 1, p. 5; Corollary 3, p. 10","note":"The intersection when the symmetric difference is small, else nothing","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":["threshold"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-0ABB195D8EDD51","locator":"Theorem 6.5, p. 27; Theorem 7.1, p. 28","note":"UC in a star network; the singularity and cardinality tests are hybrids, not models","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":["standard model"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-0B192882742EA9","locator":"§6.3, p. 17","note":"Argued in prose for each colluding pair; no theorem","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":["semi_honest"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-0B5F1D0BD96B51","locator":"§4.4, p. 15","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-0B7CFF21CA785B","locator":"§6.2.1, p. 26; Tables 12–13, pp. 30–31","note":"Also run on unequal sets, without exploiting the imbalance","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-0BCE4020A91A27","locator":"Appendix A, step 5, p. 85","note":null,"subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"all"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-0BD310BF8E4FFA","locator":"§3.2, p. 4; §4.3, pp. 8-9","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":["semi_honest"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-0C1284056FFBA0","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-0CA8000F58CA77","locator":"§2.6, p. 10; §6.1, p. 26; Corollary 7.2, p. 28","note":"Threshold ElGamal or Paillier, as stated, though exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts; a PRG in NC1 for the test","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":["DDH","DCR","PRG"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-0CB6ED66A379C2","locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18; Theorem 4.1, p. 20","note":"In the F_vole-hybrid model, a hybrid model; covered by the malicious proofs, whose simulators program H","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":["programmable random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-0CFB44C61539FE","locator":"Appendix A, p. 85","note":"Without permutation in steps 3 and 4 each party learns exactly which items are shared","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":["intersection"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-0D07346813A0CD","locator":"Theorem 7.1, p. 28","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":["semi_honest"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-0D82E1DD4A8336","locator":"Theorem 3, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":["malicious"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-0EF5238532E81D","locator":"§6.4, p. 16; Figure 9, p. 27; Appendix A, p. 26","note":"Tags and decommitment keys come from a PRF; commitments and the encodings rest on random oracles","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":["PRF"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-0FAD462992FC1C","locator":"§5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-10979B996943C4","locator":"§3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":"two_party"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-109A3C0947529A","locator":"§3.1, p. 3","note":"The client","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":"one"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-1139D03C5D6FD7","locator":"Figure 10, p. 39","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-118F7F3FA14F84","locator":"Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"balanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-12EBE1968C21B4","locator":"Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-139226C0721008","locator":"Functionality 2.1, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":["intersection"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-13B08D966E0C47","locator":"Figure 5, p. 39; Appendix B.5, p. 35","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-13B110C6F05176","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-1405566C521933","locator":"§2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":["random oracle"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-141719D2D771CC","locator":"Theorem 4, p. 10; §7.1, p. 22","note":"No hardness assumption is named beyond the random oracles; OOS and its base OTs are taken as given","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":"not_reported"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-15312B97B1558E","locator":"§2.1, p. 4; Corollary 6, p. 16","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-154533991037F9","locator":"Figure 10, p. 16","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-155586E9D5B7F3","locator":"Protocol 4.4, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"multiparty"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-161689F209DE9C","locator":"Abstract, p. 1","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"unbalanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-16822573BAF240","locator":"Appendix B, pp. 29–31; §7.1, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":["paxos","ot_extension"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-1684CEB342CDFD","locator":"§4, pp. 9-10; §5, pp. 10-13","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","secret_sharing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-1791F791BCEFF7","locator":"Appendix D, p. 33; Theorem 4, p. 10","note":"Claimed without a separate proof; the proof given is the malicious random-oracle one, with OOS as an ideal functionality","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":["standard model"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-17B4E8E77D8ECD","locator":"Figure 5, p. 24","note":"The receiver.","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":"one"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-17EFA38D0E4741","locator":"§4.2, p. 13","note":"Per-bin match results stay inside the generic protocol; both parties learn only the output of f.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"shared"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-18265406D2A555","locator":"§3, p. 4","note":"Computed as the bit-vector of the intersection","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-18BB21B8FA30F6","locator":"Appendix A, step 5, p. 85","note":"Each party counts the matches between the doubly exponentiated, permuted lists","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":["cardinality"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-19AB43B1778682","locator":"Appendix B.3, p. 16","note":"One-More-RSA, which has no registry card; the RSA assumption is weaker than the one used","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":["one-more RSA"]},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-1A20CCB7537BC1","locator":"§6.3, p. 17; Table 4, p. 18; §7.2, p. 19","note":"Three parties, any two colluding","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":"\\( t_c \\le 2 \\)"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-1B125041A879B5","locator":"Figure 5, p. 24; §3.2, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":["key_agreement","diffie_hellman"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-1BB80BEF06BC73","locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":["circuit"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-1BC80CB7A695ED","locator":"§3.3, p. 5; §4.4, p. 9","note":"The Naor-Reingold PRF over P-256; no proof is given, and no underlying assumption is named.","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":["PRF"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-1BFCC47D1D4F9D","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":["intersection"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-1D63211C5DC564","locator":"Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-1D75E1650EB220","locator":"Figure 6, p. 26","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":"balanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-1D8A9D21363FB5","locator":"Figure 5, p. 18; Figure 10, p. 41","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":["threshold_fhe","additively_homomorphic_encryption","set_reconciliation"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-1D9C5A75BED2B7","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-1DE541F17596F5","locator":"Figure 2, p. 6; Figure 4, p. 11","note":"The receiver.","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":"one"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-1F3B0F033B9589","locator":"Theorem 1, p. 12; §3.1, p. 4; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":["PRF","CR hash"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-1F81B5FE0A1115","locator":"§3.1, pp. 6–12; §4.2, pp. 13–14","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-1F8F9221E93931","locator":"Figure 2, p. 10","note":"The client.","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"one"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-1FCAB3792F4675","locator":"§2, p. 6; §5.4, p. 18","note":"The authors see no extension to malicious adversaries.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":["semi_honest"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-1FFEA490BE7FA9","locator":"§3.2, pp. 14–16; Figure 4, p. 36","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":["batched_oprf","vole","paxos"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-207CC2C3F263AF","locator":"RS21 Theorem 5.1, p. 21; §4, p. 23","note":"Inherited from the VOLE-PSI circuit-PSI, with the OKVS in its doubly oblivious form","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":["programmable random oracle"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-217123868DC1B2","locator":"Theorem 7.1, p. 28; §1.2, p. 4","note":"The two-party case of the multiparty theorem; no separate theorem is given","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":["semi_honest"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-21894BD02F8C07","locator":"Theorems 1–2, pp. 15–16; Figure 3, p. 15","note":"One-sided simulation against the receiver; the theorems cover the unlabeled functionality; no labeled functionality is stated","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-2297906E51A221","locator":"§6.1, p. 26; §7.1, p. 29","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":["additively_homomorphic_encryption","garbled_circuits","polynomial_sparsity_test","set_reconciliation"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-23842D21555B70","locator":"§3, pp. 13–16; Figure 4, p. 36","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":["batched_oprf","vole","paxos"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-23C217C01FC23C","locator":"Figure 9, p. 27","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-23FDF6DE1CA652","locator":"Lemma 1, p. 4; §7.1, p. 22","note":"Code correlation robustness; OOS and its base OTs are taken as given","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":["CR hash"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-240740D2A687F8","locator":"Figure 2, p. 14","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-2515C5682CB5AF","locator":"§4.4, p. 9","note":"Security follows from that of the base protocol, the paper says","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":["semi_honest"]},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-25F31AD4514165","locator":"Theorem 7.1, p. 28","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"\\( t_c < \\ell \\)"},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-261CC24894A70B","locator":"§1.2, p. 4; Theorem 3.4, p. 8; §3.2.1, p. 8","note":"No collusion; two colluding parties, such as the key dealer and the pivot, break it","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"\\( t_c \\le 1 \\)"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-26242F36FD29EB","locator":"Figure 2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":"two_party"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-264E7D7BB64E0E","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-2697B279D58368","locator":"Figure 3, step 4, p. 11","note":"The receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":"one"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-274667BFAC7457","locator":"§6.1–6.2, pp. 10–12; Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":["dual_execution","ot_extension","simple_hashing","permutation_based_hashing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-27865A51FFD01F","locator":"§5, Security, p. 23; §2.1, p. 8; §2.2.2, p. 10","note":"Proved with an ideal random 1-out-of-N OT, a hybrid model; its random-OT extension models the hash as a random oracle","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":["random oracle"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-2803EDF9C9D04D","locator":"Appendix A, p. 85","note":"No proof is given for the protocol","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"not_reported"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-28189E8376D9F3","locator":"Theorem 8, p. 15; §4.1, p. 17","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":["standard model"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-28937082F91154","locator":"§6.1, p. 14","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"multiparty"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-28986C500DDB29","locator":"Figure 1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":["cardinality","sum"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-28DF91C3B57850","locator":"§2.2, p. 4","note":"Built for a receiver set much smaller than the sender set; it runs unchanged on any sizes","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"unbalanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-2927BB7351AEC0","locator":"Figures 1–2, pp. 13–14; §5.2, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-292DDB8F3EAAE5","locator":"§4, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":["batched_oprf","vole","okvs"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-2A7697A66F626F","locator":"Figure 4, p. 12; §6.7, pp. 17–18","note":"Bob only","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":"one"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-2B0DA503D95E04","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-2B1F14324EDFC0","locator":"Protocol 10, p. 20","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":"shared"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-2B514E83DA6ACD","locator":"Figure 3, p. 13","note":null,"subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-2BB71977104803","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":["intersection"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-2BBA24BAFDEE1E","locator":"Theorem 6, p. 9; §5.2, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":["semi_honest"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-2BE9CBC2DB0A7C","locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":"one"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-2C08F5E100AA48","locator":"Figure 1, p. 3; §4.3.1, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":["cardinality","sum"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-2C11B041BB65FD","locator":"Theorem 3.4, p. 8; §1.2, p. 4; Appendix A, pp. 13-14","note":"The two-party PSI is an ideal functionality in the proof; Kamara et al.'s instantiation needs only a PRF, and no OT is used","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":["PRF"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-2CC78125370BDA","locator":"Protocol 3, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":["intersection"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-2DA224145CC413","locator":"§2, p. 2","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":"two_party"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-2DA9AFCABBAB53","locator":"§4, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"multiparty"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-2DC843E5C19A6A","locator":"§2.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-2DECFAD676E45E","locator":"Figure 2, p. 6; Theorems 1–2, p. 6","note":"P1 learns the cardinality; P2 learns the intersection-sum.","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"all"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-2E6F2B7EC25825","locator":"Appendix A, p. 85","note":null,"subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-2E86467236FC68","locator":"§3, p. 6; §3.1, p. 12","note":"Hash to the FourQ curve and OPRF output hash","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":["random oracle"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-2F220DFD48F5FB","locator":"§6.4, pp. 15–16; Figure 9, p. 27","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":["encode_commit","ot_extension","simple_hashing","permutation_based_hashing"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-3089F932951B49","locator":"Protocol PM-Malicious-Server, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":["oblivious_polynomial_evaluation"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-30A6446693E0D4","locator":"Theorem 4.5, p. 11","note":"Static corruption","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":["malicious"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-30B3385B3432EC","locator":"Theorems 3-4, pp. 9-10; Appendix E, p. 20","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":["semi_honest"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-30B40800238D46","locator":"Appendix E, pp. 20-21","note":"No idealized model in the proof, which assumes a random-OT functionality; hybrids are not models.","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":["standard model"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-31E4C65096170B","locator":"Imported Theorem 2.2, p. 9; Corollary B.2, p. 40","note":"Circular-secure LWE, as the corollary names; threshold AHE may run phase two, but exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":["LWE","circular security"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-3291D32FC681BD","locator":"§1, p. 2; §4, p. 23","note":"Both parties hold secret shares, as in the VOLE-PSI circuit-PSI","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":"shared"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-32AA0F67684776","locator":"§4.5, pp. 10-11; §5.1, pp. 11-12","note":"Argued in prose, without a proof","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":{"receiver":"malicious","sender":"semi_honest"}},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-32DE1EC993726C","locator":"Theorem 4, p. 10; §4.4, pp. 15–16","note":"A corrupt party may use a larger set, bounded through the hash output lengths","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":["malicious"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-32FE2F9A5216AE","locator":"Appendix B.3, p. 16; Table 2, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":["random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-3301D77A5C7932","locator":"Figure 1, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-3371F412F3D5E0","locator":"Figure 5, p. 39","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":["intersection"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-33B53646F3C2D9","locator":"Theorems 1–2, pp. 15–16; §4.3, p. 10","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":["Ring-LWE","One-More-Gap-DH"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-33FA365A543DE5","locator":"§2, p. 3","note":"Both sets padded to a known common size","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":"balanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-3447FA97BFA128","locator":"Abstract, p. 1; §4.3, pp. 8-9","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":["standard model"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-34CC6744283CE3","locator":"§3, pp. 5–6; §3.1, pp. 6–12","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-350E5D0F0F8FC1","locator":"Theorem 2, p. 11; Figure 4, p. 12","note":"Hash functions are sampled fresh for each run; the proof uses no random oracle","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":["standard model"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-35393C59F6F743","locator":"§6.3, p. 19","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-36BCDCD2307D43","locator":"§2, p. 3","note":"Either party, or both, may learn it, as for all the paper's protocols","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":"one"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-36CCCA2F25DAE8","locator":"§2.2, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":["semi_honest"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-371E2600563885","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-3780500B43F9F1","locator":"Protocol 4.4, p. 10; Theorem 4.3, p. 10; Theorem 4.5, p. 11","note":"PRF masks from the clients; the OPPRF and zero-sharing are ideal functionalities in the proof","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":["PRF"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-37D75D3A96BCF0","locator":"Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":"two_party"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-37F386D504CD64","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-3842816A614B36","locator":"Figure 2, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-388BFC85A31843","locator":"§2, p. 5; §5.2, p. 16","note":"Per-item match bits stay inside the generic protocol; both parties learn only the output of f.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"shared"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-38C3415755C265","locator":"§4, p. 6; §7, p. 18","note":"No hardness assumption is named; the encodings use OOS OT extension, proved with a programmable random oracle","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"not_reported"},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-398AE6D63F4E3A","locator":"§2.1, p. 4","note":"Static corruption of all but one party","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"\\( t_c < \\ell \\)"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-3CE533CE38BBF8","locator":"Figure 1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-3DB7413B9FB9D6","locator":"Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-3E0EDB18EAC6B0","locator":"§4.2, p. 8; §4.4, p. 9","note":"Costs grow with both sets, as in the base protocol","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-3E1FDDC74D48A5","locator":"§2, p. 3","note":"Either party, or both, may learn it, as for all the paper's protocols","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":"one"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-3E4203E9726973","locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":["LPN"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-3F854CC8D4144D","locator":"§7, p. 15","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":["semi_honest"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-40681D1223D9CD","locator":"§2, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-4073FAC60ED9F0","locator":"§4.3.2, p. 10; Appendix F, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":["semi_honest"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-40952043DC8348","locator":"Appendix B.2, p. 30; Table 4, p. 36","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":["oprf","okvs","vole","secret_sharing"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-4095DE16A85D33","locator":"§3, p. 6","note":"The earlier labeled-PSI proof carries over unchanged","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-41383339D82613","locator":"§2.2, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":["semi_honest"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-41BD1DA983E5C0","locator":"§2.1, p. 4; footnote 4, p. 3","note":"Standalone; the bucketing functions are random for simplicity and replaceable by public-key PRFs","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":["standard model"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-4362B22313F965","locator":"§6.3, p. 19","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-43AA5F45983141","locator":"§2, p. 4; §4, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":["garbled_circuits","ot_extension"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-445803C5C4279F","locator":"§2.3, p. 4; Theorems 1-2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":["semi_honest"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-459F0043BCE6FF","locator":"Figure 9, step 4, p. 27","note":"Bob only","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":"one"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-45DB6D0993A83D","locator":"§4, p. 23","note":"Receiver only, as in the VOLE-PSI protocol","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":"one"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-460AC2A77E2561","locator":"Figure 1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-461F48657FB8E3","locator":null,"note":"No proof is given; the protocol inherits the generic protocol's security.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"not_reported"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-47249F340BA4EB","locator":"§2.3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":"balanced"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-4780007F6499B7","locator":"§3.3, p. 5; §4.2, pp. 7-8","note":"LowMC is used as the PRF; no proof is given, and the OTs' assumptions are not named.","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":["PRF"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-48ACD8473AE5D5","locator":"§4, p. 23; Table 2, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":["opprf","batched_oprf","vole","okvs","cuckoo_hashing","simple_hashing"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-48B3D2D364FF8C","locator":"§2.1, p. 4; Theorem 2, p. 14","note":"The simulator may replace the corrupt parties' inputs; a later paper proves the same protocol malicious-secure","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":["augmented_semi_honest"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-48C938ABBE1FB9","locator":"Figure 1, p. 9; §5.2, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":["garbled_circuits","oprf","ot_extension","cuckoo_filter"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-4A4DA0D8BADEBB","locator":"Lemmas 5-7, pp. 10-14; §4.1, pp. 15-16","note":"UC security against either party; a corrupt receiver may use a somewhat larger set than advertised.","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":["malicious"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-4AE8C28301E067","locator":"§4.3, pp. 8-9; §4.4, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":["standard model"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-4B17BD55D429EA","locator":"Appendix A, p. 85","note":"The authors relate it to Diffie-Hellman key exchange","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":["diffie_hellman"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-4B53F9D2AD7648","locator":"Protocol 3.3, note a, p. 8; proof of Theorem 3.4, pp. 8-9","note":"The malicious variant hashes items with a random oracle; the two-party PSI hybrid is not a model","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":["random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-4BCC226131479E","locator":"§2.2, p. 4; §4.2, p. 14","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":["labeled"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-4C5117DF906773","locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18","note":"In the F_vole-hybrid model, a hybrid model; the simulators program H","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":["programmable random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-4C8F625E56491A","locator":"Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":["intersection"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-4D004940DAD263","locator":"§2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-4D4878B70B5195","locator":"Theorem 4.5, p. 11","note":"The ZeroXOR hybrid of the proof is not a model","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":["random oracle"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-4D5694908270E9","locator":"Abstract, p. 1; §2.4, p. 7; Lemma 5, p. 10","note":"The ideal permutation model with random oracles.","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":["random permutation","random oracle"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-4DBA72E1307312","locator":"§4.4, p. 9","note":"The client","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":"one"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-4E0C9AE76931C6","locator":"§2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":["random oracle"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-4F9AC183C679C7","locator":"§2, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-5006401AF93FDF","locator":"Figure 8, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-5168C006E294AE","locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":["PRF"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-51FC481DC316D3","locator":"§1, p. 1","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":"all"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-536E52B83CE130","locator":"§5.1, pp. 11-12; Appendix F, p. 22","note":"Exponential ElGamal and Ring-LWE as measured; the proof assumes any CPA-secure additively homomorphic scheme.","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":["DDH","Ring-LWE"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-53906C6928437A","locator":"§2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":["random oracle"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-53CC6C81736AC5","locator":"§1, p. 1","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"all"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-549C24FFBE6232","locator":"Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":["intersection"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-5526729B3AF108","locator":"§3.1, p. 5; Appendix D, p. 19","note":"The hash to the group is a random oracle that the simulator programs.","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":["programmable random oracle"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-55B4CE13A49A33","locator":"§4.1, pp. 9-11; §6.3, p. 19","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":["okvs","ot_extension"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-5691556EF25B1B","locator":"Figure 6, p. 9","note":"Alice; Bob receives nothing or, if desired, the sorted elements","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":"one"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-56CDA21139DA10","locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":["DDH"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-571985CABC2E14","locator":"Abstract, p. 1; Theorem 4, p. 10","note":"The OOS hybrid of the proof is not a model","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":["non-programmable random oracle"]},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-576EFA68C10264","locator":"Table 1, p. 3; §6.1, p. 14","note":"The comparison lists all but one party; the zero-sharing argument is written for \\( t_c < \\ell - 1 \\)","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"\\( t_c < \\ell \\)"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-5773B33AB52173","locator":"§5.6, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":["rsa_blind_signature"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-5899BBBAB4BF4E","locator":"§2.3, pp. 4–5; §3.1, p. 12","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":["Ring-LWE","One-More-Gap-DH"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-58B1C0779E1FE1","locator":"Functionality 2.1, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"balanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-58FC930573FEC5","locator":"§2, p. 3; §5.3.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":["intersection"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-5919F18545C7EA","locator":"Figure 5, p. 24","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":"balanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-59493A36D5FC01","locator":"§3, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":["fully_homomorphic_encryption","set_reconciliation"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-59F7D4F93F7A72","locator":"§4, pp. 22–23; Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":["batched_oprf","subfield_vole","okvs"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-5A5DD071AB8127","locator":"§2.2, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":["semi_honest"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-5A87015A639AA8","locator":"§1.2, PDF p. 5; §3.2, PDF p. 9","note":"For non-malleable hashed Diffie-Hellman","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":["ODH"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-5ACC1B5067DE2B","locator":"Figure 6, p. 8; §7.2, p. 18","note":"The table-based OPPRF hashes with a random oracle; the ideal-OPPRF hybrid of the proof is not a model","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":["random oracle"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-5B878714C8132C","locator":"§3, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-5B9A8022205725","locator":"§7, p. 15","note":"Each list holds \\( n \\) items, without loss of generality","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":"balanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-5C106C333C8A74","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":["intersection"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-5DAB598C81ECEC","locator":"Abstract, p. 1; §4.2, p. 8","note":"Costs grow with both sets; the abstract states them for two lists of the same length","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-5DC4D76CC87B53","locator":"Figure 1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-5DFF17065D2591","locator":"Protocol PM-Malicious-Client, p. 10; §5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing","cut_and_choose"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-5E88D0CDAA91D5","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2017-CLR","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-5E91B080CF4E9B","locator":"Figure 3, step 6, p. 13","note":"Bob learns the intersection and sends it to Alice","subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":"all"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-5EDB5AFA4C3774","locator":"Protocol 3.3, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"multiparty"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-5F09F5E8FCD999","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-5F3263A835E6C8","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-601781C3FA90DF","locator":"§3, p. 8; §7.1, p. 24","note":"The Vandermonde OKVS: the receiver interpolates a polynomial through its items","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":["batched_oprf","vole","okvs"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-61BD95E8785684","locator":"Figure 2, p. 10; §5.3, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":["oprf","ot_extension","cuckoo_filter"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-637AA8CFF1751F","locator":"Figure 1, p. 9","note":"The client.","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"one"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-650536B9412C60","locator":"Figure 9, step 5, p. 23","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":"one"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-65621ABCC71FEB","locator":"§5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":"balanced"},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-659DA443118F3F","locator":"Protocol 4.4, p. 10; Theorem 4.5, p. 11","note":"A parameter: \\( \\ell - t_c - 1 \\) clients, one pivot and \\( t_c \\) servers, cheaper for smaller \\( t_c \\)","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"\\( t_c < \\ell \\)"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-65A6A0E5747CAB","locator":"Figure 6, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-65CFC41F8E78AD","locator":"Figure 6, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":"all"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-66B0169A647A87","locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":["DDH"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-66D8D361209139","locator":"Figure 7, p. 25; Figure 8, p. 25","note":"Against a malicious sender the receiver gets the intersection further cut by a sender-chosen leakage function of its set","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":["intersection"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-66F6D4D1F7B12E","locator":"Abstract, p. 1; §1.1, p. 1","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"unbalanced"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-68053336AF8B9D","locator":"§4.5, pp. 10-11; §5.1, pp. 11-12","note":"Argued in prose, without a proof","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":{"receiver":"malicious","sender":"semi_honest"}},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-6858108A269DBA","locator":"§2.3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"multiparty"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-68CDEF4B1B9DA5","locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":["LPN"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-694711BC816CF9","locator":"§3.1, pp. 11–12; §5.4, p. 18","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-69484B1AC2AAC9","locator":"Theorem 8, p. 15; §4.1, p. 17","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":["standard model"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-698090B4ACBAD5","locator":"Theorem 3.4, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":["malicious"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-69CB081DD79DD0","locator":"§5.2, p. 11; Figure 3, p. 13","note":null,"subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":"balanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-6B3C6D911E66BA","locator":"Figure 8, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-6B5045355AF63F","locator":"§4.4, p. 15","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":["semi_honest"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-6BB1703F3EC6DD","locator":"Theorem 7, p. 21; Figure 3, p. 22","note":"Random oracles as in PaXoS-PSI, whose proof it follows; the vOLE hybrid is not a model","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":["random oracle"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-6BF151F10E5BF0","locator":"§4, p. 23","note":"Through the malicious VOLE-PSI protocol; no separate proof for the new OKVS","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":["malicious"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-6C090A1C7C2351","locator":"§2.3, p. 4; Theorems 1-2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-6C339E508026F3","locator":"§3, p. 4; §4, p. 5","note":"Cost depends on the size of the universe only","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":"not_applicable"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-6C935D04F50DF2","locator":"§4.1, pp. 16-17","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":"shared"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-6DD014AB37F859","locator":"§3.1, p. 5; §5.1, p. 12; Appendix D, pp. 19-20","note":"Ring-LWE through the slotted encryption of the values; the proof assumes any CPA-secure additively homomorphic scheme.","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":["DDH","Ring-LWE"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-6E53896040E0EA","locator":"Figure 9, step 5, p. 23","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":"one"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-6F903CCB4EC11E","locator":"§5.1, p. 6; Appendix B.2, p. 15","note":"Honest-but-curious client and server; malicious proofs left to future work","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":["semi_honest"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-6FADBE27221783","locator":"§5.1, p. 6; Appendix B.3, p. 16","note":"Honest-but-curious client and server; malicious proofs left to future work","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":["semi_honest"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-700174B9DEF175","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":"two_party"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-707FC9304CB0A6","locator":"§6.3, p. 19","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-70AC0CE85545D0","locator":"§2.1, pp. 8–9; §2.2.2, p. 10","note":"The base-OT assumption is not named","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":["CR hash"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-722015D79F78FA","locator":"§2, p. 5; §6.3, p. 24","note":"Any symmetric function f of the intersection; the measured instance tests whether its size exceeds a threshold.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":["circuit"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-72B8BEDC592442","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":"two_party"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-73E60BF1359DC8","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-7404E21FC08FE7","locator":"§2.2, p. 6; §3, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":["semi_honest"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-741614FEDBF685","locator":"Figure 7, p. 9; §3.1, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":["secret_sharing","simple_hashing","polynomial_sparsity_test"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-74FFCA61E4F5A4","locator":"§2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":["random oracle"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-756F2EE97C0488","locator":"§2.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-759174E4124121","locator":"§5.3.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":["garbled_circuits","ot_extension","sorting_network"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-76BB4E0EA4D5AF","locator":"§7.1, p. 25","note":"The VOLE cost is \\( o(n) \\), so the protocol suits large sets","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-76F1872281E69A","locator":"§3.5, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"unbalanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-771129613AF068","locator":"§5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":"balanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-774CB368C36FE4","locator":"§6, pp. 24–28; Figure 9, p. 30","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":["additively_homomorphic_encryption","garbled_circuits","polynomial_sparsity_test","set_reconciliation"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-7756C416AE9797","locator":"§2.3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-778F74C74189CC","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":"balanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-77C0DD8FB42077","locator":"§§5–7, pp. 10–17","note":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":["additively_homomorphic_encryption","ole","polynomial_sparsity_test","set_reconciliation"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-77CED8ABDFCBD2","locator":"§3, p. 6; §5, p. 15","note":"The protocol keeps the OPRF; the measured proof of concept omits it","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-78C5591F5FBD74","locator":"Figure 1, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-79DE90304535DA","locator":"§4.1, pp. 16-17; §5.2, p. 20","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"shared"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-7BF17D5B5C8B75","locator":"Figure 6, p. 8; §7.2, p. 18","note":"Evaluated with the table-based OPPRF, which hashes with a random oracle","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":["random oracle"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-7C2F088F16FB9F","locator":"Figure 2, step 9, p. 14; Figure 3, p. 15","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"one"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-7C5E61A4CD712C","locator":"§3, p. 8","note":"The intersection if the symmetric difference is at most \\( 2t \\), otherwise nothing","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":["threshold"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-7C5FFA4BA0D35E","locator":"Figure 3, p. 10","note":"P1 learns the cardinality; P2 learns the intersection-sum.","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":"all"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-7CB06EAE7057AC","locator":"§5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":["oblivious_polynomial_evaluation"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-7CF131898FD6E7","locator":"§2.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-7D8902680A685F","locator":"§4.1, pp. 10-12; §6.2, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":["cuckoo_hashing","permutation_based_hashing"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-7E98E5A1D25C1B","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-7EF2706FEF4B02","locator":null,"note":"No proof is given.","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"not_reported"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-7F3B6328A65A14","locator":"§5.2, p. 11; Lemma 4, p. 12","note":"The server's privacy is preserved as in the semi-honest protocol","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":{"receiver":"semi_honest","sender":"malicious"}},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-7FB6921BF4E7B5","locator":"Theorem 3, p. 33","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":["semi_honest"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-8025A39B00D001","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-81BA06F127378D","locator":"§3, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":["intersection"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-82218F3F73AC3F","locator":"Appendix A, p. 85","note":null,"subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"two_party"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-83CB565CD6EB09","locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":"one"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-84290B70B11836","locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":["DDH"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-8475207DBF2352","locator":"Figure 3, step 4, p. 11","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":"one"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-848917E84CDBDB","locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18","note":"In the F_vole-hybrid model, a hybrid model; the simulators program H","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":["programmable random oracle"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-84B0023EE181F0","locator":"Appendix A, p. 85","note":"No proof is given for the protocol","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"not_reported"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-84F6FF2B492136","locator":"§2, p. 79; Appendix A, p. 85","note":"Only the discrete-log setting modulo a prime and a hash whose output cannot be influenced or predicted are stated","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"not_reported"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-85C720A0FE1C60","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":"balanced"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-866B56DC9823AA","locator":"Theorem 2, p. 13; §6.3, p. 15","note":"A corrupt party may use up to \\( m\\mu \\) items","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":["malicious"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-86747A01303824","locator":"§4, pp. 22–23; Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":["batched_oprf","vole","okvs"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-875D63E8101172","locator":"Figure 1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":["cardinality","sum"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-87AAEB9A53E346","locator":"Figure 10, step 4, p. 16","note":"The leader announces the intersection it decodes","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":"all"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-87D06936AACDF2","locator":"Theorem 1, p. 15; Theorem 2, p. 16","note":"One-sided simulation against the receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-884AA71822A90D","locator":"§2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":["semi_honest"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-888C7D8153B831","locator":"§7, p. 15","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":["intersection"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-88DDC79CF1C8DC","locator":"Theorem 1, p. 15; Figure 1, step 1, p. 13","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":["random oracle"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-891223B9E23EC3","locator":"§3.5, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"unbalanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-8A4F6E4EB8B752","locator":"Protocol PM-Malicious-Server, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":"balanced"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-8AB72741020D41","locator":"Theorems 1–2, pp. 15–16; §4.3, p. 10","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":["Ring-LWE","One-More-Gap-DH"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-8B765494695714","locator":"§3.1, p. 5; §5.1, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":["diffie_hellman","additively_homomorphic_encryption"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-8B956CE7F24AA3","locator":"Appendix A.2, p. 26; Lemma 13, p. 27","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-8BBBE8F14ED7C3","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-8C103DB2CF5053","locator":"Figure 2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-8C7305F21CA2E2","locator":"§2.4, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-8CEF9DD76986D8","locator":"§5.2, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":"two_party"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"ATTR-8D0FA139E8413B","locator":"§3.5, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-8D5E4261905CEE","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-8EFCFAC4671220","locator":"Figure 1, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"all"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-8F0CFB9B9800FF","locator":"§1.2, PDF p. 5; §3.2, PDF p. 9","note":"For non-malleable hashed Diffie-Hellman","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":["ODH"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-907FBC2E16F0C3","locator":"Figure 3, step 4, p. 11","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":"one"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-9090F0621D690A","locator":"Figure 4, p. 11; §5.1, p. 16","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":["key_agreement","diffie_hellman"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-909C1C5F0F7A60","locator":"Figure 4, p. 11","note":"P1 learns the cardinality; P2 learns the intersection-sum.","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":"all"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-90C934F5699FF1","locator":"§2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-90E1A0B7C7E58E","locator":"Theorem 3, p. 33; Figure 9, p. 23","note":"In the F_sub-vole-hybrid model, a hybrid model, with random oracles H_B and H_o","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":["random oracle"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-912A79324499A4","locator":"Theorem 3, p. 33","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":["semi_honest"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-9146AC360CF72F","locator":"§6.3, p. 16; §3.1, p. 4; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":["PRF","CR hash"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-91F23B4FB5EDF4","locator":"§4, p. 22","note":"No assumption is named; the subfield VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":"not_reported"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-91FE0EFF9E4360","locator":"Figure 2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"all"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-920B6FACAF39E0","locator":"§6.3, p. 19","note":"Via the PaXoS-PSI proofs, written for any binary OKVS; corrupt parties may use larger sets","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":["malicious"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-921AC3E0325070","locator":"Figure 9, p. 27","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":["intersection"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-9265B864E26407","locator":"RS21 Theorem 3.1, p. 16; §4, p. 23","note":"Inherited from VOLE-PSI, whose simulators program H in the F_vole-hybrid model","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":["programmable random oracle"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-92AA291539B411","locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":["PRF"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-937CB3C135D19C","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":["intersection"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-93937DAA097FE1","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-93FE5A223612B8","locator":"Abstract, p. 1; Theorem 4, p. 10","note":"None beyond the random oracle in the OOS OT-extension hybrid; instantiating OOS needs base OTs, whose assumption is not named","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":"not_reported"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-941913FB3CF2DF","locator":"Figure 5, p. 24","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-948BA70C5D19BD","locator":"§6.3, p. 16; §4, pp. 9-10","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-94A5CD214B719B","locator":null,"note":"No proof is given; the protocol inherits the generic protocol's security.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"not_reported"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-94AC2AF8F17B2E","locator":"Figure 7, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"one"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-957F07AEFD41F1","locator":"Table 2, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"ATTR-96084B01ACC0BE","locator":"Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-9630272BF8A0FC","locator":"§5, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"balanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-975C6B364686F8","locator":"Abstract, p. 1; Lemma 4 and proof sketch, pp. 12-13","note":"The simulator extracts the server's input from its oracle queries","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":["random oracle"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-9774E80ACB1AEF","locator":"Functionality 2.1, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-978F8F77D71AA1","locator":"Figure 4, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":"balanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-981D74AB866ADE","locator":"§2, p. 2; Figure 3, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-9829C13D15094B","locator":"Figure 6, p. 22; Figure 9, p. 30","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":["threshold_fhe","additively_homomorphic_encryption","set_reconciliation"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-984F7985D19220","locator":"Table 2, p. 25; §4, p. 22","note":"No assumption is named; Silver supplies the VOLE and OT correlations","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":"not_reported"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-9856DA8E4ED2B5","locator":"Theorem 5.1, p. 21; §6, p. 23","note":"OPPRF in the F_oprf-hybrid model and 2PC as a functionality; the circuit-PSI proof is deferred to PSTY19","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":["programmable random oracle"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-986727200D7C08","locator":"§5.4, p. 18","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":"unbalanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-98CA3324837B07","locator":"§7, pp. 15-17","note":"The protocol is sketched without proof","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":"not_reported"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-98F13477429A02","locator":"§3, p. 8; §7.1, p. 24","note":"The Vandermonde OKVS: the receiver interpolates a polynomial through its items","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":["batched_oprf","vole","okvs"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-99A105D45A158E","locator":"Abstract, p. 1; Theorem 4, p. 10","note":"None beyond the random oracle in the OOS OT-extension hybrid; instantiating OOS needs base OTs, whose assumption is not named","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":"not_reported"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-99E3EA5C4EA279","locator":"Figure 3, step 3, p. 22","note":"The receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":"one"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-99F18594249953","locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":["circuit"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-9A1C0D6285C99F","locator":"Theorem 2, p. 11; §5.2, pp. 12–13","note":"Malicious parties are discussed without a proof","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-9A8CD1C828EE66","locator":"Appendix A, steps 1-4, p. 85","note":"Lists of any lengths are exchanged in full; nothing exploits one larger list","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"balanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-9C0CE629F7EB61","locator":"Lemmas 11-12, pp. 24-25; §3.2, p. 8","note":"The ideal permutation model; the random oracle hashes the Diffie-Hellman key.","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":["random permutation","random oracle"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-9C1E783F34232A","locator":"§5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-9C93061F8A7999","locator":"Figure 4, p. 12; §6.7, pp. 17–18","note":"Bob only; output to both parties is not supported","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"one"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-9CDA186FE05F6C","locator":"Algorithm 1, p. 5; §4, p. 5","note":"Each match is revealed as soon as it is found","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":"all"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-9D66DBE7098264","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-9DADAF6B7B17F8","locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":["LPN"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-9DDD76E1A37108","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":"balanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-9ECAAC94023AC3","locator":"Theorem 6, p. 9; Figure 2, p. 10; §5.2, p. 11","note":"BaRK-OPRF is proved with ideal base OTs, a hybrid model; the PSI step is argued informally","subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":["standard model"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-9FFB777A22C8EF","locator":"Figure 1, p. 3; §4.3.2, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":["cardinality","sum"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-A01EE9D5E4FCB8","locator":"Protocol 3, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":"two_party"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-A0E0FFBB1B9510","locator":"Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":"two_party"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-A0EE3B8036091F","locator":"Figure 9, p. 38","note":"Both parties hold shares of a membership bit and associated values per bin","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":"shared"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-A1727A844756BD","locator":"Figure 9, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-A244F41D59007F","locator":"§1.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-A27E57DBB518C1","locator":"Lemmas 11-12, pp. 24-25","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":["semi_honest"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-A2937475BD3A85","locator":"Appendix A, p. 85","note":null,"subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"all"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-A2B1108AAA5BA3","locator":"Theorem 4, p. 10; §4.4, pp. 15–16","note":"A corrupt party may use a larger set, bounded through the hash output lengths","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":["malicious"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"ATTR-A2C5010E1CBEAC","locator":"Figure 2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":["intersection"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-A34C081758D239","locator":"Theorem B.1, p. 40","note":"UC in a star network; the cardinality test is a hybrid, not a model","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":["standard model"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-A3994212AC29BB","locator":"Figure 9, p. 38","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":["circuit"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-A3B949B08696AA","locator":"§2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":"one"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-A3DF1473128D22","locator":"§2, p. 3; §3, pp. 4-5","note":"Unsafe standalone: set sizes are unrestricted, so an all-ones input reveals the other set","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":["semi_honest"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-A44E9A9494AF8C","locator":"§2, p. 4; §6.4, p. 15","note":"Sets of equal size; unequal sets are padded, at most doubling the threshold","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-A4EEAC1C2F514E","locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":"one"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-A5552E50F0F34E","locator":"Appendix A, p. 85","note":"No adversary model; a zero-knowledge proof against active cheating is suggested but not given","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"not_reported"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-A564E05B46D701","locator":null,"note":"Security is inherited from the generic two-party protocol; no assumption is stated.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"not_reported"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-A57D7728A6B0FD","locator":"§2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":["semi_honest"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-A58E84299A6D06","locator":"§2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-A58F4A61200976","locator":"§2.2, p. 6; Theorem 4, p. 14","note":"Static passive adversary corrupting Alice or Bob","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":["semi_honest"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-A5AAC804A0813B","locator":"Figure 6, p. 12","note":"The intersection if the symmetric difference is at most \\( 2t \\), otherwise nothing","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":["threshold"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-A5E722E6D670C8","locator":"§2, p. 5; §4.2, p. 13","note":"Any symmetric function f of the intersection.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":["circuit"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-A625BC587642EC","locator":"§2.3, pp. 4–5; §4.2, p. 13","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":["Ring-LWE","One-More-Gap-DH"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-A6F773B8AE5F92","locator":"Figure 2, step 9, p. 14","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"one"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-A746AB3269A352","locator":"Table 1, p. 4; §3.2, pp. 8-9; Lemmas 11-12, pp. 24-25","note":"Hashed Diffie-Hellman is a secure key agreement under CDH with a random oracle; elligator makes the messages pseudorandom.","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":["CDH"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-A89F37695A7C3A","locator":"§4, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-A8E9F32B8EDC6C","locator":"§2, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"balanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-AA3221715D40D1","locator":"§3.1, p. 5; Appendix D, p. 19","note":"The hash to the group is a random oracle that the simulator programs.","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":["programmable random oracle"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"ATTR-AA6FB1EEA71476","locator":"§5, pp. 21–23; Protocol 3, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":["batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","permutation_based_hashing"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"ATTR-AAB374B487C9E9","locator":"§6.3, p. 19; PRTY20 Figure 3","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-AB0B89236B98A7","locator":"Protocol 3.3, p. 8; §3.2.2, p. 8; Appendix A, p. 13","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":["okvs","paxos","server_aided_psi"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-AB328400ECE3F2","locator":"Theorem 2, p. 13; §4, p. 6","note":"UC in the F_encode-hybrid model, a hybrid model; OOS realizes F_encode with a programmable random oracle","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":["programmable random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-AB7FD20046513E","locator":"§2, p. 2; Figure 4, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-AB8F695CFE0506","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":["intersection"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-ABFC45103A47C9","locator":"§3.3, pp. 4-5; footnote 8, p. 5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance, El Gamal an alternative","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":["DCR"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-AC82E132AA3A0C","locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18; Theorem 4.1, p. 20","note":"In the F_vole-hybrid model, a hybrid model; covered by the malicious proofs, whose simulators program H","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":["programmable random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-ACBE687216CA31","locator":"Figure 1, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-ACCC5F9B2AD59B","locator":"Figure 1, p. 5; Figure 8, step 5, p. 12","note":"The leader announces the intersection it computes","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"all"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-AD03F078B63F27","locator":"§7, p. 15","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":"multiparty"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-AD63C2C21D2BCE","locator":"§7.1, p. 21; Theorem 7, p. 21","note":"None beyond the random oracles in the vOLE hybrid; it needs a malicious-secure vOLE protocol, which the paper does not fix","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":"not_reported"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-AE39E4806B47E4","locator":"§3.1, p. 5; §3.2, p. 7; Appendix D, pp. 19-20","note":"DCR through the deployed Paillier encryption; the proof assumes any CPA-secure additively homomorphic scheme.","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":["DDH","DCR"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-AEDD563D534E66","locator":"§2.3, p. 4; Theorem 2, p. 11","note":"Through IND-CPA, circuit-private FV over RLWE rings; the paper names no hardness assumption","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":["Ring-LWE"]},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-AF281C0816932B","locator":"Theorem 1, p. 12; §5.3, Generalization, p. 13; Table 1, p. 3","note":"Any number of colluding parties; sharing zero with only \\( t_c + 1 \\) parties tolerates at most \\( t_c \\)","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"\\( t_c < \\ell \\)"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-AF867D40821042","locator":"Appendix D, p. 33; Theorem 4, p. 10","note":"Claimed without a separate proof; the proof given is the malicious random-oracle one, with OOS as an ideal functionality","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":["standard model"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-B00AC65B518457","locator":"§6, pp. 22–24; Figure 10, p. 39; §7.2, p. 30","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":["opprf","batched_oprf","vole","paxos","cuckoo_hashing","simple_hashing","gmw","pcg"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"ATTR-B01BDDD02ECC07","locator":"§6.3, pp. 16-17","note":"Three parties only; a collusion of the leader with a later party would learn a partial intersection beyond three","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":"multiparty"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-B08A42D4D8FD4D","locator":"§2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-B0ECED1D851107","locator":"§2.3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"multiparty"},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-B240000501C905","locator":"§7, p. 16","note":"Stated informally: values outside the intersection look random to any coalition; no proof","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":"\\( t_c < \\ell \\)"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-B2681E3A39DD3D","locator":"Figure 1, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":"balanced"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-B328B04C81CEEE","locator":"§4.2, p. 14; §3, p. 6","note":"The labeled proof is sketched as a direct extension of the unlabeled one","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-B3CFF4989A8D9A","locator":"§3.3, pp. 4-5; §7, step 1, p. 16","note":"Any semantically secure additively homomorphic scheme, a key pair per client; Paillier is the named instance","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":["DCR"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-B49695CB288343","locator":"Theorem 1, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":["semi_honest"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-B4C2530654D9CD","locator":"Theorem 3, p. 33; Figure 9, p. 23","note":"In the F_sub-vole-hybrid model, a hybrid model, with random oracles H_B and H_o","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":["random oracle"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-B4C358C2B37D95","locator":"§5.1, pp. 10-11","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":{"receiver":"malicious","sender":"semi_honest"}},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-B61C366EA1BB49","locator":"§2.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":"balanced"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-B780F5F02B5F19","locator":"Theorem 4, p. 10; §7.1, p. 22","note":"No hardness assumption is named beyond the random oracles; OOS and its base OTs are taken as given","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":"not_reported"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-B89A99F63E7680","locator":"Corollary 6, p. 16","note":"Either suffices","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":["OT","AHE"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-B968152484FC9E","locator":"Figure 6, p. 8; Theorem 2, p. 14","note":"The table-based OPPRF hashes with a random oracle; the proof sketch assumes a secure OPRF, a hybrid rather than a model","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":["random oracle"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"ATTR-B987814F4B521E","locator":"§4, p. 22","note":"No assumption is named; the VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":"not_reported"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-BA764A05E17677","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":["intersection"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-BAD55F3CA5B517","locator":"§7.1, p. 25","note":"The VOLE cost is \\( o(n) \\), so the protocol suits large sets","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":"balanced"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-BB6F267217F2E0","locator":"Corollary 3, p. 10","note":"Either suffices","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":["OT","AHE"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"ATTR-BC721BCC505A56","locator":null,"note":"Security is inherited from the generic two-party protocol; no assumption is stated.","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"not_reported"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-BC792797366F9E","locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":["PRF"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-BCEA5641FE00C3","locator":"Theorem 1, p. 15; §4.3, p. 10; Figure 1, step 1, p. 13","note":"The inner OPRF hash and the hash to short strings are random oracles; extraction observes queries","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":["random oracle"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"ATTR-BD87DB4D46927B","locator":"Figures 1–2, pp. 13–14; §4.3, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-BF684D6275CBC5","locator":"§4, pp. 22–23","note":"No assumption is named; the VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":"not_reported"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-C0CC77F6A30E37","locator":"Figure 3, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-C15BA6A3E6B822","locator":"Table 2, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-C1A087E8DF2443","locator":"Table 4, p. 29","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":"balanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-C1EEA5295C4139","locator":"§5.2, pp. 14-16; §5.4, pp. 17-18; §8.1, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":["okvs","ot_extension","simple_hashing"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"ATTR-C25A128261021E","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-C2E178618E3EC8","locator":"§5.2, pp. 11–12; Figure 3, p. 13","note":null,"subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":["batched_oprf","ot_extension","cuckoo_hashing"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-C30874F02F5B9F","locator":"§7.2, pp. 26 and 30","note":"LPN with regular noise, for the VOLE; SilentOT generates GMW's OTs","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":["LPN"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-C3C1DC0639D64C","locator":"Appendix B, pp. 29–31; §7.1, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":["paxos","ot_extension"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-C3F38112E63118","locator":"§4, p. 23; Table 2, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":["semi_honest"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-C439C04386B50E","locator":"Theorem B.1, p. 40; Theorem 5.1, p. 17","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":["semi_honest"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-C4AF9AA4A66484","locator":"Theorem 3, p. 16; §6.5, p. 17","note":"Alice is held to exactly \\( n \\) items; a corrupt Bob may use up to \\( m\\mu \\)","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":["malicious"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-C4DB6B5F84238D","locator":"Theorem 3, p. 16; Appendix A, p. 26; §4, p. 6","note":"UC in the F_encode-hybrid model; the commitment needs only a non-programmable oracle, OOS a programmable one","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":["programmable random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"ATTR-C55D3C2737B510","locator":"§4, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":["intersection"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-C5F7E4F0DB3142","locator":"Figure 2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"all"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-C66D2366D42A5F","locator":"§2.3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"balanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-C6909C37982BD9","locator":"§2, p. 3; §5.3.3, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-C6B7C5FCC7AFDE","locator":"§6.1–6.2, pp. 10–12; Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":["dual_execution","ot_extension","simple_hashing","permutation_based_hashing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-C7080C9FD672A9","locator":"Theorem 5.1, p. 21; §6, p. 23","note":"OPPRF in the F_oprf-hybrid model and 2PC as a functionality; the circuit-PSI proof is deferred to PSTY19","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":["programmable random oracle"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-C742076B3B49F5","locator":"Appendix B.2, p. 15; Table 2, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":["random oracle"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-C78FB49636C6B2","locator":"§4.2, p. 14","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":["random oracle"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"ATTR-C8AD2DD7FBD30E","locator":"§3.1–3.2, pp. 6–7; Lemma 3, p. 7; Figure 2, p. 10","note":"The pseudorandom code is a PRF (AES); the hash is Hamming correlation robust","subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":["PRF","CR hash"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-C929EA766D3170","locator":"§2.4, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"balanced"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-C9815F5037AE74","locator":"§2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":["random oracle"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-C99B5EB60B16AB","locator":"§3, p. 8","note":"Either, through the FHE instantiation the paper names","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":["LWE","Ring-LWE"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-C9B5738EFF6BD4","locator":"§2, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-C9B8094BFE83BE","locator":"Theorem 7, p. 21","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":["malicious"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-C9C0A7EF21EED8","locator":"§3.3, pp. 4-5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":["DCR"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-CA46759B03FDA0","locator":"Protocol PM-Malicious-Client, step 1, p. 10; footnote 10, p. 11","note":"Paillier is the named homomorphic instance","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":["DCR","PRF","CRHF"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-CA4BA20620D5F7","locator":"§1.1, p. 2; §2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":["semi_honest"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-CA6426C9F63606","locator":"§2.2, p. 4; §3, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG","value":["intersection"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-CACA14142FADE4","locator":"Figure 1, p. 6; Figure 10, p. 41","note":"The intersection if every set exceeds it by at most \\( t \\) elements","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":["threshold"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-CAD58771910373","locator":"§2.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"ATTR-CAE6C022816C56","locator":"§2, p. 4; §3, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":["garbled_circuits","ot_extension"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"ATTR-CB2942C31A1DC2","locator":"§2, p. 2","note":null,"subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":"two_party"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-CB369AC446E394","locator":"Figure 1, p. 6; Figure 3, step 4, p. 11","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":"one"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-CBF681798BB8A0","locator":"§2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":"two_party"},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-CC79F135B049A6","locator":"Table 4, p. 36; Appendix B.4, p. 30","note":"Any subset of parties, the central party included","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":"\\( t_c < \\ell \\)"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-CCFC21B8D4E976","locator":"Theorem 8, p. 15; §5.1, p. 20","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":["standard model"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-CD0F0CA621944A","locator":"Theorem 3.1, p. 16; Theorem 4.1, p. 20; Lemma 3.3, p. 17","note":"A malicious receiver's effective set is bounded by the OKVS size","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":["malicious"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-CD11A1A03AE9B3","locator":"§2, p. 2","note":"The client; mutual PSI by two one-way runs","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":"one"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-CD31F8A2DD29BB","locator":"Appendix A, p. 85","note":"The authors relate it to Diffie-Hellman key exchange","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":["diffie_hellman"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-CD37A8653B30E2","locator":"Figure 3, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-CDFA1A162B89C8","locator":"§7.1, pp. 20-22","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":["okvs","vole"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-CE31EAFA131426","locator":"footnote 4, p. 2; §5, p. 10","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":["standard model"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-CE9A3E5BD2F585","locator":"§3.3, pp. 4-5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":["DCR"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"ATTR-CF1A8B50B21A2D","locator":"§5.2, pp. 16-17; §6.3, p. 24","note":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":["cuckoo_hashing","permutation_based_hashing","gmw"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-CF41B7D31B3188","locator":"§2.1, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-CF866D7265ADD4","locator":"Figure 9, p. 11","note":"All sets have exactly \\( n \\) items","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"ATTR-CFEEFC4ECD5356","locator":"Figure 1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-D02AA14FFDE8BB","locator":"Theorem 3.1, p. 16; footnote 2, p. 15; Theorem 4.1, p. 20","note":"With interpolation a malicious receiver's effective set has at most \\( n_Y \\) items","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":["malicious"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-D0BD8C8A4FDA5F","locator":"Figure 4, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-D15096671241AA","locator":"§6.1, p. 14; §4, pp. 9-10","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","secret_sharing"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-D1A340CA3F9D6C","locator":"§2, p. 3","note":"Both sets padded to a known common size","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":"balanced"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-D1DC88648C249C","locator":"§2.3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"balanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-D3581A63EB099B","locator":"§3.1, p. 3; §4.4, p. 9","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":["cardinality"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-D3D16C5A7B285E","locator":"Figure 6, p. 26","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":["key_agreement","diffie_hellman"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-D3D19CBDA503D6","locator":"§6, pp. 22–24; Figure 10, p. 39; §7.2, p. 30","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":["opprf","batched_oprf","vole","paxos","cuckoo_hashing","simple_hashing","gmw"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-D4128AAA45AEBD","locator":"Figure 6, p. 26","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":["intersection"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-D47444AD206345","locator":"Theorem 2, p. 13; §4, pp. 6–7","note":"UC in the F_encode-hybrid model, a hybrid model; encodings from chosen-message OTs and a PRF","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":["standard model"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-D5A6FF3ADBBCD1","locator":"abstract, p. 1; §6, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":["semi_honest"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-D6F239D0930D22","locator":"§1, p. 2; §4, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":["circuit"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-D714399A15E177","locator":"§2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-D7B13FF8F71AB9","locator":"Appendix F, p. 22","note":"Argued from the encryption scheme and negligible Bloom-filter collisions; no idealized model.","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":["standard model"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-D82259CE0818B8","locator":"§3.3, pp. 4-5; Protocol PM-Malicious-Server, p. 12","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":["DCR"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-D85AC5A9E483EA","locator":"§2, p. 4; §5.3.2, pp. 8-9","note":"Stated provable from DDH for the Naor-Pinkas OT; the shuffle's homomorphic scheme is not named","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":["DDH"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-D952EB584909F7","locator":"Figure 5, p. 39; Theorem 9, p. 31; Table 4, p. 36","note":"PRF zero-sharing; the two-party OPRF is an ideal functionality, instantiated with vOLE in the comparison","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":["PRF"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-D9646B3218F583","locator":"Figure 6, p. 26","note":"The receiver.","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":"one"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"ATTR-D9665937F84FF9","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"ATTR-D978C03AF8FD86","locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":["DDH"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-D9921158D75D91","locator":"§6.3, p. 19","note":"Via the PaXoS-PSI proofs, written for any binary OKVS; corrupt parties may use larger sets","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":["malicious"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-D99E5E4375C246","locator":"Table 4, p. 29","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":"balanced"},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"ATTR-DAAF6B2F29BEE1","locator":"Theorem B.1, p. 40","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"\\( t_c < \\ell \\)"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"ATTR-DB43D9042E213B","locator":"Figure 2, p. 6; Figure 9, p. 30","note":"The intersection if the union minus the intersection has at most \\( t \\) elements","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":["threshold"]},{"attribute":"corruptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-DBAE484575A1CF","locator":"Theorem 7.1, p. 28","note":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"\\( t_c < \\ell \\)"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"ATTR-DBD362751C716E","locator":"§4.2, p. 7; §4.4, p. 9","note":"Hashing to bins is carried over from the base protocol, which the paper optimizes this way","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-DC00631FFDEC2A","locator":"§4, pp. 9–11; §5, pp. 16–19","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":["paxos","ot_extension"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-DC727B3A047433","locator":"Figure 3, p. 11; Figure 4, p. 12","note":"The receiver learns the intersection; the sender learns nothing","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"one"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"ATTR-DD1EFEB5BA9E8C","locator":"§2.1, p. 4; Theorem 3, p. 9","note":"Passive, static","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":["semi_honest"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"ATTR-DD5434407276CF","locator":"§5.2, pp. 20-21; §7.4, p. 27","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-DD6C11D91A8D24","locator":"§4.1–4.2, pp. 6–9; Figure 2, p. 8","note":null,"subject_id":"PSI-CONSTRUCTION-2017-CLR","value":["fully_homomorphic_encryption","cuckoo_hashing","simple_hashing","permutation_based_hashing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-DD994437BAB8AB","locator":"Figure 5, p. 39; Theorem 9, p. 31","note":"The OPRF hybrid of the proof is not a model","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":["random oracle"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"ATTR-DE6E547DAEF8D9","locator":"§2.2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"ATTR-DF02D4F5F395C3","locator":"Appendix A, steps 1-4, p. 85","note":"Lists of any lengths are exchanged in full; nothing exploits one larger list","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"balanced"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-DF8240D44EC5A5","locator":"§2, p. 3; Algorithm 1, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"ATTR-E0104E31FA0E16","locator":"Protocol 10, p. 20; §7.3, p. 25","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-E0934FA0CB36A0","locator":"§1.1, p. 2; §2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":["semi_honest"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-E106A9B0EDE1CD","locator":"§2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"one"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-E11FDDC7DC2032","locator":"§2.3, p. 6; Figure 8, p. 27","note":"The intersection if the symmetric difference has at most \\( t \\) elements, otherwise nothing","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":["threshold"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-E19A4C410FEC8B","locator":"Figure 8, step 5, p. 12; §6.1, p. 14","note":"The leader announces the intersection it computes","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"all"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-E1C774105C750F","locator":"Figure 2, p. 6; Figure 9, p. 30","note":"The intersection if the union minus the intersection has at most \\( t \\) elements","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":["threshold"]},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"ATTR-E1D894BC1DF7F8","locator":"Theorem 2, p. 13; §6.3, p. 15","note":"A corrupt party may use up to \\( m\\mu \\) items, fewer than \\( 4n \\) in the evaluated range","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":["malicious"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-E2732EC00F9D1B","locator":"§1.2, p. 4; §6.1, p. 26","note":"UC; the singularity test is an ideal functionality realized by Yao's garbled circuits","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":["standard model"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-E298D3F098FCD0","locator":"Figure 3, p. 10; §5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":["batched_oprf","ot_extension","cuckoo_hashing","additively_homomorphic_encryption"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-E2D3A6CA7F6964","locator":"§5.3.3, p. 9","note":"The evaluator; it may permute or sort the outputs again and send them back to the generator","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":"one"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"ATTR-E39B4EFEED0778","locator":"Functionality 2.1, p. 4; Protocol 3.3, step 6, p. 8","note":"The last party","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"one"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-E3C1A38D7B24DA","locator":"Figure 2, step 9, p. 14; §1.1, p. 2","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":["labeled"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"ATTR-E446AF18020C78","locator":"§2.2, p. 5","note":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":"two_party"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-E460CA867F0AE1","locator":"Figure 1, p. 6; Figure 3, step 4, p. 11","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":"one"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"ATTR-E48657A5EF2AE6","locator":"§2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"two_party"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-E4B5DA8A87146F","locator":"Appendix B.2, pp. 15-16","note":"With one extra DH-oracle query in the reduction","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":["One-More-Gap-DH"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"ATTR-E4B8696CF06085","locator":"§3.1, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-E516DAB73CB993","locator":"Protocol 9, p. 17; §7.3, p. 24","note":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"ATTR-E56B4031B09886","locator":"§7.2, pp. 26 and 30","note":"LPN with regular noise, for the VOLE; GMW's OTs come from IKNP","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":["LPN"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"ATTR-E5C7CFBC1251EE","locator":"§5.1, pp. 11-12; Appendix E, pp. 20-21","note":"Paillier for the OPRF values and Ring-LWE for the associated values as measured; the proof assumes any CPA-secure scheme and random OT.","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":["DCR","Ring-LWE"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-E60E7FE40A5A96","locator":"Abstract, p. 1; Figure 9, p. 11","note":"The intersection when it has at least \\( n - t \\) items, else nothing","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":["threshold"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"ATTR-E64287DCF7B230","locator":"§2.2, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"unbalanced"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"ATTR-E69750AB0F8E45","locator":"§5.3.2, pp. 8-9","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":["garbled_circuits","ot_extension","sorting_network","additively_homomorphic_encryption"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"ATTR-E6A33CB94743DA","locator":"Lemma 1, p. 4; §7.1, p. 22","note":"Code correlation robustness; OOS and its base OTs are taken as given","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":["CR hash"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-E7DCAF07822460","locator":"§2, p. 79; Appendix A, p. 85","note":"Only the discrete-log setting modulo a prime and a hash whose output cannot be influenced or predicted are stated","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"not_reported"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-E85CE85C4C51B2","locator":"Figure 9, p. 38","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":["circuit"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-E8ABC564F35C13","locator":"§4.1, p. 5; §4.2, p. 7","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-E8EBABE0FD1C42","locator":"Imported Theorem 2.2, p. 9; Corollary 7.2, p. 28","note":"Circular-secure LWE, as the corollary names; threshold AHE may run phase two, but exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":["LWE","circular security"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"ATTR-E8FC11EC8420B7","locator":"Appendix A.2, p. 26; Lemma 13, p. 27; §3.2, p. 9","note":"No ideal permutation.","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":["random oracle"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"ATTR-E8FE65F6A73F28","locator":"Figure 9, p. 27","note":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-EABF3833B85912","locator":"§7, step 4, p. 16","note":"Every party checks the published row values against its own items","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":"all"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"ATTR-EB4FEECE19A35D","locator":"abstract, p. 1; §4.2, p. 10; Theorem 4, p. 10","note":"Proved in the OOS-hybrid model, a hybrid model, with non-programmable oracles H1 and H2","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":["non-programmable random oracle"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-EBD80203D9F571","locator":"§3.1, p. 3","note":"The client","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":"one"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-EC80BB82F03B75","locator":"§4, pp. 9–11; §5, pp. 16–19","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":["paxos","ot_extension"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"ATTR-EDDD2091254660","locator":"§3.1, p. 3","note":"The client","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":"one"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"ATTR-EE1A68743F1854","locator":"§3, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":["random oracle"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"ATTR-EF1583F6AB7B5C","locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":"one"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-EFDC5753FAD3B9","locator":"§3, p. 8","note":"A sketch: security is argued from FHE alone, without a formal proof or random oracle","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":["standard model"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"ATTR-F0BC46D12D0EC7","locator":"§2.6, p. 10; §7.1, p. 29","note":"Either, as stated, though exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts; garbling's oblivious transfers are not discussed","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":["DCR","DDH"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-F0C580B3DFA562","locator":"Protocol 4.2, p. 10; Protocol 4.4, p. 10; §5, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":["okvs","paxos","opprf","secret_sharing"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"ATTR-F11367CB2B4B9F","locator":"Figure 6, p. 37","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":"two_party"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-F26C9D979D453F","locator":"Theorem 3 and its proof, pp. 25–26","note":"Non-black-box simulation; the reduction programs the OPRF random oracle","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":["programmable random oracle"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"ATTR-F2794B571975E5","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":["intersection"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"ATTR-F2A6CCD6A26EA1","locator":"§5, pp. 5-10","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":["garbled_circuits","ot_extension","sorting_network"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"ATTR-F2A9E8B3102FAC","locator":"Figure 9, p. 14; Theorem 2, p. 14; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":["PRF","CR hash"]},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"ATTR-F334C26344CC8B","locator":"§4, pp. 6–7; Figure 6, p. 19; §7, p. 18","note":"Also actively secure OT extension","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":["PRF","CR hash"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-F3CB3DE80A3B7E","locator":"Functionality 2.1, p. 4; Protocol 4.4, step 6, p. 10","note":"The last server","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"one"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"ATTR-F412F1DD0B9406","locator":"Theorem 7.1, p. 28","note":"UC in a star network; the cardinality test is a hybrid, not a model","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":["standard model"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"ATTR-F439BC92B4483C","locator":"Figure 2, p. 6; Theorems 1–2, p. 6","note":"P1 learns the cardinality; P2 learns the intersection-sum.","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"all"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"ATTR-F469074F472977","locator":"§2, p. 3","note":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":"two_party"},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"ATTR-F4CD60023815F9","locator":"Functionality 2.1, p. 4","note":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":["intersection"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-F5213C5DE73E4B","locator":"§2.1, p. 4; footnote 4, p. 3","note":"Standalone; the bucketing functions are random for simplicity and work equally well as pseudorandom functions, where the key is known to all parties","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":["standard model"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"ATTR-F5592413272F7B","locator":"footnote 4, p. 2; §5.1, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":["standard model"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"ATTR-F5AFE670C7D590","locator":"Figure 2, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":"two_party"},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"ATTR-F678E849277A56","locator":"Figure 3, p. 22","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":"balanced"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-F76C262687C460","locator":"Figure 10, p. 39","note":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"ATTR-F7A126F336DA63","locator":"Appendix A, p. 85","note":"No adversary model; a zero-knowledge proof against active cheating is suggested but not given","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"not_reported"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"ATTR-F7EA316DDA8E24","locator":"§3.1, p. 3","note":"The client","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":"one"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"ATTR-F85293731DA7CA","locator":"Figure 9, p. 38","note":"Both parties hold shares of a membership bit and associated values per bin","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":"shared"},{"attribute":"assumptions","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"ATTR-F89D3DBD028FF7","locator":"Theorem 3, p. 25; Definition 1, p. 17","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF; also an H-limited FHE assumption argued heuristically","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":["Ring-LWE","One-More-Gap-DH"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"ATTR-F9A7061A0A0FD2","locator":"Figure 3, p. 8","note":"Hashed items raised to the server's secret exponent in a prime-order subgroup; the paper does not say Diffie-Hellman","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":["diffie_hellman"]},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"ATTR-F9FB3BDF3DCEE4","locator":"Figure 4, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":["bloom_filter","additively_homomorphic_encryption"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"ATTR-FA5B8F4E883968","locator":"Figure 2, p. 14","note":null,"subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"two_party"},{"attribute":"adversary","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-FA63A8BBF5C1F4","locator":"Theorem 9, p. 31; Appendix B.4, p. 34","note":"Corrupt parties may contribute sets of up to twice the honest size","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":["malicious"]},{"attribute":"set_size_regime","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-FA6A62B4821BE1","locator":"Figure 3, p. 11","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":"balanced"},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-FAF2F10D2B7417","locator":"Figure 5, p. 39; Appendix B.7, p. 38","note":"The central party; an extension gives output to all under a weaker functionality","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":"one"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"ATTR-FB98A4EAA0843A","locator":"§5, p. 10; Figure 8, p. 12","note":null,"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"multiparty"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"ATTR-FC46EC72C6DE0A","locator":"§7, steps 1-4, p. 16","note":null,"subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":["oblivious_polynomial_evaluation","secret_sharing"]},{"attribute":"output","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"ATTR-FCB3A438BDBE54","locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":["circuit"]},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"ATTR-FD45F31C40E579","locator":"Figure 5, p. 39","note":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":"multiparty"},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"ATTR-FE0B06D5CF3EA1","locator":"abstract, p. 1; §4.2, p. 10; Theorem 4, p. 10","note":"Proved in the OOS-hybrid model, a hybrid model, with non-programmable oracles H1 and H2","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":["non-programmable random oracle"]},{"attribute":"output_to","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"ATTR-FE6BC73BCAFFF5","locator":"§3, p. 8","note":"Alice decrypts the numerator and computes the intersection","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":"one"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"ATTR-FEA7E3F6D00A35","locator":"§3.5, p. 6","note":null,"subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"two_party"},{"attribute":"parties","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"ATTR-FFABDBCA8F4527","locator":"§4, p. 23","note":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":"two_party"},{"attribute":"technique","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"ATTR-FFC484B0D8E3AF","locator":"Figure 11, p. 15; §4.1, p. 16","note":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":["secret_sharing","simple_hashing"]},{"attribute":"security_model","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"ATTR-FFD8BD5F2EF2C9","locator":"Abstract, p. 1; Theorem 4, p. 10","note":"The OOS hybrid of the proof is not a model","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":["non-programmable random oracle"]}],"attributeModel":{"attributes":[{"axis":"Setting","key":"parties","label":"Parties","question":"Whether two parties or more than two hold sets.","type":"enum","values":[{"id":"two_party","label":"Two-party"},{"id":"multiparty","label":"Multiparty"}]},{"axis":"Functionality","key":"output","label":"Output","question":"What the protocol computes from the intersection.","type":"multi_enum","values":[{"id":"intersection","label":"Intersection"},{"id":"cardinality","label":"Cardinality","meaning":"The size of the intersection (PSI-CA)."},{"id":"sum","label":"Intersection-sum","meaning":"A sum of values associated with intersecting items."},{"id":"threshold","label":"Threshold","meaning":"The intersection, or a predicate on it, only when its size meets a threshold."},{"id":"circuit","label":"Circuit","meaning":"Secret shares of per-item results, fed to a further secure computation (circuit-based PSI)."},{"id":"labeled","label":"Labeled","meaning":"The intersection with labels the server associates with its items (labeled PSI)."}]},{"axis":"Functionality","key":"output_to","label":"Output to","question":"Which parties learn the output.","type":"enum","values":[{"id":"one","label":"One party"},{"id":"all","label":"All parties"},{"id":"shared","label":"Secret-shared","meaning":"No party learns it; the parties hold shares (circuit-based PSI)."}]},{"axis":"Setting","key":"set_size_regime","label":"Set sizes","question":"Whether the protocol targets sets of the same order or exploits one much larger set.","type":"enum","values":[{"id":"balanced","label":"Balanced"},{"id":"unbalanced","label":"Unbalanced"}]},{"applies_to":{"parties":"multiparty"},"axis":"Setting","key":"corruptions","label":"Corruptions","question":"How many of the \\( \\ell \\) parties the adversary may corrupt.","type":"bound"},{"axis":"Security","by_role":true,"key":"adversary","label":"Adversary","question":"How corrupted parties may behave; one value per role when it differs by party.","type":"multi_enum","values":[{"id":"semi_honest","label":"Semi-honest"},{"id":"augmented_semi_honest","label":"Augmented semi-honest","meaning":"The adversary may change the corrupted parties' inputs, then runs the protocol honestly on them."},{"id":"covert","label":"Covert"},{"id":"malicious","label":"Malicious"},{"id":"malicious_privacy_only","label":"Malicious, privacy only","meaning":"Privacy against a malicious party, without simulation-based security."}]},{"axis":"Assumption","key":"assumptions","label":"Assumptions","question":"Which hardness assumptions security rests on.","type":"assumptions"},{"axis":"Model","key":"security_model","label":"Security model","question":"Which idealized models the proof uses.","type":"models"},{"axis":"Functionality","key":"technique","label":"Technique","question":"The techniques the protocol combines.","type":"multi_enum","values":[{"id":"diffie_hellman","label":"Diffie-Hellman"},{"id":"key_agreement","label":"Key agreement"},{"id":"rsa_blind_signature","label":"RSA blind signature"},{"id":"oblivious_polynomial_evaluation","label":"Oblivious polynomial evaluation"},{"id":"additively_homomorphic_encryption","label":"Additively homomorphic encryption"},{"id":"fully_homomorphic_encryption","label":"Fully homomorphic encryption"},{"id":"threshold_fhe","label":"Threshold FHE"},{"id":"set_reconciliation","label":"Set reconciliation"},{"id":"polynomial_sparsity_test","label":"Polynomial sparsity test"},{"id":"oprf","label":"OPRF"},{"id":"batched_oprf","label":"Batched OPRF"},{"id":"opprf","label":"OPPRF"},{"id":"ot_extension","label":"OT extension"},{"id":"sparse_ot_extension","label":"Sparse OT extension"},{"id":"bloom_filter","label":"Bloom filter"},{"id":"garbled_bloom_filter","label":"Garbled Bloom filter"},{"id":"cuckoo_hashing","label":"Cuckoo hashing"},{"id":"simple_hashing","label":"Simple hashing"},{"id":"balanced_allocation_hashing","label":"Balanced allocation hashing"},{"id":"cuckoo_filter","label":"Cuckoo filter"},{"id":"permutation_based_hashing","label":"Permutation-based hashing"},{"id":"paxos","label":"PaXoS"},{"id":"okvs","label":"OKVS"},{"id":"vole","label":"VOLE"},{"id":"subfield_vole","label":"Subfield VOLE"},{"id":"pcg","label":"PCG"},{"id":"ole","label":"OLE"},{"id":"garbled_circuits","label":"Garbled circuits"},{"id":"gmw","label":"GMW"},{"id":"sorting_network","label":"Sorting network"},{"id":"secret_sharing","label":"Secret sharing"},{"id":"server_aided_psi","label":"Server-aided PSI"},{"id":"dual_execution","label":"Dual execution"},{"id":"encode_commit","label":"Encode-commit"},{"id":"cut_and_choose","label":"Cut-and-choose"}]}],"roles":[{"id":"sender","label":"Sender"},{"id":"receiver","label":"Receiver"},{"id":"leader","label":"Leader"},{"id":"client","label":"Per client"},{"id":"party","label":"Per party"},{"id":"pivot","label":"Pivot"},{"id":"server","label":"Per server"}],"states":["conditional","unknown","not_reported","not_applicable"]},"blockAssertions":[{"block":"oprf","count":"\\( 2.4n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","func":"oprf","id":"BLOCK-0382E770D02894","implementation":"BaRK-OPRF (KKRT16)","locator":"Protocol 7, step 1, p. 16; Protocol 9, step 2, p. 17; Theorem 8, p. 15; §7.3, p. 24","note":"One one-time OPRF per cuckoo bin, queried by P1","params":{},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC"},{"block":"gc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","func":"gc","id":"BLOCK-03F360DA68F494","implementation":"free-XOR with garbled-row reduction","locator":"§2, p. 4; §5.1, p. 7; §5.2, p. 7; Table 1, p. 2","note":"Merger and filter; the Waksman swappers are unary gates the generator programs, counted in its own figures","params":{"|C|":"\\( s \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","func":"vole","id":"BLOCK-063A554A46DDDE","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","func":"two_pc","id":"BLOCK-064A33365CF899","implementation":"GMW, with SilentOT","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT"},{"block":"coin","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","func":"coin_toss","id":"BLOCK-0D59123F03B33F","implementation":null,"locator":"Figure 4, step 1, p. 12","note":"Agrees on the hash function of the bins","params":{},"phase":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","func":"two_pc","id":"BLOCK-130B77DD0C7757","implementation":"GMW, in ABY","locator":"Protocol 9, step 3, p. 17; §5.2, p. 20; §7.3, pp. 25–26; §7.4, p. 27","note":"The matching circuit, one equality test per bin and no stash; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\log(\\lambda+\\log(1.27n)) \\)","|C|":"\\( 1.27n(\\lambda+\\log(1.27n)-1) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH"},{"block":"inv","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","func":"inv","id":"BLOCK-17AB535057C696","implementation":"singularity test of Kiltz et al.","locator":"Figure 5, step 6, p. 11; Theorem 3, p. 11","note":"Bob inputs the encrypted difference of the Hankel matrices, Alice her secret key","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| > \\lambda+\\log((4t^{2}+2t)(p-1)) \\)","k":"\\( 2t+1 \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-AHE"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","func":"vole","id":"BLOCK-1A073E06965FA8","implementation":"silent VOLE (Silver)","locator":"§4, pp. 22–23; RS21 Figure 4, step 3, p. 36; RS21 Theorem 3.1, p. 16","note":"The malicious VOLE-PSI protocol with this paper's OKVS, one correlation per OKVS position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( en_Y \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-MAL"},{"block":"base_ot","count":"\\( \\lambda \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","func":"ot","id":"BLOCK-1F1F15A35448D2","implementation":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","params":{},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT"},{"block":"cmp","count":"\\( \\lambda t \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","func":"two_pc","id":"BLOCK-214FC01C4018D6","implementation":null,"locator":"Figure 8, step 5, p. 10; Figure 2 and §2.3, p. 5","note":"One comparison per bucket and partition of the summed shares with the default, any generic secure computation, with \\( O(|\\mathbb{F}|) \\) gates","params":{"|C|":"\\( O(|\\mathbb{F}|) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","func":"vole","id":"BLOCK-29F42C1BDCE483","implementation":"silent VOLE (Silver)","locator":"§4, p. 23; Table 2, p. 25; RS21 Figure 8, step 1, p. 38; RS21 Figure 4, step 3, p. 36","note":"For the OPRF's OKVS over the receiver's cuckoo bins, one correlation per position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( e\\epsilon n_Y \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT"},{"block":"encode","count":"\\( m\\mu \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","func":"encode","id":"BLOCK-2A7F4DEA754B0A","implementation":"OOS16 1-out-of-N OT, BCH-(511, 76, 171) code","locator":"Figure 9, step 3, p. 27; Theorem 3, p. 16; §7, p. 18","note":"One instance per bin position, Bob receiving","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM"},{"block":"gc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","func":"gc","id":"BLOCK-2ABC130B714E6A","implementation":"free-XOR with garbled-row reduction","locator":"§2, p. 4; §5.3.2, p. 8; Table 1, p. 2","note":"Alice, who inputs the masks, garbles; Bob evaluates and learns the masked outputs, as Yao's evaluator does","params":{"|C|":"\\( s \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE"},{"block":"base_ot","count":"\\( \\lambda \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","func":"ot","id":"BLOCK-2CF4619366B0CE","implementation":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","params":{},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA"},{"block":"opprf","count":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"},"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","func":"opprf","id":"BLOCK-2D48B786131CB2","implementation":"malicious PaXoS-based OPPRF of Pinkas et al.; measured with KMPRT's table-based OPPRF","locator":"Protocol 4.2, step 2, p. 10; Theorem 4.3, p. 10","note":"The leader receives in each; the pivot and every other server send in one","params":{"m_1":"\\( n \\)","m_2":"\\( n \\)"},"phase":null,"sessions":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"},"subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION"},{"block":"vec_intrvl","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","func":"mpc","id":"BLOCK-37694BE0313505","implementation":null,"locator":"Figure 11, step 10, p. 15; Figure 5, p. 6; §4, p. 14","note":"Whether one partition's summed intersection size lies between \\( n-t \\) and \\( n \\), with secret-shared output, by any generic MPC protocol","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\lambda\\ell|\\mathbb{F}|) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY"},{"block":"vec_leq","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","func":"two_pc","id":"BLOCK-3B798A9C5B1041","implementation":null,"locator":"Figure 7, step 8, p. 9; Figure 3 and §2.3, p. 6","note":"One test whether any of the \\( \\lambda \\) partition sums is at most \\( t \\), by generic secure computation","params":{"|C|":"\\( O(\\lambda|\\mathbb{F}|) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","func":"vole","id":"BLOCK-3E3A9572AEBB96","implementation":"silent VOLE (Silver)","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","note":"Invoked as subfield VOLE with the base field equal to its extension, which is VOLE","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\approx 1.28n_Y \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-FAST"},{"block":"oprf","count":"\\( 1.27n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","func":"oprf","id":"BLOCK-44291DA87F117A","implementation":"OPRF of PSZ18 in the code; costed as BaRK-OPRF (KKRT16)","locator":"Protocol 7, step 1, p. 16; §5.2, p. 20; §7.3, p. 24; §7.4, p. 27","note":"One one-time OPRF per cuckoo bin, queried by P1","params":{},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH"},{"block":"coin","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","func":"coin_toss","id":"BLOCK-48A879510CD797","implementation":null,"locator":"Figure 9, step 1, p. 27","note":"Agrees on the hash function and the commitment parameters","params":{},"phase":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM"},{"block":"oos","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","func":"oos","id":"BLOCK-4AC28E6383EB00","implementation":"OOS OT extension, Naor-Pinkas base OTs","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; §4.4, p. 15; §7.1, p. 22","note":"One run whose choice strings are the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS"},{"block":"zero_share","count":"\\( n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","func":"zero_share","id":"BLOCK-516D6D785DB098","implementation":"unconditional zero sharing of Kolesnikov et al., from exchanged seeds","locator":"Protocol 4.2, step 1, p. 10; Theorem 4.3, p. 10; Protocol 4.4, step 6, p. 10","note":"Among the pivot and the servers, the leader included, inside ZeroXOR; each takes one share per item","params":{"\\ell":"\\( t_c + 1 \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION"},{"block":"ole_to_receiver","count":"\\( 3t+1 \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","func":"ole","id":"BLOCK-524576A067EEAD","implementation":null,"locator":"Figure 10, step 3, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","note":"Alice receives her evaluations under Bob's random polynomials; any passively secure OLE with constant communication overhead","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-AHE"},{"block":"gc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","func":"gc","id":"BLOCK-558DC5E6D11D8D","implementation":"Yao's garbled circuits","locator":"§6.1, p. 26; Imported Theorem 6.3, p. 25","note":"Half-GCD singularity test of the Hankel matrix of order \\( t+1 \\); the garbler and the oblivious transfers are left open","params":{"|C|":"\\( O(t\\log^{2}t\\cdot\\mathrm{poly}(\\kappa)) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY"},{"block":"rot","count":"\\( \\epsilon n_Y+s \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","func":"rot","id":"BLOCK-561427A641F3E7","implementation":"Kolesnikov-Kumaresan 1-out-of-N OT extension, BCH code","locator":"Protocol 3, step 2, p. 22; §5, Security, p. 23","note":"One per bin and stash position: \\( N = 2^{\\mu} \\) for items cut to \\( \\mu = \\sigma-\\log_2(\\epsilon n_Y)+\\log_2 k \\) bits by permutation-based hashing","params":{"N":"\\( 2^{\\sigma}k/(\\epsilon n_Y) \\)","\\tau":"\\( \\lambda+\\log_2(kn_Xn_Y) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT"},{"block":"base_ot","count":"\\( \\lambda \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","func":"ot","id":"BLOCK-56152DDBD17521","implementation":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, run the other way, once per pair of parties","params":{},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","func":"two_pc","id":"BLOCK-58D0DD9931937D","implementation":null,"locator":"§4, p. 23; RS21 Figure 10, step 5, p. 39; RS21 §6, p. 23","note":"One equality test of the bin values per bin, as in VOLE-PSI; the paper names only Silver for the row","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT"},{"block":"oos","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","func":"oos","id":"BLOCK-5A9F4EF13D7B7F","implementation":"OOS OT extension, Naor-Pinkas base OTs","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","note":"One run on the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL"},{"block":"oprf","count":"\\( B \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","func":"oprf","id":"BLOCK-5ED2A888754702","implementation":"KKRT batched OPRF","locator":"Figure 10, steps 2–3, p. 16; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"Per party: three OPPRFs in a ring, P1 to P2 to P3 to P1, one OPRF per cuckoo bin of the receiver; each party keys one and queries one","params":{},"phase":"online","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY"},{"block":"ot","count":"\\( \\sigma n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","func":"ot","id":"BLOCK-6232B5AE5D0D93","implementation":"IKNP OT extension","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN"},{"block":"base_ot_share","count":"\\( \\min(t_c+1,\\ell-1)\\kappa \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","func":"ot","id":"BLOCK-6404392A66FF64","implementation":"Naor-Pinkas","locator":"§7, p. 17; Table 1, p. 3; §5.3, Generalization, p. 13","note":"Per party: \\( \\kappa \\) base OTs for each sharing OPRF it keys or queries, which IKNP extends; the OPRF's sender sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","sessions":"\\( \\min(t_c+1,\\ell-1) \\)","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH"},{"block":"rot","count":"\\( 1.3n_X \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","func":"rot","id":"BLOCK-6507D70031ADF0","implementation":"Batched random OT of Kolesnikov et al.","locator":"Figure 3, step 3, p. 10; Appendix A.6, p. 16; Table 3, p. 12; §5.1, p. 11","note":"One per cuckoo bin of P1, which learns its PRF value; base public-key OTs precede it","params":{"N":"\\( 2^{\\sigma} \\)","\\tau":"\\( u \\)"},"phase":"online","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT"},{"block":"base_ot_rec","count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","func":"ot","id":"BLOCK-6785B21A4271BA","implementation":"Naor-Pinkas","locator":"§7, p. 17; Table 1, p. 3","note":"\\( \\kappa \\) base OTs for each client's reconstruction OPRF, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH"},{"block":"zk","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","func":"zk","id":"BLOCK-6EFA70751AA8CA","implementation":null,"locator":"Figure 8, step 1b, p. 25; proof of Theorem 3, pp. 25–26","note":"That all OPRF answers use one key","params":{},"phase":"online","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE"},{"block":"base_ot","count":"\\( \\lambda \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","func":"ot","id":"BLOCK-735466255B49D8","implementation":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","params":{},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC"},{"block":"gc","count":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4} \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","func":"gc","id":"BLOCK-7544B9B1EBCB30","implementation":"free-XOR with garbled-row reduction","locator":"§2, p. 4; §4, p. 5; Algorithm 1, p. 5; Table 1, p. 2","note":"One Equal circuit per comparison; the count is the expected number after shuffling, and at most \\( n^2 \\)","params":{"|C|":"\\( \\sigma-1 \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC"},{"block":"psi","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","func":"psi","id":"BLOCK-75F9DC5B8AB189","implementation":"server-aided PSI of Kamara et al.","locator":"Protocol 3.3, step 6, p. 8; Theorem 3.4, p. 8","note":"Between the pivot and the leader, on their derived sets; one client aids as the server","params":{"n_X":"\\( n \\)","n_Y":"\\( n \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION"},{"block":"coin","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","func":"coin_toss","id":"BLOCK-7F3680569EA635","implementation":null,"locator":"Figure 4, step 1, p. 12","note":"Agrees on the hash function of the bins","params":{},"phase":null,"subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM"},{"block":"min","count":"\\( \\lambda t \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","func":"mpc","id":"BLOCK-80BF49CEA4D05B","implementation":null,"locator":"Figure 11, step 7, p. 15; Figure 4, p. 6; §4, p. 14","note":"One per partition and bucket: the least padding among the parties, with secret-shared output, by any generic MPC protocol","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","func":"two_pc","id":"BLOCK-82764987527B1B","implementation":"GMW","locator":"Protocol 10, step 3, p. 20; Functionality 1, p. 9; §7.3, pp. 24–26","note":"The matching circuit: two \\( \\gamma \\)-bit sections per bin and the stash pairs of full items; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2\\cdot 2.4n(\\lambda+\\log(2.4n)-1)+s^{2}(\\sigma-1) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED"},{"block":"sub_vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","func":"sub_vole","id":"BLOCK-849CFE532DAC86","implementation":"silent subfield VOLE (Silver)","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","note":"The smallest base field and the smallest extension meeting these bounds","params":{"\\mathbb{B}":"\\( |\\mathbb{B}| \\ge \\lambda+\\log(n_Xn_Y) \\)","\\mathbb{F}":"\\( |\\mathbb{F}| \\ge \\kappa \\)","m":"\\( 1.23n_Y \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2022-RR-SD"},{"block":"isect","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","func":"mpc","id":"BLOCK-85A09AD3F483AB","implementation":null,"locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","note":"The intersection step of GS19: each set polynomial times a random polynomial of degree \\( t \\), summed at \\( 3t+1 \\) points; multiplications over the field","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( (3t+1)\\ell \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY"},{"block":"ot","count":"\\( \\sigma n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","func":"ot","id":"BLOCK-86A67DED4CD059","implementation":"IKNP OT extension","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT"},{"block":"gc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","func":"gc","id":"BLOCK-87445918A498F1","implementation":"free-XOR with garbled-row reduction","locator":"§2, p. 4; §5.3.1, p. 8; Table 1, p. 2","note":null,"params":{"|C|":"\\( s \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT"},{"block":"ot","count":"\\( \\sigma n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","func":"ot","id":"BLOCK-8857CB6C9AD936","implementation":"IKNP OT extension","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC"},{"block":"base_ot","count":"\\( \\kappa \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","func":"ot","id":"BLOCK-89CEE970BC64AE","implementation":"Chou-Orlandi OT with the verification step of Doerner et al.","locator":"§3.1, p. 4; §5.1, pp. 11–12","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR"},{"block":"gc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","func":"gc","id":"BLOCK-8EF67E94D6C8E4","implementation":"free-XOR with garbled-row reduction","locator":"§2, p. 4; §3, p. 4; Table 1, p. 2","note":null,"params":{"|C|":"\\( 2^{\\sigma} \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA"},{"block":"ole_to_receiver","count":"\\( 3t/2+1 \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","func":"ole","id":"BLOCK-92EAAAE2C065C9","implementation":null,"locator":"Corollary 3, p. 10; GS19 Figure 10, step 3, p. 17","note":"Noisy polynomial addition of the intersection step: Alice receives her evaluations under Bob's random polynomials","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY"},{"block":"base_ot","count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","func":"ot","id":"BLOCK-94813ED15A474D","implementation":"Naor-Pinkas","locator":"§7, p. 17; Table 1, p. 3","note":"\\( \\kappa \\) base OTs for each client's OPRF with the leader, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","func":"vole","id":"BLOCK-9619FABDD69A63","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-SH"},{"block":"oprf","count":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","func":"oprf","id":"BLOCK-98507CCDAFDC61","implementation":"vOLE","locator":"Figure 5, step 2(a), p. 39; Theorem 9, p. 31; Table 4, p. 36","note":"One malicious two-party OPRF per client, keyed by the client; the leader queries its \\( n \\) items in each","params":{"c":"\\( n \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","func":"vole","id":"BLOCK-9B3ED3E9B2476C","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20 and the consistency check of WYKW20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION"},{"block":"cot","count":"\\( \\sigma n_Y \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","func":"cot","id":"BLOCK-9FE53BC7520FEE","implementation":"C-OT extension of Keller, Orsini and Scholl","locator":"Figure 1, p. 9; §4.3, p. 8; §5.1, pp. 11–12","note":"Random-choice C-OTs on the free-XOR offset, one per input bit of each precomputed item","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC"},{"block":"oprf","count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","func":"oprf","id":"BLOCK-A784B1DE14583B","implementation":"KKRT batched OPRF","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8; §6.1, p. 14; §7, p. 17","note":"One per cuckoo bin of the leader in each client's OPPRF; the leader queries in all, a client keys one","params":{},"phase":"online","sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG"},{"block":"oos","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","func":"oos","id":"BLOCK-A8A5632693A716","implementation":"OOS OT extension, Naor-Pinkas base OTs","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","note":"One run on the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS"},{"block":"rot","count":"\\( \\sigma n_Y \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","func":"rot","id":"BLOCK-AB371A8CE910FA","implementation":"OT extension of Keller, Orsini and Scholl, in libOTe","locator":"Figure 2, p. 10; §4.4, p. 10; §5.3, p. 12","note":"One random OT of exponents per input bit of each precomputed item; the online messages turn it into a correlated OT","params":{"\\tau":"\\( w \\)"},"phase":"offline","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","func":"two_pc","id":"BLOCK-AB69492E38ECC8","implementation":"GMW","locator":"Protocol 9, step 3, p. 17; Functionality 1, p. 9; §7.3, pp. 24–26","note":"The matching circuit; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2.4n(\\lambda+\\log(2.4n)-1)+sn(\\sigma-1) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC"},{"block":"pict","count":"\\( \\lambda t\\tilde{t} \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","func":"l_pict","id":"BLOCK-ACF7BED22FBCFC","implementation":"protocol of Branco, Döttling and Pu, with generic secure computation in place of homomorphic encryption","locator":"Figure 11, p. 15; Figure 12, p. 16; Theorems 7–8, pp. 15–16; §4.1, p. 16","note":"One test per bucket and per threshold up to \\( \\tilde{t} \\), with secret-shared output","params":{"\\ell":"\\( \\ell \\)","n":"\\( n \\)","t":"\\( \\le \\tilde{t} \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","func":"two_pc","id":"BLOCK-AD7D27AC21615D","implementation":"GMW, in the ABY framework","locator":"§5.2, pp. 16–17; §6.2, pp. 22–23; §6.3, p. 24","note":"The matching circuit up to one bit per item; the circuit for f adds its own gates and depth","params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D"},{"block":"geq","count":"\\( \\lambda t \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","func":"mpc","id":"BLOCK-AE946123FF976D","implementation":null,"locator":"Figure 12, steps 5–6, p. 16; Figure 2 and §2.3, p. 5","note":"One per partition and bucket: the summed test shares against the bucket's threshold, giving the intersection size or the default","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","func":"vole","id":"BLOCK-B04FD9564F832F","implementation":null,"locator":"Figure 3, step 1, p. 22; Theorem 7, p. 21; §7.1, p. 21","note":"Chosen inputs: the receiver puts in its OKVS, the sender a random scalar; no malicious protocol for it is named","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\ell_1}} \\)","m":"\\( m \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE"},{"block":"oprf_rec","count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","func":"oprf","id":"BLOCK-B314BCC3360B59","implementation":"KKRT batched OPRF","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"One per cuckoo bin of the leader in each client's reconstruction OPPRF; the leader queries in all, a client keys one","params":{},"phase":"online","sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH"},{"block":"ole_to_sender","count":"\\( 3t/2+1 \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","func":"ole","id":"BLOCK-B3E08CFE9D388E","implementation":null,"locator":"Corollary 3, p. 10; GS19 Figure 10, step 4, p. 17","note":"Noisy polynomial addition of the intersection step: Bob receives his evaluations under Alice's random polynomials","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","func":"two_pc","id":"BLOCK-BA103218EA3926","implementation":"GMW, with IKNP OT extension","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT"},{"block":"oos","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","func":"oos","id":"BLOCK-BD6E33A6070333","implementation":"OOS malicious OT extension","locator":"§5.2, p. 16; §5.4, p. 17; §6.3, p. 19; PRTY20 Figure 3, step 2, p. 11","note":"One run on the receiver's star-architecture table, one instance per position of its leaves and centre; \\( \\tau \\), the length of \\( H_1 \\), as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( (b+1)(1.3n'+\\lambda+0.5\\log n') \\)","n_C":"\\( w \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"},{"block":"ot","count":"\\( \\sigma n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","func":"ot","id":"BLOCK-C64ABAEE012B97","implementation":"IKNP OT extension","locator":"§2, p. 4","note":"One per bit of Bob's set, for his wire labels as evaluator","params":{"\\tau":"\\( \\kappa \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE"},{"block":"oprf_reversed","count":"\\( 2.4n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","func":"oprf","id":"BLOCK-C802089E558003","implementation":"BaRK-OPRF (KKRT16)","locator":"Protocol 10, step 2, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 25","note":"Second phase, roles reversed: one per bin of P2's cuckoo table, queried by P2","params":{},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED"},{"block":"coin","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","func":"coin_toss","id":"BLOCK-C92996B1E606D9","implementation":null,"locator":"Figure 8, step 1, p. 25; Figure 1, steps 1–2, p. 13; §7.3, pp. 17–18","note":"Samples the hash functions per receiver, since the pre-processing is not reused","params":{},"phase":"offline","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE"},{"block":"base_ot","count":"\\( \\kappa \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","func":"ot","id":"BLOCK-CABFDA758999BC","implementation":"Chou-Orlandi OT with the verification step of Doerner et al.","locator":"§3.1, p. 4; §5.1, pp. 11–12","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC"},{"block":"coin","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","func":"coin_toss","id":"BLOCK-D1602C37D3C1AB","implementation":null,"locator":"Figure 1, steps 1–2, p. 13","note":"Samples the hash to short strings and the three cuckoo hash functions","params":{},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2018-CHLR"},{"block":"base_ot","count":"\\( k \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","func":"ot","id":"BLOCK-D4DF8508F129D4","implementation":"Naor-Pinkas OTs extended by IKNP","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16; Table 4, p. 15","note":"The \\( k \\) column OTs of BaRK-OPRF on \\( \\kappa \\)-bit seeds, run in the offline phase; the matrix that stretches them to the bins is the protocol's","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","subject_id":"PSI-CONSTRUCTION-2016-KKRT"},{"block":"oprf_share","count":"\\( \\min(t_c+1,\\ell-1)B \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","func":"oprf","id":"BLOCK-D5309B9CCF2747","implementation":"KKRT batched OPRF","locator":"Figure 8, step 2, p. 12; §5.3, Generalization, p. 13; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"Per party: one OPRF per cuckoo bin of the receiver in each sharing OPPRF; each party keys \\( \\min(t_c+1,\\ell-1) \\) and queries as many","params":{},"phase":"online","sessions":"\\( \\min(t_c+1,\\ell-1) \\)","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH"},{"block":"encode","count":"\\( m\\mu \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","func":"encode","id":"BLOCK-D9BB1B0D15DED5","implementation":"OOS16 1-out-of-N OT, BCH-(511, 76, 171) code","locator":"Figure 4, step 3, p. 12; Theorem 2, p. 13; §7, p. 18","note":"One OOS run per direction, one instance per bin position: each party receives in one run and sends in the other","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM"},{"block":"ot","count":"\\( 2^{\\sigma} \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","func":"ot","id":"BLOCK-DB14A9F2348ECB","implementation":"IKNP OT extension","locator":"§2, p. 4; §3, p. 4","note":"One per bit of the evaluator's vector, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA"},{"block":"pict","count":"\\( \\lambda t(1+3\\ln 2t) \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","func":"pict","id":"BLOCK-DBF869C41B456D","implementation":"PICT of Ghosh and Simkin with the determinant protocol of Cramer and Damgård","locator":"Figure 7, p. 9; Figure 8, p. 10; Theorems 3–4, pp. 9–10; §3.1, p. 10","note":"One test per bucket and per threshold up to \\( 1+3\\ln 2t \\), with secret-shared output; the bracketed \\( t \\) is the test's own, bounded by the row's","params":{"n":"\\( n \\)","t":"\\( \\le 1+3\\ln 2t \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY"},{"block":"coin","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","func":"coin_toss","id":"BLOCK-DDF18A8950F080","implementation":null,"locator":"Figure 1, steps 1–2, p. 13","note":"Samples the hash to short strings and the three cuckoo hash functions","params":{},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED"},{"block":"base_ot","count":"\\( \\kappa \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","func":"ot","id":"BLOCK-E45FB202B4512B","implementation":"Naor-Pinkas","locator":"§7, p. 17","note":"Per party: \\( \\kappa \\) base OTs for the OPRF it keys, which it sends, and for the one it queries; IKNP extends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY"},{"block":"oos","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","func":"oos","id":"BLOCK-E62F9B725DD60E","implementation":"OOS OT extension, Naor-Pinkas base OTs","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; §4.4, p. 15; §7.1, p. 22; Table 1, p. 21","note":"One run whose choice strings are the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","func":"vole","id":"BLOCK-E6907F0E7E4451","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","func":"vole","id":"BLOCK-E7D5CBEB959514","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION"},{"block":"sing_test","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","func":"mpc","id":"BLOCK-E987866CA11FBE","implementation":null,"locator":"Figure 8, step 2, p. 27; Figure 7, p. 26; §6.1, Multi-Party Singularity Testing, pp. 25–26","note":"The paper's SingTest: half-GCD test of the summed Hankel shares over a field of over \\( \\lambda+\\log(t(t+1)(p-1)) \\) bits; any protocol, two sketched","params":{"\\ell":"\\( \\ell \\)","depth":"\\( O(t\\log^{2}t) \\)","|C|":"\\( O(t\\log^{2}t) \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF"},{"block":"two_pc","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","func":"two_pc","id":"BLOCK-F2EF5AB5400249","implementation":null,"locator":"§4.2, p. 13; §6.2, pp. 22–23","note":"Yao or GMW, not fixed; the circuit for f adds its own gates and depth","params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR"},{"block":"ot","count":"\\( m\\mu(\\sigma-\\log n) \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","func":"ot","id":"BLOCK-F7AB9717F605A4","implementation":"KOS15 chosen-message 1-out-of-2 OT extension","locator":"§4, pp. 6–7; Figure 4, step 3, p. 12; §7, p. 18; Figure 8, p. 20","note":"Per direction, \\( \\sigma-\\log n \\) OTs of \\( \\kappa \\)-bit strings per encoding, run offline on random choices; each party receives one way and sends the other","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM"},{"block":"base_ot","count":"\\( \\lambda \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","func":"ot","id":"BLOCK-F876ECD506B547","implementation":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","params":{},"phase":"setup","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN"},{"block":"ole_to_sender","count":"\\( 3t+1 \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","func":"ole","id":"BLOCK-FBA330D986868B","implementation":null,"locator":"Figure 10, step 4, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","note":"Bob receives his evaluations under Alice's random polynomials; any passively secure OLE with constant communication overhead","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-GS-AHE"},{"block":"vole","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","func":"vole","id":"BLOCK-FC3FBED7DF2D17","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20 and the consistency check of WYKW20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-RS-MAL"},{"block":"oos","count":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","func":"oos","id":"BLOCK-FC93810391164D","implementation":"OOS malicious OT extension","locator":"§4.1, pp. 10–11; §6.3, p. 19; §8.1, p. 23; PRTY20 Figure 3, step 2, p. 11","note":"One run on the receiver's three-hash table, one instance per position; \\( \\tau \\), the output length of \\( H_1 \\), is set as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( 1.3n+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":null,"subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT"},{"block":"oprf","count":"\\( 2.4n \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","func":"oprf","id":"BLOCK-FD28126AD798A4","implementation":"BaRK-OPRF (KKRT16)","locator":"Protocol 10, step 1, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 24","note":"First phase: one one-time OPRF per bin of P1's cuckoo table, queried by P1","params":{},"phase":null,"subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED"},{"block":"gc","count":"\\( n_Y \\)","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","func":"gc","id":"BLOCK-FED0D472700CAA","implementation":"Yao with free-XOR, half-gates and fixed-key AES","locator":"Figure 1, p. 9; §5.2, p. 12","note":"One garbled LowMC circuit per precomputed item, sent offline and evaluated online","params":{"|C|":"\\( a \\)"},"phase":"offline","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC"}],"catalogVersion":"psi-dossier-v1-seed","comparisonModel":{"algorithms":[],"blocks":[{"group":"Oblivious transfer","id":"ot","kind":"functionality","label":"OT","meaning":"1-out-of-\\( N \\) oblivious transfer of \\( \\tau \\)-bit strings: the sender inputs \\( N \\) strings and the receiver learns the one it chooses, as in PRTY20's \\( \\mathcal{F}^{\\tau}_{N\\text{-OT}} \\).","params":[{"default":"\\( 2 \\)","meaning":"Strings the receiver chooses from","name":"N"},{"meaning":"String length in bits, where the paper states it","name":"\\tau","optional":true}],"roles":["sender","receiver"]},{"group":"Oblivious transfer","id":"rot","kind":"functionality","label":"ROT","meaning":"Random OT: as OT, but the sender inputs nothing and receives random strings, as in PRTY20's \\( \\mathcal{F}^{\\tau}_{N\\text{-ROT}} \\).","params":[{"default":"\\( 2 \\)","meaning":"Strings the receiver chooses from","name":"N"},{"meaning":"String length in bits, where the paper states it","name":"\\tau","optional":true}],"roles":["sender","receiver"]},{"group":"Oblivious transfer","id":"cot","kind":"functionality","label":"C-OT","meaning":"Correlated OT of \\( \\tau \\)-bit strings: the sender fixes a correlation \\( f \\) and gets a random \\( m_0 \\) with \\( m_1 = f(m_0) \\), and the receiver learns \\( m_b \\) for its choice bit \\( b \\), as KRSSW19 takes it from ALSZ13.","params":[{"meaning":"String length in bits","name":"\\tau"}],"roles":["sender","receiver"]},{"group":"Oblivious transfer","id":"oos","kind":"functionality","label":"OOS","meaning":"The OT extension of Orrù, Orsini and Scholl as PRTY20 defines it: for the sender's \\( s \\) and the receiver's choices \\( d_1, \\ldots, d_m \\), the sender gets \\( q_i \\) and the receiver \\( r_i = q_i \\oplus s \\wedge C(d_i) \\), for a binary linear code \\( C \\) of length \\( n_C \\), dimension \\( \\tau \\) and distance at least \\( \\kappa \\); the outputs are XOR-homomorphic across instances.","params":[{"meaning":"Dimension: the number of instances, all with one sender string \\( s \\)","name":"m"},{"meaning":"Length of the linear code: the width of the OT-extension matrix","name":"n_C"},{"meaning":"Dimension of the code: the length in bits of each choice string, so \\( N = 2^{\\tau} \\)","name":"\\tau"}],"roles":["sender","receiver"]},{"group":"OLE and VOLE","id":"ole","kind":"functionality","label":"OLE","meaning":"Oblivious linear function evaluation over \\( \\mathbb{F} \\): the sender inputs \\( a, b \\), the receiver \\( x \\), and the receiver learns \\( ax + b \\), as GS19's \\( \\mathcal{F}_{\\mathsf{OLE}} \\).","params":[{"meaning":"The field: named (\\( \\mathbb{F}_{2^{\\kappa}} \\)), or given by the size of its elements in bits, \\( |\\mathbb{F}| \\), as everywhere in the table","name":"\\mathbb{F}"}],"roles":["sender","receiver"]},{"group":"OLE and VOLE","id":"vole","kind":"functionality","label":"VOLE","meaning":"Vector OLE of dimension \\( m \\) over a field \\( \\mathbb{F} \\): the sender gets \\( \\Delta \\) and \\( \\vec{B} \\), the receiver \\( \\vec{A} \\) and \\( \\vec{C} = \\vec{A}\\Delta + \\vec{B} \\); random, as in RS21's \\( \\mathcal{F}_{\\mathsf{vole}} \\), or with the receiver's vector chosen, as in GPRTY21's vOLE.","params":[{"meaning":"Dimension: the number of correlations, all with one \\( \\Delta \\)","name":"m"},{"meaning":"The field: named (\\( \\mathbb{F}_{2^{\\kappa}} \\)), or given by the size of its elements in bits, \\( |\\mathbb{F}| \\), as everywhere in the table","name":"\\mathbb{F}"}],"roles":["sender","receiver"]},{"group":"OLE and VOLE","id":"sub_vole","kind":"functionality","label":"sub-VOLE","meaning":"Subfield VOLE: \\( \\vec{A} \\) over a base field \\( \\mathbb{B} \\), and \\( \\Delta \\), \\( \\vec{B} \\), \\( \\vec{C} \\) over its extension \\( \\mathbb{F} \\), as in RR22's \\( \\mathcal{F}_{\\textsf{sub-vole}} \\).","params":[{"meaning":"Dimension: the number of correlations","name":"m"},{"meaning":"The base field: named, or given by the size of its elements in bits, \\( |\\mathbb{B}| \\)","name":"\\mathbb{B}"},{"meaning":"The extension field: named, or given by the size of its elements in bits, \\( |\\mathbb{F}| \\)","name":"\\mathbb{F}"}],"roles":["sender","receiver"]},{"group":"Oblivious PRF and encoding","id":"oprf","kind":"functionality","label":"OPRF","meaning":"Oblivious PRF: the receiver inputs queries \\( q_1, \\ldots, q_c \\) and learns \\( F(k, q_i) \\), the sender inputs or gets the key \\( k \\), as PSTY19 defines it; its one-time \\( \\mathcal{F}_{\\mathsf{OPRF}} \\) has \\( c = 1 \\).","params":[{"default":"\\( 1 \\)","meaning":"Queries under one key","name":"c"}],"roles":["sender","receiver"]},{"group":"Oblivious PRF and encoding","id":"opprf","kind":"functionality","label":"OPPRF","meaning":"Oblivious programmable PRF: the sender programs up to \\( m_1 \\) points and gets the key and a hint, the receiver makes up to \\( m_2 \\) queries and learns the hint and the PRF values at them, as in NTY21's \\( \\mathcal{F}_{\\mathsf{opprf}} \\).","params":[{"meaning":"Bound on the points the sender programs","name":"m_1"},{"meaning":"Bound on the receiver's queries","name":"m_2"}],"roles":["sender","receiver"]},{"group":"Oblivious PRF and encoding","id":"encode","kind":"functionality","label":"Encode","meaning":"Oblivious encoding, RR17's \\( \\mathcal{F}_{\\mathsf{encode}} \\): a random map from \\( \\sigma \\)-bit inputs to \\( \\ell \\)-bit outputs; the receiver learns its value at one input of its choice, the sender at any number of inputs.","params":[{"meaning":"Input length in bits (the paper's \\( \\sigma \\))","name":"in"},{"meaning":"Output length in bits (the paper's \\( \\ell \\))","name":"out"}],"roles":["sender","receiver"]},{"group":"Generic secure computation","id":"two_pc","kind":"functionality","label":"2PC","meaning":"Generic secure two-party computation of a Boolean circuit \\( C \\).","params":[{"meaning":"AND gates of the circuit","name":"|C|"},{"meaning":"AND depth of the circuit, where the paper states it","name":"depth","optional":true}],"roles":["party"]},{"group":"Generic secure computation","id":"mpc","kind":"functionality","label":"MPC","meaning":"Generic secure multiparty computation of a circuit \\( C \\) among \\( \\ell \\) parties, Boolean or arithmetic over a field.","params":[{"meaning":"Number of parties","name":"\\ell"},{"meaning":"Multiplication gates of the circuit: AND gates, or multiplications over its field","name":"|C|"},{"meaning":"Multiplicative depth of the circuit, where the paper states it","name":"depth","optional":true}],"roles":["party"]},{"group":"Generic secure computation","id":"gc","kind":"garbling","label":"GC","meaning":"A garbled circuit for \\( C \\) (Yao): one party garbles and sends it, the other evaluates it; with free XOR, only non-free gates cost.","params":[{"meaning":"Non-free gates of the circuit","name":"|C|"}],"roles":["garbler","evaluator"]},{"group":"Intersection and cardinality tests","id":"psi","kind":"functionality","label":"PSI","meaning":"Two-party PSI, used inside a multiparty protocol; a server-aided implementation adds a server that holds no input and learns no output.","params":[{"meaning":"Sender's set size","name":"n_X"},{"meaning":"Receiver's set size","name":"n_Y"}],"roles":["sender","receiver","server"]},{"group":"Intersection and cardinality tests","id":"pict","kind":"functionality","label":"PICT","meaning":"Two-party private intersection cardinality test with secret-shared output: for sets of at most \\( n \\) items, the parties get shares of 1 if \\( |X \\triangle Y| \\le t \\) and of 0 otherwise, as GS23's \\( \\mathcal{F}^{n,t}_{\\mathsf{pict}} \\).","params":[{"meaning":"Bound on each set's size","name":"n"},{"meaning":"Threshold on the symmetric difference","name":"t"}],"roles":["party"]},{"group":"Intersection and cardinality tests","id":"l_pict","kind":"functionality","label":"ℓ-PICT","meaning":"Multiparty private intersection cardinality test with secret-shared output: \\( \\ell \\) parties with sets of \\( n \\) items get shares of 1 if their intersection has at least \\( n - t \\) items and of 0 otherwise, as GS23's \\( \\mathcal{F}^{n,t}_{\\ell\\text{-pict}} \\).","params":[{"meaning":"Number of parties","name":"\\ell"},{"meaning":"Size of each set","name":"n"},{"meaning":"Allowed shortfall of the intersection from \\( n \\)","name":"t"}],"roles":["party"]},{"group":"Intersection and cardinality tests","id":"inv","kind":"functionality","label":"INV","meaning":"Singularity test of a \\( k \\times k \\) matrix over \\( \\mathbb{F} \\), encrypted under one party's additively homomorphic key: both learn whether it is singular, as GS19's \\( \\mathcal{F}_{\\mathsf{INV}} \\), realized by Kiltz et al.","params":[{"meaning":"Order of the matrix","name":"k"},{"meaning":"The field: named (\\( \\mathbb{F}_{2^{\\kappa}} \\)), or given by the size of its elements in bits, \\( |\\mathbb{F}| \\), as everywhere in the table","name":"\\mathbb{F}"}],"roles":["party"]},{"group":"Randomness and proofs","id":"coin_toss","kind":"functionality","label":"coin tossing","meaning":"Coin tossing (CHLR18 says coin flipping): the parties jointly sample public random values, such as hash functions, that neither can bias.","params":[{"meaning":"Random values sampled, where the invocation fixes how many (KOS15 samples its check weights this way)","name":"m","optional":true},{"meaning":"The field the values are in: named, or given by the size of its elements in bits, \\( |\\mathbb{F}| \\)","name":"\\mathbb{F}","optional":true}],"roles":["party"]},{"group":"Randomness and proofs","id":"zero_share","kind":"functionality","label":"zeroShare","meaning":"Zero sharing among \\( \\ell \\) parties: on any input, each party gets a random share and the shares XOR to zero, as in NTY21's \\( \\mathcal{F}_{\\mathsf{zeroShare}} \\), taken from KMPRT.","params":[{"meaning":"Number of parties sharing zero (the paper's \\( n \\))","name":"\\ell"}],"roles":["party"]},{"group":"Randomness and proofs","id":"zk","kind":"functionality","label":"zero knowledge proof","meaning":"A zero knowledge proof that the prover's messages satisfy a statement, from which the simulator extracts the witness; the instance's note names the statement.","roles":["prover","verifier"]}],"columns":[],"conventions":[{"group":"Set sizes","rule":"Where the paper assumes every set has the same size, formulas use \\( n = n_X = n_Y \\); where the sizes may differ, \\( n_X \\) (sender) and \\( n_Y \\) (receiver)."},{"group":"Messages and rounds","rule":"Two-party tables count messages (one flow in one direction is one message); multiparty tables count rounds (every party may send in a round)."},{"group":"Messages and rounds","rule":"Phases run one after another and are listed apart. Within a phase, steps that need nothing from each other run at the same time, so the count is the longest chain of dependent steps."},{"group":"Communication and computation","rule":"Every cost is counted from the protocol: each message and who sends it, each operation and who performs it. Communication is the bits a role sends. A paper's own figures only check the count."},{"group":"Communication and computation","rule":"Computation counts only the costly operations. XORs, additions (in a field too), code encodings, lookups, comparisons and permutations are not counted."},{"group":"Communication and computation","rule":"Each evaluation of a hash function is one sym op, hashing items into bins included."},{"group":"Communication and computation","rule":"OTs and circuit AND gates count invocations of a building block; only a closed row shows them."},{"group":"Building blocks","rule":"A building block is what a protocol uses and its paper neither builds nor costs: a functionality of its hybrid model (VOLE, OT, OPRF, 2PC) or a garbled circuit. \\( k\\,\\mathsf{Func}[\\ldots] \\) is \\( k \\) independent invocations."},{"group":"Building blocks","rule":"An open row costs a block from the protocol its paper names for it, counted like the protocol itself with the instance's parameters."},{"group":"Building blocks","rule":"Where the roles invoke a block a different number of times (a leader paired with every client), its arrow gives each role's count; its one-time setup runs once per pairing, so each role's setup figures count its own pairings."},{"group":"Building blocks","rule":"A block used without a protocol named for it is not counted: its line reads \"not instantiated by\" the paper that leaves it abstract. Messages leave such a block inside an implementation out and name it after \"excl.\", so that count is no bound."},{"group":"Constants","rule":"Hashing and OKVS expansion constants are written as the paper prints them; a parameter the paper fixes as a function of the set sizes or security parameters is substituted."}],"filters":["output","adversary","set_size_regime","technique"],"implementation_complexity":{"iknp":{"counted":{"costs":[{"block":"iknp","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"iknp","chain":["iknp"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"iknp","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"iknp","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"iknp","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"iknp_rot":{"counted":{"costs":[{"block":"iknp_rot","chain":["iknp_rot"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"iknp_rot","chain":["iknp_rot"],"derived":true,"formula":"\\( 0 \\)","locator":"§2.2.2, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"iknp_rot","chain":["iknp_rot"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"iknp_rot","chain":["iknp_rot"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"iknp_rot","chain":["iknp_rot","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[]}},"kos15":{"counted":{"costs":[{"block":"kos15","chain":["kos15"],"derived":true,"formula":"\\( \\kappa(k + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","source":"KOS15","subject":"receiver"},{"block":"kos15","chain":["kos15"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","source":"KOS15","subject":"sender"},{"block":"kos15","chain":["kos15"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"sender"},{"block":"kos15","chain":["kos15"],"derived":true,"formula":"\\( k + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"receiver"},{"block":"kos15","chain":["kos15"],"derived":true,"formula":"\\( 3k + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"sender"},{"block":"kos15","chain":["kos15"],"derived":true,"formula":"\\( 3k + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"kos15","chain":["kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"kos15","chain":["kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"kos15","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"kos15","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"kos15","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"kos15","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"kos15","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"kos15","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"kos15","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"5","open":[],"phase":"setup","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"7","open":[],"phase":"online","rounds":"5"}],"variables":[]}},"kos15_frand":{"single":{"costs":[{"block":"kos15_frand","chain":["kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","source":"KOS15","subject":"party"},{"block":"kos15_frand","chain":["kos15_frand"],"derived":true,"formula":"\\( m|\\mathbb{F}|/\\kappa + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"party"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"np01":{"counted":{"costs":[{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"np01","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"oos17":{"counted":{"costs":[{"block":"oos17","chain":["oos17"],"derived":true,"formula":"\\( k(n_C(m + \\lambda) + \\lambda(n_C + \\tau)) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos17","chain":["oos17"],"derived":true,"formula":"\\( k\\lambda m \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos17","chain":["oos17"],"derived":true,"formula":"\\( 2kn_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos17","chain":["oos17"],"derived":true,"formula":"\\( kn_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos17","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[]}},"schnorr_fs":{"single":{"costs":[{"block":"schnorr_fs","chain":["schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","source":"DKLs18","subject":"prover"},{"block":"schnorr_fs","chain":["schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"prover"},{"block":"schnorr_fs","chain":["schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","operation":"modmul","source":"DKLs18","subject":"prover"},{"block":"schnorr_fs","chain":["schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"prover"},{"block":"schnorr_fs","chain":["schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"verifier"},{"block":"schnorr_fs","chain":["schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"verifier"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[]}},"silent_ot":{"counted":{"costs":[{"block":"silent_ot","chain":["silent_ot"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 4, p. 15","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"silent_ot","chain":["silent_ot"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 10, step 3, p. 20","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot"],"derived":true,"formula":"\\( 2\\nu - 2\\omega + 2k \\)","locator":"Figure 6, step 1, p. 17; Figure 4, Expand step 2, p. 15; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"silent_ot","chain":["silent_ot"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega + k \\)","locator":"Figure 6, Output steps 2–3, p. 17; Figure 4, Expand step 1, p. 15","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot","iknp"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["OT (GGM trees)"],"source":"PSZ18","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot","iknp"],"derived":true,"formula":"\\( 2\\omega\\log_2(\\nu/\\omega)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["OT (GGM trees)"],"source":"PSZ18","subject":"sender"},{"block":"silent_ot","chain":["silent_ot","iknp"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM trees)"],"source":"PSZ18","subject":"sender"},{"block":"silent_ot","chain":["silent_ot","iknp"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM trees)"],"source":"PSZ18","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"silent_ot","chain":["silent_ot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}],"variables":[{"meaning":"LPN noise weight for the k outputs: the number of punctured GGM trees, one per block of regular noise (BCG+19 writes t)","symbol":"\\omega"},{"meaning":"LPN code length for the k outputs (BCG+19 writes N); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2k \\)","symbol":"\\nu"}]}},"vsot":{"counted":{"costs":[{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"communication","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( k(3\\kappa + 2\\tau) \\)","locator":"Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( k(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","source":"DKLs18","subject":"receiver"},{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"computation","operation":"exponentiation","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"receiver"},{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( 6k \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot"],"derived":true,"formula":"\\( 5k \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"receiver"},{"block":"vsot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"modmul","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vsot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vsot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","ZK (discrete log of B)"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"variables":[]}}},"implementations":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"costs":[{"basis":"counted","formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","note":"\\( C \\) and \\( g^r \\)","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","note":"Two encryptions per transfer; R is taken as a counter both parties keep, as the paper allows","subject":"sender"},{"basis":"counted","formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","note":"PK_0 per transfer","subject":"receiver"},{"basis":"counted","formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","note":"\\( g^r \\) and \\( C^r \\), precomputed once","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","note":"\\( (PK_0)^r \\) per transfer","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","note":"The division \\( (PK_1)^r = C^r/(PK_0)^r \\) per transfer; its inversion has no unit of the topic","operation":"modmul","subject":"sender"},{"basis":"counted","formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","note":"Two calls to H per transfer, one per encryption","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","note":"\\( PK_\\sigma = g^k \\) and the decryption key \\( (g^r)^k \\) per transfer","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","note":"At most one division per transfer, PK_0 = C/PK_σ when the choice is 1","operation":"modmul","subject":"receiver"},{"basis":"counted","formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","note":"One call to H to decrypt its message","operation":"symmetric_op","subject":"receiver"}],"id":"np01","label":"Naor-Pinkas OT","note":"Protocol 3.1 with \\( N = 2 \\), many transfers sharing \\( C \\) and \\( g^r \\), as the PSI papers run it for base OTs.","params":["k","\\tau"],"realizes":"ot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"from":"sender","id":"init","locator":"Protocol 3.1, Initialization, p. 451","phase":"setup","what":"\\( C \\) and \\( g^r \\), published once for all transfers"},{"after":["init"],"from":"receiver","id":"pk0","locator":"Protocol 3.1, Transfer, first step, p. 451","what":"PK_0 per transfer, computed from C when the choice is 1"},{"after":["pk0"],"from":"sender","id":"enc","locator":"Protocol 3.1, Transfer, second step, p. 451","what":"the two encryptions per transfer"}],"source":"NP01"},{"cites":[{"key":"CO15","title":"The Simplest Protocol for Oblivious Transfer"}],"costs":[{"basis":"counted","formula":"\\( 3 \\)","locator":"§2.1, Setup step 2, Choose step 2, Transfer step 2, p. 4","measure":"rounds","note":"The sender's S (reusable across runs), the receiver's R_i, the sender's ciphertexts"},{"basis":"counted","formula":"\\( |\\mathbb{G}| + kN(\\tau+\\kappa) \\)","locator":"§2.1, p. 4; Lemma 3 and the concrete example, p. 5; abstract, p. 1","measure":"communication","note":"One group element once, then N ciphertexts per OT, each \\( \\tau+\\kappa \\) bits in the paper's concrete scheme; the abstract says 2mn ciphertexts","subject":"sender"},{"formula":"\\( k|\\mathbb{G}| \\)","locator":"Abstract, p. 1; §2.1, Choose, p. 4","measure":"communication","note":"One group element R_i per OT","subject":"receiver"},{"formula":"\\( 2+k \\)","locator":"Abstract, p. 1","measure":"computation","operation":"exponentiation","subject":"sender"},{"formula":"\\( 2k \\)","locator":"Abstract, p. 1","measure":"computation","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( kN \\)","locator":"§2.1, Key Derivation step 1 and Transfer, p. 4","measure":"computation","note":"One key-derivation hash per string, then one encryption each","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( k \\)","locator":"§2.1, Key Derivation step 2, p. 4","measure":"computation","note":"One key-derivation hash per OT","operation":"symmetric_op","subject":"receiver"}],"id":"co15","label":"Chou-Orlandi OT (the simplest OT)","note":"The ePrint version withdraws the UC claim of the proceedings version (§1.1, p. 3).","params":["k","N","\\tau"],"realizes":"ot","roles":{"receiver":"receiver","sender":"sender"},"source":"CO15"},{"cites":[{"key":"CO15","title":"The Simplest Protocol for Oblivious Transfer"},{"key":"DKLs18","title":"Secure Two-party Threshold ECDSA from ECDSA Assumptions"}],"costs":[{"basis":"counted","formula":"\\( |\\mathbb{G}| \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"communication","note":"The public key B","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( k(3\\kappa + 2\\tau) \\)","locator":"Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","note":"Per OT the challenge, the openings H(ρ_0) and H(ρ_1), and the two padded messages","subject":"sender"},{"basis":"counted","formula":"\\( k(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","note":"Per OT the encoded choice A and the response","subject":"receiver"},{"basis":"counted","formula":"\\( 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"computation","note":"B = bG","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","note":"bA and b(A − B) per OT","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","note":"aG and aB per OT; ωB is B or nothing","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( 6k \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","note":"Per OT the two pads, their hashes and their double hashes; steps 7 and 9 reuse them","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5k \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","note":"Per OT its pad, its hash and double hash, then the double hashes of the two openings, one of which repeats step 6's value","operation":"symmetric_op","subject":"receiver"}],"id":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","note":"DKLs18 runs it as random OT for KOS base OTs, dropping the message transfer (PDF p. 52); then the 2kτ bits go. Group additions (A − B) are not counted.","params":["k","\\tau"],"realizes":"ot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"from":"sender","id":"pk","locator":"Appendix A, Protocol 7, step 1, and the remark after step 10, PDF p. 52","phase":"setup","what":"the public key B, reused across the OTs"},{"id":"zk","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","phase":"setup","uses":[0],"what":"proof of knowledge of the discrete log of B, non-interactive, so it travels with B"},{"after":["pk","zk"],"from":"receiver","id":"A","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","what":"the encoded choice A per OT"},{"after":["A"],"from":"sender","id":"xi","locator":"Appendix A, Protocol 7, steps 4 and 5, PDF p. 52","what":"the challenge ξ, from the pads of A"},{"after":["xi"],"from":"receiver","id":"resp","locator":"Appendix A, Protocol 7, step 6, PDF p. 52","what":"the response"},{"after":["resp"],"from":"sender","id":"open","locator":"Appendix A, Protocol 7, step 7, PDF p. 52","what":"the openings H(ρ_0) and H(ρ_1), once the response checks"},{"from":"sender","id":"pad","locator":"Appendix A, Protocol 7, step 9, PDF p. 52","what":"the two padded messages, right after the openings","with":"open"}],"source":"DKLs18","uses":[{"count":"\\( 1 \\)","func":"zk","implementation":"schnorr_fs","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","note":"Proof of knowledge of the discrete log of the public key B, the paper's \\( \\mathcal{F}_{\\mathsf{ZK}}^{\\mathsf{RDL}} \\); costed as Schnorr with Fiat–Shamir, sent with B","part":"ZK (discrete log of B)","phase":"setup","roles":{"prover":"sender","verifier":"receiver"}}]},{"cites":[{"key":"Sch89","title":"Efficient identification and signatures for smart cards"},{"key":"FS86","title":"How to prove yourself: Practical solutions to identification and signature problems"},{"key":"DKLs18","title":"Secure Two-party Threshold ECDSA from ECDSA Assumptions"}],"costs":[{"basis":"counted","formula":"\\( k(|\\mathbb{G}| + \\kappa) \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","note":"Per proof the commitment R = rG and the response z = r + eb in Z_q, of κ = |q| bits as DKLs18 sets κ","subject":"prover"},{"basis":"counted","formula":"\\( k \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","note":"R = rG per proof","operation":"exponentiation","subject":"prover"},{"basis":"counted","formula":"\\( k \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","note":"e·b in the response z = r + eb mod q","operation":"modmul","subject":"prover"},{"basis":"counted","formula":"\\( k \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","note":"The challenge e = H(G, B, R)","operation":"symmetric_op","subject":"prover"},{"basis":"counted","formula":"\\( 2k \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","note":"zG and eB, to check zG = R + eB; the addition is not counted","operation":"exponentiation","subject":"verifier"},{"basis":"counted","formula":"\\( k \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","note":"The challenge recomputed from R","operation":"symmetric_op","subject":"verifier"}],"id":"schnorr_fs","label":"Schnorr proof of knowledge of a discrete log, made non-interactive by Fiat–Shamir","note":"DKLs18 costs its proofs of knowledge of a discrete log as Schnorr with Fiat–Shamir and does not write the protocol out; counted from Schnorr's standard one, the proof being (R, z). Group additions are not counted","params":["k"],"realizes":"zk","roles":{"prover":"prover","verifier":"verifier"},"schedule":[{"from":"prover","id":"proof","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","what":"the proof (R, z), one message"}],"source":"DKLs18"},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"costs":[{"basis":"counted","formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","note":"\\( \\kappa \\) columns \\( u^i \\) of k bits","subject":"receiver"},{"basis":"counted","formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","note":"Two masked τ-bit strings per OT","subject":"sender"},{"basis":"counted","formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","note":"Its \\( \\kappa \\) seeds expanded to k-bit columns (k blocks), then two hashes per OT","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","note":"Both seeds of each base OT expanded (2k blocks), then one hash per OT","operation":"symmetric_op","subject":"receiver"}],"id":"iknp","label":"IKNP OT extension","note":"IKNP03 is not on ePrint; PSZ18 §2.2.1 restates it with the ALSZ13 optimizations (N = 2). Column XORs and the transposition are not counted.","params":["k","\\tau"],"realizes":"ot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Protocol 1, step 2, p. 10","phase":"setup","uses":[0],"what":"κ base OTs, roles reversed"},{"from":"receiver","id":"u","locator":"Protocol 1, step 3, p. 10","what":"the masked columns \\( u^i \\), from its own seeds and choices"},{"after":["base","u"],"from":"sender","id":"y","locator":"Protocol 1, steps 4 to 6, p. 10","what":"the masked pairs \\( (y_j^0, y_j^1) \\)"}],"source":"PSZ18","uses":[{"count":"\\( \\kappa \\)","func":"ot","implementation":"np01","locator":"Protocol 1, common input and step 2, p. 10","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}]},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"},{"key":"ALSZ13","title":"More efficient oblivious transfer and extensions for faster secure computation"}],"costs":[{"basis":"counted","formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"communication","note":"\\( \\kappa \\) columns \\( u^i \\) of k bits","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2.2.2, p. 10","measure":"communication","subject":"sender"},{"basis":"counted","formula":"\\( 3k \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10","measure":"computation","note":"Its seeds expanded (k blocks), then its two outputs \\( H(q_j) \\), \\( H(q_j \\oplus s) \\) per OT","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3k \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","note":"Both seeds expanded (2k blocks), then its output \\( H(t_j) \\) per OT","operation":"symmetric_op","subject":"receiver"}],"id":"iknp_rot","label":"IKNP random OT extension","note":"Protocol 1 without step 6, the outputs hashed as §2.2.2 and ALSZ13 §5.4 (p. 19) describe; τ does not enter the cost. New: gmw_iknp's random OTs on bits used iknp, which counts the sender's 2kτ bits and a second message.","params":["k","\\tau"],"realizes":"rot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Protocol 1, step 2, p. 10","phase":"setup","uses":[0],"what":"κ base OTs, roles reversed"},{"from":"receiver","id":"u","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10","what":"the masked columns \\( u^i \\); random OT drops the sender's message"}],"source":"PSZ18","uses":[{"count":"\\( \\kappa \\)","func":"ot","implementation":"np01","locator":"Protocol 1, common input and step 2, p. 10; §2.2.2, p. 10","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}]},{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"costs":[{"basis":"counted","formula":"\\( \\kappa(k+\\kappa+\\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","note":"\\( \\kappa \\) columns of \\( k+\\kappa+\\lambda \\) bits (λ the paper's s), then x and t in \\( \\mathbb{F}_{2^{\\kappa}} \\)","subject":"receiver"},{"basis":"counted","formula":"\\( 2k\\tau \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","note":"The derandomization pairs","subject":"sender"},{"basis":"counted","formula":"\\( k+\\kappa+\\lambda+1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","note":"Multiplications in \\( \\mathbb{F}_{2^{\\kappa}} \\): one per row for q, one for x·Δ","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( k+\\kappa+\\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","note":"One multiplication per row for t; x sums the weights of the rows with choice 1","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 3k+\\kappa+\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","note":"Its \\( \\kappa \\) seeds expanded to columns of \\( k+\\kappa+\\lambda \\) bits (\\( k+\\kappa+\\lambda \\) blocks), then two random-oracle calls per OT","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3k+2\\kappa+2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","note":"Both seeds of each base OT expanded (\\( 2(k+\\kappa+\\lambda) \\) blocks), then one random-oracle call per OT","operation":"symmetric_op","subject":"receiver"}],"id":"kos15","label":"KOS OT extension (chosen-message, malicious)","note":"Rounds count the protocol's own flows; the coin toss adds its own. Column XORs, the XORs of the check sums and the transposition are not counted.","params":["k","\\tau"],"realizes":"ot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Fig. 3, Initialize, p. 7","phase":"setup","uses":[0],"what":"κ base OTs, roles reversed"},{"from":"receiver","id":"u","locator":"Fig. 3, Extend step 3, p. 7","what":"the columns \\( u^i \\) over \\( k + \\kappa + \\lambda \\) rows"},{"after":["u"],"id":"coin","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","uses":[1],"what":"coin toss for the check weights χ, sampled once the receiver's columns are sent"},{"after":["coin"],"from":"receiver","id":"check","locator":"Fig. 7, Check correlation, p. 10","what":"the check values x and t"},{"after":["base","check"],"from":"sender","id":"derand","locator":"Fig. 9, step 2, p. 14","what":"the derandomization pairs, once the check passes"}],"source":"KOS15","uses":[{"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","locator":"Fig. 3, Initialize, p. 7","note":"KOS15 ran PVW08 base OTs (§4, p. 14); the PSI rows that use KOS pair it with VSOT (KRSSW19 §5.1)","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}},{"count":"\\( 1 \\)","func":"coin_toss","implementation":"kos15_frand","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( k+\\kappa+\\lambda \\)"},"part":"coin toss (check weights)","roles":{"party":["sender","receiver"]}}]},{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"costs":[{"basis":"counted","formula":"\\( \\kappa(k+\\kappa+\\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","note":"\\( \\kappa \\) columns of \\( k+\\kappa+\\lambda \\) bits, then x and t in \\( \\mathbb{F}_{2^{\\kappa}} \\)","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Fig. 7, p. 10","measure":"communication","note":"Outside the coin toss","subject":"sender"},{"basis":"counted","formula":"\\( k+\\kappa+\\lambda+1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","note":"Multiplications in \\( \\mathbb{F}_{2^{\\kappa}} \\): one per row for q, one for x·Δ","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( k+\\kappa+\\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","note":"One multiplication per row for t","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 3k+\\kappa+\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","note":"Seed expansion (\\( k+\\kappa+\\lambda \\) blocks), then \\( H(j \\| q_j) \\) and \\( H(j \\| q_j + \\Delta) \\) per OT","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3k+2\\kappa+2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","note":"Seed expansion (\\( 2(k+\\kappa+\\lambda) \\) blocks), then \\( H(j \\| t_j) \\) per OT","operation":"symmetric_op","subject":"receiver"}],"id":"kos15_rot","label":"KOS random OT extension (malicious)","note":"Fig. 3 with the check and Randomize of Fig. 7. Strings come out of the random oracle, so τ does not enter the cost. Rounds count the protocol's own flows; the coin toss adds its own.","params":["k"],"realizes":"rot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Fig. 3, Initialize, p. 7","phase":"setup","uses":[0],"what":"κ base OTs, roles reversed"},{"from":"receiver","id":"u","locator":"Fig. 3, Extend step 3, p. 7","what":"the columns \\( u^i \\) over \\( k + \\kappa + \\lambda \\) rows"},{"after":["u"],"id":"coin","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","uses":[1],"what":"coin toss for the check weights χ, sampled once the receiver's columns are sent"},{"after":["coin"],"from":"receiver","id":"check","locator":"Fig. 7, Check correlation, p. 10","what":"the check values x and t"}],"source":"KOS15","uses":[{"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","locator":"Fig. 3, Initialize, p. 7","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}},{"count":"\\( 1 \\)","func":"coin_toss","implementation":"kos15_frand","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( k+\\kappa+\\lambda \\)"},"part":"coin toss (check weights)","roles":{"party":["sender","receiver"]}}]},{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"costs":[{"basis":"counted","formula":"\\( \\kappa(k+\\kappa+\\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","note":"\\( \\kappa \\) columns of \\( k+\\kappa+\\lambda \\) bits, then x and t","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Fig. 3, Output, p. 7","measure":"communication","note":"The correlation is the sender's global Δ from the base OTs, so τ = κ; another correlation would need a correction message","subject":"sender"},{"basis":"counted","formula":"\\( k+\\kappa+\\lambda+1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","note":"Multiplications in \\( \\mathbb{F}_{2^{\\kappa}} \\): one per row for q, one for x·Δ","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( k+\\kappa+\\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","note":"One multiplication per row for t","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( k+\\kappa+\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7","measure":"computation","note":"Its \\( \\kappa \\) seeds expanded to columns of \\( k+\\kappa+\\lambda \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2(k+\\kappa+\\lambda) \\)","locator":"Fig. 3, Extend step 2, p. 7","measure":"computation","note":"Both seeds of each base OT expanded, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"receiver"}],"id":"kos15_cot","label":"KOS correlated OT extension (malicious)","note":"COTe of Fig. 3 with the correlation check of Fig. 7, without its Randomize step. Rounds count the protocol's own flows; the coin toss adds its own (kos15_frand).","params":["k","\\tau"],"realizes":"cot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Fig. 3, Initialize, p. 7","phase":"setup","uses":[0],"what":"κ base OTs, roles reversed"},{"from":"receiver","id":"u","locator":"Fig. 3, Extend step 3, p. 7","what":"the columns \\( u^i \\) over \\( k + \\kappa + \\lambda \\) rows"},{"after":["u"],"id":"coin","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","uses":[1],"what":"coin toss for the check weights χ, sampled once the receiver's columns are sent"},{"after":["coin"],"from":"receiver","id":"check","locator":"Fig. 7, Check correlation, p. 10","what":"the check values x and t"}],"source":"KOS15","uses":[{"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","locator":"Fig. 3, Initialize, p. 7","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}},{"count":"\\( 1 \\)","func":"coin_toss","implementation":"kos15_frand","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( k+\\kappa+\\lambda \\)"},"part":"coin toss (check weights)","roles":{"party":["sender","receiver"]}}]},{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"costs":[{"basis":"counted","formula":"\\( 2k\\kappa \\)","locator":"§4, p. 14","measure":"communication","note":"Per toss each party's commitment H(s) to its seed, then the seed; κ bits each, the seed keying the PRG","subject":"party"},{"basis":"counted","formula":"\\( k(m|\\mathbb{F}|/\\kappa+2) \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","note":"Per toss one hash to commit and one to check the other's opening; the XOR of the seeds expanded by the PRG into m elements of 𝔽, in κ-bit blocks","operation":"symmetric_op","subject":"party"}],"id":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","note":"§4 implements F_Rand with a standard hash-based commitment and AES-128 in counter mode as the PRG, at κ = 128, without writing the protocol out. The seed is uniform, so H(s) commits to it with no further randomness, as RS21's coin toss; the XORs are not counted","params":["k","m","\\mathbb{F}"],"realizes":"coin_toss","roles":{"party":"party"},"schedule":[{"from":"party","id":"commit","locator":"§4, p. 14","what":"each party's commitment to its seed, both at once"},{"after":["commit"],"from":"party","id":"open","locator":"§4, p. 14","what":"each party's seed, once both commitments are in"}],"source":"KOS15"},{"cites":[{"key":"KK13","title":"Improved OT extension for transferring short secrets"}],"costs":[{"basis":"counted","formula":"\\( kn_C \\)","locator":"Protocol 2, step 3, p. 11","measure":"communication","note":"\\( n_C \\) columns \\( v^i \\) of k bits","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2.2.2, p. 10; §2.2.3, p. 11","measure":"communication","subject":"sender"},{"basis":"counted","formula":"\\( 2kn_C/\\kappa + k \\)","locator":"Protocol 2, step 3, p. 11; §2.2.3, p. 11","measure":"computation","note":"Both seeds of each of the \\( n_C \\) base OTs expanded to k-bit columns, in \\( \\kappa \\)-bit blocks, then its output \\( H(t_j) \\) per OT","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( kn_C/\\kappa \\)","locator":"Protocol 2, step 4, p. 11","measure":"computation","note":"One seed per base OT expanded to a k-bit column, in \\( \\kappa \\)-bit blocks; its outputs are counted by the row","operation":"symmetric_op","subject":"sender"}],"id":"kk13_rot","label":"KK13 1-out-of-N random OT extension, linear code","note":"Protocol 1 with Protocol 2's changes, as random OT (§2.2.3, p. 11): the sender computes an output, one encoding and one hash, only where the row asks. KK13 is not on ePrint.","params":["k","N","\\tau"],"realizes":"rot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Protocol 1, step 2, p. 10, with β the code length (§2.2.3, p. 11)","phase":"setup","uses":[0],"what":"n_C base OTs, roles reversed"},{"from":"receiver","id":"v","locator":"Protocol 2, step 3, p. 11; §2.2.3, p. 11","what":"the columns \\( v^i \\); random OT drops the sender's message"}],"source":"PSZ18","uses":[{"count":"\\( n_C \\)","func":"ot","implementation":"np01","locator":"Protocol 2, p. 11; §2.2.3, p. 11","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"variables":[{"meaning":"Codeword length of the code, also the number of base OTs (512 for PSZ18's BCH code at κ = 128)","symbol":"n_C"}]},{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"costs":[{"basis":"counted","formula":"\\( k(n_C(m+\\lambda) + \\lambda(n_C+\\tau)) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","note":"\\( n_C \\) columns of \\( m+\\lambda \\) bits (λ the paper's s), then λ check pairs \\( t^{(\\ell)}, w^{(\\ell)} \\)","subject":"receiver"},{"basis":"counted","formula":"\\( k\\lambda m \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","note":"λ random m-bit check strings","subject":"sender"},{"basis":"counted","formula":"\\( 2kn_C(m+\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","note":"Both seeds of each base OT expanded to a column of \\( m+\\lambda \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( kn_C(m+\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","note":"One seed per base OT expanded to a column of \\( m+\\lambda \\) bits, in \\( \\kappa \\)-bit blocks; the output hashes lie outside F_OOS","operation":"symmetric_op","subject":"sender"}],"id":"oos17","label":"OOS 1-out-of-N OT extension (malicious)","note":"Computation counted from Fig. 2. XORs (matrix columns, check sums) and the componentwise products with b are not counted, as for IKNP and KOS; §6's XOR count is a check.","params":["k","m","n_C","\\tau"],"realizes":"oos","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Fig. 2, Init, p. 8","phase":"setup","uses":[0],"what":"n_C base OTs on random inputs, roles reversed"},{"from":"receiver","id":"U","locator":"Fig. 2, Extend step 2, p. 8","what":"the columns \\( u^j \\) over \\( m + \\lambda \\) rows"},{"after":["U"],"from":"sender","id":"x","locator":"Fig. 2, Extend steps 3 and 4, p. 8","what":"λ random check strings, sent once U is received"},{"after":["x"],"from":"receiver","id":"tw","locator":"Fig. 2, Extend step 4, p. 8","what":"the check values \\( t^{(\\ell)} \\) and \\( w^{(\\ell)} \\)"}],"source":"OOS17","uses":[{"count":"\\( n_C \\)","func":"ot","implementation":"np01","locator":"Fig. 2, Init, p. 8","note":"OOS17 does not fix the base OT (its implementation ran SimpleOT, §6, p. 22); PRTY20 §7.1 (p. 22) uses Naor-Pinkas","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}]},{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"KK13","title":"Improved OT extension for transferring short secrets"}],"costs":[{"basis":"counted","formula":"\\( kmn_C \\)","locator":"§2.1, p. 6","measure":"communication","note":"The matrix U of m rows and \\( n_C \\) columns","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2.1, pp. 6–7","measure":"communication","subject":"sender"},{"basis":"counted","formula":"\\( 2kn_Cm/\\kappa \\)","locator":"§2.1, p. 6","measure":"computation","note":"Both seeds of each base OT expanded to a column of m bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( kn_Cm/\\kappa \\)","locator":"§2.1, pp. 6–7","measure":"computation","note":"One seed per base OT expanded to a column of m bits, in \\( \\kappa \\)-bit blocks; the output hashes lie outside F_OOS","operation":"symmetric_op","subject":"sender"}],"id":"oos17_sh","label":"OOS OT extension without the consistency check (the KK protocol with a linear code)","note":"Passively secure against the receiver (§2.1, p. 7); the semi-honest PRTY20 rows use it. XORs are not counted.","params":["k","m","n_C","\\tau"],"realizes":"oos","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"§2.1, p. 6","phase":"setup","uses":[0],"what":"n_C base OTs on random inputs, roles reversed"},{"from":"receiver","id":"U","locator":"§2.1, p. 6","what":"the matrix U"}],"source":"OOS17","uses":[{"count":"\\( n_C \\)","func":"ot","implementation":"np01","locator":"§2.1, p. 6","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}]},{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"costs":[{"basis":"counted","formula":"\\( n_C(k+\\lambda) + \\lambda(n_C+in) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","note":"The k encodings as one OOS run of k instances: \\( n_C \\) columns of \\( k+\\lambda \\) bits, then λ check pairs","subject":"receiver"},{"basis":"counted","formula":"\\( \\lambda k \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","note":"λ random k-bit check strings","subject":"sender"},{"basis":"counted","formula":"\\( 2n_C(k+\\lambda)/\\kappa + k \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","note":"Seed expansion in \\( \\kappa \\)-bit blocks over columns of \\( k+\\lambda \\) bits, then one hash \\( H(i,t_i) \\) per encoding","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_C(k+\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","note":"Seed expansion in \\( \\kappa \\)-bit blocks; one hash per value it evaluates, a number the row sets, not counted","operation":"symmetric_op","subject":"sender"}],"id":"oos17_encode","label":"OOS 1-out-of-N random OT as oblivious encoding","note":"RR17 §4 (p. 6) shows OOS realizes F_encode; the out-bit values are random-oracle outputs and cost no communication. XORs are not counted.","params":["k","in"],"realizes":"encode","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Fig. 2, Init, p. 8","phase":"setup","uses":[0],"what":"n_C base OTs on random inputs, roles reversed"},{"from":"receiver","id":"U","locator":"Fig. 2, Extend step 2, p. 8","what":"the columns \\( u^j \\) over \\( k + \\lambda \\) rows"},{"after":["U"],"from":"sender","id":"x","locator":"Fig. 2, Extend steps 3 and 4, p. 8","what":"λ random check strings, sent once U is received"},{"after":["x"],"from":"receiver","id":"tw","locator":"Fig. 2, Extend step 4, p. 8","what":"the check values \\( t^{(\\ell)} \\) and \\( w^{(\\ell)} \\)"}],"source":"OOS17","uses":[{"count":"\\( n_C \\)","func":"ot","implementation":"np01","locator":"Fig. 2, Init, p. 8","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"variables":[{"meaning":"Length of the code, of dimension at least in (511 for RR17's BCH-(511, 76, 171) code)","symbol":"n_C"}]},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"costs":[{"basis":"counted","formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","note":"The seed of the code C, an AES-128 key","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","note":"w columns of k bits, one w-bit row per instance, with the ALSZ13 trick that sets \\( t_0 \\) to the expanded seed","subject":"receiver"},{"basis":"counted","formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","note":"Both seeds of each base OT expanded to k-bit columns, in \\( \\kappa \\)-bit blocks; per instance four AES calls for \\( C(r_j) \\) and one hash for its output","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","note":"One seed per base OT expanded to a k-bit column, in \\( \\kappa \\)-bit blocks; each evaluation it makes costs five calls more, a number the row sets","operation":"symmetric_op","subject":"sender"}],"id":"kkrt16","label":"BaRK-OPRF","note":"One query per instance (c = 1). The sender's evaluations of the PRF, a code and a hash each, are counted by the row.","params":["k"],"realizes":"oprf","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"from":"sender","id":"code","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","phase":"setup","what":"the code C, an AES-128 key"},{"id":"base","locator":"Figure 2, step 3, p. 10; §6.3, p. 16","phase":"setup","uses":[0],"what":"w base OTs by IKNP, roles reversed"},{"after":["code"],"from":"receiver","id":"matrix","locator":"Figure 2, steps 2 and 3, p. 10; footnote 1, p. 6","what":"the matrix columns, one w-bit row per instance, encoded with C"}],"source":"KKRT16","uses":[{"count":"\\( w \\)","func":"ot","implementation":"iknp","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"costs":[{"basis":"counted","formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","note":"The seed of the code C, an AES-128 key","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; §5.3, p. 12","measure":"communication","note":"One w-bit row per instance","subject":"receiver"},{"basis":"counted","formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","note":"Seed expansion in \\( \\kappa \\)-bit blocks; per instance four AES calls for its codeword and one hash for its output","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16","measure":"computation","note":"Seed expansion in \\( \\kappa \\)-bit blocks; each output it computes costs five calls more, a number the row sets","operation":"symmetric_op","subject":"sender"}],"id":"kkrt16_rot","label":"BaRK-OPRF as batched 1-out-of-N random OT","note":"Same protocol as kkrt16, seen as 1-out-of-N ROT for any N (§1, p. 2); τ, the output length, does not enter the cost.","params":["k"],"realizes":"rot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"from":"sender","id":"code","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","phase":"setup","what":"the code C, an AES-128 key"},{"id":"base","locator":"Figure 2, step 3, p. 10; §6.3, p. 16","phase":"setup","uses":[0],"what":"w base OTs by IKNP, roles reversed"},{"after":["code"],"from":"receiver","id":"matrix","locator":"Figure 2, steps 2 and 3, p. 10; footnote 1, p. 6","what":"the matrix columns, one w-bit row per instance, encoded with C"}],"source":"KKRT16","uses":[{"count":"\\( w \\)","func":"ot","implementation":"iknp","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits","symbol":"w"}]},{"cites":[{"key":"GPRTY21","paper":"PSI-PAPER-2021-GPRTY","title":"Oblivious key-value stores and amplification for private set intersection"}],"costs":[{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, step 1, p. 22","measure":"communication","note":"Sends nothing outside the vOLE, whose input is its random scalar s","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, step 1, p. 22","measure":"communication","note":"Sends nothing outside the vOLE, whose input is the OKVS of its queries","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 22","measure":"computation","note":"Its key is the vOLE's output Q with its scalar s; evaluating F at its own points is its caller's work","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2kc \\)","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","note":"Per query \\( H_1 \\) for its OKVS and \\( H_2 \\) on the decoded R; the linear OKVS's own hashing is left open","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","note":"Encoding its OKVS and decoding R at each query multiply only for a linear OKVS whose rows hold field elements","operation":"field_op","subject":"receiver","value":"conditional"}],"id":"gprty21_vole_oprf","label":"vOLE-based OPRF of generalized PaXoS-PSI","note":"F(x) = H_2(x, Decode(Q,x) + H_1(x)s): its messages are the vOLE's, and OKVS encoding and decoding are local.","params":["k","c"],"realizes":"oprf","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"vole","locator":"Figure 3, step 1, p. 22","uses":[0],"what":"the vOLE on the receiver's OKVS of its queries and the sender's random scalar"}],"source":"GPRTY21","uses":[{"count":"\\( k \\)","func":"vole","implementation":null,"locator":"Figure 3, step 1, p. 22; §7.1, p. 21","note":"Malicious vOLE with the receiver's vector chosen; the paper notes none was implemented (p. 21)","open_in":"GPRTY21","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{v}} \\)","m":"\\( m_O \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"variables":[{"meaning":"Slots of the linear OKVS that encodes the receiver's c queries","symbol":"m_O"},{"meaning":"Output length of \\( H_1 \\); the vOLE is over \\( \\mathrm{GF}(2^{v}) \\)","symbol":"v"}]},{"cites":[{"key":"PRTY20","paper":"PSI-PAPER-2020-PRTY","title":"PSI from PaXoS: Fast, malicious private set intersection"}],"costs":[{"basis":"counted","formula":"\\( kh \\)","locator":"Appendix B, p. 14","measure":"communication","note":"The OKVS hint; the paper does not give its size","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are the PaXoS of its queries","subject":"receiver"},{"basis":"counted","formula":"\\( 5km_1 \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, step 3, p. 11; PRTY20 Figure 6, p. 19","measure":"computation","note":"Per programmed point its PRF value: H_1, the PaXoS hashes h_1, h_2, r to decode Q, and H_2; the hint OKVS's own hashing is left open","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5km_2 \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, steps 1 and 4, p. 11; PRTY20 Figure 6, p. 19","measure":"computation","note":"Per query H_1, the PaXoS hashes h_1, h_2, r, shared by encoding D and decoding R, and H_2; decoding the hint's OKVS is hashing left open","operation":"symmetric_op","subject":"receiver"}],"id":"prty20_opprf","label":"PaXoS-based malicious OPPRF","note":"The OPRF is PRTY20's PaXoS-PSI core (H_1 into the receiver's PaXoS, H_2 on its outputs), which Appendix B sketches without the hashes. NTY21's experiments measure KMPRT's table-based OPPRF instead (§5, p. 11); not declared here.","params":["k","m_1","m_2"],"realizes":"opprf","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"oos","locator":"Appendix B, p. 14; PRTY20 Figure 3, steps 1–2, p. 11","uses":[0],"what":"the OOS run on the receiver's PaXoS of its queries, with its consistency check"},{"after":["oos"],"from":"sender","id":"hint","locator":"Appendix B, p. 14","what":"the hint, an OKVS of the programmed values masked by the sender's PRF values"}],"source":"NTY21","uses":[{"count":"\\( k \\)","func":"oos","implementation":"oos17","locator":"Appendix B, p. 14; PRTY20 §4.4, p. 15 and Theorem 8, p. 20","note":"The receiver's PaXoS of its queries as choice strings; m and τ as PRTY20 sets them","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(m_1m_2) \\)","m":"\\( 2.4m_2+\\lambda+O(\\log m_2) \\)","n_C":"\\( w \\)"},"part":"OOS (the receiver's queries)","roles":{"receiver":"receiver","sender":"sender"}}],"variables":[{"meaning":"Length of the OOS code, the width of the OT-extension matrix","symbol":"w"},{"meaning":"Bits of the hint, the OKVS S that encodes the sender's m_1 programmed points","symbol":"h"}]},{"cites":[{"key":"KMPRT17","paper":"PSI-PAPER-2017-KMPRT","title":"Practical multi-party private set intersection from symmetric-key techniques"}],"costs":[{"basis":"counted","formula":"\\( (\\ell-1)\\kappa \\)","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","note":"At most: P_i sends ℓ − i seeds, κ bits each as NTY21's Protocol C.1 keys the PRF","phase":"setup","subject":"party"},{"basis":"counted","formula":"\\( (\\ell-1)k \\)","locator":"Figure 9, Generate zero-sharing, p. 14","measure":"computation","note":"One PRF call per seed per share","operation":"symmetric_op","subject":"party"}],"id":"kmprt17_zero_share","label":"Unconditional zero sharing from exchanged seeds","params":["k","\\ell"],"realizes":"zero_share","roles":{"party":"party"},"schedule":[{"from":"party","id":"seeds","locator":"Figure 9, Initialization, p. 14","phase":"setup","what":"a PRF seed from each party to every later party"}],"source":"KMPRT17"},{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"costs":[{"basis":"counted","formula":"\\( k\\omega|\\mathbb{F}| \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","note":"One correction c in 𝔽 per tree; the OT messages are the uses'","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","note":"The receiver sends only OT messages","subject":"receiver"},{"basis":"counted","formula":"\\( k(\\nu(1+|\\mathbb{F}|/\\kappa)-2\\omega) \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","note":"Full trees: per tree ν/2ω − 1 calls of G (2κ bits) and ν/2ω of G′ (two elements of 𝔽), in κ-bit blocks; Expand reuses the leaves","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( k(\\nu-2\\omega\\log_2(\\nu/\\omega)+(\\nu-2\\omega)|\\mathbb{F}|/\\kappa) \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","note":"All but the punctured path: per tree \\( \\nu/2\\omega - \\log_2(\\nu/\\omega) \\) calls of \\( G \\) and \\( \\nu/2\\omega - 1 \\) of \\( G' \\), in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"receiver"}],"id":"silver","label":"Silver silent VOLE","note":"BCG+19's semi-honest PCG protocol with an LDPC code and regular noise (§7.1); CRR21 says the communication is BCG+19's. Negations and κ-bit XORs are not counted. CRR21 now warns its codes are broken","params":["k","m","\\mathbb{F}"],"realizes":"vole","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"ggm","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19","uses":[0,1],"what":"GGM-tree OTs, every level of every tree in parallel"},{"id":"rev","locator":"Figure 9, step 2, p. 19; CRR21 §7, Vole Performance, p. 19","uses":[2],"what":"reverse VOLE, one OT per bit of Δ with the sender choosing; needs only the inputs, so it runs with the tree OTs"},{"after":["rev"],"from":"sender","id":"corr","locator":"Figure 6, step 2, p. 17; Figure 9, steps 2–3, p. 19","what":"the corrections c, one per tree; each uses the share b_i that the reverse-VOLE OT reply gives the sender"}],"source":"BCG+19","uses":[{"count":"\\( k\\omega(\\log_2(\\nu/\\omega)-1) \\)","func":"ot","implementation":"iknp","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19; §7.1, Noise distribution, p. 30; Table 2 caption, p. 31","note":"One per level above the last of each tree, on XORs of κ-bit nodes. IKNP from 128 base OTs, as BCG+19's \"hybrid\"","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k\\omega \\)","func":"ot","implementation":"iknp","locator":"Figure 6, step 1, p. 17","note":"The last level's OT carries the two sums of leaves, each in 𝔽","params":{"\\tau":"\\( |\\mathbb{F}| \\)"},"part":"OT (GGM last level)","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k|\\mathbb{F}| \\)","func":"ot","implementation":"iknp","locator":"CRR21 §7, Vole Performance, p. 19; Figure 9, step 2, p. 19; Theorem 8, p. 18","note":"The reverse VOLE for the noise values in 𝔽: one OT per bit of Δ, as CRR21 states count and length; roles as OT-based multiplication by Δ's bits","params":{"\\tau":"\\( O(\\kappa|\\mathbb{F}|) \\)"},"part":"OT (reverse VOLE)","roles":{"receiver":"sender","sender":"receiver"},"source":"CRR21"}],"variables":[{"meaning":"LPN noise weight: the number of punctured GGM trees, one per block of regular noise (BCG+19 and CRR21 write t)","symbol":"\\omega"},{"meaning":"LPN code length (BCG+19 writes N, CRR21 n); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2m \\)","symbol":"\\nu"}]},{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"costs":[{"basis":"counted","formula":"\\( k\\omega|\\mathbb{F}| \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","note":"One correction c in the extension field per tree; the OT and reverse sub-VOLE messages are the uses'","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","note":"The receiver sends only the uses' messages","subject":"receiver"},{"basis":"counted","formula":"\\( k(\\nu(1+|\\mathbb{F}|/\\kappa)-2\\omega) \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","note":"Full trees: per tree ν/2ω − 1 calls of G (2κ bits) and ν/2ω of G′ (two elements of 𝔽), in κ-bit blocks; Expand reuses the leaves","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( k(\\nu-2\\omega\\log_2(\\nu/\\omega)+(\\nu-2\\omega)|\\mathbb{F}|/\\kappa) \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","note":"All but the punctured path: per tree \\( \\nu/2\\omega - \\log_2(\\nu/\\omega) \\) calls of \\( G \\) and \\( \\nu/2\\omega - 1 \\) of \\( G' \\), in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"receiver"}],"id":"silver_sub","label":"Silver silent subfield VOLE","note":"BCG+19's semi-honest subfield-VOLE PCG with an LDPC code and regular noise (§7.1); CRR21 measures only its full-field VOLE (log |𝔽| = 128). Negations and κ-bit XORs are not counted","params":["k","m","\\mathbb{B}","\\mathbb{F}"],"realizes":"sub_vole","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"ggm","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19","uses":[0,1],"what":"GGM-tree OTs, every level of every tree in parallel"},{"id":"rev","locator":"Figure 9, steps 1–2, p. 19","uses":[2],"what":"reverse subfield VOLE on the noise values; the sender picks its share b itself, so it runs with the tree OTs"},{"from":"sender","id":"corr","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","what":"the corrections c, one per tree, in parallel to the OTs"}],"source":"BCG+19","uses":[{"count":"\\( k\\omega(\\log_2(\\nu/\\omega)-1) \\)","func":"ot","implementation":"iknp","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19; §7.1, Noise distribution, p. 30; Table 2 caption, p. 31","note":"One per level above the last of each tree, on XORs of κ-bit nodes. IKNP from 128 base OTs, as BCG+19's \"hybrid\"","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k\\omega \\)","func":"ot","implementation":"iknp","locator":"Figure 6, step 1, p. 17","note":"The last level's OT carries the two sums of leaves, each in the extension field 𝔽","params":{"\\tau":"\\( |\\mathbb{F}| \\)"},"part":"OT (GGM last level)","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k \\)","func":"sub_vole","implementation":null,"locator":"Theorem 8 and Figure 8, p. 18; Figure 9, step 2, p. 19","note":"Reverse subfield VOLE: the receiver inputs the noise values in 𝔹, the sender Δ and its shares. Not needed when \\( \\mathbb{B} = \\mathbb{F}_2 \\). No source costs it for a subfield","open_in":"BCG+19","params":{"\\mathbb{B}":"\\( \\mathbb{B} \\)","\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"},"part":"reverse sub-VOLE","roles":{"receiver":"receiver","sender":"sender"}}],"variables":[{"meaning":"LPN noise weight: the number of punctured GGM trees, one per block of regular noise (BCG+19 and CRR21 write t)","symbol":"\\omega"},{"meaning":"LPN code length (BCG+19 writes N, CRR21 n); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2m \\)","symbol":"\\nu"}]},{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"costs":[{"basis":"counted","formula":"\\( k((3\\omega+1)|\\mathbb{F}|+2\\omega\\kappa) \\)","locator":"Figure 13, steps 6–7, p. 25; Figure 16, step 5, p. 26","measure":"communication","note":"Per tree the odd-leaf XOR \\( K \\) and the hash \\( \\Gamma \\) (\\( \\kappa \\) bits each) and \\( c \\in \\mathbb{F}^2 \\); then \\( X \\) and one \\( V \\) per tree, in \\( \\mathbb{F} \\)","subject":"sender"},{"basis":"counted","formula":"\\( k\\kappa \\)","locator":"Figure 16, step 4, p. 26; text after Theorem 16, p. 27","measure":"communication","note":"A PRG seed for the challenges, as the paper suggests in place of sending them","subject":"receiver"},{"basis":"counted","formula":"\\( k(\\nu(3+2|\\mathbb{F}|/\\kappa)-\\omega+(\\nu/\\omega+1)|\\mathbb{F}|/\\kappa) \\)","locator":"Figure 13, steps 2 and 7, p. 25; text after Theorem 16, p. 27","measure":"computation","note":"Full trees: \\( G \\) inside, \\( G' \\) into \\( \\mathbb{F}^2 \\times \\{0,1\\}^{\\kappa} \\) at the leaves, one hash \\( h \\) per tree; then the challenges from the seed. In κ-bit blocks","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( k(\\nu(3+2|\\mathbb{F}|/\\kappa)-2\\omega(\\log_2(\\nu/\\omega)+1+|\\mathbb{F}|/\\kappa)+(\\nu/\\omega+1)|\\mathbb{F}|/\\kappa) \\)","locator":"Figure 13, step 8, p. 25; text after Theorem 16, p. 27","measure":"computation","note":"All but the punctured path, one hash h per tree, then the challenges from the seed. In κ-bit blocks","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( k(2\\nu+1) \\)","locator":"Figure 16, step 5, p. 26","measure":"computation","note":"Per tree \\( V = \\sum_i \\tau_i(v_{2i} + \\tau v_{2i+1}) \\) with the challenges, two products per output; once \\( \\tau x \\) in \\( X = \\chi + \\tau x \\)","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( k(2\\nu+2\\omega) \\)","locator":"Figure 16, step 7, p. 26","measure":"computation","note":"Per tree the check's \\( \\sum_i \\tau_i(v_{2i} + \\tau v_{2i+1}) \\), two products per output, and \\( X\\tau_\\alpha y \\) on its right side","operation":"field_op","subject":"receiver"}],"id":"silver_mal","label":"Silver silent VOLE with BCG+19's malicious setup","note":"Neither RS21 nor CRR21 says how Silver's VOLE is made malicious; this takes BCG+19 §6, with regular noise (§7.1) and the challenges from a seed. Negations and κ-bit XORs are not counted","params":["k","m","\\mathbb{F}"],"realizes":"vole","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"ots","locator":"Figure 13, step 5, p. 25; Figure 16, step 3, p. 26","uses":[0],"what":"GGM-tree OTs, every level of every tree in parallel"},{"id":"rev","locator":"Figure 16, steps 1–2, p. 26","uses":[1],"what":"generalized reverse VOLE on the noise values; the sender picks β, b and χ itself, so it runs with the OTs"},{"from":"sender","id":"kcg","locator":"Figure 13, steps 6–7, p. 25","what":"per tree the odd-leaf key K, the correction c and the hash Γ, in parallel to the OTs"},{"after":["ots","rev","kcg"],"from":"receiver","id":"seed","locator":"Figure 16, step 4, p. 26; text after Theorem 16, p. 27","what":"a seed for the challenges τ and τ_i, sent once the sender's trees and reverse-VOLE inputs are fixed"},{"after":["seed"],"from":"sender","id":"xv","locator":"Figure 16, step 5, p. 26","what":"X = χ + τx and one V per tree"}],"source":"BCG+19","uses":[{"count":"\\( k\\omega\\log_2(\\nu/\\omega) \\)","func":"ot","implementation":"kos15","locator":"Figure 13, step 5, p. 25; Figure 16, step 3, p. 26; Theorem 15, p. 23","note":"One per level above the leaves of each tree, on XORs of κ-bit nodes; the leaf level's odd half is sent in the clear. Parallel, maliciously secure","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM trees)","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k \\)","func":"vole","implementation":null,"locator":"Figure 14, p. 25; Figure 16, step 2, p. 26; §6.6, p. 28","note":"The generalized reverse VOLE: the sender's two scalars (χ, x) on the receiver's noise values. BCG+19 leaves its protocol open","open_in":"BCG+19","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"},"part":"reverse VOLE","roles":{"receiver":"receiver","sender":"sender"}}],"variables":[{"meaning":"LPN noise weight: the number of PPRFs, one per block of regular noise (BCG+19 writes t)","symbol":"\\omega"},{"meaning":"LPN code length (BCG+19 writes N); each PPRF has \\( \\nu/\\omega \\) outputs, a power of two, on a tree of \\( 2\\nu/\\omega \\) leaves. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2m \\)","symbol":"\\nu"}]},{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"costs":[{"basis":"counted","formula":"\\( k\\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","note":"a′ = β − a per single-point VOLE; the paper's optimization 1 drops it when log |𝔽| ≥ λ","subject":"receiver"},{"basis":"counted","formula":"\\( k\\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","note":"The correction d per single-point VOLE, besides the OTs","subject":"sender"},{"basis":"counted","formula":"\\( k(\\nu(1+|\\mathbb{F}|/\\kappa)-2\\omega) \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","note":"Full trees: \\( G \\) on the inner levels, \\( G' \\) into \\( \\mathbb{F}^2 \\) at the leaves, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( k(\\nu-2\\omega\\log_2(\\nu/\\omega)+(\\nu-2\\omega)|\\mathbb{F}|/\\kappa) \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","note":"All but the punctured path: per tree \\( \\nu/2\\omega - \\log_2(\\nu/\\omega) \\) calls of \\( G \\) and \\( \\nu/2\\omega - 1 \\) of \\( G' \\), in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( k(d_A\\nu+\\omega) \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","note":"Per tree Δ·a′ in γ = b − Δa′; then v·A in y = vA + b, d_A products per column, as A's nonzero entries are uniform in 𝔽","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 2kd_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","note":"u·A in x = uA + e and w·A in z = wA + c, d_A products per column each, as A's nonzero entries are uniform in 𝔽","operation":"field_op","subject":"receiver"}],"id":"sgrr19_ywl20","label":"SGRR19 VOLE with YWL+20's iterative bootstrapping","note":"RS21's VOLE (§7.2, p. 26), counted from WYKW20's VOLE form of YWL+20's extension, semi-honest part (Figure 7, steps 1–3, and Figure 8), regular noise. Negations and κ-bit XORs are not counted","params":["k","m","\\mathbb{F}"],"realizes":"vole","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15","phase":"setup","uses":[0],"what":"base VOLE for the LPN secret and one [β] per single-point VOLE, first extension only"},{"id":"ots","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18","uses":[1,2],"what":"GGM-tree OTs, every level of every tree in parallel"},{"after":["base"],"from":"receiver","id":"a","locator":"Figure 7, step 1, p. 15","what":"a′ = β − a per single-point VOLE"},{"after":["a"],"from":"sender","id":"d","locator":"Figure 7, steps 1 and 3, p. 15","what":"the correction d per single-point VOLE, from γ = b − Δa′"}],"source":"WYKW20","uses":[{"count":"\\( k \\)","func":"vole","implementation":null,"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE; later ones reserve them from their output. RS21 does not say how","open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu+\\omega \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k\\omega(\\log_2(\\nu/\\omega)-1) \\)","func":"ot","implementation":"iknp","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18; SGRR19 §8.1, p. 12; RS21 §7.2, p. 26","note":"One per level above the last of each tree, on XORs of κ-bit nodes. Neither RS21 nor SGRR19 names the OT extension (libOTe, EMP)","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k\\omega \\)","func":"ot","implementation":"iknp","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( |\\mathbb{F}| \\)"},"part":"OT (GGM last level)","roles":{"receiver":"receiver","sender":"sender"}}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]},{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"},{"key":"WYKW20","title":"Wolverine: Fast, scalable, and communication-efficient zero-knowledge proofs for boolean and arithmetic circuits"}],"costs":[{"basis":"counted","formula":"\\( k((\\omega+2)|\\mathbb{F}|+\\kappa) \\)","locator":"Figure 7, steps 1, 5 and 6, p. 15; Optimizations, items 2–3, pp. 16–17; Appendix A, p. 29","measure":"communication","note":"a′ per single-point VOLE, then one batched check: a seed for the coefficients, x* and V_A","subject":"receiver"},{"basis":"counted","formula":"\\( k\\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15; Appendix A, p. 29","measure":"communication","note":"The correction d per single-point VOLE. The equality test's commitment and opening are left out: the commitment scheme is not fixed","subject":"sender"},{"basis":"counted","formula":"\\( k(\\nu(1+2|\\mathbb{F}|/\\kappa)-2\\omega) \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","note":"Full trees, then the ν coefficients from the seed; in κ-bit blocks","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( k(\\nu(1+2|\\mathbb{F}|/\\kappa)-2\\omega\\log_2(\\nu/\\omega)-2\\omega|\\mathbb{F}|/\\kappa) \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","note":"All but the punctured path, then the ν coefficients from the seed; in κ-bit blocks","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( k((d_A+1)\\nu+\\omega+1) \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","note":"Per tree Δ·a′ in γ; v·A, d_A per column (A has entries in 𝔽); the check's Δ·x* in y = y* − Δx* and χ·v in V_B, one per output","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( k((2d_A+1)\\nu+\\omega) \\)","locator":"Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","note":"u·A and w·A, d_A per column each (A has entries in 𝔽); the check's β·χ_α per tree in x* and χ·w in V_A, one per output","operation":"field_op","subject":"receiver"}],"id":"sgrr19_ywl20_wykw20","label":"SGRR19 VOLE with YWL+20's bootstrapping and WYKW20's consistency check","note":"RS21's malicious VOLE (§7.2, p. 26), counted from WYKW20's VOLE extension (Figures 7–8) with its batched check and seed (optimizations 2–3), regular noise. Negations and κ-bit XORs are not counted","params":["k","m","\\mathbb{F}"],"realizes":"vole","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"base","locator":"Figure 8, steps 2 and 5, p. 18; Appendix B.4, Optimizations, p. 39","phase":"setup","uses":[0],"what":"base VOLE for the LPN secret, one [β] per single-point VOLE and the batched check, first extension only"},{"id":"ots","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18","uses":[1,2],"what":"GGM-tree OTs, every level of every tree in parallel"},{"after":["base"],"from":"receiver","id":"a","locator":"Figure 7, step 1, p. 15","what":"a′ = β − a per single-point VOLE"},{"after":["a"],"from":"sender","id":"d","locator":"Figure 7, steps 1 and 3, p. 15","what":"the correction d per single-point VOLE, from γ = b − Δa′"},{"after":["ots","d"],"from":"receiver","id":"chal","locator":"Figure 7, step 5, p. 15; Optimizations, items 2–3, pp. 16–17","what":"the seed for the coefficients χ and x*, once the trees and d are fixed"},{"after":["chal"],"from":"sender","id":"commit","locator":"Figure 7, step 6, p. 15; Appendix A, p. 29","what":"a commitment to V_B, which needs y = y* − Δx*"},{"after":["commit"],"from":"receiver","id":"va","locator":"Appendix A, p. 29","what":"V_A"},{"after":["va"],"from":"sender","id":"open","locator":"Appendix A, p. 29","what":"the opening of V_B"}],"source":"WYKW20","uses":[{"count":"\\( k \\)","func":"vole","implementation":null,"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE, one for the batched check. WYKW20 uses its base sVOLE; RS21 does not say","open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu+\\omega+1 \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k\\omega(\\log_2(\\nu/\\omega)-1) \\)","func":"ot","implementation":"kos15","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18","note":"One per level above the last of each tree, on XORs of κ-bit nodes; the paper names no OT protocol","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","roles":{"receiver":"receiver","sender":"sender"}},{"count":"\\( k\\omega \\)","func":"ot","implementation":"kos15","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( |\\mathbb{F}| \\)"},"part":"OT (GGM last level)","roles":{"receiver":"receiver","sender":"sender"}}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega-1 \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]},{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"costs":[{"basis":"counted","formula":"\\( 3\\kappa k|C| \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","note":"Three rows \\( H(A \\| B) \\oplus C \\) of κ bits per non-free gate, the first row being zero; none per XOR gate","subject":"garbler"},{"basis":"counted","formula":"\\( 4k|C| \\)","locator":"§1.1, pp. 2–3","measure":"computation","note":"H on each of the four label pairs, the first giving the output label","operation":"symmetric_op","subject":"garbler"},{"basis":"counted","formula":"\\( k|C| \\)","locator":"§1.1, p. 2","measure":"computation","note":"One call to H on the labels it holds; point-and-permute picks the row","operation":"symmetric_op","subject":"evaluator"}],"id":"gc_grr3","label":"Free-XOR garbling with garbled-row reduction (GRR3)","note":"KS08 is not on ePrint; counted from ZRE15's restatement of GRR3 with free XOR (KS08's combination). \\( |C| \\) counts non-free gates.","params":["k","|C|"],"realizes":"gc","roles":{"evaluator":"evaluator","garbler":"garbler"},"source":"ZRE15"},{"cites":[{"key":"ZRE15","title":"Two Halves Make a Whole - Reducing Data Transfer in Garbled Circuits Using Half Gates"},{"key":"BHKR13","title":"Efficient Garbling from a Fixed-Key Blockcipher"},{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"}],"costs":[{"basis":"counted","formula":"\\( 2\\kappa k|C| \\)","locator":"Fig. 2, GbAnd, p. 9","measure":"communication","note":"The rows \\( T_G \\) and \\( T_E \\), κ bits each, per AND gate; none per XOR gate","subject":"garbler"},{"basis":"counted","formula":"\\( 4k|C| \\)","locator":"Fig. 2, GbAnd, p. 9","measure":"computation","note":"H on both labels of each input wire, reused for the output labels; with BHKR13 each H is one fixed-key AES call (Definition 2, p. 11)","operation":"symmetric_op","subject":"garbler"},{"basis":"counted","formula":"\\( 2k|C| \\)","locator":"Fig. 2, Ev, p. 9","measure":"computation","note":"H on the label it holds of each input wire","operation":"symmetric_op","subject":"evaluator"}],"id":"gc_halfgates","label":"Half-gates garbling with free XOR and fixed-key AES","note":"\\( |C| \\) counts non-free gates; Fig. 2 garbles AND and XOR gates, and Fig. 1 any odd gate the same way.","params":["k","|C|"],"realizes":"gc","roles":{"evaluator":"evaluator","garbler":"garbler"},"source":"ZRE15"},{"cites":[{"key":"Yao86","title":"How to Generate and Exchange Secrets (Extended Abstract)"}],"costs":[{"basis":"counted","formula":"\\( 4c_Ek|C| \\)","locator":"§1.1, p. 2","measure":"communication","note":"Four ciphertexts per gate, one per combination of input labels, XOR gates included","subject":"garbler"},{"basis":"counted","formula":"\\( 4k|C| \\)","locator":"§1.1, p. 2","measure":"computation","note":"One encryption under both input labels per row; a double encryption, as HEK12 §2 writes it, would be two","operation":"symmetric_op","subject":"garbler"},{"basis":"counted","formula":"\\( 4k|C| \\)","locator":"§1.1, p. 2","measure":"computation","note":"It tries all four rows, without point-and-permute","operation":"symmetric_op","subject":"evaluator"}],"id":"gc_yao","label":"Yao's garbled circuits (classical)","note":"Yao86 is not on ePrint; counted from ZRE15's description of the classical construction. Without free XOR every gate costs, so \\( |C| \\) counts all gates.","params":["k","|C|"],"realizes":"gc","roles":{"evaluator":"evaluator","garbler":"garbler"},"source":"ZRE15","variables":[{"meaning":"Length in bits of one garbled-table ciphertext: a CPA-secure encryption of a κ-bit wire label, longer than the κ-bit rows of point-and-permute (ZRE15 §1.1)","symbol":"c_E"}]},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"},{"key":"Bea91","title":"Efficient multiparty protocols using circuit randomization"},{"key":"IKNP03","title":"Extending oblivious transfers efficiently"},{"key":"ALSZ13","title":"More efficient oblivious transfer and extensions for faster secure computation"},{"key":"DSZ15","title":"ABY – a framework for efficient mixed-protocol secure two-party computation"}],"costs":[{"basis":"counted","formula":"\\( 2k|C| \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","note":"Per AND gate its shares of x ⊕ a and y ⊕ b, one bit each, given the triples","phase":"online","subject":"party"}],"id":"gmw_iknp","label":"GMW with multiplication triples from random OTs by OT extension (IKNP, as in ABY)","note":"GMW87, Bea91 and ABY are not on ePrint; the online step is Beaver's multiplication as MASCOT restates it, over \\( \\mathbb{F}_2 \\) without MACs. Sharing inputs and opening outputs belong to the row; XOR and AND on shares are not counted.","params":["k","|C|","depth"],"realizes":"two_pc","roles":{"party":"party"},"schedule":[{"id":"rot","locator":"ALSZ13 §5.1, Algorithm 1, p. 12; §5.4, R-OT for GMW, p. 19","uses":[0],"what":"random OTs on bits for the multiplication triples, one each way per AND gate, before the inputs"},{"after":["rot"],"from":"party","id":"open_a","locator":"KOS16 (MASCOT) Protocol 6, Multiply step 1, p. 21; ALSZ13 §2.4, p. 7","repeat":"\\( \\mathrm{depth} \\)","what":"one party's shares of x ⊕ a and y ⊕ b, per AND layer"},{"after":["rot"],"from":"party","id":"open_b","locator":"KOS16 (MASCOT) Protocol 6, Multiply step 1, p. 21; ALSZ13 §2.4, p. 7","repeat":"\\( \\mathrm{depth} \\)","what":"the other party's shares of x ⊕ a and y ⊕ b, at the same time, per AND layer"}],"source":"ALSZ13","uses":[{"count":"\\( k|C| \\)","func":"rot","implementation":"iknp_rot","locator":"§5.1, Algorithm 1, p. 12; §5.4, R-OT for GMW, p. 19","note":"Two random OTs on bits per AND gate, one each way: each party is sender in k|C| of them and receiver in the other k|C|, so each bears both roles' costs once","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":"party","sender":"party"}}]},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"},{"key":"ALSZ13","title":"More efficient oblivious transfer and extensions for faster secure computation"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"costs":[{"basis":"counted","formula":"\\( 2k|C| \\)","locator":"ALSZ13 §2.4, p. 7, and §5.1, p. 12; KOS16 (ePrint 2016/505) §6.2, p. 20, Protocol 6, Multiply, p. 21","measure":"communication","note":"Beaver multiplication: per AND gate each party sends its shares of x ⊕ a and y ⊕ b; XOR gates are local","phase":"online","source":"ALSZ13","subject":"party"}],"id":"gmw_silent","label":"GMW with multiplication triples from silent random OTs","note":"GMW87 is not on ePrint; triples as ALSZ13 §5.1 derives them from random OTs, AND gates by Beaver's method. Local XORs and ANDs of bits are not counted, nor XOR gates, which the block does not parametrize","params":["k","|C|","depth"],"realizes":"two_pc","roles":{"party":"party"},"schedule":[{"id":"rot","locator":"ALSZ13 §5.1 and Algorithm 1, p. 12","uses":[0],"what":"the triples' random OTs, one each way per AND gate"},{"after":["rot"],"from":"party","id":"open_1","locator":"KOS16 (ePrint 2016/505) Protocol 6, Multiply, step 1, p. 21; ALSZ13 §2.4, p. 7","repeat":"\\( \\mathrm{depth} \\)","what":"per AND layer: one party's shares of x ⊕ a and y ⊕ b"},{"after":["rot"],"from":"party","id":"open_2","locator":"KOS16 (ePrint 2016/505) Protocol 6, Multiply, step 1, p. 21; ALSZ13 §2.4, p. 7","repeat":"\\( \\mathrm{depth} \\)","what":"per AND layer: the other party's shares of x ⊕ a and y ⊕ b, sent at the same time"}],"source":"BCG+19","uses":[{"count":"\\( k|C| \\)","func":"rot","implementation":"silent_ot","locator":"ALSZ13 §5.1 and Algorithm 1, p. 12; BCG+19 §1, p. 3","note":"Two random OTs on bits per AND gate, one each way: each party is sender in one batch, receiver in the other","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":"party","sender":"party"},"source":"ALSZ13"}]},{"cites":[{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"costs":[{"basis":"counted","formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 4, p. 15","measure":"communication","note":"One correction \\( c \\in \\mathbb{F}_{2^{\\kappa}} \\) per tree","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 10, step 3, p. 20","measure":"communication","note":"Only the OTs' messages; the masked choices t of chosen-input OT are not sent","subject":"receiver"},{"basis":"counted","formula":"\\( 2\\nu-2\\omega+2k \\)","locator":"Figure 6, step 1, p. 17; Figure 4, Expand step 2, p. 15; §7.1, Noise distribution, p. 30","measure":"computation","note":"Full trees in κ-bit blocks, then both hashes H(i, w′ᵢ − j·x) per OT; H outputs κ bits, so τ ≤ κ","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2\\nu-2\\omega\\log_2(\\nu/\\omega)-2\\omega+k \\)","locator":"Figure 6, Output steps 2–3, p. 17; Figure 4, Expand step 1, p. 15","measure":"computation","note":"All but the punctured path in κ-bit blocks, then one hash H(i, v′ᵢ) per OT","operation":"symmetric_op","subject":"receiver"}],"id":"silent_ot","label":"Silent OT extension (two-round, from dual LPN)","note":"BCG+19's semi-honest random OT (Figure 4 over the subfield VOLE of Figures 6 and 9 with \\( \\mathbb{B} = \\mathbb{F}_2 \\), so no reverse VOLE), quasi-cyclic code and regular noise (§7.1). Negations and κ-bit XORs are not counted","params":["k","\\tau"],"realizes":"rot","roles":{"receiver":"receiver","sender":"sender"},"schedule":[{"id":"ots","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19","uses":[0],"what":"GGM-tree OTs, every level of every tree in parallel"},{"from":"sender","id":"corr","locator":"Figure 6, step 2, p. 17; Theorem 8, p. 18","what":"the corrections c, one per tree, in parallel to the OTs; with \\( \\mathbb{B} = \\mathbb{F}_2 \\) there is no reverse VOLE to wait for"}],"source":"BCG+19","uses":[{"count":"\\( \\omega\\log_2(\\nu/\\omega) \\)","func":"ot","implementation":"iknp","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19; Theorem 10, p. 20; Table 2 caption, p. 31; §7.2, p. 31","note":"One per tree level; over \\( \\mathbb{F}_{2^{\\kappa}} \\) every level's strings are \\( \\kappa \\) bits. 128 Naor–Pinkas base OTs, then IKNP, as BCG+19's \"hybrid\"","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM trees)","roles":{"receiver":"receiver","sender":"sender"}}],"variables":[{"meaning":"LPN noise weight for the k outputs: the number of punctured GGM trees, one per block of regular noise (BCG+19 writes t)","symbol":"\\omega"},{"meaning":"LPN code length for the k outputs (BCG+19 writes N); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2k \\)","symbol":"\\nu"}]},{"cites":[{"key":"KMRS14","title":"Scaling private set intersection to billion-element sets"}],"costs":[{"basis":"counted","formula":"\\( k(\\kappa+(\\lambda n_X+5d)w) \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 1 and 3, p. 14","measure":"communication","note":"Its key and the three dummy sets to P_2, then the images of its items' λ copies and of D_0 and D_1 to the server","subject":"sender"},{"basis":"counted","formula":"\\( k(\\lambda n_Y+2d)w \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 2–3, p. 14","measure":"communication","note":"The images of its items' λ copies and of D_0 and D_2 to the server","subject":"receiver"},{"basis":"counted","formula":"\\( 2k(\\lambda n_Y+d)w \\)","locator":"Protocol A.2, step 4, p. 14","measure":"communication","note":"At most: X, the images of the common items' copies and of D_0, to each of the two parties; no broadcast","subject":"server"},{"basis":"counted","formula":"\\( k(2\\lambda n_X+3d) \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 3, 5 and 6, p. 14","measure":"computation","note":"One PRF call per item copy and dummy, then at most one inversion per value of X: the λ copies of each common item and D_0","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( k(2\\lambda n_Y+3d) \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 3, 5 and 6, p. 14","measure":"computation","note":"One PRF call per item copy and dummy, then at most one inversion per value of X: the λ copies of each common item and D_0","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol A.2, step 4, p. 14","measure":"computation","note":"Intersects the two sets of images, comparisons only","operation":"symmetric_op","subject":"server"}],"id":"kmrs14","label":"Server-aided PSI of Kamara et al.","note":"Not on ePrint; read from NTY21 Appendix A. Each party replicates its items λ times with their index; the dummy sets are added once. The server is a third party that holds no input.","params":["k","n_X","n_Y"],"realizes":"psi","roles":{"receiver":"P_2","sender":"P_1","server":"S"},"schedule":[{"from":"sender","id":"key","locator":"Protocol A.2, step 1, p. 14","what":"the PRF key and the dummy sets D_0, D_1, D_2, to P_2"},{"from":"sender","id":"images_sender","locator":"Protocol A.2, step 3, p. 14","what":"the shuffled images of its items' copies and of D_0 and D_1, to the server"},{"after":["key"],"from":"receiver","id":"images_receiver","locator":"Protocol A.2, steps 2–3, p. 14","what":"the shuffled images of its items' copies and of D_0 and D_2, to the server"},{"after":["images_sender","images_receiver"],"from":"server","id":"reply","locator":"Protocol A.2, step 4, p. 14","what":"the intersection X of the images, to both parties"}],"source":"NTY21","variables":[{"meaning":"Size of each dummy set \\( D_0, D_1, D_2 \\); Protocol A.2 does not fix it","symbol":"d"},{"meaning":"Bits of an item and of its PRF value: F is inverted in step 6, so it permutes w-bit strings; Protocol A.2 does not fix w","symbol":"w"}]},{"cites":[{"key":"KMWF07","title":"Secure linear algebra using linearly recurrent sequences"}],"costs":[],"id":"kmwf07","label":"Secure singularity test of Kiltz et al.","note":"Here k is the block's matrix order, not a count; the one instance has count 1. Passive security, correct with probability \\( 1-(k+1)/q \\). Not on ePrint and no readable source gives its protocol, so no cost is counted","params":["k","\\mathbb{F}"],"realizes":"inv","roles":{"party":"party"},"source":"GS19"},{"cites":[{"key":"GS19","title":"The communication complexity of threshold private set intersection"},{"key":"CD01","title":"Secure distributed linear algebra in a constant number of rounds"}],"costs":[],"id":"gs19_cd01","label":"PICT of Ghosh and Simkin with the determinant protocol of Cramer and Damgård","note":"Generic secure computation inside, left open by GS23 (OT or additively homomorphic encryption). CD01 is not on ePrint and GS23 does not give the protocol, so no cost is counted; GS19 instantiates with KMWF07 instead","params":["k","n","t"],"realizes":"pict","roles":{"party":"party"},"source":"GS23"},{"cites":[{"key":"BDP21","title":"Multiparty cardinality testing for threshold private intersection"}],"costs":[{"basis":"counted","formula":"\\( (4t+2)kn \\)","locator":"BDP21 Protocol 2, step 2, p. 13","measure":"computation","note":"Per test, its set polynomial at each of the 4t + 2 public points, n − 1 products, then times its random scalar","operation":"field_op","subject":"party"}],"id":"bdp21_generic","label":"Multiparty cardinality test of Branco, Döttling and Pu, with generic secure computation","note":"BDP21 (ePrint 2020/1307) gives the version with threshold additively homomorphic encryption; GS23 replaces the encryption by generic secure computation without giving that protocol, so only the parties' local evaluations are counted. Each party's evaluations go into the computation as its input. Rounds not stated","params":["k","\\ell","n","t"],"realizes":"l_pict","roles":{"party":"party"},"schedule":[{"id":"test","locator":"GS23 §4.1, p. 16; BDP21 Protocol 2, steps 2–4, p. 13","uses":[0],"what":"the sum, the division and the degree test on the parties' evaluations, by generic secure computation"}],"source":"GS23","uses":[{"count":"\\( k \\)","func":"mpc","implementation":null,"locator":"GS23 §4.1, p. 16; BDP21 Protocol 2, steps 2–4, p. 13; Protocol 1, p. 10","note":"The parties' randomized evaluations summed and divided by the first party's, then the degree test by rational interpolation on two support sets, all by generic secure computation","open_in":"GS23","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( \\mathrm{poly}(t) \\)"},"part":"MPC (secure degree test)","roles":{"party":"party"}}]}],"measures":[{"column_label":"{subject} communication","id":"communication","label":"Communication","meaning":"What the role sends, in bits or counted elements.","subjects":["roles"],"total":true},{"column_label":"{subject} computation","id":"computation","label":"Computation","meaning":"The work the role performs, counted by operation where the source counts it.","subjects":["roles","algorithms"],"total":true},{"id":"rounds","label":"Rounds","meaning":"Rounds of interaction; in the two-party table, messages.","subjects":[]}],"members":[],"objects":[],"operations":[{"id":"exponentiation","label":"exp","meaning":"Group exponentiations in any group the protocol uses, as the source counts them: a prime-order group (a scalar multiplication on an elliptic curve), \\( \\mathbb{Z}_N^* \\) or \\( \\mathbb{Z}_{N^2}^* \\) for RSA and Paillier, or the multiplicative group of a finite field.","short":"group exponentiations"},{"id":"modmul","label":"mod mult","meaning":"Modular multiplications.","short":"modular multiplications"},{"id":"hom_op","label":"hom ops","meaning":"Homomorphic operations on ciphertexts.","short":"homomorphic operations"},{"id":"hom_mult","label":"hom mult","meaning":"Homomorphic multiplications.","short":"homomorphic multiplications"},{"id":"enc_dec","label":"enc/dec","meaning":"Encryptions and decryptions of the homomorphic scheme.","short":"encryptions and decryptions"},{"id":"field_op","label":"field mult","meaning":"Multiplications in a field; additions and XORs are not counted.","short":"field multiplications"},{"id":"symmetric_op","label":"sym ops","meaning":"Symmetric-key operations (hash, PRF or block-cipher calls).","short":"hash, PRF or block-cipher calls"},{"id":"ot","invocations":true,"label":"OTs","meaning":"Oblivious transfers.","short":"oblivious transfers"},{"id":"and_gate","invocations":true,"label":"circuit AND gates","meaning":"AND gates of the circuit the parties evaluate under 2PC (garbled circuits or GMW); with free XOR only AND gates cost.","short":"AND gates of the 2PC circuit"},{"id":"comparison","label":"comparisons","meaning":"Comparisons.","short":"comparisons"}],"per":[{"id":"client","label":"per client"}],"phases":[{"id":"setup","label":"setup","meaning":"Once per key, database or set of parties, before any session."},{"id":"offline","label":"offline","meaning":"Before the online input, query or message is known."},{"id":"online","label":"online","meaning":"Once the input, query or message is known."}],"roles":[{"aliases":[{"paper":"PSI-PAPER-1999-HFH","writes":"Alice"},{"paper":"PSI-PAPER-2004-FNP","writes":"server"},{"paper":"PSI-PAPER-2010-DT","writes":"server"},{"paper":"PSI-PAPER-2019-KRSSW","writes":"server"},{"paper":"PSI-PAPER-2020-ION","writes":"P1"},{"paper":"PSI-PAPER-2019-GS","writes":"Bob"}],"applies_to":{"parties":"two_party"},"id":"sender","label":"Sender","meaning":"Holds the set \\(X\\), of size \\(n_X\\); in one-sided PSI, the party that does not learn the output.","regime":"Two-party PSI."},{"aliases":[{"paper":"PSI-PAPER-1999-HFH","writes":"Bob"},{"paper":"PSI-PAPER-2004-FNP","writes":"client (chooser)"},{"paper":"PSI-PAPER-2010-DT","writes":"client"},{"paper":"PSI-PAPER-2019-KRSSW","writes":"client"},{"paper":"PSI-PAPER-2020-ION","writes":"P2"},{"paper":"PSI-PAPER-2019-GS","writes":"Alice"}],"applies_to":{"parties":"two_party"},"id":"receiver","label":"Receiver","meaning":"Holds the set \\(Y\\), of size \\(n_Y\\); in one-sided PSI, the party that learns the output.","regime":"Two-party PSI."},{"aliases":[{"paper":"PSI-PAPER-2017-KMPRT","writes":"leader"},{"paper":"PSI-PAPER-2021-NTY","writes":"the last server, P_ℓ"},{"paper":"PSI-PAPER-2021-BMRR","writes":"P_1"}],"applies_to":{"parties":"multiparty"},"id":"leader","label":"Leader","meaning":"The party that collects the other parties' messages and computes the output.","regime":"Multiparty PSI with a designated party."},{"aliases":[{"paper":"PSI-PAPER-2017-KMPRT","writes":"client"},{"paper":"PSI-PAPER-2021-NTY","writes":"client"},{"paper":"PSI-PAPER-2021-BMRR","writes":"P_i"}],"applies_to":{"parties":"multiparty"},"id":"client","label":"Per client","meaning":"Each party that only contributes its set and sends to the leader or the pivot, counted per party.","regime":"Multiparty PSI with a designated party."},{"aliases":[],"applies_to":{"parties":"multiparty"},"id":"party","label":"Per party","meaning":"Each party, when all parties play the same role.","regime":"Symmetric multiparty PSI."},{"aliases":[{"paper":"PSI-PAPER-2021-NTY","writes":"pivot"}],"applies_to":{"parties":"multiparty"},"id":"pivot","label":"Pivot","meaning":"The party that receives and combines the clients' encodings before the final step (NTY).","regime":"Multiparty PSI with clients, a pivot and servers."},{"aliases":[{"paper":"PSI-PAPER-2021-NTY","writes":"server"}],"applies_to":{"parties":"multiparty"},"id":"server","label":"Per server","meaning":"Each party that holds the clients' PRF keys and runs an OPPRF with the leader (NTY).","regime":"Multiparty PSI with clients, a pivot and servers."}],"tables":[{"column_labels":{"rounds":"Messages"},"columns":["output","set_size_regime","adversary","assumptions","security_model","rounds","communication.sender","communication.receiver","computation.sender","computation.receiver"],"id":"two_party","label":"Two-party","when":{"parties":"two_party"}},{"columns":["output","corruptions","adversary","assumptions","security_model","rounds","communication","computation"],"id":"multiparty","label":"Multiparty","when":{"parties":"multiparty"}}]},"constructions":[{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-NOT-STATED-DISCRETE-LOG-SETTING-MODULO-A-PRIME-WITH-AN-UNPREDICTABLE-HASH","assumption_name":"not stated; discrete-log setting modulo a prime with an unpredictable hash","attributes":{"adversary":{"locator":"Appendix A, p. 85","note":"No adversary model; a zero-knowledge proof against active cheating is suggested but not given","value":"not_reported"},"assumptions":{"locator":"§2, p. 79; Appendix A, p. 85","note":"Only the discrete-log setting modulo a prime and a hash whose output cannot be influenced or predicted are stated","value":"not_reported"},"output":{"locator":"Appendix A, step 5, p. 85","note":"Each party counts the matches between the doubly exponentiated, permuted lists","value":["cardinality"]},"output_to":{"locator":"Appendix A, step 5, p. 85","value":"all"},"parties":{"locator":"Appendix A, p. 85","value":"two_party"},"security_model":{"locator":"Appendix A, p. 85","note":"No proof is given for the protocol","value":"not_reported"},"set_size_regime":{"locator":"Appendix A, steps 1-4, p. 85","note":"Lists of any lengths are exchanged in full; nothing exploits one larger list","value":"balanced"},"technique":{"locator":"Appendix A, p. 85","note":"The authors relate it to Diffie-Hellman key exchange","value":["diffie_hellman"]}},"authors":["Bernardo A. Huberman","Matt Franklin","Tad Hogg"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["no-trusted-third-party","matching-count"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"commutative_exponentiation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated","subject":"sender","tip":"Sender is Alice and receiver is Bob; the protocol is symmetric and both learn the count."},{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"computation","note":"Its own hashed items, then the other party's values, each with its secret exponent","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Appendix A, step 1, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"computation","note":"Its own hashed items, then the other party's values, each with its secret exponent","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Appendix A, step 2, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-1999-HFH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-1999-HFH"],"paper_title":"Enhancing Privacy and Trust in Electronic Communities","paper_url":"https://doi.org/10.1145/336992.337012","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party matching count","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"own_a","locator":"Appendix A, step 1, p. 85","phase":"online","what":"Alice's hashed items to her secret exponent, permuted"},{"from":"receiver","id":"own_b","locator":"Appendix A, step 2, p. 85","phase":"online","what":"Bob's hashed items to his secret exponent, permuted"},{"after":["own_b"],"from":"sender","id":"re_a","locator":"Appendix A, step 3, p. 85","phase":"online","what":"Bob's values raised again to her exponent, permuted"},{"after":["own_a"],"from":"receiver","id":"re_b","locator":"Appendix A, step 4, p. 85","phase":"online","what":"Alice's values raised again to his exponent, permuted"}],"security_mode":"not_reported","security_model":"no adversary model or proof is given for the protocol (Appendix A, p. 85)","security_notion":"not stated in the paper","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Two-party preference matching by commutative exponentiation: each party raises its hashed items to a secret exponent modulo a prime, the other re-exponentiates them, and both count equal values in the permuted lists. Permuting every list hides which items match, so each party learns only the number of matches.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-1999-HFH","year":1999},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-NOT-STATED-DISCRETE-LOG-SETTING-MODULO-A-PRIME-WITH-AN-UNPREDICTABLE-HASH","assumption_name":"not stated; discrete-log setting modulo a prime with an unpredictable hash","attributes":{"adversary":{"locator":"Appendix A, p. 85","note":"No adversary model; a zero-knowledge proof against active cheating is suggested but not given","value":"not_reported"},"assumptions":{"locator":"§2, p. 79; Appendix A, p. 85","note":"Only the discrete-log setting modulo a prime and a hash whose output cannot be influenced or predicted are stated","value":"not_reported"},"output":{"locator":"Appendix A, p. 85","note":"Without permutation in steps 3 and 4 each party learns exactly which items are shared","value":["intersection"]},"output_to":{"locator":"Appendix A, p. 85","value":"all"},"parties":{"locator":"Appendix A, p. 85","value":"two_party"},"security_model":{"locator":"Appendix A, p. 85","note":"No proof is given for the protocol","value":"not_reported"},"set_size_regime":{"locator":"Appendix A, steps 1-4, p. 85","note":"Lists of any lengths are exchanged in full; nothing exploits one larger list","value":"balanced"},"technique":{"locator":"Appendix A, p. 85","note":"The authors relate it to Diffie-Hellman key exchange","value":["diffie_hellman"]}},"authors":["Bernardo A. Huberman","Matt Franklin","Tad Hogg"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["no-trusted-third-party","matching-count"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"commutative_exponentiation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated in order","subject":"sender","tip":"Sender is Alice and receiver is Bob; the protocol is symmetric and both learn the intersection."},{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated in order","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"computation","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Appendix A, step 1, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"computation","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Appendix A, step 2, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-1999-HFH"],"paper_title":"Enhancing Privacy and Trust in Electronic Communities","paper_url":"https://doi.org/10.1145/336992.337012","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party matching count","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"own_a","locator":"Appendix A, step 1, p. 85","phase":"online","what":"Alice's hashed items to her secret exponent, permuted"},{"from":"receiver","id":"own_b","locator":"Appendix A, step 2, p. 85","phase":"online","what":"Bob's hashed items to his secret exponent, permuted"},{"after":["own_b"],"from":"sender","id":"re_a","locator":"Appendix A, step 3, p. 85","phase":"online","what":"Bob's values raised again to her exponent, in the order received"},{"after":["own_a"],"from":"receiver","id":"re_b","locator":"Appendix A, step 4, p. 85","phase":"online","what":"Alice's values raised again to his exponent, in the order received"}],"security_mode":"not_reported","security_model":"no adversary model or proof is given for the protocol (Appendix A, p. 85)","security_notion":"not stated in the paper","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The variation of HFH preference matching in which the doubly exponentiated lists are returned in the order received, so each party learns which of its own items are shared rather than only how many. It is the Diffie-Hellman-style intersection protocol later PSI work traces to this paper.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-1999-HFH","year":1999},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"additively_homomorphic","assumption_id":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","assumption_name":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)","attributes":{"adversary":{"locator":"§4.4, p. 9","note":"Security follows from that of the base protocol, the paper says","value":["semi_honest"]},"assumptions":{"locator":"§3.3, pp. 4-5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"}],"value":["DCR"]},"output":{"locator":"§3.1, p. 3; §4.4, p. 9","value":["cardinality"]},"output_to":{"locator":"§4.4, p. 9","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"§4.3, pp. 8-9; §4.4, p. 9","value":["standard model"]},"set_size_regime":{"locator":"§4.2, p. 8; §4.4, p. 9","note":"Costs grow with both sets, as in the base protocol","value":"balanced"},"technique":{"locator":"§4.2, p. 7; §4.4, p. 9","note":"Hashing to bins is carried over from the base protocol, which the paper optimizes this way","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing"]}},"authors":["Michael J. Freedman","Kobbi Nissim","Benny Pinkas"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":[],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oblivious_polynomial_evaluation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 4n_X|\\mathbb{Z}_N| \\)","locator":"§4.2, p. 7; §4.4, p. 9","measure":"communication","note":"One ciphertext per candidate bin of each item, now encrypting a fixed string; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{2n_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\kappa \\)","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, pp. 7-8; §4.4, p. 9","measure":"communication","note":"The \\( M+1 \\) encrypted coefficients of each bin polynomial, her public key, and a key for the bin hash, taken as \\( \\kappa \\) bits","subject":"receiver"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-8; §4.4, p. 9","measure":"computation","note":"Per item and each of its two bins, \\( M \\) short exponentiations by Horner's rule and one full-length one by \\( r \\)","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7; §4.4, p. 9","measure":"computation","note":"Homomorphic additions, per item and bin: \\( M \\) in Horner's rule and one adding the encrypted fixed string","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"§4.4, p. 9","measure":"computation","note":"Encrypting the fixed string of zeros for each of its two answers","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, naming its two bins","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{n_Y(M+1)}{\\ln\\ln n_Y}+2n_X \\)","locator":"Protocol PM-Semi-Honest, steps 1(c) and 3, p. 6; §4.2, pp. 7-8; §4.4, p. 9","measure":"computation","note":"Encrypting every coefficient of the bin polynomials, then decrypting both answers for each sender item and counting the fixed strings","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O\\left(\\frac{n_YM^2}{\\ln\\ln n_Y}\\right) \\)","locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §4.2, p. 7","measure":"computation","note":"Coefficients of each bin polynomial from its roots, \\( O(M^2) \\) for degree \\( M \\); the paper does not fix the method","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, placing it in the less loaded of its two bins","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2004-FNP"],"paper_title":"Efficient Private Matching and Set Intersection","paper_url":"https://doi.org/10.1007/978-3-540-24676-3_1","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"PSI cardinality","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, p. 7","phase":"online","what":"public key, bin-hash key and the encrypted coefficients of the bin polynomials"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.4, p. 9","phase":"online","what":"both answers for each item, encrypting the fixed string, permuted"}],"security_mode":"computational","security_model":"semi-honest, standard model, by the proof of PM-Semi-Honest (§4.4, p. 9)","security_notion":"the client learns \\( \\lvert X \\cap Y \\rvert \\) only","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Private cardinality matching: the FNP semi-honest protocol with the server encrypting a fixed string of zeros instead of its item, so the client learns only how many of her decryptions equal that string, the size of the intersection.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Degree of each bin polynomial, the maximum bin load, \\( O(\\ln\\ln n_Y) \\)","symbol":"M"}],"verification_cost":null,"work_id":"PSI-PAPER-2004-FNP","year":2004},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"additively_homomorphic","assumption_id":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PSEUDORANDOM-FUNCTION-AND-COLLISION-RESISTANT-HASH","assumption_name":"semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash","attributes":{"adversary":{"locator":"§5.1, pp. 10-11; footnote 11, p. 11","note":"A malicious server cannot affect the client's privacy here, the paper notes, but can break correctness","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"Protocol PM-Malicious-Client, step 1, p. 10; footnote 10, p. 11","note":"Paillier is the named homomorphic instance","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"},{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"},{"id":"ASM-CRHF","name":"Collision-resistant hash functions (CRHF)","short":"CRHF"}],"value":["DCR","PRF","CRHF"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"footnote 4, p. 2; §5, p. 10","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"Protocol PM-Malicious-Client, p. 10; §5.1, p. 11","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing","cut_and_choose"]}},"authors":["Michael J. Freedman","Kobbi Nissim","Benny Pinkas"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":[],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oblivious_polynomial_evaluation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2Ln_X|\\mathbb{Z}_N|+L \\)","locator":"Protocol PM-Malicious-Client, steps 2 and 4-5, p. 10","measure":"communication","note":"A challenge naming the copies to open, then one ciphertext per item, candidate bin and evaluated copy; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{3Ln_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\left(\\frac{L}{2}+1\\right)\\kappa \\)","locator":"Protocol PM-Malicious-Client, steps 1 and 3, p. 10; §4.2, pp. 7-8","measure":"communication","note":"\\( L \\) copies of the encrypted bin polynomials, then openings of half and the PRF keys of the rest; plus her public key and the hash key","subject":"receiver"},{"basis":"counted","formula":"\\( L(M+1)n_X \\)","locator":"Protocol PM-Malicious-Client, step 4, p. 10; §4.2, pp. 6-8","measure":"computation","note":"Per item, both bins in each of the \\( L/2 \\) evaluated copies: \\( M \\) short exponentiations by Horner's rule and one full-length one","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( L(M+1)n_X \\)","locator":"Protocol PM-Malicious-Client, step 4, p. 10; §4.2, pp. 6-7","measure":"computation","note":"Homomorphic additions, per answer: \\( M \\) in Horner's rule and one adding the encrypted share","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( Ln_X+\\frac{Ln_Y(M+1)}{2\\ln\\ln n_Y} \\)","locator":"Protocol PM-Malicious-Client, steps 3-4, p. 10","measure":"computation","note":"One encrypted share per answer, and re-encrypting the opened coefficients to check them; the check of the roots is not specified","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{L}{2}+2\\right)n_X \\)","locator":"Protocol PM-Malicious-Client, steps 1 and 4, p. 10","measure":"computation","note":"Per item, the collision-resistant hash and the bin hash, then its pseudo-identity under each revealed key","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{Ln_Y(M+1)}{\\ln\\ln n_Y}+Ln_X \\)","locator":"Protocol PM-Malicious-Client, steps 1 and 5, p. 10; §4.2, pp. 7-8","measure":"computation","note":"Encrypting the coefficients of all \\( L \\) copies, then decrypting every answer","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O\\left(\\frac{Ln_YM^2}{\\ln\\ln n_Y}\\right) \\)","locator":"Protocol PM-Malicious-Client, step 1, p. 10; §4.2, p. 7","measure":"computation","note":"Coefficients of each bin polynomial of each copy from its roots, \\( O(M^2) \\) for degree \\( M \\)","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( (L+2)n_Y \\)","locator":"Protocol PM-Malicious-Client, step 1, p. 10","measure":"computation","note":"Per item, the collision-resistant hash and the bin hash, then its pseudo-identity under each of the \\( L \\) keys","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2004-FNP"],"paper_title":"Efficient Private Matching and Set Intersection","paper_url":"https://doi.org/10.1007/978-3-540-24676-3_1","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"copies","locator":"Protocol PM-Malicious-Client, step 1, p. 10","phase":"online","what":"bin-hash key, public key and the \\( L \\) encrypted copies of the bin polynomials"},{"after":["copies"],"from":"sender","id":"challenge","locator":"Protocol PM-Malicious-Client, step 2, p. 10","phase":"online","what":"which \\( L/2 \\) copies to open"},{"after":["challenge"],"from":"receiver","id":"open","locator":"Protocol PM-Malicious-Client, step 3, p. 10","phase":"online","what":"openings of the chosen copies and the PRF keys of the others"},{"after":["open"],"from":"sender","id":"answers","locator":"Protocol PM-Malicious-Client, steps 4-5, p. 10","phase":"online","what":"the answers of each item in the unopened copies, as shares of the item"}],"security_mode":"computational","security_model":"malicious client, standard model (footnote 4, p. 2; §5, p. 10; proof sketch, p. 11)","security_notion":"private matching with the client's effective input bounded by \\( n_Y \\) items","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"FNP private matching secure against a malicious client: she sends \\( L \\) copies of her bin polynomials over pseudorandom identities, the server opens half to check they hold at most \\( n_Y \\) nonzero roots, and evaluates the rest with XOR shares of each item as payloads, so an item is learned only if it is a root of every copy.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of cut-and-choose copies; the error is exponentially small in \\( L \\)","symbol":"L"},{"meaning":"Degree of each bin polynomial, the maximum bin load, \\( O(\\ln\\ln n_Y) \\)","symbol":"M"}],"verification_cost":null,"work_id":"PSI-PAPER-2004-FNP","year":2004},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"additively_homomorphic","assumption_id":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PSEUDORANDOM-FUNCTION-AND-COLLISION-RESISTANT-HASH","assumption_name":"semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash","attributes":{"adversary":{"locator":"§5.1, pp. 10-11","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"§3.3, pp. 4-5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"}],"value":["DCR"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"footnote 4, p. 2; §5.1, p. 11","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"§5.1, p. 11","value":["oblivious_polynomial_evaluation"]}},"authors":["Michael J. Freedman","Kobbi Nissim","Benny Pinkas"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":[],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oblivious_polynomial_evaluation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2n_X|\\mathbb{Z}_N| \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6","measure":"communication","note":"One ciphertext per item; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( (2n_Y+1)|\\mathbb{Z}_N| \\)","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §5.1, p. 11","measure":"communication","note":"Her public key and the encrypted coefficients of one degree-\\( n_Y \\) polynomial, whose constant term is fixed to one and not sent","subject":"receiver"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7","measure":"computation","note":"Per item, \\( n_Y \\) short exponentiations by Horner's rule and one full-length one","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7; §5.1, p. 11","measure":"computation","note":"Homomorphic additions, per item: \\( n_Y \\) in Horner's rule, the last adding the known constant term, and one adding the encrypted item","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Protocol PM-Semi-Honest, step 2(b), p. 6","measure":"computation","note":"Encrypting each item for its answer","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Protocol PM-Semi-Honest, steps 1 and 3, p. 6","measure":"computation","note":"Encrypting the coefficients and decrypting the replies","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O(n_Y^2) \\)","locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §5.1, p. 11","measure":"computation","note":"Coefficients of the polynomial from its roots, scaled so the constant term is one; the paper does not fix the method","operation":"field_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2004-FNP"],"paper_title":"Efficient Private Matching and Set Intersection","paper_url":"https://doi.org/10.1007/978-3-540-24676-3_1","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §5.1, p. 11","phase":"online","what":"public key and the encrypted coefficients of one polynomial, its constant term fixed to one"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Semi-Honest, step 2, p. 6","phase":"online","what":"one answer per item, permuted"}],"security_mode":"computational","security_model":"malicious client, standard model (footnote 4, p. 2; §5, p. 10; proof sketch, p. 11)","security_notion":"private matching with the client's effective input bounded by \\( n_Y \\) items","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The simple malicious-client protocol FNP describe before the hashed one: PM-Semi-Honest without bins, with the polynomial's constant term fixed to one so that it cannot be identically zero and has at most \\( n_Y \\) roots.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2004-FNP","year":2004},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"additively_homomorphic","assumption_id":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-RANDOM-ORACLES","assumption_name":"semantically secure additively homomorphic encryption and random oracles","attributes":{"adversary":{"locator":"§5.2, p. 11; Lemma 4, p. 12","note":"The server's privacy is preserved as in the semi-honest protocol","value":{"receiver":"semi_honest","sender":"malicious"}},"assumptions":{"locator":"§3.3, pp. 4-5; Protocol PM-Malicious-Server, p. 12","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"}],"value":["DCR"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; Lemma 4 and proof sketch, pp. 12-13","note":"The simulator extracts the server's input from its oracle queries","value":["random oracle"]},"set_size_regime":{"locator":"Protocol PM-Malicious-Server, p. 12","value":"balanced"},"technique":{"locator":"Protocol PM-Malicious-Server, p. 12","value":["oblivious_polynomial_evaluation"]}},"authors":["Michael J. Freedman","Kobbi Nissim","Benny Pinkas"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":[],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oblivious_polynomial_evaluation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n_X(2|\\mathbb{Z}_N|+\\tau) \\)","locator":"Protocol PM-Malicious-Server, step 2, p. 12","measure":"communication","note":"A ciphertext and a random-oracle output for each item, permuted; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( (2n_Y+3)|\\mathbb{Z}_N| \\)","locator":"Protocol PM-Malicious-Server, step 1, p. 12","measure":"communication","note":"Her public key and the encrypted coefficients of one degree-\\( n_Y \\) polynomial","subject":"receiver"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Malicious-Server, step 2, p. 12; §4.2, pp. 6-7","measure":"computation","note":"No bins: per item, \\( n_Y \\) short exponentiations by Horner's rule and one full-length one, all derandomized","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Malicious-Server, step 2(b), p. 12; §4.2, pp. 6-7","measure":"computation","note":"Homomorphic additions, per item: \\( n_Y \\) in Horner's rule and one adding the encrypted seed","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Protocol PM-Malicious-Server, step 2(b), p. 12","measure":"computation","note":"Encrypting the random seed of each item, with randomness derived from it","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Protocol PM-Malicious-Server, step 2, p. 12","measure":"computation","note":"Per item, one call to each random oracle","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)\\min(n_X,n_Y) \\)","locator":"Protocol PM-Malicious-Server, step 3(b), p. 12","measure":"computation","note":"Re-running the server's derandomized evaluation for each reply whose hash matches one of her items, counted for the largest possible intersection","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( (n_Y+1)\\min(n_X,n_Y) \\)","locator":"Protocol PM-Malicious-Server, step 3(b), p. 12","measure":"computation","note":"The homomorphic additions of each re-run evaluation","operation":"hom_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+n_Y+1+\\min(n_X,n_Y) \\)","locator":"Protocol PM-Malicious-Server, steps 1 and 3, p. 12","measure":"computation","note":"Encrypting the coefficients, decrypting each reply, and re-encrypting the seed in each re-run evaluation","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O(n_Y^2) \\)","locator":"Protocol PM-Malicious-Server, step 1(b), p. 12","measure":"computation","note":"Coefficients of the polynomial from its roots; the paper does not fix the method","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_X(n_Y+1) \\)","locator":"Protocol PM-Malicious-Server, step 3, p. 12","measure":"computation","note":"Per reply, the first random oracle on the decrypted seed and the second on each of her items, to find the one it fits","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2004-FNP"],"paper_title":"Efficient Private Matching and Set Intersection","paper_url":"https://doi.org/10.1007/978-3-540-24676-3_1","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Malicious-Server, step 1, p. 12","phase":"online","what":"public key and the encrypted coefficients of the polynomial"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Malicious-Server, step 2, p. 12","phase":"online","what":"one ciphertext and one random-oracle output per item, permuted"}],"security_mode":"computational","security_model":"malicious server, random oracle model (Lemma 4 and proof sketch, pp. 12-13)","security_notion":"private matching against a malicious server, with the server's input extracted from its random-oracle queries","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"FNP private matching secure against a malicious server in the random oracle model: for each item the server derives all its randomness from \\( H_1(s) \\) for a random \\( s \\) and returns \\( \\mathrm{Enc}(r'\\cdot P(y)+s) \\) with \\( H_2(r'',y) \\), so the client can check that each reply is what an honest server would send for one of her items.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Output length of the random oracle \\( H_2 \\), not fixed by the paper","symbol":"\\tau"}],"verification_cost":null,"work_id":"PSI-PAPER-2004-FNP","year":2004},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"additively_homomorphic","assumption_id":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","assumption_name":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)","attributes":{"adversary":{"locator":"§7, p. 15","value":["semi_honest"]},"assumptions":{"locator":"§3.3, pp. 4-5; §7, step 1, p. 16","note":"Any semantically secure additively homomorphic scheme, a key pair per client; Paillier is the named instance","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"}],"value":["DCR"]},"corruptions":{"locator":"§7, p. 16","note":"Stated informally: values outside the intersection look random to any coalition; no proof","value":"\\( t_c < \\ell \\)"},"output":{"locator":"§7, p. 15","value":["intersection"]},"output_to":{"locator":"§7, step 4, p. 16","note":"Every party checks the published row values against its own items","value":"all"},"parties":{"locator":"§7, p. 15","value":"multiparty"},"security_model":{"locator":"§7, pp. 15-17","note":"The protocol is sketched without proof","value":"not_reported"},"set_size_regime":{"locator":"§7, p. 15","note":"Each list holds \\( n \\) items, without loss of generality","value":"balanced"},"technique":{"locator":"§7, steps 1-4, p. 16","value":["oblivious_polynomial_evaluation","secret_sharing"]}},"authors":["Michael J. Freedman","Kobbi Nissim","Benny Pinkas"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":[],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oblivious_polynomial_evaluation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (2n\\ell+n+3)|\\mathbb{Z}_N| \\)","locator":"§7, steps 1 and 3, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(a), p. 6","measure":"communication","note":"Her public key; then \\( n+1 \\) encrypted coefficients and \\( n(\\ell-1) \\) encrypted zero shares, posted once; then \\( n \\) row XORs at plaintext width","subject":"client"},{"basis":"counted","formula":"\\( 2n(\\ell-1)|\\mathbb{Z}_N| \\)","locator":"§7, step 2, p. 16","measure":"communication","note":"\\( n \\) permuted tuples of one ciphertext per client, posted once","subject":"leader"},{"basis":"counted","formula":"\\( n(n+1)(\\ell-1) \\)","locator":"§7, step 2, p. 16; §4.2, pp. 6–7; p. 17","measure":"computation","note":"Per item and client, \\( n \\) short exponentiations by Horner's rule and one by a fresh random multiplier; hashing to bins would lower this","operation":"exponentiation","subject":"leader"},{"basis":"counted","formula":"\\( n(n+1)(\\ell-1) \\)","locator":"§7, step 2, p. 16; §4.2, pp. 6–7","measure":"computation","note":"Homomorphic additions per item and client: \\( n \\) in Horner's rule and one adding the encrypted share of the item","operation":"hom_op","subject":"leader"},{"basis":"counted","formula":"\\( n(\\ell-1) \\)","locator":"§7, step 2, p. 16","measure":"computation","note":"Encrypting each item's share for each client, under that client's key","operation":"enc_dec","subject":"leader"},{"basis":"counted","formula":"\\( 2n\\ell+1 \\)","locator":"§7, steps 1 and 3, p. 16","measure":"computation","note":"Encrypts \\( n+1 \\) coefficients and \\( n(\\ell-1) \\) zero shares, then decrypts her column from the leader and from every client, her own included","operation":"enc_dec","subject":"client"},{"basis":"counted","formula":"\\( O(n^{2}) \\)","locator":"§7, step 1, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(b), p. 6","measure":"computation","note":"Coefficients of her polynomial from its roots, \\( O(n^{2}) \\) for degree \\( n \\); the paper does not fix the method","operation":"field_op","subject":"client"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2004-FNP"],"paper_title":"Efficient Private Matching and Set Intersection","paper_url":"https://doi.org/10.1007/978-3-540-24676-3_1","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"client","id":"keys","locator":"§7, steps 1–2, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(a), p. 6","phase":"online","what":"each client's public key, which the others encrypt her column under"},{"after":["keys"],"from":"client","id":"post","locator":"§7, step 1, p. 16","phase":"online","what":"the encrypted coefficients of her polynomial and her zero-XOR shares, each column under its client's key"},{"after":["keys","post"],"from":"leader","id":"tuples","locator":"§7, step 2, p. 16","phase":"online","what":"the permuted tuples, each item's share for every client under that client's key"},{"after":["post","tuples"],"from":"client","id":"rows","locator":"§7, step 3, p. 16","phase":"online","what":"the XOR of each row of her decrypted column"}],"security_mode":"computational","security_model":"semi-honest; no proof is given (§7, pp. 15-17)","security_notion":"each party learns the intersection of all \\( \\ell \\) lists","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"FNP's sketch of multiparty PSI: the clients post encrypted polynomials and encrypted zero-XOR share matrices, the leader evaluates each client's polynomial at its items with XOR shares of the item as payloads, and the clients publish row XORs from which every party reads off the intersection.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2004-FNP","year":2004},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"additively_homomorphic","assumption_id":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","assumption_name":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)","attributes":{"adversary":{"locator":"§3.2, p. 4; §4.3, pp. 8-9","value":["semi_honest"]},"assumptions":{"locator":"§3.3, pp. 4-5; footnote 8, p. 5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance, El Gamal an alternative","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"}],"value":["DCR"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; §4.3, pp. 8-9","value":["standard model"]},"set_size_regime":{"locator":"Abstract, p. 1; §4.2, p. 8","note":"Costs grow with both sets; the abstract states them for two lists of the same length","value":"balanced"},"technique":{"locator":"§4.1, p. 5; §4.2, p. 7","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing"]}},"authors":["Michael J. Freedman","Kobbi Nissim","Benny Pinkas"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["payload-transfer"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2004-FNP-OPE-PSI","PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oblivious_polynomial_evaluation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 4n_X|\\mathbb{Z}_N| \\)","locator":"§4.2, p. 7","measure":"communication","note":"One ciphertext per candidate bin of each of its items; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{2n_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\kappa \\)","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, pp. 7-8","measure":"communication","note":"The \\( M+1 \\) encrypted coefficients of each bin polynomial, her public key, and a key for the bin hash, taken as \\( \\kappa \\) bits","subject":"receiver"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-8","measure":"computation","note":"Per item and each of its two bins, \\( M \\) short exponentiations by Horner's rule and one full-length one by \\( r \\)","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7","measure":"computation","note":"Homomorphic additions, per item and bin: \\( M \\) in Horner's rule and one adding the encrypted item","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Protocol PM-Semi-Honest, step 2(b), p. 6; §4.2, p. 7","measure":"computation","note":"Encrypting the item, with any payload, for each of its two answers","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, naming its two bins","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{n_Y(M+1)}{\\ln\\ln n_Y}+2n_X \\)","locator":"Protocol PM-Semi-Honest, steps 1(c) and 3, p. 6; §4.2, pp. 7-8","measure":"computation","note":"Encrypting every coefficient of the bin polynomials, then decrypting both answers for each sender item","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O\\left(\\frac{n_YM^2}{\\ln\\ln n_Y}\\right) \\)","locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §4.2, p. 7","measure":"computation","note":"Coefficients of each bin polynomial from its roots, \\( O(M^2) \\) for degree \\( M \\); the paper does not fix the method","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, placing it in the less loaded of its two bins","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2004-FNP-SH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2004-FNP"],"paper_title":"Efficient Private Matching and Set Intersection","paper_url":"https://doi.org/10.1007/978-3-540-24676-3_1","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, p. 7","phase":"online","what":"public key, bin-hash key and the encrypted coefficients of the bin polynomials"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, p. 7","phase":"online","what":"both answers for each item, one per candidate bin, permuted"}],"security_mode":"computational","security_model":"semi-honest, standard model (Lemmas 1-3, p. 8; §4.3, p. 9)","security_notion":"private matching: the client learns \\( X \\cap Y \\); client privacy by indistinguishability, server privacy by comparison with the ideal model","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The client encodes her set as the roots of polynomials, one per bin of a balanced-allocation hash, and sends their encrypted coefficients; the server evaluates the two candidate bin polynomials homomorphically at each of its items and returns encryptions of \\( r\\cdot P(y)+y \\), which decrypt to \\( y \\) exactly for shared items.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Degree of each bin polynomial, the maximum bin load, \\( O(\\ln\\ln n_Y) \\)","symbol":"M"}],"verification_cost":null,"work_id":"PSI-PAPER-2004-FNP","year":2004},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"factoring","assumption_id":"PSI-ASSUMPTION-ONE-MORE-RSA-INVERSION-AND-RANDOM-ORACLES","assumption_name":"one-more RSA inversion and random oracles","attributes":{"adversary":{"locator":"§5.1, p. 6; Appendix B.3, p. 16","note":"Honest-but-curious client and server; malicious proofs left to future work","value":["semi_honest"]},"assumptions":{"locator":"Appendix B.3, p. 16","note":"One-More-RSA, which has no registry card; the RSA assumption is weaker than the one used","resolved":[{"id":"ASM-ONE-MORE-RSA","name":"One-more RSA inversion (one-more RSA)","short":"one-more RSA"}],"value":["one-more RSA"]},"output":{"locator":"§2, p. 2; Figure 4, p. 9","value":["intersection"]},"output_to":{"locator":"§2, p. 2","note":"The client; mutual PSI by two one-way runs","value":"one"},"parties":{"locator":"§2, p. 2","value":"two_party"},"security_model":{"locator":"Appendix B.3, p. 16; Table 2, p. 11","value":["random oracle"]},"set_size_regime":{"locator":"Table 2, p. 11","value":"balanced"},"technique":{"locator":"§5.6, p. 9","value":["rsa_blind_signature"]}},"authors":["Emiliano De Cristofaro","Gene Tsudik"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"step_phase":"online"},"capabilities":["server-precomputation","no-online-client-exponentiation"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2010-DT-BLIND-RSA"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"rsa_blind_signature","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n_Y|\\mathbb{Z}_N| + n_X\\kappa \\)","locator":"Figure 4, step 5, p. 9","measure":"communication","note":"The signed blinded values, and one security-parameter-length tag per item","subject":"sender"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{Z}_N| \\)","locator":"Figure 4, step 3, p. 9","measure":"communication","note":"One blinded hash per item","subject":"receiver"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 4, step 1, p. 9; §5.6, p. 9","measure":"computation","note":"RSA signatures with the private exponent; reusable while the key and set are unchanged","operation":"exponentiation","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Figure 4, inputs and step 1, p. 9","measure":"computation","note":"Hashing each item, then hashing its signature into a tag","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 4, p. 9; Table 2, p. 11","measure":"computation","note":"Signing each blinded value with the full-length private exponent","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"Figure 4, step 2, p. 9; §5.6, p. 9","measure":"computation","note":"Blinding: a random factor to the small public exponent, then one multiplication, per item","operation":"modmul","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, inputs, p. 9","measure":"computation","note":"Hashing each item","operation":"symmetric_op","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 6, p. 9; §5.6, p. 9","measure":"computation","note":"Unblinding: one division by the blinding factor per item, whose inverse can be computed offline; no online exponentiation","operation":"modmul","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 6, p. 9","measure":"computation","note":"One tag hash per unblinded signature","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2010-DT"],"paper_title":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","paper_url":"https://eprint.iacr.org/2009/491","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"blinded","locator":"Figure 4, step 3, p. 9","phase":"online","what":"the blinded hashes"},{"after":["blinded"],"from":"sender","id":"reply","locator":"Figure 4, steps 4-5, p. 9","phase":"online","what":"the signed blinded values and the precomputed tags"}],"security_mode":"computational","security_model":"honest-but-curious, random oracle model, one-more-RSA (Appendix B.3, p. 16)","security_notion":"server privacy, client privacy, and client unlinkability; no server unlinkability","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"One-way PSI from RSA blind signatures: the server publishes hashes of its RSA signatures on its hashed items, and the client obtains signatures on her own hashed items blindly, unblinds, hashes and compares. The server signs its set offline and the client does no online exponentiation.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2010-DT","year":2010},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-ONE-MORE-GAP-DH-AND-RANDOM-ORACLES","assumption_name":"One-More-Gap-DH and random oracles","attributes":{"adversary":{"locator":"§5.1, p. 6; Appendix B.2, p. 15","note":"Honest-but-curious client and server; malicious proofs left to future work","value":["semi_honest"]},"assumptions":{"locator":"Appendix B.2, pp. 15-16","note":"With one extra DH-oracle query in the reduction","resolved":[{"id":"ASM-OMGDH","name":"One-more gap Diffie-Hellman (One-More-Gap-DH)","short":"One-More-Gap-DH"}],"value":["One-More-Gap-DH"]},"output":{"locator":"§2, p. 2; Figure 3, p. 8","value":["intersection"]},"output_to":{"locator":"§2, p. 2","note":"The client; mutual PSI by two one-way runs","value":"one"},"parties":{"locator":"§2, p. 2","value":"two_party"},"security_model":{"locator":"Appendix B.2, p. 15; Table 2, p. 11","value":["random oracle"]},"set_size_regime":{"locator":"Table 2, p. 11","value":"balanced"},"technique":{"locator":"Figure 3, p. 8","note":"Hashed items raised to the server's secret exponent in a prime-order subgroup; the paper does not say Diffie-Hellman","value":["diffie_hellman"]}},"authors":["Emiliano De Cristofaro","Gene Tsudik"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"step_phase":"online"},"capabilities":["server-unlinkability","server-precomputation"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2010-DT-LINEAR-APSI"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"prime_order_group_exponentiation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (n_Y+1)|\\mathbb{G}| + n_X\\kappa \\)","locator":"Figure 3, step 4, p. 8","measure":"communication","note":"Its key share, the exponentiated blinded values, and one security-parameter-length tag per item","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)|\\mathbb{G}| \\)","locator":"Figure 3, step 2, p. 8","measure":"communication","note":"The blinded product of hashes and one blinded value per item","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+1 \\)","locator":"§5.5, p. 8; Table 2, p. 11","measure":"computation","note":"Precomputing each hashed item to the power of minus its fresh secret, and its key share; short exponents","operation":"exponentiation","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 3, inputs, p. 8; §5.5, p. 8","measure":"computation","note":"Hashing each of its items","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_Y+1 \\)","locator":"Figure 3, step 3, p. 8; Table 2, p. 11","measure":"computation","note":"Each blinded value and the blinded product; the paper states \\( O(n_Y) \\) exponentiations with 160-bit exponents","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 3, step 3, p. 8; §5.5, p. 8","measure":"computation","note":"One multiplication per tag, the exponentiated blinded product times the precomputed item power","operation":"modmul","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 3, step 3, p. 8","measure":"computation","note":"One hash per tag","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y+2 \\)","locator":"Figure 3, steps 1 and 5, p. 8; Table 2, p. 11","measure":"computation","note":"Blinding and unblinding; the paper states \\( O(n_Y) \\) exponentiations with 160-bit exponents","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 5, p. 8","measure":"computation","note":"The product of the hashes, the quotients, blinding and unblinding, each quotient counted as one multiplication by an inverse","operation":"modmul","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 3, inputs and step 5, p. 8","measure":"computation","note":"Hashing each item, then one tag hash per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2010-DT-FIG3","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2010-DT"],"paper_title":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","paper_url":"https://eprint.iacr.org/2009/491","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"blinded","locator":"Figure 3, steps 1-2, p. 8","phase":"online","what":"the blinded product of hashes X and the blinded values y_i"},{"after":["blinded"],"from":"sender","id":"reply","locator":"Figure 3, steps 3-4, p. 8","phase":"online","what":"Z, the exponentiated blinded values and the tags"}],"security_mode":"computational","security_model":"honest-but-curious, random oracle model; the server-privacy reduction to One-More-Gap-DH uses one additional DH-oracle query (Appendix B.2, pp. 15-16)","security_notion":"server privacy, client privacy, client and server unlinkability","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"One-way PSI in a prime-order subgroup: the client blinds a product of her item hashes and each of its complements, the server raises them to a fresh secret and sends hashed tags of its own items under the same secret, and the client unblinds and compares tags. Communication and computation are linear in the set sizes.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2010-DT","year":2010},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"ASM-DDH","assumption_ids":["ASM-DDH","ASM-ROM"],"assumption_name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model","attributes":{"adversary":{"locator":"§2, p. 3; §3, pp. 4-5","note":"Unsafe standalone: set sizes are unrestricted, so an all-ones input reveals the other set","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"}],"value":["DDH"]},"output":{"locator":"§3, p. 4","note":"Computed as the bit-vector of the intersection","value":["intersection"]},"output_to":{"locator":"§2, p. 3","note":"Either party, or both, may learn it, as for all the paper's protocols","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§3, p. 4; §4, p. 5","note":"Cost depends on the size of the universe only","value":"not_applicable"},"technique":{"locator":"§2, p. 4; §3, p. 4","value":["garbled_circuits","ot_extension"]}},"authors":["Yan Huang","David Evans","Jonathan Katz"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §3, p. 4; Table 1, p. 2","params":{"|C|":"\\( 2^{\\sigma} \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( 2^{\\sigma} \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4; §3, p. 4","note":"One per bit of the evaluator's vector, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"gc","func":"gc","implementation":"gc_grr3","label":"Free-XOR garbling with garbled-row reduction (GRR3)","locator":"§2, p. 4; §3, p. 4; Table 1, p. 2","node":"","params":{"|C|":"\\( 2^{\\sigma} \\)"},"phase":"online","roles":{"evaluator":"receiver","garbler":"sender"},"source":"ZRE15"},{"block":"ot","calls":[{"block":"ot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"base_ot","node":""},"source":"NP01"}],"count":"\\( 2^{\\sigma} \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"§2, p. 4; §3, p. 4","node":"","note":"One per bit of the evaluator's vector, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"base_ot","count":"\\( \\lambda \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","node":"","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"phase":"online","step_phase":"online"},"capabilities":["small-universe"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","PSI-CONTRIB-2012-HEK-SIZE-AUDITING"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"gc":{"costs":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa|C| \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4|C| \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( |C| \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"evaluator"}],"counts":[],"variables":[]},"ot":{"costs":[{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"construction_family":"garbled_circuit_bit_vector","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2^{\\sigma}\\kappa \\)","locator":"§2, p. 4; §3, p. 4","measure":"communication","note":"The generator's input labels, one per bit of its vector","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, p. 4; §3, p. 4","measure":"communication","note":"Sends only inside the OT extension","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §3, p. 4","measure":"computation","note":"No cryptographic operation outside garbling and the OTs; the bit-vector is built in the clear","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §3, p. 4","measure":"computation","note":"No cryptographic operation outside evaluating the circuit and the OTs","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OT","the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot","open":[],"phase":"setup","rounds":"\\mathsf{OT}[\\ldots]#base_ot"},{"gloss":["OT","the protocol's own messages"],"messages":"\\mathsf{OT}[\\ldots]#ot + 1","open":[],"phase":"online","rounds":"(\\mathsf{OT}[\\ldots]#ot \\parallel 1)"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa2^{\\sigma} \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4\\cdot 2^{\\sigma} \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 2^{\\sigma} \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2^{\\sigma}\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2\\cdot 2^{\\sigma}\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\cdot 2^{\\sigma} \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\cdot 2^{\\sigma} \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\lambda\\tau \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2012-HEK-BWA","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2012-HEK"],"paper_title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","paper_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §3, p. 4","phase":"online","what":"OT extension for the evaluator's input labels; the garbled AND gates ride with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §3, p. 4","phase":"online","what":"the generator's input labels, one per bit of its vector"}],"security_mode":"computational","security_model":"semi-honest two-party; no proof given (§2, p. 4)","security_notion":"PSI as a bit-vector intersection","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PSI for a small universe by Yao's garbled circuits: each set is a bit-vector over the \\( 2^{\\sigma} \\) possible elements and the circuit ANDs the two vectors bit by bit, so the cost is independent of the set sizes.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2012-HEK","year":2012},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"ASM-DDH","assumption_ids":["ASM-DDH","ASM-ROM"],"assumption_name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model","attributes":{"adversary":{"locator":"§2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"}],"value":["DDH"]},"output":{"locator":"§2, p. 3; Algorithm 1, p. 5","value":["intersection"]},"output_to":{"locator":"Algorithm 1, p. 5; §4, p. 5","note":"Each match is revealed as soon as it is found","value":"all"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§2, p. 4; §4, p. 5","value":["garbled_circuits","ot_extension"]}},"authors":["Yan Huang","David Evans","Jonathan Katz"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"count":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4} \\)","func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §4, p. 5; Algorithm 1, p. 5; Table 1, p. 2","note":"One Equal circuit per comparison; the count is the expected number after shuffling, and at most \\( n^2 \\)","params":{"|C|":"\\( \\sigma-1 \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"gc","count":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4} \\)","func":"gc","implementation":"gc_grr3","label":"Free-XOR garbling with garbled-row reduction (GRR3)","locator":"§2, p. 4; §4, p. 5; Algorithm 1, p. 5; Table 1, p. 2","node":"","note":"One Equal circuit per comparison; the count is the expected number after shuffling, and at most \\( n^2 \\)","params":{"|C|":"\\( \\sigma-1 \\)"},"phase":"online","roles":{"evaluator":"receiver","garbler":"sender"},"source":"ZRE15"},{"block":"ot","calls":[{"block":"ot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"base_ot","node":""},"source":"NP01"}],"count":"\\( \\sigma n \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"§2, p. 4","node":"","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"base_ot","count":"\\( \\lambda \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","node":"","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"phase":"online","step_phase":"online"},"capabilities":["early-reveal"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"gc":{"costs":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa k|C| \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4k|C| \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( k|C| \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"evaluator"}],"counts":[],"variables":[]},"ot":{"costs":[{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"construction_family":"garbled_circuit_pairwise_comparison","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\sigma n\\kappa \\)","locator":"§2, p. 4; §4, p. 5","measure":"communication","note":"The generator's input labels, one per bit of its set, sent once for all comparisons","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4} \\)","locator":"Algorithm 1, p. 5; §4, p. 5","measure":"communication","note":"One bit per comparison: the Equal output it reveals to the generator, which needs it to choose the next pair","phase":"online","statistic":"expected","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Algorithm 1, p. 5; §4, p. 5","measure":"computation","note":"No cryptographic operation outside garbling and the OTs; permuting its set is done in the clear","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Algorithm 1, p. 5; §4, p. 5","measure":"computation","note":"No cryptographic operation outside evaluating the circuits and the OTs","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OT","the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot","open":[],"phase":"setup","rounds":"\\mathsf{OT}[\\ldots]#base_ot"},{"gloss":["OT","the protocol's own messages"],"messages":"\\mathsf{OT}[\\ldots]#ot + 2","open":[],"phase":"online","rounds":"(\\mathsf{OT}[\\ldots]#ot \\parallel 1) + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa\\frac{(2n-\\hat{n})^2+\\hat{n}}{4}(\\sigma - 1) \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4\\frac{(2n-\\hat{n})^2+\\hat{n}}{4}(\\sigma - 1) \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4}(\\sigma - 1) \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( \\sigma n\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2\\sigma n\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\lambda\\tau \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2012-HEK-PWC","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2012-HEK"],"paper_title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","paper_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §4, p. 5","phase":"online","what":"OT extension for the evaluator's input labels; the garbled Equal circuits ride with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §4, p. 5","phase":"online","what":"the generator's input labels, sent once for all comparisons"},{"after":["ot","labels"],"from":"receiver","id":"reveal","locator":"Algorithm 1, lines 6–7, p. 5; §4, p. 5","phase":"online","what":"the revealed Equal output bits, which tell the generator which pairs remain"}],"security_mode":"computational","security_model":"semi-honest two-party; positional leakage of early reveal is removed by random permutation of the inputs (§4, p. 5); no proof given (§2, p. 4)","security_notion":"PSI (intersection revealed, nothing else)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PSI by garbled-circuit equality tests on every pair of elements, each match revealed as soon as it is found so that later comparisons with matched elements are skipped; random permutation of the inputs hides the order of the reveals.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Size of the intersection","symbol":"\\hat{n}"}],"verification_cost":null,"work_id":"PSI-PAPER-2012-HEK","year":2012},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-DECISIONAL-DIFFIE-HELLMAN-FOR-THE-OBLIVIOUS-TRANSFER-IN-THE-RANDOM-ORACLE-MODEL-WITH-AN-UNNAMED-HOMOMORPHIC-ENCRYPTION-SCHEME","assumption_name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model, with an unnamed homomorphic encryption scheme","attributes":{"adversary":{"locator":"§1.1, p. 2; §2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4; §5.3.2, pp. 8-9","note":"Stated provable from DDH for the Naor-Pinkas OT; the shuffle's homomorphic scheme is not named","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"}],"value":["DDH"]},"output":{"locator":"Figure 6, p. 9","value":["intersection"]},"output_to":{"locator":"Figure 6, p. 9","note":"Alice; Bob receives nothing or, if desired, the sorted elements","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§5.3.2, pp. 8-9","value":["garbled_circuits","ot_extension","sorting_network","additively_homomorphic_encryption"]}},"authors":["Yan Huang","David Evans","Jonathan Katz"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §5.3.2, p. 8; Table 1, p. 2","note":"Alice, who inputs the masks, garbles; Bob evaluates and learns the masked outputs, as Yao's evaluator does","params":{"|C|":"\\( s \\)"},"roles":{"evaluator":"sender","garbler":"receiver"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of Bob's set, for his wire labels as evaluator","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"sender","sender":"receiver"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, run the other way, once per pair of parties","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"gc","func":"gc","implementation":"gc_grr3","label":"Free-XOR garbling with garbled-row reduction (GRR3)","locator":"§2, p. 4; §5.3.2, p. 8; Table 1, p. 2","node":"","note":"Alice, who inputs the masks, garbles; Bob evaluates and learns the masked outputs, as Yao's evaluator does","params":{"|C|":"\\( s \\)"},"phase":"online","roles":{"evaluator":"sender","garbler":"receiver"},"source":"ZRE15"},{"block":"ot","calls":[{"block":"ot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"shared":{"block":"base_ot","node":""},"source":"NP01"}],"count":"\\( \\sigma n \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"§2, p. 4","node":"","note":"One per bit of Bob's set, for his wire labels as evaluator","params":{"\\tau":"\\( \\kappa \\)"},"phase":"online","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"PSZ18"},{"block":"base_ot","count":"\\( \\lambda \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","node":"","note":"Base OTs of the OT extension, run the other way, once per pair of parties","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"NP01"}]},"capabilities":["linear-shuffle"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"gc":{"costs":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa|C| \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4|C| \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( |C| \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"evaluator"}],"counts":[],"variables":[]},"ot":{"costs":[{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"construction_family":"garbled_circuit_sort_compare_shuffle","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\gamma_{\\mathrm{pk}} \\)","locator":"Figure 6, Preparation, p. 9","measure":"communication","note":"Alice's public key; her key generation has no unit of the topic","phase":"setup","subject":"receiver"},{"basis":"counted","formula":"\\( n\\gamma \\)","locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"communication","note":"Bob's \\( n \\) permuted ciphertexts","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n\\gamma + (2\\sigma+\\lambda)n\\kappa \\)","locator":"§2, p. 4; §5.3.2, p. 8; Figure 6, step 1, p. 9","measure":"communication","note":"Her \\( n \\) encrypted masks, and as generator one input label per bit of her set and of her \\( (\\sigma+\\lambda) \\)-bit masks","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"computation","note":"One homomorphic subtraction \\( [[r_i']]\\cdot[[r_i]]^{-1} \\) per element, then a random permutation","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 6, p. 9","measure":"computation","note":"Encrypting his \\( n \\) shares under Alice's key","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"computation","note":"Encrypting her \\( n \\) shares, then decrypting the \\( n \\) shuffled ciphertexts","operation":"enc_dec","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages","OT"],"messages":"4","open":[],"phase":"setup","rounds":"3"},{"gloss":["OT","the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages","OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot + 1","open":[],"phase":"setup","rounds":"(1 \\parallel \\mathsf{OT}[\\ldots]#base_ot)"},{"gloss":["OT","the protocol's own messages"],"messages":"\\mathsf{OT}[\\ldots]#ot + 2","open":[],"phase":"online","rounds":"(\\mathsf{OT}[\\ldots]#ot \\parallel 1) + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa s \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"receiver"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4s \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"receiver"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( s \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( \\sigma n\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2\\sigma n\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\lambda\\tau \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2012-HEK"],"paper_title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","paper_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"pk","locator":"Figure 6, Preparation, p. 9","phase":"setup","what":"Alice's public key, reusable across runs"},{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, run the other way, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §5.3.2, p. 8","phase":"online","what":"OT extension for Bob's input labels as evaluator; Alice's garbled circuit rides with its replies"},{"from":"receiver","id":"labels","locator":"§2, p. 4; §5.3.2, p. 8","phase":"online","what":"Alice's input labels as generator, for her set and her masks"},{"from":"receiver","id":"masks","locator":"Figure 6, step 1, p. 9","phase":"online","what":"Alice's encrypted masks","with":"labels"},{"after":["pk","ot","labels","masks"],"from":"sender","id":"shuffle","locator":"Figure 6, steps 2–3, p. 9","phase":"online","what":"Bob's permuted ciphertexts of the masked outputs"}],"security_mode":"computational","security_model":"semi-honest two-party; no proof given (§2, p. 4); statistical masking \\( O(n \\cdot 2^{-\\lambda}) \\) in the secret-sharing step (§5.3.2, p. 8)","security_notion":"PSI (intersection revealed, nothing else)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Sort-compare-shuffle PSI whose final shuffle is homomorphic: the garbled circuit leaves additive shares of the filtered outputs, Alice sends her shares encrypted under her key, and Bob combines them with his, permutes the ciphertexts and returns them for Alice to decrypt.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bits of one ciphertext of the unnamed additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of Alice's public key of the unnamed additively homomorphic scheme","symbol":"\\gamma_{\\mathrm{pk}}"},{"meaning":"Non-free gates of the SCS-HE circuit, \\( 2\\sigma n\\log(2n) + (3n-1)\\sigma - n + (\\sigma+\\lambda)n \\)","symbol":"s"}],"verification_cost":null,"work_id":"PSI-PAPER-2012-HEK","year":2012},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"ASM-DDH","assumption_ids":["ASM-DDH","ASM-ROM"],"assumption_name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model","attributes":{"adversary":{"locator":"§1.1, p. 2; §2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"}],"value":["DDH"]},"output":{"locator":"§2, p. 3; §5.3.1, p. 8","value":["intersection"]},"output_to":{"locator":"§2, p. 3","note":"Either party, or both, may learn it, as for all the paper's protocols","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§5.3.1, p. 8","value":["garbled_circuits","ot_extension","sorting_network"]}},"authors":["Yan Huang","David Evans","Jonathan Katz"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §5.3.1, p. 8; Table 1, p. 2","params":{"|C|":"\\( s \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"gc","func":"gc","implementation":"gc_grr3","label":"Free-XOR garbling with garbled-row reduction (GRR3)","locator":"§2, p. 4; §5.3.1, p. 8; Table 1, p. 2","node":"","params":{"|C|":"\\( s \\)"},"phase":"online","roles":{"evaluator":"receiver","garbler":"sender"},"source":"ZRE15"},{"block":"ot","calls":[{"block":"ot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"base_ot","node":""},"source":"NP01"}],"count":"\\( \\sigma n \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"§2, p. 4","node":"","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"base_ot","count":"\\( \\lambda \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","node":"","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"phase":"online","step_phase":"online"},"capabilities":["quasi-linear-circuit","generic-composition"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"gc":{"costs":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa|C| \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4|C| \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( |C| \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"evaluator"}],"counts":[],"variables":[]},"ot":{"costs":[{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"construction_family":"garbled_circuit_sort_compare_shuffle","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\sigma n\\kappa \\)","locator":"§2, p. 4; §5, p. 6","measure":"communication","note":"The generator's input labels, one per bit of its sorted set","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, p. 4","measure":"communication","note":"Sends only inside the OT extension","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §5, p. 6","measure":"computation","note":"No cryptographic operation outside garbling and the OTs; sorting its own set is done in the clear","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §5, p. 6","measure":"computation","note":"No cryptographic operation outside evaluating the circuit and the OTs; sorting its own set is done in the clear","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OT","the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot","open":[],"phase":"setup","rounds":"\\mathsf{OT}[\\ldots]#base_ot"},{"gloss":["OT","the protocol's own messages"],"messages":"\\mathsf{OT}[\\ldots]#ot + 1","open":[],"phase":"online","rounds":"(\\mathsf{OT}[\\ldots]#ot \\parallel 1)"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa s \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4s \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( s \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( \\sigma n\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2\\sigma n\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\lambda\\tau \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2012-HEK"],"paper_title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","paper_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §5.3.1, p. 8","phase":"online","what":"OT extension for the evaluator's input labels; the garbled circuit rides with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §5, p. 6","phase":"online","what":"the generator's input labels, one per bit of its sorted set"}],"security_mode":"computational","security_model":"semi-honest two-party; Yao's protocol with Naor-Pinkas OT and OT extension; the paper states provability from DDH in the random oracle model without a proof (§2, p. 4)","security_notion":"PSI (intersection revealed, nothing else)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The sort-compare-shuffle variant that hides the positions of the matches by obliviously sorting the filtered outputs with Batcher sorters instead of shuffling them; it can beat shuffling when the intersection is small relative to the sets.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Size of the intersection, assumed known for sizing the sorters","symbol":"\\hat{n}"},{"meaning":"Non-free gates of the SCS-SORT circuit, \\( 2\\sigma n\\log(2n) + (3n-1)\\sigma - n + \\sigma n\\log(2\\hat{n})(\\log(2\\hat{n})+1) \\), with bitonic sorters","symbol":"s"}],"verification_cost":null,"work_id":"PSI-PAPER-2012-HEK","year":2012},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"ASM-DDH","assumption_ids":["ASM-DDH","ASM-ROM"],"assumption_name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model","attributes":{"adversary":{"locator":"§1.1, p. 2; §2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"}],"value":["DDH"]},"output":{"locator":"§2, p. 3; §5.3.3, p. 9","value":["intersection"]},"output_to":{"locator":"§5.3.3, p. 9","note":"The evaluator; it may permute or sort the outputs again and send them back to the generator","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§5, pp. 5-10","value":["garbled_circuits","ot_extension","sorting_network"]}},"authors":["Yan Huang","David Evans","Jonathan Katz"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §5.1, p. 7; §5.2, p. 7; Table 1, p. 2","note":"Merger and filter; the Waksman swappers are unary gates the generator programs, counted in its own figures","params":{"|C|":"\\( s \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"gc","func":"gc","implementation":"gc_grr3","label":"Free-XOR garbling with garbled-row reduction (GRR3)","locator":"§2, p. 4; §5.1, p. 7; §5.2, p. 7; Table 1, p. 2","node":"","note":"Merger and filter; the Waksman swappers are unary gates the generator programs, counted in its own figures","params":{"|C|":"\\( s \\)"},"phase":"online","roles":{"evaluator":"receiver","garbler":"sender"},"source":"ZRE15"},{"block":"ot","calls":[{"block":"ot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"base_ot","node":""},"source":"NP01"}],"count":"\\( \\sigma n \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"§2, p. 4","node":"","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"base_ot","count":"\\( \\lambda \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§2, p. 4; Table 2, p. 13","node":"","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"phase":"online","step_phase":"online"},"capabilities":["quasi-linear-circuit","generic-composition"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"gc":{"costs":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa|C| \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4|C| \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( |C| \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"evaluator"}],"counts":[],"variables":[]},"ot":{"costs":[{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"construction_family":"garbled_circuit_sort_compare_shuffle","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\sigma n\\kappa + \\sigma(n\\log n-n+1)\\kappa \\)","locator":"§2, p. 4; §5.3.3, p. 9","measure":"communication","note":"Its input labels, and one ciphertext per programmed gate of the Waksman swappers, \\( \\sigma \\) gates per swapper","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, p. 4","measure":"communication","note":"Sends only inside the OT extension","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2\\sigma(n\\log n-n+1) \\)","locator":"§5.3.3, p. 9; §2, pp. 3–4","measure":"computation","note":"Garbling each programmed swapper gate: two rows, one encryption call each, one row then dropped by row reduction","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma(n\\log n-n+1) \\)","locator":"§5.3.3, p. 9; §2, p. 4","measure":"computation","note":"One decryption per programmed swapper gate","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OT","the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot","open":[],"phase":"setup","rounds":"\\mathsf{OT}[\\ldots]#base_ot"},{"gloss":["OT","the protocol's own messages"],"messages":"\\mathsf{OT}[\\ldots]#ot + 1","open":[],"phase":"online","rounds":"(\\mathsf{OT}[\\ldots]#ot \\parallel 1)"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 3\\kappa s \\)","locator":"§1.1, pp. 2–3; §3.2, p. 7","measure":"communication","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( 4s \\)","locator":"§1.1, pp. 2–3","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_grr3"],"derived":true,"formula":"\\( s \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( \\sigma n\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 2\\sigma n\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"ot","chain":["iknp"],"derived":true,"formula":"\\( 3\\sigma n \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\lambda\\tau \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\lambda \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2012-HEK"],"paper_title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","paper_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §5.1–5.2, pp. 6–7","phase":"online","what":"OT extension for the evaluator's input labels; the garbled merger and filter ride with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §5.3.3, p. 9","phase":"online","what":"the generator's input labels and its programmed Waksman swapper gates"}],"security_mode":"computational","security_model":"semi-honest two-party; Yao's protocol with Naor-Pinkas OT and OT extension; the paper states provability from DDH in the random oracle model without a proof (§2, p. 4)","security_notion":"PSI (intersection revealed, nothing else)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Sort-compare-shuffle PSI by Yao's garbled circuits: each party sorts its set locally, a bitonic merger sorts the union, DupSelect-3 circuits keep the duplicates, and a Waksman switching network programmed by the generator shuffles the \\( n \\) results before they are revealed, for \\( \\Theta(n\\log n) \\) gates.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Non-free gates of the SCS-WN merger and filter, \\( 2\\sigma n\\log(2n) + (3n-1)\\sigma - n \\); the swapper gates are counted apart","symbol":"s"}],"verification_cost":null,"work_id":"PSI-PAPER-2012-HEK","year":2012},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-HAMMING-CORRELATION-ROBUST-HASH-AND-PSEUDORANDOM-CODE-WITH-IDEAL-BASE-OTS","assumption_name":"Hamming correlation-robust hash and pseudorandom code, with ideal base OTs","attributes":{"adversary":{"locator":"Theorem 6, p. 9; §5.2, p. 11","value":["semi_honest"]},"assumptions":{"locator":"§3.1–3.2, pp. 6–7; Lemma 3, p. 7; Figure 2, p. 10","note":"The pseudorandom code is a PRF (AES); the hash is Hamming correlation robust","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"},{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["PRF","CR hash"]},"output":{"locator":"Figure 3, p. 13","value":["intersection"]},"output_to":{"locator":"Figure 3, step 6, p. 13","note":"Bob learns the intersection and sends it to Alice","value":"all"},"parties":{"locator":"§5.2, p. 11","value":"two_party"},"security_model":{"locator":"Theorem 6, p. 9; Figure 2, p. 10; §5.2, p. 11","note":"BaRK-OPRF is proved with ideal base OTs, a hybrid model; the PSI step is argued informally","value":["standard model"]},"set_size_regime":{"locator":"§5.2, p. 11; Figure 3, p. 13","value":"balanced"},"technique":{"locator":"§5.2, pp. 11–12; Figure 3, p. 13","value":["batched_oprf","ot_extension","cuckoo_hashing"]}},"authors":["Vladimir Kolesnikov","Ranjit Kumaresan","Mike Rosulek","Ni Trieu"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"},{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( k \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OTs extended by IKNP","instantiation":"iknp","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16; Table 4, p. 15","note":"The \\( k \\) column OTs of BaRK-OPRF on \\( \\kappa \\)-bit seeds, run in the offline phase; the matrix that stretches them to the bins is the protocol's","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"base_ot","calls":[{"block":"base_ot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"NP01"}],"count":"\\( k \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16; Table 4, p. 15","node":"","note":"The \\( k \\) column OTs of BaRK-OPRF on \\( \\kappa \\)-bit seeds, run in the offline phase; the matrix that stretches them to the bins is the protocol's","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"PSZ18"}]},"capabilities":["item-length-independent-oprf-cost"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]}},"construction_family":"oprf_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","note":"The key of the pseudorandom code, an AES key","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( (3+s)n(\\lambda+2\\log n) \\)","locator":"Figure 3, step 4, p. 13; §5.2, p. 12; §6.1, p. 16","measure":"communication","note":"Alice's permuted PRF values, \\( v=\\lambda+2\\log n \\) bits each, for every item and hash function or stash position","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( k(1.2n+s)+\\hat{n}\\sigma \\)","locator":"Figure 2, steps 2–3, p. 10; Figure 3, steps 1, 3 and 6, p. 13; §6.3, p. 16","measure":"communication","note":"Bob's matrix, one masked column of \\( 1.2n+s \\) bits per OT, then the intersection; the seeds of the hash functions are not sized","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( k(1.2n+s)/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16","measure":"computation","note":"Its seed of each of the \\( k \\) OTs expanded to a column of \\( 1.2n+s \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( (18+5s)n \\)","locator":"Figure 3, step 4, p. 13; Figure 2, step 4, p. 10; §6.3, p. 16","measure":"computation","note":"Three bin hashes per item, then per PRF value four AES calls for the code and one hash, for three hash functions and \\( s \\) stash positions","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2k(1.2n+s)/\\kappa \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16","measure":"computation","note":"Both seeds of each OT expanded to a column of \\( 1.2n+s \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( 9n+5s \\)","locator":"Figure 3, steps 2–3, p. 13; Figure 2, steps 2 and 5, p. 10; §6.3, p. 16","measure":"computation","note":"Three cuckoo hashes per item, then four AES calls for the code and one output hash per bin and stash position","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages","OT"],"messages":"2","open":[],"phase":"offline","rounds":"2"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages","OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot + 1","open":[],"phase":"offline","rounds":"(1 \\parallel \\mathsf{OT}[\\ldots]#base_ot)"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( k\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","phase":"offline","source":"PSZ18","subject":"sender"},{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( 2k\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","operation":"symmetric_op","phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"base_ot","chain":["iknp"],"derived":true,"formula":"\\( 3k \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","operation":"symmetric_op","phase":"offline","source":"PSZ18","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2016-KKRT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2016-KKRT"],"paper_title":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","paper_url":"https://eprint.iacr.org/2016/799","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"code","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","phase":"offline","what":"Alice's key of the pseudorandom code"},{"blocks":["base_ot"],"id":"base","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","phase":"offline","what":"the \\( k \\) OTs of seeds that BaRK-OPRF extends, by IKNP"},{"from":"receiver","id":"hash","locator":"Figure 3, step 1, p. 13","phase":"online","what":"Bob's cuckoo hash functions"},{"after":["code","base"],"from":"receiver","id":"matrix","locator":"Figure 2, steps 2–3, p. 10; Figure 3, step 3, p. 13; §6.3, p. 16","phase":"online","what":"Bob's OT-extension matrix, one row per bin and stash position","with":"hash"},{"after":["hash","matrix"],"from":"sender","id":"prf","locator":"Figure 3, step 4, p. 13","phase":"online","what":"Alice's permuted PRF values, per hash function and stash position"},{"after":["prf"],"from":"receiver","id":"result","locator":"Figure 3, step 6, p. 13","phase":"online","what":"the intersection, returned to Alice"}],"security_mode":"computational","security_model":"semi-honest two-party; BaRK-OPRF proved with ideal base OTs (Theorem 6, p. 9); PSI security argued in §5.2, p. 11","security_notion":"PSI with output to both parties","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Semi-honest PSI from BaRK-OPRF, an IKNP-style OT extension whose width is a pseudorandom code rather than a repetition code, so one OPRF instance costs one matrix row whatever the item length. Bob cuckoo-hashes his items into 1.2n bins and Alice sends PRF values of hers for each hash function and stash position.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Width of the pseudorandom code and the number of base OTs, \\( O(\\kappa) \\): a random code of width \\( 4\\kappa \\) suffices","symbol":"k"},{"meaning":"Stash size of the cuckoo table","symbol":"s"},{"meaning":"OPRF output length, \\( \\lambda+2\\log n \\) bits","symbol":"v"},{"meaning":"Size of the intersection, which Bob returns to Alice","symbol":"\\hat{n}"}],"verification_cost":null,"work_id":"PSI-PAPER-2016-KKRT","year":2016},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"lattice","assumption_id":"PSI-ASSUMPTION-IND-CPA-LEVELED-FHE-WITH-CIRCUIT-PRIVACY-FV-OVER-RING-LWE","assumption_name":"IND-CPA leveled FHE with circuit privacy (FV over Ring-LWE)","attributes":{"adversary":{"locator":"Theorem 2, p. 11; §5.2, pp. 12–13","note":"Malicious parties are discussed without a proof","value":["semi_honest"]},"assumptions":{"locator":"§2.3, p. 4; Theorem 2, p. 11","note":"Through IND-CPA, circuit-private FV over RLWE rings; the paper names no hardness assumption","resolved":[{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"}],"value":["Ring-LWE"]},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 3, p. 11; Figure 4, p. 12","note":"The receiver learns the intersection; the sender learns nothing","value":"one"},"parties":{"locator":"§2.2, p. 3","value":"two_party"},"security_model":{"locator":"Theorem 2, p. 11; Figure 4, p. 12","note":"Hash functions are sampled fresh for each run; the proof uses no random oracle","value":["standard model"]},"set_size_regime":{"locator":"§2.2, p. 4","note":"Built for a receiver set much smaller than the sender set; it runs unchanged on any sizes","value":"unbalanced"},"technique":{"locator":"§4.1–4.2, pp. 6–9; Figure 2, p. 8","value":["fully_homomorphic_encryption","cuckoo_hashing","simple_hashing","permutation_based_hashing"]}},"authors":["Hao Chen","Kim Laine","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["communication-sublinear-in-larger-set","light-receiver-computation","offline-sender-preprocessing"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"fhe_polynomial_evaluation_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"locator":"Figure 1, step 1, p. 5; §2.3, p. 4; §5.2, p. 11; Table 2, p. 13","measure":"communication","note":"Its public and evaluation keys, which the flooding and the products need; the protocol has no key step and sizes neither","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( (2^{w}-1)\\left(\\left\\lfloor \\log_2(B/\\alpha)/w \\right\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3, p. 10; Figure 4, step 5, p. 12","measure":"communication","note":"Window powers of each batched cuckoo-table plaintext, each an FV ciphertext of two ring elements","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3–4.4, p. 10; Figure 4, step 6, p. 12","measure":"communication","note":"One reply per partition and batch, counted at full width; modulus switching shrinks it","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O(mB^{2}/\\alpha) \\)","locator":"Figure 4, step 4, p. 12; §6.1, p. 14","measure":"computation","note":"Coefficients of each partition's bin polynomial, then batching; fresh hash functions make it per run","operation":"field_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 4, step 1, p. 12; Figure 2, step 1, p. 8; §4.2, p. 8","measure":"computation","note":"Per item: the hash to a shorter string when items are long, then the location hash under each of the three cuckoo hash functions for simple hashing","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}\\left(\\frac{B}{\\alpha}-1\\right) \\)","locator":"§4.3, p. 10; Figure 4, step 6a, p. 12","measure":"computation","note":"One product per power from the square up to the partition size, shared by the partitions","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( 2\\frac{m}{k}(B+\\alpha) \\)","locator":"Figure 4, step 6b, p. 12; §5.2, p. 11","measure":"computation","note":"\\( B/\\alpha+1 \\) plaintext products and \\( B/\\alpha \\) additions per partition and batch, then adding the encryption of zero that floods the reply","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k} \\)","locator":"§5.2, p. 11","measure":"computation","note":"An encryption of zero with large noise per reply, for function privacy in the leveled instantiation","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\left((2^{w}-1)\\left(\\left\\lfloor \\log_2(B/\\alpha)/w \\right\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","locator":"§2.2, p. 4; Figure 4, steps 5 and 7, p. 12","measure":"computation","note":"FV encryptions of the window powers and decryptions of the replies","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 4, step 1, p. 12; Figure 2, step 2, p. 8","measure":"computation","note":"Per item: the hash to a shorter string when items are long, then one location hash per cuckoo hash function; re-insertions, which go unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2017-CLR","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2017-CLR"],"paper_title":"Fast Private Set Intersection from Homomorphic Encryption","paper_url":"https://eprint.iacr.org/2017/299","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"unbalanced PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"keys","locator":"Figure 1, step 1, p. 5; §2.3, p. 4; §5.2, p. 11","phase":"setup","what":"Public key, and evaluation keys where key generation outputs them, for the flooding and the products"},{"from":"receiver","id":"query","locator":"Figure 4, step 5, p. 12","phase":"online","what":"Encrypted window powers of each batched cuckoo-table plaintext"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 4, step 6, p. 12; §5.2, p. 11","phase":"online","what":"One flooded result per partition and batch, optionally modulus-switched"}],"security_mode":"computational","security_model":"semi-honest two-party, simulation-based (Theorem 2, p. 11)","security_notion":"PSI with output to the receiver only (FPSI, Figure 3)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Unbalanced PSI from leveled FV: the receiver sends its cuckoo table batched and encrypted, and the sender homomorphically evaluates, slot by slot, the polynomial whose roots are its items in the matching bin. Windowing, partitioning and modulus switching keep the depth and the reply small, so communication is \\( O(n_Y\\log n_X) \\) and only the sender works in \\( n_X \\).","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo hash table bins, a small constant times \\( n_Y \\) (three hash functions, no stash)","symbol":"m"},{"meaning":"Batching slots per FV plaintext, the ring dimension","symbol":"k"},{"meaning":"Sender bin capacity after simple hashing with three hash functions","symbol":"B"},{"meaning":"Partitions of each sender bin","symbol":"\\alpha"},{"meaning":"Window size in bits (the paper's \\( \\ell \\))","symbol":"w"}],"verification_cost":null,"work_id":"PSI-PAPER-2017-CLR","year":2017},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","assumption_name":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF","attributes":{"adversary":{"locator":"§6.3, p. 17","note":"Argued in prose for each colluding pair; no theorem","value":["semi_honest"]},"assumptions":{"locator":"§6.3, p. 16; §3.1, p. 4; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"},{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["PRF","CR hash"]},"corruptions":{"locator":"§6.3, p. 17; Table 4, p. 18; §7.2, p. 19","note":"Three parties, any two colluding","value":"\\( t_c \\le 2 \\)"},"output":{"locator":"Figure 10, step 4, p. 16","value":["intersection"]},"output_to":{"locator":"Figure 10, step 4, p. 16","note":"The leader announces the intersection it decodes","value":"all"},"parties":{"locator":"§6.3, pp. 16-17","note":"Three parties only; a collusion of the leader with a later party would learn a partial intersection beyond three","value":"multiparty"},"security_model":{"locator":"Figure 6, p. 8; §7.2, p. 18","note":"Evaluated with the table-based OPPRF, which hashes with a random oracle","value":["random oracle"]},"set_size_regime":{"locator":"Figure 10, p. 16","value":"balanced"},"technique":{"locator":"§6.3, p. 16; §4, pp. 9-10","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing"]}},"authors":["Vladimir Kolesnikov","Naor Matania","Benny Pinkas","Mike Rosulek","Ni Trieu"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\kappa \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17","note":"Per party: \\( \\kappa \\) base OTs for the OPRF it keys, which it sends, and for the one it queries; IKNP extends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"party","sender":"party"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( B \\)","func":"oprf","id":"oprf","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 10, steps 2–3, p. 16; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"Per party: three OPPRFs in a ring, P1 to P2 to P3 to P1, one OPRF per cuckoo bin of the receiver; each party keys one and queries one","phase":"online","roles":{"receiver":"party","sender":"party"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"base_ot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§7, p. 17","node":"","note":"Per party: \\( \\kappa \\) base OTs for the OPRF it keys, which it sends, and for the one it queries; IKNP extends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"party","sender":"party"},"source":"NP01"},{"block":"oprf","calls":[{"block":"oprf","calls":[{"block":"oprf","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":"party","sender":"party"},"shared":{"block":"base_ot","node":""},"source":"NP01"}],"count":"\\( w \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":"party","sender":"party"},"source":"PSZ18"}],"count":"\\( B \\)","func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Figure 10, steps 2–3, p. 16; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","node":"","note":"Per party: three OPPRFs in a ring, P1 to P2 to P3 to P1, one OPRF per cuckoo bin of the receiver; each party keys one and queries one","phase":"online","roles":{"receiver":"party","sender":"party"},"source":"KKRT16"}],"phase":"online","step_phase":"online"},"capabilities":["three-opprf-executions"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2017-KMPRT-OPPRF"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"oprf":{"costs":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]}},"construction_family":"opprf_incremental_chain","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( T(\\lambda+\\log n)+B\\kappa+2\\hat{n}\\sigma \\)","locator":"Figure 10, steps 2–4, p. 16; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §7.1, TABLE, p. 17","measure":"communication","note":"Its one hint, a table of \\( (\\lambda+\\log n) \\)-bit entries as in the general protocol and a \\( \\kappa \\)-bit nonce per bin; P1 then announces the intersection","phase":"online","subject":"party","tip":"P1's, which also announces the intersection to the other two; P2 and P3 send only their hint."},{"basis":"counted","formula":"\\( 30n+B+O(n) \\)","locator":"Figure 10, steps 2–3, p. 16; Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; KKRT16 §6.3, p. 16","measure":"computation","note":"Five bin hashes per item; as sender, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search; one hash per bin as receiver","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"party"}],"counts":{"exact":[{"gloss":["OT","OPRF"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["OT","base OT"],"messages":"3","open":[],"phase":"offline","rounds":"3"},{"gloss":["OPRF","the protocol's own messages"],"messages":"5","open":[],"phase":"online","rounds":"5"}],"overview":[{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot","open":[],"phase":"offline","rounds":"\\mathsf{OT}[\\ldots]#base_ot"},{"gloss":["OPRF","the protocol's own messages"],"messages":"\\mathsf{OPRF}[\\ldots]#oprf + 4","open":[],"phase":"online","rounds":"\\mathsf{OPRF}[\\ldots]#oprf + 4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"party"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"offline","source":"NP01","subject":"party"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"party"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"offline","source":"NP01","subject":"party"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"offline","source":"NP01","subject":"party"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"offline","source":"NP01","subject":"party"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"party"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( Bw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","phase":"online","source":"KKRT16","subject":"party"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 3Bw/\\kappa + 5B \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7; Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"party"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w\\kappa \\)","locator":"Protocol 1, step 3, p. 10; Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 6w \\)","locator":"Protocol 1, steps 4 and 6, p. 10; Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"party"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2017-KMPRT"],"paper_title":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","paper_url":"https://eprint.iacr.org/2017/799","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot"],"id":"base","locator":"§7, p. 17; Table 1, p. 3; §7.2, Results, p. 19","phase":"offline","what":"Naor-Pinkas base OTs of the three OPRF pairings, in the paper's offline phase"},{"after":["base"],"blocks":["oprf"],"id":"oprf","locator":"Figure 10, steps 2–3, p. 16; Figure 7, step 3, p. 11","phase":"online","what":"the three OPRF batches of the ring, which need only the sets"},{"after":["oprf"],"from":"party","id":"hint1","locator":"Figure 10, steps 1–2, p. 16; Figure 6, step 5, p. 8","phase":"online","what":"P1's hint to P2, programmed with its random encodings"},{"after":["hint1"],"from":"party","id":"hint2","locator":"Figure 10, step 3, p. 16","phase":"online","what":"P2's hint to P3, programmed with the encodings it decoded"},{"after":["hint2"],"from":"party","id":"hint3","locator":"Figure 10, step 3, p. 16","phase":"online","what":"P3's hint to P1, programmed with the encodings it decoded"},{"after":["hint3"],"from":"party","id":"announce","locator":"Figure 10, step 4, p. 16","phase":"online","what":"the intersection, from P1"}],"security_mode":"computational","security_model":"semi-honest, any two of three parties may collude; argued in prose, no theorem (§6.3, p. 17)","security_notion":"three-party PSI","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Three-party PSI computed incrementally through three OPPRFs in a ring. The leader programs random encodings of its items to the second party, which reprograms what it receives to the third, which reprograms back to the leader; the leader keeps the items whose encodings return.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bins of the receiver's cuckoo table in one multi-query OPPRF, \\( O(n) \\): three primary and two supplementary hash functions, no stash","symbol":"B"},{"meaning":"Table entries in one multi-query OPPRF's hint: \\( 2^{\\lceil\\log(\\beta_1+1)\\rceil} \\) in each of the \\( m_1 \\) primary bins and \\( 2^{\\lceil\\log(\\beta_2+1)\\rceil} \\) in each of the \\( m_2 \\) supplementary ones, \\( \\beta_1, \\beta_2 \\) bounding the sender's items per bin and \\( B = m_1+m_2 \\); 47.04n at n = 2^20 (Table 2)","symbol":"T"},{"meaning":"Size of the intersection, which P1 announces","symbol":"\\hat{n}"}],"verification_cost":null,"work_id":"PSI-PAPER-2017-KMPRT","year":2017},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","assumption_name":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF","attributes":{"adversary":{"locator":"§2.1, p. 4; Theorem 2, p. 14","note":"The simulator may replace the corrupt parties' inputs; a later paper proves the same protocol malicious-secure","value":["augmented_semi_honest"]},"assumptions":{"locator":"Figure 9, p. 14; Theorem 2, p. 14; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"},{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["PRF","CR hash"]},"corruptions":{"locator":"Table 1, p. 3; §6.1, p. 14","note":"The comparison lists all but one party; the zero-sharing argument is written for \\( t_c < \\ell - 1 \\)","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 1, p. 5","value":["intersection"]},"output_to":{"locator":"Figure 8, step 5, p. 12; §6.1, p. 14","note":"The leader announces the intersection it computes","value":"all"},"parties":{"locator":"§6.1, p. 14","value":"multiparty"},"security_model":{"locator":"Figure 6, p. 8; Theorem 2, p. 14","note":"The table-based OPPRF hashes with a random oracle; the proof sketch assumes a secure OPRF, a hybrid rather than a model","value":["random oracle"]},"set_size_regime":{"locator":"§5, p. 10","value":"balanced"},"technique":{"locator":"§6.1, p. 14; §4, pp. 9-10","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","secret_sharing"]}},"authors":["Vladimir Kolesnikov","Naor Matania","Benny Pinkas","Mike Rosulek","Ni Trieu"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"func":"ot","id":"base_ot","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17; Table 1, p. 3","note":"\\( \\kappa \\) base OTs for each client's OPRF with the leader, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"func":"oprf","id":"oprf","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8; §6.1, p. 14; §7, p. 17","note":"One per cuckoo bin of the leader in each client's OPPRF; the leader queries in all, a client keys one","phase":"online","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"base_ot","count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§7, p. 17; Table 1, p. 3","node":"","note":"\\( \\kappa \\) base OTs for each client's OPRF with the leader, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"source":"NP01"},{"block":"oprf","calls":[{"block":"oprf","calls":[{"block":"oprf","count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell - 1)\\kappa \\)"},"func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":"leader","sender":"client"},"shared":{"block":"base_ot","node":""},"source":"NP01"}],"count":{"client":"\\( w \\)","leader":"\\( (\\ell - 1)w \\)"},"func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":"client","sender":"leader"},"source":"PSZ18"}],"count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8; §6.1, p. 14; §7, p. 17","node":"","note":"One per cuckoo bin of the leader in each client's OPPRF; the leader queries in all, a client keys one","phase":"online","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"source":"KKRT16"}]},"capabilities":["symmetric-key-techniques","unconditional-zero-sharing"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","PSI-CONTRIB-2017-KMPRT-OPPRF","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"oprf":{"costs":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]}},"construction_family":"opprf_unconditional_zero_sharing","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\ell-1)\\kappa \\)","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","note":"A PRF seed to every client, once for any number of zero-sharings","phase":"setup","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-1)\\hat{n}\\sigma \\)","locator":"Figure 8, step 5, p. 12; §6.1, p. 14","measure":"communication","note":"The intersection to each client; the paper names no broadcast channel","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-2)\\kappa \\)","locator":"Figure 9, Initialization, p. 14","measure":"communication","note":"PRF seeds to the parties after it","phase":"setup","subject":"client","tip":"The largest client's: party \\( P_i \\) sends a seed to each party after it, \\( \\ell-i \\) in all, so the last sends none."},{"basis":"counted","formula":"\\( T(\\lambda+\\log n)+B\\kappa \\)","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §7.1, TABLE, p. 17","measure":"communication","note":"One hint to the leader, a table of \\( (\\lambda+\\log n) \\)-bit entries and a \\( \\kappa \\)-bit nonce per bin","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(n+B)+3n \\)","locator":"Figure 9, Generate zero-sharing, p. 14; Figure 7, step 1, p. 11; Figure 6, step 6, p. 8; Appendix B, p. 24","measure":"computation","note":"A PRF call per seed for each item's zero-share, three cuckoo hashes per item, and one hash per bin as receiver in each client's OPPRF","operation":"symmetric_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+29)n+O(n) \\)","locator":"Figure 9, Generate zero-sharing, p. 14; Figure 7, step 2, p. 11; Figure 6, steps 2–3, p. 8; KKRT16 §6.3, p. 16","measure":"computation","note":"A PRF call per seed for each item's zero-share, five bin hashes per item, five calls per OPRF value at its \\( 5n \\) bin entries, and the nonce search","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"client"}],"counts":{"exact":[{"gloss":["the protocol's own messages","OT","OPRF"],"messages":"2","open":[],"phase":"setup","rounds":"1"},{"gloss":["OT","base OT"],"messages":"4","open":[],"phase":"offline","rounds":"3"},{"gloss":["OPRF","the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"setup","rounds":"1"},{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot","open":[],"phase":"offline","rounds":"\\mathsf{OT}[\\ldots]#base_ot"},{"gloss":["OPRF","the protocol's own messages"],"messages":"\\mathsf{OPRF}[\\ldots]#oprf + 2","open":[],"phase":"online","rounds":"\\mathsf{OPRF}[\\ldots]#oprf + 2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"client"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"client"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( (\\ell - 1)\\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( 2(\\ell - 1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( (\\ell - 1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot","chain":["np01"],"derived":true,"formula":"\\( (\\ell - 1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"offline","source":"NP01","subject":"leader"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"client"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( Bw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"client"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"client"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"client"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( (\\ell - 1)Bw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","phase":"online","source":"KKRT16","subject":"leader"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2(\\ell - 1)Bw/\\kappa + 5(\\ell - 1)B \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"leader"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2(\\ell - 1)w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"leader"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3(\\ell - 1)w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"leader"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2017-KMPRT","PSI-PAPER-2016-KKRT"],"paper_title":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","paper_url":"https://eprint.iacr.org/2017/799","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":["leader","client"],"id":"seeds","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","phase":"setup","what":"pairwise PRF seeds, each party to the parties after it"},{"blocks":["base_ot"],"id":"base","locator":"§7, p. 17; Table 1, p. 3; §7.2, Results, p. 19","phase":"offline","what":"Naor-Pinkas base OTs of each client's OPRF, in the paper's offline phase"},{"after":["base"],"blocks":["oprf"],"id":"oprf","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11","phase":"online","what":"the OPRFs the leader queries, which need only the sets"},{"after":["seeds","oprf"],"from":"client","id":"rec","locator":"Figure 8, step 4, p. 12; Figure 9, p. 14; Figure 6, step 5, p. 8","phase":"online","what":"each client's hint, programmed with its PRF zero-shares"},{"after":["rec"],"from":"leader","id":"announce","locator":"Figure 8, step 5, p. 12; §6.1, p. 14","phase":"online","what":"the intersection"}],"security_mode":"computational","security_model":"augmented semi-honest (Theorem 2 with proof sketch, pp. 14-15)","security_notion":"multi-party PSI (Figure 1, p. 5)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The KMPRT protocol with the conditional zero-sharing replaced by unconditional zero-sharing from pairwise PRF seeds. Each party programs one OPPRF to the leader with its PRF share of zero per item, so only the reconstruction phase needs interaction.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bins of the receiver's cuckoo table in one multi-query OPPRF, \\( O(n) \\): three primary and two supplementary hash functions, no stash","symbol":"B"},{"meaning":"Table entries in one multi-query OPPRF's hint: \\( 2^{\\lceil\\log(\\beta_1+1)\\rceil} \\) in each of the \\( m_1 \\) primary bins and \\( 2^{\\lceil\\log(\\beta_2+1)\\rceil} \\) in each of the \\( m_2 \\) supplementary ones, \\( \\beta_1, \\beta_2 \\) bounding the sender's items per bin and \\( B = m_1+m_2 \\); 47.04n at n = 2^20 (Table 2)","symbol":"T"},{"meaning":"Size of the intersection, which the leader announces","symbol":"\\hat{n}"}],"verification_cost":null,"work_id":"PSI-PAPER-2017-KMPRT","year":2017},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","assumption_name":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF","attributes":{"adversary":{"locator":"Theorem 1, p. 12","value":["semi_honest"]},"assumptions":{"locator":"Theorem 1, p. 12; §3.1, p. 4; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"},{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["PRF","CR hash"]},"corruptions":{"locator":"Theorem 1, p. 12; §5.3, Generalization, p. 13; Table 1, p. 3","note":"Any number of colluding parties; sharing zero with only \\( t_c + 1 \\) parties tolerates at most \\( t_c \\)","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 1, p. 5","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 5; Figure 8, step 5, p. 12","note":"The leader announces the intersection it computes","value":"all"},"parties":{"locator":"§5, p. 10; Figure 8, p. 12","value":"multiparty"},"security_model":{"locator":"Figure 6, p. 8; §7.2, p. 18","note":"The table-based OPPRF hashes with a random oracle; the ideal-OPPRF hybrid of the proof is not a model","value":["random oracle"]},"set_size_regime":{"locator":"§5, p. 10","value":"balanced"},"technique":{"locator":"§4, pp. 9-10; §5, pp. 10-13","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","secret_sharing"]}},"authors":["Vladimir Kolesnikov","Naor Matania","Benny Pinkas","Mike Rosulek","Ni Trieu"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\min(t_c+1,\\ell-1)\\kappa \\)","func":"ot","id":"base_ot_share","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17; Table 1, p. 3; §5.3, Generalization, p. 13","note":"Per party: \\( \\kappa \\) base OTs for each sharing OPRF it keys or queries, which IKNP extends; the OPRF's sender sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"sessions":"\\( \\min(t_c+1,\\ell-1) \\)"},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"func":"ot","id":"base_ot_rec","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17; Table 1, p. 3","note":"\\( \\kappa \\) base OTs for each client's reconstruction OPRF, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( \\min(t_c+1,\\ell-1)B \\)","func":"oprf","id":"oprf_share","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 8, step 2, p. 12; §5.3, Generalization, p. 13; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"Per party: one OPRF per cuckoo bin of the receiver in each sharing OPPRF; each party keys \\( \\min(t_c+1,\\ell-1) \\) and queries as many","phase":"online","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"sessions":"\\( \\min(t_c+1,\\ell-1) \\)"},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"func":"oprf","id":"oprf_rec","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"One per cuckoo bin of the leader in each client's reconstruction OPPRF; the leader queries in all, a client keys one","phase":"online","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"base_ot_share","count":"\\( \\min(t_c+1,\\ell-1)\\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§7, p. 17; Table 1, p. 3; §5.3, Generalization, p. 13","node":"","note":"Per party: \\( \\kappa \\) base OTs for each sharing OPRF it keys or queries, which IKNP extends; the OPRF's sender sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"sessions":"\\( \\min(t_c+1,\\ell-1) \\)","source":"NP01"},{"block":"base_ot_rec","count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§7, p. 17; Table 1, p. 3","node":"","note":"\\( \\kappa \\) base OTs for each client's reconstruction OPRF, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"source":"NP01"},{"block":"oprf_share","calls":[{"block":"oprf_share","calls":[{"block":"oprf_share","count":"\\( \\min(t_c+1,\\ell-1)\\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"shared":{"block":"base_ot_share","node":""},"source":"NP01"}],"count":"\\( \\min(t_c+1,\\ell-1)w \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"source":"PSZ18"}],"count":"\\( \\min(t_c+1,\\ell-1)B \\)","func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Figure 8, step 2, p. 12; §5.3, Generalization, p. 13; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","node":"","note":"Per party: one OPRF per cuckoo bin of the receiver in each sharing OPPRF; each party keys \\( \\min(t_c+1,\\ell-1) \\) and queries as many","phase":"online","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"sessions":"\\( \\min(t_c+1,\\ell-1) \\)","source":"KKRT16"},{"block":"oprf_rec","calls":[{"block":"oprf_rec","calls":[{"block":"oprf_rec","count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell - 1)\\kappa \\)"},"func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":"leader","sender":"client"},"shared":{"block":"base_ot_rec","node":""},"source":"NP01"}],"count":{"client":"\\( w \\)","leader":"\\( (\\ell - 1)w \\)"},"func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"offline","roles":{"receiver":"client","sender":"leader"},"source":"PSZ18"}],"count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","node":"","note":"One per cuckoo bin of the leader in each client's reconstruction OPPRF; the leader queries in all, a client keys one","phase":"online","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"source":"KKRT16"}],"phase":"online","step_phase":"online"},"capabilities":["symmetric-key-techniques","no-honest-majority","corruption-threshold-parameter"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","PSI-CONTRIB-2017-KMPRT-OPPRF","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"client_storage":null,"communication":null,"complexity":{"base_ot_rec":{"costs":[{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"base_ot_share":{"costs":[{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","source":"NP01","subject":"sender"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( k|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","source":"NP01","subject":"receiver"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"sender"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","source":"NP01","subject":"sender"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","source":"NP01","subject":"sender"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"sender"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","source":"NP01","subject":"receiver"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","source":"NP01","subject":"receiver"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( k \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[]},"oprf_rec":{"costs":[{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_rec","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]},"oprf_share":{"costs":[{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_share","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]}},"construction_family":"opprf_conditional_zero_sharing","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\min(t_c+1,\\ell-1)(T(\\lambda+\\log n)+B\\kappa)+(\\ell-1)\\hat{n}\\sigma \\)","locator":"Figure 8, steps 2 and 5, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §5.3, Generalization, p. 13; §7.1, TABLE, p. 17","measure":"communication","note":"A hint to each party it deals to, a table of \\( (\\lambda+\\log n) \\)-bit entries and a \\( \\kappa \\)-bit nonce per bin; then the intersection to each other party","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\min(t_c+1,\\ell-1)+1)(T(\\lambda+\\log n)+B\\kappa) \\)","locator":"Figure 8, steps 2 and 4, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §5.3, Generalization, p. 13; §7.1, TABLE, p. 17","measure":"communication","note":"A sharing hint to each party it deals to and a reconstruction hint to the leader, each a table of \\( (\\lambda+\\log n) \\)-bit entries and a nonce per bin","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 5n+\\min(t_c+1,\\ell-1)(25n+B)+(\\ell-1)B+O(\\min(t_c+1,\\ell-1)n) \\)","locator":"Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; Figure 8, steps 2 and 4, p. 12; §5.3, p. 13; KKRT16 §6.3, p. 16","measure":"computation","note":"Five bin hashes per item; as a sharing sender, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search; one hash per bin as receiver","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"leader"},{"basis":"counted","formula":"\\( 30n+\\min(t_c+1,\\ell-1)(25n+B)+O(\\min(t_c+1,\\ell-1)n) \\)","locator":"Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; Figure 8, steps 2 and 4, p. 12; §5.3, p. 13; KKRT16 §6.3, p. 16","measure":"computation","note":"Five bin hashes per item; as sender in its sharing OPPRFs and the one to the leader, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"client"}],"counts":{"exact":[{"gloss":["OT","OPRF"],"messages":"2","open":[],"phase":"setup","rounds":"1"},{"gloss":["OT","base OT"],"messages":"6","open":[],"phase":"offline","rounds":"3"},{"gloss":["OPRF","the protocol's own messages"],"messages":"6","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#base_ot_share + \\mathsf{OT}[\\ldots]#base_ot_rec","open":[],"phase":"offline","rounds":"(\\mathsf{OT}[\\ldots]#base_ot_share \\parallel \\mathsf{OT}[\\ldots]#base_ot_rec)"},{"gloss":["OPRF","the protocol's own messages"],"messages":"\\mathsf{OPRF}[\\ldots]#oprf_share + \\mathsf{OPRF}[\\ldots]#oprf_rec + 4","open":[],"phase":"online","rounds":"(\\mathsf{OPRF}[\\ldots]#oprf_share \\parallel \\mathsf{OPRF}[\\ldots]#oprf_rec) + 3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1)|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"leader"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1)|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"client"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1)\\kappa^{2} + \\min(t_c+1,\\ell-1)\\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1)\\kappa^{2} + \\min(t_c+1,\\ell-1)\\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1) \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"leader"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1) \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"client"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 2\\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot_share","chain":["np01"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization","measure":"communication","phase":"setup","source":"NP01","subject":"client"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead","measure":"computation","operation":"exponentiation","phase":"setup","source":"NP01","subject":"client"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"exponentiation","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"modmul","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","operation":"symmetric_op","phase":"offline","source":"NP01","subject":"client"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( (\\ell - 1)\\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( 2(\\ell - 1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"exponentiation","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( (\\ell - 1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"modmul","phase":"offline","source":"NP01","subject":"leader"},{"block":"base_ot_rec","chain":["np01"],"derived":true,"formula":"\\( (\\ell - 1)\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","operation":"symmetric_op","phase":"offline","source":"NP01","subject":"leader"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( \\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"leader"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( \\min(t_c+1,\\ell-1)\\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"client"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( \\min(t_c+1,\\ell-1)Bw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","phase":"online","source":"KKRT16","subject":"leader"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( \\min(t_c+1,\\ell-1)Bw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","phase":"online","source":"KKRT16","subject":"client"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)Bw/\\kappa + 5\\min(t_c+1,\\ell-1)B \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7; Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"leader"},{"block":"oprf_share","chain":["kkrt16"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)Bw/\\kappa + 5\\min(t_c+1,\\ell-1)B \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7; Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"client"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)w\\kappa \\)","locator":"Protocol 1, step 3, p. 10; Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"leader"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3\\min(t_c+1,\\ell-1)w\\kappa \\)","locator":"Protocol 1, step 3, p. 10; Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"client"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 6\\min(t_c+1,\\ell-1)w \\)","locator":"Protocol 1, steps 4 and 6, p. 10; Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"leader"},{"block":"oprf_share","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 6\\min(t_c+1,\\ell-1)w \\)","locator":"Protocol 1, steps 4 and 6, p. 10; Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"client"},{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"client"},{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( Bw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"client"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"client"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"client"},{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( (\\ell - 1)Bw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","phase":"online","source":"KKRT16","subject":"leader"},{"block":"oprf_rec","chain":["kkrt16"],"derived":true,"formula":"\\( 2(\\ell - 1)Bw/\\kappa + 5(\\ell - 1)B \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"leader"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2(\\ell - 1)w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"leader"},{"block":"oprf_rec","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3(\\ell - 1)w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"offline","source":"PSZ18","subject":"leader"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2017-KMPRT-SH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2017-KMPRT","PSI-PAPER-2016-KKRT"],"paper_title":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","paper_url":"https://eprint.iacr.org/2017/799","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot_share","base_ot_rec"],"id":"base","locator":"§7, p. 17; Table 1, p. 3; §7.2, Results, p. 19","phase":"offline","what":"Naor-Pinkas base OTs of every OPRF pairing, in the paper's offline phase"},{"after":["base"],"blocks":["oprf_share","oprf_rec"],"id":"oprf","locator":"Figure 8, steps 2 and 4, p. 12; Figure 7, step 3, p. 11; §5.3, p. 13","phase":"online","what":"both OPRF batches, which need only the sets"},{"after":["oprf"],"from":["leader","client"],"id":"share","locator":"Figure 8, step 2, p. 12; Figure 6, step 5, p. 8","phase":"online","what":"sharing hints, each dealer's tables programmed with its zero-shares"},{"after":["share"],"from":"client","id":"rec","locator":"Figure 8, steps 3–4, p. 12; Figure 6, step 5, p. 8","phase":"online","what":"reconstruction hints to the leader, programmed with each client's combined share"},{"after":["rec"],"from":"leader","id":"announce","locator":"Figure 8, step 5, p. 12","phase":"online","what":"the intersection"}],"security_mode":"computational","security_model":"semi-honest, any number of colluding parties, ideal OPPRF functionality (Theorem 1, p. 12)","security_notion":"multi-party PSI (Figure 1, p. 5)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Multiparty PSI from oblivious programmable PRFs. The parties first deal each other shares of zero conditioned on holding an item, through pairwise OPPRFs; each then programs an OPPRF to the leader with its share, and the leader keeps the items whose received values sum to its own share.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bins of the receiver's cuckoo table in one multi-query OPPRF, \\( O(n) \\): three primary and two supplementary hash functions, no stash","symbol":"B"},{"meaning":"Table entries in one multi-query OPPRF's hint: \\( 2^{\\lceil\\log(\\beta_1+1)\\rceil} \\) in each of the \\( m_1 \\) primary bins and \\( 2^{\\lceil\\log(\\beta_2+1)\\rceil} \\) in each of the \\( m_2 \\) supplementary ones, \\( \\beta_1, \\beta_2 \\) bounding the sender's items per bin and \\( B = m_1+m_2 \\); 47.04n at n = 2^20 (Table 2)","symbol":"T"},{"meaning":"Size of the intersection, which the leader announces","symbol":"\\hat{n}"}],"verification_cost":null,"work_id":"PSI-PAPER-2017-KMPRT","year":2017},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","assumption_name":"Orrù-Orsini-Scholl OT extension in the programmable random oracle model","attributes":{"adversary":{"locator":"Theorem 2, p. 13; §6.3, p. 15","note":"A corrupt party may use up to \\( m\\mu \\) items, fewer than \\( 4n \\) in the evaluated range","value":["malicious"]},"assumptions":{"locator":"§4, p. 6; §7, p. 18","note":"No hardness assumption is named; the encodings use OOS OT extension, proved with a programmable random oracle","value":"not_reported"},"output":{"locator":"Figure 4, p. 12","value":["intersection"]},"output_to":{"locator":"Figure 4, p. 12; §6.7, pp. 17–18","note":"Bob only; output to both parties is not supported","value":"one"},"parties":{"locator":"Figure 4, p. 12","value":"two_party"},"security_model":{"locator":"Theorem 2, p. 13; §4, p. 6","note":"UC in the F_encode-hybrid model, a hybrid model; OOS realizes F_encode with a programmable random oracle","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 4, p. 12","value":"balanced"},"technique":{"locator":"§6.1–6.2, pp. 10–12; Figure 4, p. 12","value":["dual_execution","ot_extension","simple_hashing","permutation_based_hashing"]}},"authors":["Peter Rindal","Mike Rosulek"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"count":"\\( m\\mu \\)","func":"encode","id":"encode","implementation":"OOS16 1-out-of-N OT, BCH-(511, 76, 171) code","instantiation":"oos17_encode","locator":"Figure 4, step 3, p. 12; Theorem 2, p. 13; §7, p. 18","note":"One OOS run per direction, one instance per bin position: each party receives in one run and sends in the other","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]}},{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 4, step 1, p. 12","note":"Agrees on the hash function of the bins"}],"bootstrapping":null,"call_tree":{"calls":[{"block":"encode","calls":[{"block":"encode","count":"\\( n_C \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Fig. 2, Init, p. 8","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"NP01"}],"count":"\\( m\\mu \\)","func":"encode","implementation":"oos17_encode","label":"OOS 1-out-of-N random OT as oblivious encoding","locator":"Figure 4, step 3, p. 12; Theorem 2, p. 13; §7, p. 18","node":"","note":"One OOS run per direction, one instance per bin position: each party receives in one run and sends in the other","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"OOS17"},{"block":"coin","func":"coin_toss","locator":"Figure 4, step 1, p. 12","node":"","note":"Agrees on the hash function of the bins","open":true,"phase":"online"}],"phase":"online","step_phase":"online"},"capabilities":["symmetric-key-only","parallelizable"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION"],"client_storage":null,"communication":null,"complexity":{"encode":{"costs":[{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(k + \\lambda) + \\lambda(n_C + in) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( \\lambda k \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( 2n_C(k + \\lambda)/\\kappa + k \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(k + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[{"meaning":"Length of the code, of dimension at least in (511 for RR17's BCH-(511, 76, 171) code)","symbol":"n_C"}]}},"construction_family":"dual_execution_oblivious_encoding","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n\\mu(\\lambda+2\\log(n\\mu)) \\)","locator":"Figure 4, step 4a, p. 12; §6.2, p. 12","measure":"communication","note":"Alice's common encodings, \\( \\mu \\) per item, each as long as an encoding","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 4, p. 12","measure":"communication","note":"Bob sends only the flows of the encodings and the coin toss","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n(\\mu+1) \\)","locator":"Figure 4, steps 2a and 4a, p. 12; §6.1, p. 11; §4, p. 6","measure":"computation","note":"One phasing hash per item, then one output hash per sender encoding, \\( \\mu \\) per item","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n(\\mu+1) \\)","locator":"Figure 4, steps 2b and 4b, p. 12; §6.1, p. 11; §4, p. 6","measure":"computation","note":"One phasing hash per item, then one output hash per sender encoding, \\( \\mu \\) per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"6","open":[],"phase":"setup","rounds":"3"},{"gloss":["coin tossing","Encode","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 7","open":[],"phase":"online","rounds":"\\mathsf{coin tossing}[\\ldots]#coin + 4"}],"overview":[{"gloss":["coin tossing","Encode","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + \\mathsf{Encode}[\\ldots]#encode + 1","open":[],"phase":"online","rounds":"\\mathsf{coin tossing}[\\ldots]#coin + \\mathsf{Encode}[\\ldots]#encode + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(m\\mu + \\lambda) + \\lambda(n_C + \\sigma - \\log n) + \\lambda m\\mu \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8; Fig. 2, Extend step 4, p. 8","measure":"communication","phase":"online","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(m\\mu + \\lambda) + \\lambda(n_C + \\sigma - \\log n) + \\lambda m\\mu \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8; Fig. 2, Extend step 4, p. 8","measure":"communication","phase":"online","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( 3n_C(m\\mu + \\lambda)/\\kappa + m\\mu \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","phase":"online","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( 3n_C(m\\mu + \\lambda)/\\kappa + m\\mu \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","phase":"online","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa + n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa + n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 3n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 3n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 3n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 3n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2017-RR-CCS"],"paper_title":"Malicious-Secure Private Set Intersection via Dual Execution","paper_url":"https://eprint.iacr.org/2017/769","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 4, step 1, p. 12","phase":"online","what":"coin tossing for the hash function of the bins"},{"after":["coin"],"blocks":["encode"],"id":"encode","locator":"Figure 4, steps 2–3, p. 12","phase":"online","what":"oblivious encodings both ways, one per bin position, on the phased items"},{"after":["encode"],"from":"sender","id":"common","locator":"Figure 4, step 4a, p. 12","phase":"online","what":"Alice's common encodings"}],"security_mode":"computational","security_model":"malicious, UC, F_encode-hybrid; F_encode in the programmable random oracle model (Theorem 2, p. 13; §4, p. 6)","security_notion":"PSI with output to Bob; corrupt party's set bounded by \\( m\\mu \\) for \\( m \\) bins of \\( \\mu \\) items","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Malicious PSI that applies dual execution to the PSZ paradigm: each bin position runs an oblivious encoding in each direction, and Alice sends the XOR of both encodings for her items, aggregated across bins. Simple hashing with phasing replaces cuckoo hashing, whose placement a malicious party could exploit.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of bins, \\( O(n/\\log n) \\): \\( n/4 \\) on a LAN and \\( n/10 \\) on a WAN","symbol":"m"},{"meaning":"Bin size, \\( O(\\log n) \\): the most items a bin holds except with probability \\( 2^{-\\lambda} \\)","symbol":"\\mu"}],"verification_cost":null,"work_id":"PSI-PAPER-2017-RR-CCS","year":2017},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLE-COMMITMENT-H-X-R-AND-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","assumption_name":"random-oracle commitment \\( H(x \\| r) \\) and Orrù-Orsini-Scholl OT extension in the programmable random oracle model","attributes":{"adversary":{"locator":"Theorem 3, p. 16; §6.5, p. 17","note":"Alice is held to exactly \\( n \\) items; a corrupt Bob may use up to \\( m\\mu \\)","value":["malicious"]},"assumptions":{"locator":"§6.4, p. 16; Figure 9, p. 27; Appendix A, p. 26","note":"Tags and decommitment keys come from a PRF; commitments and the encodings rest on random oracles","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"output":{"locator":"Figure 9, p. 27","value":["intersection"]},"output_to":{"locator":"Figure 9, step 4, p. 27","note":"Bob only","value":"one"},"parties":{"locator":"Figure 9, p. 27","value":"two_party"},"security_model":{"locator":"Theorem 3, p. 16; Appendix A, p. 26; §4, p. 6","note":"UC in the F_encode-hybrid model; the commitment needs only a non-programmable oracle, OOS a programmable one","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 9, p. 27","value":"balanced"},"technique":{"locator":"§6.4, pp. 15–16; Figure 9, p. 27","value":["encode_commit","ot_extension","simple_hashing","permutation_based_hashing"]}},"authors":["Peter Rindal","Mike Rosulek"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"count":"\\( m\\mu \\)","func":"encode","id":"encode","implementation":"OOS16 1-out-of-N OT, BCH-(511, 76, 171) code","instantiation":"oos17_encode","locator":"Figure 9, step 3, p. 27; Theorem 3, p. 16; §7, p. 18","note":"One instance per bin position, Bob receiving","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 9, step 1, p. 27","note":"Agrees on the hash function and the commitment parameters"}],"bootstrapping":null,"call_tree":{"calls":[{"block":"encode","calls":[{"block":"encode","count":"\\( n_C \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Fig. 2, Init, p. 8","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( m\\mu \\)","func":"encode","implementation":"oos17_encode","label":"OOS 1-out-of-N random OT as oblivious encoding","locator":"Figure 9, step 3, p. 27; Theorem 3, p. 16; §7, p. 18","node":"","note":"One instance per bin position, Bob receiving","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"OOS17"},{"block":"coin","func":"coin_toss","locator":"Figure 9, step 1, p. 27","node":"","note":"Agrees on the hash function and the commitment parameters","open":true,"phase":"online"}],"phase":"online","step_phase":"online"},"capabilities":["symmetric-key-only","exact-sender-set-size"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT"],"client_storage":null,"communication":null,"complexity":{"encode":{"costs":[{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(k + \\lambda) + \\lambda(n_C + in) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( \\lambda k \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( 2n_C(k + \\lambda)/\\kappa + k \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(k + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[{"meaning":"Length of the code, of dimension at least in (511 for RR17's BCH-(511, 76, 171) code)","symbol":"n_C"}]}},"construction_family":"commitment_oblivious_encoding","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n(C+\\mu(T+D)) \\)","locator":"Figure 9, step 4, p. 27; §6.4, p. 16","measure":"communication","note":"Per item a commitment and \\( \\mu \\) tags, each with the decommitment masked by an encoding","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 9, p. 27","measure":"communication","note":"Bob sends only the flows of the encodings and the coin toss","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n(3\\mu+2) \\)","locator":"Figure 9, steps 2a and 4, p. 27; §4, p. 6","measure":"computation","note":"Per item a phasing hash and a commitment; per sender encoding its output hash and the tag and mask PRF calls","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n+2m\\mu+M \\)","locator":"Figure 9, steps 2b, 3 and 4, p. 27; §6.4, p. 16","measure":"computation","note":"A phasing hash per item, the tag and mask PRF calls at every bin position, and one trial decommitment per tag match","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["coin tossing","Encode","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 4","open":[],"phase":"online","rounds":"\\mathsf{coin tossing}[\\ldots]#coin + 4"}],"overview":[{"gloss":["coin tossing","Encode","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + \\mathsf{Encode}[\\ldots]#encode + 1","open":[],"phase":"online","rounds":"\\mathsf{coin tossing}[\\ldots]#coin + \\mathsf{Encode}[\\ldots]#encode + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(m\\mu + \\lambda) + \\lambda(n_C + \\sigma - \\log n) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","phase":"online","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( \\lambda m\\mu \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","phase":"online","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( 2n_C(m\\mu + \\lambda)/\\kappa + m\\mu \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","phase":"online","source":"OOS17","subject":"receiver"},{"block":"encode","chain":["oos17_encode"],"derived":true,"formula":"\\( n_C(m\\mu + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","phase":"online","source":"OOS17","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"encode","chain":["oos17_encode","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2017-RR-CCS"],"paper_title":"Malicious-Secure Private Set Intersection via Dual Execution","paper_url":"https://eprint.iacr.org/2017/769","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 9, step 1, p. 27","phase":"online","what":"coin tossing for the hash function and the commitment parameters"},{"after":["coin"],"blocks":["encode"],"id":"encode","locator":"Figure 9, steps 2–3, p. 27","phase":"online","what":"Bob's oblivious encodings, one per bin position, on the phased items"},{"after":["encode"],"from":"sender","id":"commit","locator":"Figure 9, step 4, p. 27","phase":"online","what":"Alice's commitments with their tagged, masked decommitments"}],"security_mode":"computational","security_model":"malicious, UC, F_encode-hybrid with an extractable hiding commitment, random oracle model (Theorem 3, p. 16; Appendix A, p. 26)","security_notion":"PSI with output to Bob; Alice restricted to exactly \\( n \\) items","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Malicious PSI in which Bob obliviously encodes his binned items and Alice commits to each of her items, sending decommitments masked under PRFs of her encodings with tags that let Bob find which to open. Commitments are H(x‖r) in the random oracle model.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of bins, \\( O(n/\\log n) \\): \\( n/4 \\) on a LAN and \\( n/10 \\) on a WAN","symbol":"m"},{"meaning":"Bin size, \\( O(\\log n) \\): the most items a bin holds except with probability \\( 2^{-\\lambda} \\)","symbol":"\\mu"},{"meaning":"Bits of a commitment \\( H(x \\| r) \\); the paper puts it at about \\( 2\\kappa \\)","symbol":"C"},{"meaning":"Bits of a decommitment \\( r \\), and of each mask over it; the paper puts it at about \\( \\kappa \\)","symbol":"D"},{"meaning":"Bits of a tag; the protocol fixes none, and the paper's asymptotic count takes about \\( \\log n \\)","symbol":"T"},{"meaning":"Tag matches Bob opens with a trial decommitment: one per intersecting item, plus false matches","symbol":"M"}],"verification_cost":null,"work_id":"PSI-PAPER-2017-RR-CCS","year":2017},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-PRF-CORRELATION-ROBUST-HASH-AND-ACTIVELY-SECURE-OT-EXTENSION-WITHOUT-RANDOM-ORACLES","assumption_name":"PRF, correlation-robust hash, and actively secure OT extension, without random oracles","attributes":{"adversary":{"locator":"Theorem 2, p. 13; §6.3, p. 15","note":"A corrupt party may use up to \\( m\\mu \\) items","value":["malicious"]},"assumptions":{"locator":"§4, pp. 6–7; Figure 6, p. 19; §7, p. 18","note":"Also actively secure OT extension","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"},{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["PRF","CR hash"]},"output":{"locator":"Figure 4, p. 12","value":["intersection"]},"output_to":{"locator":"Figure 4, p. 12; §6.7, pp. 17–18","note":"Bob only","value":"one"},"parties":{"locator":"Figure 4, p. 12","value":"two_party"},"security_model":{"locator":"Theorem 2, p. 13; §4, pp. 6–7","note":"UC in the F_encode-hybrid model, a hybrid model; encodings from chosen-message OTs and a PRF","value":["standard model"]},"set_size_regime":{"locator":"Figure 4, p. 12","value":"balanced"},"technique":{"locator":"§6.1–6.2, pp. 10–12; Figure 4, p. 12","value":["dual_execution","ot_extension","simple_hashing","permutation_based_hashing"]}},"authors":["Peter Rindal","Mike Rosulek"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"count":"\\( m\\mu(\\sigma-\\log n) \\)","func":"ot","id":"ot","implementation":"KOS15 chosen-message 1-out-of-2 OT extension","instantiation":"kos15","locator":"§4, pp. 6–7; Figure 4, step 3, p. 12; §7, p. 18; Figure 8, p. 20","note":"Per direction, \\( \\sigma-\\log n \\) OTs of \\( \\kappa \\)-bit strings per encoding, run offline on random choices; each party receives one way and sends the other","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]}},{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 4, step 1, p. 12","note":"Agrees on the hash function of the bins"}],"bootstrapping":null,"call_tree":{"calls":[{"block":"ot","calls":[{"block":"ot","calls":[{"block":"ot","func":"zk","implementation":"schnorr_fs","label":"Schnorr proof of knowledge of a discrete log, made non-interactive by Fiat–Shamir","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","node":"0/0","note":"Proof of knowledge of the discrete log of the public key B, the paper's \\( \\mathcal{F}_{\\mathsf{ZK}}^{\\mathsf{RDL}} \\); costed as Schnorr with Fiat–Shamir, sent with B","part":"ZK (discrete log of B)","phase":"setup","roles":{"prover":["sender","receiver"],"verifier":["sender","receiver"]},"source":"DKLs18"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"0","note":"KOS15 ran PVW08 base OTs (§4, p. 14); the PSI rows that use KOS pair it with VSOT (KRSSW19 §5.1)","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"DKLs18"},{"block":"ot","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( m\\mu(\\sigma - \\log n) + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver","sender","receiver"]},"source":"KOS15"}],"count":"\\( m\\mu(\\sigma-\\log n) \\)","func":"ot","implementation":"kos15","label":"KOS OT extension (chosen-message, malicious)","locator":"§4, pp. 6–7; Figure 4, step 3, p. 12; §7, p. 18; Figure 8, p. 20","node":"","note":"Per direction, \\( \\sigma-\\log n \\) OTs of \\( \\kappa \\)-bit strings per encoding, run offline on random choices; each party receives one way and sends the other","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"KOS15"},{"block":"coin","func":"coin_toss","locator":"Figure 4, step 1, p. 12","node":"","note":"Agrees on the hash function of the bins","open":true,"phase":"online"}],"phase":"online","step_phase":"online"},"capabilities":["no-random-oracle"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION"],"client_storage":null,"communication":null,"complexity":{"ot":{"costs":[{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( \\kappa(k + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( 2k\\tau \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( k + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( 3k + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( 3k + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"5","open":[],"phase":"setup","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"7","open":[],"phase":"online","rounds":"5"}],"variables":[]}},"construction_family":"dual_execution_oblivious_encoding","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n\\mu(\\lambda+2\\log(n\\mu))+m\\mu(\\sigma-\\log n) \\)","locator":"Figure 4, steps 3–4, p. 12; §6.2, p. 12; Figure 8, p. 20","measure":"communication","note":"Alice's common encodings, and one bit per OT she receives to flip a choice made at random offline","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( m\\mu(\\sigma-\\log n) \\)","locator":"Figure 4, step 3, p. 12; Figure 8, p. 20; §7.1, p. 21","measure":"communication","note":"One bit per OT he receives, flipping a choice made at random offline","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n+\\mu(n+m)(\\sigma-\\log n) \\)","locator":"Figure 4, steps 2a, 3a and 4a, p. 12; §4, pp. 6–7","measure":"computation","note":"A phasing hash per item; one PRF call per input bit for its receiver encoding at every bin position and for each of its sender encodings","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n+\\mu(n+m)(\\sigma-\\log n) \\)","locator":"Figure 4, steps 2b, 3b and 4b, p. 12; §4, pp. 6–7","measure":"computation","note":"As Alice's: Bob's encodings mirror hers","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"10","open":[],"phase":"setup","rounds":"5"},{"gloss":["OT"],"messages":"10","open":[],"phase":"offline","rounds":"5"},{"gloss":["coin tossing","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 3","open":[],"phase":"online","rounds":"\\mathsf{coin tossing}[\\ldots]#coin + 2"}],"overview":[{"gloss":["OT"],"messages":"\\mathsf{OT}[\\ldots]#ot","open":[],"phase":"offline","rounds":"\\mathsf{OT}[\\ldots]#ot"},{"gloss":["coin tossing","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 3","open":[],"phase":"online","rounds":"\\mathsf{coin tossing}[\\ldots]#coin + 2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( \\kappa(m\\mu(\\sigma - \\log n) + \\kappa + \\lambda) + 2\\kappa + 2m\\mu(\\sigma - \\log n)\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10; Fig. 9, step 2, p. 14","measure":"communication","phase":"offline","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( \\kappa(m\\mu(\\sigma - \\log n) + \\kappa + \\lambda) + 2\\kappa + 2m\\mu(\\sigma - \\log n)\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10; Fig. 9, step 2, p. 14","measure":"communication","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( 2m\\mu(\\sigma - \\log n) + 2\\kappa + 2\\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","phase":"offline","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( 2m\\mu(\\sigma - \\log n) + 2\\kappa + 2\\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( 6m\\mu(\\sigma - \\log n) + 3\\kappa + 3\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","phase":"offline","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15"],"derived":true,"formula":"\\( 6m\\mu(\\sigma - \\log n) + 3\\kappa + 3\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} + \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52; Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} + \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52; Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 4\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52; Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 4\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52; Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 11\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52; Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot"],"derived":true,"formula":"\\( 11\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52; Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 3 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 3 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"ot","chain":["kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 4\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 4\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"receiver"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 2m\\mu(\\sigma - \\log n) + 2\\kappa + 2\\lambda + 4 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"sender"},{"block":"ot","chain":["kos15","kos15_frand"],"derived":true,"formula":"\\( 2m\\mu(\\sigma - \\log n) + 2\\kappa + 2\\lambda + 4 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2017-RR-CCS"],"paper_title":"Malicious-Secure Private Set Intersection via Dual Execution","paper_url":"https://eprint.iacr.org/2017/769","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["ot"],"id":"ot","locator":"§4, pp. 6–7; §7, p. 18; Figure 8, p. 20; §7.1, pp. 20–21","phase":"offline","what":"chosen-message OTs both ways, on random choices"},{"blocks":["coin"],"id":"coin","locator":"Figure 4, step 1, p. 12","phase":"online","what":"coin tossing for the hash function of the bins"},{"after":["ot","coin"],"from":"receiver","id":"flip_b","locator":"Figure 4, steps 2b and 3b, p. 12; Figure 8, p. 20","phase":"online","what":"Bob's choice flips, one per OT he receives"},{"after":["ot","coin"],"from":"sender","id":"flip_a","locator":"Figure 4, steps 2a and 3a, p. 12; Figure 8, p. 20","phase":"online","what":"Alice's choice flips, one per OT she receives"},{"after":["flip_b"],"from":"sender","id":"common","locator":"Figure 4, step 4a, p. 12","phase":"online","what":"Alice's common encodings"}],"security_mode":"computational","security_model":"malicious, UC, F_encode-hybrid, standard model (Theorem 2, p. 13; §4, pp. 6-7)","security_notion":"PSI with output to Bob; corrupt party's set bounded by \\( m\\mu \\) for \\( m \\) bins of \\( \\mu \\) items","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The dual-execution PSI of RR17 with each oblivious encoding built from σ chosen-message OTs combined through a PRF, so no random oracle is needed. The cost grows with the item length σ.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of bins, \\( O(n/\\log n) \\): \\( n/4 \\) on a LAN and \\( n/10 \\) on a WAN","symbol":"m"},{"meaning":"Bin size, \\( O(\\log n) \\): the most items a bin holds except with probability \\( 2^{-\\lambda} \\)","symbol":"\\mu"}],"verification_cost":null,"work_id":"PSI-PAPER-2017-RR-CCS","year":2017},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"mixed","assumption_id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","assumption_name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)","attributes":{"adversary":{"locator":"Theorem 1, p. 15; Theorem 2, p. 16","note":"One-sided simulation against the receiver","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"Theorems 1–2, pp. 15–16; §4.3, p. 10","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","resolved":[{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"},{"id":"ASM-OMGDH","name":"One-more gap Diffie-Hellman (One-More-Gap-DH)","short":"One-More-Gap-DH"}],"value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"Figure 3, p. 15","value":["intersection"]},"output_to":{"locator":"Figure 2, step 9, p. 14; Figure 3, p. 15","value":"one"},"parties":{"locator":"Figure 2, p. 14","value":"two_party"},"security_model":{"locator":"Theorem 1, p. 15; §4.3, p. 10; Figure 1, step 1, p. 13","note":"The inner OPRF hash and the hash to short strings are random oracles; extraction observes queries","value":["random oracle"]},"set_size_regime":{"locator":"Abstract, p. 1; §1.1, p. 1","value":"unbalanced"},"technique":{"locator":"Figures 1–2, pp. 13–14; §4.3, p. 10","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"authors":["Hao Chen","Zhicong Huang","Kim Laine","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 1, steps 1–2, p. 13","note":"Samples the hash to short strings and the three cuckoo hash functions","phase":"setup","roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"coin","func":"coin_toss","locator":"Figure 1, steps 1–2, p. 13","node":"","note":"Samples the hash to short strings and the three cuckoo hash functions","open":true,"phase":"setup","roles":{"party":["sender","receiver"]}}]},"capabilities":["arbitrary-length-items","reusable-sender-preprocessing","malicious-receiver-security","communication-sublinear-in-larger-set"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2018-CHLR-LONG-ITEMS","PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3, p. 10; §3.1, p. 7; Figure 2, step 7, p. 14; §8.1, p. 18","measure":"communication","note":"Blinded OPRF queries, then window powers per batch; symmetric-key BFV nearly halves fresh ciphertexts in the implementation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3.1, p. 7; Figure 2, step 8, p. 14","measure":"communication","note":"OPRF answers, then one reply per subset and batch at full width; modulus switching shrinks the reply","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 1, step 1, p. 13; §4.3, p. 10","measure":"computation","note":"OPRF on its own set, reusable with many receivers","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O(m\\alpha B^{2}) \\)","locator":"Figure 1, step 5, p. 13; §8.2, p. 19","measure":"computation","note":"Coefficients of each subset's symmetric polynomial over the slot extension field","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 6n_X \\)","locator":"Figure 1, steps 1–2, p. 13; §4.3, p. 10","measure":"computation","note":"Per item: the OPRF hash to the group and output hash, the hash to short strings, and the three cuckoo hash functions of simple hashing","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.3, p. 10","measure":"computation","note":"One answer per blinded OPRF query","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}(B-1) \\)","locator":"Figure 2, step 8a, p. 14","measure":"computation","note":"One product per power from the square up to the split size, shared by the subsets","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}(2B+1) \\)","locator":"Figure 2, step 8b, p. 14; §4.2, p. 9","measure":"computation","note":"\\( B+1 \\) plaintext products and \\( B \\) additions per subset and batch; the OPRF removes the flooding","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4.3, p. 10","measure":"computation","note":"Blinding and unblinding each OPRF query","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","locator":"Figure 2, steps 7 and 9, p. 14","measure":"computation","note":"BFV encryptions of the window powers and decryptions of the replies","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 6n_Y \\)","locator":"Figure 2, steps 7a–7b, p. 14; §4.3, p. 10","measure":"computation","note":"Per item: the OPRF hash to the group and output hash, the hash to short strings, and the three cuckoo hash functions; re-insertions, unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["coin tossing","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 1","open":[],"phase":"setup","rounds":"(\\mathsf{coin tossing}[\\ldots]#coin \\parallel 1)"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["coin tossing","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 1","open":[],"phase":"setup","rounds":"(\\mathsf{coin tossing}[\\ldots]#coin \\parallel 1)"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2018-CHLR","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2018-CHLR","PSI-PAPER-2017-CLR"],"paper_title":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","paper_url":"https://eprint.iacr.org/2018/787","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"unbalanced PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 1, steps 1–2, p. 13","phase":"setup","what":"Coin flipping for the hash to short strings and the three cuckoo hash functions"},{"from":"receiver","id":"keys","locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","phase":"setup","what":"Evaluation keys, sent once and reused"},{"from":"receiver","id":"oprf_query","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"Blinded OPRF queries, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"OPRF answers under the sender's key"},{"after":["coin","oprf_answer"],"from":"receiver","id":"query","locator":"Figure 2, steps 7b–7e, p. 14","phase":"online","what":"Encrypted window powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 2, step 8, p. 14","phase":"online","what":"Dot-product results, one per subset and batch, optionally modulus-switched"}],"security_mode":"computational","security_model":"one-sided simulation against a malicious receiver in the random oracle hybrid (Theorem 1, p. 15); privacy against a malicious sender (Theorem 2, p. 16)","security_notion":"PSI with output to the receiver (Figure 3)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The CLR17 protocol run on OPRF outputs: both sets pass through a Diffie-Hellman OPRF keyed by the sender, which removes noise flooding and lets the receiver be extracted, and extension-field SIMD slots carry long items. The sender's pre-processing of its OPRF-processed set is reusable with many receivers.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo hash table bins, \\( O(n_Y) \\)","symbol":"m"},{"meaning":"SIMD slots per BFV ciphertext, the ring dimension over the slot extension degree","symbol":"k"},{"meaning":"Split size: the most items in one subset of a sender bin","symbol":"B"},{"meaning":"Subsets per sender bin","symbol":"\\alpha"},{"meaning":"Window base for the receiver's powers","symbol":"w"}],"verification_cost":null,"work_id":"PSI-PAPER-2018-CHLR","year":2018},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"mixed","assumption_id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","assumption_name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)","attributes":{"adversary":{"locator":"Theorems 1–2, pp. 15–16; Figure 3, p. 15","note":"One-sided simulation against the receiver; the theorems cover the unlabeled functionality; no labeled functionality is stated","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"Theorems 1–2, pp. 15–16; §4.3, p. 10","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","resolved":[{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"},{"id":"ASM-OMGDH","name":"One-more gap Diffie-Hellman (One-More-Gap-DH)","short":"One-More-Gap-DH"}],"value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"Figure 2, step 9, p. 14; §1.1, p. 2","value":["labeled"]},"output_to":{"locator":"Figure 2, step 9, p. 14","value":"one"},"parties":{"locator":"Figure 2, p. 14","value":"two_party"},"security_model":{"locator":"Theorem 1, p. 15; Figure 1, step 1, p. 13","value":["random oracle"]},"set_size_regime":{"locator":"Abstract, p. 1","value":"unbalanced"},"technique":{"locator":"Figures 1–2, pp. 13–14; §5.2, p. 12","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"authors":["Hao Chen","Zhicong Huang","Kim Laine","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 1, steps 1–2, p. 13","note":"Samples the hash to short strings and the three cuckoo hash functions","phase":"setup","roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"coin","func":"coin_toss","locator":"Figure 1, steps 1–2, p. 13","node":"","note":"Samples the hash to short strings and the three cuckoo hash functions","open":true,"phase":"setup","roles":{"party":["sender","receiver"]}}]},"capabilities":["labels-for-matching-items","communication-sublinear-in-larger-set","reusable-sender-preprocessing","batched-keyword-pir"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2018-CHLR-LABELED-PSI","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2018-CHLR-LONG-ITEMS"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3, p. 10; Figure 2, step 7, p. 14","measure":"communication","note":"As unlabeled; labels add nothing to the query","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (1+c)\\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"Figure 2, step 8, p. 14; §5.1, pp. 11–12","measure":"communication","note":"Intersection results plus one label result per chunk, per subset and batch","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 1, step 1, p. 13","measure":"computation","note":"OPRF on its own set, reusable with many receivers","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O((1+c)m\\alpha B^{2}) \\)","locator":"Figure 1, step 5b, p. 13; §5.1, p. 12","measure":"computation","note":"Each subset's symmetric polynomial, then a Newton interpolation per label chunk, each \\( O(B^2) \\) in the split size \\( B \\)","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 7n_X \\)","locator":"Figure 1, steps 1–2, p. 13; §4.3, p. 10; §5.2 and footnote 7, p. 12","measure":"computation","note":"As unlabeled, six per item, plus a PRG call per item that stretches the second part of its OPRF value into a pad as long as its label","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}(B-1) \\)","locator":"Figure 2, step 8a, p. 14","measure":"computation","note":"Powers up to the split size, computed once per batch and shared by the intersection and label polynomials","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( (1+c)\\alpha\\frac{m}{k}(2B+1) \\)","locator":"Figure 2, step 8b, p. 14; §5.1, p. 11","measure":"computation","note":"The dot product repeated for each label chunk: \\( B+1 \\) plaintext products and \\( B \\) additions per polynomial, subset and batch","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+(1+c)\\alpha\\right)\\frac{m}{k} \\)","locator":"Figure 2, steps 7 and 9, p. 14","measure":"computation","note":"BFV encryptions of the window powers and decryptions of all results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 7n_Y \\)","locator":"Figure 2, steps 7a–7b and 9, p. 14; §4.3, p. 10; §5.2 and footnote 7, p. 12","measure":"computation","note":"As unlabeled, six per item, plus a PRG call per item in the intersection to strip its pad, counted for every item; cuckoo re-insertions add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["coin tossing","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 1","open":[],"phase":"setup","rounds":"(\\mathsf{coin tossing}[\\ldots]#coin \\parallel 1)"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["coin tossing","the protocol's own messages"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin + 1","open":[],"phase":"setup","rounds":"(\\mathsf{coin tossing}[\\ldots]#coin \\parallel 1)"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2018-CHLR","PSI-PAPER-2017-CLR"],"paper_title":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","paper_url":"https://eprint.iacr.org/2018/787","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"labeled PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 1, steps 1–2, p. 13","phase":"setup","what":"Coin flipping for the hash to short strings and the three cuckoo hash functions"},{"from":"receiver","id":"keys","locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","phase":"setup","what":"Evaluation keys, sent once and reused"},{"from":"receiver","id":"oprf_query","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"Blinded OPRF queries, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"OPRF answers under the sender's key"},{"after":["coin","oprf_answer"],"from":"receiver","id":"query","locator":"Figure 2, steps 7b–7e, p. 14","phase":"online","what":"Encrypted window powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 2, step 8b, p. 14","phase":"online","what":"Intersection results, one per subset and batch"},{"from":"sender","id":"labels","locator":"Figure 2, step 8b, p. 14; §5.1, pp. 11–12","phase":"online","what":"Label results, one per chunk, subset and batch, returned with the intersection results","with":"reply"}],"security_mode":"computational","security_model":"Theorems 1-2 (pp. 15-16) stated for the unlabeled functionality","security_notion":"labeled PSI with output to the receiver (no ideal functionality stated for labels)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Labeled PSI on the CHLR18 protocol: the sender pads each label with the second half of its item's OPRF output and interpolates, per subset, a polynomial that maps items to padded labels. It evaluates these polynomials on the receiver's encrypted powers next to the intersection polynomials, keeping communication sublinear in \\( n_X \\).","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo hash table bins, \\( O(n_Y) \\)","symbol":"m"},{"meaning":"SIMD slots per BFV ciphertext, the ring dimension over the slot extension degree","symbol":"k"},{"meaning":"Split size: the most items in one subset of a sender bin","symbol":"B"},{"meaning":"Subsets per sender bin","symbol":"\\alpha"},{"meaning":"Window base for the receiver's powers","symbol":"w"},{"meaning":"Label chunks per item: label length over item length, rounded up","symbol":"c"}],"verification_cost":null,"work_id":"PSI-PAPER-2018-CHLR","year":2018},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"mixed","assumption_id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-H-LIMITED-LEVELED-FHE","assumption_name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure H-limited leveled FHE","attributes":{"adversary":{"locator":"Theorem 3, p. 25","tip":"Simulation against either party, for a leaky functionality in which a malicious sender may drop receiver items.","value":["malicious"]},"assumptions":{"locator":"Theorem 3, p. 25; Definition 1, p. 17","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF; also an H-limited FHE assumption argued heuristically","resolved":[{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"},{"id":"ASM-OMGDH","name":"One-more gap Diffie-Hellman (One-More-Gap-DH)","short":"One-More-Gap-DH"}],"value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"Figure 7, p. 25; Figure 8, p. 25","note":"Against a malicious sender the receiver gets the intersection further cut by a sender-chosen leakage function of its set","value":["intersection"]},"output_to":{"locator":"Figure 7, p. 25","value":"one"},"parties":{"locator":"Figure 8, p. 25","value":"two_party"},"security_model":{"locator":"Theorem 3 and its proof, pp. 25–26","note":"Non-black-box simulation; the reduction programs the OPRF random oracle","value":["programmable random oracle"]},"set_size_regime":{"locator":"§7.3, p. 17","value":"unbalanced"},"technique":{"locator":"Figure 8, p. 25","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"authors":["Hao Chen","Zhicong Huang","Kim Laine","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 8, step 1, p. 25; Figure 1, steps 1–2, p. 13; §7.3, pp. 17–18","note":"Samples the hash functions per receiver, since the pre-processing is not reused","phase":"offline","roles":{"party":["sender","receiver"]}},{"cites":[],"func":"zk","id":"zk","locator":"Figure 8, step 1b, p. 25; proof of Theorem 3, pp. 25–26","note":"That all OPRF answers use one key","phase":"online","roles":{"prover":"sender","verifier":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"coin","func":"coin_toss","locator":"Figure 8, step 1, p. 25; Figure 1, steps 1–2, p. 13; §7.3, pp. 17–18","node":"","note":"Samples the hash functions per receiver, since the pre-processing is not reused","open":true,"phase":"offline","roles":{"party":["sender","receiver"]}},{"block":"zk","func":"zk","locator":"Figure 8, step 1b, p. 25; proof of Theorem 3, pp. 25–26","node":"","note":"That all OPRF answers use one key","open":true,"phase":"online","roles":{"prover":"sender","verifier":"receiver"}}]},"capabilities":["malicious-sender-with-leakage","malicious-receiver-security","communication-sublinear-in-larger-set"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","PSI-CONTRIB-2018-CHLR-LABELED-PSI","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"Figure 8, step 1, p. 25; Figure 2, step 7, p. 14","measure":"communication","note":"As in the semi-honest-sender protocol","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"Figure 8, steps 1b and 2, p. 25","measure":"communication","note":"OPRF answers, then the label-polynomial results only","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§7.3, pp. 17–18; Figure 8, step 1, p. 25","measure":"computation","note":"Pre-processing per receiver: jointly sampled hash functions are not reused","operation":"exponentiation","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( O(m\\alpha B^{2}) \\)","locator":"§5.1–5.2, p. 12; Figure 8, step 1a, p. 25","measure":"computation","note":"Interpolation of the hash-valued label polynomials, \\( O(B^2) \\) in the split size \\( B \\); symmetric polynomials are skipped","operation":"field_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 7n_X \\)","locator":"Figure 8, step 1a, p. 25; Figure 1, steps 1–2, p. 13; §4.3, p. 10","measure":"computation","note":"As in the semi-honest-sender protocol, six per item, plus hashing each item into its label","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}(B-1) \\)","locator":"Figure 8, step 2, p. 25; Figure 2, step 8a, p. 14","measure":"computation","note":"Powers up to the split size, shared by the subsets; label polynomials replace the symmetric ones","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}(2B+1) \\)","locator":"Figure 8, step 2, p. 25; Figure 2, step 8b, p. 14","measure":"computation","note":"The label polynomials' dot products only: \\( B+1 \\) plaintext products and \\( B \\) additions per subset and batch","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","locator":"Figure 8, step 3, p. 25","measure":"computation","note":"BFV encryptions of the window powers and decryptions of the label results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 7n_Y \\)","locator":"Figure 8, steps 1 and 3, p. 25; Figure 2, steps 7a–7b, p. 14; §4.3, p. 10","measure":"computation","note":"As in the semi-honest-sender protocol, six per item, plus hashing each item to compare with its decrypted label result; cuckoo re-insertions add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["coin tossing"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin","open":[],"phase":"offline","rounds":"\\mathsf{coin tossing}[\\ldots]#coin"},{"gloss":["the protocol's own messages","zero knowledge proof"],"messages":"\\mathsf{zero knowledge proof}[\\ldots]#zk + 4","open":[],"phase":"online","rounds":"(1 \\parallel \\mathsf{zero knowledge proof}[\\ldots]#zk) + 3"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["coin tossing"],"messages":"\\mathsf{coin tossing}[\\ldots]#coin","open":[],"phase":"offline","rounds":"\\mathsf{coin tossing}[\\ldots]#coin"},{"gloss":["the protocol's own messages","zero knowledge proof"],"messages":"\\mathsf{zero knowledge proof}[\\ldots]#zk + 4","open":[],"phase":"online","rounds":"(1 \\parallel \\mathsf{zero knowledge proof}[\\ldots]#zk) + 3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2018-CHLR"],"paper_title":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","paper_url":"https://eprint.iacr.org/2018/787","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"unbalanced PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"keys","locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","phase":"setup","what":"Evaluation keys, sent once and reused"},{"blocks":["coin"],"id":"coin","locator":"Figure 8, step 1, p. 25; Figure 1, steps 1–2, p. 13","phase":"offline","what":"Coin flipping for the hash functions, per receiver, before the sender's pre-processing"},{"from":"receiver","id":"oprf_query","locator":"Figure 8, step 1, p. 25; Figure 2, step 7a, p. 14","phase":"online","what":"Blinded OPRF queries, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"Figure 8, step 1b, p. 25; Figure 2, step 7a, p. 14","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_query"],"blocks":["zk"],"id":"zk","locator":"Figure 8, step 1b, p. 25","phase":"online","what":"Proof that every OPRF answer uses the one key, given with the answers"},{"after":["coin","oprf_answer","zk"],"from":"receiver","id":"query","locator":"Figure 8, step 1, p. 25; Figure 2, steps 7b–7e, p. 14","phase":"online","what":"Encrypted window powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 8, step 2, p. 25","phase":"online","what":"Results of the hash-valued label polynomials only, one per subset and batch"}],"security_mode":"computational","security_model":"non-black-box simulation in the random oracle hybrid (Theorem 3, p. 25)","security_notion":"leaky PSI functionality \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\) (Figure 7)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Labeled PSI with the label of each item set to a random-oracle hash of its OPRF value, so a correct label for a receiver item requires knowing that item. Under the assumption that the FHE parameters cannot evaluate the hash, a malicious sender is restricted to a polynomial-size set and a leakage function that can only remove items.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo hash table bins, \\( O(n_Y) \\)","symbol":"m"},{"meaning":"SIMD slots per BFV ciphertext, the ring dimension over the slot extension degree","symbol":"k"},{"meaning":"Split size: the most items in one subset of a sender bin","symbol":"B"},{"meaning":"Subsets per sender bin","symbol":"\\alpha"},{"meaning":"Window base for the receiver's powers","symbol":"w"}],"verification_cost":null,"work_id":"PSI-PAPER-2018-CHLR","year":2018},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-SEMI-HONEST-GENERIC-TWO-PARTY-COMPUTATION-GMW-OR-YAO-NO-ASSUMPTION-STATED","assumption_name":"Semi-honest generic two-party computation (GMW or Yao); no assumption stated","attributes":{"adversary":{"locator":"§2, p. 6; §5.4, p. 18","note":"The authors see no extension to malicious adversaries.","value":["semi_honest"]},"assumptions":{"note":"Security is inherited from the generic two-party protocol; no assumption is stated.","value":"not_reported"},"output":{"locator":"§2, p. 5; §6.3, p. 24","note":"Any symmetric function f of the intersection; the measured instance tests whether its size exceeds a threshold.","value":["circuit"]},"output_to":{"locator":"§2, p. 5; §5.2, p. 16","note":"Per-item match bits stay inside the generic protocol; both parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2, p. 5","value":"two_party"},"security_model":{"note":"No proof is given; the protocol inherits the generic protocol's security.","value":"not_reported"},"set_size_regime":{"locator":"§2, p. 5","value":"balanced"},"technique":{"locator":"§5.2, pp. 16-17; §6.3, p. 24","value":["cuckoo_hashing","permutation_based_hashing","gmw"]}},"authors":["Benny Pinkas","Thomas Schneider","Christian Weinert","Udi Wieder"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"},{"key":"DSZ15","title":"ABY – a framework for efficient mixed-protocol secure two-party computation"}],"func":"two_pc","id":"two_pc","implementation":"GMW, in the ABY framework","instantiation":"gmw_iknp","locator":"§5.2, pp. 16–17; §6.2, pp. 22–23; §6.3, p. 24","note":"The matching circuit up to one bit per item; the circuit for f adds its own gates and depth","params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"},"roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"two_pc","calls":[{"block":"two_pc","calls":[{"block":"two_pc","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10; §2.2.2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"NP01"}],"count":"\\( g \\)","func":"rot","implementation":"iknp_rot","label":"IKNP random OT extension","locator":"§5.1, Algorithm 1, p. 12; §5.4, R-OT for GMW, p. 19","node":"0","note":"Two random OTs on bits per AND gate, one each way: each party is sender in k|C| of them and receiver in the other k|C|, so each bears both roles' costs once","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"PSZ18"}],"func":"two_pc","implementation":"gmw_iknp","label":"GMW with multiplication triples from random OTs by OT extension (IKNP, as in ABY)","locator":"§5.2, pp. 16–17; §6.2, pp. 22–23; §6.3, p. 24","node":"","note":"The matching circuit up to one bit per item; the circuit for f adds its own gates and depth","params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"ALSZ13"}]},"capabilities":["any-symmetric-function-of-intersection","combined-stash","associated-data"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING"],"client_storage":null,"communication":null,"complexity":{"two_pc":{"costs":[{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2|C| \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( |C|\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6|C| \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"\\mathrm{depth}","open":[],"phase":"online","rounds":"\\mathrm{depth}"}],"variables":[]}},"construction_family":"cuckoo_hashing_circuit_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 0 \\)","locator":"§5.2, p. 16","measure":"communication","note":"Alice sends only inside the generic two-party computation","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§5.2, p. 16","measure":"communication","note":"Bob sends only inside the generic two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( 4n \\)","locator":"Algorithm 2, p. 15; Algorithm 3, p. 16; §5.2, pp. 16–17","measure":"computation","note":"Alice's 2D Cuckoo hashing: each item's positions under the four hash functions, each computed once and kept across relocations","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§5.1, p. 15; §5.2, pp. 16–17","measure":"computation","note":"Bob's Cuckoo hashing into both tables: each item's two positions per table, each computed once","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"6","open":[],"phase":"setup","rounds":"3"},{"gloss":["2PC"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["2PC"],"messages":"2\\log_2\\sigma","open":[],"phase":"online","rounds":"\\log_2\\sigma"}],"overview":[{"gloss":["2PC"],"messages":"\\mathsf{2PC}[\\ldots]#two_pc","open":[],"phase":"online","rounds":"\\mathsf{2PC}[\\ldots]#two_pc"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2g \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2g \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( g\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( g\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6g \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6g \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2018-PSWW-2D","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2018-PSWW"],"paper_title":"Efficient Circuit-based PSI via Cuckoo Hashing","paper_url":"https://eprint.iacr.org/2018/120","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["two_pc"],"id":"circuit","locator":"§5.2, p. 16; §6.3, p. 24","phase":"online","what":"GMW evaluation of the circuit comparing each bin and the combined stash, then f"}],"security_mode":"computational","security_model":"semi-honest two-party; security is inherited from the generic protocol, no proof given (§5.2, p. 16)","security_notion":"\\( f(X \\cap Y) \\) for a symmetric function f, revealing nothing else","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Circuit-based PSI from iterative two-dimensional cuckoo hashing: Alice places each item in both bins of one of two tables with two-item bins and no stash, Bob places each item once in each table with one combined stash, so a common item meets in exactly one bin, and a GMW circuit compares bins and stash before computing f.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Size of Bob's combined stash","symbol":"s_c"},{"meaning":"AND gates of the matching circuit, \\( 4\\cdot 2.4n(\\sigma - \\log_2(2.4n) + 1) + s_cn(\\sigma - 1) \\)","symbol":"g"}],"verification_cost":null,"work_id":"PSI-PAPER-2018-PSWW","year":2018},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-SEMI-HONEST-GENERIC-TWO-PARTY-COMPUTATION-GMW-OR-YAO-NO-ASSUMPTION-STATED","assumption_name":"Semi-honest generic two-party computation (GMW or Yao); no assumption stated","attributes":{"adversary":{"locator":"§2, p. 6","value":["semi_honest"]},"assumptions":{"note":"Security is inherited from the generic two-party protocol; no assumption is stated.","value":"not_reported"},"output":{"locator":"§2, p. 5; §4.2, p. 13","note":"Any symmetric function f of the intersection.","value":["circuit"]},"output_to":{"locator":"§4.2, p. 13","note":"Per-bin match results stay inside the generic protocol; both parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2, p. 5","value":"two_party"},"security_model":{"note":"No proof is given; the protocol inherits the generic protocol's security.","value":"not_reported"},"set_size_regime":{"locator":"§2, p. 5","value":"balanced"},"technique":{"locator":"§4.1, pp. 10-12; §6.2, p. 22","value":["cuckoo_hashing","permutation_based_hashing"]}},"authors":["Benny Pinkas","Thomas Schneider","Christian Weinert","Udi Wieder"],"base_signature":null,"block_size":null,"blocks":[{"cites":[],"func":"two_pc","id":"two_pc","locator":"§4.2, p. 13; §6.2, pp. 22–23","note":"Yao or GMW, not fixed; the circuit for f adds its own gates and depth","params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"two_pc","func":"two_pc","locator":"§4.2, p. 13; §6.2, pp. 22–23","node":"","note":"Yao or GMW, not fixed; the circuit for f adds its own gates and depth","open":true,"params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"},"phase":"online"}]},"capabilities":["any-symmetric-function-of-intersection","non-constant-stash"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"cuckoo_hashing_circuit_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 0 \\)","locator":"§4.2, p. 13","measure":"communication","note":"Alice sends only inside the generic two-party computation","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§4.2, p. 13","measure":"communication","note":"Bob sends only inside the generic two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( 4n \\)","locator":"Algorithm 1, p. 12; §4.1, pp. 11–12","measure":"computation","note":"Alice's two Cuckoo hashings over the left rows, four hash functions per item; the right tables reuse those placements","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§4.1, pp. 11–12; Figure 1, p. 11","measure":"computation","note":"Bob's four Cuckoo hashings use four distinct hash functions, the right tables mirroring the left; each position computed once","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["2PC"],"messages":"\\mathsf{2PC}[\\ldots]#two_pc","open":[],"phase":"online","rounds":"\\mathsf{2PC}[\\ldots]#two_pc"}],"overview":[{"gloss":["2PC"],"messages":"\\mathsf{2PC}[\\ldots]#two_pc","open":[],"phase":"online","rounds":"\\mathsf{2PC}[\\ldots]#two_pc"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2018-PSWW"],"paper_title":"Efficient Circuit-based PSI via Cuckoo Hashing","paper_url":"https://eprint.iacr.org/2018/120","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["two_pc"],"id":"circuit","locator":"§4.2, step 3, p. 13","phase":"online","what":"generic evaluation of the circuit comparing each bin once and the stashes with all items, then f"}],"security_mode":"computational","security_model":"semi-honest two-party; failure probability negligible in \\( n \\) with stashes of size \\( \\omega(1) \\) (§4.1, p. 13; Appendix C, p. 34)","security_notion":"\\( f(X \\cap Y) \\) for a symmetric function f, revealing nothing else","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Circuit-based PSI from mirror cuckoo hashing: Alice maps each item to two subtables of one column of four tables by reusing her cuckoo placements, Bob runs cuckoo hashing four times, and a generic circuit compares each bin once and stashed items with all items, for \\( \\omega(\\sigma n) \\) gates.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Size of a combined stash, at most twice a single stash","symbol":"s_c"},{"meaning":"AND gates of the matching circuit, \\( 4\\cdot 2.4n(\\sigma - \\log_2(2.4n) + 1) + 3s_cn(\\sigma - 1) \\)","symbol":"g"}],"verification_cost":null,"work_id":"PSI-PAPER-2018-PSWW","year":2018},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-RANDOM-OT-EXTENSION-WITH-A-HASH-MODELED-AS-A-RANDOM-ORACLE","assumption_name":"random OT extension with a hash modeled as a random oracle","attributes":{"adversary":{"locator":"§5, Security, p. 23","value":["semi_honest"]},"assumptions":{"locator":"§2.1, pp. 8–9; §2.2.2, p. 10","note":"The base-OT assumption is not named","resolved":[{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["CR hash"]},"output":{"locator":"Protocol 3, p. 22","value":["intersection"]},"output_to":{"locator":"Protocol 3, Output, p. 22","note":"P2 only","value":"one"},"parties":{"locator":"Protocol 3, p. 22","value":"two_party"},"security_model":{"locator":"§5, Security, p. 23; §2.1, p. 8; §2.2.2, p. 10","note":"Proved with an ideal random 1-out-of-N OT, a hybrid model; its random-OT extension models the hash as a random oracle","value":["random oracle"]},"set_size_regime":{"locator":"§6.2.1, p. 26; Tables 12–13, pp. 30–31","note":"Also run on unequal sets, without exploiting the imbalance","value":"balanced"},"technique":{"locator":"§5, pp. 21–23; Protocol 3, p. 22","value":["batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","permutation_based_hashing"]}},"authors":["Benny Pinkas","Thomas Schneider","Michael Zohner"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KK13","title":"Improved OT extension for transferring short secrets"}],"count":"\\( \\epsilon n_Y+s \\)","func":"rot","id":"rot","implementation":"Kolesnikov-Kumaresan 1-out-of-N OT extension, BCH code","instantiation":"kk13_rot","locator":"Protocol 3, step 2, p. 22; §5, Security, p. 23","note":"One per bin and stash position: \\( N = 2^{\\mu} \\) for items cut to \\( \\mu = \\sigma-\\log_2(\\epsilon n_Y)+\\log_2 k \\) bits by permutation-based hashing","params":{"N":"\\( 2^{\\sigma}k/(\\epsilon n_Y) \\)","\\tau":"\\( \\lambda+\\log_2(kn_Xn_Y) \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"rot","calls":[{"block":"rot","count":"\\( n_C \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 2, p. 11; §2.2.3, p. 11","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\epsilon n_Y+s \\)","func":"rot","implementation":"kk13_rot","label":"KK13 1-out-of-N random OT extension, linear code","locator":"Protocol 3, step 2, p. 22; §5, Security, p. 23","node":"","note":"One per bin and stash position: \\( N = 2^{\\mu} \\) for items cut to \\( \\mu = \\sigma-\\log_2(\\epsilon n_Y)+\\log_2 k \\) bits by permutation-based hashing","params":{"N":"\\( 2^{\\sigma}k/(\\epsilon n_Y) \\)","\\tau":"\\( \\lambda+\\log_2(kn_Xn_Y) \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"}],"phase":"online","step_phase":"online"},"capabilities":["item-length-independent-oprf-cost"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS"],"client_storage":null,"communication":null,"complexity":{"rot":{"costs":[{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( kn_C \\)","locator":"Protocol 2, step 3, p. 11","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( 0 \\)","locator":"§2.2.2, p. 10; §2.2.3, p. 11","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( 2kn_C/\\kappa + k \\)","locator":"Protocol 2, step 3, p. 11; §2.2.3, p. 11","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( kn_C/\\kappa \\)","locator":"Protocol 2, step 4, p. 11","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Codeword length of the code, also the number of base OTs (512 for PSZ18's BCH code at κ = 128)","symbol":"n_C"}]}},"construction_family":"oprf_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (k+s)n_X(\\lambda+\\log_2(kn_Xn_Y)) \\)","locator":"Protocol 3, common input and steps 2–3, p. 22","measure":"communication","note":"Masks of P1's items for every hash function and stash position","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 3, p. 22; §5, Efficiency, p. 23","measure":"communication","note":"P2 sends only the correction matrix of the random OTs","subject":"receiver"},{"basis":"counted","formula":"\\( (2k+s)n_X \\)","locator":"Protocol 3, steps 1a and 2c, p. 22; §5, pp. 22–23","measure":"computation","note":"Its \\( k \\) bin hashes per item, then one correlation-robust hash per OPRF value, for every hash function and stash position","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( kn_Y \\)","locator":"Protocol 3, step 1b, p. 22","measure":"computation","note":"Its \\( k \\) cuckoo hashes per item; its OPRF outputs come with the random OTs","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["ROT","the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["ROT","the protocol's own messages"],"messages":"\\mathsf{ROT}[\\ldots]#rot + 1","open":[],"phase":"online","rounds":"\\mathsf{ROT}[\\ldots]#rot + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( (\\epsilon n_Y + s)n_C \\)","locator":"Protocol 2, step 3, p. 11","measure":"communication","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( 0 \\)","locator":"§2.2.2, p. 10; §2.2.3, p. 11","measure":"communication","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( 2(\\epsilon n_Y + s)n_C/\\kappa + \\epsilon n_Y + s \\)","locator":"Protocol 2, step 3, p. 11; §2.2.3, p. 11","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kk13_rot"],"derived":true,"formula":"\\( (\\epsilon n_Y + s)n_C/\\kappa \\)","locator":"Protocol 2, step 4, p. 11","measure":"computation","operation":"symmetric_op","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kk13_rot","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2018-PSZ-OT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2018-PSZ"],"paper_title":"Scalable Private Set Intersection Based on OT Extension","paper_url":"https://eprint.iacr.org/2016/930","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["rot"],"id":"rot","locator":"Protocol 3, step 2, p. 22","phase":"online","what":"random OTs as the OPRF, one per bin and stash position"},{"after":["rot"],"from":"sender","id":"masks","locator":"Protocol 3, step 3, p. 22","phase":"online","what":"P1's permuted OPRF values, for the bins and the stash"}],"security_mode":"computational","security_model":"semi-honest, simulation-based, with an ideal 1-out-of-N random OT functionality (§5, 'Security', p. 23)","security_notion":"PSI with output to P2","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Semi-honest OT-based PSI in which P2 cuckoo-hashes and P1 simple-hashes into the same bins, and one random 1-out-of-N OT per bin realizes an OPRF on items shortened by permutation-based hashing. P1 sends the OPRF values of its items and P2 intersects them in the clear.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of cuckoo hash functions","symbol":"k"},{"meaning":"Stash size of the cuckoo table","symbol":"s"},{"meaning":"Bins per item of P2's set: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"}],"verification_cost":null,"work_id":"PSI-PAPER-2018-PSZ","year":2018},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-IND-CPA-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PAILLIER-OR-DAMG-RD-JURIK-AND-PASSIVELY-SECURE-OLE","assumption_name":"IND-CPA additively homomorphic encryption (Paillier or Damgård-Jurik) and passively secure OLE","attributes":{"adversary":{"locator":"§2.2, p. 6; Theorem 4, p. 14","note":"Static passive adversary corrupting Alice or Bob","value":["semi_honest"]},"assumptions":{"locator":"§2.3, p. 6; Theorem 2, p. 10; §7.2, p. 17","note":"IND-CPA additively homomorphic encryption, instantiated by Paillier or Damgård–Jurik; passively secure OLE","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"}],"value":["DCR"]},"output":{"locator":"Figure 6, p. 12","note":"The intersection if the symmetric difference is at most \\( 2t \\), otherwise nothing","value":["threshold"]},"output_to":{"locator":"Figure 6, p. 12","value":"all"},"parties":{"locator":"§2.2, p. 5","value":"two_party"},"security_model":{"locator":"Theorem 4, p. 14; Lemma 4, p. 14","note":"UC in the plain model; the cardinality test, noisy addition and OLE hybrids are functionalities, not models","value":["standard model"]},"set_size_regime":{"locator":"§2, p. 4; §6.4, p. 15","note":"Sets of equal size; unequal sets are padded, at most doubling the threshold","value":"balanced"},"technique":{"locator":"§§5–7, pp. 10–17","value":["additively_homomorphic_encryption","ole","polynomial_sparsity_test","set_reconciliation"]}},"authors":["Satrajit Ghosh","Mark Simkin"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KMWF07","title":"Secure linear algebra using linearly recurrent sequences"}],"func":"inv","id":"inv","implementation":"singularity test of Kiltz et al.","instantiation":"kmwf07","locator":"Figure 5, step 6, p. 11; Theorem 3, p. 11","note":"Bob inputs the encrypted difference of the Hankel matrices, Alice her secret key","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| > \\lambda+\\log((4t^{2}+2t)(p-1)) \\)","k":"\\( 2t+1 \\)"},"roles":{"party":["sender","receiver"]}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t+1 \\)","func":"ole","id":"ole_to_receiver","locator":"Figure 10, step 3, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","note":"Alice receives her evaluations under Bob's random polynomials; any passively secure OLE with constant communication overhead","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t+1 \\)","func":"ole","id":"ole_to_sender","locator":"Figure 10, step 4, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","note":"Bob receives his evaluations under Alice's random polynomials; any passively secure OLE with constant communication overhead","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"inv","func":"inv","implementation":"kmwf07","label":"Secure singularity test of Kiltz et al.","locator":"Figure 5, step 6, p. 11; Theorem 3, p. 11","node":"","note":"Bob inputs the encrypted difference of the Hankel matrices, Alice her secret key","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| > \\lambda+\\log((4t^{2}+2t)(p-1)) \\)","k":"\\( 2t+1 \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"GS19"},{"block":"ole_to_receiver","count":"\\( 3t+1 \\)","func":"ole","locator":"Figure 10, step 3, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","node":"","note":"Alice receives her evaluations under Bob's random polynomials; any passively secure OLE with constant communication overhead","open":true,"params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"}},{"block":"ole_to_sender","count":"\\( 3t+1 \\)","func":"ole","locator":"Figure 10, step 4, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","node":"","note":"Bob receives his evaluations under Alice's random polynomials; any passively secure OLE with constant communication overhead","open":true,"params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":"online","reversed":true,"roles":{"receiver":"sender","sender":"receiver"}}],"phase":"online","step_phase":"online"},"capabilities":["sublinear-in-set-size","size-hiding-cardinality-test"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"client_storage":null,"communication":null,"complexity":{"inv":{"costs":[],"counts":[],"variables":[]}},"construction_family":"polynomial_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (3t+1)\\log p + 1 \\)","locator":"Figure 5, p. 11; Figure 10, p. 17","measure":"communication","note":"A one-bit verdict, then \\( 3t+1 \\) masked evaluations","subject":"sender","tip":"Alice, who holds the decryption key, is counted as receiver and Bob as sender; both learn the output."},{"basis":"counted","formula":"\\( (4t+1)\\gamma + |\\mathbb{F}| + \\eta + (3t+1)\\log p \\)","locator":"Figure 5, steps 3–4, p. 11; Figure 10, step 5, p. 17","measure":"communication","note":"The \\( 4t+1 \\) encrypted Hankel entries with the point \\( u \\) and her public key, then \\( 3t+1 \\) masked evaluations","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","locator":"Figure 5, p. 11; Figure 7, p. 13; §1.2, p. 4","measure":"computation","note":"Hankel entries (one power per item, exponent up to \\( p \\)), set-polynomial evaluations, rational interpolation by Gaussian elimination","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","locator":"Figure 5, p. 11; Figure 7, p. 13","measure":"computation","note":"As the receiver, symmetrically","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4t+1 \\)","locator":"Figure 5, step 3, p. 11","measure":"computation","note":"Encrypts the entries of her Hankel matrix","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( 4t+1 \\)","locator":"Figure 5, step 5, p. 11","measure":"computation","note":"Encrypts the entries of his own Hankel matrix","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( 4t+1 \\)","locator":"Figure 5, step 5, p. 11","measure":"computation","note":"Subtracts his encrypted entries from hers, one per distinct entry of the Hankel matrix","operation":"hom_op","subject":"sender"}],"counts":{"exact":[{"gloss":["the protocol's own messages","INV","OLE"],"messages":"\\mathsf{INV}[\\ldots]#inv + \\mathsf{OLE}[\\ldots]#ole_to_receiver + \\mathsf{OLE}[\\ldots]#ole_to_sender + 4","open":[],"phase":"online","rounds":"\\mathsf{INV}[\\ldots]#inv + (\\mathsf{OLE}[\\ldots]#ole_to_receiver \\parallel \\mathsf{OLE}[\\ldots]#ole_to_sender) + 3"}],"overview":[{"gloss":["the protocol's own messages","INV","OLE"],"messages":"\\mathsf{INV}[\\ldots]#inv + \\mathsf{OLE}[\\ldots]#ole_to_receiver + \\mathsf{OLE}[\\ldots]#ole_to_sender + 4","open":[],"phase":"online","rounds":"\\mathsf{INV}[\\ldots]#inv + (\\mathsf{OLE}[\\ldots]#ole_to_receiver \\parallel \\mathsf{OLE}[\\ldots]#ole_to_sender) + 3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2019-GS-AHE","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2019-GS"],"paper_title":"The Communication Complexity of Threshold Private Set Intersection","paper_url":"https://eprint.iacr.org/2019/175","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"hankel","locator":"Figure 5, steps 3–4, p. 11","phase":"online","what":"Alice's encrypted Hankel matrix, the point u and her public key"},{"after":["hankel"],"blocks":["inv"],"id":"inv","locator":"Figure 5, steps 5–6, p. 11","phase":"online","what":"singularity test of the encrypted difference of the Hankel matrices"},{"after":["inv"],"from":"sender","id":"verdict","locator":"Figure 5, step 7, p. 11","phase":"online","what":"Bob's verdict, similar or different"},{"after":["verdict"],"blocks":["ole_to_receiver","ole_to_sender"],"id":"ole","locator":"Figure 7, steps 2–4, p. 13; Figure 10, steps 3–4, p. 17","phase":"online","what":"both OLE batches of noisy polynomial addition, run only on similar sets"},{"after":["ole"],"from":"receiver","id":"masked_a","locator":"Figure 10, step 5, p. 17","phase":"online","what":"Alice's masked evaluations"},{"after":["ole"],"from":"sender","id":"masked_b","locator":"Figure 10, step 6, p. 17","phase":"online","what":"Bob's masked evaluations"}],"security_mode":"computational","security_model":"UC, static passive adversary; Theorem 4 in the (F_PICT, F_NPA)-hybrid model and Theorem 5 in the F_OLE-hybrid model (pp. 14, 16)","security_notion":"threshold PSI (intersection if the symmetric difference is at most \\( 2t \\))","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Two-party threshold PSI in two steps: a private intersection cardinality test that encodes each set as a sum of monomials and tests the sparsity of their difference through an encrypted Hankel matrix, then noisy polynomial addition over OLE from which each party interpolates in the clear the elements only it holds.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bits of one ciphertext of the additively homomorphic scheme (Paillier or Damgård-Jurik)","symbol":"\\gamma"},{"meaning":"Bits of Alice's public key of the additively homomorphic scheme, which the paper does not size","symbol":"\\eta"}],"verification_cost":null,"work_id":"PSI-PAPER-2019-GS","year":2019},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"lattice","assumption_id":"ASM-LWE","assumption_ids":["ASM-LWE","ASM-RLWE"],"assumption_name":"LWE or Ring-LWE","attributes":{"adversary":{"locator":"§2.2, p. 6; §3, p. 8","value":["semi_honest"]},"assumptions":{"locator":"§3, p. 8","note":"Either, through the FHE instantiation the paper names","resolved":[{"id":"ASM-LWE","name":"Learning with errors (LWE)","short":"LWE"},{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"}],"value":["LWE","Ring-LWE"]},"output":{"locator":"§3, p. 8","note":"The intersection if the symmetric difference is at most \\( 2t \\), otherwise nothing","value":["threshold"]},"output_to":{"locator":"§3, p. 8","note":"Alice decrypts the numerator and computes the intersection","value":"one"},"parties":{"locator":"§3, p. 8","value":"two_party"},"security_model":{"locator":"§3, p. 8","note":"A sketch: security is argued from FHE alone, without a formal proof or random oracle","value":["standard model"]},"set_size_regime":{"locator":"§2, p. 4","value":"balanced"},"technique":{"locator":"§3, p. 8","value":["fully_homomorphic_encryption","set_reconciliation"]}},"authors":["Satrajit Ghosh","Mark Simkin"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["sublinear-in-set-size"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"polynomial_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( O(t\\log p) \\)","locator":"§3, p. 8","measure":"communication","note":"Exactly \\( (2t+1)C+\\log p \\) for ciphertexts of \\( C = O(\\log p) \\) bits: evaluations at the public points, and a random point in the clear","subject":"receiver"},{"basis":"counted","formula":"\\( O(t\\log p) \\)","locator":"§3, p. 8","measure":"communication","note":"Exactly \\( tC \\): encrypted coefficients of the numerator polynomial","subject":"sender"},{"measure":"communication","note":"Alice's FHE public and evaluation keys, which Bob needs to compute on her ciphertexts; the sketch neither names nor sizes them","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( O(nt) \\)","locator":"§3, p. 8","measure":"computation","note":"Evaluations of its set polynomial at the public points","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( O(nt) \\)","locator":"§3, p. 8","measure":"computation","note":"Evaluations of its set polynomial at the same points","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 3t+1 \\)","locator":"§3, p. 8","measure":"computation","note":"Encrypts her \\( 2t+1 \\) evaluations, then decrypts the \\( t \\) coefficients of the numerator","operation":"enc_dec","subject":"receiver"},{"measure":"computation","note":"Homomorphic rational interpolation from encrypted points, called far from practical","operation":"hom_op","subject":"sender","value":"not_reported"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2019-GS-FHE","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2019-GS"],"paper_title":"The Communication Complexity of Threshold Private Set Intersection","paper_url":"https://eprint.iacr.org/2019/175","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"keys","locator":"§3, p. 8","phase":"setup","what":"Alice's FHE public and evaluation keys, which the sketch leaves implicit"},{"from":"receiver","id":"evals","locator":"§3, p. 8","phase":"online","what":"encrypted evaluations at the 2t points and at z, with z in the clear"},{"after":["keys","evals"],"from":"sender","id":"numerator","locator":"§3, p. 8","phase":"online","what":"the encrypted coefficients of the numerator polynomial, or ⊥"}],"security_mode":"computational","security_model":"passive adversary; security follows from the security of FHE, stated without a formal proof (§3, p. 8)","security_notion":"threshold PSI","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The communication upper bound for two-party threshold PSI: the Minsky–Trachtenberg–Zippel set reconciliation protocol run under FHE. Alice sends encrypted evaluations of her root polynomial; Bob interpolates the rational function homomorphically, checks it at a random point, and returns the encrypted numerator, which encodes the elements only Alice holds.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bits of one FHE ciphertext of an element of \\( \\mathbb{F}_p \\), a constant multiple of \\( \\log p \\) by assumption","symbol":"C"}],"verification_cost":null,"work_id":"PSI-PAPER-2019-GS","year":2019},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-LOWMC-AS-A-PSEUDORANDOM-FUNCTION-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","assumption_name":"LowMC as a pseudorandom function and maliciously secure OT, without a proof","attributes":{"adversary":{"locator":"§4.5, pp. 10-11; §5.1, pp. 11-12","note":"Argued in prose, without a proof","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"§3.3, p. 5; §4.2, pp. 7-8","note":"LowMC is used as the PRF; no proof is given, and the OTs' assumptions are not named.","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"output":{"locator":"Figure 1, p. 9","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 9","note":"The client.","value":"one"},"parties":{"locator":"§3.5, p. 6","value":"two_party"},"security_model":{"note":"No proof is given.","value":"not_reported"},"set_size_regime":{"locator":"§3.5, p. 6","value":"unbalanced"},"technique":{"locator":"Figure 1, p. 9; §5.2, p. 12","value":["garbled_circuits","oprf","ot_extension","cuckoo_filter"]}},"authors":["Daniel Kales","Christian Rechberger","Thomas Schneider","Matthias Senker","Christian Weinert"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"Yao86","title":"How to Generate and Exchange Secrets (Extended Abstract)"},{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"ZRE15","title":"Two Halves Make a Whole - Reducing Data Transfer in Garbled Circuits Using Half Gates"},{"key":"BHKR13","title":"Efficient Garbling from a Fixed-Key Blockcipher"}],"count":"\\( n_Y \\)","func":"gc","id":"gc","implementation":"Yao with free-XOR, half-gates and fixed-key AES","instantiation":"gc_halfgates","locator":"Figure 1, p. 9; §5.2, p. 12","note":"One garbled LowMC circuit per precomputed item, sent offline and evaluated online","params":{"|C|":"\\( a \\)"},"phase":"offline","roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"count":"\\( \\sigma n_Y \\)","func":"cot","id":"cot","implementation":"C-OT extension of Keller, Orsini and Scholl","instantiation":"kos15_cot","locator":"Figure 1, p. 9; §4.3, p. 8; §5.1, pp. 11–12","note":"Random-choice C-OTs on the free-XOR offset, one per input bit of each precomputed item","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"CO15","title":"The Simplest Protocol for Oblivious Transfer"},{"key":"DKLs18","title":"Secure Two-party Threshold ECDSA from ECDSA Assumptions"}],"count":"\\( \\kappa \\)","func":"ot","id":"base_ot","implementation":"Chou-Orlandi OT with the verification step of Doerner et al.","instantiation":"vsot","locator":"§3.1, p. 4; §5.1, pp. 11–12","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"gc","count":"\\( n_Y \\)","func":"gc","implementation":"gc_halfgates","label":"Half-gates garbling with free XOR and fixed-key AES","locator":"Figure 1, p. 9; §5.2, p. 12","node":"","note":"One garbled LowMC circuit per precomputed item, sent offline and evaluated online","params":{"|C|":"\\( a \\)"},"phase":"offline","roles":{"evaluator":"receiver","garbler":"sender"},"source":"ZRE15"},{"block":"cot","calls":[{"block":"cot","count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"base_ot","node":""},"source":"DKLs18"},{"block":"cot","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\sigma n_Y + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver"]},"source":"KOS15"}],"count":"\\( \\sigma n_Y \\)","func":"cot","implementation":"kos15_cot","label":"KOS correlated OT extension (malicious)","locator":"Figure 1, p. 9; §4.3, p. 8; §5.1, pp. 11–12","node":"","note":"Random-choice C-OTs on the free-XOR offset, one per input bit of each precomputed item","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"KOS15"},{"block":"base_ot","calls":[{"block":"base_ot","func":"zk","implementation":"schnorr_fs","label":"Schnorr proof of knowledge of a discrete log, made non-interactive by Fiat–Shamir","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","node":"0","note":"Proof of knowledge of the discrete log of the public key B, the paper's \\( \\mathcal{F}_{\\mathsf{ZK}}^{\\mathsf{RDL}} \\); costed as Schnorr with Fiat–Shamir, sent with B","part":"ZK (discrete log of B)","phase":"setup","roles":{"prover":"receiver","verifier":"sender"},"source":"DKLs18"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"§3.1, p. 4; §5.1, pp. 11–12","node":"","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"DKLs18"}]},"capabilities":["precomputation","server-set-updates","malicious-client-security","no-online-server-cryptography","client-storage-linear-in-server-set"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"communication","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( k(3\\kappa + 2\\tau) \\)","locator":"Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( k(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"computation","operation":"exponentiation","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 6k \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 5k \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"modmul","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","ZK (discrete log of B)"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"variables":[]},"cot":{"costs":[{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( \\kappa(k + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( 0 \\)","locator":"Fig. 3, Output, p. 7","measure":"communication","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( k + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( k + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( 2(k + \\kappa + \\lambda) \\)","locator":"Fig. 3, Extend step 2, p. 7","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"cot","chain":["kos15_cot","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"cot","chain":["kos15_cot","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"cot","chain":["kos15_cot","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"cot","chain":["kos15_cot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"cot","chain":["kos15_cot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"5","open":[],"phase":"setup","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"6","open":[],"phase":"online","rounds":"4"}],"variables":[]},"gc":{"costs":[{"block":"gc","chain":["gc_halfgates"],"derived":true,"formula":"\\( 2\\kappa k|C| \\)","locator":"Fig. 2, GbAnd, p. 9","measure":"communication","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_halfgates"],"derived":true,"formula":"\\( 4k|C| \\)","locator":"Fig. 2, GbAnd, p. 9","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_halfgates"],"derived":true,"formula":"\\( 2k|C| \\)","locator":"Fig. 2, Ev, p. 9","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"evaluator"}],"counts":[],"variables":[]}},"construction_family":"oprf_cuckoo_filter_precomputation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n_X/L + n_Xv \\)","locator":"§4.1, p. 6; Figure 1, Setup Phase, p. 9","measure":"communication","note":"Compressed filter: a bitmap of the table and one tag per item.","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( \\kappa^2 \\)","locator":"§4.2, Key Schedule, p. 7; Figure 1, Base Phase, p. 9","measure":"communication","note":"The labels of its \\( \\kappa \\)-bit key, sent once for all circuits, which share one key schedule","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_Y\\kappa \\)","locator":"Figure 1, Online Phase, p. 9","measure":"communication","note":"One masked wire label per input bit.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_Y \\)","locator":"Figure 1, Online Phase, p. 9","measure":"communication","note":"One correction bit per input bit.","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 3n_X + \\rho \\)","locator":"Figure 1, Setup Phase, p. 9; §3.4, pp. 5–6","measure":"computation","note":"One LowMC evaluation per item, then a tag and a bucket hash to insert it, and one hash per alternate bucket","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y \\)","locator":"§3.4, p. 6; Figure 1, Online Phase, p. 9","measure":"computation","note":"Filter lookup: the tag hash and both bucket hashes per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["OT","the protocol's own messages"],"messages":"6","open":[],"phase":"setup","rounds":"5"},{"gloss":["C-OT","the protocol's own messages"],"messages":"7","open":[],"phase":"offline","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["OT","the protocol's own messages"],"messages":"\\mathsf{OT}[\\ldots]#base_ot + 1","open":[],"phase":"setup","rounds":"(\\mathsf{OT}[\\ldots]#base_ot \\parallel 1)"},{"gloss":["C-OT","the protocol's own messages"],"messages":"\\mathsf{C-OT}[\\ldots]#cot + 1","open":[],"phase":"offline","rounds":"\\mathsf{C-OT}[\\ldots]#cot + 1"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"gc","chain":["gc_halfgates"],"derived":true,"formula":"\\( 2\\kappa n_Ya \\)","locator":"Fig. 2, GbAnd, p. 9","measure":"communication","phase":"offline","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_halfgates"],"derived":true,"formula":"\\( 4n_Ya \\)","locator":"Fig. 2, GbAnd, p. 9","measure":"computation","operation":"symmetric_op","phase":"offline","source":"ZRE15","subject":"sender"},{"block":"gc","chain":["gc_halfgates"],"derived":true,"formula":"\\( 2n_Ya \\)","locator":"Fig. 2, Ev, p. 9","measure":"computation","operation":"symmetric_op","phase":"offline","source":"ZRE15","subject":"receiver"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( \\kappa(\\sigma n_Y + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( 0 \\)","locator":"Fig. 3, Output, p. 7","measure":"communication","phase":"offline","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","phase":"offline","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7","measure":"computation","operation":"symmetric_op","phase":"offline","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot"],"derived":true,"formula":"\\( 2(\\sigma n_Y + \\kappa + \\lambda) \\)","locator":"Fig. 3, Extend step 2, p. 7","measure":"computation","operation":"symmetric_op","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"receiver"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"sender"},{"block":"cot","chain":["kos15_cot","kos15_frand"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","operation":"exponentiation","phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","operation":"exponentiation","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","operation":"symmetric_op","phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","operation":"symmetric_op","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"modmul","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2019-KRSSW-GC","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2019-KRSSW"],"paper_title":"Mobile Private Contact Discovery at Scale","paper_url":"https://eprint.iacr.org/2019/517","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"unbalanced PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot"],"id":"base_ot","locator":"§3.1, p. 4; §5.1, pp. 11–12","phase":"setup","what":"base OTs of the OT extension"},{"from":"sender","id":"filter","locator":"Figure 1, Setup Phase, p. 9; §4.1, p. 6","phase":"setup","what":"the compressed cuckoo filter of the server's PRF values"},{"after":["base_ot"],"blocks":["cot"],"id":"cot","locator":"Figure 1, Base Phase, p. 9; §4.3, p. 8","phase":"offline","what":"random-choice C-OTs on the free-XOR offset, one per input bit of each precomputed item"},{"after":["cot"],"blocks":["gc"],"id":"gc","locator":"Figure 1, Base Phase, p. 9; §4.3, p. 8","phase":"offline","what":"one garbled LowMC circuit per precomputed item, its input labels set from the C-OT outputs; it travels in the server's base-phase flow"},{"after":["cot"],"from":"sender","id":"circuits","locator":"Figure 1, Base Phase, p. 9; §4.2, Key Schedule, p. 7","phase":"offline","what":"the labels of the server's key, sent once with the garbled circuits"},{"after":["cot"],"from":"receiver","id":"correction","locator":"Figure 1, Online Phase, p. 9; §4.3, p. 8","phase":"online","what":"correction bits, one per input bit"},{"after":["cot","correction"],"from":"sender","id":"labels","locator":"Figure 1, Online Phase, p. 9; §4.3, p. 8","phase":"online","what":"masked wire labels, one per input bit"}],"security_mode":"computational","security_model":"malicious client and semi-honest server, argued informally (§4.5, pp. 10-11)","security_notion":"PSI with output to the client, with precomputation","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Unbalanced PSI with precomputation: the server sends a compressed cuckoo filter of LowMC values of its whole set once; in a base phase it garbles LowMC circuits for the client and runs correlated OTs with it; online the client obtains its input labels with correction bits, evaluates the circuits and looks the results up in the filter.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"AND gates of the garbled PRF circuit (624 for the LowMC instance used)","symbol":"a"},{"meaning":"Tag length of the cuckoo filter","symbol":"v"},{"meaning":"Load factor of the cuckoo filter","symbol":"L"},{"meaning":"Alternate-bucket hashes while building the cuckoo filter: one each time an item's first bucket is full and one per relocated tag","symbol":"\\rho"}],"verification_cost":null,"work_id":"PSI-PAPER-2019-KRSSW","year":2019},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"group","assumption_id":"PSI-ASSUMPTION-NAOR-REINGOLD-PRF-OVER-P-256-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","assumption_name":"Naor-Reingold PRF over P-256 and maliciously secure OT, without a proof","attributes":{"adversary":{"locator":"§4.5, pp. 10-11; §5.1, pp. 11-12","note":"Argued in prose, without a proof","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"§3.3, p. 5; §4.4, p. 9","note":"The Naor-Reingold PRF over P-256; no proof is given, and no underlying assumption is named.","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"output":{"locator":"Figure 2, p. 10","value":["intersection"]},"output_to":{"locator":"Figure 2, p. 10","note":"The client.","value":"one"},"parties":{"locator":"§3.5, p. 6","value":"two_party"},"security_model":{"note":"No proof is given.","value":"not_reported"},"set_size_regime":{"locator":"§3.5, p. 6","value":"unbalanced"},"technique":{"locator":"Figure 2, p. 10; §5.3, p. 12","value":["oprf","ot_extension","cuckoo_filter"]}},"authors":["Daniel Kales","Christian Rechberger","Thomas Schneider","Matthias Senker","Christian Weinert"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"count":"\\( \\sigma n_Y \\)","func":"rot","id":"rot","implementation":"OT extension of Keller, Orsini and Scholl, in libOTe","instantiation":"kos15_rot","locator":"Figure 2, p. 10; §4.4, p. 10; §5.3, p. 12","note":"One random OT of exponents per input bit of each precomputed item; the online messages turn it into a correlated OT","params":{"\\tau":"\\( w \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"CO15","title":"The Simplest Protocol for Oblivious Transfer"},{"key":"DKLs18","title":"Secure Two-party Threshold ECDSA from ECDSA Assumptions"}],"count":"\\( \\kappa \\)","func":"ot","id":"base_ot","implementation":"Chou-Orlandi OT with the verification step of Doerner et al.","instantiation":"vsot","locator":"§3.1, p. 4; §5.1, pp. 11–12","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"rot","calls":[{"block":"rot","count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"base_ot","node":""},"source":"DKLs18"},{"block":"rot","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\sigma n_Y + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver"]},"source":"KOS15"}],"count":"\\( \\sigma n_Y \\)","func":"rot","implementation":"kos15_rot","label":"KOS random OT extension (malicious)","locator":"Figure 2, p. 10; §4.4, p. 10; §5.3, p. 12","node":"","note":"One random OT of exponents per input bit of each precomputed item; the online messages turn it into a correlated OT","params":{"\\tau":"\\( w \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"KOS15"},{"block":"base_ot","calls":[{"block":"base_ot","func":"zk","implementation":"schnorr_fs","label":"Schnorr proof of knowledge of a discrete log, made non-interactive by Fiat–Shamir","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","node":"0","note":"Proof of knowledge of the discrete log of the public key B, the paper's \\( \\mathcal{F}_{\\mathsf{ZK}}^{\\mathsf{RDL}} \\); costed as Schnorr with Fiat–Shamir, sent with B","part":"ZK (discrete log of B)","phase":"setup","roles":{"prover":"receiver","verifier":"sender"},"source":"DKLs18"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"§3.1, p. 4; §5.1, pp. 11–12","node":"","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"DKLs18"}]},"capabilities":["precomputation","server-set-updates","malicious-client-security","client-storage-linear-in-server-set"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"],"client_storage":null,"communication":null,"complexity":{"base_ot":{"costs":[{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"communication","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( k(3\\kappa + 2\\tau) \\)","locator":"Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( k(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52","measure":"computation","operation":"exponentiation","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2k \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","operation":"exponentiation","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 6k \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 5k \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","operation":"symmetric_op","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"modmul","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","ZK (discrete log of B)"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"variables":[]},"rot":{"costs":[{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( \\kappa(k + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( 0 \\)","locator":"Fig. 7, p. 10","measure":"communication","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( k + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( 3k + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( 3k + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"rot","chain":["kos15_rot","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"rot","chain":["kos15_rot","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"rot","chain":["kos15_rot","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"rot","chain":["kos15_rot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"rot","chain":["kos15_rot","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( k + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"5","open":[],"phase":"setup","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"6","open":[],"phase":"online","rounds":"4"}],"variables":[]}},"construction_family":"oprf_cuckoo_filter_precomputation","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n_X/L + n_Xv \\)","locator":"§4.1, p. 6; Figure 2, Setup Phase, p. 10","measure":"communication","note":"Compressed filter: a bitmap of the table and one tag per item.","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y(\\sigma w + |\\mathbb{G}|) \\)","locator":"Figure 2, Online Phase, p. 10","measure":"communication","note":"One masked exponent per input bit and one group element per item.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"communication","note":"One correction bit per input bit.","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 2, Setup Phase, p. 10","measure":"computation","note":"One PRF value per server item, then filter insertion.","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_X \\)","locator":"Figure 2, p. 10","measure":"computation","note":"The exponent product of the PRF key, at most one multiplication per input bit.","operation":"modmul","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X + \\rho \\)","locator":"§3.4, pp. 5–6; Figure 2, Setup Phase, p. 10","measure":"computation","note":"Filter insertion: a tag hash and a bucket hash per item, then one hash per alternate bucket","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"One group element per client item.","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2\\sigma n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"A key multiple per input bit; per item the mask product and its product with the key, plus one inversion","operation":"modmul","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"One point multiplication per item, then a filter lookup.","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( (\\sigma-1)n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"The product of the received values per item.","operation":"modmul","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 3n_Y \\)","locator":"§3.4, p. 6; Figure 2, Online Phase, p. 10","measure":"computation","note":"Filter lookup: the tag hash and both bucket hashes per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["OT","the protocol's own messages"],"messages":"6","open":[],"phase":"setup","rounds":"5"},{"gloss":["ROT"],"messages":"6","open":[],"phase":"offline","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["OT","the protocol's own messages"],"messages":"\\mathsf{OT}[\\ldots]#base_ot + 1","open":[],"phase":"setup","rounds":"(\\mathsf{OT}[\\ldots]#base_ot \\parallel 1)"},{"gloss":["ROT"],"messages":"\\mathsf{ROT}[\\ldots]#rot","open":[],"phase":"offline","rounds":"\\mathsf{ROT}[\\ldots]#rot"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( \\kappa(\\sigma n_Y + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( 0 \\)","locator":"Fig. 7, p. 10","measure":"communication","phase":"offline","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","phase":"offline","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","operation":"field_op","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( 3\\sigma n_Y + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","phase":"offline","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot"],"derived":true,"formula":"\\( 3\\sigma n_Y + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","operation":"symmetric_op","phase":"offline","source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"receiver"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"sender"},{"block":"rot","chain":["kos15_rot","kos15_frand"],"derived":true,"formula":"\\( \\sigma n_Y + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["coin toss (check weights)"],"phase":"offline","source":"KOS15","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","operation":"exponentiation","phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","operation":"exponentiation","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","operation":"symmetric_op","phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","operation":"symmetric_op","phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"modmul","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"exponentiation","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"base_ot","chain":["vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0","operation":"symmetric_op","part":["ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2019-KRSSW-NR","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2019-KRSSW"],"paper_title":"Mobile Private Contact Discovery at Scale","paper_url":"https://eprint.iacr.org/2019/517","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"unbalanced PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["base_ot"],"id":"base_ot","locator":"§3.1, p. 4; §5.1, pp. 11–12","phase":"setup","what":"base OTs of the OT extension"},{"from":"sender","id":"filter","locator":"Figure 2, Setup Phase, p. 10; §4.1, p. 6","phase":"setup","what":"the compressed cuckoo filter of the server's PRF values"},{"after":["base_ot"],"blocks":["rot"],"id":"rot","locator":"Figure 2, Base Phase, p. 10; §4.4, p. 10","phase":"offline","what":"random OTs of exponents, one per input bit of each precomputed item"},{"after":["rot"],"from":"receiver","id":"correction","locator":"Figure 2, Online Phase, p. 10; §4.4, p. 10","phase":"online","what":"correction bits, one per input bit"},{"after":["rot","correction"],"from":"sender","id":"masked","locator":"Figure 2, Online Phase, p. 10","phase":"online","what":"masked exponents, one per input bit, and one masked group element per item"}],"security_mode":"computational","security_model":"malicious client and semi-honest server, argued informally (§4.5, pp. 10-11)","security_notion":"PSI with output to the client, with precomputation","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Unbalanced PSI with precomputation from the Naor-Reingold PRF: the server sends a compressed cuckoo filter of PRF values of its whole set once, and online the client, using precomputed random OTs, receives either a mask or the mask times the key element for each input bit and one masked group element, from which it computes its PRF value to look up.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Tag length of the cuckoo filter","symbol":"v"},{"meaning":"Load factor of the cuckoo filter","symbol":"L"},{"meaning":"Bit length of an element of the exponent group \\( \\mathbb{Z}_q \\) of the PRF","symbol":"w"},{"meaning":"Alternate-bucket hashes while building the cuckoo filter: one each time an item's first bucket is full and one per relocated tag","symbol":"\\rho"}],"verification_cost":null,"work_id":"PSI-PAPER-2019-KRSSW","year":2019},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"ASM-PRF","assumption_ids":["ASM-PRF"],"assumption_name":"Pseudorandom functions","attributes":{"adversary":{"locator":"§2.2, p. 8","value":["semi_honest"]},"assumptions":{"locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"output":{"locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","value":["circuit"]},"output_to":{"locator":"Protocol 10, p. 20","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2.1, p. 8","value":"two_party"},"security_model":{"locator":"Theorem 8, p. 15; §5.1, p. 20","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§2.1, p. 8","value":"balanced"},"technique":{"locator":"Protocol 10, p. 20; §7.3, p. 25","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]}},"authors":["Benny Pinkas","Thomas Schneider","Oleksandr Tkachenko","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 2.4n \\)","func":"oprf","id":"oprf","implementation":"BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 10, step 1, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 24","note":"First phase: one one-time OPRF per bin of P1's cuckoo table, queried by P1","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 2.4n \\)","func":"oprf","id":"oprf_reversed","implementation":"BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 10, step 2, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 25","note":"Second phase, roles reversed: one per bin of P2's cuckoo table, queried by P2","roles":{"receiver":"sender","sender":"receiver"}},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"}],"func":"two_pc","id":"two_pc","implementation":"GMW","instantiation":"gmw_iknp","locator":"Protocol 10, step 3, p. 20; Functionality 1, p. 9; §7.3, pp. 24–26","note":"The matching circuit: two \\( \\gamma \\)-bit sections per bin and the stash pairs of full items; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2\\cdot 2.4n(\\lambda+\\log(2.4n)-1)+s^{2}(\\sigma-1) \\)"},"roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oprf","calls":[{"block":"oprf","calls":[{"block":"oprf","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"NP01"}],"count":"\\( w \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"PSZ18"}],"count":"\\( 2.4n \\)","func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Protocol 10, step 1, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 24","node":"","note":"First phase: one one-time OPRF per bin of P1's cuckoo table, queried by P1","phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"KKRT16"},{"block":"oprf_reversed","calls":[{"block":"oprf_reversed","calls":[{"block":"oprf_reversed","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( w \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"}],"count":"\\( 2.4n \\)","func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Protocol 10, step 2, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 25","node":"","note":"Second phase, roles reversed: one per bin of P2's cuckoo table, queried by P2","phase":"online","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"KKRT16"},{"block":"two_pc","calls":[{"block":"two_pc","calls":[{"block":"two_pc","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10; §2.2.2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"NP01"}],"count":"\\( 4.8n(\\lambda + \\log(2.4n) - 1) + s^{2}(\\sigma - 1) \\)","func":"rot","implementation":"iknp_rot","label":"IKNP random OT extension","locator":"§5.1, Algorithm 1, p. 12; §5.4, R-OT for GMW, p. 19","node":"0","note":"Two random OTs on bits per AND gate, one each way: each party is sender in k|C| of them and receiver in the other k|C|, so each bears both roles' costs once","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"PSZ18"}],"func":"two_pc","implementation":"gmw_iknp","label":"GMW with multiplication triples from random OTs by OT extension (IKNP, as in ABY)","locator":"Protocol 10, step 3, p. 20; Functionality 1, p. 9; §7.3, pp. 24–26","node":"","note":"The matching circuit: two \\( \\gamma \\)-bit sections per bin and the stash pairs of full items; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2\\cdot 2.4n(\\lambda+\\log(2.4n)-1)+s^{2}(\\sigma-1) \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"ALSZ13"}],"phase":"online","step_phase":"online"},"capabilities":["linear-communication","role-reversal-for-stash"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"client_storage":null,"communication":null,"complexity":{"oprf":{"costs":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]},"oprf_reversed":{"costs":[{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]},"two_pc":{"costs":[{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2|C| \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( |C|\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6|C| \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"\\mathrm{depth}","open":[],"phase":"online","rounds":"\\mathrm{depth}"}],"variables":[]}},"construction_family":"opprf_cuckoo_hashing_circuit_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( Bm(\\lambda+\\log(2.4n)) \\)","locator":"§7.2, p. 23; §7.3, pp. 24–25; Protocol 10, step 1, p. 20","measure":"communication","note":"P2's first-phase hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","subject":"sender"},{"basis":"counted","formula":"\\( 2s(\\lambda+\\log(2.4n)) \\)","locator":"Protocol 10, step 2, p. 20; Construction 4, p. 14; Protocol 7, step 2, p. 16","measure":"communication","note":"P1's second-phase hint: one polynomial through two points per stash slot, with \\( \\gamma \\)-bit coefficients","subject":"receiver"},{"basis":"counted","formula":"\\( O(nm) + 4.8n(2s-1) \\)","locator":"§4.3, p. 18; §7.2, p. 23; Protocol 10, step 2, p. 20","measure":"computation","note":"Interpolates the first-phase hints by Lagrange, then evaluates P1's hint, of degree \\( 2s-1 \\), in each of its bins by Horner","operation":"field_op","subject":"sender","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n."},{"basis":"counted","formula":"\\( 4.8n(m-1) + O(s^{2}) \\)","locator":"Construction 4, p. 14; Protocol 10, steps 1–2, p. 20; §7.2, p. 23","measure":"computation","note":"Evaluates its mega-bin's hint by Horner in each first-phase bin, then interpolates its own hint by Lagrange","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 12n \\)","locator":"Protocol 9, steps 1–2, p. 17; Protocol 7, step 2, p. 16; Protocol 10, p. 20","measure":"computation","note":"Its items' two bin positions, then five calls per BaRK-OPRF value at each of its \\( 2n \\) first-phase bin entries","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n + 10s \\)","locator":"Protocol 9, step 1, p. 17; Protocol 10, step 2, p. 20; Protocol 7, step 2, p. 16","measure":"computation","note":"Its items' two Cuckoo positions, then five calls per BaRK-OPRF value at the two bins of each stash slot","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["OPRF","base OT"],"messages":"8","open":[],"phase":"setup","rounds":"4"},{"gloss":["2PC"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["OPRF","the protocol's own messages","2PC"],"messages":"2\\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) + 4","open":[],"phase":"online","rounds":"\\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) + 2"}],"overview":[{"gloss":["OPRF","the protocol's own messages","2PC"],"messages":"\\mathsf{OPRF}[\\ldots]#oprf + \\mathsf{OPRF}[\\ldots]#oprf_reversed + \\mathsf{2PC}[\\ldots]#two_pc + 2","open":[],"phase":"online","rounds":"(\\mathsf{OPRF}[\\ldots]#oprf \\parallel \\mathsf{OPRF}[\\ldots]#oprf_reversed) + \\mathsf{2PC}[\\ldots]#two_pc + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2.4nw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 4.8nw/\\kappa + 12n \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2.4nw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( 2.4nw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( 4.8nw/\\kappa + 12n \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16"],"derived":true,"formula":"\\( 2.4nw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf_reversed","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2(4.8n(\\lambda + \\log(2.4n) - 1) + s^{2}(\\sigma - 1)) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2(4.8n(\\lambda + \\log(2.4n) - 1) + s^{2}(\\sigma - 1)) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( (4.8n(\\lambda + \\log(2.4n) - 1) + s^{2}(\\sigma - 1))\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( (4.8n(\\lambda + \\log(2.4n) - 1) + s^{2}(\\sigma - 1))\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6(4.8n(\\lambda + \\log(2.4n) - 1) + s^{2}(\\sigma - 1)) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6(4.8n(\\lambda + \\log(2.4n) - 1) + s^{2}(\\sigma - 1)) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2019-PSTY"],"paper_title":"Efficient Circuit-based PSI with Linear Communication","paper_url":"https://eprint.iacr.org/2019/241","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oprf","oprf_reversed"],"id":"oprf","locator":"Protocol 10, steps 1–2, p. 20; Protocol 7, step 1, p. 16","phase":"online","what":"both OPRF batches, P1 querying its cuckoo bins and, roles reversed, P2 its own; each needs only the hashed sets"},{"after":["oprf"],"from":"sender","id":"hint","locator":"Protocol 10, step 1, p. 20; Protocol 7, step 2, p. 16","phase":"online","what":"P2's first-phase hint polynomials"},{"after":["oprf"],"from":"receiver","id":"hint_reversed","locator":"Protocol 10, step 2, p. 20; Protocol 7, step 2, p. 16","phase":"online","what":"P1's second-phase hint for its stashed items"},{"after":["hint","hint_reversed"],"blocks":["two_pc"],"id":"circuit","locator":"Protocol 10, step 3, p. 20","phase":"online","what":"the circuit comparing both phases' OPPRF outputs per bin and the two stashes pairwise, then f"}],"security_mode":"computational","security_model":"semi-honest two-party; security from the OPPRF and 2PC functionalities (§5.1, p. 20); failure negligible in the statistical parameter (§5, p. 19)","security_notion":"\\( f(X \\cap Y) \\) for a symmetric function \\( f \\)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Circuit-based PSI with linear communication: a first OPPRF phase covers P1's cuckoo-table items, a second phase with roles reversed maps P1's stashed items against P2's cuckoo table, and the circuit compares only the two small stashes pairwise.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of mega-bins, each with its own hint polynomial; \\( O(n/m) \\), and \\( n/\\log n \\) asymptotically","symbol":"B"},{"meaning":"Maximum number of items in a mega-bin, the hint degree bound; \\( O(\\log n) \\) asymptotically","symbol":"m"},{"meaning":"OPPRF output length compared in the circuit, \\( \\lambda+\\log\\beta \\) for \\( \\beta = 2.4n \\) bins","symbol":"\\gamma"},{"meaning":"Stash size of the cuckoo tables","symbol":"s"}],"verification_cost":null,"work_id":"PSI-PAPER-2019-PSTY","year":2019},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"ASM-PRF","assumption_ids":["ASM-PRF"],"assumption_name":"Pseudorandom functions","attributes":{"adversary":{"locator":"§2.2, p. 8","value":["semi_honest"]},"assumptions":{"locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"output":{"locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","value":["circuit"]},"output_to":{"locator":"§4.1, pp. 16-17","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2.1, p. 8","value":"two_party"},"security_model":{"locator":"Theorem 8, p. 15; §4.1, p. 17","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§2.1, p. 8","value":"balanced"},"technique":{"locator":"Protocol 9, p. 17; §7.3, p. 24","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]}},"authors":["Benny Pinkas","Thomas Schneider","Oleksandr Tkachenko","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 2.4n \\)","func":"oprf","id":"oprf","implementation":"BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 7, step 1, p. 16; Protocol 9, step 2, p. 17; Theorem 8, p. 15; §7.3, p. 24","note":"One one-time OPRF per cuckoo bin, queried by P1","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"}],"func":"two_pc","id":"two_pc","implementation":"GMW","instantiation":"gmw_iknp","locator":"Protocol 9, step 3, p. 17; Functionality 1, p. 9; §7.3, pp. 24–26","note":"The matching circuit; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2.4n(\\lambda+\\log(2.4n)-1)+sn(\\sigma-1) \\)"},"roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oprf","calls":[{"block":"oprf","calls":[{"block":"oprf","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"NP01"}],"count":"\\( w \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"PSZ18"}],"count":"\\( 2.4n \\)","func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Protocol 7, step 1, p. 16; Protocol 9, step 2, p. 17; Theorem 8, p. 15; §7.3, p. 24","node":"","note":"One one-time OPRF per cuckoo bin, queried by P1","phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"KKRT16"},{"block":"two_pc","calls":[{"block":"two_pc","calls":[{"block":"two_pc","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10; §2.2.2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"NP01"}],"count":"\\( 2.4n(\\lambda + \\log(2.4n) - 1) + sn(\\sigma - 1) \\)","func":"rot","implementation":"iknp_rot","label":"IKNP random OT extension","locator":"§5.1, Algorithm 1, p. 12; §5.4, R-OT for GMW, p. 19","node":"0","note":"Two random OTs on bits per AND gate, one each way: each party is sender in k|C| of them and receiver in the other k|C|, so each bears both roles' costs once","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"PSZ18"}],"func":"two_pc","implementation":"gmw_iknp","label":"GMW with multiplication triples from random OTs by OT extension (IKNP, as in ABY)","locator":"Protocol 9, step 3, p. 17; Functionality 1, p. 9; §7.3, pp. 24–26","node":"","note":"The matching circuit; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2.4n(\\lambda+\\log(2.4n)-1)+sn(\\sigma-1) \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"ALSZ13"}],"phase":"online","step_phase":"online"},"capabilities":["payloads"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"client_storage":null,"communication":null,"complexity":{"oprf":{"costs":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]},"two_pc":{"costs":[{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2|C| \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( |C|\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6|C| \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"\\mathrm{depth}","open":[],"phase":"online","rounds":"\\mathrm{depth}"}],"variables":[]}},"construction_family":"opprf_cuckoo_hashing_circuit_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( Bm(\\lambda+\\log(2.4n)) \\)","locator":"§7.2, p. 23; §7.3, p. 24; Protocol 7, step 2, p. 16","measure":"communication","note":"P2's hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 7, p. 16; Protocol 9, p. 17","measure":"communication","note":"P1 sends only inside the OPRFs and the two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( O(nm) \\)","locator":"§4.3, p. 18; §7.2, p. 23","measure":"computation","note":"P2 interpolates one hint polynomial of degree at most \\( m \\) per mega-bin by Lagrange, \\( O(Bm^2) \\) for \\( B = O(n/m) \\) mega-bins","operation":"field_op","subject":"sender","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n."},{"basis":"counted","formula":"\\( 4.8n(m-1) \\)","locator":"Construction 4, p. 14; Protocol 7, step 3, p. 16; §4.3, p. 18","measure":"computation","note":"Evaluates its mega-bin's hint polynomial by Horner in each of its bins, \\( m-1 \\) multiplications each","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 12n \\)","locator":"Protocol 9, steps 1–2, p. 17; Protocol 7, step 2, p. 16; Construction 4, p. 14","measure":"computation","note":"Its items' two bin positions, then five calls per BaRK-OPRF value at each of its \\( 2n \\) bin entries to program the hints","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Protocol 9, step 1, p. 17","measure":"computation","note":"Its items' two Cuckoo positions, each computed once","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["OPRF","base OT"],"messages":"7","open":[],"phase":"setup","rounds":"4"},{"gloss":["2PC"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["OPRF","the protocol's own messages","2PC"],"messages":"2\\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) + 2","open":[],"phase":"online","rounds":"\\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) + 2"}],"overview":[{"gloss":["OPRF","the protocol's own messages","2PC"],"messages":"\\mathsf{OPRF}[\\ldots]#oprf + \\mathsf{2PC}[\\ldots]#two_pc + 1","open":[],"phase":"online","rounds":"\\mathsf{OPRF}[\\ldots]#oprf + \\mathsf{2PC}[\\ldots]#two_pc + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2.4nw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 4.8nw/\\kappa + 12n \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2.4nw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2(2.4n(\\lambda + \\log(2.4n) - 1) + sn(\\sigma - 1)) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2(2.4n(\\lambda + \\log(2.4n) - 1) + sn(\\sigma - 1)) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( (2.4n(\\lambda + \\log(2.4n) - 1) + sn(\\sigma - 1))\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( (2.4n(\\lambda + \\log(2.4n) - 1) + sn(\\sigma - 1))\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6(2.4n(\\lambda + \\log(2.4n) - 1) + sn(\\sigma - 1)) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6(2.4n(\\lambda + \\log(2.4n) - 1) + sn(\\sigma - 1)) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2019-PSTY"],"paper_title":"Efficient Circuit-based PSI with Linear Communication","paper_url":"https://eprint.iacr.org/2019/241","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oprf"],"id":"oprf","locator":"Protocol 9, step 2, p. 17; Protocol 7, step 1, p. 16","phase":"online","what":"one OPRF per cuckoo bin, queried with P1's bin entries"},{"after":["oprf"],"from":"sender","id":"hint","locator":"Protocol 7, step 2, p. 16","phase":"online","what":"P2's hint polynomials, programmed with the OPRF keys"},{"after":["hint"],"blocks":["two_pc"],"id":"circuit","locator":"Protocol 9, step 3, p. 17","phase":"online","what":"the circuit comparing the OPPRF outputs per bin and each stashed item with all of P2's, then f"}],"security_mode":"computational","security_model":"semi-honest two-party; security follows from the OPPRF and 2PC functionalities (§4.1, p. 17); fails if the stash overflows (§4.2, pp. 17-18)","security_notion":"\\( f(X \\cap Y) \\) for a symmetric function \\( f \\)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Circuit-based PSI in which P1 cuckoo-hashes into 2.4n bins and a stash, a batched OPPRF gives one value per bin to compare, and a generic two-party circuit compares each bin once and each stashed item with all of P2's items before computing f.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of mega-bins, each with its own hint polynomial; \\( O(n/m) \\), and \\( n/\\log n \\) asymptotically","symbol":"B"},{"meaning":"Maximum number of items in a mega-bin, the hint degree bound; \\( O(\\log n) \\) asymptotically","symbol":"m"},{"meaning":"OPPRF output length compared in the circuit, \\( \\lambda+\\log\\beta \\) for \\( \\beta = 2.4n \\) bins","symbol":"\\gamma"},{"meaning":"Stash size of the cuckoo table","symbol":"s"}],"verification_cost":null,"work_id":"PSI-PAPER-2019-PSTY","year":2019},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"ASM-PRF","assumption_ids":["ASM-PRF"],"assumption_name":"Pseudorandom functions","attributes":{"adversary":{"locator":"§2.2, p. 8","value":["semi_honest"]},"assumptions":{"locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"output":{"locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","value":["circuit"]},"output_to":{"locator":"§4.1, pp. 16-17; §5.2, p. 20","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2.1, p. 8","value":"two_party"},"security_model":{"locator":"Theorem 8, p. 15; §4.1, p. 17","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§2.1, p. 8","value":"balanced"},"technique":{"locator":"§5.2, pp. 20-21; §7.4, p. 27","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]}},"authors":["Benny Pinkas","Thomas Schneider","Oleksandr Tkachenko","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"PSZ18","paper":"PSI-PAPER-2018-PSZ","title":"Scalable private set intersection based on OT extension"},{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 1.27n \\)","func":"oprf","id":"oprf","implementation":"OPRF of PSZ18 in the code; costed as BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 7, step 1, p. 16; §5.2, p. 20; §7.3, p. 24; §7.4, p. 27","note":"One one-time OPRF per cuckoo bin, queried by P1","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"},{"key":"DSZ15","title":"ABY – a framework for efficient mixed-protocol secure two-party computation"}],"func":"two_pc","id":"two_pc","implementation":"GMW, in ABY","instantiation":"gmw_iknp","locator":"Protocol 9, step 3, p. 17; §5.2, p. 20; §7.3, pp. 25–26; §7.4, p. 27","note":"The matching circuit, one equality test per bin and no stash; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\log(\\lambda+\\log(1.27n)) \\)","|C|":"\\( 1.27n(\\lambda+\\log(1.27n)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oprf","calls":[{"block":"oprf","calls":[{"block":"oprf","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"NP01"}],"count":"\\( w \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","note":"IKNP extends 128 Naor-Pinkas OTs to the w base OTs","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"PSZ18"}],"count":"\\( 1.27n \\)","func":"oprf","implementation":"kkrt16","label":"BaRK-OPRF","locator":"Protocol 7, step 1, p. 16; §5.2, p. 20; §7.3, p. 24; §7.4, p. 27","node":"","note":"One one-time OPRF per cuckoo bin, queried by P1","phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"KKRT16"},{"block":"two_pc","calls":[{"block":"two_pc","calls":[{"block":"two_pc","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10; §2.2.2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"NP01"}],"count":"\\( 1.27n(\\lambda + \\log(1.27n) - 1) \\)","func":"rot","implementation":"iknp_rot","label":"IKNP random OT extension","locator":"§5.1, Algorithm 1, p. 12; §5.4, R-OT for GMW, p. 19","node":"0","note":"Two random OTs on bits per AND gate, one each way: each party is sender in k|C| of them and receiver in the other k|C|, so each bears both roles' costs once","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"PSZ18"}],"func":"two_pc","implementation":"gmw_iknp","label":"GMW with multiplication triples from random OTs by OT extension (IKNP, as in ABY)","locator":"Protocol 9, step 3, p. 17; §5.2, p. 20; §7.3, pp. 25–26; §7.4, p. 27","node":"","note":"The matching circuit, one equality test per bin and no stash; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\log(\\lambda+\\log(1.27n)) \\)","|C|":"\\( 1.27n(\\lambda+\\log(1.27n)-1) \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"ALSZ13"}],"phase":"online","step_phase":"online"},"capabilities":["linear-communication","no-stash","payloads"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"client_storage":null,"communication":null,"complexity":{"oprf":{"costs":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits, between 3κ and 4κ","symbol":"w"}]},"two_pc":{"costs":[{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2|C| \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( |C|\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6|C| \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"\\mathrm{depth}","open":[],"phase":"online","rounds":"\\mathrm{depth}"}],"variables":[]}},"construction_family":"opprf_cuckoo_hashing_circuit_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( Bm(\\lambda+\\log(1.27n)) \\)","locator":"§7.2, pp. 23-24; §7.3, p. 24; Protocol 7, step 2, p. 16","measure":"communication","note":"P2's hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 7, p. 16; §5.2, p. 20","measure":"communication","note":"P1 sends only inside the OPRFs and the two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( O(nm) \\)","locator":"§4.3, p. 18; §7.2, pp. 23-24","measure":"computation","note":"P2 interpolates one hint polynomial of degree at most \\( m \\) per mega-bin by Lagrange, \\( O(Bm^2) \\) for \\( B = O(n/m) \\) mega-bins","operation":"field_op","subject":"sender","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n."},{"basis":"counted","formula":"\\( 2.54n(m-1) \\)","locator":"Construction 4, p. 14; Protocol 7, step 3, p. 16; §5.2, p. 20","measure":"computation","note":"Evaluates its mega-bin's hint polynomial by Horner in each of its bins, \\( m-1 \\) multiplications each","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 18n \\)","locator":"§5.2, pp. 20–21; footnote 6, p. 13; Protocol 7, step 2, p. 16","measure":"computation","note":"Its items' three bin positions, then five calls per BaRK-OPRF value at each of its \\( 3n \\) bin entries to program the hints","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n \\)","locator":"§5.2, pp. 20–21","measure":"computation","note":"Its items' three Cuckoo positions, each computed once","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["OPRF","base OT"],"messages":"7","open":[],"phase":"setup","rounds":"4"},{"gloss":["2PC"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["OPRF","the protocol's own messages","2PC"],"messages":"2\\log(\\lambda+\\log(1.27n)) + 2","open":[],"phase":"online","rounds":"\\log(\\lambda+\\log(1.27n)) + 2"}],"overview":[{"gloss":["OPRF","the protocol's own messages","2PC"],"messages":"\\mathsf{OPRF}[\\ldots]#oprf + \\mathsf{2PC}[\\ldots]#two_pc + 1","open":[],"phase":"online","rounds":"\\mathsf{OPRF}[\\ldots]#oprf + \\mathsf{2PC}[\\ldots]#two_pc + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 1.27nw \\)","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 2.54nw/\\kappa + 6.35n \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"oprf","chain":["kkrt16"],"derived":true,"formula":"\\( 1.27nw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oprf","chain":["kkrt16","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2.54n(\\lambda + \\log(1.27n) - 1) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2.54n(\\lambda + \\log(1.27n) - 1) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 1.27n(\\lambda + \\log(1.27n) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 1.27n(\\lambda + \\log(1.27n) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 7.62n(\\lambda + \\log(1.27n) - 1) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 7.62n(\\lambda + \\log(1.27n) - 1) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2019-PSTY"],"paper_title":"Efficient Circuit-based PSI with Linear Communication","paper_url":"https://eprint.iacr.org/2019/241","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oprf"],"id":"oprf","locator":"§5.2, p. 20; Protocol 9, step 2, p. 17; Protocol 7, step 1, p. 16","phase":"online","what":"one OPRF per bin of P1's three-function cuckoo table, queried with its bin entries"},{"after":["oprf"],"from":"sender","id":"hint","locator":"Protocol 7, step 2, p. 16","phase":"online","what":"P2's hint polynomials, programmed with the OPRF keys"},{"after":["hint"],"blocks":["two_pc"],"id":"circuit","locator":"Protocol 9, step 3, p. 17; §5.2, p. 20","phase":"online","what":"the circuit with one equality test of OPPRF outputs per bin, then f"}],"security_mode":"computational","security_model":"semi-honest two-party; OPPRF from a PRF (Theorem 5) in the F_OPRF-hybrid model (Theorem 8); protocol security from the OPPRF and 2PC functionalities (§4.1, p. 17); hashing failure below \\( 2^{-40} \\) by the experiments of Pinkas, Schneider, and Zohner (§5.2, p. 20)","security_notion":"\\( f(X \\cap Y) \\) for a symmetric function \\( f \\)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Circuit-based PSI in which P1 cuckoo-hashes with three hash functions into 1.27n bins and no stash, a batched OPPRF from per-mega-bin hint polynomials gives one value per bin, and the circuit makes one γ-bit equality test per bin before computing f.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Number of mega-bins, each with its own hint polynomial; \\( O(n/m) \\), and \\( n/\\log n \\) asymptotically","symbol":"B"},{"meaning":"Maximum number of items in a mega-bin, the hint degree bound; at most 1,024 in the implementation, \\( O(\\log n) \\) asymptotically","symbol":"m"},{"meaning":"OPPRF output length compared in the circuit, \\( \\lambda+\\log\\beta \\) for \\( \\beta = 1.27n \\) bins","symbol":"\\gamma"}],"verification_cost":null,"work_id":"PSI-PAPER-2019-PSTY","year":2019},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-EXPONENTIAL-ELGAMAL-AND-RING-LWE-IN-THE-MEASUREMENTS","assumption_name":"CPA-secure additively homomorphic encryption (exponential ElGamal and Ring-LWE in the measurements)","attributes":{"adversary":{"locator":"§4.3.2, p. 10; Appendix F, p. 22","value":["semi_honest"]},"assumptions":{"locator":"§5.1, pp. 11-12; Appendix F, p. 22","note":"Exponential ElGamal and Ring-LWE as measured; the proof assumes any CPA-secure additively homomorphic scheme.","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"},{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"}],"value":["DDH","Ring-LWE"]},"output":{"locator":"Figure 1, p. 3; §4.3.2, p. 10","value":["cardinality","sum"]},"output_to":{"locator":"Figure 4, p. 11","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"Appendix F, p. 22","note":"Argued from the encryption scheme and negligible Bloom-filter collisions; no idealized model.","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"Figure 4, p. 11","value":["bloom_filter","additively_homomorphic_encryption"]}},"authors":["Mihaela Ion","Ben Kreuter","Ahmet Erhan Nergiz","Sarvar Patel","Shobhit Saxena","Karn Seth","Mariana Raykova","David Shanahan","Moti Yung"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["encrypted-bloom-filter"],"ciphertext_security":null,"circuit_class":null,"claim_ids":[],"client_storage":null,"communication":null,"complexity":{},"construction_family":"encrypted_bloom_filter_homomorphic_tags","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 4, Setup, p. 11","measure":"communication","note":"Its public key","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( (n(59+1.44\\log_2 n)+1)e \\)","locator":"Figure 4, steps 3 and 6, p. 11; §5.1, p. 11; Table 4, p. 12","measure":"communication","note":"\\( (b+1)e \\): one ciphertext per bit of a \\( b \\)-bit Bloom filter sized for a negligible false match over all items, then the sum","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 4, Setup, p. 11","measure":"communication","note":"Its public key","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y e \\)","locator":"Figure 4, step 5, p. 11","measure":"communication","note":"One membership ciphertext and one value ciphertext per item, before slotting.","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( b + n_Y + 1 \\)","locator":"Figure 4, steps 3 and 6, p. 11; Appendix A.4, p. 16","measure":"computation","note":"Encrypts each filter bit, decrypts each membership ciphertext, and encrypts zero to refresh the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 6, p. 11; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( kn_X \\)","locator":"Figure 4, step 2, p. 11; Appendix A.7, p. 16","measure":"computation","note":"Builds its Bloom filter: \\( k \\) hashes per item","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y + 1 \\)","locator":"Figure 4, steps 4–5 and Output, p. 11; Appendix A.4, p. 16","measure":"computation","note":"Per item an encryption of \\( k \\), a refresh and its value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y(k+2) \\)","locator":"Figure 4, steps 4–5, p. 11; Appendix A.4, p. 16","measure":"computation","note":"Per item sums its \\( k \\) filter ciphertexts, subtracts, masks by a scalar, then adds the refresh's encryption of zero","operation":"hom_op","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( kn_Y \\)","locator":"Figure 4, step 4a, p. 11","measure":"computation","note":"The \\( k \\) filter positions of each item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-ION-BF","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-ION"],"paper_title":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","paper_url":"https://eprint.iacr.org/2019/723","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"PSI cardinality and intersection-sum","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"pk1","locator":"Figure 4, Setup, p. 11","phase":"offline","what":"P1's public key"},{"from":"receiver","id":"pk2","locator":"Figure 4, Setup, p. 11","phase":"offline","what":"P2's public key, exchanged at the same time"},{"from":"sender","id":"filter","locator":"Figure 4, steps 2–3, p. 11","phase":"online","what":"the encrypted Bloom filter"},{"after":["pk1","filter"],"from":"receiver","id":"membership","locator":"Figure 4, steps 4–5, p. 11","phase":"online","what":"refreshed membership ciphertexts with the encrypted associated values"},{"after":["pk2","membership"],"from":"sender","id":"sum","locator":"Figure 4, step 6, p. 11","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security_mode":"computational","security_model":"semi-honest two-party; simulation from the intersection size and sum, given the encryption scheme and negligible Bloom-filter collisions (§4.3.2, p. 10; Appendix F)","security_notion":"private intersection-sum with cardinality","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Private intersection-sum with cardinality from an encrypted Bloom filter: P1 sends its Bloom filter encrypted bit by bit, P2 computes for each item a ciphertext that is zero exactly on a match and sends it shuffled with its encrypted value, and P1 sums the values of the zero entries.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bloom-filter length, chosen so that a false match over all items has probability at most \\( 2^{-40} \\)","symbol":"b"},{"meaning":"Size of one additively homomorphic ciphertext","symbol":"e"},{"meaning":"Number of Bloom-filter hash functions, chosen with b","symbol":"k"},{"meaning":"Size of one additively homomorphic public key","symbol":"e_{\\mathrm{pk}}"}],"verification_cost":null,"work_id":"PSI-PAPER-2020-ION","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-DDH-AND-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-RANDOM-ORACLE-MODEL-PAILLIER-WITH-DAMG-RD-JURIK-IN-DEPLOYMENT","assumption_name":"DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)","attributes":{"adversary":{"locator":"§2.3, p. 4; Theorems 1-2, p. 6","value":["semi_honest"]},"assumptions":{"locator":"§3.1, p. 5; §3.2, p. 7; Appendix D, pp. 19-20","note":"DCR through the deployed Paillier encryption; the proof assumes any CPA-secure additively homomorphic scheme.","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"},{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"}],"value":["DDH","DCR"]},"output":{"locator":"Figure 1, p. 3","value":["cardinality","sum"]},"output_to":{"locator":"Figure 2, p. 6; Theorems 1–2, p. 6","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"§3.1, p. 5; Appendix D, p. 19","note":"The hash to the group is a random oracle that the simulator programs.","value":["programmable random oracle"]},"set_size_regime":{"locator":"§2.4, p. 4","value":"balanced"},"technique":{"locator":"§3.1, p. 5","value":["diffie_hellman","additively_homomorphic_encryption"]}},"authors":["Mihaela Ion","Ben Kreuter","Ahmet Erhan Nergiz","Sarvar Patel","Shobhit Saxena","Karn Seth","Mariana Raykova","David Shanahan","Moti Yung"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["deployed","threshold-abort-variant","reverse-variant","segmented-inputs"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"diffie_hellman_homomorphic_tags","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n_X|\\mathbb{G}| + e \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"communication","note":"Its hashed and exponentiated set, then one ciphertext of the sum.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( |\\mathbb{Z}_N| \\)","locator":"Figure 2, Setup, p. 6","measure":"communication","note":"Its Paillier public key, the modulus","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( (n_X + n_Y)|\\mathbb{G}| + n_Y e \\)","locator":"Figure 2, Round 2, p. 6","measure":"communication","note":"P1's set exponentiated again, then its own items with their encrypted values, before slotting","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 3, p. 6; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 1 \\)","locator":"Figure 2, Round 3, p. 6; Appendix A.4, p. 16","measure":"computation","note":"The fresh encryption of zero that refreshes the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 2, Round 1, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y + 1 \\)","locator":"Figure 2, Round 2 and Output, p. 6","measure":"computation","note":"Encrypts each value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-ION-DDH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-ION"],"paper_title":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","paper_url":"https://eprint.iacr.org/2019/723","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"PSI cardinality and intersection-sum","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"pk","locator":"Figure 2, Setup, p. 6","phase":"offline","what":"P2's fresh public key"},{"from":"sender","id":"round1","locator":"Figure 2, Round 1, step 2, p. 6","phase":"online","what":"P1's hashed and exponentiated set"},{"after":["round1"],"from":"receiver","id":"z","locator":"Figure 2, Round 2, steps 1–2, p. 6","phase":"online","what":"P1's elements exponentiated again, the set Z"},{"from":"receiver","id":"pairs","locator":"Figure 2, Round 2, steps 3–4, p. 6","phase":"online","what":"its own exponentiated items with their encrypted values, in the same round","with":"z"},{"after":["pk","z","pairs"],"from":"sender","id":"sum","locator":"Figure 2, Round 3, step 3, p. 6","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security_mode":"computational","security_model":"semi-honest two-party; simulation-based proofs from DDH and the security of the homomorphic encryption with H as a random oracle (Theorems 1-2, p. 6; Appendix D)","security_notion":"private intersection-sum with cardinality","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Private intersection-sum with cardinality from double-exponentiated hashed Diffie-Hellman: each party exponentiates hashed identifiers with its key in shuffled order, P2 attaches Paillier encryptions of its values, and P1 sums the ciphertexts of matching items for P2 to decrypt.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Size of one additively homomorphic ciphertext (Damgård-Jurik Paillier with s = 3 in the deployment)","symbol":"e"}],"verification_cost":null,"work_id":"PSI-PAPER-2020-ION","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-DDH-AND-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-RANDOM-ORACLE-MODEL-PAILLIER-WITH-DAMG-RD-JURIK-IN-DEPLOYMENT","assumption_name":"DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)","attributes":{"adversary":{"locator":"§2.3, p. 4; Theorems 1-2, p. 6","value":["semi_honest"]},"assumptions":{"locator":"§3.1, p. 5; §5.1, p. 12; Appendix D, pp. 19-20","note":"Ring-LWE through the slotted encryption of the values; the proof assumes any CPA-secure additively homomorphic scheme.","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"},{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"}],"value":["DDH","Ring-LWE"]},"output":{"locator":"Figure 1, p. 3","value":["cardinality","sum"]},"output_to":{"locator":"Figure 2, p. 6; Theorems 1–2, p. 6","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"§3.1, p. 5; Appendix D, p. 19","note":"The hash to the group is a random oracle that the simulator programs.","value":["programmable random oracle"]},"set_size_regime":{"locator":"§2.4, p. 4","value":"balanced"},"technique":{"locator":"§3.1, p. 5; §5.1, p. 12","value":["diffie_hellman","additively_homomorphic_encryption"]}},"authors":["Mihaela Ion","Ben Kreuter","Ahmet Erhan Nergiz","Sarvar Patel","Shobhit Saxena","Karn Seth","Mariana Raykova","David Shanahan","Moti Yung"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["deployed","threshold-abort-variant","reverse-variant","segmented-inputs"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"diffie_hellman_homomorphic_tags","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( n_X|\\mathbb{G}| + 2|\\mathcal{R}_q| \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"communication","note":"Its hashed and exponentiated set, then one ciphertext of the sum.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2|\\mathcal{R}_q| \\)","locator":"Figure 2, Setup, p. 6","measure":"communication","note":"Its Ring-LWE public key, two ring elements at full width, as the paper states no encoding","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( (n_X + n_Y)|\\mathbb{G}| + 2n_Y|\\mathcal{R}_q| \\)","locator":"Figure 2, Round 2, p. 6","measure":"communication","note":"P1's set exponentiated again, then its own items with their encrypted values, before slotting","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 3, p. 6; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 1 \\)","locator":"Figure 2, Round 3, p. 6; Appendix A.4, p. 16","measure":"computation","note":"The fresh encryption of zero that refreshes the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 2, Round 1, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y + 1 \\)","locator":"Figure 2, Round 2 and Output, p. 6","measure":"computation","note":"Encrypts each value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-ION"],"paper_title":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","paper_url":"https://eprint.iacr.org/2019/723","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"PSI cardinality and intersection-sum","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"pk","locator":"Figure 2, Setup, p. 6","phase":"offline","what":"P2's fresh public key"},{"from":"sender","id":"round1","locator":"Figure 2, Round 1, step 2, p. 6","phase":"online","what":"P1's hashed and exponentiated set"},{"after":["round1"],"from":"receiver","id":"z","locator":"Figure 2, Round 2, steps 1–2, p. 6","phase":"online","what":"P1's elements exponentiated again, the set Z"},{"from":"receiver","id":"pairs","locator":"Figure 2, Round 2, steps 3–4, p. 6","phase":"online","what":"its own exponentiated items with their encrypted values, in the same round","with":"z"},{"after":["pk","z","pairs"],"from":"sender","id":"sum","locator":"Figure 2, Round 3, step 3, p. 6","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security_mode":"computational","security_model":"semi-honest two-party; simulation-based proofs from DDH and the security of the homomorphic encryption with H as a random oracle (Theorems 1-2, p. 6; Appendix D)","security_notion":"private intersection-sum with cardinality","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The deployed DDH-based intersection-sum protocol with the associated values encrypted under slotted Ring-LWE instead of Paillier, which the paper finds about 40% faster for similar communication.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2020-ION","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-BATCHED-RANDOM-OT","assumption_name":"CPA-secure additively homomorphic encryption and batched random OT","attributes":{"adversary":{"locator":"Theorems 3-4, pp. 9-10; Appendix E, p. 20","value":["semi_honest"]},"assumptions":{"locator":"§5.1, pp. 11-12; Appendix E, pp. 20-21","note":"Paillier for the OPRF values and Ring-LWE for the associated values as measured; the proof assumes any CPA-secure scheme and random OT.","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"},{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"}],"value":["DCR","Ring-LWE"]},"output":{"locator":"Figure 1, p. 3; §4.3.1, p. 9","value":["cardinality","sum"]},"output_to":{"locator":"Figure 3, p. 10","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"Appendix E, pp. 20-21","note":"No idealized model in the proof, which assumes a random-OT functionality; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"Figure 3, p. 10; §5.1, p. 11","value":["batched_oprf","ot_extension","cuckoo_hashing","additively_homomorphic_encryption"]}},"authors":["Mihaela Ion","Ben Kreuter","Ahmet Erhan Nergiz","Sarvar Patel","Shobhit Saxena","Karn Seth","Mariana Raykova","David Shanahan","Moti Yung"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 1.3n_X \\)","func":"rot","id":"rot","implementation":"Batched random OT of Kolesnikov et al.","instantiation":"kkrt16_rot","locator":"Figure 3, step 3, p. 10; Appendix A.6, p. 16; Table 3, p. 12; §5.1, p. 11","note":"One per cuckoo bin of P1, which learns its PRF value; base public-key OTs precede it","params":{"N":"\\( 2^{\\sigma} \\)","\\tau":"\\( u \\)"},"phase":"online","roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"rot","calls":[{"block":"rot","calls":[{"block":"rot","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( w \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"}],"count":"\\( 1.3n_X \\)","func":"rot","implementation":"kkrt16_rot","label":"BaRK-OPRF as batched 1-out-of-N random OT","locator":"Figure 3, step 3, p. 10; Appendix A.6, p. 16; Table 3, p. 12; §5.1, p. 11","node":"","note":"One per cuckoo bin of P1, which learns its PRF value; base public-key OTs precede it","params":{"N":"\\( 2^{\\sigma} \\)","\\tau":"\\( u \\)"},"phase":"online","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"KKRT16"}]},"capabilities":["shuffled-oprf","reverse-variant"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"client_storage":null,"communication":null,"complexity":{"rot":{"costs":[{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"sender"},{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( kw \\)","locator":"Figure 2, step 3, p. 10; §5.3, p. 12","measure":"communication","source":"KKRT16","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( 2kw/\\kappa + 5k \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( kw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16","measure":"computation","operation":"symmetric_op","source":"KKRT16","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["the protocol's own messages","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[{"meaning":"Width of the OT-extension matrix, the pseudorandom code's length (the paper's k): 424–448 bits","symbol":"w"}]}},"construction_family":"oprf_shuffle_homomorphic_tags","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 3, Setup, p. 10","measure":"communication","note":"Its public key","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 1.3n_Xe + e \\)","locator":"Figure 3, steps 4 and 7, p. 10","measure":"communication","note":"One encrypted OPRF value per bin, then the sum ciphertext","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 3, Setup, p. 10","measure":"communication","note":"Its public key","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( (1.3n_X + n_Y)e + 3n_Y u \\)","locator":"Figure 3, steps 5–6, p. 10","measure":"communication","note":"Re-masked ciphertexts per bin, then three OPRF values and one value ciphertext per item, before slotting","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2.6n_X + 1 \\)","locator":"Figure 3, steps 4 and 7, p. 10; Appendix A.4, p. 16","measure":"computation","note":"Encrypts its OPRF value in each bin, decrypts each re-masked one, and encrypts zero to refresh the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 3, step 7, p. 10; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 3n_X \\)","locator":"Figure 3, step 2, p. 10; Appendix A.8, p. 16","measure":"computation","note":"Cuckoo hashing: three bin hashes per item, kept through evictions","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2.6n_X + n_Y + 1 \\)","locator":"Figure 3, steps 5–6 and Output, p. 10; Appendix A.4, p. 16","measure":"computation","note":"Per bin a mask encryption and a refresh, per item its value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2.6n_X \\)","locator":"Figure 3, step 5, p. 10; Appendix A.4, p. 16","measure":"computation","note":"Per bin adds the mask, then the refresh's encryption of zero","operation":"hom_op","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 18n_Y \\)","locator":"Figure 3, step 6, p. 10","measure":"computation","note":"Per item three bin hashes and the OPRF at its three candidate bins, five calls each as KKRT counts them","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["ROT","base OT"],"messages":"4","open":[],"phase":"setup","rounds":"4"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["ROT","the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"offline","rounds":"1"},{"gloss":["ROT","the protocol's own messages"],"messages":"\\mathsf{ROT}[\\ldots]#rot + 4","open":[],"phase":"online","rounds":"(2 \\parallel \\mathsf{ROT}[\\ldots]#rot) + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","phase":"setup","source":"KKRT16","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( 1.3n_Xw \\)","locator":"Figure 2, step 3, p. 10; §5.3, p. 12","measure":"communication","phase":"online","source":"KKRT16","subject":"sender"},{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( 2.6n_Xw/\\kappa + 6.5n_X \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16; §3.3, p. 7","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"sender"},{"block":"rot","chain":["kkrt16_rot"],"derived":true,"formula":"\\( 1.3n_Xw/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16","measure":"computation","operation":"symmetric_op","phase":"online","source":"KKRT16","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( w\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( 2w\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp"],"derived":true,"formula":"\\( 3w \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"PSZ18","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"rot","chain":["kkrt16_rot","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["base OT","base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-ION-ROT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-ION","PSI-PAPER-2016-KKRT"],"paper_title":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","paper_url":"https://eprint.iacr.org/2019/723","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"PSI cardinality and intersection-sum","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"pk1","locator":"Figure 3, Setup, p. 10","phase":"offline","what":"P1's public key"},{"from":"receiver","id":"pk2","locator":"Figure 3, Setup, p. 10","phase":"offline","what":"P2's public key, exchanged at the same time"},{"blocks":["rot"],"id":"rot","locator":"Figure 3, steps 2–3, p. 10","phase":"online","what":"one random OT per cuckoo bin of P1, which learns its PRF values; its one flow is P1's"},{"from":"sender","id":"oprf","locator":"Figure 3, step 4, p. 10","phase":"online","what":"P1's encrypted PRF values, sent with its random-OT message"},{"after":["pk1","oprf"],"from":"receiver","id":"remask","locator":"Figure 3, step 5, p. 10","phase":"online","what":"the re-masked, refreshed PRF ciphertexts"},{"after":["rot"],"from":"receiver","id":"items","locator":"Figure 3, step 6, p. 10","phase":"online","what":"its masked PRF values per item with the encrypted associated values","with":"remask"},{"after":["pk2","remask","items"],"from":"sender","id":"sum","locator":"Figure 3, step 7, p. 10","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security_mode":"computational","security_model":"semi-honest two-party; simulation-based proofs from the encryption scheme and the random-OT functionality (Theorems 3-4, pp. 9-10; Appendix E)","security_notion":"private intersection-sum with cardinality","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Private intersection-sum with cardinality from batched random-OT OPRFs: P1 cuckoo-hashes its items, encrypts its OPRF outputs for P2 to re-mask and shuffle, and matches them against P2's masked OPRF values to sum P2's encrypted values.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Length of one OPRF value sent by P2 (a SHA-256 output as implemented)","symbol":"u"},{"meaning":"Size of one additively homomorphic ciphertext","symbol":"e"},{"meaning":"Size of one additively homomorphic public key","symbol":"e_{\\mathrm{pk}}"}],"verification_cost":null,"work_id":"PSI-PAPER-2020-ION","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"ASM-ROM","assumption_ids":["ASM-ROM"],"assumption_name":"Non-programmable random oracles, in the OOS OT-extension hybrid model","attributes":{"adversary":{"locator":"Theorem 4, p. 10; §4.4, pp. 15–16","note":"A corrupt party may use a larger set, bounded through the hash output lengths","value":["malicious"]},"assumptions":{"locator":"Theorem 4, p. 10; §7.1, p. 22","note":"No hardness assumption is named beyond the random oracles; OOS and its base OTs are taken as given","value":"not_reported"},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 6; Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"abstract, p. 1; §4.2, p. 10; Theorem 4, p. 10","note":"Proved in the OOS-hybrid model, a hybrid model, with non-programmable oracles H1 and H2","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"§4, pp. 9–11; §5, pp. 16–19","value":["paxos","ot_extension"]}},"authors":["Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","note":"One run on the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oos","calls":[{"block":"oos","count":"\\( w \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Fig. 2, Init, p. 8","node":"0","note":"OOS17 does not fix the base OT (its implementation ran SimpleOT, §6, p. 22); PRTY20 §7.1 (p. 22) uses Naor-Pinkas","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"func":"oos","implementation":"oos17","label":"OOS 1-out-of-N OT extension (malicious)","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","node":"","note":"One run on the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"OOS17"}],"phase":"online","step_phase":"online"},"capabilities":["linear-communication"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"client_storage":null,"communication":null,"complexity":{"oos":{"costs":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda) + \\lambda(n_C + \\tau) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda m \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[]}},"construction_family":"okvs_ot_extension","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2\\kappa n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, p. 15","measure":"communication","note":"One \\( H_2 \\) output per item, at the \\( 2\\kappa \\) bits recommended against a malicious sender","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 6, Decode, p. 19","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 6, p. 19","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OOS","the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["OOS","the protocol's own messages"],"messages":"\\mathsf{OOS}[\\ldots]#oos + 1","open":[],"phase":"online","rounds":"\\mathsf{OOS}[\\ldots]#oos + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w(2.4n_Y + d + 2\\lambda) + \\lambda(w + \\lambda + \\log_2(n_Xn_Y)) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda(2.4n_Y + d + \\lambda) \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2w(2.4n_Y + d + 2\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w(2.4n_Y + d + 2\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2w\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-PRTY-MAL","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-PRTY"],"paper_title":"PSI from PaXoS: Fast, Malicious Private Set Intersection","paper_url":"https://eprint.iacr.org/2020/193","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11","phase":"online","what":"the OOS run on the receiver's PaXoS, with its consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security_mode":"computational","security_model":"malicious two-party, random oracle model, OOS-hybrid (Theorem 4, p. 10; Lemmas 5-6, pp. 12-14)","security_notion":"PSI with output to the receiver; corrupt parties may use larger sets","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Malicious PaXoS-PSI: the receiver encodes (y, H1(y)) into the 2-core garbled cuckoo table and uses it as its OOS choice strings, and the sender sends H2(x, ·) of each item, so a simulator extracts both parties' sets from their oracle queries. Longer hash outputs and codes bound a corrupt party's effective set.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph, so the PaXoS has d + λ extra positions; the paper sets it to (1 + ε) log n","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2020-PRTY","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"ASM-ROM","assumption_ids":["ASM-ROM"],"assumption_name":"Non-programmable random oracles, in the OOS OT-extension hybrid model","attributes":{"adversary":{"locator":"Theorem 4, p. 10; §4.4, pp. 15–16","note":"A corrupt party may use a larger set, bounded through the hash output lengths","value":["malicious"]},"assumptions":{"locator":"Theorem 4, p. 10; §7.1, p. 22","note":"No hardness assumption is named beyond the random oracles; OOS and its base OTs are taken as given","value":"not_reported"},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"abstract, p. 1; §4.2, p. 10; Theorem 4, p. 10","note":"Proved in the OOS-hybrid model, a hybrid model, with non-programmable oracles H1 and H2","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"Appendix B, pp. 29–31; §7.1, p. 22","value":["paxos","ot_extension"]}},"authors":["Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","note":"One run on the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oos","calls":[{"block":"oos","count":"\\( w \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Fig. 2, Init, p. 8","node":"0","note":"OOS17 does not fix the base OT (its implementation ran SimpleOT, §6, p. 22); PRTY20 §7.1 (p. 22) uses Naor-Pinkas","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"func":"oos","implementation":"oos17","label":"OOS 1-out-of-N OT extension (malicious)","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","node":"","note":"One run on the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"OOS17"}],"phase":"online","step_phase":"online"},"capabilities":["linear-communication"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"client_storage":null,"communication":null,"complexity":{"oos":{"costs":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda) + \\lambda(n_C + \\tau) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda m \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[]}},"construction_family":"okvs_ot_extension","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2\\kappa n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, p. 15","measure":"communication","note":"One \\( H_2 \\) output per item, at the \\( 2\\kappa \\) bits recommended against a malicious sender","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 7, Decode, p. 30","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 7, p. 30","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OOS","the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["OOS","the protocol's own messages"],"messages":"\\mathsf{OOS}[\\ldots]#oos + 1","open":[],"phase":"online","rounds":"\\mathsf{OOS}[\\ldots]#oos + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w(2n_Y + d + 2\\lambda) + \\lambda(w + \\lambda + \\log_2(n_Xn_Y)) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda(2n_Y + d + \\lambda) \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2w(2n_Y + d + 2\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w(2n_Y + d + 2\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2w\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-PRTY"],"paper_title":"PSI from PaXoS: Fast, Malicious Private Set Intersection","paper_url":"https://eprint.iacr.org/2020/193","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11; Figure 7, p. 30","phase":"online","what":"the OOS run on the receiver's DFS PaXoS, with its consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security_mode":"computational","security_model":"malicious two-party, random oracle model, OOS-hybrid (Theorem 4, p. 10; Lemmas 5-6, pp. 12-14)","security_notion":"PSI with output to the receiver; corrupt parties may use larger sets","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Malicious PaXoS-PSI over the DFS-based garbled cuckoo table of Appendix B, with 2n main positions instead of 2.4n. It sends the least of the paper's malicious configurations.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph (the paper's σ), so the PaXoS has d + λ extra positions; at most log n + O(1)","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2020-PRTY","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-CODE-CORRELATION-ROBUST-HASH-IN-THE-OOS-OT-EXTENSION-HYBRID-MODEL","assumption_name":"Code-correlation-robust hash, in the OOS OT-extension hybrid model","attributes":{"adversary":{"locator":"§4.4, p. 15","value":["semi_honest"]},"assumptions":{"locator":"Lemma 1, p. 4; §7.1, p. 22","note":"Code correlation robustness; OOS and its base OTs are taken as given","resolved":[{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["CR hash"]},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 6; Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"Appendix D, p. 33; Theorem 4, p. 10","note":"Claimed without a separate proof; the proof given is the malicious random-oracle one, with OOS as an ideal functionality","value":["standard model"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"§4, pp. 9–11; §5, pp. 16–19","value":["paxos","ot_extension"]}},"authors":["Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17_sh","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; §4.4, p. 15; §7.1, p. 22; Table 1, p. 21","note":"One run whose choice strings are the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oos","calls":[{"block":"oos","count":"\\( w \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§2.1, p. 6","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"func":"oos","implementation":"oos17_sh","label":"OOS OT extension without the consistency check (the KK protocol with a linear code)","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; §4.4, p. 15; §7.1, p. 22; Table 1, p. 21","node":"","note":"One run whose choice strings are the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"OOS17"}],"phase":"online","step_phase":"online"},"capabilities":["linear-communication"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS"],"client_storage":null,"communication":null,"complexity":{"oos":{"costs":[{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( mn_C \\)","locator":"§2.1, p. 6","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 0 \\)","locator":"§2.1, pp. 6–7","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 2n_Cm/\\kappa \\)","locator":"§2.1, p. 6","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( n_Cm/\\kappa \\)","locator":"§2.1, pp. 6–7","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[]}},"construction_family":"okvs_ot_extension","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log_2(n_Xn_Y))n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, pp. 14–15; Lemma 6, p. 14","measure":"communication","note":"One \\( H_2 \\) output per item, at the semi-honest length, the least the proof allows","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 6, Decode, p. 19","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 6, p. 19","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OOS","the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["OOS","the protocol's own messages"],"messages":"\\mathsf{OOS}[\\ldots]#oos + 1","open":[],"phase":"online","rounds":"\\mathsf{OOS}[\\ldots]#oos + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( (2.4n_Y + d + \\lambda)w \\)","locator":"§2.1, p. 6","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 0 \\)","locator":"§2.1, pp. 6–7","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 2w(2.4n_Y + d + \\lambda)/\\kappa \\)","locator":"§2.1, p. 6","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( w(2.4n_Y + d + \\lambda)/\\kappa \\)","locator":"§2.1, pp. 6–7","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2w\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-PRTY-SH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-PRTY"],"paper_title":"PSI from PaXoS: Fast, Malicious Private Set Intersection","paper_url":"https://eprint.iacr.org/2020/193","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11; §2.1, p. 6","phase":"online","what":"the OOS run on the receiver's PaXoS, without the consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security_mode":"computational","security_model":"semi-honest two-party; standard model as stated in Appendix D (p. 33)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PSI from a PaXoS (garbled cuckoo table): the receiver encodes its items into the table and uses it as its choice strings in the OOS OT extension, whose XOR-homomorphism lets the sender evaluate each item's mask. This row uses the 2-core table with 2.4n main positions and the shortest hash outputs.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph, so the PaXoS has d + λ extra positions; the paper sets it to (1 + ε) log n","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2020-PRTY","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-CODE-CORRELATION-ROBUST-HASH-IN-THE-OOS-OT-EXTENSION-HYBRID-MODEL","assumption_name":"Code-correlation-robust hash, in the OOS OT-extension hybrid model","attributes":{"adversary":{"locator":"§4.4, p. 15","value":["semi_honest"]},"assumptions":{"locator":"Lemma 1, p. 4; §7.1, p. 22","note":"Code correlation robustness; OOS and its base OTs are taken as given","resolved":[{"id":"ASM-CR-HASH","name":"Correlation-robust hash functions (CR hash)","short":"CR hash"}],"value":["CR hash"]},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"Appendix D, p. 33; Theorem 4, p. 10","note":"Claimed without a separate proof; the proof given is the malicious random-oracle one, with OOS as an ideal functionality","value":["standard model"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"Appendix B, pp. 29–31; §7.1, p. 22","value":["paxos","ot_extension"]}},"authors":["Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17_sh","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; §4.4, p. 15; §7.1, p. 22","note":"One run whose choice strings are the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oos","calls":[{"block":"oos","count":"\\( w \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"§2.1, p. 6","node":"0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"func":"oos","implementation":"oos17_sh","label":"OOS OT extension without the consistency check (the KK protocol with a linear code)","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; §4.4, p. 15; §7.1, p. 22","node":"","note":"One run whose choice strings are the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"OOS17"}],"phase":"online","step_phase":"online"},"capabilities":["linear-communication"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS"],"client_storage":null,"communication":null,"complexity":{"oos":{"costs":[{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( mn_C \\)","locator":"§2.1, p. 6","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 0 \\)","locator":"§2.1, pp. 6–7","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 2n_Cm/\\kappa \\)","locator":"§2.1, p. 6","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( n_Cm/\\kappa \\)","locator":"§2.1, pp. 6–7","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"online","rounds":"1"}],"variables":[]}},"construction_family":"okvs_ot_extension","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log_2(n_Xn_Y))n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, pp. 14–15; Lemma 6, p. 14","measure":"communication","note":"One \\( H_2 \\) output per item, at the semi-honest length, the least the proof allows","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 7, Decode, p. 30","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 7, p. 30","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OOS","the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["OOS","the protocol's own messages"],"messages":"\\mathsf{OOS}[\\ldots]#oos + 1","open":[],"phase":"online","rounds":"\\mathsf{OOS}[\\ldots]#oos + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( (2n_Y + d + \\lambda)w \\)","locator":"§2.1, p. 6","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 0 \\)","locator":"§2.1, pp. 6–7","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( 2w(2n_Y + d + \\lambda)/\\kappa \\)","locator":"§2.1, p. 6","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17_sh"],"derived":true,"formula":"\\( w(2n_Y + d + \\lambda)/\\kappa \\)","locator":"§2.1, pp. 6–7","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2w\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17_sh","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2020-PRTY"],"paper_title":"PSI from PaXoS: Fast, Malicious Private Set Intersection","paper_url":"https://eprint.iacr.org/2020/193","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11; Figure 7, p. 30","phase":"online","what":"the OOS run on the receiver's DFS PaXoS, without the consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security_mode":"computational","security_model":"semi-honest two-party; standard model as stated in Appendix D (p. 33)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PaXoS-PSI with the alternative garbled cuckoo table of Appendix B, built by a DFS traversal that turns each cycle into one constraint on the extra positions. Its 2n main positions give the paper's lowest semi-honest communication, at a slower running time than the 2-core table.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph (the paper's σ), so the PaXoS has d + λ extra positions; at most log n + O(1)","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2020-PRTY","year":2020},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-YAO-GARBLED-CIRCUITS-NO-FURTHER-ASSUMPTION-STATED-FOR-THE-TWO-PARTY-CASE","assumption_name":"Additively homomorphic encryption and Yao garbled circuits; no further assumption stated for the two-party case","attributes":{"adversary":{"locator":"Theorem 7.1, p. 28; §1.2, p. 4","note":"The two-party case of the multiparty theorem; no separate theorem is given","value":["semi_honest"]},"assumptions":{"locator":"§2.6, p. 10; §7.1, p. 29","note":"Either, as stated, though exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts; garbling's oblivious transfers are not discussed","resolved":[{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"},{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"}],"value":["DCR","DDH"]},"output":{"locator":"§2.3, p. 6; Figure 8, p. 27","note":"The intersection if the symmetric difference has at most \\( t \\) elements, otherwise nothing","value":["threshold"]},"output_to":{"locator":"§7.1, Two-party case, p. 29; §2.3, p. 6","note":"The functionality gives every party the output; the two-party protocol has only Alice decrypt and interpolate","value":"one"},"parties":{"locator":"§1.2, p. 4","value":"two_party"},"security_model":{"locator":"§1.2, p. 4; §6.1, p. 26","note":"UC; the singularity test is an ideal functionality realized by Yao's garbled circuits","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"§6.1, p. 26; §7.1, p. 29","value":["additively_homomorphic_encryption","garbled_circuits","polynomial_sparsity_test","set_reconciliation"]}},"authors":["Saikrishna Badrinarayanan","Peihan Miao","Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"Yao86","title":"How to Generate and Exchange Secrets (Extended Abstract)"}],"func":"gc","id":"gc","implementation":"Yao's garbled circuits","instantiation":"gc_yao","locator":"§6.1, p. 26; Imported Theorem 6.3, p. 25","note":"Half-GCD singularity test of the Hankel matrix of order \\( t+1 \\); the garbler and the oblivious transfers are left open","params":{"|C|":"\\( O(t\\log^{2}t\\cdot\\mathrm{poly}(\\kappa)) \\)"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"gc","func":"gc","implementation":"gc_yao","label":"Yao's garbled circuits (classical)","locator":"§6.1, p. 26; Imported Theorem 6.3, p. 25","node":"","note":"Half-GCD singularity test of the Hankel matrix of order \\( t+1 \\); the garbler and the oblivious transfers are left open","params":{"|C|":"\\( O(t\\log^{2}t\\cdot\\mathrm{poly}(\\kappa)) \\)"},"phase":"online","source":"ZRE15"}]},"capabilities":["sublinear-in-set-size","no-fhe"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"client_storage":null,"communication":null,"complexity":{"gc":{"costs":[{"block":"gc","chain":["gc_yao"],"derived":true,"formula":"\\( 4c_E|C| \\)","locator":"§1.1, p. 2","measure":"communication","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_yao"],"derived":true,"formula":"\\( 4|C| \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"garbler"},{"block":"gc","chain":["gc_yao"],"derived":true,"formula":"\\( 4|C| \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"evaluator"}],"counts":[],"variables":[{"meaning":"Length in bits of one garbled-table ciphertext: a CPA-secure encryption of a κ-bit wire label, longer than the κ-bit rows of point-and-permute (ZRE15 §1.1)","symbol":"c_E"}]}},"construction_family":"polynomial_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (3t+4)\\gamma \\)","locator":"§7.1, p. 29","measure":"communication","note":"One encrypted combination per evaluation point","subject":"sender","tip":"Alice, who holds the decryption key and alone learns the output, is counted as receiver and Bob as sender."},{"locator":"§7.1, p. 29; §2.6, p. 10","measure":"communication","note":"Her public key; the additively homomorphic scheme, and so the size of its key, is left open","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( |\\mathbb{F}| + 2(3t+4)\\gamma \\)","locator":"Figure 8, step 1a, p. 27; §7.1, p. 29","measure":"communication","note":"The sparsity-test point u, taking Alice as P1, then encryptions of \\( p^A(x) \\) and \\( R^A_2(x) \\) at each of \\( 3t+4 \\) points","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","locator":"Figure 8, p. 27; Figure 9, p. 30","measure":"computation","note":"Hankel shares, with one power per item of exponent up to \\( p \\), and set-polynomial evaluations, then rational interpolation of degree \\( 3t+3 \\)","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 3(3t+4) \\)","locator":"§7.1, p. 29","measure":"computation","note":"Two encryptions per evaluation point, then one decryption of Bob's reply","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)) \\)","locator":"Figure 8, step 1, p. 27; §7.1, p. 29","measure":"computation","note":"Hankel shares, with one power per item of exponent up to \\( p \\), and its set and random polynomials at the points; it interpolates nothing","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4(3t+4) \\)","locator":"§7.1, p. 29","measure":"computation","note":"Per point, two scalar products of Alice's ciphertexts and two additions, one of them adding his own encrypted term","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( 3t+4 \\)","locator":"§7.1, p. 29; §2.6, p. 10","measure":"computation","note":"His own term \\( p^B(x)R^B_2(x) \\) at each point, encrypted afresh, which also refreshes the reply","operation":"enc_dec","subject":"sender"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"gc","chain":["gc_yao"],"derived":true,"formula":"\\( O(c_Et\\log^{2}t\\mathrm{poly}(\\kappa)) \\)","locator":"§1.1, p. 2","measure":"communication","source":"ZRE15","subject":"total"},{"block":"gc","chain":["gc_yao"],"derived":true,"formula":"\\( O(t\\log^{2}t\\mathrm{poly}(\\kappa)) \\)","locator":"§1.1, p. 2","measure":"computation","operation":"symmetric_op","source":"ZRE15","subject":"total"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-BMRR","PSI-PAPER-2019-GS"],"paper_title":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","paper_url":"https://eprint.iacr.org/2020/600","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"keys","locator":"§3.3, p. 13; §7.1, Two-party case, p. 29","phase":"setup","what":"Alice's public key of the additively homomorphic scheme"},{"from":"receiver","id":"u","locator":"Figure 8, step 1a, p. 27","phase":"online","what":"The random point u of the sparsity test, Alice as P1"},{"after":["u"],"blocks":["gc"],"id":"test","locator":"Figure 8, step 2, p. 27; §6.1, Two-party case, p. 26; §7.1, p. 29","phase":"online","what":"Garbled singularity test of the Hankel matrix on both parties' shares; its bit decides whether the second phase runs"},{"after":["test"],"from":"receiver","id":"enc","locator":"§7.1, Two-party case, p. 29","phase":"online","what":"Encryptions of Alice's set polynomial and second random polynomial at each of the 3t+4 points"},{"after":["keys","enc"],"from":"sender","id":"reply","locator":"§7.1, Two-party case, p. 29","phase":"online","what":"Bob's encrypted noisy combination at each point"}],"security_mode":"computational","security_model":"semi-honest; the two-party specialization is described in prose (§1.2, p. 4; §6.1, p. 26; §7.1, p. 29) rather than in a separate theorem","security_notion":"two-party threshold PSI","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The two-party case of BMRR's TAHE route, offered as the answer to the open problem of Ghosh–Simkin: the monomial encoding and sparsity test, with the Hankel singularity test done by half-GCD inside Yao's garbled circuits, then a second phase in which Bob returns encrypted noisy evaluations for Alice to decrypt and interpolate.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bits of one ciphertext of the additively homomorphic scheme","symbol":"\\gamma"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-BMRR","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"ASM-DDH","assumption_ids":["ASM-DDH","ASM-DCR","ASM-PRG"],"assumption_name":"Threshold additively homomorphic encryption with distributed setup (ElGamal under DDH or Paillier under DCR) and a PRG in \\( \\mathrm{NC}^{1} \\)","attributes":{"adversary":{"locator":"Theorem 7.1, p. 28","value":["semi_honest"]},"assumptions":{"locator":"§2.6, p. 10; §6.1, p. 26; Corollary 7.2, p. 28","note":"Threshold ElGamal or Paillier, as stated, though exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts; a PRG in NC1 for the test","resolved":[{"id":"ASM-DDH","name":"Decisional Diffie-Hellman (DDH)","short":"DDH"},{"id":"ASM-DCR","name":"Decisional composite residuosity (DCR)","short":"DCR"},{"id":"ASM-PRG","name":"Pseudorandom generators (PRG)","short":"PRG"}],"value":["DDH","DCR","PRG"]},"corruptions":{"locator":"Theorem 7.1, p. 28","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 2, p. 6; Figure 9, p. 30","note":"The intersection if the union minus the intersection has at most \\( t \\) elements","value":["threshold"]},"output_to":{"locator":"Figure 2, p. 6","value":"all"},"parties":{"locator":"§2.3, p. 6","value":"multiparty"},"security_model":{"locator":"Theorem 6.5, p. 27; Theorem 7.1, p. 28","note":"UC in a star network; the singularity and cardinality tests are hybrids, not models","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"§6, pp. 24–28; Figure 9, p. 30","value":["additively_homomorphic_encryption","garbled_circuits","polynomial_sparsity_test","set_reconciliation"]}},"authors":["Saikrishna Badrinarayanan","Peihan Miao","Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"CDN01","title":"Multiparty computation from threshold homomorphic encryption"},{"key":"DIK+08","title":"Scalable multiparty computation with nearly optimal work and resilience"},{"key":"Yao86","title":"How to generate and exchange secrets (extended abstract)"},{"key":"AIK05","title":"Computationally private randomizing polynomials and their applications"}],"func":"mpc","id":"sing_test","locator":"Figure 8, step 2, p. 27; Figure 7, p. 26; §6.1, Multi-Party Singularity Testing, pp. 25–26","note":"The paper's SingTest: half-GCD test of the summed Hankel shares over a field of over \\( \\lambda+\\log(t(t+1)(p-1)) \\) bits; any protocol, two sketched","params":{"\\ell":"\\( \\ell \\)","depth":"\\( O(t\\log^{2}t) \\)","|C|":"\\( O(t\\log^{2}t) \\)"},"roles":{"party":["leader","client"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"sing_test","func":"mpc","locator":"Figure 8, step 2, p. 27; Figure 7, p. 26; §6.1, Multi-Party Singularity Testing, pp. 25–26","node":"","note":"The paper's SingTest: half-GCD test of the summed Hankel shares over a field of over \\( \\lambda+\\log(t(t+1)(p-1)) \\) bits; any protocol, two sketched","open":true,"params":{"\\ell":"\\( \\ell \\)","depth":"\\( O(t\\log^{2}t) \\)","|C|":"\\( O(t\\log^{2}t) \\)"},"phase":"online","roles":{"party":["leader","client"]}}],"phase":"online","step_phase":"online"},"capabilities":["sublinear-in-set-size","star-network","no-fhe"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"polynomial_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\eta + (3t+4)(2\\gamma+\\delta) \\)","locator":"Figure 9, step 2, p. 30; Figure 8, p. 27; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"communication","note":"Nothing in the test outside the MPC; then its TAHE key component and per point its encrypted random term, its noisy term and a partial decryption","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(\\ell\\eta + |\\mathbb{F}| + (3t+4)(2\\gamma+\\log p)) \\)","locator":"Figure 9, step 2, p. 30; Figure 8, step 1a, p. 27; Figure 9, steps 3c, 3e and 3g, p. 30","measure":"communication","note":"To each other party: the point u, in the field of the test; then the joint TAHE key and per point three values","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 8, step 1d, p. 27","measure":"computation","note":"The power \\( u^{a} \\) of the test point for each of its items, in the field of the test","operation":"exponentiation","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n(6t+4) + O(t^{3}) \\)","locator":"Figure 8, step 1d, p. 27; Figure 9, steps 3–4, p. 30","measure":"computation","note":"Powers up to \\( 2t \\) of each \\( u^{a} \\); its randomized polynomial at \\( 3t+4 \\) points, each item tested as a root; the rest in \\( O(t^{3}) \\)","operation":"field_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 3(3t+4) \\)","locator":"Figure 9, steps 3b, 3d and 3f, p. 30","measure":"computation","note":"Per point, two encryptions and a partial decryption; none in the test outside the MPC","operation":"enc_dec","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(3t+4) \\)","locator":"Figure 9, step 3d, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 8, step 1d, p. 27","measure":"computation","note":"The power \\( u^{a} \\) of the test point for each of its items, in the field of the test","operation":"exponentiation","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n(6t+4) + O(t^{3}) \\)","locator":"Figure 8, steps 1b and 1d, p. 27; Figure 9, steps 3–4, p. 30","measure":"computation","note":"As a client, for its own set, its Hankel share then scaled by \\( \\ell-1 \\)","operation":"field_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+5)(3t+4) \\)","locator":"Figure 9, steps 3b–3g, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point: two encryptions, \\( \\ell+1 \\) refreshes, a partial decryption and the combination","operation":"enc_dec","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (4\\ell+1)(3t+4) \\)","locator":"Figure 9, steps 3c–3e, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","phase":"online","subject":"leader"}],"counts":{"exact":[{"gloss":["the protocol's own messages","MPC"],"messages":"\\mathsf{MPC}[\\ldots]#sing_test + 9","open":[],"phase":"online","rounds":"\\mathsf{MPC}[\\ldots]#sing_test + 9"}],"overview":[{"gloss":["the protocol's own messages","MPC"],"messages":"\\mathsf{MPC}[\\ldots]#sing_test + 9","open":[],"phase":"online","rounds":"\\mathsf{MPC}[\\ldots]#sing_test + 9"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-BMRR"],"paper_title":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","paper_url":"https://eprint.iacr.org/2020/600","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"leader","id":"u","locator":"Figure 8, step 1a, p. 27","phase":"online","what":"The random point u of the sparsity test"},{"after":["u"],"blocks":["sing_test"],"id":"test","locator":"Figure 8, step 2, p. 27; Figure 9, step 1, p. 30","phase":"online","what":"Singularity test of the Hankel matrix the parties hold additive shares of; similar, or different and all stop"},{"after":["test"],"from":"client","id":"tahe_pk","locator":"Figure 9, step 2, p. 30","phase":"online","what":"Each party's component of the TAHE public key, once the test says similar"},{"after":["tahe_pk"],"from":"leader","id":"tahe_key","locator":"Figure 9, step 2, p. 30","phase":"online","what":"The joint TAHE key, all components, to every other party"},{"after":["tahe_key"],"from":"client","id":"random","locator":"Figure 9, step 3b, p. 30","phase":"online","what":"Encryptions of its random polynomial R_i at the 3t+4 points"},{"after":["random"],"from":"leader","id":"others","locator":"Figure 9, step 3c, p. 30","phase":"online","what":"Per party and point, the encrypted sum of the other parties' R_j"},{"after":["others"],"from":"client","id":"noisy","locator":"Figure 9, step 3d, p. 30","phase":"online","what":"Its encrypted noisy term at each point"},{"after":["noisy"],"from":"leader","id":"total","locator":"Figure 9, step 3e, p. 30","phase":"online","what":"The encrypted sums V(x) at each point"},{"after":["total"],"from":"client","id":"vshares","locator":"Figure 9, step 3f, p. 30","phase":"online","what":"Partial decryptions of each V(x)"},{"after":["vshares"],"from":"leader","id":"values","locator":"Figure 9, step 3g, p. 30","phase":"online","what":"The decrypted V(x) at each point"}],"security_mode":"computational","security_model":"UC, semi-honest, up to \\( \\ell - 1 \\) corruptions; Theorem 6.5 in the F_SingTest-hybrid model and Theorem 7.1 in the F_CTest-diff-hybrid model (pp. 27-28)","security_notion":"multiparty threshold PSI, functionality F_TPSI-diff","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Multiparty threshold PSI for the union-minus-intersection threshold: each party encodes its set as a sum of monomials, the parties test the sparsity of a weighted difference through a Hankel matrix whose singularity is decided by half-GCD in a garbled circuit built under threshold AHE, and a second phase returns noisy evaluations from which each party interpolates its own excess elements.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bits of one ciphertext of the threshold additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of one partial decryption of the threshold additively homomorphic scheme","symbol":"\\delta"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold additively homomorphic public key","symbol":"\\eta"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-BMRR","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"lattice","assumption_id":"PSI-ASSUMPTION-THRESHOLD-FHE-WITH-DISTRIBUTED-SETUP-FROM-CIRCULAR-SECURE-LWE-WITH-THRESHOLD-ADDITIVELY-HOMOMORPHIC-ENCRYPTION","assumption_name":"Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption","attributes":{"adversary":{"locator":"Theorem 7.1, p. 28; Theorem 5.4, p. 21","value":["semi_honest"]},"assumptions":{"locator":"Imported Theorem 2.2, p. 9; Corollary 7.2, p. 28","note":"Circular-secure LWE, as the corollary names; threshold AHE may run phase two, but exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts","resolved":[{"id":"ASM-LWE","name":"Learning with errors (LWE)","short":"LWE"},{"id":"ASM-CIRCULAR-SECURITY","name":"Circular security (key-dependent message security for key cycles)","short":"key-dependent message security for key cycles"}],"value":["LWE","circular security"]},"corruptions":{"locator":"Theorem 7.1, p. 28","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 2, p. 6; Figure 9, p. 30","note":"The intersection if the union minus the intersection has at most \\( t \\) elements","value":["threshold"]},"output_to":{"locator":"Figure 2, p. 6","value":"all"},"parties":{"locator":"§2.3, p. 6","value":"multiparty"},"security_model":{"locator":"Theorem 7.1, p. 28","note":"UC in a star network; the cardinality test is a hybrid, not a model","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"Figure 6, p. 22; Figure 9, p. 30","value":["threshold_fhe","additively_homomorphic_encryption","set_reconciliation"]}},"authors":["Saikrishna Badrinarayanan","Peihan Miao","Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["sublinear-in-set-size","star-network"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"polynomial_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\eta_{\\mathrm{FHE}} + \\eta + (2t+2)\\gamma_{\\mathrm{FHE}} + \\delta_{\\mathrm{FHE}} + (3t+4)(2\\gamma+\\delta) \\)","locator":"Figure 6, step 1, p. 22; Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"communication","note":"Its TFHE key component, encrypted evaluations and a partial decryption of the predicate; then its TAHE key component and per point three ciphertexts","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(\\ell(\\eta_{\\mathrm{FHE}} + \\eta) + \\log p + \\gamma_{\\mathrm{FHE}} + 1 + (3t+4)(2\\gamma+\\log p)) \\)","locator":"Figure 6, step 1, p. 22; Figure 6, steps 2 and 5, p. 22; Figure 9, steps 3c, 3e and 3g, p. 30","measure":"communication","note":"To each other party: the joint TFHE key, z, the encrypted predicate and its bit; then the joint TAHE key and per point three values","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n(6t+7) + O(t^{3}) \\)","locator":"Figure 6, step 3, p. 22; Figure 9, steps 3–4, p. 30","measure":"computation","note":"Its set polynomial at \\( 2t+2 \\), then a randomized one at \\( 3t+4 \\) points, each item tested as a root; random terms and interpolation in \\( O(t^{3}) \\)","operation":"field_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 3(3t+4) + 2t + 3 \\)","locator":"Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"computation","note":"Under TFHE \\( 2t+2 \\) encryptions and a partial decryption; under TAHE, per point, two encryptions and a partial decryption","operation":"enc_dec","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(3t+4) \\)","locator":"Figure 9, step 3d, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n(6t+7) + O(t^{3}) \\)","locator":"Figure 6, step 3, p. 22; Figure 9, steps 3–4, p. 30","measure":"computation","note":"As a client, for its own set; the cardinality test it evaluates under TFHE","operation":"field_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+5)(3t+4) + 2t + 4 \\)","locator":"Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b–3g, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"TFHE: \\( 2t+2 \\) encryptions, a partial decryption, the combination; TAHE, per point: two encryptions, \\( \\ell+1 \\) refreshes, a share, the combination","operation":"enc_dec","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (4\\ell+1)(3t+4) \\)","locator":"Figure 9, steps 3c–3e, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"TAHE, per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","phase":"online","subject":"leader"},{"locator":"Figure 6, step 4, p. 22","measure":"computation","note":"TFHE evaluation, per other party, of the quotients, interpolation from \\( 2t+1 \\) points, the test at z and both differences' roots; then the union's size","operation":"hom_mult","phase":"online","subject":"leader","value":"not_reported"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"15","open":[],"phase":"online","rounds":"14"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"15","open":[],"phase":"online","rounds":"14"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-BMRR"],"paper_title":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","paper_url":"https://eprint.iacr.org/2020/600","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"client","id":"tfhe_pk","locator":"Figure 6, step 1, p. 22","phase":"online","what":"Each party's component of the TFHE public key"},{"after":["tfhe_pk"],"from":"leader","id":"tfhe_key","locator":"Figure 6, step 1, p. 22","phase":"online","what":"The joint TFHE key, all components, to every other party"},{"from":"leader","id":"z","locator":"Figure 6, step 2, p. 22","phase":"online","what":"The random point z"},{"after":["tfhe_key","z"],"from":"client","id":"evals","locator":"Figure 6, step 3, p. 22","phase":"online","what":"Encrypted evaluations of its set polynomial at the 2t+1 points and at z"},{"after":["evals"],"from":"leader","id":"predicate","locator":"Figure 6, steps 4–5, p. 22","phase":"online","what":"The encrypted predicate b"},{"after":["predicate"],"from":"client","id":"shares","locator":"Figure 6, step 5, p. 22","phase":"online","what":"Partial decryptions of b"},{"after":["shares"],"from":"leader","id":"verdict","locator":"Figure 6, step 5, p. 22; Figure 9, step 1, p. 30","phase":"online","what":"The decrypted b: similar, or different and all stop"},{"after":["verdict"],"from":"client","id":"tahe_pk","locator":"Figure 9, step 2, p. 30","phase":"online","what":"Each party's component of the TAHE public key, once the test says similar"},{"after":["tahe_pk"],"from":"leader","id":"tahe_key","locator":"Figure 9, step 2, p. 30","phase":"online","what":"The joint TAHE key, all components, to every other party"},{"after":["tahe_key"],"from":"client","id":"random","locator":"Figure 9, step 3b, p. 30","phase":"online","what":"Encryptions of its random polynomial R_i at the 3t+4 points"},{"after":["random"],"from":"leader","id":"others","locator":"Figure 9, step 3c, p. 30","phase":"online","what":"Per party and point, the encrypted sum of the other parties' R_j"},{"after":["others"],"from":"client","id":"noisy","locator":"Figure 9, step 3d, p. 30","phase":"online","what":"Its encrypted noisy term at each point"},{"after":["noisy"],"from":"leader","id":"total","locator":"Figure 9, step 3e, p. 30","phase":"online","what":"The encrypted sums V(x) at each point"},{"after":["total"],"from":"client","id":"vshares","locator":"Figure 9, step 3f, p. 30","phase":"online","what":"Partial decryptions of each V(x)"},{"after":["vshares"],"from":"leader","id":"values","locator":"Figure 9, step 3g, p. 30","phase":"online","what":"The decrypted V(x) at each point"}],"security_mode":"computational","security_model":"UC, semi-honest, up to \\( \\ell - 1 \\) corruptions; Theorem 7.1 in the F_CTest-diff-hybrid model, instantiated by Theorem 5.4 (pp. 21, 28)","security_notion":"multiparty threshold PSI, functionality F_TPSI-diff","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Multiparty threshold PSI for the union-minus-intersection threshold from threshold FHE: the central party homomorphically reconstructs, for each other party, the encrypted set differences with its own set and tests the size of their union; a second phase under threshold AHE returns noisy evaluations from which each party interpolates its own excess elements.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bits of one ciphertext of the threshold FHE scheme, bounded by a polynomial in the security parameter by compactness","symbol":"\\gamma_{\\mathrm{FHE}}"},{"meaning":"Bits of one partial decryption of the threshold FHE scheme","symbol":"\\delta_{\\mathrm{FHE}}"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold FHE public key","symbol":"\\eta_{\\mathrm{FHE}}"},{"meaning":"Bits of one ciphertext of the threshold additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of one partial decryption of the threshold additively homomorphic scheme","symbol":"\\delta"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold additively homomorphic public key","symbol":"\\eta"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-BMRR","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"lattice","assumption_id":"PSI-ASSUMPTION-THRESHOLD-FHE-WITH-DISTRIBUTED-SETUP-FROM-CIRCULAR-SECURE-LWE-WITH-THRESHOLD-ADDITIVELY-HOMOMORPHIC-ENCRYPTION","assumption_name":"Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption","attributes":{"adversary":{"locator":"Theorem B.1, p. 40; Theorem 5.1, p. 17","value":["semi_honest"]},"assumptions":{"locator":"Imported Theorem 2.2, p. 9; Corollary B.2, p. 40","note":"Circular-secure LWE, as the corollary names; threshold AHE may run phase two, but exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts","resolved":[{"id":"ASM-LWE","name":"Learning with errors (LWE)","short":"LWE"},{"id":"ASM-CIRCULAR-SECURITY","name":"Circular security (key-dependent message security for key cycles)","short":"key-dependent message security for key cycles"}],"value":["LWE","circular security"]},"corruptions":{"locator":"Theorem B.1, p. 40","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 1, p. 6; Figure 10, p. 41","note":"The intersection if every set exceeds it by at most \\( t \\) elements","value":["threshold"]},"output_to":{"locator":"Figure 1, p. 6","value":"all"},"parties":{"locator":"§2.3, p. 6","value":"multiparty"},"security_model":{"locator":"Theorem B.1, p. 40","note":"UC in a star network; the cardinality test is a hybrid, not a model","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"Figure 5, p. 18; Figure 10, p. 41","value":["threshold_fhe","additively_homomorphic_encryption","set_reconciliation"]}},"authors":["Saikrishna Badrinarayanan","Peihan Miao","Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["sublinear-in-set-size","star-network"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"polynomial_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\eta_{\\mathrm{FHE}} + \\eta + (2t+4)\\gamma_{\\mathrm{FHE}} + \\delta_{\\mathrm{FHE}} + (3t+4)(2\\gamma+\\delta) \\)","locator":"Figure 5, step 1, p. 18; Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b, 3d and 3f, p. 41","measure":"communication","note":"Its TFHE key component, encrypted evaluations and a partial decryption of the predicate; then its TAHE key component and per point three ciphertexts","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(\\ell(\\eta_{\\mathrm{FHE}} + \\eta) + \\log p + \\gamma_{\\mathrm{FHE}} + 1 + (3t+4)(2\\gamma+\\log p)) \\)","locator":"Figure 5, step 1, p. 18; Figure 5, steps 2 and 5, p. 18; Figure 10, steps 3c, 3e and 3g, p. 41","measure":"communication","note":"To each other party: the joint TFHE key, z, the encrypted predicate and its bit; then the joint TAHE key and per point three values","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n(6t+9) + O(t^{3}) \\)","locator":"Figure 5, step 3, p. 18; Figure 10, steps 3–4, p. 41","measure":"computation","note":"Its randomized polynomial at \\( 2t+4 \\), then a new one at \\( 3t+4 \\) points, each item tested as a root; random terms and interpolation in \\( O(t^{3}) \\)","operation":"field_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 3(3t+4) + 2t + 5 \\)","locator":"Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b, 3d and 3f, p. 41","measure":"computation","note":"Under TFHE \\( 2t+4 \\) encryptions and a partial decryption; under TAHE, per point, two encryptions and a partial decryption","operation":"enc_dec","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(3t+4) \\)","locator":"Figure 10, step 3d, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n(6t+9) + O(t^{3}) \\)","locator":"Figure 5, step 3, p. 18; Figure 10, steps 3–4, p. 41","measure":"computation","note":"As a client, for its own set; the cardinality test it evaluates under TFHE","operation":"field_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+5)(3t+4) + 2t + 6 \\)","locator":"Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b–3g, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","note":"TFHE: \\( 2t+4 \\) encryptions, a partial decryption, the combination; TAHE, per point: two encryptions, \\( \\ell+1 \\) refreshes, a share, the combination","operation":"enc_dec","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (4\\ell+1)(3t+4) \\)","locator":"Figure 10, steps 3c–3e, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","note":"TAHE, per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","phase":"online","subject":"leader"},{"locator":"Figure 5, step 4, p. 18","measure":"computation","note":"The TFHE evaluation of the quotients, a rational interpolation from \\( 2t+3 \\) points and the test at z; the paper gives no circuit","operation":"hom_mult","phase":"online","subject":"leader","value":"not_reported"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"15","open":[],"phase":"online","rounds":"14"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"15","open":[],"phase":"online","rounds":"14"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-BMRR"],"paper_title":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","paper_url":"https://eprint.iacr.org/2020/600","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"client","id":"tfhe_pk","locator":"Figure 5, step 1, p. 18","phase":"online","what":"Each party's component of the TFHE public key"},{"after":["tfhe_pk"],"from":"leader","id":"tfhe_key","locator":"Figure 5, step 1, p. 18","phase":"online","what":"The joint TFHE key, all components, to every other party"},{"from":"leader","id":"z","locator":"Figure 5, step 2, p. 18","phase":"online","what":"The random point z"},{"after":["tfhe_key","z"],"from":"client","id":"evals","locator":"Figure 5, step 3, p. 18","phase":"online","what":"Encrypted evaluations of its randomized polynomial at the 2t+3 points and at z"},{"after":["evals"],"from":"leader","id":"predicate","locator":"Figure 5, steps 4–5, p. 18","phase":"online","what":"The encrypted predicate b"},{"after":["predicate"],"from":"client","id":"shares","locator":"Figure 5, step 5, p. 18","phase":"online","what":"Partial decryptions of b"},{"after":["shares"],"from":"leader","id":"verdict","locator":"Figure 5, step 5, p. 18; Figure 10, step 1, p. 41","phase":"online","what":"The decrypted b: similar, or different and all stop"},{"after":["verdict"],"from":"client","id":"tahe_pk","locator":"Figure 10, step 2, p. 41","phase":"online","what":"Each party's component of the TAHE public key, once the test says similar"},{"after":["tahe_pk"],"from":"leader","id":"tahe_key","locator":"Figure 10, step 2, p. 41","phase":"online","what":"The joint TAHE key, all components, to every other party"},{"after":["tahe_key"],"from":"client","id":"random","locator":"Figure 10, step 3b, p. 41","phase":"online","what":"Encryptions of its random polynomial R_i at the 3t+4 points"},{"after":["random"],"from":"leader","id":"others","locator":"Figure 10, step 3c, p. 41","phase":"online","what":"Per party and point, the encrypted sum of the other parties' R_j"},{"after":["others"],"from":"client","id":"noisy","locator":"Figure 10, step 3d, p. 41","phase":"online","what":"Its encrypted noisy term at each point"},{"after":["noisy"],"from":"leader","id":"total","locator":"Figure 10, step 3e, p. 41","phase":"online","what":"The encrypted sums V(x) at each point"},{"after":["total"],"from":"client","id":"vshares","locator":"Figure 10, step 3f, p. 41","phase":"online","what":"Partial decryptions of each V(x)"},{"after":["vshares"],"from":"leader","id":"values","locator":"Figure 10, step 3g, p. 41","phase":"online","what":"The decrypted V(x) at each point"}],"security_mode":"computational","security_model":"UC, semi-honest, up to \\( \\ell - 1 \\) corruptions; Theorem B.1 in the F_CTest-int-hybrid model, instantiated by Theorem 5.1 (pp. 17, 40)","security_notion":"multiparty threshold PSI, functionality F_TPSI-int","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Multiparty threshold PSI for the per-set threshold from threshold FHE: each party sends encrypted evaluations of its randomized root polynomial, the central party homomorphically interpolates one rational function and tests it at a random point, and the shared second phase under threshold AHE lets each party interpolate its own excess elements.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bits of one ciphertext of the threshold FHE scheme, bounded by a polynomial in the security parameter by compactness","symbol":"\\gamma_{\\mathrm{FHE}}"},{"meaning":"Bits of one partial decryption of the threshold FHE scheme","symbol":"\\delta_{\\mathrm{FHE}}"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold FHE public key","symbol":"\\eta_{\\mathrm{FHE}}"},{"meaning":"Bits of one ciphertext of the threshold additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of one partial decryption of the threshold additively homomorphic scheme","symbol":"\\delta"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold additively homomorphic public key","symbol":"\\eta"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-BMRR","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"mixed","assumption_id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","assumption_name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)","attributes":{"adversary":{"locator":"§3, p. 6","note":"The earlier labeled-PSI proof carries over unchanged","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"§2.3, pp. 4–5; §3.1, p. 12","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","resolved":[{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"},{"id":"ASM-OMGDH","name":"One-more gap Diffie-Hellman (One-More-Gap-DH)","short":"One-More-Gap-DH"}],"value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"§2.2, p. 4; §3, p. 5","value":["intersection"]},"output_to":{"locator":"§2.2, p. 4","value":"one"},"parties":{"locator":"§2.2, p. 4","value":"two_party"},"security_model":{"locator":"§3, p. 6; §3.1, p. 12","note":"Hash to the FourQ curve and OPRF output hash","value":["random oracle"]},"set_size_regime":{"locator":"§1, p. 1; §2.2, p. 4","value":"unbalanced"},"technique":{"locator":"§3, pp. 5–6; §3.1, pp. 6–12","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"authors":["Kelong Cong","Radames Cruz Moreno","Mariana Botelho da Gama","Wei Dai","Ilia Iliashenko","Kim Laine","Michael Rosenberg"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["communication-sublinear-in-larger-set","square-root-homomorphic-multiplications","updatable-sender-preprocessing","malicious-receiver-security"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"locator":"§2.3, p. 5; §3, p. 6","measure":"communication","note":"Evaluation keys for the key switching of every multiplication; the receiver alone holds the secret key, so it sends them once. Their size is not given","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3, p. 6; §3.1, pp. 9–11; §5, p. 15","measure":"communication","note":"Blinded OPRF queries on FourQ, then the encrypted source powers of each batch","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3.1, p. 7","measure":"communication","note":"OPRF answers, then one result per partition and batch","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§3, p. 6; §3.1, p. 12","measure":"computation","note":"OPRF on its own set: hash to the curve and one scalar multiplication per item; updatable","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O(mB^{2}/\\alpha) \\)","locator":"§3, p. 6; §4.2, p. 13","measure":"computation","note":"Coefficients of each partition's intersection polynomial over prime-field slots","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three, as simple hashing uses them all","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}\\left(L_\\alpha+(\\alpha+1)H_\\alpha-\\alpha-2-s\\right) \\)","locator":"§3.1, pp. 8 and 10","measure":"computation","note":"Paterson–Stockmeyer per batch: a product per low or high power that is not a source power, then one per high power and partition","operation":"hom_mult","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}(2L_\\alpha H_\\alpha-1) \\)","locator":"§3.1, p. 8","measure":"computation","note":"A plaintext product per coefficient in the inner sums, and the additions of the inner and outer sums, per partition and batch","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§3, p. 6","measure":"computation","note":"Blinding and unblinding each OPRF query","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( (s+\\alpha)\\frac{m}{k} \\)","locator":"§3, p. 6; §3.1, p. 7","measure":"computation","note":"BFV encryptions of the source powers and decryptions of the results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three; re-insertions, unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-CONG","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-CONG","PSI-PAPER-2018-CHLR","PSI-PAPER-2017-CLR"],"paper_title":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","paper_url":"https://eprint.iacr.org/2021/1116","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"unbalanced PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"keys","locator":"§3, p. 6; §2.3, p. 5","phase":"setup","what":"Evaluation keys for the key switching of every product, sent once"},{"from":"receiver","id":"oprf_query","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"Blinded OPRF queries on FourQ, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_answer"],"from":"receiver","id":"query","locator":"§3, p. 6; §3.1, pp. 9–11","phase":"online","what":"Encrypted source powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"§3, p. 6; §3.1, p. 7","phase":"online","what":"One result per partition and batch, modulus-switched"}],"security_mode":"computational","security_model":"as in the earlier labeled-PSI paper's Theorem 1: malicious receiver; privacy against a malicious sender (§3, p. 6)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The CHLR18 protocol with a mandatory OPRF, items split over prime-field SIMD slots instead of extension fields, Paterson–Stockmeyer evaluation of each partition's intersection polynomial, and query powers chosen by extremal postage-stamp bases. Online computation drops to \\( O(\\sqrt{n_X}) \\) homomorphic multiplications.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo hash table bins (the paper's \\( M \\)), \\( O(n_Y) \\)","symbol":"m"},{"meaning":"Cuckoo bins per BFV ciphertext: slots over the slots an item spans","symbol":"k"},{"meaning":"Largest sender bin size","symbol":"B"},{"meaning":"Partitions of each sender bin","symbol":"\\alpha"},{"meaning":"Encrypted source powers per batch, from windowing or an extremal postage-stamp basis for the target depth","symbol":"s"},{"meaning":"Paterson–Stockmeyer low powers per partition polynomial","symbol":"L_\\alpha"},{"meaning":"Paterson–Stockmeyer high powers per partition polynomial","symbol":"H_\\alpha"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-CONG","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"mixed","assumption_id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BGV","assumption_name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BGV)","attributes":{"adversary":{"locator":"§3, p. 6; §5, p. 15","note":"The protocol keeps the OPRF; the measured proof of concept omits it","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"§2.3, pp. 4–5; §3.1, p. 12","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","resolved":[{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"},{"id":"ASM-OMGDH","name":"One-more gap Diffie-Hellman (One-More-Gap-DH)","short":"One-More-Gap-DH"}],"value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"§3, p. 5","value":["intersection"]},"output_to":{"locator":"§2.2, p. 4","value":"one"},"parties":{"locator":"§2.2, p. 4","value":"two_party"},"security_model":{"locator":"§3, p. 6","value":["random oracle"]},"set_size_regime":{"locator":"§5.4, p. 18","value":"unbalanced"},"technique":{"locator":"§3.1, pp. 11–12; §5.4, p. 18","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"authors":["Kelong Cong","Radames Cruz Moreno","Mariana Botelho da Gama","Wei Dai","Ilia Iliashenko","Kim Laine","Michael Rosenberg"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["communication-nearly-constant-in-larger-set","cacheable-evaluation-keys"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\lfloor \\log_p B \\rfloor + 1)K \\)","locator":"§3.1, p. 12; §2.3, p. 5; Table 8, p. 27","measure":"communication","note":"Frobenius keys and the relinearization key, independent of the receiver set and cacheable; one Frobenius key suffices at extra cost","per":"client","phase":"setup","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3.1, p. 11; §1.2, p. 3","measure":"communication","note":"A constant number of source powers per batch; ring elements grow as the square of the depth, of order log log of the sender set","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§5.4, p. 18","measure":"communication","note":"No partitioning, so one result per batch","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O(mB^{2}) \\)","locator":"§3, p. 6; §5.4, p. 18","measure":"computation","note":"Coefficients of each bin's intersection polynomial","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three, as simple hashing uses them all","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O\\left(\\frac{m}{k}\\sqrt{B}\\right) \\)","locator":"§3.1, pp. 8 and 11–12","measure":"computation","note":"Paterson–Stockmeyer per batch; depth-free Frobenius operations replace many of the power products","operation":"hom_mult","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O\\left(\\frac{m}{k}B\\right) \\)","locator":"§3.1, pp. 8 and 11–12; Lemma 2, p. 12","measure":"computation","note":"Plaintext products and additions of the Paterson–Stockmeyer sums, and the Frobenius operations that give powers","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( (s+1)\\frac{m}{k} \\)","locator":"§3.1, p. 11","measure":"computation","note":"BGV encryptions of the source powers and decryptions of the results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three; re-insertions, unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-CONG"],"paper_title":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","paper_url":"https://eprint.iacr.org/2021/1116","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"unbalanced PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"keys","locator":"§3.1, p. 12; §5.4, p. 19","phase":"setup","what":"Frobenius keys and the relinearization key, cached by the sender"},{"from":"receiver","id":"oprf_query","locator":"§3, p. 6; §5, p. 15","phase":"online","what":"Blinded OPRF queries on FourQ, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"§3, p. 6; §5, p. 15","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_answer"],"from":"receiver","id":"query","locator":"§3.1, p. 11; §5.4, p. 18","phase":"online","what":"A constant number of encrypted source powers per batch"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"§5.4, p. 18","phase":"online","what":"One result per batch, without partitioning"}],"security_mode":"computational","security_model":"as in the SEAL protocol (§3, p. 6); the measured implementation omits the OPRF (§5, p. 15)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"A low-communication configuration of CMGD21 over HElib BGV: with a small plaintext prime, the sender obtains most powers of the receiver's query by depth-free Frobenius operations, so a constant number of encrypted powers supports depth \\( O(\\log\\log n_X) \\), and communication is \\( \\tilde O(\\log^{2}\\log n_X) \\) in the sender set.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo hash table bins (the paper's \\( M \\)), \\( O(n_Y) \\)","symbol":"m"},{"meaning":"Cuckoo bins per BGV ciphertext: slots over the slots an item spans","symbol":"k"},{"meaning":"Largest sender bin size, the degree of its intersection polynomial","symbol":"B"},{"meaning":"Encrypted source powers per batch, a constant for depth of order \\( \\log\\log B \\)","symbol":"s"},{"meaning":"Size of one key-switching key: a Frobenius key or the relinearization key","symbol":"K"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-CONG","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"mixed","assumption_id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","assumption_name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)","attributes":{"adversary":{"locator":"§4.2, p. 14; §3, p. 6","note":"The labeled proof is sketched as a direct extension of the unlabeled one","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"§2.3, pp. 4–5; §4.2, p. 13","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","resolved":[{"id":"ASM-RLWE","name":"Ring learning with errors (Ring-LWE)","short":"Ring-LWE"},{"id":"ASM-OMGDH","name":"One-more gap Diffie-Hellman (One-More-Gap-DH)","short":"One-More-Gap-DH"}],"value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"§2.2, p. 4; §4.2, p. 14","value":["labeled"]},"output_to":{"locator":"§2.2, p. 4","value":"one"},"parties":{"locator":"§2.2, p. 4","value":"two_party"},"security_model":{"locator":"§4.2, p. 14","value":["random oracle"]},"set_size_regime":{"locator":"§2.2, p. 4","value":"unbalanced"},"technique":{"locator":"§3.1, pp. 6–12; §4.2, pp. 13–14","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"authors":["Kelong Cong","Radames Cruz Moreno","Mariana Botelho da Gama","Wei Dai","Ilia Iliashenko","Kim Laine","Michael Rosenberg"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[]},"capabilities":["labels-for-matching-items","communication-sublinear-in-larger-set","updatable-labels"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2018-CHLR-LABELED-PSI"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","correctness":null,"corruption_model":null,"costs":[{"locator":"§2.3, p. 5; §3, p. 6","measure":"communication","note":"Evaluation keys for the key switching of every multiplication; the receiver alone holds the secret key, so it sends them once. Their size is not given","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§5.3, p. 18","measure":"communication","note":"As unlabeled; label length does not change the query","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (1+c)\\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.2, p. 14; §5.3, p. 18","measure":"communication","note":"Intersection results plus one result per item-length label fragment","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O((1+c)mB^{2}/\\alpha) \\)","locator":"§4.2, p. 13; §3, p. 6","measure":"computation","note":"Each partition's intersection polynomial and an interpolation per label fragment, \\( O(B^2) \\) in the partition size \\( B \\); updatable","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 6n_X \\)","locator":"§3, pp. 5–6; §3.1, p. 12; §4.2, p. 13","measure":"computation","note":"As unlabeled, five per item, plus one symmetric encryption of each label under a key taken from the extended OPRF value","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}\\left(L_\\alpha+H_\\alpha-2-s+(1+c)\\alpha(H_\\alpha-1)\\right) \\)","locator":"§3.1, p. 8; §4.2, p. 14; §5.3, p. 18","measure":"computation","note":"Low and high powers that are not source powers, once per batch, then a product per high power for each intersection and label polynomial","operation":"hom_mult","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( (1+c)\\alpha\\frac{m}{k}(2L_\\alpha H_\\alpha-1) \\)","locator":"§3.1, p. 8; §4.2, p. 14","measure":"computation","note":"A plaintext product per coefficient and the additions of the sums, for the intersection polynomial and each label fragment","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left(s+(1+c)\\alpha\\right)\\frac{m}{k} \\)","locator":"§4.2, p. 14","measure":"computation","note":"BFV encryptions of the source powers and decryptions of all results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 6n_Y \\)","locator":"§3, pp. 5–6; §3.1, p. 12; §4.2, pp. 13–14","measure":"computation","note":"As unlabeled, five per item, plus decrypting the label of each item in the intersection, counted for every item; cuckoo re-insertions add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-CONG-LABELED","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-CONG","PSI-PAPER-2018-CHLR"],"paper_title":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","paper_url":"https://eprint.iacr.org/2021/1116","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"labeled PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"keys","locator":"§3, p. 6; §2.3, p. 5","phase":"setup","what":"Evaluation keys for the key switching of every product, sent once"},{"from":"receiver","id":"oprf_query","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"Blinded OPRF queries on FourQ, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_answer"],"from":"receiver","id":"query","locator":"§3, p. 6; §5.3, p. 18","phase":"online","what":"Encrypted source powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"§3, p. 6; §4.2, p. 14","phase":"online","what":"Intersection results, one per partition and batch"},{"from":"sender","id":"labels","locator":"§4.2, p. 14","phase":"online","what":"Label results, one per fragment, partition and batch, returned beside the intersection results","with":"reply"}],"security_mode":"computational","security_model":"proof sketch extending the earlier unlabeled proof (§4.2, p. 14)","security_notion":"labeled PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Labeled PSI over prime-field slots: each label is encrypted under a key from the extended OPRF output, split into item-length fragments, and interpolated fragment by fragment per bin and partition. The sender evaluates these polynomials with Paterson–Stockmeyer on the same query powers as the intersection polynomials.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo hash table bins (the paper's \\( M \\)), \\( O(n_Y) \\)","symbol":"m"},{"meaning":"Cuckoo bins per BFV ciphertext: slots over the slots an item spans","symbol":"k"},{"meaning":"Largest sender bin size","symbol":"B"},{"meaning":"Partitions of each sender bin","symbol":"\\alpha"},{"meaning":"Encrypted source powers per batch, from windowing or an extremal postage-stamp basis","symbol":"s"},{"meaning":"Paterson–Stockmeyer low powers per partition polynomial","symbol":"L_\\alpha"},{"meaning":"Paterson–Stockmeyer high powers per partition polynomial","symbol":"H_\\alpha"},{"meaning":"Item-length fragments of an encrypted label with its nonce","symbol":"c"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-CONG","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"ASM-ROM","assumption_ids":["ASM-ROM"],"assumption_name":"Random oracles, in the OOS OT-extension hybrid model","attributes":{"adversary":{"locator":"§6.3, p. 19","note":"Via the PaXoS-PSI proofs, written for any binary OKVS; corrupt parties may use larger sets","value":["malicious"]},"assumptions":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"None beyond the random oracle in the OOS OT-extension hybrid; instantiating OOS needs base OTs, whose assumption is not named","source":"PSI-PAPER-2020-PRTY","value":"not_reported"},"output":{"locator":"§6.3, p. 19; PRTY20 Figure 3","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"The receiver","source":"PSI-PAPER-2020-PRTY","value":"one"},"parties":{"locator":"§6.3, p. 19","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"The OOS hybrid of the proof is not a model","source":"PSI-PAPER-2020-PRTY","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","source":"PSI-PAPER-2020-PRTY","value":"balanced"},"technique":{"locator":"§4.1, pp. 9-11; §6.3, p. 19","value":["okvs","ot_extension"]}},"authors":["Gayathri Garimella","Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"func":"oos","id":"oos","implementation":"OOS malicious OT extension","instantiation":"oos17","locator":"§4.1, pp. 10–11; §6.3, p. 19; §8.1, p. 23; PRTY20 Figure 3, step 2, p. 11","note":"One run on the receiver's three-hash table, one instance per position; \\( \\tau \\), the output length of \\( H_1 \\), is set as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( 1.3n+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oos","calls":[{"block":"oos","count":"\\( w \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Fig. 2, Init, p. 8","node":"0","note":"OOS17 does not fix the base OT (its implementation ran SimpleOT, §6, p. 22); PRTY20 §7.1 (p. 22) uses Naor-Pinkas","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"func":"oos","implementation":"oos17","label":"OOS 1-out-of-N OT extension (malicious)","locator":"§4.1, pp. 10–11; §6.3, p. 19; §8.1, p. 23; PRTY20 Figure 3, step 2, p. 11","node":"","note":"One run on the receiver's three-hash table, one instance per position; \\( \\tau \\), the output length of \\( H_1 \\), is set as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( 1.3n+d+\\lambda \\)","n_C":"\\( w \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"OOS17"}],"phase":"online","step_phase":"online"},"capabilities":["heuristic-error-analysis"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-GPRTY-3H-GCT","PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI"],"client_storage":null,"communication":null,"complexity":{"oos":{"costs":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda) + \\lambda(n_C + \\tau) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda m \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[]}},"construction_family":"okvs_ot_extension","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2\\kappa n \\)","locator":"PRTY20 Figure 3, step 3, p. 11; PRTY20 §4.4, p. 15; Theorem 7, p. 21; Figure 4, p. 23","measure":"communication","note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item, as for malicious security","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its table","source":"PSI-PAPER-2020-PRTY","subject":"receiver"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§4.1, pp. 9–11; Figure 2, p. 12; PRTY20 Figure 3, step 3, p. 11","measure":"computation","note":"Per item: the table's hyperedge hash and \\( r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§4.1, pp. 9–11; Figure 2, p. 12; PRTY20 Figure 3, steps 1 and 4, p. 11","measure":"computation","note":"Per item: the hyperedge hash and \\( r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OOS","the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["OOS","the protocol's own messages"],"messages":"\\mathsf{OOS}[\\ldots]#oos + 1","open":[],"phase":"online","rounds":"\\mathsf{OOS}[\\ldots]#oos + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w(1.3n + d + 2\\lambda) + \\lambda(w + \\lambda + 2\\log n) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda(1.3n + d + \\lambda) \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2w(1.3n + d + 2\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w(1.3n + d + 2\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2w\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-GPRTY","PSI-PAPER-2020-PRTY"],"paper_title":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","paper_url":"https://eprint.iacr.org/2021/883","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oos"],"id":"oos","locator":"§6.3, p. 19; PRTY20 Figure 3, steps 1–2, p. 11","phase":"online","what":"the OOS run on the receiver's three-hash garbled cuckoo table"},{"after":["oos"],"from":"sender","id":"masks","locator":"PRTY20 Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security_mode":"computational","security_model":"malicious two-party, random oracle model, OOS-hybrid, via the PaXoS-PSI proofs (§6.3, p. 19)","security_notion":"PSI with output to the receiver; corrupt parties may use larger sets","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PaXoS-PSI with its binary OKVS replaced by a three-hash garbled cuckoo table of about \\( 1.3n \\) slots. The receiver encodes its items in the table and runs one OOS OT per slot; the sender hashes its decoded values, and fewer slots mean fewer OTs.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Codeword length of the OOS OT extension, in bits","symbol":"w"},{"meaning":"Bound on the hyperedges left in the 2-core after peeling, the paper's d(n), so the table has d + λ extra positions","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-GPRTY","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"ASM-ROM","assumption_ids":["ASM-ROM"],"assumption_name":"Random oracles, in the OOS OT-extension hybrid model","attributes":{"adversary":{"locator":"§6.3, p. 19","note":"Via the PaXoS-PSI proofs, written for any binary OKVS; corrupt parties may use larger sets","value":["malicious"]},"assumptions":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"None beyond the random oracle in the OOS OT-extension hybrid; instantiating OOS needs base OTs, whose assumption is not named","source":"PSI-PAPER-2020-PRTY","value":"not_reported"},"output":{"locator":"§6.3, p. 19","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"The receiver","source":"PSI-PAPER-2020-PRTY","value":"one"},"parties":{"locator":"§6.3, p. 19","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"The OOS hybrid of the proof is not a model","source":"PSI-PAPER-2020-PRTY","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","source":"PSI-PAPER-2020-PRTY","value":"balanced"},"technique":{"locator":"§5.2, pp. 14-16; §5.4, pp. 17-18; §8.1, p. 23","value":["okvs","ot_extension","simple_hashing"]}},"authors":["Gayathri Garimella","Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"func":"oos","id":"oos","implementation":"OOS malicious OT extension","instantiation":"oos17","locator":"§5.2, p. 16; §5.4, p. 17; §6.3, p. 19; PRTY20 Figure 3, step 2, p. 11","note":"One run on the receiver's star-architecture table, one instance per position of its leaves and centre; \\( \\tau \\), the length of \\( H_1 \\), as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( (b+1)(1.3n'+\\lambda+0.5\\log n') \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oos","calls":[{"block":"oos","count":"\\( w \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Fig. 2, Init, p. 8","node":"0","note":"OOS17 does not fix the base OT (its implementation ran SimpleOT, §6, p. 22); PRTY20 §7.1 (p. 22) uses Naor-Pinkas","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"func":"oos","implementation":"oos17","label":"OOS 1-out-of-N OT extension (malicious)","locator":"§5.2, p. 16; §5.4, p. 17; §6.3, p. 19; PRTY20 Figure 3, step 2, p. 11","node":"","note":"One run on the receiver's star-architecture table, one instance per position of its leaves and centre; \\( \\tau \\), the length of \\( H_1 \\), as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( (b+1)(1.3n'+\\lambda+0.5\\log n') \\)","n_C":"\\( w \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"},"source":"OOS17"}],"phase":"online","step_phase":"online"},"capabilities":["empirical-error-analysis"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","PSI-CONTRIB-2021-GPRTY-3H-GCT","PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI"],"client_storage":null,"communication":null,"complexity":{"oos":{"costs":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda) + \\lambda(n_C + \\tau) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda m \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( n_C(m + \\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2n_C\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( n_C \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[]}},"construction_family":"okvs_ot_extension","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2\\kappa n \\)","locator":"PRTY20 Figure 3, step 3, p. 11; PRTY20 §4.4, p. 15; Theorem 7, p. 21; Figure 4, p. 23","measure":"communication","note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item, as for malicious security","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its table","source":"PSI-PAPER-2020-PRTY","subject":"receiver"},{"basis":"counted","formula":"\\( 7n \\)","locator":"§5.2, p. 15; §4.1, pp. 9–11; PRTY20 Figure 3, step 3, p. 11","measure":"computation","note":"Per item: the leaf hash, the hyperedge and \\( r \\) hashes of its leaf and of the centre, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 7n \\)","locator":"§5.2, p. 15; §4.1, pp. 9–11; PRTY20 Figure 3, steps 1 and 4, p. 11","measure":"computation","note":"Per item: the leaf hash, the hyperedge and \\( r \\) hashes of its leaf and of the centre, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["OOS","the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"overview":[{"gloss":["OOS","the protocol's own messages"],"messages":"\\mathsf{OOS}[\\ldots]#oos + 1","open":[],"phase":"online","rounds":"\\mathsf{OOS}[\\ldots]#oos + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w((b+1)(1.3n'+\\lambda+0.5\\log n')+\\lambda) + \\lambda(w+\\lambda+2\\log n) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( \\lambda (b+1)(1.3n'+\\lambda+0.5\\log n') \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( 2w((b+1)(1.3n'+\\lambda+0.5\\log n')+\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"receiver"},{"block":"oos","chain":["oos17"],"derived":true,"formula":"\\( w((b+1)(1.3n'+\\lambda+0.5\\log n')+\\lambda)/\\kappa \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","operation":"symmetric_op","source":"OOS17","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2w\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"exponentiation","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"modmul","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"oos","chain":["oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0","operation":"symmetric_op","part":["base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-GPRTY","PSI-PAPER-2020-PRTY"],"paper_title":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","paper_url":"https://eprint.iacr.org/2021/883","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["oos"],"id":"oos","locator":"§5.4, p. 17; §6.3, p. 19; PRTY20 Figure 3, steps 1–2, p. 11","phase":"online","what":"the OOS run on the receiver's star-architecture OKVS"},{"after":["oos"],"from":"sender","id":"masks","locator":"PRTY20 Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security_mode":"computational","security_model":"malicious two-party, random oracle model, OOS-hybrid, via the PaXoS-PSI proofs (§6.3, p. 19)","security_notion":"PSI with output to the receiver; corrupt parties may use larger sets","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PaXoS-PSI over the star-architecture OKVS, which hashes items into leaf three-hash tables and adds a centre table that absorbs any one leaf failure. Amplification turns an empirically measured leaf failure rate into a small overall failure probability.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Codeword length of the OOS OT extension, in bits","symbol":"w"},{"meaning":"Leaf tables of the star architecture (the paper's q), the bins its simple hashing maps the items into","symbol":"b"},{"meaning":"Bound on the items in one leaf: the maximum load of n items in b bins, except with probability 2^{-λ}","symbol":"n'"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-GPRTY","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"ASM-ROM","assumption_ids":["ASM-ROM","ASM-PRF"],"assumption_name":"Random oracle and PRF-based zero sharing, in the malicious two-party OPRF hybrid model","attributes":{"adversary":{"locator":"Theorem 9, p. 31; Appendix B.4, p. 34","note":"Corrupt parties may contribute sets of up to twice the honest size","value":["malicious"]},"assumptions":{"locator":"Figure 5, p. 39; Theorem 9, p. 31; Table 4, p. 36","note":"PRF zero-sharing; the two-party OPRF is an ideal functionality, instantiated with vOLE in the comparison","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"corruptions":{"locator":"Table 4, p. 36; Appendix B.4, p. 30","note":"Any subset of parties, the central party included","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 5, p. 39","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 39; Appendix B.7, p. 38","note":"The central party; an extension gives output to all under a weaker functionality","value":"one"},"parties":{"locator":"Figure 5, p. 39","value":"multiparty"},"security_model":{"locator":"Figure 5, p. 39; Theorem 9, p. 31","note":"The OPRF hybrid of the proof is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Figure 5, p. 39; Appendix B.5, p. 35","value":"balanced"},"technique":{"locator":"Appendix B.2, p. 30; Table 4, p. 36","value":["oprf","okvs","vole","secret_sharing"]}},"authors":["Gayathri Garimella","Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[],"count":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"func":"oprf","id":"oprf","implementation":"vOLE","instantiation":"gprty21_vole_oprf","locator":"Figure 5, step 2(a), p. 39; Theorem 9, p. 31; Table 4, p. 36","note":"One malicious two-party OPRF per client, keyed by the client; the leader queries its \\( n \\) items in each","params":{"c":"\\( n \\)"},"roles":{"receiver":"leader","sender":"client"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"oprf","calls":[{"block":"oprf","count":{"client":"\\( 1 \\)","leader":"\\( \\ell - 1 \\)"},"func":"vole","locator":"Figure 3, step 1, p. 22; §7.1, p. 21","node":"0","note":"Malicious vOLE with the receiver's vector chosen; the paper notes none was implemented (p. 21)","open":true,"open_in":"GPRTY21","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{v}} \\)","m":"\\( m_O \\)"},"part":"VOLE","phase":"online","roles":{"receiver":"leader","sender":"client"}}],"count":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"func":"oprf","implementation":"gprty21_vole_oprf","label":"vOLE-based OPRF of generalized PaXoS-PSI","locator":"Figure 5, step 2(a), p. 39; Theorem 9, p. 31; Table 4, p. 36","node":"","note":"One malicious two-party OPRF per client, keyed by the client; the leader queries its \\( n \\) items in each","params":{"c":"\\( n \\)"},"phase":"online","roles":{"receiver":"leader","sender":"client"},"source":"GPRTY21"}]},"capabilities":["any-okvs"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","PSI-CONTRIB-2021-GPRTY-OKVS"],"client_storage":null,"communication":null,"complexity":{"oprf":{"costs":[{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 3, step 1, p. 22","measure":"communication","source":"GPRTY21","subject":"sender"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 3, step 1, p. 22","measure":"communication","source":"GPRTY21","subject":"receiver"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 22","measure":"computation","operation":"symmetric_op","source":"GPRTY21","subject":"sender"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 2kc \\)","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","operation":"symmetric_op","source":"GPRTY21","subject":"receiver"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","operation":"field_op","source":"GPRTY21","subject":"receiver","value":"conditional"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"instance":{"count":"\\( k \\)","func":"vole","id":"oprf@0","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{v}} \\)","m":"\\( m_O \\)"}},"locator":"Figure 3, step 1, p. 22; §7.1, p. 21","measure":"communication","node":"0","open_in":"GPRTY21","part":["VOLE"],"source":"GPRTY21","subject":"total","value":"not_instantiated"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"instance":{"count":"\\( k \\)","func":"vole","id":"oprf@0","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{v}} \\)","m":"\\( m_O \\)"}},"locator":"Figure 3, step 1, p. 22; §7.1, p. 21","measure":"computation","node":"0","open_in":"GPRTY21","part":["VOLE"],"source":"GPRTY21","subject":"total","value":"not_instantiated"}],"counts":[{"gloss":[],"messages":"0","open":["VOLE"],"phase":"online","rounds":"0"}],"variables":[{"meaning":"Slots of the linear OKVS that encodes the receiver's c queries","symbol":"m_O"},{"meaning":"Output length of \\( H_1 \\); the vOLE is over \\( \\mathrm{GF}(2^{v}) \\)","symbol":"v"}]}},"construction_family":"oprf_okvs_zero_sharing","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 5, steps 1–2, p. 39","measure":"communication","note":"Sends only inside the OPRFs; first in the order, it sends no zero-sharing key","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-1)|\\mathbb{F}| \\)","locator":"Figure 5, step 1, p. 39","measure":"communication","note":"Zero-sharing keys drawn from \\( \\mathbb{F} \\), one to each party before it in the order","phase":"setup","subject":"client","tip":"The last client's, the largest: the client \\( P_i \\) sends \\( i \\) keys, so the first sends one."},{"basis":"counted","formula":"\\( m|\\mathbb{F}| \\)","locator":"Figure 5, steps 2(b)–(c), p. 39","measure":"communication","note":"Its OKVS of its \\( n \\) items to the leader, one field element per slot","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(\\ell-1)n \\)","locator":"Figure 5, steps 1 and 3, p. 39","measure":"computation","note":"Per item its zero-share, one PRF call per other party, and H on each client's OPRF value; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"leader"},{"basis":"counted","locator":"Figure 5, steps 3–4, p. 39","measure":"computation","note":"Encoding its OKVS and decoding all \\( \\ell \\) at its items multiply only for an OKVS whose rows hold field elements, which the protocol leaves open","operation":"field_op","phase":"online","subject":"leader","value":"conditional"},{"basis":"counted","formula":"\\( (\\ell+2)n \\)","locator":"Figure 5, steps 1 and 2(b), p. 39; Figure 3, step 2, p. 22","measure":"computation","note":"Per item its zero-share, one PRF call per other party, its OPRF value, \\( H_1 \\) and \\( H_2 \\), and H; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"client"},{"basis":"counted","locator":"Figure 5, step 2(b), p. 39; Figure 3, step 2, p. 22","measure":"computation","note":"One product by s per item in its OPRF values, plus decoding Q and encoding its OKVS, which multiply only for an OKVS with field rows","operation":"field_op","phase":"online","subject":"client","value":"conditional"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"1","open":["VOLE"],"phase":"online","rounds":"1"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"},{"gloss":["OPRF","the protocol's own messages"],"messages":"\\mathsf{OPRF}[\\ldots]#oprf + 1","open":[],"phase":"online","rounds":"\\mathsf{OPRF}[\\ldots]#oprf + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 3, step 1, p. 22","measure":"communication","source":"GPRTY21","subject":"client"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 22","measure":"computation","operation":"symmetric_op","source":"GPRTY21","subject":"client"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"instance":{"count":{"client":"\\( 1 \\)","leader":"\\( \\ell - 1 \\)"},"func":"vole","id":"oprf@0","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{v}} \\)","m":"\\( m_O \\)"}},"locator":"Figure 3, step 1, p. 22; §7.1, p. 21","measure":"communication","node":"0","open_in":"GPRTY21","part":["VOLE"],"source":"GPRTY21","subject":"total","value":"not_instantiated"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"instance":{"count":{"client":"\\( 1 \\)","leader":"\\( \\ell - 1 \\)"},"func":"vole","id":"oprf@0","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{v}} \\)","m":"\\( m_O \\)"}},"locator":"Figure 3, step 1, p. 22; §7.1, p. 21","measure":"computation","node":"0","open_in":"GPRTY21","part":["VOLE"],"source":"GPRTY21","subject":"total","value":"not_instantiated"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 3, step 1, p. 22","measure":"communication","source":"GPRTY21","subject":"leader"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"formula":"\\( 2(\\ell - 1)n \\)","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","operation":"symmetric_op","source":"GPRTY21","subject":"leader"},{"block":"oprf","chain":["gprty21_vole_oprf"],"derived":true,"locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","operation":"field_op","source":"GPRTY21","subject":"leader","value":"conditional"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-GPRTY"],"paper_title":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","paper_url":"https://eprint.iacr.org/2021/883","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"client","id":"keys","locator":"Figure 5, step 1, p. 39; §B.5, p. 35","phase":"setup","what":"zero-sharing keys, from each client to every party before it in the order"},{"blocks":["oprf"],"id":"oprf","locator":"Figure 5, step 2(a), p. 39","phase":"online","what":"one OPRF per client, the leader querying its set"},{"after":["oprf"],"from":"client","id":"okvs","locator":"Figure 5, steps 2(b)–(c), p. 39","phase":"online","what":"each client's OKVS of its hashed OPRF values masked by its zero-shares"}],"security_mode":"computational","security_model":"malicious, F_oprf-hybrid, random oracle model (Theorem 9, p. 31)","security_notion":"UC-secure multiparty PSI with output to a central party; corrupt parties may use larger sets","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The KMPRT augmented semi-honest protocol over any OKVS and a malicious two-party OPRF, with each OPRF output hashed by a random oracle before it is masked with a PRF zero-share. The added hash lets the simulator extract corrupt inputs, which makes the protocol malicious-secure.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Slots of the OKVS a party sends, which encodes its \\( n \\) items; Figure 5 leaves the OKVS open","symbol":"m"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-GPRTY","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"ASM-ROM","assumption_ids":["ASM-ROM"],"assumption_name":"Random oracles, in the vector-OLE hybrid model","attributes":{"adversary":{"locator":"Theorem 7, p. 21","value":["malicious"]},"assumptions":{"locator":"§7.1, p. 21; Theorem 7, p. 21","note":"None beyond the random oracles in the vOLE hybrid; it needs a malicious-secure vOLE protocol, which the paper does not fix","value":"not_reported"},"output":{"locator":"Figure 3, p. 22","value":["intersection"]},"output_to":{"locator":"Figure 3, step 3, p. 22","note":"The receiver","value":"one"},"parties":{"locator":"Figure 3, p. 22","value":"two_party"},"security_model":{"locator":"Theorem 7, p. 21; Figure 3, p. 22","note":"Random oracles as in PaXoS-PSI, whose proof it follows; the vOLE hybrid is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 22","value":"balanced"},"technique":{"locator":"§7.1, pp. 20-22","value":["okvs","vole"]}},"authors":["Gayathri Garimella","Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[],"func":"vole","id":"vole","locator":"Figure 3, step 1, p. 22; Theorem 7, p. 21; §7.1, p. 21","note":"Chosen inputs: the receiver puts in its OKVS, the sender a random scalar; no malicious protocol for it is named","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\ell_1}} \\)","m":"\\( m \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","func":"vole","locator":"Figure 3, step 1, p. 22; Theorem 7, p. 21; §7.1, p. 21","node":"","note":"Chosen inputs: the receiver puts in its OKVS, the sender a random scalar; no malicious protocol for it is named","open":true,"params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\ell_1}} \\)","m":"\\( m \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"}}],"phase":"online","step_phase":"online"},"capabilities":["any-linear-okvs"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"okvs_vole","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 2\\kappa n \\)","locator":"Figure 3, step 2, p. 22; Theorem 7, p. 21; PRTY20 §4.4, p. 15","measure":"communication","note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, p. 22","measure":"communication","note":"Sends nothing outside the vOLE, whose input is its OKVS; no error-correcting code is sent","subject":"receiver"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Figure 3, step 2, p. 22","measure":"computation","note":"\\( H_1 \\) and \\( H_2 \\) per item, besides any hashing of the linear OKVS, which the paper leaves open","operation":"symmetric_op","subject":"sender"},{"basis":"counted","locator":"Figure 3, step 2, p. 22","measure":"computation","note":"One multiplication by s per item, plus those of decoding Q, which depend on the linear OKVS chosen","operation":"field_op","subject":"sender","value":"conditional"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","note":"\\( H_1 \\) and \\( H_2 \\) per item, besides any hashing of the linear OKVS, which the paper leaves open","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","note":"Encoding its OKVS and decoding R at each item multiply only for an OKVS whose rows hold field elements","operation":"field_op","subject":"receiver","value":"conditional"}],"counts":{"exact":[{"gloss":["VOLE","the protocol's own messages"],"messages":"\\mathsf{VOLE}[\\ldots]#vole + 1","open":[],"phase":"online","rounds":"\\mathsf{VOLE}[\\ldots]#vole + 1"}],"overview":[{"gloss":["VOLE","the protocol's own messages"],"messages":"\\mathsf{VOLE}[\\ldots]#vole + 1","open":[],"phase":"online","rounds":"\\mathsf{VOLE}[\\ldots]#vole + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-GPRTY"],"paper_title":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","paper_url":"https://eprint.iacr.org/2021/883","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["vole"],"id":"vole","locator":"Figure 3, step 1, p. 22","phase":"online","what":"the vOLE on the receiver's OKVS and the sender's random scalar"},{"after":["vole"],"from":"sender","id":"masks","locator":"Figure 3, step 2, p. 22","phase":"online","what":"the sender's hashed set M"}],"security_mode":"computational","security_model":"malicious two-party, random oracle model, vOLE-hybrid (Theorem 7, p. 21)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PaXoS-PSI generalized to any linear OKVS by replacing the OOS correlation with vector OLE over \\( \\mathrm{GF}(2^{\\ell_1}) \\). The receiver's OKVS of its hashed items is the vOLE input, so no error-correcting code is needed.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Slots of the linear OKVS that encodes the receiver's \\( n \\) items, which the paper leaves open","symbol":"m"},{"meaning":"Output length of \\( H_1 \\): the vOLE works over \\( GF(2^{\\ell_1}) \\), with \\( \\ell_1 \\) set as in PaXoS-PSI","symbol":"\\ell_1"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-GPRTY","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-IDEAL-OPPRF-AND-ZERO-SHARING-FUNCTIONALITIES","assumption_name":"PRF and random oracle, with OKVS obliviousness and ideal OPPRF and zero-sharing functionalities","attributes":{"adversary":{"locator":"Theorem 4.5, p. 11","note":"Static corruption","value":["malicious"]},"assumptions":{"locator":"Protocol 4.4, p. 10; Theorem 4.3, p. 10; Theorem 4.5, p. 11","note":"PRF masks from the clients; the OPPRF and zero-sharing are ideal functionalities in the proof","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"corruptions":{"locator":"Protocol 4.4, p. 10; Theorem 4.5, p. 11","note":"A parameter: \\( \\ell - t_c - 1 \\) clients, one pivot and \\( t_c \\) servers, cheaper for smaller \\( t_c \\)","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Functionality 2.1, p. 4","value":["intersection"]},"output_to":{"locator":"Functionality 2.1, p. 4; Protocol 4.4, step 6, p. 10","note":"The last server","value":"one"},"parties":{"locator":"Protocol 4.4, p. 10","value":"multiparty"},"security_model":{"locator":"Theorem 4.5, p. 11","note":"The ZeroXOR hybrid of the proof is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Functionality 2.1, p. 4","value":"balanced"},"technique":{"locator":"Protocol 4.2, p. 10; Protocol 4.4, p. 10; §5, p. 11","value":["okvs","paxos","opprf","secret_sharing"]}},"authors":["Ofri Nevo","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KMPRT17","paper":"PSI-PAPER-2017-KMPRT","title":"Practical multi-party private set intersection from symmetric-key techniques"}],"count":"\\( n \\)","func":"zero_share","id":"zero_share","implementation":"unconditional zero sharing of Kolesnikov et al., from exchanged seeds","instantiation":"kmprt17_zero_share","locator":"Protocol 4.2, step 1, p. 10; Theorem 4.3, p. 10; Protocol 4.4, step 6, p. 10","note":"Among the pivot and the servers, the leader included, inside ZeroXOR; each takes one share per item","params":{"\\ell":"\\( t_c + 1 \\)"},"roles":{"party":["pivot","server","leader"]}},{"cites":[{"key":"PRTY20","paper":"PSI-PAPER-2020-PRTY","title":"PSI from PaXoS: Fast, malicious private set intersection"},{"key":"KMPRT17","paper":"PSI-PAPER-2017-KMPRT","title":"Practical multi-party private set intersection from symmetric-key techniques"},{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"},"func":"opprf","id":"opprf","implementation":"malicious PaXoS-based OPPRF of Pinkas et al.; measured with KMPRT's table-based OPPRF","instantiation":"prty20_opprf","locator":"Protocol 4.2, step 2, p. 10; Theorem 4.3, p. 10","note":"The leader receives in each; the pivot and every other server send in one","params":{"m_1":"\\( n \\)","m_2":"\\( n \\)"},"roles":{"receiver":"leader","sender":["pivot","server"]},"sessions":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"zero_share","count":"\\( n \\)","func":"zero_share","implementation":"kmprt17_zero_share","label":"Unconditional zero sharing from exchanged seeds","locator":"Protocol 4.2, step 1, p. 10; Theorem 4.3, p. 10; Protocol 4.4, step 6, p. 10","node":"","note":"Among the pivot and the servers, the leader included, inside ZeroXOR; each takes one share per item","params":{"\\ell":"\\( t_c + 1 \\)"},"phase":"online","roles":{"party":["pivot","server","leader"]},"source":"KMPRT17"},{"block":"opprf","calls":[{"block":"opprf","calls":[{"block":"opprf","count":{"leader":"\\( t_cw \\)","pivot":"\\( w \\)","server":"\\( w \\)"},"func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Fig. 2, Init, p. 8","node":"0/0","note":"OOS17 does not fix the base OT (its implementation ran SimpleOT, §6, p. 22); PRTY20 §7.1 (p. 22) uses Naor-Pinkas","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["pivot","server"],"sender":"leader"},"source":"NP01"}],"count":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"},"func":"oos","implementation":"oos17","label":"OOS 1-out-of-N OT extension (malicious)","locator":"Appendix B, p. 14; PRTY20 §4.4, p. 15 and Theorem 8, p. 20","node":"0","note":"The receiver's PaXoS of its queries as choice strings; m and τ as PRTY20 sets them","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n^{2}) \\)","m":"\\( 2.4n + \\lambda + O(\\log n) \\)","n_C":"\\( w \\)"},"part":"OOS (the receiver's queries)","phase":"online","roles":{"receiver":"leader","sender":["pivot","server"]},"source":"OOS17"}],"count":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"},"func":"opprf","implementation":"prty20_opprf","label":"PaXoS-based malicious OPPRF","locator":"Protocol 4.2, step 2, p. 10; Theorem 4.3, p. 10","node":"","note":"The leader receives in each; the pivot and every other server send in one","params":{"m_1":"\\( n \\)","m_2":"\\( n \\)"},"phase":"online","roles":{"receiver":"leader","sender":["pivot","server"]},"sessions":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"},"source":"NTY21"}],"phase":"online","step_phase":"online"},"capabilities":["corruption-threshold-calibration","lightweight-clients"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING"],"client_storage":null,"communication":null,"complexity":{"opprf":{"costs":[{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( kh \\)","locator":"Appendix B, p. 14","measure":"communication","source":"NTY21","subject":"sender"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, steps 1–2, p. 11","measure":"communication","source":"NTY21","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( 5km_1 \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, step 3, p. 11; PRTY20 Figure 6, p. 19","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"sender"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( 5km_2 \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, steps 1 and 4, p. 11; PRTY20 Figure 6, p. 19","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4kwm_2 + 2kw\\lambda + k\\lambda(w + \\lambda + \\log_2(m_1m_2)) + O(kw\\log m_2) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","node":"0","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4k\\lambda m_2 + k\\lambda^{2} + O(k\\lambda\\log m_2) \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","node":"0","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"sender"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 4.8kwm_2/\\kappa + 4kw\\lambda/\\kappa + O(kw\\log m_2/\\kappa) \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","node":"0","operation":"symmetric_op","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4kwm_2/\\kappa + 2kw\\lambda/\\kappa + O(kw\\log m_2/\\kappa) \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","node":"0","operation":"symmetric_op","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"sender"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2w\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"sender"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"4","open":[],"phase":"online","rounds":"4"}],"variables":[{"meaning":"Length of the OOS code, the width of the OT-extension matrix","symbol":"w"},{"meaning":"Bits of the hint, the OKVS S that encodes the sender's m_1 programmed points","symbol":"h"}]},"zero_share":{"costs":[{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( (\\ell - 1)\\kappa \\)","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","phase":"setup","source":"KMPRT17","subject":"party"},{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( (\\ell - 1)k \\)","locator":"Figure 9, Generate zero-sharing, p. 14","measure":"computation","operation":"symmetric_op","source":"KMPRT17","subject":"party"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"setup","rounds":"1"}],"variables":[]}},"construction_family":"okvs_zeroxor","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (m+t_c)\\kappa \\)","locator":"Protocol 4.4, steps 2–3, p. 10","measure":"communication","note":"A \\( \\kappa \\)-bit PRF key to each server, then its OKVS of \\( \\kappa \\)-bit values to the pivot","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 4.4, steps 4 and 6, p. 10; Protocol 4.2, p. 10","measure":"communication","note":"Sends only inside ZeroXOR, as zero-sharing party and OPPRF sender","subject":"pivot"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, p. 10","measure":"communication","note":"Sends only inside ZeroXOR, as zero-sharing party and OPPRF sender","subject":"server"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, p. 10","measure":"communication","note":"Sends only inside ZeroXOR, as zero-sharing party and the receiver of every OPPRF","subject":"leader"},{"basis":"counted","formula":"\\( (t_c+1)n \\)","locator":"Protocol 4.4, step 3 and note a, p. 10","measure":"computation","note":"Per item the random oracle H and one PRF call per server key; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n \\)","locator":"Protocol 4.4, step 4 and note a, p. 10","measure":"computation","note":"H per item; decoding the clients' OKVSs XORs their rows, and their hashing is left open","operation":"symmetric_op","phase":"online","subject":"pivot"},{"basis":"counted","formula":"\\( (\\ell-t_c)n \\)","locator":"Protocol 4.4, step 5 and note a, p. 10","measure":"computation","note":"Per item H and one PRF call per client key","operation":"symmetric_op","phase":"online","subject":"server"},{"basis":"counted","formula":"\\( (\\ell-t_c)n \\)","locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, step 3, p. 10","measure":"computation","note":"As a server, per item H and one PRF call per client key; comparing its share with the OPPRF outputs is XORs","operation":"symmetric_op","phase":"online","subject":"leader"}],"counts":{"exact":[{"gloss":["zeroShare","base OT"],"messages":"6","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages","OPPRF"],"messages":"7","open":[],"phase":"online","rounds":"5"}],"overview":[{"gloss":["the protocol's own messages","zeroShare","OPPRF"],"messages":"\\mathsf{zeroShare}[\\ldots]#zero_share + \\mathsf{OPPRF}[\\ldots]#opprf + 1","open":[],"phase":"online","rounds":"(1 \\parallel \\mathsf{zeroShare}[\\ldots]#zero_share) + \\mathsf{OPPRF}[\\ldots]#opprf"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( t_c\\kappa \\)","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","phase":"setup","source":"KMPRT17","subject":"pivot"},{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( t_c\\kappa \\)","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","phase":"setup","source":"KMPRT17","subject":"server"},{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( t_c\\kappa \\)","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","phase":"setup","source":"KMPRT17","subject":"leader"},{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( t_cn \\)","locator":"Figure 9, Generate zero-sharing, p. 14","measure":"computation","operation":"symmetric_op","source":"KMPRT17","subject":"pivot"},{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( t_cn \\)","locator":"Figure 9, Generate zero-sharing, p. 14","measure":"computation","operation":"symmetric_op","source":"KMPRT17","subject":"server"},{"block":"zero_share","chain":["kmprt17_zero_share"],"derived":true,"formula":"\\( t_cn \\)","locator":"Figure 9, Generate zero-sharing, p. 14","measure":"computation","operation":"symmetric_op","source":"KMPRT17","subject":"leader"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( h \\)","locator":"Appendix B, p. 14","measure":"communication","source":"NTY21","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( h \\)","locator":"Appendix B, p. 14","measure":"communication","source":"NTY21","subject":"server"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( 5n \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, step 3, p. 11; PRTY20 Figure 6, p. 19","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( 5n \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, step 3, p. 11; PRTY20 Figure 6, p. 19","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"server"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4\\lambda n + \\lambda^{2} + O(\\lambda\\log n) \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","node":"0","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4\\lambda n + \\lambda^{2} + O(\\lambda\\log n) \\)","locator":"Fig. 2, Extend step 4, p. 8","measure":"communication","node":"0","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"server"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4wn/\\kappa + 2w\\lambda/\\kappa + O(w\\log n/\\kappa) \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","node":"0","operation":"symmetric_op","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4wn/\\kappa + 2w\\lambda/\\kappa + O(w\\log n/\\kappa) \\)","locator":"Fig. 2, Extend step 1 and Output, p. 8","measure":"computation","node":"0","operation":"symmetric_op","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"server"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"server"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"server"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"server"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"pivot"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( w \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"server"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( 0 \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, steps 1–2, p. 11","measure":"communication","source":"NTY21","subject":"leader"},{"block":"opprf","chain":["prty20_opprf"],"derived":true,"formula":"\\( 5t_cn \\)","locator":"Appendix B, p. 14; PRTY20 Figure 3, steps 1 and 4, p. 11; PRTY20 Figure 6, p. 19","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"leader"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 2.4t_cwn + 2t_cw\\lambda + t_c\\lambda(w + \\lambda + \\log_2(n^{2})) + O(t_cw\\log n) \\)","locator":"Fig. 2, Extend steps 2 and 4, p. 8","measure":"communication","node":"0","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"leader"},{"block":"opprf","chain":["prty20_opprf","oos17"],"derived":true,"formula":"\\( 4.8t_cwn/\\kappa + 4t_cw\\lambda/\\kappa + O(t_cw\\log n/\\kappa) \\)","locator":"Fig. 2, Extend step 1, p. 8","measure":"computation","node":"0","operation":"symmetric_op","part":["OOS (the receiver's queries)"],"source":"OOS17","subject":"leader"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2t_c|\\mathbb{G}| + 2t_cw\\kappa \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"leader"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2t_c + t_cw \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"leader"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( t_cw \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"leader"},{"block":"opprf","chain":["prty20_opprf","oos17","np01"],"derived":true,"formula":"\\( 2t_cw \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OOS (the receiver's queries)","base OT"],"phase":"setup","source":"NP01","subject":"leader"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-NTY","PSI-PAPER-2017-KMPRT"],"paper_title":"Simple, Fast Malicious Multiparty Private Set Intersection","paper_url":"https://eprint.iacr.org/2021/1221","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"client","id":"keys","locator":"Protocol 4.4, step 2, p. 10","phase":"online","what":"a PRF key to each server"},{"from":"client","id":"okvs","locator":"Protocol 4.4, step 3, p. 10; §4.2.1, p. 11","phase":"online","what":"its OKVS of the XORed PRF values, to the pivot"},{"blocks":["zero_share"],"id":"share","locator":"Protocol 4.2, step 1, p. 10; Protocol 4.4, step 6, p. 10","phase":"online","what":"zero-shares of each ZeroXOR party's items, needing only the items"},{"after":["keys","okvs","share"],"blocks":["opprf"],"id":"opprf","locator":"Protocol 4.2, step 2, p. 10; Protocol 4.4, steps 4–6, p. 10","phase":"online","what":"the OPPRFs to the leader, each programmed with its sender's values masked by its zero-shares"}],"security_mode":"computational","security_model":"malicious, \\( t_c < \\ell \\) corrupted, F_zeroXOR-hybrid and random oracle model (Theorem 4.5, p. 11)","security_notion":"\\( \\ell \\)-party PSI with output to \\( P_\\ell \\) (Functionality 2.1, p. 4)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Malicious multiparty PSI calibrated to the number of corruptions. Clients deliver a conditional zero-sharing to a pivot and \\( t_c \\) servers through one OKVS and \\( t_c \\) PRF keys each, and those \\( t_c + 1 \\) parties find the items whose shares sum to zero with a ZeroXOR protocol over OPPRFs.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Slots of the OKVS a client sends, which encodes its \\( n \\) items; Protocol 4.4 leaves the OKVS open, and the experiments use PaXoS with \\( 2.5n \\) bins","symbol":"m"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-NTY","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"symmetric","assumption_id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-AN-IDEAL-TWO-PARTY-PSI-FUNCTIONALITY","assumption_name":"PRF and random oracle, with OKVS obliviousness and an ideal two-party PSI functionality","attributes":{"adversary":{"locator":"Theorem 3.4, p. 8","value":["malicious"]},"assumptions":{"locator":"Theorem 3.4, p. 8; §1.2, p. 4; Appendix A, pp. 13-14","note":"The two-party PSI is an ideal functionality in the proof; Kamara et al.'s instantiation needs only a PRF, and no OT is used","resolved":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)","short":"PRF"}],"value":["PRF"]},"corruptions":{"locator":"§1.2, p. 4; Theorem 3.4, p. 8; §3.2.1, p. 8","note":"No collusion; two colluding parties, such as the key dealer and the pivot, break it","value":"\\( t_c \\le 1 \\)"},"output":{"locator":"Functionality 2.1, p. 4","value":["intersection"]},"output_to":{"locator":"Functionality 2.1, p. 4; Protocol 3.3, step 6, p. 8","note":"The last party","value":"one"},"parties":{"locator":"Protocol 3.3, p. 8","value":"multiparty"},"security_model":{"locator":"Protocol 3.3, note a, p. 8; proof of Theorem 3.4, pp. 8-9","note":"The malicious variant hashes items with a random oracle; the two-party PSI hybrid is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Functionality 2.1, p. 4","value":"balanced"},"technique":{"locator":"Protocol 3.3, p. 8; §3.2.2, p. 8; Appendix A, p. 13","value":["okvs","paxos","server_aided_psi"]}},"authors":["Ofri Nevo","Ni Trieu","Avishay Yanai"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"KMRS14","title":"Scaling private set intersection to billion-element sets"}],"func":"psi","id":"psi","implementation":"server-aided PSI of Kamara et al.","instantiation":"kmrs14","locator":"Protocol 3.3, step 6, p. 8; Theorem 3.4, p. 8","note":"Between the pivot and the leader, on their derived sets; one client aids as the server","params":{"n_X":"\\( n \\)","n_Y":"\\( n \\)"},"roles":{"receiver":"leader","sender":"pivot","server":"client"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"psi","func":"psi","implementation":"kmrs14","label":"Server-aided PSI of Kamara et al.","locator":"Protocol 3.3, step 6, p. 8; Theorem 3.4, p. 8","node":"","note":"Between the pivot and the leader, on their derived sets; one client aids as the server","params":{"n_X":"\\( n \\)","n_Y":"\\( n \\)"},"phase":"online","roles":{"receiver":"leader","sender":"pivot","server":"client"},"source":"NTY21"}],"phase":"online","step_phase":"online"},"capabilities":["symmetric-key-primitives-only","no-collusion"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION"],"client_storage":null,"communication":null,"complexity":{"psi":{"costs":[{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( \\kappa + (\\lambda n_X + 5d)w \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 1 and 3, p. 14","measure":"communication","source":"NTY21","subject":"sender"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( (\\lambda n_Y + 2d)w \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 2–3, p. 14","measure":"communication","source":"NTY21","subject":"receiver"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 2(\\lambda n_Y + d)w \\)","locator":"Protocol A.2, step 4, p. 14","measure":"communication","source":"NTY21","subject":"server"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 2\\lambda n_X + 3d \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 3, 5 and 6, p. 14","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"sender"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 2\\lambda n_Y + 3d \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 3, 5 and 6, p. 14","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"receiver"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 0 \\)","locator":"Protocol A.2, step 4, p. 14","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"server"}],"counts":[{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"variables":[{"meaning":"Size of each dummy set \\( D_0, D_1, D_2 \\); Protocol A.2 does not fix it","symbol":"d"},{"meaning":"Bits of an item and of its PRF value: F is inverted in step 6, so it permutes w-bit strings; Protocol A.2 does not fix w","symbol":"w"}]}},"construction_family":"okvs_reduction_to_server_aided_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (m+\\ell-3)\\kappa \\)","locator":"Protocol 3.3, steps 1–3, p. 8; §3.2.2, p. 8","measure":"communication","note":"The first client: a \\( \\kappa \\)-bit PRF key to each other client, and its OKVS under all keys to the leader","phase":"online","subject":"client","tip":"The first client's, the largest: it deals the keys; every other client sends one OKVS of \\( m\\kappa \\) bits to the pivot and makes \\( 2n \\) sym ops."},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 3.3, steps 4 and 6, p. 8","measure":"communication","note":"Sends only inside the two-party PSI","subject":"pivot"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 3.3, steps 5–6, p. 8","measure":"communication","note":"Sends only inside the two-party PSI","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-2)n \\)","locator":"Protocol 3.3, steps 2–3 and note a, p. 8","measure":"computation","note":"The first client: per item the random oracle H and one PRF call per other client's key; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n \\)","locator":"Protocol 3.3, step 4 and note a, p. 8","measure":"computation","note":"H per item; decoding the clients' OKVSs XORs their rows, and their hashing is left open","operation":"symmetric_op","phase":"online","subject":"pivot"},{"basis":"counted","formula":"\\( n \\)","locator":"Protocol 3.3, step 5 and note a, p. 8","measure":"computation","note":"H per item; decoding the first client's OKVS XORs its rows, and its hashing is left open","operation":"symmetric_op","phase":"online","subject":"leader"}],"counts":{"exact":[{"gloss":["the protocol's own messages","PSI"],"messages":"5","open":[],"phase":"online","rounds":"5"}],"overview":[{"gloss":["the protocol's own messages","PSI"],"messages":"\\mathsf{PSI}[\\ldots]#psi + 2","open":[],"phase":"online","rounds":"\\mathsf{PSI}[\\ldots]#psi + 2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( \\kappa + (\\lambda n + 5d)w \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 1 and 3, p. 14","measure":"communication","source":"NTY21","subject":"pivot"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( (\\lambda n + 2d)w \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 2–3, p. 14","measure":"communication","source":"NTY21","subject":"leader"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 2(\\lambda n + d)w \\)","locator":"Protocol A.2, step 4, p. 14","measure":"communication","source":"NTY21","subject":"client"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 2\\lambda n + 3d \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 3, 5 and 6, p. 14","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"pivot"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 2\\lambda n + 3d \\)","locator":"Appendix A.1, p. 13; Protocol A.2, steps 3, 5 and 6, p. 14","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"leader"},{"block":"psi","chain":["kmrs14"],"derived":true,"formula":"\\( 0 \\)","locator":"Protocol A.2, step 4, p. 14","measure":"computation","operation":"symmetric_op","source":"NTY21","subject":"client"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-NTY"],"paper_title":"Simple, Fast Malicious Multiparty Private Set Intersection","paper_url":"https://eprint.iacr.org/2021/1221","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"client","id":"keys","locator":"Protocol 3.3, step 1, p. 8","phase":"online","what":"the first client's PRF keys, one to each other client"},{"from":"client","id":"okvs_leader","locator":"Protocol 3.3, step 2, p. 8","phase":"online","what":"the first client's OKVS under all the keys, to the leader"},{"after":["keys"],"from":"client","id":"okvs_pivot","locator":"Protocol 3.3, step 3, p. 8","phase":"online","what":"each other client's OKVS under its key, to the pivot"},{"after":["okvs_leader","okvs_pivot"],"blocks":["psi"],"id":"psi","locator":"Protocol 3.3, steps 4–6, p. 8","phase":"online","what":"the server-aided two-party PSI on the pivot's and the leader's derived sets"}],"security_mode":"computational","security_model":"malicious, at most one corrupted party, \\( F_{\\mathrm{psi}}^{2,1,n} \\)-hybrid (Theorem 3.4, p. 8)","security_notion":"\\( \\ell \\)-party PSI with output to \\( P_\\ell \\) (Functionality 2.1, p. 4)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Malicious multiparty PSI against a single corrupt party from PRF keys and OKVS encodings alone. One party deals PRF keys and an OKVS so that the intersection of all sets reduces to a two-party PSI between the last two parties, run as server-aided PSI with another party as the aid.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Slots of the OKVS a client sends, which encodes its \\( n \\) items; Protocol 3.3 leaves the OKVS open, and the experiments use PaXoS with \\( 2.5n \\) bins","symbol":"m"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-NTY","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-VOLE-FROM-LPN-WITH-REGULAR-NOISE","assumption_name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise","attributes":{"adversary":{"locator":"abstract, p. 1; §6, p. 23","value":["semi_honest"]},"assumptions":{"locator":"§7.2, pp. 26 and 30","note":"LPN with regular noise, for the VOLE; GMW's OTs come from IKNP","resolved":[{"id":"ASM-LPN","name":"Learning parity with noise (LPN)","short":"LPN"}],"value":["LPN"]},"output":{"locator":"Figure 9, p. 38","value":["circuit"]},"output_to":{"locator":"Figure 9, p. 38","note":"Both parties hold shares of a membership bit and associated values per bin","value":"shared"},"parties":{"locator":"Figure 10, p. 39","value":"two_party"},"security_model":{"locator":"Theorem 5.1, p. 21; §6, p. 23","note":"OPPRF in the F_oprf-hybrid model and 2PC as a functionality; the circuit-PSI proof is deferred to PSTY19","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 4, p. 29","value":"balanced"},"technique":{"locator":"§6, pp. 22–24; Figure 10, p. 39; §7.2, p. 30","value":["opprf","batched_oprf","vole","paxos","cuckoo_hashing","simple_hashing","gmw"]}},"authors":["Peter Rindal","Phillipp Schoppmann"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"func":"two_pc","id":"two_pc","implementation":"GMW, with IKNP OT extension","instantiation":"gmw_iknp","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","func":"vole","locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","node":"0","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE; later ones reserve them from their output. RS21 does not say how","open":true,"open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"1/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18; SGRR19 §8.1, p. 12; RS21 §7.2, p. 26","node":"1","note":"One per level above the last of each tree, on XORs of κ-bit nodes. Neither RS21 nor SGRR19 names the OT extension (libOTe, EMP)","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"2/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"1/0"},"source":"NP01"}],"count":"\\( \\omega \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","node":"2","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"}],"func":"vole","implementation":"sgrr19_ywl20","label":"SGRR19 VOLE with YWL+20's iterative bootstrapping","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","node":"","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"WYKW20"},{"block":"two_pc","calls":[{"block":"two_pc","calls":[{"block":"two_pc","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10; §2.2.2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"NP01"}],"count":"\\( \\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","func":"rot","implementation":"iknp_rot","label":"IKNP random OT extension","locator":"§5.1, Algorithm 1, p. 12; §5.4, R-OT for GMW, p. 19","node":"0","note":"Two random OTs on bits per AND gate, one each way: each party is sender in k|C| of them and receiver in the other k|C|, so each bears both roles' costs once","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"PSZ18"}],"func":"two_pc","implementation":"gmw_iknp","label":"GMW with multiplication triples from random OTs by OT extension (IKNP, as in ABY)","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","node":"","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"ALSZ13"}],"phase":"online","step_phase":"online"},"capabilities":["associated-values","secret-shared-output"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RS-CIRCUIT-PSI","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"client_storage":null,"communication":null,"complexity":{"two_pc":{"costs":[{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2|C| \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( |C|\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6|C| \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"party"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"1","open":[],"phase":"offline","rounds":"1"},{"gloss":["the protocol's own messages"],"messages":"\\mathrm{depth}","open":[],"phase":"online","rounds":"\\mathrm{depth}"}],"variables":[]},"vole":{"costs":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu(|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu - 2\\omega\\log_2(\\nu/\\omega) + (\\nu - 2\\omega)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"3","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]}},"construction_family":"opprf_cuckoo_circuit","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (7.2n_X+d+\\lambda)(\\lambda+\\log_2(\\epsilon n_Y))+2\\kappa \\)","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 4, steps 1 and 5, p. 36; Figure 1, parameters, p. 7; §6, p. 23","measure":"communication","note":"The OPPRF table, an XoPaXoS over its items in their three bins, and the coin toss's commitment and opening; associated values add more","subject":"sender"},{"basis":"counted","formula":"\\( (2.4\\epsilon n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; Figure 10, step 4, p. 39; §2, PaXoS details, p. 10","measure":"communication","note":"The OPRF's PaXoS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4\\epsilon n_Y+d+\\lambda+3n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 1, p. 7","measure":"computation","note":"One product per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per entry of its three-bin table; the XoPaXoS encoding is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 18n_X+1 \\)","locator":"Figure 10, steps 2–3, p. 39; Figure 8, step 2, p. 38; Figure 4, step 1 and the sender's evaluation, p. 36; §7.2, p. 30","measure":"computation","note":"Simple hashing with three functions, then per table entry row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( (5\\epsilon+4)n_Y+1 \\)","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2, 5 and 6, p. 36; Figure 8, step 3, p. 38","measure":"computation","note":"Cuckoo hashing, the bin labels, then per bin row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"6","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["VOLE","2PC"],"messages":"3","open":[],"phase":"offline","rounds":"2"},{"gloss":["the protocol's own messages","2PC"],"messages":"2\\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil + 3","open":[],"phase":"online","rounds":"\\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil + 3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages","2PC"],"messages":"\\mathsf{2PC}[\\ldots]#two_pc + 3","open":[],"phase":"online","rounds":"\\mathsf{2PC}[\\ldots]#two_pc + 3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp"],"derived":true,"formula":"\\( 2\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","locator":"KOS16 (MASCOT) Protocol 6, Multiply, p. 21; §2.4, p. 7","measure":"communication","phase":"online","source":"ALSZ13","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( \\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( \\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10; §2.2.2, p. 10; §2.2.2, p. 10","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot"],"derived":true,"formula":"\\( 6\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","locator":"Protocol 1, step 4, p. 10; §2.2.2, p. 10; Protocol 1, step 3, p. 10; §2.2.2, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_iknp","iknp_rot","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RS"],"paper_title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","paper_url":"https://eprint.iacr.org/2021/266","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 8, step 1, p. 38; Figure 10, step 4, p. 39","phase":"online","what":"commitment to its coin-toss share, the first flow of the OPRF inside the OPPRF"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; Figure 8, step 1, p. 38; §7.1, p. 25","phase":"offline","what":"random VOLE for the OPRF's encoding of the cuckoo bins, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the OPRF's encoding of its bin labels, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"table","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39","phase":"online","what":"the OPPRF table, programming each bin's random value at its items","with":"open"},{"after":["open","table"],"blocks":["two_pc"],"id":"cmp","locator":"Figure 10, step 5, p. 39; §7.2, p. 30","phase":"online","what":"GMW comparison of each bin's two values into secret shares"}],"security_mode":"computational","security_model":"semi-honest two-party; OPPRF in the F_oprf-hybrid model (Theorem 5.1, p. 21); composition argued by reference to Pinkas, Schneider, Tkachenko, and Yanai (§6, p. 23)","security_notion":"circuit-PSI with secret-shared output","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Circuit-PSI after Pinkas, Schneider, Tkachenko and Yanai with a VOLE-based OPPRF programmed through XoPaXoS: the receiver cuckoo-hashes, the sender simple-hashes and programs a random value per bin, and GMW compares the values bin by bin into secret shares. This row generates GMW's OTs with IKNP.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo-table expansion: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"},{"meaning":"Bound on the 2-core of a PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; a PaXoS over \\( k \\) items has \\( 2.4k + d + \\lambda \\) positions","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-RS","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-VOLE-FROM-LPN-WITH-REGULAR-NOISE","assumption_name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise","attributes":{"adversary":{"locator":"abstract, p. 1; §6, p. 23","value":["semi_honest"]},"assumptions":{"locator":"§7.2, pp. 26 and 30","note":"LPN with regular noise, for the VOLE; SilentOT generates GMW's OTs","resolved":[{"id":"ASM-LPN","name":"Learning parity with noise (LPN)","short":"LPN"}],"value":["LPN"]},"output":{"locator":"Figure 9, p. 38","value":["circuit"]},"output_to":{"locator":"Figure 9, p. 38","note":"Both parties hold shares of a membership bit and associated values per bin","value":"shared"},"parties":{"locator":"Figure 10, p. 39","value":"two_party"},"security_model":{"locator":"Theorem 5.1, p. 21; §6, p. 23","note":"OPPRF in the F_oprf-hybrid model and 2PC as a functionality; the circuit-PSI proof is deferred to PSTY19","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 4, p. 29","value":"balanced"},"technique":{"locator":"§6, pp. 22–24; Figure 10, p. 39; §7.2, p. 30","value":["opprf","batched_oprf","vole","paxos","cuckoo_hashing","simple_hashing","gmw","pcg"]}},"authors":["Peter Rindal","Phillipp Schoppmann"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"two_pc","id":"two_pc","implementation":"GMW, with SilentOT","instantiation":"gmw_silent","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","func":"vole","locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","node":"0","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE; later ones reserve them from their output. RS21 does not say how","open":true,"open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"1/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18; SGRR19 §8.1, p. 12; RS21 §7.2, p. 26","node":"1","note":"One per level above the last of each tree, on XORs of κ-bit nodes. Neither RS21 nor SGRR19 names the OT extension (libOTe, EMP)","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"2/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"1/0"},"source":"NP01"}],"count":"\\( \\omega \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","node":"2","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"}],"func":"vole","implementation":"sgrr19_ywl20","label":"SGRR19 VOLE with YWL+20's iterative bootstrapping","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","node":"","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"WYKW20"},{"block":"two_pc","calls":[{"block":"two_pc","calls":[{"block":"two_pc","calls":[{"block":"two_pc","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"NP01"}],"count":"\\( \\omega\\log_2(\\nu/\\omega) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19; Theorem 10, p. 20; Table 2 caption, p. 31; §7.2, p. 31","node":"0/0","note":"One per tree level; over \\( \\mathbb{F}_{2^{\\kappa}} \\) every level's strings are \\( \\kappa \\) bits. 128 Naor–Pinkas base OTs, then IKNP, as BCG+19's \"hybrid\"","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM trees)","phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"PSZ18"}],"count":"\\( \\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","func":"rot","implementation":"silent_ot","label":"Silent OT extension (two-round, from dual LPN)","locator":"ALSZ13 §5.1 and Algorithm 1, p. 12; BCG+19 §1, p. 3","node":"0","note":"Two random OTs on bits per AND gate, one each way: each party is sender in one batch, receiver in the other","params":{"\\tau":"\\( 1 \\)"},"part":"ROT (AND gates)","phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]},"source":"BCG+19"}],"func":"two_pc","implementation":"gmw_silent","label":"GMW with multiplication triples from silent random OTs","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","node":"","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"BCG+19"}],"phase":"online","step_phase":"online"},"capabilities":["associated-values","secret-shared-output"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RS-CIRCUIT-PSI","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"client_storage":null,"communication":null,"complexity":{"two_pc":{"costs":[{"block":"two_pc","chain":["gmw_silent"],"derived":true,"formula":"\\( 2|C| \\)","locator":"ALSZ13 §2.4, p. 7, and §5.1, p. 12; KOS16 (ePrint 2016/505) §6.2, p. 20, Protocol 6, Multiply, p. 21","measure":"communication","phase":"online","source":"ALSZ13","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 4, p. 15; Figure 10, step 3, p. 20","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"BCG+19","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot"],"derived":true,"formula":"\\( 4\\nu - 4\\omega + 3|C| - 2\\omega\\log_2(\\nu/\\omega) \\)","locator":"Figure 6, step 1, p. 17; Figure 4, Expand step 2, p. 15; §7.1, Noise distribution, p. 30; Figure 6, Output steps 2–3, p. 17; Figure 4, Expand step 1, p. 15","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"BCG+19","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega)\\kappa \\)","locator":"Protocol 1, step 3, p. 10; Protocol 1, step 6, p. 10","measure":"communication","node":"0/0","part":["ROT (AND gates)","OT (GGM trees)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp"],"derived":true,"formula":"\\( 6\\omega\\log_2(\\nu/\\omega) \\)","locator":"Protocol 1, steps 4 and 6, p. 10; Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","OT (GGM trees)"],"phase":"offline","source":"PSZ18","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0/0","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"exponentiation","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"modmul","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"party"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"symmetric_op","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"party"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"offline","rounds":"2"},{"gloss":["the protocol's own messages"],"messages":"\\mathrm{depth}","open":[],"phase":"online","rounds":"\\mathrm{depth}"}],"variables":[{"meaning":"LPN noise weight for the k outputs: the number of punctured GGM trees, one per block of regular noise (BCG+19 writes t)","symbol":"\\omega"},{"meaning":"LPN code length for the k outputs (BCG+19 writes N); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2k \\)","symbol":"\\nu"}]},"vole":{"costs":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu(|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu - 2\\omega\\log_2(\\nu/\\omega) + (\\nu - 2\\omega)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"3","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]}},"construction_family":"opprf_cuckoo_circuit","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (7.2n_X+d+\\lambda)(\\lambda+\\log_2(\\epsilon n_Y))+2\\kappa \\)","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 4, steps 1 and 5, p. 36; Figure 1, parameters, p. 7; §6, p. 23","measure":"communication","note":"The OPPRF table, an XoPaXoS over its items in their three bins, and the coin toss's commitment and opening; associated values add more","subject":"sender"},{"basis":"counted","formula":"\\( (2.4\\epsilon n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; Figure 10, step 4, p. 39; §2, PaXoS details, p. 10","measure":"communication","note":"The OPRF's PaXoS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4\\epsilon n_Y+d+\\lambda+3n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 1, p. 7","measure":"computation","note":"One product per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per entry of its three-bin table; the XoPaXoS encoding is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 18n_X+1 \\)","locator":"Figure 10, steps 2–3, p. 39; Figure 8, step 2, p. 38; Figure 4, step 1 and the sender's evaluation, p. 36; §7.2, p. 30","measure":"computation","note":"Simple hashing with three functions, then per table entry row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( (5\\epsilon+4)n_Y+1 \\)","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2, 5 and 6, p. 36; Figure 8, step 3, p. 38","measure":"computation","note":"Cuckoo hashing, the bin labels, then per bin row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"6","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["VOLE","2PC"],"messages":"4","open":[],"phase":"offline","rounds":"2"},{"gloss":["the protocol's own messages","2PC"],"messages":"2\\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil + 3","open":[],"phase":"online","rounds":"\\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil + 3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages","2PC"],"messages":"\\mathsf{2PC}[\\ldots]#two_pc + 3","open":[],"phase":"online","rounds":"\\mathsf{2PC}[\\ldots]#two_pc + 3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent"],"derived":true,"formula":"\\( 2\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","locator":"ALSZ13 §2.4, p. 7, and §5.1, p. 12; KOS16 (ePrint 2016/505) §6.2, p. 20, Protocol 6, Multiply, p. 21","measure":"communication","phase":"online","source":"ALSZ13","subject":"sender"},{"block":"two_pc","chain":["gmw_silent"],"derived":true,"formula":"\\( 2\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) \\)","locator":"ALSZ13 §2.4, p. 7, and §5.1, p. 12; KOS16 (ePrint 2016/505) §6.2, p. 20, Protocol 6, Multiply, p. 21","measure":"communication","phase":"online","source":"ALSZ13","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 4, p. 15; Figure 10, step 3, p. 20","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"BCG+19","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 4, p. 15; Figure 10, step 3, p. 20","measure":"communication","node":"0","part":["ROT (AND gates)"],"phase":"offline","source":"BCG+19","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot"],"derived":true,"formula":"\\( 4\\nu - 4\\omega + 3\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) - 2\\omega\\log_2(\\nu/\\omega) \\)","locator":"Figure 6, step 1, p. 17; Figure 4, Expand step 2, p. 15; §7.1, Noise distribution, p. 30; Figure 6, Output steps 2–3, p. 17; Figure 4, Expand step 1, p. 15","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"BCG+19","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot"],"derived":true,"formula":"\\( 4\\nu - 4\\omega + 3\\epsilon n_Y(\\lambda + \\log_2(\\epsilon n_Y) - 1) - 2\\omega\\log_2(\\nu/\\omega) \\)","locator":"Figure 6, step 1, p. 17; Figure 4, Expand step 2, p. 15; §7.1, Noise distribution, p. 30; Figure 6, Output steps 2–3, p. 17; Figure 4, Expand step 1, p. 15","measure":"computation","node":"0","operation":"symmetric_op","part":["ROT (AND gates)"],"phase":"offline","source":"BCG+19","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega)\\kappa \\)","locator":"Protocol 1, step 3, p. 10; Protocol 1, step 6, p. 10","measure":"communication","node":"0/0","part":["ROT (AND gates)","OT (GGM trees)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega)\\kappa \\)","locator":"Protocol 1, step 3, p. 10; Protocol 1, step 6, p. 10","measure":"communication","node":"0/0","part":["ROT (AND gates)","OT (GGM trees)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp"],"derived":true,"formula":"\\( 6\\omega\\log_2(\\nu/\\omega) \\)","locator":"Protocol 1, steps 4 and 6, p. 10; Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","OT (GGM trees)"],"phase":"offline","source":"PSZ18","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp"],"derived":true,"formula":"\\( 6\\omega\\log_2(\\nu/\\omega) \\)","locator":"Protocol 1, steps 4 and 6, p. 10; Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0/0","operation":"symmetric_op","part":["ROT (AND gates)","OT (GGM trees)"],"phase":"offline","source":"PSZ18","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0/0","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} + \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451; Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0/0","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"exponentiation","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 3\\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"exponentiation","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"modmul","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"modmul","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"symmetric_op","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"two_pc","chain":["gmw_silent","silent_ot","iknp","np01"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead; Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0/0","operation":"symmetric_op","part":["ROT (AND gates)","OT (GGM trees)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RS"],"paper_title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","paper_url":"https://eprint.iacr.org/2021/266","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 8, step 1, p. 38; Figure 10, step 4, p. 39","phase":"online","what":"commitment to its coin-toss share, the first flow of the OPRF inside the OPPRF"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; Figure 8, step 1, p. 38; §7.1, p. 25","phase":"offline","what":"random VOLE for the OPRF's encoding of the cuckoo bins, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the OPRF's encoding of its bin labels, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"table","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39","phase":"online","what":"the OPPRF table, programming each bin's random value at its items","with":"open"},{"after":["open","table"],"blocks":["two_pc"],"id":"cmp","locator":"Figure 10, step 5, p. 39; §7.2, p. 30","phase":"online","what":"GMW comparison of each bin's two values into secret shares"}],"security_mode":"computational","security_model":"semi-honest two-party; OPPRF in the F_oprf-hybrid model (Theorem 5.1, p. 21); composition argued by reference to Pinkas, Schneider, Tkachenko, and Yanai (§6, p. 23)","security_notion":"circuit-PSI with secret-shared output","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The VOLE-PSI circuit-PSI with GMW's offline OTs generated by SilentOT instead of IKNP, which removes the κ factor from the comparison phase's communication. It is the faster variant on slow networks.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo-table expansion: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"},{"meaning":"Bound on the 2-core of a PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; a PaXoS over \\( k \\) items has \\( 2.4k + d + \\lambda \\) positions","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-RS","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-PROGRAMMABLE-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","assumption_name":"Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","attributes":{"adversary":{"locator":"Theorem 3.1, p. 16; Theorem 4.1, p. 20; Lemma 3.3, p. 17","note":"A malicious receiver's effective set is bounded by the OKVS size","value":["malicious"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","resolved":[{"id":"ASM-LPN","name":"Learning parity with noise (LPN)","short":"LPN"}],"value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18","note":"In the F_vole-hybrid model, a hybrid model; the simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 6, p. 37","value":"balanced"},"technique":{"locator":"§3.2, pp. 14–16; Figure 4, p. 36","value":["batched_oprf","vole","paxos"]}},"authors":["Peter Rindal","Phillipp Schoppmann"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"},{"key":"WYKW20","title":"Wolverine: Fast, scalable, and communication-efficient zero-knowledge proofs for boolean and arithmetic circuits"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20 and the consistency check of WYKW20","instantiation":"sgrr19_ywl20_wykw20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","func":"vole","locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","node":"0","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE, one for the batched check. WYKW20 uses its base sVOLE; RS21 does not say","open":true,"open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"block":"vole","calls":[{"block":"vole","calls":[{"block":"vole","func":"zk","implementation":"schnorr_fs","label":"Schnorr proof of knowledge of a discrete log, made non-interactive by Fiat–Shamir","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","node":"1/0/0","note":"Proof of knowledge of the discrete log of the public key B, the paper's \\( \\mathcal{F}_{\\mathsf{ZK}}^{\\mathsf{RDL}} \\); costed as Schnorr with Fiat–Shamir, sent with B","part":"ZK (discrete log of B)","phase":"setup","roles":{"prover":"receiver","verifier":"sender"},"source":"DKLs18"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"1/0","note":"KOS15 ran PVW08 base OTs (§4, p. 14); the PSI rows that use KOS pair it with VSOT (KRSSW19 §5.1)","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"DKLs18"},{"block":"vole","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"1/1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver"]},"source":"KOS15"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"kos15","label":"KOS OT extension (chosen-message, malicious)","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18","node":"1","note":"One per level above the last of each tree, on XORs of κ-bit nodes; the paper names no OT protocol","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"KOS15"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"2/0","note":"KOS15 ran PVW08 base OTs (§4, p. 14); the PSI rows that use KOS pair it with VSOT (KRSSW19 §5.1)","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"1/0"},"source":"DKLs18"},{"block":"vole","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"2/1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\omega + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver"]},"source":"KOS15"}],"count":"\\( \\omega \\)","func":"ot","implementation":"kos15","label":"KOS OT extension (chosen-message, malicious)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","node":"2","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"KOS15"}],"func":"vole","implementation":"sgrr19_ywl20_wykw20","label":"SGRR19 VOLE with YWL+20's bootstrapping and WYKW20's consistency check","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","node":"","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"WYKW20"}],"phase":"online","step_phase":"online"},"capabilities":["data-independent-setup"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"client_storage":null,"communication":null,"complexity":{"vole":{"costs":[{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (\\omega + 2)|\\mathbb{F}| + \\kappa \\)","locator":"Figure 7, steps 1, 5 and 6, p. 15; Optimizations, items 2–3, pp. 16–17; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\nu(2|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\nu(2|\\mathbb{F}|/\\kappa + 1) - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega|\\mathbb{F}|/\\kappa \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (d_A + 1)\\nu + \\omega + 1 \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (2d_A + 1)\\nu + \\omega \\)","locator":"Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"1/0/0","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"5","open":["base VOLE"],"phase":"setup","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"11","open":[],"phase":"online","rounds":"9"}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega-1 \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]}},"construction_family":"vole_okvs_oprf","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\kappa n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37; §4, pp. 19–20","measure":"communication","note":"OPRF values of \\( \\kappa \\) bits, which the paper shows suffice, and the coin toss's commitment and opening","subject":"sender"},{"basis":"counted","formula":"\\( (2.4n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, PaXoS details, p. 10; Figure 1, parameters, p. 7","measure":"communication","note":"The PaXoS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4n_Y+d+\\lambda+n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37; Figure 1, p. 7","measure":"computation","note":"One product \\( A_i\\Delta \\) per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per item; the binary-row decode is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"5","open":["base VOLE"],"phase":"setup","rounds":"5"},{"gloss":["VOLE"],"messages":"11","open":[],"phase":"offline","rounds":"9"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (\\omega + 2)\\kappa + \\kappa \\)","locator":"Figure 7, steps 1, 5 and 6, p. 15; Optimizations, items 2–3, pp. 16–17; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 3, p. 15; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( 3\\nu - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( 3\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (d_A + 1)\\nu + \\omega + 1 \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (2d_A + 1)\\nu + \\omega \\)","locator":"Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"1/0/0","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RS-MAL","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RS"],"paper_title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","paper_url":"https://eprint.iacr.org/2021/266","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the PaXoS's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the PaXoS of its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3 and parameters, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"\\( \\kappa \\)-bit OPRF values of its items, in random order","with":"open"}],"security_mode":"computational","security_model":"malicious two-party, programmable random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","security_notion":"PSI with output to the receiver; a corrupt receiver may use a larger set","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The VOLE-based OPRF with a random-oracle encoding of the receiver's set and a coin-tossed offset, giving malicious security at almost no extra cost. The sender's OPRF values need only κ bits, by the paper's sharper analysis.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bound on the 2-core of the PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; the PaXoS has \\( 2.4n_Y + d + \\lambda \\) positions","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-RS","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-PROGRAMMABLE-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","assumption_name":"Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","attributes":{"adversary":{"locator":"Theorem 3.1, p. 16; footnote 2, p. 15; Theorem 4.1, p. 20","note":"With interpolation a malicious receiver's effective set has at most \\( n_Y \\) items","value":["malicious"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","resolved":[{"id":"ASM-LPN","name":"Learning parity with noise (LPN)","short":"LPN"}],"value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18","note":"In the F_vole-hybrid model, a hybrid model; the simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 6, p. 37","value":"balanced"},"technique":{"locator":"§3, p. 8; §7.1, p. 24","note":"The Vandermonde OKVS: the receiver interpolates a polynomial through its items","value":["batched_oprf","vole","okvs"]}},"authors":["Peter Rindal","Phillipp Schoppmann"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"},{"key":"WYKW20","title":"Wolverine: Fast, scalable, and communication-efficient zero-knowledge proofs for boolean and arithmetic circuits"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20 and the consistency check of WYKW20","instantiation":"sgrr19_ywl20_wykw20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","func":"vole","locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","node":"0","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE, one for the batched check. WYKW20 uses its base sVOLE; RS21 does not say","open":true,"open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"block":"vole","calls":[{"block":"vole","calls":[{"block":"vole","func":"zk","implementation":"schnorr_fs","label":"Schnorr proof of knowledge of a discrete log, made non-interactive by Fiat–Shamir","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","node":"1/0/0","note":"Proof of knowledge of the discrete log of the public key B, the paper's \\( \\mathcal{F}_{\\mathsf{ZK}}^{\\mathsf{RDL}} \\); costed as Schnorr with Fiat–Shamir, sent with B","part":"ZK (discrete log of B)","phase":"setup","roles":{"prover":"receiver","verifier":"sender"},"source":"DKLs18"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"1/0","note":"KOS15 ran PVW08 base OTs (§4, p. 14); the PSI rows that use KOS pair it with VSOT (KRSSW19 §5.1)","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"DKLs18"},{"block":"vole","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"1/1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver"]},"source":"KOS15"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"kos15","label":"KOS OT extension (chosen-message, malicious)","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18","node":"1","note":"One per level above the last of each tree, on XORs of κ-bit nodes; the paper names no OT protocol","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"KOS15"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"2/0","note":"KOS15 ran PVW08 base OTs (§4, p. 14); the PSI rows that use KOS pair it with VSOT (KRSSW19 §5.1)","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"1/0"},"source":"DKLs18"},{"block":"vole","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"2/1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\omega + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver"]},"source":"KOS15"}],"count":"\\( \\omega \\)","func":"ot","implementation":"kos15","label":"KOS OT extension (chosen-message, malicious)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","node":"2","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"KOS15"}],"func":"vole","implementation":"sgrr19_ywl20_wykw20","label":"SGRR19 VOLE with YWL+20's bootstrapping and WYKW20's consistency check","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","node":"","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"WYKW20"}],"phase":"online","step_phase":"online"},"capabilities":["data-independent-setup"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"client_storage":null,"communication":null,"complexity":{"vole":{"costs":[{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (\\omega + 2)|\\mathbb{F}| + \\kappa \\)","locator":"Figure 7, steps 1, 5 and 6, p. 15; Optimizations, items 2–3, pp. 16–17; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\nu(2|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\nu(2|\\mathbb{F}|/\\kappa + 1) - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega|\\mathbb{F}|/\\kappa \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (d_A + 1)\\nu + \\omega + 1 \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (2d_A + 1)\\nu + \\omega \\)","locator":"Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"1/0/0","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"5","open":["base VOLE"],"phase":"setup","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"11","open":[],"phase":"online","rounds":"9"}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega-1 \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]}},"construction_family":"vole_okvs_oprf","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\kappa n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37; §4, pp. 19–20","measure":"communication","note":"OPRF values of \\( \\kappa \\) bits, which the paper shows suffice, and the coin toss's commitment and opening","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, The Vandermonde OKVS, p. 8","measure":"communication","note":"The polynomial masked by its VOLE share, one field element per coefficient, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( O((n_X+n_Y)\\log^{2} n_Y) \\)","locator":"§3, p. 8; Figure 4, p. 36; Figure 6, p. 37","measure":"computation","note":"Products \\( A_i\\Delta \\) for \\( K = B + A\\Delta \\), multi-point evaluation of the polynomial \\( K \\) at its items, and one \\( \\Delta H_F(y) \\) per item","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y\\log^{2} n_Y) \\)","locator":"§3, p. 8; §7.1, p. 24; Figure 6, p. 37","measure":"computation","note":"Fast interpolation of the polynomial through its items, then multi-point evaluation of its VOLE share \\( C \\) at them","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"5","open":["base VOLE"],"phase":"setup","rounds":"5"},{"gloss":["VOLE"],"messages":"11","open":[],"phase":"offline","rounds":"9"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (\\omega + 2)\\kappa + \\kappa \\)","locator":"Figure 7, steps 1, 5 and 6, p. 15; Optimizations, items 2–3, pp. 16–17; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 3, p. 15; Appendix A, p. 29","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( 3\\nu - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( 3\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; Optimizations, items 2–3, pp. 16–17","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (d_A + 1)\\nu + \\omega + 1 \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"formula":"\\( (2d_A + 1)\\nu + \\omega \\)","locator":"Figure 8, step 4, p. 18; Optimizations, item 3, pp. 16–17; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega + 1 \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Optimizations, item 3, p. 16; Appendix B.4, Optimizations, p. 39; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"1","operation":"field_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"1/0/0","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"1/0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"1/1","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"1/1","operation":"symmetric_op","part":["OT (GGM inner levels)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"2","operation":"field_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15"],"derived":true,"formula":"\\( 3\\omega + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"2/1","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20_wykw20","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"2/1","operation":"symmetric_op","part":["OT (GGM last level)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RS"],"paper_title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","paper_url":"https://eprint.iacr.org/2021/266","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the polynomial's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36; §2, The Vandermonde OKVS, p. 8","phase":"online","what":"seed, coin-toss share and the polynomial through its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3 and parameters, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"\\( \\kappa \\)-bit OPRF values of its items, in random order","with":"open"}],"security_mode":"computational","security_model":"malicious two-party, programmable random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","security_notion":"PSI with output to the receiver; a corrupt receiver may use a larger set","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The malicious VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interpolation cost.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2021-RS","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","assumption_name":"Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","attributes":{"adversary":{"locator":"Figure 6, p. 37","note":"OPRF outputs of \\( \\lambda + \\log n_X + \\log n_Y \\) bits","value":["semi_honest"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","resolved":[{"id":"ASM-LPN","name":"Learning parity with noise (LPN)","short":"LPN"}],"value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18; Theorem 4.1, p. 20","note":"In the F_vole-hybrid model, a hybrid model; covered by the malicious proofs, whose simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"§7.1, p. 25","note":"The VOLE cost is \\( o(n) \\), so the protocol suits large sets","value":"balanced"},"technique":{"locator":"§3, pp. 13–16; Figure 4, p. 36","value":["batched_oprf","vole","paxos"]}},"authors":["Peter Rindal","Phillipp Schoppmann"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","func":"vole","locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","node":"0","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE; later ones reserve them from their output. RS21 does not say how","open":true,"open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"1/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18; SGRR19 §8.1, p. 12; RS21 §7.2, p. 26","node":"1","note":"One per level above the last of each tree, on XORs of κ-bit nodes. Neither RS21 nor SGRR19 names the OT extension (libOTe, EMP)","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"2/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"1/0"},"source":"NP01"}],"count":"\\( \\omega \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","node":"2","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"}],"func":"vole","implementation":"sgrr19_ywl20","label":"SGRR19 VOLE with YWL+20's iterative bootstrapping","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","node":"","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"WYKW20"}],"phase":"online","step_phase":"online"},"capabilities":["data-independent-setup"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF"],"client_storage":null,"communication":null,"complexity":{"vole":{"costs":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu(|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu - 2\\omega\\log_2(\\nu/\\omega) + (\\nu - 2\\omega)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"3","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]}},"construction_family":"vole_okvs_oprf","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37","measure":"communication","note":"The OPRF values of its items, and the coin toss's commitment and opening, one field element each","subject":"sender"},{"basis":"counted","formula":"\\( (2.4n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, PaXoS details, p. 10; Figure 1, parameters, p. 7","measure":"communication","note":"The PaXoS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4n_Y+d+\\lambda+n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37; Figure 1, p. 7","measure":"computation","note":"One product \\( A_i\\Delta \\) per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per item; the binary-row decode is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["VOLE"],"messages":"2","open":[],"phase":"offline","rounds":"2"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RS-SH","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RS"],"paper_title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","paper_url":"https://eprint.iacr.org/2021/266","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the PaXoS's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the PaXoS of its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"OPRF values of its items, in random order","with":"open"}],"security_mode":"computational","security_model":"semi-honest two-party, random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"PSI from an OPRF built on VOLE: the receiver solves a PaXoS for its items, derandomizes a random VOLE of that length with one κ-bit element per position, and the sender evaluates the OPRF on its own set and sends the values. LPN-based VOLE makes the correlation cost sublinear.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Bound on the 2-core of the PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; the PaXoS has \\( 2.4n_Y + d + \\lambda \\) positions","symbol":"d"}],"verification_cost":null,"work_id":"PSI-PAPER-2021-RS","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","assumption_name":"Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","attributes":{"adversary":{"locator":"Figure 6, p. 37","note":"OPRF outputs of \\( \\lambda + \\log n_X + \\log n_Y \\) bits","value":["semi_honest"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","resolved":[{"id":"ASM-LPN","name":"Learning parity with noise (LPN)","short":"LPN"}],"value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18; Theorem 4.1, p. 20","note":"In the F_vole-hybrid model, a hybrid model; covered by the malicious proofs, whose simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"§7.1, p. 25","note":"The VOLE cost is \\( o(n) \\), so the protocol suits large sets","value":"balanced"},"technique":{"locator":"§3, p. 8; §7.1, p. 24","note":"The Vandermonde OKVS: the receiver interpolates a polynomial through its items","value":["batched_oprf","vole","okvs"]}},"authors":["Peter Rindal","Phillipp Schoppmann"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","func":"vole","locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","node":"0","note":"First extension with each Δ: μ for the LPN secret, one per single-point VOLE; later ones reserve them from their output. RS21 does not say how","open":true,"open_in":"RS21","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"},"part":"base VOLE","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"1/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; Figure 8, step 3, p. 18; SGRR19 §8.1, p. 12; RS21 §7.2, p. 26","node":"1","note":"One per level above the last of each tree, on XORs of κ-bit nodes. Neither RS21 nor SGRR19 names the OT extension (libOTe, EMP)","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"2/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"1/0"},"source":"NP01"}],"count":"\\( \\omega \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","node":"2","note":"The last level's OT carries sums of leaves, in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"}],"func":"vole","implementation":"sgrr19_ywl20","label":"SGRR19 VOLE with YWL+20's iterative bootstrapping","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","node":"","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"WYKW20"}],"phase":"online","step_phase":"online"},"capabilities":["data-independent-setup"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF"],"client_storage":null,"communication":null,"complexity":{"vole":{"costs":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu(|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\nu - 2\\omega\\log_2(\\nu/\\omega) + (\\nu - 2\\omega)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"3","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"variables":[{"meaning":"LPN noise weight: single-point VOLEs per extension, one per block of regular noise (WYKW20 writes t)","symbol":"\\omega"},{"meaning":"LPN length per extension (WYKW20 writes n), fixed by the LPN parameters; each block has \\( \\nu/\\omega \\) entries, a power of two. \\( \\nu-\\mu-\\omega \\ge m \\) when one extension gives all \\( m \\) outputs","symbol":"\\nu"},{"meaning":"LPN dimension: correlations kept for the next extension (WYKW20 writes k)","symbol":"\\mu"},{"meaning":"Nonzero entries per column of the LPN matrix A: 10 in WYKW20 and YWL+20, a 10-local code","symbol":"d_A"}]}},"construction_family":"vole_okvs_oprf","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37","measure":"communication","note":"The OPRF values of its items, and the coin toss's commitment and opening, one field element each","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, The Vandermonde OKVS, p. 8","measure":"communication","note":"The polynomial masked by its VOLE share, one field element per coefficient, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( O((n_X+n_Y)\\log^{2} n_Y) \\)","locator":"§3, p. 8; Figure 4, p. 36; Figure 6, p. 37","measure":"computation","note":"Products \\( A_i\\Delta \\) for \\( K = B + A\\Delta \\), multi-point evaluation of the polynomial \\( K \\) at its items, and one \\( \\Delta H_F(y) \\) per item","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y\\log^{2} n_Y) \\)","locator":"§3, p. 8; §7.1, p. 24; Figure 6, p. 37","measure":"computation","note":"Fast interpolation of the polynomial through its items, then multi-point evaluation of its VOLE share \\( C \\) at them","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":["base VOLE"],"phase":"setup","rounds":"3"},{"gloss":["VOLE"],"messages":"2","open":[],"phase":"offline","rounds":"2"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 1, p. 15; Optimizations, item 1, p. 16","measure":"communication","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 7, step 3, p. 15","measure":"communication","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega \\)","locator":"Figure 7, step 2, p. 15; text before Figure 7, p. 14","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 7, step 2, p. 15","measure":"computation","operation":"symmetric_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( d_A\\nu + \\omega \\)","locator":"Figure 7, step 1, p. 15; Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"formula":"\\( 2d_A\\nu \\)","locator":"Figure 8, step 4, p. 18; §6.1, p. 18","measure":"computation","operation":"field_op","source":"WYKW20","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"communication","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20"],"derived":true,"instance":{"func":"vole","id":"vole@0","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\mu + \\omega \\)"}},"locator":"Figure 8, steps 2 and 5, p. 18; Figure 7, step 1, p. 15; §6.1, p. 19","measure":"computation","node":"0","open_in":"RS21","part":["base VOLE"],"phase":"setup","source":"WYKW20","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"1/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"1/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["sgrr19_ywl20","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RS"],"paper_title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","paper_url":"https://eprint.iacr.org/2021/266","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the polynomial's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36; §2, The Vandermonde OKVS, p. 8","phase":"online","what":"seed, coin-toss share and the polynomial through its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"OPRF values of its items, in random order","with":"open"}],"security_mode":"computational","security_model":"semi-honest two-party, random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The semi-honest VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interpolation cost.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2021-RS","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","assumption_name":"oracle Diffie-Hellman with elligator encoding, ideal permutation, and random oracles","attributes":{"adversary":{"locator":"Lemmas 5-7, pp. 10-14; §4.1, pp. 15-16","note":"UC security against either party; a corrupt receiver may use a somewhat larger set than advertised.","value":["malicious"]},"assumptions":{"locator":"§1.2, PDF p. 5; §3.2, PDF p. 9","note":"For non-malleable hashed Diffie-Hellman","resolved":[{"id":"ASM-ODH","name":"Oracle Diffie-Hellman (ODH)","short":"ODH"}],"value":["ODH"]},"output":{"locator":"Figure 2, p. 6","value":["intersection"]},"output_to":{"locator":"Figure 2, p. 6; Figure 4, p. 11","note":"The receiver.","value":"one"},"parties":{"locator":"Figure 2, p. 6","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; §2.4, p. 7; Lemma 5, p. 10","note":"The ideal permutation model with random oracles.","value":["random permutation","random oracle"]},"set_size_regime":{"locator":"Figure 4, p. 11","value":"balanced"},"technique":{"locator":"Figure 4, p. 11; §5.1, p. 16","value":["key_agreement","diffie_hellman"]}},"authors":["Mike Rosulek","Ni Trieu"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["low-communication","small-sets"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"key_agreement_polynomial_encoding","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( |\\mathbb{G}| + 2\\kappa n_X \\)","locator":"Table 1, p. 4; §4, p. 15","measure":"communication","note":"One key-agreement message and one hash output per item.","subject":"sender"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{F}| \\)","locator":"Table 1, p. 4; §4, p. 15","measure":"communication","note":"The polynomial, over a field the size of an encoded group element.","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + 1 \\)","locator":"§4, p. 15","measure":"computation","note":"One key-agreement message and one key per item.","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 4, step 5, p. 11; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 4, step 5, p. 11; §3.2, p. 8","measure":"computation","note":"Per item: the first random oracle, the permutation, the hash of the Diffie-Hellman key, then the second random oracle","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4, p. 15; §3.2, p. 9","measure":"computation","note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 4, step 4, p. 11; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Interpolation of the polynomial through its points, by the fast algorithms the paper uses","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 4, steps 3, 4 and 7, p. 11; §3.2, p. 8","measure":"computation","note":"Per item: the inverse permutation, the first random oracle, the hash of the Diffie-Hellman key, then the second random oracle","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RT-MAL","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RT"],"paper_title":"Compact and Malicious Private Set Intersection for Small Sets","paper_url":"https://eprint.iacr.org/2021/1159","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"receiver","id":"poly","locator":"Figure 4, steps 3-4, p. 11; §3.2, p. 8; §4, Optimizations, p. 15","phase":"online","what":"the polynomial P; its Diffie-Hellman responses do not use m"},{"after":["poly"],"from":"sender","id":"keys","locator":"Figure 4, steps 5-6, p. 11","phase":"online","what":"the shuffled H_2 outputs K"},{"from":"sender","id":"ka","locator":"Figure 4, step 2, p. 11; §4, Optimizations, p. 15","phase":"online","what":"the key-agreement message m, combined with K","with":"keys"}],"security_mode":"computational","security_model":"malicious, UC, ideal permutation plus random oracle model (abstract, p. 1; Lemmas 5-7, pp. 10-14; §4.1, pp. 15-16)","security_notion":"PSI with output to the receiver; a corrupt receiver may input more than \\( n \\) items (\\( n' < 8n + 4 \\) for \\( n = 2^{10} \\), \\( |F| = 2^{256} \\))","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Malicious PSI from a key agreement with pseudorandom, non-malleable messages: the sender sends one Diffie-Hellman message, the receiver encodes its responses through an ideal permutation as a polynomial at hashed items, and the sender returns hashes of the keys it derives at its own items.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2021-RT","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-CDH-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","assumption_name":"CDH with elligator encoding, ideal permutation, and random oracles","attributes":{"adversary":{"locator":"Lemmas 11-12, pp. 24-25","value":["semi_honest"]},"assumptions":{"locator":"Table 1, p. 4; §3.2, pp. 8-9; Lemmas 11-12, pp. 24-25","note":"Hashed Diffie-Hellman is a secure key agreement under CDH with a random oracle; elligator makes the messages pseudorandom.","resolved":[{"id":"ASM-CDH","name":"Computational Diffie-Hellman (CDH)","short":"CDH"}],"value":["CDH"]},"output":{"locator":"Figure 5, p. 24","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 24","note":"The receiver.","value":"one"},"parties":{"locator":"Figure 2, p. 6","value":"two_party"},"security_model":{"locator":"Lemmas 11-12, pp. 24-25; §3.2, p. 8","note":"The ideal permutation model; the random oracle hashes the Diffie-Hellman key.","value":["random permutation","random oracle"]},"set_size_regime":{"locator":"Figure 5, p. 24","value":"balanced"},"technique":{"locator":"Figure 5, p. 24; §3.2, p. 8","value":["key_agreement","diffie_hellman"]}},"authors":["Mike Rosulek","Ni Trieu"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["low-communication","small-sets"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"key_agreement_polynomial_encoding","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( |\\mathbb{G}| + (\\lambda + \\log(n_Xn_Y))n_X \\)","locator":"Table 1, p. 4; Figure 5, p. 24","measure":"communication","note":"One key-agreement message and one short key per item.","subject":"sender"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{F}| \\)","locator":"Table 1, p. 4; Figure 5, p. 24","measure":"communication","note":"The polynomial, over a field the size of an encoded group element.","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + 1 \\)","locator":"Figure 5, p. 24; §4, p. 15","measure":"computation","note":"One key-agreement message and one key per item.","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 5, step 5, p. 24; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Figure 5, step 5, p. 24; §3.2, p. 8","measure":"computation","note":"Per item, the permutation and the hash of the Diffie-Hellman key","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 5, p. 24; §3.2, p. 9","measure":"computation","note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 5, step 4, p. 24; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Interpolation of the polynomial through its points, by the fast algorithms the paper uses","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 5, steps 3 and 7, p. 24; §3.2, p. 8","measure":"computation","note":"Per item, the inverse permutation and the hash of the Diffie-Hellman key","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RT-SH-V1","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RT"],"paper_title":"Compact and Malicious Private Set Intersection for Small Sets","paper_url":"https://eprint.iacr.org/2021/1159","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"ka","locator":"Figure 5, step 2, p. 24","phase":"online","what":"the key-agreement message m"},{"from":"receiver","id":"poly","locator":"Figure 5, steps 3-4, p. 24; §3.2, p. 8","phase":"online","what":"the polynomial P; its Diffie-Hellman responses do not use m"},{"after":["poly"],"from":"sender","id":"keys","locator":"Figure 5, steps 5-6, p. 24","phase":"online","what":"the shuffled keys K, from P evaluated at its items"}],"security_mode":"computational","security_model":"semi-honest; ideal permutation; hashed Diffie-Hellman in the random oracle model under CDH (Lemmas 11-12, pp. 24-25; §3.2, p. 8; Table 1, p. 4)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Semi-honest variant of the key-agreement PSI: the receiver interpolates its Diffie-Hellman responses, through an inverse ideal permutation, at its plain items, and the sender returns keys shortened to the statistical parameter plus twice the log of the set size.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2021-RT","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"discrete_log","assumption_id":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-AND-RANDOM-ORACLES","assumption_name":"oracle Diffie-Hellman with elligator encoding and random oracles","attributes":{"adversary":{"locator":"Appendix A.2, p. 26; Lemma 13, p. 27","value":["semi_honest"]},"assumptions":{"locator":"§1.2, PDF p. 5; §3.2, PDF p. 9","note":"For non-malleable hashed Diffie-Hellman","resolved":[{"id":"ASM-ODH","name":"Oracle Diffie-Hellman (ODH)","short":"ODH"}],"value":["ODH"]},"output":{"locator":"Figure 6, p. 26","value":["intersection"]},"output_to":{"locator":"Figure 6, p. 26","note":"The receiver.","value":"one"},"parties":{"locator":"Figure 2, p. 6","value":"two_party"},"security_model":{"locator":"Appendix A.2, p. 26; Lemma 13, p. 27; §3.2, p. 9","note":"No ideal permutation.","value":["random oracle"]},"set_size_regime":{"locator":"Figure 6, p. 26","value":"balanced"},"technique":{"locator":"Figure 6, p. 26","value":["key_agreement","diffie_hellman"]}},"authors":["Mike Rosulek","Ni Trieu"],"base_signature":null,"block_size":null,"blocks":[],"bootstrapping":null,"call_tree":{"calls":[],"phase":"online","step_phase":"online"},"capabilities":["low-communication","no-ideal-permutation"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"],"client_storage":null,"communication":null,"complexity":{},"construction_family":"key_agreement_polynomial_encoding","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( |\\mathbb{G}| + (\\lambda + \\log(n_Xn_Y))n_X \\)","locator":"Table 1, p. 4; Figure 6, p. 26","measure":"communication","note":"One key-agreement message and one short key per item.","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y + 1)|\\mathbb{F}| \\)","locator":"Table 1, p. 4; Figure 6, p. 26","measure":"communication","note":"The polynomial, one degree larger for the random point \\( P(0) = R \\).","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + 1 \\)","locator":"Figure 6, p. 26; §4, p. 15","measure":"computation","note":"One key-agreement message and one key per item.","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 6, step 5, p. 26; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 6, step 5, p. 26; §3.2, p. 8","measure":"computation","note":"The hash of the Diffie-Hellman key of each item","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 6, p. 26; §3.2, p. 9","measure":"computation","note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 6, step 4, p. 26; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Interpolation of the polynomial through its points and the random point at zero, by the fast algorithms the paper uses","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 6, step 7, p. 26; §3.2, p. 8","measure":"computation","note":"The hash of the Diffie-Hellman key of each item","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2021-RT-SH-V2","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2021-RT"],"paper_title":"Compact and Malicious Private Set Intersection for Small Sets","paper_url":"https://eprint.iacr.org/2021/1159","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"ka","locator":"Figure 6, step 2, p. 26","phase":"online","what":"the key-agreement message m"},{"from":"receiver","id":"poly","locator":"Figure 6, steps 3-4, p. 26; §3.2, p. 8","phase":"online","what":"the polynomial P; its Diffie-Hellman responses do not use m"},{"after":["poly"],"from":"sender","id":"keys","locator":"Figure 6, steps 5-6, p. 26","phase":"online","what":"the shuffled keys K, from P evaluated at its items"}],"security_mode":"computational","security_model":"semi-honest; non-malleable key agreement with pseudorandom second messages, which for hashed Diffie-Hellman is the oracle Diffie-Hellman assumption (Lemma 13, p. 27; §3.2, p. 9; Table 1, p. 4)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Semi-honest key-agreement PSI without an ideal permutation: the receiver interpolates its Diffie-Hellman responses directly at its items and adds a random point at zero, which lets the simulator program one evaluation at a time.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2021-RT","year":2021},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-SILVER-FOR-SILENT-OT-AND-VOLE","assumption_name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; Silver for silent OT and VOLE","attributes":{"adversary":{"locator":"§4, p. 23; Table 2, p. 25","value":["semi_honest"]},"assumptions":{"locator":"Table 2, p. 25; §4, p. 22","note":"No assumption is named; Silver supplies the VOLE and OT correlations","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"§1, p. 2; §4, p. 23","value":["circuit"]},"output_to":{"locator":"§1, p. 2; §4, p. 23","note":"Both parties hold secret shares, as in the VOLE-PSI circuit-PSI","value":"shared"},"parties":{"locator":"§4, p. 23","value":"two_party"},"security_model":{"locator":"RS21 Theorem 5.1, p. 21; §4, p. 23","note":"Inherited from the VOLE-PSI circuit-PSI, with the OKVS in its doubly oblivious form","source":"PSI-PAPER-2021-RS","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 2, p. 25","value":"balanced"},"technique":{"locator":"§4, p. 23; Table 2, p. 25","value":["opprf","batched_oprf","vole","okvs","cuckoo_hashing","simple_hashing"]}},"authors":["Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"vole","id":"vole","implementation":"silent VOLE (Silver)","instantiation":"silver","locator":"§4, p. 23; Table 2, p. 25; RS21 Figure 8, step 1, p. 38; RS21 Figure 4, step 3, p. 36","note":"For the OPRF's OKVS over the receiver's cuckoo bins, one correlation per position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( e\\epsilon n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[],"func":"two_pc","id":"two_pc","locator":"§4, p. 23; RS21 Figure 10, step 5, p. 39; RS21 §6, p. 23","note":"One equality test of the bin values per bin, as in VOLE-PSI; the paper names only Silver for the row","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19; §7.1, Noise distribution, p. 30; Table 2 caption, p. 31","node":"0","note":"One per level above the last of each tree, on XORs of κ-bit nodes. IKNP from 128 base OTs, as BCG+19's \"hybrid\"","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"1/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"0/0"},"source":"NP01"}],"count":"\\( \\omega \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 6, step 1, p. 17","node":"1","note":"The last level's OT carries the two sums of leaves, each in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"2/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"NP01"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"CRR21 §7, Vole Performance, p. 19; Figure 9, step 2, p. 19; Theorem 8, p. 18","node":"2","note":"The reverse VOLE for the noise values in 𝔽: one OT per bit of Δ, as CRR21 states count and length; roles as OT-based multiplication by Δ's bits","params":{"\\tau":"\\( O(\\kappa^{2}) \\)"},"part":"OT (reverse VOLE)","phase":"offline","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"PSZ18"}],"func":"vole","implementation":"silver","label":"Silver silent VOLE","locator":"§4, p. 23; Table 2, p. 25; RS21 Figure 8, step 1, p. 38; RS21 Figure 4, step 3, p. 36","node":"","note":"For the OPRF's OKVS over the receiver's cuckoo bins, one correlation per position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( e\\epsilon n_Y \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"BCG+19"},{"block":"two_pc","func":"two_pc","locator":"§4, p. 23; RS21 Figure 10, step 5, p. 39; RS21 §6, p. 23","node":"","note":"One equality test of the bin values per bin, as in VOLE-PSI; the paper names only Silver for the row","open":true,"params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"phase":"online","roles":{"party":["sender","receiver"]}}],"phase":"online","step_phase":"online"},"capabilities":["secret-shared-output"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-CIRCUIT-PSI"],"client_storage":null,"communication":null,"complexity":{"vole":{"costs":[{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\nu(|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\nu - 2\\omega\\log_2(\\nu/\\omega) + (\\nu - 2\\omega)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( |\\mathbb{F}|\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( O(|\\mathbb{F}|^{2}\\kappa) \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3|\\mathbb{F}| \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3|\\mathbb{F}| \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"6","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"5","open":[],"phase":"online","rounds":"3"}],"variables":[{"meaning":"LPN noise weight: the number of punctured GGM trees, one per block of regular noise (BCG+19 and CRR21 write t)","symbol":"\\omega"},{"meaning":"LPN code length (BCG+19 writes N, CRR21 n); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2m \\)","symbol":"\\nu"}]}},"construction_family":"opprf_cuckoo_circuit","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( 3e(\\lambda+\\log_2(\\epsilon n_Y))n_X+2\\kappa \\)","locator":"RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; RS21 Figure 4, steps 1 and 5, p. 36; §4, p. 23; Figure 1, step 5, p. 7","measure":"communication","note":"The OPPRF table, this paper's doubly oblivious OKVS over its items in their three bins, and the coin toss's commitment and opening","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( (e\\epsilon n_Y+2)\\kappa \\)","locator":"RS21 Figure 4, step 4, p. 36; RS21 Figure 10, step 4, p. 39; §4, p. 23","measure":"communication","note":"The OPRF's OKVS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( e\\epsilon n_Y+O(n_X) \\)","locator":"RS21 Figure 4, step 4 and the sender's evaluation, p. 36; RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; §2, p. 6; §2, Field row, p. 8","measure":"computation","note":"One product per OKVS position for \\( K = B + A\\Delta \\); per table entry \\( \\Delta H_F(y) \\) and the OPRF decode's products with the field-valued dense columns","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( 24n_X+1 \\)","locator":"RS21 Figure 10, steps 2–3, p. 39; RS21 Figure 8, step 2, p. 38; RS21 Figure 4, p. 36; Figure 1, step 1, p. 7","measure":"computation","note":"Simple hashing with three functions; per table entry the two row functions, \\( H_F \\) and \\( H \\) for the OPRF, and the row functions for the table","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"RS21 Figure 4, p. 36; RS21 Figure 8, step 3, p. 38; RS21 Figure 10, step 1, p. 39; §2, p. 6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns in encoding the OPRF's OKVS over its bins and in decoding it at each bin","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( (7\\epsilon+4)n_Y+1 \\)","locator":"RS21 Figure 10, steps 1 and 4, p. 39; RS21 Figure 4, steps 2, 5 and 6, p. 36; RS21 Figure 8, step 3, p. 38; Figure 1, step 1, p. 7","measure":"computation","note":"Cuckoo hashing, the bin labels, then per bin the row functions, \\( H_F \\) and \\( H \\) for the OPRF, and the row functions for the table","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"6","open":[],"phase":"setup","rounds":"3"},{"gloss":["VOLE"],"messages":"5","open":[],"phase":"offline","rounds":"3"},{"gloss":["the protocol's own messages","2PC"],"messages":"\\mathsf{2PC}[\\ldots]#two_pc + 3","open":[],"phase":"online","rounds":"\\mathsf{2PC}[\\ldots]#two_pc + 3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages","2PC"],"messages":"\\mathsf{2PC}[\\ldots]#two_pc + 3","open":[],"phase":"online","rounds":"\\mathsf{2PC}[\\ldots]#two_pc + 3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 2\\nu - 2\\omega \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\kappa^{2} \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( O(\\kappa^{3}) \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"paper_title":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","paper_url":"https://eprint.iacr.org/2022/320","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"circuit-PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"RS21 Figure 4, step 1, p. 36; RS21 Figure 8, step 1, p. 38; RS21 Figure 10, step 4, p. 39","phase":"online","what":"commitment to its coin-toss share, the first flow of the OPRF inside the OPPRF"},{"blocks":["vole"],"id":"vole","locator":"RS21 Figure 4, step 3, p. 36; RS21 Figure 8, step 1, p. 38; §4, p. 23","phase":"offline","what":"random VOLE for the OPRF's encoding of the cuckoo bins, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"RS21 Figure 10, steps 1 and 4, p. 39; RS21 Figure 4, steps 2 and 4, p. 36; §4, p. 23","phase":"online","what":"seed, coin-toss share and the OPRF's encoding of its bin labels, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"RS21 Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"table","locator":"RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; §4, p. 23","phase":"online","what":"the OPPRF table, programming each bin's random value at its items","with":"open"},{"after":["open","table"],"blocks":["two_pc"],"id":"cmp","locator":"RS21 Figure 10, step 5, p. 39; §4, p. 23","phase":"online","what":"2PC comparison of each bin's two values into secret shares"}],"security_mode":"computational","security_model":"semi-honest two-party, by reference to the circuit-PSI of PSI-PAPER-2021-RS (§4, p. 23)","security_notion":"circuit-PSI with secret-shared output","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The VOLE-PSI circuit-PSI with the row-weight-3 triangulation OKVS in its doubly oblivious form and Silver for the VOLE and OT correlations. The paper describes it only through VOLE-PSI and one benchmark row.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Cuckoo-table expansion: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"},{"meaning":"OKVS expansion: an OKVS over \\( k \\) items has \\( ek \\) positions; not stated for this row (the paper's PSI rows use about 1.23 unclustered and 1.28 clustered)","symbol":"e"}],"verification_cost":null,"work_id":"PSI-PAPER-2022-RR","year":2022},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-SUBFIELD-VOLE-HYBRID-MODEL-VOLE-FOLLOWING-COUTEAU-RINDAL-RAGHURAMAN-2021-AND-BOYLE-ET-AL-2019","assumption_name":"Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019","attributes":{"adversary":{"locator":"Theorem 3, p. 33","value":["semi_honest"]},"assumptions":{"locator":"§4, p. 22","note":"No assumption is named; the VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"Figure 9, p. 23","value":["intersection"]},"output_to":{"locator":"Figure 9, step 5, p. 23","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 9, p. 23","value":"two_party"},"security_model":{"locator":"Theorem 3, p. 33; Figure 9, p. 23","note":"In the F_sub-vole-hybrid model, a hybrid model, with random oracles H_B and H_o","value":["random oracle"]},"set_size_regime":{"locator":"Figure 9, p. 23","value":"balanced"},"technique":{"locator":"§4, pp. 22–23; Figure 9, p. 23","value":["batched_oprf","vole","okvs"]}},"authors":["Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"vole","id":"vole","implementation":"silent VOLE (Silver)","instantiation":"silver","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","note":"Invoked as subfield VOLE with the base field equal to its extension, which is VOLE","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\approx 1.28n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19; §7.1, Noise distribution, p. 30; Table 2 caption, p. 31","node":"0","note":"One per level above the last of each tree, on XORs of κ-bit nodes. IKNP from 128 base OTs, as BCG+19's \"hybrid\"","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"1/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"vole","node":"0/0"},"source":"NP01"}],"count":"\\( \\omega \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 6, step 1, p. 17","node":"1","note":"The last level's OT carries the two sums of leaves, each in 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"vole","calls":[{"block":"vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"2/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","roles":{"receiver":"receiver","sender":"sender"},"source":"NP01"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"CRR21 §7, Vole Performance, p. 19; Figure 9, step 2, p. 19; Theorem 8, p. 18","node":"2","note":"The reverse VOLE for the noise values in 𝔽: one OT per bit of Δ, as CRR21 states count and length; roles as OT-based multiplication by Δ's bits","params":{"\\tau":"\\( O(\\kappa^{2}) \\)"},"part":"OT (reverse VOLE)","phase":"offline","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"PSZ18"}],"func":"vole","implementation":"silver","label":"Silver silent VOLE","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","node":"","note":"Invoked as subfield VOLE with the base field equal to its extension, which is VOLE","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\approx 1.28n_Y \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"BCG+19"}],"phase":"online","step_phase":"online"},"capabilities":["multi-threaded"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"client_storage":null,"communication":null,"complexity":{"vole":{"costs":[{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\nu(|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\nu - 2\\omega\\log_2(\\nu/\\omega) + (\\nu - 2\\omega)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( |\\mathbb{F}|\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( O(|\\mathbb{F}|^{2}\\kappa) \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3|\\mathbb{F}| \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3|\\mathbb{F}| \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"counts":[{"gloss":["base OT"],"messages":"6","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"5","open":[],"phase":"online","rounds":"3"}],"variables":[{"meaning":"LPN noise weight: the number of punctured GGM trees, one per block of regular noise (BCG+19 and CRR21 write t)","symbol":"\\omega"},{"meaning":"LPN code length (BCG+19 writes N, CRR21 n); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2m \\)","symbol":"\\nu"}]}},"construction_family":"vole_okvs_oprf","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X \\)","locator":"Figure 9, step 4 and parameters, p. 23; §4, p. 22","measure":"communication","note":"The OPRF values of the sender's items","subject":"sender"},{"basis":"counted","formula":"\\( 1.28\\kappa n_Y+2\\kappa \\)","locator":"Figure 9, steps 1, 3 and 4, p. 23; §4, p. 22","measure":"communication","note":"The OKVS correction, one field element per position, with the seeds \\( r \\) and \\( r' \\); the figure omits sending \\( r' \\), which the sender needs","subject":"receiver"},{"basis":"counted","formula":"\\( 1.28n_Y+O(n_X) \\)","locator":"Figure 9, steps 3–4, p. 23; Figure 1, p. 7; §4, p. 22; §2, Field row, p. 8","measure":"computation","note":"One product per OKVS position for \\( B' = B + A'\\Delta \\); per item \\( \\Delta H_B(y) \\) and the decode's products with the field-valued dense columns","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 9, step 4, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_B \\) and \\( H_o \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"Figure 9, steps 1, 3 and 5, p. 23; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns: their powers, the gap's elimination and back-substitution in encoding, and the decodes at its items","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 9, steps 1 and 5, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item \\( H_B \\), the two row functions and \\( H_o \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"6","open":[],"phase":"setup","rounds":"3"},{"gloss":["VOLE"],"messages":"5","open":[],"phase":"offline","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 2\\nu - 2\\omega \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( \\kappa^{2} \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( O(\\kappa^{3}) \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"2","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"receiver"},{"block":"vole","chain":["silver","iknp"],"derived":true,"formula":"\\( 3\\kappa \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"2","operation":"symmetric_op","part":["OT (reverse VOLE)"],"source":"PSZ18","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"2/0","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"exponentiation","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"modmul","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"vole","chain":["silver","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"2/0","operation":"symmetric_op","part":["OT (reverse VOLE)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2022-RR-FAST","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"paper_title":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","paper_url":"https://eprint.iacr.org/2022/320","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["vole"],"id":"vole","locator":"Figure 9, step 2, p. 23","phase":"offline","what":"random VOLE of the OKVS's dimension, before the sets"},{"after":["vole"],"from":"receiver","id":"okvs","locator":"Figure 9, steps 1 and 3, p. 23","phase":"online","what":"OKVS seed r, the seed r′ the figure omits, and the OKVS correction"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 9, step 4, p. 23","phase":"online","what":"OPRF values of its items, in random order"}],"security_mode":"computational","security_model":"semi-honest two-party, random oracle model, F_sub-vole-hybrid (Theorem 3, p. 33)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"VOLE-PSI with the triangulation OKVS of row weight 3, clustered for speed, and no subfield: the receiver derandomizes a VOLE into its OKVS and the sender sends OPRF values. The new OKVS encodes in near-linear time with only a few dense columns.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2022-RR","year":2022},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"ASM-ROM","assumption_ids":["ASM-ROM"],"assumption_name":"Random oracles, in the vector-OLE hybrid model (malicious protocol of VOLE-PSI)","attributes":{"adversary":{"locator":"§4, p. 23","note":"Through the malicious VOLE-PSI protocol; no separate proof for the new OKVS","value":["malicious"]},"assumptions":{"locator":"§4, pp. 22–23","note":"No assumption is named; the VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"§4, p. 23","value":["intersection"]},"output_to":{"locator":"§4, p. 23","note":"Receiver only, as in the VOLE-PSI protocol","value":"one"},"parties":{"locator":"§4, p. 23","value":"two_party"},"security_model":{"locator":"RS21 Theorem 3.1, p. 16; §4, p. 23","note":"Inherited from VOLE-PSI, whose simulators program H in the F_vole-hybrid model","source":"PSI-PAPER-2021-RS","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 2, p. 25","value":"balanced"},"technique":{"locator":"§4, p. 23","value":["batched_oprf","vole","okvs"]}},"authors":["Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"vole","id":"vole","implementation":"silent VOLE (Silver)","instantiation":"silver_mal","locator":"§4, pp. 22–23; RS21 Figure 4, step 3, p. 36; RS21 Theorem 3.1, p. 16","note":"The malicious VOLE-PSI protocol with this paper's OKVS, one correlation per OKVS position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( en_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"vole","calls":[{"block":"vole","calls":[{"block":"vole","calls":[{"block":"vole","func":"zk","implementation":"schnorr_fs","label":"Schnorr proof of knowledge of a discrete log, made non-interactive by Fiat–Shamir","locator":"Appendix A, Protocol 7, step 2, PDF p. 52; Cost Analysis, PDF p. 48","node":"0/0/0","note":"Proof of knowledge of the discrete log of the public key B, the paper's \\( \\mathcal{F}_{\\mathsf{ZK}}^{\\mathsf{RDL}} \\); costed as Schnorr with Fiat–Shamir, sent with B","part":"ZK (discrete log of B)","phase":"setup","roles":{"prover":"receiver","verifier":"sender"},"source":"DKLs18"}],"count":"\\( \\kappa \\)","func":"ot","implementation":"vsot","label":"Verified Simplest OT (Chou-Orlandi with the verification of Doerner et al.)","locator":"Fig. 3, Initialize, p. 7","node":"0/0","note":"KOS15 ran PVW08 base OTs (§4, p. 14); the PSI rows that use KOS pair it with VSOT (KRSSW19 §5.1)","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"DKLs18"},{"block":"vole","func":"coin_toss","implementation":"kos15_frand","label":"Coin tossing by hash commitments to two seeds, expanded by a PRG (KOS15's F_Rand)","locator":"Fig. 7, Check correlation, p. 10; §4, p. 14","node":"0/1","note":"F_Rand samples the weights χ in \\( \\mathbb{F}_{2^{\\kappa}} \\), one per row, after the receiver's columns; §4 realizes it with hash commitments to two seeds","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda \\)"},"part":"coin toss (check weights)","phase":"offline","roles":{"party":["sender","receiver"]},"source":"KOS15"}],"count":"\\( \\omega\\log_2(\\nu/\\omega) \\)","func":"ot","implementation":"kos15","label":"KOS OT extension (chosen-message, malicious)","locator":"Figure 13, step 5, p. 25; Figure 16, step 3, p. 26; Theorem 15, p. 23","node":"0","note":"One per level above the leaves of each tree, on XORs of κ-bit nodes; the leaf level's odd half is sent in the clear. Parallel, maliciously secure","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM trees)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"KOS15"},{"block":"vole","func":"vole","locator":"Figure 14, p. 25; Figure 16, step 2, p. 26; §6.6, p. 28","node":"1","note":"The generalized reverse VOLE: the sender's two scalars (χ, x) on the receiver's noise values. BCG+19 leaves its protocol open","open":true,"open_in":"BCG+19","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"},"part":"reverse VOLE","phase":"offline","roles":{"receiver":"receiver","sender":"sender"}}],"func":"vole","implementation":"silver_mal","label":"Silver silent VOLE with BCG+19's malicious setup","locator":"§4, pp. 22–23; RS21 Figure 4, step 3, p. 36; RS21 Theorem 3.1, p. 16","node":"","note":"The malicious VOLE-PSI protocol with this paper's OKVS, one correlation per OKVS position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( en_Y \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"BCG+19"}],"phase":"online","step_phase":"online"},"capabilities":["multi-threaded"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"client_storage":null,"communication":null,"complexity":{"vole":{"costs":[{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( (3\\omega + 1)|\\mathbb{F}| + 2\\omega\\kappa \\)","locator":"Figure 13, steps 6–7, p. 25; Figure 16, step 5, p. 26","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 16, step 4, p. 26; text after Theorem 16, p. 27","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( \\nu(2|\\mathbb{F}|/\\kappa + 3) - \\omega + (\\nu/\\omega + 1)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 13, steps 2 and 7, p. 25; text after Theorem 16, p. 27","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( \\nu(2|\\mathbb{F}|/\\kappa + 3) - 2\\omega(\\log_2(\\nu/\\omega) + |\\mathbb{F}|/\\kappa + 1) + (\\nu/\\omega + 1)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 13, step 8, p. 25; text after Theorem 16, p. 27","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( 2\\nu + 1 \\)","locator":"Figure 16, step 5, p. 26","measure":"computation","operation":"field_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( 2\\nu + 2\\omega \\)","locator":"Figure 16, step 7, p. 26","measure":"computation","operation":"field_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"0","part":["OT (GGM trees)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( 2\\omega\\log_2(\\nu/\\omega)\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"0","part":["OT (GGM trees)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"0","operation":"field_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"0","operation":"field_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega) + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"0/0","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0/0","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0/0","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"modmul","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"0/1","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"0/1","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"0/1","operation":"symmetric_op","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"0/1","operation":"symmetric_op","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal"],"derived":true,"instance":{"func":"vole","id":"vole@1","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Figure 14, p. 25; Figure 16, step 2, p. 26; §6.6, p. 28","measure":"communication","node":"1","open_in":"BCG+19","part":["reverse VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["silver_mal"],"derived":true,"instance":{"func":"vole","id":"vole@1","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Figure 14, p. 25; Figure 16, step 2, p. 26; §6.6, p. 28","measure":"computation","node":"1","open_in":"BCG+19","part":["reverse VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"}],"counts":[{"gloss":["base OT"],"messages":"5","open":[],"phase":"setup","rounds":"5"},{"gloss":["the protocol's own messages"],"messages":"10","open":["reverse VOLE"],"phase":"online","rounds":"7"}],"variables":[{"meaning":"LPN noise weight: the number of PPRFs, one per block of regular noise (BCG+19 writes t)","symbol":"\\omega"},{"meaning":"LPN code length (BCG+19 writes N); each PPRF has \\( \\nu/\\omega \\) outputs, a power of two, on a tree of \\( 2\\nu/\\omega \\) leaves. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2m \\)","symbol":"\\nu"}]}},"construction_family":"vole_okvs_oprf","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( \\kappa n_X+2\\kappa \\)","locator":"RS21 Figure 4, steps 1 and 5, p. 36; RS21 Figure 6, step 3, p. 37; §4, p. 23","measure":"communication","note":"OPRF values of \\( \\kappa \\) bits, and the coin toss's commitment and opening","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( (en_Y+2)\\kappa \\)","locator":"RS21 Figure 4, step 4, p. 36; §4, p. 23; Figure 1, p. 7","measure":"communication","note":"This paper's OKVS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( en_Y+O(n_X) \\)","locator":"RS21 Figure 4, step 4 and the sender's evaluation, p. 36; §4, p. 23; Figure 1, p. 7; §2, Field row, p. 8","measure":"computation","note":"One product per OKVS position for \\( K = B + A\\Delta \\); per item \\( \\Delta H_F(y) \\) and the decode's products with the field-valued dense columns","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X+1 \\)","locator":"RS21 Figure 4, step 1 and the sender's evaluation, p. 36; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"RS21 Figure 4, steps 2, 4 and 6, p. 36; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns in encoding the OKVS and in decoding its VOLE share at its items","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y+1 \\)","locator":"RS21 Figure 4, steps 2, 5 and 6, p. 36; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"5","open":[],"phase":"setup","rounds":"5"},{"gloss":["VOLE"],"messages":"10","open":["reverse VOLE"],"phase":"offline","rounds":"7"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}],"overview":[{"gloss":["VOLE"],"messages":"\\mathsf{VOLE}[\\ldots]#vole","open":[],"phase":"offline","rounds":"\\mathsf{VOLE}[\\ldots]#vole"},{"gloss":["the protocol's own messages"],"messages":"3","open":[],"phase":"online","rounds":"3"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( (3\\omega + 1)\\kappa + 2\\omega\\kappa \\)","locator":"Figure 13, steps 6–7, p. 25; Figure 16, step 5, p. 26","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Figure 16, step 4, p. 26; text after Theorem 16, p. 27","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( 5\\nu - \\omega + \\nu/\\omega + 1 \\)","locator":"Figure 13, steps 2 and 7, p. 25; text after Theorem 16, p. 27","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( 5\\nu - 2\\omega(\\log_2(\\nu/\\omega) + 2) + \\nu/\\omega + 1 \\)","locator":"Figure 13, step 8, p. 25; text after Theorem 16, p. 27","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( 2\\nu + 1 \\)","locator":"Figure 16, step 5, p. 26","measure":"computation","operation":"field_op","source":"BCG+19","subject":"sender"},{"block":"vole","chain":["silver_mal"],"derived":true,"formula":"\\( 2\\nu + 2\\omega \\)","locator":"Figure 16, step 7, p. 26","measure":"computation","operation":"field_op","source":"BCG+19","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( \\kappa(\\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda) + 2\\kappa \\)","locator":"Fig. 3, Extend step 3, p. 7; Fig. 7, Check correlation, p. 10","measure":"communication","node":"0","part":["OT (GGM trees)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( 2\\omega\\log_2(\\nu/\\omega)\\kappa \\)","locator":"Fig. 9, step 2, p. 14","measure":"communication","node":"0","part":["OT (GGM trees)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda + 1 \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"0","operation":"field_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda \\)","locator":"Fig. 7, Check correlation, p. 10","measure":"computation","node":"0","operation":"field_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15"],"derived":true,"formula":"\\( 3\\omega\\log_2(\\nu/\\omega) + 2\\kappa + 2\\lambda \\)","locator":"Fig. 3, Extend step 2, p. 7; Fig. 7, Randomize, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM trees)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( |\\mathbb{G}| + 5\\kappa^{2} \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, steps 5, 7 and 9, PDF p. 52","measure":"communication","node":"0/0","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( \\kappa(|\\mathbb{G}| + \\kappa) \\)","locator":"Appendix A, Protocol 7, steps 3 and 6, PDF p. 52","measure":"communication","node":"0/0","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa + 1 \\)","locator":"Appendix A, Protocol 7, step 1, PDF p. 52; Appendix A, Protocol 7, step 4, PDF p. 52","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Appendix A, Protocol 7, step 3, PDF p. 52","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 6\\kappa \\)","locator":"Appendix A, Protocol 7, steps 4, 5 and 7, PDF p. 52","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot"],"derived":true,"formula":"\\( 5\\kappa \\)","locator":"Appendix A, Protocol 7, steps 3, 6 and 8, PDF p. 52","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( |\\mathbb{G}| + \\kappa \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version); Appendix A, Protocol 7, parameters, PDF p. 52","measure":"communication","node":"0/0/0","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"modmul","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 2 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"exponentiation","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","vsot","schnorr_fs"],"derived":true,"formula":"\\( 1 \\)","locator":"§VII, Cost Analysis, PDF p. 48 (p. 12 of the June 2018 ePrint version)","measure":"computation","node":"0/0/0","operation":"symmetric_op","part":["OT (GGM trees)","base OT","ZK (discrete log of B)"],"phase":"setup","source":"DKLs18","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"0/1","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"§4, p. 14","measure":"communication","node":"0/1","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"0/1","operation":"symmetric_op","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"sender"},{"block":"vole","chain":["silver_mal","kos15","kos15_frand"],"derived":true,"formula":"\\( \\omega\\log_2(\\nu/\\omega) + \\kappa + \\lambda + 2 \\)","locator":"§4, p. 14; Fig. 7, Check correlation, p. 10","measure":"computation","node":"0/1","operation":"symmetric_op","part":["OT (GGM trees)","coin toss (check weights)"],"source":"KOS15","subject":"receiver"},{"block":"vole","chain":["silver_mal"],"derived":true,"instance":{"func":"vole","id":"vole@1","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Figure 14, p. 25; Figure 16, step 2, p. 26; §6.6, p. 28","measure":"communication","node":"1","open_in":"BCG+19","part":["reverse VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"},{"block":"vole","chain":["silver_mal"],"derived":true,"instance":{"func":"vole","id":"vole@1","params":{"\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Figure 14, p. 25; Figure 16, step 2, p. 26; §6.6, p. 28","measure":"computation","node":"1","open_in":"BCG+19","part":["reverse VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2022-RR-MAL","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"paper_title":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","paper_url":"https://eprint.iacr.org/2022/320","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"from":"sender","id":"commit","locator":"RS21 Figure 4, step 1, p. 36; RS21 Figure 6, step 1, p. 37; §4, p. 23","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"RS21 Figure 4, step 3, p. 36; RS21 §7.1, p. 25; §4, p. 23","phase":"offline","what":"random VOLE of the OKVS's dimension, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"RS21 Figure 4, steps 2 and 4, p. 36; §4, p. 23","phase":"online","what":"seed, coin-toss share and this paper's OKVS of its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"RS21 Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"RS21 Figure 6, steps 2–3 and parameters, p. 37; RS21 Figure 4, the sender's evaluation, p. 36","phase":"online","what":"\\( \\kappa \\)-bit OPRF values of its items, in random order","with":"open"}],"security_mode":"computational","security_model":"malicious two-party, via the VOLE-PSI proofs (§4, p. 23)","security_notion":"PSI with output to the receiver; a corrupt receiver may use a larger set","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"The malicious VOLE-PSI protocol of Rindal and Schoppmann run with the triangulation OKVS in place of PaXoS. The authors observe almost no overhead over their semi-honest protocol.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"OKVS expansion: the receiver's OKVS has \\( en_Y \\) positions; not stated for this row (Table 2 prints 1.3; the fast instantiation has about 1.28)","symbol":"e"}],"verification_cost":null,"work_id":"PSI-PAPER-2022-RR","year":2022},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"idealized_model","assumption_id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-SUBFIELD-VOLE-HYBRID-MODEL-VOLE-FOLLOWING-COUTEAU-RINDAL-RAGHURAMAN-2021-AND-BOYLE-ET-AL-2019","assumption_name":"Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019","attributes":{"adversary":{"locator":"Theorem 3, p. 33","value":["semi_honest"]},"assumptions":{"locator":"§4, p. 22","note":"No assumption is named; the subfield VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"Figure 9, p. 23","value":["intersection"]},"output_to":{"locator":"Figure 9, step 5, p. 23","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 9, p. 23","value":"two_party"},"security_model":{"locator":"Theorem 3, p. 33; Figure 9, p. 23","note":"In the F_sub-vole-hybrid model, a hybrid model, with random oracles H_B and H_o","value":["random oracle"]},"set_size_regime":{"locator":"Figure 9, p. 23","value":"balanced"},"technique":{"locator":"§4, pp. 22–23; Figure 9, p. 23","value":["batched_oprf","subfield_vole","okvs"]}},"authors":["Srinivasan Raghuraman","Peter Rindal"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"sub_vole","id":"sub_vole","implementation":"silent subfield VOLE (Silver)","instantiation":"silver_sub","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","note":"The smallest base field and the smallest extension meeting these bounds","params":{"\\mathbb{B}":"\\( |\\mathbb{B}| \\ge \\lambda+\\log(n_Xn_Y) \\)","\\mathbb{F}":"\\( |\\mathbb{F}| \\ge \\kappa \\)","m":"\\( 1.23n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"sub_vole","calls":[{"block":"sub_vole","calls":[{"block":"sub_vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"0/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"source":"NP01"}],"count":"\\( \\omega(\\log_2(\\nu/\\omega) - 1) \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 6, step 1, p. 17; Figure 9, step 3, p. 19; §7.1, Noise distribution, p. 30; Table 2 caption, p. 31","node":"0","note":"One per level above the last of each tree, on XORs of κ-bit nodes. IKNP from 128 base OTs, as BCG+19's \"hybrid\"","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM inner levels)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"sub_vole","calls":[{"block":"sub_vole","count":"\\( \\kappa \\)","func":"ot","implementation":"np01","label":"Naor-Pinkas OT","locator":"Protocol 1, common input and step 2, p. 10","node":"1/0","params":{"\\tau":"\\( \\kappa \\)"},"part":"base OT","phase":"setup","reversed":true,"roles":{"receiver":"sender","sender":"receiver"},"shared":{"block":"sub_vole","node":"0/0"},"source":"NP01"}],"count":"\\( \\omega \\)","func":"ot","implementation":"iknp","label":"IKNP OT extension","locator":"Figure 6, step 1, p. 17","node":"1","note":"The last level's OT carries the two sums of leaves, each in the extension field 𝔽","params":{"\\tau":"\\( \\kappa \\)"},"part":"OT (GGM last level)","phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"PSZ18"},{"block":"sub_vole","func":"sub_vole","locator":"Theorem 8 and Figure 8, p. 18; Figure 9, step 2, p. 19","node":"2","note":"Reverse subfield VOLE: the receiver inputs the noise values in 𝔹, the sender Δ and its shares. Not needed when \\( \\mathbb{B} = \\mathbb{F}_2 \\). No source costs it for a subfield","open":true,"open_in":"BCG+19","params":{"\\mathbb{B}":"\\( \\mathbb{B} \\)","\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"},"part":"reverse sub-VOLE","phase":"offline","roles":{"receiver":"receiver","sender":"sender"}}],"func":"sub_vole","implementation":"silver_sub","label":"Silver silent subfield VOLE","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","node":"","note":"The smallest base field and the smallest extension meeting these bounds","params":{"\\mathbb{B}":"\\( |\\mathbb{B}| \\ge \\lambda+\\log(n_Xn_Y) \\)","\\mathbb{F}":"\\( |\\mathbb{F}| \\ge \\kappa \\)","m":"\\( 1.23n_Y \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"},"source":"BCG+19"}],"phase":"online","step_phase":"online"},"capabilities":["multi-threaded"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"client_storage":null,"communication":null,"complexity":{"sub_vole":{"costs":[{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( \\omega|\\mathbb{F}| \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( \\nu(|\\mathbb{F}|/\\kappa + 1) - 2\\omega \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( \\nu - 2\\omega\\log_2(\\nu/\\omega) + (\\nu - 2\\omega)|\\mathbb{F}|/\\kappa \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 2\\omega|\\mathbb{F}| \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"instance":{"func":"sub_vole","id":"sub_vole@2","params":{"\\mathbb{B}":"\\( \\mathbb{B} \\)","\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Theorem 8 and Figure 8, p. 18; Figure 9, step 2, p. 19","measure":"communication","node":"2","open_in":"BCG+19","part":["reverse sub-VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"instance":{"func":"sub_vole","id":"sub_vole@2","params":{"\\mathbb{B}":"\\( \\mathbb{B} \\)","\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Theorem 8 and Figure 8, p. 18; Figure 9, step 2, p. 19","measure":"computation","node":"2","open_in":"BCG+19","part":["reverse sub-VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"}],"counts":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["the protocol's own messages"],"messages":"3","open":["reverse sub-VOLE"],"phase":"online","rounds":"2"}],"variables":[{"meaning":"LPN noise weight: the number of punctured GGM trees, one per block of regular noise (BCG+19 and CRR21 write t)","symbol":"\\omega"},{"meaning":"LPN code length (BCG+19 writes N, CRR21 n); each tree has \\( \\nu/\\omega \\) leaves, a power of two. BCG+19 benchmarks N/n = 2, so \\( \\nu = 2m \\)","symbol":"\\nu"}]}},"construction_family":"subfield_vole_okvs","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X \\)","locator":"Figure 9, step 4 and parameters, p. 23; §4, p. 22","measure":"communication","note":"The OPRF values of the sender's items","subject":"sender"},{"basis":"counted","formula":"\\( 1.23(\\lambda+\\log(n_Xn_Y))n_Y+2\\kappa \\)","locator":"Figure 9, steps 1, 3 and 4, p. 23; §4, p. 22; Theorem 3, p. 33","measure":"communication","note":"The OKVS correction, one base-field element per position, with the seeds \\( r \\) and \\( r' \\); the figure omits sending \\( r' \\), which the sender needs","subject":"receiver"},{"basis":"counted","formula":"\\( 1.23n_Y+O(n_X) \\)","locator":"Figure 9, steps 3–4, p. 23; Figure 1, p. 7; §4, p. 22; §2, Field row, p. 8","measure":"computation","note":"One base-by-extension product per OKVS position for \\( B' = B + A'\\Delta \\); per item \\( \\Delta H_B(y) \\) and the decode's dense-column products","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 9, step 4, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_B \\) and \\( H_o \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"Figure 9, steps 1, 3 and 5, p. 23; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns: their powers, the gap's elimination and back-substitution in encoding, and the decodes at its items","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 9, steps 1 and 5, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item \\( H_B \\), the two row functions and \\( H_o \\)","operation":"symmetric_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["base OT"],"messages":"3","open":[],"phase":"setup","rounds":"3"},{"gloss":["sub-VOLE"],"messages":"3","open":["reverse sub-VOLE"],"phase":"offline","rounds":"2"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}],"overview":[{"gloss":["sub-VOLE"],"messages":"\\mathsf{sub-VOLE}[\\ldots]#sub_vole","open":[],"phase":"offline","rounds":"\\mathsf{sub-VOLE}[\\ldots]#sub_vole"},{"gloss":["the protocol's own messages"],"messages":"2","open":[],"phase":"online","rounds":"2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Figure 6, step 2, p. 17; Figure 9, step 3, p. 19","measure":"communication","source":"BCG+19","subject":"sender"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( 0 \\)","locator":"Figure 6, p. 17; Figure 9, p. 19","measure":"communication","source":"BCG+19","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( 2\\nu - 2\\omega \\)","locator":"Figure 6, step 1, p. 17; Figure 3, Expand, p. 14; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"sender"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"formula":"\\( 2\\nu - 2\\omega\\log_2(\\nu/\\omega) - 2\\omega \\)","locator":"Figure 6, Output steps 2–3, p. 17; §7.1, Noise distribution, p. 30","measure":"computation","operation":"symmetric_op","source":"BCG+19","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( \\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 2\\omega(\\log_2(\\nu/\\omega) - 1)\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"0","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega(\\log_2(\\nu/\\omega) - 1) \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"0","operation":"symmetric_op","part":["OT (GGM inner levels)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( 2|\\mathbb{G}| + 2\\kappa^{2} \\)","locator":"Protocol 3.1, p. 451, Initialization; Protocol 3.1, p. 451, Transfer; footnote 3, p. 451","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa|\\mathbb{G}| \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"communication","node":"0/0","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa + 2 \\)","locator":"Protocol 3.1, p. 451, Initialization and Overhead; Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer and Overhead","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( 2\\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"exponentiation","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"modmul","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp","np01"],"derived":true,"formula":"\\( \\kappa \\)","locator":"Protocol 3.1, p. 451, Transfer","measure":"computation","node":"0/0","operation":"symmetric_op","part":["OT (GGM inner levels)","base OT"],"phase":"setup","source":"NP01","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( \\omega\\kappa \\)","locator":"Protocol 1, step 3, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 2\\omega\\kappa \\)","locator":"Protocol 1, step 6, p. 10","measure":"communication","node":"1","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 4 and 6, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"sender"},{"block":"sub_vole","chain":["silver_sub","iknp"],"derived":true,"formula":"\\( 3\\omega \\)","locator":"Protocol 1, steps 3 and 7, p. 10","measure":"computation","node":"1","operation":"symmetric_op","part":["OT (GGM last level)"],"source":"PSZ18","subject":"receiver"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"instance":{"func":"sub_vole","id":"sub_vole@2","params":{"\\mathbb{B}":"\\( \\mathbb{B} \\)","\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Theorem 8 and Figure 8, p. 18; Figure 9, step 2, p. 19","measure":"communication","node":"2","open_in":"BCG+19","part":["reverse sub-VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"},{"block":"sub_vole","chain":["silver_sub"],"derived":true,"instance":{"func":"sub_vole","id":"sub_vole@2","params":{"\\mathbb{B}":"\\( \\mathbb{B} \\)","\\mathbb{F}":"\\( \\mathbb{F} \\)","m":"\\( \\omega \\)"}},"locator":"Theorem 8 and Figure 8, p. 18; Figure 9, step 2, p. 19","measure":"computation","node":"2","open_in":"BCG+19","part":["reverse sub-VOLE"],"source":"BCG+19","subject":"total","value":"not_instantiated"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2022-RR-SD","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"paper_title":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","paper_url":"https://eprint.iacr.org/2022/320","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["sub_vole"],"id":"sub_vole","locator":"Figure 9, step 2, p. 23","phase":"offline","what":"random subfield VOLE of the OKVS's dimension, before the sets"},{"after":["sub_vole"],"from":"receiver","id":"okvs","locator":"Figure 9, steps 1 and 3, p. 23","phase":"online","what":"OKVS seed r, the seed r′ the figure omits, and the OKVS correction over the base field"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 9, step 4, p. 23","phase":"online","what":"OPRF values of its items, in random order"}],"security_mode":"computational","security_model":"semi-honest two-party, random oracle model, F_sub-vole-hybrid (Theorem 3, p. 33)","security_notion":"PSI with output to the receiver","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"VOLE-PSI over subfield VOLE: the OKVS lives in a base field just large enough to avoid false matches, about \\( \\lambda + \\log(n_X n_Y) \\) bits, while the VOLE key is in a \\( 2^{\\kappa} \\) extension, so communication is \\( O(n\\lambda + n \\log n) \\). The OKVS is the unclustered row-weight-3 triangulation scheme.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2022-RR","year":2022},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-OBLIVIOUS-TRANSFER-OR-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-ANY-ASSUMPTION-IMPLYING-SECURE-COMPUTATION","assumption_name":"Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)","attributes":{"adversary":{"locator":"§2.1, p. 4; Corollary 6, p. 16","value":["semi_honest"]},"assumptions":{"locator":"Corollary 6, p. 16","note":"Either suffices","resolved":[{"id":"ASM-OT","name":"Oblivious transfer (OT)","short":"OT"},{"id":"ASM-AHE","name":"Additively homomorphic encryption (AHE)","short":"AHE"}],"value":["OT","AHE"]},"corruptions":{"locator":"§2.1, p. 4","note":"Static corruption of all but one party","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Abstract, p. 1; Figure 9, p. 11","note":"The intersection when it has at least \\( n - t \\) items, else nothing","value":["threshold"]},"output_to":{"locator":"§1, p. 1","value":"all"},"parties":{"locator":"§4, p. 11","value":"multiparty"},"security_model":{"locator":"§2.1, p. 4; footnote 4, p. 3","note":"Standalone; the bucketing functions are random for simplicity and work equally well as pseudorandom functions, where the key is known to all parties","value":["standard model"]},"set_size_regime":{"locator":"Figure 9, p. 11","note":"All sets have exactly \\( n \\) items","value":"balanced"},"technique":{"locator":"Figure 11, p. 15; §4.1, p. 16","value":["secret_sharing","simple_hashing"]}},"authors":["Satrajit Ghosh","Mark Simkin"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"BDP21","title":"Multiparty cardinality testing for threshold private intersection"}],"count":"\\( \\lambda t\\tilde{t} \\)","func":"l_pict","id":"pict","implementation":"protocol of Branco, Döttling and Pu, with generic secure computation in place of homomorphic encryption","instantiation":"bdp21_generic","locator":"Figure 11, p. 15; Figure 12, p. 16; Theorems 7–8, pp. 15–16; §4.1, p. 16","note":"One test per bucket and per threshold up to \\( \\tilde{t} \\), with secret-shared output","params":{"\\ell":"\\( \\ell \\)","n":"\\( n \\)","t":"\\( \\le \\tilde{t} \\)"},"roles":{"party":"party"}},{"cites":[],"count":"\\( \\lambda t \\)","func":"mpc","id":"min","locator":"Figure 11, step 7, p. 15; Figure 4, p. 6; §4, p. 14","note":"One per partition and bucket: the least padding among the parties, with secret-shared output, by any generic MPC protocol","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"roles":{"party":"party"}},{"cites":[],"count":"\\( \\lambda t \\)","func":"mpc","id":"geq","locator":"Figure 12, steps 5–6, p. 16; Figure 2 and §2.3, p. 5","note":"One per partition and bucket: the summed test shares against the bucket's threshold, giving the intersection size or the default","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"roles":{"party":"party"}},{"cites":[],"func":"mpc","id":"vec_intrvl","locator":"Figure 11, step 10, p. 15; Figure 5, p. 6; §4, p. 14","note":"Whether one partition's summed intersection size lies between \\( n-t \\) and \\( n \\), with secret-shared output, by any generic MPC protocol","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\lambda\\ell|\\mathbb{F}|) \\)"},"roles":{"party":"party"}},{"cites":[],"func":"mpc","id":"isect","locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","note":"The intersection step of GS19: each set polynomial times a random polynomial of degree \\( t \\), summed at \\( 3t+1 \\) points; multiplications over the field","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( (3t+1)\\ell \\)"},"roles":{"party":"party"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"pict","calls":[{"block":"pict","count":"\\( \\lambda t\\tilde{t} \\)","func":"mpc","locator":"GS23 §4.1, p. 16; BDP21 Protocol 2, steps 2–4, p. 13; Protocol 1, p. 10","node":"0","note":"The parties' randomized evaluations summed and divided by the first party's, then the degree test by rational interpolation on two support sets, all by generic secure computation","open":true,"open_in":"GS23","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( \\mathrm{poly}(\\tilde{t}) \\)"},"part":"MPC (secure degree test)","phase":"online","roles":{"party":"party"}}],"count":"\\( \\lambda t\\tilde{t} \\)","func":"l_pict","implementation":"bdp21_generic","label":"Multiparty cardinality test of Branco, Döttling and Pu, with generic secure computation","locator":"Figure 11, p. 15; Figure 12, p. 16; Theorems 7–8, pp. 15–16; §4.1, p. 16","node":"","note":"One test per bucket and per threshold up to \\( \\tilde{t} \\), with secret-shared output","params":{"\\ell":"\\( \\ell \\)","n":"\\( n \\)","t":"\\( \\le \\tilde{t} \\)"},"phase":"online","roles":{"party":"party"},"source":"GS23"},{"block":"min","count":"\\( \\lambda t \\)","func":"mpc","locator":"Figure 11, step 7, p. 15; Figure 4, p. 6; §4, p. 14","node":"","note":"One per partition and bucket: the least padding among the parties, with secret-shared output, by any generic MPC protocol","open":true,"params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"phase":"online","roles":{"party":"party"}},{"block":"geq","count":"\\( \\lambda t \\)","func":"mpc","locator":"Figure 12, steps 5–6, p. 16; Figure 2 and §2.3, p. 5","node":"","note":"One per partition and bucket: the summed test shares against the bucket's threshold, giving the intersection size or the default","open":true,"params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"phase":"online","roles":{"party":"party"}},{"block":"vec_intrvl","func":"mpc","locator":"Figure 11, step 10, p. 15; Figure 5, p. 6; §4, p. 14","node":"","note":"Whether one partition's summed intersection size lies between \\( n-t \\) and \\( n \\), with secret-shared output, by any generic MPC protocol","open":true,"params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\lambda\\ell|\\mathbb{F}|) \\)"},"phase":"online","roles":{"party":"party"}},{"block":"isect","func":"mpc","locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","node":"","note":"The intersection step of GS19: each set polynomial times a random polynomial of degree \\( t \\), summed at \\( 3t+1 \\) points; multiplications over the field","open":true,"params":{"\\ell":"\\( \\ell \\)","|C|":"\\( (3t+1)\\ell \\)"},"phase":"online","roles":{"party":"party"}}],"phase":"online","step_phase":"online"},"capabilities":["sublinear-in-set-size","no-fhe","large-intersection-condition"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","PSI-CONTRIB-2023-GS-PICT-COMPILER"],"client_storage":null,"communication":null,"complexity":{"pict":{"costs":[{"block":"pict","chain":["bdp21_generic"],"derived":true,"formula":"\\( (4t + 2)kn \\)","locator":"BDP21 Protocol 2, step 2, p. 13","measure":"computation","operation":"field_op","source":"GS23","subject":"party"},{"block":"pict","chain":["bdp21_generic"],"derived":true,"instance":{"count":"\\( k \\)","func":"mpc","id":"pict@0","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( \\mathrm{poly}(t) \\)"}},"locator":"GS23 §4.1, p. 16; BDP21 Protocol 2, steps 2–4, p. 13; Protocol 1, p. 10","measure":"communication","node":"0","open_in":"GS23","part":["MPC (secure degree test)"],"source":"GS23","subject":"total","value":"not_instantiated"},{"block":"pict","chain":["bdp21_generic"],"derived":true,"instance":{"count":"\\( k \\)","func":"mpc","id":"pict@0","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( \\mathrm{poly}(t) \\)"}},"locator":"GS23 §4.1, p. 16; BDP21 Protocol 2, steps 2–4, p. 13; Protocol 1, p. 10","measure":"computation","node":"0","open_in":"GS23","part":["MPC (secure degree test)"],"source":"GS23","subject":"total","value":"not_instantiated"}],"counts":[{"gloss":[],"messages":"0","open":["MPC (secure degree test)"],"phase":"online","rounds":"0"}],"variables":[]}},"construction_family":"bucketed_cardinality_test_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( |\\mathbb{F}| \\)","locator":"Figure 11, step 11, p. 15; Corollary 6, p. 16; §2.1, p. 4","measure":"communication","note":"Its share of the test's result, broadcast, so that all learn whether to compute the intersection","subject":"party"},{"basis":"counted","formula":"\\( \\lambda n \\)","locator":"Figure 11, step 4, p. 15; footnote 4, p. 3","measure":"computation","note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","subject":"party"},{"basis":"counted","formula":"\\( O(nt+t^{3}) \\)","locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","measure":"computation","note":"Its set polynomial at the points, the division by it, rational interpolation and the roots among its items; the paper does not fix the methods","operation":"field_op","subject":"party"}],"counts":{"exact":[{"gloss":["MPC","the protocol's own messages"],"messages":"\\mathsf{MPC}[\\ldots]#min + \\mathsf{MPC}[\\ldots]#geq + \\mathsf{MPC}[\\ldots]#vec_intrvl + \\mathsf{MPC}[\\ldots]#isect + 1","open":["MPC (secure degree test)"],"phase":"online","rounds":"(\\mathsf{MPC}[\\ldots]#geq \\parallel \\mathsf{MPC}[\\ldots]#min) + \\mathsf{MPC}[\\ldots]#vec_intrvl + \\mathsf{MPC}[\\ldots]#isect + 1"}],"overview":[{"gloss":["ℓ-PICT","MPC","the protocol's own messages"],"messages":"\\mathsf{ℓ-PICT}[\\ldots]#pict + \\mathsf{MPC}[\\ldots]#min + \\mathsf{MPC}[\\ldots]#geq + \\mathsf{MPC}[\\ldots]#vec_intrvl + \\mathsf{MPC}[\\ldots]#isect + 1","open":[],"phase":"online","rounds":"(\\mathsf{ℓ-PICT}[\\ldots]#pict + \\mathsf{MPC}[\\ldots]#geq \\parallel \\mathsf{MPC}[\\ldots]#min) + \\mathsf{MPC}[\\ldots]#vec_intrvl + \\mathsf{MPC}[\\ldots]#isect + 1"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[{"block":"pict","chain":["bdp21_generic"],"derived":true,"formula":"\\( (4\\tilde{t} + 2)\\lambda t\\tilde{t}n \\)","locator":"BDP21 Protocol 2, step 2, p. 13","measure":"computation","operation":"field_op","source":"GS23","subject":"party"},{"block":"pict","chain":["bdp21_generic"],"derived":true,"instance":{"count":"\\( \\lambda t\\tilde{t} \\)","func":"mpc","id":"pict@0","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( \\mathrm{poly}(\\tilde{t}) \\)"}},"locator":"GS23 §4.1, p. 16; BDP21 Protocol 2, steps 2–4, p. 13; Protocol 1, p. 10","measure":"communication","node":"0","open_in":"GS23","part":["MPC (secure degree test)"],"source":"GS23","subject":"total","value":"not_instantiated"},{"block":"pict","chain":["bdp21_generic"],"derived":true,"instance":{"count":"\\( \\lambda t\\tilde{t} \\)","func":"mpc","id":"pict@0","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( \\mathrm{poly}(\\tilde{t}) \\)"}},"locator":"GS23 §4.1, p. 16; BDP21 Protocol 2, steps 2–4, p. 13; Protocol 1, p. 10","measure":"computation","node":"0","open_in":"GS23","part":["MPC (secure degree test)"],"source":"GS23","subject":"total","value":"not_instantiated"}],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2023-GS","PSI-PAPER-2019-GS"],"paper_title":"Threshold Private Set Intersection with Better Communication Complexity","paper_url":"https://eprint.iacr.org/2023/919","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"multiparty threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["pict"],"id":"tests","locator":"Figure 11, steps 1–6, p. 15; Figure 12, steps 1–2, p. 16","phase":"online","what":"all cardinality tests, per partition, bucket and threshold, on the bucketed sets"},{"blocks":["min"],"id":"min","locator":"Figure 11, step 7, p. 15","phase":"online","what":"each bucket's least padding, which needs only the bucketed sets"},{"after":["tests"],"blocks":["geq"],"id":"geq","locator":"Figure 12, steps 3–6, p. 16","phase":"online","what":"per bucket, the summed test shares against the bucket's threshold"},{"after":["geq","min"],"blocks":["vec_intrvl"],"id":"vec","locator":"Figure 11, steps 8–10, p. 15","phase":"online","what":"whether one partition's summed intersection size lies in the interval"},{"after":["vec"],"from":"party","id":"open","locator":"Figure 11, step 11, p. 15; Corollary 6, p. 16","phase":"online","what":"each party's share of the test's result"},{"after":["open"],"blocks":["isect"],"id":"isect","locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","phase":"online","what":"the noisy combination of all set polynomials at the points, run only on a large intersection"}],"security_mode":"computational","security_model":"standalone, static passive adversary corrupting all but one party; Theorems 7-8 in hybrid models with ideal functionalities (pp. 15-16); correctness except with probability \\( 2^{-\\lambda} \\) (Theorem 6, p. 14)","security_notion":"multiparty threshold PSI (intersection of at least \\( n - t \\) elements)","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Multiparty threshold PSI with communication quasilinear in the threshold, from generic secure computation. Each party hashes its set into \\( t \\) buckets under \\( \\lambda \\) functions, the parties test each bucket's intersection size with a cardinality test at a logarithmic threshold, and the intersection is computed only if one partition shows it large enough.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[{"meaning":"Threshold of the per-bucket tests, at least \\( 1+3\\ln(2t\\ell) \\)","symbol":"\\tilde{t}"}],"verification_cost":null,"work_id":"PSI-PAPER-2023-GS","year":2023},{"adaptive_security":null,"api_style":null,"associated_data":null,"assumption_family":"generic","assumption_id":"PSI-ASSUMPTION-OBLIVIOUS-TRANSFER-OR-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-ANY-ASSUMPTION-IMPLYING-SECURE-COMPUTATION","assumption_name":"Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)","attributes":{"adversary":{"locator":"§2.1, p. 4; Theorem 3, p. 9","note":"Passive, static","value":["semi_honest"]},"assumptions":{"locator":"Corollary 3, p. 10","note":"Either suffices","resolved":[{"id":"ASM-OT","name":"Oblivious transfer (OT)","short":"OT"},{"id":"ASM-AHE","name":"Additively homomorphic encryption (AHE)","short":"AHE"}],"value":["OT","AHE"]},"output":{"locator":"Abstract, p. 1; Figure 1, p. 5; Corollary 3, p. 10","note":"The intersection when the symmetric difference is small, else nothing","value":["threshold"]},"output_to":{"locator":"§1, p. 1","value":"all"},"parties":{"locator":"§3, p. 6","value":"two_party"},"security_model":{"locator":"§2.1, p. 4; footnote 4, p. 3","note":"Standalone; the bucketing functions are random for simplicity and replaceable by public-key PRFs","value":["standard model"]},"set_size_regime":{"locator":"Figure 1, p. 5","value":"balanced"},"technique":{"locator":"Figure 7, p. 9; §3.1, p. 10","value":["secret_sharing","simple_hashing","polynomial_sparsity_test"]}},"authors":["Satrajit Ghosh","Mark Simkin"],"base_signature":null,"block_size":null,"blocks":[{"cites":[{"key":"GS19","paper":"PSI-PAPER-2019-GS","title":"The communication complexity of threshold private set intersection"},{"key":"CD01","title":"Secure distributed linear algebra in a constant number of rounds"}],"count":"\\( \\lambda t(1+3\\ln 2t) \\)","func":"pict","id":"pict","implementation":"PICT of Ghosh and Simkin with the determinant protocol of Cramer and Damgård","instantiation":"gs19_cd01","locator":"Figure 7, p. 9; Figure 8, p. 10; Theorems 3–4, pp. 9–10; §3.1, p. 10","note":"One test per bucket and per threshold up to \\( 1+3\\ln 2t \\), with secret-shared output; the bracketed \\( t \\) is the test's own, bounded by the row's","params":{"n":"\\( n \\)","t":"\\( \\le 1+3\\ln 2t \\)"},"roles":{"party":["sender","receiver"]}},{"cites":[],"count":"\\( \\lambda t \\)","func":"two_pc","id":"cmp","locator":"Figure 8, step 5, p. 10; Figure 2 and §2.3, p. 5","note":"One comparison per bucket and partition of the summed shares with the default, any generic secure computation, with \\( O(|\\mathbb{F}|) \\) gates","params":{"|C|":"\\( O(|\\mathbb{F}|) \\)"}},{"cites":[],"func":"two_pc","id":"vec_leq","locator":"Figure 7, step 8, p. 9; Figure 3 and §2.3, p. 6","note":"One test whether any of the \\( \\lambda \\) partition sums is at most \\( t \\), by generic secure computation","params":{"|C|":"\\( O(\\lambda|\\mathbb{F}|) \\)"}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t/2+1 \\)","func":"ole","id":"ole_to_receiver","locator":"Corollary 3, p. 10; GS19 Figure 10, step 3, p. 17","note":"Noisy polynomial addition of the intersection step: Alice receives her evaluations under Bob's random polynomials","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t/2+1 \\)","func":"ole","id":"ole_to_sender","locator":"Corollary 3, p. 10; GS19 Figure 10, step 4, p. 17","note":"Noisy polynomial addition of the intersection step: Bob receives his evaluations under Alice's random polynomials","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"sender","sender":"receiver"}}],"bootstrapping":null,"call_tree":{"calls":[{"block":"pict","count":"\\( \\lambda t(1+3\\ln 2t) \\)","func":"pict","implementation":"gs19_cd01","label":"PICT of Ghosh and Simkin with the determinant protocol of Cramer and Damgård","locator":"Figure 7, p. 9; Figure 8, p. 10; Theorems 3–4, pp. 9–10; §3.1, p. 10","node":"","note":"One test per bucket and per threshold up to \\( 1+3\\ln 2t \\), with secret-shared output; the bracketed \\( t \\) is the test's own, bounded by the row's","params":{"n":"\\( n \\)","t":"\\( \\le 1+3\\ln 2t \\)"},"phase":"online","roles":{"party":["sender","receiver"]},"source":"GS23"},{"block":"cmp","count":"\\( \\lambda t \\)","func":"two_pc","locator":"Figure 8, step 5, p. 10; Figure 2 and §2.3, p. 5","node":"","note":"One comparison per bucket and partition of the summed shares with the default, any generic secure computation, with \\( O(|\\mathbb{F}|) \\) gates","open":true,"params":{"|C|":"\\( O(|\\mathbb{F}|) \\)"},"phase":"online"},{"block":"vec_leq","func":"two_pc","locator":"Figure 7, step 8, p. 9; Figure 3 and §2.3, p. 6","node":"","note":"One test whether any of the \\( \\lambda \\) partition sums is at most \\( t \\), by generic secure computation","open":true,"params":{"|C|":"\\( O(\\lambda|\\mathbb{F}|) \\)"},"phase":"online"},{"block":"ole_to_receiver","count":"\\( 3t/2+1 \\)","func":"ole","locator":"Corollary 3, p. 10; GS19 Figure 10, step 3, p. 17","node":"","note":"Noisy polynomial addition of the intersection step: Alice receives her evaluations under Bob's random polynomials","open":true,"params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"}},{"block":"ole_to_sender","count":"\\( 3t/2+1 \\)","func":"ole","locator":"Corollary 3, p. 10; GS19 Figure 10, step 4, p. 17","node":"","note":"Noisy polynomial addition of the intersection step: Bob receives his evaluations under Alice's random polynomials","open":true,"params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"phase":"online","reversed":true,"roles":{"receiver":"sender","sender":"receiver"}}],"phase":"online","step_phase":"online"},"capabilities":["sublinear-in-set-size","no-fhe"],"ciphertext_security":null,"circuit_class":null,"claim_ids":["PSI-CONTRIB-2023-GS-PICT-COMPILER","PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"client_storage":null,"communication":null,"complexity":{"pict":{"costs":[],"counts":[],"variables":[]}},"construction_family":"bucketed_cardinality_test_threshold_psi","correctness":null,"corruption_model":null,"costs":[{"basis":"counted","formula":"\\( |\\mathbb{F}| + (3t/2+1)\\log p \\)","locator":"Figure 7, p. 9; Corollary 3, p. 10; GS19 Figure 10, step 6, p. 17","measure":"communication","note":"Bob's share of the test's result, then his masked evaluations at half the threshold","subject":"sender"},{"basis":"counted","formula":"\\( |\\mathbb{F}| + (3t/2+1)\\log p \\)","locator":"Figure 7, p. 9; Corollary 3, p. 10; GS19 Figure 10, step 5, p. 17","measure":"communication","note":"Alice's share of the test's result, then her masked evaluations at half the threshold","subject":"receiver"},{"basis":"counted","formula":"\\( \\lambda n \\)","locator":"Figure 7, step 3, p. 9; footnote 4, p. 3","measure":"computation","note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\lambda n \\)","locator":"Figure 7, step 2, p. 9; footnote 4, p. 3","measure":"computation","note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( O(nt+t^{3}) \\)","locator":"Figure 7, step 7, p. 9; Figure 8, step 4, p. 10; GS19 Figure 7, steps 3–7, p. 13","measure":"computation","note":"Evaluates its polynomials at the points, interpolates and tests roots; the sums of its shares are additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( O(nt+t^{3}) \\)","locator":"Figure 7, step 6, p. 9; Figure 8, step 3, p. 10; GS19 Figure 7, steps 3–7, p. 13","measure":"computation","note":"Evaluates its polynomials at the points, interpolates and tests roots; the sums of its shares are additions","operation":"field_op","subject":"receiver"}],"counts":{"exact":[{"gloss":["PICT","2PC","the protocol's own messages","OLE"],"messages":"\\mathsf{PICT}[\\ldots]#pict + \\mathsf{2PC}[\\ldots]#cmp + \\mathsf{2PC}[\\ldots]#vec_leq + \\mathsf{OLE}[\\ldots]#ole_to_receiver + \\mathsf{OLE}[\\ldots]#ole_to_sender + 4","open":[],"phase":"online","rounds":"\\mathsf{PICT}[\\ldots]#pict + \\mathsf{2PC}[\\ldots]#cmp + \\mathsf{2PC}[\\ldots]#vec_leq + (\\mathsf{OLE}[\\ldots]#ole_to_receiver \\parallel \\mathsf{OLE}[\\ldots]#ole_to_sender) + 2"}],"overview":[{"gloss":["PICT","2PC","the protocol's own messages","OLE"],"messages":"\\mathsf{PICT}[\\ldots]#pict + \\mathsf{2PC}[\\ldots]#cmp + \\mathsf{2PC}[\\ldots]#vec_leq + \\mathsf{OLE}[\\ldots]#ole_to_receiver + \\mathsf{OLE}[\\ldots]#ole_to_sender + 4","open":[],"phase":"online","rounds":"\\mathsf{PICT}[\\ldots]#pict + \\mathsf{2PC}[\\ldots]#cmp + \\mathsf{2PC}[\\ldots]#vec_leq + (\\mathsf{OLE}[\\ldots]#ole_to_receiver \\parallel \\mathsf{OLE}[\\ldots]#ole_to_sender) + 2"}]},"decapsulation_cost":null,"decrypt_cost":{},"decrypt_pairings":"","decryption_failure":null,"derived":[],"encapsulation_cost":null,"exactness":null,"id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","identifiable_abort":null,"key_size":null,"large_universe":null,"misuse_resistance":null,"multi_use_attributes":null,"noise_management":null,"nonce_generation":null,"nonce_requirement":null,"nonce_size":null,"normative_status":null,"object_type":null,"online":null,"output_compatibility":null,"packing":null,"paper_ids":["PSI-PAPER-2023-GS","PSI-PAPER-2019-GS"],"paper_title":"Threshold Private Set Intersection with Better Communication Complexity","paper_url":"https://eprint.iacr.org/2023/919","parallelizable":null,"plaintext_space":null,"policy_class":null,"post_quantum_mechanism":null,"preprocessing":null,"primitive":"two-party threshold PSI","privacy_model":null,"proof_model":null,"quantum_security":null,"query_communication":null,"resilience":null,"response_communication":null,"robustness":null,"schedule":[{"blocks":["pict"],"id":"pict","locator":"Figure 7, steps 1–5, p. 9; Figure 8, steps 1–2, p. 10","phase":"online","what":"all cardinality tests, per bucket, partition and threshold, on the bucketed sets"},{"after":["pict"],"blocks":["cmp"],"id":"cmp","locator":"Figure 8, steps 3–5, p. 10","phase":"online","what":"per bucket, the summed test shares compared with the default"},{"after":["cmp"],"blocks":["vec_leq"],"id":"vec_leq","locator":"Figure 7, steps 6–8, p. 9","phase":"online","what":"whether some partition's summed differences are at most \\( t \\)"},{"after":["vec_leq"],"from":"receiver","id":"share_a","locator":"Figure 7, step 9, p. 9; Corollary 3, p. 10","phase":"online","what":"Alice's share of the test's result"},{"after":["vec_leq"],"from":"sender","id":"share_b","locator":"Figure 7, step 9, p. 9; Corollary 3, p. 10","phase":"online","what":"Bob's share of the test's result"},{"after":["share_a","share_b"],"blocks":["ole_to_receiver","ole_to_sender"],"id":"ole","locator":"Corollary 3, p. 10; GS19 Figure 7, step 4, p. 13; GS19 Figure 10, steps 3–4, p. 17","phase":"online","what":"both OLE batches of noisy polynomial addition, run only on similar sets"},{"after":["ole"],"from":"receiver","id":"masked_a","locator":"GS19 Figure 10, step 5, p. 17","phase":"online","what":"Alice's masked evaluations"},{"after":["ole"],"from":"sender","id":"masked_b","locator":"GS19 Figure 10, step 6, p. 17","phase":"online","what":"Bob's masked evaluations"}],"security_mode":"computational","security_model":"standalone, static passive adversary; Theorem 3 in the (F_△, F_vec-leq)-hybrid model and Theorem 4 in the F_pict-hybrid model (pp. 9-10); correctness except with probability \\( 2^{-\\lambda} \\) (Theorem 3, p. 9)","security_notion":"two-party threshold PSI","server_model":null,"server_work":null,"setup_model":null,"signer_model":null,"signing_cost":null,"signing_rounds":null,"sizes":{},"statefulness":null,"summary":"Two-party threshold PSI that hashes both sets into \\( t \\) buckets under \\( \\lambda \\) functions and runs the Ghosh-Simkin cardinality test at a logarithmic threshold on every bucket, combining the secret-shared results. If some partition shows a small symmetric difference, the intersection is then computed.","supported_gates":null,"tag_size":null,"threshold_policy":null,"transform":null,"update_model":null,"variables":[],"verification_cost":null,"work_id":"PSI-PAPER-2023-GS","year":2023}],"costAssertions":[{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","formula":"\\( Bm(\\lambda+\\log(1.27n)) \\)","id":"COST-00086DC3A5547C","includes":null,"locator":"§7.2, pp. 23-24; §7.3, p. 24; Protocol 7, step 2, p. 16","measure":"communication","member":null,"note":"P2's hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","formula":"\\( 2\\kappa n \\)","id":"COST-00680280CF3A60","includes":null,"locator":"PRTY20 Figure 3, step 3, p. 11; PRTY20 §4.4, p. 15; Theorem 7, p. 21; Figure 4, p. 23","measure":"communication","member":null,"note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item, as for malicious security","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-00898EA9C91879","includes":null,"locator":"§3, p. 6; §3.1, pp. 9–11; §5, p. 15","measure":"communication","member":null,"note":"Blinded OPRF queries on FourQ, then the encrypted source powers of each batch","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","formula":"\\( O(nt) \\)","id":"COST-00E1DD83A5E594","includes":null,"locator":"§3, p. 8","measure":"computation","member":null,"note":"Evaluations of its set polynomial at the same points","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","formula":"\\( (5\\epsilon+4)n_Y+1 \\)","id":"COST-0147358662DCED","includes":null,"locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2, 5 and 6, p. 36; Figure 8, step 3, p. 38","measure":"computation","member":null,"note":"Cuckoo hashing, the bin labels, then per bin row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":null,"id":"COST-01D094EF744AC8","includes":null,"locator":"Figure 6, step 4, p. 22","measure":"computation","member":null,"note":"TFHE evaluation, per other party, of the quotients, interpolation from \\( 2t+1 \\) points, the test at z and both differences' roots; then the union's size","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( 4n_Y \\)","id":"COST-020FD84C9AF208","includes":null,"locator":"Figure 4, steps 3, 4 and 7, p. 11; §3.2, p. 8","measure":"computation","member":null,"note":"Per item: the inverse permutation, the first random oracle, the hash of the Diffie-Hellman key, then the second random oracle","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","formula":"\\( (5\\epsilon+4)n_Y+1 \\)","id":"COST-022A9722C18240","includes":null,"locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2, 5 and 6, p. 36; Figure 8, step 3, p. 38","measure":"computation","member":null,"note":"Cuckoo hashing, the bin labels, then per bin row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( n_Y \\)","id":"COST-023C0FDE03A629","includes":null,"locator":"Figure 4, step 6, p. 9; §5.6, p. 9","measure":"computation","member":null,"note":"Unblinding: one division by the blinding factor per item, whose inverse can be computed offline; no online exponentiation","operation":"modmul","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","formula":"\\( k(1.2n+s)/\\kappa \\)","id":"COST-025B5385BBBDA3","includes":null,"locator":"Figure 2, step 3, p. 10; §6.3, p. 16","measure":"computation","member":null,"note":"Its seed of each of the \\( k \\) OTs expanded to a column of \\( 1.2n+s \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2016-KKRT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":"\\( (3t+4)\\gamma \\)","id":"COST-02617E5B5744D3","includes":null,"locator":"§7.1, p. 29","measure":"communication","member":null,"note":"One encrypted combination per evaluation point","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":"Alice, who holds the decryption key and alone learns the output, is counted as receiver and Bob as sender.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( 2(M+1)n_X \\)","id":"COST-0266C54985509A","includes":null,"locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-8","measure":"computation","member":null,"note":"Per item and each of its two bins, \\( M \\) short exponentiations by Horner's rule and one full-length one by \\( r \\)","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","formula":"\\( O(n_Y\\log^{2} n_Y) \\)","id":"COST-04797751FBC056","includes":null,"locator":"§3, p. 8; §7.1, p. 24; Figure 6, p. 37","measure":"computation","member":null,"note":"Fast interpolation of the polynomial through its items, then multi-point evaluation of its VOLE share \\( C \\) at them","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( \\frac{Ln_Y(M+1)}{\\ln\\ln n_Y}+Ln_X \\)","id":"COST-05BC67FAB18E96","includes":null,"locator":"Protocol PM-Malicious-Client, steps 1 and 5, p. 10; §4.2, pp. 7-8","measure":"computation","member":null,"note":"Encrypting the coefficients of all \\( L \\) copies, then decrypting every answer","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","formula":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4} \\)","id":"COST-05FD7970AB17DE","includes":null,"locator":"Algorithm 1, p. 5; §4, p. 5","measure":"communication","member":null,"note":"One bit per comparison: the Equal output it reveals to the generator, which needs it to choose the next pair","operation":null,"per":null,"phase":"online","source":null,"statistic":"expected","subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","formula":"\\( (k+s)n_X(\\lambda+\\log_2(kn_Xn_Y)) \\)","id":"COST-065A3BD34F24E1","includes":null,"locator":"Protocol 3, common input and steps 2–3, p. 22","measure":"communication","member":null,"note":"Masks of P1's items for every hash function and stash position","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","formula":"\\( 5n_Y \\)","id":"COST-06D2D0D4C1965F","includes":null,"locator":"Figure 3, steps 1 and 4, p. 11; Figure 7, p. 30","measure":"computation","member":null,"note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","formula":"\\( 2n_X+1 \\)","id":"COST-0753883176AEFB","includes":null,"locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","member":null,"note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( n_Y \\)","id":"COST-0784E4EC78F2DB","includes":null,"locator":"Figure 2, Online Phase, p. 10","measure":"computation","member":null,"note":"One point multiplication per item, then a filter lookup.","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( kn_X \\)","id":"COST-0954F8AE763728","includes":null,"locator":"Figure 4, step 2, p. 11; Appendix A.7, p. 16","measure":"computation","member":null,"note":"Builds its Bloom filter: \\( k \\) hashes per item","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","formula":"\\( O(n_Y) \\)","id":"COST-0984BA346DB15F","includes":null,"locator":"RS21 Figure 4, steps 2, 4 and 6, p. 36; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","member":null,"note":"Products with the field-valued dense columns in encoding the OKVS and in decoding its VOLE share at its items","operation":"field_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( O(n\\log^2 n) \\)","id":"COST-0B63A6CC3557FC","includes":null,"locator":"Figure 5, step 5, p. 24; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","member":null,"note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( 3(3t+4) \\)","id":"COST-0BA110443AD555","includes":null,"locator":"Figure 9, steps 3b, 3d and 3f, p. 30","measure":"computation","member":null,"note":"Per point, two encryptions and a partial decryption; none in the test outside the MPC","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( 6n_Y \\)","id":"COST-0C0C76FB75594C","includes":null,"locator":"§3, pp. 5–6; §3.1, p. 12; §4.2, pp. 13–14","measure":"computation","member":null,"note":"As unlabeled, five per item, plus decrypting the label of each item in the intersection, counted for every item; cuckoo re-insertions add more","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","formula":"\\( (7\\epsilon+4)n_Y+1 \\)","id":"COST-0DDE12850F986D","includes":null,"locator":"RS21 Figure 10, steps 1 and 4, p. 39; RS21 Figure 4, steps 2, 5 and 6, p. 36; RS21 Figure 8, step 3, p. 38; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Cuckoo hashing, the bin labels, then per bin the row functions, \\( H_F \\) and \\( H \\) for the OPRF, and the row functions for the table","operation":"symmetric_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","formula":"\\( n+2m\\mu+M \\)","id":"COST-0E57F7268235BA","includes":null,"locator":"Figure 9, steps 2b, 3 and 4, p. 27; §6.4, p. 16","measure":"computation","member":null,"note":"A phasing hash per item, the tag and mask PRF calls at every bin position, and one trial decommitment per tag match","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","formula":"\\( (n_Y+1)n_X \\)","id":"COST-1023A94A4531E5","includes":null,"locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7","measure":"computation","member":null,"note":"Per item, \\( n_Y \\) short exponentiations by Horner's rule and one full-length one","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","formula":"\\( 4n \\)","id":"COST-110575A346713F","includes":null,"locator":"§4.1, pp. 9–11; Figure 2, p. 12; PRTY20 Figure 3, step 3, p. 11","measure":"computation","member":null,"note":"Per item: the table's hyperedge hash and \\( r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","formula":"\\( 2n_X+1 \\)","id":"COST-110658ADC99AD2","includes":null,"locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","member":null,"note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","formula":"\\( 4n_X+1 \\)","id":"COST-116064FF728538","includes":null,"locator":"RS21 Figure 4, step 1 and the sender's evaluation, p. 36; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Per item the two row functions, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( 2n_X \\)","id":"COST-11A59FAB4061D5","includes":null,"locator":"Protocol PM-Semi-Honest, step 2(b), p. 6; §4.2, p. 7","measure":"computation","member":null,"note":"Encrypting the item, with any payload, for each of its two answers","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","formula":"\\( 18n \\)","id":"COST-11C40FCE59144C","includes":null,"locator":"§5.2, pp. 20–21; footnote 6, p. 13; Protocol 7, step 2, p. 16","measure":"computation","member":null,"note":"Its items' three bin positions, then five calls per BaRK-OPRF value at each of its \\( 3n \\) bin entries to program the hints","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","formula":"\\( 2\\kappa n \\)","id":"COST-1211D7B9D7B857","includes":null,"locator":"Figure 3, step 2, p. 22; Theorem 7, p. 21; PRTY20 §4.4, p. 15","measure":"communication","member":null,"note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( 2n_Y \\)","id":"COST-121746B88987E2","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":"Blinding and unblinding each OPRF query","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( 2.6n_X + n_Y + 1 \\)","id":"COST-121C861FDD6F4A","includes":null,"locator":"Figure 3, steps 5–6 and Output, p. 10; Appendix A.4, p. 16","measure":"computation","member":null,"note":"Per bin a mask encryption and a refresh, per item its value, then decrypts the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","formula":"\\( \\kappa n_X+2\\kappa \\)","id":"COST-12E86FEA0130F6","includes":null,"locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37; §4, pp. 19–20","measure":"communication","member":null,"note":"OPRF values of \\( \\kappa \\) bits, which the paper shows suffice, and the coin toss's commitment and opening","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","formula":"\\( n\\mu(\\lambda+2\\log(n\\mu))+m\\mu(\\sigma-\\log n) \\)","id":"COST-13777C1FE12A5C","includes":null,"locator":"Figure 4, steps 3–4, p. 12; §6.2, p. 12; Figure 8, p. 20","measure":"communication","member":null,"note":"Alice's common encodings, and one bit per OT she receives to flip a choice made at random offline","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( e_{\\mathrm{pk}} \\)","id":"COST-13BEF7735CE7E1","includes":null,"locator":"Figure 3, Setup, p. 10","measure":"communication","member":null,"note":"Its public key","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","formula":"\\( 2\\sigma(n\\log n-n+1) \\)","id":"COST-14E69F113D7AB7","includes":null,"locator":"§5.3.3, p. 9; §2, pp. 3–4","measure":"computation","member":null,"note":"Garbling each programmed swapper gate: two rows, one encryption call each, one row then dropped by row reduction","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","formula":"\\( 0 \\)","id":"COST-1547D377D74729","includes":null,"locator":"§2, pp. 3–4; §3, p. 4","measure":"computation","member":null,"note":"No cryptographic operation outside garbling and the OTs; the bit-vector is built in the clear","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X \\)","id":"COST-155321C860AE86","includes":null,"locator":"Figure 9, step 4 and parameters, p. 23; §4, p. 22","measure":"communication","member":null,"note":"The OPRF values of the sender's items","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( n_X \\)","id":"COST-155F926105F36F","includes":null,"locator":"§4.2, p. 7","measure":"computation","member":null,"note":"The bin hash of each item, naming its two bins","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X+2\\kappa \\)","id":"COST-15667E5051BB08","includes":null,"locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37","measure":"communication","member":null,"note":"The OPRF values of its items, and the coin toss's commitment and opening, one field element each","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","formula":"\\( 7n \\)","id":"COST-162C1489ACCBD5","includes":null,"locator":"§5.2, p. 15; §4.1, pp. 9–11; PRTY20 Figure 3, steps 1 and 4, p. 11","measure":"computation","member":null,"note":"Per item: the leaf hash, the hyperedge and \\( r \\) hashes of its leaf and of the centre, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( L(M+1)n_X \\)","id":"COST-17555AFB148690","includes":null,"locator":"Protocol PM-Malicious-Client, step 4, p. 10; §4.2, pp. 6-8","measure":"computation","member":null,"note":"Per item, both bins in each of the \\( L/2 \\) evaluated copies: \\( M \\) short exponentiations by Horner's rule and one full-length one","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","formula":"\\( (18+5s)n \\)","id":"COST-1756B69585CB10","includes":null,"locator":"Figure 3, step 4, p. 13; Figure 2, step 4, p. 10; §6.3, p. 16","measure":"computation","member":null,"note":"Three bin hashes per item, then per PRF value four AES calls for the code and one hash, for three hash functions and \\( s \\) stash positions","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2016-KKRT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( 7n_Y \\)","id":"COST-190BF653833F91","includes":null,"locator":"Figure 2, steps 7a–7b and 9, p. 14; §4.3, p. 10; §5.2 and footnote 7, p. 12","measure":"computation","member":null,"note":"As unlabeled, six per item, plus a PRG call per item in the intersection to strip its pad, counted for every item; cuckoo re-insertions add more","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( O\\left(\\frac{n_YM^2}{\\ln\\ln n_Y}\\right) \\)","id":"COST-1A5199A2414EA5","includes":null,"locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §4.2, p. 7","measure":"computation","member":null,"note":"Coefficients of each bin polynomial from its roots, \\( O(M^2) \\) for degree \\( M \\); the paper does not fix the method","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( n_X \\)","id":"COST-1AB530A825ACA6","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","formula":"\\( (\\ell-2)\\kappa \\)","id":"COST-1B5BA18E08F6A0","includes":null,"locator":"Figure 9, Initialization, p. 14","measure":"communication","member":null,"note":"PRF seeds to the parties after it","operation":null,"per":null,"phase":"setup","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","tip":"The largest client's: party \\( P_i \\) sends a seed to each party after it, \\( \\ell-i \\) in all, so the last sends none.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","formula":"\\( 0 \\)","id":"COST-1B97B9DA3D1E12","includes":null,"locator":"§2, pp. 3–4; §3, p. 4","measure":"computation","member":null,"note":"No cryptographic operation outside evaluating the circuit and the OTs","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","formula":"\\( 2(\\ell-1)n \\)","id":"COST-1BBFA0F8BD09D0","includes":null,"locator":"Figure 5, steps 1 and 3, p. 39","measure":"computation","member":null,"note":"Per item its zero-share, one PRF call per other party, and H on each client's OPRF value; the OKVS's own hashing is left open","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","formula":"\\( 0 \\)","id":"COST-1BC7323E1FAECF","includes":null,"locator":"§5.2, p. 16","measure":"communication","member":null,"note":"Alice sends only inside the generic two-party computation","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( \\frac{n_Y(M+1)}{\\ln\\ln n_Y}+2n_X \\)","id":"COST-1CD214F01DC00C","includes":null,"locator":"Protocol PM-Semi-Honest, steps 1(c) and 3, p. 6; §4.2, pp. 7-8; §4.4, p. 9","measure":"computation","member":null,"note":"Encrypting every coefficient of the bin polynomials, then decrypting both answers for each sender item and counting the fixed strings","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","formula":"\\( 0 \\)","id":"COST-1CEC4B79DC7918","includes":null,"locator":"Figure 3, steps 1–2, p. 11","measure":"communication","member":null,"note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( b + n_Y + 1 \\)","id":"COST-1D06D4DFC82F56","includes":null,"locator":"Figure 4, steps 3 and 6, p. 11; Appendix A.4, p. 16","measure":"computation","member":null,"note":"Encrypts each filter bit, decrypts each membership ciphertext, and encrypts zero to refresh the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( O(n\\log^2 n) \\)","id":"COST-1D7AB0BCA06905","includes":null,"locator":"Figure 4, step 5, p. 11; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","member":null,"note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","formula":"\\( \\lambda n \\)","id":"COST-1E530EA9DD7585","includes":null,"locator":"Figure 11, step 4, p. 15; footnote 4, p. 3","measure":"computation","member":null,"note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"party","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","formula":"\\( \\sigma n_Y \\)","id":"COST-1E67FF0E029447","includes":null,"locator":"Figure 1, Online Phase, p. 9","measure":"communication","member":null,"note":"One correction bit per input bit.","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( kn_Y \\)","id":"COST-1E85E6EEA6F422","includes":null,"locator":"Figure 4, step 4a, p. 11","measure":"computation","member":null,"note":"The \\( k \\) filter positions of each item","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","formula":"\\( 2\\kappa n_X \\)","id":"COST-1E8DF188333C1B","includes":null,"locator":"Figure 3, step 3, p. 11; §4.4, p. 15","measure":"communication","member":null,"note":"One \\( H_2 \\) output per item, at the \\( 2\\kappa \\) bits recommended against a malicious sender","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( O(n\\log^2 n) \\)","id":"COST-1EE2245B4CA0AF","includes":null,"locator":"Figure 4, step 4, p. 11; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","member":null,"note":"Interpolation of the polynomial through its points, by the fast algorithms the paper uses","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","formula":"\\( T(\\lambda+\\log n)+B\\kappa \\)","id":"COST-1F0D29A9D86D81","includes":null,"locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §7.1, TABLE, p. 17","measure":"communication","member":null,"note":"One hint to the leader, a table of \\( (\\lambda+\\log n) \\)-bit entries and a \\( \\kappa \\)-bit nonce per bin","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( \\eta_{\\mathrm{FHE}} + \\eta + (2t+2)\\gamma_{\\mathrm{FHE}} + \\delta_{\\mathrm{FHE}} + (3t+4)(2\\gamma+\\delta) \\)","id":"COST-1F42068D1C783D","includes":null,"locator":"Figure 6, step 1, p. 22; Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"communication","member":null,"note":"Its TFHE key component, encrypted evaluations and a partial decryption of the predicate; then its TAHE key component and per point three ciphertexts","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( n_X/L + n_Xv \\)","id":"COST-1FD9F14FFD38AF","includes":null,"locator":"§4.1, p. 6; Figure 2, Setup Phase, p. 10","measure":"communication","member":null,"note":"Compressed filter: a bitmap of the table and one tag per item.","operation":null,"per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( \\frac{n_Y(M+1)}{\\ln\\ln n_Y}+2n_X \\)","id":"COST-20667B11B634C0","includes":null,"locator":"Protocol PM-Semi-Honest, steps 1(c) and 3, p. 6; §4.2, pp. 7-8","measure":"computation","member":null,"note":"Encrypting every coefficient of the bin polynomials, then decrypting both answers for each sender item","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","formula":"\\( 4.8n(m-1) \\)","id":"COST-20C5F6CE675AF5","includes":null,"locator":"Construction 4, p. 14; Protocol 7, step 3, p. 16; §4.3, p. 18","measure":"computation","member":null,"note":"Evaluates its mega-bin's hint polynomial by Horner in each of its bins, \\( m-1 \\) multiplications each","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","formula":"\\( n+\\mu(n+m)(\\sigma-\\log n) \\)","id":"COST-21009D9687348B","includes":null,"locator":"Figure 4, steps 2b, 3b and 4b, p. 12; §4, pp. 6–7","measure":"computation","member":null,"note":"As Alice's: Bob's encodings mirror hers","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","formula":"\\( 2n_Y+1 \\)","id":"COST-2198115E26DE22","includes":null,"locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","member":null,"note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","formula":null,"id":"COST-21FC5D14576889","includes":null,"locator":"Figure 5, steps 3–4, p. 39","measure":"computation","member":null,"note":"Encoding its OKVS and decoding all \\( \\ell \\) at its items multiply only for an OKVS whose rows hold field elements, which the protocol leaves open","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","tip":null,"value":"conditional"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":"\\( 3(3t+4) \\)","id":"COST-2212E1A4E7826C","includes":null,"locator":"§7.1, p. 29","measure":"computation","member":null,"note":"Two encryptions per evaluation point, then one decryption of Bob's reply","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( n_X \\)","id":"COST-244833CEAF3630","includes":null,"locator":"Figure 6, step 5, p. 26; §3.2, p. 8","measure":"computation","member":null,"note":"The hash of the Diffie-Hellman key of each item","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","formula":"\\( 3n_Y+1 \\)","id":"COST-25BF0D295075C4","includes":null,"locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","member":null,"note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","formula":"\\( (4t+1)\\gamma + |\\mathbb{F}| + \\eta + (3t+1)\\log p \\)","id":"COST-26C932A460E51E","includes":null,"locator":"Figure 5, steps 3–4, p. 11; Figure 10, step 5, p. 17","measure":"communication","member":null,"note":"The \\( 4t+1 \\) encrypted Hankel entries with the point \\( u \\) and her public key, then \\( 3t+1 \\) masked evaluations","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( 5n_X \\)","id":"COST-26D622447C26BF","includes":null,"locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","member":null,"note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three, as simple hashing uses them all","operation":"symmetric_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( 2Ln_X|\\mathbb{Z}_N|+L \\)","id":"COST-275AAE8F1DCF1E","includes":null,"locator":"Protocol PM-Malicious-Client, steps 2 and 4-5, p. 10","measure":"communication","member":null,"note":"A challenge naming the copies to open, then one ciphertext per item, candidate bin and evaluated copy; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","formula":null,"id":"COST-27B5E280423D73","includes":null,"locator":null,"measure":"communication","member":null,"note":"Alice's FHE public and evaluation keys, which Bob needs to compute on her ciphertexts; the sketch neither names nor sizes them","operation":null,"per":"client","phase":"setup","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( 6n_X \\)","id":"COST-2842323EA46632","includes":null,"locator":"Figure 1, steps 1–2, p. 13; §4.3, p. 10","measure":"computation","member":null,"note":"Per item: the OPRF hash to the group and output hash, the hash to short strings, and the three cuckoo hash functions of simple hashing","operation":"symmetric_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( 2(M+1)n_X \\)","id":"COST-2B7065B19A0CFD","includes":null,"locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7; §4.4, p. 9","measure":"computation","member":null,"note":"Homomorphic additions, per item and bin: \\( M \\) in Horner's rule and one adding the encrypted fixed string","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","formula":null,"id":"COST-2C8308A5754BF5","includes":null,"locator":null,"measure":"computation","member":null,"note":"Homomorphic rational interpolation from encrypted points, called far from practical","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","formula":"\\( 0 \\)","id":"COST-2CEC5E6069A235","includes":null,"locator":"Protocol 7, p. 16; §5.2, p. 20","measure":"communication","member":null,"note":"P1 sends only inside the OPRFs and the two-party computation","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","formula":"\\( 3n_X+1 \\)","id":"COST-2D28E14DAD6109","includes":null,"locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","member":null,"note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( O(m\\alpha B^{2}) \\)","id":"COST-2D3532DFB06A98","includes":null,"locator":"Figure 1, step 5, p. 13; §8.2, p. 19","measure":"computation","member":null,"note":"Coefficients of each subset's symmetric polynomial over the slot extension field","operation":"field_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( n_X + n_Y \\)","id":"COST-2D9AED2EEAACD4","includes":null,"locator":"Figure 2, Round 2, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( n_X|\\mathbb{G}| + e \\)","id":"COST-2DB623C9DAE8EB","includes":null,"locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"communication","member":null,"note":"Its hashed and exponentiated set, then one ciphertext of the sum.","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","formula":"\\( 7n \\)","id":"COST-2E1375E59DFAF9","includes":null,"locator":"§5.2, p. 15; §4.1, pp. 9–11; PRTY20 Figure 3, step 3, p. 11","measure":"computation","member":null,"note":"Per item: the leaf hash, the hyperedge and \\( r \\) hashes of its leaf and of the centre, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( \\left(\\frac{2n_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\kappa \\)","id":"COST-2EC7E3223EBEBE","includes":null,"locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, pp. 7-8","measure":"communication","member":null,"note":"The \\( M+1 \\) encrypted coefficients of each bin polynomial, her public key, and a key for the bin hash, taken as \\( \\kappa \\) bits","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( (4\\ell+1)(3t+4) \\)","id":"COST-2F3EEC94DB7096","includes":null,"locator":"Figure 9, steps 3c–3e, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"Per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( 3n_Y + 1 \\)","id":"COST-2F68CC1957F2FF","includes":null,"locator":"Figure 4, steps 4–5 and Output, p. 11; Appendix A.4, p. 16","measure":"computation","member":null,"note":"Per item an encryption of \\( k \\), a refresh and its value, then decrypts the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","id":"COST-30E9262D099935","includes":null,"locator":"Figure 8, p. 27; Figure 9, p. 30","measure":"computation","member":null,"note":"Hankel shares, with one power per item of exponent up to \\( p \\), and set-polynomial evaluations, then rational interpolation of degree \\( 3t+3 \\)","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( O(n_Y^2) \\)","id":"COST-317D4D222EB157","includes":null,"locator":"Protocol PM-Malicious-Server, step 1(b), p. 12","measure":"computation","member":null,"note":"Coefficients of the polynomial from its roots; the paper does not fix the method","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( (1+c)\\alpha\\frac{m}{k}(2L_\\alpha H_\\alpha-1) \\)","id":"COST-31E097D4B730D1","includes":null,"locator":"§3.1, p. 8; §4.2, p. 14","measure":"computation","member":null,"note":"A plaintext product per coefficient and the additions of the sums, for the intersection polynomial and each label fragment","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","formula":"\\( n \\)","id":"COST-325E4413FDED1F","includes":null,"locator":"Protocol 3.3, step 4 and note a, p. 8","measure":"computation","member":null,"note":"H per item; decoding the clients' OKVSs XORs their rows, and their hashing is left open","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"pivot","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","formula":"\\( 0 \\)","id":"COST-3374483DA62285","includes":null,"locator":"Figure 3, steps 1–2, p. 11","measure":"communication","member":null,"note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-33B928C5D0D65A","includes":null,"locator":"§3.1, p. 7; Figure 2, step 8, p. 14","measure":"communication","member":null,"note":"OPRF answers, then one reply per subset and batch at full width; modulus switching shrinks the reply","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( n_Y \\)","id":"COST-35A6D64C72CFBE","includes":null,"locator":"§4.2, p. 7","measure":"computation","member":null,"note":"The bin hash of each item, placing it in the less loaded of its two bins","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","formula":null,"id":"COST-35AE67E7AA63F8","includes":null,"locator":"Figure 5, step 2(b), p. 39; Figure 3, step 2, p. 22","measure":"computation","member":null,"note":"One product by s per item in its OPRF values, plus decoding Q and encoding its OKVS, which multiply only for an OKVS with field rows","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","tip":null,"value":"conditional"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","formula":"\\( 0 \\)","id":"COST-36BA33461BA439","includes":null,"locator":"Protocol 3.3, steps 4 and 6, p. 8","measure":"communication","member":null,"note":"Sends only inside the two-party PSI","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"pivot","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( 2n_X \\)","id":"COST-36DE5F3E75B7F0","includes":null,"locator":"Figure 4, inputs and step 1, p. 9","measure":"computation","member":null,"note":"Hashing each item, then hashing its signature into a tag","operation":"symmetric_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( n_Y \\)","id":"COST-36F969AE6F8205","includes":null,"locator":"Figure 2, Round 3, p. 6; §5, p. 11","measure":"computation","member":null,"note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( \\eta_{\\mathrm{FHE}} + \\eta + (2t+4)\\gamma_{\\mathrm{FHE}} + \\delta_{\\mathrm{FHE}} + (3t+4)(2\\gamma+\\delta) \\)","id":"COST-382C0999FF0BDB","includes":null,"locator":"Figure 5, step 1, p. 18; Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b, 3d and 3f, p. 41","measure":"communication","member":null,"note":"Its TFHE key component, encrypted evaluations and a partial decryption of the predicate; then its TAHE key component and per point three ciphertexts","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-38813FA222B5C8","includes":null,"locator":"§4.3, p. 10; Figure 2, step 7, p. 14","measure":"communication","member":null,"note":"As unlabeled; labels add nothing to the query","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( 1 \\)","id":"COST-38C6CE331B4286","includes":null,"locator":"Figure 2, Round 3, p. 6; Appendix A.4, p. 16","measure":"computation","member":null,"note":"The fresh encryption of zero that refreshes the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( n_Y \\)","id":"COST-38EB8F9943BC7D","includes":null,"locator":"Figure 4, step 6, p. 9","measure":"computation","member":null,"note":"One tag hash per unblinded signature","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","formula":"\\( (e\\epsilon n_Y+2)\\kappa \\)","id":"COST-3A1CAD94DE5E2D","includes":null,"locator":"RS21 Figure 4, step 4, p. 36; RS21 Figure 10, step 4, p. 39; §4, p. 23","measure":"communication","member":null,"note":"The OPRF's OKVS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","formula":"\\( 5n_X \\)","id":"COST-3A8176B8A438F5","includes":null,"locator":"Figure 3, step 3, p. 11; Figure 7, Decode, p. 30","measure":"computation","member":null,"note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( (m+t_c)\\kappa \\)","id":"COST-3AAA99A73A8B72","includes":null,"locator":"Protocol 4.4, steps 2–3, p. 10","measure":"communication","member":null,"note":"A \\( \\kappa \\)-bit PRF key to each server, then its OKVS of \\( \\kappa \\)-bit values to the pivot","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","formula":"\\( 5n_Y \\)","id":"COST-3AD2AFFB12FE2D","includes":null,"locator":"Figure 3, steps 1 and 4, p. 11; Figure 6, p. 19","measure":"computation","member":null,"note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","formula":"\\( 30n+B+O(n) \\)","id":"COST-3B2ABAB24A6548","includes":null,"locator":"Figure 10, steps 2–3, p. 16; Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; KKRT16 §6.3, p. 16","measure":"computation","member":null,"note":"Five bin hashes per item; as sender, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search; one hash per bin as receiver","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":"expected","subject":"party","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","formula":"\\( n(n+1)(\\ell-1) \\)","id":"COST-3B5DABE9E2D027","includes":null,"locator":"§7, step 2, p. 16; §4.2, pp. 6–7; p. 17","measure":"computation","member":null,"note":"Per item and client, \\( n \\) short exponentiations by Horner's rule and one by a fresh random multiplier; hashing to bins would lower this","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( 1.3n_Xe + e \\)","id":"COST-3B7C2F947B8578","includes":null,"locator":"Figure 3, steps 4 and 7, p. 10","measure":"communication","member":null,"note":"One encrypted OPRF value per bin, then the sum ciphertext","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( 3(3t+4) + 2t + 3 \\)","id":"COST-3C097AAAD184E0","includes":null,"locator":"Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"computation","member":null,"note":"Under TFHE \\( 2t+2 \\) encryptions and a partial decryption; under TAHE, per point, two encryptions and a partial decryption","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","formula":"\\( n_X+n_Y \\)","id":"COST-3CA481473F9D96","includes":null,"locator":"Appendix A, steps 2 and 4, p. 85","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","formula":"\\( n \\)","id":"COST-3CCCE687A3B2D7","includes":null,"locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"computation","member":null,"note":"One homomorphic subtraction \\( [[r_i']]\\cdot[[r_i]]^{-1} \\) per element, then a random permutation","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","formula":"\\( (n_Y+2)\\kappa \\)","id":"COST-3D28EC66275717","includes":null,"locator":"Figure 4, step 4, p. 36; §2, The Vandermonde OKVS, p. 8","measure":"communication","member":null,"note":"The polynomial masked by its VOLE share, one field element per coefficient, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","formula":"\\( n \\)","id":"COST-3D9941ED14231E","includes":null,"locator":"Protocol 3.3, step 5 and note a, p. 8","measure":"computation","member":null,"note":"H per item; decoding the first client's OKVS XORs its rows, and its hashing is left open","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","formula":"\\( 0 \\)","id":"COST-3DA06E0F83164B","includes":null,"locator":"§5.2, p. 16","measure":"communication","member":null,"note":"Bob sends only inside the generic two-party computation","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( n_Y|\\mathbb{F}| \\)","id":"COST-3DA7509B8BB713","includes":null,"locator":"Table 1, p. 4; §4, p. 15","measure":"communication","member":null,"note":"The polynomial, over a field the size of an encoded group element.","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","formula":"\\( O((n_X+n_Y)\\log^{2} n_Y) \\)","id":"COST-4085ACC6026DAA","includes":null,"locator":"§3, p. 8; Figure 4, p. 36; Figure 6, p. 37","measure":"computation","member":null,"note":"Products \\( A_i\\Delta \\) for \\( K = B + A\\Delta \\), multi-point evaluation of the polynomial \\( K \\) at its items, and one \\( \\Delta H_F(y) \\) per item","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( 2n_Y \\)","id":"COST-418AA862352E3D","includes":null,"locator":"Figure 5, p. 24; §3.2, p. 9","measure":"computation","member":null,"note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( (\\ell-t_c)n \\)","id":"COST-420EC1EB445898","includes":null,"locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, step 3, p. 10","measure":"computation","member":null,"note":"As a server, per item H and one PRF call per client key; comparing its share with the OPPRF outputs is XORs","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","formula":"\\( n_X \\)","id":"COST-420FC01E0C11E0","includes":null,"locator":"Appendix A, step 1, p. 85","measure":"computation","member":null,"note":"One hash of each of its own items","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( 2(3t+4) \\)","id":"COST-42B19ECA65013D","includes":null,"locator":"Figure 10, step 3d, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( 2(M+1)n_X \\)","id":"COST-44A775AE3D5FF0","includes":null,"locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7","measure":"computation","member":null,"note":"Homomorphic additions, per item and bin: \\( M \\) in Horner's rule and one adding the encrypted item","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( (t_c+1)n \\)","id":"COST-45721D48C50BBD","includes":null,"locator":"Protocol 4.4, step 3 and note a, p. 10","measure":"computation","member":null,"note":"Per item the random oracle H and one PRF call per server key; the OKVS's own hashing is left open","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( n(6t+9) + O(t^{3}) \\)","id":"COST-45BF025578D99B","includes":null,"locator":"Figure 5, step 3, p. 18; Figure 10, steps 3–4, p. 41","measure":"computation","member":null,"note":"As a client, for its own set; the cardinality test it evaluates under TFHE","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( n_Y+1 \\)","id":"COST-45CC5EC3E4B7F5","includes":null,"locator":"Figure 3, step 3, p. 8; Table 2, p. 11","measure":"computation","member":null,"note":"Each blinded value and the blinded product; the paper states \\( O(n_Y) \\) exponentiations with 160-bit exponents","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","formula":"\\( (\\ell-2)n \\)","id":"COST-45F6B156CC54ED","includes":null,"locator":"Protocol 3.3, steps 2–3 and note a, p. 8","measure":"computation","member":null,"note":"The first client: per item the random oracle H and one PRF call per other client's key; the OKVS's own hashing is left open","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( n_Y \\)","id":"COST-460017F1693616","includes":null,"locator":"Figure 6, step 7, p. 26; §3.2, p. 8","measure":"computation","member":null,"note":"The hash of the Diffie-Hellman key of each item","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( 5n_Y \\)","id":"COST-460520E5F25E00","includes":null,"locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","member":null,"note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three; re-insertions, unbounded, add more","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","formula":"\\( 0 \\)","id":"COST-46148030E6D142","includes":null,"locator":"§4.2, p. 13","measure":"communication","member":null,"note":"Bob sends only inside the generic two-party computation","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","formula":"\\( 24n_X+1 \\)","id":"COST-466071315578B0","includes":null,"locator":"RS21 Figure 10, steps 2–3, p. 39; RS21 Figure 8, step 2, p. 38; RS21 Figure 4, p. 36; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Simple hashing with three functions; per table entry the two row functions, \\( H_F \\) and \\( H \\) for the OPRF, and the row functions for the table","operation":"symmetric_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","formula":"\\( 0 \\)","id":"COST-4664AAC6064967","includes":null,"locator":"Protocol 7, p. 16; Protocol 9, p. 17","measure":"communication","member":null,"note":"P1 sends only inside the OPRFs and the two-party computation","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( n_Y \\)","id":"COST-46EC863691C997","includes":null,"locator":"§4.3, p. 10","measure":"computation","member":null,"note":"One answer per blinded OPRF query","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( n_X + n_Y \\)","id":"COST-4863854747F777","includes":null,"locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","formula":"\\( |\\mathbb{F}| \\)","id":"COST-49849B4ED592BB","includes":null,"locator":"Figure 11, step 11, p. 15; Corollary 6, p. 16; §2.1, p. 4","measure":"communication","member":null,"note":"Its share of the test's result, broadcast, so that all learn whether to compute the intersection","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"party","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","formula":"\\( n_X+n_Y \\)","id":"COST-49A61FB928CB8B","includes":null,"locator":"Appendix A, steps 1 and 3, p. 85","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-49E18DD137A773","includes":null,"locator":"§3.1, p. 11; §1.2, p. 3","measure":"communication","member":null,"note":"A constant number of source powers per batch; ring elements grow as the square of the depth, of order log log of the sender set","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( \\alpha\\frac{m}{k} \\)","id":"COST-4A48AC13C22D30","includes":null,"locator":"§5.2, p. 11","measure":"computation","member":null,"note":"An encryption of zero with large noise per reply, for function privacy in the leveled instantiation","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( n_Y \\)","id":"COST-4A6E3D06DCA6FD","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","id":"COST-4A97AF1FED21F0","includes":null,"locator":"Appendix A, steps 1 and 3, p. 85","measure":"communication","member":null,"note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-1999-HFH","tip":"Sender is Alice and receiver is Bob; the protocol is symmetric and both learn the count.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( \\frac{m}{k}(B-1) \\)","id":"COST-4A9E7A161733E4","includes":null,"locator":"Figure 2, step 8a, p. 14","measure":"computation","member":null,"note":"One product per power from the square up to the split size, shared by the subsets","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":"An upper bound: a power the receiver sends needs no product.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","formula":"\\( T(\\lambda+\\log n)+B\\kappa+2\\hat{n}\\sigma \\)","id":"COST-4B91B3265579B1","includes":null,"locator":"Figure 10, steps 2–4, p. 16; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §7.1, TABLE, p. 17","measure":"communication","member":null,"note":"Its one hint, a table of \\( (\\lambda+\\log n) \\)-bit entries as in the general protocol and a \\( \\kappa \\)-bit nonce per bin; P1 then announces the intersection","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"party","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","tip":"P1's, which also announces the intersection to the other two; P2 and P3 send only their hint.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( e_{\\mathrm{pk}} \\)","id":"COST-4C5EABBED09ADC","includes":null,"locator":"Figure 4, Setup, p. 11","measure":"communication","member":null,"note":"Its public key","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( n_X \\)","id":"COST-4E5EAD195BF372","includes":null,"locator":"Figure 2, Setup Phase, p. 10","measure":"computation","member":null,"note":"One PRF value per server item, then filter insertion.","operation":"exponentiation","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( n_X + 1 \\)","id":"COST-4EEB7DE54BFC96","includes":null,"locator":"Figure 6, p. 26; §4, p. 15","measure":"computation","member":null,"note":"One key-agreement message and one key per item.","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( (n_Y + 1)|\\mathbb{F}| \\)","id":"COST-4F00BF7609D297","includes":null,"locator":"Table 1, p. 4; Figure 6, p. 26","measure":"communication","member":null,"note":"The polynomial, one degree larger for the random point \\( P(0) = R \\).","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","formula":"\\( (2.4n_Y+d+\\lambda+2)\\kappa \\)","id":"COST-4F5F33423D4712","includes":null,"locator":"Figure 4, step 4, p. 36; §2, PaXoS details, p. 10; Figure 1, parameters, p. 7","measure":"communication","member":null,"note":"The PaXoS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( O(mB^{2}) \\)","id":"COST-4F98BE602C5A5A","includes":null,"locator":"§3, p. 6; §5.4, p. 18","measure":"computation","member":null,"note":"Coefficients of each bin's intersection polynomial","operation":"field_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","formula":"\\( \\kappa \\)","id":"COST-4FD2E6D3EA7143","includes":null,"locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","member":null,"note":"The key of the pseudorandom code, an AES key","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2016-KKRT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( 2n_X \\)","id":"COST-5013F54557A252","includes":null,"locator":"Protocol PM-Malicious-Server, step 2, p. 12","measure":"computation","member":null,"note":"Per item, one call to each random oracle","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","formula":"\\( (2n\\ell+n+3)|\\mathbb{Z}_N| \\)","id":"COST-507DC65E1DA41D","includes":null,"locator":"§7, steps 1 and 3, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(a), p. 6","measure":"communication","member":null,"note":"Her public key; then \\( n+1 \\) encrypted coefficients and \\( n(\\ell-1) \\) encrypted zero shares, posted once; then \\( n \\) row XORs at plaintext width","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","formula":"\\( (2k+s)n_X \\)","id":"COST-50E21E9EDE2C1A","includes":null,"locator":"Protocol 3, steps 1a and 2c, p. 22; §5, pp. 22–23","measure":"computation","member":null,"note":"Its \\( k \\) bin hashes per item, then one correlation-robust hash per OPRF value, for every hash function and stash position","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","formula":"\\( n(3\\mu+2) \\)","id":"COST-50ED0B98321559","includes":null,"locator":"Figure 9, steps 2a and 4, p. 27; §4, p. 6","measure":"computation","member":null,"note":"Per item a phasing hash and a commitment; per sender encoding its output hash and the tag and mask PRF calls","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( n_Y|\\mathbb{G}| + (1+c)\\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-51A46924713392","includes":null,"locator":"Figure 2, step 8, p. 14; §5.1, pp. 11–12","measure":"communication","member":null,"note":"Intersection results plus one label result per chunk, per subset and batch","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( (\\sigma-1)n_Y \\)","id":"COST-51B2D6824843E1","includes":null,"locator":"Figure 2, Online Phase, p. 10","measure":"computation","member":null,"note":"The product of the received values per item.","operation":"modmul","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( O\\left(\\frac{m}{k}B\\right) \\)","id":"COST-51F3FD6016204D","includes":null,"locator":"§3.1, pp. 8 and 11–12; Lemma 2, p. 12","measure":"computation","member":null,"note":"Plaintext products and additions of the Paterson–Stockmeyer sums, and the Frobenius operations that give powers","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( (1+c)\\alpha\\frac{m}{k}(2B+1) \\)","id":"COST-52328398FE1523","includes":null,"locator":"Figure 2, step 8b, p. 14; §5.1, p. 11","measure":"computation","member":null,"note":"The dot product repeated for each label chunk: \\( B+1 \\) plaintext products and \\( B \\) additions per polynomial, subset and batch","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","formula":"\\( n\\gamma \\)","id":"COST-537C7DD90B4AF0","includes":null,"locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"communication","member":null,"note":"Bob's \\( n \\) permuted ciphertexts","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","formula":"\\( O(nt) \\)","id":"COST-5426603A3DE227","includes":null,"locator":"§3, p. 8","measure":"computation","member":null,"note":"Evaluations of its set polynomial at the public points","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( O(n_Y) \\)","id":"COST-543671AC7E0AB7","includes":null,"locator":"Figure 4, step 2, p. 9; §5.6, p. 9","measure":"computation","member":null,"note":"Blinding: a random factor to the small public exponent, then one multiplication, per item","operation":"modmul","per":null,"phase":"offline","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( n_Y|\\mathbb{Z}_N| + n_X\\kappa \\)","id":"COST-544DA2CA5D7E1B","includes":null,"locator":"Figure 4, step 5, p. 9","measure":"communication","member":null,"note":"The signed blinded values, and one security-parameter-length tag per item","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","formula":"\\( O(t\\log p) \\)","id":"COST-5482DA781EFA3D","includes":null,"locator":"§3, p. 8","measure":"communication","member":null,"note":"Exactly \\( tC \\): encrypted coefficients of the numerator polynomial","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","formula":"\\( (\\ell-1)(n+B)+3n \\)","id":"COST-55D6C6B75E92E0","includes":null,"locator":"Figure 9, Generate zero-sharing, p. 14; Figure 7, step 1, p. 11; Figure 6, step 6, p. 8; Appendix B, p. 24","measure":"computation","member":null,"note":"A PRF call per seed for each item's zero-share, three cuckoo hashes per item, and one hash per bin as receiver in each client's OPPRF","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","formula":"\\( (7.2n_X+d+\\lambda)(\\lambda+\\log_2(\\epsilon n_Y))+2\\kappa \\)","id":"COST-5642A2198A0AC3","includes":null,"locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 4, steps 1 and 5, p. 36; Figure 1, parameters, p. 7; §6, p. 23","measure":"communication","member":null,"note":"The OPPRF table, an XoPaXoS over its items in their three bins, and the coin toss's commitment and opening; associated values add more","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( (2^{w}-1)\\left(\\left\\lfloor \\log_2(B/\\alpha)/w \\right\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-575B7943DAFE09","includes":null,"locator":"§4.3, p. 10; Figure 4, step 5, p. 12","measure":"communication","member":null,"note":"Window powers of each batched cuckoo-table plaintext, each an FV ciphertext of two ring elements","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","formula":"\\( Bm(\\lambda+\\log(2.4n)) \\)","id":"COST-5A83A1AAC41BDA","includes":null,"locator":"§7.2, p. 23; §7.3, p. 24; Protocol 7, step 2, p. 16","measure":"communication","member":null,"note":"P2's hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","formula":"\\( 4t+1 \\)","id":"COST-5AC6718C9FEE42","includes":null,"locator":"Figure 5, step 5, p. 11","measure":"computation","member":null,"note":"Encrypts the entries of his own Hankel matrix","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( 2(3t+4) \\)","id":"COST-5C8DBE5B5FF425","includes":null,"locator":"Figure 9, step 3d, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( n_X \\)","id":"COST-5D97540942F7CD","includes":null,"locator":"Figure 2, Round 1, p. 6","measure":"computation","member":null,"note":"Hashes each item to the group","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","formula":"\\( 18n_X+1 \\)","id":"COST-5E1208FEE07C0C","includes":null,"locator":"Figure 10, steps 2–3, p. 39; Figure 8, step 2, p. 38; Figure 4, step 1 and the sender's evaluation, p. 36; §7.2, p. 30","measure":"computation","member":null,"note":"Simple hashing with three functions, then per table entry row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( n_Y \\)","id":"COST-5E75C73319DD93","includes":null,"locator":"Figure 4, step 6, p. 11; §5, p. 11","measure":"computation","member":null,"note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( O\\left(\\frac{n_YM^2}{\\ln\\ln n_Y}\\right) \\)","id":"COST-5E8DFC332E9F27","includes":null,"locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §4.2, p. 7","measure":"computation","member":null,"note":"Coefficients of each bin polynomial from its roots, \\( O(M^2) \\) for degree \\( M \\); the paper does not fix the method","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( n_X \\)","id":"COST-5F6FB1C13E3ED8","includes":null,"locator":"Figure 3, step 3, p. 8","measure":"computation","member":null,"note":"One hash per tag","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":null,"id":"COST-5FE775C4F830A4","includes":null,"locator":"§7.1, p. 29; §2.6, p. 10","measure":"communication","member":null,"note":"Her public key; the additively homomorphic scheme, and so the size of its key, is left open","operation":null,"per":"client","phase":"setup","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( 2.6n_X + 1 \\)","id":"COST-6147A1FBA9BCE4","includes":null,"locator":"Figure 3, steps 4 and 7, p. 10; Appendix A.4, p. 16","measure":"computation","member":null,"note":"Encrypts its OPRF value in each bin, decrypts each re-masked one, and encrypts zero to refresh the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","formula":"\\( 4t+1 \\)","id":"COST-6189074DE47E1B","includes":null,"locator":"Figure 5, step 3, p. 11","measure":"computation","member":null,"note":"Encrypts the entries of her Hankel matrix","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","formula":"\\( (\\lambda+\\log_2(n_Xn_Y))n_X \\)","id":"COST-625EED5C9042A1","includes":null,"locator":"Figure 3, step 3, p. 11; §4.4, pp. 14–15; Lemma 6, p. 14","measure":"communication","member":null,"note":"One \\( H_2 \\) output per item, at the semi-honest length, the least the proof allows","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( 0 \\)","id":"COST-62642ACB2B63A5","includes":null,"locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, p. 10","measure":"communication","member":null,"note":"Sends only inside ZeroXOR, as zero-sharing party and OPPRF sender","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"server","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":null,"id":"COST-62741692C9F223","includes":null,"locator":"§2.3, p. 5; §3, p. 6","measure":"communication","member":null,"note":"Evaluation keys for the key switching of every multiplication; the receiver alone holds the secret key, so it sends them once. Their size is not given","operation":null,"per":"client","phase":"setup","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","formula":"\\( (3t+1)\\log p + 1 \\)","id":"COST-63405BFA97C326","includes":null,"locator":"Figure 5, p. 11; Figure 10, p. 17","measure":"communication","member":null,"note":"A one-bit verdict, then \\( 3t+1 \\) masked evaluations","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","tip":"Alice, who holds the decryption key, is counted as receiver and Bob as sender; both learn the output.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","formula":"\\( 2\\kappa n \\)","id":"COST-637BD705354998","includes":null,"locator":"PRTY20 Figure 3, step 3, p. 11; PRTY20 §4.4, p. 15; Theorem 7, p. 21; Figure 4, p. 23","measure":"communication","member":null,"note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item, as for malicious security","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","formula":"\\( \\kappa^2 \\)","id":"COST-63F9B18954C9FD","includes":null,"locator":"§4.2, Key Schedule, p. 7; Figure 1, Base Phase, p. 9","measure":"communication","member":null,"note":"The labels of its \\( \\kappa \\)-bit key, sent once for all circuits, which share one key schedule","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","formula":"\\( 0 \\)","id":"COST-65ED83FF1B95E1","includes":null,"locator":"§4.2, p. 13","measure":"communication","member":null,"note":"Alice sends only inside the generic two-party computation","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","formula":"\\( 3n_X + \\rho \\)","id":"COST-6636857E786D0C","includes":null,"locator":"Figure 1, Setup Phase, p. 9; §3.4, pp. 5–6","measure":"computation","member":null,"note":"One LowMC evaluation per item, then a tag and a bucket hash to insert it, and one hash per alternate bucket","operation":"symmetric_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( 5n_X \\)","id":"COST-6687992A6AAAF5","includes":null,"locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","member":null,"note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three, as simple hashing uses them all","operation":"symmetric_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","formula":"\\( (\\ell-1)\\kappa \\)","id":"COST-66DB5B17081AED","includes":null,"locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","member":null,"note":"A PRF seed to every client, once for any number of zero-sharings","operation":null,"per":null,"phase":"setup","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","formula":"\\( (\\ell+29)n+O(n) \\)","id":"COST-6770D2AE8599ED","includes":null,"locator":"Figure 9, Generate zero-sharing, p. 14; Figure 7, step 2, p. 11; Figure 6, steps 2–3, p. 8; KKRT16 §6.3, p. 16","measure":"computation","member":null,"note":"A PRF call per seed for each item's zero-share, five bin hashes per item, five calls per OPRF value at its \\( 5n \\) bin entries, and the nonce search","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":"expected","subject":"client","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","formula":"\\( |\\mathbb{F}| + (3t/2+1)\\log p \\)","id":"COST-68CDB7ADF109E9","includes":null,"locator":"Figure 7, p. 9; Corollary 3, p. 10; GS19 Figure 10, step 5, p. 17","measure":"communication","member":null,"note":"Alice's share of the test's result, then her masked evaluations at half the threshold","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","formula":"\\( 4n \\)","id":"COST-68FD49552622D9","includes":null,"locator":"§5.1, p. 15; §5.2, pp. 16–17","measure":"computation","member":null,"note":"Bob's Cuckoo hashing into both tables: each item's two positions per table, each computed once","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( n_X+n_Y+1+\\min(n_X,n_Y) \\)","id":"COST-690577DBDFF84F","includes":null,"locator":"Protocol PM-Malicious-Server, steps 1 and 3, p. 12","measure":"computation","member":null,"note":"Encrypting the coefficients, decrypting each reply, and re-encrypting the seed in each re-run evaluation","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( \\frac{m}{k}(B-1) \\)","id":"COST-69280FF1A1B515","includes":null,"locator":"Figure 8, step 2, p. 25; Figure 2, step 8a, p. 14","measure":"computation","member":null,"note":"Powers up to the split size, shared by the subsets; label polynomials replace the symmetric ones","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":"An upper bound: a power the receiver sends needs no product.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","formula":"\\( n_X \\)","id":"COST-6A3DE4CA2C1BA2","includes":null,"locator":"Appendix A, step 1, p. 85","measure":"computation","member":null,"note":"One hash of each of its own items","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-1999-HFH","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":null,"id":"COST-6ACBDC6287AE28","includes":null,"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","member":null,"note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","operation":null,"per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( n_Y|\\mathbb{F}| \\)","id":"COST-6BF2346920BDA5","includes":null,"locator":"Table 1, p. 4; Figure 5, p. 24","measure":"communication","member":null,"note":"The polynomial, over a field the size of an encoded group element.","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( n_Y \\)","id":"COST-6C91C9759ADCD4","includes":null,"locator":"Figure 2, Round 2, p. 6","measure":"computation","member":null,"note":"Hashes each item to the group","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( n \\)","id":"COST-6D05DD8F657F79","includes":null,"locator":"Protocol 4.4, step 4 and note a, p. 10","measure":"computation","member":null,"note":"H per item; decoding the clients' OKVSs XORs their rows, and their hashing is left open","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"pivot","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-6D8B9CEFC60780","includes":null,"locator":"Figure 8, steps 1b and 2, p. 25","measure":"communication","member":null,"note":"OPRF answers, then the label-polynomial results only","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","formula":null,"id":"COST-6E4231E2E71E55","includes":null,"locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","member":null,"note":"Encoding its OKVS and decoding R at each item multiply only for an OKVS whose rows hold field elements","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","tip":null,"value":"conditional"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( (\\ell-1)(\\ell(\\eta_{\\mathrm{FHE}} + \\eta) + \\log p + \\gamma_{\\mathrm{FHE}} + 1 + (3t+4)(2\\gamma+\\log p)) \\)","id":"COST-6E4C8809B90997","includes":null,"locator":"Figure 6, step 1, p. 22; Figure 6, steps 2 and 5, p. 22; Figure 9, steps 3c, 3e and 3g, p. 30","measure":"communication","member":null,"note":"To each other party: the joint TFHE key, z, the encrypted predicate and its bit; then the joint TAHE key and per point three values","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","formula":"\\( 0 \\)","id":"COST-6E90DFBA6F65A2","includes":null,"locator":"§2, p. 4","measure":"communication","member":null,"note":"Sends only inside the OT extension","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( 4n_X \\)","id":"COST-6F68A379C94724","includes":null,"locator":"Figure 4, step 1, p. 12; Figure 2, step 1, p. 8; §4.2, p. 8","measure":"computation","member":null,"note":"Per item: the hash to a shorter string when items are long, then the location hash under each of the three cuckoo hash functions for simple hashing","operation":"symmetric_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( n_Y \\)","id":"COST-6FE33E8ED95A32","includes":null,"locator":"Figure 2, Round 2, p. 6","measure":"computation","member":null,"note":"Hashes each item to the group","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","formula":"\\( O((n_X+n_Y)\\log^{2} n_Y) \\)","id":"COST-70E087ECDF19DF","includes":null,"locator":"§3, p. 8; Figure 4, p. 36; Figure 6, p. 37","measure":"computation","member":null,"note":"Products \\( A_i\\Delta \\) for \\( K = B + A\\Delta \\), multi-point evaluation of the polynomial \\( K \\) at its items, and one \\( \\Delta H_F(y) \\) per item","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","formula":"\\( n_X+n_Y \\)","id":"COST-724E4942FB1182","includes":null,"locator":"Appendix A, steps 2 and 4, p. 85","measure":"computation","member":null,"note":"Its own hashed items, then the other party's values, each with its secret exponent","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-1999-HFH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( n_X \\)","id":"COST-726C9728E5832E","includes":null,"locator":"Protocol PM-Malicious-Server, step 2(b), p. 12","measure":"computation","member":null,"note":"Encrypting the random seed of each item, with randomness derived from it","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":"\\( |\\mathbb{F}| + 2(3t+4)\\gamma \\)","id":"COST-7292C4DEA64C8A","includes":null,"locator":"Figure 8, step 1a, p. 27; §7.1, p. 29","measure":"communication","member":null,"note":"The sparsity-test point u, taking Alice as P1, then encryptions of \\( p^A(x) \\) and \\( R^A_2(x) \\) at each of \\( 3t+4 \\) points","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","formula":"\\( 2n\\ell+1 \\)","id":"COST-7350914B8310BF","includes":null,"locator":"§7, steps 1 and 3, p. 16","measure":"computation","member":null,"note":"Encrypts \\( n+1 \\) coefficients and \\( n(\\ell-1) \\) zero shares, then decrypts her column from the leader and from every client, her own included","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","formula":"\\( m\\mu(\\sigma-\\log n) \\)","id":"COST-739D253330F712","includes":null,"locator":"Figure 4, step 3, p. 12; Figure 8, p. 20; §7.1, p. 21","measure":"communication","member":null,"note":"One bit per OT he receives, flipping a choice made at random offline","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( 5n_Y \\)","id":"COST-73B0F75CD3D568","includes":null,"locator":"Figure 3, steps 1 and 5, p. 8","measure":"computation","member":null,"note":"The product of the hashes, the quotients, blinding and unblinding, each quotient counted as one multiplication by an inverse","operation":"modmul","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( 2(3t+4) \\)","id":"COST-7404F5C5A6B1C7","includes":null,"locator":"Figure 9, step 3d, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+(1+c)\\alpha\\right)\\frac{m}{k} \\)","id":"COST-7456CCFC5A46E8","includes":null,"locator":"Figure 2, steps 7 and 9, p. 14","measure":"computation","member":null,"note":"BFV encryptions of the window powers and decryptions of all results","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( n_X \\)","id":"COST-74C47B63702E84","includes":null,"locator":"Figure 4, step 1, p. 9; §5.6, p. 9","measure":"computation","member":null,"note":"RSA signatures with the private exponent; reusable while the key and set are unchanged","operation":"exponentiation","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( (\\ell-t_c)n \\)","id":"COST-75B11974BB8A24","includes":null,"locator":"Protocol 4.4, step 5 and note a, p. 10","measure":"computation","member":null,"note":"Per item H and one PRF call per client key","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"server","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","formula":"\\( 3n_X+1 \\)","id":"COST-75B450612B94A4","includes":null,"locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","member":null,"note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( n_X(2|\\mathbb{Z}_N|+\\tau) \\)","id":"COST-764D5C2F870963","includes":null,"locator":"Protocol PM-Malicious-Server, step 2, p. 12","measure":"communication","member":null,"note":"A ciphertext and a random-oracle output for each item, permuted; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( O\\left(\\frac{Ln_YM^2}{\\ln\\ln n_Y}\\right) \\)","id":"COST-7717197B9B2501","includes":null,"locator":"Protocol PM-Malicious-Client, step 1, p. 10; §4.2, p. 7","measure":"computation","member":null,"note":"Coefficients of each bin polynomial of each copy from its roots, \\( O(M^2) \\) for degree \\( M \\)","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( 5n_Y \\)","id":"COST-780E2A1282FC92","includes":null,"locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","member":null,"note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three; re-insertions, unbounded, add more","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","id":"COST-787DD266B39360","includes":null,"locator":"Figure 5, p. 11; Figure 7, p. 13","measure":"computation","member":null,"note":"As the receiver, symmetrically","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( |\\mathbb{G}| + 2\\kappa n_X \\)","id":"COST-792EF232011073","includes":null,"locator":"Table 1, p. 4; §4, p. 15","measure":"communication","member":null,"note":"One key-agreement message and one hash output per item.","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( \\left(\\frac{2n_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\kappa \\)","id":"COST-796AA4946E2E43","includes":null,"locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, pp. 7-8; §4.4, p. 9","measure":"communication","member":null,"note":"The \\( M+1 \\) encrypted coefficients of each bin polynomial, her public key, and a key for the bin hash, taken as \\( \\kappa \\) bits","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( e_{\\mathrm{pk}} \\)","id":"COST-79763FE376E533","includes":null,"locator":"Figure 3, Setup, p. 10","measure":"communication","member":null,"note":"Its public key","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","formula":"\\( O(nm) \\)","id":"COST-7999AC0430C435","includes":null,"locator":"§4.3, p. 18; §7.2, p. 23","measure":"computation","member":null,"note":"P2 interpolates one hint polynomial of degree at most \\( m \\) per mega-bin by Lagrange, \\( O(Bm^2) \\) for \\( B = O(n/m) \\) mega-bins","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( (n(59+1.44\\log_2 n)+1)e \\)","id":"COST-79F9200CE7201B","includes":null,"locator":"Figure 4, steps 3 and 6, p. 11; §5.1, p. 11; Table 4, p. 12","measure":"communication","member":null,"note":"\\( (b+1)e \\): one ciphertext per bit of a \\( b \\)-bit Bloom filter sized for a negligible false match over all items, then the sum","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","id":"COST-7AE470572AD27B","includes":null,"locator":"Appendix A, steps 1 and 3, p. 85","measure":"communication","member":null,"note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated in order","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","tip":"Sender is Alice and receiver is Bob; the protocol is symmetric and both learn the intersection.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","formula":"\\( (2.4\\epsilon n_Y+d+\\lambda+2)\\kappa \\)","id":"COST-7B9499DBC6DDB6","includes":null,"locator":"Figure 4, step 4, p. 36; Figure 10, step 4, p. 39; §2, PaXoS details, p. 10","measure":"communication","member":null,"note":"The OPRF's PaXoS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( \\left(\\frac{L}{2}+2\\right)n_X \\)","id":"COST-7BB4CF5E572D25","includes":null,"locator":"Protocol PM-Malicious-Client, steps 1 and 4, p. 10","measure":"computation","member":null,"note":"Per item, the collision-resistant hash and the bin hash, then its pseudo-identity under each revealed key","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","formula":"\\( n_Y \\)","id":"COST-7C492D66C88909","includes":null,"locator":"Appendix A, step 2, p. 85","measure":"computation","member":null,"note":"One hash of each of its own items","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( n_Y \\)","id":"COST-7CFBBA475A5E2A","includes":null,"locator":"Figure 4, step 4, p. 9; Table 2, p. 11","measure":"computation","member":null,"note":"Signing each blinded value with the full-length private exponent","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":"\\( 4(3t+4) \\)","id":"COST-7D3EE1605B9D14","includes":null,"locator":"§7.1, p. 29","measure":"computation","member":null,"note":"Per point, two scalar products of Alice's ciphertexts and two additions, one of them adding his own encrypted term","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","formula":"\\( Bm(\\lambda+\\log(2.4n)) \\)","id":"COST-7E622681EE6790","includes":null,"locator":"§7.2, p. 23; §7.3, pp. 24–25; Protocol 10, step 1, p. 20","measure":"communication","member":null,"note":"P2's first-phase hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","formula":"\\( 4n_Y \\)","id":"COST-7F2B553148ADEF","includes":null,"locator":"Figure 9, steps 1 and 5, p. 23; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Per item \\( H_B \\), the two row functions and \\( H_o \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( 2n_Y \\)","id":"COST-7FBC6E538D76ED","includes":null,"locator":"§4.3, p. 10","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","id":"COST-7FC76AE55FB1ED","includes":null,"locator":"Figure 8, step 3, p. 25","measure":"computation","member":null,"note":"BFV encryptions of the window powers and decryptions of the label results","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","formula":"\\( 0 \\)","id":"COST-80515866521658","includes":null,"locator":"Figure 4, p. 12","measure":"communication","member":null,"note":"Bob sends only the flows of the encodings and the coin toss","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","formula":"\\( 3n \\)","id":"COST-809A08E153B157","includes":null,"locator":"§5.2, pp. 20–21","measure":"computation","member":null,"note":"Its items' three Cuckoo positions, each computed once","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( \\frac{m}{k}\\left(L_\\alpha+(\\alpha+1)H_\\alpha-\\alpha-2-s\\right) \\)","id":"COST-809C4D75D447F6","includes":null,"locator":"§3.1, pp. 8 and 10","measure":"computation","member":null,"note":"Paterson–Stockmeyer per batch: a product per low or high power that is not a source power, then one per high power and partition","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( O((1+c)m\\alpha B^{2}) \\)","id":"COST-80E94CD91E7432","includes":null,"locator":"Figure 1, step 5b, p. 13; §5.1, p. 12","measure":"computation","member":null,"note":"Each subset's symmetric polynomial, then a Newton interpolation per label chunk, each \\( O(B^2) \\) in the split size \\( B \\)","operation":"field_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( (L+2)n_Y \\)","id":"COST-8127B63A6C815D","includes":null,"locator":"Protocol PM-Malicious-Client, step 1, p. 10","measure":"computation","member":null,"note":"Per item, the collision-resistant hash and the bin hash, then its pseudo-identity under each of the \\( L \\) keys","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( n_Y \\)","id":"COST-813509ACEA689A","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","formula":"\\( 30n+\\min(t_c+1,\\ell-1)(25n+B)+O(\\min(t_c+1,\\ell-1)n) \\)","id":"COST-8177AC4344FFE1","includes":null,"locator":"Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; Figure 8, steps 2 and 4, p. 12; §5.3, p. 13; KKRT16 §6.3, p. 16","measure":"computation","member":null,"note":"Five bin hashes per item; as sender in its sharing OPPRFs and the one to the leader, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":"expected","subject":"client","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( n_X \\)","id":"COST-81B96623864336","includes":null,"locator":"§7.3, pp. 17–18; Figure 8, step 1, p. 25","measure":"computation","member":null,"note":"Pre-processing per receiver: jointly sampled hash functions are not reused","operation":"exponentiation","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( n_Y + 1 \\)","id":"COST-81D9FE9F1F1186","includes":null,"locator":"Figure 2, Round 2 and Output, p. 6","measure":"computation","member":null,"note":"Encrypts each value, then decrypts the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( n_Y \\)","id":"COST-82649190F931C2","includes":null,"locator":"Figure 3, step 7, p. 10; §5, p. 11","measure":"computation","member":null,"note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","id":"COST-82666BEE69836A","includes":null,"locator":"Figure 2, steps 7 and 9, p. 14","measure":"computation","member":null,"note":"BFV encryptions of the window powers and decryptions of the replies","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","formula":"\\( 0 \\)","id":"COST-82906E71FFB79A","includes":null,"locator":"§2, pp. 3–4; §5, p. 6","measure":"computation","member":null,"note":"No cryptographic operation outside garbling and the OTs; sorting its own set is done in the clear","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","formula":"\\( 2n \\)","id":"COST-82F397AB26901C","includes":null,"locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","member":null,"note":"\\( H_1 \\) and \\( H_2 \\) per item, besides any hashing of the linear OKVS, which the paper leaves open","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","formula":"\\( 4t+1 \\)","id":"COST-840A4F667A3E75","includes":null,"locator":"Figure 5, step 5, p. 11","measure":"computation","member":null,"note":"Subtracts his encrypted entries from hers, one per distinct entry of the Hankel matrix","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","formula":"\\( 0 \\)","id":"COST-8467843E38FCFE","includes":null,"locator":"Algorithm 1, p. 5; §4, p. 5","measure":"computation","member":null,"note":"No cryptographic operation outside garbling and the OTs; permuting its set is done in the clear","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( (n_Y+1)|\\mathbb{G}| + n_X\\kappa \\)","id":"COST-84B4169928AD0D","includes":null,"locator":"Figure 3, step 4, p. 8","measure":"communication","member":null,"note":"Its key share, the exponentiated blinded values, and one security-parameter-length tag per item","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","formula":"\\( n \\)","id":"COST-84D41BE8EE5CC3","includes":null,"locator":"Figure 6, p. 9","measure":"computation","member":null,"note":"Encrypting his \\( n \\) shares under Alice's key","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( (\\ell+5)(3t+4) \\)","id":"COST-84EEEE762F1C44","includes":null,"locator":"Figure 9, steps 3b–3g, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"Per point: two encryptions, \\( \\ell+1 \\) refreshes, a partial decryption and the combination","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( (\\ell+5)(3t+4) + 2t + 6 \\)","id":"COST-84F6EDD8E93194","includes":null,"locator":"Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b–3g, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"TFHE: \\( 2t+4 \\) encryptions, a partial decryption, the combination; TAHE, per point: two encryptions, \\( \\ell+1 \\) refreshes, a share, the combination","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","formula":"\\( 2n \\)","id":"COST-863418BC596232","includes":null,"locator":"Figure 3, step 2, p. 22","measure":"computation","member":null,"note":"\\( H_1 \\) and \\( H_2 \\) per item, besides any hashing of the linear OKVS, which the paper leaves open","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( 4n_X|\\mathbb{Z}_N| \\)","id":"COST-8646DD2C1BFAC2","includes":null,"locator":"§4.2, p. 7","measure":"communication","member":null,"note":"One ciphertext per candidate bin of each of its items; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( \\left(\\frac{3Ln_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\left(\\frac{L}{2}+1\\right)\\kappa \\)","id":"COST-879E1C29AC8FAE","includes":null,"locator":"Protocol PM-Malicious-Client, steps 1 and 3, p. 10; §4.2, pp. 7-8","measure":"communication","member":null,"note":"\\( L \\) copies of the encrypted bin polynomials, then openings of half and the PRF keys of the rest; plus her public key and the hash key","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( \\frac{m}{k}\\left(L_\\alpha+H_\\alpha-2-s+(1+c)\\alpha(H_\\alpha-1)\\right) \\)","id":"COST-87F715BF8C7CEE","includes":null,"locator":"§3.1, p. 8; §4.2, p. 14; §5.3, p. 18","measure":"computation","member":null,"note":"Low and high powers that are not source powers, once per batch, then a product per high power for each intersection and label polynomial","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( n_Y(\\sigma w + |\\mathbb{G}|) \\)","id":"COST-880C986FC0A0F4","includes":null,"locator":"Figure 2, Online Phase, p. 10","measure":"communication","member":null,"note":"One masked exponent per input bit and one group element per item.","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","formula":"\\( 1.23(\\lambda+\\log(n_Xn_Y))n_Y+2\\kappa \\)","id":"COST-881992E4F306F3","includes":null,"locator":"Figure 9, steps 1, 3 and 4, p. 23; §4, p. 22; Theorem 3, p. 33","measure":"communication","member":null,"note":"The OKVS correction, one base-field element per position, with the seeds \\( r \\) and \\( r' \\); the figure omits sending \\( r' \\), which the sender needs","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","formula":"\\( n\\mu(\\lambda+2\\log(n\\mu)) \\)","id":"COST-89D35F1395275F","includes":null,"locator":"Figure 4, step 4a, p. 12; §6.2, p. 12","measure":"communication","member":null,"note":"Alice's common encodings, \\( \\mu \\) per item, each as long as an encoding","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( 2n_Y \\)","id":"COST-8A761CD7AF95E8","includes":null,"locator":"§4.3, p. 10","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( n_X|\\mathbb{G}| + 2|\\mathcal{R}_q| \\)","id":"COST-8C3FCEC0DA2A69","includes":null,"locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"communication","member":null,"note":"Its hashed and exponentiated set, then one ciphertext of the sum.","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","formula":"\\( 4n \\)","id":"COST-8F077A28104F81","includes":null,"locator":"Algorithm 2, p. 15; Algorithm 3, p. 16; §5.2, pp. 16–17","measure":"computation","member":null,"note":"Alice's 2D Cuckoo hashing: each item's positions under the four hash functions, each computed once and kept across relocations","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( 2|\\mathcal{R}_q| \\)","id":"COST-8FD369F2F5D655","includes":null,"locator":"Figure 2, Setup, p. 6","measure":"communication","member":null,"note":"Its Ring-LWE public key, two ring elements at full width, as the paper states no encoding","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","formula":"\\( \\sigma n\\kappa \\)","id":"COST-905A27C7191743","includes":null,"locator":"§2, p. 4; §5, p. 6","measure":"communication","member":null,"note":"The generator's input labels, one per bit of its sorted set","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","formula":"\\( 1.23n_Y+O(n_X) \\)","id":"COST-91D78984C88811","includes":null,"locator":"Figure 9, steps 3–4, p. 23; Figure 1, p. 7; §4, p. 22; §2, Field row, p. 8","measure":"computation","member":null,"note":"One base-by-extension product per OKVS position for \\( B' = B + A'\\Delta \\); per item \\( \\Delta H_B(y) \\) and the decode's dense-column products","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( n_X \\)","id":"COST-9299E6382F08E1","includes":null,"locator":"Figure 3, inputs, p. 8; §5.5, p. 8","measure":"computation","member":null,"note":"Hashing each of its items","operation":"symmetric_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":null,"id":"COST-947CE91A3A6344","includes":null,"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","member":null,"note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","operation":null,"per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","formula":"\\( \\sigma n\\kappa + \\sigma(n\\log n-n+1)\\kappa \\)","id":"COST-94D793FF3675E3","includes":null,"locator":"§2, p. 4; §5.3.3, p. 9","measure":"communication","member":null,"note":"Its input labels, and one ciphertext per programmed gate of the Waksman swappers, \\( \\sigma \\) gates per swapper","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( 3n_Y \\)","id":"COST-94EAB6CBCC2875","includes":null,"locator":"§3.4, p. 6; Figure 2, Online Phase, p. 10","measure":"computation","member":null,"note":"Filter lookup: the tag hash and both bucket hashes per item","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","formula":"\\( (2.4n_Y+d+\\lambda+2)\\kappa \\)","id":"COST-94F7A0AA26D48C","includes":null,"locator":"Figure 4, step 4, p. 36; §2, PaXoS details, p. 10; Figure 1, parameters, p. 7","measure":"communication","member":null,"note":"The PaXoS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","formula":"\\( 0 \\)","id":"COST-95AC20B236A678","includes":null,"locator":"Figure 9, p. 27","measure":"communication","member":null,"note":"Bob sends only the flows of the encodings and the coin toss","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","formula":"\\( O(nt+t^{3}) \\)","id":"COST-95C3DA594223E8","includes":null,"locator":"Figure 7, step 6, p. 9; Figure 8, step 3, p. 10; GS19 Figure 7, steps 3–7, p. 13","measure":"computation","member":null,"note":"Evaluates its polynomials at the points, interpolates and tests roots; the sums of its shares are additions","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","formula":"\\( 0 \\)","id":"COST-9607F62F6C14DB","includes":null,"locator":"Figure 3, steps 1–2, p. 11","measure":"communication","member":null,"note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","formula":"\\( 2n_Y+1 \\)","id":"COST-96457C1BD9D7C4","includes":null,"locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","member":null,"note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","formula":"\\( 3n_Y+1 \\)","id":"COST-96DBE9855322E5","includes":null,"locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","member":null,"note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","formula":"\\( 4n \\)","id":"COST-9729A6B388840D","includes":null,"locator":"Algorithm 1, p. 12; §4.1, pp. 11–12","measure":"computation","member":null,"note":"Alice's two Cuckoo hashings over the left rows, four hash functions per item; the right tables reuse those placements","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( 7n_X \\)","id":"COST-9756828C505906","includes":null,"locator":"Figure 1, steps 1–2, p. 13; §4.3, p. 10; §5.2 and footnote 7, p. 12","measure":"computation","member":null,"note":"As unlabeled, six per item, plus a PRG call per item that stretches the second part of its OPRF value into a pad as long as its label","operation":"symmetric_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","formula":"\\( (2.4\\epsilon n_Y+d+\\lambda+2)\\kappa \\)","id":"COST-97A4757B04A02B","includes":null,"locator":"Figure 4, step 4, p. 36; Figure 10, step 4, p. 39; §2, PaXoS details, p. 10","measure":"communication","member":null,"note":"The OPRF's PaXoS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","formula":"\\( 2k(1.2n+s)/\\kappa \\)","id":"COST-97D4A64F0F4426","includes":null,"locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16","measure":"computation","member":null,"note":"Both seeds of each OT expanded to a column of \\( 1.2n+s \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2016-KKRT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( (4\\ell+1)(3t+4) \\)","id":"COST-98057A754EE243","includes":null,"locator":"Figure 10, steps 3c–3e, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"TAHE, per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","formula":"\\( 12n \\)","id":"COST-98F545A6036D90","includes":null,"locator":"Protocol 9, steps 1–2, p. 17; Protocol 7, step 2, p. 16; Construction 4, p. 14","measure":"computation","member":null,"note":"Its items' two bin positions, then five calls per BaRK-OPRF value at each of its \\( 2n \\) bin entries to program the hints","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( 2(M+1)n_X \\)","id":"COST-99C44D78C8EB80","includes":null,"locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-8; §4.4, p. 9","measure":"computation","member":null,"note":"Per item and each of its two bins, \\( M \\) short exponentiations by Horner's rule and one full-length one by \\( r \\)","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-9A7EB476AAFB32","includes":null,"locator":"Figure 8, step 1, p. 25; Figure 2, step 7, p. 14","measure":"communication","member":null,"note":"As in the semi-honest-sender protocol","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","formula":"\\( 2n_X|\\mathbb{Z}_N| \\)","id":"COST-9AD82384CB7FBB","includes":null,"locator":"Protocol PM-Semi-Honest, step 2, p. 6","measure":"communication","member":null,"note":"One ciphertext per item; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( \\frac{m}{k}\\left(\\frac{B}{\\alpha}-1\\right) \\)","id":"COST-9BEBCFB171B974","includes":null,"locator":"§4.3, p. 10; Figure 4, step 6a, p. 12","measure":"computation","member":null,"note":"One product per power from the square up to the partition size, shared by the partitions","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":"An upper bound: a power the receiver sends needs no product.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( n_X + 1 \\)","id":"COST-9C0CDED305AD25","includes":null,"locator":"Figure 5, p. 24; §4, p. 15","measure":"computation","member":null,"note":"One key-agreement message and one key per item.","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( 6n_X \\)","id":"COST-9CE6910486E8D0","includes":null,"locator":"§3, pp. 5–6; §3.1, p. 12; §4.2, p. 13","measure":"computation","member":null,"note":"As unlabeled, five per item, plus one symmetric encryption of each label under a key taken from the extended OPRF value","operation":"symmetric_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","formula":"\\( (n_Y+1)n_X \\)","id":"COST-9DBE3F584A606B","includes":null,"locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7; §5.1, p. 11","measure":"computation","member":null,"note":"Homomorphic additions, per item: \\( n_Y \\) in Horner's rule, the last adding the known constant term, and one adding the encrypted item","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":null,"id":"COST-9DDFF0FECFC07A","includes":null,"locator":"Figure 1, step 1, p. 5; §2.3, p. 4; §5.2, p. 11; Table 2, p. 13","measure":"communication","member":null,"note":"Its public and evaluation keys, which the flooding and the products need; the protocol has no key step and sizes neither","operation":null,"per":"client","phase":"setup","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( n_Y + 1 \\)","id":"COST-9E87B13E5F976F","includes":null,"locator":"Figure 2, Round 2 and Output, p. 6","measure":"computation","member":null,"note":"Encrypts each value, then decrypts the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( 2n_X \\)","id":"COST-9E9FF940481776","includes":null,"locator":"Figure 5, step 5, p. 24; §3.2, p. 8","measure":"computation","member":null,"note":"Per item, the permutation and the hash of the Diffie-Hellman key","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","formula":"\\( 1.28n_Y+O(n_X) \\)","id":"COST-9F76CF3DDE9C12","includes":null,"locator":"Figure 9, steps 3–4, p. 23; Figure 1, p. 7; §4, p. 22; §2, Field row, p. 8","measure":"computation","member":null,"note":"One product per OKVS position for \\( B' = B + A'\\Delta \\); per item \\( \\Delta H_B(y) \\) and the decode's products with the field-valued dense columns","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","formula":"\\( \\sigma n_Y\\kappa \\)","id":"COST-9F9D5E0EDE4B95","includes":null,"locator":"Figure 1, Online Phase, p. 9","measure":"communication","member":null,"note":"One masked wire label per input bit.","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-A0EA5CCAD9C188","includes":null,"locator":"§5.3, p. 18","measure":"communication","member":null,"note":"As unlabeled; label length does not change the query","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","formula":"\\( O(n_Y^2) \\)","id":"COST-A12A711D9FE801","includes":null,"locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §5.1, p. 11","measure":"computation","member":null,"note":"Coefficients of the polynomial from its roots, scaled so the constant term is one; the paper does not fix the method","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","formula":"\\( 3e(\\lambda+\\log_2(\\epsilon n_Y))n_X+2\\kappa \\)","id":"COST-A1DD82DFBB185D","includes":null,"locator":"RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; RS21 Figure 4, steps 1 and 5, p. 36; §4, p. 23; Figure 1, step 5, p. 7","measure":"communication","member":null,"note":"The OPPRF table, this paper's doubly oblivious OKVS over its items in their three bins, and the coin toss's commitment and opening","operation":null,"per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( O(m\\alpha B^{2}) \\)","id":"COST-A2509E111E1FCA","includes":null,"locator":"§5.1–5.2, p. 12; Figure 8, step 1a, p. 25","measure":"computation","member":null,"note":"Interpolation of the hash-valued label polynomials, \\( O(B^2) \\) in the split size \\( B \\); symmetric polynomials are skipped","operation":"field_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","formula":"\\( O(nm) \\)","id":"COST-A2E13CF539BEB1","includes":null,"locator":"§4.3, p. 18; §7.2, pp. 23-24","measure":"computation","member":null,"note":"P2 interpolates one hint polynomial of degree at most \\( m \\) per mega-bin by Lagrange, \\( O(Bm^2) \\) for \\( B = O(n/m) \\) mega-bins","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","formula":"\\( (\\ell+2)n \\)","id":"COST-A30B33EB290075","includes":null,"locator":"Figure 5, steps 1 and 2(b), p. 39; Figure 3, step 2, p. 22","measure":"computation","member":null,"note":"Per item its zero-share, one PRF call per other party, its OPRF value, \\( H_1 \\) and \\( H_2 \\), and H; the OKVS's own hashing is left open","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( 7n_X \\)","id":"COST-A353C91110B22D","includes":null,"locator":"Figure 8, step 1a, p. 25; Figure 1, steps 1–2, p. 13; §4.3, p. 10","measure":"computation","member":null,"note":"As in the semi-honest-sender protocol, six per item, plus hashing each item into its label","operation":"symmetric_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","formula":"\\( n(\\mu+1) \\)","id":"COST-A36DDF2BBED15D","includes":null,"locator":"Figure 4, steps 2b and 4b, p. 12; §6.1, p. 11; §4, p. 6","measure":"computation","member":null,"note":"One phasing hash per item, then one output hash per sender encoding, \\( \\mu \\) per item","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","formula":"\\( O(nm) + 4.8n(2s-1) \\)","id":"COST-A47C3AB4974242","includes":null,"locator":"§4.3, p. 18; §7.2, p. 23; Protocol 10, step 2, p. 20","measure":"computation","member":null,"note":"Interpolates the first-phase hints by Lagrange, then evaluates P1's hint, of degree \\( 2s-1 \\), in each of its bins by Horner","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( (2n_Y+3)|\\mathbb{Z}_N| \\)","id":"COST-A48BC62378966D","includes":null,"locator":"Protocol PM-Malicious-Server, step 1, p. 12","measure":"communication","member":null,"note":"Her public key and the encrypted coefficients of one degree-\\( n_Y \\) polynomial","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( L(M+1)n_X \\)","id":"COST-A4CB539643D7A7","includes":null,"locator":"Protocol PM-Malicious-Client, step 4, p. 10; §4.2, pp. 6-7","measure":"computation","member":null,"note":"Homomorphic additions, per answer: \\( M \\) in Horner's rule and one adding the encrypted share","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","formula":"\\( 2.4\\epsilon n_Y+d+\\lambda+3n_X \\)","id":"COST-A4F0E814A78C51","includes":null,"locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 1, p. 7","measure":"computation","member":null,"note":"One product per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per entry of its three-bin table; the XoPaXoS encoding is additions","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( (n_Y+1)n_X \\)","id":"COST-A53A7298435F5D","includes":null,"locator":"Protocol PM-Malicious-Server, step 2(b), p. 12; §4.2, pp. 6-7","measure":"computation","member":null,"note":"Homomorphic additions, per item: \\( n_Y \\) in Horner's rule and one adding the encrypted seed","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( n(6t+7) + O(t^{3}) \\)","id":"COST-A55C921D3FE22A","includes":null,"locator":"Figure 6, step 3, p. 22; Figure 9, steps 3–4, p. 30","measure":"computation","member":null,"note":"Its set polynomial at \\( 2t+2 \\), then a randomized one at \\( 3t+4 \\) points, each item tested as a root; random terms and interpolation in \\( O(t^{3}) \\)","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( 18n_Y \\)","id":"COST-A5A2B3704CEDB8","includes":null,"locator":"Figure 3, step 6, p. 10","measure":"computation","member":null,"note":"Per item three bin hashes and the OPRF at its three candidate bins, five calls each as KKRT counts them","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","formula":"\\( n_X/L + n_Xv \\)","id":"COST-A615E5A7F31E4D","includes":null,"locator":"§4.1, p. 6; Figure 1, Setup Phase, p. 9","measure":"communication","member":null,"note":"Compressed filter: a bitmap of the table and one tag per item.","operation":null,"per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","formula":"\\( |\\mathbb{F}| + (3t/2+1)\\log p \\)","id":"COST-A66F074E5AC2D2","includes":null,"locator":"Figure 7, p. 9; Corollary 3, p. 10; GS19 Figure 10, step 6, p. 17","measure":"communication","member":null,"note":"Bob's share of the test's result, then his masked evaluations at half the threshold","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( 2\\frac{m}{k}(B+\\alpha) \\)","id":"COST-A6C7DEFDC2F3D2","includes":null,"locator":"Figure 4, step 6b, p. 12; §5.2, p. 11","measure":"computation","member":null,"note":"\\( B/\\alpha+1 \\) plaintext products and \\( B/\\alpha \\) additions per partition and batch, then adding the encryption of zero that floods the reply","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( n_Y|\\mathbb{Z}_N| \\)","id":"COST-A6DB5573BF244D","includes":null,"locator":"Figure 4, step 3, p. 9","measure":"communication","member":null,"note":"One blinded hash per item","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","formula":"\\( 2.54n(m-1) \\)","id":"COST-A7857033C9AB7A","includes":null,"locator":"Construction 4, p. 14; Protocol 7, step 3, p. 16; §5.2, p. 20","measure":"computation","member":null,"note":"Evaluates its mega-bin's hint polynomial by Horner in each of its bins, \\( m-1 \\) multiplications each","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","formula":"\\( 18n_X+1 \\)","id":"COST-A80CC5C12848B5","includes":null,"locator":"Figure 10, steps 2–3, p. 39; Figure 8, step 2, p. 38; Figure 4, step 1 and the sender's evaluation, p. 36; §7.2, p. 30","measure":"computation","member":null,"note":"Simple hashing with three functions, then per table entry row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X+2\\kappa \\)","id":"COST-A82E85DC6D55E9","includes":null,"locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37","measure":"communication","member":null,"note":"The OPRF values of its items, and the coin toss's commitment and opening, one field element each","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","formula":"\\( (n_Y+2)\\kappa \\)","id":"COST-A8EEE6C88FD365","includes":null,"locator":"Figure 4, step 4, p. 36; §2, The Vandermonde OKVS, p. 8","measure":"communication","member":null,"note":"The polynomial masked by its VOLE share, one field element per coefficient, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( (s+\\alpha)\\frac{m}{k} \\)","id":"COST-A90EED452C8B39","includes":null,"locator":"§3, p. 6; §3.1, p. 7","measure":"computation","member":null,"note":"BFV encryptions of the source powers and decryptions of the results","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","formula":"\\( 0 \\)","id":"COST-A92E5A668C0668","includes":null,"locator":"Figure 5, steps 1–2, p. 39","measure":"communication","member":null,"note":"Sends only inside the OPRFs; first in the order, it sends no zero-sharing key","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( 2n_Y \\)","id":"COST-AA60274102CD25","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( 7n_Y \\)","id":"COST-AA828898946540","includes":null,"locator":"Figure 8, steps 1 and 3, p. 25; Figure 2, steps 7a–7b, p. 14; §4.3, p. 10","measure":"computation","member":null,"note":"As in the semi-honest-sender protocol, six per item, plus hashing each item to compare with its decrypted label result; cuckoo re-insertions add more","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","formula":"\\( 5n_Y \\)","id":"COST-AA8CEE498B20DE","includes":null,"locator":"Figure 3, steps 1 and 4, p. 11; Figure 6, p. 19","measure":"computation","member":null,"note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( 2n_Y \\)","id":"COST-AB033E55EDEF9F","includes":null,"locator":"Figure 3, inputs and step 5, p. 8","measure":"computation","member":null,"note":"Hashing each item, then one tag hash per item","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":"\\( 3t+4 \\)","id":"COST-ABA3D27918F6A0","includes":null,"locator":"§7.1, p. 29; §2.6, p. 10","measure":"computation","member":null,"note":"His own term \\( p^B(x)R^B_2(x) \\) at each point, encrypted afresh, which also refreshes the reply","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( O\\left(\\frac{m}{k}\\sqrt{B}\\right) \\)","id":"COST-ABB648F8F00C8A","includes":null,"locator":"§3.1, pp. 8 and 11–12","measure":"computation","member":null,"note":"Paterson–Stockmeyer per batch; depth-free Frobenius operations replace many of the power products","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","formula":"\\( n(\\ell-1) \\)","id":"COST-ABC4C8FEEF6C77","includes":null,"locator":"§7, step 2, p. 16","measure":"computation","member":null,"note":"Encrypting each item's share for each client, under that client's key","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( 2n_Y+2 \\)","id":"COST-AC9FD93408ABCB","includes":null,"locator":"Figure 3, steps 1 and 5, p. 8; Table 2, p. 11","measure":"computation","member":null,"note":"Blinding and unblinding; the paper states \\( O(n_Y) \\) exponentiations with 160-bit exponents","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( O(n\\log^2 n) \\)","id":"COST-AD9804B367CABD","includes":null,"locator":"Figure 5, step 4, p. 24; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","member":null,"note":"Interpolation of the polynomial through its points, by the fast algorithms the paper uses","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( n_X + 1 \\)","id":"COST-AE0D82DBB0BD22","includes":null,"locator":"§4, p. 15","measure":"computation","member":null,"note":"One key-agreement message and one key per item.","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( |\\mathbb{G}| + (\\lambda + \\log(n_Xn_Y))n_X \\)","id":"COST-AE904468E7592E","includes":null,"locator":"Table 1, p. 4; Figure 6, p. 26","measure":"communication","member":null,"note":"One key-agreement message and one short key per item.","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","formula":"\\( 0 \\)","id":"COST-AF0534EC1E9131","includes":null,"locator":"Figure 3, steps 1–2, p. 11","measure":"communication","member":null,"note":"Sends nothing outside the OOS run, whose choice strings are its table","operation":null,"per":null,"phase":null,"source":"PSI-PAPER-2020-PRTY","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","formula":"\\( 0 \\)","id":"COST-AF1FF6F9858BAE","includes":null,"locator":"Algorithm 1, p. 5; §4, p. 5","measure":"computation","member":null,"note":"No cryptographic operation outside evaluating the circuits and the OTs","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-AF5549D9F36BC0","includes":null,"locator":"§4.3, p. 10; §3.1, p. 7; Figure 2, step 7, p. 14; §8.1, p. 18","measure":"communication","member":null,"note":"Blinded OPRF queries, then window powers per batch; symmetric-key BFV nearly halves fresh ciphertexts in the implementation","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","formula":"\\( 2s(\\lambda+\\log(2.4n)) \\)","id":"COST-B1C3A0C4A3A602","includes":null,"locator":"Protocol 10, step 2, p. 20; Construction 4, p. 14; Protocol 7, step 2, p. 16","measure":"communication","member":null,"note":"P1's second-phase hint: one polynomial through two points per stash slot, with \\( \\gamma \\)-bit coefficients","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","formula":"\\( 2n \\)","id":"COST-B1D9DB5AFA9067","includes":null,"locator":"Protocol 9, step 1, p. 17","measure":"computation","member":null,"note":"Its items' two Cuckoo positions, each computed once","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","formula":"\\( \\kappa n_X+2\\kappa \\)","id":"COST-B30593ECC98D38","includes":null,"locator":"RS21 Figure 4, steps 1 and 5, p. 36; RS21 Figure 6, step 3, p. 37; §4, p. 23","measure":"communication","member":null,"note":"OPRF values of \\( \\kappa \\) bits, and the coin toss's commitment and opening","operation":null,"per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( O(mB^{2}/\\alpha) \\)","id":"COST-B3E485D16EEF70","includes":null,"locator":"§3, p. 6; §4.2, p. 13","measure":"computation","member":null,"note":"Coefficients of each partition's intersection polynomial over prime-field slots","operation":"field_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( 4n_X|\\mathbb{Z}_N| \\)","id":"COST-B41129BFB77155","includes":null,"locator":"§4.2, p. 7; §4.4, p. 9","measure":"communication","member":null,"note":"One ciphertext per candidate bin of each item, now encrypting a fixed string; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( \\eta + (3t+4)(2\\gamma+\\delta) \\)","id":"COST-B41A8C3F966D0F","includes":null,"locator":"Figure 9, step 2, p. 30; Figure 8, p. 27; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"communication","member":null,"note":"Nothing in the test outside the MPC; then its TAHE key component and per point its encrypted random term, its noisy term and a partial decryption","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( n_X \\)","id":"COST-B57B4667B308B4","includes":null,"locator":"Figure 1, step 1, p. 13","measure":"computation","member":null,"note":"OPRF on its own set, reusable with many receivers","operation":"exponentiation","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","formula":"\\( n_X+n_Y \\)","id":"COST-B5D81959116367","includes":null,"locator":"Protocol PM-Semi-Honest, steps 1 and 3, p. 6","measure":"computation","member":null,"note":"Encrypting the coefficients and decrypting the replies","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","formula":"\\( O(nt+t^{3}) \\)","id":"COST-B71CB55953C816","includes":null,"locator":"Figure 7, step 7, p. 9; Figure 8, step 4, p. 10; GS19 Figure 7, steps 3–7, p. 13","measure":"computation","member":null,"note":"Evaluates its polynomials at the points, interpolates and tests roots; the sums of its shares are additions","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( 2n_Y \\)","id":"COST-B72AAE6BC5B9FF","includes":null,"locator":"§4.3, p. 10","measure":"computation","member":null,"note":"Blinding and unblinding each OPRF query","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":null,"id":"COST-B746D7E76444C3","includes":null,"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","member":null,"note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","operation":null,"per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( (4\\ell+1)(3t+4) \\)","id":"COST-B80154FCC2AC9D","includes":null,"locator":"Figure 9, steps 3c–3e, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"TAHE, per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","formula":"\\( \\gamma_{\\mathrm{pk}} \\)","id":"COST-B83284041DEC96","includes":null,"locator":"Figure 6, Preparation, p. 9","measure":"communication","member":null,"note":"Alice's public key; her key generation has no unit of the topic","operation":null,"per":null,"phase":"setup","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","formula":"\\( (\\ell-1)|\\mathbb{F}| \\)","id":"COST-B8D470AD569543","includes":null,"locator":"Figure 5, step 1, p. 39","measure":"communication","member":null,"note":"Zero-sharing keys drawn from \\( \\mathbb{F} \\), one to each party before it in the order","operation":null,"per":null,"phase":"setup","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","tip":"The last client's, the largest: the client \\( P_i \\) sends \\( i \\) keys, so the first sends one.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( 2n_Y \\)","id":"COST-B9BC8460F2C00D","includes":null,"locator":"Figure 6, p. 26; §3.2, p. 9","measure":"computation","member":null,"note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( (s+1)\\frac{m}{k} \\)","id":"COST-BAD129D1FAD92D","includes":null,"locator":"§3.1, p. 11","measure":"computation","member":null,"note":"BGV encryptions of the source powers and decryptions of the results","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","formula":"\\( 0 \\)","id":"COST-BAE237F7B857E0","includes":null,"locator":"Protocol 3, p. 22; §5, Efficiency, p. 23","measure":"communication","member":null,"note":"P2 sends only the correction matrix of the random OTs","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","id":"COST-BAF5F5609B298C","includes":null,"locator":"Figure 5, p. 11; Figure 7, p. 13; §1.2, p. 4","measure":"computation","member":null,"note":"Hankel entries (one power per item, exponent up to \\( p \\)), set-polynomial evaluations, rational interpolation by Gaussian elimination","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( 6n_Y \\)","id":"COST-BB2D0E3DD1238E","includes":null,"locator":"Figure 2, steps 7a–7b, p. 14; §4.3, p. 10","measure":"computation","member":null,"note":"Per item: the OPRF hash to the group and output hash, the hash to short strings, and the three cuckoo hash functions; re-insertions, unbounded, add more","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( \\sigma n_X \\)","id":"COST-BBD0E4658B3DF6","includes":null,"locator":"Figure 2, p. 10","measure":"computation","member":null,"note":"The exponent product of the PRF key, at most one multiplication per input bit.","operation":"modmul","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","formula":"\\( en_Y+O(n_X) \\)","id":"COST-BD3C02FFC4C094","includes":null,"locator":"RS21 Figure 4, step 4 and the sender's evaluation, p. 36; §4, p. 23; Figure 1, p. 7; §2, Field row, p. 8","measure":"computation","member":null,"note":"One product per OKVS position for \\( K = B + A\\Delta \\); per item \\( \\Delta H_F(y) \\) and the decode's products with the field-valued dense columns","operation":"field_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","formula":"\\( (en_Y+2)\\kappa \\)","id":"COST-BD8FD788F082E1","includes":null,"locator":"RS21 Figure 4, step 4, p. 36; §4, p. 23; Figure 1, p. 7","measure":"communication","member":null,"note":"This paper's OKVS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","operation":null,"per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","formula":"\\( 5n_X \\)","id":"COST-BDC5B4B55FAAB0","includes":null,"locator":"Figure 3, step 3, p. 11; Figure 7, Decode, p. 30","measure":"computation","member":null,"note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( (\\lfloor \\log_p B \\rfloor + 1)K \\)","id":"COST-BE742FDFA843C1","includes":null,"locator":"§3.1, p. 12; §2.3, p. 5; Table 8, p. 27","measure":"communication","member":null,"note":"Frobenius keys and the relinearization key, independent of the receiver set and cacheable; one Frobenius key suffices at extra cost","operation":null,"per":"client","phase":"setup","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( n \\)","id":"COST-BE85C653176C2B","includes":null,"locator":"Figure 8, step 1d, p. 27","measure":"computation","member":null,"note":"The power \\( u^{a} \\) of the test point for each of its items, in the field of the test","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X \\)","id":"COST-BFC04E6101A9A8","includes":null,"locator":"Figure 9, step 4 and parameters, p. 23; §4, p. 22","measure":"communication","member":null,"note":"The OPRF values of the sender's items","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","formula":"\\( (\\min(t_c+1,\\ell-1)+1)(T(\\lambda+\\log n)+B\\kappa) \\)","id":"COST-C0B81B575E6CA4","includes":null,"locator":"Figure 8, steps 2 and 4, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §5.3, Generalization, p. 13; §7.1, TABLE, p. 17","measure":"communication","member":null,"note":"A sharing hint to each party it deals to and a reconstruction hint to the leader, each a table of \\( (\\lambda+\\log n) \\)-bit entries and a nonce per bin","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( \\alpha\\frac{m}{k}(2B+1) \\)","id":"COST-C0BBAC03B9D21F","includes":null,"locator":"Figure 8, step 2, p. 25; Figure 2, step 8b, p. 14","measure":"computation","member":null,"note":"The label polynomials' dot products only: \\( B+1 \\) plaintext products and \\( B \\) additions per subset and batch","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","formula":"\\( 0 \\)","id":"COST-C0E5CB5CE5882D","includes":null,"locator":"§2, p. 4; §3, p. 4","measure":"communication","member":null,"note":"Sends only inside the OT extension","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( n_X+1 \\)","id":"COST-C17E44A204834E","includes":null,"locator":"§5.5, p. 8; Table 2, p. 11","measure":"computation","member":null,"note":"Precomputing each hashed item to the power of minus its fresh secret, and its key share; short exponents","operation":"exponentiation","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":null,"id":"COST-C34D609293A049","includes":null,"locator":"Figure 5, step 4, p. 18","measure":"computation","member":null,"note":"The TFHE evaluation of the quotients, a rational interpolation from \\( 2t+3 \\) points and the test at z; the paper gives no circuit","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( 4n_X \\)","id":"COST-C3516B1A9A124C","includes":null,"locator":"Figure 4, step 5, p. 11; §3.2, p. 8","measure":"computation","member":null,"note":"Per item: the first random oracle, the permutation, the hash of the Diffie-Hellman key, then the second random oracle","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","formula":"\\( 2.4\\epsilon n_Y+d+\\lambda+3n_X \\)","id":"COST-C362F204253256","includes":null,"locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 1, p. 7","measure":"computation","member":null,"note":"One product per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per entry of its three-bin table; the XoPaXoS encoding is additions","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","id":"COST-C37FCCCC305A58","includes":null,"locator":"Appendix A, steps 2 and 4, p. 85","measure":"communication","member":null,"note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-1999-HFH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","formula":"\\( 2n_Y \\)","id":"COST-C3978D85E581C3","includes":null,"locator":"§4, p. 15; §3.2, p. 9","measure":"computation","member":null,"note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( \\alpha\\frac{m}{k}(2B+1) \\)","id":"COST-C39B2351B5CF31","includes":null,"locator":"Figure 2, step 8b, p. 14; §4.2, p. 9","measure":"computation","member":null,"note":"\\( B+1 \\) plaintext products and \\( B \\) additions per subset and batch; the OPRF removes the flooding","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( \\left(s+(1+c)\\alpha\\right)\\frac{m}{k} \\)","id":"COST-C3C24D9518152A","includes":null,"locator":"§4.2, p. 14","measure":"computation","member":null,"note":"BFV encryptions of the source powers and decryptions of all results","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","formula":"\\( \\lambda n \\)","id":"COST-C3CD7CC7929A25","includes":null,"locator":"Figure 7, step 3, p. 9; footnote 4, p. 3","measure":"computation","member":null,"note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","formula":"\\( n_Y \\)","id":"COST-C3D3E2E46FFA1A","includes":null,"locator":"§4.3, p. 10","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","formula":"\\( 12n \\)","id":"COST-C419D5A216A7A7","includes":null,"locator":"Protocol 9, steps 1–2, p. 17; Protocol 7, step 2, p. 16; Protocol 10, p. 20","measure":"computation","member":null,"note":"Its items' two bin positions, then five calls per BaRK-OPRF value at each of its \\( 2n \\) first-phase bin entries","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( n(6t+9) + O(t^{3}) \\)","id":"COST-C4A235AE986C68","includes":null,"locator":"Figure 5, step 3, p. 18; Figure 10, steps 3–4, p. 41","measure":"computation","member":null,"note":"Its randomized polynomial at \\( 2t+4 \\), then a new one at \\( 3t+4 \\) points, each item tested as a root; random terms and interpolation in \\( O(t^{3}) \\)","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","formula":"\\( k(1.2n+s)+\\hat{n}\\sigma \\)","id":"COST-C544F0A07844F5","includes":null,"locator":"Figure 2, steps 2–3, p. 10; Figure 3, steps 1, 3 and 6, p. 13; §6.3, p. 16","measure":"communication","member":null,"note":"Bob's matrix, one masked column of \\( 1.2n+s \\) bits per OT, then the intersection; the seeds of the hash functions are not sized","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2016-KKRT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","formula":"\\( 2n + 10s \\)","id":"COST-C5E96E6D139B68","includes":null,"locator":"Protocol 9, step 1, p. 17; Protocol 10, step 2, p. 20; Protocol 7, step 2, p. 16","measure":"computation","member":null,"note":"Its items' two Cuckoo positions, then five calls per BaRK-OPRF value at the two bins of each stash slot","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","formula":"\\( 5n_Y \\)","id":"COST-C65C953D60AD96","includes":null,"locator":"Figure 3, steps 1 and 4, p. 11; Figure 7, p. 30","measure":"computation","member":null,"note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","formula":null,"id":"COST-C6FC8D9AED6EDC","includes":null,"locator":"Figure 3, step 2, p. 22","measure":"computation","member":null,"note":"One multiplication by s per item, plus those of decoding Q, which depend on the linear OKVS chosen","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","tip":null,"value":"conditional"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( n(6t+7) + O(t^{3}) \\)","id":"COST-C70121C643C91E","includes":null,"locator":"Figure 6, step 3, p. 22; Figure 9, steps 3–4, p. 30","measure":"computation","member":null,"note":"As a client, for its own set; the cardinality test it evaluates under TFHE","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( n_X \\)","id":"COST-C8018AD9B41C2F","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( (n_Y+1)\\min(n_X,n_Y) \\)","id":"COST-C821194097B88F","includes":null,"locator":"Protocol PM-Malicious-Server, step 3(b), p. 12","measure":"computation","member":null,"note":"Re-running the server's derandomized evaluation for each reply whose hash matches one of her items, counted for the largest possible intersection","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","formula":"\\( (\\ell+5)(3t+4) + 2t + 4 \\)","id":"COST-C83C24F633B8DB","includes":null,"locator":"Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b–3g, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","member":null,"note":"TFHE: \\( 2t+2 \\) encryptions, a partial decryption, the combination; TAHE, per point: two encryptions, \\( \\ell+1 \\) refreshes, a share, the combination","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( \\alpha\\frac{m}{k}(2L_\\alpha H_\\alpha-1) \\)","id":"COST-C87B9F8858B954","includes":null,"locator":"§3.1, p. 8","measure":"computation","member":null,"note":"A plaintext product per coefficient in the inner sums, and the additions of the inner and outer sums, per partition and batch","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","formula":"\\( n_X \\)","id":"COST-C8B840019E4872","includes":null,"locator":"Figure 1, step 1, p. 13; §4.3, p. 10","measure":"computation","member":null,"note":"OPRF on its own set, reusable with many receivers","operation":"exponentiation","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","formula":"\\( (3+s)n(\\lambda+2\\log n) \\)","id":"COST-C91A475AA06F63","includes":null,"locator":"Figure 3, step 4, p. 13; §5.2, p. 12; §6.1, p. 16","measure":"communication","member":null,"note":"Alice's permuted PRF values, \\( v=\\lambda+2\\log n \\) bits each, for every item and hash function or stash position","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2016-KKRT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","formula":"\\( 4n_Y+1 \\)","id":"COST-C9B67CC4FCFA74","includes":null,"locator":"RS21 Figure 4, steps 2, 5 and 6, p. 36; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Per item the two row functions, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( (n_X + n_Y)|\\mathbb{G}| + 2n_Y|\\mathcal{R}_q| \\)","id":"COST-C9D6E48FB59594","includes":null,"locator":"Figure 2, Round 2, p. 6","measure":"communication","member":null,"note":"P1's set exponentiated again, then its own items with their encrypted values, before slotting","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( O(mB^{2}/\\alpha) \\)","id":"COST-CA96B7B19359C6","includes":null,"locator":"Figure 4, step 4, p. 12; §6.1, p. 14","measure":"computation","member":null,"note":"Coefficients of each partition's bin polynomial, then batching; fresh hash functions make it per run","operation":"field_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","formula":"\\( 3n_Y \\)","id":"COST-CB6EB64C568869","includes":null,"locator":"§3.4, p. 6; Figure 1, Online Phase, p. 9","measure":"computation","member":null,"note":"Filter lookup: the tag hash and both bucket hashes per item","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( (\\ell-1)(\\ell\\eta + |\\mathbb{F}| + (3t+4)(2\\gamma+\\log p)) \\)","id":"COST-CB92813C88FABA","includes":null,"locator":"Figure 9, step 2, p. 30; Figure 8, step 1a, p. 27; Figure 9, steps 3c, 3e and 3g, p. 30","measure":"communication","member":null,"note":"To each other party: the point u, in the field of the test; then the joint TAHE key and per point three values","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( O((1+c)mB^{2}/\\alpha) \\)","id":"COST-CBE881256C70DD","includes":null,"locator":"§4.2, p. 13; §3, p. 6","measure":"computation","member":null,"note":"Each partition's intersection polynomial and an interpolation per label fragment, \\( O(B^2) \\) in the partition size \\( B \\); updatable","operation":"field_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","formula":"\\( 2\\kappa n_X \\)","id":"COST-CC9D8F9E036A96","includes":null,"locator":"Figure 3, step 3, p. 11; §4.4, p. 15","measure":"communication","member":null,"note":"One \\( H_2 \\) output per item, at the \\( 2\\kappa \\) bits recommended against a malicious sender","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","formula":"\\( 0 \\)","id":"COST-CCDD6CE597958A","includes":null,"locator":"Figure 3, p. 22","measure":"communication","member":null,"note":"Sends nothing outside the vOLE, whose input is its OKVS; no error-correcting code is sent","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( 2n_Y \\)","id":"COST-CCFDD612E078A0","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( 2n_X + \\rho \\)","id":"COST-CD25793FA1E092","includes":null,"locator":"§3.4, pp. 5–6; Figure 2, Setup Phase, p. 10","measure":"computation","member":null,"note":"Filter insertion: a tag hash and a bucket hash per item, then one hash per alternate bucket","operation":"symmetric_op","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( |\\mathbb{Z}_N| \\)","id":"COST-CDADD1FFFEDB73","includes":null,"locator":"Figure 2, Setup, p. 6","measure":"communication","member":null,"note":"Its Paillier public key, the modulus","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","formula":"\\( 2^{\\sigma}\\kappa \\)","id":"COST-CE1CD0F49E3449","includes":null,"locator":"§2, p. 4; §3, p. 4","measure":"communication","member":null,"note":"The generator's input labels, one per bit of its vector","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","formula":"\\( O(n_Y) \\)","id":"COST-CEA3471690D447","includes":null,"locator":"Figure 9, steps 1, 3 and 5, p. 23; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","member":null,"note":"Products with the field-valued dense columns: their powers, the gap's elimination and back-substitution in encoding, and the decodes at its items","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","formula":"\\( 4n_X \\)","id":"COST-CFC0EEA4416352","includes":null,"locator":"Figure 9, step 4, p. 23; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Per item the two row functions, \\( H_B \\) and \\( H_o \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","formula":"\\( n_Y|\\mathbb{G}| + (1+c)\\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-CFCDC6D6A41D35","includes":null,"locator":"§4.2, p. 14; §5.3, p. 18","measure":"communication","member":null,"note":"Intersection results plus one result per item-length label fragment","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( n_X \\)","id":"COST-CFEC3386799812","includes":null,"locator":"Figure 2, Round 1, p. 6","measure":"computation","member":null,"note":"Hashes each item to the group","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","formula":"\\( (m+\\ell-3)\\kappa \\)","id":"COST-D026DBC14BDF05","includes":null,"locator":"Protocol 3.3, steps 1–3, p. 8; §3.2.2, p. 8","measure":"communication","member":null,"note":"The first client: a \\( \\kappa \\)-bit PRF key to each other client, and its OKVS under all keys to the leader","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","tip":"The first client's, the largest: it deals the keys; every other client sends one OKVS of \\( m\\kappa \\) bits to the pivot and makes \\( 2n \\) sym ops.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","formula":"\\( \\lambda n \\)","id":"COST-D0663B79AA6C05","includes":null,"locator":"Figure 7, step 2, p. 9; footnote 4, p. 3","measure":"computation","member":null,"note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( 4n_Y \\)","id":"COST-D0FAD12719CEB2","includes":null,"locator":"Figure 4, step 1, p. 12; Figure 2, step 2, p. 8","measure":"computation","member":null,"note":"Per item: the hash to a shorter string when items are long, then one location hash per cuckoo hash function; re-insertions, which go unbounded, add more","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","formula":"\\( O(n_Y) \\)","id":"COST-D10D8982BEC1F2","includes":null,"locator":"Figure 9, steps 1, 3 and 5, p. 23; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","member":null,"note":"Products with the field-valued dense columns: their powers, the gap's elimination and back-substitution in encoding, and the decodes at its items","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( n_Y \\)","id":"COST-D163AF4F52CD9C","includes":null,"locator":"§4.3, p. 10","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( n_Y \\)","id":"COST-D16985C944941E","includes":null,"locator":"Figure 2, Round 3, p. 6; §5, p. 11","measure":"computation","member":null,"note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( (\\ell-1)(\\ell(\\eta_{\\mathrm{FHE}} + \\eta) + \\log p + \\gamma_{\\mathrm{FHE}} + 1 + (3t+4)(2\\gamma+\\log p)) \\)","id":"COST-D24306DF52BCAF","includes":null,"locator":"Figure 5, step 1, p. 18; Figure 5, steps 2 and 5, p. 18; Figure 10, steps 3c, 3e and 3g, p. 41","measure":"communication","member":null,"note":"To each other party: the joint TFHE key, z, the encrypted predicate and its bit; then the joint TAHE key and per point three values","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( n_Y \\)","id":"COST-D2DEB7B322C20C","includes":null,"locator":"§3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( n_X \\)","id":"COST-D3FA37CCD4E087","includes":null,"locator":"Figure 3, step 3, p. 8; §5.5, p. 8","measure":"computation","member":null,"note":"One multiplication per tag, the exponentiated blinded product times the precomputed item power","operation":"modmul","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","formula":"\\( 0 \\)","id":"COST-D40AED2BCF9F8E","includes":null,"locator":"Figure 3, steps 1–2, p. 11","measure":"communication","member":null,"note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","formula":"\\( 4n_X \\)","id":"COST-D42CD685FFB369","includes":null,"locator":"Figure 9, step 4, p. 23; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Per item the two row functions, \\( H_B \\) and \\( H_o \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","formula":"\\( kn_Y \\)","id":"COST-D4E5B7F84366FF","includes":null,"locator":"Protocol 3, step 1b, p. 22","measure":"computation","member":null,"note":"Its \\( k \\) cuckoo hashes per item; its OPRF outputs come with the random OTs","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","formula":"\\( 2n(\\ell-1)|\\mathbb{Z}_N| \\)","id":"COST-D5544BE1A10710","includes":null,"locator":"§7, step 2, p. 16","measure":"communication","member":null,"note":"\\( n \\) permuted tuples of one ciphertext per client, posted once","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( e_{\\mathrm{pk}} \\)","id":"COST-D5A33197543499","includes":null,"locator":"Figure 4, Setup, p. 11","measure":"communication","member":null,"note":"Its public key","operation":null,"per":null,"phase":"offline","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","formula":"\\( 5n_X \\)","id":"COST-D5E46A4CD39231","includes":null,"locator":"Figure 3, step 3, p. 11; Figure 6, Decode, p. 19","measure":"computation","member":null,"note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( (n_Y+1)\\min(n_X,n_Y) \\)","id":"COST-D7075C3B357EA0","includes":null,"locator":"Protocol PM-Malicious-Server, step 3(b), p. 12","measure":"computation","member":null,"note":"The homomorphic additions of each re-run evaluation","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","formula":"\\( \\min(t_c+1,\\ell-1)(T(\\lambda+\\log n)+B\\kappa)+(\\ell-1)\\hat{n}\\sigma \\)","id":"COST-D76DA197D62269","includes":null,"locator":"Figure 8, steps 2 and 5, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §5.3, Generalization, p. 13; §7.1, TABLE, p. 17","measure":"communication","member":null,"note":"A hint to each party it deals to, a table of \\( (\\lambda+\\log n) \\)-bit entries and a \\( \\kappa \\)-bit nonce per bin; then the intersection to each other party","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","formula":"\\( 9n+5s \\)","id":"COST-D816B795EB2A80","includes":null,"locator":"Figure 3, steps 2–3, p. 13; Figure 2, steps 2 and 5, p. 10; §6.3, p. 16","measure":"computation","member":null,"note":"Three cuckoo hashes per item, then four AES calls for the code and one output hash per bin and stash position","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2016-KKRT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( (1.3n_X + n_Y)e + 3n_Y u \\)","id":"COST-D83DD3A20C860A","includes":null,"locator":"Figure 3, steps 5–6, p. 10","measure":"communication","member":null,"note":"Re-masked ciphertexts per bin, then three OPRF values and one value ciphertext per item, before slotting","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","formula":"\\( n(C+\\mu(T+D)) \\)","id":"COST-D84B3AE35F94D5","includes":null,"locator":"Figure 9, step 4, p. 27; §6.4, p. 16","measure":"communication","member":null,"note":"Per item a commitment and \\( \\mu \\) tags, each with the decommitment masked by an encoding","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( \\sigma n_Y \\)","id":"COST-D8633A384D11C7","includes":null,"locator":"Figure 2, Online Phase, p. 10","measure":"communication","member":null,"note":"One correction bit per input bit.","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","formula":"\\( \\sigma n\\kappa \\)","id":"COST-D97E4EDD3EC941","includes":null,"locator":"§2, p. 4; §4, p. 5","measure":"communication","member":null,"note":"The generator's input labels, one per bit of its set, sent once for all comparisons","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( n_X \\)","id":"COST-D9A4408A2CCDFC","includes":null,"locator":"§3, p. 6; §3.1, p. 12","measure":"computation","member":null,"note":"OPRF on its own set: hash to the curve and one scalar multiplication per item; updatable","operation":"exponentiation","per":null,"phase":"setup","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","formula":"\\( (n_Y+1)|\\mathbb{G}| \\)","id":"COST-DBBB4FD90F3E31","includes":null,"locator":"Figure 3, step 2, p. 8","measure":"communication","member":null,"note":"The blinded product of hashes and one blinded value per item","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( 2n_Y e \\)","id":"COST-DCBFAB5370161C","includes":null,"locator":"Figure 4, step 5, p. 11","measure":"communication","member":null,"note":"One membership ciphertext and one value ciphertext per item, before slotting.","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","formula":"\\( \\kappa n_X+2\\kappa \\)","id":"COST-DD70971D190F75","includes":null,"locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37; §4, pp. 19–20","measure":"communication","member":null,"note":"OPRF values of \\( \\kappa \\) bits, which the paper shows suffice, and the coin toss's commitment and opening","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","formula":"\\( 0 \\)","id":"COST-DDAE2B100A8ED3","includes":null,"locator":"Protocol 3.3, steps 5–6, p. 8","measure":"communication","member":null,"note":"Sends only inside the two-party PSI","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","formula":"\\( \\frac{m}{k}(B-1) \\)","id":"COST-DEC51F359C12D0","includes":null,"locator":"Figure 2, step 8a, p. 14","measure":"computation","member":null,"note":"Powers up to the split size, computed once per batch and shared by the intersection and label polynomials","operation":"hom_mult","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","tip":"An upper bound: a power the receiver sends needs no product.","value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-DED6FB10C73199","includes":null,"locator":"§4.3–4.4, p. 10; Figure 4, step 6, p. 12","measure":"communication","member":null,"note":"One reply per partition and batch, counted at full width; modulus switching shrinks it","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( (n_X + n_Y)|\\mathbb{G}| + n_Y e \\)","id":"COST-DF231C29385E43","includes":null,"locator":"Figure 2, Round 2, p. 6","measure":"communication","member":null,"note":"P1's set exponentiated again, then its own items with their encrypted values, before slotting","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( 3n_X \\)","id":"COST-DFA93CE7CA7BB7","includes":null,"locator":"Figure 3, step 2, p. 10; Appendix A.8, p. 16","measure":"computation","member":null,"note":"Cuckoo hashing: three bin hashes per item, kept through evictions","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","formula":"\\( 4n \\)","id":"COST-DFE23A68051DD4","includes":null,"locator":"§4.1, pp. 11–12; Figure 1, p. 11","measure":"computation","member":null,"note":"Bob's four Cuckoo hashings use four distinct hash functions, the right tables mirroring the left; each position computed once","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","formula":"\\( 3(3t+4) + 2t + 5 \\)","id":"COST-E14688FFAE7432","includes":null,"locator":"Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b, 3d and 3f, p. 41","measure":"computation","member":null,"note":"Under TFHE \\( 2t+4 \\) encryptions and a partial decryption; under TAHE, per point, two encryptions and a partial decryption","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","formula":"\\( O(n_Y\\log^{2} n_Y) \\)","id":"COST-E284ECFA5686EC","includes":null,"locator":"§3, p. 8; §7.1, p. 24; Figure 6, p. 37","measure":"computation","member":null,"note":"Fast interpolation of the polynomial through its items, then multi-point evaluation of its VOLE share \\( C \\) at them","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( |\\mathbb{G}| + (\\lambda + \\log(n_Xn_Y))n_X \\)","id":"COST-E2D3383516EFA6","includes":null,"locator":"Table 1, p. 4; Figure 5, p. 24","measure":"communication","member":null,"note":"One key-agreement message and one short key per item.","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","formula":"\\( 1.28\\kappa n_Y+2\\kappa \\)","id":"COST-E35B3D54E49170","includes":null,"locator":"Figure 9, steps 1, 3 and 4, p. 23; §4, p. 22","measure":"communication","member":null,"note":"The OKVS correction, one field element per position, with the seeds \\( r \\) and \\( r' \\); the figure omits sending \\( r' \\), which the sender needs","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","formula":"\\( (\\ell-1)\\hat{n}\\sigma \\)","id":"COST-E44FA76C993C0B","includes":null,"locator":"Figure 8, step 5, p. 12; §6.1, p. 14","measure":"communication","member":null,"note":"The intersection to each client; the paper names no broadcast channel","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","formula":"\\( O(n_Y) \\)","id":"COST-E50CB169FB82EE","includes":null,"locator":"RS21 Figure 4, p. 36; RS21 Figure 8, step 3, p. 38; RS21 Figure 10, step 1, p. 39; §2, p. 6; §2, Field row, p. 8","measure":"computation","member":null,"note":"Products with the field-valued dense columns in encoding the OPRF's OKVS over its bins and in decoding it at each bin","operation":"field_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","formula":"\\( n_Y \\)","id":"COST-E539A8BBF9B577","includes":null,"locator":"Appendix A, step 2, p. 85","measure":"computation","member":null,"note":"One hash of each of its own items","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-1999-HFH","tip":null,"value":null},{"basis":"stated","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":null,"id":"COST-E5C9E2E3DD7100","includes":null,"locator":"§2.3, p. 5; §3, p. 6","measure":"communication","member":null,"note":"Evaluation keys for the key switching of every multiplication; the receiver alone holds the secret key, so it sends them once. Their size is not given","operation":null,"per":"client","phase":"setup","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":"not_reported"},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","formula":"\\( 0 \\)","id":"COST-E60A3D8E18C587","includes":null,"locator":"§2, pp. 3–4; §5, p. 6","measure":"computation","member":null,"note":"No cryptographic operation outside evaluating the circuit and the OTs; sorting its own set is done in the clear","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","formula":"\\( O(n^{2}) \\)","id":"COST-E61253A81565C3","includes":null,"locator":"§7, step 1, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(b), p. 6","measure":"computation","member":null,"note":"Coefficients of her polynomial from its roots, \\( O(n^{2}) \\) for degree \\( n \\); the paper does not fix the method","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( n_X \\)","id":"COST-E61A0E22254379","includes":null,"locator":"§4.2, p. 7","measure":"computation","member":null,"note":"The bin hash of each item, naming its two bins","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","formula":"\\( 2n_Y \\)","id":"COST-E68471AE72BF6C","includes":null,"locator":"Figure 5, steps 3 and 7, p. 24; §3.2, p. 8","measure":"computation","member":null,"note":"Per item, the inverse permutation and the hash of the Diffie-Hellman key","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( (n_Y+1)n_X \\)","id":"COST-E6EB6794957AE3","includes":null,"locator":"Protocol PM-Malicious-Server, step 2, p. 12; §4.2, pp. 6-7","measure":"computation","member":null,"note":"No bins: per item, \\( n_Y \\) short exponentiations by Horner's rule and one full-length one, all derandomized","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( n \\)","id":"COST-E77F0264C00E2C","includes":null,"locator":"Figure 8, step 1d, p. 27","measure":"computation","member":null,"note":"The power \\( u^{a} \\) of the test point for each of its items, in the field of the test","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","formula":"\\( n\\gamma + (2\\sigma+\\lambda)n\\kappa \\)","id":"COST-E7FD2AF3EF187A","includes":null,"locator":"§2, p. 4; §5.3.2, p. 8; Figure 6, step 1, p. 9","measure":"communication","member":null,"note":"Her \\( n \\) encrypted masks, and as generator one input label per bit of her set and of her \\( (\\sigma+\\lambda) \\)-bit masks","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( O(n\\log^2 n) \\)","id":"COST-E92D7E2EF9EC8D","includes":null,"locator":"Figure 6, step 5, p. 26; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","member":null,"note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","formula":"\\( O(t\\log p) \\)","id":"COST-EA5F5BFC75877A","includes":null,"locator":"§3, p. 8","measure":"communication","member":null,"note":"Exactly \\( (2t+1)C+\\log p \\) for ciphertexts of \\( C = O(\\log p) \\) bits: evaluations at the public points, and a random point in the clear","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","formula":"\\( n_X(n_Y+1) \\)","id":"COST-EA6A1A490DEBA0","includes":null,"locator":"Protocol PM-Malicious-Server, step 3, p. 12","measure":"computation","member":null,"note":"Per reply, the first random oracle on the decrypted seed and the second on each of her items, to find the one it fits","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","formula":"\\( O(n(t+\\log p)) \\)","id":"COST-EACE642DDDA1B9","includes":null,"locator":"Figure 8, step 1, p. 27; §7.1, p. 29","measure":"computation","member":null,"note":"Hankel shares, with one power per item of exponent up to \\( p \\), and its set and random polynomials at the points; it interpolates nothing","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","formula":"\\( n_X \\)","id":"COST-EB4E362525901C","includes":null,"locator":"Protocol PM-Semi-Honest, step 2(b), p. 6","measure":"computation","member":null,"note":"Encrypting each item for its answer","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( n_Y \\)","id":"COST-EB6F4830631CD7","includes":null,"locator":"Figure 2, Online Phase, p. 10","measure":"computation","member":null,"note":"One group element per client item.","operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","formula":"\\( 2.4n_Y+d+\\lambda+n_X \\)","id":"COST-EB709A67F7495D","includes":null,"locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37; Figure 1, p. 7","measure":"computation","member":null,"note":"One product \\( A_i\\Delta \\) per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per item; the binary-row decode is additions","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","formula":"\\( O(n\\log^2 n) \\)","id":"COST-EC6F6487B96F31","includes":null,"locator":"Figure 6, step 4, p. 26; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","member":null,"note":"Interpolation of the polynomial through its points and the random point at zero, by the fast algorithms the paper uses","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","formula":"\\( n_Y \\)","id":"COST-EC935B4CEB3BE9","includes":null,"locator":"§4.2, p. 7","measure":"computation","member":null,"note":"The bin hash of each item, placing it in the less loaded of its two bins","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","formula":"\\( 2\\sigma n_Y \\)","id":"COST-EFBF0E479BA006","includes":null,"locator":"Figure 2, Online Phase, p. 10","measure":"computation","member":null,"note":"A key multiple per input bit; per item the mask product and its product with the key, plus one inversion","operation":"modmul","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","formula":"\\( 4.8n(m-1) + O(s^{2}) \\)","id":"COST-EFC58CC88CE217","includes":null,"locator":"Construction 4, p. 14; Protocol 10, steps 1–2, p. 20; §7.2, p. 23","measure":"computation","member":null,"note":"Evaluates its mega-bin's hint by Horner in each first-phase bin, then interpolates its own hint by Lagrange","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","formula":"\\( 2n \\)","id":"COST-F06842B478DB42","includes":null,"locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"computation","member":null,"note":"Encrypting her \\( n \\) shares, then decrypting the \\( n \\) shuffled ciphertexts","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","formula":"\\( 1 \\)","id":"COST-F15B59E4054C5F","includes":null,"locator":"Figure 2, Round 3, p. 6; Appendix A.4, p. 16","measure":"computation","member":null,"note":"The fresh encryption of zero that refreshes the sum","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","formula":"\\( 2.6n_X \\)","id":"COST-F28EA5CEC098E6","includes":null,"locator":"Figure 3, step 5, p. 10; Appendix A.4, p. 16","measure":"computation","member":null,"note":"Per bin adds the mask, then the refresh's encryption of zero","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-F29922F75DE59B","includes":null,"locator":"§3.1, p. 7","measure":"communication","member":null,"note":"OPRF answers, then one result per partition and batch","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","formula":"\\( (7.2n_X+d+\\lambda)(\\lambda+\\log_2(\\epsilon n_Y))+2\\kappa \\)","id":"COST-F2BF40180F83F2","includes":null,"locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 4, steps 1 and 5, p. 36; Figure 1, parameters, p. 7; §6, p. 23","measure":"communication","member":null,"note":"The OPPRF table, an XoPaXoS over its items in their three bins, and the coin toss's commitment and opening; associated values add more","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","formula":"\\( n(n+1)(\\ell-1) \\)","id":"COST-F2DFB5C27192B4","includes":null,"locator":"§7, step 2, p. 16; §4.2, pp. 6–7","measure":"computation","member":null,"note":"Homomorphic additions per item and client: \\( n \\) in Horner's rule and one adding the encrypted share of the item","operation":"hom_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","formula":"\\( \\left((2^{w}-1)\\left(\\left\\lfloor \\log_2(B/\\alpha)/w \\right\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","id":"COST-F2EF2D0BF3B822","includes":null,"locator":"§2.2, p. 4; Figure 4, steps 5 and 7, p. 12","measure":"computation","member":null,"note":"FV encryptions of the window powers and decryptions of the replies","operation":"enc_dec","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2017-CLR","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","formula":"\\( O(nt+t^{3}) \\)","id":"COST-F39E098CC3BD66","includes":null,"locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","measure":"computation","member":null,"note":"Its set polynomial at the points, the division by it, rational interpolation and the roots among its items; the paper does not fix the methods","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"party","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","formula":"\\( 4n \\)","id":"COST-F3DC91A4AAD49D","includes":null,"locator":"§4.1, pp. 9–11; Figure 2, p. 12; PRTY20 Figure 3, steps 1 and 4, p. 11","measure":"computation","member":null,"note":"Per item: the hyperedge hash and \\( r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","formula":"\\( 4n_Y \\)","id":"COST-F44FE378383C9C","includes":null,"locator":"Figure 9, steps 1 and 5, p. 23; Figure 1, step 1, p. 7","measure":"computation","member":null,"note":"Per item \\( H_B \\), the two row functions and \\( H_o \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( n_X + n_Y \\)","id":"COST-F459C256A151DE","includes":null,"locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","formula":"\\( 3t+1 \\)","id":"COST-F485E0EDA44813","includes":null,"locator":"§3, p. 8","measure":"computation","member":null,"note":"Encrypts her \\( 2t+1 \\) evaluations, then decrypts the \\( t \\) coefficients of the numerator","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","formula":"\\( Ln_X+\\frac{Ln_Y(M+1)}{2\\ln\\ln n_Y} \\)","id":"COST-F48BECBD4A930D","includes":null,"locator":"Protocol PM-Malicious-Client, steps 3-4, p. 10","measure":"computation","member":null,"note":"One encrypted share per answer, and re-encrypting the opened coefficients to check them; the check of the roots is not specified","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( 0 \\)","id":"COST-F4AB4144F82334","includes":null,"locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, p. 10","measure":"communication","member":null,"note":"Sends only inside ZeroXOR, as zero-sharing party and the receiver of every OPPRF","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( n(6t+4) + O(t^{3}) \\)","id":"COST-F51DD08F6720A1","includes":null,"locator":"Figure 8, step 1d, p. 27; Figure 9, steps 3–4, p. 30","measure":"computation","member":null,"note":"Powers up to \\( 2t \\) of each \\( u^{a} \\); its randomized polynomial at \\( 3t+4 \\) points, each item tested as a root; the rest in \\( O(t^{3}) \\)","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","formula":"\\( (\\lambda+\\log_2(n_Xn_Y))n_X \\)","id":"COST-F52034F2D0F527","includes":null,"locator":"Figure 3, step 3, p. 11; §4.4, pp. 14–15; Lemma 6, p. 14","measure":"communication","member":null,"note":"One \\( H_2 \\) output per item, at the semi-honest length, the least the proof allows","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","formula":"\\( n_Y \\)","id":"COST-F5CBF3A685D5E9","includes":null,"locator":"Figure 4, inputs, p. 9","measure":"computation","member":null,"note":"Hashing each item","operation":"symmetric_op","per":null,"phase":"offline","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","formula":"\\( (2n_Y+1)|\\mathbb{Z}_N| \\)","id":"COST-F5D67BA8640B48","includes":null,"locator":"Protocol PM-Semi-Honest, step 1, p. 6; §5.1, p. 11","measure":"communication","member":null,"note":"Her public key and the encrypted coefficients of one degree-\\( n_Y \\) polynomial, whose constant term is fixed to one and not sent","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","formula":"\\( 2n_X \\)","id":"COST-F6059DC37532D1","includes":null,"locator":"§4.4, p. 9","measure":"computation","member":null,"note":"Encrypting the fixed string of zeros for each of its two answers","operation":"enc_dec","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","formula":"\\( 0 \\)","id":"COST-F65950DAFAFD0F","includes":null,"locator":"§2, p. 4","measure":"communication","member":null,"note":"Sends only inside the OT extension","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","formula":"\\( 2.4n_Y+d+\\lambda+n_X \\)","id":"COST-F7AF3F268093C8","includes":null,"locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37; Figure 1, p. 7","measure":"computation","member":null,"note":"One product \\( A_i\\Delta \\) per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per item; the binary-row decode is additions","operation":"field_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","formula":"\\( e\\epsilon n_Y+O(n_X) \\)","id":"COST-F7D2735E4B1610","includes":null,"locator":"RS21 Figure 4, step 4 and the sender's evaluation, p. 36; RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; §2, p. 6; §2, Field row, p. 8","measure":"computation","member":null,"note":"One product per OKVS position for \\( K = B + A\\Delta \\); per table entry \\( \\Delta H_F(y) \\) and the OPRF decode's products with the field-valued dense columns","operation":"field_op","per":null,"phase":null,"source":"PSI-PAPER-2021-RS","statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","formula":"\\( n(\\mu+1) \\)","id":"COST-F82FFAD9DE75D6","includes":null,"locator":"Figure 4, steps 2a and 4a, p. 12; §6.1, p. 11; §4, p. 6","measure":"computation","member":null,"note":"One phasing hash per item, then one output hash per sender encoding, \\( \\mu \\) per item","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","formula":"\\( 0 \\)","id":"COST-F86E4D86E322A8","includes":null,"locator":"Protocol 4.4, steps 4 and 6, p. 10; Protocol 4.2, p. 10","measure":"communication","member":null,"note":"Sends only inside ZeroXOR, as zero-sharing party and OPPRF sender","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"pivot","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","formula":"\\( n(6t+4) + O(t^{3}) \\)","id":"COST-F882A658B5A917","includes":null,"locator":"Figure 8, steps 1b and 1d, p. 27; Figure 9, steps 3–4, p. 30","measure":"computation","member":null,"note":"As a client, for its own set, its Hankel share then scaled by \\( \\ell-1 \\)","operation":"field_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"leader","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","formula":"\\( 5n+\\min(t_c+1,\\ell-1)(25n+B)+(\\ell-1)B+O(\\min(t_c+1,\\ell-1)n) \\)","id":"COST-F8932FB6285274","includes":null,"locator":"Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; Figure 8, steps 2 and 4, p. 12; §5.3, p. 13; KKRT16 §6.3, p. 16","measure":"computation","member":null,"note":"Five bin hashes per item; as a sharing sender, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search; one hash per bin as receiver","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":"expected","subject":"leader","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","formula":"\\( n_Y(k+2) \\)","id":"COST-F91E56565B73E0","includes":null,"locator":"Figure 4, steps 4–5, p. 11; Appendix A.4, p. 16","measure":"computation","member":null,"note":"Per item sums its \\( k \\) filter ciphertexts, subtracts, masks by a scalar, then adds the refresh's encryption of zero","operation":"hom_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","formula":"\\( 0 \\)","id":"COST-F920F8E5D5275E","includes":null,"locator":"Figure 3, steps 1–2, p. 11","measure":"communication","member":null,"note":"Sends nothing outside the OOS run, whose choice strings are its table","operation":null,"per":null,"phase":null,"source":"PSI-PAPER-2020-PRTY","statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","formula":"\\( n_X+n_Y \\)","id":"COST-F964C53B402F83","includes":null,"locator":"Appendix A, steps 1 and 3, p. 85","measure":"computation","member":null,"note":"Its own hashed items, then the other party's values, each with its secret exponent","operation":"exponentiation","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-1999-HFH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","formula":"\\( \\sigma(n\\log n-n+1) \\)","id":"COST-FA6C9BC40423C4","includes":null,"locator":"§5.3.3, p. 9; §2, p. 4","measure":"computation","member":null,"note":"One decryption per programmed swapper gate","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","formula":"\\( m|\\mathbb{F}| \\)","id":"COST-FB26025E33A1B8","includes":null,"locator":"Figure 5, steps 2(b)–(c), p. 39","measure":"communication","member":null,"note":"Its OKVS of its \\( n \\) items to the leader, one field element per slot","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"client","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","formula":"\\( n_X + n_Y \\)","id":"COST-FB78A7A0951DA5","includes":null,"locator":"Figure 2, Round 2, p. 6","measure":"computation","member":null,"note":null,"operation":"exponentiation","per":null,"phase":"online","source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","formula":"\\( n+\\mu(n+m)(\\sigma-\\log n) \\)","id":"COST-FC7BE187E39448","includes":null,"locator":"Figure 4, steps 2a, 3a and 4a, p. 12; §4, pp. 6–7","measure":"computation","member":null,"note":"A phasing hash per item; one PRF call per input bit for its receiver encoding at every bin position and for each of its sender encodings","operation":"symmetric_op","per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","formula":"\\( n_Y|\\mathbb{G}| + \\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","id":"COST-FDF6C4376BBEA8","includes":null,"locator":"§5.4, p. 18","measure":"communication","member":null,"note":"No partitioning, so one result per batch","operation":null,"per":null,"phase":"online","source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","formula":"\\( 5n_X \\)","id":"COST-FE1A97124BFB72","includes":null,"locator":"Figure 3, step 3, p. 11; Figure 6, Decode, p. 19","measure":"computation","member":null,"note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","per":null,"phase":null,"source":null,"statistic":null,"subject":"sender","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","tip":null,"value":null},{"basis":"counted","block":null,"evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","id":"COST-FED70305DF189D","includes":null,"locator":"Appendix A, steps 2 and 4, p. 85","measure":"communication","member":null,"note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated in order","operation":null,"per":null,"phase":null,"source":null,"statistic":null,"subject":"receiver","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","tip":null,"value":null}],"edges":[{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-002D8579EEC8D5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-SD","target":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0056AA13502D87","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2017-RR-CCS","target":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0085D93A128653","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","target":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-00EB2E6DADD6E9","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2012-HEK","target":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0117AA2E8CEFE3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","target":"PSI-PAPER-2004-FNP","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-02278B59BD1DE0","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-NR","target":"PSI-ASSUMPTION-NAOR-REINGOLD-PRF-OVER-P-256-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-022BB021719BF5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-02344D4AF8B3C7","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","target":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-02AAF73315C02E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-CHLR","target":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-02D0C384F2E531","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-GPRTY","target":"PSI-CONTRIB-2021-GPRTY-3H-GCT","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-02F77BA41C7EA1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2012-HEK","target":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","type":"HAS_RESULT"},{"evidenceLocator":"PSTY19 Protocol 9 (p. 17) and Protocol 10 (p. 20), IACR ePrint 2019/241, PDF dated 2019-02-28","evidenceUrl":"https://eprint.iacr.org/2019/241","id":"PSI-REL-037CE2D51C5889","note":"The linear-communication circuit-PSI programs the batched OPPRF so that all of a bin's items share one target, leaving one comparison per bin in the circuit.","resultId":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","target":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"RS21 §1.1 (p. 2); §2 (pp. 9-10); Figure 4 (p. 36), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-03DB8105C2FD36","note":"The VOLE-based OPRF encodes the receiver's set with the PaXoS solver with \\( 2.4n \\) main positions.","resultId":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"HEK12 §7.3 with footnotes 3-4 (p. 12), Figure 11 and Table 2 (p. 13), NDSS 2012 PDF dated 2011-11-28","evidenceUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","id":"PSI-REL-042F71E51C8557","note":"HEK12 reimplement the one-more-DL-based PSI protocol of De Cristofaro and Tsudik as a client-server protocol and measure it against their garbled-circuit protocol at five security levels.","resultId":"PSI-CONTRIB-2010-DT-LINEAR-APSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2010-DT-LINEAR-APSI","target":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","type":"BENCHMARKS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-04942C11C3B5ED","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2020-ION","target":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","type":"HAS_RESULT"},{"evidenceLocator":"CHLR18 §5.2 (p. 12), §7.3 (p. 17), Figure 8 (p. 25), IACR ePrint 2018/787, PDF dated 2018-08-27","evidenceUrl":"https://eprint.iacr.org/2018/787","id":"PSI-REL-05444B708CFD27","note":"The leaky malicious-sender protocol uses labeled PSI with hash-valued labels as its only output channel and drops the intersection polynomial.","resultId":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","target":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"CMGD21 §3 (p. 6) and §3.1 (p. 7), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidenceUrl":"https://eprint.iacr.org/2021/1116","id":"PSI-REL-05939CC4DBD08B","note":"Prime-field slots are safe only because CMGD21 makes the CHLR18 OPRF step mandatory: partial matches of OPRF outputs reveal nothing about the sender's items.","resultId":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","target":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-05B2F4B83D00C5","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-AUG","target":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-05D1FBD1DB4935","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RT-MAL","target":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-076A2FC2FB1034","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-KRSSW","target":"PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2020-PRTY-MAL--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-080CF27F05CEF9","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","target":"PSI-ASSUMPTION-OBLIVIOUS-TRANSFER-OR-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-ANY-ASSUMPTION-IMPLYING-SECURE-COMPUTATION","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0A02A2F8337AF6","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0A141C6D1D47CD","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RT-SH-V1","target":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0A7ABC11364CA2","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","target":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0A9DBEDD56F401","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-CONG","target":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0AC17F2726E618","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH--RELIES_ON--ASM-PRF","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","target":"ASM-PRF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0B8BB5355E313D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-SM","target":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0BB78473A42DA7","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-PSWW","target":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0BF1E10D75899D","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2018-CHLR","target":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0D756434ADE75C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-NR","target":"PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0DAEB7EF2E45BB","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","target":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0DC548A07B7C16","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-BMRR","target":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0DD1F945B8F6B1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","target":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PSTY19 §1 (p. 2), §3.2 (p. 12), and §3.3 (pp. 13-15), IACR ePrint 2019/241, PDF dated 2019-02-28","evidenceUrl":"https://eprint.iacr.org/2019/241","id":"PSI-REL-0DE1B85497C887","note":"PSTY19 adapts the polynomial OPPRF of KMPRT17 to a one-query definition that allows correlated targets and batches the hints of all bins into one polynomial of total size linear in the programmed points.","resultId":"PSI-CONTRIB-2017-KMPRT-OPPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-OPPRF","target":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","type":"EXTENDS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0E881255D1D09D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-GS-FHE","target":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PRTY20 §1.1 (pp. 2-3); Table 1 (p. 21); Table 2 (p. 24); Appendix D (pp. 34-35), IACR ePrint 2020/193, PDF dated 2020-02-16","evidenceUrl":"https://eprint.iacr.org/2020/193","id":"PSI-REL-0E9F2741697D11","note":"PaXoS-PSI improves on the communication of Rindal-Rosulek dual-execution malicious PSI from \\( O(\\kappa n \\log n) \\) to \\( O(\\kappa n) \\), replacing hashing into small bins with a PaXoS encoding over OOS; for \\( 2^{20} \\) items it reports 202.04 MB against 22,183 MB for the dual-execution variant with 64-bit items and 1,322 MB for the encode-commit variant.","resultId":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0EB24F224A3E47","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2017-KMPRT","target":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-0F1B2A2BDC43E0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR","target":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"RT21 abstract (p. 1), §1 (p. 2), §1.2 (pp. 5-6), IACR ePrint 2021/1159, version of October 17, 2021","evidenceUrl":"https://eprint.iacr.org/2021/1159","id":"PSI-REL-0FD49B8B26ED69","note":"RT21 present their malicious protocol as an improvement of the classic Diffie-Hellman protocol of Huberman, Franklin, and Hogg: \\( n + 1 \\) group elements plus n hashes against \\( 2n \\) group elements plus n hashes, while security rises from semi-honest to malicious.","resultId":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","target":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-10240C4087B03D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1042463AC082B8","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-KRSSW","target":"PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-111E952AAAF33A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-SD","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-113D14CA5C332D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","target":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-113DD0B8A4D24F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PSTY19 §1 (p. 2), §1.4 (p. 7), and §5 (p. 19), IACR ePrint 2019/241, PDF dated 2019-02-28","evidenceUrl":"https://eprint.iacr.org/2019/241","id":"PSI-REL-113ED311360FE6","note":"PSTY19 reduces the \\( \\omega(n) \\) comparisons of the PSWW18 construction, \\( s \\cdot n \\) of which serve a stash of size \\( \\omega(1) \\), to \\( O(n) \\) comparisons and linear communication.","resultId":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","target":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"CMGD21 §4.1-4.2 (pp. 12-14), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidenceUrl":"https://eprint.iacr.org/2021/1116","id":"PSI-REL-115A95705F25E1","note":"CMGD21 builds its labeled mode on the CHLR18 approach of encrypting labels under part of the OPRF output and interpolating the encrypted labels, adapting it to prime-field chunks.","resultId":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","target":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-13D800CD82DAEB","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-BWA","target":"PSI-CONTRIB-2012-HEK-SIZE-AUDITING","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-13F94721DD9605","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","target":"PSI-PAPER-2010-DT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1499A382DB9300","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","target":"PSI-PAPER-2019-GS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-157EF2DA4FD608","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","target":"PSI-PAPER-1999-HFH","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1583ABCE9B3C3A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","target":"PSI-PAPER-2004-FNP","type":"DESCRIBED_IN"},{"evidenceLocator":"FNP04 §4.2 (pp. 6-8), EUROCRYPT 2004, LNCS 3027, printed pages","evidenceUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"PSI-REL-163DB9BD653BBB","note":"Balanced-allocation hashing splits the client's polynomial into low-degree bin polynomials, reducing the server's exponentiations from \\( O(k_C k_S) \\) to \\( O(k_C + k_S \\ln \\ln k_C) \\).","resultId":"PSI-CONTRIB-2004-FNP-OPE-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2004-FNP-OPE-PSI","target":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-16463D3EAF2DE1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1690D4B82E4EB5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-SH","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-16DA6BBAE47009","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RT-SH-V2","target":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-AND-RANDOM-ORACLES","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-17536F7E7FD8DE","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","target":"PSI-CONTRIB-2021-GPRTY-3H-GCT","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1781913A053D67","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-RT","target":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-182BFDE485D343","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-LABELED","target":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PSTY19 abstract (p. 1), Table 3 (p. 25), and Table 5 (p. 27), IACR ePrint 2019/241, PDF dated 2019-02-28","evidenceUrl":"https://eprint.iacr.org/2019/241","id":"PSI-REL-199B0E702E23FB","note":"The stash-less OPPRF protocol communicates 2.6 to 12.8 times less and runs 2.8 to 5.8 times faster than the 2D cuckoo-hashing protocol, the previous best circuit-based PSI.","resultId":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","target":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"GS23 §1.3, paper outline paragraph, and footnote 5 (p. 4), IACR ePrint 2023/919, PDF dated 2023-06-12","evidenceUrl":"https://eprint.iacr.org/2023/919","id":"PSI-REL-19F72B2422AE70","note":"GS23 credit the two-party \\( O(\\lambda t \\,\\mathrm{polylog}\\, t) \\) bound without FHE to the GS19 construction combined with an observation of BMRR, and say their own two-party protocol does not improve on it asymptotically.","resultId":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","target":"PSI-CONTRIB-2023-GS-PICT-COMPILER","type":"ANALYZES"},{"evidenceLocator":"RR22 §1 (p. 3); §5.1 and Table 1 (pp. 23-25), IACR ePrint 2022/320, PDF dated 2022-11-02","evidenceUrl":"https://eprint.iacr.org/2022/320","id":"PSI-REL-19FB02DBD7F11B","note":"The triangulation OKVS keeps weight-3 rows but replaces the three-hash table's wholesale 2-core solving and two traversals by greedy triangulation with a few dense columns; encoding \\( 2^{20} \\) items is 13 times faster and the expansion is 1.23 rather than 1.3.","resultId":"PSI-CONTRIB-2021-GPRTY-3H-GCT","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-GPRTY-3H-GCT","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1A252939674628","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2020-PRTY","target":"PSI-CONTRIB-2020-PRTY-PAXOS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1AC44A104AB678","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-BMRR","target":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1B0E9C63D831BF","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-GC","target":"PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"RT21 Appendix A.1 (pp. 23-24) and A.2 (p. 26), IACR ePrint 2021/1159, version of October 17, 2021","evidenceUrl":"https://eprint.iacr.org/2021/1159","id":"PSI-REL-1C5D3C4A4E6179","note":"The semi-honest variants keep the malicious protocol's structure and drop the random oracles H1 and H2 used only for extraction, shortening the sender's keys; variant 2 also drops the ideal permutation.","resultId":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","target":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1D3FAD0FFC8FE8","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1DAED6C0B8196F","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-ION-ROT","target":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-BATCHED-RANDOM-OT","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1DBE53C1A65874","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"FNP04 §5 (pp. 9-13), Protocol PM-Malicious-Client (p. 10), §5.2 and Protocol PM-Malicious-Server (pp. 11-12), EUROCRYPT 2004, LNCS 3027, printed pages","evidenceUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"PSI-REL-1E751F5208AE4C","note":"The malicious-client protocol modifies PM-Semi-Honest with balanced-allocation hashing by cut-and-choose, and the malicious-server protocol modifies PM-Semi-Honest, given without hashing, by random-oracle derandomization.","resultId":"PSI-CONTRIB-2004-FNP-OPE-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2004-FNP-OPE-PSI","target":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","type":"HARDENS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1EAF28445EF974","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","target":"PSI-PAPER-2019-PSTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1EFCB7B25CDB94","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2023-GS","target":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-1F3499DEEC553C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-PSTY","target":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-20147A6D0E2E38","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","target":"PSI-ASSUMPTION-RANDOM-ORACLE-COMMITMENT-H-X-R-AND-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","type":"RELIES_ON"},{"evidenceLocator":"GS23 abstract (p. 1), §1 (p. 1), §1.2 (p. 2), and Corollary 6 (p. 16), IACR ePrint 2023/919, PDF dated 2023-06-12","evidenceUrl":"https://eprint.iacr.org/2023/919","id":"PSI-REL-2058D89E3B9920","note":"GS23 reuses the GS19 step for computing a large intersection and replaces the quadratic dependence on t of cardinality testing from additive HE by a quasilinear one, now for ℓ parties.","resultId":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","target":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-20686C9D399B85","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-CONG","target":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","type":"HAS_RESULT"},{"evidenceLocator":"CHLR18 §1.3 (p. 3), §4.1-4.2 (pp. 9-10), Theorem 1 (p. 15), IACR ePrint 2018/787, PDF dated 2018-08-27","evidenceUrl":"https://eprint.iacr.org/2018/787","id":"PSI-REL-206A9B2C15332E","note":"CHLR18 applies an OPRF to both sets before the CLR17 homomorphic intersection, which removes noise flooding, bin padding, and polynomial randomization and raises security from semi-honest to a malicious receiver (with privacy against a malicious sender).","resultId":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","target":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","type":"CHANGES_SECURITY_MODEL"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-20BD79B63F3E24","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","target":"PSI-CONTRIB-2021-GPRTY-OKVS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-22658F17999AAC","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","target":"PSI-PAPER-2012-HEK","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-227F21C087CB5E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","target":"PSI-PAPER-2023-GS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-234F766894EABD","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","target":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-RANDOM-ORACLES","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-23FEB805CEE3D3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2016-KKRT","target":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-243ADDD9FB3588","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","target":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"GS23 §1 (pp. 1-2), IACR ePrint 2023/919, PDF dated 2023-06-12","evidenceUrl":"https://eprint.iacr.org/2023/919","id":"PSI-REL-24B59806086C6C","note":"GS23 note that the BMRR \\( \\tilde O(\\lambda \\ell t) \\) protocol without FHE is equivalent to two-party threshold PSI for \\( \\ell = 2 \\) but for \\( \\ell > 2 \\) requires fewer than t distinct elements outside the intersection among all sets, a condition GS23's large-intersection protocol does not impose.","resultId":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","target":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","type":"ANALYZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2574B49E930B76","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-LABELED","target":"PSI-PAPER-2018-CHLR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-25CD94C7799A49","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-GPRTY","target":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-26351E821018C3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-FAST","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-26CA1CB064C7FF","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","target":"PSI-PAPER-2021-BMRR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-26CC9B3AAA4283","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","target":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2701D13374293D","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-SH","target":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-28D8D84A94AAC1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR","target":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-296F6A56575366","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-GPRTY","target":"PSI-CONTRIB-2021-GPRTY-OKVS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2BB6578D017FE1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-PSZ-OT","target":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2D2B9AEFDD5DD3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2E0A9D8898C455","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL","target":"PSI-PAPER-2020-PRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"NTY §5.1 and Tables 3-4 (pp. 11-12), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidenceUrl":"https://eprint.iacr.org/2021/1221","id":"PSI-REL-2E0B17EADDFFFE","note":"NTY report 10-23 times lower client running time and 1.2-8.5 times lower total running time than the semi-honest KMPRT protocol, while being maliciously secure.","resultId":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2E1132920FB8BE","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","target":"PSI-PAPER-2017-RR-CCS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2E8E45BE32AE36","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-DDH","target":"PSI-PAPER-2020-ION","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2E99B75DCFA85E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL","target":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2EEED1619C4EEF","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2004-FNP-SH","target":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-2F2F78778A5311","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-NR","target":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"RR22 §1.2 (p. 4); §4 (pp. 21-23); Figure 9 (p. 23); Table 2 (p. 25), IACR ePrint 2022/320, PDF dated 2022-11-02","evidenceUrl":"https://eprint.iacr.org/2022/320","id":"PSI-REL-2FA4627ED3F8E6","note":"Raghuraman and Rindal extend the VOLE-PSI protocol to subfield VOLE, so that the OKVS lives in a base field of about \\( \\lambda + \\log(n_x n_y) \\) bits; for \\( 2^{20} \\) items they report \\( 180n \\) bits against \\( 426n \\).","resultId":"PSI-CONTRIB-2021-RS-VOLE-OPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-RS-VOLE-OPRF","target":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","type":"EXTENDS"},{"evidenceLocator":"RS21 §5 (p. 21); Figure 8 (p. 38), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-30B319AD9FC89F","note":"The OPPRF of the circuit-PSI is built on the VOLE-based OPRF of the same paper.","resultId":"PSI-CONTRIB-2021-RS-VOLE-OPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-RS-VOLE-OPRF","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-311AC61A5C7B4E","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","target":"PSI-ASSUMPTION-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-YAO-GARBLED-CIRCUITS-NO-FURTHER-ASSUMPTION-STATED-FOR-THE-TWO-PARTY-CASE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-31AE619C156466","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","target":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"NTY §1.1.1 (p. 2), §2.0.3 (p. 5), Appendix B (p. 14), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidenceUrl":"https://eprint.iacr.org/2021/1221","id":"PSI-REL-328E7C954B2CD2","note":"NTY instantiate the OPPRF of ZeroXOR with the maliciously secure PaXoS-based OPPRF, which resists a sender that programs a point in only some cuckoo bins.","resultId":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-32B2495F31622C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-PSZ-OT","target":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"Ion et al. §4.3.1 (p. 9) and §5.1 (p. 11), IACR ePrint 2019/723, PDF dated 2020-09-05","evidenceUrl":"https://eprint.iacr.org/2019/723","id":"PSI-REL-3430B9E7A26F0F","note":"The random-OT protocol follows the batched-OPRF PSI of KKRT16, with its batched random OT, and adds a shuffle and re-masking of the OPRF outputs plus homomorphic tags so that the intersection stays hidden while its sum is computed.","resultId":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","target":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","type":"EXTENDS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3602C1B36BFC2F","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-GC","target":"PSI-ASSUMPTION-LOWMC-AS-A-PSEUDORANDOM-FUNCTION-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-36AD59C2DDD257","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","target":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3885DC88C2D13E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-FAST","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-395BC637FEF55D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-PSWW-2D","target":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"CMGD21 §1.2 (p. 3) and §3.1 (p. 7), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidenceUrl":"https://eprint.iacr.org/2021/1116","id":"PSI-REL-3992B625BB8FD9","note":"CMGD21 replaces the extension-field SIMD slots that CHLR18 used for arbitrary-length items with items split over prime-field slots.","resultId":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","target":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","type":"CHANGES_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-39BC172EAE9C97","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RS-SH","target":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3A8F3501F70E97","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","target":"PSI-PAPER-2020-PRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3AA45FDB589BB4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","target":"PSI-PAPER-2012-HEK","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3AACE9D954C088","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-AUG","target":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3C67EB83C89FFC","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","target":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PSEUDORANDOM-FUNCTION-AND-COLLISION-RESISTANT-HASH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3C9EC7F67AAB68","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2020-PRTY","target":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3D747C3508A92D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-SH","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3F3ED708CD1744","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-SM","target":"PSI-PAPER-2017-RR-CCS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3F9C427B21F473","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","target":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-3FFF5B494BD392","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-436A5CF0FA871B","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-BWA","target":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-43AA1AB2062FA9","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2022-RR","target":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-43EBC17D3F680D","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RT-MAL","target":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-443D1D2ACD6943","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-AUG","target":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-45547468E78DD3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","target":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-45A1370CC6C4A4","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-1999-HFH","target":"PSI-ASSUMPTION-NOT-STATED-DISCRETE-LOG-SETTING-MODULO-A-PRIME-WITH-AN-UNPREDICTABLE-HASH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-46DADD89D2AF5E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-FAST","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-476DA4AB3F7609","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-AUG","target":"PSI-CONTRIB-2017-KMPRT-OPPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-486EE26B16B9CD","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","target":"PSI-PAPER-2021-GPRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"VCE Table 3 (p. 13) and Appendix B.2 (p. 18), IACR ePrint 2023/1777, PDF dated 2023-11-16","evidenceUrl":"https://eprint.iacr.org/2023/1777","id":"PSI-REL-4A93689FF262F2","note":"VCE count \\( 7(n - 1)k \\) OTs at the leader, \\( 3.5(n - 1)k \\) per assistant, and \\( 3.5(n + 1)(n - 1)k \\) in total for the KMPRT protocol, from its OPPRF calls at 3.5 OTs each.","resultId":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","target":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON","type":"ANALYZES"},{"evidenceLocator":"RS21 §1.4 (p. 6); §7.1 (pp. 25-26); Table 1 (p. 25); Table 3 (p. 29), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-4A94D8760D86BD","note":"VOLE-PSI builds on PaXoS-PSI but replaces OT extension with sublinear VOLE, sending κ rather than about \\( 5\\kappa \\) bits per encoding position with malicious security; for \\( 2^{20} \\) items it reports 57.86 MB against 247.6 MB.","resultId":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4ABB6AB5282544","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","target":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4B71BB97FCE1DF","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","target":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4B7EB07397A196","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2023-GS","target":"PSI-CONTRIB-2023-GS-PICT-COMPILER","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4C34B8190BC86A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-PWC","target":"PSI-PAPER-2012-HEK","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4D5364555A8086","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-FAST","target":"PSI-PAPER-2022-RR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4D873CF56D8DCE","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","target":"PSI-PAPER-2022-RR","type":"DESCRIBED_IN"},{"evidenceLocator":"GPRTY21 §1.2 (p. 3); §5 (p. 13), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-4DAF969B43E99E","note":"GPRTY21 responds to the practice, as in PSZ18, of extrapolating cuckoo-hashing failure probabilities from large experiments, by amplifying an empirically validated OKVS failure rate instead.","resultId":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","target":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","type":"ANALYZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4DE5C9FE2F8ECA","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2017-CLR","target":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4E04AA4CE693B1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","target":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-4F6B114C82B1A9","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","target":"PSI-PAPER-2019-PSTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-50B949A6D7652B","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-50D7E964475902","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","target":"PSI-ASSUMPTION-THRESHOLD-FHE-WITH-DISTRIBUTED-SETUP-FROM-CIRCULAR-SECURE-LWE-WITH-THRESHOLD-ADDITIVELY-HOMOMORPHIC-ENCRYPTION","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-50E106E328F87A","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","target":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BGV","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-51318CCC55D8D2","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-SH","target":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"RS21 §2 (pp. 10-11); Figure 1 (p. 7); Theorem 5.1 (pp. 21-22), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-525FE648B15A66","note":"XoPaXoS modifies the PaXoS solver to sample its free positions at random, so that the encoding is uniform for uniform values, as the OPPRF requires.","resultId":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"EXTENDS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5296D3F7381FE5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-LABELED","target":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-53BD65696B5082","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL","target":"PSI-ASSUMPTION-PROGRAMMABLE-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5426E79FBE5D32","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-CONG","target":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-545DA0AFD7D042","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-KRSSW","target":"PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","type":"HAS_RESULT"},{"evidenceLocator":"GS23 §1 (pp. 1-2) and Corollary 6 (p. 16), IACR ePrint 2023/919, PDF dated 2023-06-12","evidenceUrl":"https://eprint.iacr.org/2023/919","id":"PSI-REL-5594AAE20F9322","note":"For the large-intersection condition, where BMRR reach \\( O(nT) \\) only from threshold FHE, GS23 reach \\( O(\\lambda^{2} \\ell t \\,\\mathrm{polylog}\\, t) \\) from oblivious transfer or additively homomorphic encryption, at an extra security-parameter and polylog factor.","resultId":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","target":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","type":"CHANGES_ASSUMPTION"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-55EC47A33AAB46","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","target":"PSI-PAPER-2012-HEK","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-56468CC22251A4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-AUG","target":"PSI-PAPER-2017-KMPRT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5795F460859E5F","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2010-DT-FIG3","target":"PSI-ASSUMPTION-ONE-MORE-GAP-DH-AND-RANDOM-ORACLES","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF--RELIES_ON--ASM-DDH","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","target":"ASM-DDH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF--RELIES_ON--ASM-DCR","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","target":"ASM-DCR","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF--RELIES_ON--ASM-PRG","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","target":"ASM-PRG","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-58592D6C49A943","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2018-PSWW-2D","target":"PSI-ASSUMPTION-SEMI-HONEST-GENERIC-TWO-PARTY-COMPUTATION-GMW-OR-YAO-NO-ASSUMPTION-STATED","type":"RELIES_ON"},{"evidenceLocator":"KKRT16 §5.1 (p. 11), §5.3 (p. 12), Figure 3 (p. 13), IACR ePrint 2016/799, PDF dated 2016-08-20","evidenceUrl":"https://eprint.iacr.org/2016/799","id":"PSI-REL-5953C40F632A15","note":"The PSI protocol runs one BaRK-OPRF instance per cuckoo bin and stash position, so each bin consumes one row of a 424-448-bit OT-extension matrix.","resultId":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","target":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5961054A301428","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2016-KKRT","target":"PSI-ASSUMPTION-HAMMING-CORRELATION-ROBUST-HASH-AND-PSEUDORANDOM-CODE-WITH-IDEAL-BASE-OTS","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-599C43515B0AB0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5A10F62C276C0A","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","target":"PSI-ASSUMPTION-CODE-CORRELATION-ROBUST-HASH-IN-THE-OOS-OT-EXTENSION-HYBRID-MODEL","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5AB2F45CB65ED1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2004-FNP","target":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","type":"HAS_RESULT"},{"evidenceLocator":"CMGD21 §1.2 (p. 3) and §3.1 (pp. 11-12), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidenceUrl":"https://eprint.iacr.org/2021/1116","id":"PSI-REL-5AB3DAF3D493F4","note":"CMGD21 lowers the number of encrypted query powers from \\( O(\\log B) \\), as with CLR17 windowing, to \\( O(1) \\) using depth-free Frobenius operations, reducing communication from \\( \\tilde O(2^{C} C^{2}) \\) to \\( \\tilde O(C^{2}) \\) with \\( C = \\log \\log |X| \\).","resultId":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","target":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"FNP04 §7 (pp. 15-17), EUROCRYPT 2004, LNCS 3027, printed pages","evidenceUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"PSI-REL-5AE307BB062E79","note":"Each client encodes its items as in the two-party protocol, and the leader evaluates all client polynomials with XOR-shared payloads.","resultId":"PSI-CONTRIB-2004-FNP-OPE-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2004-FNP-OPE-PSI","target":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","type":"EXTENDS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-BWA--RELIES_ON--ASM-DDH","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-BWA","target":"ASM-DDH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-BWA--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-BWA","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5B84D2BBCC194B","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","target":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-VOLE-FROM-LPN-WITH-REGULAR-NOISE","type":"RELIES_ON"},{"evidenceLocator":"NTY §1.1.1 (p. 2), §1.2 (p. 4), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidenceUrl":"https://eprint.iacr.org/2021/1221","id":"PSI-REL-5C4198F6422A15","note":"At \\( t = n - 1 \\) the NTY protocol coincides with that of Garimella et al. up to the OKVS instantiation, with the same performance; for smaller t it removes clients from the zero test and becomes cheaper.","resultId":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"GENERALIZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5C63429C5E1295","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-LABELED","target":"PSI-PAPER-2021-CONG","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5E44F52934BE20","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-5E5D9A47579DAF","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","target":"PSI-ASSUMPTION-SEMI-HONEST-GENERIC-TWO-PARTY-COMPUTATION-GMW-OR-YAO-NO-ASSUMPTION-STATED","type":"RELIES_ON"},{"evidenceLocator":"GPRTY21 §2.4, Definition 4 and Lemma 5 (pp. 6-7), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-5F0F33CB2352B3","note":"GPRTY21 observes that the PaXoS bound on encodable random-oracle values uses only correctness, restates it for any key-value store, and formalizes it as the (n, n')-overfitting game.","resultId":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","target":"PSI-CONTRIB-2021-GPRTY-OKVS","type":"GENERALIZES"},{"evidenceLocator":"KMPRT §5.1-5.2 (pp. 11-12) and Figure 8 (p. 12), IACR ePrint 2017/799, PDF dated 2017-08-24","evidenceUrl":"https://eprint.iacr.org/2017/799","id":"PSI-REL-5FBADF6DF8D147","note":"Conditional zero-sharing and conditional reconstruction are both realized as multi-query OPPRF instances, between every pair of parties and from each party to the leader.","resultId":"PSI-CONTRIB-2017-KMPRT-OPPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-OPPRF","target":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-608B2F41B87049","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2024-VCE","target":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-60FE8AF8F5594F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-62CAF492A6B895","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2017-KMPRT","target":"PSI-CONTRIB-2017-KMPRT-OPPRF","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-64C848D9D59073","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","target":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PSTY19 Protocol 7 (p. 16) and §7.3 (p. 24), IACR ePrint 2019/241, PDF dated 2019-02-28","evidenceUrl":"https://eprint.iacr.org/2019/241","id":"PSI-REL-64EA78C08DB134","note":"The batched OPPRF is built in the F_OPRF-hybrid model, and its cost is estimated with the BaRK-OPRF at no more than 450 bits per evaluation.","resultId":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","target":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6505BF0B4DB78B","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","target":"PSI-PAPER-2018-CHLR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-65D15F1320AB27","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-ION-BF","target":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-EXPONENTIAL-ELGAMAL-AND-RING-LWE-IN-THE-MEASUREMENTS","type":"RELIES_ON"},{"evidenceLocator":"GPRTY21 §6.2 (p. 19), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-6689776221FC63","note":"GPRTY21 observes that the VOLE-PSI OPRF combines vector OLE with PaXoS and that any OKVS can replace PaXoS there; its own vector-OLE protocol is derived from PaXoS-PSI.","resultId":"PSI-CONTRIB-2021-RS-VOLE-OPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-RS-VOLE-OPRF","target":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","type":"GENERALIZES"},{"evidenceLocator":"BMRR Theorems 4.1 and 4.3 with proofs (pp. 15-17), IACR ePrint 2020/600, PDF dated 2021-02-25","evidenceUrl":"https://eprint.iacr.org/2020/600","id":"PSI-REL-6760BCDBD515B5","note":"BMRR derive the per-party \\( \\Omega(T) \\) and total \\( \\Omega(nT) \\) bounds for multiparty threshold PSI by reducing from the two-party \\( \\Omega(T) \\) bound of GS19.","resultId":"PSI-CONTRIB-2019-GS-LOWER-BOUND","reviewStatus":"theorem_checked","source":"PSI-CONTRIB-2019-GS-LOWER-BOUND","target":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND","type":"EXTENDS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6852828FE741DF","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","target":"PSI-PAPER-2023-GS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6896F7BABE1416","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-68C8B44D413083","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","target":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-699883E2F310D4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","target":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-69A4FAB07E9CB0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6A411E78BA35BA","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","target":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6A7ED31B057834","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","target":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6A8B2A32C5E23F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-MAL","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6A8E59A4E03B7F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-LABELED","target":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6A9D2899E4A873","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-BMRR","target":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6B2DA213947C87","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-RS","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"HAS_RESULT"},{"evidenceLocator":"GS19 §1 (p. 1) and §3 (pp. 7-8), IACR ePrint 2019/175, PDF dated 2020-05-27","evidenceUrl":"https://eprint.iacr.org/2019/175","id":"PSI-REL-6B9B3A5526164C","note":"Ghosh and Simkin reduce threshold PSI to PSI on padded sets and so turn the disjointness-based linear lower bound that they attribute to Freedman, Nissim, and Pinkas into an \\( \\Omega(t) \\) bound in the threshold.","resultId":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","target":"PSI-CONTRIB-2019-GS-LOWER-BOUND","type":"EXTENDS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6C83A543FC895A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-LABELED","target":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-6C8E28F73D910F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","target":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"GPRTY21 §7.2 (pp. 21-22); Appendix B.2 (p. 30); Appendix B.6 (pp. 36-37), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-703E7986960F4D","note":"GPRTY21 shows that this protocol, with each OPRF output hashed together with the item by a random oracle and written over any OKVS, is secure against malicious adversaries.","resultId":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","target":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","type":"HARDENS"},{"evidenceLocator":"RR17 §5.3 (pp. 8-10), §6.4 (pp. 15-16), IACR ePrint 2017/769, full version of August 9, 2017","evidenceUrl":"https://eprint.iacr.org/2017/769","id":"PSI-REL-7157E27A648ACB","note":"Viewing the sender's encodings in dual execution as commitments, the encode-commit protocol replaces them with a standard commitment and masked decommitments.","resultId":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","target":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT","type":"CHANGES_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-735E701D86EA30","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-ROT","target":"PSI-PAPER-2016-KKRT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7372FB6531F902","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-GC","target":"PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"RR22 §5.1 (p. 24), IACR ePrint 2022/320, PDF dated 2022-11-02","evidenceUrl":"https://eprint.iacr.org/2022/320","id":"PSI-REL-74B3190AACFDC3","note":"Raghuraman and Rindal argue that the empirical 2-core bound behind the star instantiation is in error, likely costing a few bits (λ about 27 rather than 29), and replace amplification by direct parameter selection at expansion 1.23 to 1.28 instead of 1.32.","resultId":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"ANALYZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-750702C579DA68","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","target":"PSI-PAPER-2019-GS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7629A57DD2955B","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","target":"PSI-CONTRIB-2020-PRTY-PAXOS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"RR22 abstract (p. 1); §1 (p. 2); Table 2 (p. 25), IACR ePrint 2022/320, PDF dated 2022-11-02","evidenceUrl":"https://eprint.iacr.org/2022/320","id":"PSI-REL-76ACFB69145BB5","note":"With the new OKVS, RR22's fast semi-honest PSI runs in 369 ms for \\( 2^{20} \\) items against 2,073 ms for KKRT16 on the same laptop.","resultId":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-78850EB718F4FA","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-PAPER-2017-CLR","type":"DESCRIBED_IN"},{"evidenceLocator":"RS21 §1.4 (p. 6); §5 (p. 21); §6 (p. 22), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-7910E67D93EC17","note":"VOLE-PSI replaces the polynomial-interpolation OPPRF of PSTY19 with an OPPRF built from the VOLE-based OPRF and a XoPaXoS encoding of the sender's corrections.","resultId":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"CHANGES_MECHANISM"},{"evidenceLocator":"NTY §2.0.5 (p. 5), §4.1 and Protocol 4.2 (p. 10), Protocol C.1 (p. 14), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidenceUrl":"https://eprint.iacr.org/2021/1221","id":"PSI-REL-79B8B9E816B9C4","note":"ZeroXOR masks each OPPRF-programmed value with the unconditional zero-sharing of KMPRT, which NTY restate as a functionality and protocol, and uses it against a malicious adversary.","resultId":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7A8B8AD1267EED","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","target":"PSI-PAPER-2020-ION","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7C09EF78B36C91","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2017-CLR","target":"PSI-ASSUMPTION-IND-CPA-LEVELED-FHE-WITH-CIRCUIT-PRIVACY-FV-OVER-RING-LWE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-PWC--RELIES_ON--ASM-DDH","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-PWC","target":"ASM-DDH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-PWC--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-PWC","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"RR22 §1 (p. 2); Appendix A.1-A.2, Definitions 1-3 and Theorems 1-2 (pp. 30-31), IACR ePrint 2022/320, PDF dated 2022-11-02","evidenceUrl":"https://eprint.iacr.org/2022/320","id":"PSI-REL-7C2E8EB7762AEC","note":"The triangulation construction is a linear OKVS in the sense of the OKVS abstraction, and RR22 adds a doubly oblivious variant for circuit PSI.","resultId":"PSI-CONTRIB-2021-GPRTY-OKVS","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-GPRTY-OKVS","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"INSTANTIATES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7C53ED3545109C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RT-SH-V1","target":"PSI-PAPER-2021-RT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7D106CCE1FA51A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","target":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7D1F92F6E2A051","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","target":"PSI-PAPER-2020-PRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"GS19 abstract (p. 1) and §1 (p. 2), IACR ePrint 2019/175, PDF dated 2020-05-27","evidenceUrl":"https://eprint.iacr.org/2019/175","id":"PSI-REL-7DC5B628F3963A","note":"Earlier threshold PSI, including the FNP04 threshold decision on the intersection size, communicates at least linearly in the smaller set; GS19 reaches communication depending mainly on t.","resultId":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","target":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7DECC3E0B9B575","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-PAPER-2018-CHLR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7E03D36E227D8F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-SH","target":"PSI-PAPER-2017-KMPRT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7F3ABD60915625","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-SD","target":"PSI-PAPER-2022-RR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7FD148EE6A5CF8","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","target":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-7FFB4F8554B928","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-PSTY","target":"PSI-CONTRIB-2019-PSTY-PAYLOAD","type":"HAS_RESULT"},{"evidenceLocator":"PSZ18 §1.2 'OT-Based PSI' (pp. 4-5), Table 1 (p. 5), §5 (p. 22), IACR ePrint 2016/930, PDF dated 2019-07-28","evidenceUrl":"https://eprint.iacr.org/2016/930","id":"PSI-REL-8093770807288B","note":"PSZ18 contrasts its fixed BCH code with KKRT16's pseudorandom code for the same OPRF role, reporting 1.10-1.15 times the communication and noting that its code admits a malicious-receiver extension that the pseudorandom code does not.","resultId":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","target":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","type":"CHANGES_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8240F7C3E5982C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","target":"PSI-CONTRIB-2010-DT-BLIND-RSA","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-82848B2DEAEA36","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-1999-HFH","target":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-837415A871C9BD","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","target":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PSZ18 §1.3 (p. 5), §3 (p. 12), IACR ePrint 2016/930, PDF dated 2019-07-28; FNP04 §4.2 (pp. 7-8)","evidenceUrl":"https://eprint.iacr.org/2016/930","id":"PSI-REL-84C9E0993A1B27","note":"PSZ18 supplies concrete parameters for the hashing-to-bins approach that FNP04 introduced for PSI with only an asymptotic analysis.","resultId":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","target":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","type":"ANALYZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-860ACE7BC5E151","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","target":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-87BB2A28DEAF53","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-LABELED","target":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-897CD355CC8060","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR","target":"PSI-PAPER-2017-CLR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-898AA8A0EDBC53","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-PWC","target":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8AD0AF1346BECF","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8B40811A4F9B70","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2004-FNP","target":"PSI-CONTRIB-2004-FNP-OT-REDUCTION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8B655505E73B4D","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-GS-AHE","target":"PSI-ASSUMPTION-IND-CPA-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PAILLIER-OR-DAMG-RD-JURIK-AND-PASSIVELY-SECURE-OLE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8C1D9AE00ABF22","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2022-RR-FAST","target":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-SUBFIELD-VOLE-HYBRID-MODEL-VOLE-FOLLOWING-COUTEAU-RINDAL-RAGHURAMAN-2021-AND-BOYLE-ET-AL-2019","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8DC71950294D91","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","target":"PSI-ASSUMPTION-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8FBDC668AA592D","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","target":"PSI-ASSUMPTION-DECISIONAL-DIFFIE-HELLMAN-FOR-THE-OBLIVIOUS-TRANSFER-IN-THE-RANDOM-ORACLE-MODEL-WITH-AN-UNNAMED-HOMOMORPHIC-ENCRYPTION-SCHEME","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-8FCEE472E0B3F4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","target":"PSI-PAPER-2020-PRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"GPRTY21 §3 (p. 9); §4.1 (pp. 9-11); Figure 1 (p. 8); Table 2 (p. 29), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-8FE88B9539729C","note":"The three-hash table generalizes the PaXoS garbled cuckoo table from two to three hash functions, keeping its \\( L \\| R \\) treatment of the 2-core, and reduces the main table from about \\( 2.4n \\) to \\( 1.3n \\) positions.","resultId":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","target":"PSI-CONTRIB-2021-GPRTY-3H-GCT","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-904AD20799DEA4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-91AE0496C986F1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","target":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-930B154A39E41C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-1999-HFH","target":"PSI-PAPER-1999-HFH","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9384B0E1EE9ECF","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-93A7052A551868","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2004-FNP","target":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9507428DA815F3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-GS","target":"PSI-CONTRIB-2019-GS-LOWER-BOUND","type":"HAS_RESULT"},{"evidenceLocator":"CMGD21 §1.2 (p. 3) and §3.1 (pp. 9-10), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidenceUrl":"https://eprint.iacr.org/2021/1116","id":"PSI-REL-95DDF3E8551C05","note":"CMGD21 replaces the windowing introduced by CLR17 with extremal postage-stamp bases, sending fewer encrypted powers for the same depth.","resultId":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","target":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-95ECAC281F39B1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH","target":"PSI-PAPER-2020-PRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-964DF6E3E28026","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","target":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-96631761A1DA1A","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2022-RR-SD","target":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-SUBFIELD-VOLE-HYBRID-MODEL-VOLE-FOLLOWING-COUTEAU-RINDAL-RAGHURAMAN-2021-AND-BOYLE-ET-AL-2019","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9676A96F5213B6","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2004-FNP","target":"PSI-CONTRIB-2004-FNP-OPE-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-96C9950CD4F45E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","target":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN--RELIES_ON--ASM-DDH","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","target":"ASM-DDH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-990E5CBFDE011C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-MAL","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"BMRR §3.1 (pp. 11-12) and §5.1 (p. 17), IACR ePrint 2020/600, PDF dated 2021-02-25","evidenceUrl":"https://eprint.iacr.org/2020/600","id":"PSI-REL-99804BAE9AC969","note":"BMRR start from the two-party FHE protocol of GS19 and generalize it to n parties under threshold FHE, adding random linear factors against unexpected degree reduction.","resultId":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","target":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","type":"GENERALIZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-99D216968D1099","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","target":"PSI-ASSUMPTION-NOT-STATED-DISCRETE-LOG-SETTING-MODULO-A-PRIME-WITH-AN-UNPREDICTABLE-HASH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-99F78E06662FAF","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","target":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9AA02818500739","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-RS","target":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9AE1D7025D2231","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-GS","target":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9B851FADB74D9C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-CLR","target":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9C0412D55E6941","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-CHLR","target":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-9CC1025C4D7650","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","target":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"KMPRT abstract (p. 1), Table 1 (p. 3), §6.1 (pp. 14-15), IACR ePrint 2017/799, PDF dated 2017-08-24","evidenceUrl":"https://eprint.iacr.org/2017/799","id":"PSI-REL-9F100A919ADD87","note":"Replacing the pairwise OPPRF zero-sharing phase by zero-sharing from PRF seeds lowers client communication from \\( O(m t \\lambda) \\) to \\( O(m \\lambda) \\) bits and the 5-party, \\( 2^{20} \\)-item run from 72 s to 22 s, while relaxing semi-honest to augmented semi-honest security.","resultId":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","target":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A04F9991339FFC","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","target":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A1C066B0315B3D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-BF","target":"PSI-PAPER-2020-ION","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A1EBFA5D400023","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","target":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PSEUDORANDOM-FUNCTION-AND-COLLISION-RESISTANT-HASH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A216A5D791D7B4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-GS-AHE","target":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A3C65E49F4BBAC","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","target":"PSI-PAPER-2004-FNP","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A424EB9C307447","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-LABELED","target":"PSI-PAPER-2018-CHLR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A53D97F4D33FAE","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","target":"PSI-PAPER-2021-GPRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A593AA0DC56F66","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","target":"PSI-PAPER-2021-BMRR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A5FB2BCD90E099","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","target":"PSI-ASSUMPTION-ONE-MORE-RSA-INVERSION-AND-RANDOM-ORACLES","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A6D51CB1CD9511","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-ROT","target":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A714C818487BC9","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-PSZ-OT","target":"PSI-PAPER-2018-PSZ","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A7214264DA31E7","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-SH","target":"PSI-PAPER-2016-KKRT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A7366C6280EF51","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RT-SH-V2","target":"PSI-PAPER-2021-RT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A74D4BF6116D0D","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2018-CHLR-LABELED","target":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-A83379AC4B6C2D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2020-PRTY","target":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","type":"HAS_RESULT"},{"evidenceLocator":"FNP04 §4.4-4.5 (p. 9), EUROCRYPT 2004, LNCS 3027, printed pages","evidenceUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"PSI-REL-A8E46FDBF6FFBE","note":"Changing the server's payload in PM-Semi-Honest yields the cardinality variant, and random payloads plus a secure circuit yield the threshold variant.","resultId":"PSI-CONTRIB-2004-FNP-OPE-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2004-FNP-OPE-PSI","target":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","type":"EXTENDS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AA8BB96A97AC36","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-BMRR","target":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AABBBE1A8E0B0C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","target":"PSI-PAPER-2019-GS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AB426C5E5EC4F6","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","target":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-ABDF290CD5167E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-ACA53F43F62D36","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-RT","target":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AE253D2E0D398D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","target":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AEDF9460C58810","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-MAL","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AF5DFDFAC64569","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2020-ION","target":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AFAB7FC65BDE6C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","target":"PSI-PAPER-2004-FNP","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-AFE1A0AE93C9C1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL","target":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B03698685782DB","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-ROT","target":"PSI-PAPER-2020-ION","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2019-GS-FHE--RELIES_ON--ASM-LWE","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-GS-FHE","target":"ASM-LWE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2019-GS-FHE--RELIES_ON--ASM-RLWE","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-GS-FHE","target":"ASM-RLWE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B08E30FD4FD790","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2016-KKRT","target":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B123215A949136","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-SH","target":"PSI-PAPER-2004-FNP","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B1E0A6967466CC","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","target":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-IDEAL-OPPRF-AND-ZERO-SHARING-FUNCTIONALITIES","type":"RELIES_ON"},{"evidenceLocator":"RS21 §1.3 (p. 5); §4 (pp. 19-20); §7.1 (p. 26), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-B2410EA9D47C56","note":"VOLE-PSI shows that the \\( 2\\kappa \\)-bit sender values required by the PaXoS-PSI analysis can be reduced to κ bits by extracting only non-colliding OPRF queries.","resultId":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","target":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","type":"ANALYZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B2554E4CCCCA60","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RT-MAL","target":"PSI-PAPER-2021-RT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B261CBD39CCF91","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","target":"PSI-CONTRIB-2017-KMPRT-OPPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B37EB085F8A4F6","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-CLR","target":"PSI-PAPER-2017-CLR","type":"DESCRIBED_IN"},{"evidenceLocator":"NTY §2.0.4 (p. 5), Protocols 3.1 and 3.3 (pp. 6, 8), proof of Theorem 3.2 (p. 7), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidenceUrl":"https://eprint.iacr.org/2021/1221","id":"PSI-REL-B39E80FFC99C37","note":"P1 and the other senders encode their items with PRF values in OKVSs, whose obliviousness the simulation uses to replace them with random encodings.","resultId":"PSI-CONTRIB-2021-GPRTY-OKVS","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-GPRTY-OKVS","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B642A632D55703","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-ROT","target":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B65F8821BBC02B","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2016-KKRT","target":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B68DA97D24C8D4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","target":"PSI-CONTRIB-2021-GPRTY-3H-GCT","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B6BAFF799AD9C0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2004-FNP","target":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B71F476E5E5F20","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","target":"PSI-PAPER-2021-GPRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B854444D3AFC00","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-SD","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"GPRTY21 §7.1 (pp. 20-21); Figure 3 (p. 22), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-B967884DE8F1B5","note":"The generalized protocol adapts PaXoS-PSI to any linear OKVS by replacing the OOS correlation with vector OLE, which removes the error-correcting code.","resultId":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","target":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","type":"GENERALIZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-B9805C1CB77337","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","target":"PSI-CONTRIB-2023-GS-PICT-COMPILER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT--RELIES_ON--ASM-DDH","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","target":"ASM-DDH","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-BA37A8C914B87E","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2018-PSZ-OT","target":"PSI-ASSUMPTION-RANDOM-OT-EXTENSION-WITH-A-HASH-MODELED-AS-A-RANDOM-ORACLE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-BBE03A23DAD162","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","target":"PSI-ASSUMPTION-DDH-AND-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-RANDOM-ORACLE-MODEL-PAILLIER-WITH-DAMG-RD-JURIK-IN-DEPLOYMENT","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-BC155F8A419D3A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-PSWW-2D","target":"PSI-PAPER-2018-PSWW","type":"DESCRIBED_IN"},{"evidenceLocator":"BMRR abstract (p. 1), §1.2 (p. 4), §3.3-3.4 (pp. 12-14), Imported Theorem 6.4 (p. 27), IACR ePrint 2020/600, PDF dated 2021-02-25","evidenceUrl":"https://eprint.iacr.org/2020/600","id":"PSI-REL-BD1852E75D5AD4","note":"BMRR keep the monomial encoding, Hankel sparsity test, and noisy-polynomial intersection step of GS19 and replace the general singularity test with a Hankel-specific half-GCD test, lowering two-party communication from \\( \\tilde O(T^{2}) \\) to \\( \\tilde O(T) \\) without FHE.","resultId":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","target":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-BE49E4E224E74B","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-KRSSW","target":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-BEE1FB3E694351","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-NR","target":"PSI-PAPER-2019-KRSSW","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-BF18ACE901FD7E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","target":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-BF2CE9FFC4EA7A","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","target":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-H-LIMITED-LEVELED-FHE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C23148F97D037A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C244011C8039E0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-NTY","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C2DA3F5B1CA713","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","target":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C35DC380A0B6B0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-NTY","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C389FBA788B1F5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-GS","target":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C3CA9E4D698638","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-GS-AHE","target":"PSI-PAPER-2019-GS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C410FF96E9EFE8","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-SD","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C426707741A75F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-GC","target":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PSWW18 §6.2 (pp. 21-23) and Table 3 (p. 23), IACR ePrint 2018/120, PDF dated 2019-01-24","evidenceUrl":"https://eprint.iacr.org/2018/120","id":"PSI-REL-C4392F01F67DE9","note":"The 2D cuckoo-hashing circuit has 1.8 to 2.8 times fewer AND gates than sort-compare-shuffle without its shuffle phase for \\( n = 2^{12} \\) and \\( 2^{16} \\), where that circuit was the previous best.","resultId":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","target":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C4AD98566FA73D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-GS-FHE","target":"PSI-PAPER-2019-GS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C5550FB52B2CA3","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","target":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-AN-IDEAL-TWO-PARTY-PSI-FUNCTIONALITY","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C5DC58B6908BF8","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-RS","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C61EC95DA2A9F8","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2016-KKRT","target":"PSI-PAPER-2016-KKRT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C73DBB28A3B106","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-CONG-LABELED","target":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C88F7EE27991D5","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","target":"PSI-ASSUMPTION-THRESHOLD-FHE-WITH-DISTRIBUTED-SETUP-FROM-CIRCULAR-SECURE-LWE-WITH-THRESHOLD-ADDITIVELY-HOMOMORPHIC-ENCRYPTION","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C8FBB59CB36B46","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","target":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C914F7F65F5606","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-C97E6060494793","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2004-FNP","target":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","type":"HAS_RESULT"},{"evidenceLocator":"FNP04 §2 (p. 2) and abstract (p. 1), EUROCRYPT 2004, LNCS 3027, printed pages","evidenceUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"PSI-REL-C9E2EF3540F343","note":"FNP04 contrasts its standard-model semi-honest protocol with earlier \\( O(k) \\)-exponentiation constructions, citing HFH99, that had been analyzed only in the random oracle model against semi-honest parties.","resultId":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","target":"PSI-CONTRIB-2004-FNP-OPE-PSI","type":"CHANGES_SECURITY_MODEL"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2019-PSTY-BASIC--RELIES_ON--ASM-PRF","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-PSTY-BASIC","target":"ASM-PRF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-CAB7C4CAB7C7B7","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-BASIC","target":"PSI-PAPER-2019-PSTY","type":"DESCRIBED_IN"},{"evidenceLocator":"CHLR18 §3 (pp. 7-8) and §8.3 (p. 21), IACR ePrint 2018/787, PDF dated 2018-08-27","evidenceUrl":"https://eprint.iacr.org/2018/787","id":"PSI-REL-CC6912A2A0C512","note":"CHLR18 replaces the plaintext modulus of the item length used by CLR17 with extension-field SIMD slots, making arbitrary-length (80-bit hashed) items efficient where CLR17 was practically limited to 32 bits.","resultId":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","target":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-CCE94BB89441A2","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","target":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-CD0BF54BB3CEA1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-SH","target":"PSI-CONTRIB-2017-KMPRT-OPPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-CDC4247FFF9606","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH","target":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-CDDE1B05AA60C2","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","target":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-CE1E9E02F27DC6","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH","target":"PSI-CONTRIB-2020-PRTY-PAXOS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"VCE §5.3.3 (pp. 11-12), Table 3 (p. 13), Appendix B.2 (p. 18), IACR ePrint 2023/1777, PDF dated 2023-11-16","evidenceUrl":"https://eprint.iacr.org/2023/1777","id":"PSI-REL-CE3EB6B9CD684C","note":"VCE count tk OPPRFs at the leader and k per assistant for the ZeroXOR step of NTY, 3.5tk OTs in total, and describe it as outperforming the protocols of Kolesnikov et al., Ben-Efraim et al., and Chandran et al.","resultId":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","target":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON","type":"ANALYZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-CEA44044209B5E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-SH","target":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"CHLR18 §1.3 (p. 3), §7.2 (p. 16), §7.3 (pp. 17-18), Theorem 3 (p. 25), IACR ePrint 2018/787, PDF dated 2018-08-27","evidenceUrl":"https://eprint.iacr.org/2018/787","id":"PSI-REL-CFBA1C1578FE78","note":"CHLR18 restricts what a malicious sender can do in FHE-based unbalanced PSI from forcing the intersection to be the receiver's full set, as in CLR17, to X ∩ Y ∩ leakage(Y), under an H-limited FHE assumption.","resultId":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","target":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","type":"HARDENS"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D073D26D886B39","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-SH","target":"PSI-CONTRIB-2004-FNP-OPE-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"KMPRT §3.1 (pp. 4-5), §3.4 (p. 7), §4 (p. 9), IACR ePrint 2017/799, PDF dated 2017-08-24","evidenceUrl":"https://eprint.iacr.org/2017/799","id":"PSI-REL-D0BBC5F91DCC6A","note":"KMPRT build every OPPRF from the KKRT batched OPRF, one OPRF instance per bin plus a sender hint, and inherit its related-key and leakage relaxations.","resultId":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","target":"PSI-CONTRIB-2017-KMPRT-OPPRF","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D1A6C04E9AD47D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","target":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D23BFA8662B48F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-PSZ","target":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D29B119D5404FB","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-CHLR","target":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D3E3B0265FABD9","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","target":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D434EA34063E7E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","target":"PSI-PAPER-2021-NTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D440B9F66A4C82","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","target":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D520C3F689627C","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-ION-DDH","target":"PSI-ASSUMPTION-DDH-AND-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-RANDOM-ORACLE-MODEL-PAILLIER-WITH-DAMG-RD-JURIK-IN-DEPLOYMENT","type":"RELIES_ON"},{"evidenceLocator":"RS21 §1.4 (p. 6); §6 (pp. 22-23); Table 4 (p. 29), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-D574B7ABCCB8A4","note":"VOLE-PSI's circuit-PSI keeps the PSTY19 protocol and replaces its polynomial-based OPPRF with one built from the VOLE OPRF and XoPaXoS; for \\( 2^{20} \\) items it runs in 23.3 s against 72.0 s at 5 Gbps with IKNP-based GMW.","resultId":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","target":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D5DFF532A4C7D0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D602B8C9D9CF5A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2017-KMPRT","target":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D71164527456C2","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","target":"PSI-PAPER-2021-NTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D734B5F88B72AA","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","target":"PSI-ASSUMPTION-OBLIVIOUS-TRANSFER-OR-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-ANY-ASSUMPTION-IMPLYING-SECURE-COMPUTATION","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D74E2465FB9B8F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","target":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D7DC2F4823B2A9","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-BASIC","target":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"CHLR18 §1.3 (p. 3) and §5.1 (pp. 11-12), IACR ePrint 2018/787, PDF dated 2018-08-27","evidenceUrl":"https://eprint.iacr.org/2018/787","id":"PSI-REL-D86F7502610F13","note":"CHLR18 extends the CLR17 protocol to labeled PSI: the sender additionally evaluates a label-interpolation polynomial per bin, keeping communication sublinear in the sender's set.","resultId":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","target":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","type":"EXTENDS"},{"evidenceLocator":"GS23 §1.2 (p. 2) and §3.1 (p. 10), IACR ePrint 2023/919, PDF dated 2023-06-12","evidenceUrl":"https://eprint.iacr.org/2023/919","id":"PSI-REL-D8748195710498","note":"GS23 follows the GS19 split into a cardinality test and an intersection step, and instantiates the inner two-party test of its compiler with the GS19 cardinality test, adapted to secret-shared output and run at logarithmic thresholds.","resultId":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","target":"PSI-CONTRIB-2023-GS-PICT-COMPILER","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D8A66D1244E786","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","target":"PSI-PAPER-2017-KMPRT","type":"DESCRIBED_IN"},{"evidenceLocator":"NTY §2 (pp. 4-5), Protocol 4.2 (p. 10), §5 (p. 11), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidenceUrl":"https://eprint.iacr.org/2021/1221","id":"PSI-REL-D9031CE7805242","note":"NTY take the OPPRF definitions almost verbatim from KMPRT and run an OPPRF from each of t parties to P_n inside ZeroXOR.","resultId":"PSI-CONTRIB-2017-KMPRT-OPPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-KMPRT-OPPRF","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-D9A9832C02564F","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2010-DT-FIG3","target":"PSI-CONTRIB-2010-DT-LINEAR-APSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DA64E354B0D9BE","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2020-PRTY","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DABFF319A31613","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2019-PSTY","target":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DB1F0DA6F08D29","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","target":"PSI-PAPER-2021-GPRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DB3E20D69EBAC0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"PSWW18 abstract (p. 1), §1.4 (p. 5), and §6.2 (pp. 21-22), IACR ePrint 2018/120, PDF dated 2019-01-24","evidenceUrl":"https://eprint.iacr.org/2018/120","id":"PSI-REL-DC005BBC68544C","note":"Mirror cuckoo hashing reduces the comparisons of circuit-based PSI from the \\( O(n \\log n) \\) of the sort-compare-shuffle circuit to \\( \\omega(n) \\).","resultId":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","target":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DC24661E80FE2A","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","target":"PSI-CONTRIB-2023-GS-PICT-COMPILER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DC4AF7618A53D3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-1999-HFH","target":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DD55CA24721F33","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-GC","target":"PSI-PAPER-2019-KRSSW","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-DD766D6377461D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","target":"PSI-PAPER-2020-PRTY","type":"DESCRIBED_IN"},{"evidenceLocator":"GPRTY21 §1.1 (p. 3); §2.1-2.3 (pp. 5-6), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-DF0EFAA989A483","note":"The OKVS definition generalizes PaXoS from binary to linear and other key-value encodings and makes obliviousness explicit; a binary OKVS is a PaXoS.","resultId":"PSI-CONTRIB-2020-PRTY-PAXOS","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-PAXOS","target":"PSI-CONTRIB-2021-GPRTY-OKVS","type":"GENERALIZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E0A1A0C5960639","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","target":"PSI-PAPER-2017-RR-CCS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E11696FDE933A6","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E17848EC6CD828","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2004-FNP","target":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E1978DBB4E2947","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","target":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E38409EC829384","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR","target":"PSI-PAPER-2018-CHLR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E4767DD1EC29C3","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","target":"PSI-PAPER-2017-KMPRT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2022-RR-MAL--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2022-RR-MAL","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E518ECD93FC8FD","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-NR","target":"PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E526B100447AB5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-PSZ","target":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY--RELIES_ON--ASM-PRF","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","target":"ASM-PRF","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E590CC24E78773","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RT-SH-V2","target":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E7E575525A3B31","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","target":"PSI-PAPER-2021-BMRR","type":"DESCRIBED_IN"},{"evidenceLocator":"BMRR §1.1 (p. 2) and §2.3 (p. 6), IACR ePrint 2020/600, PDF dated 2021-02-25","evidenceUrl":"https://eprint.iacr.org/2020/600","id":"PSI-REL-E80F7DCBAEF828","note":"BMRR generalize the two-party threshold PSI functionality of GS19 to two multiparty functionalities that coincide for two parties.","resultId":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","target":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","type":"GENERALIZES"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E8579D423BF124","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-ION-DDH","target":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E89917946A7E50","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","target":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-E916112EC59937","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","target":"PSI-PAPER-2004-FNP","type":"DESCRIBED_IN"},{"evidenceLocator":"CMGD21 §1.2 (p. 3) and §3.1 (pp. 7-8), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidenceUrl":"https://eprint.iacr.org/2021/1116","id":"PSI-REL-E9579E75D343E2","note":"CMGD21 replaces computing all powers up to the partition size, as in the CLR17 framework retained by CHLR18, with Paterson-Stockmeyer evaluation, reducing non-scalar multiplications per bin from linear to \\( O(\\sqrt{B}) \\).","resultId":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","target":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EA925B91DF5519","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-MAL","target":"PSI-PAPER-2022-RR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EAAB075E71CC49","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-LABELED","target":"PSI-PAPER-2017-CLR","type":"DESCRIBED_IN"},{"evidenceLocator":"NTY §2.0.4 (p. 5), Protocol 4.4 (p. 10), §5 (p. 11), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidenceUrl":"https://eprint.iacr.org/2021/1221","id":"PSI-REL-EAD3970580F753","note":"Each client sends the pivot a single OKVS encoding its items instead of running pairwise OPPRFs, using the OKVS definition of Garimella et al. and PaXoS as the instance they prove oblivious.","resultId":"PSI-CONTRIB-2021-GPRTY-OKVS","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2021-GPRTY-OKVS","target":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EAE455543FE3BD","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EB330AA9E4BD38","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-CONG","target":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EB54F1DD25536D","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL","target":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"GPRTY21 §6.3 (p. 19); §8.2 (p. 23); Table 1 (p. 24), IACR ePrint 2021/883, PDF dated 2021-11-30","evidenceUrl":"https://eprint.iacr.org/2021/883","id":"PSI-REL-EB6E1EF5A2618C","note":"Used as the binary OKVS of PaXoS-PSI, the three-hash table reduces the malicious protocol's communication 1.61 times for \\( 2^{20} \\) items, because \\( 1.3n \\) OTs replace \\( 2.4n \\).","resultId":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","target":"PSI-CONTRIB-2021-GPRTY-3H-GCT","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EB6FFD28C1CA0B","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","target":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EBC3E600697B09","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","target":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-VOLE-FROM-LPN-WITH-REGULAR-NOISE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EBDDAA81A382A5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2010-DT","target":"PSI-CONTRIB-2010-DT-BLIND-RSA","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EC964FE7D7F65E","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2010-DT","target":"PSI-CONTRIB-2010-DT-LINEAR-APSI","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-ED6DAFCD6056D0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-CHLR","target":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-ED8AF909AFBB5C","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-LABELED","target":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-EE1CC77B8F29E0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR","target":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F0D4ABC91A3DF4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","target":"PSI-PAPER-2021-BMRR","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F1311457EFEDFB","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-GPRTY","target":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F1C963A551B37A","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH","target":"PSI-ASSUMPTION-CODE-CORRELATION-ROBUST-HASH-IN-THE-OOS-OT-EXTENSION-HYBRID-MODEL","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F2B58A02B398EA","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2021-GPRTY","target":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F3062CE0894AB5","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-LABELED","target":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F30F101043C447","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","target":"PSI-PAPER-2018-PSWW","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F351AEE7355C61","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2012-HEK","target":"PSI-CONTRIB-2012-HEK-SIZE-AUDITING","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F3C3BE20D24FD8","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","target":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-SILVER-FOR-SILENT-OT-AND-VOLE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F3FD18059A5B25","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","target":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F58BAF5A30E4B0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2017-RR-CCS","target":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","type":"HAS_RESULT"},{"evidenceLocator":"RT21 §1 (p. 2), §1.2 (pp. 5-6), Table 1 (p. 4), IACR ePrint 2021/1159, version of October 17, 2021","evidenceUrl":"https://eprint.iacr.org/2021/1159","id":"PSI-REL-F5A28C177EF706","note":"RT21's semi-honest variants send one key-agreement message, one field element per receiver item, and one short key per sender item, against the classic Diffie-Hellman protocol's group element per item in both directions, which RT21 names as the protocol it improves.","resultId":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","target":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F5AD070E232121","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2022-RR","target":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS--RELIES_ON--ASM-ROM","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","target":"ASM-ROM","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F66163F5C1D7F9","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","target":"PSI-PAPER-2021-RS","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F7DFEC2FE37AC4","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2016-KKRT","target":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"Ion et al. §3.1 (p. 5) and §4.2 (p. 8), IACR ePrint 2019/723, PDF dated 2020-09-05","evidenceUrl":"https://eprint.iacr.org/2019/723","id":"PSI-REL-F8488203CA27FD","note":"Ion et al. extend the shuffled commutative-exponentiation intersection-cardinality protocol of Huberman, Franklin, and Hogg with additively homomorphic tags so that one party also learns the sum of values over the intersection.","resultId":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","target":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","type":"EXTENDS"},{"evidenceLocator":"PSTY19 §6 (pp. 21-22), IACR ePrint 2019/241, PDF dated 2019-02-28","evidenceUrl":"https://eprint.iacr.org/2019/241","id":"PSI-REL-F86920DE99826B","note":"Payloads are injected with a second batched OPPRF whose targets differ per item, XORing the bin mask with each item's payload.","resultId":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","target":"PSI-CONTRIB-2019-PSTY-PAYLOAD","type":"BUILDS_ON_MECHANISM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-F94EF5A6ABA660","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","target":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"GS19 §1 (p. 2), IACR ePrint 2019/175, PDF dated 2020-05-27","evidenceUrl":"https://eprint.iacr.org/2019/175","id":"PSI-REL-FB172D2D1D1503","note":"GS19 lists PSWW18 among threshold PSI solutions whose communication scales at least linearly in the smaller set, and gives protocols whose communication depends mainly on t.","resultId":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","target":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","type":"IMPROVES_EFFICIENCY"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED--RELIES_ON--ASM-PRF","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","target":"ASM-PRF","type":"RELIES_ON"},{"evidenceLocator":"RS21 §2, Eq. (1) and Conjecture 2.1 (pp. 11-12); Lemma 3.3 (p. 18), IACR ePrint 2021/266, PDF dated 2024-08-08","evidenceUrl":"https://eprint.iacr.org/2021/266","id":"PSI-REL-FC77068F4FA440","note":"The malicious-receiver proof of the VOLE-based OPRF uses the PaXoS bound to limit the receiver's effective set to \\( O(n) \\), and conjectures a tighter bound of m.","resultId":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","reviewStatus":"fulltext_checked","source":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","target":"PSI-CONTRIB-2021-RS-VOLE-OPRF","type":"BUILDS_ON_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FCA61E024C6030","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-PAPER-2018-PSWW","target":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","type":"HAS_RESULT"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FCC099F6F6D7F7","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2012-HEK-BWA","target":"PSI-PAPER-2012-HEK","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FCFCEFC1501349","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","target":"PSI-ASSUMPTION-PROGRAMMABLE-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FD3B00A7E55EBC","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","target":"PSI-PAPER-2021-CONG","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FD45F24E2405F1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-SH","target":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FDC6BBF6AC4938","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2022-RR-MAL","target":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FDCA3FB76C8EE0","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2010-DT-FIG3","target":"PSI-PAPER-2010-DT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FDD830B6DE5565","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2021-RT-SH-V1","target":"PSI-ASSUMPTION-CDH-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","type":"RELIES_ON"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FDD8768C5E0E96","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2019-KRSSW-GC","target":"PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FE0B739C0449A1","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2017-KMPRT-AUG","target":"PSI-PAPER-2016-KKRT","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FF4DED52C351BD","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2021-CONG","target":"PSI-PAPER-2021-CONG","type":"DESCRIBED_IN"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FF9D4CFEA76803","note":"","resultId":null,"reviewStatus":"source_declared","source":"PSI-CONSTRUCTION-2020-PRTY-SH","target":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","type":"SUPPORTED_BY_CLAIM"},{"evidenceLocator":"","evidenceUrl":"","id":"PSI-REL-FFFAB00864F09A","note":"","resultId":null,"reviewStatus":"scheme_declared","source":"PSI-CONSTRUCTION-2017-RR-CCS-SM","target":"PSI-ASSUMPTION-PRF-CORRELATION-ROBUST-HASH-AND-ACTIVELY-SECURE-OT-EXTENSION-WITHOUT-RANDOM-ORACLES","type":"RELIES_ON"}],"nodes":[{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-YAO-GARBLED-CIRCUITS-NO-FURTHER-ASSUMPTION-STATED-FOR-THE-TWO-PARTY-CASE","keywords":["generic"],"metadata":{"family":"generic","name":"Additively homomorphic encryption and Yao garbled circuits; no further assumption stated for the two-party case"},"primaryUrl":null,"sections":[],"slug":"additively-homomorphic-encry","status":"catalogued","subtitle":"generic","summary":"Assumption used by one or more PSI construction records: Additively homomorphic encryption and Yao garbled circuits; no further assumption stated for the two-party case.","title":"Additively homomorphic encryption and Yao garbled circuits; no further assumption stated for the two-party case","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-YAO-GARBLED-CIRCUITS-NO-FURTHER-ASSUMPTION-STATED-FOR-THE-TWO-PARTY-CASE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-CDH-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","keywords":["discrete_log"],"metadata":{"family":"discrete_log","name":"CDH with elligator encoding, ideal permutation, and random oracles"},"primaryUrl":null,"sections":[],"slug":"cdh-with-elligator-encoding","status":"catalogued","subtitle":"discrete_log","summary":"Assumption used by one or more PSI construction records: CDH with elligator encoding, ideal permutation, and random oracles.","title":"CDH with elligator encoding, ideal permutation, and random oracles","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-CDH-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-CODE-CORRELATION-ROBUST-HASH-IN-THE-OOS-OT-EXTENSION-HYBRID-MODEL","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"Code-correlation-robust hash, in the OOS OT-extension hybrid model"},"primaryUrl":null,"sections":[],"slug":"code-correlation-robust-hash","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: Code-correlation-robust hash, in the OOS OT-extension hybrid model.","title":"Code-correlation-robust hash, in the OOS OT-extension hybrid model","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-CODE-CORRELATION-ROBUST-HASH-IN-THE-OOS-OT-EXTENSION-HYBRID-MODEL"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-BATCHED-RANDOM-OT","keywords":["generic"],"metadata":{"family":"generic","name":"CPA-secure additively homomorphic encryption and batched random OT"},"primaryUrl":null,"sections":[],"slug":"cpa-secure-additively-homomo","status":"catalogued","subtitle":"generic","summary":"Assumption used by one or more PSI construction records: CPA-secure additively homomorphic encryption and batched random OT.","title":"CPA-secure additively homomorphic encryption and batched random OT","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-BATCHED-RANDOM-OT"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-EXPONENTIAL-ELGAMAL-AND-RING-LWE-IN-THE-MEASUREMENTS","keywords":["generic"],"metadata":{"family":"generic","name":"CPA-secure additively homomorphic encryption (exponential ElGamal and Ring-LWE in the measurements)"},"primaryUrl":null,"sections":[],"slug":"cpa-secure-additively-homomo-2","status":"catalogued","subtitle":"generic","summary":"Assumption used by one or more PSI construction records: CPA-secure additively homomorphic encryption (exponential ElGamal and Ring-LWE in the measurements).","title":"CPA-secure additively homomorphic encryption (exponential ElGamal and Ring-LWE in the measurements)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-EXPONENTIAL-ELGAMAL-AND-RING-LWE-IN-THE-MEASUREMENTS"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-DDH-AND-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-RANDOM-ORACLE-MODEL-PAILLIER-WITH-DAMG-RD-JURIK-IN-DEPLOYMENT","keywords":["discrete_log"],"metadata":{"family":"discrete_log","name":"DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)"},"primaryUrl":null,"sections":[],"slug":"ddh-and-cpa-secure","status":"catalogued","subtitle":"discrete_log","summary":"Assumption used by one or more PSI construction records: DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment).","title":"DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-DDH-AND-CPA-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-RANDOM-ORACLE-MODEL-PAILLIER-WITH-DAMG-RD-JURIK-IN-DEPLOYMENT"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-DECISIONAL-DIFFIE-HELLMAN-FOR-THE-OBLIVIOUS-TRANSFER-IN-THE-RANDOM-ORACLE-MODEL-WITH-AN-UNNAMED-HOMOMORPHIC-ENCRYPTION-SCHEME","keywords":["discrete_log"],"metadata":{"family":"discrete_log","name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model, with an unnamed homomorphic encryption scheme"},"primaryUrl":null,"sections":[],"slug":"decisional-diffie-hellman-fo","status":"catalogued","subtitle":"discrete_log","summary":"Assumption used by one or more PSI construction records: Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model, with an unnamed homomorphic encryption scheme.","title":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model, with an unnamed homomorphic encryption scheme","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-DECISIONAL-DIFFIE-HELLMAN-FOR-THE-OBLIVIOUS-TRANSFER-IN-THE-RANDOM-ORACLE-MODEL-WITH-AN-UNNAMED-HOMOMORPHIC-ENCRYPTION-SCHEME"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-HAMMING-CORRELATION-ROBUST-HASH-AND-PSEUDORANDOM-CODE-WITH-IDEAL-BASE-OTS","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"Hamming correlation-robust hash and pseudorandom code, with ideal base OTs"},"primaryUrl":null,"sections":[],"slug":"hamming-correlation-robust-h","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: Hamming correlation-robust hash and pseudorandom code, with ideal base OTs.","title":"Hamming correlation-robust hash and pseudorandom code, with ideal base OTs","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-HAMMING-CORRELATION-ROBUST-HASH-AND-PSEUDORANDOM-CODE-WITH-IDEAL-BASE-OTS"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-IND-CPA-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PAILLIER-OR-DAMG-RD-JURIK-AND-PASSIVELY-SECURE-OLE","keywords":["generic"],"metadata":{"family":"generic","name":"IND-CPA additively homomorphic encryption (Paillier or Damgård-Jurik) and passively secure OLE"},"primaryUrl":null,"sections":[],"slug":"ind-cpa-additively-homomorph","status":"catalogued","subtitle":"generic","summary":"Assumption used by one or more PSI construction records: IND-CPA additively homomorphic encryption (Paillier or Damgård-Jurik) and passively secure OLE.","title":"IND-CPA additively homomorphic encryption (Paillier or Damgård-Jurik) and passively secure OLE","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-IND-CPA-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PAILLIER-OR-DAMG-RD-JURIK-AND-PASSIVELY-SECURE-OLE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-IND-CPA-LEVELED-FHE-WITH-CIRCUIT-PRIVACY-FV-OVER-RING-LWE","keywords":["lattice"],"metadata":{"family":"lattice","name":"IND-CPA leveled FHE with circuit privacy (FV over Ring-LWE)"},"primaryUrl":null,"sections":[],"slug":"ind-cpa-leveled-fhe","status":"catalogued","subtitle":"lattice","summary":"Assumption used by one or more PSI construction records: IND-CPA leveled FHE with circuit privacy (FV over Ring-LWE).","title":"IND-CPA leveled FHE with circuit privacy (FV over Ring-LWE)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-IND-CPA-LEVELED-FHE-WITH-CIRCUIT-PRIVACY-FV-OVER-RING-LWE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-LOWMC-AS-A-PSEUDORANDOM-FUNCTION-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"LowMC as a pseudorandom function and maliciously secure OT, without a proof"},"primaryUrl":null,"sections":[],"slug":"lowmc-as-a-pseudorandom","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: LowMC as a pseudorandom function and maliciously secure OT, without a proof.","title":"LowMC as a pseudorandom function and maliciously secure OT, without a proof","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-LOWMC-AS-A-PSEUDORANDOM-FUNCTION-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-NAOR-REINGOLD-PRF-OVER-P-256-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF","keywords":["group"],"metadata":{"family":"group","name":"Naor-Reingold PRF over P-256 and maliciously secure OT, without a proof"},"primaryUrl":null,"sections":[],"slug":"naor-reingold-prf-over","status":"catalogued","subtitle":"group","summary":"Assumption used by one or more PSI construction records: Naor-Reingold PRF over P-256 and maliciously secure OT, without a proof.","title":"Naor-Reingold PRF over P-256 and maliciously secure OT, without a proof","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-NAOR-REINGOLD-PRF-OVER-P-256-AND-MALICIOUSLY-SECURE-OT-WITHOUT-A-PROOF"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-NOT-STATED-DISCRETE-LOG-SETTING-MODULO-A-PRIME-WITH-AN-UNPREDICTABLE-HASH","keywords":["discrete_log"],"metadata":{"family":"discrete_log","name":"not stated; discrete-log setting modulo a prime with an unpredictable hash"},"primaryUrl":null,"sections":[],"slug":"not-stated-discrete-log","status":"catalogued","subtitle":"discrete_log","summary":"Assumption used by one or more PSI construction records: not stated; discrete-log setting modulo a prime with an unpredictable hash.","title":"not stated; discrete-log setting modulo a prime with an unpredictable hash","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-NOT-STATED-DISCRETE-LOG-SETTING-MODULO-A-PRIME-WITH-AN-UNPREDICTABLE-HASH"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-OBLIVIOUS-TRANSFER-OR-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-ANY-ASSUMPTION-IMPLYING-SECURE-COMPUTATION","keywords":["generic"],"metadata":{"family":"generic","name":"Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)"},"primaryUrl":null,"sections":[],"slug":"oblivious-transfer-or-additi","status":"catalogued","subtitle":"generic","summary":"Assumption used by one or more PSI construction records: Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation).","title":"Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-OBLIVIOUS-TRANSFER-OR-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-ANY-ASSUMPTION-IMPLYING-SECURE-COMPUTATION"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DH-AND-RANDOM-ORACLES","keywords":["discrete_log"],"metadata":{"family":"discrete_log","name":"One-More-Gap-DH and random oracles"},"primaryUrl":null,"sections":[],"slug":"one-more-gap-dh","status":"catalogued","subtitle":"discrete_log","summary":"Assumption used by one or more PSI construction records: One-More-Gap-DH and random oracles.","title":"One-More-Gap-DH and random oracles","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ONE-MORE-GAP-DH-AND-RANDOM-ORACLES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-H-LIMITED-LEVELED-FHE","keywords":["mixed"],"metadata":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure H-limited leveled FHE"},"primaryUrl":null,"sections":[],"slug":"one-more-gap-diffie","status":"catalogued","subtitle":"mixed","summary":"Assumption used by one or more PSI construction records: One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure H-limited leveled FHE.","title":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure H-limited leveled FHE","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-H-LIMITED-LEVELED-FHE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV","keywords":["mixed"],"metadata":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)"},"primaryUrl":null,"sections":[],"slug":"one-more-gap-diffie-2","status":"catalogued","subtitle":"mixed","summary":"Assumption used by one or more PSI construction records: One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV).","title":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BFV"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BGV","keywords":["mixed"],"metadata":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BGV)"},"primaryUrl":null,"sections":[],"slug":"one-more-gap-diffie-3","status":"catalogued","subtitle":"mixed","summary":"Assumption used by one or more PSI construction records: One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BGV).","title":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BGV)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ONE-MORE-GAP-DIFFIE-HELLMAN-IN-THE-RANDOM-ORACLE-MODEL-AND-SEMANTICALLY-SECURE-LEVELED-FHE-BGV"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ONE-MORE-RSA-INVERSION-AND-RANDOM-ORACLES","keywords":["factoring"],"metadata":{"family":"factoring","name":"one-more RSA inversion and random oracles"},"primaryUrl":null,"sections":[],"slug":"one-more-rsa-inversion","status":"catalogued","subtitle":"factoring","summary":"Assumption used by one or more PSI construction records: one-more RSA inversion and random oracles.","title":"one-more RSA inversion and random oracles","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ONE-MORE-RSA-INVERSION-AND-RANDOM-ORACLES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-AND-RANDOM-ORACLES","keywords":["discrete_log"],"metadata":{"family":"discrete_log","name":"oracle Diffie-Hellman with elligator encoding and random oracles"},"primaryUrl":null,"sections":[],"slug":"oracle-diffie-hellman-with","status":"catalogued","subtitle":"discrete_log","summary":"Assumption used by one or more PSI construction records: oracle Diffie-Hellman with elligator encoding and random oracles.","title":"oracle Diffie-Hellman with elligator encoding and random oracles","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-AND-RANDOM-ORACLES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES","keywords":["discrete_log"],"metadata":{"family":"discrete_log","name":"oracle Diffie-Hellman with elligator encoding, ideal permutation, and random oracles"},"primaryUrl":null,"sections":[],"slug":"oracle-diffie-hellman-with-2","status":"catalogued","subtitle":"discrete_log","summary":"Assumption used by one or more PSI construction records: oracle Diffie-Hellman with elligator encoding, ideal permutation, and random oracles.","title":"oracle Diffie-Hellman with elligator encoding, ideal permutation, and random oracles","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ORACLE-DIFFIE-HELLMAN-WITH-ELLIGATOR-ENCODING-IDEAL-PERMUTATION-AND-RANDOM-ORACLES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"Orrù-Orsini-Scholl OT extension in the programmable random oracle model"},"primaryUrl":null,"sections":[],"slug":"orr-orsini-scholl-ot","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: Orrù-Orsini-Scholl OT extension in the programmable random oracle model.","title":"Orrù-Orsini-Scholl OT extension in the programmable random oracle model","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-AN-IDEAL-TWO-PARTY-PSI-FUNCTIONALITY","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"PRF and random oracle, with OKVS obliviousness and an ideal two-party PSI functionality"},"primaryUrl":null,"sections":[],"slug":"prf-and-random-oracle","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: PRF and random oracle, with OKVS obliviousness and an ideal two-party PSI functionality.","title":"PRF and random oracle, with OKVS obliviousness and an ideal two-party PSI functionality","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-AN-IDEAL-TWO-PARTY-PSI-FUNCTIONALITY"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-IDEAL-OPPRF-AND-ZERO-SHARING-FUNCTIONALITIES","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"PRF and random oracle, with OKVS obliviousness and ideal OPPRF and zero-sharing functionalities"},"primaryUrl":null,"sections":[],"slug":"prf-and-random-oracle-2","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: PRF and random oracle, with OKVS obliviousness and ideal OPPRF and zero-sharing functionalities.","title":"PRF and random oracle, with OKVS obliviousness and ideal OPPRF and zero-sharing functionalities","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-OKVS-OBLIVIOUSNESS-AND-IDEAL-OPPRF-AND-ZERO-SHARING-FUNCTIONALITIES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF"},"primaryUrl":null,"sections":[],"slug":"prf-and-random-oracle-3","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF.","title":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-PRF-AND-RANDOM-ORACLE-WITH-THE-OPPRF-INSTANTIATED-FROM-THE-KKRT-BATCHED-OPRF"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-PRF-CORRELATION-ROBUST-HASH-AND-ACTIVELY-SECURE-OT-EXTENSION-WITHOUT-RANDOM-ORACLES","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"PRF, correlation-robust hash, and actively secure OT extension, without random oracles"},"primaryUrl":null,"sections":[],"slug":"prf-correlation-robust-hash","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: PRF, correlation-robust hash, and actively secure OT extension, without random oracles.","title":"PRF, correlation-robust hash, and actively secure OT extension, without random oracles","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-PRF-CORRELATION-ROBUST-HASH-AND-ACTIVELY-SECURE-OT-EXTENSION-WITHOUT-RANDOM-ORACLES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-PROGRAMMABLE-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","keywords":["idealized_model"],"metadata":{"family":"idealized_model","name":"Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise"},"primaryUrl":null,"sections":[],"slug":"programmable-random-oracles","status":"catalogued","subtitle":"idealized_model","summary":"Assumption used by one or more PSI construction records: Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise.","title":"Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-PROGRAMMABLE-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-RANDOM-ORACLE-COMMITMENT-H-X-R-AND-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"random-oracle commitment \\( H(x \\| r) \\) and Orrù-Orsini-Scholl OT extension in the programmable random oracle model"},"primaryUrl":null,"sections":[],"slug":"random-oracle-commitment-h","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: random-oracle commitment \\( H(x \\| r) \\) and Orrù-Orsini-Scholl OT extension in the programmable random oracle model.","title":"random-oracle commitment \\( H(x \\| r) \\) and Orrù-Orsini-Scholl OT extension in the programmable random oracle model","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-RANDOM-ORACLE-COMMITMENT-H-X-R-AND-ORR-ORSINI-SCHOLL-OT-EXTENSION-IN-THE-PROGRAMMABLE-RANDOM-ORACLE-MODEL"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-SILVER-FOR-SILENT-OT-AND-VOLE","keywords":["idealized_model"],"metadata":{"family":"idealized_model","name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; Silver for silent OT and VOLE"},"primaryUrl":null,"sections":[],"slug":"random-oracles-in-the","status":"catalogued","subtitle":"idealized_model","summary":"Assumption used by one or more PSI construction records: Random oracles, in the OPPRF and generic two-party computation hybrid models; Silver for silent OT and VOLE.","title":"Random oracles, in the OPPRF and generic two-party computation hybrid models; Silver for silent OT and VOLE","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-SILVER-FOR-SILENT-OT-AND-VOLE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-VOLE-FROM-LPN-WITH-REGULAR-NOISE","keywords":["idealized_model"],"metadata":{"family":"idealized_model","name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise"},"primaryUrl":null,"sections":[],"slug":"random-oracles-in-the-2","status":"catalogued","subtitle":"idealized_model","summary":"Assumption used by one or more PSI construction records: Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise.","title":"Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-OPPRF-AND-GENERIC-TWO-PARTY-COMPUTATION-HYBRID-MODELS-VOLE-FROM-LPN-WITH-REGULAR-NOISE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-SUBFIELD-VOLE-HYBRID-MODEL-VOLE-FOLLOWING-COUTEAU-RINDAL-RAGHURAMAN-2021-AND-BOYLE-ET-AL-2019","keywords":["idealized_model"],"metadata":{"family":"idealized_model","name":"Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019"},"primaryUrl":null,"sections":[],"slug":"random-oracles-in-the-3","status":"catalogued","subtitle":"idealized_model","summary":"Assumption used by one or more PSI construction records: Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019.","title":"Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-SUBFIELD-VOLE-HYBRID-MODEL-VOLE-FOLLOWING-COUTEAU-RINDAL-RAGHURAMAN-2021-AND-BOYLE-ET-AL-2019"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE","keywords":["idealized_model"],"metadata":{"family":"idealized_model","name":"Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise"},"primaryUrl":null,"sections":[],"slug":"random-oracles-in-the-4","status":"catalogued","subtitle":"idealized_model","summary":"Assumption used by one or more PSI construction records: Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise.","title":"Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-RANDOM-ORACLES-IN-THE-VECTOR-OLE-HYBRID-MODEL-VOLE-FROM-LPN-WITH-REGULAR-NOISE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-RANDOM-OT-EXTENSION-WITH-A-HASH-MODELED-AS-A-RANDOM-ORACLE","keywords":["symmetric"],"metadata":{"family":"symmetric","name":"random OT extension with a hash modeled as a random oracle"},"primaryUrl":null,"sections":[],"slug":"random-ot-extension-with","status":"catalogued","subtitle":"symmetric","summary":"Assumption used by one or more PSI construction records: random OT extension with a hash modeled as a random oracle.","title":"random OT extension with a hash modeled as a random oracle","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-RANDOM-OT-EXTENSION-WITH-A-HASH-MODELED-AS-A-RANDOM-ORACLE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE","keywords":["additively_homomorphic"],"metadata":{"family":"additively_homomorphic","name":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)"},"primaryUrl":null,"sections":[],"slug":"semantic-security-of-an","status":"catalogued","subtitle":"additively_homomorphic","summary":"Assumption used by one or more PSI construction records: semantic security of an additively homomorphic encryption scheme (Paillier named as an instance).","title":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-SEMANTIC-SECURITY-OF-AN-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-SCHEME-PAILLIER-NAMED-AS-AN-INSTANCE"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-RANDOM-ORACLES","keywords":["additively_homomorphic"],"metadata":{"family":"additively_homomorphic","name":"semantically secure additively homomorphic encryption and random oracles"},"primaryUrl":null,"sections":[],"slug":"semantically-secure-additive","status":"catalogued","subtitle":"additively_homomorphic","summary":"Assumption used by one or more PSI construction records: semantically secure additively homomorphic encryption and random oracles.","title":"semantically secure additively homomorphic encryption and random oracles","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-AND-RANDOM-ORACLES"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PSEUDORANDOM-FUNCTION-AND-COLLISION-RESISTANT-HASH","keywords":["additively_homomorphic"],"metadata":{"family":"additively_homomorphic","name":"semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash"},"primaryUrl":null,"sections":[],"slug":"semantically-secure-additive-2","status":"catalogued","subtitle":"additively_homomorphic","summary":"Assumption used by one or more PSI construction records: semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash.","title":"semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-SEMANTICALLY-SECURE-ADDITIVELY-HOMOMORPHIC-ENCRYPTION-PSEUDORANDOM-FUNCTION-AND-COLLISION-RESISTANT-HASH"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-SEMI-HONEST-GENERIC-TWO-PARTY-COMPUTATION-GMW-OR-YAO-NO-ASSUMPTION-STATED","keywords":["generic"],"metadata":{"family":"generic","name":"Semi-honest generic two-party computation (GMW or Yao); no assumption stated"},"primaryUrl":null,"sections":[],"slug":"semi-honest-generic-two","status":"catalogued","subtitle":"generic","summary":"Assumption used by one or more PSI construction records: Semi-honest generic two-party computation (GMW or Yao); no assumption stated.","title":"Semi-honest generic two-party computation (GMW or Yao); no assumption stated","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-SEMI-HONEST-GENERIC-TWO-PARTY-COMPUTATION-GMW-OR-YAO-NO-ASSUMPTION-STATED"},{"evidence":"scheme_declared","id":"PSI-ASSUMPTION-THRESHOLD-FHE-WITH-DISTRIBUTED-SETUP-FROM-CIRCULAR-SECURE-LWE-WITH-THRESHOLD-ADDITIVELY-HOMOMORPHIC-ENCRYPTION","keywords":["lattice"],"metadata":{"family":"lattice","name":"Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption"},"primaryUrl":null,"sections":[],"slug":"threshold-fhe-with-distribut","status":"catalogued","subtitle":"lattice","summary":"Assumption used by one or more PSI construction records: Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption.","title":"Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-ASSUMPTION-THRESHOLD-FHE-WITH-DISTRIBUTED-SETUP-FROM-CIRCULAR-SECURE-LWE-WITH-THRESHOLD-ADDITIVELY-HOMOMORPHIC-ENCRYPTION"},{"contributions":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-1999-HFH","keywords":["two-party matching count","commutative_exponentiation","no-trusted-third-party","matching-count"],"metadata":{"assumption":{"family":"discrete_log","name":"not stated; discrete-log setting modulo a prime with an unpredictable hash"},"attributes":{"adversary":{"locator":"Appendix A, p. 85","note":"No adversary model; a zero-knowledge proof against active cheating is suggested but not given","value":"not_reported"},"assumptions":{"locator":"§2, p. 79; Appendix A, p. 85","note":"Only the discrete-log setting modulo a prime and a hash whose output cannot be influenced or predicted are stated","value":"not_reported"},"output":{"locator":"Appendix A, step 5, p. 85","note":"Each party counts the matches between the doubly exponentiated, permuted lists","value":["cardinality"]},"output_to":{"locator":"Appendix A, step 5, p. 85","value":"all"},"parties":{"locator":"Appendix A, p. 85","value":"two_party"},"security_model":{"locator":"Appendix A, p. 85","note":"No proof is given for the protocol","value":"not_reported"},"set_size_regime":{"locator":"Appendix A, steps 1-4, p. 85","note":"Lists of any lengths are exchanged in full; nothing exploits one larger list","value":"balanced"},"technique":{"locator":"Appendix A, p. 85","note":"The authors relate it to Diffie-Hellman key exchange","value":["diffie_hellman"]}},"capabilities":["no-trusted-third-party","matching-count"],"claim_ids":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"],"construction_family":"commutative_exponentiation","costs":[{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated","subject":"sender","tip":"Sender is Alice and receiver is Bob; the protocol is symmetric and both learn the count."},{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"computation","note":"Its own hashed items, then the other party's values, each with its secret exponent","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Appendix A, step 1, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"computation","note":"Its own hashed items, then the other party's values, each with its secret exponent","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Appendix A, step 2, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-1999-HFH","name":"HFH preference matching","paper_ids":["PSI-PAPER-1999-HFH"],"primitive":"two-party matching count","schedule":[{"from":"sender","id":"own_a","locator":"Appendix A, step 1, p. 85","phase":"online","what":"Alice's hashed items to her secret exponent, permuted"},{"from":"receiver","id":"own_b","locator":"Appendix A, step 2, p. 85","phase":"online","what":"Bob's hashed items to his secret exponent, permuted"},{"after":["own_b"],"from":"sender","id":"re_a","locator":"Appendix A, step 3, p. 85","phase":"online","what":"Bob's values raised again to her exponent, permuted"},{"after":["own_a"],"from":"receiver","id":"re_b","locator":"Appendix A, step 4, p. 85","phase":"online","what":"Alice's values raised again to his exponent, permuted"}],"security":{"mode":"not_reported","model":"no adversary model or proof is given for the protocol (Appendix A, p. 85)","notion":"not stated in the paper"},"status":"published","title":"HFH private preference matching by exponentiation of hashed items modulo a prime","work_id":"PSI-PAPER-1999-HFH","year":1999},"primaryUrl":"https://doi.org/10.1145/336992.337012","sections":[{"content":"Two-party preference matching by commutative exponentiation: each party raises its hashed items to a secret exponent modulo a prime, the other re-exponentiates them, and both count equal values in the permuted lists. Permuting every list hides which items match, so each party learns only the number of matches.","heading":"Summary"}],"slug":"hfh99-hfh-preference-matching","status":"fulltext_checked","subtitle":"two-party matching count · 1999","summary":"Two-party preference matching by commutative exponentiation: each party raises its hashed items to a secret exponent modulo a prime, the other re-exponentiates them, and both count equal values in the permuted lists. Permuting every list hides which items match, so each party learns only the number of matches.","title":"HFH preference matching","type":"construction","venue":"ACM EC 1999","year":1999,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-1999-HFH"},{"contributions":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","keywords":["two-party matching count","commutative_exponentiation","no-trusted-third-party","matching-count"],"metadata":{"assumption":{"family":"discrete_log","name":"not stated; discrete-log setting modulo a prime with an unpredictable hash"},"attributes":{"adversary":{"locator":"Appendix A, p. 85","note":"No adversary model; a zero-knowledge proof against active cheating is suggested but not given","value":"not_reported"},"assumptions":{"locator":"§2, p. 79; Appendix A, p. 85","note":"Only the discrete-log setting modulo a prime and a hash whose output cannot be influenced or predicted are stated","value":"not_reported"},"output":{"locator":"Appendix A, p. 85","note":"Without permutation in steps 3 and 4 each party learns exactly which items are shared","value":["intersection"]},"output_to":{"locator":"Appendix A, p. 85","value":"all"},"parties":{"locator":"Appendix A, p. 85","value":"two_party"},"security_model":{"locator":"Appendix A, p. 85","note":"No proof is given for the protocol","value":"not_reported"},"set_size_regime":{"locator":"Appendix A, steps 1-4, p. 85","note":"Lists of any lengths are exchanged in full; nothing exploits one larger list","value":"balanced"},"technique":{"locator":"Appendix A, p. 85","note":"The authors relate it to Diffie-Hellman key exchange","value":["diffie_hellman"]}},"capabilities":["no-trusted-third-party","matching-count"],"claim_ids":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"],"construction_family":"commutative_exponentiation","costs":[{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated in order","subject":"sender","tip":"Sender is Alice and receiver is Bob; the protocol is symmetric and both learn the intersection."},{"basis":"counted","formula":"\\( (n_X+n_Y)|\\mathbb{G}| \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"communication","note":"Residues modulo the prime: its own hashed items exponentiated, then the other list re-exponentiated in order","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 1 and 3, p. 85","measure":"computation","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Appendix A, step 1, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Appendix A, steps 2 and 4, p. 85","measure":"computation","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Appendix A, step 2, p. 85","measure":"computation","note":"One hash of each of its own items","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","name":"HFH intersection variant","paper_ids":["PSI-PAPER-1999-HFH"],"primitive":"two-party matching count","schedule":[{"from":"sender","id":"own_a","locator":"Appendix A, step 1, p. 85","phase":"online","what":"Alice's hashed items to her secret exponent, permuted"},{"from":"receiver","id":"own_b","locator":"Appendix A, step 2, p. 85","phase":"online","what":"Bob's hashed items to his secret exponent, permuted"},{"after":["own_b"],"from":"sender","id":"re_a","locator":"Appendix A, step 3, p. 85","phase":"online","what":"Bob's values raised again to her exponent, in the order received"},{"after":["own_a"],"from":"receiver","id":"re_b","locator":"Appendix A, step 4, p. 85","phase":"online","what":"Alice's values raised again to his exponent, in the order received"}],"security":{"mode":"not_reported","model":"no adversary model or proof is given for the protocol (Appendix A, p. 85)","notion":"not stated in the paper"},"status":"published","title":"HFH set intersection by exponentiation of hashed items modulo a prime, without permuting the returned lists","work_id":"PSI-PAPER-1999-HFH","year":1999},"primaryUrl":"https://doi.org/10.1145/336992.337012","sections":[{"content":"The variation of HFH preference matching in which the doubly exponentiated lists are returned in the order received, so each party learns which of its own items are shared rather than only how many. It is the Diffie-Hellman-style intersection protocol later PSI work traces to this paper.","heading":"Summary"}],"slug":"hfh99-hfh-intersection-variant","status":"fulltext_checked","subtitle":"two-party matching count · 1999","summary":"The variation of HFH preference matching in which the doubly exponentiated lists are returned in the order received, so each party learns which of its own items are shared rather than only how many. It is the Diffie-Hellman-style intersection protocol later PSI work traces to this paper.","title":"HFH intersection variant","type":"construction","venue":"ACM EC 1999","year":1999,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-1999-HFH-INTERSECTION"},{"contributions":["PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","keywords":["psi cardinality","oblivious_polynomial_evaluation"],"metadata":{"assumption":{"family":"additively_homomorphic","name":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)"},"attributes":{"adversary":{"locator":"§4.4, p. 9","note":"Security follows from that of the base protocol, the paper says","value":["semi_honest"]},"assumptions":{"locator":"§3.3, pp. 4-5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","value":["DCR"]},"output":{"locator":"§3.1, p. 3; §4.4, p. 9","value":["cardinality"]},"output_to":{"locator":"§4.4, p. 9","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"§4.3, pp. 8-9; §4.4, p. 9","value":["standard model"]},"set_size_regime":{"locator":"§4.2, p. 8; §4.4, p. 9","note":"Costs grow with both sets, as in the base protocol","value":"balanced"},"technique":{"locator":"§4.2, p. 7; §4.4, p. 9","note":"Hashing to bins is carried over from the base protocol, which the paper optimizes this way","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing"]}},"capabilities":[],"claim_ids":["PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD"],"construction_family":"oblivious_polynomial_evaluation","costs":[{"basis":"counted","formula":"\\( 4n_X|\\mathbb{Z}_N| \\)","locator":"§4.2, p. 7; §4.4, p. 9","measure":"communication","note":"One ciphertext per candidate bin of each item, now encrypting a fixed string; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{2n_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\kappa \\)","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, pp. 7-8; §4.4, p. 9","measure":"communication","note":"The \\( M+1 \\) encrypted coefficients of each bin polynomial, her public key, and a key for the bin hash, taken as \\( \\kappa \\) bits","subject":"receiver"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-8; §4.4, p. 9","measure":"computation","note":"Per item and each of its two bins, \\( M \\) short exponentiations by Horner's rule and one full-length one by \\( r \\)","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7; §4.4, p. 9","measure":"computation","note":"Homomorphic additions, per item and bin: \\( M \\) in Horner's rule and one adding the encrypted fixed string","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"§4.4, p. 9","measure":"computation","note":"Encrypting the fixed string of zeros for each of its two answers","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, naming its two bins","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{n_Y(M+1)}{\\ln\\ln n_Y}+2n_X \\)","locator":"Protocol PM-Semi-Honest, steps 1(c) and 3, p. 6; §4.2, pp. 7-8; §4.4, p. 9","measure":"computation","note":"Encrypting every coefficient of the bin polynomials, then decrypting both answers for each sender item and counting the fixed strings","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O\\left(\\frac{n_YM^2}{\\ln\\ln n_Y}\\right) \\)","locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §4.2, p. 7","measure":"computation","note":"Coefficients of each bin polynomial from its roots, \\( O(M^2) \\) for degree \\( M \\); the paper does not fix the method","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, placing it in the less loaded of its two bins","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","name":"FNP \\( \\mathrm{PM}_C \\) (cardinality)","paper_ids":["PSI-PAPER-2004-FNP"],"primitive":"PSI cardinality","schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, p. 7","phase":"online","what":"public key, bin-hash key and the encrypted coefficients of the bin polynomials"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.4, p. 9","phase":"online","what":"both answers for each item, encrypting the fixed string, permuted"}],"security":{"mode":"computational","model":"semi-honest, standard model, by the proof of PM-Semi-Honest (§4.4, p. 9)","notion":"the client learns \\( \\lvert X \\cap Y \\rvert \\) only"},"status":"published","title":"FNP semi-honest PSI cardinality from oblivious polynomial evaluation with a constant payload","variables":[{"meaning":"Degree of each bin polynomial, the maximum bin load, \\( O(\\ln\\ln n_Y) \\)","symbol":"M"}],"work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Private cardinality matching: the FNP semi-honest protocol with the server encrypting a fixed string of zeros instead of its item, so the client learns only how many of her decryptions equal that string, the size of the intersection.","heading":"Summary"}],"slug":"fnp04-fnp-mathrm-pm-c","status":"fulltext_checked","subtitle":"PSI cardinality · 2004","summary":"Private cardinality matching: the FNP semi-honest protocol with the server encrypting a fixed string of zeros instead of its item, so the client learns only how many of her decryptions equal that string, the size of the intersection.","title":"FNP \\( \\mathrm{PM}_C \\) (cardinality)","type":"construction","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2004-FNP-CARDINALITY"},{"contributions":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","keywords":["two-party psi","oblivious_polynomial_evaluation"],"metadata":{"assumption":{"family":"additively_homomorphic","name":"semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash"},"attributes":{"adversary":{"locator":"§5.1, pp. 10-11; footnote 11, p. 11","note":"A malicious server cannot affect the client's privacy here, the paper notes, but can break correctness","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"Protocol PM-Malicious-Client, step 1, p. 10; footnote 10, p. 11","note":"Paillier is the named homomorphic instance","value":["DCR","PRF","CRHF"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"footnote 4, p. 2; §5, p. 10","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"Protocol PM-Malicious-Client, p. 10; §5.1, p. 11","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing","cut_and_choose"]}},"capabilities":[],"claim_ids":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"construction_family":"oblivious_polynomial_evaluation","costs":[{"basis":"counted","formula":"\\( 2Ln_X|\\mathbb{Z}_N|+L \\)","locator":"Protocol PM-Malicious-Client, steps 2 and 4-5, p. 10","measure":"communication","note":"A challenge naming the copies to open, then one ciphertext per item, candidate bin and evaluated copy; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{3Ln_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\left(\\frac{L}{2}+1\\right)\\kappa \\)","locator":"Protocol PM-Malicious-Client, steps 1 and 3, p. 10; §4.2, pp. 7-8","measure":"communication","note":"\\( L \\) copies of the encrypted bin polynomials, then openings of half and the PRF keys of the rest; plus her public key and the hash key","subject":"receiver"},{"basis":"counted","formula":"\\( L(M+1)n_X \\)","locator":"Protocol PM-Malicious-Client, step 4, p. 10; §4.2, pp. 6-8","measure":"computation","note":"Per item, both bins in each of the \\( L/2 \\) evaluated copies: \\( M \\) short exponentiations by Horner's rule and one full-length one","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( L(M+1)n_X \\)","locator":"Protocol PM-Malicious-Client, step 4, p. 10; §4.2, pp. 6-7","measure":"computation","note":"Homomorphic additions, per answer: \\( M \\) in Horner's rule and one adding the encrypted share","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( Ln_X+\\frac{Ln_Y(M+1)}{2\\ln\\ln n_Y} \\)","locator":"Protocol PM-Malicious-Client, steps 3-4, p. 10","measure":"computation","note":"One encrypted share per answer, and re-encrypting the opened coefficients to check them; the check of the roots is not specified","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{L}{2}+2\\right)n_X \\)","locator":"Protocol PM-Malicious-Client, steps 1 and 4, p. 10","measure":"computation","note":"Per item, the collision-resistant hash and the bin hash, then its pseudo-identity under each revealed key","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{Ln_Y(M+1)}{\\ln\\ln n_Y}+Ln_X \\)","locator":"Protocol PM-Malicious-Client, steps 1 and 5, p. 10; §4.2, pp. 7-8","measure":"computation","note":"Encrypting the coefficients of all \\( L \\) copies, then decrypting every answer","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O\\left(\\frac{Ln_YM^2}{\\ln\\ln n_Y}\\right) \\)","locator":"Protocol PM-Malicious-Client, step 1, p. 10; §4.2, p. 7","measure":"computation","note":"Coefficients of each bin polynomial of each copy from its roots, \\( O(M^2) \\) for degree \\( M \\)","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( (L+2)n_Y \\)","locator":"Protocol PM-Malicious-Client, step 1, p. 10","measure":"computation","note":"Per item, the collision-resistant hash and the bin hash, then its pseudo-identity under each of the \\( L \\) keys","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","name":"FNP PM-Malicious-Client","paper_ids":["PSI-PAPER-2004-FNP"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"copies","locator":"Protocol PM-Malicious-Client, step 1, p. 10","phase":"online","what":"bin-hash key, public key and the \\( L \\) encrypted copies of the bin polynomials"},{"after":["copies"],"from":"sender","id":"challenge","locator":"Protocol PM-Malicious-Client, step 2, p. 10","phase":"online","what":"which \\( L/2 \\) copies to open"},{"after":["challenge"],"from":"receiver","id":"open","locator":"Protocol PM-Malicious-Client, step 3, p. 10","phase":"online","what":"openings of the chosen copies and the PRF keys of the others"},{"after":["open"],"from":"sender","id":"answers","locator":"Protocol PM-Malicious-Client, steps 4-5, p. 10","phase":"online","what":"the answers of each item in the unopened copies, as shares of the item"}],"security":{"mode":"computational","model":"malicious client, standard model (footnote 4, p. 2; §5, p. 10; proof sketch, p. 11)","notion":"private matching with the client's effective input bounded by \\( n_Y \\) items"},"status":"published","title":"FNP PSI secure against a malicious client by cut-and-choose over bin polynomials","variables":[{"meaning":"Number of cut-and-choose copies; the error is exponentially small in \\( L \\)","symbol":"L"},{"meaning":"Degree of each bin polynomial, the maximum bin load, \\( O(\\ln\\ln n_Y) \\)","symbol":"M"}],"work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"FNP private matching secure against a malicious client: she sends \\( L \\) copies of her bin polynomials over pseudorandom identities, the server opens half to check they hold at most \\( n_Y \\) nonzero roots, and evaluates the rest with XOR shares of each item as payloads, so an item is learned only if it is a root of every copy.","heading":"Summary"}],"slug":"fnp04-fnp-pm-malicious-client","status":"fulltext_checked","subtitle":"two-party PSI · 2004","summary":"FNP private matching secure against a malicious client: she sends \\( L \\) copies of her bin polynomials over pseudorandom identities, the server opens half to check they hold at most \\( n_Y \\) nonzero roots, and evaluates the rest with XOR shares of each item as payloads, so an item is learned only if it is a root of every copy.","title":"FNP PM-Malicious-Client","type":"construction","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT"},{"contributions":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","keywords":["two-party psi","oblivious_polynomial_evaluation"],"metadata":{"assumption":{"family":"additively_homomorphic","name":"semantically secure additively homomorphic encryption, pseudorandom function, and collision-resistant hash"},"attributes":{"adversary":{"locator":"§5.1, pp. 10-11","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"§3.3, pp. 4-5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","value":["DCR"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"footnote 4, p. 2; §5.1, p. 11","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"§5.1, p. 11","value":["oblivious_polynomial_evaluation"]}},"capabilities":[],"claim_ids":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"construction_family":"oblivious_polynomial_evaluation","costs":[{"basis":"counted","formula":"\\( 2n_X|\\mathbb{Z}_N| \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6","measure":"communication","note":"One ciphertext per item; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( (2n_Y+1)|\\mathbb{Z}_N| \\)","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §5.1, p. 11","measure":"communication","note":"Her public key and the encrypted coefficients of one degree-\\( n_Y \\) polynomial, whose constant term is fixed to one and not sent","subject":"receiver"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7","measure":"computation","note":"Per item, \\( n_Y \\) short exponentiations by Horner's rule and one full-length one","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7; §5.1, p. 11","measure":"computation","note":"Homomorphic additions, per item: \\( n_Y \\) in Horner's rule, the last adding the known constant term, and one adding the encrypted item","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Protocol PM-Semi-Honest, step 2(b), p. 6","measure":"computation","note":"Encrypting each item for its answer","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( n_X+n_Y \\)","locator":"Protocol PM-Semi-Honest, steps 1 and 3, p. 6","measure":"computation","note":"Encrypting the coefficients and decrypting the replies","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O(n_Y^2) \\)","locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §5.1, p. 11","measure":"computation","note":"Coefficients of the polynomial from its roots, scaled so the constant term is one; the paper does not fix the method","operation":"field_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","name":"FNP malicious client without hashing","paper_ids":["PSI-PAPER-2004-FNP"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §5.1, p. 11","phase":"online","what":"public key and the encrypted coefficients of one polynomial, its constant term fixed to one"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Semi-Honest, step 2, p. 6","phase":"online","what":"one answer per item, permuted"}],"security":{"mode":"computational","model":"malicious client, standard model (footnote 4, p. 2; §5, p. 10; proof sketch, p. 11)","notion":"private matching with the client's effective input bounded by \\( n_Y \\) items"},"status":"published","title":"FNP PSI secure against a malicious client by one polynomial whose constant term is fixed and nonzero","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"The simple malicious-client protocol FNP describe before the hashed one: PM-Semi-Honest without bins, with the polynomial's constant term fixed to one so that it cannot be identically zero and has at most \\( n_Y \\) roots.","heading":"Summary"}],"slug":"fnp04-fnp-malicious-client-without","status":"fulltext_checked","subtitle":"two-party PSI · 2004","summary":"The simple malicious-client protocol FNP describe before the hashed one: PM-Semi-Honest without bins, with the polynomial's constant term fixed to one so that it cannot be identically zero and has at most \\( n_Y \\) roots.","title":"FNP malicious client without hashing","type":"construction","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH"},{"contributions":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","keywords":["two-party psi","oblivious_polynomial_evaluation"],"metadata":{"assumption":{"family":"additively_homomorphic","name":"semantically secure additively homomorphic encryption and random oracles"},"attributes":{"adversary":{"locator":"§5.2, p. 11; Lemma 4, p. 12","note":"The server's privacy is preserved as in the semi-honest protocol","value":{"receiver":"semi_honest","sender":"malicious"}},"assumptions":{"locator":"§3.3, pp. 4-5; Protocol PM-Malicious-Server, p. 12","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance","value":["DCR"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; Lemma 4 and proof sketch, pp. 12-13","note":"The simulator extracts the server's input from its oracle queries","value":["random oracle"]},"set_size_regime":{"locator":"Protocol PM-Malicious-Server, p. 12","value":"balanced"},"technique":{"locator":"Protocol PM-Malicious-Server, p. 12","value":["oblivious_polynomial_evaluation"]}},"capabilities":[],"claim_ids":["PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"],"construction_family":"oblivious_polynomial_evaluation","costs":[{"basis":"counted","formula":"\\( n_X(2|\\mathbb{Z}_N|+\\tau) \\)","locator":"Protocol PM-Malicious-Server, step 2, p. 12","measure":"communication","note":"A ciphertext and a random-oracle output for each item, permuted; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( (2n_Y+3)|\\mathbb{Z}_N| \\)","locator":"Protocol PM-Malicious-Server, step 1, p. 12","measure":"communication","note":"Her public key and the encrypted coefficients of one degree-\\( n_Y \\) polynomial","subject":"receiver"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Malicious-Server, step 2, p. 12; §4.2, pp. 6-7","measure":"computation","note":"No bins: per item, \\( n_Y \\) short exponentiations by Horner's rule and one full-length one, all derandomized","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)n_X \\)","locator":"Protocol PM-Malicious-Server, step 2(b), p. 12; §4.2, pp. 6-7","measure":"computation","note":"Homomorphic additions, per item: \\( n_Y \\) in Horner's rule and one adding the encrypted seed","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Protocol PM-Malicious-Server, step 2(b), p. 12","measure":"computation","note":"Encrypting the random seed of each item, with randomness derived from it","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Protocol PM-Malicious-Server, step 2, p. 12","measure":"computation","note":"Per item, one call to each random oracle","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)\\min(n_X,n_Y) \\)","locator":"Protocol PM-Malicious-Server, step 3(b), p. 12","measure":"computation","note":"Re-running the server's derandomized evaluation for each reply whose hash matches one of her items, counted for the largest possible intersection","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( (n_Y+1)\\min(n_X,n_Y) \\)","locator":"Protocol PM-Malicious-Server, step 3(b), p. 12","measure":"computation","note":"The homomorphic additions of each re-run evaluation","operation":"hom_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+n_Y+1+\\min(n_X,n_Y) \\)","locator":"Protocol PM-Malicious-Server, steps 1 and 3, p. 12","measure":"computation","note":"Encrypting the coefficients, decrypting each reply, and re-encrypting the seed in each re-run evaluation","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O(n_Y^2) \\)","locator":"Protocol PM-Malicious-Server, step 1(b), p. 12","measure":"computation","note":"Coefficients of the polynomial from its roots; the paper does not fix the method","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_X(n_Y+1) \\)","locator":"Protocol PM-Malicious-Server, step 3, p. 12","measure":"computation","note":"Per reply, the first random oracle on the decrypted seed and the second on each of her items, to find the one it fits","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","name":"FNP PM-Malicious-Server","paper_ids":["PSI-PAPER-2004-FNP"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Malicious-Server, step 1, p. 12","phase":"online","what":"public key and the encrypted coefficients of the polynomial"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Malicious-Server, step 2, p. 12","phase":"online","what":"one ciphertext and one random-oracle output per item, permuted"}],"security":{"mode":"computational","model":"malicious server, random oracle model (Lemma 4 and proof sketch, pp. 12-13)","notion":"private matching against a malicious server, with the server's input extracted from its random-oracle queries"},"status":"published","title":"FNP PSI secure against a malicious server by random-oracle derandomization of replies","variables":[{"meaning":"Output length of the random oracle \\( H_2 \\), not fixed by the paper","symbol":"\\tau"}],"work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"FNP private matching secure against a malicious server in the random oracle model: for each item the server derives all its randomness from \\( H_1(s) \\) for a random \\( s \\) and returns \\( \\mathrm{Enc}(r'\\cdot P(y)+s) \\) with \\( H_2(r'',y) \\), so the client can check that each reply is what an honest server would send for one of her items.","heading":"Summary"}],"slug":"fnp04-fnp-pm-malicious-server","status":"fulltext_checked","subtitle":"two-party PSI · 2004","summary":"FNP private matching secure against a malicious server in the random oracle model: for each item the server derives all its randomness from \\( H_1(s) \\) for a random \\( s \\) and returns \\( \\mathrm{Enc}(r'\\cdot P(y)+s) \\) with \\( H_2(r'',y) \\), so the client can check that each reply is what an honest server would send for one of her items.","title":"FNP PM-Malicious-Server","type":"construction","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2004-FNP-MAL-SERVER"},{"contributions":["PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","keywords":["multiparty psi","oblivious_polynomial_evaluation"],"metadata":{"assumption":{"family":"additively_homomorphic","name":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)"},"attributes":{"adversary":{"locator":"§7, p. 15","value":["semi_honest"]},"assumptions":{"locator":"§3.3, pp. 4-5; §7, step 1, p. 16","note":"Any semantically secure additively homomorphic scheme, a key pair per client; Paillier is the named instance","value":["DCR"]},"corruptions":{"locator":"§7, p. 16","note":"Stated informally: values outside the intersection look random to any coalition; no proof","value":"\\( t_c < \\ell \\)"},"output":{"locator":"§7, p. 15","value":["intersection"]},"output_to":{"locator":"§7, step 4, p. 16","note":"Every party checks the published row values against its own items","value":"all"},"parties":{"locator":"§7, p. 15","value":"multiparty"},"security_model":{"locator":"§7, pp. 15-17","note":"The protocol is sketched without proof","value":"not_reported"},"set_size_regime":{"locator":"§7, p. 15","note":"Each list holds \\( n \\) items, without loss of generality","value":"balanced"},"technique":{"locator":"§7, steps 1-4, p. 16","value":["oblivious_polynomial_evaluation","secret_sharing"]}},"capabilities":[],"claim_ids":["PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE"],"construction_family":"oblivious_polynomial_evaluation","costs":[{"basis":"counted","formula":"\\( (2n\\ell+n+3)|\\mathbb{Z}_N| \\)","locator":"§7, steps 1 and 3, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(a), p. 6","measure":"communication","note":"Her public key; then \\( n+1 \\) encrypted coefficients and \\( n(\\ell-1) \\) encrypted zero shares, posted once; then \\( n \\) row XORs at plaintext width","subject":"client"},{"basis":"counted","formula":"\\( 2n(\\ell-1)|\\mathbb{Z}_N| \\)","locator":"§7, step 2, p. 16","measure":"communication","note":"\\( n \\) permuted tuples of one ciphertext per client, posted once","subject":"leader"},{"basis":"counted","formula":"\\( n(n+1)(\\ell-1) \\)","locator":"§7, step 2, p. 16; §4.2, pp. 6–7; p. 17","measure":"computation","note":"Per item and client, \\( n \\) short exponentiations by Horner's rule and one by a fresh random multiplier; hashing to bins would lower this","operation":"exponentiation","subject":"leader"},{"basis":"counted","formula":"\\( n(n+1)(\\ell-1) \\)","locator":"§7, step 2, p. 16; §4.2, pp. 6–7","measure":"computation","note":"Homomorphic additions per item and client: \\( n \\) in Horner's rule and one adding the encrypted share of the item","operation":"hom_op","subject":"leader"},{"basis":"counted","formula":"\\( n(\\ell-1) \\)","locator":"§7, step 2, p. 16","measure":"computation","note":"Encrypting each item's share for each client, under that client's key","operation":"enc_dec","subject":"leader"},{"basis":"counted","formula":"\\( 2n\\ell+1 \\)","locator":"§7, steps 1 and 3, p. 16","measure":"computation","note":"Encrypts \\( n+1 \\) coefficients and \\( n(\\ell-1) \\) zero shares, then decrypts her column from the leader and from every client, her own included","operation":"enc_dec","subject":"client"},{"basis":"counted","formula":"\\( O(n^{2}) \\)","locator":"§7, step 1, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(b), p. 6","measure":"computation","note":"Coefficients of her polynomial from its roots, \\( O(n^{2}) \\) for degree \\( n \\); the paper does not fix the method","operation":"field_op","subject":"client"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","name":"FNP multi-party PM","paper_ids":["PSI-PAPER-2004-FNP"],"primitive":"multiparty PSI","schedule":[{"from":"client","id":"keys","locator":"§7, steps 1–2, p. 16; §4.1, Protocol PM-Semi-Honest, step 1(a), p. 6","phase":"online","what":"each client's public key, which the others encrypt her column under"},{"after":["keys"],"from":"client","id":"post","locator":"§7, step 1, p. 16","phase":"online","what":"the encrypted coefficients of her polynomial and her zero-XOR shares, each column under its client's key"},{"after":["keys","post"],"from":"leader","id":"tuples","locator":"§7, step 2, p. 16","phase":"online","what":"the permuted tuples, each item's share for every client under that client's key"},{"after":["post","tuples"],"from":"client","id":"rows","locator":"§7, step 3, p. 16","phase":"online","what":"the XOR of each row of her decrypted column"}],"security":{"mode":"computational","model":"semi-honest; no proof is given (§7, pp. 15-17)","notion":"each party learns the intersection of all \\( \\ell \\) lists"},"status":"published","title":"FNP semi-honest multi-party PSI from encrypted client polynomials and XOR-shared payloads","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"FNP's sketch of multiparty PSI: the clients post encrypted polynomials and encrypted zero-XOR share matrices, the leader evaluates each client's polynomial at its items with XOR shares of the item as payloads, and the clients publish row XORs from which every party reads off the intersection.","heading":"Summary"}],"slug":"fnp04-fnp-multi-party-pm","status":"fulltext_checked","subtitle":"multiparty PSI · 2004","summary":"FNP's sketch of multiparty PSI: the clients post encrypted polynomials and encrypted zero-XOR share matrices, the leader evaluates each client's polynomial at its items with XOR shares of the item as payloads, and the clients publish row XORs from which every party reads off the intersection.","title":"FNP multi-party PM","type":"construction","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2004-FNP-MULTIPARTY"},{"contributions":["PSI-CONTRIB-2004-FNP-OPE-PSI","PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-SH","keywords":["two-party psi","oblivious_polynomial_evaluation","payload-transfer"],"metadata":{"assumption":{"family":"additively_homomorphic","name":"semantic security of an additively homomorphic encryption scheme (Paillier named as an instance)"},"attributes":{"adversary":{"locator":"§3.2, p. 4; §4.3, pp. 8-9","value":["semi_honest"]},"assumptions":{"locator":"§3.3, pp. 4-5; footnote 8, p. 5","note":"Any semantically secure additively homomorphic scheme; Paillier is the named instance, El Gamal an alternative","value":["DCR"]},"output":{"locator":"§3.1, p. 3","value":["intersection"]},"output_to":{"locator":"§3.1, p. 3","note":"The client","value":"one"},"parties":{"locator":"§3.1, p. 3","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; §4.3, pp. 8-9","value":["standard model"]},"set_size_regime":{"locator":"Abstract, p. 1; §4.2, p. 8","note":"Costs grow with both sets; the abstract states them for two lists of the same length","value":"balanced"},"technique":{"locator":"§4.1, p. 5; §4.2, p. 7","value":["oblivious_polynomial_evaluation","balanced_allocation_hashing"]}},"capabilities":["payload-transfer"],"claim_ids":["PSI-CONTRIB-2004-FNP-OPE-PSI","PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING"],"construction_family":"oblivious_polynomial_evaluation","costs":[{"basis":"counted","formula":"\\( 4n_X|\\mathbb{Z}_N| \\)","locator":"§4.2, p. 7","measure":"communication","note":"One ciphertext per candidate bin of each of its items; a Paillier ciphertext lies in \\( \\mathbb{Z}_{N^2} \\)","subject":"sender"},{"basis":"counted","formula":"\\( \\left(\\frac{2n_Y(M+1)}{\\ln\\ln n_Y}+1\\right)|\\mathbb{Z}_N|+\\kappa \\)","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, pp. 7-8","measure":"communication","note":"The \\( M+1 \\) encrypted coefficients of each bin polynomial, her public key, and a key for the bin hash, taken as \\( \\kappa \\) bits","subject":"receiver"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-8","measure":"computation","note":"Per item and each of its two bins, \\( M \\) short exponentiations by Horner's rule and one full-length one by \\( r \\)","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( 2(M+1)n_X \\)","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, pp. 6-7","measure":"computation","note":"Homomorphic additions, per item and bin: \\( M \\) in Horner's rule and one adding the encrypted item","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Protocol PM-Semi-Honest, step 2(b), p. 6; §4.2, p. 7","measure":"computation","note":"Encrypting the item, with any payload, for each of its two answers","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, naming its two bins","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{n_Y(M+1)}{\\ln\\ln n_Y}+2n_X \\)","locator":"Protocol PM-Semi-Honest, steps 1(c) and 3, p. 6; §4.2, pp. 7-8","measure":"computation","note":"Encrypting every coefficient of the bin polynomials, then decrypting both answers for each sender item","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O\\left(\\frac{n_YM^2}{\\ln\\ln n_Y}\\right) \\)","locator":"Protocol PM-Semi-Honest, step 1(b), p. 6; §4.2, p. 7","measure":"computation","note":"Coefficients of each bin polynomial from its roots, \\( O(M^2) \\) for degree \\( M \\); the paper does not fix the method","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.2, p. 7","measure":"computation","note":"The bin hash of each item, placing it in the less loaded of its two bins","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2004-FNP-SH","name":"FNP PM-Semi-Honest with balanced allocations","paper_ids":["PSI-PAPER-2004-FNP"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"coeffs","locator":"Protocol PM-Semi-Honest, step 1, p. 6; §4.2, p. 7","phase":"online","what":"public key, bin-hash key and the encrypted coefficients of the bin polynomials"},{"after":["coeffs"],"from":"sender","id":"answers","locator":"Protocol PM-Semi-Honest, step 2, p. 6; §4.2, p. 7","phase":"online","what":"both answers for each item, one per candidate bin, permuted"}],"security":{"mode":"computational","model":"semi-honest, standard model (Lemmas 1-3, p. 8; §4.3, p. 9)","notion":"private matching: the client learns \\( X \\cap Y \\); client privacy by indistinguishability, server privacy by comparison with the ideal model"},"status":"published","title":"FNP semi-honest PSI from oblivious polynomial evaluation with balanced-allocation hashing","variables":[{"meaning":"Degree of each bin polynomial, the maximum bin load, \\( O(\\ln\\ln n_Y) \\)","symbol":"M"}],"work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"The client encodes her set as the roots of polynomials, one per bin of a balanced-allocation hash, and sends their encrypted coefficients; the server evaluates the two candidate bin polynomials homomorphically at each of its items and returns encryptions of \\( r\\cdot P(y)+y \\), which decrypt to \\( y \\) exactly for shared items.","heading":"Summary"}],"slug":"fnp04-fnp-pm-semi-honest","status":"fulltext_checked","subtitle":"two-party PSI · 2004","summary":"The client encodes her set as the roots of polynomials, one per bin of a balanced-allocation hash, and sends their encrypted coefficients; the server evaluates the two candidate bin polynomials homomorphically at each of its items and returns encryptions of \\( r\\cdot P(y)+y \\), which decrypt to \\( y \\) exactly for shared items.","title":"FNP PM-Semi-Honest with balanced allocations","type":"construction","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2004-FNP-SH"},{"contributions":["PSI-CONTRIB-2010-DT-BLIND-RSA"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","keywords":["two-party psi","rsa_blind_signature","server-precomputation","no-online-client-exponentiation"],"metadata":{"assumption":{"family":"factoring","name":"one-more RSA inversion and random oracles"},"attributes":{"adversary":{"locator":"§5.1, p. 6; Appendix B.3, p. 16","note":"Honest-but-curious client and server; malicious proofs left to future work","value":["semi_honest"]},"assumptions":{"locator":"Appendix B.3, p. 16","note":"One-More-RSA, which has no registry card; the RSA assumption is weaker than the one used","value":["one-more RSA"]},"output":{"locator":"§2, p. 2; Figure 4, p. 9","value":["intersection"]},"output_to":{"locator":"§2, p. 2","note":"The client; mutual PSI by two one-way runs","value":"one"},"parties":{"locator":"§2, p. 2","value":"two_party"},"security_model":{"locator":"Appendix B.3, p. 16; Table 2, p. 11","value":["random oracle"]},"set_size_regime":{"locator":"Table 2, p. 11","value":"balanced"},"technique":{"locator":"§5.6, p. 9","value":["rsa_blind_signature"]}},"capabilities":["server-precomputation","no-online-client-exponentiation"],"claim_ids":["PSI-CONTRIB-2010-DT-BLIND-RSA"],"construction_family":"rsa_blind_signature","costs":[{"basis":"counted","formula":"\\( n_Y|\\mathbb{Z}_N| + n_X\\kappa \\)","locator":"Figure 4, step 5, p. 9","measure":"communication","note":"The signed blinded values, and one security-parameter-length tag per item","subject":"sender"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{Z}_N| \\)","locator":"Figure 4, step 3, p. 9","measure":"communication","note":"One blinded hash per item","subject":"receiver"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 4, step 1, p. 9; §5.6, p. 9","measure":"computation","note":"RSA signatures with the private exponent; reusable while the key and set are unchanged","operation":"exponentiation","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Figure 4, inputs and step 1, p. 9","measure":"computation","note":"Hashing each item, then hashing its signature into a tag","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 4, p. 9; Table 2, p. 11","measure":"computation","note":"Signing each blinded value with the full-length private exponent","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"Figure 4, step 2, p. 9; §5.6, p. 9","measure":"computation","note":"Blinding: a random factor to the small public exponent, then one multiplication, per item","operation":"modmul","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, inputs, p. 9","measure":"computation","note":"Hashing each item","operation":"symmetric_op","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 6, p. 9; §5.6, p. 9","measure":"computation","note":"Unblinding: one division by the blinding factor per item, whose inverse can be computed offline; no online exponentiation","operation":"modmul","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 6, p. 9","measure":"computation","note":"One tag hash per unblinded signature","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","name":"DT10 blind-RSA PSI","paper_ids":["PSI-PAPER-2010-DT"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"blinded","locator":"Figure 4, step 3, p. 9","phase":"online","what":"the blinded hashes"},{"after":["blinded"],"from":"sender","id":"reply","locator":"Figure 4, steps 4-5, p. 9","phase":"online","what":"the signed blinded values and the precomputed tags"}],"security":{"mode":"computational","model":"honest-but-curious, random oracle model, one-more-RSA (Appendix B.3, p. 16)","notion":"server privacy, client privacy, and client unlinkability; no server unlinkability"},"status":"published","title":"De Cristofaro-Tsudik semi-honest PSI from RSA blind signatures with server precomputation","work_id":"PSI-PAPER-2010-DT","year":2010},"primaryUrl":"https://eprint.iacr.org/2009/491","sections":[{"content":"One-way PSI from RSA blind signatures: the server publishes hashes of its RSA signatures on its hashed items, and the client obtains signatures on her own hashed items blindly, unblinds, hashes and compares. The server signs its set offline and the client does no online exponentiation.","heading":"Summary"}],"slug":"dt10-dt10-blind-rsa-psi","status":"fulltext_checked","subtitle":"two-party PSI · 2010","summary":"One-way PSI from RSA blind signatures: the server publishes hashes of its RSA signatures on its hashed items, and the client obtains signatures on her own hashed items blindly, unblinds, hashes and compares. The server signs its set offline and the client does no online exponentiation.","title":"DT10 blind-RSA PSI","type":"construction","venue":"FC 2010","year":2010,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2010-DT-BLIND-RSA"},{"contributions":["PSI-CONTRIB-2010-DT-LINEAR-APSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2010-DT-FIG3","keywords":["two-party psi","prime_order_group_exponentiation","server-unlinkability","server-precomputation"],"metadata":{"assumption":{"family":"discrete_log","name":"One-More-Gap-DH and random oracles"},"attributes":{"adversary":{"locator":"§5.1, p. 6; Appendix B.2, p. 15","note":"Honest-but-curious client and server; malicious proofs left to future work","value":["semi_honest"]},"assumptions":{"locator":"Appendix B.2, pp. 15-16","note":"With one extra DH-oracle query in the reduction","value":["One-More-Gap-DH"]},"output":{"locator":"§2, p. 2; Figure 3, p. 8","value":["intersection"]},"output_to":{"locator":"§2, p. 2","note":"The client; mutual PSI by two one-way runs","value":"one"},"parties":{"locator":"§2, p. 2","value":"two_party"},"security_model":{"locator":"Appendix B.2, p. 15; Table 2, p. 11","value":["random oracle"]},"set_size_regime":{"locator":"Table 2, p. 11","value":"balanced"},"technique":{"locator":"Figure 3, p. 8","note":"Hashed items raised to the server's secret exponent in a prime-order subgroup; the paper does not say Diffie-Hellman","value":["diffie_hellman"]}},"capabilities":["server-unlinkability","server-precomputation"],"claim_ids":["PSI-CONTRIB-2010-DT-LINEAR-APSI"],"construction_family":"prime_order_group_exponentiation","costs":[{"basis":"counted","formula":"\\( (n_Y+1)|\\mathbb{G}| + n_X\\kappa \\)","locator":"Figure 3, step 4, p. 8","measure":"communication","note":"Its key share, the exponentiated blinded values, and one security-parameter-length tag per item","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+1)|\\mathbb{G}| \\)","locator":"Figure 3, step 2, p. 8","measure":"communication","note":"The blinded product of hashes and one blinded value per item","subject":"receiver"},{"basis":"counted","formula":"\\( n_X+1 \\)","locator":"§5.5, p. 8; Table 2, p. 11","measure":"computation","note":"Precomputing each hashed item to the power of minus its fresh secret, and its key share; short exponents","operation":"exponentiation","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 3, inputs, p. 8; §5.5, p. 8","measure":"computation","note":"Hashing each of its items","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_Y+1 \\)","locator":"Figure 3, step 3, p. 8; Table 2, p. 11","measure":"computation","note":"Each blinded value and the blinded product; the paper states \\( O(n_Y) \\) exponentiations with 160-bit exponents","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 3, step 3, p. 8; §5.5, p. 8","measure":"computation","note":"One multiplication per tag, the exponentiated blinded product times the precomputed item power","operation":"modmul","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 3, step 3, p. 8","measure":"computation","note":"One hash per tag","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y+2 \\)","locator":"Figure 3, steps 1 and 5, p. 8; Table 2, p. 11","measure":"computation","note":"Blinding and unblinding; the paper states \\( O(n_Y) \\) exponentiations with 160-bit exponents","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 5, p. 8","measure":"computation","note":"The product of the hashes, the quotients, blinding and unblinding, each quotient counted as one multiplication by an inverse","operation":"modmul","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 3, inputs and step 5, p. 8","measure":"computation","note":"Hashing each item, then one tag hash per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2010-DT-FIG3","name":"DT10 PSI (Figure 3)","paper_ids":["PSI-PAPER-2010-DT"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"blinded","locator":"Figure 3, steps 1-2, p. 8","phase":"online","what":"the blinded product of hashes X and the blinded values y_i"},{"after":["blinded"],"from":"sender","id":"reply","locator":"Figure 3, steps 3-4, p. 8","phase":"online","what":"Z, the exponentiated blinded values and the tags"}],"security":{"mode":"computational","model":"honest-but-curious, random oracle model; the server-privacy reduction to One-More-Gap-DH uses one additional DH-oracle query (Appendix B.2, pp. 15-16)","notion":"server privacy, client privacy, client and server unlinkability"},"status":"published","title":"De Cristofaro-Tsudik semi-honest PSI with linear complexity in a prime-order subgroup","work_id":"PSI-PAPER-2010-DT","year":2010},"primaryUrl":"https://eprint.iacr.org/2009/491","sections":[{"content":"One-way PSI in a prime-order subgroup: the client blinds a product of her item hashes and each of its complements, the server raises them to a fresh secret and sends hashed tags of its own items under the same secret, and the client unblinds and compares tags. Communication and computation are linear in the set sizes.","heading":"Summary"}],"slug":"dt10-dt10-psi-figure-3","status":"fulltext_checked","subtitle":"two-party PSI · 2010","summary":"One-way PSI in a prime-order subgroup: the client blinds a product of her item hashes and each of its complements, the server raises them to a fresh secret and sends hashed tags of its own items under the same secret, and the client unblinds and compares tags. Communication and computation are linear in the set sizes.","title":"DT10 PSI (Figure 3)","type":"construction","venue":"FC 2010","year":2010,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2010-DT-FIG3"},{"contributions":["PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","PSI-CONTRIB-2012-HEK-SIZE-AUDITING"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-BWA","keywords":["two-party psi","garbled_circuit_bit_vector","small-universe"],"metadata":{"assumption":{"family":"discrete_log","name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model"},"attributes":{"adversary":{"locator":"§2, p. 3; §3, pp. 4-5","note":"Unsafe standalone: set sizes are unrestricted, so an all-ones input reveals the other set","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","value":["DDH"]},"output":{"locator":"§3, p. 4","note":"Computed as the bit-vector of the intersection","value":["intersection"]},"output_to":{"locator":"§2, p. 3","note":"Either party, or both, may learn it, as for all the paper's protocols","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§3, p. 4; §4, p. 5","note":"Cost depends on the size of the universe only","value":"not_applicable"},"technique":{"locator":"§2, p. 4; §3, p. 4","value":["garbled_circuits","ot_extension"]}},"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §3, p. 4; Table 1, p. 2","params":{"|C|":"\\( 2^{\\sigma} \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( 2^{\\sigma} \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4; §3, p. 4","note":"One per bit of the evaluator's vector, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["small-universe"],"claim_ids":["PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","PSI-CONTRIB-2012-HEK-SIZE-AUDITING"],"construction_family":"garbled_circuit_bit_vector","costs":[{"basis":"counted","formula":"\\( 2^{\\sigma}\\kappa \\)","locator":"§2, p. 4; §3, p. 4","measure":"communication","note":"The generator's input labels, one per bit of its vector","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, p. 4; §3, p. 4","measure":"communication","note":"Sends only inside the OT extension","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §3, p. 4","measure":"computation","note":"No cryptographic operation outside garbling and the OTs; the bit-vector is built in the clear","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §3, p. 4","measure":"computation","note":"No cryptographic operation outside evaluating the circuit and the OTs","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-BWA","name":"HEK BWA","paper_ids":["PSI-PAPER-2012-HEK"],"primitive":"two-party PSI","schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §3, p. 4","phase":"online","what":"OT extension for the evaluator's input labels; the garbled AND gates ride with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §3, p. 4","phase":"online","what":"the generator's input labels, one per bit of its vector"}],"security":{"mode":"computational","model":"semi-honest two-party; no proof given (§2, p. 4)","notion":"PSI as a bit-vector intersection"},"status":"published","title":"HEK bitwise-AND PSI over a bit-vector of the universe, semi-honest two-party, Yao garbled circuits","work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"PSI for a small universe by Yao's garbled circuits: each set is a bit-vector over the \\( 2^{\\sigma} \\) possible elements and the circuit ANDs the two vectors bit by bit, so the cost is independent of the set sizes.","heading":"Summary"}],"slug":"hek12-hek-bwa","status":"fulltext_checked","subtitle":"two-party PSI · 2012","summary":"PSI for a small universe by Yao's garbled circuits: each set is a bit-vector over the \\( 2^{\\sigma} \\) possible elements and the circuit ANDs the two vectors bit by bit, so the cost is independent of the set sizes.","title":"HEK BWA","type":"construction","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2012-HEK-BWA"},{"contributions":["PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-PWC","keywords":["two-party psi","garbled_circuit_pairwise_comparison","early-reveal"],"metadata":{"assumption":{"family":"discrete_log","name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model"},"attributes":{"adversary":{"locator":"§2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","value":["DDH"]},"output":{"locator":"§2, p. 3; Algorithm 1, p. 5","value":["intersection"]},"output_to":{"locator":"Algorithm 1, p. 5; §4, p. 5","note":"Each match is revealed as soon as it is found","value":"all"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§2, p. 4; §4, p. 5","value":["garbled_circuits","ot_extension"]}},"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"count":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4} \\)","func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §4, p. 5; Algorithm 1, p. 5; Table 1, p. 2","note":"One Equal circuit per comparison; the count is the expected number after shuffling, and at most \\( n^2 \\)","params":{"|C|":"\\( \\sigma-1 \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["early-reveal"],"claim_ids":["PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"construction_family":"garbled_circuit_pairwise_comparison","costs":[{"basis":"counted","formula":"\\( \\sigma n\\kappa \\)","locator":"§2, p. 4; §4, p. 5","measure":"communication","note":"The generator's input labels, one per bit of its set, sent once for all comparisons","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{(2n-\\hat{n})^2+\\hat{n}}{4} \\)","locator":"Algorithm 1, p. 5; §4, p. 5","measure":"communication","note":"One bit per comparison: the Equal output it reveals to the generator, which needs it to choose the next pair","phase":"online","statistic":"expected","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Algorithm 1, p. 5; §4, p. 5","measure":"computation","note":"No cryptographic operation outside garbling and the OTs; permuting its set is done in the clear","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Algorithm 1, p. 5; §4, p. 5","measure":"computation","note":"No cryptographic operation outside evaluating the circuits and the OTs","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-PWC","name":"HEK PWC","paper_ids":["PSI-PAPER-2012-HEK"],"primitive":"two-party PSI","schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §4, p. 5","phase":"online","what":"OT extension for the evaluator's input labels; the garbled Equal circuits ride with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §4, p. 5","phase":"online","what":"the generator's input labels, sent once for all comparisons"},{"after":["ot","labels"],"from":"receiver","id":"reveal","locator":"Algorithm 1, lines 6–7, p. 5; §4, p. 5","phase":"online","what":"the revealed Equal output bits, which tell the generator which pairs remain"}],"security":{"mode":"computational","model":"semi-honest two-party; positional leakage of early reveal is removed by random permutation of the inputs (§4, p. 5); no proof given (§2, p. 4)","notion":"PSI (intersection revealed, nothing else)"},"status":"published","title":"HEK pairwise-comparison PSI with early reveal of matches, semi-honest two-party, Yao garbled circuits","variables":[{"meaning":"Size of the intersection","symbol":"\\hat{n}"}],"work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"PSI by garbled-circuit equality tests on every pair of elements, each match revealed as soon as it is found so that later comparisons with matched elements are skipped; random permutation of the inputs hides the order of the reveals.","heading":"Summary"}],"slug":"hek12-hek-pwc","status":"fulltext_checked","subtitle":"two-party PSI · 2012","summary":"PSI by garbled-circuit equality tests on every pair of elements, each match revealed as soon as it is found so that later comparisons with matched elements are skipped; random permutation of the inputs hides the order of the reveals.","title":"HEK PWC","type":"construction","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2012-HEK-PWC"},{"contributions":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","keywords":["two-party psi","garbled_circuit_sort_compare_shuffle","linear-shuffle"],"metadata":{"assumption":{"family":"discrete_log","name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model, with an unnamed homomorphic encryption scheme"},"attributes":{"adversary":{"locator":"§1.1, p. 2; §2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4; §5.3.2, pp. 8-9","note":"Stated provable from DDH for the Naor-Pinkas OT; the shuffle's homomorphic scheme is not named","value":["DDH"]},"output":{"locator":"Figure 6, p. 9","value":["intersection"]},"output_to":{"locator":"Figure 6, p. 9","note":"Alice; Bob receives nothing or, if desired, the sorted elements","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§5.3.2, pp. 8-9","value":["garbled_circuits","ot_extension","sorting_network","additively_homomorphic_encryption"]}},"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §5.3.2, p. 8; Table 1, p. 2","note":"Alice, who inputs the masks, garbles; Bob evaluates and learns the masked outputs, as Yao's evaluator does","params":{"|C|":"\\( s \\)"},"roles":{"evaluator":"sender","garbler":"receiver"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of Bob's set, for his wire labels as evaluator","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"sender","sender":"receiver"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, run the other way, once per pair of parties","phase":"setup","roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["linear-shuffle"],"claim_ids":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"construction_family":"garbled_circuit_sort_compare_shuffle","costs":[{"basis":"counted","formula":"\\( \\gamma_{\\mathrm{pk}} \\)","locator":"Figure 6, Preparation, p. 9","measure":"communication","note":"Alice's public key; her key generation has no unit of the topic","phase":"setup","subject":"receiver"},{"basis":"counted","formula":"\\( n\\gamma \\)","locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"communication","note":"Bob's \\( n \\) permuted ciphertexts","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n\\gamma + (2\\sigma+\\lambda)n\\kappa \\)","locator":"§2, p. 4; §5.3.2, p. 8; Figure 6, step 1, p. 9","measure":"communication","note":"Her \\( n \\) encrypted masks, and as generator one input label per bit of her set and of her \\( (\\sigma+\\lambda) \\)-bit masks","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"computation","note":"One homomorphic subtraction \\( [[r_i']]\\cdot[[r_i]]^{-1} \\) per element, then a random permutation","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 6, p. 9","measure":"computation","note":"Encrypting his \\( n \\) shares under Alice's key","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Figure 6, p. 9; §5.3.2, p. 9","measure":"computation","note":"Encrypting her \\( n \\) shares, then decrypting the \\( n \\) shuffled ciphertexts","operation":"enc_dec","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","name":"HEK SCS-HE","paper_ids":["PSI-PAPER-2012-HEK"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"pk","locator":"Figure 6, Preparation, p. 9","phase":"setup","what":"Alice's public key, reusable across runs"},{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, run the other way, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §5.3.2, p. 8","phase":"online","what":"OT extension for Bob's input labels as evaluator; Alice's garbled circuit rides with its replies"},{"from":"receiver","id":"labels","locator":"§2, p. 4; §5.3.2, p. 8","phase":"online","what":"Alice's input labels as generator, for her set and her masks"},{"from":"receiver","id":"masks","locator":"Figure 6, step 1, p. 9","phase":"online","what":"Alice's encrypted masks","with":"labels"},{"after":["pk","ot","labels","masks"],"from":"sender","id":"shuffle","locator":"Figure 6, steps 2–3, p. 9","phase":"online","what":"Bob's permuted ciphertexts of the masked outputs"}],"security":{"mode":"computational","model":"semi-honest two-party; no proof given (§2, p. 4); statistical masking \\( O(n \\cdot 2^{-\\lambda}) \\) in the secret-sharing step (§5.3.2, p. 8)","notion":"PSI (intersection revealed, nothing else)"},"status":"published","title":"HEK sort-compare-shuffle PSI with homomorphic-encryption shuffling, semi-honest two-party","variables":[{"meaning":"Bits of one ciphertext of the unnamed additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of Alice's public key of the unnamed additively homomorphic scheme","symbol":"\\gamma_{\\mathrm{pk}}"},{"meaning":"Non-free gates of the SCS-HE circuit, \\( 2\\sigma n\\log(2n) + (3n-1)\\sigma - n + (\\sigma+\\lambda)n \\)","symbol":"s"}],"work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"Sort-compare-shuffle PSI whose final shuffle is homomorphic: the garbled circuit leaves additive shares of the filtered outputs, Alice sends her shares encrypted under her key, and Bob combines them with his, permutes the ciphertexts and returns them for Alice to decrypt.","heading":"Summary"}],"slug":"hek12-hek-scs-he","status":"fulltext_checked","subtitle":"two-party PSI · 2012","summary":"Sort-compare-shuffle PSI whose final shuffle is homomorphic: the garbled circuit leaves additive shares of the filtered outputs, Alice sends her shares encrypted under her key, and Bob combines them with his, permutes the ciphertexts and returns them for Alice to decrypt.","title":"HEK SCS-HE","type":"construction","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2012-HEK-SCS-HE"},{"contributions":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","keywords":["two-party psi","garbled_circuit_sort_compare_shuffle","quasi-linear-circuit","generic-composition"],"metadata":{"assumption":{"family":"discrete_log","name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model"},"attributes":{"adversary":{"locator":"§1.1, p. 2; §2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","value":["DDH"]},"output":{"locator":"§2, p. 3; §5.3.1, p. 8","value":["intersection"]},"output_to":{"locator":"§2, p. 3","note":"Either party, or both, may learn it, as for all the paper's protocols","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§5.3.1, p. 8","value":["garbled_circuits","ot_extension","sorting_network"]}},"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §5.3.1, p. 8; Table 1, p. 2","params":{"|C|":"\\( s \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["quasi-linear-circuit","generic-composition"],"claim_ids":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"construction_family":"garbled_circuit_sort_compare_shuffle","costs":[{"basis":"counted","formula":"\\( \\sigma n\\kappa \\)","locator":"§2, p. 4; §5, p. 6","measure":"communication","note":"The generator's input labels, one per bit of its sorted set","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, p. 4","measure":"communication","note":"Sends only inside the OT extension","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §5, p. 6","measure":"computation","note":"No cryptographic operation outside garbling and the OTs; sorting its own set is done in the clear","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, pp. 3–4; §5, p. 6","measure":"computation","note":"No cryptographic operation outside evaluating the circuit and the OTs; sorting its own set is done in the clear","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","name":"HEK SCS-SORT","paper_ids":["PSI-PAPER-2012-HEK"],"primitive":"two-party PSI","schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §5.3.1, p. 8","phase":"online","what":"OT extension for the evaluator's input labels; the garbled circuit rides with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §5, p. 6","phase":"online","what":"the generator's input labels, one per bit of its sorted set"}],"security":{"mode":"computational","model":"semi-honest two-party; Yao's protocol with Naor-Pinkas OT and OT extension; the paper states provability from DDH in the random oracle model without a proof (§2, p. 4)","notion":"PSI (intersection revealed, nothing else)"},"status":"published","title":"HEK sort-compare-shuffle PSI that hides positions by obliviously sorting the filtered outputs, semi-honest two-party, Yao garbled circuits","variables":[{"meaning":"Size of the intersection, assumed known for sizing the sorters","symbol":"\\hat{n}"},{"meaning":"Non-free gates of the SCS-SORT circuit, \\( 2\\sigma n\\log(2n) + (3n-1)\\sigma - n + \\sigma n\\log(2\\hat{n})(\\log(2\\hat{n})+1) \\), with bitonic sorters","symbol":"s"}],"work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"The sort-compare-shuffle variant that hides the positions of the matches by obliviously sorting the filtered outputs with Batcher sorters instead of shuffling them; it can beat shuffling when the intersection is small relative to the sets.","heading":"Summary"}],"slug":"hek12-hek-scs-sort","status":"fulltext_checked","subtitle":"two-party PSI · 2012","summary":"The sort-compare-shuffle variant that hides the positions of the matches by obliviously sorting the filtered outputs with Batcher sorters instead of shuffling them; it can beat shuffling when the intersection is small relative to the sets.","title":"HEK SCS-SORT","type":"construction","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2012-HEK-SCS-SORT"},{"contributions":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","keywords":["two-party psi","garbled_circuit_sort_compare_shuffle","quasi-linear-circuit","generic-composition"],"metadata":{"assumption":{"family":"discrete_log","name":"Decisional Diffie-Hellman for the oblivious transfer, in the random oracle model"},"attributes":{"adversary":{"locator":"§1.1, p. 2; §2, p. 3","value":["semi_honest"]},"assumptions":{"locator":"§2, p. 4","note":"Stated provable from DDH for the Naor-Pinkas OT; no proof is given","value":["DDH"]},"output":{"locator":"§2, p. 3; §5.3.3, p. 9","value":["intersection"]},"output_to":{"locator":"§5.3.3, p. 9","note":"The evaluator; it may permute or sort the outputs again and send them back to the generator","value":"one"},"parties":{"locator":"§2, p. 3","value":"two_party"},"security_model":{"locator":"§2, p. 4","value":["random oracle"]},"set_size_regime":{"locator":"§2, p. 3","note":"Both sets padded to a known common size","value":"balanced"},"technique":{"locator":"§5, pp. 5-10","value":["garbled_circuits","ot_extension","sorting_network"]}},"blocks":[{"cites":[{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"PSSW09","title":"Secure two-party computation is practical"}],"func":"gc","id":"gc","implementation":"free-XOR with garbled-row reduction","instantiation":"gc_grr3","locator":"§2, p. 4; §5.1, p. 7; §5.2, p. 7; Table 1, p. 2","note":"Merger and filter; the Waksman swappers are unary gates the generator programs, counted in its own figures","params":{"|C|":"\\( s \\)"},"roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( \\sigma n \\)","func":"ot","id":"ot","implementation":"IKNP OT extension","instantiation":"iknp","locator":"§2, p. 4","note":"One per bit of the evaluator's set, for its wire label","params":{"\\tau":"\\( \\kappa \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\lambda \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OT","instantiation":"np01","locator":"§2, p. 4; Table 2, p. 13","note":"Base OTs of the OT extension, once per pair of parties","phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["quasi-linear-circuit","generic-composition"],"claim_ids":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"],"construction_family":"garbled_circuit_sort_compare_shuffle","costs":[{"basis":"counted","formula":"\\( \\sigma n\\kappa + \\sigma(n\\log n-n+1)\\kappa \\)","locator":"§2, p. 4; §5.3.3, p. 9","measure":"communication","note":"Its input labels, and one ciphertext per programmed gate of the Waksman swappers, \\( \\sigma \\) gates per swapper","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§2, p. 4","measure":"communication","note":"Sends only inside the OT extension","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2\\sigma(n\\log n-n+1) \\)","locator":"§5.3.3, p. 9; §2, pp. 3–4","measure":"computation","note":"Garbling each programmed swapper gate: two rows, one encryption call each, one row then dropped by row reduction","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma(n\\log n-n+1) \\)","locator":"§5.3.3, p. 9; §2, p. 4","measure":"computation","note":"One decryption per programmed swapper gate","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","name":"HEK SCS-WN","paper_ids":["PSI-PAPER-2012-HEK"],"primitive":"two-party PSI","schedule":[{"blocks":["base_ot"],"id":"base","locator":"§2, p. 4; §7, p. 11","phase":"setup","what":"base OTs of the OT extension, once per pair of parties"},{"after":["base"],"blocks":["ot","gc"],"id":"ot","locator":"§2, pp. 3–4; §5.1–5.2, pp. 6–7","phase":"online","what":"OT extension for the evaluator's input labels; the garbled merger and filter ride with its replies"},{"from":"sender","id":"labels","locator":"§2, p. 4; §5.3.3, p. 9","phase":"online","what":"the generator's input labels and its programmed Waksman swapper gates"}],"security":{"mode":"computational","model":"semi-honest two-party; Yao's protocol with Naor-Pinkas OT and OT extension; the paper states provability from DDH in the random oracle model without a proof (§2, p. 4)","notion":"PSI (intersection revealed, nothing else)"},"status":"published","title":"HEK sort-compare-shuffle PSI with Waksman-network shuffling, semi-honest two-party, Yao garbled circuits","variables":[{"meaning":"Non-free gates of the SCS-WN merger and filter, \\( 2\\sigma n\\log(2n) + (3n-1)\\sigma - n \\); the swapper gates are counted apart","symbol":"s"}],"work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"Sort-compare-shuffle PSI by Yao's garbled circuits: each party sorts its set locally, a bitonic merger sorts the union, DupSelect-3 circuits keep the duplicates, and a Waksman switching network programmed by the generator shuffles the \\( n \\) results before they are revealed, for \\( \\Theta(n\\log n) \\) gates.","heading":"Summary"}],"slug":"hek12-hek-scs-wn","status":"fulltext_checked","subtitle":"two-party PSI · 2012","summary":"Sort-compare-shuffle PSI by Yao's garbled circuits: each party sorts its set locally, a bitonic merger sorts the union, DupSelect-3 circuits keep the duplicates, and a Waksman switching network programmed by the generator shuffles the \\( n \\) results before they are revealed, for \\( \\Theta(n\\log n) \\) gates.","title":"HEK SCS-WN","type":"construction","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2012-HEK-SCS-WN"},{"contributions":["PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2016-KKRT","keywords":["two-party psi","oprf_cuckoo_hashing","item-length-independent-oprf-cost"],"metadata":{"assumption":{"family":"symmetric","name":"Hamming correlation-robust hash and pseudorandom code, with ideal base OTs"},"attributes":{"adversary":{"locator":"Theorem 6, p. 9; §5.2, p. 11","value":["semi_honest"]},"assumptions":{"locator":"§3.1–3.2, pp. 6–7; Lemma 3, p. 7; Figure 2, p. 10","note":"The pseudorandom code is a PRF (AES); the hash is Hamming correlation robust","value":["PRF","CR hash"]},"output":{"locator":"Figure 3, p. 13","value":["intersection"]},"output_to":{"locator":"Figure 3, step 6, p. 13","note":"Bob learns the intersection and sends it to Alice","value":"all"},"parties":{"locator":"§5.2, p. 11","value":"two_party"},"security_model":{"locator":"Theorem 6, p. 9; Figure 2, p. 10; §5.2, p. 11","note":"BaRK-OPRF is proved with ideal base OTs, a hybrid model; the PSI step is argued informally","value":["standard model"]},"set_size_regime":{"locator":"§5.2, p. 11; Figure 3, p. 13","value":"balanced"},"technique":{"locator":"§5.2, pp. 11–12; Figure 3, p. 13","value":["batched_oprf","ot_extension","cuckoo_hashing"]}},"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"},{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"count":"\\( k \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas OTs extended by IKNP","instantiation":"iknp","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16; Table 4, p. 15","note":"The \\( k \\) column OTs of BaRK-OPRF on \\( \\kappa \\)-bit seeds, run in the offline phase; the matrix that stretches them to the bins is the protocol's","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["item-length-independent-oprf-cost"],"claim_ids":["PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI"],"construction_family":"oprf_cuckoo_hashing","costs":[{"basis":"counted","formula":"\\( \\kappa \\)","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","measure":"communication","note":"The key of the pseudorandom code, an AES key","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( (3+s)n(\\lambda+2\\log n) \\)","locator":"Figure 3, step 4, p. 13; §5.2, p. 12; §6.1, p. 16","measure":"communication","note":"Alice's permuted PRF values, \\( v=\\lambda+2\\log n \\) bits each, for every item and hash function or stash position","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( k(1.2n+s)+\\hat{n}\\sigma \\)","locator":"Figure 2, steps 2–3, p. 10; Figure 3, steps 1, 3 and 6, p. 13; §6.3, p. 16","measure":"communication","note":"Bob's matrix, one masked column of \\( 1.2n+s \\) bits per OT, then the intersection; the seeds of the hash functions are not sized","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( k(1.2n+s)/\\kappa \\)","locator":"Figure 2, step 3, p. 10; §6.3, p. 16","measure":"computation","note":"Its seed of each of the \\( k \\) OTs expanded to a column of \\( 1.2n+s \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( (18+5s)n \\)","locator":"Figure 3, step 4, p. 13; Figure 2, step 4, p. 10; §6.3, p. 16","measure":"computation","note":"Three bin hashes per item, then per PRF value four AES calls for the code and one hash, for three hash functions and \\( s \\) stash positions","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2k(1.2n+s)/\\kappa \\)","locator":"Figure 2, steps 2–3, p. 10; §6.3, p. 16","measure":"computation","note":"Both seeds of each OT expanded to a column of \\( 1.2n+s \\) bits, in \\( \\kappa \\)-bit blocks","operation":"symmetric_op","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( 9n+5s \\)","locator":"Figure 3, steps 2–3, p. 13; Figure 2, steps 2 and 5, p. 10; §6.3, p. 16","measure":"computation","note":"Three cuckoo hashes per item, then four AES calls for the code and one output hash per bin and stash position","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2016-KKRT","name":"KKRT PSI","paper_ids":["PSI-PAPER-2016-KKRT"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"code","locator":"Figure 2, step 0, p. 10; §6.3, p. 16","phase":"offline","what":"Alice's key of the pseudorandom code"},{"blocks":["base_ot"],"id":"base","locator":"Figure 2, step 3, p. 10; footnote 1, p. 6; §6.3, p. 16","phase":"offline","what":"the \\( k \\) OTs of seeds that BaRK-OPRF extends, by IKNP"},{"from":"receiver","id":"hash","locator":"Figure 3, step 1, p. 13","phase":"online","what":"Bob's cuckoo hash functions"},{"after":["code","base"],"from":"receiver","id":"matrix","locator":"Figure 2, steps 2–3, p. 10; Figure 3, step 3, p. 13; §6.3, p. 16","phase":"online","what":"Bob's OT-extension matrix, one row per bin and stash position","with":"hash"},{"after":["hash","matrix"],"from":"sender","id":"prf","locator":"Figure 3, step 4, p. 13","phase":"online","what":"Alice's permuted PRF values, per hash function and stash position"},{"after":["prf"],"from":"receiver","id":"result","locator":"Figure 3, step 6, p. 13","phase":"online","what":"the intersection, returned to Alice"}],"security":{"mode":"computational","model":"semi-honest two-party; BaRK-OPRF proved with ideal base OTs (Theorem 6, p. 9); PSI security argued in §5.2, p. 11","notion":"PSI with output to both parties"},"status":"published","title":"KKRT semi-honest two-party PSI from BaRK-OPRF and cuckoo hashing","variables":[{"meaning":"Width of the pseudorandom code and the number of base OTs, \\( O(\\kappa) \\): a random code of width \\( 4\\kappa \\) suffices","symbol":"k"},{"meaning":"Stash size of the cuckoo table","symbol":"s"},{"meaning":"OPRF output length, \\( \\lambda+2\\log n \\) bits","symbol":"v"},{"meaning":"Size of the intersection, which Bob returns to Alice","symbol":"\\hat{n}"}],"work_id":"PSI-PAPER-2016-KKRT","year":2016},"primaryUrl":"https://eprint.iacr.org/2016/799","sections":[{"content":"Semi-honest PSI from BaRK-OPRF, an IKNP-style OT extension whose width is a pseudorandom code rather than a repetition code, so one OPRF instance costs one matrix row whatever the item length. Bob cuckoo-hashes his items into 1.2n bins and Alice sends PRF values of hers for each hash function and stash position.","heading":"Summary"}],"slug":"kkrt16-kkrt-psi","status":"fulltext_checked","subtitle":"two-party PSI · 2016","summary":"Semi-honest PSI from BaRK-OPRF, an IKNP-style OT extension whose width is a pseudorandom code rather than a repetition code, so one OPRF instance costs one matrix row whatever the item length. Bob cuckoo-hashes his items into 1.2n bins and Alice sends PRF values of hers for each hash function and stash position.","title":"KKRT PSI","type":"construction","venue":"ACM CCS 2016","year":2016,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2016-KKRT"},{"contributions":["PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-CLR","keywords":["unbalanced psi","fhe_polynomial_evaluation_cuckoo_hashing","communication-sublinear-in-larger-set","light-receiver-computation","offline-sender-preprocessing"],"metadata":{"assumption":{"family":"lattice","name":"IND-CPA leveled FHE with circuit privacy (FV over Ring-LWE)"},"attributes":{"adversary":{"locator":"Theorem 2, p. 11; §5.2, pp. 12–13","note":"Malicious parties are discussed without a proof","value":["semi_honest"]},"assumptions":{"locator":"§2.3, p. 4; Theorem 2, p. 11","note":"Through IND-CPA, circuit-private FV over RLWE rings; the paper names no hardness assumption","value":["Ring-LWE"]},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 3, p. 11; Figure 4, p. 12","note":"The receiver learns the intersection; the sender learns nothing","value":"one"},"parties":{"locator":"§2.2, p. 3","value":"two_party"},"security_model":{"locator":"Theorem 2, p. 11; Figure 4, p. 12","note":"Hash functions are sampled fresh for each run; the proof uses no random oracle","value":["standard model"]},"set_size_regime":{"locator":"§2.2, p. 4","note":"Built for a receiver set much smaller than the sender set; it runs unchanged on any sizes","value":"unbalanced"},"technique":{"locator":"§4.1–4.2, pp. 6–9; Figure 2, p. 8","value":["fully_homomorphic_encryption","cuckoo_hashing","simple_hashing","permutation_based_hashing"]}},"capabilities":["communication-sublinear-in-larger-set","light-receiver-computation","offline-sender-preprocessing"],"claim_ids":["PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION"],"construction_family":"fhe_polynomial_evaluation_cuckoo_hashing","costs":[{"locator":"Figure 1, step 1, p. 5; §2.3, p. 4; §5.2, p. 11; Table 2, p. 13","measure":"communication","note":"Its public and evaluation keys, which the flooding and the products need; the protocol has no key step and sizes neither","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( (2^{w}-1)\\left(\\left\\lfloor \\log_2(B/\\alpha)/w \\right\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3, p. 10; Figure 4, step 5, p. 12","measure":"communication","note":"Window powers of each batched cuckoo-table plaintext, each an FV ciphertext of two ring elements","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3–4.4, p. 10; Figure 4, step 6, p. 12","measure":"communication","note":"One reply per partition and batch, counted at full width; modulus switching shrinks it","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O(mB^{2}/\\alpha) \\)","locator":"Figure 4, step 4, p. 12; §6.1, p. 14","measure":"computation","note":"Coefficients of each partition's bin polynomial, then batching; fresh hash functions make it per run","operation":"field_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 4, step 1, p. 12; Figure 2, step 1, p. 8; §4.2, p. 8","measure":"computation","note":"Per item: the hash to a shorter string when items are long, then the location hash under each of the three cuckoo hash functions for simple hashing","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}\\left(\\frac{B}{\\alpha}-1\\right) \\)","locator":"§4.3, p. 10; Figure 4, step 6a, p. 12","measure":"computation","note":"One product per power from the square up to the partition size, shared by the partitions","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( 2\\frac{m}{k}(B+\\alpha) \\)","locator":"Figure 4, step 6b, p. 12; §5.2, p. 11","measure":"computation","note":"\\( B/\\alpha+1 \\) plaintext products and \\( B/\\alpha \\) additions per partition and batch, then adding the encryption of zero that floods the reply","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k} \\)","locator":"§5.2, p. 11","measure":"computation","note":"An encryption of zero with large noise per reply, for function privacy in the leveled instantiation","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\left((2^{w}-1)\\left(\\left\\lfloor \\log_2(B/\\alpha)/w \\right\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","locator":"§2.2, p. 4; Figure 4, steps 5 and 7, p. 12","measure":"computation","note":"FV encryptions of the window powers and decryptions of the replies","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 4, step 1, p. 12; Figure 2, step 2, p. 8","measure":"computation","note":"Per item: the hash to a shorter string when items are long, then one location hash per cuckoo hash function; re-insertions, which go unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-CLR","name":"CLR17 FHE PSI","paper_ids":["PSI-PAPER-2017-CLR"],"primitive":"unbalanced PSI","schedule":[{"from":"receiver","id":"keys","locator":"Figure 1, step 1, p. 5; §2.3, p. 4; §5.2, p. 11","phase":"setup","what":"Public key, and evaluation keys where key generation outputs them, for the flooding and the products"},{"from":"receiver","id":"query","locator":"Figure 4, step 5, p. 12","phase":"online","what":"Encrypted window powers of each batched cuckoo-table plaintext"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 4, step 6, p. 12; §5.2, p. 11","phase":"online","what":"One flooded result per partition and batch, optionally modulus-switched"}],"security":{"mode":"computational","model":"semi-honest two-party, simulation-based (Theorem 2, p. 11)","notion":"PSI with output to the receiver only (FPSI, Figure 3)"},"status":"published","title":"CLR17 semi-honest unbalanced PSI from leveled FV with batching, cuckoo hashing, windowing, and partitioning","variables":[{"meaning":"Cuckoo hash table bins, a small constant times \\( n_Y \\) (three hash functions, no stash)","symbol":"m"},{"meaning":"Batching slots per FV plaintext, the ring dimension","symbol":"k"},{"meaning":"Sender bin capacity after simple hashing with three hash functions","symbol":"B"},{"meaning":"Partitions of each sender bin","symbol":"\\alpha"},{"meaning":"Window size in bits (the paper's \\( \\ell \\))","symbol":"w"}],"work_id":"PSI-PAPER-2017-CLR","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/299","sections":[{"content":"Unbalanced PSI from leveled FV: the receiver sends its cuckoo table batched and encrypted, and the sender homomorphically evaluates, slot by slot, the polynomial whose roots are its items in the matching bin. Windowing, partitioning and modulus switching keep the depth and the reply small, so communication is \\( O(n_Y\\log n_X) \\) and only the sender works in \\( n_X \\).","heading":"Summary"}],"slug":"clr17-clr17-fhe-psi","status":"fulltext_checked","subtitle":"unbalanced PSI · 2017","summary":"Unbalanced PSI from leveled FV: the receiver sends its cuckoo table batched and encrypted, and the sender homomorphically evaluates, slot by slot, the polynomial whose roots are its items in the matching bin. Windowing, partitioning and modulus switching keep the depth and the reply small, so communication is \\( O(n_Y\\log n_X) \\) and only the sender works in \\( n_X \\).","title":"CLR17 FHE PSI","type":"construction","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2017-CLR"},{"contributions":["PSI-CONTRIB-2017-KMPRT-OPPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","keywords":["multiparty psi","opprf_incremental_chain","three-opprf-executions"],"metadata":{"assumption":{"family":"symmetric","name":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF"},"attributes":{"adversary":{"locator":"§6.3, p. 17","note":"Argued in prose for each colluding pair; no theorem","value":["semi_honest"]},"assumptions":{"locator":"§6.3, p. 16; §3.1, p. 4; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","value":["PRF","CR hash"]},"corruptions":{"locator":"§6.3, p. 17; Table 4, p. 18; §7.2, p. 19","note":"Three parties, any two colluding","value":"\\( t_c \\le 2 \\)"},"output":{"locator":"Figure 10, step 4, p. 16","value":["intersection"]},"output_to":{"locator":"Figure 10, step 4, p. 16","note":"The leader announces the intersection it decodes","value":"all"},"parties":{"locator":"§6.3, pp. 16-17","note":"Three parties only; a collusion of the leader with a later party would learn a partial intersection beyond three","value":"multiparty"},"security_model":{"locator":"Figure 6, p. 8; §7.2, p. 18","note":"Evaluated with the table-based OPPRF, which hashes with a random oracle","value":["random oracle"]},"set_size_regime":{"locator":"Figure 10, p. 16","value":"balanced"},"technique":{"locator":"§6.3, p. 16; §4, pp. 9-10","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing"]}},"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\kappa \\)","func":"ot","id":"base_ot","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17","note":"Per party: \\( \\kappa \\) base OTs for the OPRF it keys, which it sends, and for the one it queries; IKNP extends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"party","sender":"party"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( B \\)","func":"oprf","id":"oprf","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 10, steps 2–3, p. 16; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"Per party: three OPPRFs in a ring, P1 to P2 to P3 to P1, one OPRF per cuckoo bin of the receiver; each party keys one and queries one","phase":"online","roles":{"receiver":"party","sender":"party"}}],"capabilities":["three-opprf-executions"],"claim_ids":["PSI-CONTRIB-2017-KMPRT-OPPRF"],"construction_family":"opprf_incremental_chain","costs":[{"basis":"counted","formula":"\\( T(\\lambda+\\log n)+B\\kappa+2\\hat{n}\\sigma \\)","locator":"Figure 10, steps 2–4, p. 16; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §7.1, TABLE, p. 17","measure":"communication","note":"Its one hint, a table of \\( (\\lambda+\\log n) \\)-bit entries as in the general protocol and a \\( \\kappa \\)-bit nonce per bin; P1 then announces the intersection","phase":"online","subject":"party","tip":"P1's, which also announces the intersection to the other two; P2 and P3 send only their hint."},{"basis":"counted","formula":"\\( 30n+B+O(n) \\)","locator":"Figure 10, steps 2–3, p. 16; Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; KKRT16 §6.3, p. 16","measure":"computation","note":"Five bin hashes per item; as sender, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search; one hash per bin as receiver","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"party"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","name":"KMPRT three-party PSI","paper_ids":["PSI-PAPER-2017-KMPRT"],"primitive":"multiparty PSI","schedule":[{"blocks":["base_ot"],"id":"base","locator":"§7, p. 17; Table 1, p. 3; §7.2, Results, p. 19","phase":"offline","what":"Naor-Pinkas base OTs of the three OPRF pairings, in the paper's offline phase"},{"after":["base"],"blocks":["oprf"],"id":"oprf","locator":"Figure 10, steps 2–3, p. 16; Figure 7, step 3, p. 11","phase":"online","what":"the three OPRF batches of the ring, which need only the sets"},{"after":["oprf"],"from":"party","id":"hint1","locator":"Figure 10, steps 1–2, p. 16; Figure 6, step 5, p. 8","phase":"online","what":"P1's hint to P2, programmed with its random encodings"},{"after":["hint1"],"from":"party","id":"hint2","locator":"Figure 10, step 3, p. 16","phase":"online","what":"P2's hint to P3, programmed with the encodings it decoded"},{"after":["hint2"],"from":"party","id":"hint3","locator":"Figure 10, step 3, p. 16","phase":"online","what":"P3's hint to P1, programmed with the encodings it decoded"},{"after":["hint3"],"from":"party","id":"announce","locator":"Figure 10, step 4, p. 16","phase":"online","what":"the intersection, from P1"}],"security":{"mode":"computational","model":"semi-honest, any two of three parties may collude; argued in prose, no theorem (§6.3, p. 17)","notion":"three-party PSI"},"status":"published","title":"KMPRT optimized semi-honest three-party PSI from a chain of three OPPRFs","variables":[{"meaning":"Bins of the receiver's cuckoo table in one multi-query OPPRF, \\( O(n) \\): three primary and two supplementary hash functions, no stash","symbol":"B"},{"meaning":"Table entries in one multi-query OPPRF's hint: \\( 2^{\\lceil\\log(\\beta_1+1)\\rceil} \\) in each of the \\( m_1 \\) primary bins and \\( 2^{\\lceil\\log(\\beta_2+1)\\rceil} \\) in each of the \\( m_2 \\) supplementary ones, \\( \\beta_1, \\beta_2 \\) bounding the sender's items per bin and \\( B = m_1+m_2 \\); 47.04n at n = 2^20 (Table 2)","symbol":"T"},{"meaning":"Size of the intersection, which P1 announces","symbol":"\\hat{n}"}],"work_id":"PSI-PAPER-2017-KMPRT","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/799","sections":[{"content":"Three-party PSI computed incrementally through three OPPRFs in a ring. The leader programs random encodings of its items to the second party, which reprograms what it receives to the third, which reprograms back to the leader; the leader keeps the items whose encodings return.","heading":"Summary"}],"slug":"kmprt17-kmprt-three-party-psi","status":"fulltext_checked","subtitle":"multiparty PSI · 2017","summary":"Three-party PSI computed incrementally through three OPPRFs in a ring. The leader programs random encodings of its items to the second party, which reprograms what it receives to the third, which reprograms back to the leader; the leader keeps the items whose encodings return.","title":"KMPRT three-party PSI","type":"construction","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2017-KMPRT-3PARTY"},{"contributions":["PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","PSI-CONTRIB-2017-KMPRT-OPPRF","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","keywords":["multiparty psi","opprf_unconditional_zero_sharing","symmetric-key-techniques","unconditional-zero-sharing"],"metadata":{"assumption":{"family":"symmetric","name":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF"},"attributes":{"adversary":{"locator":"§2.1, p. 4; Theorem 2, p. 14","note":"The simulator may replace the corrupt parties' inputs; a later paper proves the same protocol malicious-secure","value":["augmented_semi_honest"]},"assumptions":{"locator":"Figure 9, p. 14; Theorem 2, p. 14; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","value":["PRF","CR hash"]},"corruptions":{"locator":"Table 1, p. 3; §6.1, p. 14","note":"The comparison lists all but one party; the zero-sharing argument is written for \\( t_c < \\ell - 1 \\)","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 1, p. 5","value":["intersection"]},"output_to":{"locator":"Figure 8, step 5, p. 12; §6.1, p. 14","note":"The leader announces the intersection it computes","value":"all"},"parties":{"locator":"§6.1, p. 14","value":"multiparty"},"security_model":{"locator":"Figure 6, p. 8; Theorem 2, p. 14","note":"The table-based OPPRF hashes with a random oracle; the proof sketch assumes a secure OPRF, a hybrid rather than a model","value":["random oracle"]},"set_size_regime":{"locator":"§5, p. 10","value":"balanced"},"technique":{"locator":"§6.1, p. 14; §4, pp. 9-10","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","secret_sharing"]}},"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"func":"ot","id":"base_ot","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17; Table 1, p. 3","note":"\\( \\kappa \\) base OTs for each client's OPRF with the leader, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"func":"oprf","id":"oprf","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8; §6.1, p. 14; §7, p. 17","note":"One per cuckoo bin of the leader in each client's OPPRF; the leader queries in all, a client keys one","phase":"online","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}}],"capabilities":["symmetric-key-techniques","unconditional-zero-sharing"],"claim_ids":["PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","PSI-CONTRIB-2017-KMPRT-OPPRF","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"construction_family":"opprf_unconditional_zero_sharing","costs":[{"basis":"counted","formula":"\\( (\\ell-1)\\kappa \\)","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","measure":"communication","note":"A PRF seed to every client, once for any number of zero-sharings","phase":"setup","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-1)\\hat{n}\\sigma \\)","locator":"Figure 8, step 5, p. 12; §6.1, p. 14","measure":"communication","note":"The intersection to each client; the paper names no broadcast channel","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-2)\\kappa \\)","locator":"Figure 9, Initialization, p. 14","measure":"communication","note":"PRF seeds to the parties after it","phase":"setup","subject":"client","tip":"The largest client's: party \\( P_i \\) sends a seed to each party after it, \\( \\ell-i \\) in all, so the last sends none."},{"basis":"counted","formula":"\\( T(\\lambda+\\log n)+B\\kappa \\)","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §7.1, TABLE, p. 17","measure":"communication","note":"One hint to the leader, a table of \\( (\\lambda+\\log n) \\)-bit entries and a \\( \\kappa \\)-bit nonce per bin","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(n+B)+3n \\)","locator":"Figure 9, Generate zero-sharing, p. 14; Figure 7, step 1, p. 11; Figure 6, step 6, p. 8; Appendix B, p. 24","measure":"computation","note":"A PRF call per seed for each item's zero-share, three cuckoo hashes per item, and one hash per bin as receiver in each client's OPPRF","operation":"symmetric_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+29)n+O(n) \\)","locator":"Figure 9, Generate zero-sharing, p. 14; Figure 7, step 2, p. 11; Figure 6, steps 2–3, p. 8; KKRT16 §6.3, p. 16","measure":"computation","note":"A PRF call per seed for each item's zero-share, five bin hashes per item, five calls per OPRF value at its \\( 5n \\) bin entries, and the nonce search","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"client"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","name":"KMPRT augmented semi-honest multiparty PSI","paper_ids":["PSI-PAPER-2017-KMPRT","PSI-PAPER-2016-KKRT"],"primitive":"multiparty PSI","schedule":[{"from":["leader","client"],"id":"seeds","locator":"Figure 9, Initialization, p. 14; §6.1, p. 14","phase":"setup","what":"pairwise PRF seeds, each party to the parties after it"},{"blocks":["base_ot"],"id":"base","locator":"§7, p. 17; Table 1, p. 3; §7.2, Results, p. 19","phase":"offline","what":"Naor-Pinkas base OTs of each client's OPRF, in the paper's offline phase"},{"after":["base"],"blocks":["oprf"],"id":"oprf","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11","phase":"online","what":"the OPRFs the leader queries, which need only the sets"},{"after":["seeds","oprf"],"from":"client","id":"rec","locator":"Figure 8, step 4, p. 12; Figure 9, p. 14; Figure 6, step 5, p. 8","phase":"online","what":"each client's hint, programmed with its PRF zero-shares"},{"after":["rec"],"from":"leader","id":"announce","locator":"Figure 8, step 5, p. 12; §6.1, p. 14","phase":"online","what":"the intersection"}],"security":{"mode":"computational","model":"augmented semi-honest (Theorem 2 with proof sketch, pp. 14-15)","notion":"multi-party PSI (Figure 1, p. 5)"},"status":"published","title":"KMPRT augmented semi-honest multiparty PSI from unconditional zero-sharing and table-based OPPRFs","variables":[{"meaning":"Bins of the receiver's cuckoo table in one multi-query OPPRF, \\( O(n) \\): three primary and two supplementary hash functions, no stash","symbol":"B"},{"meaning":"Table entries in one multi-query OPPRF's hint: \\( 2^{\\lceil\\log(\\beta_1+1)\\rceil} \\) in each of the \\( m_1 \\) primary bins and \\( 2^{\\lceil\\log(\\beta_2+1)\\rceil} \\) in each of the \\( m_2 \\) supplementary ones, \\( \\beta_1, \\beta_2 \\) bounding the sender's items per bin and \\( B = m_1+m_2 \\); 47.04n at n = 2^20 (Table 2)","symbol":"T"},{"meaning":"Size of the intersection, which the leader announces","symbol":"\\hat{n}"}],"work_id":"PSI-PAPER-2017-KMPRT","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/799","sections":[{"content":"The KMPRT protocol with the conditional zero-sharing replaced by unconditional zero-sharing from pairwise PRF seeds. Each party programs one OPPRF to the leader with its PRF share of zero per item, so only the reconstruction phase needs interaction.","heading":"Summary"}],"slug":"kmprt17-kmprt-augmented-semi-honest","status":"fulltext_checked","subtitle":"multiparty PSI · 2017","summary":"The KMPRT protocol with the conditional zero-sharing replaced by unconditional zero-sharing from pairwise PRF seeds. Each party programs one OPPRF to the leader with its PRF share of zero per item, so only the reconstruction phase needs interaction.","title":"KMPRT augmented semi-honest multiparty PSI","type":"construction","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2017-KMPRT-AUG"},{"contributions":["PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","PSI-CONTRIB-2017-KMPRT-OPPRF","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-KMPRT-SH","keywords":["multiparty psi","opprf_conditional_zero_sharing","symmetric-key-techniques","no-honest-majority","corruption-threshold-parameter"],"metadata":{"assumption":{"family":"symmetric","name":"PRF and random oracle, with the OPPRF instantiated from the KKRT batched OPRF"},"attributes":{"adversary":{"locator":"Theorem 1, p. 12","value":["semi_honest"]},"assumptions":{"locator":"Theorem 1, p. 12; §3.1, p. 4; §7, p. 17","note":"The OPPRF is built on the KKRT OPRF, whose hash is correlation robust","value":["PRF","CR hash"]},"corruptions":{"locator":"Theorem 1, p. 12; §5.3, Generalization, p. 13; Table 1, p. 3","note":"Any number of colluding parties; sharing zero with only \\( t_c + 1 \\) parties tolerates at most \\( t_c \\)","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 1, p. 5","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 5; Figure 8, step 5, p. 12","note":"The leader announces the intersection it computes","value":"all"},"parties":{"locator":"§5, p. 10; Figure 8, p. 12","value":"multiparty"},"security_model":{"locator":"Figure 6, p. 8; §7.2, p. 18","note":"The table-based OPPRF hashes with a random oracle; the ideal-OPPRF hybrid of the proof is not a model","value":["random oracle"]},"set_size_regime":{"locator":"§5, p. 10","value":"balanced"},"technique":{"locator":"§4, pp. 9-10; §5, pp. 10-13","value":["opprf","batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","secret_sharing"]}},"blocks":[{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":"\\( \\min(t_c+1,\\ell-1)\\kappa \\)","func":"ot","id":"base_ot_share","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17; Table 1, p. 3; §5.3, Generalization, p. 13","note":"Per party: \\( \\kappa \\) base OTs for each sharing OPRF it keys or queries, which IKNP extends; the OPRF's sender sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"sessions":"\\( \\min(t_c+1,\\ell-1) \\)"},{"cites":[{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"count":{"client":"\\( \\kappa \\)","leader":"\\( (\\ell-1)\\kappa \\)"},"func":"ot","id":"base_ot_rec","implementation":"Naor-Pinkas","instantiation":"np01","locator":"§7, p. 17; Table 1, p. 3","note":"\\( \\kappa \\) base OTs for each client's reconstruction OPRF, which IKNP extends; the client, the OPRF's sender, sends them","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( \\min(t_c+1,\\ell-1)B \\)","func":"oprf","id":"oprf_share","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 8, step 2, p. 12; §5.3, Generalization, p. 13; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"Per party: one OPRF per cuckoo bin of the receiver in each sharing OPPRF; each party keys \\( \\min(t_c+1,\\ell-1) \\) and queries as many","phase":"online","roles":{"receiver":["leader","client"],"sender":["leader","client"]},"sessions":"\\( \\min(t_c+1,\\ell-1) \\)"},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":{"client":"\\( B \\)","leader":"\\( (\\ell-1)B \\)"},"func":"oprf","id":"oprf_rec","implementation":"KKRT batched OPRF","instantiation":"kkrt16","locator":"Figure 8, step 4, p. 12; Figure 7, step 3, p. 11; Figure 6, step 1, p. 8","note":"One per cuckoo bin of the leader in each client's reconstruction OPPRF; the leader queries in all, a client keys one","phase":"online","roles":{"receiver":"leader","sender":"client"},"sessions":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"}}],"capabilities":["symmetric-key-techniques","no-honest-majority","corruption-threshold-parameter"],"claim_ids":["PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","PSI-CONTRIB-2017-KMPRT-OPPRF","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"construction_family":"opprf_conditional_zero_sharing","costs":[{"basis":"counted","formula":"\\( \\min(t_c+1,\\ell-1)(T(\\lambda+\\log n)+B\\kappa)+(\\ell-1)\\hat{n}\\sigma \\)","locator":"Figure 8, steps 2 and 5, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §5.3, Generalization, p. 13; §7.1, TABLE, p. 17","measure":"communication","note":"A hint to each party it deals to, a table of \\( (\\lambda+\\log n) \\)-bit entries and a \\( \\kappa \\)-bit nonce per bin; then the intersection to each other party","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\min(t_c+1,\\ell-1)+1)(T(\\lambda+\\log n)+B\\kappa) \\)","locator":"Figure 8, steps 2 and 4, p. 12; Figure 7, step 3, p. 11; Figure 6, steps 2–5, p. 8; §5.3, Generalization, p. 13; §7.1, TABLE, p. 17","measure":"communication","note":"A sharing hint to each party it deals to and a reconstruction hint to the leader, each a table of \\( (\\lambda+\\log n) \\)-bit entries and a nonce per bin","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 5n+\\min(t_c+1,\\ell-1)(25n+B)+(\\ell-1)B+O(\\min(t_c+1,\\ell-1)n) \\)","locator":"Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; Figure 8, steps 2 and 4, p. 12; §5.3, p. 13; KKRT16 §6.3, p. 16","measure":"computation","note":"Five bin hashes per item; as a sharing sender, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search; one hash per bin as receiver","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"leader"},{"basis":"counted","formula":"\\( 30n+\\min(t_c+1,\\ell-1)(25n+B)+O(\\min(t_c+1,\\ell-1)n) \\)","locator":"Figure 7, steps 1–2, p. 11; Figure 6, steps 2, 3 and 6, p. 8; Figure 8, steps 2 and 4, p. 12; §5.3, p. 13; KKRT16 §6.3, p. 16","measure":"computation","note":"Five bin hashes per item; as sender in its sharing OPPRFs and the one to the leader, five calls per OPRF value at its \\( 5n \\) bin entries and the nonce search","operation":"symmetric_op","phase":"online","statistic":"expected","subject":"client"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-KMPRT-SH","name":"KMPRT semi-honest multiparty PSI","paper_ids":["PSI-PAPER-2017-KMPRT","PSI-PAPER-2016-KKRT"],"primitive":"multiparty PSI","schedule":[{"blocks":["base_ot_share","base_ot_rec"],"id":"base","locator":"§7, p. 17; Table 1, p. 3; §7.2, Results, p. 19","phase":"offline","what":"Naor-Pinkas base OTs of every OPRF pairing, in the paper's offline phase"},{"after":["base"],"blocks":["oprf_share","oprf_rec"],"id":"oprf","locator":"Figure 8, steps 2 and 4, p. 12; Figure 7, step 3, p. 11; §5.3, p. 13","phase":"online","what":"both OPRF batches, which need only the sets"},{"after":["oprf"],"from":["leader","client"],"id":"share","locator":"Figure 8, step 2, p. 12; Figure 6, step 5, p. 8","phase":"online","what":"sharing hints, each dealer's tables programmed with its zero-shares"},{"after":["share"],"from":"client","id":"rec","locator":"Figure 8, steps 3–4, p. 12; Figure 6, step 5, p. 8","phase":"online","what":"reconstruction hints to the leader, programmed with each client's combined share"},{"after":["rec"],"from":"leader","id":"announce","locator":"Figure 8, step 5, p. 12","phase":"online","what":"the intersection"}],"security":{"mode":"computational","model":"semi-honest, any number of colluding parties, ideal OPPRF functionality (Theorem 1, p. 12)","notion":"multi-party PSI (Figure 1, p. 5)"},"status":"published","title":"KMPRT semi-honest multiparty PSI from conditional zero-sharing over table-based OPPRFs","variables":[{"meaning":"Bins of the receiver's cuckoo table in one multi-query OPPRF, \\( O(n) \\): three primary and two supplementary hash functions, no stash","symbol":"B"},{"meaning":"Table entries in one multi-query OPPRF's hint: \\( 2^{\\lceil\\log(\\beta_1+1)\\rceil} \\) in each of the \\( m_1 \\) primary bins and \\( 2^{\\lceil\\log(\\beta_2+1)\\rceil} \\) in each of the \\( m_2 \\) supplementary ones, \\( \\beta_1, \\beta_2 \\) bounding the sender's items per bin and \\( B = m_1+m_2 \\); 47.04n at n = 2^20 (Table 2)","symbol":"T"},{"meaning":"Size of the intersection, which the leader announces","symbol":"\\hat{n}"}],"work_id":"PSI-PAPER-2017-KMPRT","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/799","sections":[{"content":"Multiparty PSI from oblivious programmable PRFs. The parties first deal each other shares of zero conditioned on holding an item, through pairwise OPPRFs; each then programs an OPPRF to the leader with its share, and the leader keeps the items whose received values sum to its own share.","heading":"Summary"}],"slug":"kmprt17-kmprt-semi-honest-multiparty","status":"fulltext_checked","subtitle":"multiparty PSI · 2017","summary":"Multiparty PSI from oblivious programmable PRFs. The parties first deal each other shares of zero conditioned on holding an item, through pairwise OPPRFs; each then programs an OPPRF to the leader with its share, and the leader keeps the items whose received values sum to its own share.","title":"KMPRT semi-honest multiparty PSI","type":"construction","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2017-KMPRT-SH"},{"contributions":["PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","keywords":["two-party psi","dual_execution_oblivious_encoding","symmetric-key-only","parallelizable"],"metadata":{"assumption":{"family":"symmetric","name":"Orrù-Orsini-Scholl OT extension in the programmable random oracle model"},"attributes":{"adversary":{"locator":"Theorem 2, p. 13; §6.3, p. 15","note":"A corrupt party may use up to \\( m\\mu \\) items, fewer than \\( 4n \\) in the evaluated range","value":["malicious"]},"assumptions":{"locator":"§4, p. 6; §7, p. 18","note":"No hardness assumption is named; the encodings use OOS OT extension, proved with a programmable random oracle","value":"not_reported"},"output":{"locator":"Figure 4, p. 12","value":["intersection"]},"output_to":{"locator":"Figure 4, p. 12; §6.7, pp. 17–18","note":"Bob only; output to both parties is not supported","value":"one"},"parties":{"locator":"Figure 4, p. 12","value":"two_party"},"security_model":{"locator":"Theorem 2, p. 13; §4, p. 6","note":"UC in the F_encode-hybrid model, a hybrid model; OOS realizes F_encode with a programmable random oracle","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 4, p. 12","value":"balanced"},"technique":{"locator":"§6.1–6.2, pp. 10–12; Figure 4, p. 12","value":["dual_execution","ot_extension","simple_hashing","permutation_based_hashing"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"count":"\\( m\\mu \\)","func":"encode","id":"encode","implementation":"OOS16 1-out-of-N OT, BCH-(511, 76, 171) code","instantiation":"oos17_encode","locator":"Figure 4, step 3, p. 12; Theorem 2, p. 13; §7, p. 18","note":"One OOS run per direction, one instance per bin position: each party receives in one run and sends in the other","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]}},{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 4, step 1, p. 12","note":"Agrees on the hash function of the bins"}],"capabilities":["symmetric-key-only","parallelizable"],"claim_ids":["PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION"],"construction_family":"dual_execution_oblivious_encoding","costs":[{"basis":"counted","formula":"\\( n\\mu(\\lambda+2\\log(n\\mu)) \\)","locator":"Figure 4, step 4a, p. 12; §6.2, p. 12","measure":"communication","note":"Alice's common encodings, \\( \\mu \\) per item, each as long as an encoding","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 4, p. 12","measure":"communication","note":"Bob sends only the flows of the encodings and the coin toss","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n(\\mu+1) \\)","locator":"Figure 4, steps 2a and 4a, p. 12; §6.1, p. 11; §4, p. 6","measure":"computation","note":"One phasing hash per item, then one output hash per sender encoding, \\( \\mu \\) per item","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n(\\mu+1) \\)","locator":"Figure 4, steps 2b and 4b, p. 12; §6.1, p. 11; §4, p. 6","measure":"computation","note":"One phasing hash per item, then one output hash per sender encoding, \\( \\mu \\) per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","name":"RR17 DE-ROM","paper_ids":["PSI-PAPER-2017-RR-CCS"],"primitive":"two-party PSI","schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 4, step 1, p. 12","phase":"online","what":"coin tossing for the hash function of the bins"},{"after":["coin"],"blocks":["encode"],"id":"encode","locator":"Figure 4, steps 2–3, p. 12","phase":"online","what":"oblivious encodings both ways, one per bin position, on the phased items"},{"after":["encode"],"from":"sender","id":"common","locator":"Figure 4, step 4a, p. 12","phase":"online","what":"Alice's common encodings"}],"security":{"mode":"computational","model":"malicious, UC, F_encode-hybrid; F_encode in the programmable random oracle model (Theorem 2, p. 13; §4, p. 6)","notion":"PSI with output to Bob; corrupt party's set bounded by \\( m\\mu \\) for \\( m \\) bins of \\( \\mu \\) items"},"status":"published","title":"Rindal-Rosulek malicious dual-execution PSI with random-oracle oblivious encodings","variables":[{"meaning":"Number of bins, \\( O(n/\\log n) \\): \\( n/4 \\) on a LAN and \\( n/10 \\) on a WAN","symbol":"m"},{"meaning":"Bin size, \\( O(\\log n) \\): the most items a bin holds except with probability \\( 2^{-\\lambda} \\)","symbol":"\\mu"}],"work_id":"PSI-PAPER-2017-RR-CCS","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/769","sections":[{"content":"Malicious PSI that applies dual execution to the PSZ paradigm: each bin position runs an oblivious encoding in each direction, and Alice sends the XOR of both encodings for her items, aggregated across bins. Simple hashing with phasing replaces cuckoo hashing, whose placement a malicious party could exploit.","heading":"Summary"}],"slug":"rr17-rr17-de-rom","status":"fulltext_checked","subtitle":"two-party PSI · 2017","summary":"Malicious PSI that applies dual execution to the PSZ paradigm: each bin position runs an oblivious encoding in each direction, and Alice sends the XOR of both encodings for her items, aggregated across bins. Simple hashing with phasing replaces cuckoo hashing, whose placement a malicious party could exploit.","title":"RR17 DE-ROM","type":"construction","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM"},{"contributions":["PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","keywords":["two-party psi","commitment_oblivious_encoding","symmetric-key-only","exact-sender-set-size"],"metadata":{"assumption":{"family":"symmetric","name":"random-oracle commitment \\( H(x \\| r) \\) and Orrù-Orsini-Scholl OT extension in the programmable random oracle model"},"attributes":{"adversary":{"locator":"Theorem 3, p. 16; §6.5, p. 17","note":"Alice is held to exactly \\( n \\) items; a corrupt Bob may use up to \\( m\\mu \\)","value":["malicious"]},"assumptions":{"locator":"§6.4, p. 16; Figure 9, p. 27; Appendix A, p. 26","note":"Tags and decommitment keys come from a PRF; commitments and the encodings rest on random oracles","value":["PRF"]},"output":{"locator":"Figure 9, p. 27","value":["intersection"]},"output_to":{"locator":"Figure 9, step 4, p. 27","note":"Bob only","value":"one"},"parties":{"locator":"Figure 9, p. 27","value":"two_party"},"security_model":{"locator":"Theorem 3, p. 16; Appendix A, p. 26; §4, p. 6","note":"UC in the F_encode-hybrid model; the commitment needs only a non-programmable oracle, OOS a programmable one","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 9, p. 27","value":"balanced"},"technique":{"locator":"§6.4, pp. 15–16; Figure 9, p. 27","value":["encode_commit","ot_extension","simple_hashing","permutation_based_hashing"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"count":"\\( m\\mu \\)","func":"encode","id":"encode","implementation":"OOS16 1-out-of-N OT, BCH-(511, 76, 171) code","instantiation":"oos17_encode","locator":"Figure 9, step 3, p. 27; Theorem 3, p. 16; §7, p. 18","note":"One instance per bin position, Bob receiving","params":{"in":"\\( \\sigma-\\log n \\)","out":"\\( \\lambda+2\\log(n\\mu) \\)"},"phase":"online","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 9, step 1, p. 27","note":"Agrees on the hash function and the commitment parameters"}],"capabilities":["symmetric-key-only","exact-sender-set-size"],"claim_ids":["PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT"],"construction_family":"commitment_oblivious_encoding","costs":[{"basis":"counted","formula":"\\( n(C+\\mu(T+D)) \\)","locator":"Figure 9, step 4, p. 27; §6.4, p. 16","measure":"communication","note":"Per item a commitment and \\( \\mu \\) tags, each with the decommitment masked by an encoding","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 9, p. 27","measure":"communication","note":"Bob sends only the flows of the encodings and the coin toss","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n(3\\mu+2) \\)","locator":"Figure 9, steps 2a and 4, p. 27; §4, p. 6","measure":"computation","note":"Per item a phasing hash and a commitment; per sender encoding its output hash and the tag and mask PRF calls","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n+2m\\mu+M \\)","locator":"Figure 9, steps 2b, 3 and 4, p. 27; §6.4, p. 16","measure":"computation","note":"A phasing hash per item, the tag and mask PRF calls at every bin position, and one trial decommitment per tag match","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","name":"RR17 EC-ROM","paper_ids":["PSI-PAPER-2017-RR-CCS"],"primitive":"two-party PSI","schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 9, step 1, p. 27","phase":"online","what":"coin tossing for the hash function and the commitment parameters"},{"after":["coin"],"blocks":["encode"],"id":"encode","locator":"Figure 9, steps 2–3, p. 27","phase":"online","what":"Bob's oblivious encodings, one per bin position, on the phased items"},{"after":["encode"],"from":"sender","id":"commit","locator":"Figure 9, step 4, p. 27","phase":"online","what":"Alice's commitments with their tagged, masked decommitments"}],"security":{"mode":"computational","model":"malicious, UC, F_encode-hybrid with an extractable hiding commitment, random oracle model (Theorem 3, p. 16; Appendix A, p. 26)","notion":"PSI with output to Bob; Alice restricted to exactly \\( n \\) items"},"status":"published","title":"Rindal-Rosulek malicious encode-commit PSI with random-oracle commitments and oblivious encodings","variables":[{"meaning":"Number of bins, \\( O(n/\\log n) \\): \\( n/4 \\) on a LAN and \\( n/10 \\) on a WAN","symbol":"m"},{"meaning":"Bin size, \\( O(\\log n) \\): the most items a bin holds except with probability \\( 2^{-\\lambda} \\)","symbol":"\\mu"},{"meaning":"Bits of a commitment \\( H(x \\| r) \\); the paper puts it at about \\( 2\\kappa \\)","symbol":"C"},{"meaning":"Bits of a decommitment \\( r \\), and of each mask over it; the paper puts it at about \\( \\kappa \\)","symbol":"D"},{"meaning":"Bits of a tag; the protocol fixes none, and the paper's asymptotic count takes about \\( \\log n \\)","symbol":"T"},{"meaning":"Tag matches Bob opens with a trial decommitment: one per intersecting item, plus false matches","symbol":"M"}],"work_id":"PSI-PAPER-2017-RR-CCS","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/769","sections":[{"content":"Malicious PSI in which Bob obliviously encodes his binned items and Alice commits to each of her items, sending decommitments masked under PRFs of her encodings with tags that let Bob find which to open. Commitments are H(x‖r) in the random oracle model.","heading":"Summary"}],"slug":"rr17-rr17-ec-rom","status":"fulltext_checked","subtitle":"two-party PSI · 2017","summary":"Malicious PSI in which Bob obliviously encodes his binned items and Alice commits to each of her items, sending decommitments masked under PRFs of her encodings with tags that let Bob find which to open. Commitments are H(x‖r) in the random oracle model.","title":"RR17 EC-ROM","type":"construction","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM"},{"contributions":["PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","keywords":["two-party psi","dual_execution_oblivious_encoding","no-random-oracle"],"metadata":{"assumption":{"family":"symmetric","name":"PRF, correlation-robust hash, and actively secure OT extension, without random oracles"},"attributes":{"adversary":{"locator":"Theorem 2, p. 13; §6.3, p. 15","note":"A corrupt party may use up to \\( m\\mu \\) items","value":["malicious"]},"assumptions":{"locator":"§4, pp. 6–7; Figure 6, p. 19; §7, p. 18","note":"Also actively secure OT extension","value":["PRF","CR hash"]},"output":{"locator":"Figure 4, p. 12","value":["intersection"]},"output_to":{"locator":"Figure 4, p. 12; §6.7, pp. 17–18","note":"Bob only","value":"one"},"parties":{"locator":"Figure 4, p. 12","value":"two_party"},"security_model":{"locator":"Theorem 2, p. 13; §4, pp. 6–7","note":"UC in the F_encode-hybrid model, a hybrid model; encodings from chosen-message OTs and a PRF","value":["standard model"]},"set_size_regime":{"locator":"Figure 4, p. 12","value":"balanced"},"technique":{"locator":"§6.1–6.2, pp. 10–12; Figure 4, p. 12","value":["dual_execution","ot_extension","simple_hashing","permutation_based_hashing"]}},"blocks":[{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"count":"\\( m\\mu(\\sigma-\\log n) \\)","func":"ot","id":"ot","implementation":"KOS15 chosen-message 1-out-of-2 OT extension","instantiation":"kos15","locator":"§4, pp. 6–7; Figure 4, step 3, p. 12; §7, p. 18; Figure 8, p. 20","note":"Per direction, \\( \\sigma-\\log n \\) OTs of \\( \\kappa \\)-bit strings per encoding, run offline on random choices; each party receives one way and sends the other","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":["sender","receiver"],"sender":["sender","receiver"]}},{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 4, step 1, p. 12","note":"Agrees on the hash function of the bins"}],"capabilities":["no-random-oracle"],"claim_ids":["PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION"],"construction_family":"dual_execution_oblivious_encoding","costs":[{"basis":"counted","formula":"\\( n\\mu(\\lambda+2\\log(n\\mu))+m\\mu(\\sigma-\\log n) \\)","locator":"Figure 4, steps 3–4, p. 12; §6.2, p. 12; Figure 8, p. 20","measure":"communication","note":"Alice's common encodings, and one bit per OT she receives to flip a choice made at random offline","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( m\\mu(\\sigma-\\log n) \\)","locator":"Figure 4, step 3, p. 12; Figure 8, p. 20; §7.1, p. 21","measure":"communication","note":"One bit per OT he receives, flipping a choice made at random offline","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n+\\mu(n+m)(\\sigma-\\log n) \\)","locator":"Figure 4, steps 2a, 3a and 4a, p. 12; §4, pp. 6–7","measure":"computation","note":"A phasing hash per item; one PRF call per input bit for its receiver encoding at every bin position and for each of its sender encodings","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n+\\mu(n+m)(\\sigma-\\log n) \\)","locator":"Figure 4, steps 2b, 3b and 4b, p. 12; §4, pp. 6–7","measure":"computation","note":"As Alice's: Bob's encodings mirror hers","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","name":"RR17 SM","paper_ids":["PSI-PAPER-2017-RR-CCS"],"primitive":"two-party PSI","schedule":[{"blocks":["ot"],"id":"ot","locator":"§4, pp. 6–7; §7, p. 18; Figure 8, p. 20; §7.1, pp. 20–21","phase":"offline","what":"chosen-message OTs both ways, on random choices"},{"blocks":["coin"],"id":"coin","locator":"Figure 4, step 1, p. 12","phase":"online","what":"coin tossing for the hash function of the bins"},{"after":["ot","coin"],"from":"receiver","id":"flip_b","locator":"Figure 4, steps 2b and 3b, p. 12; Figure 8, p. 20","phase":"online","what":"Bob's choice flips, one per OT he receives"},{"after":["ot","coin"],"from":"sender","id":"flip_a","locator":"Figure 4, steps 2a and 3a, p. 12; Figure 8, p. 20","phase":"online","what":"Alice's choice flips, one per OT she receives"},{"after":["flip_b"],"from":"sender","id":"common","locator":"Figure 4, step 4a, p. 12","phase":"online","what":"Alice's common encodings"}],"security":{"mode":"computational","model":"malicious, UC, F_encode-hybrid, standard model (Theorem 2, p. 13; §4, pp. 6-7)","notion":"PSI with output to Bob; corrupt party's set bounded by \\( m\\mu \\) for \\( m \\) bins of \\( \\mu \\) items"},"status":"published","title":"Rindal-Rosulek malicious dual-execution PSI with standard-model oblivious encodings","variables":[{"meaning":"Number of bins, \\( O(n/\\log n) \\): \\( n/4 \\) on a LAN and \\( n/10 \\) on a WAN","symbol":"m"},{"meaning":"Bin size, \\( O(\\log n) \\): the most items a bin holds except with probability \\( 2^{-\\lambda} \\)","symbol":"\\mu"}],"work_id":"PSI-PAPER-2017-RR-CCS","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/769","sections":[{"content":"The dual-execution PSI of RR17 with each oblivious encoding built from σ chosen-message OTs combined through a PRF, so no random oracle is needed. The cost grows with the item length σ.","heading":"Summary"}],"slug":"rr17-rr17-sm","status":"fulltext_checked","subtitle":"two-party PSI · 2017","summary":"The dual-execution PSI of RR17 with each oblivious encoding built from σ chosen-message OTs combined through a PRF, so no random oracle is needed. The cost grows with the item length σ.","title":"RR17 SM","type":"construction","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2017-RR-CCS-SM"},{"contributions":["PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2018-CHLR-LONG-ITEMS","PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-CHLR","keywords":["unbalanced psi","oprf_fhe_polynomial_evaluation_cuckoo_hashing","arbitrary-length-items","reusable-sender-preprocessing","malicious-receiver-security","communication-sublinear-in-larger-set"],"metadata":{"assumption":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)"},"attributes":{"adversary":{"locator":"Theorem 1, p. 15; Theorem 2, p. 16","note":"One-sided simulation against the receiver","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"Theorems 1–2, pp. 15–16; §4.3, p. 10","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"Figure 3, p. 15","value":["intersection"]},"output_to":{"locator":"Figure 2, step 9, p. 14; Figure 3, p. 15","value":"one"},"parties":{"locator":"Figure 2, p. 14","value":"two_party"},"security_model":{"locator":"Theorem 1, p. 15; §4.3, p. 10; Figure 1, step 1, p. 13","note":"The inner OPRF hash and the hash to short strings are random oracles; extraction observes queries","value":["random oracle"]},"set_size_regime":{"locator":"Abstract, p. 1; §1.1, p. 1","value":"unbalanced"},"technique":{"locator":"Figures 1–2, pp. 13–14; §4.3, p. 10","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"blocks":[{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 1, steps 1–2, p. 13","note":"Samples the hash to short strings and the three cuckoo hash functions","phase":"setup","roles":{"party":["sender","receiver"]}}],"capabilities":["arbitrary-length-items","reusable-sender-preprocessing","malicious-receiver-security","communication-sublinear-in-larger-set"],"claim_ids":["PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2018-CHLR-LONG-ITEMS","PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION"],"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","costs":[{"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3, p. 10; §3.1, p. 7; Figure 2, step 7, p. 14; §8.1, p. 18","measure":"communication","note":"Blinded OPRF queries, then window powers per batch; symmetric-key BFV nearly halves fresh ciphertexts in the implementation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3.1, p. 7; Figure 2, step 8, p. 14","measure":"communication","note":"OPRF answers, then one reply per subset and batch at full width; modulus switching shrinks the reply","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 1, step 1, p. 13; §4.3, p. 10","measure":"computation","note":"OPRF on its own set, reusable with many receivers","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O(m\\alpha B^{2}) \\)","locator":"Figure 1, step 5, p. 13; §8.2, p. 19","measure":"computation","note":"Coefficients of each subset's symmetric polynomial over the slot extension field","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 6n_X \\)","locator":"Figure 1, steps 1–2, p. 13; §4.3, p. 10","measure":"computation","note":"Per item: the OPRF hash to the group and output hash, the hash to short strings, and the three cuckoo hash functions of simple hashing","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.3, p. 10","measure":"computation","note":"One answer per blinded OPRF query","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}(B-1) \\)","locator":"Figure 2, step 8a, p. 14","measure":"computation","note":"One product per power from the square up to the split size, shared by the subsets","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}(2B+1) \\)","locator":"Figure 2, step 8b, p. 14; §4.2, p. 9","measure":"computation","note":"\\( B+1 \\) plaintext products and \\( B \\) additions per subset and batch; the OPRF removes the flooding","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4.3, p. 10","measure":"computation","note":"Blinding and unblinding each OPRF query","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","locator":"Figure 2, steps 7 and 9, p. 14","measure":"computation","note":"BFV encryptions of the window powers and decryptions of the replies","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 6n_Y \\)","locator":"Figure 2, steps 7a–7b, p. 14; §4.3, p. 10","measure":"computation","note":"Per item: the OPRF hash to the group and output hash, the hash to short strings, and the three cuckoo hash functions; re-insertions, unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-CHLR","name":"CHLR18 PSI","paper_ids":["PSI-PAPER-2018-CHLR","PSI-PAPER-2017-CLR"],"primitive":"unbalanced PSI","schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 1, steps 1–2, p. 13","phase":"setup","what":"Coin flipping for the hash to short strings and the three cuckoo hash functions"},{"from":"receiver","id":"keys","locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","phase":"setup","what":"Evaluation keys, sent once and reused"},{"from":"receiver","id":"oprf_query","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"Blinded OPRF queries, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"OPRF answers under the sender's key"},{"after":["coin","oprf_answer"],"from":"receiver","id":"query","locator":"Figure 2, steps 7b–7e, p. 14","phase":"online","what":"Encrypted window powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 2, step 8, p. 14","phase":"online","what":"Dot-product results, one per subset and batch, optionally modulus-switched"}],"security":{"mode":"computational","model":"one-sided simulation against a malicious receiver in the random oracle hybrid (Theorem 1, p. 15); privacy against a malicious sender (Theorem 2, p. 16)","notion":"PSI with output to the receiver (Figure 3)"},"status":"published","title":"CHLR18 unbalanced PSI from Diffie-Hellman OPRF pre-processing and leveled BFV with extension-field SIMD slots","variables":[{"meaning":"Cuckoo hash table bins, \\( O(n_Y) \\)","symbol":"m"},{"meaning":"SIMD slots per BFV ciphertext, the ring dimension over the slot extension degree","symbol":"k"},{"meaning":"Split size: the most items in one subset of a sender bin","symbol":"B"},{"meaning":"Subsets per sender bin","symbol":"\\alpha"},{"meaning":"Window base for the receiver's powers","symbol":"w"}],"work_id":"PSI-PAPER-2018-CHLR","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"The CLR17 protocol run on OPRF outputs: both sets pass through a Diffie-Hellman OPRF keyed by the sender, which removes noise flooding and lets the receiver be extracted, and extension-field SIMD slots carry long items. The sender's pre-processing of its OPRF-processed set is reusable with many receivers.","heading":"Summary"}],"slug":"chlr18-chlr18-psi","status":"fulltext_checked","subtitle":"unbalanced PSI · 2018","summary":"The CLR17 protocol run on OPRF outputs: both sets pass through a Diffie-Hellman OPRF keyed by the sender, which removes noise flooding and lets the receiver be extracted, and extension-field SIMD slots carry long items. The sender's pre-processing of its OPRF-processed set is reusable with many receivers.","title":"CHLR18 PSI","type":"construction","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2018-CHLR"},{"contributions":["PSI-CONTRIB-2018-CHLR-LABELED-PSI","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2018-CHLR-LONG-ITEMS","PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","keywords":["labeled psi","oprf_fhe_polynomial_evaluation_cuckoo_hashing","labels-for-matching-items","communication-sublinear-in-larger-set","reusable-sender-preprocessing","batched-keyword-pir"],"metadata":{"assumption":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)"},"attributes":{"adversary":{"locator":"Theorems 1–2, pp. 15–16; Figure 3, p. 15","note":"One-sided simulation against the receiver; the theorems cover the unlabeled functionality; no labeled functionality is stated","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"Theorems 1–2, pp. 15–16; §4.3, p. 10","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"Figure 2, step 9, p. 14; §1.1, p. 2","value":["labeled"]},"output_to":{"locator":"Figure 2, step 9, p. 14","value":"one"},"parties":{"locator":"Figure 2, p. 14","value":"two_party"},"security_model":{"locator":"Theorem 1, p. 15; Figure 1, step 1, p. 13","value":["random oracle"]},"set_size_regime":{"locator":"Abstract, p. 1","value":"unbalanced"},"technique":{"locator":"Figures 1–2, pp. 13–14; §5.2, p. 12","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"blocks":[{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 1, steps 1–2, p. 13","note":"Samples the hash to short strings and the three cuckoo hash functions","phase":"setup","roles":{"party":["sender","receiver"]}}],"capabilities":["labels-for-matching-items","communication-sublinear-in-larger-set","reusable-sender-preprocessing","batched-keyword-pir"],"claim_ids":["PSI-CONTRIB-2018-CHLR-LABELED-PSI","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2018-CHLR-LONG-ITEMS"],"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","costs":[{"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.3, p. 10; Figure 2, step 7, p. 14","measure":"communication","note":"As unlabeled; labels add nothing to the query","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (1+c)\\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"Figure 2, step 8, p. 14; §5.1, pp. 11–12","measure":"communication","note":"Intersection results plus one label result per chunk, per subset and batch","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 1, step 1, p. 13","measure":"computation","note":"OPRF on its own set, reusable with many receivers","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O((1+c)m\\alpha B^{2}) \\)","locator":"Figure 1, step 5b, p. 13; §5.1, p. 12","measure":"computation","note":"Each subset's symmetric polynomial, then a Newton interpolation per label chunk, each \\( O(B^2) \\) in the split size \\( B \\)","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 7n_X \\)","locator":"Figure 1, steps 1–2, p. 13; §4.3, p. 10; §5.2 and footnote 7, p. 12","measure":"computation","note":"As unlabeled, six per item, plus a PRG call per item that stretches the second part of its OPRF value into a pad as long as its label","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}(B-1) \\)","locator":"Figure 2, step 8a, p. 14","measure":"computation","note":"Powers up to the split size, computed once per batch and shared by the intersection and label polynomials","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( (1+c)\\alpha\\frac{m}{k}(2B+1) \\)","locator":"Figure 2, step 8b, p. 14; §5.1, p. 11","measure":"computation","note":"The dot product repeated for each label chunk: \\( B+1 \\) plaintext products and \\( B \\) additions per polynomial, subset and batch","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+(1+c)\\alpha\\right)\\frac{m}{k} \\)","locator":"Figure 2, steps 7 and 9, p. 14","measure":"computation","note":"BFV encryptions of the window powers and decryptions of all results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 7n_Y \\)","locator":"Figure 2, steps 7a–7b and 9, p. 14; §4.3, p. 10; §5.2 and footnote 7, p. 12","measure":"computation","note":"As unlabeled, six per item, plus a PRG call per item in the intersection to strip its pad, counted for every item; cuckoo re-insertions add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","name":"CHLR18 labeled PSI","paper_ids":["PSI-PAPER-2018-CHLR","PSI-PAPER-2017-CLR"],"primitive":"labeled PSI","schedule":[{"blocks":["coin"],"id":"coin","locator":"Figure 1, steps 1–2, p. 13","phase":"setup","what":"Coin flipping for the hash to short strings and the three cuckoo hash functions"},{"from":"receiver","id":"keys","locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","phase":"setup","what":"Evaluation keys, sent once and reused"},{"from":"receiver","id":"oprf_query","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"Blinded OPRF queries, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"Figure 2, step 7a, p. 14; §4.3, p. 10","phase":"online","what":"OPRF answers under the sender's key"},{"after":["coin","oprf_answer"],"from":"receiver","id":"query","locator":"Figure 2, steps 7b–7e, p. 14","phase":"online","what":"Encrypted window powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 2, step 8b, p. 14","phase":"online","what":"Intersection results, one per subset and batch"},{"from":"sender","id":"labels","locator":"Figure 2, step 8b, p. 14; §5.1, pp. 11–12","phase":"online","what":"Label results, one per chunk, subset and batch, returned with the intersection results","with":"reply"}],"security":{"mode":"computational","model":"Theorems 1-2 (pp. 15-16) stated for the unlabeled functionality","notion":"labeled PSI with output to the receiver (no ideal functionality stated for labels)"},"status":"published","title":"CHLR18 labeled PSI from OPRF-padded label-interpolation polynomials under leveled BFV","variables":[{"meaning":"Cuckoo hash table bins, \\( O(n_Y) \\)","symbol":"m"},{"meaning":"SIMD slots per BFV ciphertext, the ring dimension over the slot extension degree","symbol":"k"},{"meaning":"Split size: the most items in one subset of a sender bin","symbol":"B"},{"meaning":"Subsets per sender bin","symbol":"\\alpha"},{"meaning":"Window base for the receiver's powers","symbol":"w"},{"meaning":"Label chunks per item: label length over item length, rounded up","symbol":"c"}],"work_id":"PSI-PAPER-2018-CHLR","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"Labeled PSI on the CHLR18 protocol: the sender pads each label with the second half of its item's OPRF output and interpolates, per subset, a polynomial that maps items to padded labels. It evaluates these polynomials on the receiver's encrypted powers next to the intersection polynomials, keeping communication sublinear in \\( n_X \\).","heading":"Summary"}],"slug":"chlr18-chlr18-labeled-psi","status":"fulltext_checked","subtitle":"labeled PSI · 2018","summary":"Labeled PSI on the CHLR18 protocol: the sender pads each label with the second half of its item's OPRF output and interpolates, per subset, a polynomial that maps items to padded labels. It evaluates these polynomials on the receiver's encrypted powers next to the intersection polynomials, keeping communication sublinear in \\( n_X \\).","title":"CHLR18 labeled PSI","type":"construction","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2018-CHLR-LABELED"},{"contributions":["PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","PSI-CONTRIB-2018-CHLR-LABELED-PSI","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","keywords":["unbalanced psi","oprf_fhe_polynomial_evaluation_cuckoo_hashing","malicious-sender-with-leakage","malicious-receiver-security","communication-sublinear-in-larger-set"],"metadata":{"assumption":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure H-limited leveled FHE"},"attributes":{"adversary":{"locator":"Theorem 3, p. 25","tip":"Simulation against either party, for a leaky functionality in which a malicious sender may drop receiver items.","value":["malicious"]},"assumptions":{"locator":"Theorem 3, p. 25; Definition 1, p. 17","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF; also an H-limited FHE assumption argued heuristically","value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"Figure 7, p. 25; Figure 8, p. 25","note":"Against a malicious sender the receiver gets the intersection further cut by a sender-chosen leakage function of its set","value":["intersection"]},"output_to":{"locator":"Figure 7, p. 25","value":"one"},"parties":{"locator":"Figure 8, p. 25","value":"two_party"},"security_model":{"locator":"Theorem 3 and its proof, pp. 25–26","note":"Non-black-box simulation; the reduction programs the OPRF random oracle","value":["programmable random oracle"]},"set_size_regime":{"locator":"§7.3, p. 17","value":"unbalanced"},"technique":{"locator":"Figure 8, p. 25","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"blocks":[{"cites":[],"func":"coin_toss","id":"coin","locator":"Figure 8, step 1, p. 25; Figure 1, steps 1–2, p. 13; §7.3, pp. 17–18","note":"Samples the hash functions per receiver, since the pre-processing is not reused","phase":"offline","roles":{"party":["sender","receiver"]}},{"cites":[],"func":"zk","id":"zk","locator":"Figure 8, step 1b, p. 25; proof of Theorem 3, pp. 25–26","note":"That all OPRF answers use one key","phase":"online","roles":{"prover":"sender","verifier":"receiver"}}],"capabilities":["malicious-sender-with-leakage","malicious-receiver-security","communication-sublinear-in-larger-set"],"claim_ids":["PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","PSI-CONTRIB-2018-CHLR-LABELED-PSI","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER"],"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","costs":[{"locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","measure":"communication","note":"Evaluation keys, which this paper neither names nor sizes; a later paper lists their sizes as an offline cost, sent once and reused","per":"client","phase":"setup","source":"PSI-PAPER-2021-CONG","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"Figure 8, step 1, p. 25; Figure 2, step 7, p. 14","measure":"communication","note":"As in the semi-honest-sender protocol","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"Figure 8, steps 1b and 2, p. 25","measure":"communication","note":"OPRF answers, then the label-polynomial results only","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§7.3, pp. 17–18; Figure 8, step 1, p. 25","measure":"computation","note":"Pre-processing per receiver: jointly sampled hash functions are not reused","operation":"exponentiation","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( O(m\\alpha B^{2}) \\)","locator":"§5.1–5.2, p. 12; Figure 8, step 1a, p. 25","measure":"computation","note":"Interpolation of the hash-valued label polynomials, \\( O(B^2) \\) in the split size \\( B \\); symmetric polynomials are skipped","operation":"field_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 7n_X \\)","locator":"Figure 8, step 1a, p. 25; Figure 1, steps 1–2, p. 13; §4.3, p. 10","measure":"computation","note":"As in the semi-honest-sender protocol, six per item, plus hashing each item into its label","operation":"symmetric_op","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}(B-1) \\)","locator":"Figure 8, step 2, p. 25; Figure 2, step 8a, p. 14","measure":"computation","note":"Powers up to the split size, shared by the subsets; label polynomials replace the symmetric ones","operation":"hom_mult","phase":"online","subject":"sender","tip":"An upper bound: a power the receiver sends needs no product."},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}(2B+1) \\)","locator":"Figure 8, step 2, p. 25; Figure 2, step 8b, p. 14","measure":"computation","note":"The label polynomials' dot products only: \\( B+1 \\) plaintext products and \\( B \\) additions per subset and batch","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4.3, p. 10","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left((w-1)\\left(\\lfloor\\log_w B\\rfloor+1\\right)+\\alpha\\right)\\frac{m}{k} \\)","locator":"Figure 8, step 3, p. 25","measure":"computation","note":"BFV encryptions of the window powers and decryptions of the label results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 7n_Y \\)","locator":"Figure 8, steps 1 and 3, p. 25; Figure 2, steps 7a–7b, p. 14; §4.3, p. 10","measure":"computation","note":"As in the semi-honest-sender protocol, six per item, plus hashing each item to compare with its decrypted label result; cuckoo re-insertions add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","name":"CHLR18 leaky malicious PSI","paper_ids":["PSI-PAPER-2018-CHLR"],"primitive":"unbalanced PSI","schedule":[{"from":"receiver","id":"keys","locator":"CMGD21 Table 5, p. 19; CMGD21 §5.4, p. 19","phase":"setup","what":"Evaluation keys, sent once and reused"},{"blocks":["coin"],"id":"coin","locator":"Figure 8, step 1, p. 25; Figure 1, steps 1–2, p. 13","phase":"offline","what":"Coin flipping for the hash functions, per receiver, before the sender's pre-processing"},{"from":"receiver","id":"oprf_query","locator":"Figure 8, step 1, p. 25; Figure 2, step 7a, p. 14","phase":"online","what":"Blinded OPRF queries, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"Figure 8, step 1b, p. 25; Figure 2, step 7a, p. 14","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_query"],"blocks":["zk"],"id":"zk","locator":"Figure 8, step 1b, p. 25","phase":"online","what":"Proof that every OPRF answer uses the one key, given with the answers"},{"after":["coin","oprf_answer","zk"],"from":"receiver","id":"query","locator":"Figure 8, step 1, p. 25; Figure 2, steps 7b–7e, p. 14","phase":"online","what":"Encrypted window powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"Figure 8, step 2, p. 25","phase":"online","what":"Results of the hash-valued label polynomials only, one per subset and batch"}],"security":{"mode":"computational","model":"non-black-box simulation in the random oracle hybrid (Theorem 3, p. 25)","notion":"leaky PSI functionality \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\) (Figure 7)"},"status":"published","title":"CHLR18 malicious PSI with leakage: hash-valued labels under an H-limited leveled FHE assumption","variables":[{"meaning":"Cuckoo hash table bins, \\( O(n_Y) \\)","symbol":"m"},{"meaning":"SIMD slots per BFV ciphertext, the ring dimension over the slot extension degree","symbol":"k"},{"meaning":"Split size: the most items in one subset of a sender bin","symbol":"B"},{"meaning":"Subsets per sender bin","symbol":"\\alpha"},{"meaning":"Window base for the receiver's powers","symbol":"w"}],"work_id":"PSI-PAPER-2018-CHLR","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"Labeled PSI with the label of each item set to a random-oracle hash of its OPRF value, so a correct label for a receiver item requires knowing that item. Under the assumption that the FHE parameters cannot evaluate the hash, a malicious sender is restricted to a polynomial-size set and a leakage function that can only remove items.","heading":"Summary"}],"slug":"chlr18-chlr18-leaky-malicious-psi","status":"fulltext_checked","subtitle":"unbalanced PSI · 2018","summary":"Labeled PSI with the label of each item set to a random-oracle hash of its OPRF value, so a correct label for a receiver item requires knowing that item. Under the assumption that the FHE parameters cannot evaluate the hash, a malicious sender is restricted to a polynomial-size set and a leakage function that can only remove items.","title":"CHLR18 leaky malicious PSI","type":"construction","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE"},{"contributions":["PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-PSWW-2D","keywords":["circuit-psi","cuckoo_hashing_circuit_psi","any-symmetric-function-of-intersection","combined-stash","associated-data"],"metadata":{"assumption":{"family":"generic","name":"Semi-honest generic two-party computation (GMW or Yao); no assumption stated"},"attributes":{"adversary":{"locator":"§2, p. 6; §5.4, p. 18","note":"The authors see no extension to malicious adversaries.","value":["semi_honest"]},"assumptions":{"note":"Security is inherited from the generic two-party protocol; no assumption is stated.","value":"not_reported"},"output":{"locator":"§2, p. 5; §6.3, p. 24","note":"Any symmetric function f of the intersection; the measured instance tests whether its size exceeds a threshold.","value":["circuit"]},"output_to":{"locator":"§2, p. 5; §5.2, p. 16","note":"Per-item match bits stay inside the generic protocol; both parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2, p. 5","value":"two_party"},"security_model":{"note":"No proof is given; the protocol inherits the generic protocol's security.","value":"not_reported"},"set_size_regime":{"locator":"§2, p. 5","value":"balanced"},"technique":{"locator":"§5.2, pp. 16-17; §6.3, p. 24","value":["cuckoo_hashing","permutation_based_hashing","gmw"]}},"blocks":[{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"},{"key":"DSZ15","title":"ABY – a framework for efficient mixed-protocol secure two-party computation"}],"func":"two_pc","id":"two_pc","implementation":"GMW, in the ABY framework","instantiation":"gmw_iknp","locator":"§5.2, pp. 16–17; §6.2, pp. 22–23; §6.3, p. 24","note":"The matching circuit up to one bit per item; the circuit for f adds its own gates and depth","params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"},"roles":{"party":["sender","receiver"]}}],"capabilities":["any-symmetric-function-of-intersection","combined-stash","associated-data"],"claim_ids":["PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING"],"construction_family":"cuckoo_hashing_circuit_psi","costs":[{"basis":"counted","formula":"\\( 0 \\)","locator":"§5.2, p. 16","measure":"communication","note":"Alice sends only inside the generic two-party computation","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§5.2, p. 16","measure":"communication","note":"Bob sends only inside the generic two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( 4n \\)","locator":"Algorithm 2, p. 15; Algorithm 3, p. 16; §5.2, pp. 16–17","measure":"computation","note":"Alice's 2D Cuckoo hashing: each item's positions under the four hash functions, each computed once and kept across relocations","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§5.1, p. 15; §5.2, pp. 16–17","measure":"computation","note":"Bob's Cuckoo hashing into both tables: each item's two positions per table, each computed once","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-PSWW-2D","name":"PSWW 2D cuckoo circuit-PSI","paper_ids":["PSI-PAPER-2018-PSWW"],"primitive":"circuit-PSI","schedule":[{"blocks":["two_pc"],"id":"circuit","locator":"§5.2, p. 16; §6.3, p. 24","phase":"online","what":"GMW evaluation of the circuit comparing each bin and the combined stash, then f"}],"security":{"mode":"computational","model":"semi-honest two-party; security is inherited from the generic protocol, no proof given (§5.2, p. 16)","notion":"\\( f(X \\cap Y) \\) for a symmetric function f, revealing nothing else"},"status":"published","title":"PSWW circuit-based PSI from iterative 2D cuckoo hashing with two-item bins and a combined stash, semi-honest two-party, GMW","variables":[{"meaning":"Size of Bob's combined stash","symbol":"s_c"},{"meaning":"AND gates of the matching circuit, \\( 4\\cdot 2.4n(\\sigma - \\log_2(2.4n) + 1) + s_cn(\\sigma - 1) \\)","symbol":"g"}],"work_id":"PSI-PAPER-2018-PSWW","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/120","sections":[{"content":"Circuit-based PSI from iterative two-dimensional cuckoo hashing: Alice places each item in both bins of one of two tables with two-item bins and no stash, Bob places each item once in each table with one combined stash, so a common item meets in exactly one bin, and a GMW circuit compares bins and stash before computing f.","heading":"Summary"}],"slug":"psww18-psww-2d-cuckoo-circuit","status":"fulltext_checked","subtitle":"circuit-PSI · 2018","summary":"Circuit-based PSI from iterative two-dimensional cuckoo hashing: Alice places each item in both bins of one of two tables with two-item bins and no stash, Bob places each item once in each table with one combined stash, so a common item meets in exactly one bin, and a GMW circuit compares bins and stash before computing f.","title":"PSWW 2D cuckoo circuit-PSI","type":"construction","venue":"EUROCRYPT 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2018-PSWW-2D"},{"contributions":["PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","keywords":["circuit-psi","cuckoo_hashing_circuit_psi","any-symmetric-function-of-intersection","non-constant-stash"],"metadata":{"assumption":{"family":"generic","name":"Semi-honest generic two-party computation (GMW or Yao); no assumption stated"},"attributes":{"adversary":{"locator":"§2, p. 6","value":["semi_honest"]},"assumptions":{"note":"Security is inherited from the generic two-party protocol; no assumption is stated.","value":"not_reported"},"output":{"locator":"§2, p. 5; §4.2, p. 13","note":"Any symmetric function f of the intersection.","value":["circuit"]},"output_to":{"locator":"§4.2, p. 13","note":"Per-bin match results stay inside the generic protocol; both parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2, p. 5","value":"two_party"},"security_model":{"note":"No proof is given; the protocol inherits the generic protocol's security.","value":"not_reported"},"set_size_regime":{"locator":"§2, p. 5","value":"balanced"},"technique":{"locator":"§4.1, pp. 10-12; §6.2, p. 22","value":["cuckoo_hashing","permutation_based_hashing"]}},"blocks":[{"cites":[],"func":"two_pc","id":"two_pc","locator":"§4.2, p. 13; §6.2, pp. 22–23","note":"Yao or GMW, not fixed; the circuit for f adds its own gates and depth","params":{"depth":"\\( \\log_2\\sigma \\)","|C|":"\\( g \\)"}}],"capabilities":["any-symmetric-function-of-intersection","non-constant-stash"],"claim_ids":["PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT"],"construction_family":"cuckoo_hashing_circuit_psi","costs":[{"basis":"counted","formula":"\\( 0 \\)","locator":"§4.2, p. 13","measure":"communication","note":"Alice sends only inside the generic two-party computation","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"§4.2, p. 13","measure":"communication","note":"Bob sends only inside the generic two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( 4n \\)","locator":"Algorithm 1, p. 12; §4.1, pp. 11–12","measure":"computation","note":"Alice's two Cuckoo hashings over the left rows, four hash functions per item; the right tables reuse those placements","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§4.1, pp. 11–12; Figure 1, p. 11","measure":"computation","note":"Bob's four Cuckoo hashings use four distinct hash functions, the right tables mirroring the left; each position computed once","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","name":"PSWW mirror cuckoo circuit-PSI","paper_ids":["PSI-PAPER-2018-PSWW"],"primitive":"circuit-PSI","schedule":[{"blocks":["two_pc"],"id":"circuit","locator":"§4.2, step 3, p. 13","phase":"online","what":"generic evaluation of the circuit comparing each bin once and the stashes with all items, then f"}],"security":{"mode":"computational","model":"semi-honest two-party; failure probability negligible in \\( n \\) with stashes of size \\( \\omega(1) \\) (§4.1, p. 13; Appendix C, p. 34)","notion":"\\( f(X \\cap Y) \\) for a symmetric function f, revealing nothing else"},"status":"published","title":"PSWW circuit-based PSI from mirror cuckoo hashing with \\( \\omega(1) \\) stashes, semi-honest two-party","variables":[{"meaning":"Size of a combined stash, at most twice a single stash","symbol":"s_c"},{"meaning":"AND gates of the matching circuit, \\( 4\\cdot 2.4n(\\sigma - \\log_2(2.4n) + 1) + 3s_cn(\\sigma - 1) \\)","symbol":"g"}],"work_id":"PSI-PAPER-2018-PSWW","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/120","sections":[{"content":"Circuit-based PSI from mirror cuckoo hashing: Alice maps each item to two subtables of one column of four tables by reusing her cuckoo placements, Bob runs cuckoo hashing four times, and a generic circuit compares each bin once and stashed items with all items, for \\( \\omega(\\sigma n) \\) gates.","heading":"Summary"}],"slug":"psww18-psww-mirror-cuckoo-circuit","status":"fulltext_checked","subtitle":"circuit-PSI · 2018","summary":"Circuit-based PSI from mirror cuckoo hashing: Alice maps each item to two subtables of one column of four tables by reusing her cuckoo placements, Bob runs cuckoo hashing four times, and a generic circuit compares each bin once and stashed items with all items, for \\( \\omega(\\sigma n) \\) gates.","title":"PSWW mirror cuckoo circuit-PSI","type":"construction","venue":"EUROCRYPT 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2018-PSWW-MIRROR"},{"contributions":["PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-PSZ-OT","keywords":["two-party psi","oprf_cuckoo_hashing","item-length-independent-oprf-cost"],"metadata":{"assumption":{"family":"symmetric","name":"random OT extension with a hash modeled as a random oracle"},"attributes":{"adversary":{"locator":"§5, Security, p. 23","value":["semi_honest"]},"assumptions":{"locator":"§2.1, pp. 8–9; §2.2.2, p. 10","note":"The base-OT assumption is not named","value":["CR hash"]},"output":{"locator":"Protocol 3, p. 22","value":["intersection"]},"output_to":{"locator":"Protocol 3, Output, p. 22","note":"P2 only","value":"one"},"parties":{"locator":"Protocol 3, p. 22","value":"two_party"},"security_model":{"locator":"§5, Security, p. 23; §2.1, p. 8; §2.2.2, p. 10","note":"Proved with an ideal random 1-out-of-N OT, a hybrid model; its random-OT extension models the hash as a random oracle","value":["random oracle"]},"set_size_regime":{"locator":"§6.2.1, p. 26; Tables 12–13, pp. 30–31","note":"Also run on unequal sets, without exploiting the imbalance","value":"balanced"},"technique":{"locator":"§5, pp. 21–23; Protocol 3, p. 22","value":["batched_oprf","ot_extension","cuckoo_hashing","simple_hashing","permutation_based_hashing"]}},"blocks":[{"cites":[{"key":"KK13","title":"Improved OT extension for transferring short secrets"}],"count":"\\( \\epsilon n_Y+s \\)","func":"rot","id":"rot","implementation":"Kolesnikov-Kumaresan 1-out-of-N OT extension, BCH code","instantiation":"kk13_rot","locator":"Protocol 3, step 2, p. 22; §5, Security, p. 23","note":"One per bin and stash position: \\( N = 2^{\\mu} \\) for items cut to \\( \\mu = \\sigma-\\log_2(\\epsilon n_Y)+\\log_2 k \\) bits by permutation-based hashing","params":{"N":"\\( 2^{\\sigma}k/(\\epsilon n_Y) \\)","\\tau":"\\( \\lambda+\\log_2(kn_Xn_Y) \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["item-length-independent-oprf-cost"],"claim_ids":["PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS"],"construction_family":"oprf_cuckoo_hashing","costs":[{"basis":"counted","formula":"\\( (k+s)n_X(\\lambda+\\log_2(kn_Xn_Y)) \\)","locator":"Protocol 3, common input and steps 2–3, p. 22","measure":"communication","note":"Masks of P1's items for every hash function and stash position","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 3, p. 22; §5, Efficiency, p. 23","measure":"communication","note":"P2 sends only the correction matrix of the random OTs","subject":"receiver"},{"basis":"counted","formula":"\\( (2k+s)n_X \\)","locator":"Protocol 3, steps 1a and 2c, p. 22; §5, pp. 22–23","measure":"computation","note":"Its \\( k \\) bin hashes per item, then one correlation-robust hash per OPRF value, for every hash function and stash position","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( kn_Y \\)","locator":"Protocol 3, step 1b, p. 22","measure":"computation","note":"Its \\( k \\) cuckoo hashes per item; its OPRF outputs come with the random OTs","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2018-PSZ-OT","name":"PSZ18 OT + hashing","paper_ids":["PSI-PAPER-2018-PSZ"],"primitive":"two-party PSI","schedule":[{"blocks":["rot"],"id":"rot","locator":"Protocol 3, step 2, p. 22","phase":"online","what":"random OTs as the OPRF, one per bin and stash position"},{"after":["rot"],"from":"sender","id":"masks","locator":"Protocol 3, step 3, p. 22","phase":"online","what":"P1's permuted OPRF values, for the bins and the stash"}],"security":{"mode":"computational","model":"semi-honest, simulation-based, with an ideal 1-out-of-N random OT functionality (§5, 'Security', p. 23)","notion":"PSI with output to P2"},"status":"published","title":"Pinkas-Schneider-Zohner semi-honest OT-based PSI with cuckoo hashing, permutation-based hashing, and 1-out-of-N random OT","variables":[{"meaning":"Number of cuckoo hash functions","symbol":"k"},{"meaning":"Stash size of the cuckoo table","symbol":"s"},{"meaning":"Bins per item of P2's set: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"}],"work_id":"PSI-PAPER-2018-PSZ","year":2018},"primaryUrl":"https://eprint.iacr.org/2016/930","sections":[{"content":"Semi-honest OT-based PSI in which P2 cuckoo-hashes and P1 simple-hashes into the same bins, and one random 1-out-of-N OT per bin realizes an OPRF on items shortened by permutation-based hashing. P1 sends the OPRF values of its items and P2 intersects them in the clear.","heading":"Summary"}],"slug":"psz18-psz18-ot-hashing","status":"fulltext_checked","subtitle":"two-party PSI · 2018","summary":"Semi-honest OT-based PSI in which P2 cuckoo-hashes and P1 simple-hashes into the same bins, and one random 1-out-of-N OT per bin realizes an OPRF on items shortened by permutation-based hashing. P1 sends the OPRF values of its items and P2 intersects them in the clear.","title":"PSZ18 OT + hashing","type":"construction","venue":"ACM Transactions on Privacy and Security 21(2)","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2018-PSZ-OT"},{"contributions":["PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-GS-AHE","keywords":["two-party threshold psi","polynomial_threshold_psi","sublinear-in-set-size","size-hiding-cardinality-test"],"metadata":{"assumption":{"family":"generic","name":"IND-CPA additively homomorphic encryption (Paillier or Damgård-Jurik) and passively secure OLE"},"attributes":{"adversary":{"locator":"§2.2, p. 6; Theorem 4, p. 14","note":"Static passive adversary corrupting Alice or Bob","value":["semi_honest"]},"assumptions":{"locator":"§2.3, p. 6; Theorem 2, p. 10; §7.2, p. 17","note":"IND-CPA additively homomorphic encryption, instantiated by Paillier or Damgård–Jurik; passively secure OLE","value":["DCR"]},"output":{"locator":"Figure 6, p. 12","note":"The intersection if the symmetric difference is at most \\( 2t \\), otherwise nothing","value":["threshold"]},"output_to":{"locator":"Figure 6, p. 12","value":"all"},"parties":{"locator":"§2.2, p. 5","value":"two_party"},"security_model":{"locator":"Theorem 4, p. 14; Lemma 4, p. 14","note":"UC in the plain model; the cardinality test, noisy addition and OLE hybrids are functionalities, not models","value":["standard model"]},"set_size_regime":{"locator":"§2, p. 4; §6.4, p. 15","note":"Sets of equal size; unequal sets are padded, at most doubling the threshold","value":"balanced"},"technique":{"locator":"§§5–7, pp. 10–17","value":["additively_homomorphic_encryption","ole","polynomial_sparsity_test","set_reconciliation"]}},"blocks":[{"cites":[{"key":"KMWF07","title":"Secure linear algebra using linearly recurrent sequences"}],"func":"inv","id":"inv","implementation":"singularity test of Kiltz et al.","instantiation":"kmwf07","locator":"Figure 5, step 6, p. 11; Theorem 3, p. 11","note":"Bob inputs the encrypted difference of the Hankel matrices, Alice her secret key","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| > \\lambda+\\log((4t^{2}+2t)(p-1)) \\)","k":"\\( 2t+1 \\)"},"roles":{"party":["sender","receiver"]}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t+1 \\)","func":"ole","id":"ole_to_receiver","locator":"Figure 10, step 3, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","note":"Alice receives her evaluations under Bob's random polynomials; any passively secure OLE with constant communication overhead","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t+1 \\)","func":"ole","id":"ole_to_sender","locator":"Figure 10, step 4, p. 17; §7.2, Efficiency, p. 17; Theorem 5, p. 16","note":"Bob receives his evaluations under Alice's random polynomials; any passively secure OLE with constant communication overhead","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["sublinear-in-set-size","size-hiding-cardinality-test"],"claim_ids":["PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"construction_family":"polynomial_threshold_psi","costs":[{"basis":"counted","formula":"\\( (3t+1)\\log p + 1 \\)","locator":"Figure 5, p. 11; Figure 10, p. 17","measure":"communication","note":"A one-bit verdict, then \\( 3t+1 \\) masked evaluations","subject":"sender","tip":"Alice, who holds the decryption key, is counted as receiver and Bob as sender; both learn the output."},{"basis":"counted","formula":"\\( (4t+1)\\gamma + |\\mathbb{F}| + \\eta + (3t+1)\\log p \\)","locator":"Figure 5, steps 3–4, p. 11; Figure 10, step 5, p. 17","measure":"communication","note":"The \\( 4t+1 \\) encrypted Hankel entries with the point \\( u \\) and her public key, then \\( 3t+1 \\) masked evaluations","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","locator":"Figure 5, p. 11; Figure 7, p. 13; §1.2, p. 4","measure":"computation","note":"Hankel entries (one power per item, exponent up to \\( p \\)), set-polynomial evaluations, rational interpolation by Gaussian elimination","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","locator":"Figure 5, p. 11; Figure 7, p. 13","measure":"computation","note":"As the receiver, symmetrically","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4t+1 \\)","locator":"Figure 5, step 3, p. 11","measure":"computation","note":"Encrypts the entries of her Hankel matrix","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( 4t+1 \\)","locator":"Figure 5, step 5, p. 11","measure":"computation","note":"Encrypts the entries of his own Hankel matrix","operation":"enc_dec","subject":"sender"},{"basis":"counted","formula":"\\( 4t+1 \\)","locator":"Figure 5, step 5, p. 11","measure":"computation","note":"Subtracts his encrypted entries from hers, one per distinct entry of the Hankel matrix","operation":"hom_op","subject":"sender"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-GS-AHE","name":"Ghosh-Simkin AHE threshold PSI","paper_ids":["PSI-PAPER-2019-GS"],"primitive":"two-party threshold PSI","schedule":[{"from":"receiver","id":"hankel","locator":"Figure 5, steps 3–4, p. 11","phase":"online","what":"Alice's encrypted Hankel matrix, the point u and her public key"},{"after":["hankel"],"blocks":["inv"],"id":"inv","locator":"Figure 5, steps 5–6, p. 11","phase":"online","what":"singularity test of the encrypted difference of the Hankel matrices"},{"after":["inv"],"from":"sender","id":"verdict","locator":"Figure 5, step 7, p. 11","phase":"online","what":"Bob's verdict, similar or different"},{"after":["verdict"],"blocks":["ole_to_receiver","ole_to_sender"],"id":"ole","locator":"Figure 7, steps 2–4, p. 13; Figure 10, steps 3–4, p. 17","phase":"online","what":"both OLE batches of noisy polynomial addition, run only on similar sets"},{"after":["ole"],"from":"receiver","id":"masked_a","locator":"Figure 10, step 5, p. 17","phase":"online","what":"Alice's masked evaluations"},{"after":["ole"],"from":"sender","id":"masked_b","locator":"Figure 10, step 6, p. 17","phase":"online","what":"Bob's masked evaluations"}],"security":{"mode":"computational","model":"UC, static passive adversary; Theorem 4 in the (F_PICT, F_NPA)-hybrid model and Theorem 5 in the F_OLE-hybrid model (pp. 14, 16)","notion":"threshold PSI (intersection if the symmetric difference is at most \\( 2t \\))"},"status":"published","title":"Ghosh-Simkin two-party threshold PSI from additively homomorphic encryption and OLE, semi-honest, \\( \\tilde O(t^{2}) \\) communication","variables":[{"meaning":"Bits of one ciphertext of the additively homomorphic scheme (Paillier or Damgård-Jurik)","symbol":"\\gamma"},{"meaning":"Bits of Alice's public key of the additively homomorphic scheme, which the paper does not size","symbol":"\\eta"}],"work_id":"PSI-PAPER-2019-GS","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/175","sections":[{"content":"Two-party threshold PSI in two steps: a private intersection cardinality test that encodes each set as a sum of monomials and tests the sparsity of their difference through an encrypted Hankel matrix, then noisy polynomial addition over OLE from which each party interpolates in the clear the elements only it holds.","heading":"Summary"}],"slug":"gs19-ghosh-simkin-ahe-threshold","status":"fulltext_checked","subtitle":"two-party threshold PSI · 2019","summary":"Two-party threshold PSI in two steps: a private intersection cardinality test that encodes each set as a sum of monomials and tests the sparsity of their difference through an encrypted Hankel matrix, then noisy polynomial addition over OLE from which each party interpolates in the clear the elements only it holds.","title":"Ghosh-Simkin AHE threshold PSI","type":"construction","venue":"CRYPTO 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2019-GS-AHE"},{"contributions":["PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-GS-FHE","keywords":["two-party threshold psi","polynomial_threshold_psi","sublinear-in-set-size"],"metadata":{"assumption":{"family":"lattice","name":"LWE or Ring-LWE"},"attributes":{"adversary":{"locator":"§2.2, p. 6; §3, p. 8","value":["semi_honest"]},"assumptions":{"locator":"§3, p. 8","note":"Either, through the FHE instantiation the paper names","value":["LWE","Ring-LWE"]},"output":{"locator":"§3, p. 8","note":"The intersection if the symmetric difference is at most \\( 2t \\), otherwise nothing","value":["threshold"]},"output_to":{"locator":"§3, p. 8","note":"Alice decrypts the numerator and computes the intersection","value":"one"},"parties":{"locator":"§3, p. 8","value":"two_party"},"security_model":{"locator":"§3, p. 8","note":"A sketch: security is argued from FHE alone, without a formal proof or random oracle","value":["standard model"]},"set_size_regime":{"locator":"§2, p. 4","value":"balanced"},"technique":{"locator":"§3, p. 8","value":["fully_homomorphic_encryption","set_reconciliation"]}},"capabilities":["sublinear-in-set-size"],"claim_ids":["PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND"],"construction_family":"polynomial_threshold_psi","costs":[{"basis":"counted","formula":"\\( O(t\\log p) \\)","locator":"§3, p. 8","measure":"communication","note":"Exactly \\( (2t+1)C+\\log p \\) for ciphertexts of \\( C = O(\\log p) \\) bits: evaluations at the public points, and a random point in the clear","subject":"receiver"},{"basis":"counted","formula":"\\( O(t\\log p) \\)","locator":"§3, p. 8","measure":"communication","note":"Exactly \\( tC \\): encrypted coefficients of the numerator polynomial","subject":"sender"},{"measure":"communication","note":"Alice's FHE public and evaluation keys, which Bob needs to compute on her ciphertexts; the sketch neither names nor sizes them","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( O(nt) \\)","locator":"§3, p. 8","measure":"computation","note":"Evaluations of its set polynomial at the public points","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( O(nt) \\)","locator":"§3, p. 8","measure":"computation","note":"Evaluations of its set polynomial at the same points","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 3t+1 \\)","locator":"§3, p. 8","measure":"computation","note":"Encrypts her \\( 2t+1 \\) evaluations, then decrypts the \\( t \\) coefficients of the numerator","operation":"enc_dec","subject":"receiver"},{"measure":"computation","note":"Homomorphic rational interpolation from encrypted points, called far from practical","operation":"hom_op","subject":"sender","value":"not_reported"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-GS-FHE","name":"Ghosh-Simkin FHE threshold PSI","paper_ids":["PSI-PAPER-2019-GS"],"primitive":"two-party threshold PSI","schedule":[{"from":"receiver","id":"keys","locator":"§3, p. 8","phase":"setup","what":"Alice's FHE public and evaluation keys, which the sketch leaves implicit"},{"from":"receiver","id":"evals","locator":"§3, p. 8","phase":"online","what":"encrypted evaluations at the 2t points and at z, with z in the clear"},{"after":["keys","evals"],"from":"sender","id":"numerator","locator":"§3, p. 8","phase":"online","what":"the encrypted coefficients of the numerator polynomial, or ⊥"}],"security":{"mode":"computational","model":"passive adversary; security follows from the security of FHE, stated without a formal proof (§3, p. 8)","notion":"threshold PSI"},"status":"published","title":"Ghosh-Simkin two-party threshold PSI from FHE-evaluated set reconciliation, semi-honest, \\( O(t \\log p) \\) communication","variables":[{"meaning":"Bits of one FHE ciphertext of an element of \\( \\mathbb{F}_p \\), a constant multiple of \\( \\log p \\) by assumption","symbol":"C"}],"work_id":"PSI-PAPER-2019-GS","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/175","sections":[{"content":"The communication upper bound for two-party threshold PSI: the Minsky–Trachtenberg–Zippel set reconciliation protocol run under FHE. Alice sends encrypted evaluations of her root polynomial; Bob interpolates the rational function homomorphically, checks it at a random point, and returns the encrypted numerator, which encodes the elements only Alice holds.","heading":"Summary"}],"slug":"gs19-ghosh-simkin-fhe-threshold","status":"fulltext_checked","subtitle":"two-party threshold PSI · 2019","summary":"The communication upper bound for two-party threshold PSI: the Minsky–Trachtenberg–Zippel set reconciliation protocol run under FHE. Alice sends encrypted evaluations of her root polynomial; Bob interpolates the rational function homomorphically, checks it at a random point, and returns the encrypted numerator, which encodes the elements only Alice holds.","title":"Ghosh-Simkin FHE threshold PSI","type":"construction","venue":"CRYPTO 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2019-GS-FHE"},{"contributions":["PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-KRSSW-GC","keywords":["unbalanced psi","oprf_cuckoo_filter_precomputation","precomputation","server-set-updates","malicious-client-security","no-online-server-cryptography","client-storage-linear-in-server-set"],"metadata":{"assumption":{"family":"symmetric","name":"LowMC as a pseudorandom function and maliciously secure OT, without a proof"},"attributes":{"adversary":{"locator":"§4.5, pp. 10-11; §5.1, pp. 11-12","note":"Argued in prose, without a proof","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"§3.3, p. 5; §4.2, pp. 7-8","note":"LowMC is used as the PRF; no proof is given, and the OTs' assumptions are not named.","value":["PRF"]},"output":{"locator":"Figure 1, p. 9","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 9","note":"The client.","value":"one"},"parties":{"locator":"§3.5, p. 6","value":"two_party"},"security_model":{"note":"No proof is given.","value":"not_reported"},"set_size_regime":{"locator":"§3.5, p. 6","value":"unbalanced"},"technique":{"locator":"Figure 1, p. 9; §5.2, p. 12","value":["garbled_circuits","oprf","ot_extension","cuckoo_filter"]}},"blocks":[{"cites":[{"key":"Yao86","title":"How to Generate and Exchange Secrets (Extended Abstract)"},{"key":"KS08","title":"Improved Garbled Circuit: Free XOR Gates and Applications"},{"key":"ZRE15","title":"Two Halves Make a Whole - Reducing Data Transfer in Garbled Circuits Using Half Gates"},{"key":"BHKR13","title":"Efficient Garbling from a Fixed-Key Blockcipher"}],"count":"\\( n_Y \\)","func":"gc","id":"gc","implementation":"Yao with free-XOR, half-gates and fixed-key AES","instantiation":"gc_halfgates","locator":"Figure 1, p. 9; §5.2, p. 12","note":"One garbled LowMC circuit per precomputed item, sent offline and evaluated online","params":{"|C|":"\\( a \\)"},"phase":"offline","roles":{"evaluator":"receiver","garbler":"sender"}},{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"count":"\\( \\sigma n_Y \\)","func":"cot","id":"cot","implementation":"C-OT extension of Keller, Orsini and Scholl","instantiation":"kos15_cot","locator":"Figure 1, p. 9; §4.3, p. 8; §5.1, pp. 11–12","note":"Random-choice C-OTs on the free-XOR offset, one per input bit of each precomputed item","params":{"\\tau":"\\( \\kappa \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"CO15","title":"The Simplest Protocol for Oblivious Transfer"},{"key":"DKLs18","title":"Secure Two-party Threshold ECDSA from ECDSA Assumptions"}],"count":"\\( \\kappa \\)","func":"ot","id":"base_ot","implementation":"Chou-Orlandi OT with the verification step of Doerner et al.","instantiation":"vsot","locator":"§3.1, p. 4; §5.1, pp. 11–12","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["precomputation","server-set-updates","malicious-client-security","no-online-server-cryptography","client-storage-linear-in-server-set"],"claim_ids":["PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"],"construction_family":"oprf_cuckoo_filter_precomputation","costs":[{"basis":"counted","formula":"\\( n_X/L + n_Xv \\)","locator":"§4.1, p. 6; Figure 1, Setup Phase, p. 9","measure":"communication","note":"Compressed filter: a bitmap of the table and one tag per item.","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( \\kappa^2 \\)","locator":"§4.2, Key Schedule, p. 7; Figure 1, Base Phase, p. 9","measure":"communication","note":"The labels of its \\( \\kappa \\)-bit key, sent once for all circuits, which share one key schedule","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_Y\\kappa \\)","locator":"Figure 1, Online Phase, p. 9","measure":"communication","note":"One masked wire label per input bit.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_Y \\)","locator":"Figure 1, Online Phase, p. 9","measure":"communication","note":"One correction bit per input bit.","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 3n_X + \\rho \\)","locator":"Figure 1, Setup Phase, p. 9; §3.4, pp. 5–6","measure":"computation","note":"One LowMC evaluation per item, then a tag and a bucket hash to insert it, and one hash per alternate bucket","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y \\)","locator":"§3.4, p. 6; Figure 1, Online Phase, p. 9","measure":"computation","note":"Filter lookup: the tag hash and both bucket hashes per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-KRSSW-GC","name":"LowMC-GC-PSI","paper_ids":["PSI-PAPER-2019-KRSSW"],"primitive":"unbalanced PSI","schedule":[{"blocks":["base_ot"],"id":"base_ot","locator":"§3.1, p. 4; §5.1, pp. 11–12","phase":"setup","what":"base OTs of the OT extension"},{"from":"sender","id":"filter","locator":"Figure 1, Setup Phase, p. 9; §4.1, p. 6","phase":"setup","what":"the compressed cuckoo filter of the server's PRF values"},{"after":["base_ot"],"blocks":["cot"],"id":"cot","locator":"Figure 1, Base Phase, p. 9; §4.3, p. 8","phase":"offline","what":"random-choice C-OTs on the free-XOR offset, one per input bit of each precomputed item"},{"after":["cot"],"blocks":["gc"],"id":"gc","locator":"Figure 1, Base Phase, p. 9; §4.3, p. 8","phase":"offline","what":"one garbled LowMC circuit per precomputed item, its input labels set from the C-OT outputs; it travels in the server's base-phase flow"},{"after":["cot"],"from":"sender","id":"circuits","locator":"Figure 1, Base Phase, p. 9; §4.2, Key Schedule, p. 7","phase":"offline","what":"the labels of the server's key, sent once with the garbled circuits"},{"after":["cot"],"from":"receiver","id":"correction","locator":"Figure 1, Online Phase, p. 9; §4.3, p. 8","phase":"online","what":"correction bits, one per input bit"},{"after":["cot","correction"],"from":"sender","id":"labels","locator":"Figure 1, Online Phase, p. 9; §4.3, p. 8","phase":"online","what":"masked wire labels, one per input bit"}],"security":{"mode":"computational","model":"malicious client and semi-honest server, argued informally (§4.5, pp. 10-11)","notion":"PSI with output to the client, with precomputation"},"status":"published","title":"KRSSW19 LowMC-GC-PSI: precomputed unbalanced PSI with a garbled LowMC OPRF, correlated-OT precomputation, and a compressed cuckoo filter","variables":[{"meaning":"AND gates of the garbled PRF circuit (624 for the LowMC instance used)","symbol":"a"},{"meaning":"Tag length of the cuckoo filter","symbol":"v"},{"meaning":"Load factor of the cuckoo filter","symbol":"L"},{"meaning":"Alternate-bucket hashes while building the cuckoo filter: one each time an item's first bucket is full and one per relocated tag","symbol":"\\rho"}],"work_id":"PSI-PAPER-2019-KRSSW","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/517","sections":[{"content":"Unbalanced PSI with precomputation: the server sends a compressed cuckoo filter of LowMC values of its whole set once; in a base phase it garbles LowMC circuits for the client and runs correlated OTs with it; online the client obtains its input labels with correction bits, evaluates the circuits and looks the results up in the filter.","heading":"Summary"}],"slug":"krssw19-lowmc-gc-psi","status":"fulltext_checked","subtitle":"unbalanced PSI · 2019","summary":"Unbalanced PSI with precomputation: the server sends a compressed cuckoo filter of LowMC values of its whole set once; in a base phase it garbles LowMC circuits for the client and runs correlated OTs with it; online the client obtains its input labels with correction bits, evaluates the circuits and looks the results up in the filter.","title":"LowMC-GC-PSI","type":"construction","venue":"USENIX Security 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2019-KRSSW-GC"},{"contributions":["PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-KRSSW-NR","keywords":["unbalanced psi","oprf_cuckoo_filter_precomputation","precomputation","server-set-updates","malicious-client-security","client-storage-linear-in-server-set"],"metadata":{"assumption":{"family":"group","name":"Naor-Reingold PRF over P-256 and maliciously secure OT, without a proof"},"attributes":{"adversary":{"locator":"§4.5, pp. 10-11; §5.1, pp. 11-12","note":"Argued in prose, without a proof","value":{"receiver":"malicious","sender":"semi_honest"}},"assumptions":{"locator":"§3.3, p. 5; §4.4, p. 9","note":"The Naor-Reingold PRF over P-256; no proof is given, and no underlying assumption is named.","value":["PRF"]},"output":{"locator":"Figure 2, p. 10","value":["intersection"]},"output_to":{"locator":"Figure 2, p. 10","note":"The client.","value":"one"},"parties":{"locator":"§3.5, p. 6","value":"two_party"},"security_model":{"note":"No proof is given.","value":"not_reported"},"set_size_regime":{"locator":"§3.5, p. 6","value":"unbalanced"},"technique":{"locator":"Figure 2, p. 10; §5.3, p. 12","value":["oprf","ot_extension","cuckoo_filter"]}},"blocks":[{"cites":[{"key":"KOS15","title":"Actively Secure OT Extension with Optimal Overhead"}],"count":"\\( \\sigma n_Y \\)","func":"rot","id":"rot","implementation":"OT extension of Keller, Orsini and Scholl, in libOTe","instantiation":"kos15_rot","locator":"Figure 2, p. 10; §4.4, p. 10; §5.3, p. 12","note":"One random OT of exponents per input bit of each precomputed item; the online messages turn it into a correlated OT","params":{"\\tau":"\\( w \\)"},"phase":"offline","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"CO15","title":"The Simplest Protocol for Oblivious Transfer"},{"key":"DKLs18","title":"Secure Two-party Threshold ECDSA from ECDSA Assumptions"}],"count":"\\( \\kappa \\)","func":"ot","id":"base_ot","implementation":"Chou-Orlandi OT with the verification step of Doerner et al.","instantiation":"vsot","locator":"§3.1, p. 4; §5.1, pp. 11–12","note":"Base OTs of the OT extension, on \\( \\kappa \\)-bit seeds","params":{"\\tau":"\\( \\kappa \\)"},"phase":"setup","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["precomputation","server-set-updates","malicious-client-security","client-storage-linear-in-server-set"],"claim_ids":["PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"],"construction_family":"oprf_cuckoo_filter_precomputation","costs":[{"basis":"counted","formula":"\\( n_X/L + n_Xv \\)","locator":"§4.1, p. 6; Figure 2, Setup Phase, p. 10","measure":"communication","note":"Compressed filter: a bitmap of the table and one tag per item.","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y(\\sigma w + |\\mathbb{G}|) \\)","locator":"Figure 2, Online Phase, p. 10","measure":"communication","note":"One masked exponent per input bit and one group element per item.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"communication","note":"One correction bit per input bit.","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 2, Setup Phase, p. 10","measure":"computation","note":"One PRF value per server item, then filter insertion.","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( \\sigma n_X \\)","locator":"Figure 2, p. 10","measure":"computation","note":"The exponent product of the PRF key, at most one multiplication per input bit.","operation":"modmul","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X + \\rho \\)","locator":"§3.4, pp. 5–6; Figure 2, Setup Phase, p. 10","measure":"computation","note":"Filter insertion: a tag hash and a bucket hash per item, then one hash per alternate bucket","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"One group element per client item.","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2\\sigma n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"A key multiple per input bit; per item the mask product and its product with the key, plus one inversion","operation":"modmul","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"One point multiplication per item, then a filter lookup.","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( (\\sigma-1)n_Y \\)","locator":"Figure 2, Online Phase, p. 10","measure":"computation","note":"The product of the received values per item.","operation":"modmul","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 3n_Y \\)","locator":"§3.4, p. 6; Figure 2, Online Phase, p. 10","measure":"computation","note":"Filter lookup: the tag hash and both bucket hashes per item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-KRSSW-NR","name":"ECC-NR-PSI","paper_ids":["PSI-PAPER-2019-KRSSW"],"primitive":"unbalanced PSI","schedule":[{"blocks":["base_ot"],"id":"base_ot","locator":"§3.1, p. 4; §5.1, pp. 11–12","phase":"setup","what":"base OTs of the OT extension"},{"from":"sender","id":"filter","locator":"Figure 2, Setup Phase, p. 10; §4.1, p. 6","phase":"setup","what":"the compressed cuckoo filter of the server's PRF values"},{"after":["base_ot"],"blocks":["rot"],"id":"rot","locator":"Figure 2, Base Phase, p. 10; §4.4, p. 10","phase":"offline","what":"random OTs of exponents, one per input bit of each precomputed item"},{"after":["rot"],"from":"receiver","id":"correction","locator":"Figure 2, Online Phase, p. 10; §4.4, p. 10","phase":"online","what":"correction bits, one per input bit"},{"after":["rot","correction"],"from":"sender","id":"masked","locator":"Figure 2, Online Phase, p. 10","phase":"online","what":"masked exponents, one per input bit, and one masked group element per item"}],"security":{"mode":"computational","model":"malicious client and semi-honest server, argued informally (§4.5, pp. 10-11)","notion":"PSI with output to the client, with precomputation"},"status":"published","title":"KRSSW19 ECC-NR-PSI: precomputed unbalanced PSI with an oblivious Naor-Reingold PRF over P-256, correlated-OT precomputation, and a compressed cuckoo filter","variables":[{"meaning":"Tag length of the cuckoo filter","symbol":"v"},{"meaning":"Load factor of the cuckoo filter","symbol":"L"},{"meaning":"Bit length of an element of the exponent group \\( \\mathbb{Z}_q \\) of the PRF","symbol":"w"},{"meaning":"Alternate-bucket hashes while building the cuckoo filter: one each time an item's first bucket is full and one per relocated tag","symbol":"\\rho"}],"work_id":"PSI-PAPER-2019-KRSSW","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/517","sections":[{"content":"Unbalanced PSI with precomputation from the Naor-Reingold PRF: the server sends a compressed cuckoo filter of PRF values of its whole set once, and online the client, using precomputed random OTs, receives either a mask or the mask times the key element for each input bit and one masked group element, from which it computes its PRF value to look up.","heading":"Summary"}],"slug":"krssw19-ecc-nr-psi","status":"fulltext_checked","subtitle":"unbalanced PSI · 2019","summary":"Unbalanced PSI with precomputation from the Naor-Reingold PRF: the server sends a compressed cuckoo filter of PRF values of its whole set once, and online the client, using precomputed random OTs, receives either a mask or the mask times the key element for each input bit and one masked group element, from which it computes its PRF value to look up.","title":"ECC-NR-PSI","type":"construction","venue":"USENIX Security 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2019-KRSSW-NR"},{"contributions":["PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","keywords":["circuit-psi","opprf_cuckoo_hashing_circuit_psi","linear-communication","role-reversal-for-stash"],"metadata":{"assumption":{"family":"symmetric","name":"Pseudorandom functions"},"attributes":{"adversary":{"locator":"§2.2, p. 8","value":["semi_honest"]},"assumptions":{"locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","value":["PRF"]},"output":{"locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","value":["circuit"]},"output_to":{"locator":"Protocol 10, p. 20","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2.1, p. 8","value":"two_party"},"security_model":{"locator":"Theorem 8, p. 15; §5.1, p. 20","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§2.1, p. 8","value":"balanced"},"technique":{"locator":"Protocol 10, p. 20; §7.3, p. 25","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]}},"blocks":[{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 2.4n \\)","func":"oprf","id":"oprf","implementation":"BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 10, step 1, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 24","note":"First phase: one one-time OPRF per bin of P1's cuckoo table, queried by P1","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 2.4n \\)","func":"oprf","id":"oprf_reversed","implementation":"BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 10, step 2, p. 20; Protocol 7, step 1, p. 16; §7.3, p. 25","note":"Second phase, roles reversed: one per bin of P2's cuckoo table, queried by P2","roles":{"receiver":"sender","sender":"receiver"}},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"}],"func":"two_pc","id":"two_pc","implementation":"GMW","instantiation":"gmw_iknp","locator":"Protocol 10, step 3, p. 20; Functionality 1, p. 9; §7.3, pp. 24–26","note":"The matching circuit: two \\( \\gamma \\)-bit sections per bin and the stash pairs of full items; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2\\cdot 2.4n(\\lambda+\\log(2.4n)-1)+s^{2}(\\sigma-1) \\)"},"roles":{"party":["sender","receiver"]}}],"capabilities":["linear-communication","role-reversal-for-stash"],"claim_ids":["PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"construction_family":"opprf_cuckoo_hashing_circuit_psi","costs":[{"basis":"counted","formula":"\\( Bm(\\lambda+\\log(2.4n)) \\)","locator":"§7.2, p. 23; §7.3, pp. 24–25; Protocol 10, step 1, p. 20","measure":"communication","note":"P2's first-phase hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","subject":"sender"},{"basis":"counted","formula":"\\( 2s(\\lambda+\\log(2.4n)) \\)","locator":"Protocol 10, step 2, p. 20; Construction 4, p. 14; Protocol 7, step 2, p. 16","measure":"communication","note":"P1's second-phase hint: one polynomial through two points per stash slot, with \\( \\gamma \\)-bit coefficients","subject":"receiver"},{"basis":"counted","formula":"\\( O(nm) + 4.8n(2s-1) \\)","locator":"§4.3, p. 18; §7.2, p. 23; Protocol 10, step 2, p. 20","measure":"computation","note":"Interpolates the first-phase hints by Lagrange, then evaluates P1's hint, of degree \\( 2s-1 \\), in each of its bins by Horner","operation":"field_op","subject":"sender","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n."},{"basis":"counted","formula":"\\( 4.8n(m-1) + O(s^{2}) \\)","locator":"Construction 4, p. 14; Protocol 10, steps 1–2, p. 20; §7.2, p. 23","measure":"computation","note":"Evaluates its mega-bin's hint by Horner in each first-phase bin, then interpolates its own hint by Lagrange","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 12n \\)","locator":"Protocol 9, steps 1–2, p. 17; Protocol 7, step 2, p. 16; Protocol 10, p. 20","measure":"computation","note":"Its items' two bin positions, then five calls per BaRK-OPRF value at each of its \\( 2n \\) first-phase bin entries","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n + 10s \\)","locator":"Protocol 9, step 1, p. 17; Protocol 10, step 2, p. 20; Protocol 7, step 2, p. 16","measure":"computation","note":"Its items' two Cuckoo positions, then five calls per BaRK-OPRF value at the two bins of each stash slot","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","name":"PSTY advanced (dual-execution) OPPRF circuit-PSI","paper_ids":["PSI-PAPER-2019-PSTY"],"primitive":"circuit-PSI","schedule":[{"blocks":["oprf","oprf_reversed"],"id":"oprf","locator":"Protocol 10, steps 1–2, p. 20; Protocol 7, step 1, p. 16","phase":"online","what":"both OPRF batches, P1 querying its cuckoo bins and, roles reversed, P2 its own; each needs only the hashed sets"},{"after":["oprf"],"from":"sender","id":"hint","locator":"Protocol 10, step 1, p. 20; Protocol 7, step 2, p. 16","phase":"online","what":"P2's first-phase hint polynomials"},{"after":["oprf"],"from":"receiver","id":"hint_reversed","locator":"Protocol 10, step 2, p. 20; Protocol 7, step 2, p. 16","phase":"online","what":"P1's second-phase hint for its stashed items"},{"after":["hint","hint_reversed"],"blocks":["two_pc"],"id":"circuit","locator":"Protocol 10, step 3, p. 20","phase":"online","what":"the circuit comparing both phases' OPPRF outputs per bin and the two stashes pairwise, then f"}],"security":{"mode":"computational","model":"semi-honest two-party; security from the OPPRF and 2PC functionalities (§5.1, p. 20); failure negligible in the statistical parameter (§5, p. 19)","notion":"\\( f(X \\cap Y) \\) for a symmetric function \\( f \\)"},"status":"published","title":"PSTY circuit-based PSI with linear communication via a role-reversed OPPRF phase for the stash, semi-honest two-party","variables":[{"meaning":"Number of mega-bins, each with its own hint polynomial; \\( O(n/m) \\), and \\( n/\\log n \\) asymptotically","symbol":"B"},{"meaning":"Maximum number of items in a mega-bin, the hint degree bound; \\( O(\\log n) \\) asymptotically","symbol":"m"},{"meaning":"OPPRF output length compared in the circuit, \\( \\lambda+\\log\\beta \\) for \\( \\beta = 2.4n \\) bins","symbol":"\\gamma"},{"meaning":"Stash size of the cuckoo tables","symbol":"s"}],"work_id":"PSI-PAPER-2019-PSTY","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/241","sections":[{"content":"Circuit-based PSI with linear communication: a first OPPRF phase covers P1's cuckoo-table items, a second phase with roles reversed maps P1's stashed items against P2's cuckoo table, and the circuit compares only the two small stashes pairwise.","heading":"Summary"}],"slug":"psty19-psty-advanced-dual-execution","status":"fulltext_checked","subtitle":"circuit-PSI · 2019","summary":"Circuit-based PSI with linear communication: a first OPPRF phase covers P1's cuckoo-table items, a second phase with roles reversed maps P1's stashed items against P2's cuckoo table, and the circuit compares only the two small stashes pairwise.","title":"PSTY advanced (dual-execution) OPPRF circuit-PSI","type":"construction","venue":"EUROCRYPT 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2019-PSTY-ADVANCED"},{"contributions":["PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","keywords":["circuit-psi","opprf_cuckoo_hashing_circuit_psi","payloads"],"metadata":{"assumption":{"family":"symmetric","name":"Pseudorandom functions"},"attributes":{"adversary":{"locator":"§2.2, p. 8","value":["semi_honest"]},"assumptions":{"locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","value":["PRF"]},"output":{"locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","value":["circuit"]},"output_to":{"locator":"§4.1, pp. 16-17","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2.1, p. 8","value":"two_party"},"security_model":{"locator":"Theorem 8, p. 15; §4.1, p. 17","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§2.1, p. 8","value":"balanced"},"technique":{"locator":"Protocol 9, p. 17; §7.3, p. 24","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]}},"blocks":[{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 2.4n \\)","func":"oprf","id":"oprf","implementation":"BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 7, step 1, p. 16; Protocol 9, step 2, p. 17; Theorem 8, p. 15; §7.3, p. 24","note":"One one-time OPRF per cuckoo bin, queried by P1","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"}],"func":"two_pc","id":"two_pc","implementation":"GMW","instantiation":"gmw_iknp","locator":"Protocol 9, step 3, p. 17; Functionality 1, p. 9; §7.3, pp. 24–26","note":"The matching circuit; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\max(\\log\\sigma,\\log(\\lambda+\\log(2.4n))) \\)","|C|":"\\( 2.4n(\\lambda+\\log(2.4n)-1)+sn(\\sigma-1) \\)"},"roles":{"party":["sender","receiver"]}}],"capabilities":["payloads"],"claim_ids":["PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"construction_family":"opprf_cuckoo_hashing_circuit_psi","costs":[{"basis":"counted","formula":"\\( Bm(\\lambda+\\log(2.4n)) \\)","locator":"§7.2, p. 23; §7.3, p. 24; Protocol 7, step 2, p. 16","measure":"communication","note":"P2's hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 7, p. 16; Protocol 9, p. 17","measure":"communication","note":"P1 sends only inside the OPRFs and the two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( O(nm) \\)","locator":"§4.3, p. 18; §7.2, p. 23","measure":"computation","note":"P2 interpolates one hint polynomial of degree at most \\( m \\) per mega-bin by Lagrange, \\( O(Bm^2) \\) for \\( B = O(n/m) \\) mega-bins","operation":"field_op","subject":"sender","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n."},{"basis":"counted","formula":"\\( 4.8n(m-1) \\)","locator":"Construction 4, p. 14; Protocol 7, step 3, p. 16; §4.3, p. 18","measure":"computation","note":"Evaluates its mega-bin's hint polynomial by Horner in each of its bins, \\( m-1 \\) multiplications each","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 12n \\)","locator":"Protocol 9, steps 1–2, p. 17; Protocol 7, step 2, p. 16; Construction 4, p. 14","measure":"computation","note":"Its items' two bin positions, then five calls per BaRK-OPRF value at each of its \\( 2n \\) bin entries to program the hints","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Protocol 9, step 1, p. 17","measure":"computation","note":"Its items' two Cuckoo positions, each computed once","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","name":"PSTY basic OPPRF circuit-PSI","paper_ids":["PSI-PAPER-2019-PSTY"],"primitive":"circuit-PSI","schedule":[{"blocks":["oprf"],"id":"oprf","locator":"Protocol 9, step 2, p. 17; Protocol 7, step 1, p. 16","phase":"online","what":"one OPRF per cuckoo bin, queried with P1's bin entries"},{"after":["oprf"],"from":"sender","id":"hint","locator":"Protocol 7, step 2, p. 16","phase":"online","what":"P2's hint polynomials, programmed with the OPRF keys"},{"after":["hint"],"blocks":["two_pc"],"id":"circuit","locator":"Protocol 9, step 3, p. 17","phase":"online","what":"the circuit comparing the OPPRF outputs per bin and each stashed item with all of P2's, then f"}],"security":{"mode":"computational","model":"semi-honest two-party; security follows from the OPPRF and 2PC functionalities (§4.1, p. 17); fails if the stash overflows (§4.2, pp. 17-18)","notion":"\\( f(X \\cap Y) \\) for a symmetric function \\( f \\)"},"status":"published","title":"PSTY basic circuit-based PSI from batched OPPRF with a compared stash, semi-honest two-party","variables":[{"meaning":"Number of mega-bins, each with its own hint polynomial; \\( O(n/m) \\), and \\( n/\\log n \\) asymptotically","symbol":"B"},{"meaning":"Maximum number of items in a mega-bin, the hint degree bound; \\( O(\\log n) \\) asymptotically","symbol":"m"},{"meaning":"OPPRF output length compared in the circuit, \\( \\lambda+\\log\\beta \\) for \\( \\beta = 2.4n \\) bins","symbol":"\\gamma"},{"meaning":"Stash size of the cuckoo table","symbol":"s"}],"work_id":"PSI-PAPER-2019-PSTY","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/241","sections":[{"content":"Circuit-based PSI in which P1 cuckoo-hashes into 2.4n bins and a stash, a batched OPPRF gives one value per bin to compare, and a generic two-party circuit compares each bin once and each stashed item with all of P2's items before computing f.","heading":"Summary"}],"slug":"psty19-psty-basic-opprf-circuit","status":"fulltext_checked","subtitle":"circuit-PSI · 2019","summary":"Circuit-based PSI in which P1 cuckoo-hashes into 2.4n bins and a stash, a batched OPPRF gives one value per bin to compare, and a generic two-party circuit compares each bin once and each stashed item with all of P2's items before computing f.","title":"PSTY basic OPPRF circuit-PSI","type":"construction","venue":"EUROCRYPT 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2019-PSTY-BASIC"},{"contributions":["PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","keywords":["circuit-psi","opprf_cuckoo_hashing_circuit_psi","linear-communication","no-stash","payloads"],"metadata":{"assumption":{"family":"symmetric","name":"Pseudorandom functions"},"attributes":{"adversary":{"locator":"§2.2, p. 8","value":["semi_honest"]},"assumptions":{"locator":"Construction 4 and Theorem 5, p. 14","note":"The batched programmable PRF is built from a PRF; the OPRF and the two-party computation are used as functionalities.","value":["PRF"]},"output":{"locator":"§2.1, p. 8","note":"The circuit computes any agreed function f of the intersection.","value":["circuit"]},"output_to":{"locator":"§4.1, pp. 16-17; §5.2, p. 20","note":"Per-bin match results stay inside the two-party computation; the parties learn only the output of f.","value":"shared"},"parties":{"locator":"§2.1, p. 8","value":"two_party"},"security_model":{"locator":"Theorem 8, p. 15; §4.1, p. 17","note":"Proved in the OPRF and two-party-computation hybrid model; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§2.1, p. 8","value":"balanced"},"technique":{"locator":"§5.2, pp. 20-21; §7.4, p. 27","value":["opprf","batched_oprf","cuckoo_hashing","simple_hashing","gmw"]}},"blocks":[{"cites":[{"key":"PSZ18","paper":"PSI-PAPER-2018-PSZ","title":"Scalable private set intersection based on OT extension"},{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 1.27n \\)","func":"oprf","id":"oprf","implementation":"OPRF of PSZ18 in the code; costed as BaRK-OPRF (KKRT16)","instantiation":"kkrt16","locator":"Protocol 7, step 1, p. 16; §5.2, p. 20; §7.3, p. 24; §7.4, p. 27","note":"One one-time OPRF per cuckoo bin, queried by P1","roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"GMW87","title":"How to play any mental game or a completeness theorem for protocols with honest majority"},{"key":"DSZ15","title":"ABY – a framework for efficient mixed-protocol secure two-party computation"}],"func":"two_pc","id":"two_pc","implementation":"GMW, in ABY","instantiation":"gmw_iknp","locator":"Protocol 9, step 3, p. 17; §5.2, p. 20; §7.3, pp. 25–26; §7.4, p. 27","note":"The matching circuit, one equality test per bin and no stash; the circuit for \\( f \\) adds its own gates and depth","params":{"depth":"\\( \\log(\\lambda+\\log(1.27n)) \\)","|C|":"\\( 1.27n(\\lambda+\\log(1.27n)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"capabilities":["linear-communication","no-stash","payloads"],"claim_ids":["PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"],"construction_family":"opprf_cuckoo_hashing_circuit_psi","costs":[{"basis":"counted","formula":"\\( Bm(\\lambda+\\log(1.27n)) \\)","locator":"§7.2, pp. 23-24; §7.3, p. 24; Protocol 7, step 2, p. 16","measure":"communication","note":"P2's hints: one polynomial of degree \\( m \\) per mega-bin, with \\( \\gamma \\)-bit coefficients","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 7, p. 16; §5.2, p. 20","measure":"communication","note":"P1 sends only inside the OPRFs and the two-party computation","subject":"receiver"},{"basis":"counted","formula":"\\( O(nm) \\)","locator":"§4.3, p. 18; §7.2, pp. 23-24","measure":"computation","note":"P2 interpolates one hint polynomial of degree at most \\( m \\) per mega-bin by Lagrange, \\( O(Bm^2) \\) for \\( B = O(n/m) \\) mega-bins","operation":"field_op","subject":"sender","tip":"Sender is P2, which programs the OPPRF and holds the paper's Y; receiver is P1, which cuckoo-hashes the paper's X. Both sets have size n."},{"basis":"counted","formula":"\\( 2.54n(m-1) \\)","locator":"Construction 4, p. 14; Protocol 7, step 3, p. 16; §5.2, p. 20","measure":"computation","note":"Evaluates its mega-bin's hint polynomial by Horner in each of its bins, \\( m-1 \\) multiplications each","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 18n \\)","locator":"§5.2, pp. 20–21; footnote 6, p. 13; Protocol 7, step 2, p. 16","measure":"computation","note":"Its items' three bin positions, then five calls per BaRK-OPRF value at each of its \\( 3n \\) bin entries to program the hints","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n \\)","locator":"§5.2, pp. 20–21","measure":"computation","note":"Its items' three Cuckoo positions, each computed once","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","name":"PSTY no-stash OPPRF circuit-PSI","paper_ids":["PSI-PAPER-2019-PSTY"],"primitive":"circuit-PSI","schedule":[{"blocks":["oprf"],"id":"oprf","locator":"§5.2, p. 20; Protocol 9, step 2, p. 17; Protocol 7, step 1, p. 16","phase":"online","what":"one OPRF per bin of P1's three-function cuckoo table, queried with its bin entries"},{"after":["oprf"],"from":"sender","id":"hint","locator":"Protocol 7, step 2, p. 16","phase":"online","what":"P2's hint polynomials, programmed with the OPRF keys"},{"after":["hint"],"blocks":["two_pc"],"id":"circuit","locator":"Protocol 9, step 3, p. 17; §5.2, p. 20","phase":"online","what":"the circuit with one equality test of OPPRF outputs per bin, then f"}],"security":{"mode":"computational","model":"semi-honest two-party; OPPRF from a PRF (Theorem 5) in the F_OPRF-hybrid model (Theorem 8); protocol security from the OPPRF and 2PC functionalities (§4.1, p. 17); hashing failure below \\( 2^{-40} \\) by the experiments of Pinkas, Schneider, and Zohner (§5.2, p. 20)","notion":"\\( f(X \\cap Y) \\) for a symmetric function \\( f \\)"},"status":"published","title":"PSTY stash-less circuit-based PSI from batched OPPRF with three-function cuckoo hashing, semi-honest two-party, GMW","variables":[{"meaning":"Number of mega-bins, each with its own hint polynomial; \\( O(n/m) \\), and \\( n/\\log n \\) asymptotically","symbol":"B"},{"meaning":"Maximum number of items in a mega-bin, the hint degree bound; at most 1,024 in the implementation, \\( O(\\log n) \\) asymptotically","symbol":"m"},{"meaning":"OPPRF output length compared in the circuit, \\( \\lambda+\\log\\beta \\) for \\( \\beta = 1.27n \\) bins","symbol":"\\gamma"}],"work_id":"PSI-PAPER-2019-PSTY","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/241","sections":[{"content":"Circuit-based PSI in which P1 cuckoo-hashes with three hash functions into 1.27n bins and no stash, a batched OPPRF from per-mega-bin hint polynomials gives one value per bin, and the circuit makes one γ-bit equality test per bin before computing f.","heading":"Summary"}],"slug":"psty19-psty-no-stash-opprf","status":"fulltext_checked","subtitle":"circuit-PSI · 2019","summary":"Circuit-based PSI in which P1 cuckoo-hashes with three hash functions into 1.27n bins and no stash, a batched OPPRF from per-mega-bin hint polynomials gives one value per bin, and the circuit makes one γ-bit equality test per bin before computing f.","title":"PSTY no-stash OPPRF circuit-PSI","type":"construction","venue":"EUROCRYPT 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2019-PSTY-NO-STASH"},{"contributions":[],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-BF","keywords":["psi cardinality and intersection-sum","encrypted_bloom_filter_homomorphic_tags","encrypted-bloom-filter"],"metadata":{"assumption":{"family":"generic","name":"CPA-secure additively homomorphic encryption (exponential ElGamal and Ring-LWE in the measurements)"},"attributes":{"adversary":{"locator":"§4.3.2, p. 10; Appendix F, p. 22","value":["semi_honest"]},"assumptions":{"locator":"§5.1, pp. 11-12; Appendix F, p. 22","note":"Exponential ElGamal and Ring-LWE as measured; the proof assumes any CPA-secure additively homomorphic scheme.","value":["DDH","Ring-LWE"]},"output":{"locator":"Figure 1, p. 3; §4.3.2, p. 10","value":["cardinality","sum"]},"output_to":{"locator":"Figure 4, p. 11","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"Appendix F, p. 22","note":"Argued from the encryption scheme and negligible Bloom-filter collisions; no idealized model.","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"Figure 4, p. 11","value":["bloom_filter","additively_homomorphic_encryption"]}},"capabilities":["encrypted-bloom-filter"],"claim_ids":[],"construction_family":"encrypted_bloom_filter_homomorphic_tags","costs":[{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 4, Setup, p. 11","measure":"communication","note":"Its public key","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( (n(59+1.44\\log_2 n)+1)e \\)","locator":"Figure 4, steps 3 and 6, p. 11; §5.1, p. 11; Table 4, p. 12","measure":"communication","note":"\\( (b+1)e \\): one ciphertext per bit of a \\( b \\)-bit Bloom filter sized for a negligible false match over all items, then the sum","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 4, Setup, p. 11","measure":"communication","note":"Its public key","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y e \\)","locator":"Figure 4, step 5, p. 11","measure":"communication","note":"One membership ciphertext and one value ciphertext per item, before slotting.","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( b + n_Y + 1 \\)","locator":"Figure 4, steps 3 and 6, p. 11; Appendix A.4, p. 16","measure":"computation","note":"Encrypts each filter bit, decrypts each membership ciphertext, and encrypts zero to refresh the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 4, step 6, p. 11; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( kn_X \\)","locator":"Figure 4, step 2, p. 11; Appendix A.7, p. 16","measure":"computation","note":"Builds its Bloom filter: \\( k \\) hashes per item","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y + 1 \\)","locator":"Figure 4, steps 4–5 and Output, p. 11; Appendix A.4, p. 16","measure":"computation","note":"Per item an encryption of \\( k \\), a refresh and its value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y(k+2) \\)","locator":"Figure 4, steps 4–5, p. 11; Appendix A.4, p. 16","measure":"computation","note":"Per item sums its \\( k \\) filter ciphertexts, subtracts, masks by a scalar, then adds the refresh's encryption of zero","operation":"hom_op","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( kn_Y \\)","locator":"Figure 4, step 4a, p. 11","measure":"computation","note":"The \\( k \\) filter positions of each item","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-BF","name":"Ion et al. encrypted Bloom filter intersection-sum","paper_ids":["PSI-PAPER-2020-ION"],"primitive":"PSI cardinality and intersection-sum","schedule":[{"from":"sender","id":"pk1","locator":"Figure 4, Setup, p. 11","phase":"offline","what":"P1's public key"},{"from":"receiver","id":"pk2","locator":"Figure 4, Setup, p. 11","phase":"offline","what":"P2's public key, exchanged at the same time"},{"from":"sender","id":"filter","locator":"Figure 4, steps 2–3, p. 11","phase":"online","what":"the encrypted Bloom filter"},{"after":["pk1","filter"],"from":"receiver","id":"membership","locator":"Figure 4, steps 4–5, p. 11","phase":"online","what":"refreshed membership ciphertexts with the encrypted associated values"},{"after":["pk2","membership"],"from":"sender","id":"sum","locator":"Figure 4, step 6, p. 11","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security":{"mode":"computational","model":"semi-honest two-party; simulation from the intersection size and sum, given the encryption scheme and negligible Bloom-filter collisions (§4.3.2, p. 10; Appendix F)","notion":"private intersection-sum with cardinality"},"status":"published","title":"Ion et al. encrypted-Bloom-filter private intersection-sum with cardinality, semi-honest two-party","variables":[{"meaning":"Bloom-filter length, chosen so that a false match over all items has probability at most \\( 2^{-40} \\)","symbol":"b"},{"meaning":"Size of one additively homomorphic ciphertext","symbol":"e"},{"meaning":"Number of Bloom-filter hash functions, chosen with b","symbol":"k"},{"meaning":"Size of one additively homomorphic public key","symbol":"e_{\\mathrm{pk}}"}],"work_id":"PSI-PAPER-2020-ION","year":2020},"primaryUrl":"https://eprint.iacr.org/2019/723","sections":[{"content":"Private intersection-sum with cardinality from an encrypted Bloom filter: P1 sends its Bloom filter encrypted bit by bit, P2 computes for each item a ciphertext that is zero exactly on a match and sends it shuffled with its encrypted value, and P1 sums the values of the zero entries.","heading":"Summary"}],"slug":"ikn20-ion-et-al-encrypted","status":"fulltext_checked","subtitle":"PSI cardinality and intersection-sum · 2020","summary":"Private intersection-sum with cardinality from an encrypted Bloom filter: P1 sends its Bloom filter encrypted bit by bit, P2 computes for each item a ciphertext that is zero exactly on a match and sends it shuffled with its encrypted value, and P1 sums the values of the zero entries.","title":"Ion et al. encrypted Bloom filter intersection-sum","type":"construction","venue":"IEEE EuroS&P 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-ION-BF"},{"contributions":["PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-DDH","keywords":["psi cardinality and intersection-sum","diffie_hellman_homomorphic_tags","deployed","threshold-abort-variant","reverse-variant","segmented-inputs"],"metadata":{"assumption":{"family":"discrete_log","name":"DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)"},"attributes":{"adversary":{"locator":"§2.3, p. 4; Theorems 1-2, p. 6","value":["semi_honest"]},"assumptions":{"locator":"§3.1, p. 5; §3.2, p. 7; Appendix D, pp. 19-20","note":"DCR through the deployed Paillier encryption; the proof assumes any CPA-secure additively homomorphic scheme.","value":["DDH","DCR"]},"output":{"locator":"Figure 1, p. 3","value":["cardinality","sum"]},"output_to":{"locator":"Figure 2, p. 6; Theorems 1–2, p. 6","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"§3.1, p. 5; Appendix D, p. 19","note":"The hash to the group is a random oracle that the simulator programs.","value":["programmable random oracle"]},"set_size_regime":{"locator":"§2.4, p. 4","value":"balanced"},"technique":{"locator":"§3.1, p. 5","value":["diffie_hellman","additively_homomorphic_encryption"]}},"capabilities":["deployed","threshold-abort-variant","reverse-variant","segmented-inputs"],"claim_ids":["PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"],"construction_family":"diffie_hellman_homomorphic_tags","costs":[{"basis":"counted","formula":"\\( n_X|\\mathbb{G}| + e \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"communication","note":"Its hashed and exponentiated set, then one ciphertext of the sum.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( |\\mathbb{Z}_N| \\)","locator":"Figure 2, Setup, p. 6","measure":"communication","note":"Its Paillier public key, the modulus","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( (n_X + n_Y)|\\mathbb{G}| + n_Y e \\)","locator":"Figure 2, Round 2, p. 6","measure":"communication","note":"P1's set exponentiated again, then its own items with their encrypted values, before slotting","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 3, p. 6; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 1 \\)","locator":"Figure 2, Round 3, p. 6; Appendix A.4, p. 16","measure":"computation","note":"The fresh encryption of zero that refreshes the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 2, Round 1, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y + 1 \\)","locator":"Figure 2, Round 2 and Output, p. 6","measure":"computation","note":"Encrypts each value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-DDH","name":"Ion et al. DDH intersection-sum (deployed)","paper_ids":["PSI-PAPER-2020-ION"],"primitive":"PSI cardinality and intersection-sum","schedule":[{"from":"receiver","id":"pk","locator":"Figure 2, Setup, p. 6","phase":"offline","what":"P2's fresh public key"},{"from":"sender","id":"round1","locator":"Figure 2, Round 1, step 2, p. 6","phase":"online","what":"P1's hashed and exponentiated set"},{"after":["round1"],"from":"receiver","id":"z","locator":"Figure 2, Round 2, steps 1–2, p. 6","phase":"online","what":"P1's elements exponentiated again, the set Z"},{"from":"receiver","id":"pairs","locator":"Figure 2, Round 2, steps 3–4, p. 6","phase":"online","what":"its own exponentiated items with their encrypted values, in the same round","with":"z"},{"after":["pk","z","pairs"],"from":"sender","id":"sum","locator":"Figure 2, Round 3, step 3, p. 6","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security":{"mode":"computational","model":"semi-honest two-party; simulation-based proofs from DDH and the security of the homomorphic encryption with H as a random oracle (Theorems 1-2, p. 6; Appendix D)","notion":"private intersection-sum with cardinality"},"status":"published","title":"Ion et al. DDH-based private intersection-sum with cardinality with Paillier tags, semi-honest two-party, random oracle model","variables":[{"meaning":"Size of one additively homomorphic ciphertext (Damgård-Jurik Paillier with s = 3 in the deployment)","symbol":"e"}],"work_id":"PSI-PAPER-2020-ION","year":2020},"primaryUrl":"https://eprint.iacr.org/2019/723","sections":[{"content":"Private intersection-sum with cardinality from double-exponentiated hashed Diffie-Hellman: each party exponentiates hashed identifiers with its key in shuffled order, P2 attaches Paillier encryptions of its values, and P1 sums the ciphertexts of matching items for P2 to decrypt.","heading":"Summary"}],"slug":"ikn20-ion-et-al-ddh","status":"fulltext_checked","subtitle":"PSI cardinality and intersection-sum · 2020","summary":"Private intersection-sum with cardinality from double-exponentiated hashed Diffie-Hellman: each party exponentiates hashed identifiers with its key in shuffled order, P2 attaches Paillier encryptions of its values, and P1 sums the ciphertexts of matching items for P2 to decrypt.","title":"Ion et al. DDH intersection-sum (deployed)","type":"construction","venue":"IEEE EuroS&P 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-ION-DDH"},{"contributions":["PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","keywords":["psi cardinality and intersection-sum","diffie_hellman_homomorphic_tags","deployed","threshold-abort-variant","reverse-variant","segmented-inputs"],"metadata":{"assumption":{"family":"discrete_log","name":"DDH and CPA-secure additively homomorphic encryption, random oracle model (Paillier with Damgård-Jurik in deployment)"},"attributes":{"adversary":{"locator":"§2.3, p. 4; Theorems 1-2, p. 6","value":["semi_honest"]},"assumptions":{"locator":"§3.1, p. 5; §5.1, p. 12; Appendix D, pp. 19-20","note":"Ring-LWE through the slotted encryption of the values; the proof assumes any CPA-secure additively homomorphic scheme.","value":["DDH","Ring-LWE"]},"output":{"locator":"Figure 1, p. 3","value":["cardinality","sum"]},"output_to":{"locator":"Figure 2, p. 6; Theorems 1–2, p. 6","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"§3.1, p. 5; Appendix D, p. 19","note":"The hash to the group is a random oracle that the simulator programs.","value":["programmable random oracle"]},"set_size_regime":{"locator":"§2.4, p. 4","value":"balanced"},"technique":{"locator":"§3.1, p. 5; §5.1, p. 12","value":["diffie_hellman","additively_homomorphic_encryption"]}},"capabilities":["deployed","threshold-abort-variant","reverse-variant","segmented-inputs"],"claim_ids":["PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"],"construction_family":"diffie_hellman_homomorphic_tags","costs":[{"basis":"counted","formula":"\\( n_X|\\mathbb{G}| + 2|\\mathcal{R}_q| \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"communication","note":"Its hashed and exponentiated set, then one ciphertext of the sum.","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2|\\mathcal{R}_q| \\)","locator":"Figure 2, Setup, p. 6","measure":"communication","note":"Its Ring-LWE public key, two ring elements at full width, as the paper states no encoding","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( (n_X + n_Y)|\\mathbb{G}| + 2n_Y|\\mathcal{R}_q| \\)","locator":"Figure 2, Round 2, p. 6","measure":"communication","note":"P1's set exponentiated again, then its own items with their encrypted values, before slotting","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Rounds 1 and 3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X + n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 3, p. 6; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 1 \\)","locator":"Figure 2, Round 3, p. 6; Appendix A.4, p. 16","measure":"computation","note":"The fresh encryption of zero that refreshes the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 2, Round 1, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y + 1 \\)","locator":"Figure 2, Round 2 and Output, p. 6","measure":"computation","note":"Encrypts each value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 2, Round 2, p. 6","measure":"computation","note":"Hashes each item to the group","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","name":"Ion et al. DDH intersection-sum (Ring-LWE)","paper_ids":["PSI-PAPER-2020-ION"],"primitive":"PSI cardinality and intersection-sum","schedule":[{"from":"receiver","id":"pk","locator":"Figure 2, Setup, p. 6","phase":"offline","what":"P2's fresh public key"},{"from":"sender","id":"round1","locator":"Figure 2, Round 1, step 2, p. 6","phase":"online","what":"P1's hashed and exponentiated set"},{"after":["round1"],"from":"receiver","id":"z","locator":"Figure 2, Round 2, steps 1–2, p. 6","phase":"online","what":"P1's elements exponentiated again, the set Z"},{"from":"receiver","id":"pairs","locator":"Figure 2, Round 2, steps 3–4, p. 6","phase":"online","what":"its own exponentiated items with their encrypted values, in the same round","with":"z"},{"after":["pk","z","pairs"],"from":"sender","id":"sum","locator":"Figure 2, Round 3, step 3, p. 6","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security":{"mode":"computational","model":"semi-honest two-party; simulation-based proofs from DDH and the security of the homomorphic encryption with H as a random oracle (Theorems 1-2, p. 6; Appendix D)","notion":"private intersection-sum with cardinality"},"status":"published","title":"Ion et al. DDH-based private intersection-sum with cardinality with slotted Ring-LWE tags, semi-honest two-party, random oracle model","work_id":"PSI-PAPER-2020-ION","year":2020},"primaryUrl":"https://eprint.iacr.org/2019/723","sections":[{"content":"The deployed DDH-based intersection-sum protocol with the associated values encrypted under slotted Ring-LWE instead of Paillier, which the paper finds about 40% faster for similar communication.","heading":"Summary"}],"slug":"ikn20-ion-et-al-ddh-2","status":"fulltext_checked","subtitle":"PSI cardinality and intersection-sum · 2020","summary":"The deployed DDH-based intersection-sum protocol with the associated values encrypted under slotted Ring-LWE instead of Paillier, which the paper finds about 40% faster for similar communication.","title":"Ion et al. DDH intersection-sum (Ring-LWE)","type":"construction","venue":"IEEE EuroS&P 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-ION-DDH-RLWE"},{"contributions":["PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-ROT","keywords":["psi cardinality and intersection-sum","oprf_shuffle_homomorphic_tags","shuffled-oprf","reverse-variant"],"metadata":{"assumption":{"family":"generic","name":"CPA-secure additively homomorphic encryption and batched random OT"},"attributes":{"adversary":{"locator":"Theorems 3-4, pp. 9-10; Appendix E, p. 20","value":["semi_honest"]},"assumptions":{"locator":"§5.1, pp. 11-12; Appendix E, pp. 20-21","note":"Paillier for the OPRF values and Ring-LWE for the associated values as measured; the proof assumes any CPA-secure scheme and random OT.","value":["DCR","Ring-LWE"]},"output":{"locator":"Figure 1, p. 3; §4.3.1, p. 9","value":["cardinality","sum"]},"output_to":{"locator":"Figure 3, p. 10","note":"P1 learns the cardinality; P2 learns the intersection-sum.","value":"all"},"parties":{"locator":"Figure 1, p. 3","value":"two_party"},"security_model":{"locator":"Appendix E, pp. 20-21","note":"No idealized model in the proof, which assumes a random-OT functionality; hybrids are not models.","value":["standard model"]},"set_size_regime":{"locator":"§5.1, p. 11","value":"balanced"},"technique":{"locator":"Figure 3, p. 10; §5.1, p. 11","value":["batched_oprf","ot_extension","cuckoo_hashing","additively_homomorphic_encryption"]}},"blocks":[{"cites":[{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":"\\( 1.3n_X \\)","func":"rot","id":"rot","implementation":"Batched random OT of Kolesnikov et al.","instantiation":"kkrt16_rot","locator":"Figure 3, step 3, p. 10; Appendix A.6, p. 16; Table 3, p. 12; §5.1, p. 11","note":"One per cuckoo bin of P1, which learns its PRF value; base public-key OTs precede it","params":{"N":"\\( 2^{\\sigma} \\)","\\tau":"\\( u \\)"},"phase":"online","roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["shuffled-oprf","reverse-variant"],"claim_ids":["PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"],"construction_family":"oprf_shuffle_homomorphic_tags","costs":[{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 3, Setup, p. 10","measure":"communication","note":"Its public key","phase":"offline","subject":"sender"},{"basis":"counted","formula":"\\( 1.3n_Xe + e \\)","locator":"Figure 3, steps 4 and 7, p. 10","measure":"communication","note":"One encrypted OPRF value per bin, then the sum ciphertext","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( e_{\\mathrm{pk}} \\)","locator":"Figure 3, Setup, p. 10","measure":"communication","note":"Its public key","phase":"offline","subject":"receiver"},{"basis":"counted","formula":"\\( (1.3n_X + n_Y)e + 3n_Y u \\)","locator":"Figure 3, steps 5–6, p. 10","measure":"communication","note":"Re-masked ciphertexts per bin, then three OPRF values and one value ciphertext per item, before slotting","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2.6n_X + 1 \\)","locator":"Figure 3, steps 4 and 7, p. 10; Appendix A.4, p. 16","measure":"computation","note":"Encrypts its OPRF value in each bin, decrypts each re-masked one, and encrypts zero to refresh the sum","operation":"enc_dec","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 3, step 7, p. 10; §5, p. 11","measure":"computation","note":"Adds the value ciphertexts of the matches and refreshes the sum, with every item matching as the paper counts","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 3n_X \\)","locator":"Figure 3, step 2, p. 10; Appendix A.8, p. 16","measure":"computation","note":"Cuckoo hashing: three bin hashes per item, kept through evictions","operation":"symmetric_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2.6n_X + n_Y + 1 \\)","locator":"Figure 3, steps 5–6 and Output, p. 10; Appendix A.4, p. 16","measure":"computation","note":"Per bin a mask encryption and a refresh, per item its value, then decrypts the sum","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 2.6n_X \\)","locator":"Figure 3, step 5, p. 10; Appendix A.4, p. 16","measure":"computation","note":"Per bin adds the mask, then the refresh's encryption of zero","operation":"hom_op","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 18n_Y \\)","locator":"Figure 3, step 6, p. 10","measure":"computation","note":"Per item three bin hashes and the OPRF at its three candidate bins, five calls each as KKRT counts them","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-ION-ROT","name":"Ion et al. random-OT intersection-sum","paper_ids":["PSI-PAPER-2020-ION","PSI-PAPER-2016-KKRT"],"primitive":"PSI cardinality and intersection-sum","schedule":[{"from":"sender","id":"pk1","locator":"Figure 3, Setup, p. 10","phase":"offline","what":"P1's public key"},{"from":"receiver","id":"pk2","locator":"Figure 3, Setup, p. 10","phase":"offline","what":"P2's public key, exchanged at the same time"},{"blocks":["rot"],"id":"rot","locator":"Figure 3, steps 2–3, p. 10","phase":"online","what":"one random OT per cuckoo bin of P1, which learns its PRF values; its one flow is P1's"},{"from":"sender","id":"oprf","locator":"Figure 3, step 4, p. 10","phase":"online","what":"P1's encrypted PRF values, sent with its random-OT message"},{"after":["pk1","oprf"],"from":"receiver","id":"remask","locator":"Figure 3, step 5, p. 10","phase":"online","what":"the re-masked, refreshed PRF ciphertexts"},{"after":["rot"],"from":"receiver","id":"items","locator":"Figure 3, step 6, p. 10","phase":"online","what":"its masked PRF values per item with the encrypted associated values","with":"remask"},{"after":["pk2","remask","items"],"from":"sender","id":"sum","locator":"Figure 3, step 7, p. 10","phase":"online","what":"the refreshed encrypted intersection-sum"}],"security":{"mode":"computational","model":"semi-honest two-party; simulation-based proofs from the encryption scheme and the random-OT functionality (Theorems 3-4, pp. 9-10; Appendix E)","notion":"private intersection-sum with cardinality"},"status":"published","title":"Ion et al. random-OT-based private intersection-sum with cardinality with shuffled OPRF outputs, semi-honest two-party","variables":[{"meaning":"Length of one OPRF value sent by P2 (a SHA-256 output as implemented)","symbol":"u"},{"meaning":"Size of one additively homomorphic ciphertext","symbol":"e"},{"meaning":"Size of one additively homomorphic public key","symbol":"e_{\\mathrm{pk}}"}],"work_id":"PSI-PAPER-2020-ION","year":2020},"primaryUrl":"https://eprint.iacr.org/2019/723","sections":[{"content":"Private intersection-sum with cardinality from batched random-OT OPRFs: P1 cuckoo-hashes its items, encrypts its OPRF outputs for P2 to re-mask and shuffle, and matches them against P2's masked OPRF values to sum P2's encrypted values.","heading":"Summary"}],"slug":"ikn20-ion-et-al-random","status":"fulltext_checked","subtitle":"PSI cardinality and intersection-sum · 2020","summary":"Private intersection-sum with cardinality from batched random-OT OPRFs: P1 cuckoo-hashes its items, encrypts its OPRF outputs for P2 to re-mask and shuffle, and matches them against P2's masked OPRF values to sum P2's encrypted values.","title":"Ion et al. random-OT intersection-sum","type":"construction","venue":"IEEE EuroS&P 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-ION-ROT"},{"contributions":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-MAL","keywords":["two-party psi","okvs_ot_extension","linear-communication"],"metadata":{"assumption":{"family":"idealized_model","name":"Non-programmable random oracles, in the OOS OT-extension hybrid model"},"attributes":{"adversary":{"locator":"Theorem 4, p. 10; §4.4, pp. 15–16","note":"A corrupt party may use a larger set, bounded through the hash output lengths","value":["malicious"]},"assumptions":{"locator":"Theorem 4, p. 10; §7.1, p. 22","note":"No hardness assumption is named beyond the random oracles; OOS and its base OTs are taken as given","value":"not_reported"},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 6; Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"abstract, p. 1; §4.2, p. 10; Theorem 4, p. 10","note":"Proved in the OOS-hybrid model, a hybrid model, with non-programmable oracles H1 and H2","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"§4, pp. 9–11; §5, pp. 16–19","value":["paxos","ot_extension"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","note":"One run on the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["linear-communication"],"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"construction_family":"okvs_ot_extension","costs":[{"basis":"counted","formula":"\\( 2\\kappa n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, p. 15","measure":"communication","note":"One \\( H_2 \\) output per item, at the \\( 2\\kappa \\) bits recommended against a malicious sender","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 6, Decode, p. 19","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 6, p. 19","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-MAL","name":"PaXoS-PSI (malicious, 2-core table)","paper_ids":["PSI-PAPER-2020-PRTY"],"primitive":"two-party PSI","schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11","phase":"online","what":"the OOS run on the receiver's PaXoS, with its consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security":{"mode":"computational","model":"malicious two-party, random oracle model, OOS-hybrid (Theorem 4, p. 10; Lemmas 5-6, pp. 12-14)","notion":"PSI with output to the receiver; corrupt parties may use larger sets"},"status":"published","title":"PaXoS-PSI, malicious two-party PSI from a garbled cuckoo PaXoS and OOS OT extension, random oracle model","variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph, so the PaXoS has d + λ extra positions; the paper sets it to (1 + ε) log n","symbol":"d"}],"work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"Malicious PaXoS-PSI: the receiver encodes (y, H1(y)) into the 2-core garbled cuckoo table and uses it as its OOS choice strings, and the sender sends H2(x, ·) of each item, so a simulator extracts both parties' sets from their oracle queries. Longer hash outputs and codes bound a corrupt party's effective set.","heading":"Summary"}],"slug":"prty20-paxos-psi-malicious-2","status":"fulltext_checked","subtitle":"two-party PSI · 2020","summary":"Malicious PaXoS-PSI: the receiver encodes (y, H1(y)) into the 2-core garbled cuckoo table and uses it as its OOS choice strings, and the sender sends H2(x, ·) of each item, so a simulator extracts both parties' sets from their oracle queries. Longer hash outputs and codes bound a corrupt party's effective set.","title":"PaXoS-PSI (malicious, 2-core table)","type":"construction","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-PRTY-MAL"},{"contributions":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","keywords":["two-party psi","okvs_ot_extension","linear-communication"],"metadata":{"assumption":{"family":"idealized_model","name":"Non-programmable random oracles, in the OOS OT-extension hybrid model"},"attributes":{"adversary":{"locator":"Theorem 4, p. 10; §4.4, pp. 15–16","note":"A corrupt party may use a larger set, bounded through the hash output lengths","value":["malicious"]},"assumptions":{"locator":"Theorem 4, p. 10; §7.1, p. 22","note":"No hardness assumption is named beyond the random oracles; OOS and its base OTs are taken as given","value":"not_reported"},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"abstract, p. 1; §4.2, p. 10; Theorem 4, p. 10","note":"Proved in the OOS-hybrid model, a hybrid model, with non-programmable oracles H1 and H2","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"Appendix B, pp. 29–31; §7.1, p. 22","value":["paxos","ot_extension"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; Theorem 4, p. 10; §4.4, pp. 15–16; §7.1, p. 22","note":"One run on the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\), the length of \\( H_1 \\), is raised to bound a corrupt receiver's set","params":{"\\tau":"\\( \\ge \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["linear-communication"],"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"construction_family":"okvs_ot_extension","costs":[{"basis":"counted","formula":"\\( 2\\kappa n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, p. 15","measure":"communication","note":"One \\( H_2 \\) output per item, at the \\( 2\\kappa \\) bits recommended against a malicious sender","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 7, Decode, p. 30","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 7, p. 30","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","name":"PaXoS-PSI (malicious, DFS table)","paper_ids":["PSI-PAPER-2020-PRTY"],"primitive":"two-party PSI","schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11; Figure 7, p. 30","phase":"online","what":"the OOS run on the receiver's DFS PaXoS, with its consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security":{"mode":"computational","model":"malicious two-party, random oracle model, OOS-hybrid (Theorem 4, p. 10; Lemmas 5-6, pp. 12-14)","notion":"PSI with output to the receiver; corrupt parties may use larger sets"},"status":"published","title":"PaXoS-PSI, malicious two-party PSI from the DFS-based garbled cuckoo PaXoS and OOS OT extension, random oracle model","variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph (the paper's σ), so the PaXoS has d + λ extra positions; at most log n + O(1)","symbol":"d"}],"work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"Malicious PaXoS-PSI over the DFS-based garbled cuckoo table of Appendix B, with 2n main positions instead of 2.4n. It sends the least of the paper's malicious configurations.","heading":"Summary"}],"slug":"prty20-paxos-psi-malicious-dfs","status":"fulltext_checked","subtitle":"two-party PSI · 2020","summary":"Malicious PaXoS-PSI over the DFS-based garbled cuckoo table of Appendix B, with 2n main positions instead of 2.4n. It sends the least of the paper's malicious configurations.","title":"PaXoS-PSI (malicious, DFS table)","type":"construction","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-PRTY-MAL-DFS"},{"contributions":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-SH","keywords":["two-party psi","okvs_ot_extension","linear-communication"],"metadata":{"assumption":{"family":"symmetric","name":"Code-correlation-robust hash, in the OOS OT-extension hybrid model"},"attributes":{"adversary":{"locator":"§4.4, p. 15","value":["semi_honest"]},"assumptions":{"locator":"Lemma 1, p. 4; §7.1, p. 22","note":"Code correlation robustness; OOS and its base OTs are taken as given","value":["CR hash"]},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 1, p. 6; Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"Appendix D, p. 33; Theorem 4, p. 10","note":"Claimed without a separate proof; the proof given is the malicious random-oracle one, with OOS as an ideal functionality","value":["standard model"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"§4, pp. 9–11; §5, pp. 16–19","value":["paxos","ot_extension"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17_sh","locator":"Figure 3, step 2, p. 11; Figure 6, p. 19; §2, p. 4; §4.4, p. 15; §7.1, p. 22; Table 1, p. 21","note":"One run whose choice strings are the receiver's garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2.4n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["linear-communication"],"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS"],"construction_family":"okvs_ot_extension","costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log_2(n_Xn_Y))n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, pp. 14–15; Lemma 6, p. 14","measure":"communication","note":"One \\( H_2 \\) output per item, at the semi-honest length, the least the proof allows","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 6, Decode, p. 19","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 6, p. 19","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-SH","name":"PaXoS-PSI (semi-honest, 2-core table)","paper_ids":["PSI-PAPER-2020-PRTY"],"primitive":"two-party PSI","schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11; §2.1, p. 6","phase":"online","what":"the OOS run on the receiver's PaXoS, without the consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security":{"mode":"computational","model":"semi-honest two-party; standard model as stated in Appendix D (p. 33)","notion":"PSI with output to the receiver"},"status":"published","title":"PaXoS-PSI, semi-honest two-party PSI from a garbled cuckoo PaXoS and OOS OT extension","variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph, so the PaXoS has d + λ extra positions; the paper sets it to (1 + ε) log n","symbol":"d"}],"work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"PSI from a PaXoS (garbled cuckoo table): the receiver encodes its items into the table and uses it as its choice strings in the OOS OT extension, whose XOR-homomorphism lets the sender evaluate each item's mask. This row uses the 2-core table with 2.4n main positions and the shortest hash outputs.","heading":"Summary"}],"slug":"prty20-paxos-psi-semi-honest","status":"fulltext_checked","subtitle":"two-party PSI · 2020","summary":"PSI from a PaXoS (garbled cuckoo table): the receiver encodes its items into the table and uses it as its choice strings in the OOS OT extension, whose XOR-homomorphism lets the sender evaluate each item's mask. This row uses the 2-core table with 2.4n main positions and the shortest hash outputs.","title":"PaXoS-PSI (semi-honest, 2-core table)","type":"construction","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-PRTY-SH"},{"contributions":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","keywords":["two-party psi","okvs_ot_extension","linear-communication"],"metadata":{"assumption":{"family":"symmetric","name":"Code-correlation-robust hash, in the OOS OT-extension hybrid model"},"attributes":{"adversary":{"locator":"§4.4, p. 15","value":["semi_honest"]},"assumptions":{"locator":"Lemma 1, p. 4; §7.1, p. 22","note":"Code correlation robustness; OOS and its base OTs are taken as given","value":["CR hash"]},"output":{"locator":"Figure 3, p. 11","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 3, p. 11","value":"two_party"},"security_model":{"locator":"Appendix D, p. 33; Theorem 4, p. 10","note":"Claimed without a separate proof; the proof given is the malicious random-oracle one, with OOS as an ideal functionality","value":["standard model"]},"set_size_regime":{"locator":"Figure 3, p. 11","value":"balanced"},"technique":{"locator":"Appendix B, pp. 29–31; §7.1, p. 22","value":["paxos","ot_extension"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"},{"key":"NP01","title":"Efficient oblivious transfer protocols"}],"func":"oos","id":"oos","implementation":"OOS OT extension, Naor-Pinkas base OTs","instantiation":"oos17_sh","locator":"Figure 3, step 2, p. 11; Figure 7, p. 30; §2, p. 4; §4.4, p. 15; §7.1, p. 22","note":"One run whose choice strings are the receiver's DFS garbled cuckoo table, one instance per position; \\( \\tau \\) is the output length of \\( H_1 \\)","params":{"\\tau":"\\( \\lambda+\\log_2(n_Xn_Y) \\)","m":"\\( 2n_Y+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["linear-communication"],"claim_ids":["PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS"],"construction_family":"okvs_ot_extension","costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log_2(n_Xn_Y))n_X \\)","locator":"Figure 3, step 3, p. 11; §4.4, pp. 14–15; Lemma 6, p. 14","measure":"communication","note":"One \\( H_2 \\) output per item, at the semi-honest length, the least the proof allows","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its PaXoS","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"Figure 3, step 3, p. 11; Figure 7, Decode, p. 30","measure":"computation","note":"Per item: the PaXoS hash functions \\( h_1, h_2, r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"Figure 3, steps 1 and 4, p. 11; Figure 7, p. 30","measure":"computation","note":"Per item: \\( h_1, h_2, r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","name":"PaXoS-PSI (semi-honest, DFS table)","paper_ids":["PSI-PAPER-2020-PRTY"],"primitive":"two-party PSI","schedule":[{"blocks":["oos"],"id":"oos","locator":"Figure 3, steps 1–2, p. 11; Figure 7, p. 30","phase":"online","what":"the OOS run on the receiver's DFS PaXoS, without the consistency check"},{"after":["oos"],"from":"sender","id":"masks","locator":"Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security":{"mode":"computational","model":"semi-honest two-party; standard model as stated in Appendix D (p. 33)","notion":"PSI with output to the receiver"},"status":"published","title":"PaXoS-PSI, semi-honest two-party PSI from the DFS-based garbled cuckoo PaXoS and OOS OT extension","variables":[{"meaning":"Width of the OT-extension matrix, the code length (the paper's ℓ)","symbol":"w"},{"meaning":"Bound on the cyclomatic number of the cuckoo graph (the paper's σ), so the PaXoS has d + λ extra positions; at most log n + O(1)","symbol":"d"}],"work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"PaXoS-PSI with the alternative garbled cuckoo table of Appendix B, built by a DFS traversal that turns each cycle into one constraint on the extra positions. Its 2n main positions give the paper's lowest semi-honest communication, at a slower running time than the 2-core table.","heading":"Summary"}],"slug":"prty20-paxos-psi-semi-honest-2","status":"fulltext_checked","subtitle":"two-party PSI · 2020","summary":"PaXoS-PSI with the alternative garbled cuckoo table of Appendix B, built by a DFS traversal that turns each cycle into one constraint on the extra positions. Its 2n main positions give the paper's lowest semi-honest communication, at a slower running time than the 2-core table.","title":"PaXoS-PSI (semi-honest, DFS table)","type":"construction","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2020-PRTY-SH-DFS"},{"contributions":["PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","keywords":["two-party threshold psi","polynomial_threshold_psi","sublinear-in-set-size","no-fhe"],"metadata":{"assumption":{"family":"generic","name":"Additively homomorphic encryption and Yao garbled circuits; no further assumption stated for the two-party case"},"attributes":{"adversary":{"locator":"Theorem 7.1, p. 28; §1.2, p. 4","note":"The two-party case of the multiparty theorem; no separate theorem is given","value":["semi_honest"]},"assumptions":{"locator":"§2.6, p. 10; §7.1, p. 29","note":"Either, as stated, though exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts; garbling's oblivious transfers are not discussed","value":["DCR","DDH"]},"output":{"locator":"§2.3, p. 6; Figure 8, p. 27","note":"The intersection if the symmetric difference has at most \\( t \\) elements, otherwise nothing","value":["threshold"]},"output_to":{"locator":"§7.1, Two-party case, p. 29; §2.3, p. 6","note":"The functionality gives every party the output; the two-party protocol has only Alice decrypt and interpolate","value":"one"},"parties":{"locator":"§1.2, p. 4","value":"two_party"},"security_model":{"locator":"§1.2, p. 4; §6.1, p. 26","note":"UC; the singularity test is an ideal functionality realized by Yao's garbled circuits","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"§6.1, p. 26; §7.1, p. 29","value":["additively_homomorphic_encryption","garbled_circuits","polynomial_sparsity_test","set_reconciliation"]}},"blocks":[{"cites":[{"key":"Yao86","title":"How to Generate and Exchange Secrets (Extended Abstract)"}],"func":"gc","id":"gc","implementation":"Yao's garbled circuits","instantiation":"gc_yao","locator":"§6.1, p. 26; Imported Theorem 6.3, p. 25","note":"Half-GCD singularity test of the Hankel matrix of order \\( t+1 \\); the garbler and the oblivious transfers are left open","params":{"|C|":"\\( O(t\\log^{2}t\\cdot\\mathrm{poly}(\\kappa)) \\)"}}],"capabilities":["sublinear-in-set-size","no-fhe"],"claim_ids":["PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"construction_family":"polynomial_threshold_psi","costs":[{"basis":"counted","formula":"\\( (3t+4)\\gamma \\)","locator":"§7.1, p. 29","measure":"communication","note":"One encrypted combination per evaluation point","subject":"sender","tip":"Alice, who holds the decryption key and alone learns the output, is counted as receiver and Bob as sender."},{"locator":"§7.1, p. 29; §2.6, p. 10","measure":"communication","note":"Her public key; the additively homomorphic scheme, and so the size of its key, is left open","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( |\\mathbb{F}| + 2(3t+4)\\gamma \\)","locator":"Figure 8, step 1a, p. 27; §7.1, p. 29","measure":"communication","note":"The sparsity-test point u, taking Alice as P1, then encryptions of \\( p^A(x) \\) and \\( R^A_2(x) \\) at each of \\( 3t+4 \\) points","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)+t^{3}) \\)","locator":"Figure 8, p. 27; Figure 9, p. 30","measure":"computation","note":"Hankel shares, with one power per item of exponent up to \\( p \\), and set-polynomial evaluations, then rational interpolation of degree \\( 3t+3 \\)","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 3(3t+4) \\)","locator":"§7.1, p. 29","measure":"computation","note":"Two encryptions per evaluation point, then one decryption of Bob's reply","operation":"enc_dec","subject":"receiver"},{"basis":"counted","formula":"\\( O(n(t+\\log p)) \\)","locator":"Figure 8, step 1, p. 27; §7.1, p. 29","measure":"computation","note":"Hankel shares, with one power per item of exponent up to \\( p \\), and its set and random polynomials at the points; it interpolates nothing","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4(3t+4) \\)","locator":"§7.1, p. 29","measure":"computation","note":"Per point, two scalar products of Alice's ciphertexts and two additions, one of them adding his own encrypted term","operation":"hom_op","subject":"sender"},{"basis":"counted","formula":"\\( 3t+4 \\)","locator":"§7.1, p. 29; §2.6, p. 10","measure":"computation","note":"His own term \\( p^B(x)R^B_2(x) \\) at each point, encrypted afresh, which also refreshes the reply","operation":"enc_dec","subject":"sender"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","name":"BMRR two-party AHE threshold PSI","paper_ids":["PSI-PAPER-2021-BMRR","PSI-PAPER-2019-GS"],"primitive":"two-party threshold PSI","schedule":[{"from":"receiver","id":"keys","locator":"§3.3, p. 13; §7.1, Two-party case, p. 29","phase":"setup","what":"Alice's public key of the additively homomorphic scheme"},{"from":"receiver","id":"u","locator":"Figure 8, step 1a, p. 27","phase":"online","what":"The random point u of the sparsity test, Alice as P1"},{"after":["u"],"blocks":["gc"],"id":"test","locator":"Figure 8, step 2, p. 27; §6.1, Two-party case, p. 26; §7.1, p. 29","phase":"online","what":"Garbled singularity test of the Hankel matrix on both parties' shares; its bit decides whether the second phase runs"},{"after":["test"],"from":"receiver","id":"enc","locator":"§7.1, Two-party case, p. 29","phase":"online","what":"Encryptions of Alice's set polynomial and second random polynomial at each of the 3t+4 points"},{"after":["keys","enc"],"from":"sender","id":"reply","locator":"§7.1, Two-party case, p. 29","phase":"online","what":"Bob's encrypted noisy combination at each point"}],"security":{"mode":"computational","model":"semi-honest; the two-party specialization is described in prose (§1.2, p. 4; §6.1, p. 26; §7.1, p. 29) rather than in a separate theorem","notion":"two-party threshold PSI"},"status":"published","title":"BMRR two-party threshold PSI from additive HE with a garbled-circuit Hankel singularity test, semi-honest, \\( \\tilde O(t) \\) communication","variables":[{"meaning":"Bits of one ciphertext of the additively homomorphic scheme","symbol":"\\gamma"}],"work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"The two-party case of BMRR's TAHE route, offered as the answer to the open problem of Ghosh–Simkin: the monomial encoding and sparsity test, with the Hankel singularity test done by half-GCD inside Yao's garbled circuits, then a second phase in which Bob returns encrypted noisy evaluations for Alice to decrypt and interpolate.","heading":"Summary"}],"slug":"bmrr21-bmrr-two-party-ahe","status":"fulltext_checked","subtitle":"two-party threshold PSI · 2021","summary":"The two-party case of BMRR's TAHE route, offered as the answer to the open problem of Ghosh–Simkin: the monomial encoding and sparsity test, with the Hankel singularity test done by half-GCD inside Yao's garbled circuits, then a second phase in which Bob returns encrypted noisy evaluations for Alice to decrypt and interpolate.","title":"BMRR two-party AHE threshold PSI","type":"construction","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY"},{"contributions":["PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","keywords":["multiparty threshold psi","polynomial_threshold_psi","sublinear-in-set-size","star-network","no-fhe"],"metadata":{"assumption":{"family":"generic","name":"Threshold additively homomorphic encryption with distributed setup (ElGamal under DDH or Paillier under DCR) and a PRG in \\( \\mathrm{NC}^{1} \\)"},"attributes":{"adversary":{"locator":"Theorem 7.1, p. 28","value":["semi_honest"]},"assumptions":{"locator":"§2.6, p. 10; §6.1, p. 26; Corollary 7.2, p. 28","note":"Threshold ElGamal or Paillier, as stated, though exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts; a PRG in NC1 for the test","value":["DDH","DCR","PRG"]},"corruptions":{"locator":"Theorem 7.1, p. 28","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 2, p. 6; Figure 9, p. 30","note":"The intersection if the union minus the intersection has at most \\( t \\) elements","value":["threshold"]},"output_to":{"locator":"Figure 2, p. 6","value":"all"},"parties":{"locator":"§2.3, p. 6","value":"multiparty"},"security_model":{"locator":"Theorem 6.5, p. 27; Theorem 7.1, p. 28","note":"UC in a star network; the singularity and cardinality tests are hybrids, not models","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"§6, pp. 24–28; Figure 9, p. 30","value":["additively_homomorphic_encryption","garbled_circuits","polynomial_sparsity_test","set_reconciliation"]}},"blocks":[{"cites":[{"key":"CDN01","title":"Multiparty computation from threshold homomorphic encryption"},{"key":"DIK+08","title":"Scalable multiparty computation with nearly optimal work and resilience"},{"key":"Yao86","title":"How to generate and exchange secrets (extended abstract)"},{"key":"AIK05","title":"Computationally private randomizing polynomials and their applications"}],"func":"mpc","id":"sing_test","locator":"Figure 8, step 2, p. 27; Figure 7, p. 26; §6.1, Multi-Party Singularity Testing, pp. 25–26","note":"The paper's SingTest: half-GCD test of the summed Hankel shares over a field of over \\( \\lambda+\\log(t(t+1)(p-1)) \\) bits; any protocol, two sketched","params":{"\\ell":"\\( \\ell \\)","depth":"\\( O(t\\log^{2}t) \\)","|C|":"\\( O(t\\log^{2}t) \\)"},"roles":{"party":["leader","client"]}}],"capabilities":["sublinear-in-set-size","star-network","no-fhe"],"claim_ids":["PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"construction_family":"polynomial_threshold_psi","costs":[{"basis":"counted","formula":"\\( \\eta + (3t+4)(2\\gamma+\\delta) \\)","locator":"Figure 9, step 2, p. 30; Figure 8, p. 27; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"communication","note":"Nothing in the test outside the MPC; then its TAHE key component and per point its encrypted random term, its noisy term and a partial decryption","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(\\ell\\eta + |\\mathbb{F}| + (3t+4)(2\\gamma+\\log p)) \\)","locator":"Figure 9, step 2, p. 30; Figure 8, step 1a, p. 27; Figure 9, steps 3c, 3e and 3g, p. 30","measure":"communication","note":"To each other party: the point u, in the field of the test; then the joint TAHE key and per point three values","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 8, step 1d, p. 27","measure":"computation","note":"The power \\( u^{a} \\) of the test point for each of its items, in the field of the test","operation":"exponentiation","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n(6t+4) + O(t^{3}) \\)","locator":"Figure 8, step 1d, p. 27; Figure 9, steps 3–4, p. 30","measure":"computation","note":"Powers up to \\( 2t \\) of each \\( u^{a} \\); its randomized polynomial at \\( 3t+4 \\) points, each item tested as a root; the rest in \\( O(t^{3}) \\)","operation":"field_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 3(3t+4) \\)","locator":"Figure 9, steps 3b, 3d and 3f, p. 30","measure":"computation","note":"Per point, two encryptions and a partial decryption; none in the test outside the MPC","operation":"enc_dec","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(3t+4) \\)","locator":"Figure 9, step 3d, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n \\)","locator":"Figure 8, step 1d, p. 27","measure":"computation","note":"The power \\( u^{a} \\) of the test point for each of its items, in the field of the test","operation":"exponentiation","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n(6t+4) + O(t^{3}) \\)","locator":"Figure 8, steps 1b and 1d, p. 27; Figure 9, steps 3–4, p. 30","measure":"computation","note":"As a client, for its own set, its Hankel share then scaled by \\( \\ell-1 \\)","operation":"field_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+5)(3t+4) \\)","locator":"Figure 9, steps 3b–3g, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point: two encryptions, \\( \\ell+1 \\) refreshes, a partial decryption and the combination","operation":"enc_dec","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (4\\ell+1)(3t+4) \\)","locator":"Figure 9, steps 3c–3e, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","phase":"online","subject":"leader"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","name":"BMRR TAHE threshold PSI (diff)","paper_ids":["PSI-PAPER-2021-BMRR"],"primitive":"multiparty threshold PSI","schedule":[{"from":"leader","id":"u","locator":"Figure 8, step 1a, p. 27","phase":"online","what":"The random point u of the sparsity test"},{"after":["u"],"blocks":["sing_test"],"id":"test","locator":"Figure 8, step 2, p. 27; Figure 9, step 1, p. 30","phase":"online","what":"Singularity test of the Hankel matrix the parties hold additive shares of; similar, or different and all stop"},{"after":["test"],"from":"client","id":"tahe_pk","locator":"Figure 9, step 2, p. 30","phase":"online","what":"Each party's component of the TAHE public key, once the test says similar"},{"after":["tahe_pk"],"from":"leader","id":"tahe_key","locator":"Figure 9, step 2, p. 30","phase":"online","what":"The joint TAHE key, all components, to every other party"},{"after":["tahe_key"],"from":"client","id":"random","locator":"Figure 9, step 3b, p. 30","phase":"online","what":"Encryptions of its random polynomial R_i at the 3t+4 points"},{"after":["random"],"from":"leader","id":"others","locator":"Figure 9, step 3c, p. 30","phase":"online","what":"Per party and point, the encrypted sum of the other parties' R_j"},{"after":["others"],"from":"client","id":"noisy","locator":"Figure 9, step 3d, p. 30","phase":"online","what":"Its encrypted noisy term at each point"},{"after":["noisy"],"from":"leader","id":"total","locator":"Figure 9, step 3e, p. 30","phase":"online","what":"The encrypted sums V(x) at each point"},{"after":["total"],"from":"client","id":"vshares","locator":"Figure 9, step 3f, p. 30","phase":"online","what":"Partial decryptions of each V(x)"},{"after":["vshares"],"from":"leader","id":"values","locator":"Figure 9, step 3g, p. 30","phase":"online","what":"The decrypted V(x) at each point"}],"security":{"mode":"computational","model":"UC, semi-honest, up to \\( \\ell - 1 \\) corruptions; Theorem 6.5 in the F_SingTest-hybrid model and Theorem 7.1 in the F_CTest-diff-hybrid model (pp. 27-28)","notion":"multiparty threshold PSI, functionality F_TPSI-diff"},"status":"published","title":"BMRR multiparty threshold PSI for F_TPSI-diff from threshold additive HE with Hankel singularity testing, semi-honest, \\( \\tilde O(\\ell t) \\) communication","variables":[{"meaning":"Bits of one ciphertext of the threshold additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of one partial decryption of the threshold additively homomorphic scheme","symbol":"\\delta"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold additively homomorphic public key","symbol":"\\eta"}],"work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"Multiparty threshold PSI for the union-minus-intersection threshold: each party encodes its set as a sum of monomials, the parties test the sparsity of a weighted difference through a Hankel matrix whose singularity is decided by half-GCD in a garbled circuit built under threshold AHE, and a second phase returns noisy evaluations from which each party interpolates its own excess elements.","heading":"Summary"}],"slug":"bmrr21-bmrr-tahe-threshold-psi","status":"fulltext_checked","subtitle":"multiparty threshold PSI · 2021","summary":"Multiparty threshold PSI for the union-minus-intersection threshold: each party encodes its set as a sum of monomials, the parties test the sparsity of a weighted difference through a Hankel matrix whose singularity is decided by half-GCD in a garbled circuit built under threshold AHE, and a second phase returns noisy evaluations from which each party interpolates its own excess elements.","title":"BMRR TAHE threshold PSI (diff)","type":"construction","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF"},{"contributions":["PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","keywords":["multiparty threshold psi","polynomial_threshold_psi","sublinear-in-set-size","star-network"],"metadata":{"assumption":{"family":"lattice","name":"Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption"},"attributes":{"adversary":{"locator":"Theorem 7.1, p. 28; Theorem 5.4, p. 21","value":["semi_honest"]},"assumptions":{"locator":"Imported Theorem 2.2, p. 9; Corollary 7.2, p. 28","note":"Circular-secure LWE, as the corollary names; threshold AHE may run phase two, but exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts","value":["LWE","circular security"]},"corruptions":{"locator":"Theorem 7.1, p. 28","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 2, p. 6; Figure 9, p. 30","note":"The intersection if the union minus the intersection has at most \\( t \\) elements","value":["threshold"]},"output_to":{"locator":"Figure 2, p. 6","value":"all"},"parties":{"locator":"§2.3, p. 6","value":"multiparty"},"security_model":{"locator":"Theorem 7.1, p. 28","note":"UC in a star network; the cardinality test is a hybrid, not a model","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"Figure 6, p. 22; Figure 9, p. 30","value":["threshold_fhe","additively_homomorphic_encryption","set_reconciliation"]}},"capabilities":["sublinear-in-set-size","star-network"],"claim_ids":["PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"construction_family":"polynomial_threshold_psi","costs":[{"basis":"counted","formula":"\\( \\eta_{\\mathrm{FHE}} + \\eta + (2t+2)\\gamma_{\\mathrm{FHE}} + \\delta_{\\mathrm{FHE}} + (3t+4)(2\\gamma+\\delta) \\)","locator":"Figure 6, step 1, p. 22; Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"communication","note":"Its TFHE key component, encrypted evaluations and a partial decryption of the predicate; then its TAHE key component and per point three ciphertexts","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(\\ell(\\eta_{\\mathrm{FHE}} + \\eta) + \\log p + \\gamma_{\\mathrm{FHE}} + 1 + (3t+4)(2\\gamma+\\log p)) \\)","locator":"Figure 6, step 1, p. 22; Figure 6, steps 2 and 5, p. 22; Figure 9, steps 3c, 3e and 3g, p. 30","measure":"communication","note":"To each other party: the joint TFHE key, z, the encrypted predicate and its bit; then the joint TAHE key and per point three values","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n(6t+7) + O(t^{3}) \\)","locator":"Figure 6, step 3, p. 22; Figure 9, steps 3–4, p. 30","measure":"computation","note":"Its set polynomial at \\( 2t+2 \\), then a randomized one at \\( 3t+4 \\) points, each item tested as a root; random terms and interpolation in \\( O(t^{3}) \\)","operation":"field_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 3(3t+4) + 2t + 3 \\)","locator":"Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b, 3d and 3f, p. 30","measure":"computation","note":"Under TFHE \\( 2t+2 \\) encryptions and a partial decryption; under TAHE, per point, two encryptions and a partial decryption","operation":"enc_dec","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(3t+4) \\)","locator":"Figure 9, step 3d, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n(6t+7) + O(t^{3}) \\)","locator":"Figure 6, step 3, p. 22; Figure 9, steps 3–4, p. 30","measure":"computation","note":"As a client, for its own set; the cardinality test it evaluates under TFHE","operation":"field_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+5)(3t+4) + 2t + 4 \\)","locator":"Figure 6, steps 3c and 5, p. 22; Figure 9, steps 3b–3g, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"TFHE: \\( 2t+2 \\) encryptions, a partial decryption, the combination; TAHE, per point: two encryptions, \\( \\ell+1 \\) refreshes, a share, the combination","operation":"enc_dec","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (4\\ell+1)(3t+4) \\)","locator":"Figure 9, steps 3c–3e, p. 30; §2.6, Re-randomization, p. 10","measure":"computation","note":"TAHE, per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","phase":"online","subject":"leader"},{"locator":"Figure 6, step 4, p. 22","measure":"computation","note":"TFHE evaluation, per other party, of the quotients, interpolation from \\( 2t+1 \\) points, the test at z and both differences' roots; then the union's size","operation":"hom_mult","phase":"online","subject":"leader","value":"not_reported"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","name":"BMRR TFHE threshold PSI (diff)","paper_ids":["PSI-PAPER-2021-BMRR"],"primitive":"multiparty threshold PSI","schedule":[{"from":"client","id":"tfhe_pk","locator":"Figure 6, step 1, p. 22","phase":"online","what":"Each party's component of the TFHE public key"},{"after":["tfhe_pk"],"from":"leader","id":"tfhe_key","locator":"Figure 6, step 1, p. 22","phase":"online","what":"The joint TFHE key, all components, to every other party"},{"from":"leader","id":"z","locator":"Figure 6, step 2, p. 22","phase":"online","what":"The random point z"},{"after":["tfhe_key","z"],"from":"client","id":"evals","locator":"Figure 6, step 3, p. 22","phase":"online","what":"Encrypted evaluations of its set polynomial at the 2t+1 points and at z"},{"after":["evals"],"from":"leader","id":"predicate","locator":"Figure 6, steps 4–5, p. 22","phase":"online","what":"The encrypted predicate b"},{"after":["predicate"],"from":"client","id":"shares","locator":"Figure 6, step 5, p. 22","phase":"online","what":"Partial decryptions of b"},{"after":["shares"],"from":"leader","id":"verdict","locator":"Figure 6, step 5, p. 22; Figure 9, step 1, p. 30","phase":"online","what":"The decrypted b: similar, or different and all stop"},{"after":["verdict"],"from":"client","id":"tahe_pk","locator":"Figure 9, step 2, p. 30","phase":"online","what":"Each party's component of the TAHE public key, once the test says similar"},{"after":["tahe_pk"],"from":"leader","id":"tahe_key","locator":"Figure 9, step 2, p. 30","phase":"online","what":"The joint TAHE key, all components, to every other party"},{"after":["tahe_key"],"from":"client","id":"random","locator":"Figure 9, step 3b, p. 30","phase":"online","what":"Encryptions of its random polynomial R_i at the 3t+4 points"},{"after":["random"],"from":"leader","id":"others","locator":"Figure 9, step 3c, p. 30","phase":"online","what":"Per party and point, the encrypted sum of the other parties' R_j"},{"after":["others"],"from":"client","id":"noisy","locator":"Figure 9, step 3d, p. 30","phase":"online","what":"Its encrypted noisy term at each point"},{"after":["noisy"],"from":"leader","id":"total","locator":"Figure 9, step 3e, p. 30","phase":"online","what":"The encrypted sums V(x) at each point"},{"after":["total"],"from":"client","id":"vshares","locator":"Figure 9, step 3f, p. 30","phase":"online","what":"Partial decryptions of each V(x)"},{"after":["vshares"],"from":"leader","id":"values","locator":"Figure 9, step 3g, p. 30","phase":"online","what":"The decrypted V(x) at each point"}],"security":{"mode":"computational","model":"UC, semi-honest, up to \\( \\ell - 1 \\) corruptions; Theorem 7.1 in the F_CTest-diff-hybrid model, instantiated by Theorem 5.4 (pp. 21, 28)","notion":"multiparty threshold PSI, functionality F_TPSI-diff"},"status":"published","title":"BMRR multiparty threshold PSI for F_TPSI-diff from threshold FHE and threshold additive HE, semi-honest, \\( O(\\ell t) \\) communication","variables":[{"meaning":"Bits of one ciphertext of the threshold FHE scheme, bounded by a polynomial in the security parameter by compactness","symbol":"\\gamma_{\\mathrm{FHE}}"},{"meaning":"Bits of one partial decryption of the threshold FHE scheme","symbol":"\\delta_{\\mathrm{FHE}}"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold FHE public key","symbol":"\\eta_{\\mathrm{FHE}}"},{"meaning":"Bits of one ciphertext of the threshold additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of one partial decryption of the threshold additively homomorphic scheme","symbol":"\\delta"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold additively homomorphic public key","symbol":"\\eta"}],"work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"Multiparty threshold PSI for the union-minus-intersection threshold from threshold FHE: the central party homomorphically reconstructs, for each other party, the encrypted set differences with its own set and tests the size of their union; a second phase under threshold AHE returns noisy evaluations from which each party interpolates its own excess elements.","heading":"Summary"}],"slug":"bmrr21-bmrr-tfhe-threshold-psi","status":"fulltext_checked","subtitle":"multiparty threshold PSI · 2021","summary":"Multiparty threshold PSI for the union-minus-intersection threshold from threshold FHE: the central party homomorphically reconstructs, for each other party, the encrypted set differences with its own set and tests the size of their union; a second phase under threshold AHE returns noisy evaluations from which each party interpolates its own excess elements.","title":"BMRR TFHE threshold PSI (diff)","type":"construction","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF"},{"contributions":["PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","keywords":["multiparty threshold psi","polynomial_threshold_psi","sublinear-in-set-size","star-network"],"metadata":{"assumption":{"family":"lattice","name":"Threshold FHE with distributed setup from circular-secure LWE, with threshold additively homomorphic encryption"},"attributes":{"adversary":{"locator":"Theorem B.1, p. 40; Theorem 5.1, p. 17","value":["semi_honest"]},"assumptions":{"locator":"Imported Theorem 2.2, p. 9; Corollary B.2, p. 40","note":"Circular-secure LWE, as the corollary names; threshold AHE may run phase two, but exponential ElGamal cannot decrypt the \\( \\Theta(\\kappa) \\)-bit plaintexts","value":["LWE","circular security"]},"corruptions":{"locator":"Theorem B.1, p. 40","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 1, p. 6; Figure 10, p. 41","note":"The intersection if every set exceeds it by at most \\( t \\) elements","value":["threshold"]},"output_to":{"locator":"Figure 1, p. 6","value":"all"},"parties":{"locator":"§2.3, p. 6","value":"multiparty"},"security_model":{"locator":"Theorem B.1, p. 40","note":"UC in a star network; the cardinality test is a hybrid, not a model","value":["standard model"]},"set_size_regime":{"locator":"§2.3, p. 6","value":"balanced"},"technique":{"locator":"Figure 5, p. 18; Figure 10, p. 41","value":["threshold_fhe","additively_homomorphic_encryption","set_reconciliation"]}},"capabilities":["sublinear-in-set-size","star-network"],"claim_ids":["PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"],"construction_family":"polynomial_threshold_psi","costs":[{"basis":"counted","formula":"\\( \\eta_{\\mathrm{FHE}} + \\eta + (2t+4)\\gamma_{\\mathrm{FHE}} + \\delta_{\\mathrm{FHE}} + (3t+4)(2\\gamma+\\delta) \\)","locator":"Figure 5, step 1, p. 18; Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b, 3d and 3f, p. 41","measure":"communication","note":"Its TFHE key component, encrypted evaluations and a partial decryption of the predicate; then its TAHE key component and per point three ciphertexts","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( (\\ell-1)(\\ell(\\eta_{\\mathrm{FHE}} + \\eta) + \\log p + \\gamma_{\\mathrm{FHE}} + 1 + (3t+4)(2\\gamma+\\log p)) \\)","locator":"Figure 5, step 1, p. 18; Figure 5, steps 2 and 5, p. 18; Figure 10, steps 3c, 3e and 3g, p. 41","measure":"communication","note":"To each other party: the joint TFHE key, z, the encrypted predicate and its bit; then the joint TAHE key and per point three values","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( n(6t+9) + O(t^{3}) \\)","locator":"Figure 5, step 3, p. 18; Figure 10, steps 3–4, p. 41","measure":"computation","note":"Its randomized polynomial at \\( 2t+4 \\), then a new one at \\( 3t+4 \\) points, each item tested as a root; random terms and interpolation in \\( O(t^{3}) \\)","operation":"field_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 3(3t+4) + 2t + 5 \\)","locator":"Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b, 3d and 3f, p. 41","measure":"computation","note":"Under TFHE \\( 2t+4 \\) encryptions and a partial decryption; under TAHE, per point, two encryptions and a partial decryption","operation":"enc_dec","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(3t+4) \\)","locator":"Figure 10, step 3d, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","note":"Per point, the received sum times its polynomial's value, plus its encrypted noise term, which also refreshes the result","operation":"hom_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n(6t+9) + O(t^{3}) \\)","locator":"Figure 5, step 3, p. 18; Figure 10, steps 3–4, p. 41","measure":"computation","note":"As a client, for its own set; the cardinality test it evaluates under TFHE","operation":"field_op","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell+5)(3t+4) + 2t + 6 \\)","locator":"Figure 5, steps 3c and 5, p. 18; Figure 10, steps 3b–3g, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","note":"TFHE: \\( 2t+4 \\) encryptions, a partial decryption, the combination; TAHE, per point: two encryptions, \\( \\ell+1 \\) refreshes, a share, the combination","operation":"enc_dec","phase":"online","subject":"leader"},{"basis":"counted","formula":"\\( (4\\ell+1)(3t+4) \\)","locator":"Figure 10, steps 3c–3e, p. 41; §2.6, Re-randomization, p. 10","measure":"computation","note":"TAHE, per point: the sum of all random terms less each party's, each refreshed; its own noisy term; the sum of the replies, refreshed","operation":"hom_op","phase":"online","subject":"leader"},{"locator":"Figure 5, step 4, p. 18","measure":"computation","note":"The TFHE evaluation of the quotients, a rational interpolation from \\( 2t+3 \\) points and the test at z; the paper gives no circuit","operation":"hom_mult","phase":"online","subject":"leader","value":"not_reported"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","name":"BMRR TFHE threshold PSI (int)","paper_ids":["PSI-PAPER-2021-BMRR"],"primitive":"multiparty threshold PSI","schedule":[{"from":"client","id":"tfhe_pk","locator":"Figure 5, step 1, p. 18","phase":"online","what":"Each party's component of the TFHE public key"},{"after":["tfhe_pk"],"from":"leader","id":"tfhe_key","locator":"Figure 5, step 1, p. 18","phase":"online","what":"The joint TFHE key, all components, to every other party"},{"from":"leader","id":"z","locator":"Figure 5, step 2, p. 18","phase":"online","what":"The random point z"},{"after":["tfhe_key","z"],"from":"client","id":"evals","locator":"Figure 5, step 3, p. 18","phase":"online","what":"Encrypted evaluations of its randomized polynomial at the 2t+3 points and at z"},{"after":["evals"],"from":"leader","id":"predicate","locator":"Figure 5, steps 4–5, p. 18","phase":"online","what":"The encrypted predicate b"},{"after":["predicate"],"from":"client","id":"shares","locator":"Figure 5, step 5, p. 18","phase":"online","what":"Partial decryptions of b"},{"after":["shares"],"from":"leader","id":"verdict","locator":"Figure 5, step 5, p. 18; Figure 10, step 1, p. 41","phase":"online","what":"The decrypted b: similar, or different and all stop"},{"after":["verdict"],"from":"client","id":"tahe_pk","locator":"Figure 10, step 2, p. 41","phase":"online","what":"Each party's component of the TAHE public key, once the test says similar"},{"after":["tahe_pk"],"from":"leader","id":"tahe_key","locator":"Figure 10, step 2, p. 41","phase":"online","what":"The joint TAHE key, all components, to every other party"},{"after":["tahe_key"],"from":"client","id":"random","locator":"Figure 10, step 3b, p. 41","phase":"online","what":"Encryptions of its random polynomial R_i at the 3t+4 points"},{"after":["random"],"from":"leader","id":"others","locator":"Figure 10, step 3c, p. 41","phase":"online","what":"Per party and point, the encrypted sum of the other parties' R_j"},{"after":["others"],"from":"client","id":"noisy","locator":"Figure 10, step 3d, p. 41","phase":"online","what":"Its encrypted noisy term at each point"},{"after":["noisy"],"from":"leader","id":"total","locator":"Figure 10, step 3e, p. 41","phase":"online","what":"The encrypted sums V(x) at each point"},{"after":["total"],"from":"client","id":"vshares","locator":"Figure 10, step 3f, p. 41","phase":"online","what":"Partial decryptions of each V(x)"},{"after":["vshares"],"from":"leader","id":"values","locator":"Figure 10, step 3g, p. 41","phase":"online","what":"The decrypted V(x) at each point"}],"security":{"mode":"computational","model":"UC, semi-honest, up to \\( \\ell - 1 \\) corruptions; Theorem B.1 in the F_CTest-int-hybrid model, instantiated by Theorem 5.1 (pp. 17, 40)","notion":"multiparty threshold PSI, functionality F_TPSI-int"},"status":"published","title":"BMRR multiparty threshold PSI for F_TPSI-int from threshold FHE and threshold additive HE, semi-honest, \\( O(\\ell t) \\) communication","variables":[{"meaning":"Bits of one ciphertext of the threshold FHE scheme, bounded by a polynomial in the security parameter by compactness","symbol":"\\gamma_{\\mathrm{FHE}}"},{"meaning":"Bits of one partial decryption of the threshold FHE scheme","symbol":"\\delta_{\\mathrm{FHE}}"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold FHE public key","symbol":"\\eta_{\\mathrm{FHE}}"},{"meaning":"Bits of one ciphertext of the threshold additively homomorphic scheme","symbol":"\\gamma"},{"meaning":"Bits of one partial decryption of the threshold additively homomorphic scheme","symbol":"\\delta"},{"meaning":"Bits of one party's component \\( \\mathsf{pk}_i \\) of the threshold additively homomorphic public key","symbol":"\\eta"}],"work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"Multiparty threshold PSI for the per-set threshold from threshold FHE: each party sends encrypted evaluations of its randomized root polynomial, the central party homomorphically interpolates one rational function and tests it at a random point, and the shared second phase under threshold AHE lets each party interpolate its own excess elements.","heading":"Summary"}],"slug":"bmrr21-bmrr-tfhe-threshold-psi-2","status":"fulltext_checked","subtitle":"multiparty threshold PSI · 2021","summary":"Multiparty threshold PSI for the per-set threshold from threshold FHE: each party sends encrypted evaluations of its randomized root polynomial, the central party homomorphically interpolates one rational function and tests it at a random point, and the shared second phase under threshold AHE lets each party interpolate its own excess elements.","title":"BMRR TFHE threshold PSI (int)","type":"construction","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-BMRR-TFHE-INT"},{"contributions":["PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-CONG","keywords":["unbalanced psi","oprf_fhe_polynomial_evaluation_cuckoo_hashing","communication-sublinear-in-larger-set","square-root-homomorphic-multiplications","updatable-sender-preprocessing","malicious-receiver-security"],"metadata":{"assumption":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)"},"attributes":{"adversary":{"locator":"§3, p. 6","note":"The earlier labeled-PSI proof carries over unchanged","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"§2.3, pp. 4–5; §3.1, p. 12","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"§2.2, p. 4; §3, p. 5","value":["intersection"]},"output_to":{"locator":"§2.2, p. 4","value":"one"},"parties":{"locator":"§2.2, p. 4","value":"two_party"},"security_model":{"locator":"§3, p. 6; §3.1, p. 12","note":"Hash to the FourQ curve and OPRF output hash","value":["random oracle"]},"set_size_regime":{"locator":"§1, p. 1; §2.2, p. 4","value":"unbalanced"},"technique":{"locator":"§3, pp. 5–6; §3.1, pp. 6–12","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"capabilities":["communication-sublinear-in-larger-set","square-root-homomorphic-multiplications","updatable-sender-preprocessing","malicious-receiver-security"],"claim_ids":["PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER"],"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","costs":[{"locator":"§2.3, p. 5; §3, p. 6","measure":"communication","note":"Evaluation keys for the key switching of every multiplication; the receiver alone holds the secret key, so it sends them once. Their size is not given","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3, p. 6; §3.1, pp. 9–11; §5, p. 15","measure":"communication","note":"Blinded OPRF queries on FourQ, then the encrypted source powers of each batch","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3.1, p. 7","measure":"communication","note":"OPRF answers, then one result per partition and batch","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§3, p. 6; §3.1, p. 12","measure":"computation","note":"OPRF on its own set: hash to the curve and one scalar multiplication per item; updatable","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O(mB^{2}/\\alpha) \\)","locator":"§3, p. 6; §4.2, p. 13","measure":"computation","note":"Coefficients of each partition's intersection polynomial over prime-field slots","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three, as simple hashing uses them all","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}\\left(L_\\alpha+(\\alpha+1)H_\\alpha-\\alpha-2-s\\right) \\)","locator":"§3.1, pp. 8 and 10","measure":"computation","note":"Paterson–Stockmeyer per batch: a product per low or high power that is not a source power, then one per high power and partition","operation":"hom_mult","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\alpha\\frac{m}{k}(2L_\\alpha H_\\alpha-1) \\)","locator":"§3.1, p. 8","measure":"computation","note":"A plaintext product per coefficient in the inner sums, and the additions of the inner and outer sums, per partition and batch","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§3, p. 6","measure":"computation","note":"Blinding and unblinding each OPRF query","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( (s+\\alpha)\\frac{m}{k} \\)","locator":"§3, p. 6; §3.1, p. 7","measure":"computation","note":"BFV encryptions of the source powers and decryptions of the results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three; re-insertions, unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-CONG","name":"CMGD21 PSI (SEAL)","paper_ids":["PSI-PAPER-2021-CONG","PSI-PAPER-2018-CHLR","PSI-PAPER-2017-CLR"],"primitive":"unbalanced PSI","schedule":[{"from":"receiver","id":"keys","locator":"§3, p. 6; §2.3, p. 5","phase":"setup","what":"Evaluation keys for the key switching of every product, sent once"},{"from":"receiver","id":"oprf_query","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"Blinded OPRF queries on FourQ, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_answer"],"from":"receiver","id":"query","locator":"§3, p. 6; §3.1, pp. 9–11","phase":"online","what":"Encrypted source powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"§3, p. 6; §3.1, p. 7","phase":"online","what":"One result per partition and batch, modulus-switched"}],"security":{"mode":"computational","model":"as in the earlier labeled-PSI paper's Theorem 1: malicious receiver; privacy against a malicious sender (§3, p. 6)","notion":"PSI with output to the receiver"},"status":"published","title":"CMGD21 unbalanced PSI (APSI over SEAL BFV): OPRF hashing, prime-field slots, Paterson-Stockmeyer evaluation, and postage-stamp query powers","variables":[{"meaning":"Cuckoo hash table bins (the paper's \\( M \\)), \\( O(n_Y) \\)","symbol":"m"},{"meaning":"Cuckoo bins per BFV ciphertext: slots over the slots an item spans","symbol":"k"},{"meaning":"Largest sender bin size","symbol":"B"},{"meaning":"Partitions of each sender bin","symbol":"\\alpha"},{"meaning":"Encrypted source powers per batch, from windowing or an extremal postage-stamp basis for the target depth","symbol":"s"},{"meaning":"Paterson–Stockmeyer low powers per partition polynomial","symbol":"L_\\alpha"},{"meaning":"Paterson–Stockmeyer high powers per partition polynomial","symbol":"H_\\alpha"}],"work_id":"PSI-PAPER-2021-CONG","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"The CHLR18 protocol with a mandatory OPRF, items split over prime-field SIMD slots instead of extension fields, Paterson–Stockmeyer evaluation of each partition's intersection polynomial, and query powers chosen by extremal postage-stamp bases. Online computation drops to \\( O(\\sqrt{n_X}) \\) homomorphic multiplications.","heading":"Summary"}],"slug":"cmg21-cmgd21-psi-seal","status":"fulltext_checked","subtitle":"unbalanced PSI · 2021","summary":"The CHLR18 protocol with a mandatory OPRF, items split over prime-field SIMD slots instead of extension fields, Paterson–Stockmeyer evaluation of each partition's intersection polynomial, and query powers chosen by extremal postage-stamp bases. Online computation drops to \\( O(\\sqrt{n_X}) \\) homomorphic multiplications.","title":"CMGD21 PSI (SEAL)","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-CONG"},{"contributions":["PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","keywords":["unbalanced psi","oprf_fhe_polynomial_evaluation_cuckoo_hashing","communication-nearly-constant-in-larger-set","cacheable-evaluation-keys"],"metadata":{"assumption":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BGV)"},"attributes":{"adversary":{"locator":"§3, p. 6; §5, p. 15","note":"The protocol keeps the OPRF; the measured proof of concept omits it","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"§2.3, pp. 4–5; §3.1, p. 12","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"§3, p. 5","value":["intersection"]},"output_to":{"locator":"§2.2, p. 4","value":"one"},"parties":{"locator":"§2.2, p. 4","value":"two_party"},"security_model":{"locator":"§3, p. 6","value":["random oracle"]},"set_size_regime":{"locator":"§5.4, p. 18","value":"unbalanced"},"technique":{"locator":"§3.1, pp. 11–12; §5.4, p. 18","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"capabilities":["communication-nearly-constant-in-larger-set","cacheable-evaluation-keys"],"claim_ids":["PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER"],"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","costs":[{"basis":"counted","formula":"\\( (\\lfloor \\log_p B \\rfloor + 1)K \\)","locator":"§3.1, p. 12; §2.3, p. 5; Table 8, p. 27","measure":"communication","note":"Frobenius keys and the relinearization key, independent of the receiver set and cacheable; one Frobenius key suffices at extra cost","per":"client","phase":"setup","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§3.1, p. 11; §1.2, p. 3","measure":"communication","note":"A constant number of source powers per batch; ring elements grow as the square of the depth, of order log log of the sender set","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + \\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§5.4, p. 18","measure":"communication","note":"No partitioning, so one result per batch","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O(mB^{2}) \\)","locator":"§3, p. 6; §5.4, p. 18","measure":"computation","note":"Coefficients of each bin's intersection polynomial","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 5n_X \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three, as simple hashing uses them all","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O\\left(\\frac{m}{k}\\sqrt{B}\\right) \\)","locator":"§3.1, pp. 8 and 11–12","measure":"computation","note":"Paterson–Stockmeyer per batch; depth-free Frobenius operations replace many of the power products","operation":"hom_mult","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( O\\left(\\frac{m}{k}B\\right) \\)","locator":"§3.1, pp. 8 and 11–12; Lemma 2, p. 12","measure":"computation","note":"Plaintext products and additions of the Paterson–Stockmeyer sums, and the Frobenius operations that give powers","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( (s+1)\\frac{m}{k} \\)","locator":"§3.1, p. 11","measure":"computation","note":"BGV encryptions of the source powers and decryptions of the results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 5n_Y \\)","locator":"§3, pp. 5–6; §3.1, p. 12","measure":"computation","note":"Per item: the OPRF hash to the curve and output hash, then each of the cuckoo hash functions, typically three; re-insertions, unbounded, add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","name":"CMGD21 PSI (HElib, Frobenius)","paper_ids":["PSI-PAPER-2021-CONG"],"primitive":"unbalanced PSI","schedule":[{"from":"receiver","id":"keys","locator":"§3.1, p. 12; §5.4, p. 19","phase":"setup","what":"Frobenius keys and the relinearization key, cached by the sender"},{"from":"receiver","id":"oprf_query","locator":"§3, p. 6; §5, p. 15","phase":"online","what":"Blinded OPRF queries on FourQ, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"§3, p. 6; §5, p. 15","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_answer"],"from":"receiver","id":"query","locator":"§3.1, p. 11; §5.4, p. 18","phase":"online","what":"A constant number of encrypted source powers per batch"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"§5.4, p. 18","phase":"online","what":"One result per batch, without partitioning"}],"security":{"mode":"computational","model":"as in the SEAL protocol (§3, p. 6); the measured implementation omits the OPRF (§5, p. 15)","notion":"PSI with output to the receiver"},"status":"published","title":"CMGD21 low-communication unbalanced PSI over HElib BGV with depth-free Frobenius powers (proof of concept)","variables":[{"meaning":"Cuckoo hash table bins (the paper's \\( M \\)), \\( O(n_Y) \\)","symbol":"m"},{"meaning":"Cuckoo bins per BGV ciphertext: slots over the slots an item spans","symbol":"k"},{"meaning":"Largest sender bin size, the degree of its intersection polynomial","symbol":"B"},{"meaning":"Encrypted source powers per batch, a constant for depth of order \\( \\log\\log B \\)","symbol":"s"},{"meaning":"Size of one key-switching key: a Frobenius key or the relinearization key","symbol":"K"}],"work_id":"PSI-PAPER-2021-CONG","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"A low-communication configuration of CMGD21 over HElib BGV: with a small plaintext prime, the sender obtains most powers of the receiver's query by depth-free Frobenius operations, so a constant number of encrypted powers supports depth \\( O(\\log\\log n_X) \\), and communication is \\( \\tilde O(\\log^{2}\\log n_X) \\) in the sender set.","heading":"Summary"}],"slug":"cmg21-cmgd21-psi-helib-frobenius","status":"fulltext_checked","subtitle":"unbalanced PSI · 2021","summary":"A low-communication configuration of CMGD21 over HElib BGV: with a small plaintext prime, the sender obtains most powers of the receiver's query by depth-free Frobenius operations, so a constant number of encrypted powers supports depth \\( O(\\log\\log n_X) \\), and communication is \\( \\tilde O(\\log^{2}\\log n_X) \\) in the sender set.","title":"CMGD21 PSI (HElib, Frobenius)","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-CONG-FROBENIUS"},{"contributions":["PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2018-CHLR-LABELED-PSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-CONG-LABELED","keywords":["labeled psi","oprf_fhe_polynomial_evaluation_cuckoo_hashing","labels-for-matching-items","communication-sublinear-in-larger-set","updatable-labels"],"metadata":{"assumption":{"family":"mixed","name":"One-More-Gap-Diffie-Hellman in the random oracle model, and semantically secure leveled FHE (BFV)"},"attributes":{"adversary":{"locator":"§4.2, p. 14; §3, p. 6","note":"The labeled proof is sketched as a direct extension of the unlabeled one","value":{"receiver":"malicious","sender":"malicious_privacy_only"}},"assumptions":{"locator":"§2.3, pp. 4–5; §4.2, p. 13","note":"Ring-LWE through the homomorphic scheme; One-More-Gap-DH for the OPRF","value":["Ring-LWE","One-More-Gap-DH"]},"output":{"locator":"§2.2, p. 4; §4.2, p. 14","value":["labeled"]},"output_to":{"locator":"§2.2, p. 4","value":"one"},"parties":{"locator":"§2.2, p. 4","value":"two_party"},"security_model":{"locator":"§4.2, p. 14","value":["random oracle"]},"set_size_regime":{"locator":"§2.2, p. 4","value":"unbalanced"},"technique":{"locator":"§3.1, pp. 6–12; §4.2, pp. 13–14","value":["oprf","fully_homomorphic_encryption","cuckoo_hashing","simple_hashing"]}},"capabilities":["labels-for-matching-items","communication-sublinear-in-larger-set","updatable-labels"],"claim_ids":["PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2018-CHLR-LABELED-PSI"],"construction_family":"oprf_fhe_polynomial_evaluation_cuckoo_hashing","costs":[{"locator":"§2.3, p. 5; §3, p. 6","measure":"communication","note":"Evaluation keys for the key switching of every multiplication; the receiver alone holds the secret key, so it sends them once. Their size is not given","per":"client","phase":"setup","subject":"receiver","value":"not_reported"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + s\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§5.3, p. 18","measure":"communication","note":"As unlabeled; label length does not change the query","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{G}| + (1+c)\\alpha\\frac{m}{k}\\cdot 2|\\mathcal{R}_q| \\)","locator":"§4.2, p. 14; §5.3, p. 18","measure":"communication","note":"Intersection results plus one result per item-length label fragment","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( O((1+c)mB^{2}/\\alpha) \\)","locator":"§4.2, p. 13; §3, p. 6","measure":"computation","note":"Each partition's intersection polynomial and an interpolation per label fragment, \\( O(B^2) \\) in the partition size \\( B \\); updatable","operation":"field_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( 6n_X \\)","locator":"§3, pp. 5–6; §3.1, p. 12; §4.2, p. 13","measure":"computation","note":"As unlabeled, five per item, plus one symmetric encryption of each label under a key taken from the extended OPRF value","operation":"symmetric_op","phase":"setup","subject":"sender"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( \\frac{m}{k}\\left(L_\\alpha+H_\\alpha-2-s+(1+c)\\alpha(H_\\alpha-1)\\right) \\)","locator":"§3.1, p. 8; §4.2, p. 14; §5.3, p. 18","measure":"computation","note":"Low and high powers that are not source powers, once per batch, then a product per high power for each intersection and label polynomial","operation":"hom_mult","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( (1+c)\\alpha\\frac{m}{k}(2L_\\alpha H_\\alpha-1) \\)","locator":"§3.1, p. 8; §4.2, p. 14","measure":"computation","note":"A plaintext product per coefficient and the additions of the sums, for the intersection polynomial and each label fragment","operation":"hom_op","phase":"online","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§3, p. 6","measure":"computation","operation":"exponentiation","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( \\left(s+(1+c)\\alpha\\right)\\frac{m}{k} \\)","locator":"§4.2, p. 14","measure":"computation","note":"BFV encryptions of the source powers and decryptions of all results","operation":"enc_dec","phase":"online","subject":"receiver"},{"basis":"counted","formula":"\\( 6n_Y \\)","locator":"§3, pp. 5–6; §3.1, p. 12; §4.2, pp. 13–14","measure":"computation","note":"As unlabeled, five per item, plus decrypting the label of each item in the intersection, counted for every item; cuckoo re-insertions add more","operation":"symmetric_op","phase":"online","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-CONG-LABELED","name":"CMGD21 labeled PSI (SEAL)","paper_ids":["PSI-PAPER-2021-CONG","PSI-PAPER-2018-CHLR"],"primitive":"labeled PSI","schedule":[{"from":"receiver","id":"keys","locator":"§3, p. 6; §2.3, p. 5","phase":"setup","what":"Evaluation keys for the key switching of every product, sent once"},{"from":"receiver","id":"oprf_query","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"Blinded OPRF queries on FourQ, one per receiver item"},{"after":["oprf_query"],"from":"sender","id":"oprf_answer","locator":"§3, p. 6; §3.1, p. 12","phase":"online","what":"OPRF answers under the sender's key"},{"after":["oprf_answer"],"from":"receiver","id":"query","locator":"§3, p. 6; §5.3, p. 18","phase":"online","what":"Encrypted source powers of each batch of the cuckoo table of OPRF values"},{"after":["keys","query"],"from":"sender","id":"reply","locator":"§3, p. 6; §4.2, p. 14","phase":"online","what":"Intersection results, one per partition and batch"},{"from":"sender","id":"labels","locator":"§4.2, p. 14","phase":"online","what":"Label results, one per fragment, partition and batch, returned beside the intersection results","with":"reply"}],"security":{"mode":"computational","model":"proof sketch extending the earlier unlabeled proof (§4.2, p. 14)","notion":"labeled PSI with output to the receiver"},"status":"published","title":"CMGD21 labeled PSI (APSI over SEAL BFV): OPRF-keyed label encryption with chunk-wise interpolation over prime fields","variables":[{"meaning":"Cuckoo hash table bins (the paper's \\( M \\)), \\( O(n_Y) \\)","symbol":"m"},{"meaning":"Cuckoo bins per BFV ciphertext: slots over the slots an item spans","symbol":"k"},{"meaning":"Largest sender bin size","symbol":"B"},{"meaning":"Partitions of each sender bin","symbol":"\\alpha"},{"meaning":"Encrypted source powers per batch, from windowing or an extremal postage-stamp basis","symbol":"s"},{"meaning":"Paterson–Stockmeyer low powers per partition polynomial","symbol":"L_\\alpha"},{"meaning":"Paterson–Stockmeyer high powers per partition polynomial","symbol":"H_\\alpha"},{"meaning":"Item-length fragments of an encrypted label with its nonce","symbol":"c"}],"work_id":"PSI-PAPER-2021-CONG","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"Labeled PSI over prime-field slots: each label is encrypted under a key from the extended OPRF output, split into item-length fragments, and interpolated fragment by fragment per bin and partition. The sender evaluates these polynomials with Paterson–Stockmeyer on the same query powers as the intersection polynomials.","heading":"Summary"}],"slug":"cmg21-cmgd21-labeled-psi-seal","status":"fulltext_checked","subtitle":"labeled PSI · 2021","summary":"Labeled PSI over prime-field slots: each label is encrypted under a key from the extended OPRF output, split into item-length fragments, and interpolated fragment by fragment per bin and partition. The sender evaluates these polynomials with Paterson–Stockmeyer on the same query powers as the intersection polynomials.","title":"CMGD21 labeled PSI (SEAL)","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-CONG-LABELED"},{"contributions":["PSI-CONTRIB-2021-GPRTY-3H-GCT","PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","keywords":["two-party psi","okvs_ot_extension","heuristic-error-analysis"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the OOS OT-extension hybrid model"},"attributes":{"adversary":{"locator":"§6.3, p. 19","note":"Via the PaXoS-PSI proofs, written for any binary OKVS; corrupt parties may use larger sets","value":["malicious"]},"assumptions":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"None beyond the random oracle in the OOS OT-extension hybrid; instantiating OOS needs base OTs, whose assumption is not named","source":"PSI-PAPER-2020-PRTY","value":"not_reported"},"output":{"locator":"§6.3, p. 19; PRTY20 Figure 3","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"The receiver","source":"PSI-PAPER-2020-PRTY","value":"one"},"parties":{"locator":"§6.3, p. 19","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"The OOS hybrid of the proof is not a model","source":"PSI-PAPER-2020-PRTY","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","source":"PSI-PAPER-2020-PRTY","value":"balanced"},"technique":{"locator":"§4.1, pp. 9-11; §6.3, p. 19","value":["okvs","ot_extension"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"func":"oos","id":"oos","implementation":"OOS malicious OT extension","instantiation":"oos17","locator":"§4.1, pp. 10–11; §6.3, p. 19; §8.1, p. 23; PRTY20 Figure 3, step 2, p. 11","note":"One run on the receiver's three-hash table, one instance per position; \\( \\tau \\), the output length of \\( H_1 \\), is set as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( 1.3n+d+\\lambda \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["heuristic-error-analysis"],"claim_ids":["PSI-CONTRIB-2021-GPRTY-3H-GCT","PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI"],"construction_family":"okvs_ot_extension","costs":[{"basis":"counted","formula":"\\( 2\\kappa n \\)","locator":"PRTY20 Figure 3, step 3, p. 11; PRTY20 §4.4, p. 15; Theorem 7, p. 21; Figure 4, p. 23","measure":"communication","note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item, as for malicious security","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its table","source":"PSI-PAPER-2020-PRTY","subject":"receiver"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§4.1, pp. 9–11; Figure 2, p. 12; PRTY20 Figure 3, step 3, p. 11","measure":"computation","note":"Per item: the table's hyperedge hash and \\( r \\), then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n \\)","locator":"§4.1, pp. 9–11; Figure 2, p. 12; PRTY20 Figure 3, steps 1 and 4, p. 11","measure":"computation","note":"Per item: the hyperedge hash and \\( r \\), shared by encoding and decoding, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","name":"PaXoS-PSI with 3H-GCT (malicious)","paper_ids":["PSI-PAPER-2021-GPRTY","PSI-PAPER-2020-PRTY"],"primitive":"two-party PSI","schedule":[{"blocks":["oos"],"id":"oos","locator":"§6.3, p. 19; PRTY20 Figure 3, steps 1–2, p. 11","phase":"online","what":"the OOS run on the receiver's three-hash garbled cuckoo table"},{"after":["oos"],"from":"sender","id":"masks","locator":"PRTY20 Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security":{"mode":"computational","model":"malicious two-party, random oracle model, OOS-hybrid, via the PaXoS-PSI proofs (§6.3, p. 19)","notion":"PSI with output to the receiver; corrupt parties may use larger sets"},"status":"published","title":"PaXoS-PSI with a three-hash garbled cuckoo table, malicious two-party PSI","variables":[{"meaning":"Codeword length of the OOS OT extension, in bits","symbol":"w"},{"meaning":"Bound on the hyperedges left in the 2-core after peeling, the paper's d(n), so the table has d + λ extra positions","symbol":"d"}],"work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"PaXoS-PSI with its binary OKVS replaced by a three-hash garbled cuckoo table of about \\( 1.3n \\) slots. The receiver encodes its items in the table and runs one OOS OT per slot; the sender hashes its decoded values, and fewer slots mean fewer OTs.","heading":"Summary"}],"slug":"gprty21-paxos-psi-with-3h","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"PaXoS-PSI with its binary OKVS replaced by a three-hash garbled cuckoo table of about \\( 1.3n \\) slots. The receiver encodes its items in the table and runs one OOS OT per slot; the sender hashes its decoded values, and fewer slots mean fewer OTs.","title":"PaXoS-PSI with 3H-GCT (malicious)","type":"construction","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT"},{"contributions":["PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","PSI-CONTRIB-2021-GPRTY-3H-GCT","PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-PAXOS","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","keywords":["two-party psi","okvs_ot_extension","empirical-error-analysis"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the OOS OT-extension hybrid model"},"attributes":{"adversary":{"locator":"§6.3, p. 19","note":"Via the PaXoS-PSI proofs, written for any binary OKVS; corrupt parties may use larger sets","value":["malicious"]},"assumptions":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"None beyond the random oracle in the OOS OT-extension hybrid; instantiating OOS needs base OTs, whose assumption is not named","source":"PSI-PAPER-2020-PRTY","value":"not_reported"},"output":{"locator":"§6.3, p. 19","value":["intersection"]},"output_to":{"locator":"Figure 3, step 4, p. 11","note":"The receiver","source":"PSI-PAPER-2020-PRTY","value":"one"},"parties":{"locator":"§6.3, p. 19","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; Theorem 4, p. 10","note":"The OOS hybrid of the proof is not a model","source":"PSI-PAPER-2020-PRTY","value":["non-programmable random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 11","source":"PSI-PAPER-2020-PRTY","value":"balanced"},"technique":{"locator":"§5.2, pp. 14-16; §5.4, pp. 17-18; §8.1, p. 23","value":["okvs","ot_extension","simple_hashing"]}},"blocks":[{"cites":[{"key":"OOS17","title":"Actively secure 1-out-of-N OT extension with application to private set intersection"}],"func":"oos","id":"oos","implementation":"OOS malicious OT extension","instantiation":"oos17","locator":"§5.2, p. 16; §5.4, p. 17; §6.3, p. 19; PRTY20 Figure 3, step 2, p. 11","note":"One run on the receiver's star-architecture table, one instance per position of its leaves and centre; \\( \\tau \\), the length of \\( H_1 \\), as in PaXoS-PSI","params":{"\\tau":"\\( \\ge \\lambda+2\\log n \\)","m":"\\( (b+1)(1.3n'+\\lambda+0.5\\log n') \\)","n_C":"\\( w \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["empirical-error-analysis"],"claim_ids":["PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","PSI-CONTRIB-2021-GPRTY-3H-GCT","PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI"],"construction_family":"okvs_ot_extension","costs":[{"basis":"counted","formula":"\\( 2\\kappa n \\)","locator":"PRTY20 Figure 3, step 3, p. 11; PRTY20 §4.4, p. 15; Theorem 7, p. 21; Figure 4, p. 23","measure":"communication","note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item, as for malicious security","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, steps 1–2, p. 11","measure":"communication","note":"Sends nothing outside the OOS run, whose choice strings are its table","source":"PSI-PAPER-2020-PRTY","subject":"receiver"},{"basis":"counted","formula":"\\( 7n \\)","locator":"§5.2, p. 15; §4.1, pp. 9–11; PRTY20 Figure 3, step 3, p. 11","measure":"computation","note":"Per item: the leaf hash, the hyperedge and \\( r \\) hashes of its leaf and of the centre, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 7n \\)","locator":"§5.2, p. 15; §4.1, pp. 9–11; PRTY20 Figure 3, steps 1 and 4, p. 11","measure":"computation","note":"Per item: the leaf hash, the hyperedge and \\( r \\) hashes of its leaf and of the centre, then \\( H_1 \\) and \\( H_2 \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","name":"PaXoS-PSI with star-architecture OKVS (malicious)","paper_ids":["PSI-PAPER-2021-GPRTY","PSI-PAPER-2020-PRTY"],"primitive":"two-party PSI","schedule":[{"blocks":["oos"],"id":"oos","locator":"§5.4, p. 17; §6.3, p. 19; PRTY20 Figure 3, steps 1–2, p. 11","phase":"online","what":"the OOS run on the receiver's star-architecture OKVS"},{"after":["oos"],"from":"sender","id":"masks","locator":"PRTY20 Figure 3, step 3, p. 11","phase":"online","what":"the sender's hashed set M"}],"security":{"mode":"computational","model":"malicious two-party, random oracle model, OOS-hybrid, via the PaXoS-PSI proofs (§6.3, p. 19)","notion":"PSI with output to the receiver; corrupt parties may use larger sets"},"status":"published","title":"PaXoS-PSI with a star-architecture OKVS over three-hash tables, malicious two-party PSI","variables":[{"meaning":"Codeword length of the OOS OT extension, in bits","symbol":"w"},{"meaning":"Leaf tables of the star architecture (the paper's q), the bins its simple hashing maps the items into","symbol":"b"},{"meaning":"Bound on the items in one leaf: the maximum load of n items in b bins, except with probability 2^{-λ}","symbol":"n'"}],"work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"PaXoS-PSI over the star-architecture OKVS, which hashes items into leaf three-hash tables and adds a centre table that absorbs any one leaf failure. Amplification turns an empirically measured leaf failure rate into a small overall failure probability.","heading":"Summary"}],"slug":"gprty21-paxos-psi-with-star","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"PaXoS-PSI over the star-architecture OKVS, which hashes items into leaf three-hash tables and adds a centre table that absorbs any one leaf failure. Amplification turns an empirically measured leaf failure rate into a small overall failure probability.","title":"PaXoS-PSI with star-architecture OKVS (malicious)","type":"construction","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"},{"contributions":["PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","PSI-CONTRIB-2021-GPRTY-OKVS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","keywords":["multiparty psi","oprf_okvs_zero_sharing","any-okvs"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracle and PRF-based zero sharing, in the malicious two-party OPRF hybrid model"},"attributes":{"adversary":{"locator":"Theorem 9, p. 31; Appendix B.4, p. 34","note":"Corrupt parties may contribute sets of up to twice the honest size","value":["malicious"]},"assumptions":{"locator":"Figure 5, p. 39; Theorem 9, p. 31; Table 4, p. 36","note":"PRF zero-sharing; the two-party OPRF is an ideal functionality, instantiated with vOLE in the comparison","value":["PRF"]},"corruptions":{"locator":"Table 4, p. 36; Appendix B.4, p. 30","note":"Any subset of parties, the central party included","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Figure 5, p. 39","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 39; Appendix B.7, p. 38","note":"The central party; an extension gives output to all under a weaker functionality","value":"one"},"parties":{"locator":"Figure 5, p. 39","value":"multiparty"},"security_model":{"locator":"Figure 5, p. 39; Theorem 9, p. 31","note":"The OPRF hybrid of the proof is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Figure 5, p. 39; Appendix B.5, p. 35","value":"balanced"},"technique":{"locator":"Appendix B.2, p. 30; Table 4, p. 36","value":["oprf","okvs","vole","secret_sharing"]}},"blocks":[{"cites":[],"count":{"client":"\\( 1 \\)","leader":"\\( \\ell-1 \\)"},"func":"oprf","id":"oprf","implementation":"vOLE","instantiation":"gprty21_vole_oprf","locator":"Figure 5, step 2(a), p. 39; Theorem 9, p. 31; Table 4, p. 36","note":"One malicious two-party OPRF per client, keyed by the client; the leader queries its \\( n \\) items in each","params":{"c":"\\( n \\)"},"roles":{"receiver":"leader","sender":"client"}}],"capabilities":["any-okvs"],"claim_ids":["PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","PSI-CONTRIB-2021-GPRTY-OKVS"],"construction_family":"oprf_okvs_zero_sharing","costs":[{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 5, steps 1–2, p. 39","measure":"communication","note":"Sends only inside the OPRFs; first in the order, it sends no zero-sharing key","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-1)|\\mathbb{F}| \\)","locator":"Figure 5, step 1, p. 39","measure":"communication","note":"Zero-sharing keys drawn from \\( \\mathbb{F} \\), one to each party before it in the order","phase":"setup","subject":"client","tip":"The last client's, the largest: the client \\( P_i \\) sends \\( i \\) keys, so the first sends one."},{"basis":"counted","formula":"\\( m|\\mathbb{F}| \\)","locator":"Figure 5, steps 2(b)–(c), p. 39","measure":"communication","note":"Its OKVS of its \\( n \\) items to the leader, one field element per slot","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 2(\\ell-1)n \\)","locator":"Figure 5, steps 1 and 3, p. 39","measure":"computation","note":"Per item its zero-share, one PRF call per other party, and H on each client's OPRF value; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"leader"},{"basis":"counted","locator":"Figure 5, steps 3–4, p. 39","measure":"computation","note":"Encoding its OKVS and decoding all \\( \\ell \\) at its items multiply only for an OKVS whose rows hold field elements, which the protocol leaves open","operation":"field_op","phase":"online","subject":"leader","value":"conditional"},{"basis":"counted","formula":"\\( (\\ell+2)n \\)","locator":"Figure 5, steps 1 and 2(b), p. 39; Figure 3, step 2, p. 22","measure":"computation","note":"Per item its zero-share, one PRF call per other party, its OPRF value, \\( H_1 \\) and \\( H_2 \\), and H; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"client"},{"basis":"counted","locator":"Figure 5, step 2(b), p. 39; Figure 3, step 2, p. 22","measure":"computation","note":"One product by s per item in its OPRF values, plus decoding Q and encoding its OKVS, which multiply only for an OKVS with field rows","operation":"field_op","phase":"online","subject":"client","value":"conditional"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","name":"Malicious multiparty PSI from OPRF and OKVS","paper_ids":["PSI-PAPER-2021-GPRTY"],"primitive":"multiparty PSI","schedule":[{"from":"client","id":"keys","locator":"Figure 5, step 1, p. 39; §B.5, p. 35","phase":"setup","what":"zero-sharing keys, from each client to every party before it in the order"},{"blocks":["oprf"],"id":"oprf","locator":"Figure 5, step 2(a), p. 39","phase":"online","what":"one OPRF per client, the leader querying its set"},{"after":["oprf"],"from":"client","id":"okvs","locator":"Figure 5, steps 2(b)–(c), p. 39","phase":"online","what":"each client's OKVS of its hashed OPRF values masked by its zero-shares"}],"security":{"mode":"computational","model":"malicious, F_oprf-hybrid, random oracle model (Theorem 9, p. 31)","notion":"UC-secure multiparty PSI with output to a central party; corrupt parties may use larger sets"},"status":"published","title":"Malicious multiparty PSI from two-party OPRFs, zero sharing, and OKVS, star topology","variables":[{"meaning":"Slots of the OKVS a party sends, which encodes its \\( n \\) items; Figure 5 leaves the OKVS open","symbol":"m"}],"work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"The KMPRT augmented semi-honest protocol over any OKVS and a malicious two-party OPRF, with each OPRF output hashed by a random oracle before it is masked with a PRF zero-share. The added hash lets the simulator extract corrupt inputs, which makes the protocol malicious-secure.","heading":"Summary"}],"slug":"gprty21-malicious-multiparty-psi-fro","status":"fulltext_checked","subtitle":"multiparty PSI · 2021","summary":"The KMPRT augmented semi-honest protocol over any OKVS and a malicious two-party OPRF, with each OPRF output hashed by a random oracle before it is masked with a PRF zero-share. The added hash lets the simulator extract corrupt inputs, which makes the protocol malicious-secure.","title":"Malicious multiparty PSI from OPRF and OKVS","type":"construction","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY"},{"contributions":["PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","keywords":["two-party psi","okvs_vole","any-linear-okvs"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the vector-OLE hybrid model"},"attributes":{"adversary":{"locator":"Theorem 7, p. 21","value":["malicious"]},"assumptions":{"locator":"§7.1, p. 21; Theorem 7, p. 21","note":"None beyond the random oracles in the vOLE hybrid; it needs a malicious-secure vOLE protocol, which the paper does not fix","value":"not_reported"},"output":{"locator":"Figure 3, p. 22","value":["intersection"]},"output_to":{"locator":"Figure 3, step 3, p. 22","note":"The receiver","value":"one"},"parties":{"locator":"Figure 3, p. 22","value":"two_party"},"security_model":{"locator":"Theorem 7, p. 21; Figure 3, p. 22","note":"Random oracles as in PaXoS-PSI, whose proof it follows; the vOLE hybrid is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Figure 3, p. 22","value":"balanced"},"technique":{"locator":"§7.1, pp. 20-22","value":["okvs","vole"]}},"blocks":[{"cites":[],"func":"vole","id":"vole","locator":"Figure 3, step 1, p. 22; Theorem 7, p. 21; §7.1, p. 21","note":"Chosen inputs: the receiver puts in its OKVS, the sender a random scalar; no malicious protocol for it is named","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\ell_1}} \\)","m":"\\( m \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["any-linear-okvs"],"claim_ids":["PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE"],"construction_family":"okvs_vole","costs":[{"basis":"counted","formula":"\\( 2\\kappa n \\)","locator":"Figure 3, step 2, p. 22; Theorem 7, p. 21; PRTY20 §4.4, p. 15","measure":"communication","note":"One \\( H_2 \\) output of \\( 2\\kappa \\) bits per item","subject":"sender"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Figure 3, p. 22","measure":"communication","note":"Sends nothing outside the vOLE, whose input is its OKVS; no error-correcting code is sent","subject":"receiver"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Figure 3, step 2, p. 22","measure":"computation","note":"\\( H_1 \\) and \\( H_2 \\) per item, besides any hashing of the linear OKVS, which the paper leaves open","operation":"symmetric_op","subject":"sender"},{"basis":"counted","locator":"Figure 3, step 2, p. 22","measure":"computation","note":"One multiplication by s per item, plus those of decoding Q, which depend on the linear OKVS chosen","operation":"field_op","subject":"sender","value":"conditional"},{"basis":"counted","formula":"\\( 2n \\)","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","note":"\\( H_1 \\) and \\( H_2 \\) per item, besides any hashing of the linear OKVS, which the paper leaves open","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","locator":"Figure 3, steps 1 and 3, p. 22","measure":"computation","note":"Encoding its OKVS and decoding R at each item multiply only for an OKVS whose rows hold field elements","operation":"field_op","subject":"receiver","value":"conditional"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","name":"Generalized PaXoS-PSI over vOLE","paper_ids":["PSI-PAPER-2021-GPRTY"],"primitive":"two-party PSI","schedule":[{"blocks":["vole"],"id":"vole","locator":"Figure 3, step 1, p. 22","phase":"online","what":"the vOLE on the receiver's OKVS and the sender's random scalar"},{"after":["vole"],"from":"sender","id":"masks","locator":"Figure 3, step 2, p. 22","phase":"online","what":"the sender's hashed set M"}],"security":{"mode":"computational","model":"malicious two-party, random oracle model, vOLE-hybrid (Theorem 7, p. 21)","notion":"PSI with output to the receiver"},"status":"published","title":"Generalized PaXoS-PSI from a linear OKVS and vector OLE, malicious two-party PSI","variables":[{"meaning":"Slots of the linear OKVS that encodes the receiver's \\( n \\) items, which the paper leaves open","symbol":"m"},{"meaning":"Output length of \\( H_1 \\): the vOLE works over \\( GF(2^{\\ell_1}) \\), with \\( \\ell_1 \\) set as in PaXoS-PSI","symbol":"\\ell_1"}],"work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"PaXoS-PSI generalized to any linear OKVS by replacing the OOS correlation with vector OLE over \\( \\mathrm{GF}(2^{\\ell_1}) \\). The receiver's OKVS of its hashed items is the vOLE input, so no error-correcting code is needed.","heading":"Summary"}],"slug":"gprty21-generalized-paxos-psi-over","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"PaXoS-PSI generalized to any linear OKVS by replacing the OOS correlation with vector OLE over \\( \\mathrm{GF}(2^{\\ell_1}) \\). The receiver's OKVS of its hashed items is the vOLE input, so no error-correcting code is needed.","title":"Generalized PaXoS-PSI over vOLE","type":"construction","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-GPRTY-VOLE"},{"contributions":["PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","keywords":["multiparty psi","okvs_zeroxor","corruption-threshold-calibration","lightweight-clients"],"metadata":{"assumption":{"family":"symmetric","name":"PRF and random oracle, with OKVS obliviousness and ideal OPPRF and zero-sharing functionalities"},"attributes":{"adversary":{"locator":"Theorem 4.5, p. 11","note":"Static corruption","value":["malicious"]},"assumptions":{"locator":"Protocol 4.4, p. 10; Theorem 4.3, p. 10; Theorem 4.5, p. 11","note":"PRF masks from the clients; the OPPRF and zero-sharing are ideal functionalities in the proof","value":["PRF"]},"corruptions":{"locator":"Protocol 4.4, p. 10; Theorem 4.5, p. 11","note":"A parameter: \\( \\ell - t_c - 1 \\) clients, one pivot and \\( t_c \\) servers, cheaper for smaller \\( t_c \\)","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Functionality 2.1, p. 4","value":["intersection"]},"output_to":{"locator":"Functionality 2.1, p. 4; Protocol 4.4, step 6, p. 10","note":"The last server","value":"one"},"parties":{"locator":"Protocol 4.4, p. 10","value":"multiparty"},"security_model":{"locator":"Theorem 4.5, p. 11","note":"The ZeroXOR hybrid of the proof is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Functionality 2.1, p. 4","value":"balanced"},"technique":{"locator":"Protocol 4.2, p. 10; Protocol 4.4, p. 10; §5, p. 11","value":["okvs","paxos","opprf","secret_sharing"]}},"blocks":[{"cites":[{"key":"KMPRT17","paper":"PSI-PAPER-2017-KMPRT","title":"Practical multi-party private set intersection from symmetric-key techniques"}],"count":"\\( n \\)","func":"zero_share","id":"zero_share","implementation":"unconditional zero sharing of Kolesnikov et al., from exchanged seeds","instantiation":"kmprt17_zero_share","locator":"Protocol 4.2, step 1, p. 10; Theorem 4.3, p. 10; Protocol 4.4, step 6, p. 10","note":"Among the pivot and the servers, the leader included, inside ZeroXOR; each takes one share per item","params":{"\\ell":"\\( t_c + 1 \\)"},"roles":{"party":["pivot","server","leader"]}},{"cites":[{"key":"PRTY20","paper":"PSI-PAPER-2020-PRTY","title":"PSI from PaXoS: Fast, malicious private set intersection"},{"key":"KMPRT17","paper":"PSI-PAPER-2017-KMPRT","title":"Practical multi-party private set intersection from symmetric-key techniques"},{"key":"KKRT16","paper":"PSI-PAPER-2016-KKRT","title":"Efficient batched oblivious PRF with applications to private set intersection"}],"count":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"},"func":"opprf","id":"opprf","implementation":"malicious PaXoS-based OPPRF of Pinkas et al.; measured with KMPRT's table-based OPPRF","instantiation":"prty20_opprf","locator":"Protocol 4.2, step 2, p. 10; Theorem 4.3, p. 10","note":"The leader receives in each; the pivot and every other server send in one","params":{"m_1":"\\( n \\)","m_2":"\\( n \\)"},"roles":{"receiver":"leader","sender":["pivot","server"]},"sessions":{"leader":"\\( t_c \\)","pivot":"\\( 1 \\)","server":"\\( 1 \\)"}}],"capabilities":["corruption-threshold-calibration","lightweight-clients"],"claim_ids":["PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING"],"construction_family":"okvs_zeroxor","costs":[{"basis":"counted","formula":"\\( (m+t_c)\\kappa \\)","locator":"Protocol 4.4, steps 2–3, p. 10","measure":"communication","note":"A \\( \\kappa \\)-bit PRF key to each server, then its OKVS of \\( \\kappa \\)-bit values to the pivot","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 4.4, steps 4 and 6, p. 10; Protocol 4.2, p. 10","measure":"communication","note":"Sends only inside ZeroXOR, as zero-sharing party and OPPRF sender","subject":"pivot"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, p. 10","measure":"communication","note":"Sends only inside ZeroXOR, as zero-sharing party and OPPRF sender","subject":"server"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, p. 10","measure":"communication","note":"Sends only inside ZeroXOR, as zero-sharing party and the receiver of every OPPRF","subject":"leader"},{"basis":"counted","formula":"\\( (t_c+1)n \\)","locator":"Protocol 4.4, step 3 and note a, p. 10","measure":"computation","note":"Per item the random oracle H and one PRF call per server key; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n \\)","locator":"Protocol 4.4, step 4 and note a, p. 10","measure":"computation","note":"H per item; decoding the clients' OKVSs XORs their rows, and their hashing is left open","operation":"symmetric_op","phase":"online","subject":"pivot"},{"basis":"counted","formula":"\\( (\\ell-t_c)n \\)","locator":"Protocol 4.4, step 5 and note a, p. 10","measure":"computation","note":"Per item H and one PRF call per client key","operation":"symmetric_op","phase":"online","subject":"server"},{"basis":"counted","formula":"\\( (\\ell-t_c)n \\)","locator":"Protocol 4.4, steps 5–6, p. 10; Protocol 4.2, step 3, p. 10","measure":"computation","note":"As a server, per item H and one PRF call per client key; comparing its share with the OPPRF outputs is XORs","operation":"symmetric_op","phase":"online","subject":"leader"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","name":"NTY multiparty PSI, arbitrary collusion","paper_ids":["PSI-PAPER-2021-NTY","PSI-PAPER-2017-KMPRT"],"primitive":"multiparty PSI","schedule":[{"from":"client","id":"keys","locator":"Protocol 4.4, step 2, p. 10","phase":"online","what":"a PRF key to each server"},{"from":"client","id":"okvs","locator":"Protocol 4.4, step 3, p. 10; §4.2.1, p. 11","phase":"online","what":"its OKVS of the XORed PRF values, to the pivot"},{"blocks":["zero_share"],"id":"share","locator":"Protocol 4.2, step 1, p. 10; Protocol 4.4, step 6, p. 10","phase":"online","what":"zero-shares of each ZeroXOR party's items, needing only the items"},{"after":["keys","okvs","share"],"blocks":["opprf"],"id":"opprf","locator":"Protocol 4.2, step 2, p. 10; Protocol 4.4, steps 4–6, p. 10","phase":"online","what":"the OPPRFs to the leader, each programmed with its sender's values masked by its zero-shares"}],"security":{"mode":"computational","model":"malicious, \\( t_c < \\ell \\) corrupted, F_zeroXOR-hybrid and random oracle model (Theorem 4.5, p. 11)","notion":"\\( \\ell \\)-party PSI with output to \\( P_\\ell \\) (Functionality 2.1, p. 4)"},"status":"published","title":"NTY malicious multiparty PSI against \\( t_c < \\ell \\) colluding parties from OKVS encodings and ZeroXOR over OPPRFs","variables":[{"meaning":"Slots of the OKVS a client sends, which encodes its \\( n \\) items; Protocol 4.4 leaves the OKVS open, and the experiments use PaXoS with \\( 2.5n \\) bins","symbol":"m"}],"work_id":"PSI-PAPER-2021-NTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1221","sections":[{"content":"Malicious multiparty PSI calibrated to the number of corruptions. Clients deliver a conditional zero-sharing to a pivot and \\( t_c \\) servers through one OKVS and \\( t_c \\) PRF keys each, and those \\( t_c + 1 \\) parties find the items whose shares sum to zero with a ZeroXOR protocol over OPPRFs.","heading":"Summary"}],"slug":"nty21-nty-multiparty-psi-arbitrary","status":"fulltext_checked","subtitle":"multiparty PSI · 2021","summary":"Malicious multiparty PSI calibrated to the number of corruptions. Clients deliver a conditional zero-sharing to a pivot and \\( t_c \\) servers through one OKVS and \\( t_c \\) PRF keys each, and those \\( t_c + 1 \\) parties find the items whose shares sum to zero with a ZeroXOR protocol over OPPRFs.","title":"NTY multiparty PSI, arbitrary collusion","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION"},{"contributions":["PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","keywords":["multiparty psi","okvs_reduction_to_server_aided_psi","symmetric-key-primitives-only","no-collusion"],"metadata":{"assumption":{"family":"symmetric","name":"PRF and random oracle, with OKVS obliviousness and an ideal two-party PSI functionality"},"attributes":{"adversary":{"locator":"Theorem 3.4, p. 8","value":["malicious"]},"assumptions":{"locator":"Theorem 3.4, p. 8; §1.2, p. 4; Appendix A, pp. 13-14","note":"The two-party PSI is an ideal functionality in the proof; Kamara et al.'s instantiation needs only a PRF, and no OT is used","value":["PRF"]},"corruptions":{"locator":"§1.2, p. 4; Theorem 3.4, p. 8; §3.2.1, p. 8","note":"No collusion; two colluding parties, such as the key dealer and the pivot, break it","value":"\\( t_c \\le 1 \\)"},"output":{"locator":"Functionality 2.1, p. 4","value":["intersection"]},"output_to":{"locator":"Functionality 2.1, p. 4; Protocol 3.3, step 6, p. 8","note":"The last party","value":"one"},"parties":{"locator":"Protocol 3.3, p. 8","value":"multiparty"},"security_model":{"locator":"Protocol 3.3, note a, p. 8; proof of Theorem 3.4, pp. 8-9","note":"The malicious variant hashes items with a random oracle; the two-party PSI hybrid is not a model","value":["random oracle"]},"set_size_regime":{"locator":"Functionality 2.1, p. 4","value":"balanced"},"technique":{"locator":"Protocol 3.3, p. 8; §3.2.2, p. 8; Appendix A, p. 13","value":["okvs","paxos","server_aided_psi"]}},"blocks":[{"cites":[{"key":"KMRS14","title":"Scaling private set intersection to billion-element sets"}],"func":"psi","id":"psi","implementation":"server-aided PSI of Kamara et al.","instantiation":"kmrs14","locator":"Protocol 3.3, step 6, p. 8; Theorem 3.4, p. 8","note":"Between the pivot and the leader, on their derived sets; one client aids as the server","params":{"n_X":"\\( n \\)","n_Y":"\\( n \\)"},"roles":{"receiver":"leader","sender":"pivot","server":"client"}}],"capabilities":["symmetric-key-primitives-only","no-collusion"],"claim_ids":["PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION"],"construction_family":"okvs_reduction_to_server_aided_psi","costs":[{"basis":"counted","formula":"\\( (m+\\ell-3)\\kappa \\)","locator":"Protocol 3.3, steps 1–3, p. 8; §3.2.2, p. 8","measure":"communication","note":"The first client: a \\( \\kappa \\)-bit PRF key to each other client, and its OKVS under all keys to the leader","phase":"online","subject":"client","tip":"The first client's, the largest: it deals the keys; every other client sends one OKVS of \\( m\\kappa \\) bits to the pivot and makes \\( 2n \\) sym ops."},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 3.3, steps 4 and 6, p. 8","measure":"communication","note":"Sends only inside the two-party PSI","subject":"pivot"},{"basis":"counted","formula":"\\( 0 \\)","locator":"Protocol 3.3, steps 5–6, p. 8","measure":"communication","note":"Sends only inside the two-party PSI","subject":"leader"},{"basis":"counted","formula":"\\( (\\ell-2)n \\)","locator":"Protocol 3.3, steps 2–3 and note a, p. 8","measure":"computation","note":"The first client: per item the random oracle H and one PRF call per other client's key; the OKVS's own hashing is left open","operation":"symmetric_op","phase":"online","subject":"client"},{"basis":"counted","formula":"\\( n \\)","locator":"Protocol 3.3, step 4 and note a, p. 8","measure":"computation","note":"H per item; decoding the clients' OKVSs XORs their rows, and their hashing is left open","operation":"symmetric_op","phase":"online","subject":"pivot"},{"basis":"counted","formula":"\\( n \\)","locator":"Protocol 3.3, step 5 and note a, p. 8","measure":"computation","note":"H per item; decoding the first client's OKVS XORs its rows, and its hashing is left open","operation":"symmetric_op","phase":"online","subject":"leader"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","name":"NTY multiparty PSI, no collusion","paper_ids":["PSI-PAPER-2021-NTY"],"primitive":"multiparty PSI","schedule":[{"from":"client","id":"keys","locator":"Protocol 3.3, step 1, p. 8","phase":"online","what":"the first client's PRF keys, one to each other client"},{"from":"client","id":"okvs_leader","locator":"Protocol 3.3, step 2, p. 8","phase":"online","what":"the first client's OKVS under all the keys, to the leader"},{"after":["keys"],"from":"client","id":"okvs_pivot","locator":"Protocol 3.3, step 3, p. 8","phase":"online","what":"each other client's OKVS under its key, to the pivot"},{"after":["okvs_leader","okvs_pivot"],"blocks":["psi"],"id":"psi","locator":"Protocol 3.3, steps 4–6, p. 8","phase":"online","what":"the server-aided two-party PSI on the pivot's and the leader's derived sets"}],"security":{"mode":"computational","model":"malicious, at most one corrupted party, \\( F_{\\mathrm{psi}}^{2,1,n} \\)-hybrid (Theorem 3.4, p. 8)","notion":"\\( \\ell \\)-party PSI with output to \\( P_\\ell \\) (Functionality 2.1, p. 4)"},"status":"published","title":"NTY malicious multiparty PSI without collusion from OKVS encodings and server-aided two-party PSI","variables":[{"meaning":"Slots of the OKVS a client sends, which encodes its \\( n \\) items; Protocol 3.3 leaves the OKVS open, and the experiments use PaXoS with \\( 2.5n \\) bins","symbol":"m"}],"work_id":"PSI-PAPER-2021-NTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1221","sections":[{"content":"Malicious multiparty PSI against a single corrupt party from PRF keys and OKVS encodings alone. One party deals PRF keys and an OKVS so that the intersection of all sets reduces to a two-party PSI between the last two parties, run as server-aided PSI with another party as the aid.","heading":"Summary"}],"slug":"nty21-nty-multiparty-psi-no","status":"fulltext_checked","subtitle":"multiparty PSI · 2021","summary":"Malicious multiparty PSI against a single corrupt party from PRF keys and OKVS encodings alone. One party deals PRF keys and an OKVS so that the intersection of all sets reduces to a two-party PSI between the last two parties, run as server-aided PSI with another party as the aid.","title":"NTY multiparty PSI, no collusion","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION"},{"contributions":["PSI-CONTRIB-2021-RS-CIRCUIT-PSI","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","keywords":["circuit-psi","opprf_cuckoo_circuit","associated-values","secret-shared-output"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise"},"attributes":{"adversary":{"locator":"abstract, p. 1; §6, p. 23","value":["semi_honest"]},"assumptions":{"locator":"§7.2, pp. 26 and 30","note":"LPN with regular noise, for the VOLE; GMW's OTs come from IKNP","value":["LPN"]},"output":{"locator":"Figure 9, p. 38","value":["circuit"]},"output_to":{"locator":"Figure 9, p. 38","note":"Both parties hold shares of a membership bit and associated values per bin","value":"shared"},"parties":{"locator":"Figure 10, p. 39","value":"two_party"},"security_model":{"locator":"Theorem 5.1, p. 21; §6, p. 23","note":"OPPRF in the F_oprf-hybrid model and 2PC as a functionality; the circuit-PSI proof is deferred to PSTY19","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 4, p. 29","value":"balanced"},"technique":{"locator":"§6, pp. 22–24; Figure 10, p. 39; §7.2, p. 30","value":["opprf","batched_oprf","vole","paxos","cuckoo_hashing","simple_hashing","gmw"]}},"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"IKNP03","title":"Extending oblivious transfers efficiently"}],"func":"two_pc","id":"two_pc","implementation":"GMW, with IKNP OT extension","instantiation":"gmw_iknp","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"capabilities":["associated-values","secret-shared-output"],"claim_ids":["PSI-CONTRIB-2021-RS-CIRCUIT-PSI","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"construction_family":"opprf_cuckoo_circuit","costs":[{"basis":"counted","formula":"\\( (7.2n_X+d+\\lambda)(\\lambda+\\log_2(\\epsilon n_Y))+2\\kappa \\)","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 4, steps 1 and 5, p. 36; Figure 1, parameters, p. 7; §6, p. 23","measure":"communication","note":"The OPPRF table, an XoPaXoS over its items in their three bins, and the coin toss's commitment and opening; associated values add more","subject":"sender"},{"basis":"counted","formula":"\\( (2.4\\epsilon n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; Figure 10, step 4, p. 39; §2, PaXoS details, p. 10","measure":"communication","note":"The OPRF's PaXoS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4\\epsilon n_Y+d+\\lambda+3n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 1, p. 7","measure":"computation","note":"One product per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per entry of its three-bin table; the XoPaXoS encoding is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 18n_X+1 \\)","locator":"Figure 10, steps 2–3, p. 39; Figure 8, step 2, p. 38; Figure 4, step 1 and the sender's evaluation, p. 36; §7.2, p. 30","measure":"computation","note":"Simple hashing with three functions, then per table entry row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( (5\\epsilon+4)n_Y+1 \\)","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2, 5 and 6, p. 36; Figure 8, step 3, p. 38","measure":"computation","note":"Cuckoo hashing, the bin labels, then per bin row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","name":"VOLE-PSI circuit-PSI","paper_ids":["PSI-PAPER-2021-RS"],"primitive":"circuit-PSI","schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 8, step 1, p. 38; Figure 10, step 4, p. 39","phase":"online","what":"commitment to its coin-toss share, the first flow of the OPRF inside the OPPRF"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; Figure 8, step 1, p. 38; §7.1, p. 25","phase":"offline","what":"random VOLE for the OPRF's encoding of the cuckoo bins, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the OPRF's encoding of its bin labels, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"table","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39","phase":"online","what":"the OPPRF table, programming each bin's random value at its items","with":"open"},{"after":["open","table"],"blocks":["two_pc"],"id":"cmp","locator":"Figure 10, step 5, p. 39; §7.2, p. 30","phase":"online","what":"GMW comparison of each bin's two values into secret shares"}],"security":{"mode":"computational","model":"semi-honest two-party; OPPRF in the F_oprf-hybrid model (Theorem 5.1, p. 21); composition argued by reference to Pinkas, Schneider, Tkachenko, and Yanai (§6, p. 23)","notion":"circuit-PSI with secret-shared output"},"status":"published","title":"VOLE-PSI circuit-PSI, semi-honest, from a VOLE-based OPPRF with XoPaXoS, cuckoo hashing, and a GMW comparison circuit","variables":[{"meaning":"Cuckoo-table expansion: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"},{"meaning":"Bound on the 2-core of a PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; a PaXoS over \\( k \\) items has \\( 2.4k + d + \\lambda \\) positions","symbol":"d"}],"work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"Circuit-PSI after Pinkas, Schneider, Tkachenko and Yanai with a VOLE-based OPPRF programmed through XoPaXoS: the receiver cuckoo-hashes, the sender simple-hashes and programs a random value per bin, and GMW compares the values bin by bin into secret shares. This row generates GMW's OTs with IKNP.","heading":"Summary"}],"slug":"rs21-vole-psi-circuit-psi","status":"fulltext_checked","subtitle":"circuit-PSI · 2021","summary":"Circuit-PSI after Pinkas, Schneider, Tkachenko and Yanai with a VOLE-based OPPRF programmed through XoPaXoS: the receiver cuckoo-hashes, the sender simple-hashes and programs a random value per bin, and GMW compares the values bin by bin into secret shares. This row generates GMW's OTs with IKNP.","title":"VOLE-PSI circuit-PSI","type":"construction","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RS-CIRCUIT"},{"contributions":["PSI-CONTRIB-2021-RS-CIRCUIT-PSI","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","keywords":["circuit-psi","opprf_cuckoo_circuit","associated-values","secret-shared-output"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; VOLE from LPN with regular noise"},"attributes":{"adversary":{"locator":"abstract, p. 1; §6, p. 23","value":["semi_honest"]},"assumptions":{"locator":"§7.2, pp. 26 and 30","note":"LPN with regular noise, for the VOLE; SilentOT generates GMW's OTs","value":["LPN"]},"output":{"locator":"Figure 9, p. 38","value":["circuit"]},"output_to":{"locator":"Figure 9, p. 38","note":"Both parties hold shares of a membership bit and associated values per bin","value":"shared"},"parties":{"locator":"Figure 10, p. 39","value":"two_party"},"security_model":{"locator":"Theorem 5.1, p. 21; §6, p. 23","note":"OPPRF in the F_oprf-hybrid model and 2PC as a functionality; the circuit-PSI proof is deferred to PSTY19","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 4, p. 29","value":"balanced"},"technique":{"locator":"§6, pp. 22–24; Figure 10, p. 39; §7.2, p. 30","value":["opprf","batched_oprf","vole","paxos","cuckoo_hashing","simple_hashing","gmw","pcg"]}},"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 8, step 1, p. 38; Figure 4, step 3, p. 36; Theorem 5.1, p. 21; §2, PaXoS details, p. 10","note":"For the OPRF's PaXoS over the receiver's \\( \\epsilon n_Y \\) cuckoo bins, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4\\epsilon n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"two_pc","id":"two_pc","implementation":"GMW, with SilentOT","instantiation":"gmw_silent","locator":"Figure 10, step 5, p. 39; §6, pp. 23–24; §7.2, p. 30","note":"One equality test of the bin values per bin, one AND gate fewer than their bits; associated values add more","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"capabilities":["associated-values","secret-shared-output"],"claim_ids":["PSI-CONTRIB-2021-RS-CIRCUIT-PSI","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"construction_family":"opprf_cuckoo_circuit","costs":[{"basis":"counted","formula":"\\( (7.2n_X+d+\\lambda)(\\lambda+\\log_2(\\epsilon n_Y))+2\\kappa \\)","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 4, steps 1 and 5, p. 36; Figure 1, parameters, p. 7; §6, p. 23","measure":"communication","note":"The OPPRF table, an XoPaXoS over its items in their three bins, and the coin toss's commitment and opening; associated values add more","subject":"sender"},{"basis":"counted","formula":"\\( (2.4\\epsilon n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; Figure 10, step 4, p. 39; §2, PaXoS details, p. 10","measure":"communication","note":"The OPRF's PaXoS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4\\epsilon n_Y+d+\\lambda+3n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39; Figure 1, p. 7","measure":"computation","note":"One product per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per entry of its three-bin table; the XoPaXoS encoding is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 18n_X+1 \\)","locator":"Figure 10, steps 2–3, p. 39; Figure 8, step 2, p. 38; Figure 4, step 1 and the sender's evaluation, p. 36; §7.2, p. 30","measure":"computation","note":"Simple hashing with three functions, then per table entry row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( (5\\epsilon+4)n_Y+1 \\)","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2, 5 and 6, p. 36; Figure 8, step 3, p. 38","measure":"computation","note":"Cuckoo hashing, the bin labels, then per bin row, \\( H_F \\) and \\( H \\) for the OPRF and row for the XoPaXoS","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","name":"VOLE-PSI circuit-PSI (SilentOT)","paper_ids":["PSI-PAPER-2021-RS"],"primitive":"circuit-PSI","schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 8, step 1, p. 38; Figure 10, step 4, p. 39","phase":"online","what":"commitment to its coin-toss share, the first flow of the OPRF inside the OPPRF"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; Figure 8, step 1, p. 38; §7.1, p. 25","phase":"offline","what":"random VOLE for the OPRF's encoding of the cuckoo bins, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 10, steps 1 and 4, p. 39; Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the OPRF's encoding of its bin labels, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"table","locator":"Figure 8, step 2, p. 38; Figure 10, steps 2–4, p. 39","phase":"online","what":"the OPPRF table, programming each bin's random value at its items","with":"open"},{"after":["open","table"],"blocks":["two_pc"],"id":"cmp","locator":"Figure 10, step 5, p. 39; §7.2, p. 30","phase":"online","what":"GMW comparison of each bin's two values into secret shares"}],"security":{"mode":"computational","model":"semi-honest two-party; OPPRF in the F_oprf-hybrid model (Theorem 5.1, p. 21); composition argued by reference to Pinkas, Schneider, Tkachenko, and Yanai (§6, p. 23)","notion":"circuit-PSI with secret-shared output"},"status":"published","title":"VOLE-PSI circuit-PSI, semi-honest, from a VOLE-based OPPRF with XoPaXoS, cuckoo hashing, and a GMW comparison circuit with SilentOT","variables":[{"meaning":"Cuckoo-table expansion: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"},{"meaning":"Bound on the 2-core of a PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; a PaXoS over \\( k \\) items has \\( 2.4k + d + \\lambda \\) positions","symbol":"d"}],"work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"The VOLE-PSI circuit-PSI with GMW's offline OTs generated by SilentOT instead of IKNP, which removes the κ factor from the comparison phase's communication. It is the faster variant on slow networks.","heading":"Summary"}],"slug":"rs21-vole-psi-circuit-psi-2","status":"fulltext_checked","subtitle":"circuit-PSI · 2021","summary":"The VOLE-PSI circuit-PSI with GMW's offline OTs generated by SilentOT instead of IKNP, which removes the κ factor from the comparison phase's communication. It is the faster variant on slow networks.","title":"VOLE-PSI circuit-PSI (SilentOT)","type":"construction","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT"},{"contributions":["PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-MAL","keywords":["two-party psi","vole_okvs_oprf","data-independent-setup"],"metadata":{"assumption":{"family":"idealized_model","name":"Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise"},"attributes":{"adversary":{"locator":"Theorem 3.1, p. 16; Theorem 4.1, p. 20; Lemma 3.3, p. 17","note":"A malicious receiver's effective set is bounded by the OKVS size","value":["malicious"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18","note":"In the F_vole-hybrid model, a hybrid model; the simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 6, p. 37","value":"balanced"},"technique":{"locator":"§3.2, pp. 14–16; Figure 4, p. 36","value":["batched_oprf","vole","paxos"]}},"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"},{"key":"WYKW20","title":"Wolverine: Fast, scalable, and communication-efficient zero-knowledge proofs for boolean and arithmetic circuits"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20 and the consistency check of WYKW20","instantiation":"sgrr19_ywl20_wykw20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["data-independent-setup"],"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"construction_family":"vole_okvs_oprf","costs":[{"basis":"counted","formula":"\\( \\kappa n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37; §4, pp. 19–20","measure":"communication","note":"OPRF values of \\( \\kappa \\) bits, which the paper shows suffice, and the coin toss's commitment and opening","subject":"sender"},{"basis":"counted","formula":"\\( (2.4n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, PaXoS details, p. 10; Figure 1, parameters, p. 7","measure":"communication","note":"The PaXoS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4n_Y+d+\\lambda+n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37; Figure 1, p. 7","measure":"computation","note":"One product \\( A_i\\Delta \\) per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per item; the binary-row decode is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-MAL","name":"VOLE-PSI (malicious, PaXoS)","paper_ids":["PSI-PAPER-2021-RS"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the PaXoS's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the PaXoS of its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3 and parameters, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"\\( \\kappa \\)-bit OPRF values of its items, in random order","with":"open"}],"security":{"mode":"computational","model":"malicious two-party, programmable random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","notion":"PSI with output to the receiver; a corrupt receiver may use a larger set"},"status":"published","title":"VOLE-PSI, malicious two-party PSI from a VOLE-based OPRF with a PaXoS encoding and \\( \\kappa \\)-bit OPRF outputs","variables":[{"meaning":"Bound on the 2-core of the PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; the PaXoS has \\( 2.4n_Y + d + \\lambda \\) positions","symbol":"d"}],"work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"The VOLE-based OPRF with a random-oracle encoding of the receiver's set and a coin-tossed offset, giving malicious security at almost no extra cost. The sender's OPRF values need only κ bits, by the paper's sharper analysis.","heading":"Summary"}],"slug":"rs21-vole-psi-malicious-paxos","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"The VOLE-based OPRF with a random-oracle encoding of the receiver's set and a coin-tossed offset, giving malicious security at almost no extra cost. The sender's OPRF values need only κ bits, by the paper's sharper analysis.","title":"VOLE-PSI (malicious, PaXoS)","type":"construction","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RS-MAL"},{"contributions":["PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","keywords":["two-party psi","vole_okvs_oprf","data-independent-setup"],"metadata":{"assumption":{"family":"idealized_model","name":"Programmable random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise"},"attributes":{"adversary":{"locator":"Theorem 3.1, p. 16; footnote 2, p. 15; Theorem 4.1, p. 20","note":"With interpolation a malicious receiver's effective set has at most \\( n_Y \\) items","value":["malicious"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18","note":"In the F_vole-hybrid model, a hybrid model; the simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"Figure 6, p. 37","value":"balanced"},"technique":{"locator":"§3, p. 8; §7.1, p. 24","note":"The Vandermonde OKVS: the receiver interpolates a polynomial through its items","value":["batched_oprf","vole","okvs"]}},"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"},{"key":"WYKW20","title":"Wolverine: Fast, scalable, and communication-efficient zero-knowledge proofs for boolean and arithmetic circuits"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20 and the consistency check of WYKW20","instantiation":"sgrr19_ywl20_wykw20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["data-independent-setup"],"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"construction_family":"vole_okvs_oprf","costs":[{"basis":"counted","formula":"\\( \\kappa n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37; §4, pp. 19–20","measure":"communication","note":"OPRF values of \\( \\kappa \\) bits, which the paper shows suffice, and the coin toss's commitment and opening","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, The Vandermonde OKVS, p. 8","measure":"communication","note":"The polynomial masked by its VOLE share, one field element per coefficient, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( O((n_X+n_Y)\\log^{2} n_Y) \\)","locator":"§3, p. 8; Figure 4, p. 36; Figure 6, p. 37","measure":"computation","note":"Products \\( A_i\\Delta \\) for \\( K = B + A\\Delta \\), multi-point evaluation of the polynomial \\( K \\) at its items, and one \\( \\Delta H_F(y) \\) per item","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y\\log^{2} n_Y) \\)","locator":"§3, p. 8; §7.1, p. 24; Figure 6, p. 37","measure":"computation","note":"Fast interpolation of the polynomial through its items, then multi-point evaluation of its VOLE share \\( C \\) at them","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","name":"VOLE-PSI (malicious, interpolation)","paper_ids":["PSI-PAPER-2021-RS"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the polynomial's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36; §2, The Vandermonde OKVS, p. 8","phase":"online","what":"seed, coin-toss share and the polynomial through its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3 and parameters, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"\\( \\kappa \\)-bit OPRF values of its items, in random order","with":"open"}],"security":{"mode":"computational","model":"malicious two-party, programmable random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","notion":"PSI with output to the receiver; a corrupt receiver may use a larger set"},"status":"published","title":"VOLE-PSI, malicious two-party PSI from a VOLE-based OPRF with a rate-1 polynomial-interpolation encoding and \\( \\kappa \\)-bit OPRF outputs","work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"The malicious VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interpolation cost.","heading":"Summary"}],"slug":"rs21-vole-psi-malicious-interpola","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"The malicious VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interpolation cost.","title":"VOLE-PSI (malicious, interpolation)","type":"construction","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION"},{"contributions":["PSI-CONTRIB-2021-RS-VOLE-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-SH","keywords":["two-party psi","vole_okvs_oprf","data-independent-setup"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise"},"attributes":{"adversary":{"locator":"Figure 6, p. 37","note":"OPRF outputs of \\( \\lambda + \\log n_X + \\log n_Y \\) bits","value":["semi_honest"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18; Theorem 4.1, p. 20","note":"In the F_vole-hybrid model, a hybrid model; covered by the malicious proofs, whose simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"§7.1, p. 25","note":"The VOLE cost is \\( o(n) \\), so the protocol suits large sets","value":"balanced"},"technique":{"locator":"§3, pp. 13–16; Figure 4, p. 36","value":["batched_oprf","vole","paxos"]}},"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16; §2, PaXoS details, p. 10","note":"One correlation per PaXoS position, the extra positions included","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( 2.4n_Y+d+\\lambda \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["data-independent-setup"],"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF"],"construction_family":"vole_okvs_oprf","costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37","measure":"communication","note":"The OPRF values of its items, and the coin toss's commitment and opening, one field element each","subject":"sender"},{"basis":"counted","formula":"\\( (2.4n_Y+d+\\lambda+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, PaXoS details, p. 10; Figure 1, parameters, p. 7","measure":"communication","note":"The PaXoS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( 2.4n_Y+d+\\lambda+n_X \\)","locator":"Figure 4, step 4 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37; Figure 1, p. 7","measure":"computation","note":"One product \\( A_i\\Delta \\) per PaXoS position for \\( K = B + A\\Delta \\), and one \\( \\Delta H_F(y) \\) per item; the binary-row decode is additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 3n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item a call to row, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-SH","name":"VOLE-PSI (semi-honest, PaXoS)","paper_ids":["PSI-PAPER-2021-RS"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the PaXoS's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36","phase":"online","what":"seed, coin-toss share and the PaXoS of its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"OPRF values of its items, in random order","with":"open"}],"security":{"mode":"computational","model":"semi-honest two-party, random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","notion":"PSI with output to the receiver"},"status":"published","title":"VOLE-PSI, semi-honest two-party PSI from a VOLE-based OPRF with a PaXoS encoding","variables":[{"meaning":"Bound on the 2-core of the PaXoS cuckoo graph, \\( O(\\lambda) \\) after PRTY20; the PaXoS has \\( 2.4n_Y + d + \\lambda \\) positions","symbol":"d"}],"work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"PSI from an OPRF built on VOLE: the receiver solves a PaXoS for its items, derandomizes a random VOLE of that length with one κ-bit element per position, and the sender evaluates the OPRF on its own set and sends the values. LPN-based VOLE makes the correlation cost sublinear.","heading":"Summary"}],"slug":"rs21-vole-psi-semi-honest","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"PSI from an OPRF built on VOLE: the receiver solves a PaXoS for its items, derandomizes a random VOLE of that length with one κ-bit element per position, and the sender evaluates the OPRF on its own set and sends the values. LPN-based VOLE makes the correlation cost sublinear.","title":"VOLE-PSI (semi-honest, PaXoS)","type":"construction","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RS-SH"},{"contributions":["PSI-CONTRIB-2021-RS-VOLE-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","keywords":["two-party psi","vole_okvs_oprf","data-independent-setup"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the vector-OLE hybrid model; VOLE from LPN with regular noise"},"attributes":{"adversary":{"locator":"Figure 6, p. 37","note":"OPRF outputs of \\( \\lambda + \\log n_X + \\log n_Y \\) bits","value":["semi_honest"]},"assumptions":{"locator":"§7.2, p. 26; §3.1, pp. 13–14","note":"LPN with regular noise, for the VOLE","value":["LPN"]},"output":{"locator":"Figure 6, p. 37","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 37; Figure 6, step 4, p. 37","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 6, p. 37","value":"two_party"},"security_model":{"locator":"Theorem 3.1, p. 16; Lemmas 3.2–3.3, pp. 16–18; Theorem 4.1, p. 20","note":"In the F_vole-hybrid model, a hybrid model; covered by the malicious proofs, whose simulators program H","value":["programmable random oracle"]},"set_size_regime":{"locator":"§7.1, p. 25","note":"The VOLE cost is \\( o(n) \\), so the protocol suits large sets","value":"balanced"},"technique":{"locator":"§3, p. 8; §7.1, p. 24","note":"The Vandermonde OKVS: the receiver interpolates a polynomial through its items","value":["batched_oprf","vole","okvs"]}},"blocks":[{"cites":[{"key":"SGRR19","title":"Distributed vector-OLE: Improved constructions and implementation"},{"key":"YWL+20","title":"Ferret: Fast extension for correlated OT with small communication"}],"func":"vole","id":"vole","implementation":"Extended VOLE of SGRR19, with the iterative bootstrapping of YWL+20","instantiation":"sgrr19_ywl20","locator":"Figure 4, step 3, p. 36; §7.1, p. 24; Theorem 3.1, p. 16","note":"One correlation per coefficient of the rate-one polynomial","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["data-independent-setup"],"claim_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF"],"construction_family":"vole_okvs_oprf","costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X+2\\kappa \\)","locator":"Figure 4, steps 1 and 5, p. 36; Figure 6, step 3 and parameters, p. 37","measure":"communication","note":"The OPRF values of its items, and the coin toss's commitment and opening, one field element each","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y+2)\\kappa \\)","locator":"Figure 4, step 4, p. 36; §2, The Vandermonde OKVS, p. 8","measure":"communication","note":"The polynomial masked by its VOLE share, one field element per coefficient, with the seed \\( r \\) and its coin-toss share","subject":"receiver"},{"basis":"counted","formula":"\\( O((n_X+n_Y)\\log^{2} n_Y) \\)","locator":"§3, p. 8; Figure 4, p. 36; Figure 6, p. 37","measure":"computation","note":"Products \\( A_i\\Delta \\) for \\( K = B + A\\Delta \\), multi-point evaluation of the polynomial \\( K \\) at its items, and one \\( \\Delta H_F(y) \\) per item","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X+1 \\)","locator":"Figure 4, step 1 and the sender's evaluation, p. 36; Figure 6, step 2, p. 37","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y\\log^{2} n_Y) \\)","locator":"§3, p. 8; §7.1, p. 24; Figure 6, p. 37","measure":"computation","note":"Fast interpolation of the polynomial through its items, then multi-point evaluation of its VOLE share \\( C \\) at them","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y+1 \\)","locator":"Figure 4, steps 2, 5 and 6, p. 36","measure":"computation","note":"Per item \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","name":"VOLE-PSI (semi-honest, interpolation)","paper_ids":["PSI-PAPER-2021-RS"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"commit","locator":"Figure 4, step 1, p. 36; Figure 6, step 1, p. 37","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"Figure 4, step 3, p. 36; §7.1, p. 25","phase":"offline","what":"random VOLE of the polynomial's dimension, preprocessed before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"Figure 4, steps 2 and 4, p. 36; §2, The Vandermonde OKVS, p. 8","phase":"online","what":"seed, coin-toss share and the polynomial through its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 6, steps 2–3, p. 37; Figure 4, the sender's evaluation, p. 36","phase":"online","what":"OPRF values of its items, in random order","with":"open"}],"security":{"mode":"computational","model":"semi-honest two-party, random oracle model, F_vole-hybrid (Theorem 3.1, p. 16; Theorem 4.1, p. 20)","notion":"PSI with output to the receiver"},"status":"published","title":"VOLE-PSI, semi-honest two-party PSI from a VOLE-based OPRF with a rate-1 polynomial-interpolation encoding","work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"The semi-honest VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interpolation cost.","heading":"Summary"}],"slug":"rs21-vole-psi-semi-honest-2","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"The semi-honest VOLE-PSI with the PaXoS encoding replaced by polynomial interpolation, an OKVS of rate one: the receiver's encoding shrinks from about \\( 2.4\\kappa \\) to \\( \\kappa \\) bits per item, at quasi-linear interpolation cost.","title":"VOLE-PSI (semi-honest, interpolation)","type":"construction","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION"},{"contributions":["PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RT-MAL","keywords":["two-party psi","key_agreement_polynomial_encoding","low-communication","small-sets"],"metadata":{"assumption":{"family":"discrete_log","name":"oracle Diffie-Hellman with elligator encoding, ideal permutation, and random oracles"},"attributes":{"adversary":{"locator":"Lemmas 5-7, pp. 10-14; §4.1, pp. 15-16","note":"UC security against either party; a corrupt receiver may use a somewhat larger set than advertised.","value":["malicious"]},"assumptions":{"locator":"§1.2, PDF p. 5; §3.2, PDF p. 9","note":"For non-malleable hashed Diffie-Hellman","value":["ODH"]},"output":{"locator":"Figure 2, p. 6","value":["intersection"]},"output_to":{"locator":"Figure 2, p. 6; Figure 4, p. 11","note":"The receiver.","value":"one"},"parties":{"locator":"Figure 2, p. 6","value":"two_party"},"security_model":{"locator":"Abstract, p. 1; §2.4, p. 7; Lemma 5, p. 10","note":"The ideal permutation model with random oracles.","value":["random permutation","random oracle"]},"set_size_regime":{"locator":"Figure 4, p. 11","value":"balanced"},"technique":{"locator":"Figure 4, p. 11; §5.1, p. 16","value":["key_agreement","diffie_hellman"]}},"capabilities":["low-communication","small-sets"],"claim_ids":["PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI"],"construction_family":"key_agreement_polynomial_encoding","costs":[{"basis":"counted","formula":"\\( |\\mathbb{G}| + 2\\kappa n_X \\)","locator":"Table 1, p. 4; §4, p. 15","measure":"communication","note":"One key-agreement message and one hash output per item.","subject":"sender"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{F}| \\)","locator":"Table 1, p. 4; §4, p. 15","measure":"communication","note":"The polynomial, over a field the size of an encoded group element.","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + 1 \\)","locator":"§4, p. 15","measure":"computation","note":"One key-agreement message and one key per item.","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 4, step 5, p. 11; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 4, step 5, p. 11; §3.2, p. 8","measure":"computation","note":"Per item: the first random oracle, the permutation, the hash of the Diffie-Hellman key, then the second random oracle","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"§4, p. 15; §3.2, p. 9","measure":"computation","note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 4, step 4, p. 11; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Interpolation of the polynomial through its points, by the fast algorithms the paper uses","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 4, steps 3, 4 and 7, p. 11; §3.2, p. 8","measure":"computation","note":"Per item: the inverse permutation, the first random oracle, the hash of the Diffie-Hellman key, then the second random oracle","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RT-MAL","name":"RT21 malicious","paper_ids":["PSI-PAPER-2021-RT"],"primitive":"two-party PSI","schedule":[{"from":"receiver","id":"poly","locator":"Figure 4, steps 3-4, p. 11; §3.2, p. 8; §4, Optimizations, p. 15","phase":"online","what":"the polynomial P; its Diffie-Hellman responses do not use m"},{"after":["poly"],"from":"sender","id":"keys","locator":"Figure 4, steps 5-6, p. 11","phase":"online","what":"the shuffled H_2 outputs K"},{"from":"sender","id":"ka","locator":"Figure 4, step 2, p. 11; §4, Optimizations, p. 15","phase":"online","what":"the key-agreement message m, combined with K","with":"keys"}],"security":{"mode":"computational","model":"malicious, UC, ideal permutation plus random oracle model (abstract, p. 1; Lemmas 5-7, pp. 10-14; §4.1, pp. 15-16)","notion":"PSI with output to the receiver; a corrupt receiver may input more than \\( n \\) items (\\( n' < 8n + 4 \\) for \\( n = 2^{10} \\), \\( |F| = 2^{256} \\))"},"status":"published","title":"Rosulek-Trieu malicious PSI from hashed elliptic-curve Diffie-Hellman with polynomial-encoded responses","work_id":"PSI-PAPER-2021-RT","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1159","sections":[{"content":"Malicious PSI from a key agreement with pseudorandom, non-malleable messages: the sender sends one Diffie-Hellman message, the receiver encodes its responses through an ideal permutation as a polynomial at hashed items, and the sender returns hashes of the keys it derives at its own items.","heading":"Summary"}],"slug":"rt21-rt21-malicious","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"Malicious PSI from a key agreement with pseudorandom, non-malleable messages: the sender sends one Diffie-Hellman message, the receiver encodes its responses through an ideal permutation as a polynomial at hashed items, and the sender returns hashes of the keys it derives at its own items.","title":"RT21 malicious","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RT-MAL"},{"contributions":["PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RT-SH-V1","keywords":["two-party psi","key_agreement_polynomial_encoding","low-communication","small-sets"],"metadata":{"assumption":{"family":"discrete_log","name":"CDH with elligator encoding, ideal permutation, and random oracles"},"attributes":{"adversary":{"locator":"Lemmas 11-12, pp. 24-25","value":["semi_honest"]},"assumptions":{"locator":"Table 1, p. 4; §3.2, pp. 8-9; Lemmas 11-12, pp. 24-25","note":"Hashed Diffie-Hellman is a secure key agreement under CDH with a random oracle; elligator makes the messages pseudorandom.","value":["CDH"]},"output":{"locator":"Figure 5, p. 24","value":["intersection"]},"output_to":{"locator":"Figure 5, p. 24","note":"The receiver.","value":"one"},"parties":{"locator":"Figure 2, p. 6","value":"two_party"},"security_model":{"locator":"Lemmas 11-12, pp. 24-25; §3.2, p. 8","note":"The ideal permutation model; the random oracle hashes the Diffie-Hellman key.","value":["random permutation","random oracle"]},"set_size_regime":{"locator":"Figure 5, p. 24","value":"balanced"},"technique":{"locator":"Figure 5, p. 24; §3.2, p. 8","value":["key_agreement","diffie_hellman"]}},"capabilities":["low-communication","small-sets"],"claim_ids":["PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"],"construction_family":"key_agreement_polynomial_encoding","costs":[{"basis":"counted","formula":"\\( |\\mathbb{G}| + (\\lambda + \\log(n_Xn_Y))n_X \\)","locator":"Table 1, p. 4; Figure 5, p. 24","measure":"communication","note":"One key-agreement message and one short key per item.","subject":"sender"},{"basis":"counted","formula":"\\( n_Y|\\mathbb{F}| \\)","locator":"Table 1, p. 4; Figure 5, p. 24","measure":"communication","note":"The polynomial, over a field the size of an encoded group element.","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + 1 \\)","locator":"Figure 5, p. 24; §4, p. 15","measure":"computation","note":"One key-agreement message and one key per item.","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 5, step 5, p. 24; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_X \\)","locator":"Figure 5, step 5, p. 24; §3.2, p. 8","measure":"computation","note":"Per item, the permutation and the hash of the Diffie-Hellman key","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 5, p. 24; §3.2, p. 9","measure":"computation","note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 5, step 4, p. 24; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Interpolation of the polynomial through its points, by the fast algorithms the paper uses","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 5, steps 3 and 7, p. 24; §3.2, p. 8","measure":"computation","note":"Per item, the inverse permutation and the hash of the Diffie-Hellman key","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RT-SH-V1","name":"RT21 semi-honest variant 1","paper_ids":["PSI-PAPER-2021-RT"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"ka","locator":"Figure 5, step 2, p. 24","phase":"online","what":"the key-agreement message m"},{"from":"receiver","id":"poly","locator":"Figure 5, steps 3-4, p. 24; §3.2, p. 8","phase":"online","what":"the polynomial P; its Diffie-Hellman responses do not use m"},{"after":["poly"],"from":"sender","id":"keys","locator":"Figure 5, steps 5-6, p. 24","phase":"online","what":"the shuffled keys K, from P evaluated at its items"}],"security":{"mode":"computational","model":"semi-honest; ideal permutation; hashed Diffie-Hellman in the random oracle model under CDH (Lemmas 11-12, pp. 24-25; §3.2, p. 8; Table 1, p. 4)","notion":"PSI with output to the receiver"},"status":"published","title":"Rosulek-Trieu semi-honest PSI, variant 1, from hashed Diffie-Hellman with an ideal permutation","work_id":"PSI-PAPER-2021-RT","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1159","sections":[{"content":"Semi-honest variant of the key-agreement PSI: the receiver interpolates its Diffie-Hellman responses, through an inverse ideal permutation, at its plain items, and the sender returns keys shortened to the statistical parameter plus twice the log of the set size.","heading":"Summary"}],"slug":"rt21-rt21-semi-honest-variant","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"Semi-honest variant of the key-agreement PSI: the receiver interpolates its Diffie-Hellman responses, through an inverse ideal permutation, at its plain items, and the sender returns keys shortened to the statistical parameter plus twice the log of the set size.","title":"RT21 semi-honest variant 1","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RT-SH-V1"},{"contributions":["PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RT-SH-V2","keywords":["two-party psi","key_agreement_polynomial_encoding","low-communication","no-ideal-permutation"],"metadata":{"assumption":{"family":"discrete_log","name":"oracle Diffie-Hellman with elligator encoding and random oracles"},"attributes":{"adversary":{"locator":"Appendix A.2, p. 26; Lemma 13, p. 27","value":["semi_honest"]},"assumptions":{"locator":"§1.2, PDF p. 5; §3.2, PDF p. 9","note":"For non-malleable hashed Diffie-Hellman","value":["ODH"]},"output":{"locator":"Figure 6, p. 26","value":["intersection"]},"output_to":{"locator":"Figure 6, p. 26","note":"The receiver.","value":"one"},"parties":{"locator":"Figure 2, p. 6","value":"two_party"},"security_model":{"locator":"Appendix A.2, p. 26; Lemma 13, p. 27; §3.2, p. 9","note":"No ideal permutation.","value":["random oracle"]},"set_size_regime":{"locator":"Figure 6, p. 26","value":"balanced"},"technique":{"locator":"Figure 6, p. 26","value":["key_agreement","diffie_hellman"]}},"capabilities":["low-communication","no-ideal-permutation"],"claim_ids":["PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"],"construction_family":"key_agreement_polynomial_encoding","costs":[{"basis":"counted","formula":"\\( |\\mathbb{G}| + (\\lambda + \\log(n_Xn_Y))n_X \\)","locator":"Table 1, p. 4; Figure 6, p. 26","measure":"communication","note":"One key-agreement message and one short key per item.","subject":"sender"},{"basis":"counted","formula":"\\( (n_Y + 1)|\\mathbb{F}| \\)","locator":"Table 1, p. 4; Figure 6, p. 26","measure":"communication","note":"The polynomial, one degree larger for the random point \\( P(0) = R \\).","subject":"receiver"},{"basis":"counted","formula":"\\( n_X + 1 \\)","locator":"Figure 6, p. 26; §4, p. 15","measure":"computation","note":"One key-agreement message and one key per item.","operation":"exponentiation","subject":"sender"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 6, step 5, p. 26; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Multi-point evaluation of the polynomial at its items, by the fast algorithms the paper uses","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( n_X \\)","locator":"Figure 6, step 5, p. 26; §3.2, p. 8","measure":"computation","note":"The hash of the Diffie-Hellman key of each item","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( 2n_Y \\)","locator":"Figure 6, p. 26; §3.2, p. 9","measure":"computation","note":"One key-agreement response and one key per item; elligator encoding adds expected retries.","operation":"exponentiation","subject":"receiver"},{"basis":"counted","formula":"\\( O(n\\log^2 n) \\)","locator":"Figure 6, step 4, p. 26; §2.3, pp. 6-7; §4, Costs, p. 15","measure":"computation","note":"Interpolation of the polynomial through its points and the random point at zero, by the fast algorithms the paper uses","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( n_Y \\)","locator":"Figure 6, step 7, p. 26; §3.2, p. 8","measure":"computation","note":"The hash of the Diffie-Hellman key of each item","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2021-RT-SH-V2","name":"RT21 semi-honest variant 2","paper_ids":["PSI-PAPER-2021-RT"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"ka","locator":"Figure 6, step 2, p. 26","phase":"online","what":"the key-agreement message m"},{"from":"receiver","id":"poly","locator":"Figure 6, steps 3-4, p. 26; §3.2, p. 8","phase":"online","what":"the polynomial P; its Diffie-Hellman responses do not use m"},{"after":["poly"],"from":"sender","id":"keys","locator":"Figure 6, steps 5-6, p. 26","phase":"online","what":"the shuffled keys K, from P evaluated at its items"}],"security":{"mode":"computational","model":"semi-honest; non-malleable key agreement with pseudorandom second messages, which for hashed Diffie-Hellman is the oracle Diffie-Hellman assumption (Lemma 13, p. 27; §3.2, p. 9; Table 1, p. 4)","notion":"PSI with output to the receiver"},"status":"published","title":"Rosulek-Trieu semi-honest PSI, variant 2, from non-malleable hashed Diffie-Hellman without an ideal permutation","work_id":"PSI-PAPER-2021-RT","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1159","sections":[{"content":"Semi-honest key-agreement PSI without an ideal permutation: the receiver interpolates its Diffie-Hellman responses directly at its items and adds a random point at zero, which lets the simulator program one evaluation at a time.","heading":"Summary"}],"slug":"rt21-rt21-semi-honest-variant-2","status":"fulltext_checked","subtitle":"two-party PSI · 2021","summary":"Semi-honest key-agreement PSI without an ideal permutation: the receiver interpolates its Diffie-Hellman responses directly at its items and adds a random point at zero, which lets the simulator program one evaluation at a time.","title":"RT21 semi-honest variant 2","type":"construction","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2021-RT-SH-V2"},{"contributions":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-CIRCUIT-PSI","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","keywords":["circuit-psi","opprf_cuckoo_circuit","secret-shared-output"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the OPPRF and generic two-party computation hybrid models; Silver for silent OT and VOLE"},"attributes":{"adversary":{"locator":"§4, p. 23; Table 2, p. 25","value":["semi_honest"]},"assumptions":{"locator":"Table 2, p. 25; §4, p. 22","note":"No assumption is named; Silver supplies the VOLE and OT correlations","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"§1, p. 2; §4, p. 23","value":["circuit"]},"output_to":{"locator":"§1, p. 2; §4, p. 23","note":"Both parties hold secret shares, as in the VOLE-PSI circuit-PSI","value":"shared"},"parties":{"locator":"§4, p. 23","value":"two_party"},"security_model":{"locator":"RS21 Theorem 5.1, p. 21; §4, p. 23","note":"Inherited from the VOLE-PSI circuit-PSI, with the OKVS in its doubly oblivious form","source":"PSI-PAPER-2021-RS","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 2, p. 25","value":"balanced"},"technique":{"locator":"§4, p. 23; Table 2, p. 25","value":["opprf","batched_oprf","vole","okvs","cuckoo_hashing","simple_hashing"]}},"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"vole","id":"vole","implementation":"silent VOLE (Silver)","instantiation":"silver","locator":"§4, p. 23; Table 2, p. 25; RS21 Figure 8, step 1, p. 38; RS21 Figure 4, step 3, p. 36","note":"For the OPRF's OKVS over the receiver's cuckoo bins, one correlation per position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( e\\epsilon n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[],"func":"two_pc","id":"two_pc","locator":"§4, p. 23; RS21 Figure 10, step 5, p. 39; RS21 §6, p. 23","note":"One equality test of the bin values per bin, as in VOLE-PSI; the paper names only Silver for the row","params":{"depth":"\\( \\lceil\\log_2(\\lambda+\\log_2(\\epsilon n_Y))\\rceil \\)","|C|":"\\( \\epsilon n_Y(\\lambda+\\log_2(\\epsilon n_Y)-1) \\)"},"roles":{"party":["sender","receiver"]}}],"capabilities":["secret-shared-output"],"claim_ids":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-CIRCUIT-PSI"],"construction_family":"opprf_cuckoo_circuit","costs":[{"basis":"counted","formula":"\\( 3e(\\lambda+\\log_2(\\epsilon n_Y))n_X+2\\kappa \\)","locator":"RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; RS21 Figure 4, steps 1 and 5, p. 36; §4, p. 23; Figure 1, step 5, p. 7","measure":"communication","note":"The OPPRF table, this paper's doubly oblivious OKVS over its items in their three bins, and the coin toss's commitment and opening","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( (e\\epsilon n_Y+2)\\kappa \\)","locator":"RS21 Figure 4, step 4, p. 36; RS21 Figure 10, step 4, p. 39; §4, p. 23","measure":"communication","note":"The OPRF's OKVS over its cuckoo bins, one field element per position, with the seed \\( r \\) and its coin-toss share","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( e\\epsilon n_Y+O(n_X) \\)","locator":"RS21 Figure 4, step 4 and the sender's evaluation, p. 36; RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; §2, p. 6; §2, Field row, p. 8","measure":"computation","note":"One product per OKVS position for \\( K = B + A\\Delta \\); per table entry \\( \\Delta H_F(y) \\) and the OPRF decode's products with the field-valued dense columns","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( 24n_X+1 \\)","locator":"RS21 Figure 10, steps 2–3, p. 39; RS21 Figure 8, step 2, p. 38; RS21 Figure 4, p. 36; Figure 1, step 1, p. 7","measure":"computation","note":"Simple hashing with three functions; per table entry the two row functions, \\( H_F \\) and \\( H \\) for the OPRF, and the row functions for the table","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"RS21 Figure 4, p. 36; RS21 Figure 8, step 3, p. 38; RS21 Figure 10, step 1, p. 39; §2, p. 6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns in encoding the OPRF's OKVS over its bins and in decoding it at each bin","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( (7\\epsilon+4)n_Y+1 \\)","locator":"RS21 Figure 10, steps 1 and 4, p. 39; RS21 Figure 4, steps 2, 5 and 6, p. 36; RS21 Figure 8, step 3, p. 38; Figure 1, step 1, p. 7","measure":"computation","note":"Cuckoo hashing, the bin labels, then per bin the row functions, \\( H_F \\) and \\( H \\) for the OPRF, and the row functions for the table","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","name":"Raghuraman-Rindal circuit-PSI","paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"primitive":"circuit-PSI","schedule":[{"from":"sender","id":"commit","locator":"RS21 Figure 4, step 1, p. 36; RS21 Figure 8, step 1, p. 38; RS21 Figure 10, step 4, p. 39","phase":"online","what":"commitment to its coin-toss share, the first flow of the OPRF inside the OPPRF"},{"blocks":["vole"],"id":"vole","locator":"RS21 Figure 4, step 3, p. 36; RS21 Figure 8, step 1, p. 38; §4, p. 23","phase":"offline","what":"random VOLE for the OPRF's encoding of the cuckoo bins, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"RS21 Figure 10, steps 1 and 4, p. 39; RS21 Figure 4, steps 2 and 4, p. 36; §4, p. 23","phase":"online","what":"seed, coin-toss share and the OPRF's encoding of its bin labels, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"RS21 Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"table","locator":"RS21 Figure 8, step 2, p. 38; RS21 Figure 10, steps 2–4, p. 39; §4, p. 23","phase":"online","what":"the OPPRF table, programming each bin's random value at its items","with":"open"},{"after":["open","table"],"blocks":["two_pc"],"id":"cmp","locator":"RS21 Figure 10, step 5, p. 39; §4, p. 23","phase":"online","what":"2PC comparison of each bin's two values into secret shares"}],"security":{"mode":"computational","model":"semi-honest two-party, by reference to the circuit-PSI of PSI-PAPER-2021-RS (§4, p. 23)","notion":"circuit-PSI with secret-shared output"},"status":"published","title":"VOLE-PSI circuit-PSI with the doubly oblivious triangulation OKVS and Silver, semi-honest","variables":[{"meaning":"Cuckoo-table expansion: \\( \\epsilon n_Y \\) bins","symbol":"\\epsilon"},{"meaning":"OKVS expansion: an OKVS over \\( k \\) items has \\( ek \\) positions; not stated for this row (the paper's PSI rows use about 1.23 unclustered and 1.28 clustered)","symbol":"e"}],"work_id":"PSI-PAPER-2022-RR","year":2022},"primaryUrl":"https://eprint.iacr.org/2022/320","sections":[{"content":"The VOLE-PSI circuit-PSI with the row-weight-3 triangulation OKVS in its doubly oblivious form and Silver for the VOLE and OT correlations. The paper describes it only through VOLE-PSI and one benchmark row.","heading":"Summary"}],"slug":"rr22-raghuraman-rindal-circuit-ps","status":"fulltext_checked","subtitle":"circuit-PSI · 2022","summary":"The VOLE-PSI circuit-PSI with the row-weight-3 triangulation OKVS in its doubly oblivious form and Silver for the VOLE and OT correlations. The paper describes it only through VOLE-PSI and one benchmark row.","title":"Raghuraman-Rindal circuit-PSI","type":"construction","venue":"ACM CCS 2022","year":2022,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2022-RR-CIRCUIT"},{"contributions":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-FAST","keywords":["two-party psi","vole_okvs_oprf","multi-threaded"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019"},"attributes":{"adversary":{"locator":"Theorem 3, p. 33","value":["semi_honest"]},"assumptions":{"locator":"§4, p. 22","note":"No assumption is named; the VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"Figure 9, p. 23","value":["intersection"]},"output_to":{"locator":"Figure 9, step 5, p. 23","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 9, p. 23","value":"two_party"},"security_model":{"locator":"Theorem 3, p. 33; Figure 9, p. 23","note":"In the F_sub-vole-hybrid model, a hybrid model, with random oracles H_B and H_o","value":["random oracle"]},"set_size_regime":{"locator":"Figure 9, p. 23","value":"balanced"},"technique":{"locator":"§4, pp. 22–23; Figure 9, p. 23","value":["batched_oprf","vole","okvs"]}},"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"vole","id":"vole","implementation":"silent VOLE (Silver)","instantiation":"silver","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","note":"Invoked as subfield VOLE with the base field equal to its extension, which is VOLE","params":{"\\mathbb{F}":"\\( \\mathbb{F}_{2^{\\kappa}} \\)","m":"\\( \\approx 1.28n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["multi-threaded"],"claim_ids":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"construction_family":"vole_okvs_oprf","costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X \\)","locator":"Figure 9, step 4 and parameters, p. 23; §4, p. 22","measure":"communication","note":"The OPRF values of the sender's items","subject":"sender"},{"basis":"counted","formula":"\\( 1.28\\kappa n_Y+2\\kappa \\)","locator":"Figure 9, steps 1, 3 and 4, p. 23; §4, p. 22","measure":"communication","note":"The OKVS correction, one field element per position, with the seeds \\( r \\) and \\( r' \\); the figure omits sending \\( r' \\), which the sender needs","subject":"receiver"},{"basis":"counted","formula":"\\( 1.28n_Y+O(n_X) \\)","locator":"Figure 9, steps 3–4, p. 23; Figure 1, p. 7; §4, p. 22; §2, Field row, p. 8","measure":"computation","note":"One product per OKVS position for \\( B' = B + A'\\Delta \\); per item \\( \\Delta H_B(y) \\) and the decode's products with the field-valued dense columns","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 9, step 4, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_B \\) and \\( H_o \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"Figure 9, steps 1, 3 and 5, p. 23; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns: their powers, the gap's elimination and back-substitution in encoding, and the decodes at its items","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 9, steps 1 and 5, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item \\( H_B \\), the two row functions and \\( H_o \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-FAST","name":"Raghuraman-Rindal PSI (semi-honest, fast)","paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"primitive":"two-party PSI","schedule":[{"blocks":["vole"],"id":"vole","locator":"Figure 9, step 2, p. 23","phase":"offline","what":"random VOLE of the OKVS's dimension, before the sets"},{"after":["vole"],"from":"receiver","id":"okvs","locator":"Figure 9, steps 1 and 3, p. 23","phase":"online","what":"OKVS seed r, the seed r′ the figure omits, and the OKVS correction"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 9, step 4, p. 23","phase":"online","what":"OPRF values of its items, in random order"}],"security":{"mode":"computational","model":"semi-honest two-party, random oracle model, F_sub-vole-hybrid (Theorem 3, p. 33)","notion":"PSI with output to the receiver"},"status":"published","title":"Fast instantiation of VOLE-based semi-honest PSI with the triangulation OKVS (row weight 3, clustered)","work_id":"PSI-PAPER-2022-RR","year":2022},"primaryUrl":"https://eprint.iacr.org/2022/320","sections":[{"content":"VOLE-PSI with the triangulation OKVS of row weight 3, clustered for speed, and no subfield: the receiver derandomizes a VOLE into its OKVS and the sender sends OPRF values. The new OKVS encodes in near-linear time with only a few dense columns.","heading":"Summary"}],"slug":"rr22-raghuraman-rindal-psi-semi","status":"fulltext_checked","subtitle":"two-party PSI · 2022","summary":"VOLE-PSI with the triangulation OKVS of row weight 3, clustered for speed, and no subfield: the receiver derandomizes a VOLE into its OKVS and the sender sends OPRF values. The new OKVS encodes in near-linear time with only a few dense columns.","title":"Raghuraman-Rindal PSI (semi-honest, fast)","type":"construction","venue":"ACM CCS 2022","year":2022,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2022-RR-FAST"},{"contributions":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","PSI-CONTRIB-2021-RS-CIRCUIT-PSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-MAL","keywords":["two-party psi","vole_okvs_oprf","multi-threaded"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the vector-OLE hybrid model (malicious protocol of VOLE-PSI)"},"attributes":{"adversary":{"locator":"§4, p. 23","note":"Through the malicious VOLE-PSI protocol; no separate proof for the new OKVS","value":["malicious"]},"assumptions":{"locator":"§4, pp. 22–23","note":"No assumption is named; the VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"§4, p. 23","value":["intersection"]},"output_to":{"locator":"§4, p. 23","note":"Receiver only, as in the VOLE-PSI protocol","value":"one"},"parties":{"locator":"§4, p. 23","value":"two_party"},"security_model":{"locator":"RS21 Theorem 3.1, p. 16; §4, p. 23","note":"Inherited from VOLE-PSI, whose simulators program H in the F_vole-hybrid model","source":"PSI-PAPER-2021-RS","value":["programmable random oracle"]},"set_size_regime":{"locator":"Table 2, p. 25","value":"balanced"},"technique":{"locator":"§4, p. 23","value":["batched_oprf","vole","okvs"]}},"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"vole","id":"vole","implementation":"silent VOLE (Silver)","instantiation":"silver_mal","locator":"§4, pp. 22–23; RS21 Figure 4, step 3, p. 36; RS21 Theorem 3.1, p. 16","note":"The malicious VOLE-PSI protocol with this paper's OKVS, one correlation per OKVS position","params":{"\\mathbb{F}":"\\( |\\mathbb{F}| \\approx \\kappa \\)","m":"\\( en_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["multi-threaded"],"claim_ids":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"],"construction_family":"vole_okvs_oprf","costs":[{"basis":"counted","formula":"\\( \\kappa n_X+2\\kappa \\)","locator":"RS21 Figure 4, steps 1 and 5, p. 36; RS21 Figure 6, step 3, p. 37; §4, p. 23","measure":"communication","note":"OPRF values of \\( \\kappa \\) bits, and the coin toss's commitment and opening","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( (en_Y+2)\\kappa \\)","locator":"RS21 Figure 4, step 4, p. 36; §4, p. 23; Figure 1, p. 7","measure":"communication","note":"This paper's OKVS masked by its VOLE share, one field element per position, with the seed \\( r \\) and its coin-toss share","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( en_Y+O(n_X) \\)","locator":"RS21 Figure 4, step 4 and the sender's evaluation, p. 36; §4, p. 23; Figure 1, p. 7; §2, Field row, p. 8","measure":"computation","note":"One product per OKVS position for \\( K = B + A\\Delta \\); per item \\( \\Delta H_F(y) \\) and the decode's products with the field-valued dense columns","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X+1 \\)","locator":"RS21 Figure 4, step 1 and the sender's evaluation, p. 36; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_F \\) and \\( H \\); one \\( H_F \\) for the commitment","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"RS21 Figure 4, steps 2, 4 and 6, p. 36; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns in encoding the OKVS and in decoding its VOLE share at its items","operation":"field_op","source":"PSI-PAPER-2021-RS","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y+1 \\)","locator":"RS21 Figure 4, steps 2, 5 and 6, p. 36; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_F \\) and \\( H \\); one \\( H_F \\) to check the opening","operation":"symmetric_op","source":"PSI-PAPER-2021-RS","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-MAL","name":"Raghuraman-Rindal PSI (malicious)","paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"primitive":"two-party PSI","schedule":[{"from":"sender","id":"commit","locator":"RS21 Figure 4, step 1, p. 36; RS21 Figure 6, step 1, p. 37; §4, p. 23","phase":"online","what":"commitment to its coin-toss share"},{"blocks":["vole"],"id":"vole","locator":"RS21 Figure 4, step 3, p. 36; RS21 §7.1, p. 25; §4, p. 23","phase":"offline","what":"random VOLE of the OKVS's dimension, before the sets"},{"after":["commit","vole"],"from":"receiver","id":"okvs","locator":"RS21 Figure 4, steps 2 and 4, p. 36; §4, p. 23","phase":"online","what":"seed, coin-toss share and this paper's OKVS of its items, masked by its VOLE share"},{"after":["okvs"],"from":"sender","id":"open","locator":"RS21 Figure 4, step 5, p. 36","phase":"online","what":"opening of its coin-toss share"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"RS21 Figure 6, steps 2–3 and parameters, p. 37; RS21 Figure 4, the sender's evaluation, p. 36","phase":"online","what":"\\( \\kappa \\)-bit OPRF values of its items, in random order","with":"open"}],"security":{"mode":"computational","model":"malicious two-party, via the VOLE-PSI proofs (§4, p. 23)","notion":"PSI with output to the receiver; a corrupt receiver may use a larger set"},"status":"published","title":"Malicious VOLE-PSI with the triangulation OKVS","variables":[{"meaning":"OKVS expansion: the receiver's OKVS has \\( en_Y \\) positions; not stated for this row (Table 2 prints 1.3; the fast instantiation has about 1.28)","symbol":"e"}],"work_id":"PSI-PAPER-2022-RR","year":2022},"primaryUrl":"https://eprint.iacr.org/2022/320","sections":[{"content":"The malicious VOLE-PSI protocol of Rindal and Schoppmann run with the triangulation OKVS in place of PaXoS. The authors observe almost no overhead over their semi-honest protocol.","heading":"Summary"}],"slug":"rr22-raghuraman-rindal-psi-malici","status":"fulltext_checked","subtitle":"two-party PSI · 2022","summary":"The malicious VOLE-PSI protocol of Rindal and Schoppmann run with the triangulation OKVS in place of PaXoS. The authors observe almost no overhead over their semi-honest protocol.","title":"Raghuraman-Rindal PSI (malicious)","type":"construction","venue":"ACM CCS 2022","year":2022,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2022-RR-MAL"},{"contributions":["PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-SD","keywords":["two-party psi","subfield_vole_okvs","multi-threaded"],"metadata":{"assumption":{"family":"idealized_model","name":"Random oracles, in the subfield-VOLE hybrid model; VOLE following Couteau-Rindal-Raghuraman 2021 and Boyle et al. 2019"},"attributes":{"adversary":{"locator":"Theorem 3, p. 33","value":["semi_honest"]},"assumptions":{"locator":"§4, p. 22","note":"No assumption is named; the subfield VOLE follows Couteau-Rindal-Raghuraman (Silver) and Boyle et al.","value":"not_reported","warning":"The Silver codes behind its VOLE were later shown to have far lower minimum distance than conjectured, which enables attacks; their authors advise against them"},"output":{"locator":"Figure 9, p. 23","value":["intersection"]},"output_to":{"locator":"Figure 9, step 5, p. 23","note":"Receiver only","value":"one"},"parties":{"locator":"Figure 9, p. 23","value":"two_party"},"security_model":{"locator":"Theorem 3, p. 33; Figure 9, p. 23","note":"In the F_sub-vole-hybrid model, a hybrid model, with random oracles H_B and H_o","value":["random oracle"]},"set_size_regime":{"locator":"Figure 9, p. 23","value":"balanced"},"technique":{"locator":"§4, pp. 22–23; Figure 9, p. 23","value":["batched_oprf","subfield_vole","okvs"]}},"blocks":[{"cites":[{"key":"CRR21","title":"Silver: Silent VOLE and oblivious transfer from hardness of decoding structured LDPC codes"},{"key":"BCG+19","title":"Efficient two-round OT extension and silent non-interactive secure computation"}],"func":"sub_vole","id":"sub_vole","implementation":"silent subfield VOLE (Silver)","instantiation":"silver_sub","locator":"Figure 9, step 2, p. 23; §4, p. 22; Theorem 3, p. 33","note":"The smallest base field and the smallest extension meeting these bounds","params":{"\\mathbb{B}":"\\( |\\mathbb{B}| \\ge \\lambda+\\log(n_Xn_Y) \\)","\\mathbb{F}":"\\( |\\mathbb{F}| \\ge \\kappa \\)","m":"\\( 1.23n_Y \\)"},"roles":{"receiver":"receiver","sender":"sender"}}],"capabilities":["multi-threaded"],"claim_ids":["PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"construction_family":"subfield_vole_okvs","costs":[{"basis":"counted","formula":"\\( (\\lambda+\\log(n_Xn_Y))n_X \\)","locator":"Figure 9, step 4 and parameters, p. 23; §4, p. 22","measure":"communication","note":"The OPRF values of the sender's items","subject":"sender"},{"basis":"counted","formula":"\\( 1.23(\\lambda+\\log(n_Xn_Y))n_Y+2\\kappa \\)","locator":"Figure 9, steps 1, 3 and 4, p. 23; §4, p. 22; Theorem 3, p. 33","measure":"communication","note":"The OKVS correction, one base-field element per position, with the seeds \\( r \\) and \\( r' \\); the figure omits sending \\( r' \\), which the sender needs","subject":"receiver"},{"basis":"counted","formula":"\\( 1.23n_Y+O(n_X) \\)","locator":"Figure 9, steps 3–4, p. 23; Figure 1, p. 7; §4, p. 22; §2, Field row, p. 8","measure":"computation","note":"One base-by-extension product per OKVS position for \\( B' = B + A'\\Delta \\); per item \\( \\Delta H_B(y) \\) and the decode's dense-column products","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( 4n_X \\)","locator":"Figure 9, step 4, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item the two row functions, \\( H_B \\) and \\( H_o \\)","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( O(n_Y) \\)","locator":"Figure 9, steps 1, 3 and 5, p. 23; Figure 1, p. 7; §2, pp. 5–6; §2, Field row, p. 8","measure":"computation","note":"Products with the field-valued dense columns: their powers, the gap's elimination and back-substitution in encoding, and the decodes at its items","operation":"field_op","subject":"receiver"},{"basis":"counted","formula":"\\( 4n_Y \\)","locator":"Figure 9, steps 1 and 5, p. 23; Figure 1, step 1, p. 7","measure":"computation","note":"Per item \\( H_B \\), the two row functions and \\( H_o \\)","operation":"symmetric_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2022-RR-SD","name":"Raghuraman-Rindal PSI (semi-honest, subfield VOLE)","paper_ids":["PSI-PAPER-2022-RR","PSI-PAPER-2021-RS"],"primitive":"two-party PSI","schedule":[{"blocks":["sub_vole"],"id":"sub_vole","locator":"Figure 9, step 2, p. 23","phase":"offline","what":"random subfield VOLE of the OKVS's dimension, before the sets"},{"after":["sub_vole"],"from":"receiver","id":"okvs","locator":"Figure 9, steps 1 and 3, p. 23","phase":"online","what":"OKVS seed r, the seed r′ the figure omits, and the OKVS correction over the base field"},{"after":["okvs"],"from":"sender","id":"oprf","locator":"Figure 9, step 4, p. 23","phase":"online","what":"OPRF values of its items, in random order"}],"security":{"mode":"computational","model":"semi-honest two-party, random oracle model, F_sub-vole-hybrid (Theorem 3, p. 33)","notion":"PSI with output to the receiver"},"status":"published","title":"Low-communication instantiation of semi-honest PSI with subfield VOLE and the triangulation OKVS (row weight 3, no clustering)","work_id":"PSI-PAPER-2022-RR","year":2022},"primaryUrl":"https://eprint.iacr.org/2022/320","sections":[{"content":"VOLE-PSI over subfield VOLE: the OKVS lives in a base field just large enough to avoid false matches, about \\( \\lambda + \\log(n_X n_Y) \\) bits, while the VOLE key is in a \\( 2^{\\kappa} \\) extension, so communication is \\( O(n\\lambda + n \\log n) \\). The OKVS is the unclustered row-weight-3 triangulation scheme.","heading":"Summary"}],"slug":"rr22-raghuraman-rindal-psi-semi-2","status":"fulltext_checked","subtitle":"two-party PSI · 2022","summary":"VOLE-PSI over subfield VOLE: the OKVS lives in a base field just large enough to avoid false matches, about \\( \\lambda + \\log(n_X n_Y) \\) bits, while the VOLE key is in a \\( 2^{\\kappa} \\) extension, so communication is \\( O(n\\lambda + n \\log n) \\). The OKVS is the unclustered row-weight-3 triangulation scheme.","title":"Raghuraman-Rindal PSI (semi-honest, subfield VOLE)","type":"construction","venue":"ACM CCS 2022","year":2022,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2022-RR-SD"},{"contributions":["PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","PSI-CONTRIB-2023-GS-PICT-COMPILER"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","keywords":["multiparty threshold psi","bucketed_cardinality_test_threshold_psi","sublinear-in-set-size","no-fhe","large-intersection-condition"],"metadata":{"assumption":{"family":"generic","name":"Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)"},"attributes":{"adversary":{"locator":"§2.1, p. 4; Corollary 6, p. 16","value":["semi_honest"]},"assumptions":{"locator":"Corollary 6, p. 16","note":"Either suffices","value":["OT","AHE"]},"corruptions":{"locator":"§2.1, p. 4","note":"Static corruption of all but one party","value":"\\( t_c < \\ell \\)"},"output":{"locator":"Abstract, p. 1; Figure 9, p. 11","note":"The intersection when it has at least \\( n - t \\) items, else nothing","value":["threshold"]},"output_to":{"locator":"§1, p. 1","value":"all"},"parties":{"locator":"§4, p. 11","value":"multiparty"},"security_model":{"locator":"§2.1, p. 4; footnote 4, p. 3","note":"Standalone; the bucketing functions are random for simplicity and work equally well as pseudorandom functions, where the key is known to all parties","value":["standard model"]},"set_size_regime":{"locator":"Figure 9, p. 11","note":"All sets have exactly \\( n \\) items","value":"balanced"},"technique":{"locator":"Figure 11, p. 15; §4.1, p. 16","value":["secret_sharing","simple_hashing"]}},"blocks":[{"cites":[{"key":"BDP21","title":"Multiparty cardinality testing for threshold private intersection"}],"count":"\\( \\lambda t\\tilde{t} \\)","func":"l_pict","id":"pict","implementation":"protocol of Branco, Döttling and Pu, with generic secure computation in place of homomorphic encryption","instantiation":"bdp21_generic","locator":"Figure 11, p. 15; Figure 12, p. 16; Theorems 7–8, pp. 15–16; §4.1, p. 16","note":"One test per bucket and per threshold up to \\( \\tilde{t} \\), with secret-shared output","params":{"\\ell":"\\( \\ell \\)","n":"\\( n \\)","t":"\\( \\le \\tilde{t} \\)"},"roles":{"party":"party"}},{"cites":[],"count":"\\( \\lambda t \\)","func":"mpc","id":"min","locator":"Figure 11, step 7, p. 15; Figure 4, p. 6; §4, p. 14","note":"One per partition and bucket: the least padding among the parties, with secret-shared output, by any generic MPC protocol","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"roles":{"party":"party"}},{"cites":[],"count":"\\( \\lambda t \\)","func":"mpc","id":"geq","locator":"Figure 12, steps 5–6, p. 16; Figure 2 and §2.3, p. 5","note":"One per partition and bucket: the summed test shares against the bucket's threshold, giving the intersection size or the default","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\ell|\\mathbb{F}|) \\)"},"roles":{"party":"party"}},{"cites":[],"func":"mpc","id":"vec_intrvl","locator":"Figure 11, step 10, p. 15; Figure 5, p. 6; §4, p. 14","note":"Whether one partition's summed intersection size lies between \\( n-t \\) and \\( n \\), with secret-shared output, by any generic MPC protocol","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( O(\\lambda\\ell|\\mathbb{F}|) \\)"},"roles":{"party":"party"}},{"cites":[],"func":"mpc","id":"isect","locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","note":"The intersection step of GS19: each set polynomial times a random polynomial of degree \\( t \\), summed at \\( 3t+1 \\) points; multiplications over the field","params":{"\\ell":"\\( \\ell \\)","|C|":"\\( (3t+1)\\ell \\)"},"roles":{"party":"party"}}],"capabilities":["sublinear-in-set-size","no-fhe","large-intersection-condition"],"claim_ids":["PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","PSI-CONTRIB-2023-GS-PICT-COMPILER"],"construction_family":"bucketed_cardinality_test_threshold_psi","costs":[{"basis":"counted","formula":"\\( |\\mathbb{F}| \\)","locator":"Figure 11, step 11, p. 15; Corollary 6, p. 16; §2.1, p. 4","measure":"communication","note":"Its share of the test's result, broadcast, so that all learn whether to compute the intersection","subject":"party"},{"basis":"counted","formula":"\\( \\lambda n \\)","locator":"Figure 11, step 4, p. 15; footnote 4, p. 3","measure":"computation","note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","subject":"party"},{"basis":"counted","formula":"\\( O(nt+t^{3}) \\)","locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","measure":"computation","note":"Its set polynomial at the points, the division by it, rational interpolation and the roots among its items; the paper does not fix the methods","operation":"field_op","subject":"party"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","name":"Ghosh-Simkin 2023 multiparty threshold PSI","paper_ids":["PSI-PAPER-2023-GS","PSI-PAPER-2019-GS"],"primitive":"multiparty threshold PSI","schedule":[{"blocks":["pict"],"id":"tests","locator":"Figure 11, steps 1–6, p. 15; Figure 12, steps 1–2, p. 16","phase":"online","what":"all cardinality tests, per partition, bucket and threshold, on the bucketed sets"},{"blocks":["min"],"id":"min","locator":"Figure 11, step 7, p. 15","phase":"online","what":"each bucket's least padding, which needs only the bucketed sets"},{"after":["tests"],"blocks":["geq"],"id":"geq","locator":"Figure 12, steps 3–6, p. 16","phase":"online","what":"per bucket, the summed test shares against the bucket's threshold"},{"after":["geq","min"],"blocks":["vec_intrvl"],"id":"vec","locator":"Figure 11, steps 8–10, p. 15","phase":"online","what":"whether one partition's summed intersection size lies in the interval"},{"after":["vec"],"from":"party","id":"open","locator":"Figure 11, step 11, p. 15; Corollary 6, p. 16","phase":"online","what":"each party's share of the test's result"},{"after":["open"],"blocks":["isect"],"id":"isect","locator":"Corollary 6, p. 16; GS19 §8.2, p. 19","phase":"online","what":"the noisy combination of all set polynomials at the points, run only on a large intersection"}],"security":{"mode":"computational","model":"standalone, static passive adversary corrupting all but one party; Theorems 7-8 in hybrid models with ideal functionalities (pp. 15-16); correctness except with probability \\( 2^{-\\lambda} \\) (Theorem 6, p. 14)","notion":"multiparty threshold PSI (intersection of at least \\( n - t \\) elements)"},"status":"published","title":"Ghosh-Simkin 2023 multiparty threshold PSI from bucketed cardinality tests, passive security, \\( O(\\lambda^{2} \\ell t\\,\\mathrm{polylog}\\, t) \\) communication","variables":[{"meaning":"Threshold of the per-bucket tests, at least \\( 1+3\\ln(2t\\ell) \\)","symbol":"\\tilde{t}"}],"work_id":"PSI-PAPER-2023-GS","year":2023},"primaryUrl":"https://eprint.iacr.org/2023/919","sections":[{"content":"Multiparty threshold PSI with communication quasilinear in the threshold, from generic secure computation. Each party hashes its set into \\( t \\) buckets under \\( \\lambda \\) functions, the parties test each bucket's intersection size with a cardinality test at a logarithmic threshold, and the intersection is computed only if one partition shows it large enough.","heading":"Summary"}],"slug":"gs23-ghosh-simkin-2023-multiparty","status":"fulltext_checked","subtitle":"multiparty threshold PSI · 2023","summary":"Multiparty threshold PSI with communication quasilinear in the threshold, from generic secure computation. Each party hashes its set into \\( t \\) buckets under \\( \\lambda \\) functions, the parties test each bucket's intersection size with a cardinality test at a logarithmic threshold, and the intersection is computed only if one partition shows it large enough.","title":"Ghosh-Simkin 2023 multiparty threshold PSI","type":"construction","venue":"PKC 2023","year":2023,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2023-GS-MULTIPARTY"},{"contributions":["PSI-CONTRIB-2023-GS-PICT-COMPILER","PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","keywords":["two-party threshold psi","bucketed_cardinality_test_threshold_psi","sublinear-in-set-size","no-fhe"],"metadata":{"assumption":{"family":"generic","name":"Oblivious transfer or additively homomorphic encryption (any assumption implying secure computation)"},"attributes":{"adversary":{"locator":"§2.1, p. 4; Theorem 3, p. 9","note":"Passive, static","value":["semi_honest"]},"assumptions":{"locator":"Corollary 3, p. 10","note":"Either suffices","value":["OT","AHE"]},"output":{"locator":"Abstract, p. 1; Figure 1, p. 5; Corollary 3, p. 10","note":"The intersection when the symmetric difference is small, else nothing","value":["threshold"]},"output_to":{"locator":"§1, p. 1","value":"all"},"parties":{"locator":"§3, p. 6","value":"two_party"},"security_model":{"locator":"§2.1, p. 4; footnote 4, p. 3","note":"Standalone; the bucketing functions are random for simplicity and replaceable by public-key PRFs","value":["standard model"]},"set_size_regime":{"locator":"Figure 1, p. 5","value":"balanced"},"technique":{"locator":"Figure 7, p. 9; §3.1, p. 10","value":["secret_sharing","simple_hashing","polynomial_sparsity_test"]}},"blocks":[{"cites":[{"key":"GS19","paper":"PSI-PAPER-2019-GS","title":"The communication complexity of threshold private set intersection"},{"key":"CD01","title":"Secure distributed linear algebra in a constant number of rounds"}],"count":"\\( \\lambda t(1+3\\ln 2t) \\)","func":"pict","id":"pict","implementation":"PICT of Ghosh and Simkin with the determinant protocol of Cramer and Damgård","instantiation":"gs19_cd01","locator":"Figure 7, p. 9; Figure 8, p. 10; Theorems 3–4, pp. 9–10; §3.1, p. 10","note":"One test per bucket and per threshold up to \\( 1+3\\ln 2t \\), with secret-shared output; the bracketed \\( t \\) is the test's own, bounded by the row's","params":{"n":"\\( n \\)","t":"\\( \\le 1+3\\ln 2t \\)"},"roles":{"party":["sender","receiver"]}},{"cites":[],"count":"\\( \\lambda t \\)","func":"two_pc","id":"cmp","locator":"Figure 8, step 5, p. 10; Figure 2 and §2.3, p. 5","note":"One comparison per bucket and partition of the summed shares with the default, any generic secure computation, with \\( O(|\\mathbb{F}|) \\) gates","params":{"|C|":"\\( O(|\\mathbb{F}|) \\)"}},{"cites":[],"func":"two_pc","id":"vec_leq","locator":"Figure 7, step 8, p. 9; Figure 3 and §2.3, p. 6","note":"One test whether any of the \\( \\lambda \\) partition sums is at most \\( t \\), by generic secure computation","params":{"|C|":"\\( O(\\lambda|\\mathbb{F}|) \\)"}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t/2+1 \\)","func":"ole","id":"ole_to_receiver","locator":"Corollary 3, p. 10; GS19 Figure 10, step 3, p. 17","note":"Noisy polynomial addition of the intersection step: Alice receives her evaluations under Bob's random polynomials","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"receiver","sender":"sender"}},{"cites":[{"key":"NP99","title":"Oblivious transfer and polynomial evaluation"},{"key":"IPS09","title":"Secure arithmetic computation with no honest majority"},{"key":"ADI+17","title":"Secure arithmetic computation with constant computational overhead"}],"count":"\\( 3t/2+1 \\)","func":"ole","id":"ole_to_sender","locator":"Corollary 3, p. 10; GS19 Figure 10, step 4, p. 17","note":"Noisy polynomial addition of the intersection step: Bob receives his evaluations under Alice's random polynomials","params":{"\\mathbb{F}":"\\( \\mathbb{F}_p \\)"},"roles":{"receiver":"sender","sender":"receiver"}}],"capabilities":["sublinear-in-set-size","no-fhe"],"claim_ids":["PSI-CONTRIB-2023-GS-PICT-COMPILER","PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"construction_family":"bucketed_cardinality_test_threshold_psi","costs":[{"basis":"counted","formula":"\\( |\\mathbb{F}| + (3t/2+1)\\log p \\)","locator":"Figure 7, p. 9; Corollary 3, p. 10; GS19 Figure 10, step 6, p. 17","measure":"communication","note":"Bob's share of the test's result, then his masked evaluations at half the threshold","subject":"sender"},{"basis":"counted","formula":"\\( |\\mathbb{F}| + (3t/2+1)\\log p \\)","locator":"Figure 7, p. 9; Corollary 3, p. 10; GS19 Figure 10, step 5, p. 17","measure":"communication","note":"Alice's share of the test's result, then her masked evaluations at half the threshold","subject":"receiver"},{"basis":"counted","formula":"\\( \\lambda n \\)","locator":"Figure 7, step 3, p. 9; footnote 4, p. 3","measure":"computation","note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","subject":"sender"},{"basis":"counted","formula":"\\( \\lambda n \\)","locator":"Figure 7, step 2, p. 9; footnote 4, p. 3","measure":"computation","note":"Buckets each item under each of the \\( \\lambda \\) partitioning functions","operation":"symmetric_op","subject":"receiver"},{"basis":"counted","formula":"\\( O(nt+t^{3}) \\)","locator":"Figure 7, step 7, p. 9; Figure 8, step 4, p. 10; GS19 Figure 7, steps 3–7, p. 13","measure":"computation","note":"Evaluates its polynomials at the points, interpolates and tests roots; the sums of its shares are additions","operation":"field_op","subject":"sender"},{"basis":"counted","formula":"\\( O(nt+t^{3}) \\)","locator":"Figure 7, step 6, p. 9; Figure 8, step 3, p. 10; GS19 Figure 7, steps 3–7, p. 13","measure":"computation","note":"Evaluates its polynomials at the points, interpolates and tests roots; the sums of its shares are additions","operation":"field_op","subject":"receiver"}],"dossier_type":"construction","evidence":"fulltext_checked","id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","name":"Ghosh-Simkin 2023 two-party threshold PSI","paper_ids":["PSI-PAPER-2023-GS","PSI-PAPER-2019-GS"],"primitive":"two-party threshold PSI","schedule":[{"blocks":["pict"],"id":"pict","locator":"Figure 7, steps 1–5, p. 9; Figure 8, steps 1–2, p. 10","phase":"online","what":"all cardinality tests, per bucket, partition and threshold, on the bucketed sets"},{"after":["pict"],"blocks":["cmp"],"id":"cmp","locator":"Figure 8, steps 3–5, p. 10","phase":"online","what":"per bucket, the summed test shares compared with the default"},{"after":["cmp"],"blocks":["vec_leq"],"id":"vec_leq","locator":"Figure 7, steps 6–8, p. 9","phase":"online","what":"whether some partition's summed differences are at most \\( t \\)"},{"after":["vec_leq"],"from":"receiver","id":"share_a","locator":"Figure 7, step 9, p. 9; Corollary 3, p. 10","phase":"online","what":"Alice's share of the test's result"},{"after":["vec_leq"],"from":"sender","id":"share_b","locator":"Figure 7, step 9, p. 9; Corollary 3, p. 10","phase":"online","what":"Bob's share of the test's result"},{"after":["share_a","share_b"],"blocks":["ole_to_receiver","ole_to_sender"],"id":"ole","locator":"Corollary 3, p. 10; GS19 Figure 7, step 4, p. 13; GS19 Figure 10, steps 3–4, p. 17","phase":"online","what":"both OLE batches of noisy polynomial addition, run only on similar sets"},{"after":["ole"],"from":"receiver","id":"masked_a","locator":"GS19 Figure 10, step 5, p. 17","phase":"online","what":"Alice's masked evaluations"},{"after":["ole"],"from":"sender","id":"masked_b","locator":"GS19 Figure 10, step 6, p. 17","phase":"online","what":"Bob's masked evaluations"}],"security":{"mode":"computational","model":"standalone, static passive adversary; Theorem 3 in the (F_△, F_vec-leq)-hybrid model and Theorem 4 in the F_pict-hybrid model (pp. 9-10); correctness except with probability \\( 2^{-\\lambda} \\) (Theorem 3, p. 9)","notion":"two-party threshold PSI"},"status":"published","title":"Ghosh-Simkin 2023 two-party threshold PSI from bucketed cardinality tests, passive security, constant rounds, \\( O(\\lambda^{2} t\\,\\mathrm{polylog}\\, t) \\) communication","work_id":"PSI-PAPER-2023-GS","year":2023},"primaryUrl":"https://eprint.iacr.org/2023/919","sections":[{"content":"Two-party threshold PSI that hashes both sets into \\( t \\) buckets under \\( \\lambda \\) functions and runs the Ghosh-Simkin cardinality test at a logarithmic threshold on every bucket, combining the secret-shared results. If some partition shows a small symmetric difference, the intersection is then computed.","heading":"Summary"}],"slug":"gs23-ghosh-simkin-2023-two","status":"fulltext_checked","subtitle":"two-party threshold PSI · 2023","summary":"Two-party threshold PSI that hashes both sets into \\( t \\) buckets under \\( \\lambda \\) functions and runs the Ghosh-Simkin cardinality test at a logarithmic threshold on every bucket, combining the secret-shared results. If some partition shows a small symmetric difference, the intersection is then computed.","title":"Ghosh-Simkin 2023 two-party threshold PSI","type":"construction","venue":"PKC 2023","year":2023,"sourcePath":"data/psi-catalog.json#PSI-CONSTRUCTION-2023-GS-TWO-PARTY"},{"evidence":"synthesized_from_sources","id":"PSI-GOAL-001","keywords":["two-party","malicious","unbalanced","contact-discovery","communication","concrete-efficiency"],"metadata":{"basis":"synthesized","dossier_type":"goal","evidence":"synthesized_from_sources","frontier":[{"cells":{"deployable":"no","malicious_both":"no","smaller_set_comm":"no"},"hardness_assumption":"correlation-robust hashing; pseudorandom code; oblivious transfer","line":"Semi-honest OPRF PSI from OT extension","note":"Secure only against parties that follow the protocol, with communication linear in both sets, so a lookup pays for the whole user base. Two sets of \\( 2^{20} \\) items already take 3.8 s, beyond a 2 s lookup. The OPRF runs on OT extension from base OTs.","security_model":["standard model"],"setting":"two parties; semi-honest","sources":[{"locator":"abstract, p. 1; Tables 3 and 5, p. 15","paper":"PSI-PAPER-2016-KKRT"}]},{"cells":{"deployable":"no","malicious_both":"yes","smaller_set_comm":"no"},"hardness_assumption":"oblivious transfer (RR17, PRTY20); vector oblivious linear evaluation (RR22)","line":"Malicious OT- and VOLE-based PSI","note":"Simulation against either party, a corrupt party's set being bounded only up to a constant factor (below \\( 4n \\) for \\( 2^{20} \\) items in 2017). Runs are balanced: \\( 2^{24} \\) items per party take 8.1 s on one laptop thread (2022). Communication is at least 128 bits per item of either set, so a lookup against \\( 10^{9} \\) users would move at least 16 GB. The OPRFs come from OT extension or VOLE.","security_model":["random oracle"],"setting":"two parties; malicious corruption of either party","sources":[{"locator":"Theorem 2, p. 13; §6.3, p. 15; Figure 6, p. 19","paper":"PSI-PAPER-2017-RR-CCS"},{"locator":"abstract, p. 1; Theorem 4, p. 10","paper":"PSI-PAPER-2020-PRTY"},{"locator":"Table 2, p. 25; §5, p. 23","paper":"PSI-PAPER-2022-RR"}]},{"cells":{"deployable":"no","malicious_both":"yes","smaller_set_comm":"no"},"hardness_assumption":"oracle Diffie-Hellman","line":"Malicious key-agreement PSI","note":"UC security against either party at about one group element per item; a corrupt receiver may use fewer than \\( 8n + 4 \\) items for \\( n = 2^{20} \\). Fastest in its authors' comparison for sets of at most 512 items; for \\( 2^{20} \\) items it takes 251 s, and its communication grows with both sets.","security_model":["random permutation","random oracle"],"setting":"two parties; malicious corruption of either party","sources":[{"locator":"Lemmas 5-6, pp. 10-12; Table 1, p. 4; §4.1, pp. 15-16; Table 3, p. 18; §5.2, pp. 19-20","paper":"PSI-PAPER-2021-RT"}]},{"cells":{"deployable":"no","malicious_both":"no","smaller_set_comm":"yes"},"hardness_assumption":"leveled fully homomorphic encryption with circuit privacy","line":"Semi-honest FHE-based unbalanced PSI","note":"Communication \\( O(n_Y \\log n_X) \\): 11.0 to 20.1 MB for 5,535 receiver items against \\( 2^{24} \\) sender items. That run takes 36.1 s of single-threaded sender online time, about 150 contacts per core-second against a sixtieth of the scenario's users. A malicious sender can steer the receiver's output, for example to the receiver's whole set.","security_model":["standard model"],"setting":"two parties; semi-honest; \\( n_Y \\ll n_X \\)","sources":[{"locator":"abstract, p. 1; Theorem 2, p. 11; Tables 3-5, pp. 14-16","paper":"PSI-PAPER-2017-CLR"}]},{"cells":{"deployable":"no","malicious_both":"partial","smaller_set_comm":"yes"},"hardness_assumption":"leveled FHE; One-More-Gap-Diffie-Hellman","line":"FHE-based unbalanced PSI with OPRF preprocessing","note":"Simulation against a malicious receiver but only privacy against a malicious sender, which still decides what the receiver outputs; a variant confines the sender to dropping matches through a leakage function, under a heuristic assumption on leveled FHE. For 2,048 contacts against \\( 2^{28} \\) users the sender needs 4.75 s online on 24 threads, about 18 contacts per core-second.","security_model":["random oracle"],"setting":"two parties; malicious receiver, privacy only against a malicious sender; \\( n_Y \\ll n_X \\)","sources":[{"locator":"Theorems 1-2, pp. 15-16; §7.2-7.3, pp. 16-18","paper":"PSI-PAPER-2018-CHLR"},{"locator":"§3, p. 6; Tables 1-2, pp. 16-17","paper":"PSI-PAPER-2021-CONG"}]},{"cells":{"deployable":"no","malicious_both":"partial","smaller_set_comm":"no"},"hardness_assumption":"LowMC or Naor-Reingold PRF; maliciously secure oblivious transfer","line":"Precomputed OPRF PSI for mobile contact discovery","note":"Secure against a malicious client but not a malicious server, argued in prose. On a phone, 1,024 contacts against \\( 2^{28} \\) users take 2.92 s over WiFi and 6.53 s over LTE, after a one-time download of a 1,072 MiB filter linear in the user base. The authors state that Signal's requirements are not yet met.","security_model":["unknown"],"setting":"two parties; malicious client, honest server; \\( n_Y \\ll n_X \\)","sources":[{"locator":"§4.5, pp. 10-11; Tables 4 and 6, pp. 13-14; §7, p. 14","paper":"PSI-PAPER-2019-KRSSW"}]}],"id":"PSI-GOAL-001","keywords":["two-party","malicious","unbalanced","contact-discovery","communication","concrete-efficiency"],"layers":[{"best":"UC security, set-size slack allowed","distance":"reached","distance_note":"Reached in 2017 from OT extension; the other dimensions measure what it costs.","layer":"feasibility","rungs":[{"kind":"impossibility","level":"PSI implies oblivious transfer, so it has no black-box construction from one-way functions.","sources":[{"locator":"§3.1, pp. 3-4","paper":"PSI-PAPER-2004-FNP"}],"year":2004},{"kind":"construction","level":"Security against a malicious client or a malicious server; a protocol against both is only outlined.","sources":[{"locator":"Protocol PM-Malicious-Client, p. 10; Protocol PM-Malicious-Server, p. 12; §5.3, p. 13","paper":"PSI-PAPER-2004-FNP"}],"status":"reached","year":2004},{"kind":"construction","level":"UC security against either party; a corrupt party may use fewer than \\( 4n \\) items for \\( n = 2^{20} \\).","sources":[{"locator":"Theorem 2, p. 13; §6.3, p. 15","paper":"PSI-PAPER-2017-RR-CCS"}],"status":"reached","year":2017}],"target":"full security against either party"},{"layer":"assumptions","not_applicable":"The open questions here concern security against the sender and cost; they accept any computational assumption, random oracles included.","not_applicable_label":"Any assumption allowed; security and cost are the question"},{"best":"communication linear in both sets","distance":"partway","distance_note":"Malicious protocols communicate linearly in both sets; \\( O(n_Y \\log n_X) \\) is reached only with weaker security against the sender.","layer":"asymptotic","near_misses":[{"gives_up":"malicious_both","level":"Semi-honest parties: communication sublinear in the larger set, \\( O(n_Y \\log n_X) \\), from leveled FHE.","problem":"PSI-OP-003","sources":[{"locator":"abstract, p. 1; Theorem 2, p. 11","paper":"PSI-PAPER-2017-CLR"}],"year":2017},{"gives_up":"malicious_both","level":"Simulation against a malicious receiver, only privacy against a malicious sender.","problem":"PSI-OP-002","sources":[{"locator":"Theorems 1-2, pp. 15-16; §4.2, p. 9","paper":"PSI-PAPER-2018-CHLR"}],"year":2018},{"gives_up":"malicious_both","level":"A malicious sender limited to dropping matches by a leakage function, under a heuristic assumption.","problem":"PSI-OP-004","sources":[{"locator":"§7.3, pp. 17-18; Theorem 3, p. 25","paper":"PSI-PAPER-2018-CHLR"}],"year":2018}],"rungs":[{"kind":"lower_bound","level":"For sets of equal size, computing the intersection needs communication linear in the set size, \\( \\Omega(n) \\) bits.","sources":[{"locator":"§3, pp. 7-8","paper":"PSI-PAPER-2019-GS"}],"year":2019},{"kind":"construction","level":"Malicious security with communication quasi-linear in the set size, \\( O(\\kappa n \\log n) \\) bits.","sources":[{"locator":"Theorem 2, p. 13","paper":"PSI-PAPER-2017-RR-CCS"}],"status":"reached","year":2017},{"kind":"construction","level":"Malicious security with communication linear in the set size, \\( O(\\kappa n) \\) bits, removing the \\( \\log n \\) factor.","sources":[{"locator":"abstract, p. 1; Theorem 4, p. 10; §6, p. 22","paper":"PSI-PAPER-2020-PRTY"}],"status":"reached","year":2020},{"kind":"construction","level":"Full security against a malicious sender with communication sublinear in its set, \\( o(n_X) \\) bits.","problem":"PSI-OP-001","status":"open"}],"target":"communication sublinear in the larger set"},{"best":"\\( 2^{24} \\) items per party, balanced sets only","distance":"far","distance_note":"Against Signal's \\( 10^{9} \\) users: malicious protocols run only on balanced sets of at most \\( 2^{24} \\) items, sending 128+ bits per item; trusting the server, 1,024 contacts against \\( 2^{28} \\) take 2.92 s.","layer":"concrete","near_misses":[{"gives_up":"malicious_both","level":"Malicious client, semi-honest server: 1,024 contacts against \\( 2^{28} \\) users in 2.92 s on a phone over WiFi, after a one-time 1,072 MiB download.","sources":[{"locator":"§4.5, pp. 10-11; Table 4, p. 13; Table 6, p. 14","paper":"PSI-PAPER-2019-KRSSW"}],"year":2019},{"gives_up":"malicious_both","level":"Only privacy against the sender: 2,048 contacts against \\( 2^{28} \\) users in 4.75 s of sender time on 24 threads, 15.09 MB online.","sources":[{"locator":"§3, p. 6; Tables 1-2, pp. 16-17","paper":"PSI-PAPER-2021-CONG"}],"year":2021}],"rungs":[{"kind":"construction","level":"\\( 2^{20} \\) items per party in 18 s on one thread (LAN); 1,092 MB in the WAN configuration.","sources":[{"locator":"Figure 6, p. 19; Figure 8, p. 20","paper":"PSI-PAPER-2017-RR-CCS"}],"status":"reached","year":2017},{"kind":"construction","level":"\\( 2^{20} \\) items per party in 5.6 s on one thread (LAN) with 202 MB of communication.","sources":[{"locator":"Table 2, p. 24","paper":"PSI-PAPER-2020-PRTY"}],"status":"reached","year":2020},{"kind":"construction","level":"\\( 2^{24} \\) items per party in 8.1 s on one laptop thread, at about 300 bits per item.","sources":[{"locator":"Table 2, p. 25; §5, p. 23","paper":"PSI-PAPER-2022-RR"}],"status":"reached","year":2022},{"kind":"construction","level":"Contact discovery at Signal's scale: 10,000 contacts against \\( 10^{9} \\) users in under 2 s, 1,600 contacts per second per server core.","problem":"PSI-OP-011","status":"open"}],"target":"Efficient enough to deploy, measured"}],"recognized_by":[{"locator":"§1.4, p. 3; §2.2, p. 4","paper":"PSI-PAPER-2017-CLR","statement":"States that all earlier PSI protocols send data proportional to both entire sets, whereas the insecure solution sends only the smaller set, and presents private contact discovery from a phone as the motivating application."},{"locator":"§7, p. 14","paper":"PSI-PAPER-2019-KRSSW","statement":"Reports that Signal's developers would deploy PSI-based contact discovery only at \\( 10^{9} \\) users, address books of up to 10,000 contacts, lookups under 2 s and 1,600 contacts per second on one core, and states that its protocols, secure against malicious clients only, do not yet meet this."},{"locator":"§7.2, p. 16","paper":"PSI-PAPER-2018-CHLR","statement":"Calls full simulation-based security against a malicious sender extremely challenging when communication must stay sublinear in the sender's set."},{"locator":"Table 2, p. 25; §5, p. 23","paper":"PSI-PAPER-2022-RR","statement":"Measures malicious PSI up to \\( 2^{24} \\) items per party on one laptop thread, the largest malicious runs recorded here."}],"requirements":[{"axis":"Security","key":"malicious_both","label":"Malicious security for both","layer":"feasibility","target":"full simulation against a malicious sender and a malicious receiver; a corrupt party's set may exceed its declared size by a constant factor"},{"axis":"Efficiency","key":"smaller_set_comm","label":"Sublinear in the larger set","layer":"asymptotic","target":"communication sublinear in the larger set, as for the insecure solution, which sends only the smaller set"},{"axis":"Efficiency","key":"deployable","label":"Efficient enough to deploy","layer":"concrete","target":"latency and server computation within the budget of a real deployment on unbalanced sets, measured"}],"reviewed_by":[],"status":"open","summary":"Two parties learn their intersection with full security against either party acting maliciously, communicating sublinearly in the larger set, and efficient enough to deploy. Every known line of work gives up at least one of these.","title":"Efficient malicious two-party PSI"},"primaryUrl":null,"sections":[{"content":"The application that practical two-party PSI keeps returning to is private\ncontact discovery: a phone checks which of its contacts use a messaging\nservice without revealing its address book (PSI-PAPER-2017-CLR,\nPSI-PAPER-2019-KRSSW). The sets are unbalanced, so communication should\ndepend on the phone's set rather than on the user base, as it does without\nprivacy (PSI-PAPER-2017-CLR); and either side may cheat. Security against\nmalicious parties is the property that the fastest and the most\ncommunication-efficient protocols each weaken (PSI-PAPER-2018-CHLR,\nPSI-PAPER-2019-KRSSW). The goal is all three at once.","heading":"Why this goal"},{"content":"Rows group protocols by technique and by the security they prove. A malicious\nrow may let a corrupt party use a constant factor more items than it\ndeclared, as every fast malicious protocol does; tighter bounds on that slack\nfollow only from unproven conjectures that overfitting a polynomial or a\nkey-value encoding to a random oracle is hard (PSI-PAPER-2021-RS,\nPSI-PAPER-2021-RT, PSI-PAPER-2021-GPRTY). The last column asks whether a\nprotocol fits the deployment Signal's developers described, as reported by\nKales et al. (PSI-PAPER-2019-KRSSW, §7): a server database of \\( 10^{9} \\) users,\naddress books of up to 10,000 contacts, lookups in under 2 s, and one server\ncore handling 1,600 contacts per second. Balanced protocols fail it because\ntheir communication grows with the user base; the unbalanced ones are too\nslow at a quarter of that scale and do not resist a malicious server. Times\ncome from different machines and are compared only with the budget, not with\neach other.","heading":"Reading the frontier"}],"slug":"goal-1","status":"open","subtitle":"","summary":"Efficient malicious two-party PSI","title":"Efficient malicious two-party PSI","type":"goal","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-GOAL-001"},{"evidence":"synthesized_from_sources","id":"PSI-GOAL-002","keywords":["threshold-psi","multiparty","communication-complexity","lower-bound","cardinality-testing","threshold-fhe"],"metadata":{"basis":"synthesized","dossier_type":"goal","evidence":"synthesized_from_sources","frontier":[{"cells":{"independent_of_n":"yes","many_parties":"no","no_fhe":"no","optimal_comm":"yes"},"hardness_assumption":"fully homomorphic encryption","line":"Two-party threshold PSI from FHE","note":"\\( O(t \\log p) \\) bits for two parties, matching the \\( \\Omega(t) \\) lower bound; given as a sketch.","security_model":["standard model"],"setting":"two parties","sources":[{"locator":"§3, pp. 7-8","paper":"PSI-PAPER-2019-GS"}]},{"cells":{"independent_of_n":"yes","many_parties":"no","no_fhe":"yes","optimal_comm":"yes"},"hardness_assumption":"additively homomorphic encryption","line":"Two-party threshold PSI from additively homomorphic encryption","note":"\\( \\tilde O(t^{2}) \\) bits in 2019 through a quadratic cardinality test; \\( \\tilde O(t) \\) in 2021 by testing a Hankel matrix at quasi-linear cost. Only two parties.","security_model":["standard model"],"setting":"two parties","sources":[{"locator":"Theorems 4-5, pp. 14-16; §6.3, p. 14","paper":"PSI-PAPER-2019-GS"},{"locator":"§3.3, p. 13; §7.1, p. 29","paper":"PSI-PAPER-2021-BMRR"}]},{"cells":{"independent_of_n":"yes","many_parties":"yes","no_fhe":"no","optimal_comm":"yes"},"hardness_assumption":"threshold fully homomorphic encryption","line":"Multiparty threshold PSI from threshold FHE","note":"\\( O(\\ell t \\cdot \\mathrm{poly}(\\kappa)) \\) bits in a constant number of rounds, matching the \\( \\Omega(\\ell t) \\) bound for point-to-point networks.","security_model":["unknown"],"setting":"\\( \\ell \\) parties over point-to-point channels","sources":[{"locator":"Theorem 5.1, p. 17; Corollary B.2, p. 40; Theorem 4.1 and Corollary 4.2, pp. 15-16","paper":"PSI-PAPER-2021-BMRR"}]},{"cells":{"independent_of_n":"yes","many_parties":"partial","no_fhe":"yes","optimal_comm":"yes"},"hardness_assumption":"threshold additively homomorphic encryption","line":"Multiparty threshold PSI from threshold additively homomorphic encryption","note":"\\( \\tilde O(\\ell t) \\) bits, but only for a stricter functionality that releases the intersection when all elements outside it, over every set together, number at most \\( t \\).","security_model":["unknown"],"setting":"\\( \\ell \\) parties","sources":[{"locator":"Theorem 6.5 and Corollary 6.6, pp. 27-28; Table 1, p. 3","paper":"PSI-PAPER-2021-BMRR"}]},{"cells":{"independent_of_n":"yes","many_parties":"yes","no_fhe":"yes","optimal_comm":"partial"},"hardness_assumption":"oblivious transfer or additively homomorphic encryption","line":"Multiparty threshold PSI from oblivious transfer","note":"\\( O(\\kappa^{2} \\ell t \\,\\mathrm{polylog}\\, t) \\) bits when each broadcast message counts once; the cost over point-to-point channels, where the \\( \\Omega(\\ell t) \\) bound holds, is not stated.","security_model":["standard model"],"setting":"\\( \\ell \\) parties, passive corruption; broadcast","sources":[{"locator":"§2.1, p. 4; Corollaries 5-6, p. 16","paper":"PSI-PAPER-2023-GS"}]}],"id":"PSI-GOAL-002","keywords":["threshold-psi","multiparty","communication-complexity","lower-bound","cardinality-testing","threshold-fhe"],"layers":[{"best":"\\( \\ell \\) parties via threshold FHE","distance":"reached","distance_note":"Reached in 2021 from threshold FHE; without a threshold condition, communication must grow linearly with the set size.","layer":"feasibility","rungs":[{"kind":"construction","level":"Two parties, \\( O(t \\log p) \\) bits from FHE.","sources":[{"locator":"§3, pp. 7-8","paper":"PSI-PAPER-2019-GS"}],"status":"reached","year":2019},{"kind":"construction","level":"Any number of parties, \\( O(\\ell t \\cdot \\mathrm{poly}(\\kappa)) \\) bits from threshold FHE.","sources":[{"locator":"Theorem 5.1, p. 17; Corollary B.2, p. 40","paper":"PSI-PAPER-2021-BMRR"}],"status":"reached","year":2021}],"target":"\\( \\ell \\) parties, cost independent of set size"},{"best":"\\( O(\\kappa^{2} \\ell t \\,\\mathrm{polylog}\\, t) \\) from OT","distance":"near","distance_note":"One step: a cardinality test of this cost without FHE over point-to-point channels would complete the protocol, because the intersection step already avoids FHE.","layer":"assumptions","near_misses":[{"gives_up":"many_parties","level":"Two parties: a cardinality test with quasi-linear communication from additively homomorphic encryption.","problem":"PSI-OP-008","sources":[{"locator":"§3.3, p. 13; Theorem 6.5 and Corollary 6.6, pp. 27-28","paper":"PSI-PAPER-2021-BMRR"}],"year":2021},{"gives_up":"many_parties","level":"Two parties: threshold PSI with \\( \\tilde O(t) \\) communication from additively homomorphic encryption.","problem":"PSI-OP-007","sources":[{"locator":"abstract, p. 1; §1.2, p. 4; §7.1, p. 29","paper":"PSI-PAPER-2021-BMRR"}],"year":2021},{"gives_up":"many_parties","level":"\\( \\tilde O(\\ell t) \\) without FHE when the elements outside the intersection number at most \\( t \\) over all sets together.","sources":[{"locator":"Theorem 6.5 and Corollary 6.6, pp. 27-28","paper":"PSI-PAPER-2021-BMRR"}],"year":2021}],"rungs":[{"kind":"construction","level":"From oblivious transfer or additively homomorphic encryption, \\( O(\\kappa^{2} \\ell t \\,\\mathrm{polylog}\\, t) \\) bits when a broadcast counts once.","problem":"PSI-OP-009","sources":[{"locator":"Theorem 7, p. 15; Corollaries 5-6, p. 16","paper":"PSI-PAPER-2023-GS"}],"status":"reached","year":2023},{"kind":"construction","level":"An \\( \\ell \\)-party cardinality test at \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa) \\cdot \\mathrm{polylog}(t) \\) bits without FHE over point-to-point channels.","problem":"PSI-OP-010","status":"open"},{"kind":"construction","level":"\\( \\ell \\)-party threshold PSI at \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa) \\cdot \\mathrm{polylog}(t) \\) bits without FHE over point-to-point channels.","problem":"PSI-OP-005","status":"open"}],"target":"no FHE, \\( \\ell \\cdot t \\cdot \\mathrm{polylog}(t) \\) bits"},{"best":"\\( O(\\ell t \\cdot \\mathrm{poly}(\\kappa)) \\), matching \\( \\Omega(\\ell t) \\)","distance":"reached","distance_note":"Reached in 2021 from threshold FHE, matching the lower bound; the assumptions ladder asks for the same cost without FHE.","layer":"asymptotic","rungs":[{"kind":"lower_bound","level":"Two parties need \\( \\Omega(t) \\) bits, by the linear lower bound for computing an intersection.","sources":[{"locator":"§3, pp. 7-8","paper":"PSI-PAPER-2019-GS"}],"year":2019},{"kind":"lower_bound","level":"\\( \\ell \\) parties need communication linear in \\( \\ell t \\), \\( \\Omega(\\ell t) \\) bits, over point-to-point channels.","sources":[{"locator":"Theorem 4.1 and Corollary 4.2, pp. 15-16","paper":"PSI-PAPER-2021-BMRR"}],"year":2021},{"kind":"construction","level":"Communication linear in \\( \\ell t \\) up to the security parameter, \\( O(\\ell t \\cdot \\mathrm{poly}(\\kappa)) \\) bits, in a constant number of rounds from threshold FHE.","problem":"PSI-OP-006","sources":[{"locator":"Theorem 5.1, p. 17; Corollary B.2, p. 40","paper":"PSI-PAPER-2021-BMRR"}],"status":"reached","year":2021}],"target":"\\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa) \\cdot \\mathrm{polylog}(t) \\) bits, point to point"},{"layer":"concrete","not_applicable":"The covered threshold PSI papers describe no deployment scenario, workload or budget: they present communication bounds and do not claim practicality.","not_applicable_label":"The literature gives no deployment target"}],"recognized_by":[{"locator":"§9, pp. 19-20","paper":"PSI-PAPER-2019-GS","statement":"Calls threshold PSI with communication quasi-linear in \\( t \\) from assumptions weaker than fully homomorphic encryption an open problem."},{"locator":"Tables 1-2, p. 3; §1.1, p. 4","paper":"PSI-PAPER-2021-BMRR","statement":"Marks multiparty threshold PSI from threshold additively homomorphic encryption as unknown for the functionality its threshold-FHE protocol solves, and suggests building the cardinality test from weaker assumptions."},{"locator":"§1, p. 2","paper":"PSI-PAPER-2023-GS","statement":"States that earlier work leaves asymptotically optimal multiparty threshold PSI from assumptions other than fully homomorphic encryption open."}],"requirements":[{"axis":"Setting","key":"many_parties","label":"Any number of parties","layer":"feasibility","target":"\\( \\ell \\ge 2 \\) semi-honest parties, up to \\( \\ell - 1 \\) corrupted, learn the intersection when it holds at least \\( n - t \\) of each party's \\( n \\) elements"},{"axis":"Efficiency","key":"independent_of_n","label":"Independent of set size","layer":"feasibility","target":"communication polynomial in \\( t \\), \\( \\ell \\) and \\( \\lambda \\), independent of the set size \\( n \\)"},{"axis":"Assumption","key":"no_fhe","label":"No FHE","layer":"assumptions","target":"no fully homomorphic or threshold fully homomorphic encryption, for example oblivious transfer or additively homomorphic encryption"},{"axis":"Efficiency","key":"optimal_comm","label":"Optimal communication","layer":"asymptotic","target":"\\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa) \\cdot \\mathrm{polylog}(t) \\) bits over point-to-point channels, matching the \\( \\Omega(\\ell t) \\) lower bound"}],"reviewed_by":[],"status":"open","summary":"Any number of parties learn their intersection exactly when it is large, communicating \\( \\ell \\cdot t \\) bits up to polylogarithmic and security-parameter factors over point-to-point channels, without fully homomorphic encryption. Every known protocol gives up at least one of these.","title":"Multiparty threshold PSI at optimal communication without FHE"},"primaryUrl":null,"sections":[{"content":"Computing an intersection needs communication linear in the set size, but\nwhen parties only want the intersection if it is large, communication can\ndepend on the threshold \\( t \\) instead (PSI-PAPER-2019-GS). For any number of\nparties the cost is now pinned down: at least \\( \\Omega(\\ell t) \\) bits over\npoint-to-point channels, and that much suffices with threshold fully\nhomomorphic encryption (PSI-PAPER-2021-BMRR). The area asks for the same cost\nfrom the weaker assumptions behind ordinary PSI (PSI-PAPER-2023-GS).","heading":"Why this goal"},{"content":"Each row gives up one requirement: more than two parties, an assumption weaker\nthan FHE, the exact functionality, or communication counted over\npoint-to-point channels. The row for threshold additively homomorphic\nencryption is marked partial on the first column because it solves a stricter\nfunctionality, which bounds the elements outside the intersection over all\nsets together rather than per party. The last row counts a broadcast message\nonce; over point-to-point channels each broadcast is sent to every party, and\nthe source does not state the resulting cost.","heading":"Reading the frontier"}],"slug":"goal-2","status":"open","subtitle":"","summary":"Multiparty threshold PSI at optimal communication without FHE","title":"Multiparty threshold PSI at optimal communication without FHE","type":"goal","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-GOAL-002"},{"evidence":"fulltext_checked","id":"PSI-OP-001","keywords":["unbalanced-psi","malicious-sender","fully-homomorphic-encryption","sublinear-communication","simulation-security"],"metadata":{"barriers":[],"basis":"named","caveat":null,"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-001","keywords":["unbalanced-psi","malicious-sender","fully-homomorphic-encryption","sublinear-communication","simulation-security"],"named_open_by":[{"locator":"§5.2 'Discussion', paragraph 'Malicious behavior', PDF pp. 12-13 (ePrint 2017/299, PDF dated 2017-09-06)","paper":"PSI-PAPER-2017-CLR","statement":"Notes that a malicious sender can evaluate an arbitrary function on the receiver's encrypted set and so steer the receiver's output, for example to the receiver's whole set, and says that efficiently preventing such behavior by the sender appears extremely challenging."},{"locator":"§7.2 'Receiver Privacy', PDF p. 16 (ePrint 2018/787, PDF dated 2018-08-27)","paper":"PSI-PAPER-2018-CHLR","statement":"Calls full simulation-based security against a malicious sender extremely challenging in its setting; names the requirement of communication sublinear in the sender's set as the main barrier, because it rules out extracting that set with zero-knowledge proofs of linear size, and enforcing correct computation by the sender as the second; it therefore proves only privacy against a malicious sender."}],"profile":{"Efficiency":"total communication sublinear in the sender's set size","Functionality":"two-party PSI: the receiver learns \\( X \\cap Y \\), the sender learns nothing","Model":"random oracle model permitted","Security":"full simulation-based security against a malicious sender and against a malicious receiver","Setting":"unbalanced: the receiver's set much smaller than the sender's"},"refuted_by":[],"related":[],"resolution_condition":"A two-party protocol in which the receiver, holding \\( Y \\) with \\( |Y| = N_y \\), learns \\( X^* \\cap Y \\) and the sender, holding \\( X \\) with \\( |X| = N_x \\), learns nothing, that is fully simulation-secure (stand-alone, static corruption, in the plain or the random oracle model) against a malicious receiver whose effective set has at most \\( N_y \\) items and against a malicious sender, for whom the simulator extracts an effective set \\( X^* \\) of polynomial size; and whose total communication is at most \\( p(\\lambda, N_y) \\cdot g(N_x) \\) for some polynomial \\( p \\) and some function \\( g \\) with \\( g(N) = o(N) \\). Any computational assumption may be used.","resolved_by":[],"status":"open","summary":"Can a receiver with a small set learn its intersection with a much larger sender set, with full simulation-based security against either party acting maliciously, while communication stays sublinear in the sender's set? Solved for a malicious receiver; open for a malicious sender.","title":"Unbalanced PSI against a malicious sender with sublinear communication"},"primaryUrl":null,"sections":[{"content":"In unbalanced PSI a receiver with a small set \\( Y \\), such as a phone's\ncontact list, learns which of its items lie in a sender's much larger set\n\\( X \\), as in private contact discovery. Protocols built on fully homomorphic\nencryption let the receiver send its encrypted set and the sender evaluate the\nintersection on it, so that communication grows with \\( |Y| \\) and only\nlogarithmically with \\( |X| \\) (PSI-PAPER-2017-CLR). The sender then holds an\nencrypted copy of the receiver's set and may compute on it whatever it likes,\nwhich makes security against a malicious sender the hard direction.","heading":"Background"},{"content":"Is there a two-party protocol in which the receiver learns \\( X \\cap Y \\) and\nthe sender learns nothing, that is fully simulation-secure against a malicious\nreceiver and against a malicious sender, possibly in the random oracle model,\nand whose total communication is sublinear in \\( |X| \\) for every fixed\nreceiver set size and security parameter?","heading":"Problem"},{"content":"Against a malicious receiver the question is settled: if both sets first pass\nthrough a Diffie-Hellman oblivious PRF keyed by the sender, a simulator reads\nthe receiver's set off its random-oracle queries, and communication stays\n\\( O(|Y|\\log|X|) \\) (PSI-PAPER-2018-CHLR; [security against a malicious\nreceiver with privacy against the sender](PSI-OP-002)). Against a malicious\nsender the same protocol gives only privacy: the receiver's messages reveal\nnothing, but the sender still decides what the receiver outputs, for instance\nby returning encryptions of zero so that the receiver accepts its whole set\n(PSI-PAPER-2018-CHLR, §7.2). Full simulation needs an effective input\nextracted from the sender, and the usual tool, zero-knowledge proofs as in\nearlier malicious PSI, costs communication linear in \\( |X| \\); the sender\nmust also be held to the prescribed homomorphic computation. Making the sender\nreturn, for each match, an encryption of a hash of the item's PRF value\nconfines it to [removing matches as a function of the receiver's other\nitems](PSI-OP-004), but only under a heuristic assumption that leveled\nhomomorphic encryption cannot evaluate the hash.","heading":"Why it is open"},{"content":"- Privacy against a malicious sender, which guarantees neither input\n  independence nor a correct output for the receiver.\n- Leaky functionalities, in which the receiver's output may depend on its items\n  outside the intersection.\n- Protocols whose communication is linear in the sender's set, such as\n  balanced malicious-secure PSI, or protocols that transfer an encoding of the\n  whole sender set in a setup phase (PSI-PAPER-2019-KRSSW).","heading":"What would not resolve it"},{"content":"Parties: a sender with \\( X \\), \\( |X| = N_x \\), and a receiver with \\( Y \\),\n\\( |Y| = N_y \\); \\( N_x \\), \\( N_y \\) and the item length are public. Ideal\nfunctionality: the receiver obtains \\( X^* \\cap Y \\), where \\( X^* \\) is the\nsender's input, and the sender obtains nothing. Security: stand-alone\nsimulation against a static malicious adversary corrupting either party; the\nsimulator for a corrupt receiver submits a set of at most \\( N_y \\) items, and\nthe simulator for a corrupt sender submits a set of polynomial size. Model:\nplain or random oracle model; any computational assumption. Efficiency: total\ncommunication at most \\( p(\\lambda, N_y)\\cdot g(N_x) \\) for a polynomial\n\\( p \\) and some \\( g(N) = o(N) \\).","heading":"Formal target"},{"content":"Hashing gives a malicious sender further ways to make the receiver's output\ndepend on items outside the intersection: it can perform its simple hashing\nincorrectly, and when it reuses its preprocessing across receivers and\nchooses the hash functions it can provoke cuckoo-hashing failures that depend\non the receiver's set, which leaks one bit (PSI-PAPER-2018-CHLR, §7.2 and\n§7.3).","heading":"Known obstacles"},{"content":"PSI-PAPER-2017-CLR introduced the homomorphic approach with communication\n\\( O(|Y|\\log|X|) \\) against semi-honest parties and noted that a malicious\nsender can steer the output. PSI-PAPER-2018-CHLR added oblivious PRF\npreprocessing, which gives one-sided simulation against a malicious receiver\nand privacy against a malicious sender, and a variant that limits a malicious\nsender to a leakage function under the H-limited assumption.\nPSI-PAPER-2021-CONG reduced computation and communication while keeping the\nsame guarantees.","heading":"Research history"}],"slug":"op-1","status":"open","subtitle":"","summary":"Unbalanced PSI against a malicious sender with sublinear communication","title":"Unbalanced PSI against a malicious sender with sublinear communication","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-001"},{"evidence":"fulltext_checked","id":"PSI-OP-002","keywords":["unbalanced-psi","malicious-receiver","oprf-preprocessing","one-sided-simulation","random-oracle"],"metadata":{"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-002","keywords":["unbalanced-psi","malicious-receiver","oprf-preprocessing","one-sided-simulation","random-oracle"],"named_open_by":[{"locator":"§5.2 'Discussion', paragraph 'Malicious behavior', PDF p. 13 (ePrint 2017/299, PDF dated 2017-09-06)","paper":"PSI-PAPER-2017-CLR","statement":"Notes that a malicious receiver can fill vacant cuckoo-hash slots to enlarge its set and add noise to its ciphertexts so that noise flooding no longer hides the sender's set, and leaves a formal analysis of the malicious setting and countermeasures to future work."}],"profile":{"Efficiency":"total communication sublinear in the sender's set size","Functionality":"two-party PSI: the receiver learns \\( X \\cap Y \\), the sender learns nothing","Model":"random oracle model permitted","Security":"one-sided simulation against a malicious receiver; privacy only against a malicious sender","Setting":"unbalanced: the receiver's set much smaller than the sender's"},"resolved_by":[{"locator":"Theorem 1, §7.1, PDF p. 15; Theorem 2, §7.2, PDF p. 16; communication \\( O(|Y| \\log |X|) \\), §4.2, PDF p. 9 (ePrint 2018/787, PDF dated 2018-08-27)","paper":"PSI-PAPER-2018-CHLR"}],"status":"resolved","summary":"Unbalanced PSI with communication sublinear in the sender's set, secure against a malicious receiver and only private against a malicious sender: the sender learns nothing about the receiver's set, but the receiver's output need not be correct. Solved with oblivious PRF preprocessing in the random oracle model.","title":"Unbalanced PSI against a malicious receiver with sublinear communication"},"primaryUrl":null,"sections":[{"content":"Give an unbalanced PSI protocol with communication sublinear in the sender's\nset that is simulation-secure against a malicious receiver and keeps the\nreceiver's set private from a malicious sender, in the sense of Hazay and\nLindell: the sender's view reveals nothing about the receiver's input, while\ninput independence and output correctness are not required.","heading":"Problem"},{"content":"PSI-PAPER-2018-CHLR first maps both sets through the Diffie-Hellman oblivious\nPRF \\( F_\\alpha(x) = H'(H(x)^\\alpha) \\), whose key the sender holds, and then\nruns the homomorphic intersection of PSI-PAPER-2017-CLR on the outputs. In the\nrandom oracle model and in a group where One-More-Gap-Diffie-Hellman is hard,\na simulator extracts a malicious receiver's set, of the honest size, from its\noracle queries (Theorem 1). Semantic security of the homomorphic encryption\nand the same group assumption give privacy against a malicious sender\n(Theorem 2). Communication is \\( O(|Y|\\log|X|) \\) (§4.2). Because the sender's\nnon-matching items look random to the receiver, noise flooding is no longer\nneeded, and the sender can reuse its processed set across receivers.\nPSI-PAPER-2021-CONG keeps these guarantees with lower cost.","heading":"Resolution"}],"slug":"op-2","status":"resolved","subtitle":"","summary":"Unbalanced PSI against a malicious receiver with sublinear communication","title":"Unbalanced PSI against a malicious receiver with sublinear communication","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-002"},{"evidence":"fulltext_checked","id":"PSI-OP-003","keywords":["unbalanced-psi","semi-honest","fully-homomorphic-encryption","simd-batching","cuckoo-hashing"],"metadata":{"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-003","keywords":["unbalanced-psi","semi-honest","fully-homomorphic-encryption","simd-batching","cuckoo-hashing"],"profile":{"Efficiency":"total communication sublinear in the sender's set size","Functionality":"two-party PSI: the receiver learns \\( X \\cap Y \\), the sender learns nothing","Model":"random oracle model permitted","Security":"semi-honest sender and receiver","Setting":"unbalanced: the receiver's set much smaller than the sender's"},"resolved_by":[{"locator":"Abstract, PDF p. 1; Theorem 2, §5.1, PDF p. 11; Figure 4, PDF p. 12 (ePrint 2017/299, PDF dated 2017-09-06)","paper":"PSI-PAPER-2017-CLR"}],"status":"resolved","summary":"Unbalanced PSI with communication sublinear in the sender's set, for parties that follow the protocol. Solved with leveled homomorphic encryption, batching, and hashing: communication \\( O(|Y| \\log |X|) \\).","title":"Semi-honest unbalanced PSI with sublinear communication"},"primaryUrl":null,"sections":[{"content":"Give a two-party PSI protocol, secure against semi-honest parties, in which\nthe receiver learns \\( X \\cap Y \\) and total communication is sublinear in the\nsender's set size \\( |X| \\).","heading":"Problem"},{"content":"PSI-PAPER-2017-CLR has the receiver cuckoo-hash its items, pack the table into\nbatched ciphertexts of a leveled fully homomorphic scheme, and send them with\nsome encrypted powers; the sender, holding its items in simple-hashed bins,\nevaluates for each bin a polynomial that vanishes on the bin's items and\nreturns the results, and the receiver reads its matches off the zero slots\n(Figure 4). Windowing and partitioning of the bins keep the multiplicative\ndepth low. Communication is \\( O(|Y|\\log|X|) \\) (abstract), and the protocol\nis secure against semi-honest parties in the standard model, assuming an\nIND-CPA scheme with circuit privacy, which noise flooding provides in the\nleveled setting (Theorem 2).","heading":"Resolution"}],"slug":"op-3","status":"resolved","subtitle":"","summary":"Semi-honest unbalanced PSI with sublinear communication","title":"Semi-honest unbalanced PSI with sublinear communication","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-003"},{"evidence":"fulltext_checked","id":"PSI-OP-004","keywords":["unbalanced-psi","malicious-sender","leaky-functionality","h-limited","labeled-psi","random-oracle"],"metadata":{"caveat":"The H-limited property of leveled homomorphic encryption is a heuristic assumption supported by experiments, not by a reduction to a standard problem.","dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-004","keywords":["unbalanced-psi","malicious-sender","leaky-functionality","h-limited","labeled-psi","random-oracle"],"profile":{"Efficiency":"total communication sublinear in the sender's set size","Functionality":"two-party PSI: the receiver learns \\( X \\cap Y \\), the sender learns nothing","Model":"random oracle model permitted","Security":"simulation against a malicious receiver, and against a malicious sender for output \\( X \\cap Y \\cap L(Y) \\)","Setting":"unbalanced: the receiver's set much smaller than the sender's"},"resolved_by":[{"locator":"§7.3 and Definition 1, PDF pp. 17-18; Figures 7-8 and Theorem 3, Appendix A, PDF p. 25 (ePrint 2018/787, PDF dated 2018-08-27)","paper":"PSI-PAPER-2018-CHLR"}],"status":"resolved","summary":"Unbalanced PSI with sublinear communication, secure against a malicious sender when the receiver's output may be \\( X \\cap Y \\cap L(Y) \\) for a leakage function \\( L \\) that the sender chooses. Solved under a heuristic assumption that leveled homomorphic encryption cannot evaluate a deep hash function.","title":"Unbalanced PSI against a malicious sender with bounded leakage"},"primaryUrl":null,"sections":[{"content":"Give an unbalanced PSI protocol with communication sublinear in the sender's\nset that is fully secure against a malicious receiver and simulation-secure\nagainst a malicious sender for a weaker functionality: the sender submits a\nset \\( X^* \\) and a leakage function \\( L \\), and the receiver obtains\n\\( X^* \\cap Y \\cap L(Y) \\). A malicious sender can thus withhold matches\ndepending on the receiver's other items, but cannot add items it does not\nhold.","heading":"Problem"},{"content":"PSI-PAPER-2018-CHLR runs its labeled protocol, whose communication is\nsublinear in the sender's set (§1.3, p. 3), with the label of each sender item\nset to a hash \\( H(\\mathrm{OPRF}_k(x)) \\); the receiver accepts \\( y \\) only\nif the decrypted label at its position equals \\( H(\\mathrm{OPRF}_k(y)) \\), and\nthe sender proves in zero knowledge that it used one PRF key (Figure 8).\nDefinition 1 calls a leveled scheme H-limited if no efficient party can turn an\nencryption of \\( z \\) into an encryption of \\( H(z) \\). In the random oracle\nmodel, with a One-More-Gap-Diffie-Hellman group and a semantically secure\nH-limited leveled scheme, the protocol realizes the leaky functionality with\nnon-black-box simulation, a malicious receiver held to its declared set size,\nand a malicious sender's set of polynomial size (Theorem 3). The theorem\ncovers a sender that does not reuse its preprocessing; with reuse and\nsender-chosen hash functions, selective cuckoo-hashing failures leak one bit\n(§7.3, p. 18).","heading":"Resolution"}],"slug":"op-4","status":"resolved","subtitle":"","summary":"Unbalanced PSI against a malicious sender with bounded leakage","title":"Unbalanced PSI against a malicious sender with bounded leakage","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-004"},{"evidence":"fulltext_checked","id":"PSI-OP-005","keywords":["threshold-psi","multiparty","communication-complexity","lower-bound","cardinality-testing"],"metadata":{"barriers":[],"basis":"named","caveat":null,"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-005","keywords":["threshold-psi","multiparty","communication-complexity","lower-bound","cardinality-testing"],"named_open_by":[{"locator":"Tables 1 and 2, PDF p. 3; §1.1, PDF p. 4 (ePrint 2020/600, PDF dated 2021-02-25)","paper":"PSI-PAPER-2021-BMRR","statement":"Marks as unknown a protocol from threshold additively homomorphic encryption for the functionality that releases the intersection when every set is close to it, and for the matching cardinality test, while its threshold-FHE protocols meet its \\( \\Omega(nT) \\) lower bound; suggests that future work build that cardinality test from assumptions weaker than threshold FHE and reuse the paper's second phase."},{"locator":"§1, PDF p. 2 (ePrint 2023/919, PDF dated 2023-06-12)","paper":"PSI-PAPER-2023-GS","statement":"States that Ghosh and Simkin (2019), Branco, Döttling and Pu, and Badrinarayanan et al. all leave constructing asymptotically optimal multiparty threshold PSI protocols from assumptions other than fully homomorphic encryption as an open problem, after noting that the latter two prove \\( \\Omega(\\ell t) \\) and match it up to polylogarithmic factors with FHE."}],"profile":{"Assumption":"no fully homomorphic encryption, e.g. oblivious transfer or additively homomorphic encryption","Efficiency":"total communication \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits, independent of \\( n \\)","Functionality":"threshold PSI: every party learns the intersection if it has at least \\( n - t \\) of their \\( n \\) elements","Model":"point-to-point private channels","Security":"semi-honest, static, up to \\( \\ell - 1 \\) of \\( \\ell \\) parties corrupted","Setting":"any number \\( \\ell \\ge 2 \\) of parties"},"refuted_by":[],"related":[],"resolution_condition":"A family of protocols, one for every number of parties \\( \\ell \\ge 2 \\), in which each party holds a set of \\( n \\) elements and every party obtains the intersection if it has at least \\( n - t \\) elements and nothing otherwise; secure against a static semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties; over pairwise private point-to-point channels, each message counted at its length; with total communication at most \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits for every \\( n \\); and relying on no fully homomorphic or threshold fully homomorphic encryption.","resolved_by":[],"status":"open","summary":"Can many parties learn the intersection of their sets exactly when it is large, with communication matching the \\( \\Omega(\\ell t) \\) lower bound up to polylogarithmic and security-parameter factors, without fully homomorphic encryption? Known from threshold FHE, for two parties, and when broadcast messages count once.","title":"Multiparty threshold PSI with optimal communication without FHE"},"primaryUrl":null,"sections":[{"content":"In threshold PSI the parties learn the intersection of their sets only if it is\nlarge, here if it contains at least \\( n - t \\) of each party's \\( n \\)\nelements, so for small \\( t \\) communication can fall far below the set size,\nwhich plain PSI cannot achieve in general (PSI-PAPER-2021-BMRR, §1). For two\nparties PSI-PAPER-2019-GS proved an \\( \\Omega(t) \\) lower bound and an almost\nmatching protocol from fully homomorphic encryption (FHE). PSI-PAPER-2021-BMRR\nextended both to \\( \\ell \\) parties: every protocol communicates\n\\( \\Omega(\\ell t) \\) over point-to-point channels, and threshold FHE achieves\n\\( O(\\ell t\\cdot\\mathrm{poly}(\\lambda)) \\). Whether that cost is reachable from\nweaker assumptions is the remaining question.","heading":"Background"},{"content":"Let \\( \\ell \\ge 2 \\) parties each hold a set of \\( n \\) elements, and let\n\\( t < n \\). Without fully homomorphic or threshold fully homomorphic\nencryption, is there a protocol, secure against a semi-honest adversary\ncorrupting up to \\( \\ell - 1 \\) parties, that gives every party the\nintersection if it has at least \\( n - t \\) elements and nothing otherwise,\nover point-to-point channels, with total communication\n\\( \\ell t\\cdot\\mathrm{poly}(\\lambda)\\cdot\\mathrm{polylog}(t) \\) bits?","heading":"Problem"},{"content":"With threshold FHE the bound is met: PSI-PAPER-2021-BMRR tests the\nintersection size homomorphically and then computes the intersection with\nthreshold additively homomorphic encryption ([the threshold-FHE\ncase](PSI-OP-006)). Because that second phase needs no FHE, [a cardinality\ntest of the same cost without FHE](PSI-OP-010) would suffice, but\nPSI-PAPER-2021-BMRR builds a test from threshold additively homomorphic\nencryption only for its other functionality, which releases the intersection\nwhen all elements outside it together number at most \\( t \\), a stricter\ncondition. For [two parties](PSI-OP-007) the question is settled.\nPSI-PAPER-2023-GS reaches \\( O(\\lambda^2\\ell t\\,\\mathrm{polylog}\\,t) \\) bits\nfrom oblivious transfer or additively homomorphic encryption by splitting the\nsets into buckets and running a quadratic cardinality test on small\nthresholds, but in a model where each broadcast message counts once\n([the broadcast case](PSI-OP-009)). It does not state the cost over\npoint-to-point channels, where the \\( \\Omega(\\ell t) \\) bound holds and each\nbroadcast becomes \\( \\ell - 1 \\) private messages, and it does not call its\nprotocol optimal. With a broadcast channel the known lower bound is only\n\\( \\Omega(t\\log\\ell + \\ell) \\) (PSI-PAPER-2021-BMRR, Appendix C).","heading":"Why it is open"},{"content":"- Protocols that use plain or threshold fully homomorphic encryption.\n- Protocols for the functionality that bounds all elements outside the\n  intersection together, rather than each party's.\n- Bounds that count a broadcast message once, unless they are also shown over\n  point-to-point channels.\n- Communication of order \\( \\ell t^2 \\), or with factors in \\( \\ell \\) or\n  \\( t \\) beyond \\( \\mathrm{polylog}(t) \\).","heading":"What would not resolve it"},{"content":"Parties \\( P_1,\\dots,P_\\ell \\), \\( \\ell \\ge 2 \\), hold sets\n\\( X_1,\\dots,X_\\ell \\) of exactly \\( n \\) elements from a universe of\n\\( \\mathrm{poly}(\\lambda) \\)-bit strings; \\( t < n \\) is public. Ideal\nfunctionality: if \\( |\\bigcap_i X_i| \\ge n - t \\), every party receives\n\\( \\bigcap_i X_i \\); otherwise every party receives \\( \\bot \\). Security:\nsimulation against a static semi-honest adversary corrupting any \\( \\ell - 1 \\)\nparties. Network: pairwise private channels, each message counted at its\nlength; a star topology is allowed. Efficiency: total communication\n\\( O(\\ell t\\cdot\\mathrm{poly}(\\lambda)\\cdot\\mathrm{polylog}(t)) \\) bits for\nevery \\( n \\); rounds unrestricted. Assumptions: any that do not include\nfully homomorphic or threshold fully homomorphic encryption.","heading":"Formal target"},{"content":"PSI-PAPER-2019-GS initiated sublinear threshold PSI for two parties, with an\n\\( \\Omega(t) \\) bound, an almost matching FHE protocol, an\n\\( \\tilde O(t^2) \\) protocol from additively homomorphic encryption, and a\nmultiparty extension. PSI-PAPER-2021-BMRR defined two multiparty\nfunctionalities, proved \\( \\Omega(\\ell t) \\) for both, met it with threshold\nFHE, gave \\( \\tilde O(\\ell t) \\) without FHE for the stricter functionality,\nand thereby settled the two-party case. PSI-PAPER-2023-GS compiled quadratic\ncardinality tests into quasilinear ones, counting broadcast messages once.","heading":"Research history"}],"slug":"op-5","status":"open","subtitle":"","summary":"Multiparty threshold PSI with optimal communication without FHE","title":"Multiparty threshold PSI with optimal communication without FHE","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-005"},{"evidence":"fulltext_checked","id":"PSI-OP-006","keywords":["threshold-psi","multiparty","threshold-fhe","communication-complexity"],"metadata":{"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-006","keywords":["threshold-psi","multiparty","threshold-fhe","communication-complexity"],"profile":{"Assumption":"threshold fully homomorphic encryption with distributed setup","Efficiency":"total communication \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits, independent of \\( n \\)","Functionality":"threshold PSI: every party learns the intersection if it has at least \\( n - t \\) of their \\( n \\) elements","Model":"point-to-point private channels","Security":"semi-honest, static, up to \\( \\ell - 1 \\) of \\( \\ell \\) parties corrupted","Setting":"any number \\( \\ell \\ge 2 \\) of parties"},"resolved_by":[{"locator":"Theorem 5.1, §5.1, PDF p. 17, with its communication analysis, PDF p. 19; Theorem B.1 and Corollary B.2, Appendix B, PDF p. 40; lower bound Theorem 4.1 and Corollary 4.2, PDF pp. 15-16 (ePrint 2020/600, PDF dated 2021-02-25)","paper":"PSI-PAPER-2021-BMRR"}],"status":"resolved","summary":"Multiparty threshold PSI at the optimal communication, with threshold fully homomorphic encryption allowed. Solved with \\( O(\\ell t \\cdot \\mathrm{poly}(\\lambda)) \\) communication in a constant number of rounds, matching the \\( \\Omega(\\ell t) \\) lower bound.","title":"Multiparty threshold PSI with optimal communication from threshold FHE"},"primaryUrl":null,"sections":[{"content":"Give an \\( \\ell \\)-party threshold PSI protocol, secure against a semi-honest\nadversary corrupting up to \\( \\ell - 1 \\) parties, that releases the\nintersection exactly when it has at least \\( n - t \\) elements, with\ncommunication \\( \\ell t\\cdot\\mathrm{poly}(\\lambda) \\) up to polylogarithmic\nfactors over point-to-point channels, assuming threshold fully homomorphic\nencryption.","heading":"Problem"},{"content":"PSI-PAPER-2021-BMRR works in a star network. In the first phase each party\nsends a central party \\( O(t) \\) threshold-FHE encryptions of evaluations of\nits set polynomial; the central party homomorphically interpolates a rational\nfunction and tests it at a random point, and the parties jointly decrypt one\nbit (Theorem 5.1, with \\( O(\\ell t\\cdot\\mathrm{poly}(\\lambda)) \\)\ncommunication, p. 19). If the test passes, a second phase from threshold\nadditively homomorphic encryption gives every party \\( 3t + 4 \\) evaluations\nof a randomized combination of all set polynomials, from which it interpolates\nthe elements of its own set outside the intersection (Theorem B.1). The whole\nprotocol communicates \\( O(\\ell t\\cdot\\mathrm{poly}(\\lambda)) \\) bits in a\nconstant number of rounds (Corollary B.2, whose statement names the other\nfunctionality although it instantiates this protocol), matching the\n\\( \\Omega(\\ell t) \\) bound for point-to-point networks (Theorem 4.1,\nCorollary 4.2).","heading":"Resolution"}],"slug":"op-6","status":"resolved","subtitle":"","summary":"Multiparty threshold PSI with optimal communication from threshold FHE","title":"Multiparty threshold PSI with optimal communication from threshold FHE","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-006"},{"evidence":"fulltext_checked","id":"PSI-OP-007","keywords":["threshold-psi","two-party","hankel-matrix","cardinality-testing","additively-homomorphic-encryption"],"metadata":{"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-007","keywords":["threshold-psi","two-party","hankel-matrix","cardinality-testing","additively-homomorphic-encryption"],"named_open_by":[{"locator":"§9 'Conclusion and Open Problems', PDF pp. 19-20 (ePrint 2019/175, PDF dated 2020-05-27)","paper":"PSI-PAPER-2019-GS","statement":"Calls it an open problem to construct a threshold PSI protocol with communication quasi-linear in \\( t \\) from assumptions weaker than fully homomorphic encryption, and notes that its intersection step already has this cost, so only a cardinality test of the same cost is missing."}],"profile":{"Assumption":"no fully homomorphic encryption, e.g. oblivious transfer or additively homomorphic encryption","Efficiency":"total communication \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits, independent of \\( n \\)","Functionality":"threshold PSI: every party learns the intersection if it has at least \\( n - t \\) of their \\( n \\) elements","Model":"point-to-point private channels","Security":"semi-honest, static, up to \\( \\ell - 1 \\) of \\( \\ell \\) parties corrupted","Setting":"two parties"},"resolved_by":[{"locator":"Abstract, PDF p. 1; §1.2, PDF p. 4; §3.3, PDF p. 13; §7.1 'Two-party case', PDF p. 29 (ePrint 2020/600, PDF dated 2021-02-25)","paper":"PSI-PAPER-2021-BMRR"},{"locator":"Theorem 4 and the paragraph before Lemma 4, §6.3, PDF p. 14 (ePrint 2019/175, PDF dated 2020-05-27)","paper":"PSI-PAPER-2019-GS"}],"status":"resolved","summary":"Threshold PSI without FHE at quasi-linear communication, for two parties, posed by Ghosh and Simkin. Solved: a Hankel-matrix singularity test of quasi-linear cost gives communication quasi-linear in \\( t \\) from additively homomorphic encryption.","title":"Two-party threshold PSI with quasi-linear communication without FHE"},"primaryUrl":null,"sections":[{"content":"Give a two-party protocol, secure against semi-honest parties and without\nfully homomorphic encryption, that reveals the intersection of two sets of\n\\( n \\) elements exactly when it has at least \\( n - t \\) elements, with\ncommunication \\( \\tilde O(t) \\), that is \\( t\\cdot\\mathrm{poly}(\\lambda) \\)\nup to polylogarithmic factors.","heading":"Problem"},{"content":"PSI-PAPER-2019-GS reduces two-party threshold PSI to a private intersection\ncardinality test followed by an intersection step that already costs\n\\( \\tilde O(t) \\) (Theorem 4 and the following paragraph). Its own test, a\nsingularity test of a Hankel matrix built from the parties' polynomial\nencodings, cost \\( \\tilde O(t^2) \\). PSI-PAPER-2021-BMRR observes that the\nHankel structure reduces the test to the half-GCD problem, solvable in\nquasi-linear time, so that the parties can obtain additive shares of the\nmatrix and test it with Yao's garbled circuits or additively homomorphic\nencryption at quasi-linear cost (§3.3); its second phase needs only additively\nhomomorphic encryption for two parties (§7.1). The paper states that this\ngives two-party threshold PSI with communication \\( \\tilde O(t) \\) from\nadditively homomorphic encryption and settles the question of\nPSI-PAPER-2019-GS (abstract; §1.2), with \\( \\mathrm{poly}(\\lambda) \\) factors omitted.\nPSI-PAPER-2023-GS credits the bound \\( O(\\lambda t\\,\\mathrm{polylog}\\,t) \\)\nwithout FHE to this combination (footnote 5, p. 4).","heading":"Resolution"}],"slug":"op-7","status":"resolved","subtitle":"","summary":"Two-party threshold PSI with quasi-linear communication without FHE","title":"Two-party threshold PSI with quasi-linear communication without FHE","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-007"},{"evidence":"fulltext_checked","id":"PSI-OP-008","keywords":["cardinality-testing","threshold-psi","hankel-matrix","half-gcd"],"metadata":{"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-008","keywords":["cardinality-testing","threshold-psi","hankel-matrix","half-gcd"],"named_open_by":[{"locator":"§9 'Conclusion and Open Problems', PDF pp. 19-20 (ePrint 2019/175, PDF dated 2020-05-27)","paper":"PSI-PAPER-2019-GS","statement":"Says that, since its intersection step already has the desired cost, one only needs a private intersection cardinality test with communication quasi-linear in \\( t \\) from assumptions weaker than fully homomorphic encryption."}],"profile":{"Assumption":"no fully homomorphic encryption","Efficiency":"communication \\( t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits, independent of \\( n \\)","Functionality":"two-party intersection cardinality test: whether \\( |X \\cap Y| \\ge n - t \\)","Security":"semi-honest"},"resolved_by":[{"locator":"§3.3, PDF p. 13; Theorem 6.5 and Corollary 6.6, §6.2, PDF pp. 27-28, for two parties (ePrint 2020/600, PDF dated 2021-02-25)","paper":"PSI-PAPER-2021-BMRR"}],"status":"resolved","summary":"A two-party protocol, without FHE, that decides whether two sets of \\( n \\) elements share at least \\( n - t \\) of them, with communication quasi-linear in \\( t \\). By the Ghosh-Simkin reduction it settles two-party threshold PSI without FHE; Badrinarayanan et al. gave one.","title":"Two-party intersection cardinality test with quasi-linear communication"},"primaryUrl":null,"sections":[{"content":"Is there a two-party protocol, secure against semi-honest parties and without\nfully homomorphic encryption, that outputs whether two sets of \\( n \\)\nelements share at least \\( n - t \\) of them, with communication\n\\( t\\cdot\\mathrm{poly}(\\lambda)\\cdot\\mathrm{polylog}(t) \\) bits?","heading":"Problem"},{"content":"In the test of PSI-PAPER-2019-GS the sets are encoded so that the size of\ntheir symmetric difference is the number of monomials of a polynomial, whose\nsparsity is decided by the singularity of a Hankel matrix; testing it with a\nprotocol for arbitrary matrices costs \\( \\tilde O(t^2) \\).\nPSI-PAPER-2021-BMRR observes that a Hankel matrix has only linearly many\ndistinct entries and that its singularity reduces to the half-GCD problem,\nsolvable in quasi-linear time, so the parties can obtain additive shares of the\nmatrix and test it with additively homomorphic encryption or Yao's garbled\ncircuits at quasi-linear communication (§3.3). Theorem 6.5 and Corollary 6.6\ngive the protocol for any number of parties from threshold additively\nhomomorphic encryption; for more than two parties it decides whether all\nelements outside the intersection together number at most \\( t \\).","heading":"Resolution"}],"slug":"op-8","status":"resolved","subtitle":"","summary":"Two-party intersection cardinality test with quasi-linear communication","title":"Two-party intersection cardinality test with quasi-linear communication","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-008"},{"evidence":"fulltext_checked","id":"PSI-OP-009","keywords":["threshold-psi","multiparty","broadcast-channel","bucketing","cardinality-testing","oblivious-transfer"],"metadata":{"dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-009","keywords":["threshold-psi","multiparty","broadcast-channel","bucketing","cardinality-testing","oblivious-transfer"],"profile":{"Assumption":"no fully homomorphic encryption, e.g. oblivious transfer or additively homomorphic encryption","Efficiency":"total communication \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits, independent of \\( n \\)","Functionality":"threshold PSI: every party learns the intersection if it has at least \\( n - t \\) of their \\( n \\) elements","Model":"private channels plus a broadcast channel whose messages count once","Security":"semi-honest, static, up to \\( \\ell - 1 \\) of \\( \\ell \\) parties corrupted","Setting":"any number \\( \\ell \\ge 2 \\) of parties"},"resolved_by":[{"locator":"§2.1, PDF p. 4; Theorem 7, §4, PDF p. 15; Theorem 8 and Corollaries 5-6, §4.1, PDF p. 16 (ePrint 2023/919, PDF dated 2023-06-12)","paper":"PSI-PAPER-2023-GS"}],"status":"resolved","summary":"Multiparty threshold PSI without FHE at near-optimal communication, in a network with a broadcast channel whose messages count once. Solved from oblivious transfer or additively homomorphic encryption with \\( O(\\lambda^{2}\\ell t\\,\\mathrm{polylog}\\,t) \\) bits by a bucketing compiler, against passive corruption of all but one party.","title":"Multiparty threshold PSI without FHE when broadcasts count once"},"primaryUrl":null,"sections":[{"content":"Give an \\( \\ell \\)-party threshold PSI protocol, without fully homomorphic\nencryption and secure against a semi-honest adversary corrupting up to\n\\( \\ell - 1 \\) parties, with communication\n\\( \\ell t\\cdot\\mathrm{poly}(\\lambda)\\cdot\\mathrm{polylog}(t) \\) bits, in a\nnetwork of private channels together with a broadcast channel on which\nsending a message costs its length once, whatever the number of recipients.","heading":"Problem"},{"content":"PSI-PAPER-2023-GS assumes pairwise private channels and a unit-cost broadcast\nchannel, against a static passive adversary corrupting all but one party\n(§2.1). Each party hashes its set into \\( t \\) buckets, independently\n\\( \\epsilon \\) times for a statistical parameter \\( \\epsilon = O(\\lambda) \\);\nin every bucket the parties obtain secret shares of the bucket's exact\nintersection size when it is within a logarithmic threshold of full, and of a\ndefault value otherwise, and a final secure computation checks whether one of\nthe \\( \\epsilon \\) sums of these shares shows a large enough intersection\n(Theorem 7). The bucket test is built from a quadratic cardinality test of\nearlier work run at logarithmic thresholds (Theorem 8), which the paper states\ncan be rewritten over generic secure computation at\n\\( O(\\lambda\\ell\\,\\mathrm{poly}(t)) \\). The result is an \\( \\ell \\)-party\ncardinality test and, with the multiparty intersection step that\nPSI-PAPER-2019-GS sketches without a theorem (§8.2 there), passively secure\nthreshold PSI with\n\\( O(\\epsilon^2\\ell t\\,\\mathrm{polylog}\\,t) \\) bits from oblivious transfer or\nadditively homomorphic encryption (Corollaries 5 and 6).","heading":"Resolution"}],"slug":"op-9","status":"resolved","subtitle":"","summary":"Multiparty threshold PSI without FHE when broadcasts count once","title":"Multiparty threshold PSI without FHE when broadcasts count once","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-009"},{"evidence":"fulltext_checked","id":"PSI-OP-010","keywords":["cardinality-testing","threshold-psi","multiparty","communication-complexity"],"metadata":{"basis":"named","dossier_type":"open_problem","evidence":"fulltext_checked","id":"PSI-OP-010","keywords":["cardinality-testing","threshold-psi","multiparty","communication-complexity"],"named_open_by":[{"locator":"Table 2, PDF p. 3; §1.1, PDF p. 4 (ePrint 2020/600, PDF dated 2021-02-25)","paper":"PSI-PAPER-2021-BMRR","statement":"Marks a cardinality test for this functionality from threshold additively homomorphic encryption as unknown, and suggests that future work build one from assumptions weaker than threshold FHE and plug in the paper's second phase."},{"locator":"§8.2, PDF p. 19 (ePrint 2019/175, PDF dated 2020-05-27)","paper":"PSI-PAPER-2019-GS","statement":"Separates the multiparty cardinality test, which it builds from threshold FHE, from the intersection protocol to stress that a cardinality test from simpler assumptions would immediately give the whole multiparty protocol from those assumptions."}],"profile":{"Assumption":"no fully homomorphic encryption","Efficiency":"total communication \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits, independent of \\( n \\)","Functionality":"multiparty intersection cardinality test: all parties learn whether the intersection has at least \\( n - t \\) elements","Model":"point-to-point private channels","Security":"semi-honest, static, up to \\( \\ell - 1 \\) of \\( \\ell \\) parties corrupted"},"resolution_condition":"A protocol for every number of parties \\( \\ell \\ge 2 \\), each holding \\( n \\) elements, that gives every party the bit [the intersection has at least \\( n - t \\) elements] (or shares of it), secure against a static semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties, over pairwise private point-to-point channels, with total communication at most \\( \\ell \\cdot t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) bits for every \\( n \\), and relying on no fully homomorphic or threshold fully homomorphic encryption.","status":"open","summary":"An \\( \\ell \\)-party protocol, without FHE, that tells all parties whether their intersection has at least \\( n - t \\) elements, with \\( \\ell t \\cdot \\mathrm{poly}(\\lambda) \\cdot \\mathrm{polylog}(t) \\) communication over point-to-point channels. A published reduction turns it into multiparty threshold PSI of the same cost without FHE.","title":"Multiparty intersection cardinality test with optimal communication without FHE"},"primaryUrl":null,"sections":[{"content":"Is there an \\( \\ell \\)-party protocol, secure against a semi-honest adversary\ncorrupting up to \\( \\ell - 1 \\) parties and without fully homomorphic\nencryption, that tells every party whether the intersection of their sets of\n\\( n \\) elements has at least \\( n - t \\) elements, with total communication\n\\( \\ell t\\cdot\\mathrm{poly}(\\lambda)\\cdot\\mathrm{polylog}(t) \\) bits over\npoint-to-point channels?","heading":"Problem"},{"content":"PSI-PAPER-2021-BMRR builds this test only from threshold FHE (Theorem 5.1); its\ntest from threshold additively homomorphic encryption decides the stricter\nunion-based condition instead (Corollary 6.6). PSI-PAPER-2023-GS gives an\n\\( \\ell \\)-party test with secret-shared output and\n\\( O(\\epsilon^2\\ell t\\,\\mathrm{polylog}\\,t) \\) bits from oblivious transfer or\nadditively homomorphic encryption (Corollary 5), but in a model where a\nbroadcast message counts once (§2.1), and it does not state the cost over\npoint-to-point channels.","heading":"Why it is open"}],"slug":"op-10","status":"open","subtitle":"","summary":"Multiparty intersection cardinality test with optimal communication without FHE","title":"Multiparty intersection cardinality test with optimal communication without FHE","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-010"},{"evidence":"claim_audited","id":"PSI-OP-011","keywords":["malicious","contact-discovery","unbalanced","deployment","concrete-efficiency","signal"],"metadata":{"barriers":[],"basis":"derived","caveat":"The budget is Signal's requirement as reported by Kales et al. (§7, p. 14); reading the 2 s bound as covering a whole address book is ours, no network is stated, and timings date with hardware.","derived_from":{"gap":"Protocols secure against both parties communicate linearly in both sets; contact-discovery protocols measured at scale trust the server and still miss the 2 s bound.","goal":"PSI-GOAL-001","requirements":["deployable","malicious_both"]},"dossier_type":"open_problem","evidence":"claim_audited","id":"PSI-OP-011","keywords":["malicious","contact-discovery","unbalanced","deployment","concrete-efficiency","signal"],"named_open_by":[],"profile":{"Efficiency":"each lookup under 2 s end to end, not averaged; at most 1/1,600 server core-second per contact, precomputation included","Model":"random oracles allowed; one-time server-set processing and downloads not bounded","Security":"full simulation against a malicious client and a malicious server; constant-factor slack in a corrupt party's set size","Setting":"a phone client with an address book of up to 10,000 contacts; a server holding \\( 10^{9} \\) registered users"},"recognized_by":[{"locator":"§7, p. 14","paper":"PSI-PAPER-2019-KRSSW","statement":"Reports Signal's developers' requirements for deploying PSI-based contact discovery (\\( 10^{9} \\) users, address books of up to 10,000 contacts, lookups under 2 s, 1,600 contacts per second on one core) and states that its protocols, secure against malicious clients only, do not yet meet them."},{"locator":"§1.4, p. 3; §2.2, p. 4","paper":"PSI-PAPER-2017-CLR","statement":"Presents private contact discovery from a phone as the motivating application of unbalanced PSI, where earlier protocols send data proportional to both entire sets."},{"locator":"§7.2, p. 16","paper":"PSI-PAPER-2018-CHLR","statement":"Calls full simulation-based security against a malicious sender extremely challenging when communication must stay sublinear in the sender's set."}],"refuted_by":[],"related":[],"resolution_condition":"An implementation of a two-party PSI protocol with a proof of simulation-based security against a malicious client and against a malicious server (a corrupt party's effective set may exceed its declared size by a constant factor; random oracles allowed), together with a measurement in which a client on a smartphone checks 10,000 contacts against a server set of \\( 10^{9} \\) items in under 2 s end to end, and the server's computation per contact, including any per-client precomputation and amortized over clients, is at most 1/1,600 core-second. One-time processing of the server's set, one-time downloads, and the network are reported but not bounded.","resolved_by":[],"status":"open","summary":"Can PSI secure against a malicious client and a malicious server check 10,000 contacts against \\( 10^{9} \\) users in under 2 s, with one server core handling 1,600 contacts per second, as Signal's developers require? Protocols secure against both parties run only on balanced sets; those measured at this scale trust the server.","title":"Malicious PSI deployable for contact discovery"},"primaryUrl":null,"sections":[{"content":"Messaging services find which of a user's contacts are registered by\ncomparing the phone's address book with the user base. Signal's developers\nconsidered PSI for this and, as Kales et al. report, stated what a deployable\nprotocol must handle: a server database of \\( 10^{9} \\) users, address books of up to\n10,000 contacts, lookups in under 2 s, and one server core handling 1,600\ncontacts per second (PSI-PAPER-2019-KRSSW, §7). Private contact discovery from\na phone is also the application that motivates unbalanced PSI\n(PSI-PAPER-2017-CLR). A server that runs the protocol can cheat as well as a\nclient, so the goal asks for security against both.","heading":"Background"},{"content":"Build and measure a two-party PSI protocol, simulation-secure against a\nmalicious client and against a malicious server (a corrupt party may use a\nconstant factor more items than it declared; random oracles allowed), in\nwhich a phone checks 10,000 contacts against \\( 10^9 \\) registered users in\nunder 2 s, while the server spends at most 1/1,600 core-second per contact.","heading":"Problem"},{"content":"Protocols secure against both parties are balanced: their communication is at\nleast 128 bits per item of either set (PSI-PAPER-2022-RR), so a lookup against\n\\( 10^9 \\) users would move at least 16 GB, and the largest measured run has\n\\( 2^{24} \\) items per party. The protocols built for contact discovery give\nup security against the server. Precomputed OPRF PSI on a phone checks 1,024\ncontacts against \\( 2^{28} \\) users in 2.92 s over WiFi and 6.53 s over LTE\nafter a one-time 1,072 MiB download, is secure only against a malicious\nclient, and its authors state that Signal's requirements are not met\n(PSI-PAPER-2019-KRSSW). FHE-based unbalanced PSI keeps communication small but\nonly keeps the server from learning the client's items, not from changing the\nclient's output (PSI-PAPER-2018-CHLR), and for 2,048 contacts against\n\\( 2^{28} \\) users its sender needs 4.75 s on 24 threads\n(PSI-PAPER-2021-CONG). Full simulation against a malicious sender with\ncommunication sublinear in its set is itself open\n([unbalanced PSI against a malicious sender](PSI-OP-001)).","heading":"Why it is open"},{"content":"- Protocols secure only against a malicious client, or that trust the server\n  in any other way, however fast.\n- Measurements at a smaller user base or address book, or extrapolations.\n- Latency amortized over several lookups, or server throughput that leaves\n  out per-client precomputation.\n- Designs that add servers assumed not to collude, which change the setting.","heading":"What would not resolve it"}],"slug":"op-11","status":"open","subtitle":"","summary":"Malicious PSI deployable for contact discovery","title":"Malicious PSI deployable for contact discovery","type":"open_problem","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#PSI-OP-011"},{"evidence":"fulltext_checked","id":"PSI-PAPER-1999-HFH","keywords":["private-preference-matching","diffie-hellman","commutative-exponentiation","matching-count","no-trusted-third-party","two-party"],"metadata":{"authors":["Bernardo A. Huberman","Matt Franklin","Tad Hogg"],"contribution_ids":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-1999-HFH","keywords":["private-preference-matching","diffie-hellman","commutative-exponentiation","matching-count","no-trusted-third-party","two-party"],"primary_url":"https://doi.org/10.1145/336992.337012","review_scope":"The 9-page ACM proceedings PDF (printed pages 78-86) was read in full. Locators cite the printed page numbers; PDF page \\( k \\) is printed page \\( 77 + k \\). Only the private preference matching protocol (§3, p. 81; Appendix A, p. 85) is within the PSI atlas. Community discovery (§3, pp. 80-81), deniable signatures (§4, pp. 81-82), and anonymous group membership (§5, pp. 82-83) are outside the topic and were read only to confirm that they contain no further matching protocol. The paper gives no security definition, adversary model, or proof for the matching protocol, so nothing of that kind could be checked.","status":"published","title":"Enhancing Privacy and Trust in Electronic Communities","venue":"ACM EC 1999","versions":["ACM Conference on Electronic Commerce (E-COMMERCE 99), Denver, Colorado, pp. 78-86, doi:10.1145/336992.337012; 9-page ACM PDF with printed page numbers 78-86, read 2026-10-11"],"year":1999},"primaryUrl":"https://doi.org/10.1145/336992.337012","sections":[{"content":"Enhancing Privacy and Trust in Electronic Communities","heading":"Overview"},{"content":"Title, authors, venue, and pages were checked against the ACM PDF (first page, p. 78). The PDF carries the ACM copyright line \"E-COMMERCE 99, Denver, Colorado\" and printed pages 78-86. No other version was compared.","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING: a protocol, related by the authors to Diffie-Hellman key exchange and to encrypted key exchange, in which two parties exponentiate hashes of their list items with secret exponents and count the matches (Appendix A, p. 85). The protocol is the construction PSI-CONSTRUCTION-1999-HFH. Not recorded, outside the topic: community discovery by posting key pairs for yes/no answers (§3, p. 80; Appendix A, p. 85), deniable and convertible signatures (§4, pp. 81-82; Appendix A, p. 86), and 1-out-of-n and t-out-of-n proofs of knowledge for anonymous group membership (§5, pp. 82-83; Appendix A, p. 86).","heading":"Contributions"},{"content":"The paper does not use the terms \"set intersection\" or \"PSI\". It calls the task private preference matching: the basic function takes two lists of yes/no answers and a threshold and outputs whether the number of matching answers reaches the threshold (§3, p. 81). The protocol it gives in Appendix A instead lets each party count the matches, and the paper says that this leaks the number of matches rather than the one-bit threshold decision, as a trade-off for efficiency (§3, p. 81). Revealing which items are shared appears only as a variation in which the last two lists are not permuted (Appendix A, p. 85). Later papers describe this protocol as the classic Diffie-Hellman PSI protocol (for example PSI-PAPER-2021-RT, §1, p. 1); that description is theirs. The paper states no adversary model and no security argument for the matching protocol. Its assumptions appear only as context: a prime \\( p \\) with a large prime factor \\( q \\) of \\( p - 1 \\) in which discrete logarithms are believed hard (Appendix A, p. 85), and a hash function whose output \"cannot be easily influenced or predicted\" (§2, p. 79). It adds that a zero-knowledge proof could be incorporated so that active cheating other than strategic choice of inputs is detected, without giving one (Appendix A, p. 85).","heading":"Claim boundary"}],"slug":"hfh99","status":"published","subtitle":"Bernardo A. Huberman, Matt Franklin, Tad Hogg · 1999","summary":"Enhancing Privacy and Trust in Electronic Communities","title":"Enhancing Privacy and Trust in Electronic Communities","type":"paper","venue":"ACM EC 1999","year":1999,"sourcePath":"data/psi-catalog.json#PSI-PAPER-1999-HFH"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2004-FNP","keywords":["private-matching","oblivious-polynomial-evaluation","homomorphic-encryption","balanced-allocations","cut-and-choose","psi-cardinality","threshold","multiparty","lower-bound"],"metadata":{"authors":["Michael J. Freedman","Kobbi Nissim","Benny Pinkas"],"contribution_ids":["PSI-CONTRIB-2004-FNP-OPE-PSI","PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","PSI-CONTRIB-2004-FNP-OT-REDUCTION"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2004-FNP","keywords":["private-matching","oblivious-polynomial-evaluation","homomorphic-encryption","balanced-allocations","cut-and-choose","psi-cardinality","threshold","multiparty","lower-bound"],"primary_url":"https://doi.org/10.1007/978-3-540-24676-3_1","review_scope":"The Springer chapter of the EUROCRYPT 2004 version (LNCS 3027, pp. 1-19) was read in full: §§1-8 and the protocols PM-Semi-Honest (p. 6), PM-Malicious-Client (p. 10), PM-Malicious-Server (p. 12), Private-Sample-B (p. 14), and the multi-party protocol (p. 16). Locators cite the printed LNCS page numbers, which coincide with the PDF pages of the chapter. Security arguments in this version are lemma statements with proof sketches (pp. 8, 11-13); they were read but not re-verified. The fully malicious protocol is only sketched, with details deferred to the full version (§5.3, p. 13). The 2016 journal version was not compared.","status":"published","title":"Efficient Private Matching and Set Intersection","venue":"EUROCRYPT 2004","versions":["EUROCRYPT 2004, LNCS 3027, pp. 1-19, doi:10.1007/978-3-540-24676-3_1; 19-page Springer chapter PDF, read 2026-10-11","Journal version with Carmit Hazay, Journal of Cryptology 29 (2016), doi:10.1007/s00145-014-9190-0 (not read)"],"year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Efficient Private Matching and Set Intersection","heading":"Overview"},{"content":"Title, authors, venue, and pages were checked against the chapter's first page (p. 1: \"C. Cachin and J. Camenisch (Eds.): EUROCRYPT 2004, LNCS 3027, pp. 1-19, 2004\"). LITERATURE_COVERAGE.md records the 2016 Journal of Cryptology version with Hazay as a second version of this identity; it was not read, and no claim here depends on it. The paper calls set intersection \"private matching\" (PM), with the client learning \\( X \\cap Y \\) (§3.1, p. 3).","heading":"Version and bibliographic notes"},{"content":"The paper lists its contributions on p. 2. PSI-CONTRIB-2004-FNP-OPE-PSI: set intersection from oblivious evaluation of an encrypted polynomial whose roots are the client's items, semi-honest, standard model (§4.1, p. 5; Protocol PM-Semi-Honest, p. 6; Lemmas 1-3, p. 8). PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING: balanced-allocation hashing into low-degree bin polynomials, which reduces the server's exponentiations to \\( O(k_C + k_S \\ln \\ln k_C) \\) (§4.2, pp. 6-8). PSI-CONTRIB-2004-FNP-MALICIOUS-OPE: protocols against a malicious client (cut-and-choose, standard model) and a malicious server (random oracle model) (§5, pp. 9-13). PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD: variants that output the intersection size or a threshold decision (§4.4-4.5, p. 9). PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND: an \\( \\Omega(N) \\) communication lower bound for multiplicatively approximating the intersection size (§6, pp. 13-14). PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE: a sketched multi-party protocol for semi-honest parties (§7, pp. 15-17). PSI-CONTRIB-2004-FNP-OT-REDUCTION: private matching implies oblivious transfer, so it has no black-box reduction from one-way functions (§3.1, pp. 3-4). Not carded separately: the sampling-based private approximation protocol Intersect-Approx, whose expected number of sampling invocations matches the lower bound for distinguishing intersection sizes (§6, pp. 14-15); it is described in PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND. Not carded, outside the topic: fuzzy matching and fuzzy search, including a 2-out-of-3 fuzzy matching protocol (§8, p. 17). Fuzzy PSI is excluded by SCOPE.md.","heading":"Contributions"},{"content":"Only the client learns the output (§3.1, p. 3). Security definitions are informal in this version (§3.2, p. 4), and the security lemmas carry proof sketches. The protocol against both malicious parties is described only in outline (§5.3, p. 13). The authors note that the number of rounds of Intersect-Approx depends on its output, which the security definitions do not capture (§6, \"Caveat\", p. 15). The paper leaves open more efficient fuzzy matching and malicious-secure fuzzy matching (§8, p. 17).","heading":"Claim boundary"}],"slug":"fnp04","status":"published","subtitle":"Michael J. Freedman, Kobbi Nissim, Benny Pinkas · 2004","summary":"Efficient Private Matching and Set Intersection","title":"Efficient Private Matching and Set Intersection","type":"paper","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2004-FNP"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2010-DT","keywords":["blind-rsa","authorized-psi","rsa-ppit","one-more-rsa","one-more-gap-dh","linear-complexity","data-transfer","semi-honest"],"metadata":{"authors":["Emiliano De Cristofaro","Gene Tsudik"],"contribution_ids":["PSI-CONTRIB-2010-DT-BLIND-RSA","PSI-CONTRIB-2010-DT-LINEAR-APSI"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2010-DT","keywords":["blind-rsa","authorized-psi","rsa-ppit","one-more-rsa","one-more-gap-dh","linear-complexity","data-transfer","semi-honest"],"primary_url":"https://eprint.iacr.org/2009/491","review_scope":"IACR ePrint 2009/491, PDF dated 2010-08-04, read in full: §§1-7, Figures 1-6, Tables 1-3, and Appendices A-C. The proof sketches of Appendix B were read but not re-verified. The FC 2010 proceedings version was not compared; the ePrint footnote on p. 1 says an earlier version appeared at FC 2010. All locators cite the ePrint PDF pages.","status":"published","title":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","venue":"FC 2010","versions":["IACR ePrint 2009/491, PDF dated 2010-08-04, 17 pages (read)","Financial Cryptography and Data Security (FC 2010), LNCS 6052, pp. 143-159, titled 'Practical Private Set Intersection Protocols with Linear Complexity' (bibliographic data as cited in reference [17] of IACR ePrint 2016/930 and reference [DT10] of IACR ePrint 2021/1159; not checked against Springer)"],"year":2010},"primaryUrl":"https://eprint.iacr.org/2009/491","sections":[{"content":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF. The FC 2010 venue, volume, and pages are taken from the reference lists of PSI-PAPER-2018-PSZ and PSI-PAPER-2021-RT, which give the shorter conference title. The paper uses \"client\" for the party that learns the intersection and \"server\" for the other (§2, p. 2).","heading":"Version and bibliographic notes"},{"content":"The paper lists its contributions in §3 (p. 2). PSI-CONTRIB-2010-DT-BLIND-RSA: PSI from RSA blind signatures with server precomputation, in which the client performs no online exponentiations (§5.6, Figure 4, p. 9; Appendix B.3, p. 16). PSI-CONTRIB-2010-DT-LINEAR-APSI: authorized PSI with linear computation and communication, obtained from the quadratic APSI protocol derived from RSA-PPIT, and its PSI version in a prime-order group (§5.3-5.5, Figures 1-3, pp. 7-9; Appendices B.1-B.2, pp. 14-16). Not carded separately: adding data transfer (PSI-DT, APSI-DT) to all four protocols by deriving symmetric keys from the matching values, following the earlier PPIT work (§5.7, p. 10). Not carded separately: the asymptotic and experimental comparison with prior PSI and APSI protocols (§6, Tables 2-3, pp. 10-11); its figures are recorded in the construction rows.","heading":"Contributions"},{"content":"All PSI protocols assume an honest-but-curious client and server; in APSI the server is honest-but-curious, the certification authority is not malicious, and the client may lack authorizations for some items (§5.1, p. 6). Malicious security is left to future work (§5.1, p. 6; §7, p. 12), as are formal proofs of unlinkability (Appendix B.1-B.3, pp. 14-16), a security proof for shorter exponents in the APSI protocol (§6, p. 11), and removing an extra oracle query from the One-More-Gap-DH reduction (Appendix B.2, p. 16). The APSI protocol has no comparison row: authorization by a certification authority has no facet in the topic vocabulary, and the APSI rows of Table 2 are not comparable with PSI rows.","heading":"Claim boundary"}],"slug":"dt10","status":"published","subtitle":"Emiliano De Cristofaro, Gene Tsudik · 2010","summary":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","title":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","type":"paper","venue":"FC 2010","year":2010,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2010-DT"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2012-HEK","keywords":["garbled-circuits","yao","sort-compare-shuffle","bitonic-merger","waksman-network","pairwise-comparison","bit-vector","auditing","semi-honest","two-party","benchmark"],"metadata":{"authors":["Yan Huang","David Evans","Jonathan Katz"],"contribution_ids":["PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","PSI-CONTRIB-2012-HEK-SIZE-AUDITING"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2012-HEK","keywords":["garbled-circuits","yao","sort-compare-shuffle","bitonic-merger","waksman-network","pairwise-comparison","bit-vector","auditing","semi-honest","two-party","benchmark"],"primary_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","review_scope":"The 15-page NDSS 2012 paper (PDF dated 2011-11-28) was read in full: §§1-8, Tables 1-3, Figures 1-11, and Algorithms 1-3. The paper gives no security proofs and relies on the known proof of Yao's protocol (§1.2, p. 2; §2, p. 4), so no proof was checked. The PDF names no venue; NDSS 2012 is taken from the reference lists of IACR ePrint 2018/120 and 2019/241 and from the NDSS programme page. All locators cite this PDF's pages, which carry no printed page numbers.","status":"published","title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","venue":"NDSS 2012","versions":["NDSS 2012 paper, 15-page PDF dated 2011-11-28","NDSS 2012 programme page at ndss-symposium.org (found by web search on 2026-10-11; the PDF hosted there was not compared)"],"year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","heading":"Overview"},{"content":"Title and authors were checked against the 15-page PDF dated 2011-11-28. The PDF itself does not name the venue. NDSS 2012 is the venue given in the reference lists of PSI-PAPER-2018-PSWW (reference [HEK12]) and PSI-PAPER-2019-PSTY (reference [HEK12]) and on the NDSS 2012 programme page. The authors' framework and protocol implementations are announced at www.MightBeEvil.com (p. 14).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE: the sort-compare-shuffle circuit, with a bitonic merger of the locally sorted sets, DupSelect-3 filtering, and shuffling by a Waksman network, so that the circuit has \\( \\Theta(n \\log n) \\) non-free gates (§5, pp. 5-10; Table 1, p. 2). PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM: the measured comparison of the garbled-circuit protocols with the one-more-DL-based protocol of De Cristofaro and Tsudik on the same hardware (§7, pp. 11-14; Figure 11 and Table 2, p. 13). PSI-CONTRIB-2012-HEK-SIZE-AUDITING: an extension of the circuits that withholds the intersection when its size exceeds a threshold (§6, pp. 10-11). Not listed as separate contributions: the bit-vector protocol (Bitwise-AND, §3, pp. 4-5), the pairwise-comparison protocol with early reveal (§4, p. 5), and the shuffling by sorting or by homomorphic encryption (§§5.3.1-5.3.2, pp. 8-9). They are comparison rows PSI-CONSTRUCTION-2012-HEK-BWA, PSI-CONSTRUCTION-2012-HEK-PWC, and PSI-CONSTRUCTION-2012-HEK-SCS-HE.","heading":"Contributions"},{"content":"All protocols are semi-honest and two-party; stronger threat models are left to future work (§1.1, p. 2). The paper states that the protocols can be proven secure from decisional Diffie-Hellman, used for the oblivious transfer, in the random oracle model, without giving proofs (§2, p. 4). The bit-vector protocol does not bound the set sizes, so a dishonest party could input the whole universe; the paper says it should not be used standalone (§3, pp. 4-5). The introduction says the SCS-WN protocol on 160-bit elements is faster than the De Cristofaro-Tsudik protocol except at the ultra-short security level (§1.1, p. 2), while §7.3 calls it competitive at all security levels (p. 13); the plotted times (Figure 11, p. 13) show it about five times slower at the ultra-short level and faster at every other level.","heading":"Claim boundary"}],"slug":"hek12","status":"published","subtitle":"Yan Huang, David Evans, Jonathan Katz · 2012","summary":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","title":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","type":"paper","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2012-HEK"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2016-KKRT","keywords":["batched-oprf","bark-oprf","ot-extension","pseudorandom-code","cuckoo-hashing","semi-honest","two-party"],"metadata":{"authors":["Vladimir Kolesnikov","Ranjit Kumaresan","Mike Rosulek","Ni Trieu"],"contribution_ids":["PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2016-KKRT","keywords":["batched-oprf","bark-oprf","ot-extension","pseudorandom-code","cuckoo-hashing","semi-honest","two-party"],"primary_url":"https://eprint.iacr.org/2016/799","review_scope":"IACR ePrint 2016/799, PDF dated 2016-08-20, read in full (§§1-6, Figures 1-3, Tables 1-5). The proof of Theorem 6 was read but not re-verified, and the CCS proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","venue":"ACM CCS 2016","versions":["IACR ePrint 2016/799, PDF dated 2016-08-20","ACM CCS 2016, pp. 818-829 (bibliographic data as cited in reference [43] of IACR ePrint 2016/930)"],"year":2016},"primaryUrl":"https://eprint.iacr.org/2016/799","sections":[{"content":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2016-08-20. Venue and pages are taken from the reference list of PSI-PAPER-2018-PSZ (reference [43]) and were not checked against the ACM Digital Library. The authors' implementation is at github.com/osu-crypto/BaRK-OPRF (§6, p. 14).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF: the batched, related-key OPRF (BaRK-OPRF) from OT extension with a pseudorandom code. PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI: PSI in the hashing paradigm of Pinkas, Schneider, Segev, and Zohner with BaRK-OPRF in place of their OPRF, so that the OT cost per bin no longer grows with item length, and with the hash index appended to each bin input (§5, pp. 10-13; Figure 3, p. 13; Table 1, p. 14). The abstract reports 3.1-3.6 times faster PSI than that protocol for 128-bit items and sufficiently large sets, 3.8 seconds for sets of \\( 2^{20} \\) items, and a slowdown of 4.3 times relative to insecure naive hashing for very large sets (p. 1). The protocol itself is PSI-CONSTRUCTION-2016-KKRT.","heading":"Contributions"},{"content":"The paper is strictly in the semi-honest model (§1.1, p. 3). Theorem 6 (p. 9) covers BaRK-OPRF; the security of the PSI protocol is argued in prose (§5.2, p. 11). Footnote 3 (p. 12) notes that the earlier protocol did not account for collisions among the cuckoo hash functions, which the hash-index optimization of §5.2 (Figure 3, p. 13) handles.","heading":"Claim boundary"}],"slug":"kkrt16","status":"published","subtitle":"Vladimir Kolesnikov, Ranjit Kumaresan, Mike Rosulek et al. · 2016","summary":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","title":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","type":"paper","venue":"ACM CCS 2016","year":2016,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2016-KKRT"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2017-CLR","keywords":["unbalanced-psi","fully-homomorphic-encryption","fv","seal","simd-batching","cuckoo-hashing","permutation-based-hashing","windowing","partitioning","modulus-switching","semi-honest","private-contact-discovery"],"metadata":{"authors":["Hao Chen","Kim Laine","Peter Rindal"],"contribution_ids":["PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2017-CLR","keywords":["unbalanced-psi","fully-homomorphic-encryption","fv","seal","simd-batching","cuckoo-hashing","permutation-based-hashing","windowing","partitioning","modulus-switching","semi-honest","private-contact-discovery"],"primary_url":"https://eprint.iacr.org/2017/299","review_scope":"IACR ePrint 2017/299, PDF dated 2017-09-06, read in full (§§1-7, Figures 1-4, Tables 1-5). The proofs of Theorems 1 and 2 were read but not re-verified; the hashing parameters of Table 1 and equation (1), the empirical cuckoo-hashing failure estimates of §4.2, and the SEAL parameter security estimates of Table 2 were not recomputed. The CCS proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Fast Private Set Intersection from Homomorphic Encryption","venue":"ACM CCS 2017","versions":["IACR ePrint 2017/299, PDF dated 2017-09-06 (PDF metadata)","ACM CCS 2017, pp. 1243-1255 (bibliographic data as cited in reference [12] of IACR ePrint 2018/787)"],"year":2017},"primaryUrl":"https://eprint.iacr.org/2017/299","sections":[{"content":"Fast Private Set Intersection from Homomorphic Encryption","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2017-09-06 (PDF metadata; the PDF itself carries no date). Venue and pages are taken from the reference list of PSI-PAPER-2018-CHLR (reference [12]) and were not checked against the ACM Digital Library. The paper calls the protocol of Pinkas, Schneider, and Zohner \"[PSZ16]\" and cites it as IACR ePrint 2016/930, which is PSI-PAPER-2018-PSZ. The implementation uses SEAL v2.1 (§6.1, p. 13).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION: semi-honest PSI from leveled fully homomorphic encryption with communication linear in the smaller set and logarithmic in the larger set, made practical by batching, cuckoo and permutation-based hashing, windowing, partitioning, and modulus switching. The complete protocol of Figure 4 (p. 12) is PSI-CONSTRUCTION-2017-CLR. Not recorded separately: the basic protocol of Figure 1 (p. 5), which the paper calls a strawman with \\( O(N_x N_y) \\) homomorphic operations (§3, p. 6); the variant for a receiver holding the larger set, in which the parties switch roles and the result is returned masked (§5.2, p. 13); and the comparison with the protocols of Pinkas et al. and Kolesnikov et al. (§§6.2-6.3, pp. 14-17).","heading":"Contributions"},{"content":"Security is proved only against semi-honest parties (Theorem 2, p. 11), with output to the receiver only (Figure 3, p. 11). The paper discusses but does not address malicious behavior: a malicious sender can influence the receiver's output, and a malicious receiver could add noise to its ciphertexts so that noise flooding no longer hides the sender's set (§5.2, pp. 12-13). Experiments use 32-bit items; longer items require larger FHE parameters, which the authors leave to future work (§6.1, p. 14). Cuckoo-hashing failure probabilities were determined empirically, without a stash (§4.2, pp. 7-8). Reusing the sender's pre-processing across executions is safe only against adversaries that do not force hashing failures (§6.1, p. 14).","heading":"Claim boundary"}],"slug":"clr17","status":"published","subtitle":"Hao Chen, Kim Laine, Peter Rindal · 2017","summary":"Fast Private Set Intersection from Homomorphic Encryption","title":"Fast Private Set Intersection from Homomorphic Encryption","type":"paper","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2017-CLR"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2017-KMPRT","keywords":["multiparty-psi","opprf","programmable-prf","conditional-zero-sharing","augmented-semi-honest","cuckoo-hashing","garbled-bloom-filter","semi-honest","dishonest-majority"],"metadata":{"authors":["Vladimir Kolesnikov","Naor Matania","Benny Pinkas","Mike Rosulek","Ni Trieu"],"contribution_ids":["PSI-CONTRIB-2017-KMPRT-OPPRF","PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2017-KMPRT","keywords":["multiparty-psi","opprf","programmable-prf","conditional-zero-sharing","augmented-semi-honest","cuckoo-hashing","garbled-bloom-filter","semi-honest","dishonest-majority"],"primary_url":"https://eprint.iacr.org/2017/799","review_scope":"IACR ePrint 2017/799, PDF dated 2017-08-24, read in full (§§1-7, Appendices A-B, Figures 1-12, Tables 1-5). The proofs of Theorem 1 (pp. 12-13) and Theorem 2 (proof sketch, pp. 14-15) were read but not re-verified; the security of the hashing-based OPPRF extension is argued informally (§4, p. 10). The CCS proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","venue":"ACM CCS 2017","versions":["IACR ePrint 2017/799, PDF dated 2017-08-24 (full version, as its first footnote states)","ACM CCS 2017, pp. 1257-1272 (bibliographic data as cited in reference [3] of IACR ePrint 2023/1777)"],"year":2017},"primaryUrl":"https://eprint.iacr.org/2017/799","sections":[{"content":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2017-08-24, whose first footnote calls it the full version of an ACM CCS 2017 paper (p. 1). The page range is taken from reference [3] of PSI-PAPER-2024-VCE and was not checked against the ACM Digital Library. The implementation is at github.com/osu-crypto/MultipartyPSI (§7, p. 17).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2017-KMPRT-OPPRF: the oblivious programmable PRF, its three single-query constructions (polynomial, garbled Bloom filter, table), and the hashing-based extension to many points and queries (§§3-4, pp. 4-10). PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI: multiparty PSI against any number of colluding semi-honest parties from conditional zero-sharing and conditional reconstruction over OPPRFs (§5, pp. 10-13; Theorem 1, p. 12). PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING: the augmented semi-honest variant with zero-sharing from pairwise PRF seeds (§6.1, pp. 14-15; Theorem 2, p. 14). Not yet recorded: the optimized three-party protocol with three sequential OPPRF executions instead of four (§6.3, pp. 16-17; Figure 10, p. 16), described in PSI-CONSTRUCTION-2017-KMPRT-3PARTY; the stash-free cuckoo-hashing variant with three primary and two supplementary hash functions (§4, p. 9; Appendix B, pp. 24-25), which §7.2 (p. 19) reports as 168 ms against 211 ms for two-party PSI-PAPER-2016-KKRT at \\( 2^{12} \\) items; and the hint-size optimizations of §6.2 (pp. 15-16).","heading":"Contributions"},{"content":"All protocols are semi-honest or augmented semi-honest (§2.1, p. 4); no malicious security is claimed. Theorem 1 is stated for the protocol of Figure 8 with an ideal OPPRF functionality (p. 12). The OPPRF constructions are built on the KKRT OPRF, which has related keys and leaks slightly more than the PRF output; the paper works with cleaner definitions and states that the PSI protocol remains secure in the standard sense when built from the relaxed building blocks (§3.1, p. 5). Table 1 (p. 3) compares asymptotic costs with Kissner-Song, Cheon-Jarecki-Seo, and Hazay-Venkitasubramaniam, none of which is recorded yet.","heading":"Claim boundary"}],"slug":"kmprt17","status":"published","subtitle":"Vladimir Kolesnikov, Naor Matania, Benny Pinkas et al. · 2017","summary":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","title":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","type":"paper","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2017-KMPRT"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2017-RR-CCS","keywords":["dual-execution","malicious-security","oblivious-encoding","simple-hashing","phasing","encode-commit","ot-extension","uc-security"],"metadata":{"authors":["Peter Rindal","Mike Rosulek"],"contribution_ids":["PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2017-RR-CCS","keywords":["dual-execution","malicious-security","oblivious-encoding","simple-hashing","phasing","encode-commit","ot-extension","uc-security"],"primary_url":"https://eprint.iacr.org/2017/769","review_scope":"IACR ePrint 2017/769, full version dated August 9, 2017, read in full: §§1-7, Figures 1-9, and Appendices A-B. The proof of Theorem 2 was read but not re-verified; Theorem 1 is stated with a proof sketch and Theorem 3 with simulators only, as in the paper. The CCS proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Malicious-Secure Private Set Intersection via Dual Execution","venue":"ACM CCS 2017","versions":["IACR ePrint 2017/769, full version dated August 9, 2017 (PDF dated 2017-08-09), 27 pages (read)","ACM CCS 2017, pp. 1229-1242 (bibliographic data as cited in reference [RR17b] of IACR ePrint 2021/1159; not checked against the ACM Digital Library)"],"year":2017},"primaryUrl":"https://eprint.iacr.org/2017/769","sections":[{"content":"Malicious-Secure Private Set Intersection via Dual Execution","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF, which describes itself as the full version of the CCS 2017 paper (p. 1). Alice is the sender and Bob the receiver who learns the intersection (§2.1, p. 3). The implementations are in github.com/osu-crypto/libPSI (§7, p. 18).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION: malicious security for the OT-based PSI paradigm of Pinkas, Schneider, and Zohner by running oblivious encodings in both directions and comparing common encodings, with simple hashing, phasing, and aggregation of encodings across bins (§5.1-5.2, pp. 7-8; §6.1-6.3, pp. 10-15; Figure 4, p. 12; Theorem 2, p. 13). PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT: the encode-commit variant, in which Alice commits to her items and sends masked decommitments (§5.3, pp. 8-10; §6.4-6.5, pp. 15-17; Theorem 3, p. 16; Figure 9, p. 27). Not carded separately: the oblivious encoding functionality F_encode and its two instantiations (§4, Figure 2, pp. 5-7); its programmable-random-oracle instantiation is the 1-out-of-N OT extension of Orrù, Orsini, and Scholl. Not carded separately: the experimental comparison with De Cristofaro, Kim, and Tsudik, with Rindal and Rosulek (EUROCRYPT 2017), and with the semi-honest protocol of Kolesnikov et al. (§7, Figures 6-8, pp. 18-22); its figures are recorded in the construction rows.","heading":"Contributions"},{"content":"Both protocols give output only to Bob; §6.7 (pp. 17-18) explains why the natural symmetric extension to two-party output fails against a malicious Bob. The ideal functionality allows a corrupt party up to \\( n' > n \\) items, with \\( n' < 4n \\) for \\( n = 2^{20} \\) in the dual-execution protocol (Figure 1, p. 4; §6.3, p. 15); the encode-commit protocol restricts Alice to exactly \\( n \\) items (§6.5, p. 17). Footnote 1 (p. 7) states that it is not known how to make OT of random secrets cheaper without the programmable random oracle model.","heading":"Claim boundary"}],"slug":"rr17","status":"published","subtitle":"Peter Rindal, Mike Rosulek · 2017","summary":"Malicious-Secure Private Set Intersection via Dual Execution","title":"Malicious-Secure Private Set Intersection via Dual Execution","type":"paper","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2017-RR-CCS"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2018-CHLR","keywords":["unbalanced-psi","labeled-psi","fully-homomorphic-encryption","bfv","seal","oprf","diffie-hellman-oprf","omgdh","malicious-receiver","malicious-sender","keyword-pir","extension-field-simd","private-contact-discovery"],"metadata":{"authors":["Hao Chen","Zhicong Huang","Kim Laine","Peter Rindal"],"contribution_ids":["PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","PSI-CONTRIB-2018-CHLR-LONG-ITEMS","PSI-CONTRIB-2018-CHLR-LABELED-PSI","PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2018-CHLR","keywords":["unbalanced-psi","labeled-psi","fully-homomorphic-encryption","bfv","seal","oprf","diffie-hellman-oprf","omgdh","malicious-receiver","malicious-sender","keyword-pir","extension-field-simd","private-contact-discovery"],"primary_url":"https://eprint.iacr.org/2018/787","review_scope":"IACR ePrint 2018/787, PDF dated 2018-08-27, read in full (§§1-8, Appendix A, Figures 1-8, Table 1). The proofs of Theorems 1-3 were read but not re-verified; the heuristic argument and experiments for the H-limited property (§7.3) were not reproduced; FHE parameter choices behind Figure 4 are not listed in the paper and were not checked. The CCS proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","venue":"ACM CCS 2018","versions":["IACR ePrint 2018/787, PDF dated 2018-08-27 (PDF metadata)","ACM CCS 2018, pp. 1223-1237, doi:10.1145/3243734.3243836 (bibliographic data as cited in reference [14] of IACR ePrint 2021/1116)"],"year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2018-08-27 (PDF metadata). Venue, pages, and DOI are taken from reference [14] of PSI-PAPER-2021-CONG and were not checked against the ACM Digital Library. The paper builds on PSI-PAPER-2017-CLR, which it cites as [12] and reviews in §2 (pp. 6-7). The implementation is built on SEAL v2.3.0-4 with BFV (§1.2, p. 2; §8, p. 18).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER: OPRF pre-processing before the FHE intersection, giving security against a malicious receiver and removing noise flooding (§4, pp. 8-11; Theorems 1-2, pp. 15-16). PSI-CONTRIB-2018-CHLR-LONG-ITEMS: arbitrary-length items through SIMD slots over extension fields and a lazy encoding algorithm (§3, pp. 7-8; Table 1, p. 9). PSI-CONTRIB-2018-CHLR-LABELED-PSI: labeled PSI with communication sublinear in the sender's set from label-interpolation polynomials (§5, pp. 11-12; Figures 1-2, pp. 13-14). PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER: security against a malicious sender up to a sender-chosen leakage function, from hash-valued labels and an H-limited leveled FHE assumption (§7.3, pp. 17-18; Appendix A, pp. 25-26). Not recorded separately: PSI with computation, which returns additive secret shares of the per-bin results and labels for a further secure computation with communication \\( O(|Y| \\log |X| + |f|) \\), described without a security theorem (§6, pp. 13-15); the symmetric-key BFV variant that nearly halves fresh ciphertexts (§8.1, p. 18). The complete protocols are PSI-CONSTRUCTION-2018-CHLR (unlabeled), PSI-CONSTRUCTION-2018-CHLR-LABELED, and PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.","heading":"Contributions"},{"content":"Theorem 1 (p. 15) gives one-sided simulation security against a malicious receiver and Theorem 2 (p. 16) privacy, not simulation, against a malicious sender, both for the unlabeled PSI functionality of Figure 3 (p. 15); no theorem is stated for the labeled functionality. Theorem 3 (p. 25) relies on a leveled FHE scheme being H-limited (Definition 1, p. 17), which the authors argue heuristically and support by experiments, without a reduction (§7.3, p. 17). When the sender reuses its pre-processing across receivers and picks the hash functions, a selective cuckoo-hashing failure leaks one bit of the receiver's set (§7.3, p. 18). The authors call full simulation-based security against a malicious sender extremely challenging when communication must stay sublinear in the sender's set (§7.2, p. 16). The OT-based OPRF alternative of §4.4 (pp. 10-11) is discussed but not part of the full protocol.","heading":"Claim boundary"}],"slug":"chlr18","status":"published","subtitle":"Hao Chen, Zhicong Huang, Kim Laine et al. · 2018","summary":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","title":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","type":"paper","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2018-CHLR"},{"evidence":"bibliographic_checked","id":"PSI-PAPER-2018-EKR","keywords":["secure-computation","monograph","custom-protocols","oprf","cuckoo-hashing"],"metadata":{"authors":["David Evans","Vladimir Kolesnikov","Mike Rosulek"],"contribution_ids":[],"dossier_type":"paper","evidence":"bibliographic_checked","id":"PSI-PAPER-2018-EKR","keywords":["secure-computation","monograph","custom-protocols","oprf","cuckoo-hashing"],"primary_url":"https://securecomputation.org/","review_scope":"Basis source for the PSI subfield division. In the authors' PDF dated 2022-06-11, §1.2 (generic versus specialized MPC), §3.8 \"Custom Protocols\" (printed p. 59), §3.8.1 \"Private Set Intersection (PSI)\" (printed pp. 60-63), and §3.9 \"Further Reading\" were read in full. Locators cite the printed page numbers of that PDF. The book makes no new PSI contribution; no contribution card is planned.","status":"published","title":"A Pragmatic Introduction to Secure Multi-Party Computation","venue":"NOW Publishers, 2018","versions":["NOW Publishers, 2018","Authors' PDF at securecomputation.org, version of 2022-06-11"],"year":2018},"primaryUrl":"https://securecomputation.org/","sections":[{"content":"A Pragmatic Introduction to Secure Multi-Party Computation","heading":"Overview"},{"content":"The PDF gives the citation as NOW Publishers, 2018, and identifies itself as the version of June 11, 2022. Locators cite its printed page numbers.","heading":"Version and bibliographic notes"},{"content":"§3.8.1 (pp. 60-63) defines the goal of PSI for a group of parties (p. 60), contrasts PSI on generic MPC with custom protocols (§3.8, pp. 59-60; §3.8.1, p. 60), presents two-party PSI from an OPRF with 3-way cuckoo hashing (\"PSI from OPRF\", pp. 60-62) and the OPRF from 1-out-of-infinity OT (\"More efficient OPRF from 1-out-of-∞ OT\", pp. 62-63), and notes that the extension to more than two parties is not immediate (p. 63).","heading":"Source role"}],"slug":"ekr18","status":"published","subtitle":"David Evans, Vladimir Kolesnikov, Mike Rosulek · 2018","summary":"A Pragmatic Introduction to Secure Multi-Party Computation","title":"A Pragmatic Introduction to Secure Multi-Party Computation","type":"paper","venue":"NOW Publishers, 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2018-EKR"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2018-PSWW","keywords":["circuit-based-psi","cuckoo-hashing","two-dimensional-cuckoo-hashing","mirror-cuckoo-hashing","permutation-based-hashing","stash","psi-cat","gmw","aby","semi-honest"],"metadata":{"authors":["Benny Pinkas","Thomas Schneider","Christian Weinert","Udi Wieder"],"contribution_ids":["PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2018-PSWW","keywords":["circuit-based-psi","cuckoo-hashing","two-dimensional-cuckoo-hashing","mirror-cuckoo-hashing","permutation-based-hashing","stash","psi-cat","gmw","aby","semi-honest"],"primary_url":"https://eprint.iacr.org/2018/120","review_scope":"IACR ePrint 2018/120, full version, PDF dated 2019-01-24, read in full: §§1-6, Appendices A-C, Algorithms 1-3, Figures 1-4, and Tables 1-6. The proof of Theorem 1 (Appendix A, pp. 29-33) was read but not re-verified; Appendix B is a heuristic explanation. The EUROCRYPT proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Efficient Circuit-based PSI via Cuckoo Hashing","venue":"EUROCRYPT 2018","versions":["IACR ePrint 2018/120, full version, PDF dated 2019-01-24 (ePrint lists it as a major revision of the EUROCRYPT 2018 paper)","EUROCRYPT 2018, LNCS Part III, pp. 125-157 (bibliographic data as cited in reference [PSWW18] of IACR ePrint 2019/175)"],"year":2018},"primaryUrl":"https://eprint.iacr.org/2018/120","sections":[{"content":"Efficient Circuit-based PSI via Cuckoo Hashing","heading":"Overview"},{"content":"The ePrint PDF asks to be cited as the EUROCRYPT 2018 paper (footnote on p. 1). Its first page gives no proceedings pages; those are taken from the reference list of PSI-PAPER-2019-GS. The hashing simulation code and the PSI implementation in the ABY framework are announced in §6.1 (p. 19) and §6.3 (p. 24).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT: mirror cuckoo hashing and the resulting circuit-based PSI with \\( \\omega(n) \\) comparisons and negligible failure probability, including the stash bound for non-constant stash size (§4, pp. 10-13; Appendix C, p. 34). PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING: two-dimensional cuckoo hashing, its \\( O(1/n) \\) failure analysis, and the concretely efficient PSI protocol with two-item bins and a combined stash (§5, pp. 13-18; §6, pp. 19-26; Appendix A, pp. 29-33). Not listed as separate contributions: the generalization of 2D cuckoo hashing to more parties with \\( 2^{m} \\) tables (§5.3, p. 18), the use of lookup-table evaluation to cut communication by up to 4.1 times (§6.2, p. 23), and the extension of PSI-CAT to privacy-preserving ridesharing (§6.3, p. 26).","heading":"Contributions"},{"content":"Security is semi-honest only; the authors see no way to extend their hashing to malicious adversaries (§5.4, p. 18). The parameters of the concrete protocol rest on about 5.5 million core hours of simulations rather than on an analysis of two-item bins (§3.3, p. 10; §6.1, p. 20; Appendix A, p. 29). No security proof is given; security follows from the generic two-party computation protocol (§5.2, p. 16).","heading":"Claim boundary"}],"slug":"psww18","status":"published","subtitle":"Benny Pinkas, Thomas Schneider, Christian Weinert et al. · 2018","summary":"Efficient Circuit-based PSI via Cuckoo Hashing","title":"Efficient Circuit-based PSI via Cuckoo Hashing","type":"paper","venue":"EUROCRYPT 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2018-PSWW"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2018-PSZ","keywords":["ot-extension","oprf","cuckoo-hashing","permutation-based-hashing","bch-code","circuit-based-psi","naive-hashing","unequal-set-sizes","survey"],"metadata":{"authors":["Benny Pinkas","Thomas Schneider","Michael Zohner"],"contribution_ids":["PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2018-PSZ","keywords":["ot-extension","oprf","cuckoo-hashing","permutation-based-hashing","bch-code","circuit-based-psi","naive-hashing","unequal-set-sizes","survey"],"primary_url":"https://eprint.iacr.org/2016/930","review_scope":"IACR ePrint 2016/930, PDF dated 2019-07-28, read in full: §§1-6, Protocols 1-3, Tables 1-13, Figures 1-3, and the reference list. It is also a basis source for the PSI subfield division, through §1.2 \"Classification of PSI Protocols\" (pp. 3-5) and §6.2.3 \"PSI with Unequal Set Sizes\" (pp. 29-30). The security argument of §5 (p. 23) was read but not re-verified; the empirical hashing results of §3 were not reproduced. The journal citation is the one given in the paper's first footnote and reference [65]; the ACM TOPS version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Scalable Private Set Intersection Based on OT Extension","venue":"ACM Transactions on Privacy and Security 21(2)","versions":["ACM TOPS 21(2):7:1-7:35, January 2018, doi:10.1145/3154794","IACR ePrint 2016/930, PDF dated 2019-07-28"],"year":2018},"primaryUrl":"https://eprint.iacr.org/2016/930","sections":[{"content":"Scalable Private Set Intersection Based on OT Extension","heading":"Overview"},{"content":"The paper asks to be cited as the ACM TOPS 2018 journal version and describes itself as a combined and extended version of the USENIX Security 2014 and 2015 papers (PSI-PAPER-2014-PSZ and PSI-PAPER-2015-PSSZ), with the additions listed in §1.4 and marked \"ADDED\" or \"EXTENDED\" in section headings (first footnote, p. 1; §1.4, pp. 6-7). Locators cite the ePrint PDF dated 2019-07-28.","heading":"Version and bibliographic notes"},{"content":"§1.2 (pp. 3-5) discusses PSI protocols under the headings \"A naive solution\" (insecure hashing), \"Third Party-Based PSI\", \"Public-Key-Based PSI\", \"Circuit-Based PSI\", and \"OT-Based PSI\". §6.2.3 (pp. 29-30) runs the best protocol of each class on unequal set sizes. Three of the five PSI subfields of this atlas take their scope from the public-key-based, circuit-based, and OT-based classes.","heading":"Source role"},{"content":"The paper lists its contributions in §1.3 (pp. 5-6) and its additions to the conference versions in §1.4 (pp. 6-7). PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI: the OT-based PSI protocol with per-bin OPRFs from 1-out-of-N random OT over a fixed 512-bit BCH code, whose communication no longer depends on item bit length (§2.2.3, p. 11; §5, Protocol 3, pp. 21-23). The construction is PSI-CONSTRUCTION-2018-PSZ-OT. PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS: concrete parameters for simple and cuckoo hashing in PSI (§3, pp. 12-18). Not carded here because they first appeared in the conference papers, which are separate identities without full text in this release: permutation-based hashing for PSI (§3.3, pp. 17-18; from PSI-PAPER-2015-PSSZ, whose title names it); circuit-based PSI with the sort-compare-shuffle circuit on GMW and the pairwise-comparison circuit with hashing (§4.1-4.2, pp. 18-20). Not carded: the description and benchmark of the circuit-based OPRF protocol of Pinkas, Schneider, Smart, and Williams (§4.3, pp. 20-21, marked ADDED), which the paper finds close to server-aided PSI in run-time for unequal set sizes (§6.2.3, p. 30; Table 12, p. 30); and the same-platform comparison of naive hashing, server-aided, public-key, circuit-based, and OT-based protocols (§6, Tables 8-13, pp. 24-31).","heading":"Contributions"},{"content":"All protocols compared are semi-honest (§2.1, p. 8). The paper observes that existing two-party PSI protocols all seem to have communication linear in both set sizes (§6.2.3, p. 30) and that dependence on the larger set seems inevitable if brute-force searches are to be prevented (§1.1, p. 3). The text of §6.2.3 gives client sets of \\( 2^{8} \\) and \\( 2^{16} \\) items while Tables 11-13 use \\( 2^{8} \\) and \\( 2^{12} \\) (p. 29; pp. 30-31).","heading":"Claim boundary"}],"slug":"psz18","status":"published","subtitle":"Benny Pinkas, Thomas Schneider, Michael Zohner · 2018","summary":"Scalable Private Set Intersection Based on OT Extension","title":"Scalable Private Set Intersection Based on OT Extension","type":"paper","venue":"ACM Transactions on Privacy and Security 21(2)","year":2018,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2018-PSZ"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2019-GS","keywords":["threshold-psi","communication-complexity","lower-bound","set-reconciliation","sparse-polynomial","hankel-matrix","intersection-cardinality-testing","noisy-polynomial-addition","ole","fhe","additively-homomorphic-encryption"],"metadata":{"authors":["Satrajit Ghosh","Mark Simkin"],"contribution_ids":["PSI-CONTRIB-2019-GS-LOWER-BOUND","PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2019-GS","keywords":["threshold-psi","communication-complexity","lower-bound","set-reconciliation","sparse-polynomial","hankel-matrix","intersection-cardinality-testing","noisy-polynomial-addition","ole","fhe","additively-homomorphic-encryption"],"primary_url":"https://eprint.iacr.org/2019/175","review_scope":"IACR ePrint 2019/175, PDF dated 2020-05-27, read in full: §§1-9, Theorems 1-5, Lemmas 1-4, and Figures 1-11. Proofs were read but not re-verified; the FHE upper bound and the garbled-circuit bound in §3 are sketches. The CRYPTO proceedings version was not compared; it lacks §8 (§1.3, p. 4). All locators cite the ePrint PDF pages.","status":"published","title":"The Communication Complexity of Threshold Private Set Intersection","venue":"CRYPTO 2019","versions":["IACR ePrint 2019/175, PDF dated 2020-05-27 (last of seven revisions; adds the multiparty extension of §8 after the CRYPTO 2019 extended abstract, see §1.3)","CRYPTO 2019, LNCS, pp. 3-29 (as given in the paper's own reference [GS19])"],"year":2019},"primaryUrl":"https://eprint.iacr.org/2019/175","sections":[{"content":"The Communication Complexity of Threshold Private Set Intersection","heading":"Overview"},{"content":"The ePrint page describes the PDF as a minor revision of the CRYPTO 2019 paper. The version read includes §8, multiparty threshold PSI, which §1.3 (p. 4) says was added after the CRYPTO extended abstract; footnote 7 (p. 18) thanks Badrinarayanan, Miao, and Rindal for pointing out that numerator and denominator polynomials may share roots in the multiparty cardinality test.","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2019-GS-LOWER-BOUND: an \\( \\Omega(t) \\) communication lower bound for any two-party threshold PSI protocol (§3, pp. 7-8). PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND: an \\( O(t \\log p) \\) protocol from fully homomorphic encryption and set reconciliation (§3, p. 8). PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI: the main protocol with communication \\( \\tilde O(t^{2}) \\) from additively homomorphic encryption and OLE, through private intersection cardinality testing and noisy polynomial addition (§§4-7, pp. 9-17). Not listed as separate contributions: the garbled-circuit sketch with communication at least \\( \\tilde O(t^{3}) \\) (§3, p. 9); the treatment of unequal set sizes by padding (§6.4, p. 15); and the multiparty cardinality test from threshold FHE with communication \\( \\tilde O(t) \\) and the multiparty threshold PSI from generic MPC (§8, pp. 17-19), which are sketches without theorems.","heading":"Contributions"},{"content":"Security is against static passive adversaries in the UC framework (§2.2, p. 6). The authors present the results as feasibility results of theoretical interest and do not claim practicality (§1.1, p. 2). \\( \\tilde O \\) hides polylogarithmic factors (§2, p. 4); set elements lie in a field \\( \\mathbb{F}_p \\) with \\( p \\) a \\( \\Theta(\\kappa) \\)-bit prime (§2, p. 4).","heading":"Claim boundary"}],"slug":"gs19","status":"published","subtitle":"Satrajit Ghosh, Mark Simkin · 2019","summary":"The Communication Complexity of Threshold Private Set Intersection","title":"The Communication Complexity of Threshold Private Set Intersection","type":"paper","venue":"CRYPTO 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2019-GS"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2019-KRSSW","keywords":["unbalanced-psi","private-contact-discovery","precomputation","oprf","garbled-circuits","naor-reingold-prf","lowmc","cuckoo-filter","correlated-ot","ot-extension","malicious-client","android","armv8","signal"],"metadata":{"authors":["Daniel Kales","Christian Rechberger","Thomas Schneider","Matthias Senker","Christian Weinert"],"contribution_ids":["PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2019-KRSSW","keywords":["unbalanced-psi","private-contact-discovery","precomputation","oprf","garbled-circuits","naor-reingold-prf","lowmc","cuckoo-filter","correlated-ot","ot-extension","malicious-client","android","armv8","signal"],"primary_url":"https://eprint.iacr.org/2019/517","review_scope":"IACR ePrint 2019/517, full version, PDF dated 2019-05-24, read in full (§§1-7, Appendices A-D, Figures 1-3, Tables 1-8). The paper gives no security proofs; security against malicious clients is argued in prose (§4.5). LowMC round counts (Table 2) and cuckoo-filter false-positive rates (§4.1) were not recomputed. The USENIX proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Mobile Private Contact Discovery at Scale","venue":"USENIX Security 2019","versions":["IACR ePrint 2019/517 (full version), PDF dated 2019-05-24 (PDF metadata)","USENIX Security 2019 (cited in the ePrint as reference [KRS+19], 'to appear', with author order Kales, Rechberger, Senker, Schneider, Weinert)"],"year":2019},"primaryUrl":"https://eprint.iacr.org/2019/517","sections":[{"content":"Mobile Private Contact Discovery at Scale","heading":"Overview"},{"content":"Title and authors were checked against the ePrint full version (PDF metadata dated 2019-05-24). The title page lists the authors as Kales, Rechberger, Schneider, Senker, Weinert; the paper's own reference to the USENIX Security 2019 version lists Kales, Rechberger, Senker, Schneider, Weinert. Both orders give the same initials. Venue details were not checked against the USENIX proceedings. The implementation is at contact-discovery.github.io (§5, footnote 6, p. 11).","heading":"Version and bibliographic notes"},{"content":"The paper optimizes two precomputed unbalanced PSI protocols of Kiss, Liu, Schneider, Asokan, and Pinkas (PoPETs 2017): GC-PSI, an OPRF evaluated by garbled circuits, and NR-PSI, an oblivious evaluation of the Naor-Reingold PRF (§1.1, p. 2; §3.5, p. 6). PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION: correlated-OT precomputation that halves online OT communication (§4.3, p. 8; §4.4, p. 10). PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION: a compressed cuckoo-filter encoding of the server set, smaller updates, and realistic false-positive parameters (§4.1, pp. 6-7). PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF: LowMC parameters for the garbled-circuit OPRF with 8.2 times fewer AND gates than AES-128 (§4.2, pp. 7-8). PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION: native ARMv8 implementations with security against malicious clients and their measurement (§4.5, pp. 10-11; §§5-6, pp. 11-14). Not recorded separately: the survey of contact discovery in twelve mobile messengers (§1.2, p. 3; Table 1, p. 3); the proposed combinations with multi-server PIR and with FHE-based PSI, a dedicated filter server, and database partitioning, none of them implemented (§4.6, p. 11; Appendix A, pp. 18-19); the Signal prototype (Appendix C, p. 19). The complete protocols are PSI-CONSTRUCTION-2019-KRSSW-GC (Figure 1, p. 9) and PSI-CONSTRUCTION-2019-KRSSW-NR (Figure 2, p. 10).","heading":"Contributions"},{"content":"The server is assumed semi-honest; a malicious server could learn about client items whenever the client reveals the intersection to it, as messaging apps do (§4.5, p. 11). Enumeration attacks by repeated queries remain possible and are left to rate limiting (§4.5, p. 11). The setup phase sends the client a filter linear in the server set, about 1 GiB for \\( 2^{28} \\) items, which the authors name as the bottleneck for very large sets (§4.6, p. 11). Cuckoo filters give a nonzero false-positive probability, about \\( 2^{-29} \\) per item in the experiments (§4.1, p. 6; Table 4, p. 13). The authors report Signal's stated requirements for deploying PSI-based contact discovery, a server database of \\( 10^{9} \\) users, address books of up to 10,000 contacts, lookups under 2 s, and 1,600 contacts per second on one core, and state that these are not yet met (§7, p. 14; the figures were rechecked on 2026-10-12 in the §7 of the USENIX Security 2019 version).","heading":"Claim boundary"}],"slug":"krssw19","status":"published","subtitle":"Daniel Kales, Christian Rechberger, Thomas Schneider et al. · 2019","summary":"Mobile Private Contact Discovery at Scale","title":"Mobile Private Contact Discovery at Scale","type":"paper","venue":"USENIX Security 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2019-KRSSW"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2019-PSTY","keywords":["circuit-based-psi","opprf","batched-opprf","programmable-prf","cuckoo-hashing","linear-communication","dual-execution","stash","payload","gmw","aby","semi-honest"],"metadata":{"authors":["Benny Pinkas","Thomas Schneider","Oleksandr Tkachenko","Avishay Yanai"],"contribution_ids":["PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-PAYLOAD"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2019-PSTY","keywords":["circuit-based-psi","opprf","batched-opprf","programmable-prf","cuckoo-hashing","linear-communication","dual-execution","stash","payload","gmw","aby","semi-honest"],"primary_url":"https://eprint.iacr.org/2019/241","review_scope":"IACR ePrint 2019/241, PDF dated 2019-02-28, read in full: §§1-7, Definitions 1-2, Constructions 2 and 4, Theorems 3, 5, and 8, Functionalities 1 and 6, Protocols 7, 9, and 10, and Tables 1-5. The proofs of Theorems 3, 5, and 8 were read but not re-verified. The ePrint revision of 2019-03-13 and the EUROCRYPT proceedings version were not compared. All locators cite the PDF pages of the 2019-02-28 version.","status":"published","title":"Efficient Circuit-based PSI with Linear Communication","venue":"EUROCRYPT 2019","versions":["IACR ePrint 2019/241, PDF dated 2019-02-28 (the ePrint page lists a revision of 2019-03-13, which was not compared)","EUROCRYPT 2019, LNCS 11478, pp. 122-153 (bibliographic data as cited in reference [50] of IACR ePrint 2019/723)"],"year":2019},"primaryUrl":"https://eprint.iacr.org/2019/241","sections":[{"content":"Efficient Circuit-based PSI with Linear Communication","heading":"Overview"},{"content":"Title and authors were checked against the PDF dated 2019-02-28. Venue and pages are taken from the reference list of PSI-PAPER-2020-ION and the ePrint page, which says the paper was published by the IACR in EUROCRYPT 2019. The implementation is at github.com/encryptogroup/OPPRF-PSI (footnote 8, p. 26).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF: the one-time programmable PRF with correlated targets and its batched version, whose single polynomial hint over all bins has size linear in the total number of programmed points (§3, pp. 10-16). PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION: circuit-based PSI with \\( O(n) \\) communication, through one comparison per bin and either a role-reversed phase for the stash or stash-less cuckoo hashing with three hash functions (§§4-5, pp. 16-21). PSI-CONTRIB-2019-PSTY-PAYLOAD: injection of the sender's payloads into the circuit through a second batched OPPRF (§6, pp. 21-22). Not listed as separate contributions: the mega-bin split that lowers the cost of polynomial interpolation (§4.3, p. 18; §7.2, pp. 23-24) and the PSI-CAT comparison with earlier public-key threshold protocols (§7.4, pp. 27-28).","heading":"Contributions"},{"content":"Security is semi-honest (§2.2, p. 8). The protocol's security is stated to follow from the OPPRF and generic two-party computation (§4.1, p. 17); the OPPRF is proved in the F_OPRF-hybrid model (Theorem 8, p. 15). Only the stash-less protocol was implemented; the run times of the basic and dual-execution protocols are estimates (§7.4, p. 26; Table 5, p. 27).","heading":"Claim boundary"}],"slug":"psty19","status":"published","subtitle":"Benny Pinkas, Thomas Schneider, Oleksandr Tkachenko et al. · 2019","summary":"Efficient Circuit-based PSI with Linear Communication","title":"Efficient Circuit-based PSI with Linear Communication","type":"paper","venue":"EUROCRYPT 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2019-PSTY"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2020-ION","keywords":["intersection-sum","intersection-cardinality","diffie-hellman","additively-homomorphic-encryption","paillier","random-ot","bloom-filter","deployment","monetary-cost","ad-conversion","semi-honest"],"metadata":{"authors":["Mihaela Ion","Ben Kreuter","Ahmet Erhan Nergiz","Sarvar Patel","Shobhit Saxena","Karn Seth","Mariana Raykova","David Shanahan","Moti Yung"],"contribution_ids":["PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2020-ION","keywords":["intersection-sum","intersection-cardinality","diffie-hellman","additively-homomorphic-encryption","paillier","random-ot","bloom-filter","deployment","monetary-cost","ad-conversion","semi-honest"],"primary_url":"https://eprint.iacr.org/2019/723","review_scope":"IACR ePrint 2019/723, PDF dated 2020-09-05, read in full in §§1-6, Figures 1-4, Tables 1-7, and Appendices A-B; Appendices C-H (proofs of Theorems 1-4, the reverse variants, and further encryption comparisons) were skimmed, not verified. The EuroS&P proceedings version and the 2017 technical report were not compared. All locators cite the ePrint PDF pages.","status":"published","title":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","venue":"IEEE EuroS&P 2020","versions":["IACR ePrint 2019/723, PDF dated 2020-09-05 (ePrint page: received 2019-06-18, revised 2020-09-07, noted as published in Euro S&P 2020)","An earlier technical report by most of the same authors is cited by later papers as IACR ePrint 2017/738; it was not read"],"year":2020},"primaryUrl":"https://eprint.iacr.org/2019/723","sections":[{"content":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","heading":"Overview"},{"content":"Title and authors follow the PDF dated 2020-09-05; the ePrint page lists the same nine authors with Mariana Raykova placed after Sarvar Patel. The venue is taken from the ePrint page. PSI-PAPER-2018-PSWW and PSI-PAPER-2019-PSTY cite an earlier version of the deployed protocol as the 2017 ePrint report \"Private intersection-sum protocol with applications to attributing aggregate ad conversions\" (reference [IKN+17] in both).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM: the deployed private intersection-sum-with-cardinality protocol from Diffie-Hellman double masking and additively homomorphic encryption (§3, pp. 5-7; Figure 2, p. 6). PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM: the protocol from batched random OT with a shuffle and re-masking of the OPRF outputs (§4.3.1, pp. 9-10; Figure 3, p. 10). Not listed as separate contributions: the \"Tag, Shuffle, Aggregate\" recipe for turning a PSI protocol into an intersection-sum-with-cardinality protocol (§4.2, pp. 8-9); the encrypted-Bloom-filter protocol (§4.3.2, pp. 10-11; Figure 4), which is the comparison row PSI-CONSTRUCTION-2020-ION-BF; the monetary cost model for batch computation (§2.5, p. 4; Table 1, p. 5); and the reverse variants in which the identifier-only party receives the sum (§3.4, p. 7; Appendix G).","heading":"Contributions"},{"content":"All protocols are semi-honest (§1, p. 2; §2.3, p. 4) and reveal the intersection size besides the sum, which the authors note may be undesirable leakage in other settings (§4.2, p. 9). The comparison with garbled-circuit protocols mixes measurement settings, as the authors state (§5.3, p. 12).","heading":"Claim boundary"}],"slug":"ikn20","status":"published","subtitle":"Mihaela Ion, Ben Kreuter, Ahmet Erhan Nergiz et al. · 2020","summary":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","title":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","type":"paper","venue":"IEEE EuroS&P 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2020-ION"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2020-PRTY","keywords":["paxos","probe-and-xor-of-strings","garbled-cuckoo-table","cuckoo-graph","oos-ot-extension","malicious","linear-communication","two-party"],"metadata":{"authors":["Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"contribution_ids":["PSI-CONTRIB-2020-PRTY-PAXOS","PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2020-PRTY","keywords":["paxos","probe-and-xor-of-strings","garbled-cuckoo-table","cuckoo-graph","oos-ot-extension","malicious","linear-communication","two-party"],"primary_url":"https://eprint.iacr.org/2020/193","review_scope":"IACR ePrint 2020/193, PDF dated 2020-02-16 (36 pages), read in full: §§1-7, Figures 1-7, Tables 1-2, and Appendices A-D. The proofs of Lemmas 5-6, Theorem 8, Lemma 10, Theorem 11, and Lemma 12 were read but not re-verified. The EUROCRYPT proceedings version was not compared. All locators cite the ePrint PDF pages, which equal the printed page numbers.","status":"published","title":"PSI from PaXoS: Fast, Malicious Private Set Intersection","venue":"EUROCRYPT 2020","versions":["IACR ePrint 2020/193, PDF dated 2020-02-16","EUROCRYPT 2020, Part II, LNCS 12106, pp. 739-767 (bibliographic data as cited in reference [PRTY20] of IACR ePrint 2021/883)"],"year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"PSI from PaXoS: Fast, Malicious Private Set Intersection","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2020-02-16. Venue, volume, and pages are taken from the reference list of PSI-PAPER-2021-GPRTY and were not checked against the publisher. The authors point to their source code under github.com/cryptobiu; the repository name is split across a page break in the PDF (§1.1, pp. 2-3).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2020-PRTY-PAXOS: the probe-and-XOR of strings, an input-independent binary key-value encoding with XOR-homomorphic decoding (Definition 3, p. 6; §3, pp. 5-9). PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO: the garbled cuckoo table, a PaXoS of constant rate with linear-time encoding (§5, pp. 16-21), and its DFS-based variant (Appendix B, pp. 29-31). PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI: two-party PSI from any PaXoS and the OOS OT extension, malicious or semi-honest by the choice of code (Figure 3, p. 11; Theorem 4, p. 10). PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND: the incompressibility bound on a malicious receiver's effective set (Claim 7, p. 15; Appendix A, pp. 27-29). Not separately recorded: the bound on the number of cycles in a cuckoo graph (Lemma 12, Appendix C, pp. 31-32), which is part of the garbled cuckoo table's analysis, and the qualitative comparison of PSI paradigms (Appendix D, pp. 32-36). The complete protocols are PSI-CONSTRUCTION-2020-PRTY-SH and PSI-CONSTRUCTION-2020-PRTY-MAL.","heading":"Contributions"},{"content":"The adversary corrupts one of two parties statically (§2, p. 5), and only the receiver learns the intersection (Figure 1, p. 6). The ideal functionality lets a corrupt party use a set larger than advertised (§2, p. 5). Theorem 4 (p. 10) is proved in the random oracle model with OOS as an ideal functionality; Appendix D (p. 33) states standard-model security for the semi-honest case without a separate proof. The introduction's claim that the semi-honest instantiation improves on KKRT's communication by 25% (§1.1, p. 2) does not match Table 1 (p. 21) or §7.3 (p. 23), which put PaXoS-PSI above KKRT; this was not resolved. The protocol targets sets of roughly equal size (Appendix D, p. 36).","heading":"Claim boundary"}],"slug":"prty20","status":"published","subtitle":"Benny Pinkas, Mike Rosulek, Ni Trieu et al. · 2020","summary":"PSI from PaXoS: Fast, Malicious Private Set Intersection","title":"PSI from PaXoS: Fast, Malicious Private Set Intersection","type":"paper","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2020-PRTY"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2021-BMRR","keywords":["threshold-psi","multiparty-psi","communication-complexity","lower-bound","threshold-fhe","threshold-additive-homomorphic-encryption","hankel-matrix","half-gcd","cardinality-testing","star-network"],"metadata":{"authors":["Saikrishna Badrinarayanan","Peihan Miao","Srinivasan Raghuraman","Peter Rindal"],"contribution_ids":["PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","PSI-CONTRIB-2021-BMRR-LOWER-BOUND","PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2021-BMRR","keywords":["threshold-psi","multiparty-psi","communication-complexity","lower-bound","threshold-fhe","threshold-additive-homomorphic-encryption","hankel-matrix","half-gcd","cardinality-testing","star-network"],"primary_url":"https://eprint.iacr.org/2020/600","review_scope":"IACR ePrint 2020/600, PDF dated 2021-02-25, read in full: §§1-7 and Appendices A-C, Theorems 4.1, 4.3, 5.1, 5.4, 6.5, 7.1, B.1, and C.1, Corollaries 4.2, 4.4, 6.6, 7.2, and B.2, and Figures 1-10. Proofs were read but not re-verified; Imported Theorems 2.2 and 6.1-6.4 were not checked against their sources. The PKC 2021 proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","venue":"PKC 2021","versions":["IACR ePrint 2020/600, PDF dated 2021-02-25 (ePrint page: received 2020-05-22, last of two revisions 2021-03-01, noted as a minor revision of the PKC 2021 paper; the PDF date precedes the last listed revision and the two were not compared)"],"year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","heading":"Overview"},{"content":"Title and authors were checked against the PDF dated 2021-02-25; the venue is taken from the ePrint page. The paper treats the multiparty extension in the full version of PSI-PAPER-2019-GS as concurrent work and reports that it initially overlooked an unexpected degree reduction, fixed after notification (§1.3, p. 5; footnote 6, p. 11).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES: two multiparty threshold PSI functionalities, equal for two parties and different for more (§1.1, p. 2; §2.3, p. 6; Figures 1-4). PSI-CONTRIB-2021-BMRR-LOWER-BOUND: \\( \\Omega(nT) \\) communication for both functionalities in point-to-point networks, and \\( \\Omega(T \\log n + n) \\) for the first in the broadcast model (§4, pp. 15-17; Appendix C, pp. 40-42). PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND: matching \\( O(nT) \\) protocols for both functionalities from threshold FHE (§5, pp. 17-23; §7, pp. 28-30; Appendix B, pp. 39-41). PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI: an \\( \\tilde O(nT) \\) protocol for the second functionality from threshold additively homomorphic encryption, whose two-party case gives \\( \\tilde O(T) \\) from additively homomorphic encryption (§6, pp. 24-28; §7, pp. 28-30; §1.2, p. 4). Not listed as separate contributions: the use of repeated threshold PSI with \\( T = 1, 2, 4, \\dots \\) to obtain multiparty PSI with communication independent of the set sizes, and the observation that the protocols are compact MPC in the plain model (§1.2, p. 4).","heading":"Contributions"},{"content":"All protocols are semi-honest with up to \\( n - 1 \\) corruptions and run in a star network (§1.1, p. 3; §2.3, p. 6). Upper bounds omit a \\( \\mathrm{poly}(\\lambda) \\) factor and \\( \\tilde O \\) hides polylogarithmic factors (footnote 1, p. 3). Whether the first functionality admits a protocol from assumptions weaker than threshold FHE is marked unknown (Table 1, p. 3). On the claim to settle the open problem of PSI-PAPER-2019-GS: the abstract says that, as a direct implication, the paper designs a two-party protocol with communication \\( \\tilde O(T) \\) from assumptions weaker than FHE (p. 1); §1.2 says the case \\( n = 2 \\) gives \\( \\tilde O(T) \\) from additively homomorphic encryption, referring to §§6-7 (p. 4); §3.3 attributes the gain to testing Hankel-matrix singularity through the half-GCD connection of Brent, Gustavson, and Yun, quasi-linear instead of the quadratic protocol of Kiltz et al. (p. 13). In the two-party case the singularity test is instantiated with Yao's garbled circuits at communication \\( \\tilde O(k \\cdot \\mathrm{poly}(\\lambda)) \\) for a \\( (k + 1) \\times (k + 1) \\) Hankel matrix (§6.1, p. 26), and the intersection step uses additively homomorphic encryption alone with communication \\( O(T \\cdot \\mathrm{poly}(\\lambda)) \\) (§7.1, p. 29). The later paper of Ghosh and Simkin, PSI-PAPER-2023-GS (ePrint 2023/919, PDF dated 2023-06-12), accepts the two-party result: it states that communication \\( O(\\lambda t\\,\\mathrm{polylog}\\,t) \\) without fully homomorphic encryption follows from the construction of PSI-PAPER-2019-GS combined with an observation of Badrinarayanan et al., and that its own two-party protocol does not improve on this (paper outline and footnote 5, p. 4). For more than two parties it notes that this paper's quasilinear protocol without FHE additionally requires fewer than \\( t \\) distinct elements outside the intersection among all sets (§1, pp. 1-2), and it counts this paper among the works that leave asymptotically optimal multiparty threshold PSI from assumptions other than FHE open (§1, p. 2).","heading":"Claim boundary"}],"slug":"bmrr21","status":"published","subtitle":"Saikrishna Badrinarayanan, Peihan Miao, Srinivasan Raghuraman et al. · 2021","summary":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","title":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","type":"paper","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2021-BMRR"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2021-CONG","keywords":["unbalanced-psi","labeled-psi","fully-homomorphic-encryption","bfv","bgv","seal","helib","apsi","paterson-stockmeyer","postage-stamp-bases","frobenius-automorphism","oprf","fourq","omgdh"],"metadata":{"authors":["Kelong Cong","Radames Cruz Moreno","Mariana Botelho da Gama","Wei Dai","Ilia Iliashenko","Kim Laine","Michael Rosenberg"],"contribution_ids":["PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2021-CONG","keywords":["unbalanced-psi","labeled-psi","fully-homomorphic-encryption","bfv","bgv","seal","helib","apsi","paterson-stockmeyer","postage-stamp-bases","frobenius-automorphism","oprf","fourq","omgdh"],"primary_url":"https://eprint.iacr.org/2021/1116","review_scope":"IACR ePrint 2021/1116, PDF dated 2021-11-14, read in full (§§1-6, Appendices A-D, Figures 1-2, Tables 1-8). The proofs of Lemmas 1 and 2 (Appendices B and C) were read but not re-verified; the security argument is a reference to the earlier paper's Theorem 1 plus a sketch for the labeled case (§3, p. 6; §4.2, p. 14). FHE parameter choices were not rechecked with the LWE estimator. The CCS proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","venue":"ACM CCS 2021","versions":["IACR ePrint 2021/1116, PDF dated 2021-11-14 (PDF metadata)","ACM CCS 2021 (the ePrint PDF names no venue; not checked against the proceedings)"],"year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2021-11-14 (PDF metadata). The PDF names no venue; ACM CCS 2021 was not checked against the proceedings. The paper refines PSI-PAPER-2017-CLR and PSI-PAPER-2018-CHLR, cited as [15] and [14] (§1.1, p. 3; §1.2, p. 3). The SEAL-based implementation is the open-source APSI library (§5, footnote 7, p. 15); the HElib implementation is a proof of concept without OPRF or networking (§5, p. 15).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER: evaluation of each bin's intersection polynomial with \\( O(\\sqrt{B}) \\) ciphertext-ciphertext multiplications (§3.1, pp. 7-9; Appendix A). PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES: extremal postage-stamp bases in place of windowing for the receiver's encrypted powers (§3.1, pp. 10-11). PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS: depth-free Frobenius powers giving communication nearly constant in the larger set (§3.1, pp. 11-12; §5.4, pp. 18-20). PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS: arbitrary-length items and labels over prime-field SIMD slots, with OPRF hashing made mandatory (§3.1, p. 7; §4.2, pp. 13-14). Not recorded separately: a hash-to-curve map for the FourQ curve used by the OMGDH-based OPRF, measured at about 12,000 cycles (§3.1, p. 12); the partitioning of very large sender sets into several protocol runs (§5.2, p. 18); and the security sketch for the labeled case (§4.2, p. 14). The complete protocols are PSI-CONSTRUCTION-2021-CONG (unlabeled, SEAL), PSI-CONSTRUCTION-2021-CONG-LABELED (labeled, SEAL), and PSI-CONSTRUCTION-2021-CONG-FROBENIUS (HElib proof of concept).","heading":"Contributions"},{"content":"The paper states that its security guarantees and proof are those of the earlier labeled-PSI paper: security against a malicious receiver and privacy against a malicious sender in the random oracle model (§3, p. 6); the labeled case is argued as a straightforward extension (§4.2, p. 14). The low-communication variant has impractically high computation on current CPUs (abstract, p. 1; §6, p. 20). Experiments use a false-positive probability of at most \\( 2^{-40} \\) per execution (§5.1, p. 16). Comparisons with the earlier protocol use a 24-core machine that the authors assume comparable to the earlier 32-core one (§5, p. 14).","heading":"Claim boundary"}],"slug":"cmg21","status":"published","subtitle":"Kelong Cong, Radames Cruz Moreno, Mariana Botelho da Gama et al. · 2021","summary":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","title":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","type":"paper","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2021-CONG"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2021-GPRTY","keywords":["okvs","oblivious-key-value-store","garbled-cuckoo-table","hypergraph-peeling","correctness-amplification","paxos-psi","vector-ole","multiparty-psi","malicious"],"metadata":{"authors":["Gayathri Garimella","Benny Pinkas","Mike Rosulek","Ni Trieu","Avishay Yanai"],"contribution_ids":["PSI-CONTRIB-2021-GPRTY-OKVS","PSI-CONTRIB-2021-GPRTY-3H-GCT","PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2021-GPRTY","keywords":["okvs","oblivious-key-value-store","garbled-cuckoo-table","hypergraph-peeling","correctness-amplification","paxos-psi","vector-ole","multiparty-psi","malicious"],"primary_url":"https://eprint.iacr.org/2021/883","review_scope":"IACR ePrint 2021/883, PDF dated 2021-11-30 (39 pages), read in full: §§1-8, Figures 1-5, Tables 1-4, and Appendices A-B. The proofs of Lemma 6 (sketched in Appendix A.1) and Theorem 9 were read but not re-verified; Theorem 7 is stated without a written proof. The CRYPTO proceedings version was not compared. All locators cite the ePrint PDF pages, which equal the printed page numbers.","status":"published","title":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","venue":"CRYPTO 2021","versions":["IACR ePrint 2021/883, PDF dated 2021-11-30","CRYPTO 2021, Part II, LNCS 12826, pp. 395-425 (bibliographic data as cited in reference [GPR+21] of IACR ePrint 2022/320)"],"year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","heading":"Overview"},{"content":"Title, authors, and date were checked against the ePrint PDF dated 2021-11-30. Venue, volume, and pages are taken from the reference list of PSI-PAPER-2022-RR and were not checked against the publisher.","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2021-GPRTY-OKVS: the definition of oblivious key-value stores, with linear, binary, and overfitting notions (§2, pp. 5-7), and the catalog of existing instances (§3, pp. 7-9). PSI-CONTRIB-2021-GPRTY-3H-GCT: the three-hash garbled cuckoo table (§4.1, pp. 9-11). PSI-CONTRIB-2021-GPRTY-AMPLIFICATION: replication and star architectures for amplifying OKVS correctness, with a concrete instantiation (§5, pp. 13-18). PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE: PSI from any linear OKVS and vector OLE (§7.1, pp. 20-22). PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY: malicious security for the zero-sharing multiparty PSI of Kolesnikov et al. (§7.2, pp. 21-22; Appendix B, pp. 29-39). Not separately recorded: the OKVS from simple hashing into bins with dense matrices and its sharper failure analysis (§4.2, pp. 11-12); the observation that OKVS can replace polynomials in sparse OT extension, OPPRF, and covert computation (§6.1, §6.2, §6.4, pp. 18-20); the benchmarks of OKVS constructions (Appendix A.2, pp. 28-29). The complete protocols are PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT, PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR, PSI-CONSTRUCTION-2021-GPRTY-VOLE, and PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY. The semi-honest PaXoS-PSI rows with the new encodings in Table 1 (p. 24) are not recorded as separate rows.","heading":"Contributions"},{"content":"The two-party protocols are PaXoS-PSI of PSI-PAPER-2020-PRTY with a different binary OKVS (§6.3, p. 19) or with vector OLE (§7.1, pp. 20-22); the paper does not re-prove the former. The parameter \\( 1.3n \\) of the three-hash table is a heuristic choice (§8.1, p. 23), and the failure probability of the star instantiation rests on an empirical measurement (§5.4, pp. 17-18). A later analysis in PSI-PAPER-2022-RR (§5.1, p. 24) argues that this measurement overstates the security level by a few bits; that claim was not checked here. The vector-OLE protocol and the multiparty protocol are not implemented.","heading":"Claim boundary"}],"slug":"gprty21","status":"published","subtitle":"Gayathri Garimella, Benny Pinkas, Mike Rosulek et al. · 2021","summary":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","title":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","type":"paper","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2021-GPRTY"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2021-NTY","keywords":["multiparty-psi","malicious","okvs","paxos","opprf","zeroxor","server-aided-psi","corruption-threshold","client-server"],"metadata":{"authors":["Ofri Nevo","Ni Trieu","Avishay Yanai"],"contribution_ids":["PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2021-NTY","keywords":["multiparty-psi","malicious","okvs","paxos","opprf","zeroxor","server-aided-psi","corruption-threshold","client-server"],"primary_url":"https://eprint.iacr.org/2021/1221","review_scope":"IACR ePrint 2021/1221, PDF dated 2021-09-17, read in full (§§1-5, Appendices A-D, Protocols 3.1-4.4, Tables 1-5). Proofs of Theorems 3.2 and 3.4 were read but not re-verified; Theorem 4.5 has a proof sketch and the proof of Theorem 4.3 is omitted in the paper (p. 10). The CCS proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Simple, Fast Malicious Multiparty Private Set Intersection","venue":"ACM CCS 2021","versions":["IACR ePrint 2021/1221, PDF dated 2021-09-17","ACM CCS 2021, pp. 1151-1165 (bibliographic data as cited in reference [32] of IACR ePrint 2023/1777)"],"year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1221","sections":[{"content":"Simple, Fast Malicious Multiparty Private Set Intersection","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2021-09-17, whose acknowledgments thank the CCS 2021 reviewers (p. 12). The page range is taken from reference [32] of PSI-PAPER-2024-VCE and was not checked against the ACM Digital Library. The implementation is at github.com/asu-crypto/mPSI (§5, p. 11).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION: malicious multiparty PSI when at most one party is corrupted, from PRF keys, OKVS encodings, and a two-party PSI between two designated parties instantiated as server-aided PSI (§3, pp. 5-9; Protocols 3.1 and 3.3; Theorems 3.2 and 3.4). PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED: malicious multiparty PSI against \\( t < n \\) colluding parties with clients, a pivot, and \\( t \\) servers, whose cost decreases with \\( t \\) (§4, pp. 9-11; Protocol 4.4; Theorem 4.5). Not yet recorded separately: the ZeroXOR functionality and protocol (Functionality 4.1, Protocol 4.2, Theorem 4.3, pp. 9-10), which the second contribution uses; the observation that replacing the OKVS by an OPPRF in Protocol 3.1 gives a three-party protocol against two colluding parties (§3.1.3, p. 6).","heading":"Contributions"},{"content":"Both main protocols are proved against a malicious adversary in the random oracle model with ideal subfunctionalities (Theorems 3.2, 3.4, 4.5; pp. 7-11), and the ideal functionality gives the output to \\( P_n \\) only (Functionality 2.1, p. 4). The implementation uses the table-based OPPRF code of PSI-PAPER-2017-KMPRT, which footnote 2 calls semi-honest secure and about three times slower than the malicious PaXoS-based OPPRF (p. 11). Runtimes of the protocol of Ben Efraim et al. are copied from that paper rather than rerun (§5.1, p. 11). Table 1 lists five rounds for Protocol 3.3 while §3.2.2 (p. 8) counts four.","heading":"Claim boundary"}],"slug":"nty21","status":"published","subtitle":"Ofri Nevo, Ni Trieu, Avishay Yanai · 2021","summary":"Simple, Fast Malicious Multiparty Private Set Intersection","title":"Simple, Fast Malicious Multiparty Private Set Intersection","type":"paper","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2021-NTY"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2021-RS","keywords":["vole-psi","vector-ole","batched-oprf","paxos","xopaxos","opprf","circuit-psi","malicious","lpn"],"metadata":{"authors":["Peter Rindal","Phillipp Schoppmann"],"contribution_ids":["PSI-CONTRIB-2021-RS-VOLE-OPRF","PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","PSI-CONTRIB-2021-RS-CIRCUIT-PSI"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2021-RS","keywords":["vole-psi","vector-ole","batched-oprf","paxos","xopaxos","opprf","circuit-psi","malicious","lpn"],"primary_url":"https://eprint.iacr.org/2021/266","review_scope":"IACR ePrint 2021/266, PDF dated 2024-08-08 (39 pages), read in full: §§1-8, Figures 1-11, and Tables 1-4. The proofs of Theorems 3.1, 4.1, and 5.1 were read but not re-verified. Earlier ePrint versions and the EUROCRYPT proceedings version were not compared; the revision says that the prior version did not correctly address extracting a malicious receiver's effective input (§2, p. 13), so statements about malicious extraction cite the 2024 revision only. All locators cite this PDF's pages, which equal the printed page numbers.","status":"published","title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","venue":"EUROCRYPT 2021","versions":["IACR ePrint 2021/266, PDF dated 2024-08-08 (revised version)","EUROCRYPT 2021, Part II, LNCS 12697, pp. 901-930 (bibliographic data as cited in reference [RS21] of IACR ePrint 2022/320)"],"year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","heading":"Overview"},{"content":"Title and date were checked against the ePrint PDF dated 2024-08-08. The title page spells the second author \"Phillipp Schoppman\"; the spelling \"Schoppmann\" follows the paper's own reference [SGRR19] and the citations in PSI-PAPER-2021-GPRTY and PSI-PAPER-2022-RR. Venue, volume, and pages are taken from the reference list of PSI-PAPER-2022-RR and were not checked against the publisher. The revision adds the Strong OKVS Extraction Conjecture and its discussion (§2, pp. 11-13).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2021-RS-VOLE-OPRF: a batched OPRF from vector OLE and a PaXoS encoding, malicious-secure (§3, pp. 13-18; Figure 4, p. 36). PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS: a tighter analysis of the malicious OPRF-to-PSI transformation that allows κ-bit outputs (§4, pp. 18-20). PSI-CONTRIB-2021-RS-CIRCUIT-PSI: circuit-PSI from an OPPRF built on the VOLE OPRF and XoPaXoS (§2, pp. 10-11; §§5-6, pp. 21-24). Not separately recorded: the variant with a polynomial-interpolation encoding of rate 1, analyzed only in theory (§7.1, pp. 24-25; Table 1, p. 25), and the Strong OKVS Extraction Conjecture (Conjecture 2.1, p. 12), which the authors leave open. The complete protocols are PSI-CONSTRUCTION-2021-RS-SH, PSI-CONSTRUCTION-2021-RS-MAL, and PSI-CONSTRUCTION-2021-RS-CIRCUIT.","heading":"Contributions"},{"content":"The OPRF and PSI are proved in the random oracle and F_vole-hybrid model; the implementation instantiates VOLE from LPN with regular noise (§3.1, p. 14; §7.2, p. 26). Circuit-PSI is semi-honest, and its proof is deferred to Pinkas, Schneider, Tkachenko, and Yanai (§6, p. 23). Table 1 (p. 25) prints the malicious communication formula with a \\( (\\lambda + \\log(n_x n_y)) n_y \\) term while its numeric column uses \\( 128 n_y \\); the numeric column and the measurements of Table 3 (p. 29) are recorded.","heading":"Claim boundary"}],"slug":"rs21","status":"published","subtitle":"Peter Rindal, Phillipp Schoppmann · 2021","summary":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","title":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","type":"paper","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2021-RS"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2021-RT","keywords":["key-agreement","diffie-hellman","polynomial-encoding","ideal-permutation","elligator","oracle-diffie-hellman","malicious","small-sets","communication"],"metadata":{"authors":["Mike Rosulek","Ni Trieu"],"contribution_ids":["PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2021-RT","keywords":["key-agreement","diffie-hellman","polynomial-encoding","ideal-permutation","elligator","oracle-diffie-hellman","malicious","small-sets","communication"],"primary_url":"https://eprint.iacr.org/2021/1159","review_scope":"IACR ePrint 2021/1159, author version of October 17, 2021, read in full: §§1-5, Figures 1-6, Tables 1-3, and Appendices A-C. The proofs of Lemmas 5-7 and 11-13 and the compression argument of Lemma 16 were read but not re-verified. The ACM CCS 2021 version was not compared; §1.3 (p. 6) says the October 2021 revision repaired a bug in the semi-honest proof and added a second semi-honest variant. All locators cite the ePrint PDF pages.","status":"published","title":"Compact and Malicious Private Set Intersection for Small Sets","venue":"ACM CCS 2021","versions":["IACR ePrint 2021/1159, author version dated October 17, 2021 (PDF dated 2021-10-17), 29 pages (read)","ACM CCS 2021, doi:10.1145/3460120.3484778 (as stated on p. 1 of the author version; not checked against the ACM Digital Library)"],"year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1159","sections":[{"content":"Compact and Malicious Private Set Intersection for Small Sets","heading":"Overview"},{"content":"Title, authors, and the CCS DOI were checked against the author version (p. 1). The protocol has a sender and a receiver; only the receiver learns \\( X \\cap Y \\) (Figure 2, p. 6). The implementation is at github.com/osu-crypto/MiniPSI (§5.1, p. 16).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI: a transformation from two-round key agreement with pseudorandom second messages and non-malleability to malicious PSI, by encoding the receiver's key-agreement responses in a polynomial, in the ideal permutation and random oracle model (§4, Figure 4, pp. 10-16). PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION: two semi-honest variants, instantiated with Diffie-Hellman, that lower the communication of Diffie-Hellman PSI (Appendix A, Figures 5-6, pp. 23-28; Table 1, p. 4). Not carded separately: the unconditional bound on how many items a corrupt receiver can effectively input (§4.1, pp. 15-16; Appendix C, pp. 28-29); it is recorded in the qualifiers of the malicious contribution. Not carded separately: the optimizations of Appendix B (sender without elligator encoding; OKVS instead of polynomials), whose security the paper leaves to the reader (p. 28).","heading":"Contributions"},{"content":"The paper compares protocols on small sets and records that OT-based protocols overtake it between 500 and 1,000 items on a 10 Gbps network (§1, p. 2). It conjectures, without proof, that overfitting polynomials are hard to find even when they exist, which would tighten the enforcement of a corrupt receiver's set size (§4.1, p. 16). It describes De Cristofaro-Tsudik 2010 and its improvement as RSA-accumulator protocols (§1.1, p. 3); PSI-PAPER-2010-DT's own protocols use blind RSA signatures and RSA-PPIT, not accumulators.","heading":"Claim boundary"}],"slug":"rt21","status":"published","subtitle":"Mike Rosulek, Ni Trieu · 2021","summary":"Compact and Malicious Private Set Intersection for Small Sets","title":"Compact and Malicious Private Set Intersection for Small Sets","type":"paper","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2021-RT"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2022-RR","keywords":["okvs","triangulation","gap","phase-transition","subfield-vole","vole-psi","circuit-psi","clustering","malicious"],"metadata":{"authors":["Srinivasan Raghuraman","Peter Rindal"],"contribution_ids":["PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","PSI-CONTRIB-2022-RR-SUBFIELD-VOLE"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2022-RR","keywords":["okvs","triangulation","gap","phase-transition","subfield-vole","vole-psi","circuit-psi","clustering","malicious"],"primary_url":"https://eprint.iacr.org/2022/320","review_scope":"IACR ePrint 2022/320, PDF dated 2022-11-02 (35 pages), read in full: §§1-5, Figures 1-12, Tables 1-2, and Appendices A-C. The proofs of Lemmas 1-10 and Theorem 3 were read but not re-verified, and the empirical parameter fits of §3 (Figures 2-8, Equations (1)-(3)) were not reproduced. The criticism of the failure-probability estimate of PSI-PAPER-2021-GPRTY (§5.1, p. 24) is recorded as the authors' claim. The ACM CCS proceedings version was not compared. All locators cite the ePrint PDF pages, which equal the printed page numbers.","status":"published","title":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","venue":"ACM CCS 2022","versions":["IACR ePrint 2022/320, PDF dated 2022-11-02","ACM CCS 2022 (venue as listed in LITERATURE_COVERAGE.md; the ePrint PDF names no venue, and proceedings pages were not checked)"],"year":2022},"primaryUrl":"https://eprint.iacr.org/2022/320","sections":[{"content":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2022-11-02, whose header gives only the year 2022. The venue follows LITERATURE_COVERAGE.md and was not checked against the ACM Digital Library. The implementation is at github.com/Visa-Research/volepsi (§5, p. 23).","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS: the OKVS by sparse triangulation with a small gap, its clustering, and its failure-probability analysis and parameter selection (§§2-3, pp. 5-21; Figure 1, p. 7; Appendix A, pp. 30-31). PSI-CONTRIB-2022-RR-SUBFIELD-VOLE: semi-honest VOLE-based PSI with subfield VOLE and communication \\( O(n\\lambda + n \\log n) \\) (§4, pp. 21-23; Figure 9, p. 23; Theorem 3, pp. 33-35). Not separately recorded: the application of the new OKVS, in its doubly oblivious form, to the circuit-PSI of PSI-PAPER-2021-RS (§4, p. 23; Table 2, p. 25), which appears as a construction row, and the argument that the greedy triangulation is not a matroid algorithm for \\( w > 2 \\) (Appendix B, pp. 32-33). The complete protocols are PSI-CONSTRUCTION-2022-RR-FAST, PSI-CONSTRUCTION-2022-RR-SD, PSI-CONSTRUCTION-2022-RR-MAL, and PSI-CONSTRUCTION-2022-RR-CIRCUIT.","heading":"Contributions"},{"content":"The malicious and circuit-PSI protocols are those of PSI-PAPER-2021-RS with the new OKVS; the paper proves only the semi-honest subfield-VOLE protocol (Theorem 3, p. 33). Concrete failure probabilities rest on empirical fits (§3.1-3.2, pp. 13-19). The paper's improvement factors differ by passage: the abstract reports \\( 187n \\) bits and a 6× circuit-PSI speedup, §1 a 6.8× and 2.3× reduction, §1.1 \\( 180n \\) bits and 1.5× and 23× improvements; Table 2 (p. 25) is recorded. All measurements were taken on one laptop over a local network of about 1 Gbps (§5, p. 23).","heading":"Claim boundary"}],"slug":"rr22","status":"published","subtitle":"Srinivasan Raghuraman, Peter Rindal · 2022","summary":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","title":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","type":"paper","venue":"ACM CCS 2022","year":2022,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2022-RR"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2023-GS","keywords":["threshold-psi","multiparty-psi","intersection-cardinality-testing","communication-complexity","divide-and-conquer","secret-sharing","oblivious-transfer","additively-homomorphic-encryption"],"metadata":{"authors":["Satrajit Ghosh","Mark Simkin"],"contribution_ids":["PSI-CONTRIB-2023-GS-PICT-COMPILER","PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2023-GS","keywords":["threshold-psi","multiparty-psi","intersection-cardinality-testing","communication-complexity","divide-and-conquer","secret-sharing","oblivious-transfer","additively-homomorphic-encryption"],"primary_url":"https://eprint.iacr.org/2023/919","review_scope":"IACR ePrint 2023/919, PDF dated 2023-06-12, read in full: §§1-4, Lemmas 1-5, Theorems 1-8, Corollaries 1-6, and Figures 1-12. Proofs were read but not re-verified. The PDF itself names no venue; PKC 2023 is taken from the ePrint page. The PKC proceedings version was not compared. All locators cite the ePrint PDF pages.","status":"published","title":"Threshold Private Set Intersection with Better Communication Complexity","venue":"PKC 2023","versions":["IACR ePrint 2023/919, PDF dated 2023-06-12, 18 pages (the ePrint page, received 2023-06-12, calls it a minor revision of an IACR publication in PKC 2023)"],"year":2023},"primaryUrl":"https://eprint.iacr.org/2023/919","sections":[{"content":"Threshold Private Set Intersection with Better Communication Complexity","heading":"Overview"},{"content":"Title, authors, and affiliations (Indian Institute of Technology Kharagpur; Ethereum Foundation) were checked against the PDF dated 2023-06-12. The venue is taken from the ePrint page, which describes the PDF as a minor revision of the PKC 2023 paper.","heading":"Version and bibliographic notes"},{"content":"PSI-CONTRIB-2023-GS-PICT-COMPILER: a transformation from any private intersection cardinality test with secret-shared output and communication \\( O(\\lambda \\ell\\,\\mathrm{poly}(t)) \\) to one with communication \\( O(\\lambda^{2} \\ell t\\,\\mathrm{polylog}\\,t) \\), by random partitioning into \\( t \\) buckets (abstract, p. 1; §1.2, p. 2; §§3-4, pp. 6-16). PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR: passively secure \\( \\ell \\)-party threshold PSI, releasing the intersection when it has at least \\( n - t \\) elements, with communication \\( O(\\epsilon^{2} \\ell t\\,\\mathrm{polylog}\\,t) \\) bits from oblivious transfer or additively homomorphic encryption (Corollaries 5-6, p. 16). Not listed as separate contributions: the two-party instantiation (Corollaries 2-3, p. 10), which the authors say does not improve the two-party state of the art asymptotically (p. 4), and the use of threshold PSI with thresholds \\( 2, 2^{2}, 2^{4}, \\dots \\) to compute plain PSI with communication sublinear in the set sizes for large intersections (§1.1, p. 2). The two-party instantiation is the comparison row PSI-CONSTRUCTION-2023-GS-TWO-PARTY.","heading":"Contributions"},{"content":"Security is against a static passive adversary corrupting all but one party, with pairwise authenticated private channels and a broadcast channel of unit cost (§2.1, p. 4). The partitioning uses random functions, which the authors say may be replaced by pseudorandom functions with a key known to all parties (footnote 4, p. 3). The authors consider the protocols too inefficient for most real-world parameters (§1.2, p. 3). On the earlier claim of PSI-PAPER-2021-BMRR: the paper states that two-party threshold PSI with communication \\( O(\\lambda t\\,\\mathrm{polylog}\\,t) \\) can be obtained without fully homomorphic encryption from the construction of PSI-PAPER-2019-GS combined with an observation of Badrinarayanan et al., and that its own two-party protocol does not improve on this (p. 4 and footnote 5). Its abstract sentence that current protocols rely on FHE or depend at least quadratically on \\( t \\) concerns the \\( \\ell \\)-party setting (abstract, p. 1); for \\( \\ell > 2 \\) it notes that Badrinarayanan et al. additionally require fewer than \\( t \\) distinct elements outside the intersection among all sets (§1, pp. 1-2).","heading":"Claim boundary"}],"slug":"gs23","status":"published","subtitle":"Satrajit Ghosh, Mark Simkin · 2023","summary":"Threshold Private Set Intersection with Better Communication Complexity","title":"Threshold Private Set Intersection with Better Communication Complexity","type":"paper","venue":"PKC 2023","year":2023,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2023-GS"},{"evidence":"fulltext_checked","id":"PSI-PAPER-2024-VCE","keywords":["sok","multiparty-psi","collusion-resistance","semi-honest","augmented-semi-honest","set-representation","network-topology","operation-count"],"metadata":{"authors":["Jelle Vos","Mauro Conti","Zekeriya Erkin"],"contribution_ids":["PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON"],"dossier_type":"paper","evidence":"fulltext_checked","id":"PSI-PAPER-2024-VCE","keywords":["sok","multiparty-psi","collusion-resistance","semi-honest","augmented-semi-honest","set-representation","network-topology","operation-count"],"primary_url":"https://eprint.iacr.org/2023/1777","review_scope":"IACR ePrint 2023/1777, PDF dated 2023-11-16, read in full (§§1-9, Tables 1-3, Appendices A-C, where Appendix C is the meta-review). The derivations of Appendices A-B were followed but not recomputed. The complexities and protocol descriptions it reports for other papers were not checked against those papers. All locators cite the ePrint PDF pages.","status":"published","title":"SoK: Collusion-resistant Multi-party Private Set Intersections in the Semi-honest Model","venue":"IEEE S&P 2024","versions":["IACR ePrint 2023/1777, PDF dated 2023-11-16","IEEE S&P 2024 (venue as recorded in LITERATURE_COVERAGE.md; the ePrint PDF does not name it, and the IEEE proceedings were not checked)"],"year":2024},"primaryUrl":"https://eprint.iacr.org/2023/1777","sections":[{"content":"SoK: Collusion-resistant Multi-party Private Set Intersections in the Semi-honest Model","heading":"Overview"},{"content":"Title and authors were checked against the ePrint PDF dated 2023-11-16. The PDF ends with a meta-review (Appendix C, p. 19) but does not name the venue.","heading":"Version and bibliographic notes"},{"content":"The paper covers multiparty PSI in which only the leader \\( P_1 \\) learns the intersection, at most \\( t \\) parties collude, and no external party helps; it excludes server-aided protocols and treats only the semi-honest model, noting whether malicious versions exist (§1, pp. 1-2; Definition 1, p. 2). It defines size-hiding and size-revealing privacy and exact protocols with error at most \\( 2^{-40} \\) (Definitions 2-4, p. 3), and notes that augmented semi-honest security neither implies nor follows from semi-honest security, while malicious security implies it (§2.3, pp. 3-4). Network topologies are star, mesh, wheel, and tree (§3.1, p. 4). It sorts all protocols into three constructions (§4, pp. 5-9): private homomorphic set representations (bitsets, hash sets, sorted multisets, polynomial roots), leaky homomorphic set representations (Bloom filters and garbled Bloom filters), and aggregatable membership queries (payloads in polynomial roots, oblivious programmable PRFs, oblivious key-value stores). Table 2 (p. 10) lists the protocols without known attacks in these classes, with communication, computation, rounds, topology, collusion resistance, and whether a malicious version exists; PSI-PAPER-2017-KMPRT and PSI-PAPER-2021-NTY appear under aggregatable membership queries. Section 6 (p. 12) collects recurring flaws: revealing a Bloom filter of the intersection, randomness contributed by only one party, and difficulties of moving to the malicious model.","heading":"What it classifies"},{"content":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON: worst-case counts of elliptic-curve multiplications, OTs, and OLEs for semi-honest collusion-resistant protocols, and the conclusion that no single protocol is the state of the art (§7, pp. 12-13; Table 3, p. 13; Appendices A-B, pp. 16-18). Not yet recorded: the argument that the multiparty protocol of Bay and Kayan is insecure because the leader can enumerate the universe to invert hashed PRF values (§5.2.1, p. 11); the paper states it as an argument, without proof. Section 6.2 (p. 12) also describes an error in the protocol of Wei et al. without attributing the finding to another source.","heading":"Contributions"},{"content":"The complexities in Table 2 are derived by the authors (Appendix A, pp. 16-17), partly copied from the original papers, and in some cases after modifying a protocol so that only the leader receives the output. Table 3 counts sub-protocol calls, not running time, and the authors caution that experiments in the surveyed papers ran on different hardware (§5.1.1, p. 10). The open questions the paper names (abstract, p. 1; §1, p. 2; §§7-9, pp. 12-14) are not restated here.","heading":"Claim boundary"}],"slug":"vce24","status":"published","subtitle":"Jelle Vos, Mauro Conti, Zekeriya Erkin · 2024","summary":"SoK: Collusion-resistant Multi-party Private Set Intersections in the Semi-honest Model","title":"SoK: Collusion-resistant Multi-party Private Set Intersections in the Semi-honest Model","type":"paper","venue":"IEEE S&P 2024","year":2024,"sourcePath":"data/psi-catalog.json#PSI-PAPER-2024-VCE"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","keywords":["atomic-result","private-preference-matching","commutative-exponentiation","diffie-hellman","matching-count","hashed-items"],"metadata":{"claim_slug":"dh-preference-matching","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["cardinality","intersection"],"parties":["two_party"],"technique":["diffie_hellman"]},"historical_context":{"narrative":"Huberman, Franklin, and Hogg wanted members of online communities to find others who share their preferences without handing their answers to a trusted intermediary, since such a party is hard to agree on and becomes a single point of failure. Generic methods for comparing private data were already known, but the authors chose a direct scheme modelled on Diffie-Hellman key exchange. Each side hashes its entries and applies a secret exponent; after a second exchange, values that coincide mark the entries both sides hold. Counting coincidences gives the size of the overlap, and skipping a shuffle reveals the overlap itself. The authors presented it as simple and efficient, accepting that it reveals a count rather than only whether a threshold is met, and gave no formal security analysis.","prior_boundary":"The paper motivates the protocol by the difficulty of agreeing on a trusted third party in an open community and by the single point of failure such a party creates (§1, p. 79); it notes that techniques for two or more parties to compute preference-matching functions exist under various fault and leakage assumptions, citing Fagin-Naor-Winkler and Naor-Pinkas (§3, p. 81).","significance_at_publication":"The authors present it as one technique for private preference matching that is easier to describe and quite efficient, at the price of leaking the number of matches instead of a threshold bit (§3, p. 81), and as part of mechanisms that avoid trusted third parties (abstract, p. 78).","technical_delta":"Each party hashes its items, exponentiates them with its own secret exponent modulo \\( p \\), and re-exponentiates the other party's values, so equal items yield equal values \\( H(x)^{ab} \\); the parties then count matches (Appendix A, steps 1-5, p. 85). Permuting the exchanged lists hides positions; dropping the final permutations reveals the shared items instead of only their number (Appendix A, p. 85)."},"historical_context_status":"curator_synthesis","id":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","keywords":["private-preference-matching","commutative-exponentiation","diffie-hellman","matching-count","hashed-items"],"limitations":["no adversary model, security definition, or proof is given for the protocol (Appendix A, p. 85)","the terms 'set intersection' and 'PSI' do not appear; the task is called private preference matching (§3, p. 81)","protection against active cheating is only mentioned as a possible zero-knowledge addition, not specified (Appendix A, p. 85)","no costs are stated beyond the four messages of the protocol (Appendix A, p. 85)"],"paper_id":"PSI-PAPER-1999-HFH","qualifiers":["both parties receive output: each counts the matches (Appendix A, step 5, p. 85)","the computation is modulo a large prime \\( p \\); the appendix sets up a prime \\( r \\) dividing \\( p - 1 \\) and an element g of order \\( r \\), but does not say into which group H maps (Appendix A, p. 85)","the hash function is required to have output that cannot be easily influenced or predicted ahead of time (§2, p. 79)","the basic preference-matching function in §3 takes a threshold, but the appendix protocol reveals the count of matches instead of the threshold bit (§3, p. 81)"],"source_locator":{"dossier_section":"PSI-PAPER-1999-HFH § Contributions","primary_source":"Abstract (p. 78); §1 (p. 79); §2 (p. 79); §3 'Private Preference Matching' (p. 81); Appendix A 'Discrete Log Problem' and 'Private Preference Matching' (p. 85). ACM EC 1999 proceedings PDF, printed pages.","primary_source_url":"https://doi.org/10.1145/336992.337012","status":"section_checked"},"statement":"Two parties holding lists \\( x_1, \\ldots, x_{n_X} \\) and \\( y_1, \\ldots, y_{n_Y} \\) each raise hashes of their own items modulo a prime \\( p \\) to a secret random exponent, exchange the permuted results, raise the other party's values to their own exponent, and return them permuted, so that both parties learn how many items the lists share; if the last two lists are not permuted, both learn which items are shared. The paper relates the protocol to Diffie-Hellman key exchange and states no adversary model or security proof for it.","statement_status":"source_normalized_statement","status":"published","title":"Two-party count of shared list items by commutative exponentiation of hashed items modulo a prime, without a trusted third party","work_id":"PSI-PAPER-1999-HFH","year":1999},"primaryUrl":"https://doi.org/10.1145/336992.337012","sections":[{"content":"Diffie-Hellman preference matching","heading":"Overview"},{"content":"Alice holds \\( x_1, \\ldots, x_{n_X} \\) and Bob holds \\( y_1, \\ldots, y_{n_Y} \\). Alice sends \\( H(x_1)^a, \\ldots, H(x_{n_X})^a \\bmod p \\) in random order; Bob sends \\( H(y_1)^b, \\ldots, H(y_{n_Y})^b \\bmod p \\) in random order; Alice returns the values \\( H(y_j)^{ab} \\) and Bob returns the values \\( H(x_i)^{ab} \\), each list permuted; each party then counts the matches (Appendix A, steps 1-5, p. 85). The paper lists variations: without the permutations in steps 3 and 4 both parties learn which elements they have in common; without the permutations in steps 1 and 2 they learn the positions of matches; with a fresh exponent per element they learn only matches in equal positions (Appendix A, p. 85). The authors relate the protocol to the Diffie-Hellman key exchange and to Bellovin and Merritt's encrypted key exchange (Appendix A, p. 85).","heading":"Exact contribution"},{"content":"PKE-RESULT-1976-DH-INTERACTIVE-PUBLIC-CHANNEL-KEY-AGREEMENT: Diffie-Hellman key agreement, which the paper names as the protocol's relative (Appendix A, p. 85, reference [10]). Bellovin-Merritt encrypted key exchange (reference [7]) has no record in any topic.","heading":"Related records in other topics"}],"slug":"hfh99-diffie-hellman-preference-ma","status":"published","subtitle":"Enhancing Privacy and Trust in Electronic Communities","summary":"Two parties holding lists \\( x_1, \\ldots, x_{n_X} \\) and \\( y_1, \\ldots, y_{n_Y} \\) each raise hashes of their own items modulo a prime \\( p \\) to a secret random exponent, exchange the permuted results, raise the other party's values to their own exponent, and return them permuted, so that both parties learn how many items the lists share; if the last two lists are not permuted, both learn which items are shared. The paper relates the protocol to Diffie-Hellman key exchange and states no adversary model or security proof for it.","tableRows":["PSI-CONSTRUCTION-1999-HFH-INTERSECTION","PSI-CONSTRUCTION-1999-HFH"],"title":"Two-party count of shared list items by commutative exponentiation of hashed items modulo a prime, without a trusted third party","type":"result","venue":"ACM EC 1999","year":1999,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","keywords":["atomic-result","lower-bound","communication-complexity","disjointness","private-approximation","intersection-size"],"metadata":{"claim_slug":"approx-lower-bound","contribution_kind":"boundary_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["cardinality"],"parties":["two_party"]},"historical_context":{"narrative":"Exact computation of an intersection's size inherits the linear communication cost of set disjointness, a classical communication complexity result, while approximations with additive error are cheap. That raised the hope that a multiplicative approximation could be private and sublinear at once. Freedman, Nissim, and Pinkas ruled this out by a short reduction: padding disjointness instances so that disjoint and intersecting inputs land on intersection sizes a factor \\( (1 + \\varepsilon) \\) squared apart, which any good approximation separates. The resulting linear lower bound holds whether or not privacy is required. They pair it with a sampling protocol whose expected number of rounds adapts to the true size and is optimal for telling such sizes apart, while noting that the round count itself reveals information about the result.","prior_boundary":"The randomized communication complexity of disjointness is \\( \\Theta(u) \\), \\( u \\) the length of the input strings, so computing \\( |a \\cap b| \\) exactly needs \\( \\Theta(u) \\) communication; with additive error \\( \\varepsilon u \\), very efficient protocols exist, namely \\( O(\\log u) \\) bits in the private randomness model (§2, pp. 2-3).","significance_at_publication":"The bound shows that approximation does not circumvent the linear communication of computing the intersection size (§2, p. 3); the paper's sampling protocol Intersect-Approx then matches the bound for distinguishing intersection sizes \\( k \\) and \\( k(1 + \\varepsilon) \\) in an expected \\( O(u/k) \\) sampling invocations, \\( k \\) the smaller intersection size and \\( u \\) the domain size (§6, p. 15).","technical_delta":"Padding the disjointness inputs a and b with \\( \\eta \\) leading ones and \\( (2 + \\varepsilon^2)\\eta \\) copies of themselves maps disjoint inputs to intersection size \\( \\eta \\) and intersecting inputs to size at least \\( \\eta(1 + \\varepsilon)^2 \\), so an \\( (\\varepsilon, \\delta) \\)-approximation decides disjointness (§6, pp. 13-14)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","keywords":["lower-bound","communication-complexity","disjointness","private-approximation","intersection-size"],"limitations":["approximation with additive error \\( \\varepsilon u \\) is not covered; it admits \\( O(\\log u) \\)-bit protocols, \\( u \\) the domain size (§2, p. 3)","the matching protocol Intersect-Approx is for semi-honest parties, and its number of rounds depends on the output, which the security definitions do not capture (§6, p. 15)"],"paper_id":"PSI-PAPER-2004-FNP","qualifiers":["inputs are \\( u \\)-bit strings X, Y, \\( u \\) the domain size, with \\( \\alpha = |X \\cap Y| \\) (§6, p. 13)","multiplicative error with constant \\( \\varepsilon \\); the bound \\( \\Omega(u/\\eta) \\) becomes \\( \\Theta(u) \\), \\( u \\) the domain size, when \\( \\eta \\), the intersection size the reduction starts from, is a constant (§6, p. 14)","the bound is a communication complexity bound and holds regardless of privacy (§2, p. 3)"],"source_locator":{"dossier_section":"PSI-PAPER-2004-FNP § Contributions","primary_source":"Abstract (p. 1); contributions (p. 2); §2 'Disjointness and set intersection' (pp. 2-3); §6 'A lower bound' (pp. 13-14); Protocol Private-Sample-B (p. 14); Intersect-Approx and 'Caveat' (p. 15). EUROCRYPT 2004, LNCS 3027, printed pages.","primary_source_url":"https://doi.org/10.1007/978-3-540-24676-3_1","status":"section_checked"},"statement":"For sets given as characteristic strings of \\( u \\) bits, \\( u \\) the domain size, any protocol that outputs an \\( (\\varepsilon, \\delta) \\)-approximation of \\( |X \\cap Y| \\), that is a value within a factor \\( 1 \\pm \\varepsilon \\) with probability at least \\( 1 - \\delta \\), can distinguish intersection size at most \\( \\eta \\) from at least \\( \\eta(1 + \\varepsilon)^2 \\) and hence decide disjointness on inputs of length about \\( u/\\eta \\); for constant \\( \\varepsilon \\) and constant \\( \\eta \\) its randomized communication complexity is therefore \\( \\Theta(u) \\), with or without privacy. Intersection size thus has no private approximation with sublinear worst-case communication, \\( o(u) \\), under multiplicative error.","statement_status":"source_normalized_statement","status":"published","title":"Linear communication lower bound for approximating intersection size within a multiplicative factor, by reduction from disjointness","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Communication lower bound for approximate intersection size","heading":"Overview"},{"content":"Given disjointness inputs a, b of length m, the client sets \\( X = 1^{\\eta} | a^{(2 + \\varepsilon^2)\\eta} \\) and the server sets \\( Y = 1^{\\eta} | b^{(2 + \\varepsilon^2)\\eta} \\), so \\( |X \\cap Y| = \\eta \\) if a and b are disjoint and at least \\( \\eta(1 + \\varepsilon)^2 \\) otherwise; an \\( (\\varepsilon, \\delta) \\)-approximation separates the two cases, so its randomized communication is \\( \\Omega(m) = \\Omega(u/\\eta) \\) (§6, pp. 13-14). The accompanying protocol Intersect-Approx repeats the private sampler Private-Sample-B with the AND predicate until \\( T \\) positive samples occur and outputs \\( T/s \\), \\( s \\) the number of samples drawn; it is a private approximation for semi-honest parties whose communication is dominated by 1-out-of-\\( u \\) oblivious transfers (Protocol Private-Sample-B, p. 14; §6, p. 15).","heading":"Exact contribution"},{"content":"PIR-RESULT-1999-CMS-POLYLOGARITHMIC-SINGLE-SERVER-COMMUNICATION: the paper instantiates the 1-out-of-\\( u \\) oblivious transfer of Private-Sample-B with a computational PIR scheme of Cachin, Micali, and Stadler, through the Naor-Pinkas combination, for \\( \\kappa \\cdot \\mathrm{polylog}(u) \\) communication (§6, p. 14).","heading":"Related records in other topics"}],"slug":"fnp04-lower-bound-for-approximate","status":"published","subtitle":"Efficient Private Matching and Set Intersection","summary":"For sets given as characteristic strings of \\( u \\) bits, \\( u \\) the domain size, any protocol that outputs an \\( (\\varepsilon, \\delta) \\)-approximation of \\( |X \\cap Y| \\), that is a value within a factor \\( 1 \\pm \\varepsilon \\) with probability at least \\( 1 - \\delta \\), can distinguish intersection size at most \\( \\eta \\) from at least \\( \\eta(1 + \\varepsilon)^2 \\) and hence decide disjointness on inputs of length about \\( u/\\eta \\); for constant \\( \\varepsilon \\) and constant \\( \\eta \\) its randomized communication complexity is therefore \\( \\Theta(u) \\), with or without privacy. Intersection size thus has no private approximation with sublinear worst-case communication, \\( o(u) \\), under multiplicative error.","title":"Linear communication lower bound for approximating intersection size within a multiplicative factor, by reduction from disjointness","type":"result","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","keywords":["atomic-result","balanced-allocations","hashing-to-bins","horner-rule","polynomial-degree","server-computation"],"metadata":{"claim_slug":"balanced-allocation-hashing","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["standard_model"],"technique":["oblivious_polynomial_evaluation","balanced_allocation_hashing"]},"historical_context":{"narrative":"The basic polynomial protocol makes the server evaluate a polynomial whose degree equals the client's set size at every one of its own items, so its work grows with the product of the two set sizes. Freedman, Nissim, and Pinkas cut this by letting the client spread her items over many bins and send a short polynomial for each. They used balanced allocations, placing each item in the emptier of two random bins, which keeps the fullest bin at about \\( \\ln\\ln n_Y \\) items. The server then evaluates just two short polynomials per item. With short exponents and Horner's rule on top, the construction reaches the linear communication and near-linear computation advertised in the abstract, and the authors note that full-length exponentiations, one per server item, dominate in practice.","prior_boundary":"Evaluating the client's encrypted degree-\\( n_Y \\) polynomial naively costs \\( O(n_Y) \\) exponentiations per server item, \\( O(n_Y n_X) \\) in total, for Protocol PM-Semi-Honest (§4.2, p. 6).","significance_at_publication":"These steps give the \\( O(n) \\) communication and \\( O(n \\ln\\ln n) \\) computation stated in the abstract (p. 1); in practice the server's cost is dominated by \\( n_X \\) full-length exponentiations (§4.2, p. 8).","technical_delta":"Items are hashed to short representations so that Horner's rule uses short exponents (§4.2, pp. 6-7); the client then splits her set into \\( B \\) bins by balanced allocations, \\( B \\) the number of bins, where each item goes to the less loaded of two random bins, and sends \\( B \\) encrypted polynomials of degree \\( M \\); the server evaluates two of them per item (§4.2, p. 7). By Azar et al., the maximum load is \\( (1 + o(1)) \\ln\\ln B / \\ln 2 + \\Theta(n_Y / B) \\) (§4.2, p. 7)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","keywords":["balanced-allocations","hashing-to-bins","horner-rule","polynomial-degree","server-computation"],"limitations":["the maximum-load bound holds with probability \\( 1 - o(1) \\); for concrete constants the paper cites Broder and Mitzenmacher (\\( M = 5 \\) fails with probability about \\( 10^{-58} \\)) and says simple experimentation can give finer bounds (§4.2, p. 8)","the protocol does not specify what happens if a bin overflows (§4.2, p. 8)"],"paper_id":"PSI-PAPER-2004-FNP","qualifiers":["semi-honest parties; the hashing-based protocol's security is argued informally (§4.3, p. 9)","items are first mapped to about \\( 2 \\log(\\max(n_X, n_Y)) \\) bits by pairwise-independent hashing, with a small collision probability (§4.2, p. 6)","the server returns, for every item, the encryptions for both candidate bins (§4.2, p. 7)","the mapping to bins may be chosen pseudorandomly, jointly or by either party (footnote 9, p. 7)","with \\( B = n_Y \\) bins and \\( n \\le 2^{24} \\), communication is at most four times that of the protocol without hashing (§4.2, p. 8)"],"source_locator":{"dossier_section":"PSI-PAPER-2004-FNP § Contributions","primary_source":"Abstract (p. 1); §4.2 'Efficiently Evaluating the Polynomial', including 'Exponents from a small domain', 'Using Horner's rule', 'Using hashing for bucket allocation', 'Throwing elements into bins - balanced allocations', 'A note on correctness and on constants', and 'Efficiency' (pp. 6-8); §4.3, 'Security of the hashing-based protocol' (p. 9). EUROCRYPT 2004, LNCS 3027, printed pages.","primary_source_url":"https://doi.org/10.1007/978-3-540-24676-3_1","status":"section_checked"},"statement":"In polynomial-evaluation PSI, the client maps her items into \\( B \\) bins with the two-choice balanced-allocation hash of Azar et al., pads each bin with zero roots to a common degree \\( M \\), and sends one encrypted polynomial per bin; the server evaluates, for each of its items, only the two polynomials of the bins the item could occupy. With \\( B = n_Y / \\ln\\ln n_Y \\), \\( M = O(\\ln\\ln n_Y) \\), so communication and client work remain \\( O(n_Y) \\) coefficients while the server's work falls from \\( O(n_Y n_X) \\) to \\( O(n_Y + n_X \\ln\\ln n_Y) \\) exponentiations; Horner's rule and hashing items to short representations reduce the constant further.","statement_status":"source_normalized_statement","status":"published","title":"Server exponentiations \\( O(n_Y + n_X \\ln\\ln n_Y) \\) in polynomial-evaluation PSI via balanced-allocation hashing into low-degree bin polynomials, semi-honest","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Balanced-allocation hashing for polynomial-evaluation PSI","heading":"Overview"},{"content":"The client chooses a random hash h with range \\( B \\); each item goes to the less occupied of its two candidate bins, and every bin polynomial is padded with the root 0 to degree \\( M \\) (0 is assumed not to be a valid input). The client sends the \\( B \\) encrypted polynomials and the mapping; for each item y, the server evaluates the polynomials of both candidate bins and returns \\( \\mathrm{Enc}(r \\cdot P(y) + y) \\) for each (§4.2, p. 7). Communication and the client's work equal the number of coefficients \\( B \\cdot M \\), which is \\( O(n_Y) \\) for \\( B = n_Y / \\ln\\ln n_Y \\) (§4.2, p. 8).","heading":"Exact contribution"},{"content":"None. Balanced allocations (Azar, Broder, Karlin, Upfal) has no record in any topic.","heading":"Related records in other topics"}],"slug":"fnp04-server-exponentiations-o-n","status":"published","subtitle":"Efficient Private Matching and Set Intersection","summary":"In polynomial-evaluation PSI, the client maps her items into \\( B \\) bins with the two-choice balanced-allocation hash of Azar et al., pads each bin with zero roots to a common degree \\( M \\), and sends one encrypted polynomial per bin; the server evaluates, for each of its items, only the two polynomials of the bins the item could occupy. With \\( B = n_Y / \\ln\\ln n_Y \\), \\( M = O(\\ln\\ln n_Y) \\), so communication and client work remain \\( O(n_Y) \\) coefficients while the server's work falls from \\( O(n_Y n_X) \\) to \\( O(n_Y + n_X \\ln\\ln n_Y) \\) exponentiations; Horner's rule and hashing items to short representations reduce the constant further.","tableRows":["PSI-CONSTRUCTION-2004-FNP-SH"],"title":"Server exponentiations \\( O(n_Y + n_X \\ln\\ln n_Y) \\) in polynomial-evaluation PSI via balanced-allocation hashing into low-degree bin polynomials, semi-honest","type":"result","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","keywords":["atomic-result","psi-cardinality","threshold","function-of-intersection","private-matching-variants"],"metadata":{"claim_slug":"cardinality-threshold","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["cardinality","threshold"],"parties":["two_party"],"security_model":["standard_model"],"technique":["oblivious_polynomial_evaluation"]},"historical_context":{"narrative":"Some uses of set intersection need less than the shared items: only how many there are, or whether their number passes a threshold. Freedman, Nissim, and Pinkas observed that their polynomial protocol adapts with almost no change. If the server attaches a fixed string instead of its item, the client can count matches but cannot tell which items matched. If the server attaches random values, the client ends up holding values that agree with the server's exactly on the matches, and a small secure circuit over those values can then compute a threshold test or another function of the matches. The authors point out that this circuit depends only on the server's set size and a statistical parameter, not on the size of the domain from which items are drawn.","prior_boundary":"The paper defines private cardinality matching and private threshold matching, and more generally simple functions of the intersection, as variants of private matching (§3.1, p. 3); its basic protocol reveals the intersection itself to the client (Protocol PM-Semi-Honest, p. 6).","significance_at_publication":"The circuit's cost depends on \\( n_X \\) and a statistical parameter, not on the domain size, and the same approach computes any function of the intersection, such as whether its size lies in a range (§4.5, p. 9).","technical_delta":"Only the server's payload changes: \\( 0^{s} \\) for the size (§4.4, p. 9); random values \\( r_y \\) followed by a circuit with \\( n_X \\cdot \\lambda \\) gates, \\( \\lambda \\) a statistical parameter, for the bitwise equality tests and a threshold function for the threshold decision (§4.5, p. 9)."},"historical_context_status":"curator_synthesis","id":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","keywords":["psi-cardinality","threshold","function-of-intersection","private-matching-variants"],"limitations":["no separate security argument is given for the threshold variant beyond its composition with a secure circuit evaluation (§4.5, p. 9)","no costs are stated beyond the polynomial protocol plus \\( n_X \\cdot \\lambda \\) equality gates, \\( \\lambda \\) a statistical parameter, and the threshold circuit (§4.5, p. 9)"],"paper_id":"PSI-PAPER-2004-FNP","qualifiers":["semi-honest parties; for the cardinality variant the paper says the proof follows trivially from that of PM-Semi-Honest (§4.4, p. 9)","the threshold variant adds a generic secure circuit evaluation protocol after the polynomial step, whose engine is not specified (§4.5, p. 9)","the client is the only party with output (§3.1, p. 3)"],"source_locator":{"dossier_section":"PSI-PAPER-2004-FNP § Contributions","primary_source":"Contributions (p. 2); §3.1 'PM Variants' (p. 3); §4.4 'Variant: Private Matching for Set Cardinality' (p. 9); §4.5 'Variants: Private Matching for Cardinality Threshold and Other Functions' (p. 9). EUROCRYPT 2004, LNCS 3027, printed pages.","primary_source_url":"https://doi.org/10.1007/978-3-540-24676-3_1","status":"section_checked"},"statement":"In polynomial-evaluation PSI, if the server encodes a fixed string \\( 0^{s} \\) of \\( s \\) zero bits instead of its item as the payload, the client learns only how many of its decryptions equal that string, that is \\( |X \\cap Y| \\), with security following from the semi-honest protocol. If the server instead encodes fresh random values \\( r_y \\) and the parties then run a secure circuit evaluation that compares the client's \\( n_X \\) decryptions with the server's \\( r_y \\) values and applies a threshold, the client learns only whether \\( |X \\cap Y| > t \\); the same circuit step can compute other functions of the matches.","statement_status":"source_normalized_statement","status":"published","title":"Intersection size or a threshold decision on it, instead of the intersection, from polynomial-evaluation PSI, semi-honest","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Cardinality and threshold variants of polynomial-evaluation PSI","heading":"Overview"},{"content":"Cardinality (\\( \\mathrm{PM}_C \\)): the server computes \\( \\mathrm{Enc}(r \\cdot P(y) + 0^{s}) \\), and the client outputs the number of decryptions equal to \\( 0^{s} \\), a string of \\( s \\) zero bits (§4.4, p. 9). Threshold (\\( \\mathrm{PM}_t \\)): the server computes \\( \\mathrm{Enc}(r \\cdot P(y) + r_y) \\) with random \\( r_y \\); the client's ordered decryptions and the server's ordered \\( r_y \\) values enter a circuit that tests equality bit by bit (\\( n_X \\cdot \\lambda \\) gates) and then applies the threshold function (§4.5, p. 9).","heading":"Exact contribution"},{"content":"None. The secure circuit evaluation protocol is not named.","heading":"Related records in other topics"}],"slug":"fnp04-intersection-size-or-a","status":"published","subtitle":"Efficient Private Matching and Set Intersection","summary":"In polynomial-evaluation PSI, if the server encodes a fixed string \\( 0^{s} \\) of \\( s \\) zero bits instead of its item as the payload, the client learns only how many of its decryptions equal that string, that is \\( |X \\cap Y| \\), with security following from the semi-honest protocol. If the server instead encodes fresh random values \\( r_y \\) and the parties then run a secure circuit evaluation that compares the client's \\( n_X \\) decryptions with the server's \\( r_y \\) values and applies a threshold, the client learns only whether \\( |X \\cap Y| > t \\); the same circuit step can compute other functions of the matches.","tableRows":["PSI-CONSTRUCTION-2004-FNP-CARDINALITY"],"title":"Intersection size or a threshold decision on it, instead of the intersection, from polynomial-evaluation PSI, semi-honest","type":"result","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","keywords":["atomic-result","malicious-security","cut-and-choose","random-oracle","pseudo-identities","oblivious-polynomial-evaluation"],"metadata":{"claim_slug":"malicious-ope","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["standard_model","random_oracle_model"],"technique":["oblivious_polynomial_evaluation","cut_and_choose"]},"historical_context":{"narrative":"The polynomial protocol is fragile against deviation. A cheating client can hide extra roots, especially when its items are spread over many bins, and a cheating server can blend two of its items into one reply so that the client's verdict depends on both. Freedman, Nissim, and Pinkas treated the two sides separately. The client commits to several copies of its bin polynomials built from pseudorandom item identities, and the server has half of them opened before answering with the rest, so that cheating is caught except with probability exponentially small in the number of copies. The server, in turn, must derive all of its randomness from a seed it encrypts, letting the client replay each answer. Only the first fix avoids random oracles, and the combination is outlined only.","prior_boundary":"The constructions that solved private matching with a linear number of exponentiations had been analyzed only in the random oracle model against semi-honest parties (§2, p. 2). In the semi-honest protocol a client could send a polynomial with more than \\( n_Y \\) roots, which with hashing means more nonzero roots across bins than allowed (§5.1, pp. 10-11), and a server could use two different inputs for the evaluation and the payload, for example encrypting \\( r \\cdot (P(y) + P(y')) + y' \\) so that y' is reported only if both y and y' are client items (§5.2, p. 11).","significance_at_publication":"The paper presents these as protocols for malicious environments with the same \\( O(n) \\) communication and \\( O(n \\ln\\ln n) \\) computation as the semi-honest case up to the factor L, the client-side protocol in the standard model and the server-side one in the random oracle model (abstract, p. 1; footnote 4, p. 2; §5, p. 10). It recalls informally the standard ideal-model definition of security against malicious adversaries for private matching, by comparison with an ideal model in which a corrupt party may give any input to the trusted party (§3.2, p. 4), and its proof sketch gives a malicious client an ideal-model counterpart whose input has at most \\( n_Y \\) items, up to an error exponentially small in L (§5.1, p. 11).","technical_delta":"Cut-and-choose over L copies with pseudorandom item identities bounds the client's effective set (Protocol PM-Malicious-Client, p. 10; proof sketch, p. 11). Deriving the server's evaluation randomness and a hash tag from an encrypted seed lets the client verify each reply against her own items (Protocol PM-Malicious-Server, p. 12; Lemma 4, p. 12)."},"historical_context_status":"curator_synthesis","id":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","keywords":["malicious-security","cut-and-choose","random-oracle","pseudo-identities","oblivious-polynomial-evaluation"],"limitations":["the protocol against both malicious parties is only outlined; its detailed description is deferred to the full version (§5.3, p. 13)","the malicious-server protocol is given without hashing; the paper says the balanced-allocation version may be modified similarly (§5.2, p. 11)","security arguments are proof sketches (pp. 11-13)"],"paper_id":"PSI-PAPER-2004-FNP","qualifiers":["malicious client: standard model, overhead L times the semi-honest protocol, error exponentially small in L (§5.1, p. 11)","malicious server: random oracle model, random oracles H1 and H2 (Protocol PM-Malicious-Server, p. 12)","without hashing, a client polynomial with more than \\( n_Y \\) roots is excluded by fixing the constant coefficient to 1 (§5.1, p. 11)","the client protocol uses a pseudorandom function F and a collision-resistant hash G (Protocol PM-Malicious-Client, step 1(b), p. 10; footnote 10, p. 11)"],"source_locator":{"dossier_section":"PSI-PAPER-2004-FNP § Contributions","primary_source":"Abstract (p. 1); contributions, §2 and footnote 4 (p. 2); §3.2 'Malicious adversaries' (p. 4); §5 introduction (pp. 9-10); Protocol PM-Malicious-Client (p. 10); §5.1 and proof sketch (pp. 10-11); §5.2 (p. 11); Protocol PM-Malicious-Server and Lemma 4 (p. 12); proof sketch (pp. 12-13); §5.3 (p. 13). EUROCRYPT 2004, LNCS 3027, printed pages.","primary_source_url":"https://doi.org/10.1007/978-3-540-24676-3_1","status":"section_checked"},"statement":"Against a malicious client, the client builds L copies of her bin polynomials over pseudorandom identities \\( F_s(G(x)) \\) of her items, the server opens \\( L/2 \\) copies to check that each has \\( n_Y \\) nonzero roots and evaluates the rest with XOR shares of each item as payloads, giving error exponentially small in L at L times the semi-honest cost, in the standard model. Against a malicious server, the server derives all randomness for item y from \\( r = H1(s) \\) for a random s, returns \\( (\\mathrm{Enc}(r' \\cdot P(y) + s), H2(r'', y)) \\), and the client recomputes each reply to check consistency, in the random oracle model. A protocol secure against both is only outlined.","statement_status":"source_normalized_statement","status":"published","title":"Polynomial-evaluation PSI secure against a malicious client by cut-and-choose (standard model) and against a malicious server by derandomized replies (random oracle model)","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Malicious-secure polynomial-evaluation PSI","heading":"Overview"},{"content":"PM-Malicious-Client: the client sends L copies, the server asks to open \\( L/2 \\) of them, the client opens their encrypted coefficients without revealing their PRF keys and reveals the keys of the other \\( L/2 \\) copies, and the server, after checking \\( n_Y \\) roots per opened copy, evaluates the unopened copies with \\( L/2 \\) random shares whose XOR is its item as payloads (Protocol PM-Malicious-Client, p. 10). PM-Malicious-Server: the server computes \\( r = H1(s) \\) for a random s and returns \\( (\\mathrm{Enc}(r' \\cdot P(y) + s), H2(r'', y)) \\); the client decrypts s, recomputes r, and accepts x if the pair is consistent with x (Protocol PM-Malicious-Server, p. 12). The simulator extracts the server's input from its random-oracle queries (Lemma 4 and proof sketch, pp. 12-13).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"fnp04-malicious-secure-polynomial","status":"published","subtitle":"Efficient Private Matching and Set Intersection","summary":"Against a malicious client, the client builds L copies of her bin polynomials over pseudorandom identities \\( F_s(G(x)) \\) of her items, the server opens \\( L/2 \\) copies to check that each has \\( n_Y \\) nonzero roots and evaluates the rest with XOR shares of each item as payloads, giving error exponentially small in L at L times the semi-honest cost, in the standard model. Against a malicious server, the server derives all randomness for item y from \\( r = H1(s) \\) for a random s, returns \\( (\\mathrm{Enc}(r' \\cdot P(y) + s), H2(r'', y)) \\), and the client recomputes each reply to check consistency, in the random oracle model. A protocol secure against both is only outlined.","tableRows":["PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","PSI-CONSTRUCTION-2004-FNP-MAL-SERVER"],"title":"Polynomial-evaluation PSI secure against a malicious client by cut-and-choose (standard model) and against a malicious server by derandomized replies (random oracle model)","type":"result","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","keywords":["atomic-result","multiparty","leader","xor-shares","oblivious-polynomial-evaluation","bulletin-board"],"metadata":{"claim_slug":"multiparty-ope","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["multiparty"],"technique":["oblivious_polynomial_evaluation","secret_sharing"]},"historical_context":{"narrative":"Extending the polynomial protocol to many parties looks easy: let one party, the leader, evaluate every other party's encrypted polynomial on its own items, splitting each item into shares that only a matching client can unlock. Freedman, Nissim, and Pinkas show that this naive version leaks, since the leader created the shares and can see which clients return the right ones even for items that are not shared by everyone. Their fix has every client contribute additional random shares that cancel out, so the values clients publish look random unless an item lies in every set. The resulting protocol for honest-but-curious parties needs only three rounds of postings, which the authors contrast with many-round protocols whose communication grows quadratically in the number of parties, as \\( O(\\ell^2) \\).","prior_boundary":"The paper's two-party protocol gives the intersection to one client (Protocol PM-Semi-Honest, p. 6). A strawman extension in which the leader shares each item among the clients fails, because the leader can tell which clients hold an item outside the intersection from which of them publish correct shares (§7, pp. 15-16).","significance_at_publication":"The authors note that the communication involves two rounds of client submissions and one of the leader, which they prefer to protocols with many rounds and \\( \\ell^2 \\) communication, \\( \\ell \\) the number of parties, and that hashing to bins can lower the leader's computation (§7, p. 17).","technical_delta":"Each client adds, for each leader item, random shares that XOR to zero, encrypted to the other clients, so that published values look random to the leader unless the item is in the intersection (§7, steps 1-4, p. 16)."},"historical_context_status":"curator_synthesis","id":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","keywords":["multiparty","leader","xor-shares","oblivious-polynomial-evaluation","bulletin-board"],"limitations":["no proof and no formal collusion threshold are given; the text says that for items outside the intersection the published XOR looks random to any coalition (§7, p. 16)","no costs are stated beyond the round count; the leader's computation can be reduced by the hashing of §4.2 (§7, p. 17)"],"paper_id":"PSI-PAPER-2004-FNP","qualifiers":["semi-honest parties only; the protocol is sketched (§7, p. 15)","each list is assumed to contain \\( n \\) items without loss of generality (§7, p. 15)","data is posted to a public bulletin board, or to the leader acting as one (§7, step 1, p. 16)"],"source_locator":{"dossier_section":"PSI-PAPER-2004-FNP § Contributions","primary_source":"Abstract (p. 1); contributions (p. 2); §7 'The Multi-party Case', 'A strawman protocol', and 'Achieving security with respect to semi-honest parties', steps 1-4 (pp. 15-17). EUROCRYPT 2004, LNCS 3027, printed pages.","primary_source_url":"https://doi.org/10.1007/978-3-540-24676-3_1","status":"section_checked"},"statement":"For \\( \\ell \\) parties with \\( n \\) items each, \\( \\ell - 1 \\) clients publish polynomials encoding their items under their own additively homomorphic keys, together with encrypted random shares that XOR to zero for each of the leader's \\( n \\) items; the leader evaluates every client polynomial on each of its items with one XOR share of the item as payload; each client decrypts what is encrypted under its key and publishes the XOR of the leader's share with the other clients' zero shares, and an item is in the intersection if all published values for its row XOR to it. The protocol is sketched for semi-honest parties and uses two rounds of client submissions and one round of leader submissions.","statement_status":"source_normalized_statement","status":"published","title":"Multi-party set intersection from encrypted client polynomials and XOR-shared payloads with re-randomizing zero shares, semi-honest (protocol sketch)","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Multi-party polynomial-evaluation PSI","heading":"Overview"},{"content":"Client \\( P_i \\) (\\( 1 \\le i \\le \\ell - 1 \\)) posts encrypted coefficients of a degree-\\( n \\) polynomial \\( Q_i \\) with its items as roots, and an \\( n \\times (\\ell - 1) \\) matrix of random numbers whose rows XOR to zero, column \\( j \\) encrypted under \\( P_j \\)'s key. The leader \\( P_\\ell \\) splits each of its items y into \\( \\ell - 1 \\) XOR shares \\( s_{y,j} \\) and posts, for each y, the tuple of encryptions of \\( r_{y,j} \\cdot Q_j(y) + s_{y,j} \\), in permuted order. Each client decrypts its column from the leader and from the other clients, XORs each row, and posts the \\( n \\) results; every party checks whether a row's published values XOR to one of its items (§7, steps 1-4, p. 16).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"fnp04-multi-party-set-intersection","status":"published","subtitle":"Efficient Private Matching and Set Intersection","summary":"For \\( \\ell \\) parties with \\( n \\) items each, \\( \\ell - 1 \\) clients publish polynomials encoding their items under their own additively homomorphic keys, together with encrypted random shares that XOR to zero for each of the leader's \\( n \\) items; the leader evaluates every client polynomial on each of its items with one XOR share of the item as payload; each client decrypts what is encrypted under its key and publishes the XOR of the leader's share with the other clients' zero shares, and an item is in the intersection if all published values for its row XOR to it. The protocol is sketched for semi-honest parties and uses two rounds of client submissions and one round of leader submissions.","tableRows":["PSI-CONSTRUCTION-2004-FNP-MULTIPARTY"],"title":"Multi-party set intersection from encrypted client polynomials and XOR-shared payloads with re-randomizing zero shares, semi-honest (protocol sketch)","type":"result","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2004-FNP-OPE-PSI","keywords":["atomic-result","oblivious-polynomial-evaluation","homomorphic-encryption","private-matching","paillier","standard-model"],"metadata":{"claim_slug":"ope-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["standard_model"],"technique":["oblivious_polynomial_evaluation"]},"historical_context":{"narrative":"Before this work, two parties could compute a set intersection privately with generic circuits or with many pairwise equality tests, both with communication \\( O(n^2 \\log u) \\), \\( u \\) the domain size, while cheaper constructions using a linear number of exponentiations had been argued only with random oracles and only for honest-but-curious parties. Freedman, Nissim, and Pinkas turned the client's set into the roots of a polynomial and sent its coefficients under additively homomorphic encryption, so that the server could evaluate it blindly on each of its own items and hide everything except matches behind a random multiplier. Security against semi-honest parties then rests on semantic security alone, in the standard model, and communication is linear in the set sizes, \\( O(n_X + n_Y) \\), which the authors present as an improvement over earlier solutions.","prior_boundary":"A generic circuit for private matching of length-\\( n \\) lists needs \\( O(n^2 \\log u) \\) communication and \\( O(n \\log u) \\) oblivious transfers, \\( u \\) the domain size, and comparing all pairs with private equality tests costs \\( O(n^2 \\log u) \\) communication; constructions with only \\( O(n) \\) exponentiations had been analyzed only in the random oracle model against semi-honest parties (§2, p. 2).","significance_at_publication":"The authors state that their protocols are more efficient than previous solutions, with \\( O(n) \\) communication (p. 2), and that the semi-honest protocol is secure in the standard model, unlike the earlier \\( O(n) \\)-exponentiation constructions (abstract, p. 1; §2, p. 2).","technical_delta":"The client's set becomes the root set of a polynomial sent under additively homomorphic encryption; the server evaluates it on each of its items, masks the result with a random multiplier, and adds the item, so shared items decrypt to themselves (§4.1, p. 5; Protocol PM-Semi-Honest, p. 6). Client privacy follows from semantic security and server privacy from simulating with the polynomial's roots (Lemmas 2-3, p. 8)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2004-FNP-OPE-PSI","keywords":["oblivious-polynomial-evaluation","homomorphic-encryption","private-matching","paillier","standard-model"],"limitations":["security is argued by lemma statements with proof sketches (§4.3, p. 8)","a malicious server can break correctness, for example by encrypting \\( r \\cdot (P(y) + P(y')) + y' \\) (§5.2, p. 11); malicious security is a separate contribution","the \\( O(n_Y n_X) \\) server cost of this basic protocol is reduced only by the hashing of §4.2 (p. 6)"],"paper_id":"PSI-PAPER-2004-FNP","qualifiers":["only the client learns the intersection (§3.1, p. 3)","the plaintext space is a field that represents the input domain but is exponentially larger (Protocol PM-Semi-Honest, step 1(a), p. 6)","the server may attach a payload \\( v_y \\) by computing \\( \\mathrm{Enc}(r \\cdot P(y) + (y|v_y)) \\); the client obtains \\( v_y \\) iff y is shared (Protocol PM-Semi-Honest, step 2(b), p. 6)","deciding whether a ciphertext encrypts a client item suffices, so exponential ElGamal can replace Paillier (footnote 8, p. 5)","re-randomization of the result ciphertexts is neglected in the description (footnote 6, p. 5)"],"source_locator":{"dossier_section":"PSI-PAPER-2004-FNP § Contributions","primary_source":"Abstract (p. 1); contributions (p. 2); §2 (p. 2); §3.1 (p. 3); §3.3 (pp. 4-5); §4.1 (p. 5); Protocol PM-Semi-Honest (p. 6); §4.3, Lemmas 1-3 (p. 8). EUROCRYPT 2004, LNCS 3027, printed pages.","primary_source_url":"https://doi.org/10.1007/978-3-540-24676-3_1","status":"section_checked"},"statement":"The client encodes her \\( n_Y \\) items as the roots of a polynomial P and sends its coefficients encrypted under a semantically secure additively homomorphic scheme; for each of his \\( n_X \\) items y the server homomorphically computes \\( \\mathrm{Enc}(r \\cdot P(y) + y) \\) with a fresh random r and returns the permuted ciphertexts, so the client decrypts exactly the shared items and random values otherwise. The protocol computes the intersection for the client with security against semi-honest parties in the standard model, assuming semantic security; without the hashing optimization the server performs \\( O(n_Y n_X) \\) exponentiations.","statement_status":"source_normalized_statement","status":"published","title":"Set intersection for the client from oblivious evaluation of an encrypted polynomial whose roots are the client's items, semi-honest, standard model","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Polynomial-evaluation PSI","heading":"Overview"},{"content":"The client interpolates \\( P(y) = (x_1 - y) \\cdots (x_{n_Y} - y) \\), encrypts its \\( n_Y + 1 \\) coefficients, and sends them; the server computes \\( \\mathrm{Enc}(P(y)) \\) by homomorphic operations for each of its items, then \\( \\mathrm{Enc}(r \\cdot P(y) + y) \\), and sends the permuted results; the client outputs every x in its set that appears among the decryptions (Protocol PM-Semi-Honest, p. 6). The authors note that the construction generalizes oblivious transfer protocols in which the client sends a predicate that is zero exactly at its index (footnote 7, p. 5).","heading":"Exact contribution"},{"content":"HE-RESULT-1999-PAILLIER-PRACTICAL-ADDITIVELY-HOMOMORPHIC-PUBLIC-KEY-ENCRYPTION: Paillier encryption, named as a scheme with the required homomorphism (§3.3, p. 5, reference [20]).","heading":"Related records in other topics"}],"slug":"fnp04-polynomial-evaluation-psi","status":"published","subtitle":"Efficient Private Matching and Set Intersection","summary":"The client encodes her \\( n_Y \\) items as the roots of a polynomial P and sends its coefficients encrypted under a semantically secure additively homomorphic scheme; for each of his \\( n_X \\) items y the server homomorphically computes \\( \\mathrm{Enc}(r \\cdot P(y) + y) \\) with a fresh random r and returns the permuted ciphertexts, so the client decrypts exactly the shared items and random values otherwise. The protocol computes the intersection for the client with security against semi-honest parties in the standard model, assuming semantic security; without the hashing optimization the server performs \\( O(n_Y n_X) \\) exponentiations.","tableRows":["PSI-CONSTRUCTION-2004-FNP-SH"],"title":"Set intersection for the client from oblivious evaluation of an encrypted polynomial whose roots are the client's items, semi-honest, standard model","type":"result","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2004-FNP-OPE-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2004-FNP-OT-REDUCTION","keywords":["atomic-result","oblivious-transfer","black-box-separation","one-way-functions","impagliazzo-rudich","private-matching"],"metadata":{"claim_slug":"ot-reduction","contribution_kind":"boundary_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"]},"historical_context":{"narrative":"A natural question about any new secure-computation task is how weak an assumption could possibly suffice. Freedman, Nissim, and Pinkas answered it for set intersection with a two-line encoding. If the sender's set holds each of its two bits tagged with its position, and the chooser's set holds both possible bits tagged with its choice, then the one common element tells the chooser exactly the bit it selected and nothing more. Any private matching protocol thus yields oblivious transfer, and the known black-box separation between one-way functions and oblivious transfer carries over. Set intersection therefore cannot be built from one-way functions alone in a black-box way, which the authors state as an impossibility result and do not develop further.","prior_boundary":"Impagliazzo and Rudich bounded what can be proved from one-way permutations in a black-box way (reference [13], cited in §3.1, p. 3); the paper uses this result through oblivious transfer.","significance_at_publication":"It follows that no black-box reduction of private matching from one-way functions exists (§3.1, p. 3); the authors use the reduction only for this impossibility statement (§3.1, p. 4).","technical_delta":"A two-element set encoding of the sender's bits and the chooser's choice bit turns any private matching protocol into a 1-out-of-2 bit oblivious transfer protocol (§3.1, p. 3); the semi-honest PM protocol also supports oblivious transfer of strings, and 1-out-of-N bit transfer can be built directly (§3.1, p. 4)."},"historical_context_status":"curator_synthesis","id":"PSI-CONTRIB-2004-FNP-OT-REDUCTION","keywords":["oblivious-transfer","black-box-separation","one-way-functions","impagliazzo-rudich","private-matching"],"limitations":["no non-black-box impossibility is claimed (§3.1, p. 3)","the reduction is given in prose without a formal proof (§3.1, pp. 3-4)"],"paper_id":"PSI-PAPER-2004-FNP","qualifiers":["the reduction is stated for semi-honest 1-out-of-2 bit oblivious transfer (§3.1, p. 3)","the impossibility concerns black-box reductions only (§3.1, p. 3)"],"source_locator":{"dossier_section":"PSI-PAPER-2004-FNP § Contributions","primary_source":"§3.1 'Private Matching and Oblivious Transfer' (pp. 3-4). EUROCRYPT 2004, LNCS 3027, printed pages.","primary_source_url":"https://doi.org/10.1007/978-3-540-24676-3_1","status":"section_checked"},"statement":"Semi-honest 1-out-of-2 bit oblivious transfer reduces to private matching: the sender inputs the set \\( \\{0|b_0, 1|b_1\\} \\), the chooser inputs \\( \\{\\sigma|0, \\sigma|1\\} \\), and the chooser's output of the matching protocol is \\( \\sigma|b_\\sigma \\). By the result of Impagliazzo and Rudich, private matching therefore has no black-box reduction from one-way functions.","statement_status":"source_normalized_statement","status":"published","title":"Private matching implies oblivious transfer, so set intersection has no black-box construction from one-way functions","work_id":"PSI-PAPER-2004-FNP","year":2004},"primaryUrl":"https://doi.org/10.1007/978-3-540-24676-3_1","sections":[{"content":"Private matching implies oblivious transfer","heading":"Overview"},{"content":"From a private matching protocol in which the chooser learns \\( X \\cap Y \\), the sender's set \\( \\{0|b_0, 1|b_1\\} \\) and the chooser's set \\( \\{\\sigma|0, \\sigma|1\\} \\) intersect in exactly \\( \\sigma|b_\\sigma \\), giving the chooser \\( b_\\sigma \\) and the sender nothing (§3.1, p. 3). The authors combine this with Impagliazzo and Rudich to conclude that private matching cannot be reduced to one-way functions in a black-box manner (§3.1, p. 3).","heading":"Exact contribution"},{"content":"MPC-COMP-CORR-BASEOT: oblivious transfer, the primitive that private matching is shown to imply (§3.1, p. 3).","heading":"Related records in other topics"}],"slug":"fnp04-private-matching-implies-obl","status":"published","subtitle":"Efficient Private Matching and Set Intersection","summary":"Semi-honest 1-out-of-2 bit oblivious transfer reduces to private matching: the sender inputs the set \\( \\{0|b_0, 1|b_1\\} \\), the chooser inputs \\( \\{\\sigma|0, \\sigma|1\\} \\), and the chooser's output of the matching protocol is \\( \\sigma|b_\\sigma \\). By the result of Impagliazzo and Rudich, private matching therefore has no black-box reduction from one-way functions.","title":"Private matching implies oblivious transfer, so set intersection has no black-box construction from one-way functions","type":"result","venue":"EUROCRYPT 2004","year":2004,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2004-FNP-OT-REDUCTION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2010-DT-BLIND-RSA","keywords":["atomic-result","blind-rsa","rsa-signatures","one-more-rsa","server-precomputation","weak-client","oblivious-keyword-search"],"metadata":{"claim_slug":"blind-rsa","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"technique":["rsa_blind_signature"]},"historical_context":{"narrative":"Linear-cost PSI protocols existed by 2009, but they made the client perform one modular exponentiation per item, which is heavy for a phone, and the best known oblivious-PRF protocol carried extra setup. De Cristofaro and Tsudik borrowed an idea from adaptive oblivious keyword search: the server signs the hashes of its items with an RSA key ahead of time and publishes hashes of those signatures, and the client obtains signatures on its own items by blind signing, so that matching items produce equal tags. Online, the client multiplies and divides but never exponentiates, and the server performs one exponentiation per client item. The authors recommend the protocol when the client is weak and the server can precompute, and they note that reusing tags lets a client track changes to the server's set.","prior_boundary":"Polynomial-evaluation PSI cost \\( O(n_X n_Y) \\) or \\( O(n_X \\log\\log n_Y) \\) server exponentiations; the OPRF-based protocol of Jarecki and Liu needed a common reference string with a safe RSA modulus and a polynomial input domain; the UPF-based protocol of Jarecki and Liu used \\( O(n_X + n_Y) \\) short server exponentiations and \\( O(n_Y) \\) client exponentiations (§4.1, pp. 3-4; Table 2, p. 11). The paper's own prime-order protocol also needs \\( O(n_Y) \\) client exponentiations (§5.5, p. 8).","significance_at_publication":"The client performs no online exponentiations, which suits resource-poor clients (§5.6, p. 9); in the paper's measurements the client's online time for 5,000 items per party is 1,422 ms against 5,344 ms for the prime-order protocol, while the server's is 4,662 ms against 2,072 ms (Table 3, p. 11).","technical_delta":"Adapting Ogata and Kurosawa's adaptive oblivious keyword search, the server reveals as keys the hashes of RSA signatures on its items, and the client obtains signatures on its own items by blinding (§5.6, Figure 4, p. 9); server privacy is reduced to one-more-RSA in the random oracle model (Appendix B.3, p. 16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2010-DT-BLIND-RSA","keywords":["blind-rsa","rsa-signatures","one-more-rsa","server-precomputation","weak-client","oblivious-keyword-search"],"limitations":["no server unlinkability: tags \\( H'(H(s_j)^d) \\) repeat across runs, so a client observes changes in the server's set; the paper sketches patches such as fresh RSA keys or per-run hash functions (§5.6, pp. 9-10)","without precomputation it is slower than the prime-order protocol, which uses shorter server exponents (§5.6, p. 10)","client privacy and unlinkability proofs are deferred; server privacy is a proof sketch (Appendix B.3, p. 16)","no security against malicious parties is claimed (§5.1, p. 6; §7, p. 12)"],"paper_id":"PSI-PAPER-2010-DT","qualifiers":["honest-but-curious client and server (§5.1, p. 6)","the server sets up its RSA parameters a priori and precomputes \\( n_X \\) signatures and tags; the client precomputes its blinded values (Figure 4, steps 1-2, p. 9)","only the client learns the intersection; mutual PSI is obtained by two one-way runs if neither party aborts (§2, p. 2)","data transfer can be added by deriving symmetric keys from the matching values (§5.7, p. 10)"],"source_locator":{"dossier_section":"PSI-PAPER-2010-DT § Contributions","primary_source":"§3, item 4 (p. 2); §4.1 (pp. 3-4); §5.1 (p. 6); §5.6, Figure 4 and 'Drawbacks' (pp. 9-10); §5.7 (p. 10); Table 2 (p. 11); §6.1 and Table 3 (p. 11); Appendix A, One-More-RSA (pp. 13-14); Appendix B.3 (p. 16). IACR ePrint 2009/491, PDF dated 2010-08-04.","primary_source_url":"https://eprint.iacr.org/2009/491","status":"section_checked"},"statement":"The server signs the full-domain hash of each of its \\( n_X \\) items with its RSA key offline and sends the tags \\( H'(H(s_j)^d) \\); the client blinds each hashed item as \\( H(c_i) \\cdot R_i^e \\), the server returns \\( (H(c_i) \\cdot R_i^e)^d \\), and the client divides by \\( R_i \\) to obtain \\( H(c_i)^d \\) and compares tags. Against honest-but-curious parties, in the random oracle model under the one-more-RSA assumption, the protocol is server-private, client-private, and client-unlinkable; online the server performs \\( O(n_Y) \\) exponentiations and the client \\( O(n_Y) \\) modular multiplications, after \\( n_X \\) RSA signatures of server precomputation, with \\( O(n_Y + n_X) \\) communication.","statement_status":"source_normalized_statement","status":"published","title":"PSI from RSA blind signatures with server precomputation and no online client exponentiations, semi-honest, random oracle model","work_id":"PSI-PAPER-2010-DT","year":2010},"primaryUrl":"https://eprint.iacr.org/2009/491","sections":[{"content":"Blind-RSA PSI","heading":"Overview"},{"content":"Offline, the server computes \\( K_{s:j} = H(s_j)^d \\bmod N \\) and \\( t_j = H'(K_{s:j}) \\) for each of its items, and the client computes \\( y_i = H(c_i) \\cdot (R_{c:i})^e \\bmod N \\). Online, the client sends the \\( y_i \\), the server returns \\( y_i^d \\) together with the tags \\( t_j \\), and the client computes \\( K_{c:i} = y_i^d / R_{c:i} = H(c_i)^d \\) and outputs the items whose tag \\( H'(K_{c:i}) \\) appears among the \\( t_j \\) (Figure 4, p. 9). The simulator for an honest-but-curious client answers random-oracle queries and reduces any client that learns more than \\( n_Y \\) outputs to the one-more-RSA problem (Appendix B.3, p. 16).","heading":"Exact contribution"},{"content":"SIG-CONSTRUCTION-1978-RSA: RSA signatures, computed obliviously by blinding (Figure 4, p. 9; Appendix B.3, p. 16, which cites Chaum's blind signatures). Ogata-Kurosawa adaptive oblivious keyword search, the stated source of the idea (§5.6, p. 9), has no record in any topic.","heading":"Related records in other topics"}],"slug":"dt10-psi-from-rsa-blind","status":"published","subtitle":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","summary":"The server signs the full-domain hash of each of its \\( n_X \\) items with its RSA key offline and sends the tags \\( H'(H(s_j)^d) \\); the client blinds each hashed item as \\( H(c_i) \\cdot R_i^e \\), the server returns \\( (H(c_i) \\cdot R_i^e)^d \\), and the client divides by \\( R_i \\) to obtain \\( H(c_i)^d \\) and compares tags. Against honest-but-curious parties, in the random oracle model under the one-more-RSA assumption, the protocol is server-private, client-private, and client-unlinkable; online the server performs \\( O(n_Y) \\) exponentiations and the client \\( O(n_Y) \\) modular multiplications, after \\( n_X \\) RSA signatures of server precomputation, with \\( O(n_Y + n_X) \\) communication.","tableRows":["PSI-CONSTRUCTION-2010-DT-BLIND-RSA"],"title":"PSI from RSA blind signatures with server precomputation and no online client exponentiations, semi-honest, random oracle model","type":"result","venue":"FC 2010","year":2010,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2010-DT-BLIND-RSA"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2010-DT-LINEAR-APSI","keywords":["atomic-result","authorized-psi","apsi","rsa-ppit","linear-complexity","one-more-gap-dh","product-of-hashes","certification-authority"],"metadata":{"claim_slug":"linear-apsi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"]},"historical_context":{"narrative":"Authorized set intersection asks that a client may only match items that a trusted authority has signed, which suits queries such as checking vetted suspects against a bank's records. The available construction, extended from a policy-based information transfer protocol, compared every client authorization with every server item, so its cost grew with the product of the set sizes; identity-based alternatives were linear but lost forward security. De Cristofaro and Tsudik restructured the RSA protocol so that the client folds all its signatures into one aggregate value, letting the server derive a single key per item of its own. Costs become linear, and moving the same pattern into a prime-order group gives a plain set-intersection protocol with short exponents, which the authors prove secure only for honest-but-curious parties.","prior_boundary":"APSI obtained by extending RSA-PPIT to clients with several authorizations has quadratic computation and communication (§4.2, p. 5; §5.3, Figure 1, p. 7); IBE-based PPIT is linear but not forward secure, and PEKS-based APSI needs a quadratic number of tests and bilinear maps (§4.2, p. 5).","significance_at_publication":"The authors report that the linear APSI protocol needs 12,037 ms of server time against 99,118 ms for the RSA-PPIT protocol for 5,000 items per party, with the gap growing for larger sets (Table 3 and §6.1, p. 11), and that it relies on RSA rather than bilinear maps (§4.2, p. 5).","technical_delta":"The client aggregates its authorizations into \\( \\mathrm{PCH}^* \\) and sends \\( X = (\\mathrm{PCH}^*)^2 \\cdot g^{R_c} \\) plus, for each item, a value built from \\( \\mathrm{PCH}^*/\\sigma_i \\), so the server computes one key per own item from \\( X \\) instead of one per pair (§5.4, Figure 2, pp. 7-8). Dropping the RSA setting for a subgroup of prime order \\( r \\) of \\( \\mathbb{Z}_p^* \\) gives the PSI version, with \\( |r| \\)-bit exponents and precomputable \\( (h_{sj})^{-R_s} \\) (§5.5, Figure 3, p. 8)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2010-DT-LINEAR-APSI","keywords":["authorized-psi","apsi","rsa-ppit","linear-complexity","one-more-gap-dh","product-of-hashes","certification-authority"],"limitations":["no security against malicious parties is claimed; the authors' work-in-progress malicious proofs seem to depend on the product-of-hashes structure (§5.5, p. 9)","unlinkability is argued informally, with formal proofs deferred (Appendix B.1-B.2, pp. 14-15)","shorter exponents for the APSI protocol are suggested without a security proof (§6, p. 11)","authorization by a certification authority has no facet value in this topic; it is stated here in prose"],"paper_id":"PSI-PAPER-2010-DT","qualifiers":["APSI involves an offline certification authority that is assumed not to behave maliciously; the server is honest-but-curious and the client may lack authorizations for some items (§5.1, p. 6)","in the PSI version both client and server are honest-but-curious (§5.1, p. 6)","the server privacy reduction for the PSI version gives the reduction one additional DH-oracle query; removing it is stated as ongoing work (Appendix B.2, p. 16)","simplified versions for honest-but-curious parties that drop the product of hashes are given in Appendix C (Figures 5-6, p. 17)","only the client learns the intersection (§2, p. 2)"],"source_locator":{"dossier_section":"PSI-PAPER-2010-DT § Contributions","primary_source":"§2 (p. 2); §3, items 2-3 (p. 2); §4.2 (p. 5); §5.1 Definitions 1-2 and assumptions (p. 6); §5.2 (p. 6); §5.3, Figure 1 (p. 7); §5.4, Figure 2 (pp. 7-8); §5.5, Figure 3 (pp. 8-9); Table 2 (p. 11); Table 3 (p. 11); Appendix B.1 (pp. 14-15); Appendix B.2 (pp. 15-16); Appendix C, Figures 5-6 (p. 17). IACR ePrint 2009/491, PDF dated 2010-08-04.","primary_source_url":"https://eprint.iacr.org/2009/491","status":"section_checked"},"statement":"In authorized PSI, where each client item must carry an RSA signature issued by an offline certification authority, the client sends one aggregate value X built from the product of its signatures and one blinded value per item; the server returns one exponentiated value per client value and one tag per own item, and the client recomputes the tags of its authorized items. Computation and communication are \\( O(n_Y + n_X) \\), against \\( O(n_X n_Y) \\) for the APSI protocol derived from RSA-PPIT, with an honest-but-curious server and a client that may lack authorizations, proved server-private in the random oracle model under the RSA assumption. The same structure in a prime-order subgroup of \\( \\mathbb{Z}_p^* \\) gives a PSI protocol with \\( O(n_Y + n_X) \\) costs and short exponents, whose server privacy is argued under the One-More-Gap-DH assumption in the random oracle model.","statement_status":"source_normalized_statement","status":"published","title":"Authorized PSI with computation and communication linear in both set sizes, \\( O(n_X + n_Y) \\), and its prime-order-group PSI version, semi-honest, random oracle model","work_id":"PSI-PAPER-2010-DT","year":2010},"primaryUrl":"https://eprint.iacr.org/2009/491","sections":[{"content":"Linear-cost authorized PSI and its PSI version","heading":"Overview"},{"content":"APSI (Figure 2, p. 8): the client computes \\( \\mathrm{PCH}^* = \\prod \\sigma_i \\), sends \\( X = (\\mathrm{PCH}^*)^2 \\cdot g^{R_c} \\) and \\( y_i = (\\mathrm{PCH}^*/\\sigma_i)^2 \\cdot g^{R_{c:i}} \\); the server picks \\( R_s \\), sends \\( Z = g^{eR_s} \\), \\( y_i' = y_i^{eR_s} \\), and tags \\( t_j = H'((X^e / h_{sj}^2)^{R_s}) \\); the client computes \\( K_{c:i} = y_i' \\cdot Z^{R_c} \\cdot Z^{-R_{c:i}} \\) and matches \\( H'(K_{c:i}) \\) against the tags. Server privacy reduces to RSA in the random oracle model (Appendix B.1, pp. 14-15). PSI (Figure 3, p. 8): the same flow in a subgroup of prime order \\( r \\) of \\( \\mathbb{Z}_p^* \\) with \\( \\mathrm{PCH} = \\prod H(c_i) \\), \\( X = \\mathrm{PCH} \\cdot g^{R_c} \\), and \\( t_j = H'((X/h_{sj})^{R_s}) \\); server privacy reduces to One-More-Gap-DH in the random oracle model (Appendix B.2, pp. 15-16).","heading":"Exact contribution"},{"content":"SIG-CONSTRUCTION-1978-RSA: the certification authority's authorizations are RSA signatures on hashed items (Figure 2, p. 8). The RSA-PPIT protocol of De Cristofaro, Jarecki, Kim, and Tsudik (PETS 2009), the stated starting point (§5.3, p. 7), has no record in any topic.","heading":"Related records in other topics"}],"slug":"dt10-authorized-psi-with-computat","status":"published","subtitle":"Practical Private Set Intersection Protocols with Linear Computational and Bandwidth Complexity","summary":"In authorized PSI, where each client item must carry an RSA signature issued by an offline certification authority, the client sends one aggregate value X built from the product of its signatures and one blinded value per item; the server returns one exponentiated value per client value and one tag per own item, and the client recomputes the tags of its authorized items. Computation and communication are \\( O(n_Y + n_X) \\), against \\( O(n_X n_Y) \\) for the APSI protocol derived from RSA-PPIT, with an honest-but-curious server and a client that may lack authorizations, proved server-private in the random oracle model under the RSA assumption. The same structure in a prime-order subgroup of \\( \\mathbb{Z}_p^* \\) gives a PSI protocol with \\( O(n_Y + n_X) \\) costs and short exponents, whose server privacy is argued under the One-More-Gap-DH assumption in the random oracle model.","tableRows":["PSI-CONSTRUCTION-2010-DT-FIG3"],"title":"Authorized PSI with computation and communication linear in both set sizes, \\( O(n_X + n_Y) \\), and its prime-order-group PSI version, semi-honest, random oracle model","type":"result","venue":"FC 2010","year":2010,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2010-DT-LINEAR-APSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","keywords":["atomic-result","benchmark","garbled-circuits","custom-protocols","one-more-discrete-log","bandwidth","security-levels","nist"],"metadata":{"claim_slug":"gc-versus-custom","contribution_kind":"measurement_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"set_size_regime":["balanced"],"technique":["garbled_circuits","ot_extension"]},"historical_context":{"narrative":"Through the late 2000s, designers of set-intersection protocols built them from public-key primitives and justified this by the presumed slowness of generic secure computation, without measuring the alternative. Huang, Evans, and Katz tested the presumption directly. They rebuilt the fastest custom semi-honest protocol as a real client-server program in the same Java framework as their own garbled circuits and timed both on one pair of desktop machines at five security levels. The garbled circuit used vastly more bandwidth, hundreds of megabytes against one or two, but almost no exponentiations, so its running time grew slowly with the security level while the public-key protocol grew steeply. The measurements turned an untested assumption about generic computation into a comparison with stated settings.","prior_boundary":"Custom PSI protocols from homomorphic encryption and other public-key techniques were designed on the stated belief that generic garbled-circuit solutions would be impractical, a claim the authors say had never been substantiated (abstract and §1, p. 1). The fastest semi-honest PSI protocol reported was that of De Cristofaro and Tsudik (§1.3, p. 3).","significance_at_publication":"For 32-bit elements SCS-WN was always comparable to or faster than the custom protocol, and for 160-bit elements more than ten times faster at the highest security level, at the cost of two to three orders of magnitude more bandwidth (§7.3, pp. 12-13). The conclusion states that generic protocols can be competitive with the best custom PSI protocols (§8, p. 14).","technical_delta":"The authors reimplemented the De Cristofaro-Tsudik protocols in Java as client-server protocols with the same tools as their garbled-circuit framework (§7.3 and footnote 3, p. 12) and measured both at five NIST security levels, scaling OT parameters, OT-extension security, wire-label length, and hash function together (Table 3, p. 12; Figure 11, p. 13). They also counted the expensive operations of each protocol for \\( n = 1024 \\) and \\( \\sigma = 160 \\) (Table 2, p. 13)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","keywords":["benchmark","garbled-circuits","custom-protocols","one-more-discrete-log","bandwidth","security-levels","nist"],"limitations":["for 160-bit elements at the ultra-short level SCS-WN took 51.5 s against 10.9 s for the custom protocol (Figure 11, p. 13); the introduction says it is faster except at that level (§1.1, p. 2)","the comparison covers semi-honest security only (§1.1, p. 2)","timings depend on the implementations of the cryptographic operations, which is why Table 2 also counts operations (§7.3, pp. 13-14)"],"paper_id":"PSI-PAPER-2012-HEK","qualifiers":["two Dell desktops with Intel Core 2 Duo E8400 at 3 GHz, 100 Mbps LAN, one core per party (§7, p. 11; §7.2, p. 12)","times include OT and garbled-circuit execution but exclude one-time setup, about 1.2 s for circuit construction and under 1 s for OT-extension initialization, which would add about two seconds to the first run per pair (§7, p. 11; §7.3, p. 12)","the custom protocol is the one-more-DL-based variant, which the authors found faster in total running time than the one-more-RSA-based one (footnote 4, p. 12)","both sides are the authors' Java implementations; De Cristofaro and Tsudik's own C code was single-process and not used for timing (footnote 3, p. 12)","times in this statement are read from the bar labels of Figure 11 for \\( n = 1024 \\) (p. 13)"],"source_locator":{"dossier_section":"PSI-PAPER-2012-HEK § Contributions","primary_source":"Abstract and §1 (p. 1); §1.1 (p. 2); §7 (p. 11); §7.1 and Figure 8 (p. 11); §7.2 and Figure 9 (p. 12); §7.3, footnotes 3-4, and Table 3 (p. 12); Figures 10-11 and Table 2 (p. 13); §8 (p. 14). NDSS 2012 PDF dated 2011-11-28.","primary_source_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","status":"section_checked"},"statement":"With both protocols implemented on the same two desktops (Intel Core 2 Duo E8400, 100 Mbps LAN), the garbled-circuit SCS-WN protocol computed the intersection of two sets of 1024 elements in 10.5 to 22.7 seconds for 32-bit elements and 51.5 to 122.7 seconds for 160-bit elements across NIST security levels from 80 to 256 bits, while the one-more-DL-based protocol of De Cristofaro and Tsudik took 10.9 to 1972.0 seconds; SCS-WN used 147 to 470 MB of bandwidth against 0.4 to 2.0 MB, and needs far fewer public-key operations but about 2000 times as many operations in total.","statement_status":"source_normalized_statement","status":"published","title":"Measured running time and bandwidth of garbled-circuit PSI against the fastest custom public-key PSI, semi-honest two-party","work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"Garbled circuits against custom PSI","heading":"Overview"},{"content":"Besides the comparison with the custom protocol, the paper measures its own protocols against each other. The bit-vector protocol is the fastest for element spaces up to about \\( \\sigma = 20 \\), for example for \\( n > 40 \\) at \\( \\sigma = 12 \\) and \\( n > 500 \\) at \\( \\sigma = 16 \\) (§7.1 and Figure 8, p. 11). For \\( \\sigma = 32 \\) and 128 to 8192 elements, SCS-WN is more than seven times faster than SCS-HE and 10 to 70 times faster than pairwise comparison, and the oblivious transfers take about 5% of the cost (§7.2, p. 12; Figure 10, p. 13). SCS-WN intersected two sets of \\( 2^{20} \\) 32-bit elements in about six hours (§7.2, p. 12).","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-YAO: all measured generic protocols use Yao's garbled-circuit protocol, cited as reference [39] (§1.2, p. 2). MPC-CONTRIB-2003-IKNP-OTEXT: the implementation uses OT extension, whose statistical parameter \\( \\lambda \\) is varied with the security level (§2, p. 4; Table 2, p. 13).","heading":"Related records in other topics"}],"slug":"hek12-measured-running-time-and","status":"published","subtitle":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","summary":"With both protocols implemented on the same two desktops (Intel Core 2 Duo E8400, 100 Mbps LAN), the garbled-circuit SCS-WN protocol computed the intersection of two sets of 1024 elements in 10.5 to 22.7 seconds for 32-bit elements and 51.5 to 122.7 seconds for 160-bit elements across NIST security levels from 80 to 256 bits, while the one-more-DL-based protocol of De Cristofaro and Tsudik took 10.9 to 1972.0 seconds; SCS-WN used 147 to 470 MB of bandwidth against 0.4 to 2.0 MB, and needs far fewer public-key operations but about 2000 times as many operations in total.","tableRows":["PSI-CONSTRUCTION-2012-HEK-BWA","PSI-CONSTRUCTION-2012-HEK-PWC","PSI-CONSTRUCTION-2012-HEK-SCS-HE","PSI-CONSTRUCTION-2012-HEK-SCS-SORT","PSI-CONSTRUCTION-2012-HEK-SCS-WN"],"title":"Measured running time and bandwidth of garbled-circuit PSI against the fastest custom public-key PSI, semi-honest two-party","type":"result","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2012-HEK-SIZE-AUDITING","keywords":["atomic-result","auditing","intersection-size","counter-circuit","garbled-circuits","composability"],"metadata":{"claim_slug":"size-auditing","contribution_kind":"capability_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"technique":["garbled_circuits"]},"historical_context":{"narrative":"A protocol that returns the intersection reveals a great deal, and when the universe of possible elements is small a dishonest participant can simply submit everything and read off the other set. Custom PSI protocols offered no easy way to restrict what is released, since any change to the output means redesigning the protocol. Huang, Evans, and Katz used the fact that their protocols are ordinary garbled circuits: a few extra gates can count the matches and suppress the result when there are too many. For the sort-based circuits the counter rides on signals the circuit already computes and adds no measurable time, while for the very cheap bit-vector circuit it multiplies the cost several times over. The example illustrates the argument that generic protocols compose with further computation.","prior_boundary":"A PSI output leaks much about the inputs, and for small universes a dishonest party can input every value and learn the other set (§6, p. 10; §3, pp. 4-5). The authors judge that such self-auditing appears difficult to add to custom-designed PSI protocols (§6, p. 10).","significance_at_publication":"It is the paper's demonstration that generic PSI protocols can be combined with further computation at little cost, the modularity argument for generic protocols in the introduction and conclusion (§1, pp. 1-2; §6, p. 10; §8, p. 14).","technical_delta":"Auditing logic is appended to the garbled circuit: for the sort-compare-shuffle family, a Counter circuit that lazily widens its state sums the MUX selection signals of the duplicate-selection circuits, and a comparison circuit tests the threshold; for the bit-vector protocol, a Counter sums the outputs of the AND gates (§6, pp. 10-11)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2012-HEK-SIZE-AUDITING","keywords":["auditing","intersection-size","counter-circuit","garbled-circuits","composability"],"limitations":["the paper calls the implementations prototypes and an initial study (§6, p. 10)","no security argument specific to the audited circuits is given (§2, p. 4)","the released condition is an upper bound on the intersection size (§6, p. 10), so it should not be read as threshold PSI in the sense of releasing the intersection only when it is large"],"paper_id":"PSI-PAPER-2012-HEK","qualifiers":["the policy studied is an upper bound on the intersection size; above it no output is revealed except that the bound was exceeded (§6, p. 10)","semi-honest parties, as for all protocols of the paper (§1.1, p. 2)","when the threshold is known for an application the Counter can be made smaller (§6, p. 11)"],"source_locator":{"dossier_section":"PSI-PAPER-2012-HEK § Contributions","primary_source":"§1.1 (p. 2); §3 (pp. 4-5); §6 (pp. 10-11); §7.1 (p. 11). NDSS 2012 PDF dated 2011-11-28.","primary_source_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","status":"section_checked"},"statement":"Because the PSI protocols are pure garbled circuits, the circuit can obliviously count the intersection size \\( \\hat{n} \\) and compare it with a threshold, revealing nothing but that fact when \\( \\hat{n} \\) exceeds it; in the sort-compare-shuffle protocols a Counter circuit of \\( n \\log n - n \\) non-free gates sums the duplicate-selection signals with no measurable overhead in the authors' experiments, while in the bit-vector protocol the count uses \\( \\sigma \\cdot 2^{\\sigma} \\) non-free gates instead of \\( 2^{\\sigma} \\) and raised the running time for \\( \\sigma = 16 \\) from 2.48 s to 12.22 s.","statement_status":"source_normalized_statement","status":"published","title":"Size-based auditing inside garbled-circuit PSI: the intersection is withheld when its size exceeds a threshold","work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"Size-based auditing","heading":"Overview"},{"content":"The auditing circuit computes \\( \\hat{n} \\) obliviously, which is the main cost, and compares it with a threshold, which is negligible (§6, p. 10). In the sort-compare-shuffle protocols the Counter takes as inputs the selection signals of the MUX circuits inside DupSelect-2 and DupSelect-3 (§6, p. 11; Figure 5, p. 8). The authors measured no performance overhead for those protocols and a roughly fivefold slowdown for the bit-vector protocol at \\( 12 \\le \\sigma \\le 16 \\), because its garbled-circuit part is only 35 to 45% of its running time (§6, p. 11).","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-YAO: the audit is added to the Boolean circuit evaluated with Yao's protocol (§6, p. 10).","heading":"Related records in other topics"}],"slug":"hek12-size-based-auditing-inside","status":"published","subtitle":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","summary":"Because the PSI protocols are pure garbled circuits, the circuit can obliviously count the intersection size \\( \\hat{n} \\) and compare it with a threshold, revealing nothing but that fact when \\( \\hat{n} \\) exceeds it; in the sort-compare-shuffle protocols a Counter circuit of \\( n \\log n - n \\) non-free gates sums the duplicate-selection signals with no measurable overhead in the authors' experiments, while in the bit-vector protocol the count uses \\( \\sigma \\cdot 2^{\\sigma} \\) non-free gates instead of \\( 2^{\\sigma} \\) and raised the running time for \\( \\sigma = 16 \\) from 2.48 s to 12.22 s.","tableRows":["PSI-CONSTRUCTION-2012-HEK-BWA"],"title":"Size-based auditing inside garbled-circuit PSI: the intersection is withheld when its size exceeds a threshold","type":"result","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2012-HEK-SIZE-AUDITING"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","keywords":["atomic-result","sort-compare-shuffle","bitonic-merger","duplicate-selection","waksman-network","garbled-circuits","yao","free-xor","garbled-row-reduction"],"metadata":{"claim_slug":"sort-compare-shuffle","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["garbled_circuits","ot_extension","sorting_network"]},"historical_context":{"narrative":"Before 2012 nearly every semi-honest PSI protocol was a custom design from public-key techniques, and generic secure computation was dismissed, in part because comparing all pairs of elements seemed to force a quadratic circuit. Huang, Evans, and Katz observed that each party may sort its own set before the computation starts. The garbled circuit then only has to merge two sorted lists, which a bitonic merger does with \\( n \\log 2n \\) small sorters, keep any element equal to a neighbour, and finally permute the surviving values, because their sorted positions would reveal information about elements outside the intersection. A Waksman network programmed by the circuit generator performs that permutation cheaply. The resulting quasi-linear circuit ran on million-element sets on ordinary desktops and became the generic baseline for computing PSI with secure computation.","prior_boundary":"The custom semi-honest PSI protocols of the time used public-key techniques, and the most efficient was the De Cristofaro-Tsudik protocol, secure under one-more-DL or one-more-RSA in the random oracle model (§1.3, p. 3; §2, p. 3). Generic protocols were held impractical, partly from the belief that a circuit for the intersection of two \\( n \\)-sets needs \\( \\Theta(n^{2}) \\) size (§1, p. 1); the generic weighted-PSI circuit of Jónsson et al. had \\( \\Theta(n \\log^{2} n) \\) gates and required an honest majority (§1.3, p. 3).","significance_at_publication":"The SCS-WN variant computed the intersection of two sets of \\( 2^{20} \\) 32-bit elements in about six hours with 1.7 billion non-free gates (§7.2, p. 12), was faster than every other variant of the paper for 128 to 8192 elements (Figure 10, p. 13), and is the protocol the paper compares with the De Cristofaro-Tsudik protocol (§7.3, p. 12).","technical_delta":"Each party sorts its set locally, so the circuit only merges two sorted lists with a bitonic merger built from 2-Sorters of \\( 2\\sigma \\) non-free gates (§5.1, pp. 6-7; Figures 2-4), filters matches with DupSelect-3 using that three consecutive sorted elements contain at most one match (§5.2, p. 7; Figure 5), and shuffles with a Waksman network whose swapper gates the generator programs, each garbled as a single ciphertext with garbled-row reduction (§5.3.3, pp. 9-10; Algorithm 2). The total is \\( 2\\sigma n \\log(2n) + ((3n - 1)\\sigma - n) + \\sigma(n \\log n - n + 1)/3 \\) gates (Table 1, p. 2)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","keywords":["sort-compare-shuffle","bitonic-merger","duplicate-selection","waksman-network","garbled-circuits","yao","free-xor","garbled-row-reduction"],"limitations":["no security against malicious parties is claimed; stronger threat models are left to future work (§1.1, p. 2)","the \\( \\Theta(n \\log n) \\) count is in non-free gates with free XOR; the Waksman stage is counted as \\( \\sigma(n \\log n - n + 1)/3 \\) gate equivalents because each programmed swapper gate costs one ciphertext (Table 1, p. 2; §5.3.3, p. 9)","the gate counts and timings concern the plain intersection, not a function of it (§2, p. 3)"],"paper_id":"PSI-PAPER-2012-HEK","qualifiers":["semi-honest parties; security follows from Yao's protocol in the semi-honest model, with oblivious transfer from decisional Diffie-Hellman in the random oracle model; no proof is given (§1.2, p. 2; §2, p. 4)","both sets have the same known size \\( n \\), contain no duplicates, and use \\( \\sigma \\)-bit elements; padding handles other cases (§2, p. 3)","\\( 0^{\\sigma} \\) must not be a valid element, since DupSelect outputs it for non-matches (§5.2, p. 7)","the circuit generator chooses the random permutation and configures the Waksman network locally (§5.3.3, pp. 9-10)","either or both parties may receive the intersection (§2, p. 3)"],"source_locator":{"dossier_section":"PSI-PAPER-2012-HEK § Contributions","primary_source":"Table 1 (p. 2); §1.2 (pp. 2-3); §5 and Figure 1 (pp. 5-6); §5.1 and Figures 2-4 (pp. 6-7); §5.2 and Figure 5 (pp. 7-8); §5.3 (pp. 8-10); §5.3.3, Figure 7, and Algorithms 2-3 (pp. 9-10); §7.2 (p. 12). NDSS 2012 PDF dated 2011-11-28.","primary_source_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","status":"section_checked"},"statement":"Against semi-honest parties holding \\( n \\) elements of \\( \\sigma \\) bits each, the intersection can be computed by evaluating with Yao's garbled-circuit protocol a circuit that merges the two locally sorted sets with a bitonic merger of \\( 2\\sigma n \\log(2n) \\) non-free gates, keeps each element that equals a neighbour with DupSelect-3 circuits of \\( (3n - 1)\\sigma - n \\) non-free gates in total, and destroys positional information with a Waksman switching network whose control bits the circuit generator sets from a random permutation; the circuit has \\( \\Theta(n \\log n) \\) non-free gates, whereas pairwise comparison needs \\( \\Theta(n^{2}) \\).","statement_status":"source_normalized_statement","status":"published","title":"Sort-compare-shuffle garbled circuit for two-party PSI with \\( \\Theta(n \\log n) \\) non-free gates, semi-honest","work_id":"PSI-PAPER-2012-HEK","year":2012},"primaryUrl":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","sections":[{"content":"Sort-compare-shuffle circuit","heading":"Overview"},{"content":"The circuit has three stages (Figure 1, p. 6). Sorting: the two locally sorted lists form a bitonic sequence, and a bitonic merger of \\( n \\log(2n) \\) 2-Sorters sorts their union; each 2-Sorter is a comparison plus a conditional swap with \\( 2\\sigma \\) non-free gates (§5.1, pp. 6-7). Filtering: DupSelect-3 outputs the middle of three consecutive elements if it equals a neighbour and \\( 0^{\\sigma} \\) otherwise, which leaves \\( n \\) outputs instead of \\( 2n - 1 \\) (§5.2, p. 7). Shuffling: the \\( n \\) outputs are permuted before they are revealed, because their positions leak information (§5.3, p. 8). Of the three shuffles studied, the Waksman network (SCS-WN) costs about 15% of the sorting stage (§5.3.3, p. 10), sorting the outputs again (SCS-SORT) is less efficient (§5.3.1, p. 8), and a homomorphic-encryption shuffle (SCS-HE) is linear in \\( n \\), \\( O(n) \\), but slower in practice (§5.3.2, p. 9).","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-YAO and MPC-COMP-ENC-GARBLED: the circuit is evaluated with Yao's garbled-circuit protocol, which the paper cites as its reference [39] (§1.2, p. 2; §2, pp. 3-4). MPC-CONTRIB-2008-FREEXOR: XOR gates are free and not counted (§1.2, p. 3; §2, p. 4). MPC-CONTRIB-2009-PRACTICAL2PC: garbled-row reduction to three ciphertexts per gate, and to one for the programmed swapper gates (§2, p. 4; §5.3.3, p. 9). MPC-CONTRIB-2003-IKNP-OTEXT: input-wire labels are transferred with OT extension on top of Naor-Pinkas OT (§2, p. 4).","heading":"Related records in other topics"}],"slug":"hek12-sort-compare-shuffle-psi","status":"published","subtitle":"Private Set Intersection: Are Garbled Circuits Better than Custom Protocols?","summary":"Against semi-honest parties holding \\( n \\) elements of \\( \\sigma \\) bits each, the intersection can be computed by evaluating with Yao's garbled-circuit protocol a circuit that merges the two locally sorted sets with a bitonic merger of \\( 2\\sigma n \\log(2n) \\) non-free gates, keeps each element that equals a neighbour with DupSelect-3 circuits of \\( (3n - 1)\\sigma - n \\) non-free gates in total, and destroys positional information with a Waksman switching network whose control bits the circuit generator sets from a random permutation; the circuit has \\( \\Theta(n \\log n) \\) non-free gates, whereas pairwise comparison needs \\( \\Theta(n^{2}) \\).","tableRows":["PSI-CONSTRUCTION-2012-HEK-SCS-HE","PSI-CONSTRUCTION-2012-HEK-SCS-SORT","PSI-CONSTRUCTION-2012-HEK-SCS-WN"],"title":"Sort-compare-shuffle garbled circuit for two-party PSI with \\( \\Theta(n \\log n) \\) non-free gates, semi-honest","type":"result","venue":"NDSS 2012","year":2012,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","keywords":["atomic-result","bark-oprf","batched-oprf","related-key-oprf","pseudorandom-code","ot-extension","kolesnikov-kumaresan","iknp"],"metadata":{"claim_slug":"batched-oprf","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"parties":["two_party"],"security_model":["standard_model"],"technique":["batched_oprf","ot_extension"]},"historical_context":{"narrative":"Oblivious transfer extension had made large batches of 1-out-of-2 transfers cheap, and Kolesnikov and Kumaresan had read its matrix as a repetition code that a better code could replace, reaching transfers with up to about 256 choices. Oblivious PRFs, by contrast, were still built from algebraic PRFs, and the OPRF hidden inside the PSI protocol of Pinkas, Schneider, Segev, and Zohner, which this paper calls the fastest at the time, spent one random OT on every byte of an item. Kolesnikov, Kumaresan, Rosulek, and Trieu observed that the code is never decoded and needs only large pairwise distance with overwhelming probability, so a pseudorandom code suffices. Each row of the extension matrix then gives an OPRF evaluation on an arbitrary string, with keys related across the batch, and item length drops out of the cost.","prior_boundary":"IKNP OT extension produced many 1-out-of-2 OTs from \\( \\kappa \\) base OTs and symmetric-key work, and the Kolesnikov-Kumaresan coding view of IKNP gave 1-out-of-many OT, with up to about 256 choices per matrix row (§1, p. 2; §1.1, p. 3). Earlier OPRF protocols evaluated algebraic PRFs with exponentiations (§1.1, p. 3), and the OPRF implicit in the PSI protocol of Pinkas, Schneider, Segev, and Zohner used one 1-out-of-256 random OT per byte of the effective item length (§5.1, pp. 10-11; §5.3, p. 12).","significance_at_publication":"The OT cost of one OPRF instance became 424-448 bits for the parameters considered, independent of item length (§5.3, p. 12; Table 2, p. 15). The authors use this to replace the OPRF inside the PSI protocol that their abstract calls the fastest at the time, which is the source of their PSI speedup for long items (abstract, p. 1; §5.1, p. 11).","technical_delta":"The error-correcting code of the Kolesnikov-Kumaresan framework is replaced by a pseudorandom code of minimum distance \\( \\kappa \\) that is never decoded (§2, p. 5; Definition 2, p. 7), so one row of a width-k OT-extension matrix yields one OPRF instance on arbitrary strings. The m instances share the code and the sender's secret, so their keys are related and the receiver learns a relaxed output (Definition 4 and Lemma 5, p. 8); the protocol realizes this functionality against semi-honest adversaries (Theorem 6, p. 9; Figure 2, p. 10) at about the cost of \\( 3.5m \\) 1-out-of-2 OTs (abstract, p. 1)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","keywords":["bark-oprf","batched-oprf","related-key-oprf","pseudorandom-code","ot-extension","kolesnikov-kumaresan","iknp"],"limitations":["no security against malicious parties is claimed (§1.1, p. 3)","the related-key batch is not a standard OPRF; §5.2 (p. 11) argues that it suffices for the PSI protocol of Figure 3","the matrix width k is 424-448 bits for the parameters of Table 2 (p. 15), against \\( \\kappa = 128 \\) for IKNP, so communication grows with \\( km \\) rather than \\( \\kappa m \\) (footnote 1, p. 6)"],"paper_id":"PSI-PAPER-2016-KKRT","qualifiers":["semi-honest sender and receiver (Theorem 6, p. 9)","related keys: every instance shares the pseudorandom code C and the sender's secret s (§3.3, pp. 7-8)","the receiver learns a relaxed output, the row of the extension matrix, rather than only the PRF value (§3.3, p. 8)","one receiver input per instance (§1, p. 2)","proved with an ideal functionality for the k base OTs (Figure 2, p. 10)","assumes a \\( \\kappa \\)-Hamming correlation-robust hash H and a pseudorandom code C; the implementation derives C from AES used as a PRF (Lemma 3, p. 7; §6.3, p. 16)"],"source_locator":{"dossier_section":"PSI-PAPER-2016-KKRT § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 3); §2 (pp. 4-6); Definitions 1-2 and Lemma 3 (pp. 6-7); Definition 4 and Lemma 5 (p. 8); Figure 1 and Theorem 6 (p. 9); Figure 2 (p. 10); §5.1 and §5.3 (pp. 10-12); Table 2 (p. 15). IACR ePrint 2016/799, PDF dated 2016-08-20.","primary_source_url":"https://eprint.iacr.org/2016/799","status":"theorem_checked"},"statement":"Against semi-honest adversaries, the BaRK-OPRF protocol produces a batch of m oblivious PRF instances with related keys, each of which the receiver evaluates on one input from \\( \\{0,1\\}^* \\), using k base OTs and symmetric-key operations; it replaces the error-correcting code of Kolesnikov-Kumaresan OT extension with a pseudorandom code of minimum distance \\( \\kappa \\), and m instances cost roughly as much as \\( 3.5m \\) 1-out-of-2 OTs.","statement_status":"source_normalized_statement","status":"published","title":"Batched related-key OPRF from OT extension, with per-instance cost independent of input length","work_id":"PSI-PAPER-2016-KKRT","year":2016},"primaryUrl":"https://eprint.iacr.org/2016/799","sections":[{"content":"BaRK-OPRF","heading":"Overview"},{"content":"The sender picks a pseudorandom code C and a random k-bit string s. For each of m instances the receiver secret-shares the codeword \\( C(r_j) \\) of its input \\( r_j \\) across two matrices, and the parties run k base OTs with their roles reversed, so that the sender obtains the row \\( q_j = t_j \\oplus (C(r_j) \\wedge s) \\) (Figure 2, p. 10). The sender can then evaluate \\( H(j, q_j \\oplus (C(r) \\wedge s)) \\) on any string r, while the receiver learns only the value for its own \\( r_j \\). Recovering another value requires guessing at least \\( \\kappa \\) bits of s, because two codewords differ in at least \\( \\kappa \\) positions with overwhelming probability (§2, pp. 4-5).","heading":"Exact contribution"},{"content":"MPC-CONTRIB-2003-IKNP-OTEXT: IKNP OT extension. BaRK-OPRF starts from the IKNP paradigm (§2, p. 4), and the implementation uses IKNP to extend 128 Naor-Pinkas base OTs to the k base OTs it needs (footnote 1, p. 6; §6.3, p. 16). The Kolesnikov-Kumaresan 1-out-of-N OT extension, the direct predecessor, has no record in any topic yet.","heading":"Related records in other topics"}],"slug":"kkrt16-batched-related-key-oprf","status":"published","subtitle":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","summary":"Against semi-honest adversaries, the BaRK-OPRF protocol produces a batch of m oblivious PRF instances with related keys, each of which the receiver evaluates on one input from \\( \\{0,1\\}^* \\), using k base OTs and symmetric-key operations; it replaces the error-correcting code of Kolesnikov-Kumaresan OT extension with a pseudorandom code of minimum distance \\( \\kappa \\), and m instances cost roughly as much as \\( 3.5m \\) 1-out-of-2 OTs.","tableRows":["PSI-CONSTRUCTION-2016-KKRT","PSI-CONSTRUCTION-2017-KMPRT-AUG","PSI-CONSTRUCTION-2017-KMPRT-SH","PSI-CONSTRUCTION-2020-ION-ROT"],"title":"Batched related-key OPRF from OT extension, with per-instance cost independent of input length","type":"result","venue":"ACM CCS 2016","year":2016,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2016-KKRT-BATCHED-OPRF"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","keywords":["atomic-result","bark-oprf-psi","cuckoo-hashing","hash-index","pssz","item-length","ot-extension","semi-honest"],"metadata":{"claim_slug":"item-length-independent-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["standard_model"],"set_size_regime":["balanced"],"technique":["batched_oprf","ot_extension","cuckoo_hashing"]},"historical_context":{"narrative":"The fastest semi-honest PSI protocol of 2015, from Pinkas, Schneider, Segev, and Zohner, hashed items into bins and ran an oblivious PRF in each bin, but that PRF consumed one oblivious transfer per byte of an item, so long identifiers made the protocol slower. Kolesnikov, Kumaresan, Rosulek, and Trieu kept the hashing structure and swapped in their batched OPRF, whose cost per bin is one fixed-width row of the extension matrix. They also fixed a subtle leak: when two cuckoo hash functions sent an item to the same bin, duplicated values revealed it, so they tag each bin input with its hash index. The result runs in the same time for 32-, 64-, and 128-bit items and was three to four times faster than its predecessor on long items.","prior_boundary":"In the PSSZ protocol, which the paper calls the fastest PSI protocol at the time, each bin's OPRF uses one 1-out-of-256 random OT per byte of the effective item length \\( \\sigma^* = \\sigma - \\log n \\), an OT cost of \\( 32\\sigma^* \\) bits (abstract, p. 1; §5.1, pp. 10-11; §5.3, p. 12). Its protocol and implementation do not account for collisions among the cuckoo hash functions, which leak through duplicate PRF values (§5.2, p. 12, footnote 3).","significance_at_publication":"Communication is lower than PSSZ whenever \\( \\sigma^* > 14 \\), which covers every reported PSSZ configuration except \\( n \\ge 2^{20} \\) with 32-bit items (§5.3, p. 13); PSI of \\( 2^{20} \\) items takes 3.8 s regardless of item length, and \\( 2^{24} \\) 128-bit items take about one minute against 214 s for PSSZ (abstract, p. 1; §1, p. 2; Table 3, p. 15).","technical_delta":"Each bin consumes one BaRK-OPRF instance, one row of a k-bit-wide OT-extension matrix with \\( k = 424\\text{--}448 \\), so the OT cost no longer depends on the item length (§5.3, p. 12; Table 1, p. 14). Appending the hash index z to each bin input makes Alice's PRF calls distinct and lets Bob search a single set \\( H_z \\) or \\( S_j \\) of \\( n \\) values (§5.2, pp. 11-12; Figure 3, p. 13)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","keywords":["bark-oprf-psi","cuckoo-hashing","hash-index","pssz","item-length","ot-extension","semi-honest"],"limitations":["for short items PSSZ can be faster: its OT cost is lower when the effective item length \\( \\sigma^* = \\sigma - \\log n \\) is below 14, as for 32-bit items with \\( n \\ge 2^{20} \\) (§5.3, p. 13; Table 1, p. 14; §6.2, pp. 16-17)","no security against malicious parties is claimed (§1.1, p. 3)","communication grows with the code width k of 424-448 bits per bin rather than with \\( \\kappa = 128 \\) (Table 1, p. 14; Table 5, p. 15)"],"paper_id":"PSI-PAPER-2016-KKRT","qualifiers":["semi-honest Alice and Bob; PSI security is argued in prose from the RK-PRF security of BaRK-OPRF, Definition 4 (§5.2, p. 11)","both parties learn the intersection: Bob sends it to Alice (Figure 3, step 6, p. 13)","described for equal set sizes \\( |X| = |Y| = n \\) (§5.2, p. 11; Figure 3, p. 13)","stash sizes are taken from PSSZ for a hashing failure probability of \\( 2^{-40} \\) (§6.1, p. 14)","PRF outputs of \\( \\lambda + \\log_2(n^2) \\) bits bound spurious collisions by \\( 2^{-\\lambda} \\) (§5.2, p. 12)","the hash-index optimization reduces running time by about 10% in the implementation (§5.2, p. 11)"],"source_locator":{"dossier_section":"PSI-PAPER-2016-KKRT § Contributions","primary_source":"Abstract (p. 1); §1 (p. 2); §1.1 (p. 3); §5 intro and §5.1 (pp. 10-11); §5.2 including 'An Optimization' and footnote 3 (pp. 11-12); §5.3 and 'Remark on pre-hashing long PSI inputs' (pp. 12-13); Figure 3 (p. 13); Table 1 (p. 14); §6.1 and Table 2 (pp. 14-15); Tables 3-5 (p. 15); §6.2-6.3 (pp. 16-17). IACR ePrint 2016/799, PDF dated 2016-08-20.","primary_source_url":"https://eprint.iacr.org/2016/799","status":"section_checked"},"statement":"Replacing the OPRF implicit in the PSSZ protocol, which spends one 1-out-of-256 random OT per byte of the effective item length, with BaRK-OPRF gives a semi-honest PSI protocol whose OT-extension cost is 424-448 bits per bin for \\( n = 2^{8} \\) to \\( 2^{24} \\), independent of item length. Bob cuckoo-hashes his items into \\( 1.2n \\) bins with three hash functions and a stash and appends the hash index to each bin input, so that Alice evaluates the PRF only on distinct key-input pairs and Bob searches one set of \\( n \\) values per item. Communication is \\( k(1.2n + s) + (3 + s)nv \\) bits excluding base OTs, and the authors report PSI 3.1-3.6 times faster than PSSZ for 128-bit items and sufficiently large sets.","statement_status":"source_normalized_statement","status":"published","title":"Semi-honest two-party PSI with OT-extension cost per bin independent of item length, from BaRK-OPRF in the cuckoo-hashing paradigm of Pinkas, Schneider, Segev, and Zohner","work_id":"PSI-PAPER-2016-KKRT","year":2016},"primaryUrl":"https://eprint.iacr.org/2016/799","sections":[{"content":"BaRK-OPRF PSI","heading":"Overview"},{"content":"Bob places his items in \\( 1.2n \\) bins by three-way cuckoo hashing with a stash of size \\( s \\) and uses \\( y \\| z(y) \\) as the OPRF input of the bin holding y (or y itself in the stash); the parties run \\( 1.2n + s \\) BaRK-OPRF instances with Bob as receiver; Alice sends permutations of \\( H_i = \\{F(k_{h_i(x)}, x \\| i)\\} \\) for \\( i = 1, 2, 3 \\) and \\( S_j = \\{F(k_{1.2n+j}, x)\\} \\) for each stash position; Bob outputs his items whose PRF value lies in the one set that corresponds to its hash index or stash position (Figure 3, p. 13). The paper notes that hashing long items to \\( \\lambda + \\log n \\) bits before PSI cannot remove its advantage, since effective item lengths stay above 14 bits for \\( \\lambda \\ge 40 \\) (§5.3, p. 13).","heading":"Exact contribution"},{"content":"MPC-CONTRIB-2003-IKNP-OTEXT: the implementation obtains the k base OTs of BaRK-OPRF by extending 128 Naor-Pinkas OTs with IKNP (§6.3, p. 16).","heading":"Related records in other topics"}],"slug":"kkrt16-semi-honest-two-party","status":"published","subtitle":"Efficient Batched Oblivious PRF with Applications to Private Set Intersection","summary":"Replacing the OPRF implicit in the PSSZ protocol, which spends one 1-out-of-256 random OT per byte of the effective item length, with BaRK-OPRF gives a semi-honest PSI protocol whose OT-extension cost is 424-448 bits per bin for \\( n = 2^{8} \\) to \\( 2^{24} \\), independent of item length. Bob cuckoo-hashes his items into \\( 1.2n \\) bins with three hash functions and a stash and appends the hash index to each bin input, so that Alice evaluates the PRF only on distinct key-input pairs and Bob searches one set of \\( n \\) values per item. Communication is \\( k(1.2n + s) + (3 + s)nv \\) bits excluding base OTs, and the authors report PSI 3.1-3.6 times faster than PSSZ for 128-bit items and sufficiently large sets.","tableRows":["PSI-CONSTRUCTION-2016-KKRT"],"title":"Semi-honest two-party PSI with OT-extension cost per bin independent of item length, from BaRK-OPRF in the cuckoo-hashing paradigm of Pinkas, Schneider, Segev, and Zohner","type":"result","venue":"ACM CCS 2016","year":2016,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","keywords":["atomic-result","unbalanced-psi","fully-homomorphic-encryption","fv","simd-batching","cuckoo-hashing","permutation-based-hashing","windowing","partitioning","modulus-switching","noise-flooding"],"metadata":{"claim_slug":"fhe-sublinear-communication","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["standard_model"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption","cuckoo_hashing","permutation_based_hashing"]},"historical_context":{"narrative":"In 2017 the fastest PSI protocols, built from oblivious transfer and hashing, made both parties send encodings of their entire sets, so a phone checking a few thousand contacts against a service with millions of users paid for the size of the service's set. Encrypting the small set under fully homomorphic encryption and letting the server compute on it was an obvious idea, but the depth of the intersection circuit made it impractical. Chen, Laine, and Rindal made it practical by combining SIMD batching with cuckoo and permutation-based hashing, sending extra encrypted powers to flatten the circuit, splitting the server's bins, and shrinking replies by modulus switching. Communication fell to the small set times a logarithm of the large one, and nearly all computation moved to the server, at the price of semi-honest security and 32-bit items.","prior_boundary":"The most efficient PSI protocols at the time, the OT-based protocols of Pinkas et al. and Kolesnikov et al., have communication linear in both set sizes, \\( O(n_X + n_Y) \\) (§1.1, p. 1; §1.3, p. 2), and the paper states that all prior PSI protocols send data proportional to both entire sets, whereas the insecure solution sends only the smaller set (§1.4, p. 3). A naive FHE solution would send only twice the ciphertext expansion times the smaller set, but its computation grows with the size and depth of the intersection circuit (§1.2, pp. 1-2); the concurrent online/offline protocol of Kiss et al. still needs communication or storage linear in the larger set, \\( O(n_X) \\) (§1.3, p. 2).","significance_at_publication":"For 5535 receiver items against \\( 2^{24} \\) sender items of 32 bits, the paper reports 11.0 to 20.1 MB of total communication depending on parameters, against 480.4 MB for the protocol of Pinkas et al. and 962.1 MB computed from the formula of Kolesnikov et al. (Table 5, p. 16), and 1.7 s of receiver computation in one setting (§6.2, p. 16). The authors present private contact discovery from a phone as the motivating application (§2.2, p. 4) and describe the work as a first step in applying FHE to PSI (§7, p. 17).","technical_delta":"The receiver encrypts its permutation-based cuckoo hash table with SIMD batching, and the sender evaluates per bin the polynomial \\( r\\prod(y - x) \\) from its simple-hashed bins, using encrypted powers of y supplied by the receiver (windowing) and splitting its bins into \\( \\alpha \\) partitions, then switches the reply ciphertexts to a smaller modulus (§4, pp. 6-10; Figure 4, p. 12). Communication becomes \\( O(n_Y \\log n_X) \\), only the sender performs work linear in \\( n_X \\) (p. 4), and the protocol is proved secure against semi-honest parties assuming an IND-CPA FHE scheme with circuit privacy (Theorem 2, p. 11)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","keywords":["unbalanced-psi","fully-homomorphic-encryption","fv","simd-batching","cuckoo-hashing","permutation-based-hashing","windowing","partitioning","modulus-switching","noise-flooding"],"limitations":["no security against malicious parties is claimed: a malicious sender can steer the receiver's output, for example to the receiver's full set, and a malicious receiver could add noise to its ciphertexts so that noise flooding no longer hides the sender's set (§5.2, pp. 12-13)","the implementation restricts items to 32 bits; arbitrary lengths are possible in principle but need much larger FHE parameters (§4.2, p. 9; §6.1, p. 14)","communication is lower than that of the protocol of Pinkas et al. only when the sender's set exceeds about \\( 2^{16} \\) items, and in a single-threaded LAN run with \\( n_X = 2^{20} \\) and \\( n_Y \\le 5535 \\) that protocol is faster (3.1 s against 8.6 s) (§6.2, p. 15; Table 5, p. 16)","simulation-based security requires fresh hash functions in each execution; reusing the sender's pre-processing is safe only against adversaries that do not force hashing failures (§6.1, p. 14)"],"paper_id":"PSI-PAPER-2017-CLR","qualifiers":["semi-honest sender and receiver (§2.2, p. 3; Theorem 2, p. 11)","one-sided output: the receiver learns \\( X \\cap Y \\) and the sender learns nothing (Figure 3, p. 11)","the set sizes \\( n_X \\) and \\( n_Y \\) and the item length \\( \\sigma \\) are public (§2.2, p. 3)","security assumes an IND-CPA FHE scheme with circuit privacy; with leveled parameters the sender obtains statistical function privacy by adding encryptions of zero with large noise (noise flooding) (Theorem 2, p. 11; §5.2, p. 11)","the proof of Theorem 2 uses no random oracle; the hash functions are sampled at random and treated as public parameters (p. 11)","correctness holds when hashing succeeds, which happens with probability \\( 1 - 2^{-\\lambda} \\); cuckoo hashing uses three hash functions and no stash, and its failure probability was estimated empirically (§4.2, pp. 7-8; p. 11)","the communication bound assumes the sender holds the larger set; a role-switched variant handles the opposite case with the same asymptotic communication (§2.2, p. 4; §5.2, p. 13)"],"source_locator":{"dossier_section":"PSI-PAPER-2017-CLR § Contributions","primary_source":"Abstract (p. 1); §1.4 (p. 3); §2.2 (pp. 3-4); Figure 1 and Theorem 1 (p. 5); §4.1-4.4 (pp. 6-10); Figure 2 and Table 1 (p. 8); Figure 3 and Theorem 2 (p. 11); §5.2 (pp. 11-13); Figure 4 (p. 12); §6 (pp. 13-17); Tables 3-5 (pp. 14-16). IACR ePrint 2017/299, PDF dated 2017-09-06.","primary_source_url":"https://eprint.iacr.org/2017/299","status":"theorem_checked"},"statement":"Against semi-honest adversaries, a two-party PSI protocol in which the receiver, holding \\( n_Y \\) items, encrypts its cuckoo hash table under a leveled fully homomorphic encryption scheme with SIMD batching, and the sender, holding \\( n_X \\) items in simple-hashed bins, homomorphically evaluates for each bin the product of differences \\( r\\prod(y - x) \\) and returns it, has communication \\( O(n_Y \\log n_X) \\), requires work linear in \\( n_X \\) only from the sender, and gives the intersection to the receiver only; windowing (the receiver also sends encrypted powers of its items) and partitioning of the sender's bins reduce the homomorphic circuit depth to \\( \\lceil \\log_2(\\lfloor \\log_2(B/\\alpha)/w \\rfloor + 1) \\rceil + 1 \\), \\( B \\) the bin size, \\( w \\) the window size, and \\( \\alpha \\) the number of partitions.","statement_status":"source_normalized_statement","status":"published","title":"Communication \\( O(n_Y \\log n_X) \\), linear in the smaller set and logarithmic in the larger set, for semi-honest two-party PSI, from leveled FHE with batching and hashing","work_id":"PSI-PAPER-2017-CLR","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/299","sections":[{"content":"FHE-based PSI with communication logarithmic in the larger set","heading":"Overview"},{"content":"The receiver cuckoo-hashes its items into \\( m \\) bins with three hash functions and no stash, and the sender inserts each of its items into all three candidate bins of a simple hash table with bin size \\( B \\) (Figure 2, p. 8). Permutation-based hashing stores only part of each item, and items longer than \\( 2\\log_2(n_X + n_Y) + \\lambda - 1 \\) bits are first hashed to that length (§4.2, pp. 7-9). The receiver batches its table into \\( m/s \\) plaintexts of the FV scheme, \\( s \\) the number of slots per plaintext, encrypts the powers \\( y^{i \\cdot 2^{wj}} \\) of each slot value, \\( w \\) the window size, and sends them (Figure 4, step 5, p. 12). The sender, holding precomputed coefficients of the polynomial with roots in each partition of each bin, computes encryptions of all needed powers and a plaintext-ciphertext dot product per partition, optionally switches the results to a smaller modulus, and returns \\( \\alpha \\cdot m/s \\) ciphertexts (Figure 4, steps 4 and 6, p. 12). A slot decrypts to zero exactly when the receiver's item lies in the sender's bin (§3, pp. 5-6). Windowing raises the receiver-to-sender communication by a factor \\( (2^{w} - 1)(\\lfloor \\log_2(B)/w \\rfloor + 1) \\) to lower the depth, and partitioning multiplies the reply by \\( \\alpha \\) (§4.3, pp. 9-10). Modulus switching reduces reply ciphertexts to about 15-20% of their size (§4.4, p. 10). The paper gives the concrete communication as about \\( 1.5C\\sigma n_Y \\log_2 n_X \\) bits, with \\( C \\) a small ciphertext-expansion constant (§6.3, p. 17).","heading":"Exact contribution"},{"content":"HE-PAPER-2012-FV and HE-RESULT-2012-FV-RLWE-EXACT-ARITHMETIC-SCHEME-WITH-RELINEARIZATION: the implementation uses SEAL v2.1, which implements the Fan-Vercauteren scheme, and §2.3 names FV as a scheme of the required plaintext and ciphertext form (§2.3, p. 4; §6.1, p. 13). HE-RESULT-2012-SV-SIMD-CIPHERTEXT-SLOT-PACKING-AND-PARALLEL-RECRYPTION: the batching step cites Smart-Vercauteren SIMD operations among its sources (§4.1, p. 6). HE-RESULT-2012-BGV-MODULUS-SWITCHING-NOISE-MANAGEMENT: replies are shrunk by modulus switching, citing Brakerski-Gentry-Vaikuntanathan (§4.4, p. 10). HE-PAPER-2016-DS: the paper notes that circuit privacy can be obtained with the sanitization techniques of Ducas and Stehlé, and uses the weaker statistical function privacy by noise flooding instead (§5.2, p. 11).","heading":"Related records in other topics"}],"slug":"clr17-fhe-based-psi-communication","status":"published","subtitle":"Fast Private Set Intersection from Homomorphic Encryption","summary":"Against semi-honest adversaries, a two-party PSI protocol in which the receiver, holding \\( n_Y \\) items, encrypts its cuckoo hash table under a leveled fully homomorphic encryption scheme with SIMD batching, and the sender, holding \\( n_X \\) items in simple-hashed bins, homomorphically evaluates for each bin the product of differences \\( r\\prod(y - x) \\) and returns it, has communication \\( O(n_Y \\log n_X) \\), requires work linear in \\( n_X \\) only from the sender, and gives the intersection to the receiver only; windowing (the receiver also sends encrypted powers of its items) and partitioning of the sender's bins reduce the homomorphic circuit depth to \\( \\lceil \\log_2(\\lfloor \\log_2(B/\\alpha)/w \\rfloor + 1) \\rceil + 1 \\), \\( B \\) the bin size, \\( w \\) the window size, and \\( \\alpha \\) the number of partitions.","tableRows":["PSI-CONSTRUCTION-2017-CLR","PSI-CONSTRUCTION-2018-CHLR"],"title":"Communication \\( O(n_Y \\log n_X) \\), linear in the smaller set and logarithmic in the larger set, for semi-honest two-party PSI, from leveled FHE with batching and hashing","type":"result","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","keywords":["atomic-result","unconditional-zero-sharing","augmented-semi-honest","prf-seeds","multiparty-psi","opprf"],"metadata":{"claim_slug":"augmented-zero-sharing","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["augmented_semi_honest"],"output":["intersection"],"parties":["multiparty"],"set_size_regime":["balanced"],"technique":["opprf","secret_sharing"]},"historical_context":{"narrative":"In the semi-honest protocol, the step that hands out shares of zero is the expensive one: every pair of parties runs a programmable OPRF so that a share reaches a party only if both hold the item. Kolesnikov, Matania, Pinkas, Rosulek, and Trieu observed that if parties may fix their inputs before the run, as the augmented semi-honest model allows, the shares need not be conditional at all. Pairs exchange short PRF seeds once, and each party derives its share of zero for any item locally, so only the reconstruction with the leader still uses programmable OPRFs. The price is that a corrupt party can compute the share for an item it does not hold, which standard semi-honest security forbids; the gain was a run on million-item sets roughly three times faster.","prior_boundary":"In the semi-honest protocol of the same paper, conditional zero-sharing runs a multi-query OPPRF between every pair of parties and is the most expensive part of the protocol (§5.3, p. 13; §6.1, p. 14), giving per-client communication \\( O(n t_c \\lambda) \\) bits (Table 1, p. 3).","significance_at_publication":"The abstract reports 22 seconds for 5 parties with \\( 2^{20} \\) items each, against 72 seconds for the semi-honest protocol (abstract, p. 1); Table 3 (p. 18) gives 21.93 seconds and 467.66 MB of client communication with the table-based OPPRF on a LAN. The authors argue that in PSI the only useful choice for a coalition is a common input set, so the extra power is relatively harmless (§2.1, p. 4; Appendix A, pp. 23-24).","technical_delta":"The zero-sharing protocol of Figure 9 (p. 14) derives unlimited shares of zero from seeds exchanged in a one-time initialization, and the PSI protocol replaces steps 1-3 of Figure 8 by it, keeping step 4 onward (§6.1, p. 14). Theorem 2 states security in the augmented semi-honest model, defined in §2.1 (p. 4) and Appendix A (pp. 23-24), with a proof sketch (pp. 14-15); the authors explain that a corrupt party can compute the share it would have held for an item it lacks, which rules out standard semi-honest security (§6.1, p. 15)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","keywords":["unconditional-zero-sharing","augmented-semi-honest","prf-seeds","multiparty-psi","opprf"],"limitations":["not secure in the standard semi-honest model; §2.3 of PSI-PAPER-2024-VCE (p. 3) notes that augmented semi-honest security does not imply semi-honest security","unlike the semi-honest protocol, its cost does not decrease with a smaller tolerated coalition, as PSI-PAPER-2021-NTY observes (§1.1.1, p. 1)"],"paper_id":"PSI-PAPER-2017-KMPRT","qualifiers":["augmented semi-honest model: the adversary may change the corrupted parties' inputs once, then runs the protocol honestly (§2.1, p. 4; Definition 3, p. 24)","Theorem 2 is given with a proof sketch that assumes the underlying OPRF protocol is secure (pp. 14-15)","the security argument for the zero-sharing considers a coalition of \\( t_c < \\ell - 1 \\) corrupt parties (§6.1, p. 14); Table 1 (p. 3) lists corruption threshold \\( \\ell - 1 \\) for both variants","the reported 22 seconds uses the table-based OPPRF, which models a hash function as a random oracle (Figure 6, p. 8; §7.1, pp. 17-18)"],"source_locator":{"dossier_section":"PSI-PAPER-2017-KMPRT § Contributions","primary_source":"Abstract (p. 1); Table 1 (p. 3); §2.1 (p. 4); §6.1 with Figure 9, Theorem 2, and proof sketch (pp. 14-15); §7.1 with Table 3 (pp. 17-18); Appendix A with Definition 3 (pp. 23-24). IACR ePrint 2017/799, PDF dated 2017-08-24.","primary_source_url":"https://eprint.iacr.org/2017/799","status":"theorem_checked"},"statement":"In the multiparty PSI protocol with conditional zero-sharing, the pairwise OPPRF phase is replaced by unconditional zero-sharing: each pair of parties exchanges a PRF seed once, and each party derives its share of zero for any index as the XOR of PRF values under its \\( \\ell - 1 \\) seeds. The parties then run only the conditional-reconstruction phase, in which each party programs an OPPRF to the leader. The modified protocol is secure in the augmented semi-honest model, where corrupt parties may change their inputs before running the protocol honestly, and not in the standard semi-honest model; per-client communication becomes \\( O(n \\lambda) \\) bits against \\( O(n t_c \\lambda) \\) for the semi-honest protocol.","statement_status":"source_normalized_statement","status":"published","title":"Augmented semi-honest multiparty PSI with per-client communication \\( O(n \\lambda) \\), by replacing the pairwise OPPRF zero-sharing phase with zero-sharing from pairwise PRF seeds","work_id":"PSI-PAPER-2017-KMPRT","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/799","sections":[{"content":"Augmented semi-honest multiparty PSI","heading":"Overview"},{"content":"Each party \\( P_i \\) picks a random seed \\( r_{i,j} \\) for every \\( j > i \\) and sends it to \\( P_j \\); on index ind, \\( P_i \\) computes \\( S_i(\\mathrm{ind}) \\) as the XOR of \\( F(r_{j,i}, \\mathrm{ind}) \\) over \\( j < i \\) and \\( F(r_{i,j}, \\mathrm{ind}) \\) over \\( j > i \\), so every term appears twice across all parties and the shares XOR to zero (Figure 9, p. 14). Used as the mapping \\( S_i \\) of Figure 8, these shares feed directly into the reconstruction phase with the leader (§6.1, p. 14). Correctness is unchanged: a party without x does not program its OPPRF at x, so the leader receives a random value (§6.1, p. 14). In the proof sketch, a simulator for a coalition that contains the leader submits the leader's set as every corrupt party's input, which is the extra power the augmented model grants (p. 14).","heading":"Exact contribution"}],"slug":"kmprt17-augmented-semi-honest-multip","status":"published","subtitle":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","summary":"In the multiparty PSI protocol with conditional zero-sharing, the pairwise OPPRF phase is replaced by unconditional zero-sharing: each pair of parties exchanges a PRF seed once, and each party derives its share of zero for any index as the XOR of PRF values under its \\( \\ell - 1 \\) seeds. The parties then run only the conditional-reconstruction phase, in which each party programs an OPPRF to the leader. The modified protocol is secure in the augmented semi-honest model, where corrupt parties may change their inputs before running the protocol honestly, and not in the standard semi-honest model; per-client communication becomes \\( O(n \\lambda) \\) bits against \\( O(n t_c \\lambda) \\) for the semi-honest protocol.","tableRows":["PSI-CONSTRUCTION-2017-KMPRT-AUG","PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION"],"title":"Augmented semi-honest multiparty PSI with per-client communication \\( O(n \\lambda) \\), by replacing the pairwise OPPRF zero-sharing phase with zero-sharing from pairwise PRF seeds","type":"result","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2017-KMPRT-OPPRF","keywords":["atomic-result","opprf","programmable-prf","oprf-hint","garbled-bloom-filter","polynomial-interpolation","table-based-opprf","cuckoo-hashing","stash-free-hashing"],"metadata":{"claim_slug":"opprf","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"parties":["two_party"],"security_model":["standard_model","random_oracle_model"],"technique":["opprf","batched_oprf","garbled_bloom_filter","cuckoo_hashing"]},"historical_context":{"narrative":"An oblivious PRF lets a receiver learn PRF values on inputs of its choice while the sender keeps the key, and the batched construction of Kolesnikov, Kumaresan, Rosulek, and Trieu had made such instances cost a few hundred bits each. This paper asked for more: the sender should be able to fix the outputs on chosen inputs, and the receiver should not learn whether its query hit one of them. The authors obtained this with a public hint that corrects the OPRF output on the programmed points, stored as an interpolated polynomial, a garbled Bloom filter, or a small table indexed through a random oracle, and they scaled it to many points and queries by hashing items into bins. A party could now pass a secret value to another party only when both hold the same item.","prior_boundary":"An oblivious PRF gives the sender a key and the receiver PRF values on its chosen inputs (§3.1, p. 4), and the batched OPRF of Kolesnikov, Kumaresan, Rosulek, and Trieu produces many instances from OT extension at roughly 500 bits of communication and a few symmetric-key operations each (§3.1, pp. 4-5). The paper presents programmability, the sender fixing outputs on chosen points without the receiver learning whether its query was programmed, as a new notion (§1.3, p. 3; §3.1, p. 5).","significance_at_publication":"The abstract calls the OPPRF the technical core of the multiparty PSI protocol and suggests it may be of independent interest (abstract, p. 1). In the evaluation the table-based OPPRF gives the fastest PSI and the polynomial hint with separate bins the lowest communication for practical sizes (Table 3, p. 18; §7.1, pp. 17-18).","technical_delta":"The programmable PRF adds a public hint to the syntax, with \\( (n, Q) \\)-security defined by an indistinguishability experiment (§3.1, pp. 5-6), and the OPPRF functionality hands the hint to the receiver (Figure 3, p. 5). The hint masks programmed values with OPRF outputs and is stored as a polynomial (Figure 4, p. 7), a garbled Bloom filter (Figure 5, p. 8), or a random-oracle-indexed table for \\( Q = 1 \\) (Figure 6, p. 8). Bins built with stash-free cuckoo hashing for the receiver and simple hashing for the sender scale it to large \\( n \\) and \\( Q \\) (§4, pp. 9-10; Figure 7, p. 11; Table 2, p. 10)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2017-KMPRT-OPPRF","keywords":["opprf","programmable-prf","oprf-hint","garbled-bloom-filter","polynomial-interpolation","table-based-opprf","cuckoo-hashing","stash-free-hashing"],"limitations":["no security against malicious senders or receivers is claimed (§2.1, p. 4)","no theorem covers the OPPRF constructions or the hashing extension; their security is argued in prose (§§3.2-3.4, pp. 6-9; §4, p. 10)","the polynomial hint combined over all bins grows quadratically in the number of points, \\( O(n^2) \\), and did not finish within an hour at \\( 2^{16} \\) items (Table 3, p. 18)"],"paper_id":"PSI-PAPER-2017-KMPRT","qualifiers":["semi-honest sender and receiver; the OPPRF protocols are given in the OPRF-hybrid model, and simulation of the polynomial protocol is called trivial (§3.2, p. 6)","the table-based construction supports one query (\\( Q = 1 \\)) and models H as a random oracle (Figure 6, p. 8; §3.4, pp. 8-9)","built on the KKRT OPRF, whose instances have related keys and leak slightly more than the PRF value; the paper uses cleaner definitions and says the relaxations can be incorporated (§3.1, p. 5)","the hashing extension programs the same point in several bins and relies on the receiver never querying two bins on the same item (§4, Caveats, p. 10)","hashing parameters, including the stash-free scheme, were determined empirically with failure probability below \\( 2^{-30} \\) or \\( 2^{-40} \\) (§4, p. 9; Table 2, p. 10; Appendix B, pp. 24-25)"],"source_locator":{"dossier_section":"PSI-PAPER-2017-KMPRT § Contributions","primary_source":"Abstract (p. 1); §1.3 (p. 3); §3.1 with Figures 2-3 (pp. 4-6); §3.2 and Figure 4 (pp. 6-7); §3.3 and Figure 5 (pp. 6-8); §3.4 and Figure 6 (pp. 7-9); §4 with Table 2 and Figure 7 (pp. 9-11); Appendix B (pp. 24-25); Table 3 (p. 18). IACR ePrint 2017/799, PDF dated 2017-08-24.","primary_source_url":"https://eprint.iacr.org/2017/799","status":"section_checked"},"statement":"A programmable PRF takes a set of \\( n \\) points at key generation and outputs a key and a public hint; it is \\( (n, Q) \\)-secure if the hint and \\( Q \\) outputs do not reveal which points were programmed when the programmed values are random. The OPPRF functionality gives the sender the key and hint and gives the receiver the hint and the PRF values on its \\( Q \\) queries. From an OPRF, three semi-honest OPPRFs are built: an interpolated polynomial hint of \\( n \\) values with \\( O(n^2) \\) interpolation, a garbled Bloom filter hint of about \\( 60n \\) entries with \\( O(n) \\) insertion, and, for a single query, a table of at most \\( 2n \\) entries indexed through a random oracle. Receiver-side cuckoo hashing and sender-side simple hashing extend single-query OPPRFs to many points and queries with one single-query instance per bin.","statement_status":"source_normalized_statement","status":"published","title":"Oblivious programmable PRF: sender-programmed OPRF outputs that the receiver cannot tell apart from unprogrammed ones, from an OPRF plus a hint, semi-honest","work_id":"PSI-PAPER-2017-KMPRT","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/799","sections":[{"content":"Oblivious programmable PRF","heading":"Overview"},{"content":"For a programmable PRF built from a PRF F, the sender masks each programmed value \\( y_i \\) with \\( F(k, x_i) \\) and publishes the masked points in a structure that the receiver can evaluate anywhere: the coefficients of an interpolated polynomial \\( P \\), so that the output on a query z is \\( F(k, z) \\oplus P(z) \\) (§3.2, p. 6); a garbled Bloom filter (§3.3, pp. 6-7); or, for one query, a table T of size the next power of two above \\( n \\) together with a nonce v chosen so that the positions \\( H(F(k, x_i) \\| v) \\) are distinct (§3.4, pp. 7-9). When the \\( y_i \\) are random the hint is uniform, so it hides which points were programmed (§§3.2-3.4). To handle many queries the receiver cuckoo-hashes its items into bins with three primary and two supplementary hash functions and no stash, the sender maps every item under all five functions, and the parties run one single-query OPPRF per bin (§4, pp. 9-10; Figure 7, p. 11). The polynomial and garbled Bloom filter constructions use no random oracle in their description; the table construction models H as a random oracle (Figure 6, p. 8).","heading":"Exact contribution"},{"content":"MPC-COMP-CORR-OTEXT: the OPPRF constructions are instantiated with the KKRT OPRF, which the paper describes as based on OT extension with a constant number of base-OT public-key operations (§3.1, p. 4).","heading":"Related records in other topics"}],"slug":"kmprt17-oblivious-programmable-prf","status":"published","subtitle":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","summary":"A programmable PRF takes a set of \\( n \\) points at key generation and outputs a key and a public hint; it is \\( (n, Q) \\)-secure if the hint and \\( Q \\) outputs do not reveal which points were programmed when the programmed values are random. The OPPRF functionality gives the sender the key and hint and gives the receiver the hint and the PRF values on its \\( Q \\) queries. From an OPRF, three semi-honest OPPRFs are built: an interpolated polynomial hint of \\( n \\) values with \\( O(n^2) \\) interpolation, a garbled Bloom filter hint of about \\( 60n \\) entries with \\( O(n) \\) insertion, and, for a single query, a table of at most \\( 2n \\) entries indexed through a random oracle. Receiver-side cuckoo hashing and sender-side simple hashing extend single-query OPPRFs to many points and queries with one single-query instance per bin.","tableRows":["PSI-CONSTRUCTION-2017-KMPRT-3PARTY","PSI-CONSTRUCTION-2017-KMPRT-AUG","PSI-CONSTRUCTION-2017-KMPRT-SH"],"title":"Oblivious programmable PRF: sender-programmed OPRF outputs that the receiver cannot tell apart from unprogrammed ones, from an OPRF plus a hint, semi-honest","type":"result","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2017-KMPRT-OPPRF"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","keywords":["atomic-result","multiparty-psi","conditional-zero-sharing","conditional-reconstruction","opprf","dishonest-majority","semi-honest","leader"],"metadata":{"claim_slug":"symmetric-key-mpsi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["multiparty"],"set_size_regime":["balanced"],"technique":["opprf","secret_sharing","batched_oprf","cuckoo_hashing"]},"historical_context":{"narrative":"Multiparty PSI had been built from oblivious polynomial evaluation under homomorphic encryption or from bilinear groups, so every item cost public-key operations, and no protocol had been implemented. Kolesnikov, Matania, Pinkas, Rosulek, and Trieu replaced that machinery with oblivious programmable PRFs running on OT extension. Every party splits zero into shares for each of its items and lets another party receive its share only if that party holds the same item; a designated leader then collects, again through programmable PRFs, one combined value per party and keeps the items whose values cancel. Security holds against any number of colluding semi-honest parties, and a smaller tolerated coalition means fewer pairwise instances. Their implementation intersected million-item sets among five parties in about a minute.","prior_boundary":"Multiparty PSI protocols were built from oblivious polynomial evaluation with additively homomorphic encryption or from bilinear groups. Kissner and Song have computation and communication quadratic in the set size and the number of parties; Cheon, Jarecki, and Seo reach quasi-linear complexity but assume at most \\( n/2 \\) corrupted parties; Hazay and Venkitasubramaniam need a linear number of exponentiations in the input sets and give no implementation (§1.2, p. 2; Table 1, p. 3).","significance_at_publication":"Public-key operations no longer depend on the set size (§1.2, p. 2; Table 1, p. 3), and the authors call their implementation the first of a multiparty PSI protocol (abstract, p. 1). It computes PSI of \\( 2^{20} \\) items among 5 parties in 72 seconds and among 15 parties in about 5 minutes on a LAN, with cost linear in the number of parties (abstract, p. 1; §7.2, p. 20; Figure 11, p. 19).","technical_delta":"Conditional zero-sharing uses an OPPRF between every pair of parties so that a party receives another's share of zero for an item only if it holds the item (§5.1, p. 11); conditional reconstruction uses one OPPRF from each party to the leader, which outputs items whose values XOR to zero (§5.2, p. 12; Figure 8, p. 12). Theorem 1 gives security against any number of colluding semi-honest parties (p. 12), outputs of \\( \\lambda + \\log_2 n \\) bits bound false positives by \\( 2^{-\\lambda} \\) (§5.3, p. 12), and a bound \\( t_c \\) on corruptions limits sharing to \\( t_c + 1 \\) parties (§5.3, p. 13)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","keywords":["multiparty-psi","conditional-zero-sharing","conditional-reconstruction","opprf","dishonest-majority","semi-honest","leader"],"limitations":["no security against malicious parties is claimed (§1, p. 1; §2.1, p. 4)","communication \\( O(n t_c \\lambda) \\) per client grows with the tolerated coalition and reaches gigabytes for \\( n = 2^{20} \\) (§7.2, p. 20; Table 5, p. 19)","measurements are for one machine with simulated LAN and WAN links and 128-bit items (§7, p. 17)"],"paper_id":"PSI-PAPER-2017-KMPRT","qualifiers":["semi-honest parties, any number of whom may be corrupt and collude (Theorem 1, p. 12)","proved with an ideal OPPRF functionality (Figure 8, p. 12); the evaluated instantiation uses the table-based OPPRF, which models a hash function as a random oracle (Figure 6, p. 8; §7.2, p. 18)","exponentiation counts are for an offline preprocessing phase (Table 1, p. 3)","the OPRF of Kolesnikov et al. on which the OPPRFs run uses only symmetric-key operations apart from a constant number of public-key operations for base OTs (§3.1, p. 4), so the protocol is not free of public-key operations","the generalization to at most \\( t_c \\) corrupt parties has each party \\( P_i \\) deal shares only to \\( P_{i+1}, \\ldots, P_{i+t_c+1} \\) (§5.3, p. 13); in the evaluation each party runs OPPRFs with \\( \\min\\{t_c + 1, \\ell - 1\\} \\) others, so \\( t_c = \\ell - 1 \\) and \\( t_c = \\ell - 2 \\) cost the same (§7.2, p. 20)","the leader P1 announces the intersection (Figure 8, step 5, p. 12); the ideal functionality gives it to all parties (Figure 1, p. 5)"],"source_locator":{"dossier_section":"PSI-PAPER-2017-KMPRT § Contributions","primary_source":"Abstract (p. 1); §1.2 and Table 1 (pp. 2-3); §1.3 (p. 3); §3.1 (p. 4); §5 with Figure 8 (pp. 10-12); Theorem 1 and proof (pp. 12-13); §5.3 (pp. 12-13); §7.2 with Tables 4-5 and Figure 11 (pp. 18-20). IACR ePrint 2017/799, PDF dated 2017-08-24.","primary_source_url":"https://eprint.iacr.org/2017/799","status":"theorem_checked"},"statement":"For \\( \\ell \\) parties with \\( n \\) items each, every party deals XOR-shares of zero for each of its items and, through a pairwise multi-query OPPRF, lets each other party obtain its share only for items both hold (conditional zero-sharing); each party then programs an OPPRF to the leader P1 with the XOR of the shares it holds per item, and P1 announces the items of its set whose values XOR to zero (conditional reconstruction). With an ideal OPPRF functionality the protocol is secure in the semi-honest model against any number of corrupt, colluding parties, and to tolerate at most \\( t_c \\) corruptions each party deals shares only to the next \\( t_c + 1 \\) parties. Exponentiations are confined to an offline phase, \\( O(\\ell \\kappa) \\) for the leader and \\( O(t_c \\kappa) \\) per client, and communication is \\( O(\\ell n \\lambda) \\) bits for the leader and \\( O(n t_c \\lambda) \\) bits per client.","statement_status":"source_normalized_statement","status":"published","title":"Multiparty PSI secure against any number of colluding semi-honest parties with public-key operations independent of set size, via conditional zero-sharing and reconstruction over OPPRFs","work_id":"PSI-PAPER-2017-KMPRT","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/799","sections":[{"content":"Multiparty PSI from conditional zero-sharing","heading":"Overview"},{"content":"Each party \\( P_i \\) chooses, for each of its items x, random strings \\( s^{i,1}, \\ldots, s^{i,\\ell} \\) that XOR to zero and runs a multi-query OPPRF with every other party \\( P_j \\) as sender programmed on \\( (x, s^{i,j}) \\); \\( P_j \\) queries its own set (Figure 8, steps 1-2, p. 12). Each party XORs its own share with the outputs it received into a value \\( S_i(x) \\), and in the second phase every \\( P_i \\) with \\( i > 1 \\) programs an OPPRF to P1 on \\( (x, S_i(x)) \\); P1 announces its items x with \\( S_1(x) \\) equal to the XOR of the received outputs (steps 3-5, p. 12). If some party lacks x, at least one term is pseudorandom and x is excluded except with probability \\( 2^{-\\lambda} \\) (§5.3, p. 12). The proof of Theorem 1 argues that a party without x leaves the honest parties' values for x independent of the coalition's view, and that programming an OPPRF on a random value is indistinguishable from not programming it (pp. 12-13). All OPPRF instances of a phase run in parallel, so the protocol has a constant number of rounds (§5.3, p. 13).","heading":"Exact contribution"},{"content":"MPC-COMP-CORR-OTEXT: every OPPRF instance runs on the KKRT OPRF, which the paper describes as based on OT extension (§3.1, p. 4).","heading":"Related records in other topics"}],"slug":"kmprt17-multiparty-psi-from-opprf","status":"published","subtitle":"Practical Multi-party Private Set Intersection from Symmetric-Key Techniques","summary":"For \\( \\ell \\) parties with \\( n \\) items each, every party deals XOR-shares of zero for each of its items and, through a pairwise multi-query OPPRF, lets each other party obtain its share only for items both hold (conditional zero-sharing); each party then programs an OPPRF to the leader P1 with the XOR of the shares it holds per item, and P1 announces the items of its set whose values XOR to zero (conditional reconstruction). With an ideal OPPRF functionality the protocol is secure in the semi-honest model against any number of corrupt, colluding parties, and to tolerate at most \\( t_c \\) corruptions each party deals shares only to the next \\( t_c + 1 \\) parties. Exponentiations are confined to an offline phase, \\( O(\\ell \\kappa) \\) for the leader and \\( O(t_c \\kappa) \\) per client, and communication is \\( O(\\ell n \\lambda) \\) bits for the leader and \\( O(n t_c \\lambda) \\) bits per client.","tableRows":["PSI-CONSTRUCTION-2017-KMPRT-SH"],"title":"Multiparty PSI secure against any number of colluding semi-honest parties with public-key operations independent of set size, via conditional zero-sharing and reconstruction over OPPRFs","type":"result","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT","keywords":["atomic-result","encode-commit","commitments","oblivious-encoding","malicious","uc-security","phasing","tags"],"metadata":{"claim_slug":"encode-commit","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model","standard_model"],"set_size_regime":["balanced"],"technique":["ot_extension","permutation_based_hashing","encode_commit","simple_hashing"]},"historical_context":{"narrative":"Dual execution forces the sender to bind herself to her items by obtaining encodings of them, which works but costs encoding work and lets a cheating sender spread up to a few times \\( n \\) candidate items over the bins. Rindal and Rosulek noted that those encodings act as commitments and asked what happens if an ordinary commitment takes their place. The sender commits to each item and attaches openings hidden under the receiver's encodings, together with short tags so the receiver knows which opening to try. Security needs only an extractable, hiding commitment, which a hash function provides in the random oracle model. The variant computes less and sends more, so it was the faster of the two on a fast local network and the slower one over a wide-area link.","prior_boundary":"In the dual-execution protocol of the same paper, Alice's encodings under Bob's instances act as commitments to her items, which bounds her effective set only by \\( m\\mu \\) items (§5.3, pp. 8-9; §6.3, p. 15), and Alice must act as encoding receiver for every bin position (Figure 4, p. 12).","significance_at_publication":"The commitment-based approach needs less computation and more communication, making it faster in LAN (§5.3, p. 10): 12.6 s against 18 s for dual execution at \\( n = 2^{20} \\) on one thread, but 255 s against 106 s in WAN (Figure 6, p. 19), with 1,322 MB against 1,092 MB of communication (Figure 8, p. 20); it also restricts Alice to exactly \\( n \\) items (§6.5, p. 17).","technical_delta":"Alice commits with a standard non-interactive commitment and sends decommitments masked under Bob's encodings (§5.3, p. 9); PRF-derived tags let Bob find the right decommitment to try without \\( O(n^2) \\) trial openings (§6.4, pp. 15-16; Figure 9, p. 27). Security needs straight-line extraction and standalone hiding, not equivocation (Appendix A, Definition 4, p. 26; Theorem 3, p. 16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT","keywords":["encode-commit","commitments","oblivious-encoding","malicious","uc-security","phasing","tags"],"limitations":["communication is higher than dual execution because \\( O(n \\log n) \\) tag-decommitment pairs are sent (§7.1, p. 21)","the paper states the exact bound only for Alice; Bob still acts as encoding receiver for all \\( m\\mu \\) bin positions and the simulator extracts his set from those inputs, as in the dual-execution protocol where this gives up to \\( m\\mu \\) items (Figure 9, step 3, p. 27; §6.5, p. 16; §6.3, p. 15)","Theorem 3 is supported by simulator descriptions without hybrids (§6.5, pp. 16-17)"],"paper_id":"PSI-PAPER-2017-RR-CCS","qualifiers":["UC security in the \\( F_{\\mathrm{encode}} \\)-hybrid model with a commitment satisfying Definition 4 (Theorem 3, p. 16); only Bob receives output (Figure 1, p. 4)","Alice's set is restricted to exactly \\( n \\) items, unlike the dual-execution protocol (§6.5, p. 17)","the standard model needs a UC-secure non-interactive commitment, which the authors did not implement because of its communication (Appendix A, p. 26; §7, p. 18)","uses the same simple hashing and phasing as the dual-execution protocol (§6.4, p. 16; Figure 9, step 2, p. 27)"],"source_locator":{"dossier_section":"PSI-PAPER-2017-RR-CCS § Contributions","primary_source":"§5.3 (pp. 8-10); §6.4 (pp. 15-16); §6.5, Theorem 3 (pp. 16-17); §7 'Implementation Details' (p. 18); Figure 6 (p. 19); Figure 8 (p. 20); §7.1 'Communication cost' (p. 21); Appendix A, Definition 4 (p. 26); Appendix B, Figure 9 (p. 27). IACR ePrint 2017/769, full version of August 9, 2017.","primary_source_url":"https://eprint.iacr.org/2017/769","status":"theorem_checked"},"statement":"Instead of acting as encoding receiver, Alice sends for each item a commitment \\( \\mathrm{Comm}(x; r_x) \\) and, for each position of the item's bin, a tag and the decommitment \\( r_x \\) masked under two PRF values derived from her encoding under Bob's instance; Bob builds a hash table from the tags of his own encodings and outputs his item when the unmasked value opens the commitment. With an extractable and hiding commitment, such as \\( H(x \\| r) \\) in the non-programmable random oracle model, the protocol UC-realizes PSI with output to Bob against malicious adversaries in the \\( F_{\\mathrm{encode}} \\)-hybrid model at cost \\( O(Cn \\log n) \\), \\( C \\) the cost of one oblivious encoding, and restricts Alice to exactly \\( n \\) items.","statement_status":"source_normalized_statement","status":"published","title":"Encode-commit malicious PSI with commitments to the sender's items and decommitments masked under oblivious encodings, trading communication for computation and fixing the sender's set size, UC","work_id":"PSI-PAPER-2017-RR-CCS","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/769","sections":[{"content":"Encode-commit malicious PSI","heading":"Overview"},{"content":"Bob acts as encoding receiver for every bin position and stores \\( \\llbracket y' \\rrbracket^{\\mathrm{tag}}_{b,i} = \\mathrm{PRF}(\\llbracket y' \\rrbracket^{A}_{b,i}, \\mathrm{tag}) \\) together with \\( \\llbracket y' \\rrbracket^{\\mathrm{enc}}_{b,i} \\), for bin b and position \\( i \\), in a hash table. For each item x, in random order, Alice sends \\( \\mathrm{Comm}(x; r_x) \\) and, for \\( j = 1, \\ldots, \\mu \\), the pair \\( \\llbracket x' \\rrbracket^{\\mathrm{tag}}_{b,j} \\| (\\llbracket x' \\rrbracket^{\\mathrm{enc}}_{b,j} \\oplus r_x) \\); Bob looks up each tag and adds y to the output if the recovered value opens the commitment to y (Figure 9, p. 27). The simulator extracts Alice's items from her commitments in extraction mode and Bob's from his \\( F_{\\mathrm{encode}} \\) inputs (§6.5, pp. 16-17).","heading":"Exact contribution"},{"content":"None. The commitment scheme \\( H(x \\| r) \\) and the Orrù-Orsini-Scholl OT extension have no record in any topic.","heading":"Related records in other topics"}],"slug":"rr17-encode-commit-malicious-psi","status":"published","subtitle":"Malicious-Secure Private Set Intersection via Dual Execution","summary":"Instead of acting as encoding receiver, Alice sends for each item a commitment \\( \\mathrm{Comm}(x; r_x) \\) and, for each position of the item's bin, a tag and the decommitment \\( r_x \\) masked under two PRF values derived from her encoding under Bob's instance; Bob builds a hash table from the tags of his own encodings and outputs his item when the unmasked value opens the commitment. With an extractable and hiding commitment, such as \\( H(x \\| r) \\) in the non-programmable random oracle model, the protocol UC-realizes PSI with output to Bob against malicious adversaries in the \\( F_{\\mathrm{encode}} \\)-hybrid model at cost \\( O(Cn \\log n) \\), \\( C \\) the cost of one oblivious encoding, and restricts Alice to exactly \\( n \\) items.","tableRows":["PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM"],"title":"Encode-commit malicious PSI with commitments to the sender's items and decommitments masked under oblivious encodings, trading communication for computation and fixing the sender's set size, UC","type":"result","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","keywords":["atomic-result","dual-execution","oblivious-encoding","common-encoding","simple-hashing","phasing","malicious","uc-security","psz-paradigm"],"metadata":{"claim_slug":"malicious-dual-execution","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model","standard_model"],"set_size_regime":["balanced"],"technique":["dual_execution","ot_extension","permutation_based_hashing","simple_hashing"]},"historical_context":{"narrative":"By 2017 the fastest semi-honest PSI protocols all followed one pattern: hash items into bins, let one party learn an oblivious encoding of its item in each bin, and compare encodings. Making this pattern resist a cheating sender had failed, partly because the sender's encoding cannot be inverted to extract its input and partly because cuckoo hashing makes item placement depend on the whole set. Rindal and Rosulek adapted dual execution: each party encodes its own items under the other's keys, and only a combination of both encodings is compared, so neither side can count an item it never encoded. Simple hashing and a proof that phasing remains secure complete the protocol. It needs only symmetric-key operations, can avoid random oracles, and ran far faster than the previous malicious protocols in their experiments.","prior_boundary":"The OT-based paradigm of Pinkas, Schneider, and Zohner, fastest against semi-honest adversaries, had a variant secure only against a malicious Alice (§1.1, p. 2); three features block malicious security: the encoding map is not invertible for extraction, cuckoo-hashing placement depends on Bob's whole set, and Alice may use different sets in different instances (§3.2, p. 5). The fastest malicious protocol, Rindal-Rosulek's Bloom-filter protocol, appears to depend inherently on the random oracle model (§1.1, p. 2; §1.2, p. 3).","significance_at_publication":"The paper presents this as the first fully malicious variant of the fastest semi-honest paradigm (§1.2, p. 3); the dual-execution random-oracle protocol takes 18 s in LAN and 106 s in WAN for \\( n = 2^{20} \\) on one thread, against 148 s and 1,080 s for the Bloom-filter protocol (Figure 6, p. 19), and a standard-model instantiation is faster than that protocol in LAN (§7.1, p. 20).","technical_delta":"Inspired by Mohassel-Franklin dual execution, each party is encoding receiver once, and the XOR of the two one-sided encodings forms a common encoding that a party can compute only for values it encoded (§5.1, pp. 7-8; Theorem 1, p. 8). Simple hashing replaces cuckoo hashing, phasing is shown secure against malicious adversaries, and aggregating Alice's encodings across bins removes dummy encodings (§6.1-6.2, pp. 10-12; Figure 4, p. 12; Theorem 2, p. 13)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","keywords":["dual-execution","oblivious-encoding","common-encoding","simple-hashing","phasing","malicious","uc-security","psz-paradigm"],"limitations":["two-party output is not supported: a malicious Bob could make Alice learn \\( X \\cap Y' \\) for any \\( Y' \\subseteq Y \\) (§6.7, pp. 17-18)","the protocol does not strictly enforce the size of a corrupt party's set (Figure 1, p. 4; §6.3, p. 15)","the protocols carry a \\( \\log n \\) factor more communication and computation than the semi-honest protocol of Kolesnikov et al., which the paper reports as a 3.3-4 times running-time gap in LAN for its fastest variant and 25 times in WAN (§7.1, p. 22)"],"paper_id":"PSI-PAPER-2017-RR-CCS","qualifiers":["UC security in the \\( F_{\\mathrm{encode}} \\)-hybrid model (Theorem 2, p. 13); only Bob receives output (Figure 1, p. 4)","a corrupt party may input up to \\( n' = m\\mu \\) items, \\( n' < 4n \\) for \\( \\lambda = 40 \\), \\( n = 2^{20} \\), \\( \\mu = 68 \\) (§6.3, p. 15)","the programmable-random-oracle instantiation of \\( F_{\\mathrm{encode}} \\) is the 1-out-of-N OT extension of Orrù, Orsini, and Scholl, at about three semi-honest 1-out-of-2 OTs per encoding (§4, p. 6)","the standard-model instantiation uses \\( \\sigma \\) chosen-message OTs and a PRF per encoding, so its cost grows with the item length, as \\( O(\\sigma) \\) per encoding (§4, pp. 6-7)","bins are padded to \\( \\mu \\) positions and each bin position uses its own \\( F_{\\mathrm{encode}} \\) session (§6.6, p. 17)"],"source_locator":{"dossier_section":"PSI-PAPER-2017-RR-CCS § Contributions","primary_source":"Abstract (p. 1); §1.1-1.2 (pp. 1-3); Figure 1 (p. 4); §3.1-3.2 (pp. 4-5); §4 and Figure 2 (pp. 5-7); §5.1-5.2, Figure 3, Theorem 1 (pp. 7-9); §6.1-6.2 (pp. 10-12); Figure 4 (p. 12); §6.3, Theorem 2 and 'Set Size for Malicious Parties' (pp. 13-15); §6.6 and Figure 5 (pp. 17-18); §7, Figures 6-8 (pp. 18-20); §7.1 (pp. 20-22). IACR ePrint 2017/769, full version of August 9, 2017.","primary_source_url":"https://eprint.iacr.org/2017/769","status":"theorem_checked"},"statement":"Both parties act as receiver of an oblivious encoding for every position of every bin, so each obtains one-sided encodings of its own items; for each of her items Alice sends the \\( \\mu \\) common encodings that combine her encoding under Bob's instance with her encodings under Alice's instances for the positions of the item's bin, and Bob outputs his items whose own common encodings appear. With simple hashing into \\( m = O(n / \\log n) \\) bins of \\( \\mu = O(\\log n) \\) positions, phasing to shorten items, and Alice's encodings aggregated across bins, the protocol UC-realizes PSI with output to Bob against malicious adversaries in the \\( F_{\\mathrm{encode}} \\)-hybrid model at cost \\( O(Cn \\log n) \\), where \\( C \\approx \\kappa \\) is the cost of one oblivious encoding. \\( F_{\\mathrm{encode}} \\) is realized in the programmable random oracle model by 1-out-of-N OT extension, or in the standard model by \\( \\sigma \\) oblivious transfers per encoding; a corrupt party's set may hold up to \\( m\\mu \\) items, fewer than \\( 4n \\) for \\( n = 2^{20} \\).","statement_status":"source_normalized_statement","status":"published","title":"Malicious security for OT-based PSI in the Pinkas-Schneider-Zohner paradigm by dual execution of oblivious encodings, with simple hashing and phasing, UC in the oblivious-encoding hybrid model","work_id":"PSI-PAPER-2017-RR-CCS","year":2017},"primaryUrl":"https://eprint.iacr.org/2017/769","sections":[{"content":"Dual-execution malicious PSI","heading":"Overview"},{"content":"For each bin b and position \\( i \\), Alice encodes her item x' under the instance \\( (B, b, i) \\), and Bob encodes his item y' under \\( (A, b, i) \\). For each of her items, Alice sends \\( \\llbracket x' \\rrbracket^{A}_{b,j} \\oplus \\llbracket x' \\rrbracket^{B}_{b,i} \\) for \\( j = 1, \\ldots, \\mu \\), in random order across all bins; Bob outputs y if \\( \\llbracket y' \\rrbracket^{A}_{b,i} \\oplus \\llbracket y' \\rrbracket^{B}_{b,j} \\) lies in this set for some j (Figure 4, p. 12). Encodings have \\( \\lambda + 2\\log(n\\mu) \\) bits so that spurious matches occur with probability at most \\( 2^{-\\lambda} \\) (§6.2, p. 12). The simulator extracts each party's candidate set from its \\( F_{\\mathrm{encode}} \\) inputs and, for a corrupt Alice, keeps the candidates whose common encodings appear in her message (Theorem 2 proof, pp. 13-15).","heading":"Exact contribution"},{"content":"Dual execution of Mohassel and Franklin (PKC 2006), the Orrù-Orsini-Scholl 1-out-of-N OT extension, and the Keller-Orsini-Scholl actively secure OT extension used in the standard-model instantiation (§4, pp. 6-7; §7, p. 18) have no record in any topic. MPC-CONTRIB-2003-IKNP-OTEXT: IKNP is cited among the OT-extension protocols on which the paradigm relies (§1.1, p. 2); the paper's instantiations use the later protocols named above.","heading":"Related records in other topics"}],"slug":"rr17-dual-execution-malicious-psi","status":"published","subtitle":"Malicious-Secure Private Set Intersection via Dual Execution","summary":"Both parties act as receiver of an oblivious encoding for every position of every bin, so each obtains one-sided encodings of its own items; for each of her items Alice sends the \\( \\mu \\) common encodings that combine her encoding under Bob's instance with her encodings under Alice's instances for the positions of the item's bin, and Bob outputs his items whose own common encodings appear. With simple hashing into \\( m = O(n / \\log n) \\) bins of \\( \\mu = O(\\log n) \\) positions, phasing to shorten items, and Alice's encodings aggregated across bins, the protocol UC-realizes PSI with output to Bob against malicious adversaries in the \\( F_{\\mathrm{encode}} \\)-hybrid model at cost \\( O(Cn \\log n) \\), where \\( C \\approx \\kappa \\) is the cost of one oblivious encoding. \\( F_{\\mathrm{encode}} \\) is realized in the programmable random oracle model by 1-out-of-N OT extension, or in the standard model by \\( \\sigma \\) oblivious transfers per encoding; a corrupt party's set may hold up to \\( m\\mu \\) items, fewer than \\( 4n \\) for \\( n = 2^{20} \\).","tableRows":["PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","PSI-CONSTRUCTION-2017-RR-CCS-SM"],"title":"Malicious security for OT-based PSI in the Pinkas-Schneider-Zohner paradigm by dual execution of oblivious encodings, with simple hashing and phasing, UC in the oblivious-encoding hybrid model","type":"result","venue":"ACM CCS 2017","year":2017,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","keywords":["atomic-result","labeled-psi","keyword-pir","symmetric-pir","interpolation-polynomial","unbalanced-psi","fully-homomorphic-encryption","pung"],"metadata":{"claim_slug":"labeled-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["labeled"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption","cuckoo_hashing","oprf"]},"historical_context":{"narrative":"Returning data attached to matching items, such as a public key for each contact found on a messaging service, was easy in OPRF-based PSI: encrypt each label under its item's PRF value and ship them all. But shipping them all costs communication linear in the server's set, \\( O(n_X) \\), and the keyword-search protocol of Freedman, Ishai, Pinkas, and Reingold, which used an interpolating polynomial, was linear as well. Chen, Huang, Laine, and Rindal let the server evaluate, next to the homomorphic intersection polynomial, a second polynomial that interpolates the labels of each bin. A match decrypts to its label, a miss to a random value, and the cost stays logarithmic in the server's set, \\( O(\\sigma \\log n_X + \\sigma_{\\mathrm{L}}) \\) per client item for \\( \\sigma_{\\mathrm{L}} \\)-bit labels. The result is a batched symmetric PIR by keywords.","prior_boundary":"Existing PSI protocols could return labels by encrypting each label under its item's OPRF value, but their communication is linear in the sender's set (§1.3, p. 3). The single-server PIR by keywords of Freedman, Ishai, Pinkas, and Reingold uses the same interpolation polynomial under additively homomorphic encryption with communication \\( n_X \\sigma_{\\mathrm{L}} \\) for \\( \\sigma_{\\mathrm{L}} \\)-bit labels, and the Diffie-Hellman labeled PSI of Jarecki and Liu is also linear in the larger set (§1.5, p. 5).","significance_at_publication":"The paper notes that labeled PSI with a single receiver item is single-server symmetric PIR by keywords, so the protocol is a batched keyword PIR (§1.1, p. 2; §1.5, p. 5). Replacing the multi-query keyword retrieval of the Pung messaging system, for \\( 2^{20} \\) messages of 288 bytes and 256 retrievals, it reports 4.6 s server online time and 17.6 MB against 20.5 s and 120 MB for multi-query SealPIR (§8.4, p. 21; Figure 6, p. 22).","technical_delta":"For each bin the sender interpolates H with \\( H(x_i) = v_i \\) and evaluates \\( G = H + rF \\), where F is the randomized intersection polynomial, so \\( G(y) \\) is the label on a match and uniformly random otherwise; longer labels are split into chunks (§5.1, pp. 11-12). With OPRF pre-processing the sender interpolates labels padded with the second half of each item's OPRF output, which needs no randomization and no help from the FHE scheme to hide non-matching labels (§5.2, p. 12; Figures 1-2, pp. 13-14)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","keywords":["labeled-psi","keyword-pir","symmetric-pir","interpolation-polynomial","unbalanced-psi","fully-homomorphic-encryption","pung"],"limitations":["the security theorems (Theorems 1-2, pp. 15-16) are stated for the unlabeled PSI functionality of Figure 3 (p. 15); no theorem covers the labeled functionality, which PSI-PAPER-2021-CONG later notes and sketches (§4.2, p. 14 of that paper)","Figure 6 (p. 22) does not state thread counts for this comparison"],"paper_id":"PSI-PAPER-2018-CHLR","qualifiers":["items and labels are first assumed to lie in one finite field; longer labels are split into item-size chunks and the sender repeats the evaluation per chunk (§5.1, p. 11)","complexity figures are for the CLR17-compatible variant of §5.1, with items hashed to \\( \\sigma = \\lambda + \\log n_X + \\log n_Y \\) bits (§5.1, p. 12)","offline, the sender interpolates polynomials of degree about \\( n_X/(m\\alpha) \\) per bin, \\( O(n_X^2/(m\\alpha)) \\cdot \\sigma_{\\mathrm{L}}/\\sigma \\) operations in total, \\( m \\) the number of bins and \\( \\alpha \\) the number of partitions (§5.1, p. 12)","in the OPRF-optimized variant the one-time pad can be extended to longer labels with a PRG (§5.2, footnote 7, p. 12)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-CHLR § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 2); §1.3 (p. 3); §1.5 (p. 5); §5.1-5.3 (pp. 11-12); Figures 1-2 (pp. 13-14); §8.4 (p. 21); Figure 6 (p. 22). IACR ePrint 2018/787, PDF dated 2018-08-27.","primary_source_url":"https://eprint.iacr.org/2018/787","status":"section_checked"},"statement":"In labeled PSI the sender holds a label \\( v_i \\) of \\( \\sigma_{\\mathrm{L}} \\) bits for each item \\( x_i \\) and the receiver learns the labels of the items in the intersection; if, besides the intersection polynomial, the sender homomorphically evaluates on each receiver bin a polynomial that interpolates the labels of the sender's bin (as \\( G = H + rF \\), or, after OPRF pre-processing, interpolating labels one-time-padded with a second part of each item's OPRF output), the receiver obtains the label exactly for matching items, with communication \\( O(n_Y \\log n_X \\, \\sigma + n_Y \\sigma_{\\mathrm{L}}) \\) and sender online computation \\( O(n_X \\sigma_{\\mathrm{L}}) \\), a factor \\( \\sigma_{\\mathrm{L}}/\\sigma \\) above unlabeled PSI.","statement_status":"source_normalized_statement","status":"published","title":"Labeled PSI with communication sublinear in the sender's set, \\( O(n_Y \\log n_X \\, \\sigma + n_Y \\sigma_{\\mathrm{L}}) \\) for \\( \\sigma_{\\mathrm{L}} \\)-bit labels, from homomorphically evaluated label-interpolation polynomials","work_id":"PSI-PAPER-2018-CHLR","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"Labeled PSI from FHE","heading":"Overview"},{"content":"Without OPRF pre-processing the sender evaluates, for a receiver item y in a bin, both \\( F(y) = r^* \\prod(x - y) \\) over the bin and \\( G(y) = H(y) + rF(y) \\) with H the interpolation of the bin's labels; the receiver decrypts \\( (F(y), G(y)) \\), which is \\( (0, v_i) \\) when \\( y = x_i \\) and uniformly random in \\( F^* \\times F \\) otherwise (§5.1, p. 11). With OPRF pre-processing the sender computes \\( (x'_i, x''_i) = \\mathrm{OPRF}_k(x_i) \\), uses \\( x'_i \\) as the item and \\( v'_i = v_i + x''_i \\) as the label, and interpolates G with \\( G(x'_i) = v'_i \\) (§5.2, p. 12). The full protocol batches the label polynomials like the intersection polynomials and returns their evaluations on the receiver's encrypted powers (Figure 1, step 5(b)ii, p. 13; Figure 2, steps 8-9, p. 14).","heading":"Exact contribution"},{"content":"PIR-PAPER-2018-SEALPIR: the labeled-PSI experiment replaces the multi-query PIR by keywords of the Pung system, built on the multi-query SealPIR of Angel, Chen, Laine, and Setty, and compares with it (§8, p. 18; §8.4, p. 21; Figure 6, p. 22). PIR by keywords (Chor, Gilboa, and Naor, 1997), to which the paper relates labeled PSI, has no record in any topic (§1.1, p. 2; §1.5, p. 5).","heading":"Related records in other topics"}],"slug":"chlr18-labeled-psi-sublinear-in","status":"published","subtitle":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","summary":"In labeled PSI the sender holds a label \\( v_i \\) of \\( \\sigma_{\\mathrm{L}} \\) bits for each item \\( x_i \\) and the receiver learns the labels of the items in the intersection; if, besides the intersection polynomial, the sender homomorphically evaluates on each receiver bin a polynomial that interpolates the labels of the sender's bin (as \\( G = H + rF \\), or, after OPRF pre-processing, interpolating labels one-time-padded with a second part of each item's OPRF output), the receiver obtains the label exactly for matching items, with communication \\( O(n_Y \\log n_X \\, \\sigma + n_Y \\sigma_{\\mathrm{L}}) \\) and sender online computation \\( O(n_X \\sigma_{\\mathrm{L}}) \\), a factor \\( \\sigma_{\\mathrm{L}}/\\sigma \\) above unlabeled PSI.","tableRows":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","PSI-CONSTRUCTION-2021-CONG-LABELED"],"title":"Labeled PSI with communication sublinear in the sender's set, \\( O(n_Y \\log n_X \\, \\sigma + n_Y \\sigma_{\\mathrm{L}}) \\) for \\( \\sigma_{\\mathrm{L}} \\)-bit labels, from homomorphically evaluated label-interpolation polynomials","type":"result","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-CHLR-LABELED-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","keywords":["atomic-result","malicious-sender","leaky-psi","h-limited-fhe","f-limited","labeled-psi","random-oracle","non-black-box-simulation","unbalanced-psi"],"metadata":{"claim_slug":"leaky-malicious-sender","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption","oprf","cuckoo_hashing"]},"historical_context":{"narrative":"Homomorphic PSI with a small client set gave a malicious server a lot of room: it held the client's encrypted items and could simply return encryptions of zero, making the client believe that its whole set was in the intersection. Full simulation against such a server looked out of reach, because extracting the server's set seemed to need communication linear in it, \\( \\Omega(n_X) \\). Chen, Huang, Laine, and Rindal instead asked the server to prove each match by returning, as a label, a hash of the item's oblivious PRF value. Under the assumption that leveled homomorphic encryption cannot evaluate a deep hash on encrypted data, the server must actually know an item to produce its label, so it can only remove matches as a function of the client's other items, not invent them.","prior_boundary":"In the protocol of Chen, Laine, and Rindal, and in the semi-honest version of this paper, a sender can return encryptions of zero and make the receiver output its full set (§1.3, p. 3; §7.2, p. 16). With OPRF pre-processing the paper proves only privacy against a malicious sender, without input independence or output correctness (Theorem 2, p. 16), and it names two obstacles to full simulation: communication sublinear in the sender's set, \\( o(n_X) \\), rules out extracting that set by zero-knowledge proofs, and the sender holds the encrypted receiver set and may evaluate any circuit on it (§7.2, p. 16).","significance_at_publication":"A malicious sender can no longer add receiver items it does not hold; it can only drop matches depending on the receiver's other items, which the authors call significantly less leakage than in the earlier protocol (§7.3, pp. 17-18). Labeled PSI is what makes this possible, and the variant saves work by not evaluating the intersection polynomial (§5.2, p. 12).","technical_delta":"The label of each processed item \\( x' \\) is set to \\( H(x') \\), the receiver accepts y only if the decrypted label at its bin equals \\( H(y') \\), the symmetric polynomial is neither evaluated nor sent, and the sender proves that one OPRF key was used (Figure 8, p. 25). Definition 1 (p. 17) states the F-limited property, and Theorem 3 (p. 25) proves that the protocol realizes the leaky functionality of Figure 7 (p. 25): the simulator extracts the OPRF key from the proof, takes the sender's set from its random-oracle queries, and reads the leakage function off the sender's code (pp. 25-26)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","keywords":["malicious-sender","leaky-psi","h-limited-fhe","f-limited","labeled-psi","random-oracle","non-black-box-simulation","unbalanced-psi"],"limitations":["this is not full simulation-based security against a malicious sender: the receiver's output may depend on items in \\( Y \\setminus X \\) through the sender-chosen leakage function (§7.3, p. 17)","if the sender reuses its pre-processing with many receivers and picks the hash functions, cuckoo-hashing failures can leak one bit of the receiver's set; sampling hash functions from a public reference string is suggested as a countermeasure (§7.3, p. 18)","no measurement of this variant is reported"],"paper_id":"PSI-PAPER-2018-CHLR","qualifiers":["the H-limited property is an assumption about the leveled FHE scheme and its fixed parameters, supported by a heuristic argument and experiments in which noise overflows after a few extra multiplications, not by a reduction (§7.3, p. 17)","the depth of H can be increased by iterating the hash after the FHE parameters are fixed (§7.3, p. 17)","the sender is not committed to its set and may use any subset of it in each execution (§7.3, p. 17)","the theorem first assumes the sender does not reuse pre-processing across receivers; the zero-knowledge proof of one OPRF key may be replaced by aborting on degenerate OPRF answers, with extra cases in the leakage function (§7.3, p. 17; remarks, p. 26)","simulation against a malicious sender is non-black-box (Theorem 3, p. 25)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-CHLR § Contributions","primary_source":"§1.3 (pp. 3-4); §5.2 (p. 12); §7.2 (p. 16); §7.3 and Definition 1 (pp. 17-18); Appendix A, Figures 7-8, and Theorem 3 (pp. 25-26). IACR ePrint 2018/787, PDF dated 2018-08-27.","primary_source_url":"https://eprint.iacr.org/2018/787","status":"theorem_checked"},"statement":"If the receiver accepts an item y only when the sender returns, as its label, an encryption of \\( H(\\mathrm{OPRF}_k(y)) \\) for a hash function H modeled as a random oracle, the intersection polynomial is no longer returned, and the sender proves in zero knowledge that all OPRF answers use one key, then, assuming One-More-Gap-Diffie-Hellman and a semantically secure leveled FHE scheme that is H-limited (no efficient sender can compute an encryption of \\( H(z) \\) from encryptions of the fixed powers of z), the protocol securely computes, with non-black-box simulation in the random oracle model, a leaky PSI functionality that gives the receiver \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\) for a leakage function chosen by a malicious sender whose set may have polynomial size.","statement_status":"source_normalized_statement","status":"published","title":"Malicious-sender FHE-based unbalanced PSI with bounded leakage \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\), from hash-valued labels and an H-limited leveled FHE assumption","work_id":"PSI-PAPER-2018-CHLR","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"Leaky security against a malicious sender","heading":"Overview"},{"content":"Figure 8 (p. 25) runs steps 1-7 of the labeled protocol with labels \\( H(x') \\) and a zero-knowledge proof of one OPRF key, evaluates and returns only the label polynomials, and lets the receiver output y when the decrypted label at \\( y' \\)'s cuckoo position equals \\( H(y') \\). The ideal functionality of Figure 7 (p. 25) takes the sender's set and a leakage function and outputs \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\). In the proof, a sender that produced a correct label for an item outside its extracted set would contradict the H-limited property, because outputs of the OPRF and the random oracle on such items are uniform (pp. 25-26).","heading":"Exact contribution"}],"slug":"chlr18-leaky-security-against-a","status":"published","subtitle":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","summary":"If the receiver accepts an item y only when the sender returns, as its label, an encryption of \\( H(\\mathrm{OPRF}_k(y)) \\) for a hash function H modeled as a random oracle, the intersection polynomial is no longer returned, and the sender proves in zero knowledge that all OPRF answers use one key, then, assuming One-More-Gap-Diffie-Hellman and a semantically secure leveled FHE scheme that is H-limited (no efficient sender can compute an encryption of \\( H(z) \\) from encryptions of the fixed powers of z), the protocol securely computes, with non-black-box simulation in the random oracle model, a leaky PSI functionality that gives the receiver \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\) for a leakage function chosen by a malicious sender whose set may have polynomial size.","tableRows":["PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE"],"title":"Malicious-sender FHE-based unbalanced PSI with bounded leakage \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\), from hash-valued labels and an H-limited leveled FHE assumption","type":"result","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","keywords":["atomic-result","extension-field-simd","generalized-simd-encoding","lazy-simd-encoding","arbitrary-length-items","bfv","unbalanced-psi"],"metadata":{"claim_slug":"long-items","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption"]},"historical_context":{"narrative":"Homomorphic PSI with a small client set had been demonstrated only on 32-bit strings, because the plaintext modulus had to be as large as an item, and a modulus of 80 bits, the length needed for hashed items of any length, inflated every parameter and cost. Chen, Huang, Laine, and Rindal used the more general form of SIMD packing in which each slot is an extension field with \\( p^d \\) elements, so a long item occupies one slot while the modulus stays small. They encode with only the Chinese remainder map, skipping the slot isomorphisms that the protocol never needs, and show that wider slots trade a slightly larger query for less server computation. Arbitrary-length items became practical at roughly the cost of the earlier 32-bit runs.","prior_boundary":"Chen, Laine, and Rindal set the plaintext modulus to about \\( 2^{\\sigma} \\) for \\( \\sigma \\)-bit items, so their communication grows linearly and computation quadratically with \\( \\sigma \\), as \\( O(\\sigma) \\) and \\( O(\\sigma^2) \\), and a larger plaintext prime \\( p \\) and ciphertext modulus \\( q \\) force a larger ring dimension that can leave slots unused (§3, p. 7). Their examples compare 22-bit items extended to 32 bits by permutation-based hashing (§8.3, p. 21), while hashing arbitrary items to \\( \\lambda + \\log n_X + \\log n_Y \\) bits needs \\( p \\) of about 80 bits, which the authors say hurts that protocol severely (§3, p. 8).","significance_at_publication":"With this encoding the protocol compares 80-bit items inside FHE; for \\( 2^{24} \\) sender items and 5535 receiver items the paper reports 16 MB and 22 s online against 20 MB and 40 s for the 32-bit protocol (§8.3, p. 21; Figure 5, p. 22). The lazy encoder ran 2.2 to 21.8 times faster than FFT-based encoding for d between 8 and 64 (Table 1, p. 9). The earlier paper had left efficient support for long items to future work (PSI-PAPER-2017-CLR, §6.1, p. 14).","technical_delta":"For a prime \\( p \\), \\( m \\) the ring dimension, and \\( d \\) the degree of the irreducible factors of \\( x^m + 1 \\) modulo \\( p \\), the plaintext ring splits into \\( m/d \\) copies of \\( \\mathbb{F}_{p^d} \\), so one slot holds a \\( d \\cdot \\log p \\)-bit item (§3, p. 8). The encoder applies only the CRT map \\( \\phi \\) and omits the field isomorphisms \\( \\psi \\), which are needed only to permute slots (§3.2, p. 8). The cost analysis gives query size growing with \\( \\log d \\) and online computation \\( \\Theta(1/d) \\), with only logarithmic dependence on \\( m \\) (§3.1, pp. 7-8)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","keywords":["extension-field-simd","generalized-simd-encoding","lazy-simd-encoding","arbitrary-length-items","bfv","unbalanced-psi"],"limitations":["the trade-off analysis of §3.1 is heuristic, with constants hidden (§3.1, p. 8)","the reported comparison with the 32-bit protocol also reflects the removal of noise flooding by OPRF pre-processing, so the speedup is not attributable to the encoding alone (§8.3, p. 21)"],"paper_id":"PSI-PAPER-2018-CHLR","qualifiers":["items are first hashed to \\( \\lambda + \\log n_X + \\log n_Y \\) bits, about 80 bits for \\( \\lambda = 40 \\) (§3, p. 8; Figure 1, step 1, p. 13)","requires \\( p \\) prime and \\( d \\) the smallest positive integer with \\( p^d \\equiv 1 \\bmod 2m \\) (§3, p. 8)","the cost model treats \\( n_Y \\), \\( n_X \\), \\( m \\), and the depth \\( L \\) as constants (§3.1, p. 8)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-CHLR § Contributions","primary_source":"Abstract (p. 1); §1.3 (p. 3); §3 (pp. 7-8); §3.1 (pp. 7-8); §3.2 (p. 8); Table 1 (p. 9); §8.3 (pp. 19-21); Figure 5 (p. 22). IACR ePrint 2018/787, PDF dated 2018-08-27.","primary_source_url":"https://eprint.iacr.org/2018/787","status":"section_checked"},"statement":"Encoding each hashed item into one SIMD slot holding an element of an extension field \\( \\mathbb{F}_{p^d} \\), with \\( m/d \\) slots per BFV plaintext of ring dimension \\( m \\) and an encoder that skips the slot-permutation isomorphism, lets FHE-based unbalanced PSI compare items of about 80 bits inside the homomorphic computation, enough for arbitrary-length inputs at 40-bit statistical security, without the plaintext modulus \\( p \\approx 2^{\\sigma} \\) that the 32-bit protocol of Chen, Laine, and Rindal would need; larger d increases the query size and reduces the sender's online computation in proportion to \\( 1/d \\).","statement_status":"source_normalized_statement","status":"published","title":"Arbitrary-length items in FHE-based unbalanced PSI without a plaintext modulus of the item length, via SIMD slots over extension fields","work_id":"PSI-PAPER-2018-CHLR","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"Long items through extension-field SIMD slots","heading":"Overview"},{"content":"The BFV plaintext ring \\( \\mathbb{Z}_p[x]/(x^m + 1) \\) is mapped by CRT to the product of the fields \\( \\mathbb{Z}_p[x]/(F_j(x)) \\) and then to \\( m/d \\) copies of \\( \\mathbb{F}_{p^d} \\) (§3, p. 8). Only the first map is used: items are placed directly in the factor rings, which saves the time and storage of the field isomorphisms (§3.2, p. 8). The full protocol chooses \\( p \\) and \\( d \\) with \\( d \\log_2 p \\ge \\sigma \\) (Figure 1, step 3, p. 13).","heading":"Exact contribution"},{"content":"HE-RESULT-2012-SV-SIMD-CIPHERTEXT-SLOT-PACKING-AND-PARALLEL-RECRYPTION: the general SIMD encoding with slots of flexible width is that of Smart and Vercauteren, cited as [50] (§3, p. 8; §3.2, p. 8). HE-PAPER-2012-FV: BFV as implemented in SEAL (§1.2, p. 2).","heading":"Related records in other topics"}],"slug":"chlr18-arbitrary-length-items-in","status":"published","subtitle":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","summary":"Encoding each hashed item into one SIMD slot holding an element of an extension field \\( \\mathbb{F}_{p^d} \\), with \\( m/d \\) slots per BFV plaintext of ring dimension \\( m \\) and an encoder that skips the slot-permutation isomorphism, lets FHE-based unbalanced PSI compare items of about 80 bits inside the homomorphic computation, enough for arbitrary-length inputs at 40-bit statistical security, without the plaintext modulus \\( p \\approx 2^{\\sigma} \\) that the 32-bit protocol of Chen, Laine, and Rindal would need; larger d increases the query size and reduces the sender's online computation in proportion to \\( 1/d \\).","tableRows":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2018-CHLR"],"title":"Arbitrary-length items in FHE-based unbalanced PSI without a plaintext modulus of the item length, via SIMD slots over extension fields","type":"result","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-CHLR-LONG-ITEMS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","keywords":["atomic-result","oprf-preprocessing","diffie-hellman-oprf","omgdh","malicious-receiver","one-sided-simulation","noise-flooding","unbalanced-psi","fully-homomorphic-encryption"],"metadata":{"claim_slug":"oprf-malicious-receiver","contribution_kind":"transform","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["unbalanced"],"technique":["oprf","fully_homomorphic_encryption","cuckoo_hashing"]},"historical_context":{"narrative":"The first FHE-based unbalanced PSI protocol protected the server's set only against an honest client, and it did so by flooding reply ciphertexts with noise, padding every bin, and randomizing the evaluated polynomial. Those countermeasures cost depth and parameter size, and a client that tampered with the noise in its own ciphertexts could defeat them. Chen, Huang, Laine, and Rindal moved the protection into a preprocessing step: both sets pass through an oblivious PRF keyed by the server, so the server's non-matching items look random to the client whatever it decrypts. The homomorphic part can then run with smaller parameters, and a simulator reads the client's inputs off its random-oracle queries, which yields security against a malicious client and privacy against a malicious server.","prior_boundary":"The FHE-based protocol of Chen, Laine, and Rindal was proved secure only against semi-honest parties and protected the sender's set by noise flooding, padding of every bin, and a random multiplier on the evaluated polynomial (§2, pp. 6-7; §4.1, p. 9; §4.2, p. 10). Flooding needs a heuristic noise bound and spare noise room, which rules out small FHE parameters, and a receiver that inserts extra noise into its ciphertexts can defeat it (§4.1, p. 9). The OPRF-based unbalanced protocols of Resende and Aranha and of Kiss et al. send the sender's processed set, so their communication is linear in it, \\( O(n_X) \\) (§1.4, p. 4; §4.2, p. 9).","significance_at_publication":"The authors state that dropping noise flooding lets them choose smaller FHE parameters (§1.3, p. 3). For \\( 2^{24} \\) sender items and 5535 receiver items they report 16 MB and 22 s online, single-threaded, against 20 MB and 40 s for the earlier protocol, while also comparing 80-bit instead of 22-bit items (§8.3, p. 21; Figure 5, p. 22). The sender's Diffie-Hellman pre-processing is non-interactive and reusable across receivers, which suits contact discovery with a large, slowly changing server set (§4.3, p. 10; Figure 4, p. 20).","technical_delta":"Both sets are first hashed with an OPRF keyed by the sender, either the Diffie-Hellman OPRF of Jarecki and Liu, reusable across receivers, or an OT-based OPRF applied after cuckoo hashing that cannot be reused and keeps the padding (§4.2-4.4, pp. 9-11). The FHE intersection then runs on OPRF outputs without flooding, padding, or multiplier (§4.2, pp. 9-10). A simulator that observes the receiver's random-oracle queries extracts its set, giving one-sided simulation security against a malicious receiver (Theorem 1, p. 15), and the receiver's messages are hidden by OMGDH and FHE semantic security, giving privacy against a malicious sender (Theorem 2, p. 16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","keywords":["oprf-preprocessing","diffie-hellman-oprf","omgdh","malicious-receiver","one-sided-simulation","noise-flooding","unbalanced-psi","fully-homomorphic-encryption"],"limitations":["full simulation-based security against a malicious sender is not achieved; a malicious sender can still make the receiver output its full set (§7.2, p. 16)","with the OT-based OPRF the sender cannot reuse OPRF values across receivers and must still pad its bins (§4.2, p. 10; §4.4, p. 11)","when the sender reuses its pre-processing and chooses the hash functions, a selective cuckoo-hashing failure leaks one bit of the receiver's set (§7.3, p. 18)"],"paper_id":"PSI-PAPER-2018-CHLR","qualifiers":["one-sided simulation in the sense of Hazay and Lindell against a malicious receiver, with the malicious receiver's set size equal to the honest one (Theorem 1, p. 15)","against a malicious sender only privacy holds: the receiver's messages reveal nothing about its set, but input independence and output correctness are not guaranteed (§7.2, p. 16; Theorem 2, p. 16)","random oracle model: H is a random oracle into the group, \\( H' \\) an outer hash, and the group must be One-More-Gap-Diffie-Hellman hard (§4.3, p. 10; Theorem 1, p. 15)","the OPRF output is hashed to \\( \\sigma = \\log_2(n_X n_Y) + \\lambda \\) bits with a random-oracle hash sampled by coin flipping (Figure 1, step 1, p. 13)","simulation extracts the receiver's input only before it learns OPRF values, not when it sends its first message, which the authors state suffices (§4.3, p. 10)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-CHLR § Contributions","primary_source":"Abstract (p. 1); §1.3 (pp. 3-4); §4.1-4.4 (pp. 8-11); Figures 1-2 (pp. 13-14); §7 and Figure 3 (p. 15); Theorem 1 (p. 15); §7.2 and Theorem 2 (pp. 16-17); §8.3 (pp. 19-21); Figure 5 (p. 22). IACR ePrint 2018/787, PDF dated 2018-08-27.","primary_source_url":"https://eprint.iacr.org/2018/787","status":"theorem_checked"},"statement":"If both sets are first mapped through a Diffie-Hellman-based oblivious PRF \\( F_\\alpha(x) = H'(H(x)^\\alpha) \\) whose key the sender holds, and the FHE-based intersection of Chen, Laine, and Rindal is run on the outputs, the resulting protocol securely computes PSI with one-sided simulation against a malicious receiver whose set size is unchanged, and with privacy against a malicious sender, in the random oracle model assuming One-More-Gap-Diffie-Hellman and semantically secure FHE; since the sender's processed items are pseudorandom to the receiver, noise flooding, padding of the sender's bins, and the random multiplier of the evaluated polynomial are no longer needed, and the sender can reuse its processed set with many receivers.","statement_status":"source_normalized_statement","status":"published","title":"OPRF pre-processing for FHE-based unbalanced PSI: one-sided simulation security against a malicious receiver without noise flooding, random oracle model","work_id":"PSI-PAPER-2018-CHLR","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/787","sections":[{"content":"OPRF pre-processing for FHE-based unbalanced PSI","heading":"Overview"},{"content":"The sender samples a key k and replaces its set by \\( X' = \\{H(F_k(x))\\} \\); the receiver obtains \\( F_k(y) \\) for its items interactively, by sending \\( H(y)^\\beta \\) and unblinding \\( (H(y)^{\\beta\\alpha})^{1/\\beta} \\) (§4.3, p. 10; Figure 1, step 1, p. 13; Figure 2, step 7a, p. 14). Because \\( X' \\setminus Y' \\) is pseudorandom to the receiver, the number of items in each bin can be public, the evaluated polynomial need not be randomized, and the sender does not flood noise (§4.2, pp. 9-10). In the proof of Theorem 1 the simulator collects the receiver's random-oracle queries to H, extracts its input set when the receiver queries \\( H' \\), obtains \\( X \\cap Y^* \\) from the ideal functionality, pads it with random values to size \\( n_X \\), and plays the honest sender (pp. 15-16).","heading":"Exact contribution"},{"content":"HE-PAPER-2012-FV: the FHE scheme is BFV as implemented in SEAL v2.3.0-4 (§1.2, p. 2; §8, p. 18). The Diffie-Hellman OPRF of Jarecki and Liu (SCN 2010), which the protocol uses, has no record in any topic.","heading":"Related records in other topics"}],"slug":"chlr18-oprf-pre-processing-against","status":"published","subtitle":"Labeled PSI from Fully Homomorphic Encryption with Malicious Security","summary":"If both sets are first mapped through a Diffie-Hellman-based oblivious PRF \\( F_\\alpha(x) = H'(H(x)^\\alpha) \\) whose key the sender holds, and the FHE-based intersection of Chen, Laine, and Rindal is run on the outputs, the resulting protocol securely computes PSI with one-sided simulation against a malicious receiver whose set size is unchanged, and with privacy against a malicious sender, in the random oracle model assuming One-More-Gap-Diffie-Hellman and semantically secure FHE; since the sender's processed items are pseudorandom to the receiver, noise flooding, padding of the sender's bins, and the random multiplier of the evaluated polynomial are no longer needed, and the sender can reuse its processed set with many receivers.","tableRows":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","PSI-CONSTRUCTION-2018-CHLR","PSI-CONSTRUCTION-2021-CONG"],"title":"OPRF pre-processing for FHE-based unbalanced PSI: one-sided simulation security against a malicious receiver without noise flooding, random oracle model","type":"result","venue":"ACM CCS 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","keywords":["atomic-result","two-dimensional-cuckoo-hashing","inference-graph","combined-stash","permutation-based-hashing","psi-cat","failure-probability"],"metadata":{"claim_slug":"2d-cuckoo-hashing","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["circuit"],"parties":["two_party"],"set_size_regime":["balanced"],"technique":["cuckoo_hashing","permutation_based_hashing"]},"historical_context":{"narrative":"Hashing makes circuit-based PSI cheaper only if a common item lands where both parties look for it. Earlier constructions guaranteed this by letting one party copy each item into every candidate bin, which forced the bins, and the circuit, to grow. Pinkas, Schneider, Weinert, and Wieder arranged two tables of two subtables each so that one party fills whole sides while the other fills one subtable per side; the two choices always cross in exactly one place. They proved that placing items fails with probability inversely proportional to \\( n \\) when each table is somewhat more than four times the input size, and set concrete parameters for bins holding two items by running about \\( 2^{40} \\) simulated insertions. The resulting circuits were several times smaller than both earlier circuit-based approaches.","prior_boundary":"Hashing-based circuit PSI let one party use cuckoo hashing and the other simple hashing, because two cuckoo-hashing parties may place a common item in different bins; simple hashing forces bins of \\( O(\\log n / \\log\\log n) \\) items and \\( O(n \\log n / \\log\\log n) \\) comparisons (§2, p. 7). A related layout with items in two of three tables, by Amossen and Pagh, had no tight stash analysis, and its follow-up needed stashes that grew with \\( n \\) (§2, pp. 6-7).","significance_at_publication":"With two-item bins, no stash for Alice, a combined stash for Bob, and permutation-based hashing, the circuit has \\( 4 \\cdot 2.4n(\\sigma - \\log_2(2.4n) + 1) + sn(\\sigma - 1) \\) AND gates, \\( s \\) the size of Bob's combined stash, 1.8 to 3.8 times fewer than the best earlier circuit for \\( n = 2^{12} \\) to \\( 2^{20} \\) and fixed or arbitrary bitlength (§6.2, pp. 22-23; Table 3), and PSI-CAT ran 1.4 to 2.8 times faster than Circuit-Phasing (§6.3, p. 24; Table 4).","technical_delta":"Alice's items occupy both subtables of one side and Bob's items one subtable on each side, so a common item shares exactly one subtable (§5, pp. 13-14; Figures 2-3). Alice inserts with Algorithm 2 or, with two items per bin, Algorithm 3 (pp. 15-16). An inference-graph argument bounds the probability that an item is bad by \\( ((1 + \\varepsilon)/\\varepsilon)^3 \\cdot 2/m^2 \\) per item (Theorem 1, p. 32), and also yields the tight space bound for standard cuckoo hashing and a bound of \\( k^2 n \\) per table for k copies (Appendix A.4, p. 33)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","keywords":["two-dimensional-cuckoo-hashing","inference-graph","combined-stash","permutation-based-hashing","psi-cat","failure-probability"],"limitations":["the \\( 2^{-40} \\) bound for \\( n \\ge 2^{13} \\) is extrapolated from experiments up to \\( n = 2^{12} \\) and the observed \\( n^{-3} \\) dependence, for which Appendix B gives only a heuristic explanation (§6.1, p. 20; Appendix B, pp. 33-34)","the authors see no way to make the construction secure against malicious parties, since item placement depends on the whole input set (§5.4, p. 18)","the PSI-CAT protocol remained 19 to 36 times slower than the specialized BaRK-OPRF PSI protocol, which computes only the intersection (§6.3, p. 25)"],"paper_id":"PSI-PAPER-2018-PSWW","qualifiers":["Theorem 1 covers single-item bins with tables larger than \\( 4(1 + \\varepsilon)n \\) each (Appendix A.3, p. 32)","the two-item-bin variant has no analysis; its failure probability and stash size rest on simulations (§3.3, p. 10; Appendix A, p. 29)","the hash functions must be chosen independently of the inputs and cannot be replaced after a failure without leaking information (§3, pp. 7-8; §5.2, p. 16)","semi-honest parties (§2, p. 6)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-PSWW § Contributions","primary_source":"Abstract (p. 1); §1.2 (p. 3); §2 (pp. 6-7); §3.3 (pp. 9-10); §5 and Figures 2-3 (pp. 13-14); §5.1 and Algorithms 2-3 (pp. 14-16); §5.2 and Table 1 (pp. 16-17); §6.1, Table 2, and Figure 4 (pp. 19-21); §6.2 and Table 3 (pp. 21-23); §6.3 and Tables 4-6 (pp. 23-26); Appendix A with Theorem 1 (pp. 29-33); Appendix B (pp. 33-34). IACR ePrint 2018/120, PDF dated 2019-01-24.","primary_source_url":"https://eprint.iacr.org/2018/120","status":"theorem_checked"},"statement":"In two-dimensional cuckoo hashing one party places each item in both subtables of one of two tables, using an iterative insertion that moves evicted items to the other table, and the other party places each item in one subtable of each table by standard cuckoo hashing, so that an item held by both meets in exactly one subtable; with one item per bin and tables of more than \\( 4(1 + \\varepsilon)n \\) bins the probability that some item cannot be placed is \\( O(1/n) \\) (Theorem 1); the variant with two-item bins and tables of \\( 2.4n \\) bins was measured to fail with probability at most \\( 2^{-37} \\) for \\( n = 2^{12} \\) at 99.9% confidence, with failure scaling as \\( n^{-3} \\), which the authors take as at most \\( 2^{-40} \\) for \\( n \\ge 2^{13} \\).","statement_status":"source_normalized_statement","status":"published","title":"Two-dimensional cuckoo hashing for circuit-based PSI: one shared bin per common item with \\( O(1/n) \\) failure above \\( 4(1 + \\varepsilon)n \\) bins per table","work_id":"PSI-PAPER-2018-PSWW","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/120","sections":[{"content":"Two-dimensional cuckoo hashing","heading":"Overview"},{"content":"Two tables \\( T_L \\) and \\( T_R \\) of \\( 4(1 + \\varepsilon)n \\) entries each are used, each with two hash functions (§5.1, pp. 14-15). Bob maps an item to one location in each table by standard cuckoo hashing; Alice maps it to both locations in one table, evicting occupants and their second copies to the other table (Algorithm 2, p. 15). With bins of two items the tables have \\( 2.4n \\) bins of capacity two, the same memory (Algorithm 3, p. 16). For PSI, Bob keeps one combined stash instead of one per table, which roughly halves the stash comparisons (§5.2 and Table 1, p. 17), and permutation-based hashing shortens the stored items (§5.2, pp. 16-17).","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-GMW: the measured protocol evaluates the circuit with GMW, which the authors chose because GMW ran faster than Yao in earlier experiments (§6.3, p. 24; §2, p. 6). MPC-PAPER-2015-ABY and MPC-CONTRIB-2015-ABY-MIXED: the implementation is part of the ABY framework (§1.2, p. 3; §6.3, p. 24). MPC-PAPER-1987-GMW: GMW protocol, cited as [GMW87], for the measured protocol (§2, p. 6; Table 4, p. 25).","heading":"Related records in other topics"}],"slug":"psww18-two-dimensional-cuckoo-hashi","status":"published","subtitle":"Efficient Circuit-based PSI via Cuckoo Hashing","summary":"In two-dimensional cuckoo hashing one party places each item in both subtables of one of two tables, using an iterative insertion that moves evicted items to the other table, and the other party places each item in one subtable of each table by standard cuckoo hashing, so that an item held by both meets in exactly one subtable; with one item per bin and tables of more than \\( 4(1 + \\varepsilon)n \\) bins the probability that some item cannot be placed is \\( O(1/n) \\) (Theorem 1); the variant with two-item bins and tables of \\( 2.4n \\) bins was measured to fail with probability at most \\( 2^{-37} \\) for \\( n = 2^{12} \\) at 99.9% confidence, with failure scaling as \\( n^{-3} \\), which the authors take as at most \\( 2^{-40} \\) for \\( n \\ge 2^{13} \\).","tableRows":["PSI-CONSTRUCTION-2018-PSWW-2D"],"title":"Two-dimensional cuckoo hashing for circuit-based PSI: one shared bin per common item with \\( O(1/n) \\) failure above \\( 4(1 + \\varepsilon)n \\) bins per table","type":"result","venue":"EUROCRYPT 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","keywords":["atomic-result","mirror-cuckoo-hashing","circuit-based-psi","stash","almost-linear","symmetric-functions"],"metadata":{"claim_slug":"almost-linear-circuit","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["circuit"],"parties":["two_party"],"set_size_regime":["balanced"],"technique":["cuckoo_hashing","permutation_based_hashing"]},"historical_context":{"narrative":"Circuit-based PSI pays for every comparison inside a secure computation, so the number of comparisons sets its cost. Sorting networks gave \\( n \\log n \\) comparisons, and the hashing approach of Circuit-Phasing, which pairs cuckoo hashing on one side with simple hashing on the other, gave slightly fewer, because simple hashing leaves logarithmically full bins. Pinkas, Schneider, Weinert, and Wieder let both parties use cuckoo hashing and resolved the problem that two parties may place a common item in different places by using a second set of tables whose hash functions mirror the first. Every common item then meets in exactly one bin, bins hold one item, and only a slowly growing stash must be compared with everything. Proving that such a stash keeps failure negligible completed an almost linear construction.","prior_boundary":"The best circuit constructions for PSI computed \\( O(n \\log n) \\) comparisons (sort-compare-shuffle of Huang, Evans, and Katz) or \\( O(n \\log n / \\log\\log n) \\) comparisons (Circuit-Phasing of Pinkas, Schneider, Segev, and Zohner), the latter because one party maps items by cuckoo hashing and the other by simple hashing into bins of \\( O(\\log n / \\log\\log n) \\) items (abstract, p. 1; §1.4, p. 5; §2, p. 7). The known stash bound \\( O(n^{-(s+1)}) \\) for cuckoo hashing, \\( s \\) the stash size, was stated only for constant \\( s \\) (§3.3, p. 9).","significance_at_publication":"Against the best known circuit constructions named in the abstract, the number of comparisons becomes arbitrarily close to linear, so that symmetric functions such as cardinality, threshold tests, or sums over the intersection need circuits of total size \\( \\omega(n) \\) instead of \\( O(n \\log n) \\) (abstract, p. 1; §1.3, p. 4; §6.2, p. 22).","technical_delta":"Two sets of tables are used, the right set reusing the left hash functions with the lower row in mirror order; Bob cuckoo-hashes each item into one subtable of each of the four tables, and Alice cuckoo-hashes into the two left rows and moves every item that lands in different columns to the right tables without new insertions (§4.1, pp. 10-12; Figure 1 and Algorithm 1). Appendix C shows that the Kirsch-Mitzenmacher-Wieder bound also holds for non-constant stash size, so a stash of size \\( \\omega(1) \\), for example \\( \\log\\log n \\), gives negligible failure (Appendix C, p. 34; §4.1, p. 13)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","keywords":["mirror-cuckoo-hashing","circuit-based-psi","stash","almost-linear","symmetric-functions"],"limitations":["the analysis is asymptotic and not intended to be tight (§4, p. 10)","concretely the mirror construction is worse than the 2D construction and was not implemented or timed (§6.2, p. 22; §6.3, p. 24)","no security against malicious adversaries (§5.4, p. 18)"],"paper_id":"PSI-PAPER-2018-PSWW","qualifiers":["semi-honest parties (§2, p. 6)","both sets have \\( n \\) items of bitlength \\( \\sigma \\); the parties agree on a symmetric function \\( f \\) and a circuit for it (§2, p. 5)","the hash functions are chosen at random and independently of the inputs (§3, pp. 7-8)","any symmetric function of the intersection; non-symmetric functions or the intersection itself need an \\( O(n \\log n) \\) shuffle (§1.3, p. 4)","the stash bound for a non-constant stash size \\( s \\) is derived from Theorem 5.5 of Wieder's survey (Appendix C, p. 34)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-PSWW § Contributions","primary_source":"Abstract (p. 1); §1.2 (p. 3); §1.3 (pp. 3-4); §1.4 (p. 5); §2 (pp. 6-7); §3.3 (p. 9); §4 (pp. 10-13), Figure 1 (p. 11), Algorithm 1 (p. 12); §6.2 (p. 22); Table 3 (p. 23); Appendix C (p. 34). IACR ePrint 2018/120, PDF dated 2019-01-24.","primary_source_url":"https://eprint.iacr.org/2018/120","status":"section_checked"},"statement":"For two parties with \\( n \\) items of \\( \\sigma \\) bits each, mirror cuckoo hashing places every item of each party into four standard cuckoo tables of total size \\( 8(1 + \\varepsilon)n \\) so that an item held by both meets in exactly one subtable, with stashes of size \\( \\omega(1) \\); a circuit that compares items bin by bin and compares every stashed item with all items of the other party then computes any symmetric function of the intersection with \\( \\omega(n) \\) comparisons, that is \\( o(f(n)) \\) for every \\( f(n) \\in \\omega(n) \\), and circuit size \\( \\omega(\\sigma n) \\), against \\( O(\\sigma n \\log n) \\) for sort-compare-shuffle and \\( O(\\sigma n \\log n / \\log\\log n) \\) for Circuit-Phasing, with failure probability negligible in \\( n \\).","statement_status":"source_normalized_statement","status":"published","title":"Circuit-based PSI with \\( \\omega(n) \\) comparisons and negligible failure probability from mirror cuckoo hashing, semi-honest two-party","work_id":"PSI-PAPER-2018-PSWW","year":2018},"primaryUrl":"https://eprint.iacr.org/2018/120","sections":[{"content":"Mirror cuckoo hashing for circuit-based PSI","heading":"Overview"},{"content":"The circuit (§4.2, p. 13) compares, for each bin, the item Alice mapped there with the item Bob mapped there, and compares every stashed item of either party with all items of the other. Mirror hashing guarantees that a common item is input to exactly one comparison, and the comparisons number \\( \\omega(n) \\) (§4.2, p. 13). The tables have total size \\( 8(1 + \\varepsilon)n \\); Bob keeps four stashes and Alice two (§4.1, p. 12). Concretely the circuit has \\( 4 \\cdot 2.4n(\\sigma - \\log_2(2.4n) + 1) + 3s'n(\\sigma - 1) \\) AND gates with a combined stash \\( s' \\le 2s \\) (§6.2, p. 22).","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-YAO and MPC-COMP-EVAL-GMW: the circuit may be evaluated with Yao's protocol or GMW, both named as the two main approaches (§2, p. 6).","heading":"Related records in other topics"}],"slug":"psww18-circuit-based-psi-with","status":"published","subtitle":"Efficient Circuit-based PSI via Cuckoo Hashing","summary":"For two parties with \\( n \\) items of \\( \\sigma \\) bits each, mirror cuckoo hashing places every item of each party into four standard cuckoo tables of total size \\( 8(1 + \\varepsilon)n \\) so that an item held by both meets in exactly one subtable, with stashes of size \\( \\omega(1) \\); a circuit that compares items bin by bin and compares every stashed item with all items of the other party then computes any symmetric function of the intersection with \\( \\omega(n) \\) comparisons, that is \\( o(f(n)) \\) for every \\( f(n) \\in \\omega(n) \\), and circuit size \\( \\omega(\\sigma n) \\), against \\( O(\\sigma n \\log n) \\) for sort-compare-shuffle and \\( O(\\sigma n \\log n / \\log\\log n) \\) for Circuit-Phasing, with failure probability negligible in \\( n \\).","tableRows":["PSI-CONSTRUCTION-2018-PSWW-MIRROR"],"title":"Circuit-based PSI with \\( \\omega(n) \\) comparisons and negligible failure probability from mirror cuckoo hashing, semi-honest two-party","type":"result","venue":"EUROCRYPT 2018","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","keywords":["atomic-result","ot-based-psi","bch-code","one-out-of-n-ot","kolesnikov-kumaresan","permutation-based-hashing","cuckoo-hashing","bit-length-independence"],"metadata":{"claim_slug":"bit-length-independent-ot-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["batched_oprf","ot_extension","cuckoo_hashing","permutation_based_hashing","simple_hashing"]},"historical_context":{"narrative":"In the authors' earlier OT-based protocol, each bin's oblivious PRF used transfers proportional to the item length, so longer identifiers cost more. Kolesnikov and coauthors had just removed that dependence with a pseudorandom code. Pinkas, Schneider, and Zohner reached the same goal differently in their journal version: they kept a genuine error-correcting code and fixed one BCH code with 512-bit codewords, large enough that, after shortening items with permutation-based hashing, sets of up to about 100 billion items need no larger code. Communication ends up slightly above the pseudorandom-code version but, the authors note, the structured code allows a published extension to malicious receivers. On a single platform comparing many paradigms, it ran fastest, with communication close to that of the public-key protocols.","prior_boundary":"The authors' conference protocols scaled linearly in the bit length \\( \\sigma \\) of the inputs, as \\( O(\\sigma) \\) (§1.4, 'Optimizations', p. 7). Kolesnikov et al. had replaced the error-correcting code of the implicit OPRF by a pseudorandom code of 424-448 bits, making its cost independent of \\( \\sigma \\) (§1.2, p. 4; Table 1, p. 5).","significance_at_publication":"The authors report communication 1.10-1.15 times that of Kolesnikov et al. and note that their code choice permits the malicious-receiver extension of Orrù, Orsini, and Scholl, which the pseudorandom code does not (§1.2, pp. 4-5); in their benchmarks it is the fastest protocol, with about the communication of public-key protocols (§6.2.2, p. 28), and it intersects two billion-element sets in 34.2 hours (§6.2.4, p. 31).","technical_delta":"The OPRF keeps an error-correcting code but fixes one linear BCH code that encodes up to \\( 2^{77} \\) words into 512-bit codewords with distance 129 (§2.2.3, p. 11); with permutation-based hashing this covers sets of up to \\( 2^{37} \\) elements for \\( \\lambda = 40 \\) regardless of \\( \\sigma \\) (§2.2.3, p. 11; §5, pp. 21-23; Protocol 3, p. 22). Smaller custom codes of 255-271 bits would suffice when \\( \\sigma - \\log_2(n) \\) is 8 to 13 (Table 1, p. 5)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","keywords":["ot-based-psi","bch-code","one-out-of-n-ot","kolesnikov-kumaresan","permutation-based-hashing","cuckoo-hashing","bit-length-independence"],"limitations":["communication is 1.10-1.15 times that of Kolesnikov et al. for the fixed 512-bit code (§1.2, p. 5)","smaller custom-tailored codes would lower communication for small \\( \\sigma - \\log_2(n) \\), but generating them is described as a non-trivial problem (§1.2, p. 5)","no security against malicious parties is claimed (§2.1, p. 8)","for small sets it is slower than the Bloom-filter protocols because of the base OTs (§6.2.2, pp. 28-29)"],"paper_id":"PSI-PAPER-2018-PSZ","qualifiers":["semi-honest P1 and P2; the proof assumes an ideal 1-out-of-N random OT functionality (§5, 'Security', p. 23)","efficient random OT extension relies on a function modeled as a random oracle (§2.1, p. 8; §2.2.2, p. 10)","only P2 learns the intersection (Protocol 3, 'Output', p. 22)","the 1-out-of-N OT extension needs 512 base OTs, four times as many as 1-out-of-2 OT extension, which dominates for small sets (§2.2.3, p. 11; §6.2.2, pp. 28-29)","the OT-based protocol first appeared in the USENIX 2014 and 2015 versions; independence of \\( \\sigma \\) is an addition of this version (§1.4, p. 7; §5, p. 21)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-PSZ § Contributions","primary_source":"Abstract (p. 1); §1.2 'OT-Based PSI' and Table 1 (pp. 4-5); §1.3 'A Novel OT-Based PSI Protocol' (pp. 5-6); §1.4 'Optimizations' (p. 7); §2.1 'The random oracle model' (p. 8); §2.2.3 and Protocol 2 (pp. 10-11); §3.3 (pp. 17-18); §5 and Protocol 3, 'Efficiency', 'Correctness', 'Security' (pp. 21-23); Table 8 (p. 26); §6.2.2 (pp. 27-29); Tables 9-10 (p. 29); §6.2.4 (pp. 30-31). IACR ePrint 2016/930, PDF dated 2019-07-28.","primary_source_url":"https://eprint.iacr.org/2016/930","status":"section_checked"},"statement":"P1 hashes its items into \\( b \\) bins by simple hashing with \\( k \\) hash functions and P2 by cuckoo hashing with a stash of size \\( s \\), \\( b \\) the number of bins and \\( k \\) the number of hash functions, with permutation-based hashing shortening stored items to \\( \\mu = \\sigma - \\log b + \\log k \\) bits; for each bin and stash position the parties run one 1-out-of-\\( 2^{\\mu} \\) random OT of the Kolesnikov-Kumaresan OT extension with a fixed linear \\( [2^{77}, 512, 129] \\) BCH code, which serves as an OPRF; P1 evaluates the OPRF on its own items and sends the permuted outputs, and P2 outputs its items whose outputs appear. Against semi-honest adversaries, P2 sends \\( 512(s + b) \\) bits and P1 sends about \\( k \\cdot n_X \\cdot v \\) bits with \\( v = \\lambda + \\log_2(kn_X) + \\log_2(n_Y) \\), independent of \\( \\sigma \\) for sets of up to \\( 2^{37} \\) items at \\( \\lambda = 40 \\), and P1 performs \\( (k + s)n_X \\) correlation-robust function evaluations.","statement_status":"source_normalized_statement","status":"published","title":"OT-based PSI with communication independent of item bit length for up to \\( 2^{37} \\) items, from per-bin OPRFs on 1-out-of-N random OT over a 512-bit BCH code, semi-honest","work_id":"PSI-PAPER-2018-PSZ","year":2018},"primaryUrl":"https://eprint.iacr.org/2016/930","sections":[{"content":"Bit-length-independent OT-based PSI","heading":"Overview"},{"content":"For each bin i, P1 obtains a random OPRF key \\( t_i \\), which corresponds to the values \\( q_i \\) and s of the 1-out-of-N OT extension, and P2 obtains \\( F_{t_i}(T2[i]) \\); P1 computes \\( M1[i][j] = H(q_i \\oplus (s \\wedge c_{v_j})) \\) for each of its items \\( v_j \\) in bin i, collects all values, permutes them, and sends them; stash positions are handled by evaluating the OPRF on P1's whole set (Protocol 3, p. 22; §5, p. 22). Mask length \\( v = \\lambda + \\log_2(kn_X) + \\log_2(n_Y) \\) gives correctness with probability \\( 1 - 2^{-\\lambda} \\) (§5, 'Correctness', p. 23).","heading":"Exact contribution"},{"content":"MPC-CONTRIB-2003-IKNP-OTEXT: the 1-out-of-2 OT extension of Ishai et al., on which the 1-out-of-N OT extension builds (Protocol 1, p. 10; §2.2.3, p. 10). The Kolesnikov-Kumaresan 1-out-of-N OT extension, which this protocol instantiates (§2.2.3, Protocol 2, pp. 10-11), has no record in any topic.","heading":"Related records in other topics"}],"slug":"psz18-ot-based-psi-with","status":"published","subtitle":"Scalable Private Set Intersection Based on OT Extension","summary":"P1 hashes its items into \\( b \\) bins by simple hashing with \\( k \\) hash functions and P2 by cuckoo hashing with a stash of size \\( s \\), \\( b \\) the number of bins and \\( k \\) the number of hash functions, with permutation-based hashing shortening stored items to \\( \\mu = \\sigma - \\log b + \\log k \\) bits; for each bin and stash position the parties run one 1-out-of-\\( 2^{\\mu} \\) random OT of the Kolesnikov-Kumaresan OT extension with a fixed linear \\( [2^{77}, 512, 129] \\) BCH code, which serves as an OPRF; P1 evaluates the OPRF on its own items and sends the permuted outputs, and P2 outputs its items whose outputs appear. Against semi-honest adversaries, P2 sends \\( 512(s + b) \\) bits and P1 sends about \\( k \\cdot n_X \\cdot v \\) bits with \\( v = \\lambda + \\log_2(kn_X) + \\log_2(n_Y) \\), independent of \\( \\sigma \\) for sets of up to \\( 2^{37} \\) items at \\( \\lambda = 40 \\), and P1 performs \\( (k + s)n_X \\) correlation-robust function evaluations.","tableRows":["PSI-CONSTRUCTION-2018-PSZ-OT"],"title":"OT-based PSI with communication independent of item bit length for up to \\( 2^{37} \\) items, from per-bin OPRFs on 1-out-of-N random OT over a 512-bit BCH code, semi-honest","type":"result","venue":"ACM Transactions on Privacy and Security 21(2)","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","keywords":["atomic-result","cuckoo-hashing","simple-hashing","stash-size","bin-size","hashing-failure","parameter-estimation","unequal-set-sizes"],"metadata":{"claim_slug":"hashing-parameters","contribution_kind":"measurement_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection"],"parties":["two_party"],"technique":["cuckoo_hashing","simple_hashing"]},"historical_context":{"narrative":"Hashing items into bins is what makes OT-based and circuit-based PSI run in linear time, but its parameters decide both correctness and cost: bins that overflow leak information or lose items, while oversized bins waste comparisons. Earlier work had given only asymptotic bounds for these schemes, with constants too vague to pick a concrete setting. Pinkas, Schneider, and Zohner computed the bounds numerically and ran about a billion cuckoo-hashing trials per configuration, extrapolating to a failure probability of two to the minus forty. Their tables list bin sizes, stash sizes, and bin counts, show that three hash functions work best when the parties' sets are equally large, and give low-stash choices for a small client set against a large server set, which other protocols adopted as well.","prior_boundary":"Freedman, Nissim, and Pinkas, and the later journal version with Hazay, suggested hashing to bins for PSI but analyzed its parameters only asymptotically and left setting them to future work (§1.3, p. 5; §3, p. 12); cuckoo hashing with a stash fails with probability \\( O(n^{1-c(s+1)}) \\), \\( s \\) the stash size and \\( c \\) the constant in the exponent, with unclear constants, and the utilization gains for more than two hash functions were known only asymptotically (§3.2.2, p. 15).","significance_at_publication":"The parameters let PSI protocols meet a stated hashing failure probability with concrete costs, show that three hash functions minimize comparisons for equal set sizes (§3.2.2, p. 16), and give low-stash settings for unequal set sizes (§3.2.2, p. 17; Table 11, p. 30); the authors note that the protocols of Kolesnikov et al. and of Orrù et al. benefit from this analysis (§1.2, p. 5).","technical_delta":"The paper computes the bin-size bound with 1,024-bit floating-point precision and measures cuckoo-hashing failures over \\( 2^{30} \\) repetitions, extrapolating by linear or logarithmic regression or a 4/3 margin, and tabulates trade-offs among stash size, number of hash functions, and number of bins (§3.1.2-3.2.2, pp. 13-18; Tables 3-7, Figures 1-2)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","keywords":["cuckoo-hashing","simple-hashing","stash-size","bin-size","hashing-failure","parameter-estimation","unequal-set-sizes"],"limitations":["the \\( 2^{-40} \\) values are extrapolated from \\( 2^{-30} \\) experiments, because \\( 2^{40} \\) trials were too costly (§3, p. 13; §3.2.2, pp. 15-17)","the cuckoo-hashing parameters are empirical estimates, not proved bounds (§3.2.2, p. 15)","the unequal-set parameters were computed for client sets of \\( 2^{8} \\) and \\( 2^{12} \\) items, while the text of §6.2.3 mentions \\( 2^{8} \\) and \\( 2^{16} \\) (Table 4, p. 14; §6.2.3, p. 29)"],"paper_id":"PSI-PAPER-2018-PSZ","qualifiers":["the hashing failure parameter \\( \\eta \\) is kept separate from the statistical security parameter \\( \\lambda \\) (§3, p. 13)","cuckoo hashing is used by P2 and simple hashing with the same k functions by P1, who pads bins with dummy items (§3.2.1, p. 14)","part of the analysis appeared in the conference versions, which bounded the failure for one parameter set; the trade-offs and unequal-set parameters are additions of this version (§1.4, p. 7)"],"source_locator":{"dossier_section":"PSI-PAPER-2018-PSZ § Contributions","primary_source":"§1.3 'Concrete Parameter Estimation for Hashing' (p. 5); §1.4 'Extended Hashing Parameter Analysis' (p. 7); §3 intro (pp. 12-13); §3.1.2, Eq. (3), Tables 3-4 (pp. 13-14); §3.2.1-3.2.2, Figure 1, Tables 5-6 (pp. 14-16); 'Adjusting the Number of Bins', Figure 2, Table 7 (pp. 17-18); Table 11 (p. 30). IACR ePrint 2016/930, PDF dated 2019-07-28.","primary_source_url":"https://eprint.iacr.org/2016/930","status":"section_checked"},"statement":"By evaluating the balls-into-bins bound numerically and running \\( 2^{30} \\) cuckoo-hashing trials, the paper gives concrete hashing parameters for PSI: maximum simple-hashing bin sizes for \\( n \\) items in \\( n \\) bins (16 to 20 for \\( n = 2^{8} \\) to \\( 2^{24} \\) at failure probability \\( 2^{-40} \\)) and for unequal sets; stash sizes for two hash functions and \\( 2.4n \\) bins (12, 6, 4, 3, 2 for \\( n = 2^{8}, 2^{12}, \\ldots, 2^{24} \\) at \\( 2^{-40} \\)); the fewest bins needing no stash for \\( k = 3, 4, 5 \\) hash functions (\\( 1.27n \\), \\( 1.09n \\), \\( 1.05n \\) at \\( 2^{-40} \\)); and, for 256 items and two hash functions, the bins needed for stash sizes 0 to 4 (\\( 2{,}500n \\) down to \\( 3.8n \\) at \\( 2^{-40} \\)). Three hash functions give the fewest comparisons for equal set sizes. Values for \\( 2^{-40} \\) are extrapolated from \\( 2^{-30} \\) experiments.","statement_status":"source_normalized_statement","status":"published","title":"Concrete simple- and cuckoo-hashing parameters for PSI at hashing failure probability \\( 2^{-30} \\) and \\( 2^{-40} \\), covering bin sizes, stash sizes, hash-function count, and bins for unequal set sizes","work_id":"PSI-PAPER-2018-PSZ","year":2018},"primaryUrl":"https://eprint.iacr.org/2016/930","sections":[{"content":"Concrete hashing parameters for PSI","heading":"Overview"},{"content":"Simple hashing: maximum bin sizes \\( \\mathrm{max}_b \\) from Eq. (3) for \\( n = b \\) (Table 3, p. 14) and for \\( 2n_X \\) items into \\( b = 2.4n_Y \\) bins (Table 4, p. 14). Cuckoo hashing: stash sizes for \\( k = 2 \\) and \\( b = 2.4n \\) (Figure 1 and Table 5, p. 16); \\( \\varepsilon_{\\min} \\) for \\( k = 3, 4, 5 \\) without a stash and the resulting \\( \\mathrm{max}_b \\) for P1 (Table 6, p. 16); bins for fixed stash sizes when \\( n = 256 \\) (Figure 2 and Table 7, p. 18).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"psz18-concrete-simple-and-cuckoo","status":"published","subtitle":"Scalable Private Set Intersection Based on OT Extension","summary":"By evaluating the balls-into-bins bound numerically and running \\( 2^{30} \\) cuckoo-hashing trials, the paper gives concrete hashing parameters for PSI: maximum simple-hashing bin sizes for \\( n \\) items in \\( n \\) bins (16 to 20 for \\( n = 2^{8} \\) to \\( 2^{24} \\) at failure probability \\( 2^{-40} \\)) and for unequal sets; stash sizes for two hash functions and \\( 2.4n \\) bins (12, 6, 4, 3, 2 for \\( n = 2^{8}, 2^{12}, \\ldots, 2^{24} \\) at \\( 2^{-40} \\)); the fewest bins needing no stash for \\( k = 3, 4, 5 \\) hash functions (\\( 1.27n \\), \\( 1.09n \\), \\( 1.05n \\) at \\( 2^{-40} \\)); and, for 256 items and two hash functions, the bins needed for stash sizes 0 to 4 (\\( 2{,}500n \\) down to \\( 3.8n \\) at \\( 2^{-40} \\)). Three hash functions give the fewest comparisons for equal set sizes. Values for \\( 2^{-40} \\) are extrapolated from \\( 2^{-30} \\) experiments.","tableRows":["PSI-CONSTRUCTION-2018-PSZ-OT"],"title":"Concrete simple- and cuckoo-hashing parameters for PSI at hashing failure probability \\( 2^{-30} \\) and \\( 2^{-40} \\), covering bin sizes, stash sizes, hash-function count, and bins for unequal set sizes","type":"result","venue":"ACM Transactions on Privacy and Security 21(2)","year":2018,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","keywords":["atomic-result","threshold-psi","intersection-cardinality-testing","polynomial-sparsity-test","hankel-matrix","noisy-polynomial-addition","ole","additively-homomorphic-encryption"],"metadata":{"claim_slug":"ahe-threshold-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["threshold"],"parties":["two_party"],"security_model":["standard_model"],"set_size_regime":["balanced"],"technique":["additively_homomorphic_encryption","ole","polynomial_sparsity_test","set_reconciliation"]},"historical_context":{"narrative":"Earlier threshold PSI protocols adapted a protocol for the intersection or its size, so their communication was \\( \\Omega(n) \\). Ghosh and Simkin showed that fully homomorphic encryption nearly reaches their lower bound but is computationally out of reach, and that generic garbled circuits pay a cubic price for interpolation. Their main protocol splits the problem in two. First the parties test, privately, whether their sets are close: writing each set as a sum of monomials makes the difference polynomial sparse exactly when the sets nearly agree, and sparsity reduces to whether a Hankel matrix is singular, which can be checked under additively homomorphic encryption. Only if the test passes do they compute randomized evaluations from which each party recovers its own exclusive elements. The second step is already cheap, so the cardinality test became the bottleneck.","prior_boundary":"Threshold PSI protocols of Freedman-Nissim-Pinkas, Hallgren-Orlandi-Sabelfeld, Ghosh-Nilges, Pinkas et al., and Zhao-Chow first computed PSI or its cardinality and so communicated at least linearly in the smaller set (§1, p. 2). Before this paper every threshold PSI protocol had communication \\( \\Omega(n) \\) (abstract, p. 1).","significance_at_publication":"The authors present it as the first threshold PSI protocols whose communication depends mainly on \\( t \\) and only logarithmically on \\( n \\) (abstract, p. 1). Within the paper it sits between the authors' own \\( \\tilde O(t) \\) protocol from FHE and their sketched garbled-circuit construction, which costs \\( \\tilde O(t^3) \\) because interpolation needs Gaussian elimination: it is asymptotically cheaper than the second and rests on weaker assumptions, with less computation, than the first (§3, pp. 7-9). Since the intersection step already costs \\( \\tilde O(t) \\), an \\( \\tilde O(t) \\) cardinality test would give \\( \\tilde O(t) \\) threshold PSI (§6.3, p. 14; §9, p. 19).","technical_delta":"Threshold PSI is split into a cardinality test and an intersection step (§1.2, pp. 2-4). The test uses a monomial set encoding, so sparsity of \\( p_A - p_B \\) measures the symmetric difference, and checks singularity of an encrypted Hankel matrix (Theorem 1, p. 9; Figure 5 and Theorem 3, p. 11). The intersection step uses generic computation only to produce noisy evaluations, which the parties interpolate in the clear; Lemma 1 of Kissner and Song makes the noise uniformly random (Figure 7, p. 13; Theorem 4, p. 14; Theorem 5, p. 16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","keywords":["threshold-psi","intersection-cardinality-testing","polynomial-sparsity-test","hankel-matrix","noisy-polynomial-addition","ole","additively-homomorphic-encryption"],"limitations":["the authors do not claim practical efficiency (§1.1, p. 2; §9, p. 20)","the \\( \\tilde O(t^2) \\) cost comes from the private cardinality test; the intersection step alone is \\( \\tilde O(t) \\) (§6.3, p. 14)"],"paper_id":"PSI-PAPER-2019-GS","qualifiers":["static passive adversaries in the UC framework (§2.2, p. 6)","Theorem 4 is in the \\( (F_{\\mathrm{PICT}}, F_{\\mathrm{NPA}}) \\)-hybrid model and Theorem 5 in the \\( F_{\\mathrm{OLE}} \\)-hybrid model (pp. 14, 16); the \\( \\tilde O(t^2) \\) bound holds in the plain model after instantiation (Lemmas 3-4, pp. 12, 14)","the cardinality test needs a field \\( \\mathbb{F}_r \\) whose size \\( r > (4t^2 + 2t)(p - 1)2^{\\lambda} \\) is a prime power, and errs with probability at most \\( 2^{-\\lambda} \\) (Theorem 1, p. 9)","the parties' sets have equal size \\( n \\); unequal sizes are handled by padding, at most doubling the threshold (§2, p. 4; §6.4, p. 15)","both parties learn the intersection or \\( \\perp \\) (Figure 6, p. 12)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-GS § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 2); §1.2 (pp. 2-4); §2.1, Lemmas 1-2 (p. 5); §3 (pp. 7-9); §4, Figure 3, and Theorem 1 (pp. 9-10); §5, Theorems 2-3, Figures 4-5, and Lemma 3 (pp. 10-12); §6, Figures 6-7, Theorem 4, and Lemma 4 (pp. 12-14); §7, Figures 9-10, and Theorem 5 (pp. 15-17); §9 (pp. 19-20). IACR ePrint 2019/175, PDF dated 2020-05-27.","primary_source_url":"https://eprint.iacr.org/2019/175","status":"theorem_checked"},"statement":"Against passive adversaries, two-party threshold PSI is realized with communication \\( \\tilde O(t^2) \\) in the plain model from IND-CPA additively homomorphic encryption and OLE: a private intersection cardinality test encodes each set as the polynomial with one monomial \\( x^a \\) per element, so the difference of the two encodings has at most \\( 2t \\) monomials exactly when the symmetric difference is at most \\( 2t \\), and tests this with the Hankel-matrix sparsity test of Grigorescu, Jung, and Rubinfeld under encryption and the singularity test of Kiltz, Mohassel, Weinreb, and Franklin (\\( \\tilde O(t^2) \\)); if the test passes, an OLE-based noisy polynomial addition gives both parties \\( 3t + 1 \\) evaluations of \\( p_A R_1 + p_B R_2 \\) for random degree-\\( t \\) polynomials \\( R_1, R_2 \\), from which each interpolates its exclusive elements and hence the intersection (\\( \\tilde O(t) \\)).","statement_status":"source_normalized_statement","status":"published","title":"Two-party threshold PSI with \\( \\tilde O(t^2) \\) communication from additively homomorphic encryption and OLE, via private intersection cardinality testing","work_id":"PSI-PAPER-2019-GS","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/175","sections":[{"content":"Threshold PSI from additively homomorphic encryption","heading":"Overview"},{"content":"\\( \\Pi_{\\mathrm{TPSI}} \\) (Figure 7, p. 13): the parties call \\( F_{\\mathrm{PICT}} \\) and output \\( \\perp \\) if it returns different; otherwise they call \\( F_{\\mathrm{NPA}} \\) for \\( 3t + 1 \\) evaluation points \\( \\alpha_i \\) and receive \\( V(\\alpha_i) = p_A(\\alpha_i)R_1(\\alpha_i) + p_B(\\alpha_i)R_2(\\alpha_i) \\). Alice divides by \\( p_A(\\alpha_i) \\), interpolates a rational function whose denominator is \\( p_{A \\setminus B} \\), and removes its roots from \\( S_A \\); Bob does the same. \\( \\Pi_{\\mathrm{PICT}} \\) (Figure 5, p. 11) sends Alice's encrypted Hankel matrix, Bob subtracts his own homomorphically, and \\( F_{\\mathrm{INV}} \\) decides singularity. \\( \\Pi_{\\mathrm{NPA}} \\) (Figure 10, p. 17) uses \\( 2(3t + 1) \\) OLE calls, adapting a protocol of Ghosh and Nilges (§7.2, p. 15).","heading":"Exact contribution"},{"content":"HE-RESULT-1999-PAILLIER-PRACTICAL-ADDITIVELY-HOMOMORPHIC-PUBLIC-KEY-ENCRYPTION: Paillier and its Damgård-Jurik generalization are named as possible instantiations of the additively homomorphic encryption (§2.3, p. 6).","heading":"Related records in other topics"}],"slug":"gs19-threshold-psi-from-additive","status":"published","subtitle":"The Communication Complexity of Threshold Private Set Intersection","summary":"Against passive adversaries, two-party threshold PSI is realized with communication \\( \\tilde O(t^2) \\) in the plain model from IND-CPA additively homomorphic encryption and OLE: a private intersection cardinality test encodes each set as the polynomial with one monomial \\( x^a \\) per element, so the difference of the two encodings has at most \\( 2t \\) monomials exactly when the symmetric difference is at most \\( 2t \\), and tests this with the Hankel-matrix sparsity test of Grigorescu, Jung, and Rubinfeld under encryption and the singularity test of Kiltz, Mohassel, Weinreb, and Franklin (\\( \\tilde O(t^2) \\)); if the test passes, an OLE-based noisy polynomial addition gives both parties \\( 3t + 1 \\) evaluations of \\( p_A R_1 + p_B R_2 \\) for random degree-\\( t \\) polynomials \\( R_1, R_2 \\), from which each interpolates its exclusive elements and hence the intersection (\\( \\tilde O(t) \\)).","tableRows":["PSI-CONSTRUCTION-2019-GS-AHE","PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","PSI-CONSTRUCTION-2023-GS-TWO-PARTY"],"title":"Two-party threshold PSI with \\( \\tilde O(t^2) \\) communication from additively homomorphic encryption and OLE, via private intersection cardinality testing","type":"result","venue":"CRYPTO 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","keywords":["atomic-result","threshold-psi","fhe","set-reconciliation","rational-function-interpolation","upper-bound"],"metadata":{"claim_slug":"fhe-upper-bound","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["threshold"],"parties":["two_party"],"set_size_regime":["balanced"],"technique":["fully_homomorphic_encryption","set_reconciliation"]},"historical_context":{"narrative":"Set reconciliation, a technique from distributed systems, lets two parties learn the union of their sets by exchanging a number of polynomial evaluations proportional to how much the sets differ, but it reveals both sets' differences. Ghosh and Simkin placed it under fully homomorphic encryption: one party sends encrypted evaluations of the polynomial whose roots are its elements, and the other interpolates the ratio of the two set polynomials on ciphertexts, verifies the result at a random point, and returns only the part describing the first party's exclusive elements. Communication becomes linear in the threshold and logarithmic in the field size, \\( O(t \\log p) \\) bits, close to the lower bound, although interpolating homomorphically is expensive enough that the authors treat the protocol as a feasibility result.","prior_boundary":"Before this work all threshold PSI protocols had communication \\( \\Omega(n) \\) in the set size (abstract, p. 1; §1, p. 2). The set reconciliation protocol of Minsky, Trachtenberg, and Zippel computes a set union with communication proportional to the symmetric difference but is not private (§1.2, p. 3).","significance_at_publication":"It is an upper bound within polylogarithmic factors of the \\( \\Omega(t) \\) lower bound, establishing that threshold PSI communication can depend on the threshold rather than the set size; the authors consider it of mainly theoretical interest because of the homomorphic interpolation cost (§3, pp. 7-8; Figure 2, p. 7).","technical_delta":"The set reconciliation protocol is run under fully homomorphic encryption, so the rational-function interpolation and the consistency check at z happen on ciphertexts and only the numerator encoding Alice's exclusive elements is returned (§3, p. 8)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","keywords":["threshold-psi","fhe","set-reconciliation","rational-function-interpolation","upper-bound"],"limitations":["not claimed practical: homomorphic rational-function interpolation is computationally heavy (§3, p. 8)","relies on fully homomorphic encryption; whether \\( \\tilde O(t) \\) is possible from weaker assumptions is left open (§9, p. 19)"],"paper_id":"PSI-PAPER-2019-GS","qualifiers":["a high-level sketch; the details are left to the reader (§3, p. 8)","assumes FHE ciphertexts larger than plaintexts by at most a constant factor and elements from \\( \\mathbb{F}_p \\) (§3, p. 8)","security follows from the security of FHE; known instantiations rest on lattice assumptions such as LWE or ring-LWE (§3, p. 8)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-GS § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 2); §1.2 (pp. 3-4); §3, upper bound paragraph and Figure 2 (pp. 7-8). IACR ePrint 2019/175, PDF dated 2020-05-27.","primary_source_url":"https://eprint.iacr.org/2019/175","status":"section_checked"},"statement":"Against passive adversaries, two parties can run threshold PSI with communication \\( O(t \\log p) \\) bits for set elements in \\( \\mathbb{F}_p \\), that is \\( \\tilde O(t) \\) independent of the set size \\( n \\): Alice sends FHE encryptions of her set polynomial at \\( 2t + 1 \\) points plus a random point z, Bob homomorphically interpolates the rational function \\( p_A/p_B \\) from the first \\( 2t \\) points, checks the candidate at z, and returns \\( t \\) ciphertexts holding the numerator \\( p_{A \\setminus B} \\) or \\( \\perp \\), from which Alice computes the intersection.","statement_status":"source_normalized_statement","status":"published","title":"Two-party threshold PSI with \\( O(t \\log p) \\) communication from fully homomorphic encryption, almost matching the \\( \\Omega(t) \\) bound","work_id":"PSI-PAPER-2019-GS","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/175","sections":[{"content":"\\( \\tilde O(t) \\) threshold PSI from FHE","heading":"Overview"},{"content":"Alice encodes \\( S_A \\) as \\( p_A(x) = \\prod(x - a_i) \\) and sends \\( \\mathrm{Enc}(p_A(\\alpha_1)), \\ldots, \\mathrm{Enc}(p_A(\\alpha_{2t})) \\), \\( \\mathrm{Enc}(p_A(z)) \\), and z. Bob interpolates \\( p_A/p_B \\), whose numerator and denominator have gcd 1, on ciphertexts, and returns \\( p_{A \\setminus B} \\) if the candidate agrees with \\( p_A(z)/p_B(z) \\) and \\( \\perp \\) otherwise. Total communication is \\( 2t + 1 \\) ciphertexts from Alice and \\( t \\) from Bob (§3, p. 8).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"gs19-two-party-threshold-psi","status":"published","subtitle":"The Communication Complexity of Threshold Private Set Intersection","summary":"Against passive adversaries, two parties can run threshold PSI with communication \\( O(t \\log p) \\) bits for set elements in \\( \\mathbb{F}_p \\), that is \\( \\tilde O(t) \\) independent of the set size \\( n \\): Alice sends FHE encryptions of her set polynomial at \\( 2t + 1 \\) points plus a random point z, Bob homomorphically interpolates the rational function \\( p_A/p_B \\) from the first \\( 2t \\) points, checks the candidate at z, and returns \\( t \\) ciphertexts holding the numerator \\( p_{A \\setminus B} \\) or \\( \\perp \\), from which Alice computes the intersection.","tableRows":["PSI-CONSTRUCTION-2019-GS-FHE"],"title":"Two-party threshold PSI with \\( O(t \\log p) \\) communication from fully homomorphic encryption, almost matching the \\( \\Omega(t) \\) bound","type":"result","venue":"CRYPTO 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-GS-LOWER-BOUND","keywords":["atomic-result","lower-bound","communication-complexity","threshold-psi","set-disjointness","symmetric-difference"],"metadata":{"claim_slug":"lower-bound","contribution_kind":"boundary_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["threshold"],"parties":["two_party"]},"historical_context":{"narrative":"The communication of ordinary set intersection had long been known to grow at least linearly with the sets, as \\( \\Omega(n) \\), through the hardness of deciding set disjointness. Threshold PSI asks for less: the intersection is released only when the two sets differ in at most \\( t \\) elements. Ghosh and Simkin asked what that relaxation is worth and showed that it cannot be worth everything. A threshold protocol that communicated \\( o(t) \\) bits would, after both parties pad small sets with the same public dummy elements, compute an ordinary intersection too cheaply. The bound depends only on \\( t \\), leaving room for protocols whose cost is independent of the set size, and it frames the upper bounds of the same paper.","prior_boundary":"Freedman, Nissim, and Pinkas observed that the \\( \\Theta(n) \\) communication complexity of set disjointness yields an \\( \\Omega(n) \\) lower bound for any PSI protocol on sets of size \\( n \\), which extends to intersection cardinality (§1, p. 1; §3, p. 8). All earlier threshold PSI protocols started from PSI and communicated at least linearly in the smaller set (§1, p. 2).","significance_at_publication":"With the FHE-based protocol it gives the first characterization of the communication complexity of threshold PSI, showing that communication depending on \\( t \\) rather than \\( n \\) is not ruled out (§1.1, p. 2; §3, p. 7; Figure 2, p. 7).","technical_delta":"The bound is restated in terms of the threshold: padding both inputs with a common set of dummy elements turns any threshold PSI protocol into a PSI protocol for the unpadded sets, so threshold PSI inherits an \\( \\Omega(t) \\) bound, measured by the symmetric set difference rather than the set size (§3, pp. 7-8)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-GS-LOWER-BOUND","keywords":["lower-bound","communication-complexity","threshold-psi","set-disjointness","symmetric-difference"],"limitations":["the bound concerns protocols that output the intersection when the threshold condition holds, not cardinality testing alone (§3, p. 8)","it is stated for two parties (§3, p. 7)"],"paper_id":"PSI-PAPER-2019-GS","qualifiers":["unconditional: the bound holds for any protocol, without computational assumptions (§3, p. 7)","\\( t \\) is an upper bound on the size of the symmetric set difference (§3, p. 7)","the argument is a sketch that relies on the \\( \\Omega(n) \\) bound for set intersection derived from set disjointness (§3, p. 8)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-GS § Contributions","primary_source":"Abstract (p. 1); §1 (pp. 1-2); §1.1 (p. 2); §3, lower bound paragraph and Figure 2 (pp. 7-8). IACR ePrint 2019/175, PDF dated 2020-05-27.","primary_source_url":"https://eprint.iacr.org/2019/175","status":"section_checked"},"statement":"Any two-party protocol that outputs the intersection of two sets whenever their symmetric difference is at most \\( t \\) must communicate \\( \\Omega(t) \\) bits, unconditionally: a protocol with \\( o(t) \\) communication, run on two size-\\( t \\) sets each padded with the same \\( n' - t \\) public dummy elements, would compute the intersection of size-\\( t \\) sets with \\( o(t) \\) communication, contradicting the \\( \\Omega(n) \\) set-intersection bound that follows from the communication complexity of set disjointness.","statement_status":"source_normalized_statement","status":"published","title":"\\( \\Omega(t) \\) communication lower bound for two-party threshold PSI, \\( t \\) the bound on the symmetric set difference","work_id":"PSI-PAPER-2019-GS","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/175","sections":[{"content":"\\( \\Omega(t) \\) lower bound for threshold PSI","heading":"Overview"},{"content":"Suppose protocol \\( \\Pi \\) computes the intersection of sets of size \\( n' \\) that share at least \\( n' - t \\) elements with \\( o(t) \\) communication. For sets \\( S_A \\) and \\( S_B \\) of size \\( t \\), both parties run \\( \\Pi \\) on \\( S_A \\cup S_D \\) and \\( S_B \\cup S_D \\) for a fixed public set \\( S_D \\) of \\( n' - t \\) dummies; the threshold condition always holds, and removing \\( S_D \\) from the output yields \\( S_A \\cap S_B \\) with \\( o(t) \\) communication, contradicting the \\( \\Omega(t) \\) bound for PSI on size-\\( t \\) sets (§3, p. 8).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"gs19-omega-t-communication-lower","status":"published","subtitle":"The Communication Complexity of Threshold Private Set Intersection","summary":"Any two-party protocol that outputs the intersection of two sets whenever their symmetric difference is at most \\( t \\) must communicate \\( \\Omega(t) \\) bits, unconditionally: a protocol with \\( o(t) \\) communication, run on two size-\\( t \\) sets each padded with the same \\( n' - t \\) public dummy elements, would compute the intersection of size-\\( t \\) sets with \\( o(t) \\) communication, contradicting the \\( \\Omega(n) \\) set-intersection bound that follows from the communication complexity of set disjointness.","title":"\\( \\Omega(t) \\) communication lower bound for two-party threshold PSI, \\( t \\) the bound on the symmetric set difference","type":"result","venue":"CRYPTO 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-GS-LOWER-BOUND"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","keywords":["atomic-result","correlated-ot","ot-precomputation","free-xor","garbled-circuits","naor-reingold-prf","oprf","unbalanced-psi","precomputation"],"metadata":{"claim_slug":"cot-precomputation","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["garbled_circuits","ot_extension","oprf"]},"historical_context":{"narrative":"Precomputed unbalanced PSI pushes all heavy work into phases that run before the client's contacts are known, leaving an online phase in which the client fetches the keys that let it evaluate a precomputed oblivious PRF on each item. Those fetches were ordinary oblivious transfers. Free-XOR garbling invites correlated transfers, which cost half as much, but precomputed correlated transfers seemed to require regarbling whenever the client's random choice bit differed from its real input. Kales and coauthors fixed the label pair from the correlated transfer, added a fresh random mask per label, and let a one-bit correction decide which masked value the server returns. The same idea applies to the Naor-Reingold OPRF, and in both protocols the online transfers shrink by half.","prior_boundary":"Kiss et al. split unbalanced PSI into base, setup, online, and update phases and precomputed OTs and garbled circuits in the base phase with ordinary OTs (§3.5, p. 6; §4.3, p. 8). Correlated OTs suit Free-XOR labels \\( l_1 = l_0 \\oplus \\Delta \\), but with OT precomputation the sender must swap the precomputed messages whenever the client's random choice differs from its input, which would force re-garbling at least the first layer of each precomputed circuit (§4.3, p. 8).","significance_at_publication":"OT messages are the only online communication of GC-PSI, so its online phase sends half as much; the authors state the technique is of independent interest for Yao's protocol with precomputation (§1.1, p. 2; §4.3, p. 8). The measured online phase for 1024 client items sends 2,048 KiB from server to client in GC-PSI and 4,147 KiB in NR-PSI (Table 5, p. 13).","technical_delta":"For GC-PSI the input labels are derived from correlated OTs through per-label masks \\( \\delta \\), so the swap moves into the masks: the client sends \\( b = c \\oplus y \\), the garbler replies \\( B = r_b \\oplus l_0 \\), and the client sets its label to \\( r_c \\oplus B \\) (§4.3, p. 8; Figure 1, p. 9). For NR-PSI the correlation between r and \\( r \\cdot a_j \\) in the OPRF of Hazay and Lindell lets correlated OTs replace ordinary ones, combined with OT precomputation (§4.4, p. 10; Figure 2, p. 10)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","keywords":["correlated-ot","ot-precomputation","free-xor","garbled-circuits","naor-reingold-prf","oprf","unbalanced-psi","precomputation"],"limitations":["the factor 2 concerns the online OT messages; base-phase garbled circuits and the setup-phase filter are unchanged (§4.3, p. 8; Tables 3-4, p. 13)"],"paper_id":"PSI-PAPER-2019-KRSSW","qualifiers":["applies to the precomputation setting, in which the number of precomputed OTs and circuits bounds the client items checked before the base phase must be rerun (Figure 1 caption, p. 9)","security is argued from the arguments for standard OT precomputation and the uniformity of the fresh masks \\( \\delta \\); no proof is given (§4.3, p. 8)","the GC-PSI variant relies on Free-XOR labels with a global offset \\( \\Delta \\) known only to the garbler (§4.3, p. 8)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-KRSSW § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 2); §3.1 (pp. 4-5); §3.5 (p. 6); §4.3 (p. 8); Figure 1 (p. 9); §4.4 (pp. 9-10); Figure 2 (p. 10); Table 5 (p. 13). IACR ePrint 2019/517, full version, PDF dated 2019-05-24.","primary_source_url":"https://eprint.iacr.org/2019/517","status":"section_checked"},"statement":"In unbalanced PSI whose client-side OPRF evaluations rely on OTs precomputed in an input-independent base phase, the online OT messages can come from correlated OTs: in garbled-circuit OPRF evaluation the garbler builds each input-wire label pair as \\( l_0 = r_0 \\oplus \\delta \\) and \\( l_1 = l_0 \\oplus \\Delta \\) from a correlated OT \\( (r_0, r_1 = r_0 \\oplus \\Delta) \\) and a fresh mask \\( \\delta \\), and answers the client's correction bit \\( b = c \\oplus y \\) with the single value \\( r_b \\oplus l_0 \\); in Naor-Reingold OPRF evaluation, where the client chooses between r and \\( r \\cdot a_j \\), a correlated OT combined with OT precomputation sends one message of the symmetric security parameter instead of two. In both cases online OT communication halves, and garbled circuits stay precomputable before the client's input is known.","statement_status":"source_normalized_statement","status":"published","title":"Correlated-OT precomputation that halves the online OT communication of precomputed garbled-circuit and Naor-Reingold OPRF evaluation in unbalanced PSI","work_id":"PSI-PAPER-2019-KRSSW","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/517","sections":[{"content":"Correlated-OT precomputation","heading":"Overview"},{"content":"In the base phase the parties run random correlated OTs by OT extension: the garbler, with input \\( \\Delta \\), learns \\( r_0 \\) and \\( r_1 = r_0 \\oplus \\Delta \\), and the evaluator, with a random choice c, learns \\( r_c \\) (§4.3, p. 8). Each precomputed circuit's input labels are \\( l_0 = r_0 \\oplus \\delta \\) and \\( l_1 = l_0 \\oplus \\Delta \\) with \\( \\delta \\) fresh per label. Online, the evaluator sends \\( b = c \\oplus y \\) and receives \\( B = r_b \\oplus l_0 \\), and \\( r_c \\oplus B \\) is the label for its input bit y in all four cases of \\( (c, b) \\) (§4.3, p. 8; Figure 1, p. 9). For NR-PSI the client's correction bit decides which precomputed random message the server treats as r and which masks the correlated message \\( r \\cdot a_j \\) (§4.4, p. 10).","heading":"Exact contribution"},{"content":"MPC-CONTRIB-2003-IKNP-OTEXT: the base phase runs correlated and random OTs by OT extension, which the paper introduces with IKNP (§3.1, p. 4); the implementation uses the correlated-OT extension of Keller, Orsini, and Scholl (§5.1, p. 12). MPC-CONTRIB-2008-FREEXOR: the GC-PSI variant depends on Free-XOR labels with a global offset (§4.3, p. 8). Beaver's OT precomputation (CRYPTO 1995), on which the technique builds, has no record in any topic (§3.1, p. 5; §4.3, p. 8).","heading":"Related records in other topics"}],"slug":"krssw19-correlated-ot-precomputation","status":"published","subtitle":"Mobile Private Contact Discovery at Scale","summary":"In unbalanced PSI whose client-side OPRF evaluations rely on OTs precomputed in an input-independent base phase, the online OT messages can come from correlated OTs: in garbled-circuit OPRF evaluation the garbler builds each input-wire label pair as \\( l_0 = r_0 \\oplus \\delta \\) and \\( l_1 = l_0 \\oplus \\Delta \\) from a correlated OT \\( (r_0, r_1 = r_0 \\oplus \\Delta) \\) and a fresh mask \\( \\delta \\), and answers the client's correction bit \\( b = c \\oplus y \\) with the single value \\( r_b \\oplus l_0 \\); in Naor-Reingold OPRF evaluation, where the client chooses between r and \\( r \\cdot a_j \\), a correlated OT combined with OT precomputation sends one message of the symmetric security parameter instead of two. In both cases online OT communication halves, and garbled circuits stay precomputable before the client's input is known.","tableRows":["PSI-CONSTRUCTION-2019-KRSSW-GC","PSI-CONSTRUCTION-2019-KRSSW-NR"],"title":"Correlated-OT precomputation that halves the online OT communication of precomputed garbled-circuit and Naor-Reingold OPRF evaluation in unbalanced PSI","type":"result","venue":"USENIX Security 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","keywords":["atomic-result","cuckoo-filter","filter-compression","filter-updates","false-positive-probability","precomputation","unbalanced-psi","private-contact-discovery"],"metadata":{"claim_slug":"cuckoo-filter-compression","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["cuckoo_filter"]},"historical_context":{"narrative":"In precomputed unbalanced PSI the server encrypts its entire user base under a PRF once and ships it to every client as a compact filter, so the size of that filter and of its daily updates decides whether the approach works on a phone plan. Resende and Aranha had used cuckoo filters with short tags, accepting a false-positive rate near one in eight thousand, and sent every update as a full elliptic-curve point. Kales and coauthors observed that empty entries need not be sent, that the position of a tag within its bucket carries no information, and that a tag plus one bucket index is enough to insert or delete. With longer tags the false-positive rate drops to about one in half a billion, while the filter shrinks and updates become four times smaller.","prior_boundary":"Resende and Aranha represented the server's encrypted set by a cuckoo filter with 16-bit tags, bucket size 3, and a false-positive probability of about \\( 2^{-13} \\), which the authors call impractical, and sent each updated element as a 256-bit compressed point on GLS-254 (§2, p. 4; §4.1, pp. 6-7). Kiss et al. used Bloom filters (§2, p. 4). Dictionary compression with LZMA, suggested for Bloom-filter updates, takes over 8 min to compress a filter for \\( 2^{28} \\) items (§4.1, p. 6).","significance_at_publication":"The setup transfer for \\( 2^{28} \\) server items is 1,072 MiB (Table 4, p. 13), and a filter at 10% occupancy, as in a fast-growing service, compresses 8.3 times (§4.1, p. 6). The encoding runs on the fly, while LZMA would be infeasible on a phone for regular updates (§4.1, pp. 6-7). The authors still name the filter size as the bottleneck for very large server sets (§4.6, p. 11).","technical_delta":"The filter is sent as a bit map of occupied entries plus the list of tags, or with a per-bucket tag count, since tag positions within a bucket do not matter (§4.1, p. 6). An update carries a tag and one bucket index, from which the client computes the other candidate bucket for relocations or deletion (§4.1, p. 7). Tags of 32 bits with bucket size 3 set the false-positive probability per item near \\( 2^{-29} \\) (§4.1, p. 6; Table 4, p. 13)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","keywords":["cuckoo-filter","filter-compression","filter-updates","false-positive-probability","precomputation","unbalanced-psi","private-contact-discovery"],"limitations":["the filter remains linear in the server set, \\( O(n_X) \\), about 1 GiB for \\( 2^{28} \\) items and about 8 GiB for \\( 2^{31} \\), and must be stored by the client (§4.6, p. 11)","the paper does not discuss what updates reveal; PSI-PAPER-2018-CHLR notes that in filter-based protocols of this kind the receiver learns how many items were inserted and removed and that deletions cannot be enforced (§8.3, p. 21 of that paper)"],"paper_id":"PSI-PAPER-2019-KRSSW","qualifiers":["the 30% figure is for load ≈66%, tag size 32 bits, and bucket size 3; sparser filters compress more (§4.1, p. 6)","the 59-bit update assumes \\( 2^{28} \\) items, 27-bit bucket indices, and 32-bit tags (§4.1, p. 7)","false-positive probabilities are per item; the authors note that one false positive per ten clients querying \\( 2^{10} \\) items follows from \\( 2^{-13} \\) (§4.1, p. 6)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-KRSSW § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 2); §2 (pp. 3-4); §3.4 (pp. 5-6); §3.5 (p. 6); §4.1 (pp. 6-7); §4.6 (p. 11); Table 4 (p. 13). IACR ePrint 2019/517, full version, PDF dated 2019-05-24.","primary_source_url":"https://eprint.iacr.org/2019/517","status":"section_checked"},"statement":"In unbalanced PSI where the server sends its set once as a cuckoo filter of PRF values, transmitting an occupancy bit per entry plus the nonempty tags, or the number of tags per bucket in \\( \\log_2(b + 1) \\) bits, \\( b \\) the bucket size, reduces the filter by about 30% at load ≈66% (from 6 MiB to 4.19 MiB for \\( 2^{20} \\) items with 32-bit tags and bucket size 3), and sending only a tag and one candidate bucket index per inserted or deleted item makes an update 59 bits for \\( 2^{28} \\) items instead of a 256-bit group element; 32-bit or 42-bit tags give false-positive probabilities of about \\( 2^{-29} \\) or \\( 2^{-39} \\) instead of about \\( 2^{-13} \\).","statement_status":"source_normalized_statement","status":"published","title":"Smaller transfer of the server set in precomputed unbalanced PSI: compressed cuckoo filters, 4.3x smaller updates, and false-positive rates near \\( 2^{-29} \\)","work_id":"PSI-PAPER-2019-KRSSW","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/517","sections":[{"content":"Compressed cuckoo filters","heading":"Overview"},{"content":"A cuckoo filter stores a v-bit tag of each item in one of two buckets of b entries; lookups compare tags in both candidate buckets, so equal tags cause false positives at a rate set mainly by v (§3.4, pp. 5-6). The compressed encoding sends an occupancy bit map and the stored tags, or a \\( \\log_2(b + 1) \\)-bit tag count per bucket followed by the tags (§4.1, p. 6). Updates send \\( (t_i, p_i) \\) for each changed item; the client inserts or deletes the tag at \\( p_i \\) or at \\( p_i \\oplus H(t_i) \\) (§4.1, p. 7; Figure 1, update phase, p. 9).","heading":"Exact contribution"}],"slug":"krssw19-smaller-transfer-of-the","status":"published","subtitle":"Mobile Private Contact Discovery at Scale","summary":"In unbalanced PSI where the server sends its set once as a cuckoo filter of PRF values, transmitting an occupancy bit per entry plus the nonempty tags, or the number of tags per bucket in \\( \\log_2(b + 1) \\) bits, \\( b \\) the bucket size, reduces the filter by about 30% at load ≈66% (from 6 MiB to 4.19 MiB for \\( 2^{20} \\) items with 32-bit tags and bucket size 3), and sending only a tag and one candidate bucket index per inserted or deleted item makes an update 59 bits for \\( 2^{28} \\) items instead of a 256-bit group element; 32-bit or 42-bit tags give false-positive probabilities of about \\( 2^{-29} \\) or \\( 2^{-39} \\) instead of about \\( 2^{-13} \\).","tableRows":["PSI-CONSTRUCTION-2019-KRSSW-GC","PSI-CONSTRUCTION-2019-KRSSW-NR"],"title":"Smaller transfer of the server set in precomputed unbalanced PSI: compressed cuckoo filters, 4.3x smaller updates, and false-positive rates near \\( 2^{-29} \\)","type":"result","venue":"USENIX Security 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","keywords":["atomic-result","lowmc","garbled-circuits","oprf","and-gate-count","aes-128","key-schedule","unbalanced-psi","precomputation"],"metadata":{"claim_slug":"lowmc-oprf","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["garbled_circuits","oprf"]},"historical_context":{"narrative":"In the garbled-circuit flavor of precomputed unbalanced PSI, the server sends one garbled PRF circuit per client contact before the contacts are known, so the PRF's AND-gate count sets the cost of the base phase. Every implementation had used AES-128, with about five thousand AND gates, and LowMC had been named only as a possibility. Kales and coauthors chose LowMC parameters for this setting: a single S-box per round and many rounds, which costs nothing extra in Yao's constant-round protocol, and a data-complexity bound tied to how many queries the service will ever answer. The circuit shrinks to about six hundred AND gates, the key schedule is garbled once because the key never changes, and precomputation traffic falls roughly sevenfold.","prior_boundary":"All earlier GC-PSI implementations evaluated AES-128, whose circuit with the Boyar-Peralta S-box has 5,120 AND gates without key schedule (§4.2, p. 7). Kiss et al. had mentioned LowMC as a possible replacement without fixing parameters (§1.1, p. 2; §4.2, p. 7). With Free-XOR and half-gates only AND gates cost communication, two \\( \\kappa \\)-bit labels each (§4.2, p. 7; §5.2, p. 12).","significance_at_publication":"In the base phase, which sends the garbled circuits, LowMC reduces communication 7.4 times relative to AES while the online phase stays comparable; the one-time server setup becomes slower than hardware-accelerated AES (§6.1, pp. 12-13; Tables 3-4, p. 13). The \\( 2^{64} \\) data complexity allows \\( 2^{20} \\) contact discoveries of \\( 2^{10} \\) items for each of \\( 2^{28} \\) clients (§4.2, p. 7).","technical_delta":"The authors compare five LowMC instances under the round formula updated after recent cryptanalysis and recommend instance (3), with one S-box per round and 624 AND gates, accepting 208 rounds because Yao's protocol has constant round complexity (§4.2, pp. 7-8; Table 2, p. 8). Data complexity \\( 2^{64} \\) is matched to the number of queries the service allows, and bundling all client circuits lets the fixed key schedule be garbled once, saving about 2 KiB per further item (§4.2, p. 7)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","keywords":["lowmc","garbled-circuits","oprf","and-gate-count","aes-128","key-schedule","unbalanced-psi","precomputation"],"limitations":["the one-time server setup takes 1,869.13 s with LowMC against 23.94 s with AES for \\( 2^{28} \\) items, because AES has hardware support (Table 4, p. 13; §6.1, p. 13)","the number of client queries must be bounded to stay within the data complexity (§4.2, p. 7)"],"paper_id":"PSI-PAPER-2019-KRSSW","qualifiers":["security of the OPRF rests on LowMC instance (3) being a secure PRF up to data complexity \\( 2^{64} \\), with rounds from the LowMC designers' updated formula (§4.2, pp. 7-8)","the 8.2x figure counts AND gates; the measured base-phase communication ratio is 7.4x (abstract, p. 1; §6.1, p. 12)","for small data complexity the authors recommend instance (4), with \\( 2^{32} \\) and 576 AND gates, which needs re-keying once the bound is reached (§4.2, pp. 7-8)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-KRSSW § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 2); §4.2 (pp. 7-8); Table 2 (p. 8); §6.1 (pp. 12-13); Tables 3-4 (p. 13). IACR ePrint 2019/517, full version, PDF dated 2019-05-24.","primary_source_url":"https://eprint.iacr.org/2019/517","status":"section_checked"},"statement":"Instantiating the PRF evaluated by garbled circuits in GC-PSI with the LowMC instance of block and key size 128, one S-box per round, data complexity \\( 2^{64} \\), and 208 rounds gives 624 AND gates per client item, against 5,120 for AES-128 without key schedule (8.2x fewer); since the server's key is fixed, the key schedule is garbled once for all client circuits, and the data-complexity bound is enforced by limiting client queries. In the authors' measurement the base-phase communication for \\( 2^{10} \\) client items falls from 162.52 MiB to 22.01 MiB.","statement_status":"source_normalized_statement","status":"published","title":"LowMC instead of AES-128 as the PRF of the garbled-circuit OPRF in unbalanced PSI: 8.2x fewer AND gates per client item","work_id":"PSI-PAPER-2019-KRSSW","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/517","sections":[{"content":"LowMC as the garbled OPRF","heading":"Overview"},{"content":"Table 2 (p. 8) lists LowMC instances with block and key size 128: (1) 42 S-boxes and 13 rounds, 1,638 AND gates; (2) 31 S-boxes and 13 rounds, 1,209; (3) one S-box and 208 rounds, 624; (4) one S-box, data complexity \\( 2^{32} \\), 192 rounds, 576; (5) one S-box, data complexity \\( 2^{128} \\), 287 rounds, 861; and AES-128 with 5,120. Instance (3) is used in all experiments (§6.1, p. 12). Other MPC- and FHE-oriented ciphers are set aside: three of them are stream ciphers designed for FHE ciphertext expansion, and MiMC works over large prime fields, which does not fit Boolean garbled circuits (§4.2, p. 8).","heading":"Exact contribution"},{"content":"MPC-CONTRIB-1982-YAO-2PC and MPC-CONTRIB-2015-HALFGATES: the OPRF is evaluated by Yao's garbled circuits with Free-XOR and half-gates, so AND gates determine the communication (§3.2, p. 5; §5.2, p. 12). SYM-RESULT-2001-AES-AES-128-BIT-BLOCK-CIPHER-STANDARD: AES-128 is the replaced PRF and the baseline of Table 2 (§4.2, p. 7). MPC-PAPER-2009-PRACTICAL2PC: OPRF evaluation by garbled circuits follows Pinkas, Schneider, Smart, and Williams (§4.3, p. 8). LowMC (Albrecht et al., EUROCRYPT 2015) has no record in any topic.","heading":"Related records in other topics"}],"slug":"krssw19-lowmc-instead-of-aes","status":"published","subtitle":"Mobile Private Contact Discovery at Scale","summary":"Instantiating the PRF evaluated by garbled circuits in GC-PSI with the LowMC instance of block and key size 128, one S-box per round, data complexity \\( 2^{64} \\), and 208 rounds gives 624 AND gates per client item, against 5,120 for AES-128 without key schedule (8.2x fewer); since the server's key is fixed, the key schedule is garbled once for all client circuits, and the data-complexity bound is enforced by limiting client queries. In the authors' measurement the base-phase communication for \\( 2^{10} \\) client items falls from 162.52 MiB to 22.01 MiB.","tableRows":["PSI-CONSTRUCTION-2019-KRSSW-GC"],"title":"LowMC instead of AES-128 as the PRF of the garbled-circuit OPRF in unbalanced PSI: 8.2x fewer AND gates per client item","type":"result","venue":"USENIX Security 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION","keywords":["atomic-result","android","armv8","arm-cryptography-extensions","fixed-key-aes","malicious-client","libote","p-256","private-contact-discovery","signal","unbalanced-psi"],"metadata":{"claim_slug":"mobile-implementation","contribution_kind":"implementation_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious","semi_honest"],"output":["intersection"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["garbled_circuits","ot_extension","oprf","cuckoo_filter"]},"historical_context":{"narrative":"Private contact discovery had a protocol design that suited phones, with an input-independent precomputation, a one-time transfer of the server's encrypted user base, and a cheap online phase, but its only phone implementation ran in Java with semi-honest security and needed close to a minute to check a single contact. Kales and coauthors rewrote both variants natively for ARMv8, garbling with the hardware AES instructions of recent phones and running the algebraic variant on an elliptic curve. Malicious clients came almost for free, because a client only sends oblivious-transfer messages, so swapping in actively secure transfers suffices. A thousand contacts against a quarter of a billion users then took about three seconds on WiFi, and the protocols ran inside a modified Signal client.","prior_boundary":"Kiss et al. gave the only unbalanced PSI implementation on real phones, in Java and with semi-honest security; their fastest protocol that can easily be made secure against malicious clients needed more than 52 s on WiFi to check one contact against \\( 2^{20} \\) entries, and one garbled AES-128 circuit took over a second (§1, p. 2; §5, p. 11). The FHE-based protocols of Chen et al. had been evaluated only on servers in a 10 Gbit/s network (§6.2, p. 13).","significance_at_publication":"For 1024 contacts the combined base and online time improves by more than 300 times (GC-PSI) and 30 times (NR-PSI) over the implementations of Kiss et al. run in the same environment, with 7.5 and 10.9 times less communication (Table 6, p. 14). A prototype was integrated into the Signal Android client (§1.1, p. 3; Appendix C, p. 19), although the authors state that Signal's stated requirements for a billion users are not yet met (§7, p. 14).","technical_delta":"Garbling uses fixed-key AES through the ARM Cryptography Extensions, which speed AES up 35 times, and NEON registers for 128-bit labels; NR-PSI runs over P-256, which shrinks online values 8 times relative to a finite field; libOTe is ported to ARMv8 (§5.1-5.3, pp. 11-12). Because the client sends only OT messages and correction bits, maliciously secure base OTs and OT extension suffice for malicious clients (§4.5, pp. 10-11; §5.1, pp. 11-12)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION","keywords":["android","armv8","arm-cryptography-extensions","fixed-key-aes","malicious-client","libote","p-256","private-contact-discovery","signal","unbalanced-psi"],"limitations":["the server setup takes 52,332.38 s for ECC-NR-PSI and 1,869.13 s for LowMC-GC-PSI on \\( 2^{28} \\) items, single-threaded (Table 4, p. 13)","enumeration attacks by repeated queries are not prevented; the authors recommend rate limiting (§4.5, p. 11)","a malicious server can learn about non-matching client items whenever the client reveals its intersection to the server, so a semi-honest server is assumed (§4.5, p. 11)"],"paper_id":"PSI-PAPER-2019-KRSSW","qualifiers":["malicious clients and a semi-honest server; security is argued in prose, with no simulation proof (§4.5, pp. 10-11)","the reported 2.92 s and 6.53 s are base plus online time (Table 6, p. 14), which the abstract calls the online phase (p. 1)","server on an Intel Core i7-4600U, client a Google Pixel XL 2, one thread each; WiFi with about 230 Mbit/s and 70 ms RTT, LTE with 42 Mbit/s down, 4 Mbit/s up, and 80 ms RTT; 128-bit items (§6, p. 12)","the numbers for Kiss et al. come from running their implementations in the authors' environment (Table 6, p. 14)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-KRSSW § Contributions","primary_source":"Abstract (p. 1); §1 (pp. 1-2); §1.1 (pp. 2-3); §4.5 (pp. 10-11); §5 (pp. 11-12); §6 (pp. 12-14); Tables 3-6 (pp. 13-14); §7 (p. 14); Appendices C-D (pp. 19-20); Table 8 (p. 20). IACR ePrint 2019/517, full version, PDF dated 2019-05-24.","primary_source_url":"https://eprint.iacr.org/2019/517","status":"section_checked"},"statement":"C/C++ implementations of precomputed LowMC-GC-PSI and ECC-NR-PSI for Android, using ARMv8 Cryptography Extensions for fixed-key AES garbling, the P-256 curve for the Naor-Reingold PRF, and an ARMv8 port of libOTe with Chou-Orlandi base OTs and Keller-Orsini-Scholl OT extension, are secure against malicious clients when the server is semi-honest, as argued in prose; checking 1024 client contacts against \\( 2^{28} \\) server items takes 2.92 s on WiFi and 6.53 s on LTE of base plus online time with 6.07 MiB of communication for ECC-NR-PSI, after a one-time 1,072 MiB filter transfer, and a garbled AES-128 circuit is evaluated more than 1,000 times faster than in the earlier Java implementation of Kiss et al.","statement_status":"source_normalized_statement","status":"published","title":"Native smartphone implementation of precomputed unbalanced PSI with malicious-client security: 1024 contacts against \\( 2^{28} \\) users in about 3 s","work_id":"PSI-PAPER-2019-KRSSW","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/517","sections":[{"content":"Smartphone implementation of precomputed unbalanced PSI","heading":"Overview"},{"content":"Both protocols follow the four phases of precomputed unbalanced PSI: an input-independent base phase, a setup phase in which the server sends a compressed cuckoo filter of PRF values of its whole set, an online phase of OPRF evaluations on the client's items followed by local filter lookups, and an update phase (§3.5, p. 6). The implementation measures each phase separately (Tables 3-5, p. 13) and compares with the Android implementations of Kiss et al. (Table 6, p. 14) and, on x86 hardware, with the FHE-based and Diffie-Hellman protocols using numbers taken from Chen et al. (Appendix D, Table 8, p. 20).","heading":"Exact contribution"},{"content":"MPC-CONTRIB-2003-IKNP-OTEXT: OT extension, which the paper introduces with IKNP (§3.1, p. 4); the implementation uses the actively secure extension of Keller, Orsini, and Scholl, which has no record in any topic (§5.1, p. 12). MPC-CONTRIB-2008-FREEXOR and MPC-CONTRIB-2015-HALFGATES: the garbling scheme of the GC-PSI implementation (§5.2, p. 12).","heading":"Related records in other topics"}],"slug":"krssw19-native-smartphone-implementa","status":"published","subtitle":"Mobile Private Contact Discovery at Scale","summary":"C/C++ implementations of precomputed LowMC-GC-PSI and ECC-NR-PSI for Android, using ARMv8 Cryptography Extensions for fixed-key AES garbling, the P-256 curve for the Naor-Reingold PRF, and an ARMv8 port of libOTe with Chou-Orlandi base OTs and Keller-Orsini-Scholl OT extension, are secure against malicious clients when the server is semi-honest, as argued in prose; checking 1024 client contacts against \\( 2^{28} \\) server items takes 2.92 s on WiFi and 6.53 s on LTE of base plus online time with 6.07 MiB of communication for ECC-NR-PSI, after a one-time 1,072 MiB filter transfer, and a garbled AES-128 circuit is evaluated more than 1,000 times faster than in the earlier Java implementation of Kiss et al.","tableRows":["PSI-CONSTRUCTION-2019-KRSSW-GC","PSI-CONSTRUCTION-2019-KRSSW-NR"],"title":"Native smartphone implementation of precomputed unbalanced PSI with malicious-client security: 1024 contacts against \\( 2^{28} \\) users in about 3 s","type":"result","venue":"USENIX Security 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","keywords":["atomic-result","opprf","programmable-prf","batched-opprf","polynomial-interpolation","correlated-targets","hint"],"metadata":{"claim_slug":"batched-opprf","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"parties":["two_party"],"security_model":["standard_model"],"technique":["opprf","batched_oprf"]},"historical_context":{"narrative":"An oblivious programmable PRF lets one party fix the outputs on chosen inputs while the other evaluates it without learning which inputs were chosen. In its original form each programmed input needed its own random target and its own polynomial coefficient, so programming every item that simple hashing places in a bin cost as much as the largest bin allowed. Pinkas, Schneider, Tkachenko, and Yanai observed that a single query suffices in circuit-based PSI, and that the targets may then be correlated, even identical, without loss of security. They also merged the polynomials of all bins into one, so the hint grows with the total number of items rather than with the number of bins times the maximum load. Programming every bin then costs linear communication overall.","prior_boundary":"The OPPRF was introduced by Kolesnikov, Matania, Pinkas, Rosulek, and Trieu with a polynomial-based construction and a security definition that allows many queries but requires an independent target per programmed point (§1, p. 2; §3.2, p. 12). One standalone OPPRF per bin costs communication linear in the number of programmed values, which for bins of maximal size \\( O(\\log n / \\log \\log n) \\) gives \\( O(n \\log n / \\log \\log n) \\) overall (§1.1, p. 3; §3.3, p. 13).","significance_at_publication":"The total hint size becomes \\( K \\cdot n \\) coefficients for cuckoo hashing with K hash functions (footnote 6, p. 13), at most 3% of the protocol's communication (§7.3, p. 24), which removes the logarithmic factor that bounded earlier circuit-based PSI (§1.1, pp. 3-4).","technical_delta":"The definition is changed to one query but correlated targets, including all targets equal (Definition 1, p. 11; §3.2, p. 12), which lets every item of a bin be programmed to the same value. The hints of all bins are merged into one polynomial over all programmed points, keyed per bin (Definition 2 and Construction 4, pp. 13-14), and security is reduced to a batch PRF (Theorem 5, pp. 14-15)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","keywords":["opprf","programmable-prf","batched-opprf","polynomial-interpolation","correlated-targets","hint"],"limitations":["the definition is weaker than the earlier one in allowing a single query (§3.2, p. 12)","interpolating a polynomial of degree \\( O(n) \\) costs \\( O(n^2) \\) or \\( O(n \\log^2 n) \\) operations, which the protocol reduces by splitting bins into mega-bins (§4.3, p. 18)"],"paper_id":"PSI-PAPER-2019-PSTY","qualifiers":["one query per programmed function; querying twice could break security when targets are correlated (§3.2, p. 11)","the sets \\( X_1, \\ldots, X_\\beta \\) must be disjoint; the protocol appends the bin index to each item (Definition 2, p. 14; Protocol 9, p. 17)","security reduces to a pseudorandom function (Theorems 3 and 5, pp. 12-15) and is proved in the \\( F_{\\mathrm{OPRF}} \\)-hybrid model (Theorem 8, p. 15)","semi-honest parties (§2.2, p. 8)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-PSTY § Contributions","primary_source":"§1 (p. 2); §1.1 (pp. 3-4); §3.1-3.2 with Definition 1, Construction 2, and Theorem 3 (pp. 10-13); §3.3 with Definition 2, Construction 4, and Theorem 5 (pp. 13-15); §3.4 with Theorem 8, Functionality 6, and Protocol 7 (pp. 15-16); §7.3 (p. 24). IACR ePrint 2019/241, PDF dated 2019-02-28.","primary_source_url":"https://eprint.iacr.org/2019/241","status":"theorem_checked"},"statement":"A one-time programmable PRF publishes as hint the polynomial interpolated through the points \\( (x, F'_k(x) \\oplus v) \\) for each programmed input x with target \\( v \\), so that a single evaluation returns \\( v \\) on programmed inputs and a pseudorandom value elsewhere even when the targets are correlated (Construction 2, Theorem 3); interpolating one polynomial through the points of \\( \\beta \\) such functions with independent keys gives a hint of \\( \\kappa M \\) bits for \\( M \\) programmed points in total (Construction 4, Theorem 5), and combined with \\( \\beta \\) one-time OPRF instances it securely realizes a batched oblivious programmable PRF in the \\( F_{\\mathrm{OPRF}} \\)-hybrid model (Protocol 7, Theorem 8), so the hints for bins of \\( O(\\log n / \\log \\log n) \\) items cost \\( O(\\kappa n) \\) in total instead of \\( O(\\kappa n \\log n / \\log \\log n) \\).","statement_status":"source_normalized_statement","status":"published","title":"Batched OPPRF with a single polynomial hint of \\( \\kappa M \\) bits over all bins, \\( M \\) the number of programmed points, from a one-time programmable PRF with correlated targets","work_id":"PSI-PAPER-2019-PSTY","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/241","sections":[{"content":"Batched OPPRF","heading":"Overview"},{"content":"In Protocol 7 (p. 16) the parties run \\( \\beta \\) one-time OPRF instances in which the sender receives the keys \\( k_j \\) and the receiver learns \\( F'(k_j, x_j) \\); the sender then sends the batched hint polynomial \\( P \\), and the receiver outputs \\( F'(k_j, x_j) \\oplus P(x_j) \\). The receiver learns \\( t_j \\) when \\( x_j \\) is a programmed point of bin j and a pseudorandom value otherwise (Functionality 6, p. 16).","heading":"Exact contribution"},{"content":"None: the OPPRF and the one-time OPRF are PSI-specific mechanisms.","heading":"Related records in other topics"}],"slug":"psty19-batched-opprf-with-one","status":"published","subtitle":"Efficient Circuit-based PSI with Linear Communication","summary":"A one-time programmable PRF publishes as hint the polynomial interpolated through the points \\( (x, F'_k(x) \\oplus v) \\) for each programmed input x with target \\( v \\), so that a single evaluation returns \\( v \\) on programmed inputs and a pseudorandom value elsewhere even when the targets are correlated (Construction 2, Theorem 3); interpolating one polynomial through the points of \\( \\beta \\) such functions with independent keys gives a hint of \\( \\kappa M \\) bits for \\( M \\) programmed points in total (Construction 4, Theorem 5), and combined with \\( \\beta \\) one-time OPRF instances it securely realizes a batched oblivious programmable PRF in the \\( F_{\\mathrm{OPRF}} \\)-hybrid model (Protocol 7, Theorem 8), so the hints for bins of \\( O(\\log n / \\log \\log n) \\) items cost \\( O(\\kappa n) \\) in total instead of \\( O(\\kappa n \\log n / \\log \\log n) \\).","tableRows":["PSI-CONSTRUCTION-2019-PSTY-ADVANCED","PSI-CONSTRUCTION-2019-PSTY-BASIC","PSI-CONSTRUCTION-2019-PSTY-NO-STASH"],"title":"Batched OPPRF with a single polynomial hint of \\( \\kappa M \\) bits over all bins, \\( M \\) the number of programmed points, from a one-time programmable PRF with correlated targets","type":"result","venue":"EUROCRYPT 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","keywords":["atomic-result","circuit-based-psi","linear-communication","opprf","stash","dual-execution","stash-less-cuckoo-hashing","psi-cat"],"metadata":{"claim_slug":"linear-communication","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["circuit"],"parties":["two_party"],"security_model":["standard_model"],"set_size_regime":["balanced"],"technique":["opprf","cuckoo_hashing","gmw"]},"historical_context":{"narrative":"Circuit-based PSI had come within a slowly growing factor of linear cost, but two obstacles kept it there: the party that copies each item into all its candidate bins needs bins with room for a logarithmic number of items, and the cuckoo-hashing party has a stash whose items must be compared with everything. Pinkas, Schneider, Tkachenko, and Yanai removed the first obstacle by moving the work out of the circuit: an oblivious programmable PRF maps all of a bin's items to one secret value, so the circuit checks a single equality per bin. They removed the second either by running the protocol again with roles swapped on the stashed items or by using three hash functions and no stash. Communication became linear in the set size, \\( O(n\\kappa) \\), and the measured cost fell several times.","prior_boundary":"Circuit-Phasing needed \\( O(n \\log n / \\log \\log n) \\) comparisons because the simple-hashing party fills bins of up to \\( O(\\log n / \\log \\log n) \\) items, and the private set membership protocol of Ciampi and Orlandi kept that overall communication (§1.1, p. 3). Two-dimensional cuckoo hashing reached \\( \\omega(n) \\) comparisons, with \\( s \\cdot n \\) of them spent on a stash of size \\( \\omega(1) \\) (§1, p. 2; §5, p. 19), and the linear protocol of Falk, Noble, and Ostrovsky achieved \\( O(n) \\) only when the output is the intersection itself (§5, p. 19).","significance_at_publication":"The authors call it the first circuit-based PSI with linear communication, matching the obvious lower bound on the number of comparisons (abstract, p. 1; §1.1, p. 4). The stash-less protocol ran 2.8 to 4.2 times faster in the LAN and 3.9 to 5.8 times faster in the WAN setting than the 2D cuckoo-hashing protocol (Table 5, p. 27).","technical_delta":"Circuit-Phasing's hashing is kept but the per-bin sub-circuit of S comparisons is replaced by a batched OPPRF whose output the circuit compares with one target per bin (§1.1, p. 3; Protocol 9, p. 17). The stash is handled by dual execution, comparing \\( X_T \\times Y \\), \\( X_S \\times Y_T \\), and \\( X_S \\times Y_S \\) in three groups of circuit sections (§5.1, pp. 19-20; Protocol 10), or avoided with \\( K = 3 \\) hash functions, whose cost the OPPRF makes independent of the bin load (§5.2, pp. 20-21)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","keywords":["circuit-based-psi","linear-communication","opprf","stash","dual-execution","stash-less-cuckoo-hashing","psi-cat"],"limitations":["the \\( O(n) \\) bound concerns symmetric functions; non-symmetric functions or the intersection itself need an \\( O(n \\log n) \\) shuffle (§1.3, p. 5)","the stash-less variant has no analytic failure bound (§5, p. 19)","only the stash-less protocol was implemented; times for the other variants are estimates (§7.4, p. 26)","the stash-less protocol was 41 times slower than BaRK-OPRF PSI for \\( n = 2^{20} \\) in the WAN setting (§7.4, p. 27)"],"paper_id":"PSI-PAPER-2019-PSTY","qualifiers":["semi-honest parties (§2.2, p. 8)","both sets have \\( n \\) items of bitlength \\( \\sigma \\); outputs \\( f(X \\cap Y) \\) to both parties for a symmetric function \\( f \\) (§1, p. 1; §2.1, p. 8; §1.3, p. 5)","Protocol 10 assumes a stash of size \\( O(\\log n) \\) (§5.1, p. 19)","the stash-less parameters \\( K = 3 \\) and \\( \\beta = 1.27n \\) rely on the empirical failure analysis of Pinkas, Schneider, and Zohner (§5.2, p. 20; §7.1, p. 22)","OPPRF outputs are truncated to \\( \\gamma = 40 + \\log_2 \\beta \\) bits, \\( \\beta \\) the number of bins, so a false positive occurs with probability at most \\( \\beta \\cdot 2^{-\\gamma} \\) (§4.2, p. 18; §7.1, p. 22)","security follows from that of the OPPRF and the two-party computation functionality (§4.1, p. 17; §5.1, p. 20)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-PSTY § Contributions","primary_source":"Abstract (p. 1); §1 (pp. 1-2); §1.1 (pp. 3-4); §1.5 (pp. 7-8); §4.1-4.2 with Protocol 9 (pp. 16-18); §5 with Protocol 10 (pp. 19-21); §7.1 and Table 1 (p. 22); §7.3 and Table 3 (pp. 24-25); §7.4 and Table 5 (pp. 26-28). IACR ePrint 2019/241, PDF dated 2019-02-28.","primary_source_url":"https://eprint.iacr.org/2019/241","status":"section_checked"},"statement":"Against semi-honest parties with \\( n \\) items each, letting the sender program a batched OPPRF so that all of its items in a cuckoo bin map to one random target lets the circuit test a single equality per bin; handling the receiver's stash by a second OPPRF phase with the roles reversed, restricted to the stashed items, plus \\( s^2 \\) comparisons between the two stashes (Protocol 10) yields \\( O(n) \\) comparisons and \\( O(n\\kappa) \\) communication with failure probability negligible in the statistical security parameter, and the stash-less variant with \\( K = 3 \\) hash functions and \\( 1.27n \\) bins, whose failure is below \\( 2^{-40} \\) by earlier experiments, needs 2,540 MB for \\( n = 2^{20} \\) and 2.6 to 12.8 times less communication than two-dimensional cuckoo hashing for \\( n = 2^{12} \\) to \\( 2^{20} \\).","statement_status":"source_normalized_statement","status":"published","title":"Circuit-based PSI with \\( O(n) \\) communication through one OPPRF comparison per bin, semi-honest two-party","work_id":"PSI-PAPER-2019-PSTY","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/241","sections":[{"content":"Circuit-based PSI with linear communication","heading":"Overview"},{"content":"In Protocol 9 (p. 17) the receiver P1 cuckoo-hashes its items into \\( \\beta = 2(1 + \\varepsilon)n \\) bins and P2 places each item in both candidate bins; the batched OPPRF gives P1 the value \\( y^*_j \\), equal to P2's target \\( t_j \\) when P1's item in bin j is among P2's items there; the circuit compares the first \\( \\gamma \\) bits of \\( y^*_j \\) and \\( t_j \\) per bin and every stashed item with all of P2's items. Protocol 10 (p. 20) removes the stash comparisons with a role-reversed second phase. The stash-less version uses \\( K = 3 \\) hash functions, so the circuit compares \\( 1.27n \\) values; the OPRF and the hint polynomials are about 4% of its communication (Table 3, p. 25).","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-GMW: the circuit is evaluated with GMW (Table 5 caption, p. 27; §2.3, pp. 8-9). MPC-PAPER-2015-ABY and MPC-CONTRIB-2015-ABY-MIXED: the secure circuit evaluation uses the ABY framework (§7.4, p. 27). MPC-PAPER-1987-GMW: GMW protocol, cited as [GMW87] (§2.3, p. 9; §7.3, p. 25).","heading":"Related records in other topics"}],"slug":"psty19-linear-communication-circuit","status":"published","subtitle":"Efficient Circuit-based PSI with Linear Communication","summary":"Against semi-honest parties with \\( n \\) items each, letting the sender program a batched OPPRF so that all of its items in a cuckoo bin map to one random target lets the circuit test a single equality per bin; handling the receiver's stash by a second OPPRF phase with the roles reversed, restricted to the stashed items, plus \\( s^2 \\) comparisons between the two stashes (Protocol 10) yields \\( O(n) \\) comparisons and \\( O(n\\kappa) \\) communication with failure probability negligible in the statistical security parameter, and the stash-less variant with \\( K = 3 \\) hash functions and \\( 1.27n \\) bins, whose failure is below \\( 2^{-40} \\) by earlier experiments, needs 2,540 MB for \\( n = 2^{20} \\) and 2.6 to 12.8 times less communication than two-dimensional cuckoo hashing for \\( n = 2^{12} \\) to \\( 2^{20} \\).","tableRows":["PSI-CONSTRUCTION-2019-PSTY-ADVANCED","PSI-CONSTRUCTION-2019-PSTY-NO-STASH"],"title":"Circuit-based PSI with \\( O(n) \\) communication through one OPPRF comparison per bin, semi-honest two-party","type":"result","venue":"EUROCRYPT 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2019-PSTY-PAYLOAD","keywords":["atomic-result","payload","associated-data","opprf","circuit-based-psi","intersection-sum"],"metadata":{"claim_slug":"payload","contribution_kind":"capability_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["circuit"],"parties":["two_party"],"technique":["opprf","cuckoo_hashing"]},"historical_context":{"narrative":"Many uses of circuit-based PSI need more than the matching identifiers: an advertiser and a merchant want the total spent by common customers, so each item carries a value that must reach the circuit only when it matches. In the OPPRF approach a bin collapses all of the sender's items to one secret value, which leaves no room for their individual payloads. Pinkas, Schneider, Tkachenko, and Yanai added a second programmable PRF in which each item's target is the bin's mask combined with that item's payload. The receiver's output for a matching item therefore carries the right payload under a mask that only the sender knows and inputs to the circuit, while the circuit still performs one comparison per bin.","prior_boundary":"Circuit-Phasing and the private set membership approach of Ciampi and Orlandi did not consider payloads (§1.1, p. 4). Two-dimensional cuckoo hashing handles payloads naturally because each comparison involves one item from each party, but the basic OPPRF protocol maps all of a bin's items to one output and cannot encode their different payloads in one value (§6, p. 21).","significance_at_publication":"It supports functions of data associated with intersecting items, such as aggregate revenue over common users, which the authors list among their contributions as unsupported by the Phasing circuit (§1.5, p. 7; §1.2, pp. 4-5).","technical_delta":"A second batched OPPRF uses non-equal targets, \\( \\widetilde{t}_j \\) XORed with each item's payload, so the receiver's output for a matching item hides exactly that item's payload under \\( \\widetilde{t}_j \\), which the sender inputs to the circuit (§6, p. 21)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2019-PSTY-PAYLOAD","keywords":["payload","associated-data","opprf","circuit-based-psi","intersection-sum"],"limitations":["the section describes the payload variant for the cuckoo table and does not discuss stashed items separately (§6, pp. 21-22)","no measurement of the payload variant is reported (§7, pp. 22-28)"],"paper_id":"PSI-PAPER-2019-PSTY","qualifiers":["all payloads have the same length \\( \\delta \\) (§6, p. 21)","semi-honest parties (§2.2, p. 8)","the circuit has \\( O(n(\\sigma + \\rho)) \\) input wires for items of \\( \\sigma \\) bits, \\( \\rho \\) the payload length in bits (§2.1, p. 8)"],"source_locator":{"dossier_section":"PSI-PAPER-2019-PSTY § Contributions","primary_source":"§1.1 (p. 4); §1.2 (pp. 4-5); §1.5 (p. 7); §2.1 (p. 8); §6 (pp. 21-22). IACR ePrint 2019/241, PDF dated 2019-02-28.","primary_source_url":"https://eprint.iacr.org/2019/241","status":"section_checked"},"statement":"In OPPRF-based circuit-PSI, where the sender maps several items with different payloads to one bin, a second batched OPPRF in which the sender programs each item y of bin j to the target \\( \\widetilde{t}_j \\oplus V(y) \\) lets the receiver feed its output \\( \\widetilde{y}_j \\) into the circuit, which forwards the receiver's item and payload and the sender's payload \\( \\widetilde{y}_j \\oplus \\widetilde{t}_j \\) to the function sub-circuit exactly when the per-bin equality test succeeds; the number of comparisons and the asymptotic complexity stay those of the protocol without payloads.","statement_status":"source_normalized_statement","status":"published","title":"Payloads of both parties in OPPRF-based circuit-PSI through a second batched OPPRF, at the asymptotic cost of the basic protocol","work_id":"PSI-PAPER-2019-PSTY","year":2019},"primaryUrl":"https://eprint.iacr.org/2019/241","sections":[{"content":"Payloads in OPPRF-based circuit-PSI","heading":"Overview"},{"content":"For bin j the receiver inputs its item, its own payload U(item), and the two OPPRF outputs \\( y^*_j \\) and \\( \\tilde y_j \\); the sender inputs \\( t_j \\) and \\( \\tilde t_j \\). If \\( y^*_j = t_j \\) the circuit forwards the item, U(item), and \\( \\tilde y_j \\oplus \\tilde t_j \\), which equals the sender's payload V(item) (§6, p. 21). The efficiency is that of the basic protocol (§6, p. 22).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"psty19-payloads-of-both-parties","status":"published","subtitle":"Efficient Circuit-based PSI with Linear Communication","summary":"In OPPRF-based circuit-PSI, where the sender maps several items with different payloads to one bin, a second batched OPPRF in which the sender programs each item y of bin j to the target \\( \\widetilde{t}_j \\oplus V(y) \\) lets the receiver feed its output \\( \\widetilde{y}_j \\) into the circuit, which forwards the receiver's item and payload and the sender's payload \\( \\widetilde{y}_j \\oplus \\widetilde{t}_j \\) to the function sub-circuit exactly when the per-bin equality test succeeds; the number of comparisons and the asymptotic complexity stay those of the protocol without payloads.","title":"Payloads of both parties in OPPRF-based circuit-PSI through a second batched OPPRF, at the asymptotic cost of the basic protocol","type":"result","venue":"EUROCRYPT 2019","year":2019,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2019-PSTY-PAYLOAD"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","keywords":["atomic-result","intersection-sum","cardinality","diffie-hellman","pohlig-hellman","paillier","damgard-jurik","deployment","ad-conversion"],"metadata":{"claim_slug":"ddh-intersection-sum","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["cardinality","sum"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["diffie_hellman","additively_homomorphic_encryption"]},"historical_context":{"narrative":"Measuring ad conversions requires two companies to learn how many users both saw an ad and bought, and how much those users spent, without exchanging customer lists. Commutative Diffie-Hellman masking had long answered the first half: hashed identifiers raised to both parties' secret exponents can be compared, and shuffling hides which ones matched. Ion and colleagues at Google attached an additively homomorphic encryption of each purchase value to the masked identifier, so the party that finds the matches can add the corresponding ciphertexts without learning any individual value, and only the holder of the key learns the total. The protocol is simple, uses widely deployed primitives, and keeps communication small, which the authors identify as the dominant monetary cost in batch computation between companies.","prior_boundary":"The Diffie-Hellman set-intersection protocol of Meadows computes the intersection, and Huberman, Franklin, and Hogg added a shuffle so that only its size is learned (§3.1, p. 5; §4.2, p. 8). Neither aggregates values attached to the intersecting items (§3.1, p. 5).","significance_at_publication":"The protocol had been used in practice for several years to attribute aggregate ad conversions (abstract and §1, p. 1); with Paillier encryption a run on 100,000 items per party cost 0.084 US cents in the authors' cost model, and it was 20 to 30 times cheaper in that model than the cheapest garbled-circuit protocol compared (§1, p. 3; Table 2, p. 8; §5.3, p. 12; §6, p. 13).","technical_delta":"The party holding values sends additively homomorphic encryptions of them alongside its doubly masked identifiers, and the other party sums the ciphertexts whose identifiers match in the shuffled intersection (§3.1, p. 5; Figure 2, p. 6). Security against each party is proved by simulation from the intersection size, and for P2 also the sum (Theorems 1-2, p. 6; Appendix D)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","keywords":["intersection-sum","cardinality","diffie-hellman","pohlig-hellman","paillier","damgard-jurik","deployment","ad-conversion"],"limitations":["the intersection size is revealed in addition to the sum (§4.2, p. 9)","no security against malicious parties is claimed (§2.3, p. 4)","the threshold variant only lets P1 abort before the sum is computed if the intersection is too small (§3.4, p. 7)"],"paper_id":"PSI-PAPER-2020-ION","qualifiers":["semi-honest parties (§2.3, p. 4; Theorems 1-2, p. 6)","the hash function H into a DDH group is modeled as a random oracle; a fresh oracle per execution is simulated by prepending a common random seed (§3.1, p. 5; §3.2, pp. 6-7)","P1 learns the intersection size and P2 learns the size and the sum; a reverse variant gives the sum to P1 (Figure 1, p. 3; §3.4, p. 7)","associated values and their sum are assumed small enough not to wrap around the plaintext space (§3.2, p. 7; Appendix A.4, footnote 5)","both parties use the same identifier space; finding one is outside the scope (§2.1, p. 3)"],"source_locator":{"dossier_section":"PSI-PAPER-2020-ION § Contributions","primary_source":"Abstract and §1 (pp. 1-3); §2.1 and Figure 1 (p. 3); §2.3 (p. 4); §3.1, Figure 2, and Theorems 1-2 (pp. 5-6); §3.2-3.4 and Table 2 (pp. 6-8); §4.2 (pp. 8-9); Tables 3-6 (pp. 12-13); §6 (p. 13); Appendix D. IACR ePrint 2019/723, PDF dated 2020-09-05.","primary_source_url":"https://eprint.iacr.org/2019/723","status":"theorem_checked"},"statement":"In the private intersection-sum-with-cardinality functionality, P1 holds identifiers, P2 holds identifier-value pairs, both learn the intersection size, and P2 also learns the sum of values over the intersection; a three-round protocol realizes it against semi-honest parties under DDH with the hash modeled as a random oracle and a CPA-secure additively homomorphic encryption scheme: both parties raise hashed identifiers to secret exponents, the sets are exchanged in shuffled order, P2's identifiers travel with encryptions of their values, and P1 homomorphically adds the ciphertexts of matching items and returns a rerandomized ciphertext for P2 to decrypt; for \\( n \\) items per party it sends \\( 3n \\) group elements and \\( n + 1 \\) ciphertexts.","statement_status":"source_normalized_statement","status":"published","title":"Private intersection-sum with cardinality from Diffie-Hellman double masking and additively homomorphic tags, semi-honest, random oracle model","work_id":"PSI-PAPER-2020-ION","year":2020},"primaryUrl":"https://eprint.iacr.org/2019/723","sections":[{"content":"Deployed DDH-based intersection-sum","heading":"Overview"},{"content":"Round 1: P1 sends \\( H(v_i)^{k_1} \\) in shuffled order. Round 2: P2 returns \\( H(v_i)^{k_1 k_2} \\) shuffled, and sends pairs \\( (H(w_j)^{k_2}, \\mathrm{AEnc}(t_j)) \\) shuffled. Round 3: P1 raises the first components to \\( k_1 \\), finds the matches, sums their ciphertexts, rerandomizes, and sends the result to P2 (Figure 2, p. 6). The deployment uses the NIST curve prime256v1 with SHA-256 hashing and Paillier with the Damgård-Jurik optimization, packing 65 values per ciphertext (§3.2, pp. 6-7). Variants allow a threshold abort, segmented inputs, and several values per item (§3.4, p. 7).","heading":"Exact contribution"},{"content":"PKE-RESULT-1976-DH-INTERACTIVE-PUBLIC-CHANNEL-KEY-AGREEMENT: the DDH assumption is stated with reference to Diffie and Hellman (Appendix A.2, p. 15). HE-RESULT-1999-PAILLIER-PRACTICAL-ADDITIVELY-HOMOMORPHIC-PUBLIC-KEY-ENCRYPTION and he_paillier99: the deployment encrypts the values with Paillier and the Damgård-Jurik optimization (§1, p. 2; §3.2, p. 7; Appendix B.1).","heading":"Related records in other topics"}],"slug":"ikn20-deployed-diffie-hellman-inte","status":"published","subtitle":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","summary":"In the private intersection-sum-with-cardinality functionality, P1 holds identifiers, P2 holds identifier-value pairs, both learn the intersection size, and P2 also learns the sum of values over the intersection; a three-round protocol realizes it against semi-honest parties under DDH with the hash modeled as a random oracle and a CPA-secure additively homomorphic encryption scheme: both parties raise hashed identifiers to secret exponents, the sets are exchanged in shuffled order, P2's identifiers travel with encryptions of their values, and P1 homomorphically adds the ciphertexts of matching items and returns a rerandomized ciphertext for P2 to decrypt; for \\( n \\) items per party it sends \\( 3n \\) group elements and \\( n + 1 \\) ciphertexts.","tableRows":["PSI-CONSTRUCTION-2020-ION-DDH-RLWE","PSI-CONSTRUCTION-2020-ION-DDH"],"title":"Private intersection-sum with cardinality from Diffie-Hellman double masking and additively homomorphic tags, semi-honest, random oracle model","type":"result","venue":"IEEE EuroS&P 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","keywords":["atomic-result","intersection-sum","cardinality","random-ot","batched-oprf","shuffled-oprf","tag-shuffle-aggregate"],"metadata":{"claim_slug":"rot-intersection-sum","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["cardinality","sum"],"parties":["two_party"],"set_size_regime":["balanced"],"technique":["batched_oprf","ot_extension","cuckoo_hashing","additively_homomorphic_encryption"]},"historical_context":{"narrative":"The fastest set-intersection protocols of the late 2010s replace each party's items by outputs of a batched oblivious PRF computed with random oblivious transfer, after cuckoo hashing places the items into bins. Such protocols expose which items match, so they could not directly compute a sum over a hidden intersection. Ion and colleagues inserted a shuffle: the PRF outputs of the receiving party are encrypted under its own key, masked and permuted by the other party, and so become fresh pseudorandom values in an order the receiver does not know. Encrypted purchase values ride along as tags, and the matching values are summed homomorphically. The result computes the same aggregate as the deployed protocol from symmetric-key oblivious transfer plus homomorphic encryption.","prior_boundary":"The most efficient PSI protocols evaluated a batched OPRF from random OT per cuckoo bin, building on the hashing of Pinkas, Schneider, Segev, and Zohner and the batched OPRF of Kolesnikov, Kumaresan, Rosulek, and Trieu, but they reveal which items intersect (§1, p. 2; §4.1, pp. 7-8). Circuit-based approaches hid the intersection with a garbled-circuit sub-protocol per bucket (§4.3.1, p. 9).","significance_at_publication":"The authors believe it is the first construction of private intersection-sum with cardinality from random OT (§4.3.1, p. 9). In their cost model it was cheaper than every garbled-circuit protocol compared but about 15 times more expensive than the deployed Diffie-Hellman protocol (§5.2-5.3, p. 12; Table 7, p. 13).","technical_delta":"A shuffle step is inserted after the batched OPRF: P1's encrypted OPRF outputs are additively re-masked and permuted by P2, so P1 learns the new OPRF values of its inputs only in shuffled order, and homomorphically encrypted values travel as tags with P2's items (§4.3.1, p. 9; Figure 3, p. 10). Security against each party is proved by simulation from the intersection size and sum (Theorems 3-4, pp. 9-10; Appendix E)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","keywords":["intersection-sum","cardinality","random-ot","batched-oprf","shuffled-oprf","tag-shuffle-aggregate"],"limitations":["the intersection size is revealed (§4.2, p. 9)","communication \\( 3.6n + 1 \\) homomorphic ciphertexts plus random OTs and \\( 96n \\) bytes for \\( n \\) items per party, about 15 times that of the deployed protocol in the measurements (Table 4, p. 12; §5.2, p. 12)"],"paper_id":"PSI-PAPER-2020-ION","qualifiers":["semi-honest parties (Theorems 3-4, pp. 9-10)","correctness assumes cuckoo hashing fails and random-OT outputs collide only with negligible probability (§4.3.1, p. 9)","the batched random OT of Kolesnikov et al. yields a relaxed PRF with related keys, which the authors say does not affect their protocol or proofs (Appendix A.6, p. 16)","P1 learns the intersection size and P2 the size and the sum (Figure 1, p. 3; Figure 3, p. 10)"],"source_locator":{"dossier_section":"PSI-PAPER-2020-ION § Contributions","primary_source":"§1 (p. 2); §4.1 (pp. 7-8); §4.2 (pp. 8-9); §4.3.1, Figure 3, and Theorems 3-4 (pp. 9-10); §5.1 (p. 11); Tables 3-5 and 7 (pp. 12-13); Appendices A.5-A.6 and E. IACR ePrint 2019/723, PDF dated 2020-09-05.","primary_source_url":"https://eprint.iacr.org/2019/723","status":"theorem_checked"},"statement":"Against semi-honest parties, private intersection-sum with cardinality can be computed from batched random OT: P1 cuckoo-hashes its identifiers and obtains one OPRF value per bin and stash slot, encrypts these values under its own additively homomorphic key, and P2 adds a fresh random mask to each ciphertext and returns them shuffled, which turns them into evaluations of new, still pseudorandom functions in unknown order; P2 sends, for each of its items, the masked evaluations at all candidate positions together with an encryption of its value under P2's key, and P1 adds the value ciphertexts of items that hit a decrypted evaluation and returns the rerandomized sum for P2 to decrypt.","statement_status":"source_normalized_statement","status":"published","title":"Private intersection-sum with cardinality from batched random OT with shuffled, re-masked OPRF outputs, semi-honest","work_id":"PSI-PAPER-2020-ION","year":2020},"primaryUrl":"https://eprint.iacr.org/2019/723","sections":[{"content":"Random-OT-based intersection-sum","heading":"Overview"},{"content":"P1 cuckoo-hashes into \\( b \\) bins and a stash of size \\( s \\); for each of the \\( b + s \\) positions a random OT gives P2 a key \\( k_i \\) and P1 the value \\( f_{k_i}(v_i) \\). P1 sends \\( \\mathrm{AEnc}(pk_1, f_{k_i}(v_i)) \\); P2 adds random \\( r_i \\), rerandomizes, and returns the ciphertexts shuffled. For each \\( (w_j, t_j) \\), P2 sends the set \\( \\{f_{k_i}(w_j) + r_i\\} \\) over the hash positions and stash slots, padded and in permuted order, with \\( \\mathrm{AEnc}(pk_2, t_j) \\). P1 decrypts the shuffled values, sums the tags of matching items, and sends the rerandomized sum (Figure 3, p. 10). The measured instance uses three hash functions, no stash, at most \\( 1.5n \\) bins, and the batched random OT of Kolesnikov et al. with 128 base OTs and a 448-bit pseudorandom code (§5.1, p. 11).","heading":"Exact contribution"},{"content":"MPC-CONTRIB-2003-IKNP-OTEXT: the paper describes random OT as a modification of OT extension (§4.1, p. 8) and instantiates it with the batched random OT of Kolesnikov et al. on 128 base public-key OTs (§5.1, p. 11); IKNP itself is not cited by name.","heading":"Related records in other topics"}],"slug":"ikn20-private-intersection-sum-wit","status":"published","subtitle":"On Deploying Secure Computing: Private Intersection-Sum-with-Cardinality","summary":"Against semi-honest parties, private intersection-sum with cardinality can be computed from batched random OT: P1 cuckoo-hashes its identifiers and obtains one OPRF value per bin and stash slot, encrypts these values under its own additively homomorphic key, and P2 adds a fresh random mask to each ciphertext and returns them shuffled, which turns them into evaluations of new, still pseudorandom functions in unknown order; P2 sends, for each of its items, the masked evaluations at all candidate positions together with an encryption of its value under P2's key, and P1 adds the value ciphertexts of items that hit a decrypted evaluation and returns the rerandomized sum for P2 to decrypt.","tableRows":["PSI-CONSTRUCTION-2020-ION-ROT"],"title":"Private intersection-sum with cardinality from batched random OT with shuffled, re-masked OPRF outputs, semi-honest","type":"result","venue":"IEEE EuroS&P 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","keywords":["atomic-result","garbled-cuckoo-table","paxos","cuckoo-graph","two-core","cyclomatic-number","linear-time-encoding","constant-rate"],"metadata":{"claim_slug":"garbled-cuckoo","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"technique":["paxos"]},"historical_context":{"narrative":"Cuckoo hashing had made semi-honest PSI fast, but a party's choice of bin leaks information about its other items, and garbled Bloom filters, the encodings that suited malicious protocols, cost a factor of \\( \\lambda \\) in size. The garbled cuckoo table removes the choice. Each item becomes an edge between two table positions, and the encoder sets the positions so that their XOR, together with a short random tail, equals the item's value. Positions on acyclic parts of the graph are fixed by a simple traversal, and the few constraints on cycles are solved jointly using the tail. Because a random cuckoo graph has only logarithmically many cycles, the table keeps constant rate with linear-time encoding and probes of \\( O(\\lambda) \\) positions.","prior_boundary":"Garbled Bloom filters have rate \\( \\Theta(1/\\lambda) \\) with \\( O(n\\lambda) \\) encoding and \\( \\lambda \\)-position decoding; a random Boolean matrix has rate \\( n/(n + \\lambda) \\) but \\( O(n^3) \\) encoding; the Bloomier-filter variant of Charles and Chellapilla encodes in linear time only by re-sampling hash functions until the graph is acyclic, which makes them depend on the input (§3.5, pp. 8-9; Figure 2, p. 9; §5, p. 16).","significance_at_publication":"The authors present it as matching the encoding and decoding costs of garbled Bloom filters at constant rate, about \\( 1/(2 + \\varepsilon) \\), with hash functions chosen independently of the keys (§5, p. 16; §5.3, pp. 20-21); with \\( 2.4n \\) main positions it is the encoding of the variant that the authors report as their faster implementation (§7.1, p. 22; §7.3, p. 23).","technical_delta":"Each key is an edge \\( \\{h_1(x), h_2(x)\\} \\), and the table is \\( D = L \\| R \\) with \\( |R| = d + \\lambda \\) (§5.1-5.2, pp. 17-19; Figure 6, p. 19). Theorem 8 (p. 20) bounds the failure probability using Lemma 12 (p. 31), which shows that a cuckoo graph has at most \\( \\log n \\) cycles except with negligible probability. A DFS-based variant handles each back edge with one constraint on R (Appendix B, Figure 7, p. 30; Theorem 11, p. 29)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","keywords":["garbled-cuckoo-table","paxos","cuckoo-graph","two-core","cyclomatic-number","linear-time-encoding","constant-rate"],"limitations":["the rate is about \\( 1/(2 + \\varepsilon) \\), well below 1 (§5, p. 16; Figure 2, p. 9)","the paper gives asymptotic failure bounds and no concrete failure probability for the \\( 2.4n \\) setting used in its implementation (Theorem 8, p. 20; §7.1, p. 22)"],"paper_id":"PSI-PAPER-2020-PRTY","qualifiers":["the failure bound rests on bounding the cyclomatic number of a random \\( (n, m) \\)-cuckoo graph by \\( d = (1 + \\varepsilon) \\log n \\), where \\( \\varepsilon \\) is a positive constant (Theorem 8, p. 20; Lemma 12, p. 31)","Lemma 12 is stated for a cuckoo graph with \\( (2 + \\varepsilon)n \\) nodes; the implementation uses \\( 2.4n \\) main positions for the 2-core variant and \\( 2n \\) for the DFS variant (§7.1, p. 22)","items are placed in a global order determined by the graph, unlike the online insertion of garbled Bloom filters (§5.3, p. 20)"],"source_locator":{"dossier_section":"PSI-PAPER-2020-PRTY § Contributions","primary_source":"Abstract (p. 1); Figure 2 (p. 9); §5.1-5.3 (pp. 17-21); Figure 6 (p. 19); Theorem 8 (p. 20); Appendix B, Theorem 11 and Figure 7 (pp. 29-31); Appendix C, Lemma 12 (pp. 31-32); §7.1 (p. 22). IACR ePrint 2020/193, PDF dated 2020-02-16.","primary_source_url":"https://eprint.iacr.org/2020/193","status":"theorem_checked"},"statement":"Two hash functions map each key to an edge of a cuckoo graph on the m main positions L, and a random vector r(x) selects positions among \\( d + \\lambda \\) extra positions R. The encoder solves the constraints of the edges in the graph's 2-core by Gaussian elimination over the 2-core positions and R, then fixes every other position by traversing the remaining forest away from the 2-core. With \\( d = (1 + \\varepsilon) \\log n \\), where \\( \\varepsilon \\) is a positive constant, this is a PaXoS whose failure probability is the probability that the cyclomatic number of a random cuckoo graph exceeds \\( \\log n + O(1) \\), plus \\( 2^{-\\lambda} \\) (Theorem 8). Encoding costs \\( O((d + \\lambda)^3 + n\\lambda) \\), and decoding one key XORs about \\( (\\lambda + d + 2)/2 \\) positions on average.","statement_status":"source_normalized_statement","status":"published","title":"Garbled cuckoo table: a PaXoS of size \\( (2 + \\varepsilon)n + d + \\lambda \\) with \\( O(n\\lambda) \\) encoding and \\( O(\\lambda) \\)-position decoding, hash functions independent of the keys","work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"Garbled cuckoo table","heading":"Overview"},{"content":"The table has \\( m \\) main positions and \\( d + \\lambda \\) extra positions. A key x has two main positions \\( h_1(x), h_2(x) \\) and a random extra vector r(x); its value is the XOR of the two main positions and of the extra positions selected by r(x) (Figure 6, p. 19). Encoding builds the cuckoo graph whose edges are the keys, solves the linear constraints of the edges in its 2-core with Gaussian elimination using the extra positions, picks a root value for every tree component, and then sets each remaining position while traversing edges directed away from the 2-core or the root (Figure 6, steps 1-5, p. 19). The rows of a cycle are linearly dependent in the main part, which is why the random extra part is needed; with at most d cycles the kernel has dimension at most d, and \\( d + \\lambda \\) random columns make the system solvable except with probability \\( 2^{-\\lambda} \\) (Theorem 8 and proof, p. 20). The DFS variant instead adds, for each back edge, one constraint on the extra positions equal to the XOR of the values on that cycle (Appendix B, pp. 29-31). This is the encoding used in PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI's implementation.","heading":"Exact contribution"}],"slug":"prty20-garbled-cuckoo-table-a","status":"published","subtitle":"PSI from PaXoS: Fast, Malicious Private Set Intersection","summary":"Two hash functions map each key to an edge of a cuckoo graph on the m main positions L, and a random vector r(x) selects positions among \\( d + \\lambda \\) extra positions R. The encoder solves the constraints of the edges in the graph's 2-core by Gaussian elimination over the 2-core positions and R, then fixes every other position by traversing the remaining forest away from the 2-core. With \\( d = (1 + \\varepsilon) \\log n \\), where \\( \\varepsilon \\) is a positive constant, this is a PaXoS whose failure probability is the probability that the cyclomatic number of a random cuckoo graph exceeds \\( \\log n + O(1) \\), plus \\( 2^{-\\lambda} \\) (Theorem 8). Encoding costs \\( O((d + \\lambda)^3 + n\\lambda) \\), and decoding one key XORs about \\( (\\lambda + d + 2)/2 \\) positions on average.","tableRows":["PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","PSI-CONSTRUCTION-2020-PRTY-MAL","PSI-CONSTRUCTION-2020-PRTY-SH-DFS","PSI-CONSTRUCTION-2020-PRTY-SH","PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"],"title":"Garbled cuckoo table: a PaXoS of size \\( (2 + \\varepsilon)n + d + \\lambda \\) with \\( O(n\\lambda) \\) encoding and \\( O(\\lambda) \\)-position decoding, hash functions independent of the keys","type":"result","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","keywords":["atomic-result","paxos-psi","malicious-psi","oos-ot-extension","linear-code","xor-homomorphism","random-oracle","linear-communication"],"metadata":{"claim_slug":"malicious-paxos-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest","malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["paxos","ot_extension"]},"historical_context":{"narrative":"Malicious PSI lagged far behind semi-honest PSI. The leading semi-honest protocols relied on cuckoo hashing, which leaks through the choice of bin, and the leading malicious protocol, Rindal and Rosulek's dual execution, paid \\( O(n \\log n) \\) communication for hashing into small bins. Pinkas, Rosulek, Trieu, and Yanai noticed that the outputs of the malicious OOS OT extension are XOR-homomorphic, the property that PaXoS decoding respects. If the receiver feeds an encoding of its hashed items into OOS, both parties can compute the same masked value for a common item, and the sender sends one hash per item. Random-oracle hashing on both sides lets a simulator extract inputs, and changing only the code turns the semi-honest protocol into a malicious one.","prior_boundary":"Semi-honest OT-based PSI used cuckoo hashing, but in the malicious setting a party's choice of cuckoo location leaks information about its other items, and how to use cuckoo hashing there was unknown (§1, p. 2). The malicious protocol that the authors name the most concretely efficient, Rindal and Rosulek's dual execution, hashes items into \\( O(n/\\log n) \\) bins and has \\( O(n \\log n) \\) communication (§1, p. 2; §1.1, p. 3; Appendix D, pp. 34-35).","significance_at_publication":"The authors call it the first concretely efficient PSI with linear communication and malicious security in the OT-hybrid model with a non-programmable random oracle, and the first to use cuckoo hashing for malicious PSI (abstract, p. 1; §1.1, pp. 2-3). For \\( 2^{20} \\) items the malicious 2-core variant sends 202.04 MB against 1,322 MB for the encode-commit variant of Rindal and Rosulek (Table 2, p. 24).","technical_delta":"The protocol combines the XOR-homomorphism of OOS outputs, which OOS itself uses for a consistency check, with PaXoS decoding (§4.1, pp. 9-10; Figure 3, p. 11). H1 lets the simulator extract a malicious receiver's set from D, and including x in H2 lets it extract a malicious sender's set (§4.2, p. 10); Theorem 4 (p. 10) is proved in Lemmas 5-6 (pp. 12-14). The code and hash lengths select the semi-honest or malicious instantiation (§4.4, pp. 14-16; Figures 4-5, pp. 15-16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","keywords":["paxos-psi","malicious-psi","oos-ot-extension","linear-code","xor-homomorphism","random-oracle","linear-communication"],"limitations":["the introduction states a 25% communication improvement over KKRT for the semi-honest instantiation (§1.1, p. 2), but Table 1 gives about \\( 1268n \\) bits against \\( 1018n \\) for KKRT at \\( n = 2^{20} \\) (p. 21) and §7.3 reports the best variant within 10% above KKRT (p. 23)","in the semi-honest setting the 2-core variant is 18% slower than KKRT on a LAN and about 80% slower over the two WANs for \\( 2^{20} \\) items (§7.3, p. 23)","the protocol is designed for sets of roughly equal size (Appendix D, p. 36)"],"paper_id":"PSI-PAPER-2020-PRTY","qualifiers":["static corruption of one of the two parties (§2, p. 5; Theorem 4, p. 10)","OOS is used as an ideal functionality, and H1, H2 are non-programmable random oracles (abstract, p. 1; §4.2, p. 10)","the ideal functionality lets a corrupt party contribute a set of size \\( n' > n \\); for a malicious receiver the paper bounds \\( n' \\) between \\( 2m \\) and \\( 5m \\), \\( m \\) the number of PaXoS strings, in its parameter tables (§2, p. 5; Claim 7, p. 15; Figure 5, p. 16)","only the receiver learns the intersection (Figure 1, p. 6)","linear communication means \\( O(n\\kappa) \\); the authors note that concrete hash lengths may involve an \\( O(\\log n) \\) term, as in any intersection protocol (§6, p. 22)"],"source_locator":{"dossier_section":"PSI-PAPER-2020-PRTY § Contributions","primary_source":"Abstract (p. 1); §1-1.1 (pp. 2-3); §2, OOS functionality and Lemma 1 (pp. 4-5); Figure 1 (p. 6); §4.1-4.3 (pp. 9-10); Theorem 4 (p. 10); Figure 3 (p. 11); Lemmas 5-6 (pp. 12-14); §4.4 and Figures 4-5 (pp. 14-16); §6 and Table 1 (pp. 21-22); §7.3 and Table 2 (pp. 23-24). IACR ePrint 2020/193, PDF dated 2020-02-16.","primary_source_url":"https://eprint.iacr.org/2020/193","status":"theorem_checked"},"statement":"The receiver encodes the pairs \\( (y, H_1(y)) \\) for its set into a PaXoS D and uses the strings of D as its choice inputs to the OOS 1-out-of-N OT extension. Because the code C is linear and PaXoS decoding is XOR-homomorphic, the receiver's value \\( \\mathrm{Decode}(R, x) \\) equals \\( \\mathrm{Decode}(Q, x) \\oplus C(H_1(x)) \\wedge s \\), which the sender can compute, whenever x is in the receiver's set; the sender sends \\( H_2(x, \\mathrm{Decode}(Q, x) \\oplus C(H_1(x)) \\wedge s) \\) for each of its items. The protocol is a secure two-party PSI against a malicious sender or receiver in the random oracle model with OOS as an ideal functionality, where a corrupt party may use a set of size \\( n' > n \\) (Theorem 4). The semi-honest instantiation is the same protocol with a shorter code and hash outputs.","statement_status":"source_normalized_statement","status":"published","title":"Malicious-secure two-party PSI with communication linear in the set size, \\( O(\\kappa n) \\), from any PaXoS and OOS OT extension, random oracle model","work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"PaXoS-PSI","heading":"Overview"},{"content":"The OOS functionality gives the sender a secret s and strings \\( q_i \\), and the receiver \\( r_i = q_i \\oplus C(d_i) \\wedge s \\) for its choice strings \\( d_i \\), where C is a linear code of minimum distance at least \\( \\kappa \\) (§2, pp. 4-5). If the receiver's choice strings form a PaXoS D (PSI-CONTRIB-2020-PRTY-PAXOS) encoding \\( y \\mapsto H_1(y) \\), then decoding R at x equals decoding Q at x XOR \\( C(\\mathrm{Decode}(D, x)) \\wedge s \\), so the two parties obtain the same string for every x in the receiver's set (§4.1, pp. 9-10). For any other x, the difference \\( C(\\mathrm{Decode}(D, x) \\oplus H_1(x)) \\) is a nonzero codeword, and the hashed value looks random by the code-correlation robustness of a random oracle (Lemma 1, p. 4; Lemma 5, Hybrid 4, p. 13). The sender sends one hash per item, randomly permuted, and the receiver outputs the items whose own hash appears (Figure 3, p. 11). Semi-honest security needs only H1, H2 outputs of \\( \\lambda + 2 \\log n \\) bits; the malicious instantiation lengthens H1 to bound the receiver's effective set (PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND) and sets H2 to \\( 2\\kappa \\) bits to bound the sender's (§4.4, pp. 14-16). The implementation uses the garbled cuckoo table of PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO; the complete configurations are PSI-CONSTRUCTION-2020-PRTY-SH and PSI-CONSTRUCTION-2020-PRTY-MAL.","heading":"Exact contribution"},{"content":"MPC-CONTRIB-2003-IKNP-OTEXT: the protocols compared in the paper reduce PSI to many OTs implemented with OT extension (§1, p. 2); the OOS extension that PaXoS-PSI runs is a 1-out-of-N extension in the IKNP paradigm (§2, p. 4; §4.1, p. 9). OOS itself and the Kolesnikov-Kumaresan paper behind Lemma 1 (p. 4) have no record in any topic yet.","heading":"Related records in other topics"}],"slug":"prty20-malicious-psi-with-linear","status":"published","subtitle":"PSI from PaXoS: Fast, Malicious Private Set Intersection","summary":"The receiver encodes the pairs \\( (y, H_1(y)) \\) for its set into a PaXoS D and uses the strings of D as its choice inputs to the OOS 1-out-of-N OT extension. Because the code C is linear and PaXoS decoding is XOR-homomorphic, the receiver's value \\( \\mathrm{Decode}(R, x) \\) equals \\( \\mathrm{Decode}(Q, x) \\oplus C(H_1(x)) \\wedge s \\), which the sender can compute, whenever x is in the receiver's set; the sender sends \\( H_2(x, \\mathrm{Decode}(Q, x) \\oplus C(H_1(x)) \\wedge s) \\) for each of its items. The protocol is a secure two-party PSI against a malicious sender or receiver in the random oracle model with OOS as an ideal functionality, where a corrupt party may use a set of size \\( n' > n \\) (Theorem 4). The semi-honest instantiation is the same protocol with a shorter code and hash outputs.","tableRows":["PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","PSI-CONSTRUCTION-2020-PRTY-MAL","PSI-CONSTRUCTION-2020-PRTY-SH-DFS","PSI-CONSTRUCTION-2020-PRTY-SH","PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"],"title":"Malicious-secure two-party PSI with communication linear in the set size, \\( O(\\kappa n) \\), from any PaXoS and OOS OT extension, random oracle model","type":"result","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2020-PRTY-PAXOS","keywords":["atomic-result","paxos","probe-and-xor-of-strings","key-value-encoding","garbled-bloom-filter","linear-system","homomorphic-decoding"],"metadata":{"claim_slug":"paxos","contribution_kind":"definition","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"technique":["paxos"]},"historical_context":{"narrative":"Garbled Bloom filters already let a party hide a set of keys inside a table whose values are recovered by XOR, but the table grew with the statistical parameter, and a random linear system, the compact alternative, was too slow to solve for large sets. Pinkas, Rosulek, Trieu, and Yanai isolated what such encodings must provide: a public probing rule, fixed before the inputs are known, whose rows for any \\( n \\) keys are linearly independent with overwhelming probability, and a decoder that commutes with XOR, linear maps, and bitwise AND. Treating garbled Bloom filters and random matrices as instances of one object let them write a PSI protocol once for any encoding and made rate and encoding time explicit targets for new constructions.","prior_boundary":"Garbled Bloom filters, introduced by Dong, Chen, and Wen, encode \\( n \\) items into \\( \\Theta(\\lambda n) \\) positions with \\( O(n\\lambda) \\) encoding and decode by XOR of at most \\( \\lambda \\) positions; a random Boolean matrix reaches \\( m = n + \\lambda \\) but needs \\( O(n^3) \\) Gaussian elimination and decodes by XOR of about \\( n/2 \\) positions; a Bloomier-filter variant reaches linear time only by choosing hash functions that depend on the input set (§3.5, pp. 8-9; Figure 2, p. 9).","significance_at_publication":"The abstraction separates the PSI protocol from the data structure: the protocol of Figure 3 is written for any PaXoS (§4, pp. 9-11). The authors require the map to be independent of the inputs, since an input-dependent choice would leak them, which excludes the Bloomier-filter variant (§3.1, p. 6; §3.5, p. 9).","technical_delta":"Definition 3 (p. 6) abstracts these structures as a probe-and-XOR of strings, with Encode solving a linear system and Decode computing the inner product of v(x) with the data structure (§3.2, pp. 6-7); §3.3 (p. 7) states the homomorphic properties that the PSI protocol uses, and §3.4 (pp. 7-8) names rate, encoding cost, and decoding cost as the efficiency measures."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2020-PRTY-PAXOS","keywords":["paxos","probe-and-xor-of-strings","key-value-encoding","garbled-bloom-filter","linear-system","homomorphic-decoding"],"limitations":["Definition 3 requires only linear independence of the probe vectors; it defines no hiding property for the encoded data structure (Definition 3, p. 6)","rate and encoding cost are efficiency measures, not part of the definition; a random matrix satisfies the definition with poor encoding cost (§3.1, p. 6; §3.5, p. 8)"],"paper_id":"PSI-PAPER-2020-PRTY","qualifiers":["failure probability \\( 2^{-\\lambda} \\) over the choice of the random function H (Definition 3, p. 6)","the probing rule must not depend on the inputs; the Bloomier-filter variant of Charles and Chellapilla is not a PaXoS for this reason (§3.1, p. 6; §3.5, pp. 8-9)","values are bit strings and decoding uses only 0/1 coefficients (§3.2, pp. 6-7)"],"source_locator":{"dossier_section":"PSI-PAPER-2020-PRTY § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 2); Definition 3 (p. 6); §3.2-3.4 (pp. 6-8); §3.5 and Figure 2 (pp. 8-9). IACR ePrint 2020/193, PDF dated 2020-02-16.","primary_source_url":"https://eprint.iacr.org/2020/193","status":"section_checked"},"statement":"An \\( (n, m, 2^{-\\lambda}) \\)-PaXoS is a randomized map v from strings to m-bit vectors such that, for any \\( n \\) distinct inputs, the vectors are linearly independent except with probability \\( 2^{-\\lambda} \\) over the random function. It encodes \\( n \\) key-value pairs as m strings D by solving \\( M \\cdot D = (y_1, \\ldots, y_n) \\), and decodes a key x as the XOR of the positions of D selected by v(x). Decoding commutes with XOR of two encodings, with linear maps, and with bitwise AND by a fixed string, and the map is fixed independently of the inputs.","statement_status":"source_normalized_statement","status":"published","title":"Probe-and-XOR of strings (PaXoS): an input-independent binary key-value encoding with XOR-homomorphic decoding","work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"Probe-and-XOR of strings","heading":"Overview"},{"content":"A PaXoS is given by a probe function v that maps each string to an m-bit vector (Definition 3, p. 6). To encode pairs \\( (x_i, y_i) \\), the encoder forms the matrix whose rows are \\( v(x_i) \\) and solves for \\( D = (d_1, \\ldots, d_m) \\) with \\( M \\cdot D = (y_1, \\ldots, y_n) \\); to decode x, one XORs the positions \\( d_j \\) with \\( v(x)_j = 1 \\) (§3.2, pp. 6-7). Decoding can be applied to any string, not only to encoded keys. Because decoding is linear over \\( \\mathrm{GF}(2) \\), it commutes with XOR of two encodings, with any linear map applied position by position, and with bitwise AND by a fixed string (§3.3, p. 7); these are the properties that the PSI protocol of PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI combines with the outputs of OT extension. The paper measures a PaXoS by its rate \\( n/m \\), its encoding cost, and its decoding cost (§3.4, pp. 7-8), and lists random matrices and garbled Bloom filters as instances (§3.5, p. 8). The construction of the same paper that achieves constant rate with linear-time encoding is PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO.","heading":"Exact contribution"}],"slug":"prty20-paxos-key-value-encoding","status":"published","subtitle":"PSI from PaXoS: Fast, Malicious Private Set Intersection","summary":"An \\( (n, m, 2^{-\\lambda}) \\)-PaXoS is a randomized map v from strings to m-bit vectors such that, for any \\( n \\) distinct inputs, the vectors are linearly independent except with probability \\( 2^{-\\lambda} \\) over the random function. It encodes \\( n \\) key-value pairs as m strings D by solving \\( M \\cdot D = (y_1, \\ldots, y_n) \\), and decodes a key x as the XOR of the positions of D selected by v(x). Decoding commutes with XOR of two encodings, with linear maps, and with bitwise AND by a fixed string, and the map is fixed independently of the inputs.","tableRows":["PSI-CONSTRUCTION-2020-PRTY-SH-DFS","PSI-CONSTRUCTION-2020-PRTY-SH","PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"],"title":"Probe-and-XOR of strings (PaXoS): an input-independent binary key-value encoding with XOR-homomorphic decoding","type":"result","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2020-PRTY-PAXOS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","keywords":["atomic-result","input-extraction","incompressibility","random-oracle","malicious-receiver","set-size-slack","paxos"],"metadata":{"claim_slug":"receiver-set-size-bound","contribution_kind":"security_analysis","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"security_model":["random_oracle_model"],"technique":["paxos"]},"historical_context":{"narrative":"In malicious PSI a simulator must read off the set that a corrupt receiver effectively used, and an encoding sized for \\( n \\) items might be crafted to agree with a random oracle on more of them. Pinkas, Rosulek, Trieu, and Yanai bounded this slack without any computational assumption. A PaXoS of m strings that matched the oracle on many queried points could be used to describe the oracle in fewer bits than it contains, which is possible only with small probability. For practical parameters the extracted set exceeds a small multiple of m with probability below \\( 2^{-40} \\), at the price of longer oracle outputs and longer codewords in the malicious instantiation.","prior_boundary":"Malicious PSI functionalities, as in Rindal and Rosulek's protocols, already let a corrupt party use more items than it advertises (§2, p. 5). In PaXoS-PSI the simulator extracts a malicious receiver's set as the queried y with \\( \\mathrm{Decode}(D, y) = H_1(y) \\), and the protocol by itself does not limit how many such y a crafted D satisfies (§4.4, p. 15).","significance_at_publication":"The bound fixes the slack between the advertised and extracted set sizes in the malicious instantiation and is why its hash outputs and codewords are longer than in the semi-honest one (§4.4, pp. 14-16; Figures 4-5, pp. 15-16); it applies only once \\( n' \\) exceeds m, since a structure of m strings can always encode m values (§4.4, p. 16).","technical_delta":"Claim 7 (p. 15), proved as Lemma 10 (pp. 27-29), shows that a D agreeing with H1 on many queried points would compress H1, which Proposition 9 (p. 27) rules out; Figure 5 (p. 16) turns the bound into parameters with probability below \\( 2^{-40} \\) of extracting more than \\( n' \\) items, for \\( n' \\) from \\( 2m \\) to \\( 5m \\) and \\( 2^{128} \\) queries."},"historical_context_status":"curator_synthesis","id":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","keywords":["input-extraction","incompressibility","random-oracle","malicious-receiver","set-size-slack","paxos"],"limitations":["the bound allows the extracted set to exceed the advertised size by a constant factor; it does not enforce \\( n' = n \\) (§4.3, p. 10; §4.4, p. 16)","the sender side is handled separately by choosing H2 outputs of \\( 2\\kappa \\) bits so that collisions are negligible (§4.4, p. 15)"],"paper_id":"PSI-PAPER-2020-PRTY","qualifiers":["random oracle model; the probability is over H1 and holds against unbounded adversaries making \\( Q \\) queries (Claim 7, p. 15; Lemma 10, pp. 27-29)","the parameters of Figure 5 assume \\( 2^{128} \\) queries; the authors note that \\( 2^{80} \\) queries would allow \\( \\ell_1 \\) of 70 to 90 bits (p. 16, footnote 4)"],"source_locator":{"dossier_section":"PSI-PAPER-2020-PRTY § Contributions","primary_source":"§2 (p. 5); §4.3 (p. 10); §4.4, Claim 7 (p. 15); Figure 5 (p. 16); Appendix A, Proposition 9 and Lemma 10 (pp. 27-29). IACR ePrint 2020/193, PDF dated 2020-02-16.","primary_source_url":"https://eprint.iacr.org/2020/193","status":"theorem_checked"},"statement":"If an adversary makes \\( Q \\) queries to a random oracle H1 with \\( \\ell_1 \\)-bit outputs and then outputs a PaXoS D of m strings, the probability that \\( \\mathrm{Decode}(D, y) = H_1(y) \\) holds for at least \\( n' \\) of the queried values y is at most the binomial coefficient \\( \\binom{Q}{n'} \\) divided by \\( 2^{(n' - m)\\ell_1} \\). The bound is information-theoretic and bounds the set that the simulator extracts from a malicious receiver in PaXoS-PSI; it constrains \\( n' \\) only when \\( n' \\) exceeds m.","statement_status":"source_normalized_statement","status":"published","title":"Bound on the number of random-oracle values a malicious receiver can encode in a PaXoS of m strings, by an incompressibility argument","work_id":"PSI-PAPER-2020-PRTY","year":2020},"primaryUrl":"https://eprint.iacr.org/2020/193","sections":[{"content":"Bound on a malicious receiver's effective set","heading":"Overview"},{"content":"The proof builds a compression scheme for the random oracle H1 from any adversary that produces a PaXoS consistent with H1 on \\( n' \\) queried points (Lemma 10, pp. 27-29). The compressed description lists D (\\( m \\cdot \\ell_1 \\) bits), the indices of the \\( n' \\) consistent queries, and the oracle answers for all other points; the decompressor recovers each consistent answer by decoding D. Proposition 9 (p. 27) bounds the success probability of any such scheme by the ratio of description sizes, which yields the stated bound. The simulator of PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI extracts exactly this set from a malicious receiver (Lemma 5, p. 12), so the bound determines how many items a corrupt receiver can test. Figure 5 (p. 16) lists, for PaXoS sizes \\( m \\) from \\( 2^{12} \\) to \\( 2^{24} \\), output lengths \\( \\ell_1 \\) from 129 to 233 bits and the corresponding codes for extracted sets of size \\( 2m \\) to \\( 5m \\).","heading":"Exact contribution"}],"slug":"prty20-bound-on-the-number","status":"published","subtitle":"PSI from PaXoS: Fast, Malicious Private Set Intersection","summary":"If an adversary makes \\( Q \\) queries to a random oracle H1 with \\( \\ell_1 \\)-bit outputs and then outputs a PaXoS D of m strings, the probability that \\( \\mathrm{Decode}(D, y) = H_1(y) \\) holds for at least \\( n' \\) of the queried values y is at most the binomial coefficient \\( \\binom{Q}{n'} \\) divided by \\( 2^{(n' - m)\\ell_1} \\). The bound is information-theoretic and bounds the set that the simulator extracts from a malicious receiver in PaXoS-PSI; it constrains \\( n' \\) only when \\( n' \\) exceeds m.","tableRows":["PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","PSI-CONSTRUCTION-2020-PRTY-MAL","PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"],"title":"Bound on the number of random-oracle values a malicious receiver can encode in a PaXoS of m strings, by an incompressibility argument","type":"result","venue":"EUROCRYPT 2020","year":2020,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","keywords":["atomic-result","threshold-psi","multiparty","ideal-functionality","cardinality-testing","definition"],"metadata":{"claim_slug":"functionalities","contribution_kind":"definition","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["threshold"],"parties":["multiparty"]},"historical_context":{"narrative":"Threshold PSI had been defined for two parties, where saying that each set is close to the intersection and saying that the two sets are close to each other amount to the same thing. With more parties the two readings separate: if each of \\( \\ell \\) parties holds \\( t \\) elements that no one else has, every set lies within \\( t \\) of the intersection, yet the union exceeds it by \\( \\ell t \\) elements. Badrinarayanan, Miao, Raghuraman, and Rindal therefore defined two multiparty functionalities, one requiring every party's set to lie within \\( t \\) of the intersection and one requiring the union to lie within \\( t \\) of it, with matching tests that only reveal whether the condition holds. Applications choose between them, and the known techniques reach them from different assumptions.","prior_boundary":"Ghosh and Simkin defined two-party threshold PSI, releasing the intersection when the symmetric set difference is small, and studied its communication (§1, p. 2). Earlier threshold PSI protocols computed the cardinality first and compared it with the threshold (§1, p. 2).","significance_at_publication":"The distinction organizes the paper's results: both functionalities need \\( \\Omega(\\ell t) \\) communication and admit \\( O(\\ell t) \\) from threshold FHE, but only the union-based one has a protocol from threshold additively homomorphic encryption (Table 1, p. 3).","technical_delta":"The two-party condition is generalized in two inequivalent ways, by each party's distance to the intersection and by the union's distance to it, with ideal functionalities for threshold PSI and for cardinality testing in the UC framework (§1.1, p. 2; §2.3-2.4, pp. 6-7; Figures 1-4)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","keywords":["threshold-psi","multiparty","ideal-functionality","cardinality-testing","definition"],"limitations":["the functionalities are defined for sets of equal size (§2.3, p. 6)"],"paper_id":"PSI-PAPER-2021-BMRR","qualifiers":["all sets have the same size \\( n \\) and elements lie in a field \\( \\mathbb{F}_p \\) with \\( p \\) a \\( \\Theta(\\kappa) \\)-bit prime (§2.3, p. 6)","with equal set sizes, under \\( F_{\\text{TPSI-int}} \\) either all parties learn the output or none does (§2.3, p. 6)","which functionality and threshold to use depends on the application (§1.1, pp. 2-3)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-BMRR § Contributions","primary_source":"Abstract (p. 1); §1.1 (pp. 2-3); §2.3 with Figures 1-2 (p. 6); §2.4 with Figures 3-4 (pp. 6-7); Table 1 (p. 3). IACR ePrint 2020/600, PDF dated 2021-02-25.","primary_source_url":"https://eprint.iacr.org/2020/600","status":"section_checked"},"statement":"For \\( \\ell \\) parties each holding \\( n \\) elements with intersection I, \\( F_{\\text{TPSI-int}} \\) releases I to every party if and only if \\( |S_i \\setminus I| \\le t \\) for all i, equivalently \\( |I| \\ge n - t \\), and \\( F_{\\text{TPSI-diff}} \\) releases I if and only if \\( |(S_1 \\cup \\cdots \\cup S_\\ell) \\setminus I| \\le t \\); for two parties the conditions coincide up to the factor 2 in \\( |(S_1 \\cup S_2) \\setminus I| = 2|S_i \\setminus I| \\), while for \\( \\ell > 2 \\) only \\( 2|S_i \\setminus I| \\le |(\\cup S_i) \\setminus I| \\le \\ell|S_i \\setminus I| \\) holds, so the two can lead to very different outcomes; matching cardinality-testing functionalities \\( F_{\\text{CTest-int}} \\) and \\( F_{\\text{CTest-diff}} \\) output only similar or different.","statement_status":"source_normalized_statement","status":"published","title":"Two multiparty threshold PSI functionalities: release when every party's set is close to the intersection, or when the union is close to it","work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"Multiparty threshold PSI functionalities","heading":"Overview"},{"content":"Figure 1 (p. 6) defines \\( F_{\\text{TPSI-int}} \\) and Figure 2 (p. 6) \\( F_{\\text{TPSI-diff}} \\); Figures 3-4 (p. 7) define the cardinality tests \\( F_{\\text{CTest-int}} \\) and \\( F_{\\text{CTest-diff}} \\), which output similar or different. The paper's protocols first run a cardinality test and, if it passes, a common second phase that lets each party learn \\( S_i \\setminus I \\) (§1.1, pp. 3-4).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"bmrr21-two-multiparty-threshold-psi","status":"published","subtitle":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","summary":"For \\( \\ell \\) parties each holding \\( n \\) elements with intersection I, \\( F_{\\text{TPSI-int}} \\) releases I to every party if and only if \\( |S_i \\setminus I| \\le t \\) for all i, equivalently \\( |I| \\ge n - t \\), and \\( F_{\\text{TPSI-diff}} \\) releases I if and only if \\( |(S_1 \\cup \\cdots \\cup S_\\ell) \\setminus I| \\le t \\); for two parties the conditions coincide up to the factor 2 in \\( |(S_1 \\cup S_2) \\setminus I| = 2|S_i \\setminus I| \\), while for \\( \\ell > 2 \\) only \\( 2|S_i \\setminus I| \\le |(\\cup S_i) \\setminus I| \\le \\ell|S_i \\setminus I| \\) holds, so the two can lead to very different outcomes; matching cardinality-testing functionalities \\( F_{\\text{CTest-int}} \\) and \\( F_{\\text{CTest-diff}} \\) output only similar or different.","tableRows":["PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","PSI-CONSTRUCTION-2021-BMRR-TFHE-INT"],"title":"Two multiparty threshold PSI functionalities: release when every party's set is close to the intersection, or when the union is close to it","type":"result","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND","keywords":["atomic-result","lower-bound","communication-complexity","multiparty-threshold-psi","point-to-point","broadcast","set-disjointness"],"metadata":{"claim_slug":"lower-bound","contribution_kind":"boundary_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["threshold"],"parties":["multiparty"]},"historical_context":{"narrative":"Once two-party threshold PSI was known to need communication linear in the threshold, the multiparty question was whether more parties must pay proportionally more. Badrinarayanan, Miao, Raghuraman, and Rindal answered with a simple simulation argument: if any one party could take part while exchanging \\( o(t) \\) bits, a two-party protocol could be built in which one side plays that party and the other plays everyone else, and that protocol would beat the two-party bound. Every party therefore carries \\( \\Omega(t) \\) communication, and with only point-to-point channels the total is \\( \\Omega(\\ell t) \\). A separate reduction from multiparty set disjointness gives a weaker bound when broadcast is available, a setting the authors leave for further study.","prior_boundary":"Ghosh and Simkin proved an \\( \\Omega(t) \\) lower bound for two-party threshold PSI (§1, p. 2; §3.5, p. 15). No multiparty bound was known; the paper asks whether sublinear lower and upper bounds extend to more parties (§1, p. 2).","significance_at_publication":"Together with the paper's \\( O(\\ell t) \\) protocols from threshold FHE, the bound settles the point-to-point communication complexity of both functionalities up to the omitted \\( \\mathrm{poly}(\\kappa) \\) factor (Table 1, p. 3).","technical_delta":"A protocol in which some party \\( P_{i^*} \\) communicates \\( o(T) \\) is turned into a two-party threshold PSI protocol by letting one party emulate \\( P_{i^*} \\) and the other emulate all remaining parties with the same input, contradicting the two-party bound (Theorem 4.1, pp. 15-16; Theorem 4.3, pp. 16-17). The broadcast bound reduces multiparty set disjointness, whose complexity Braverman and Oshman showed to be \\( \\Omega(N \\log n + n) \\), to \\( F_{\\text{TPSI-int}} \\) with \\( T = N - 1 \\) (Theorem C.1, pp. 40-42)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND","keywords":["lower-bound","communication-complexity","multiparty-threshold-psi","point-to-point","broadcast","set-disjointness"],"limitations":["the point-to-point bound does not necessarily apply with broadcast channels (Appendix C, p. 40)","a broadcast lower bound for \\( F_{\\text{TPSI-diff}} \\) is left open (Appendix C, p. 42)"],"paper_id":"PSI-PAPER-2021-BMRR","qualifiers":["semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties (Theorems 4.1 and 4.3, pp. 15-16)","a party's communication counts both incoming and outgoing messages (footnote 7, p. 15)","the \\( \\Omega(\\ell t) \\) total holds for point-to-point networks, which include the star network (§1.1, p. 4; §4, p. 15)","the broadcast bound is proved only for \\( F_{\\text{TPSI-int}} \\) (Theorem C.1, p. 40)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-BMRR § Contributions","primary_source":"Abstract (p. 1); §1.1 and Table 1 (pp. 3-4); §3.5 (pp. 14-15); §4.1 with Theorem 4.1 and Corollary 4.2 (pp. 15-16); §4.2 with Theorem 4.3 and Corollary 4.4 (pp. 16-17); Appendix C with Theorem C.1 (pp. 40-42). IACR ePrint 2020/600, PDF dated 2021-02-25.","primary_source_url":"https://eprint.iacr.org/2020/600","status":"theorem_checked"},"statement":"In any multiparty threshold PSI protocol for \\( F_{\\text{TPSI-int}} \\) or \\( F_{\\text{TPSI-diff}} \\) secure against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) of \\( \\ell \\) parties, every party sends and receives \\( \\Omega(t) \\) bits, so in a network of point-to-point channels the total communication is \\( \\Omega(\\ell t) \\) (Theorems 4.1 and 4.3, Corollaries 4.2 and 4.4); in the broadcast model any protocol for \\( F_{\\text{TPSI-int}} \\) needs \\( \\Omega(t \\log \\ell + \\ell) \\) (Theorem C.1).","statement_status":"source_normalized_statement","status":"published","title":"\\( \\Omega(\\ell t) \\) communication lower bound for multiparty threshold PSI in point-to-point networks, semi-honest with up to \\( \\ell - 1 \\) corruptions","work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"\\( \\Omega(\\ell t) \\) lower bound for multiparty threshold PSI","heading":"Overview"},{"content":"For \\( F_{\\text{TPSI-int}} \\), the emulating parties learn the output iff \\( |X_1 \\setminus I| \\le t \\), which for equal set sizes is the two-party condition \\( |(X_1 \\setminus X_2) \\cup (X_2 \\setminus X_1)| \\le 2t \\); for \\( F_{\\text{TPSI-diff}} \\) the reduction yields the two-party condition with threshold \\( t \\) (§4.1-4.2, pp. 15-17). Corruption of either emulating party is simulated by corrupting \\( P_{i^*} \\) alone or all other parties (Theorem 4.1, p. 15).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"bmrr21-omega-nt-lower-bound","status":"published","subtitle":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","summary":"In any multiparty threshold PSI protocol for \\( F_{\\text{TPSI-int}} \\) or \\( F_{\\text{TPSI-diff}} \\) secure against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) of \\( \\ell \\) parties, every party sends and receives \\( \\Omega(t) \\) bits, so in a network of point-to-point channels the total communication is \\( \\Omega(\\ell t) \\) (Theorems 4.1 and 4.3, Corollaries 4.2 and 4.4); in the broadcast model any protocol for \\( F_{\\text{TPSI-int}} \\) needs \\( \\Omega(t \\log \\ell + \\ell) \\) (Theorem C.1).","title":"\\( \\Omega(\\ell t) \\) communication lower bound for multiparty threshold PSI in point-to-point networks, semi-honest with up to \\( \\ell - 1 \\) corruptions","type":"result","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-BMRR-LOWER-BOUND"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","keywords":["atomic-result","threshold-psi","threshold-additive-homomorphic-encryption","hankel-matrix","half-gcd","singularity-testing","polynomial-sparsity-test","garbled-circuits"],"metadata":{"claim_slug":"tahe-threshold-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["threshold"],"parties":["multiparty","two_party"],"security_model":["standard_model"],"set_size_regime":["balanced"],"technique":["additively_homomorphic_encryption","garbled_circuits","polynomial_sparsity_test"]},"historical_context":{"narrative":"The two-party threshold PSI protocol from additively homomorphic encryption had communication quadratic in the threshold, \\( \\tilde O(t^2) \\), because its cardinality test checked singularity of a general encrypted matrix. Badrinarayanan, Miao, Raghuraman, and Rindal observed that the matrix in question is a Hankel matrix, determined by a linear number of entries, and that a classical result of Brent, Gustavson, and Yun ties its singularity to a half-GCD computation that runs in quasi-linear time. Shared among the parties and tested with a garbled circuit or homomorphic evaluation, the test costs quasi-linear communication. Combined with an encoding whose monomials count the elements outside the intersection across all parties, this gave a multiparty protocol without fully homomorphic encryption and, for two parties, quasi-linear communication in the threshold, \\( \\tilde O(t) \\).","prior_boundary":"Ghosh and Simkin's two-party threshold PSI from additively homomorphic encryption cost \\( \\tilde O(t^2) \\), dominated by the Kiltz-Mohassel-Weinreb-Franklin singularity test for arbitrary matrices, and they left \\( \\tilde O(t) \\) from assumptions weaker than FHE open (§1, p. 2; §1.2, p. 4; §3.3, p. 13).","significance_at_publication":"The paper states that the case \\( \\ell = 2 \\) solves the Ghosh-Simkin open problem (abstract, p. 1; §1.2, p. 4; §3.3, p. 13). Its multiparty protocol is computationally more efficient than the threshold-FHE protocol and almost matches the \\( \\Omega(\\ell t) \\) bound (abstract, p. 1; §1.1, p. 3).","technical_delta":"The \\( (t + 1) \\times (t + 1) \\) Hankel matrix has only \\( 2t + 1 \\) distinct entries, and by Brent, Gustavson, and Yun their singularity reduces to a half-GCD computation of \\( O(t \\log^2 t) \\) cost (Imported Theorems 6.1-6.3, p. 25). The parties share the Hankel matrix additively and run \\( F_{\\mathrm{SingTest}} \\), instantiated either by homomorphic evaluation following Franklin-Haber and Cramer-Damgård-Nielsen, with \\( O(t \\log^2 t) \\) rounds, or by jointly generating a Yao garbled circuit for the test, with \\( O(1) \\) rounds (§6.1, pp. 25-26; Figure 8 and Theorem 6.5, p. 27)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","keywords":["threshold-psi","threshold-additive-homomorphic-encryption","hankel-matrix","half-gcd","singularity-testing","polynomial-sparsity-test","garbled-circuits"],"limitations":["only \\( F_{\\text{TPSI-diff}} \\) is covered; for \\( F_{\\text{TPSI-int}} \\) a protocol from threshold additively homomorphic encryption is marked unknown (Table 1, p. 3; §1.1, p. 4)","no security against malicious parties is claimed (§1.1, p. 3)","no implementation or measurement is reported (§§6-7, pp. 24-30)"],"paper_id":"PSI-PAPER-2021-BMRR","qualifiers":["semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties (Theorem 7.1, p. 28)","Theorem 6.5 is proved in the \\( F_{\\mathrm{SingTest}} \\)-hybrid model and needs a prime \\( r > t(t + 1)(p - 1)2^{\\lambda} \\); the sparsity test errs with probability at most \\( 2^{-\\lambda} \\) (Imported Theorem 6.4 and Theorem 6.5, p. 27)","the constant-round singularity test assumes a PRG computable in \\( \\mathrm{NC}^1 \\) (§6.1, p. 26)","threshold additive homomorphic encryption can be obtained from ElGamal under DDH or Paillier under decisional composite residuosity (§2.6, p. 10)","\\( \\tilde O \\) hides polylogarithmic factors and the bounds omit \\( \\mathrm{poly}(\\kappa) \\) (footnote 1, p. 3)","in the two-party case \\( F_{\\mathrm{SingTest}} \\) uses Yao's garbled circuits with communication \\( \\tilde O(t \\cdot \\mathrm{poly}(\\kappa)) \\) for the \\( (t + 1) \\times (t + 1) \\) Hankel matrix (§6.1, p. 26), and the second phase uses additively homomorphic encryption with Alice holding the secret key, at \\( O(t \\cdot \\mathrm{poly}(\\kappa)) \\) (§7.1, p. 29)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-BMRR § Contributions","primary_source":"Abstract (p. 1); §1.1 with Tables 1-2 (pp. 3-4); §1.2 (p. 4); §2.6 (p. 10); §3.3 (pp. 12-13); §6.1 with Imported Theorems 6.1-6.3 and Figure 7 (pp. 24-26); §6.2 with Imported Theorem 6.4, Figure 8, Theorem 6.5, and Corollary 6.6 (pp. 26-28); §7 with Theorem 7.1, Corollary 7.2, §7.1, and Figure 9 (pp. 28-30). IACR ePrint 2020/600, PDF dated 2021-02-25.","primary_source_url":"https://eprint.iacr.org/2020/600","status":"theorem_checked"},"statement":"Assuming \\( \\ell \\)-out-of-\\( \\ell \\) threshold additively homomorphic encryption with distributed setup, \\( F_{\\text{TPSI-diff}} \\) is securely realized against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties in a star network with communication \\( \\tilde O(\\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa)) \\) and \\( O(1) \\) rounds: the parties obtain additive shares of the \\( (t + 1) \\times (t + 1) \\) Hankel matrix of the monomial encoding \\( p(x) = (\\ell - 1)p_1(x) - p_2(x) - \\cdots - p_\\ell(x) \\), whose number of monomials is \\( |(\\cup S_i) \\setminus I| \\), and test its singularity with an MPC protocol of communication \\( \\tilde O(t \\cdot \\ell \\cdot \\mathrm{poly}(\\kappa)) \\) built on the half-GCD connection; for \\( \\ell = 2 \\) the singularity test runs in Yao's garbled circuits and the intersection step uses additively homomorphic encryption alone, which the authors state yields two-party threshold PSI with communication \\( \\tilde O(t) \\) from assumptions weaker than FHE.","statement_status":"source_normalized_statement","status":"published","title":"Threshold PSI with \\( \\tilde O(\\ell t) \\) communication from threshold additively homomorphic encryption via Hankel singularity testing in quasi-linear cost; \\( \\tilde O(t) \\) for two parties","work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"\\( \\tilde O(\\ell t) \\) threshold PSI from threshold additively homomorphic encryption","heading":"Overview"},{"content":"\\( \\Pi_{\\text{CTest-diff}} \\) (Figure 8, p. 27): the central party picks u; party 1 encodes its set as \\( \\sum (\\ell - 1)x^a \\) and every other party as \\( -\\sum x^a \\); each party evaluates its polynomial at \\( u^0, \\ldots, u^{2t} \\), and these values define additive shares of the Hankel matrix H; \\( F_{\\mathrm{SingTest}} \\) reports whether H is singular, which happens exactly when the encoding has at most \\( t \\) monomials, except with probability \\( 2^{-\\lambda} \\). If the test passes, the second phase of Figure 9 (p. 30) computes the intersection. The communication is \\( \\tilde O(\\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa)) \\) with \\( O(1) \\) rounds (Corollaries 6.6 and 7.2, p. 28).","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-YAO and MPC-COMP-ENC-GARBLED: the constant-round singularity test generates and evaluates a Yao garbled circuit, and the two-party test uses Yao's garbled circuits, cited as [Yao86] (§6.1, p. 26; §3.3, p. 13). HE-RESULT-1999-PAILLIER-PRACTICAL-ADDITIVELY-HOMOMORPHIC-PUBLIC-KEY-ENCRYPTION: Paillier is named as a basis for threshold additive homomorphic encryption (§2.6, p. 10).","heading":"Related records in other topics"}],"slug":"bmrr21-tilde-o-nt-threshold","status":"published","subtitle":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","summary":"Assuming \\( \\ell \\)-out-of-\\( \\ell \\) threshold additively homomorphic encryption with distributed setup, \\( F_{\\text{TPSI-diff}} \\) is securely realized against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties in a star network with communication \\( \\tilde O(\\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa)) \\) and \\( O(1) \\) rounds: the parties obtain additive shares of the \\( (t + 1) \\times (t + 1) \\) Hankel matrix of the monomial encoding \\( p(x) = (\\ell - 1)p_1(x) - p_2(x) - \\cdots - p_\\ell(x) \\), whose number of monomials is \\( |(\\cup S_i) \\setminus I| \\), and test its singularity with an MPC protocol of communication \\( \\tilde O(t \\cdot \\ell \\cdot \\mathrm{poly}(\\kappa)) \\) built on the half-GCD connection; for \\( \\ell = 2 \\) the singularity test runs in Yao's garbled circuits and the intersection step uses additively homomorphic encryption alone, which the authors state yields two-party threshold PSI with communication \\( \\tilde O(t) \\) from assumptions weaker than FHE.","tableRows":["PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF"],"title":"Threshold PSI with \\( \\tilde O(\\ell t) \\) communication from threshold additively homomorphic encryption via Hankel singularity testing in quasi-linear cost; \\( \\tilde O(t) \\) for two parties","type":"result","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","keywords":["atomic-result","multiparty-threshold-psi","threshold-fhe","cardinality-testing","rational-function-interpolation","degree-reduction","star-network"],"metadata":{"claim_slug":"tfhe-upper-bound","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["threshold"],"parties":["multiparty"],"security_model":["standard_model"],"set_size_regime":["balanced"],"technique":["threshold_fhe","additively_homomorphic_encryption","set_reconciliation"]},"historical_context":{"narrative":"Two-party threshold PSI from fully homomorphic encryption had shown that communication can depend on the threshold alone, but extending it to many parties raised a subtle problem: adding the set polynomials of several parties may cancel roots by accident, so a test based on the degree of a rational function can wrongly report that the sets are close. Badrinarayanan, Miao, Raghuraman, and Rindal multiplied each party's polynomial by a random linear factor, which makes such cancellations negligible, and ran the test under threshold fully homomorphic encryption with one central party. A second phase, built only on threshold additively homomorphic encryption and economical in randomizing polynomials, then lets every party recover its own excess elements, so total communication meets the lower bound.","prior_boundary":"For two parties, Ghosh and Simkin obtained communication \\( O(t) \\) from FHE by homomorphically interpolating the ratio of the two set polynomials and checking it at a random point (§1, p. 2; §3.1, p. 11). Summing several parties' polynomials in the numerator can cancel roots, so the natural multiparty extension may accept sets that differ too much (§3.1, pp. 11-12).","significance_at_publication":"The protocols match the \\( \\Omega(\\ell t) \\) lower bound for both functionalities up to the omitted \\( \\mathrm{poly}(\\kappa) \\) factor, and their communication does not depend on the set size (Table 1, p. 3; §1.2, p. 4).","technical_delta":"Each party multiplies its set polynomial by a random linear factor \\( (x - r_i) \\), which makes accidental cancellation negligible (Lemma 2.4, p. 10; §3.1, p. 12); for \\( F_{\\text{CTest-diff}} \\) the central party instead interpolates \\( p_i/p_1 \\) for every i and counts the union of differences under encryption (§3.2, p. 12; §5.2, pp. 21-23). The second phase lets each party contribute two randomizing polynomials, reducing \\( O(\\ell^2 t) \\) to \\( O(\\ell t) \\) communication (§3.4, p. 14; Figure 9, p. 30)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","keywords":["multiparty-threshold-psi","threshold-fhe","cardinality-testing","rational-function-interpolation","degree-reduction","star-network"],"limitations":["no security against malicious parties is claimed (§1.1, p. 3)","relies on threshold FHE for the cardinality test; for \\( F_{\\text{TPSI-int}} \\) no protocol from weaker assumptions is given (Table 1, p. 3)"],"paper_id":"PSI-PAPER-2021-BMRR","qualifiers":["semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties (Theorems 7.1 and B.1, pp. 28, 40)","\\( \\ell \\)-out-of-\\( \\ell \\) threshold FHE with distributed setup, available from circular-secure LWE (Imported Theorem 2.2, p. 9; footnote 4)","star network with a designated central party; not all parties need be online at once (§1.1, p. 4; §2.3, p. 6)","the bounds omit a \\( \\mathrm{poly}(\\kappa) \\) factor (footnote 1, p. 3)","equal set sizes \\( n \\) and a field of order \\( \\Omega(2^{\\kappa}) \\) (§2.3, p. 6; Figure 5, p. 18)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-BMRR § Contributions","primary_source":"Abstract (p. 1); §1.1 with Tables 1-2 (pp. 3-4); §2.5 with Definition 2.1 and Imported Theorem 2.2 (pp. 7-9); Lemmas 2.4-2.5 (p. 10); §3.1-3.2 and §3.4 (pp. 11-14); §5.1 with Theorem 5.1 and Figure 5 (pp. 17-21); §5.2 with Theorem 5.4 and Figure 6 (pp. 21-23); §7 with Theorem 7.1, Corollary 7.2, and Figure 9 (pp. 28-30); Appendix B with Theorem B.1, Corollary B.2, and Figure 10 (pp. 39-41). IACR ePrint 2020/600, PDF dated 2021-02-25.","primary_source_url":"https://eprint.iacr.org/2020/600","status":"theorem_checked"},"statement":"Assuming \\( \\ell \\)-out-of-\\( \\ell \\) threshold FHE with distributed setup, both \\( F_{\\text{TPSI-int}} \\) and \\( F_{\\text{TPSI-diff}} \\) are securely realized against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties in a star network with communication \\( O(\\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa)) \\) and \\( O(1) \\) rounds: each party sends encrypted evaluations of its set polynomial, randomized by a factor \\( (x - r_i) \\), to a central party that homomorphically interpolates and tests a rational function, the parties jointly decrypt one bit, and if the test passes a second phase from threshold additively homomorphic encryption gives every party \\( 3t + 4 \\) evaluations of a randomized combination of all set polynomials, from which it interpolates \\( S_i \\setminus I \\).","statement_status":"source_normalized_statement","status":"published","title":"Multiparty threshold PSI with \\( O(\\ell t) \\) communication and \\( O(1) \\) rounds from threshold FHE, matching the \\( \\Omega(\\ell t) \\) bound, semi-honest","work_id":"PSI-PAPER-2021-BMRR","year":2021},"primaryUrl":"https://eprint.iacr.org/2020/600","sections":[{"content":"\\( O(\\ell t) \\) multiparty threshold PSI from threshold FHE","heading":"Overview"},{"content":"\\( \\Pi_{\\text{TFHE-CTest-int}} \\) (Figure 5, p. 18): each party sends encryptions of \\( p'_i(j) = p_i(j)(x - r_i) \\) evaluated at \\( j = 1, \\ldots, 2t + 3 \\) and at a random z; the central party interpolates \\( (p'_2 + \\cdots + p'_\\ell)/p'_1 \\) homomorphically, compares it with the value at z, and the parties decrypt the resulting bit (§5.1, p. 17). \\( \\Pi_{\\text{TFHE-CTest-diff}} \\) (Figure 6) interpolates \\( p_i/p_1 \\) for each i (§5.2, pp. 21-23). The second phase, \\( \\Pi_{\\text{TPSI-diff}} \\) (Figure 9, p. 30) and \\( \\Pi_{\\text{TPSI-int}} \\) (Figure 10, p. 41), evaluates \\( V(x) = \\sum p'_i(x) U_i(x) \\) at \\( 3t + 4 \\) points under threshold additively homomorphic encryption.","heading":"Exact contribution"},{"content":"TSIG-PAPER-2018-BGGJKRS: the threshold FHE with distributed setup follows the definition of Boneh et al. and is instantiated by their scheme (§2.5, p. 7; Imported Theorem 2.2, p. 9). HE-RESULT-1999-PAILLIER-PRACTICAL-ADDITIVELY-HOMOMORPHIC-PUBLIC-KEY-ENCRYPTION: Paillier, like ElGamal, can be converted into the threshold additively homomorphic encryption used in the second phase (§2.6, p. 10).","heading":"Related records in other topics"}],"slug":"bmrr21-multiparty-threshold-psi-wit","status":"published","subtitle":"Multi-Party Threshold Private Set Intersection with Sublinear Communication","summary":"Assuming \\( \\ell \\)-out-of-\\( \\ell \\) threshold FHE with distributed setup, both \\( F_{\\text{TPSI-int}} \\) and \\( F_{\\text{TPSI-diff}} \\) are securely realized against a semi-honest adversary corrupting up to \\( \\ell - 1 \\) parties in a star network with communication \\( O(\\ell \\cdot t \\cdot \\mathrm{poly}(\\kappa)) \\) and \\( O(1) \\) rounds: each party sends encrypted evaluations of its set polynomial, randomized by a factor \\( (x - r_i) \\), to a central party that homomorphically interpolates and tests a rational function, the parties jointly decrypt one bit, and if the test passes a second phase from threshold additively homomorphic encryption gives every party \\( 3t + 4 \\) evaluations of a randomized combination of all set polynomials, from which it interpolates \\( S_i \\setminus I \\).","tableRows":["PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","PSI-CONSTRUCTION-2021-BMRR-TFHE-INT"],"title":"Multiparty threshold PSI with \\( O(\\ell t) \\) communication and \\( O(1) \\) rounds from threshold FHE, matching the \\( \\Omega(\\ell t) \\) bound, semi-honest","type":"result","venue":"PKC 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","keywords":["atomic-result","frobenius-automorphism","depth-free-exponentiation","low-communication","bgv","helib","fully-homomorphic-encryption","unbalanced-psi"],"metadata":{"claim_slug":"frobenius-powers","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption"]},"historical_context":{"narrative":"In homomorphic PSI with a small client set, the client's upload is dominated by the extra encrypted powers it sends so that the server can stay within a shallow circuit, and their number grows with the logarithm of the server's bin size. Cong and coauthors observed that the Frobenius automorphism, available in BGV and BFV, raises an encrypted value to a power of the plaintext modulus without consuming depth. With a small modulus, the server can then build every power it needs from a constant number of ciphertexts, and the upload becomes nearly independent of the server's set size. Their prototype in HElib kept online communication under one megabyte for server sets of up to tens of millions of items, but the server computation took minutes, so the variant demonstrates a communication bound rather than a deployable protocol.","prior_boundary":"With windowing, the earlier protocols need \\( O(\\log B) \\) encrypted powers, \\( B \\) the bin size, for the sender to compute all powers up to \\( B \\) at depth \\( O(\\log \\log B) \\), which gives communication \\( \\tilde O(2^C C^2) \\) for \\( C = \\log \\log n_X \\) (§1.2, p. 3; §3.1, p. 11).","significance_at_publication":"For 210 receiver items, online communication stays at 0.76 MB for sender sets of \\( 2^{22} \\) to \\( 2^{26} \\) items, which the authors compare with 18.32 MB for 128 receiver items in the earlier protocol at \\( 2^{24} \\) (abstract, p. 1; Table 6, p. 20). Evaluation keys of 6 to 9 MB are sent once (Table 5, p. 19). Sender online time is 38.7 s at \\( 2^{20} \\) and 354 s at \\( 2^{24} \\) on 24 threads (Table 8, p. 27), and the authors call the variant not practical today (§6, p. 20).","technical_delta":"A Frobenius operation costs about one key switch, adds only additive noise, and is counted as depth-free (§2.3, p. 5). Lemma 2 (p. 12, proved in Appendix C) gives the number \\( e_D \\) of consecutive powers reachable at depth D, so \\( O(1) \\) encrypted powers suffice (§3.1, pp. 11-12). The HElib implementation over BGV, whose cyclotomic order can be chosen freely, demonstrates the effect without partitioning or windowing and without implementing the OPRF or networking (§5, p. 15; §5.4, pp. 18-19)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","keywords":["frobenius-automorphism","depth-free-exponentiation","low-communication","bgv","helib","fully-homomorphic-encryption","unbalanced-psi"],"limitations":["the HElib implementation does not implement the OPRF or networking; communication is computed from ciphertext sizes plus 32 bytes of OPRF per receiver item (§5, p. 15)","sender online computation is impractically high on current CPUs (abstract, p. 1; Table 8, p. 27; §6, p. 20)","the comparison with the earlier protocol uses public-key-mode sizes supplied by its authors and different receiver set sizes (§5.4, p. 19; Table 6, p. 20)"],"paper_id":"PSI-PAPER-2021-CONG","qualifiers":["requires a small plaintext modulus \\( p \\); the number of SIMD slots is the ring dimension divided by \\( d \\), \\( d \\) the order of \\( p \\) modulo the cyclotomic order \\( m \\), so smaller \\( p \\) gives fewer slots (§3.1, p. 12)","the receiver sends \\( \\lfloor \\log_p B \\rfloor \\) Frobenius evaluation keys, \\( B \\) the bin size, or one key at the cost of more Frobenius operations; keys are independent of the receiver's set and can be cached (§3.1, p. 12; §5.4, p. 19)","SEAL's fixed ring orders leave no suitable small primes, so the technique was implemented only in HElib (§5, p. 15)","the HElib runs use 80-bit hashed items, \\( \\alpha = 1 \\), no windowing or postage-stamp bases, and parameters with at least 128-bit security except one set at 106 bits (§5.4, p. 19; Table 6, p. 20)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-CONG § Contributions","primary_source":"Abstract (p. 1); §1.2 (p. 3); §2.3 (pp. 4-5); §3.1 Low depth exponentiation via the Frobenius operation, Examples 2-4, and Lemma 2 (pp. 11-12); §5 (pp. 14-15); §5.4 and Tables 5-6 (pp. 18-20); §6 (p. 20); Appendix C (p. 25); Appendix D and Tables 7-8 (pp. 25-27). IACR ePrint 2021/1116, PDF dated 2021-11-14.","primary_source_url":"https://eprint.iacr.org/2021/1116","status":"section_checked"},"statement":"Since the Frobenius automorphism maps an encryption of y to an encryption of \\( y^{p^i} \\) without consuming a multiplicative level, the sender can compute all powers \\( y, y^2, \\ldots, y^{e_D} \\) within depth D from the single ciphertext of y (Lemma 2), so evaluating the intersection circuit at depth \\( O(\\log \\log n_X) \\) needs only \\( O(1) \\) query ciphertexts, and the communication complexity becomes \\( \\tilde O(C^2) \\) with \\( C = \\log \\log n_X \\) instead of \\( \\tilde O(2^C C^2) \\); the receiver must also send Frobenius evaluation keys, which the sender can cache, and a small plaintext modulus reduces the number of SIMD slots.","statement_status":"source_normalized_statement","status":"published","title":"Online communication nearly constant in the larger set for FHE-based unbalanced PSI, from depth-free Frobenius powers","work_id":"PSI-PAPER-2021-CONG","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"Depth-free Frobenius powers","heading":"Overview"},{"content":"With plaintext modulus \\( p \\), the Frobenius operation maps an encryption of y to an encryption of \\( y^{p^i} \\) by a permutation of the Double-CRT representation and a key switch (§2.3, p. 5). For \\( p = 2 \\), from y alone the sender obtains \\( y^2 \\), \\( y^4 \\), \\( y^8 \\) at depth zero, the odd powers up to 15 at depth at most two, and the remaining low and high powers of Paterson-Stockmeyer evaluation by further Frobenius maps, so a degree-255 polynomial is evaluated at depth three from one ciphertext (Example 2, p. 11). Lemma 2 (p. 12) generalizes the count to any \\( p \\) and depth \\( D \\).","heading":"Exact contribution"},{"content":"HE-PAPER-2012-GHS-AES: the Frobenius operation and the Double-CRT representation are used as described by Gentry, Halevi, and Smart, cited as [27] (§2.3, p. 5). HE-PAPER-2012-BGV: the low-communication variant is implemented over BGV in HElib (§2.3, p. 4; §5, p. 14).","heading":"Related records in other topics"}],"slug":"cmg21-online-communication-nearly","status":"published","subtitle":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","summary":"Since the Frobenius automorphism maps an encryption of y to an encryption of \\( y^{p^i} \\) without consuming a multiplicative level, the sender can compute all powers \\( y, y^2, \\ldots, y^{e_D} \\) within depth D from the single ciphertext of y (Lemma 2), so evaluating the intersection circuit at depth \\( O(\\log \\log n_X) \\) needs only \\( O(1) \\) query ciphertexts, and the communication complexity becomes \\( \\tilde O(C^2) \\) with \\( C = \\log \\log n_X \\) instead of \\( \\tilde O(2^C C^2) \\); the receiver must also send Frobenius evaluation keys, which the sender can cache, and a small plaintext modulus reduces the number of SIMD slots.","tableRows":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","PSI-CONSTRUCTION-2018-CHLR","PSI-CONSTRUCTION-2021-CONG-FROBENIUS"],"title":"Online communication nearly constant in the larger set for FHE-based unbalanced PSI, from depth-free Frobenius powers","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","keywords":["atomic-result","paterson-stockmeyer","non-scalar-multiplication","polynomial-evaluation","partitioning","fully-homomorphic-encryption","unbalanced-psi","labeled-psi"],"metadata":{"claim_slug":"paterson-stockmeyer","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection","labeled"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption"]},"historical_context":{"narrative":"Homomorphic PSI with a small client set evaluates, for every bin of the server's hash table, a polynomial whose roots are the bin's items, and the earlier protocols did so by computing every power of the client's encrypted value, one ciphertext multiplication per power. With bins of a few thousand items these multiplications dominated the server's online work. Cong and coauthors applied the classic Paterson-Stockmeyer method: compute about the square root of the degree in low powers and as many high powers, combine the low powers with plaintext coefficients, which is cheap, and multiply only by the high powers. The number of expensive multiplications drops from linear to square root in the bin size, from about \\( B \\) to \\( O(\\sqrt{B}) \\) for \\( B \\) the bin size, costing at most one extra level of depth, and it combines with partitioning.","prior_boundary":"In the protocols of Chen et al., the sender computes all powers of the receiver's encrypted item up to \\( \\lceil B/\\alpha \\rceil \\) for \\( \\alpha \\) partitions of a bin of size \\( B \\), using \\( \\lceil B/\\alpha \\rceil - 1 \\) non-scalar multiplications, so computation is \\( O(n_X) \\) homomorphic multiplications with depth \\( O(\\log \\log n_X) \\) (§1.1, p. 3; §3.1, p. 7). When \\( B \\) is in the thousands and \\( \\alpha \\) about ten, these multiplications can dominate the online time (§3.1, p. 7).","significance_at_publication":"The authors call the result a quadratic improvement in homomorphic multiplications over the earlier labeled-PSI protocol (§1.2, p. 3). With all their optimizations, for \\( 2^{28} \\) sender items and 2048 receiver items they report 4.75 s sender online time on 24 threads against 28.5 s on 32 threads, and 15.09 MB against 22.28 MB of online communication (Table 2, p. 17).","technical_delta":"The intersection polynomial is rewritten as a sum over i of \\( y^{iL} \\) times an inner sum of low powers with plaintext coefficients, so only the multiplications by high powers are non-scalar (eq. (2), p. 8). The count is \\( L + 2H - 4 \\) (eq. (3), p. 8), or \\( L_\\alpha + (\\alpha + 1)H_\\alpha - (\\alpha + 3) \\) with partitioning (eq. (4), p. 8), with the optimum derived in Appendix A; Lemma 1 (p. 9) bounds the receiver powers needed for a target depth."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","keywords":["paterson-stockmeyer","non-scalar-multiplication","polynomial-evaluation","partitioning","fully-homomorphic-encryption","unbalanced-psi","labeled-psi"],"limitations":["the reported speedups combine this method with the other optimizations of the paper and different FHE parameters, so they are not attributable to it alone (§5.1, p. 15; Table 2, p. 17)","the comparison runs use 24 threads against the earlier protocol's 32, on machines the authors assume comparable (§5, p. 14; Table 1, p. 16)"],"paper_id":"PSI-PAPER-2021-CONG","qualifiers":["costs are counted in non-scalar multiplications, which dominate both running time and noise growth (§2.3, p. 5)","the slightly faster original Paterson-Stockmeyer variant is not used, because the coefficient ring \\( R_p \\), \\( p \\) the plaintext modulus, is not Euclidean (§3.1, p. 8)","with partitioning the naive method can need fewer multiplications for larger \\( \\alpha \\); Example 1 (p. 8) shows the crossover at \\( \\alpha = 6 \\) for \\( B = 81 \\), and Appendix A gives the general condition"],"source_locator":{"dossier_section":"PSI-PAPER-2021-CONG § Contributions","primary_source":"Abstract (p. 1); §1.1 (p. 3); §1.2 (p. 3); §3.1 Partitioning and Paterson-Stockmeyer (pp. 7-8); eq. (2)-(4) and Example 1 (p. 8); §3.1 Windowing and Lemma 1 (p. 9); Appendix A (pp. 23-24); Tables 1-2 (pp. 16-17). IACR ePrint 2021/1116, PDF dated 2021-11-14.","primary_source_url":"https://eprint.iacr.org/2021/1116","status":"section_checked"},"statement":"In FHE-based unbalanced PSI, the sender can evaluate each bin's intersection polynomial of degree \\( B = LH - 1 \\) on the receiver's encrypted item by computing the low powers \\( y^2, \\ldots, y^{L-1} \\) and the high powers \\( y^L, \\ldots, y^{(H-1)L} \\) and summing high powers times scalar combinations of low powers, which costs \\( L + 2H - 4 \\) ciphertext-ciphertext (non-scalar) multiplications, minimal \\( O(\\sqrt{B}) \\) for \\( L \\approx \\sqrt{2(B + 1)} \\), instead of the \\( \\lceil B/\\alpha \\rceil - 1 \\) needed to compute all powers for \\( \\alpha \\) partitions; with partitioning the count is \\( L_\\alpha + (\\alpha + 1)H_\\alpha - (\\alpha + 3) \\), the depth grows by at most one, and the protocol needs \\( O(\\sqrt{n_X}) \\) homomorphic multiplications.","statement_status":"source_normalized_statement","status":"published","title":"\\( O(\\sqrt{B}) \\) ciphertext-ciphertext multiplications per sender bin, \\( B \\) the bin size, in FHE-based unbalanced PSI, by Paterson-Stockmeyer evaluation of the intersection polynomial","work_id":"PSI-PAPER-2021-CONG","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"Paterson-Stockmeyer evaluation of the intersection polynomial","heading":"Overview"},{"content":"Choose \\( L \\) and \\( H \\) with \\( B = LH - 1 \\). The sender computes \\( y^2, \\ldots, y^{L-1} \\) and \\( y^L, y^{2L}, \\ldots, y^{(H-1)L} \\), and evaluates P(y) as the sum over \\( i < H \\) of \\( y^{iL} \\cdot \\sum_{j<L} a_{iL+j} y^j \\), where the inner sums use only scalar multiplications and additions (eq. (2), p. 8). The depth is \\( \\lceil \\log((H - 1)L + 1) \\rceil + 1 \\), at most one more than computing a degree-\\( B \\) polynomial directly, and window powers sent by the receiver lower it further (§3.1, p. 9). For \\( B = 81 \\), the method needs 23 multiplications without partitioning against 80 for computing all powers (Example 1, p. 8).","heading":"Exact contribution"},{"content":"HE-PAPER-2012-FV and HE-PAPER-2012-BGV: the method is implemented over BFV in SEAL and over BGV in HElib (§2.3, p. 4; §5, p. 14). The Paterson-Stockmeyer algorithm (SIAM J. Computing 1973) has no record in any topic.","heading":"Related records in other topics"}],"slug":"cmg21-o-sqrt-b-multiplications","status":"published","subtitle":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","summary":"In FHE-based unbalanced PSI, the sender can evaluate each bin's intersection polynomial of degree \\( B = LH - 1 \\) on the receiver's encrypted item by computing the low powers \\( y^2, \\ldots, y^{L-1} \\) and the high powers \\( y^L, \\ldots, y^{(H-1)L} \\) and summing high powers times scalar combinations of low powers, which costs \\( L + 2H - 4 \\) ciphertext-ciphertext (non-scalar) multiplications, minimal \\( O(\\sqrt{B}) \\) for \\( L \\approx \\sqrt{2(B + 1)} \\), instead of the \\( \\lceil B/\\alpha \\rceil - 1 \\) needed to compute all powers for \\( \\alpha \\) partitions; with partitioning the count is \\( L_\\alpha + (\\alpha + 1)H_\\alpha - (\\alpha + 3) \\), the depth grows by at most one, and the protocol needs \\( O(\\sqrt{n_X}) \\) homomorphic multiplications.","tableRows":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","PSI-CONSTRUCTION-2018-CHLR","PSI-CONSTRUCTION-2021-CONG-FROBENIUS","PSI-CONSTRUCTION-2021-CONG-LABELED","PSI-CONSTRUCTION-2021-CONG"],"title":"\\( O(\\sqrt{B}) \\) ciphertext-ciphertext multiplications per sender bin, \\( B \\) the bin size, in FHE-based unbalanced PSI, by Paterson-Stockmeyer evaluation of the intersection polynomial","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","keywords":["atomic-result","postage-stamp-basis","windowing","query-powers","multiplicative-depth","fully-homomorphic-encryption","unbalanced-psi"],"metadata":{"claim_slug":"postage-stamp-bases","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection","labeled"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption"]},"historical_context":{"narrative":"To keep the circuit shallow, FHE-based PSI lets the client send several encrypted powers of each query value, from which the server builds all the powers it needs. The earlier protocols chose these powers by windowing, sending digits of a fixed base, which is simple but sends more ciphertexts than necessary. Cong and coauthors recognized the choice as the global postage-stamp problem from additive number theory: find few integers whose sums of at most \\( h \\) terms cover every value up to a bound. Sending powers at an extremal basis keeps the depth at the logarithm of \\( h \\) while needing fewer ciphertexts, for example three instead of five to reach the twenty-sixth power at depth two, and a scaled second basis serves the high powers of their polynomial evaluation.","prior_boundary":"Windowing, as in the earlier protocols, sends, for \\( b \\) the window base and \\( B \\) the bin size, the \\( (b - 1)(\\lfloor \\log_b B \\rfloor + 1) \\) powers \\( y^{i \\cdot b^j} \\) so that all powers up to \\( B \\) are reachable at depth \\( \\lceil \\log(\\lfloor \\log_b B \\rfloor + 1) \\rceil \\), with \\( b \\) derived from the target depth (§3.1, p. 9). The authors call it easy to use but far from optimal (§3.1, p. 10).","significance_at_publication":"In the \\( B = 26 \\) example the receiver sends three powers instead of five at the same depth (§3.1, p. 10). Combined with Paterson-Stockmeyer, the six powers {1, 5, 8, 27, 135, 216} support polynomials of degree 728 at depth three (§3.1, p. 11). The authors note that no efficient method for finding such bases is known and that bases with large h are hard to find (§3.1, pp. 10-11).","technical_delta":"Choosing which powers to send is cast as the global postage-stamp problem (Definition 1, p. 10). The sender iterates over the exponents and computes each missing power depth-optimally as a product of two lower ones (Figure 1, p. 10). Brute-forced bases for small instances are taken from the number-theory literature, one for the low powers and one scaled by L for the high powers of Paterson-Stockmeyer evaluation (§3.1, pp. 10-11)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","keywords":["postage-stamp-basis","windowing","query-powers","multiplicative-depth","fully-homomorphic-encryption","unbalanced-psi"],"limitations":["bases with large \\( h \\) can be hard to find and may raise online computation because many powers are computed by non-scalar multiplication (§3.1, p. 11)","the paper reports no measurement isolating this change; the SEAL experiments combine it with the other optimizations (§5, p. 15)"],"paper_id":"PSI-PAPER-2021-CONG","qualifiers":["the depth bound \\( \\lceil \\log_2 h \\rceil \\), \\( h \\) the number of summands allowed, follows from computing each power as a product of two lower powers (§3.1, p. 10)","only small instances are used, for which extremal bases have been found by brute force in the literature (§3.1, p. 11)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-CONG § Contributions","primary_source":"§1.2 (p. 3); §3.1 Windowing (p. 9); §3.1 Extremal postage-stamp bases, Definition 1, and Figure 1 (pp. 10-11). IACR ePrint 2021/1116, PDF dated 2021-11-14.","primary_source_url":"https://eprint.iacr.org/2021/1116","status":"section_checked"},"statement":"If the receiver sends encryptions of \\( y^{a_1}, \\ldots, y^{a_k} \\) for an extremal postage-stamp basis \\( \\{a_1 = 1 < \\cdots < a_k\\} \\), in which every integer up to \\( r \\) is a sum of at most \\( h \\) basis elements, the sender can compute all powers of y up to \\( r \\) within multiplicative depth \\( \\lceil \\log_2 h \\rceil \\), \\( h \\) the number of summands allowed; this replaces the windowing of earlier FHE-based PSI, for example with three powers {1, 5, 8} instead of five {1, 2, 4, 8, 16} for all powers up to 26 at depth two, a 40% reduction of receiver-to-sender ciphertexts, and a second basis multiplied by L supplies the high powers of Paterson-Stockmeyer evaluation.","statement_status":"source_normalized_statement","status":"published","title":"Fewer encrypted query powers at a fixed multiplicative depth in FHE-based unbalanced PSI, from extremal postage-stamp bases instead of windowing","work_id":"PSI-PAPER-2021-CONG","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"Extremal postage-stamp bases for the receiver's powers","heading":"Overview"},{"content":"Definition 1 (p. 10) asks, for given \\( h \\) and \\( k \\), for \\( k \\) integers \\( 1 = a_1 < \\cdots < a_k \\) such that every integer up to \\( r \\) is a sum of at most \\( h \\) of them, with \\( r \\) maximal. If the receiver sends encryptions of y at the basis exponents, the sender reaches all powers up to \\( r \\) in depth \\( \\lceil \\log_2 h \\rceil \\). The basis {1, 5, 8} is the unique extremal basis for \\( h = 4 \\) and \\( k = 3 \\) (§3.1, p. 10). For Paterson-Stockmeyer evaluation one basis covers the low powers up to \\( L - 1 \\) and the same or another basis multiplied by \\( L \\) covers the high powers (§3.1, p. 11).","heading":"Exact contribution"},{"content":"Extremal postage-stamp bases (Challis and Robinson, Journal of Integer Sequences 2010) belong to additive number theory and have no record in any topic.","heading":"Related records in other topics"}],"slug":"cmg21-fewer-encrypted-query-powers","status":"published","subtitle":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","summary":"If the receiver sends encryptions of \\( y^{a_1}, \\ldots, y^{a_k} \\) for an extremal postage-stamp basis \\( \\{a_1 = 1 < \\cdots < a_k\\} \\), in which every integer up to \\( r \\) is a sum of at most \\( h \\) basis elements, the sender can compute all powers of y up to \\( r \\) within multiplicative depth \\( \\lceil \\log_2 h \\rceil \\), \\( h \\) the number of summands allowed; this replaces the windowing of earlier FHE-based PSI, for example with three powers {1, 5, 8} instead of five {1, 2, 4, 8, 16} for all powers up to 26 at depth two, a 40% reduction of receiver-to-sender ciphertexts, and a second basis multiplied by L supplies the high powers of Paterson-Stockmeyer evaluation.","tableRows":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","PSI-CONSTRUCTION-2018-CHLR","PSI-CONSTRUCTION-2021-CONG-LABELED","PSI-CONSTRUCTION-2021-CONG"],"title":"Fewer encrypted query powers at a fixed multiplicative depth in FHE-based unbalanced PSI, from extremal postage-stamp bases instead of windowing","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","keywords":["atomic-result","prime-field-slots","simd-packing","mandatory-oprf","labeled-psi","label-encryption","interpolation","fully-homomorphic-encryption","unbalanced-psi"],"metadata":{"claim_slug":"prime-field-slots","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"output":["intersection","labeled"],"parties":["two_party"],"set_size_regime":["unbalanced"],"technique":["fully_homomorphic_encryption","oprf"]},"historical_context":{"narrative":"The first labeled FHE-based PSI protocol handled long items by packing each hashed item into one slot over an extension field, which made every homomorphic operation slower, most painfully when long labels multiplied the work. Splitting an item across several small prime-field slots looks natural, but each slot value is short enough to guess, so partial matches would leak whenever the oblivious PRF step was skipped, as the earlier protocol allowed. Cong and coauthors made the PRF step mandatory, after which item chunks reveal nothing and prime fields suffice. For labels they encrypt each label under its item's PRF output, interpolate the ciphertext chunk by chunk, add a fresh nonce on updates, and move items whose chunks collide within a bin to another partition.","prior_boundary":"The earlier labeled-PSI protocol supported arbitrary-length items by hashing them into extension-field slots, which the authors say can be devastating for performance, especially with labels, and constrains parameter choices (§3.1, p. 7). It treated the OPRF step as optional, so small slot values could be guessed and partial matches would leak (§3.1, p. 7), and its label interpolation relied on extension fields, where non-zero values can be randomized and items never repeat (§4.1, p. 13; §4.2, p. 14).","significance_at_publication":"The authors expect prime fields to be cheaper than extension fields, while interpolation remains \\( O(B^2) \\) field operations, \\( B \\) the bin size (§4.2, p. 13). With all their optimizations, for 288-byte labels, \\( 2^{20} \\) sender and 256 receiver items, they report 0.66 s sender online time on 16 threads and 11.2 MB, against 4.6 s and 17.6 MB for the earlier protocol (Table 3, p. 18). They also sketch the labeled-case security proof that the earlier paper left implicit (§4.2, p. 14).","technical_delta":"Hashed items are split into prime-field chunks and the OPRF is always applied, so chunks of non-matching items look random (§3.1, p. 7). Labels are encrypted under part of the OPRF output and interpolated chunk by chunk (§4.2, p. 13; Figure 2, p. 13). Appending a random nonce on each update avoids XOR leakage between label versions, and an item whose chunks collide in a partition goes to another or a new partition, since interpolation would otherwise be impossible (§4.2, pp. 13-14)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","keywords":["prime-field-slots","simd-packing","mandatory-oprf","labeled-psi","label-encryption","interpolation","fully-homomorphic-encryption","unbalanced-psi"],"limitations":["interpolation still costs \\( O(B^2) \\) field operations per bin, \\( B \\) the bin size, mitigated only by the updatability of the precomputation (§4.2, p. 13)","labeled PSI uses more partitions and fills them less than unlabeled PSI because of chunk collisions (§4.2, p. 14)","the labeled-case security is sketched as an extension of the earlier unlabeled proof, not proved in full (§4.2, p. 14)"],"paper_id":"PSI-PAPER-2021-CONG","qualifiers":["relies on the OPRF of the earlier protocol, which gives security against a malicious receiver and privacy against a malicious sender in the random oracle model; the paper keeps those guarantees and proof (§3, p. 6)","labels longer than the item are split into item-length fragments, each with its own interpolation polynomial, so sender-to-receiver communication grows linearly in the number of fragments, \\( O(\\lceil \\sigma_{\\mathrm{L}}/\\sigma \\rceil) \\) for \\( \\sigma_{\\mathrm{L}} \\)-bit labels (§4.2, p. 14; §5.3, p. 18)","the labeled protocol returns the intersection result together with the label results, so the receiver knows which labels hold valid data (§4.2, p. 14)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-CONG § Contributions","primary_source":"§1.2 (p. 3); §3 (pp. 5-6); §3.1 SIMD packing (p. 7); §4.1-4.2 and Figure 2 (pp. 12-14); §5.3 and Tables 3-4 (pp. 18-19). IACR ePrint 2021/1116, PDF dated 2021-11-14.","primary_source_url":"https://eprint.iacr.org/2021/1116","status":"section_checked"},"statement":"If the OPRF step is always applied, each hashed item can be split across several consecutive prime-field SIMD slots, with the intersection polynomial evaluated on each part independently, instead of occupying one extension-field slot, because partial matches of OPRF outputs reveal nothing about the sender's items; for labeled PSI, each label is encrypted under a key derived from its item's OPRF output, with a fresh random nonce on every update, and the encrypted label is interpolated per slot-sized part, while the sender re-places any item whose parts collide with an existing item in the same bin and partition, at the cost of more partitions and a lower fill rate than unlabeled PSI.","statement_status":"source_normalized_statement","status":"published","title":"Arbitrary-length items and labels in FHE-based unbalanced PSI over prime-field SIMD slots, enabled by mandatory OPRF hashing","work_id":"PSI-PAPER-2021-CONG","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1116","sections":[{"content":"Prime-field slots for long items and labels","heading":"Overview"},{"content":"After the OPRF step, the receiver places each hashed item in a cuckoo bin and spreads it over several consecutive prime-field slots; the sender evaluates the intersection polynomial of each chunk position independently (§3.1, p. 7). For labels, the OPRF output is extended so that one part represents the item and another keys a symmetric cipher; the sender interpolates the encrypted label chunks (Figure 2, p. 13), and the receiver decrypts the label with the key derived from its own OPRF value (§4.2, p. 13). When inserting an item, the sender checks that none of its chunks already appears in the same positions of the target partition (§4.2, p. 14).","heading":"Exact contribution"},{"content":"HE-RESULT-2012-SV-SIMD-CIPHERTEXT-SLOT-PACKING-AND-PARALLEL-RECRYPTION: SIMD packing, cited as [60] (§2.3, p. 5).","heading":"Related records in other topics"}],"slug":"cmg21-arbitrary-length-items-and","status":"published","subtitle":"Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication","summary":"If the OPRF step is always applied, each hashed item can be split across several consecutive prime-field SIMD slots, with the intersection polynomial evaluated on each part independently, instead of occupying one extension-field slot, because partial matches of OPRF outputs reveal nothing about the sender's items; for labeled PSI, each label is encrypted under a key derived from its item's OPRF output, with a fresh random nonce on every update, and the encrypted label is interpolated per slot-sized part, while the sender re-places any item whose parts collide with an existing item in the same bin and partition, at the cost of more partitions and a lower fill rate than unlabeled PSI.","tableRows":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","PSI-CONSTRUCTION-2018-CHLR","PSI-CONSTRUCTION-2021-CONG-LABELED","PSI-CONSTRUCTION-2021-CONG"],"title":"Arbitrary-length items and labels in FHE-based unbalanced PSI over prime-field SIMD slots, enabled by mandatory OPRF hashing","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-GPRTY-3H-GCT","keywords":["atomic-result","3h-gct","garbled-cuckoo-table","hypergraph-peeling","two-core","binary-okvs","okvs-rate"],"metadata":{"claim_slug":"3h-gct","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"technique":["okvs"]},"historical_context":{"narrative":"The PaXoS encoding placed each item on an edge of a random graph, which keeps encoding linear but leaves more than half of the table slack, and in PaXoS-PSI every table position costs one oblivious transfer. Garimella and coauthors observed that hypergraphs with three positions per item stay peelable down to about \\( 1.23n \\) positions, so the same peel-and-back-substitute strategy works with a table little larger than the data. They kept the short random tail that absorbs the few unpeelable items and argued that, with current techniques, three positions per item is the right choice for peeling. Plugged into PaXoS-PSI, the smaller table cut communication by about forty percent, although the parameter \\( 1.3n \\) rested on experiments rather than a proven bound.","prior_boundary":"PaXoS used a cuckoo graph with two hash functions and about \\( 2.4n \\) positions, a heuristic choice with no proven failure probability, giving rate \\( 0.4 - o(1) \\) (§3, p. 9; Figure 1, p. 8); polynomial OKVS had rate 1 but \\( O(n \\log^2 n) \\) encoding (§3, p. 7).","significance_at_publication":"Instantiating PaXoS-PSI with it, the authors report 1.61 times less communication than PaXoS-PSI with malicious security, because \\( 1.3n \\) OTs replace \\( 2.4n \\) (§8.2, p. 23; Table 1, p. 24), and an encoding of 20.80 MB against 38.40 MB for PaXoS at \\( n = 2^{20} \\) (Table 2, p. 29).","technical_delta":"The table moves from graphs to 3-hypergraphs, which are asymptotically peelable with at least about \\( 1.23n \\) nodes (§4.1, pp. 9-10), keeps the \\( L \\| R \\) structure of PaXoS for the 2-core (§4.1, pp. 10-11), and is specified in Figure 2 (p. 12) with Lemma 6 (p. 11; proof sketch in Appendix A.1, p. 28). The implementation uses \\( 1.3n \\) nodes (§8.1, p. 23)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-GPRTY-3H-GCT","keywords":["3h-gct","garbled-cuckoo-table","hypergraph-peeling","two-core","binary-okvs","okvs-rate"],"limitations":["the authors call \\( m = 1.3n \\) an acceptable heuristic, and their table lists the error analysis of 3H-GCT as heuristic (§8.1, p. 23; Table 2, p. 29)","the rate 0.91 possible with Walzer's hypergraph construction takes effect only for very large \\( n \\) (Figure 1 caption, p. 8; §4.1, p. 10)"],"paper_id":"PSI-PAPER-2021-GPRTY","qualifiers":["values are combined by XOR, so the OKVS is binary; the extra positions R are needed because small 2-cores often consist of two identical hyperedges (§4.1, p. 11, footnote 6)","Lemma 6 is conditional on a bound \\( d(n) \\) on the 2-core, which the paper does not derive concretely; known analyses do not give concrete parameters for failure \\( 2^{-\\lambda} \\) (§4.1, p. 10)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-GPRTY § Contributions","primary_source":"Figure 1 (p. 8); §3, PaXoS (p. 9); §4.1 with footnotes 4-6 (pp. 9-11); Lemma 6 (p. 11); Figure 2 (p. 12); §8.1-8.2 (p. 23); Table 1 (p. 24); Appendix A.1 (p. 28); Table 2 (p. 29). IACR ePrint 2021/883, PDF dated 2021-11-30.","primary_source_url":"https://eprint.iacr.org/2021/883","status":"theorem_checked"},"statement":"Each key is mapped to a hyperedge of three distinct positions in a table L and to a random vector r(k) over \\( d + \\lambda \\) extra positions R, with \\( d = d(n) \\). Encoding peels the hypergraph, solves the constraints of the remaining 2-core by Gaussian elimination in \\( O((d + \\lambda)^3) \\) time, and fills the peeled positions in reverse order. If the 2-core exceeds \\( d \\) hyperedges with probability at most \\( \\varepsilon_1 \\), the result is an OKVS with error \\( \\varepsilon_1 + 2^{-\\lambda} \\) (Lemma 6). The authors list its rate as \\( 0.81 - o(1) \\) with \\( O(n\\lambda) \\) encoding and batch decoding, against \\( 0.4 - o(1) \\) for PaXoS.","statement_status":"source_normalized_statement","status":"published","title":"Three-hash garbled cuckoo table: binary OKVS with about \\( 1.3n \\) main positions instead of the \\( 2.4n \\) of PaXoS, by peeling a random 3-hypergraph","work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"Three-hash garbled cuckoo table","heading":"Overview"},{"content":"Each key k selects three distinct positions \\( h_1(k), h_2(k), h_3(k) \\) of L, and its value is the XOR of those positions and of the positions of R selected by r(k) (§4.1, pp. 9-11). Encoding repeatedly removes a hyperedge that touches a position used by no other remaining key, pushing it onto a stack; it then solves the system for the keys left in the 2-core, and finally pops the stack, setting for each key a position not yet defined so that the key decodes correctly (Figure 2, p. 12). Hyperedges of size three are used because larger hyperedges improve the orientability threshold but make linear-time peeling fail more often (footnote 5, p. 10). The construction improves the rate of the PaXoS table of PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO, and its failure probability is made concrete by the amplification of PSI-CONTRIB-2021-GPRTY-AMPLIFICATION. The PSI rows that use it are PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT and, through the star architecture, PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.","heading":"Exact contribution"}],"slug":"gprty21-three-hash-garbled-cuckoo","status":"published","subtitle":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","summary":"Each key is mapped to a hyperedge of three distinct positions in a table L and to a random vector r(k) over \\( d + \\lambda \\) extra positions R, with \\( d = d(n) \\). Encoding peels the hypergraph, solves the constraints of the remaining 2-core by Gaussian elimination in \\( O((d + \\lambda)^3) \\) time, and fills the peeled positions in reverse order. If the 2-core exceeds \\( d \\) hyperedges with probability at most \\( \\varepsilon_1 \\), the result is an OKVS with error \\( \\varepsilon_1 + 2^{-\\lambda} \\) (Lemma 6). The authors list its rate as \\( 0.81 - o(1) \\) with \\( O(n\\lambda) \\) encoding and batch decoding, against \\( 0.4 - o(1) \\) for PaXoS.","tableRows":["PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"],"title":"Three-hash garbled cuckoo table: binary OKVS with about \\( 1.3n \\) main positions instead of the \\( 2.4n \\) of PaXoS, by peeling a random 3-hypergraph","type":"result","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-GPRTY-3H-GCT"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","keywords":["atomic-result","okvs-amplification","star-architecture","failure-probability","clopper-pearson","empirical-validation","cuckoo-hashing-parameters"],"metadata":{"claim_slug":"amplification","contribution_kind":"transform","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"technique":["okvs"]},"historical_context":{"narrative":"Cuckoo-style encodings are fast, but no one could say concretely how large they must be to fail with probability \\( 2^{-40} \\). The asymptotic analyses hide their constants, and confirming so small a probability by experiment needs more than \\( 2^{40} \\) trials. Garimella, Pinkas, Rosulek, Trieu, and Yanai turned the problem around. A failure rate near \\( 2^{-30} \\) can be measured on ordinary hardware, and a composite encoding whose central part repairs any single failed component fails only when two components fail, roughly squaring the probability. Splitting the keys among many small leaves keeps the total size close to that of one table. The security parameter then rests on a measured quantity and an exact combinatorial bound instead of extrapolation.","prior_boundary":"Randomized structures in PSI, such as cuckoo hashing, have asymptotic analyses with unclear constants, so parameters for failure \\( 2^{-40} \\) were set heuristically or, as by Pinkas, Schneider, and Zohner, extrapolated from experiments costing millions of core hours that could not validate such small probabilities (§1.2, p. 3; §5, p. 13, footnote 7).","significance_at_publication":"The authors describe the star-architecture OKVS as the only construction in their comparison with an empirically proven error probability (Appendix A.2, p. 28; Table 2, p. 29); it is the encoding of their 'star arch.' PSI, which sends 1.43 times less than PaXoS-PSI with malicious security (§8.2, p. 23).","technical_delta":"Three architectures (§5.1-5.3, pp. 13-17) build a new OKVS from instances of an underlying OKVS with independent hash functions; the concrete instantiation (§5.4, pp. 17-18) validates \\( \\varepsilon \\) for the three-hash table with \\( 2^{33} \\) runs at \\( n' = 6600 \\) and amplifies it with \\( b = 10 \\) or 160 leaves."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","keywords":["okvs-amplification","star-architecture","failure-probability","clopper-pearson","empirical-validation","cuckoo-hashing-parameters"],"limitations":["encoding calls the underlying encoder up to \\( 2b + 1 \\) times, \\( b \\) the number of leaves, and decoding calls it twice (§5.2, p. 16)","the failure probability of the instantiation depends on an empirical measurement, not a proof (§5.4, p. 17)"],"paper_id":"PSI-PAPER-2021-GPRTY","qualifiers":["\\( \\varepsilon \\) is an empirical upper bound at confidence 0.9999 from the Clopper-Pearson method, measured at \\( n' = 6600 \\) and assumed to hold for larger leaf loads (§5.4, p. 17; footnote 9, p. 18)","a failure of the underlying table is a 2-core larger than \\( 0.5 \\log n' \\) after peeling (§5.4, p. 17)","the maximum leaf load \\( n' \\) is bounded by a balls-into-bins tail bound with probability \\( 2^{-\\lambda} \\) (Eq. (5), p. 16)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-GPRTY § Contributions","primary_source":"Abstract (p. 1); §1.2 (p. 3); §5 with footnotes 7-8 (p. 13); §5.1-5.3 (pp. 13-17); Eq. (3)-(5) (pp. 15-16); §5.4 with footnote 9 (pp. 17-18); Appendix A.2 and Table 2 (pp. 28-29). IACR ePrint 2021/883, PDF dated 2021-11-30.","primary_source_url":"https://eprint.iacr.org/2021/883","status":"section_checked"},"statement":"From an OKVS that fails with probability \\( \\varepsilon \\), replication with \\( c \\) copies fails with probability \\( \\varepsilon^c \\) at \\( c \\) times the size. The star architecture hashes keys into \\( b \\) leaf OKVS and adds one central OKVS; a single failed component is set at random and corrected through the others, so the scheme fails only if two of the \\( b + 1 \\) components fail, about \\( \\binom{b + 1}{2} \\cdot \\varepsilon^2 \\), at size \\( (b + 1) \\cdot \\mathrm{size}(n') \\) with \\( n' \\) the maximum leaf load. The generalized star replicates the central OKVS \\( d \\) times, \\( d \\) the replication factor, to tolerate \\( d - 1 \\) leaf failures, failing with probability \\( O(\\varepsilon^d) \\). Over the three-hash table with an empirically measured \\( \\varepsilon = 2^{-29.355} \\) at confidence 0.9999, the star gives failure \\( 2^{-52.9} \\) for \\( n = 2^{16} \\) and \\( 2^{-45.05} \\) for \\( n = 2^{20} \\) at about \\( 1.3n \\) size.","statement_status":"source_normalized_statement","status":"published","title":"OKVS correctness amplification: replication and star architectures turn \\( \\varepsilon \\), the empirically validated failure probability, into about \\( \\varepsilon^2 \\), or \\( O(\\varepsilon^d) \\) for \\( d \\) the replication factor of the central OKVS, at nearly the same size","work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"OKVS correctness amplification","heading":"Overview"},{"content":"All three architectures rely on two facts: whether an OKVS encoding fails depends only on its keys and hash functions, and a random vector of the right length is a valid encoding of random values (§5, p. 13). Replication tries a second instance whenever the first fails (§5.1, pp. 13-14). The star architecture decodes a key as the sum of its leaf's value and the central value; if one component fails, it is filled at random and the others are encoded to compensate (§5.2, pp. 14-16; failure probability in Eq. (3)-(4), p. 15). The generalized star replaces the central node by a \\( d \\)-fold replicated OKVS that can absorb up to \\( d - 1 \\) failed leaves (§5.3, pp. 16-17). In the concrete instantiation, each leaf is a three-hash table with \\( 1.3n' + \\lambda + 0.5 \\log n' \\) positions (PSI-CONTRIB-2021-GPRTY-3H-GCT), and the total size is about \\( 1.3n \\) (§5.4, pp. 17-18). The PSI row that uses it is PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.","heading":"Exact contribution"}],"slug":"gprty21-okvs-correctness-amplificati","status":"published","subtitle":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","summary":"From an OKVS that fails with probability \\( \\varepsilon \\), replication with \\( c \\) copies fails with probability \\( \\varepsilon^c \\) at \\( c \\) times the size. The star architecture hashes keys into \\( b \\) leaf OKVS and adds one central OKVS; a single failed component is set at random and corrected through the others, so the scheme fails only if two of the \\( b + 1 \\) components fail, about \\( \\binom{b + 1}{2} \\cdot \\varepsilon^2 \\), at size \\( (b + 1) \\cdot \\mathrm{size}(n') \\) with \\( n' \\) the maximum leaf load. The generalized star replicates the central OKVS \\( d \\) times, \\( d \\) the replication factor, to tolerate \\( d - 1 \\) leaf failures, failing with probability \\( O(\\varepsilon^d) \\). Over the three-hash table with an empirically measured \\( \\varepsilon = 2^{-29.355} \\) at confidence 0.9999, the star gives failure \\( 2^{-52.9} \\) for \\( n = 2^{16} \\) and \\( 2^{-45.05} \\) for \\( n = 2^{20} \\) at about \\( 1.3n \\) size.","tableRows":["PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR"],"title":"OKVS correctness amplification: replication and star architectures turn \\( \\varepsilon \\), the empirically validated failure probability, into about \\( \\varepsilon^2 \\), or \\( O(\\varepsilon^d) \\) for \\( d \\) the replication factor of the central OKVS, at nearly the same size","type":"result","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-GPRTY-AMPLIFICATION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","keywords":["atomic-result","vector-ole","linear-okvs","paxos-psi","malicious-psi","error-correcting-code","field-correlation"],"metadata":{"claim_slug":"linear-okvs-vole","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["okvs","vole"]},"historical_context":{"narrative":"PaXoS-PSI took its correlated strings from a malicious OT extension, whose correlation mixes XOR with bitwise AND, and that mix is why it needed a binary encoding and a long error-correcting code. Garimella and coauthors observed that vector OLE supplies the same kind of correlation with a genuine field multiplication by the sender's secret. Any linear encoding then commutes with the correlation, and a hashed value with a nonzero offset already looks random without a code. They restated the PaXoS-PSI protocol for this setting, so that any linear OKVS can serve, including non-binary ones. At the time no malicious-secure vector OLE had been implemented, and the authors left open whether this route would beat the OT-extension version in practice.","prior_boundary":"PaXoS-PSI works only with a binary OKVS, because the bitwise AND in the OOS correlation is not a field operation, and it needs an error-correcting code of minimum distance \\( \\kappa \\) so that \\( C(d_i) \\wedge s \\) masks at least \\( \\kappa \\) bits of s (§7.1, pp. 20-21).","significance_at_publication":"The generalization admits non-binary OKVS and removes one source of overhead (§1.3, p. 4). The authors note that it requires a malicious-secure vOLE, none of which had been implemented, and leave to future work whether it is competitive with the OT-extension version (§7.1, p. 21).","technical_delta":"With the field correlation of vector OLE, \\( \\mathrm{Decode}(R, k) = \\mathrm{Decode}(Q, k) \\oplus \\mathrm{Decode}(D, k) \\cdot s \\) holds for any linear OKVS, and \\( H(a \\oplus b \\cdot s) \\) looks random to the receiver for every nonzero b, so no code is needed (§7.1, p. 21); the protocol is Figure 3 (p. 22), adapted from PaXoS-PSI, with Theorem 7 (p. 21)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","keywords":["vector-ole","linear-okvs","paxos-psi","malicious-psi","error-correcting-code","field-correlation"],"limitations":["no implementation or concrete cost is given, and no malicious-secure vOLE had been implemented (§7.1, p. 21)","the proof is not written out; the paper states that it follows closely the proof of PaXoS-PSI (§7.1, p. 21)"],"paper_id":"PSI-PAPER-2021-GPRTY","qualifiers":["malicious security in the vOLE-hybrid, random oracle model, with the hash lengths \\( \\ell_1, \\ell_2 \\) of PaXoS-PSI (Theorem 7, p. 21; Figure 3, p. 22)","the OKVS must be linear over \\( \\mathrm{GF}(2^{\\ell_1}) \\), and only the receiver learns the intersection (Figure 3, p. 22)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-GPRTY § Contributions","primary_source":"§1.3 (p. 4); §7.1 with Eq. (6)-(7) (pp. 20-21); Theorem 7 (p. 21); Figure 3 (p. 22). IACR ePrint 2021/883, PDF dated 2021-11-30.","primary_source_url":"https://eprint.iacr.org/2021/883","status":"theorem_checked"},"statement":"The OOS correlation \\( r_i = q_i \\oplus C(d_i) \\wedge s \\) of PaXoS-PSI is replaced by the vector-OLE correlation \\( q_i = r_i \\oplus d_i \\cdot s \\) over \\( \\mathrm{GF}(2^{\\ell_1}) \\). The receiver's vOLE input is a linear OKVS D encoding the pairs \\( (y, H_1(y)) \\) for its set, and the sender sends \\( H_2(x, \\mathrm{Decode}(Q, x) \\oplus H_1(x) \\cdot s) \\) for each of its items. For any linear OKVS and the hash lengths of PaXoS-PSI, the protocol realizes two-party PSI against malicious adversaries (Theorem 7).","statement_status":"source_normalized_statement","status":"published","title":"Malicious two-party PSI from any linear OKVS and vector OLE, generalizing PaXoS-PSI and removing its error-correcting code","work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"PSI from a linear OKVS and vector OLE","heading":"Overview"},{"content":"In vector OLE the sender holds a secret s and a vector Q, and the receiver holds its chosen vector D and R with \\( q_i = r_i \\oplus d_i \\cdot s \\), where \\( \\cdot \\) is multiplication in \\( \\mathrm{GF}(2^{\\ell_1}) \\) (Figure 3, step 1, p. 22). If D is a linear OKVS (PSI-CONTRIB-2021-GPRTY-OKVS) that decodes to \\( H_1(y) \\) on the receiver's set, decoding commutes with the correlation, so for such y the receiver's \\( \\mathrm{Decode}(R, y) \\) equals the sender's \\( \\mathrm{Decode}(Q, y) \\oplus H_1(y) \\cdot s \\), while for other x the two differ by a nonzero multiple of s (§7.1, pp. 20-21). The sender hashes its values with the item and sends them permuted; the receiver outputs the items whose hash appears (Figure 3, steps 2-3, p. 22). Compared with PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI, the code that made the AND-based correlation hide s disappears, and any linear OKVS can be used (§7.1, p. 21). The paper also observes that the VOLE-based OPRF of Rindal and Schoppmann, PSI-CONTRIB-2021-RS-VOLE-OPRF, can use any OKVS in place of PaXoS (§6.2, p. 19). The complete row is PSI-CONSTRUCTION-2021-GPRTY-VOLE.","heading":"Exact contribution"},{"content":"MPC-PAPER-2019-PCG: the paper cites the pseudorandom correlation generators of Boyle et al. among the vector-OLE protocols that produce this correlation (§7.1, p. 21; reference [BCG+19], p. 24).","heading":"Related records in other topics"}],"slug":"gprty21-malicious-two-party-psi","status":"published","subtitle":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","summary":"The OOS correlation \\( r_i = q_i \\oplus C(d_i) \\wedge s \\) of PaXoS-PSI is replaced by the vector-OLE correlation \\( q_i = r_i \\oplus d_i \\cdot s \\) over \\( \\mathrm{GF}(2^{\\ell_1}) \\). The receiver's vOLE input is a linear OKVS D encoding the pairs \\( (y, H_1(y)) \\) for its set, and the sender sends \\( H_2(x, \\mathrm{Decode}(Q, x) \\oplus H_1(x) \\cdot s) \\) for each of its items. For any linear OKVS and the hash lengths of PaXoS-PSI, the protocol realizes two-party PSI against malicious adversaries (Theorem 7).","tableRows":["PSI-CONSTRUCTION-2021-GPRTY-VOLE"],"title":"Malicious two-party PSI from any linear OKVS and vector OLE, generalizing PaXoS-PSI and removing its error-correcting code","type":"result","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","keywords":["atomic-result","multiparty-psi","malicious","zero-sharing","oprf","okvs","augmented-semi-honest","star-topology"],"metadata":{"claim_slug":"malicious-multiparty","contribution_kind":"security_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["multiparty"],"security_model":["random_oracle_model"],"technique":["okvs","vole","secret_sharing"]},"historical_context":{"narrative":"Kolesnikov and coauthors had built multiparty PSI from two-party oblivious PRFs: each party masks its PRF outputs with shares of zero, and a central party sees the shares cancel only on items that everyone holds. Their most efficient variant was proven only against augmented semi-honest adversaries, in a model where the simulator may change corrupt inputs. Garimella and coauthors showed that after each PRF output is hashed together with the item through a random oracle, the same protocol is secure against malicious parties. Changing a corrupt party's input is harmless in that model, and the oracle lets a simulator read off the items an adversary encoded. Writing the protocol over any OKVS let it use the new fast encodings instead of polynomials.","prior_boundary":"Kolesnikov et al.'s most efficient multiparty PSI, built from an OPPRF that encodes zero shares with a polynomial or a garbled Bloom filter, had only augmented semi-honest security; other concretely efficient malicious multiparty PSI relied on garbled Bloom filters with cut-and-choose checks (§6.2, p. 19; §7.2, pp. 21-22; Appendix B.5, p. 35).","significance_at_publication":"The authors call it the most efficient malicious multiparty PSI to date, at nearly the cost of the augmented semi-honest protocol (§1.3, p. 4; §7.2, p. 22), against garbled-Bloom-filter protocols that they report as about 10 and 2 times slower than that protocol (§7.2, p. 22; Table 4, p. 36).","technical_delta":"Figure 5 (p. 39) writes Kolesnikov et al.'s construction over an arbitrary OKVS and wraps each OPRF output in a random oracle so that the simulator can extract inputs (Appendix B.2, p. 30); Theorem 9 (p. 31) is proved in Appendix B.4 (pp. 30-35), with a compression argument bounding the extracted set by \\( 2n \\) (p. 34). Appendix B.6 (pp. 36-37) explains why the protocol is malicious-secure though not semi-honest-secure."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","keywords":["multiparty-psi","malicious","zero-sharing","oprf","okvs","augmented-semi-honest","star-topology"],"limitations":["the protocol does not strictly enforce corrupt parties' advertised set sizes; restricting them to \\( n \\) items is left open (Appendix B.4, pp. 34-35; Appendix B.7, p. 37)","no implementation of the multiparty protocol is reported (§8, pp. 22-24)"],"paper_id":"PSI-PAPER-2021-GPRTY","qualifiers":["secure in the \\( F_{\\mathrm{oprf}} \\)-hybrid model with a malicious-secure two-party OPRF, for an exponentially large field F (Theorem 9, p. 31; Figure 5, p. 39)","star topology; only P0 receives output (Figure 5, p. 39)","all parties hold sets of the same size \\( n \\); with unequal sizes only a weaker functionality, in which corrupt parties may use the largest advertised size, is achieved (Appendix B.7, p. 37)","the \\( 2n \\) bound on corrupt parties' sets assumes \\( |F| = 2^{2\\kappa} \\) and \\( 2^{\\kappa} \\) oracle queries (Appendix B.4, p. 34)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-GPRTY § Contributions","primary_source":"§1.3 (p. 4); §6.2 (pp. 18-19); §7.2 (pp. 21-22); Appendix B.2-B.4 (pp. 29-35); Theorem 9 (p. 31); Appendix B.5 and Table 4 (pp. 35-36); Appendix B.6-B.7 (pp. 36-38); Figure 5 (p. 39). IACR ePrint 2021/883, PDF dated 2021-11-30.","primary_source_url":"https://eprint.iacr.org/2021/883","status":"theorem_checked"},"statement":"A central party P0 runs a malicious-secure two-party OPRF with every other party, and each party \\( P_i \\) sends P0 an OKVS mapping each of its items h to \\( H(\\mathrm{PRF}_i(h), h) + sh_i(h) \\), where the \\( sh_i \\) are non-interactive additive shares of zero derived from pairwise PRF keys; P0 outputs the items of its set whose decoded values sum to zero. Over an exponentially large field the protocol realizes UC-secure multiparty PSI against malicious adversaries corrupting any subset of parties in the \\( F_{\\mathrm{oprf}} \\)-hybrid model, with output to P0 only, and corrupt parties may contribute sets of up to about \\( 2n \\) items (Theorem 9).","statement_status":"source_normalized_statement","status":"published","title":"Malicious security for the zero-sharing multiparty PSI of Kolesnikov et al., once OPRF outputs are hashed with a random oracle, over any OKVS","work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"Malicious multiparty PSI from OPRF and OKVS","heading":"Overview"},{"content":"Every pair of parties shares a PRF key, from which each party derives a share \\( sh_i(h) \\) of zero for any item h, with the shares of all parties summing to zero (Figure 5, step 1, p. 39). P0 learns \\( \\mathrm{PRF}_i(h) \\) for its items from the OPRF with \\( P_i \\), and \\( P_i \\) sends an OKVS that decodes, on each of its items, to the oracle hash of the PRF value plus its zero share; P0 builds its own share in the same way and keeps the items on which all decoded values sum to zero (Figure 5, steps 2-4, p. 39). The only change from Kolesnikov et al.'s augmented semi-honest protocol is the oracle hash around the PRF value, which the simulator for a corrupt P0 or corrupt non-central parties uses to extract inputs (Appendix B.2, p. 30; B.4, pp. 31-33). Hazay and Lindell's example of a protocol that is malicious-secure but not semi-honest-secure explains the apparent paradox: the semi-honest simulator may not change a corrupt party's input, while the malicious one may (Appendix B.6, pp. 36-37). The paper compares communication \\( O(\\ell^2 \\kappa + \\ell n(\\kappa + \\lambda + \\log n)) + o(\\ell n) \\) and four rounds with other multiparty protocols in Table 4 (p. 36). The complete row is PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.","heading":"Exact contribution"}],"slug":"gprty21-malicious-multiparty-psi-fro-2","status":"published","subtitle":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","summary":"A central party P0 runs a malicious-secure two-party OPRF with every other party, and each party \\( P_i \\) sends P0 an OKVS mapping each of its items h to \\( H(\\mathrm{PRF}_i(h), h) + sh_i(h) \\), where the \\( sh_i \\) are non-interactive additive shares of zero derived from pairwise PRF keys; P0 outputs the items of its set whose decoded values sum to zero. Over an exponentially large field the protocol realizes UC-secure multiparty PSI against malicious adversaries corrupting any subset of parties in the \\( F_{\\mathrm{oprf}} \\)-hybrid model, with output to P0 only, and corrupt parties may contribute sets of up to about \\( 2n \\) items (Theorem 9).","tableRows":["PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY"],"title":"Malicious security for the zero-sharing multiparty PSI of Kolesnikov et al., once OPRF outputs are hashed with a random oracle, over any OKVS","type":"result","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-GPRTY-OKVS","keywords":["atomic-result","okvs","oblivious-key-value-store","linear-okvs","binary-okvs","overfitting","polynomial-encoding","paxos"],"metadata":{"claim_slug":"okvs","contribution_kind":"definition","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"technique":["okvs"]},"historical_context":{"narrative":"Many PSI protocols hid a party's set by interpolating a polynomial through its items, which is compact but costs quasi-linear field operations, and PaXoS had shown that a sparse XOR-based encoding could do the same job faster in one protocol. Garimella, Pinkas, Rosulek, Trieu, and Yanai named the common requirement: an encoding of key-value pairs that decodes correctly on the encoded keys and reveals nothing about which keys were used when the values are random. They separated linear and binary variants and formalized the overfitting game that limits how many keys a malicious party can squeeze into an encoding. Polynomials, garbled Bloom filters, and PaXoS became instances, and protocols written against the interface could adopt any faster instance.","prior_boundary":"PSI and related protocols hid input sets by interpolating polynomials, as in OPPRF-based multiparty PSI, circuit PSI, and SpOT-light, at \\( O(n \\log^2 n) \\) field operations (§1.1, pp. 2-3). PaXoS took a step toward an abstraction but covered only binary encodings (§1.1, p. 3), and its overfitting bound was proved for PaXoS (§2.4, p. 7).","significance_at_publication":"With one interface the authors argue that an OKVS can replace polynomials in sparse OT extension, OPPRF and its multiparty and circuit-PSI uses, PaXoS-PSI, and covert computation (§6, pp. 18-20), so that a better OKVS improves all of them (§1.3, p. 4).","technical_delta":"Definitions 1-3 (p. 5) define key-value stores, obliviousness, and linear OKVS; §2.3 (p. 6) identifies binary OKVS with PaXoS; Definition 4 (pp. 6-7) defines the overfitting game, and Lemma 5 (p. 7) restates the PaXoS bound for any key-value store. Section 3 and Figure 1 (pp. 7-9) place polynomials, random matrices, garbled Bloom filters, and PaXoS in one comparison of rate and encoding and decoding cost."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-GPRTY-OKVS","keywords":["okvs","oblivious-key-value-store","linear-okvs","binary-okvs","overfitting","polynomial-encoding","paxos"],"limitations":["whether overfitting is computationally hard for polynomial-time adversaries, beyond the information-theoretic bound, is only conjectured (§2.4, p. 7)"],"paper_id":"PSI-PAPER-2021-GPRTY","qualifiers":["obliviousness is required only when the encoded values are uniformly random (Definition 2, p. 5)","whether Encode fails depends only on the keys and the hash functions, not on the values (§2.1, p. 5)","the overfitting bound of Lemma 5 is information-theoretic and limits \\( n' \\) only beyond the size of the encoding (§2.4, p. 7)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-GPRTY § Contributions","primary_source":"Abstract (p. 1); §1.1 and §1.3 (pp. 2-4); Definitions 1-3 (p. 5); §2.3 (p. 6); Definition 4 and Lemma 5 (pp. 6-7); §2.5 and §3 with Figure 1 (pp. 7-9); §6 (pp. 18-20). IACR ePrint 2021/883, PDF dated 2021-11-30.","primary_source_url":"https://eprint.iacr.org/2021/883","status":"section_checked"},"statement":"A key-value store is a pair of algorithms (Encode, Decode) such that \\( \\mathrm{Decode}(S, k) = v \\) for every pair (k, v) used to create S, where Encode may fail with small probability depending only on the keys. It is oblivious if, when the values are uniformly random, encodings of any two key sets of the same size are computationally indistinguishable. It is linear over a field F if Decode(S, k) is the inner product of a key-dependent vector d(k) with S, and binary if d(k) is a 0/1 vector, which is a PaXoS. The \\( (n, n') \\)-overfitting game asks an adversary for an S that agrees with a random oracle on more than \\( n' \\) keys.","statement_status":"source_normalized_statement","status":"published","title":"Oblivious key-value store (OKVS): key-value encodings that hide the keys when the values are random, with linear, binary, and overfitting notions","work_id":"PSI-PAPER-2021-GPRTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/883","sections":[{"content":"Oblivious key-value store","heading":"Overview"},{"content":"An OKVS encodes a list of key-value pairs into a data structure S from which Decode recovers the value of any encoded key; Decode can be called on any key, and when the values are random, S reveals nothing about which keys were encoded (Definitions 1-2, p. 5). A linear OKVS over a field F stores a vector \\( S \\in F^m \\) and decodes by an inner product with a key-dependent vector, so encoding solves a linear system, and choosing a uniform solution gives obliviousness automatically (Definition 3, p. 5; §2.2, p. 6). A binary OKVS restricts the key vectors to 0/1 entries; over \\( \\mathrm{GF}(2^{w}) \\), \\( w \\) the value length, decoding is an XOR of positions and commutes with bitwise AND, and this is exactly the PaXoS of PSI-CONTRIB-2020-PRTY-PAXOS (§2.3, p. 6). For malicious protocols, the overfitting game measures how many pairs (k, H(k)) an adversary can fit into an encoding sized for \\( n \\) pairs (Definition 4, pp. 6-7); the information-theoretic bound of PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND applies to any key-value store (Lemma 5, p. 7). The paper measures an OKVS by rate, encoding time, and single and batch decoding time (§2.5, p. 7).","heading":"Exact contribution"}],"slug":"gprty21-oblivious-key-value-store","status":"published","subtitle":"Oblivious Key-Value Stores and Amplification for Private Set Intersection","summary":"A key-value store is a pair of algorithms (Encode, Decode) such that \\( \\mathrm{Decode}(S, k) = v \\) for every pair (k, v) used to create S, where Encode may fail with small probability depending only on the keys. It is oblivious if, when the values are uniformly random, encodings of any two key sets of the same size are computationally indistinguishable. It is linear over a field F if Decode(S, k) is the inner product of a key-dependent vector d(k) with S, and binary if d(k) is a 0/1 vector, which is a PaXoS. The \\( (n, n') \\)-overfitting game asks an adversary for an S that agrees with a random oracle on more than \\( n' \\) keys.","tableRows":["PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY"],"title":"Oblivious key-value store (OKVS): key-value encodings that hide the keys when the values are random, with linear, binary, and overfitting notions","type":"result","venue":"CRYPTO 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-GPRTY-OKVS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","keywords":["atomic-result","no-collusion","honest-majority","server-aided-psi","okvs","paxos","symmetric-key-only","reduction-to-two-party"],"metadata":{"claim_slug":"malicious-no-collusion","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["multiparty"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["okvs","paxos","server_aided_psi"]},"historical_context":{"narrative":"Multiparty PSI protocols that tolerate malicious parties had paid for the worst case: they defended against all but one party colluding and made every party run interactive subprotocols built on oblivious transfer. Nevo, Trieu, and Yanai isolated the setting in which at most one party is corrupt. One party hands out fresh PRF keys and a key-value encoding that maps its items to combined PRF values; the others turn their items into PRF images, and only two designated parties still compare sets. That comparison can use server-aided two-party PSI, with a third party as the server that does not collude, so no oblivious transfer is needed at all. The paper also shows that a coalition of any two parties breaks the protocol, which marks the boundary of this setting.","prior_boundary":"Concretely efficient multiparty PSI protocols run OPPRFs on OT extension (Kolesnikov et al., Garimella et al.) or garbled Bloom filters with OT (Ben Efraim et al.), so every party runs interactive two-party subprotocols, and the malicious ones protect against \\( n - 1 \\) colluding parties even when fewer corruptions are expected (§1.1, pp. 1-3; §1.2, p. 4; Table 1, p. 2).","significance_at_publication":"The authors state that, to their knowledge, this is the only multiparty PSI construction relying only on symmetric-key primitives (§1.2, p. 4). For three parties with \\( 2^{20} \\) items, server-aided two-party PSI lowers the running time from about 9 seconds with plain malicious PSI to about 4.8 seconds, and 32 parties with \\( 2^{20} \\) items finish in 10 seconds (§1.2, p. 4).","technical_delta":"With at most one corrupted party, PRF keys and OKVS encodings reduce \\( \\ell \\)-party PSI to two-party PSI, either recursively with \\( O(\\ell) \\) rounds (Protocol 3.1, p. 6; Theorem 3.2, p. 7) or between \\( P_{\\ell-1} \\) and \\( P_\\ell \\) in constant rounds (Protocol 3.3, p. 8; Theorem 3.4, p. 8). Items are concatenated with their PRF or OKVS values to stop a malicious P1 from forcing false matches (§3.1, p. 6; §3.2, p. 7), and the base case is server-aided two-party PSI with another party as server (§3.1.1, p. 6; Appendix A, pp. 13-14)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","keywords":["no-collusion","honest-majority","server-aided-psi","okvs","paxos","symmetric-key-only","reduction-to-two-party"],"limitations":["insecure as soon as two parties collude, since a party with both the key and the OKVS can test arbitrary inputs (§3.1.2, p. 6; §3.2.1, p. 8)","the computation of P1 and \\( P_{\\ell-1} \\) grows as \\( O(\\ell n) \\) (§3.2.2, p. 8)"],"paper_id":"PSI-PAPER-2021-NTY","qualifiers":["at most one corrupted party; a collusion of two parties such as P1 and \\( P_{\\ell-1} \\) breaks Protocol 3.3, which stays secure against any subset of \\( P_2, \\ldots, P_{\\ell-2} \\) together with one of P1, \\( P_{\\ell-1} \\), \\( P_\\ell \\) (§3.2.1, p. 8)","Theorem 3.2 is stated in the \\( F_{\\mathrm{psi}}^{\\ell-1,1,n} \\)-hybrid and random oracle model (p. 7); Theorem 3.4 is stated in the \\( F_{\\mathrm{psi}}^{2,1,n} \\)-hybrid model (p. 8), and in the malicious case parties hash items with a random oracle H whose queries the simulator observes (Protocol 3.3, note a, p. 8; pp. 8-9)","the symmetric-key-only property depends on instantiating the two-party PSI with server-aided PSI, in which the server does not collude with either party (§1.2, p. 4; §3.1.1, p. 6)","the output goes to \\( P_\\ell \\) only (Functionality 2.1, p. 4)","Protocol 3.3 has 4 rounds by the count in §3.2.2 (p. 8); Table 1 lists 5 (p. 2)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-NTY § Contributions","primary_source":"Abstract (p. 1); §1.1 with Table 1 (pp. 1-3); §1.2 (pp. 3-4); Functionality 2.1 (p. 4); §2.0.4 OKVS (p. 5); §3.1 with Protocol 3.1 (p. 6); Theorem 3.2 and proof (p. 7); §3.2 with Protocol 3.3 and Theorem 3.4 (pp. 7-9); §3.2.1-3.2.2 (p. 8); Appendix A with Protocols A.1-A.2 (pp. 13-14); §5 with Tables 3-5 (pp. 11-12). IACR ePrint 2021/1221, PDF dated 2021-09-17.","primary_source_url":"https://eprint.iacr.org/2021/1221","status":"theorem_checked"},"statement":"Against a malicious adversary corrupting at most one of \\( \\ell \\) parties, P1 sends PRF keys \\( k_i \\) to parties \\( P_2, \\ldots, P_{\\ell-2} \\) and sends \\( P_\\ell \\) an OKVS mapping each of its items to the XOR of the PRF values under those keys; each \\( P_i \\) encodes its items under \\( F(k_i, \\cdot) \\) in an OKVS sent to \\( P_{\\ell-1} \\); \\( P_{\\ell-1} \\) and \\( P_\\ell \\) then run a two-party PSI on items concatenated with their decoded values, and \\( P_\\ell \\) outputs the intersection. With an ideal two-party PSI functionality the protocol is secure, takes a constant number of rounds, and gives clients \\( O(n \\kappa) \\) communication and computation; instantiating the two-party PSI with server-aided PSI, in which a party that does not collude acts as the server, removes oblivious transfer, so the protocol uses only symmetric-key primitives. A recursive variant reduces \\( \\ell \\)-party to \\( (\\ell - 1) \\)-party PSI with \\( O(\\ell) \\) rounds.","statement_status":"source_normalized_statement","status":"published","title":"Malicious multiparty PSI with at most one corrupted party from symmetric-key primitives only, by reducing \\( \\ell \\)-party PSI to server-aided two-party PSI over OKVS encodings","work_id":"PSI-PAPER-2021-NTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1221","sections":[{"content":"Malicious multiparty PSI without collusion","heading":"Overview"},{"content":"In Protocol 3.3 (p. 8), P1 picks keys \\( k_2, \\ldots, k_{\\ell-2} \\), gives \\( k_i \\) to \\( P_i \\), and sends \\( P_\\ell \\) an OKVS that maps each of its items a to the XOR of \\( F(k_i, a) \\); each \\( P_i \\) with \\( 2 \\le i \\le \\ell - 2 \\) sends \\( P_{\\ell-1} \\) an OKVS mapping its items a to \\( F(k_i, a) \\). \\( P_{\\ell-1} \\) XORs its decodings of these OKVSs and \\( P_\\ell \\) decodes P1's OKVS; for an item in every set both obtain the same pseudorandom value. They append these values to their items and call a two-party PSI functionality, and \\( P_\\ell \\) outputs the plain items of the result (Protocol 3.3, steps 4-6, p. 8). The round count is two rounds plus those of the two-party PSI, which the server-aided protocol of Kamara et al. completes in two (§3.2.2, p. 8). Section 3.2.1 shows why a direct variant in which every \\( P_i \\) sends its OKVS to \\( P_\\ell \\) would leak more than the intersection (pp. 7-8).","heading":"Exact contribution"}],"slug":"nty21-malicious-multiparty-psi-wit","status":"published","subtitle":"Simple, Fast Malicious Multiparty Private Set Intersection","summary":"Against a malicious adversary corrupting at most one of \\( \\ell \\) parties, P1 sends PRF keys \\( k_i \\) to parties \\( P_2, \\ldots, P_{\\ell-2} \\) and sends \\( P_\\ell \\) an OKVS mapping each of its items to the XOR of the PRF values under those keys; each \\( P_i \\) encodes its items under \\( F(k_i, \\cdot) \\) in an OKVS sent to \\( P_{\\ell-1} \\); \\( P_{\\ell-1} \\) and \\( P_\\ell \\) then run a two-party PSI on items concatenated with their decoded values, and \\( P_\\ell \\) outputs the intersection. With an ideal two-party PSI functionality the protocol is secure, takes a constant number of rounds, and gives clients \\( O(n \\kappa) \\) communication and computation; instantiating the two-party PSI with server-aided PSI, in which a party that does not collude acts as the server, removes oblivious transfer, so the protocol uses only symmetric-key primitives. A recursive variant reduces \\( \\ell \\)-party to \\( (\\ell - 1) \\)-party PSI with \\( O(\\ell) \\) rounds.","tableRows":["PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION"],"title":"Malicious multiparty PSI with at most one corrupted party from symmetric-key primitives only, by reducing \\( \\ell \\)-party PSI to server-aided two-party PSI over OKVS encodings","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","keywords":["atomic-result","malicious","dishonest-majority","corruption-threshold","zeroxor","okvs","paxos","opprf","unconditional-zero-sharing","client-server","pivot"],"metadata":{"claim_slug":"malicious-threshold-calibrated","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["multiparty"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["okvs","paxos","opprf","secret_sharing"]},"historical_context":{"narrative":"Malicious multiparty PSI against a dishonest majority had become concretely efficient through garbled Bloom filters and oblivious key-value stores, but those protocols cost the same whether one party or all but one might collude, and every party took part in the whole computation. Nevo, Trieu, and Yanai tied the cost to the collusion bound \\( t_c \\). Most parties act as light clients: each sends one PRF key per server and a single key-value encoding of its items to a pivot. The pivot and \\( t_c \\) servers then hold values that cancel only on items common to all sets, and a zero test built from programmable OPRFs and pseudorandom zero-sharing reveals those items. Against the largest coalition the protocol coincides with the earlier malicious one, and smaller bounds make it faster.","prior_boundary":"The augmented semi-honest protocol of Kolesnikov et al. and the malicious protocols of Ben Efraim et al. and Garimella et al. protect against \\( \\ell - 1 \\) colluding parties at the same cost for every \\( t_c \\), and the semi-honest protocol of Chandran et al. tolerates fewer than \\( \\ell/2 \\); the paper states that it was not known how to improve these protocols for smaller \\( t_c \\) (§1.1, pp. 1-3; §1.2, p. 4; Table 1, p. 2).","significance_at_publication":"Client communication is almost constant in \\( \\ell \\) and in \\( t_c \\) below \\( \\ell - 1 \\), and for \\( (\\ell, t_c) = (15, 7) \\) with \\( 2^{20} \\) items a client needs 3.4 seconds on a LAN, which the authors report as 10-23 times less than the semi-honest protocols of Chandran et al. and Kolesnikov et al. (§5.1, p. 12; Table 3, p. 12). Total running time is 1.2-6.5 and 1.2-8.5 times lower than those protocols, and with \\( t_c \\) fixed the cost is nearly constant in \\( \\ell \\) (§5.1-5.2, p. 12).","technical_delta":"Clients deliver a conditional zero-sharing of their items to the pivot and \\( t_c \\) servers through one OKVS and \\( t_c \\) PRF keys each (§4, p. 9; Protocol 4.4, p. 10). ZeroXOR outputs the keys common to all \\( t_c + 1 \\) parties whose values XOR to zero, using OPPRFs to \\( P_\\ell \\) masked by unconditional zero-sharing so that values of non-matching keys stay hidden (Functionality 4.1, p. 9; Protocol 4.2 and Theorem 4.3, p. 10). Theorem 4.5 proves malicious security against \\( t_c < \\ell \\) (p. 11), and at \\( t_c = \\ell - 1 \\) the protocol coincides with that of Garimella et al. up to the OKVS instantiation (§1.2, p. 4)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","keywords":["malicious","dishonest-majority","corruption-threshold","zeroxor","okvs","paxos","opprf","unconditional-zero-sharing","client-server","pivot"],"limitations":["at \\( t_c = \\ell - 1 \\) there are no clients and the cost equals that of the augmented semi-honest protocol of Kolesnikov et al. (§5.1, p. 12)","comparisons with semi-honest protocols cross security models, and runtimes of Ben Efraim et al. are taken from their paper for \\( \\ell \\in \\{8, 12\\} \\) rather than rerun (§5.1, p. 11)"],"paper_id":"PSI-PAPER-2021-NTY","qualifiers":["malicious adversary that statically corrupts any strict subset of the parties, \\( t_c < \\ell \\) (abstract, p. 1; §1, p. 1; Theorem 4.5, p. 11)","Theorem 4.5 is in the ZeroXOR-hybrid and random oracle model with a proof sketch; Theorem 4.3 for ZeroXOR is in the zero-sharing and OPPRF hybrid model, and its proof is omitted (pp. 10-11)","the OPPRF is the malicious construction of Pinkas et al. (PaXoS), described in Appendix B (p. 14; §1.1.1, p. 2)","the output goes to \\( P_\\ell \\) only (Functionality 2.1, p. 4)","the \\( t_c + 1 \\) parties that process the intersection can be chosen, and only a collusion of exactly that set reveals information, whereas any \\( t_c + 1 \\) parties can do so in the protocol of Chandran et al. (§1.1.2, p. 2)","the implementation uses PaXoS with expansion 2.5 as the OKVS and the table-based OPPRF code of Kolesnikov et al., which footnote 2 says is semi-honest secure and about three times slower than the malicious PaXoS-based OPPRF (§5, p. 11)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-NTY § Contributions","primary_source":"Abstract (p. 1); §1.1 with Table 1 (pp. 1-3); §1.2 (pp. 3-4); Functionality 2.1, §2.0.4 OKVS, §2.0.5 zero-sharing (pp. 4-5); §4 with Functionality 4.1 (p. 9); Protocol 4.2, Theorem 4.3, Protocol 4.4 (p. 10); §4.2.1 and Theorem 4.5 (pp. 10-11); §5 with Tables 2-5 (pp. 11-12); Appendix B (p. 14). IACR ePrint 2021/1221, PDF dated 2021-09-17.","primary_source_url":"https://eprint.iacr.org/2021/1221","status":"theorem_checked"},"statement":"For \\( \\ell \\) parties with \\( n \\) items each and at most \\( t_c < \\ell \\) corrupted and colluding, the parties split into \\( \\ell - t_c - 1 \\) clients, one pivot, and \\( t_c \\) servers. Each client sends a PRF key to each server and one OKVS to the pivot that maps its items to the XOR of the PRF values under those keys; the pivot and the \\( t_c \\) servers then hold values that XOR to zero exactly on items in every set, and a ZeroXOR protocol among these \\( t_c + 1 \\) parties, built from OPPRFs and unconditional zero-sharing, outputs those items to \\( P_\\ell \\). In the ZeroXOR-hybrid and random oracle model the protocol is secure against a malicious adversary corrupting \\( t_c < \\ell \\) parties and runs in 4 rounds; a client sends \\( O(n \\kappa) \\) bits and computes \\( O(n t_c \\kappa) \\), the leader communicates \\( O(n \\kappa \\max\\{t_c, \\ell - t_c\\}) \\) and computes \\( O(n \\kappa (\\ell - t_c)) \\), and at \\( t_c = \\ell - 1 \\) the protocol reduces to ZeroXOR among all parties.","statement_status":"source_normalized_statement","status":"published","title":"Malicious multiparty PSI against \\( t_c < \\ell \\) colluding parties whose cost decreases with \\( t_c \\), with client communication \\( O(n \\kappa) \\), from OKVS encodings and a ZeroXOR test over OPPRFs","work_id":"PSI-PAPER-2021-NTY","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1221","sections":[{"content":"Malicious multiparty PSI calibrated to the collusion bound","heading":"Overview"},{"content":"Let \\( v = \\ell - t_c \\). Clients \\( P_1, \\ldots, P_{v-1} \\) send key \\( k_i^j \\) to each server \\( P_j \\), \\( j > v \\), and send the pivot \\( P_v \\) an OKVS \\( S_i \\) mapping each item to the XOR over servers of \\( F(k_i^j, \\text{item}) \\) (Protocol 4.4, steps 2-3, p. 10). The pivot pairs each of its items with the XOR of its decodings, and each server pairs each of its items with the XOR of \\( F(k_i^j, \\text{item}) \\) over clients (steps 4-5). For an item in every set the \\( t_c + 1 \\) values XOR to zero, otherwise to a pseudorandom value, and ZeroXOR among \\( P_v, \\ldots, P_\\ell \\) finds the items with zero XOR (step 6; §4.2, p. 10). In ZeroXOR every party except \\( P_\\ell \\) programs an OPPRF to \\( P_\\ell \\) with its value masked by its unconditional zero-share, and \\( P_\\ell \\) keeps the keys whose outputs and own value XOR to zero (Protocol 4.2, p. 10). A client communicates only its OKVS and keys, so its load depends on \\( n \\) alone (§4.2.1, p. 10).","heading":"Exact contribution"},{"content":"None. The OPPRF, OKVS, and zero-sharing building blocks are PSI mechanisms.","heading":"Related records in other topics"}],"slug":"nty21-malicious-multiparty-psi-cal","status":"published","subtitle":"Simple, Fast Malicious Multiparty Private Set Intersection","summary":"For \\( \\ell \\) parties with \\( n \\) items each and at most \\( t_c < \\ell \\) corrupted and colluding, the parties split into \\( \\ell - t_c - 1 \\) clients, one pivot, and \\( t_c \\) servers. Each client sends a PRF key to each server and one OKVS to the pivot that maps its items to the XOR of the PRF values under those keys; the pivot and the \\( t_c \\) servers then hold values that XOR to zero exactly on items in every set, and a ZeroXOR protocol among these \\( t_c + 1 \\) parties, built from OPPRFs and unconditional zero-sharing, outputs those items to \\( P_\\ell \\). In the ZeroXOR-hybrid and random oracle model the protocol is secure against a malicious adversary corrupting \\( t_c < \\ell \\) parties and runs in 4 rounds; a client sends \\( O(n \\kappa) \\) bits and computes \\( O(n t_c \\kappa) \\), the leader communicates \\( O(n \\kappa \\max\\{t_c, \\ell - t_c\\}) \\) and computes \\( O(n \\kappa (\\ell - t_c)) \\), and at \\( t_c = \\ell - 1 \\) the protocol reduces to ZeroXOR among all parties.","tableRows":["PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION"],"title":"Malicious multiparty PSI against \\( t_c < \\ell \\) colluding parties whose cost decreases with \\( t_c \\), with client communication \\( O(n \\kappa) \\), from OKVS encodings and a ZeroXOR test over OPPRFs","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","keywords":["atomic-result","circuit-psi","opprf","xopaxos","doubly-oblivious","cuckoo-hashing","gmw","secret-shared-output"],"metadata":{"claim_slug":"circuit-psi","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["circuit"],"parties":["two_party"],"set_size_regime":["balanced"],"technique":["opprf","vole","paxos","cuckoo_hashing","gmw"]},"historical_context":{"narrative":"Circuit-PSI hides even the intersection: the parties end with secret shares that a later computation can consume. The leading linear-communication protocol hashed the receiver's items into a cuckoo table and used an oblivious programmable PRF, built from polynomial interpolation, so that each bin yields equal strings exactly when its item is shared, before a small comparison circuit. Rindal and Schoppmann kept that structure and replaced the programmable PRF with one built from their VOLE-based OPRF and a sparse encoding of the sender's corrections. Because the PaXoS encoder sets some positions to zero, which could leak the sender's keys, they randomized every free position so that the encoding is uniform whenever its values are.","prior_boundary":"The linear-communication circuit-PSI of Pinkas, Schneider, Tkachenko, and Yanai combined an OPPRF based on polynomial interpolation with a small GMW circuit (§1.4, p. 6); the PaXoS encoder sets some positions to zero, so its output can depend on the encoded keys (§1.3, p. 5; §2, p. 10).","significance_at_publication":"The authors report circuit-PSI up to 3 times faster than the previous protocol (abstract, p. 1), for example 23.3 s against 72.0 s at 5 Gbps for \\( 2^{20} \\) items with IKNP-based GMW, as the earlier protocol also used, which they credit to their OPPRF (Table 4, p. 29; §7.2, p. 30). Communication falls only with SilentOT in the GMW phase: 277 MB against an estimated 2,540 MB, while the IKNP variant sends 2,830 MB (Table 4, p. 29).","technical_delta":"XoPaXoS (Figure 1, p. 7) assigns random values to the free positions of the 2-core system and to one vertex per tree, making the encoding uniform for uniform values (§2, pp. 10-11); the OPPRF is Figure 8 (p. 38) with Theorem 5.1 (p. 21), and the circuit-PSI protocol is Figure 10 (pp. 38-39), whose proof the authors defer to the earlier work (§6, pp. 22-24)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","keywords":["circuit-psi","opprf","xopaxos","doubly-oblivious","cuckoo-hashing","gmw","secret-shared-output"],"limitations":["the communication figures for the earlier protocol in Table 4 are computed from its theoretical costs, not measured (Table 4 caption, p. 29)","no malicious security is claimed for circuit-PSI (abstract, p. 1)"],"paper_id":"PSI-PAPER-2021-RS","qualifiers":["semi-honest security; the circuit-PSI proof is deferred to Pinkas, Schneider, Tkachenko, and Yanai, and the OPPRF is proved in the \\( F_{\\mathrm{oprf}} \\)-hybrid model (§6, p. 23; Theorem 5.1, p. 21)","cuckoo hashing with expansion 1.27 and three hash functions, following the earlier protocol; the authors note disagreement in the literature about these parameters (§7.2, pp. 29-30)","the final comparison uses generic two-party computation, implemented with GMW whose OTs come from IKNP or SilentOT (§7.2, p. 30)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-RS § Contributions","primary_source":"Abstract (p. 1); §1.1 and §1.3 (pp. 3-6); §1.4 (p. 6); Figure 1 (p. 7); §2, X-oblivious PaXoS (pp. 10-11); §5 and Theorem 5.1 (pp. 21-22); §6 (pp. 22-24); Table 4 and §7.2 (pp. 29-30); Figures 7-10 (pp. 37-39). IACR ePrint 2021/266, PDF dated 2024-08-08.","primary_source_url":"https://eprint.iacr.org/2021/266","status":"section_checked"},"statement":"An OPPRF is obtained from any OPRF by having the sender encode the corrections \\( z_i - F_k(y_i) \\) with XoPaXoS, a PaXoS variant whose output is uniformly distributed when the encoded values are uniform. In the circuit-PSI protocol of Pinkas, Schneider, Tkachenko, and Yanai, this OPPRF, built on the VOLE-based OPRF, replaces their polynomial-based OPPRF: the receiver places its items in a cuckoo table, the sender places its items in a simple hash table, and a generic two-party circuit compares one programmed value per bin. Both parties obtain secret shares of a membership bit and of associated values for each bin, against semi-honest adversaries.","statement_status":"source_normalized_statement","status":"published","title":"Semi-honest circuit-PSI from a VOLE-based OPPRF programmed with a doubly oblivious PaXoS (XoPaXoS), cuckoo hashing, and a GMW comparison circuit","work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"Circuit-PSI from a VOLE-based OPPRF","heading":"Overview"},{"content":"The OPPRF lets the sender program values \\( z_i \\) at points \\( y_i \\): the parties run an OPRF on the receiver's points, and the sender sends an XoPaXoS encoding P with \\( \\mathrm{Decode}(P, y_i) = z_i - F_k(y_i) \\), so the receiver's output \\( F_k(x) + \\mathrm{Decode}(P, x) \\) equals \\( z_i \\) at \\( x = y_i \\) and is random elsewhere (§5, p. 21; Figure 8, p. 38). Security against the receiver needs P to reveal nothing about the sender's points outside the intersection, which plain PaXoS does not guarantee because it fixes some positions to zero; XoPaXoS samples those positions at random (§2, pp. 10-11; Theorem 5.1 proof, pp. 21-22). In the circuit-PSI protocol the sender programs, for every bin and every item y hashed there with function j, the point \\( H(y, j) \\) to a random bin value \\( r_i \\); the receiver queries the item in its cuckoo bin and obtains \\( r_i \\) exactly when that item is in the sender's set, and a two-party circuit then outputs shares of the equality bit and of the associated values (§6, pp. 23-24; Figure 10, pp. 38-39). The OPRF underneath is PSI-CONTRIB-2021-RS-VOLE-OPRF. The complete row is PSI-CONSTRUCTION-2021-RS-CIRCUIT.","heading":"Exact contribution"},{"content":"MPC-COMP-EVAL-GMW: the comparison circuit is evaluated with the GMW implementation of libOTe (§7.2, pp. 26 and 30). MPC-CONTRIB-2003-IKNP-OTEXT: one variant generates the GMW offline OTs with IKNP OT extension (§7.2, p. 30). MPC-CONTRIB-2019-PCG-SILENT: the other variant uses SilentOT, cited to Boyle et al., CCS 2019 (§7.2, p. 30; Table 4, p. 29); that CCS paper is distinct from the CRYPTO 2019 paper MPC-PAPER-2019-PCG and has no record of its own.","heading":"Related records in other topics"}],"slug":"rs21-circuit-psi-from-vole","status":"published","subtitle":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","summary":"An OPPRF is obtained from any OPRF by having the sender encode the corrections \\( z_i - F_k(y_i) \\) with XoPaXoS, a PaXoS variant whose output is uniformly distributed when the encoded values are uniform. In the circuit-PSI protocol of Pinkas, Schneider, Tkachenko, and Yanai, this OPPRF, built on the VOLE-based OPRF, replaces their polynomial-based OPPRF: the receiver places its items in a cuckoo table, the sender places its items in a simple hash table, and a generic two-party circuit compares one programmed value per bin. Both parties obtain secret shares of a membership bit and of associated values for each bin, against semi-honest adversaries.","tableRows":["PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","PSI-CONSTRUCTION-2021-RS-CIRCUIT","PSI-CONSTRUCTION-2022-RR-CIRCUIT","PSI-CONSTRUCTION-2022-RR-MAL"],"title":"Semi-honest circuit-PSI from a VOLE-based OPPRF programmed with a doubly oblivious PaXoS (XoPaXoS), cuckoo hashing, and a GMW comparison circuit","type":"result","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-RS-CIRCUIT-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","keywords":["atomic-result","oprf-to-psi","input-extraction","malicious-sender","output-length","collision","communication"],"metadata":{"claim_slug":"short-oprf-outputs","contribution_kind":"security_analysis","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"technique":["batched_oprf"]},"historical_context":{"narrative":"Turning an oblivious PRF into malicious PSI is simple: the sender evaluates the function on its items and sends the results. The difficulty lies in the proof, where a simulator must identify the sender's items from these values. The standard argument asked for outputs long enough that no two of the sender's queries ever collide, which doubles their length to \\( 2\\kappa \\) bits. Rindal and Schoppmann pointed out that collisions among the sender's own queries are harmless unless they land on the receiver's set, which is fixed before the function is chosen. Extracting only queries without collisions keeps the simulation sound with \\( \\kappa \\)-bit outputs, so the sender's message shrinks by half.","prior_boundary":"The folklore analysis of the malicious OPRF-to-PSI transformation, as used by De Cristofaro, Kim, and Tsudik and by PaXoS-PSI, extracts every queried y whose output appears in the sender's message and therefore needs \\( 2\\kappa \\)-bit outputs so that collisions among the sender's queries are negligible (§1.3, p. 5; §4, p. 19).","significance_at_publication":"It halves the sender's message in the malicious protocol; the authors list it, with the shorter encoding, as a reason their malicious protocol sends less than PaXoS-PSI, whose analysis states \\( 2\\kappa \\)-bit values (§7.1, p. 26).","technical_delta":"The new simulator discards colliding queries; a collision matters only if it hits the receiver's set, which is fixed before F is sampled, so for \\( \\kappa = 128 \\) and \\( n_Y = 2^{30} \\) the sender would need about \\( 2^{98} \\) queries to distinguish, against \\( 2^{49} \\) under the folklore analysis (§4, pp. 19-20; Theorem 4.1, p. 20; Figure 6, p. 37)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","keywords":["oprf-to-psi","input-extraction","malicious-sender","output-length","collision","communication"],"limitations":["the saving concerns the sender's message only; the cost of the OPRF itself is unchanged (§4, p. 19)","the paper's percentages differ by passage: about 33%, up to 50% (§1.3, p. 5), and 20% to 50% (§4, p. 19)"],"paper_id":"PSI-PAPER-2021-RS","qualifiers":["malicious security in the \\( F_{\\mathrm{oprf}} \\)-hybrid model, in which F is a truly random function (Theorem 4.1, p. 20; §4, p. 19, footnote 3)","semi-honest instantiations use outputs of \\( \\lambda + \\log_2(n_Y) + \\log_2(n_X) \\) bits (Figure 6, p. 37)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-RS § Contributions","primary_source":"§1.1 (p. 3); §1.3 (p. 5); §4 (pp. 18-20); Theorem 4.1 (p. 20); §7.1 (p. 26); Figures 5-6 (p. 37). IACR ePrint 2021/266, PDF dated 2024-08-08.","primary_source_url":"https://eprint.iacr.org/2021/266","status":"theorem_checked"},"statement":"In the transformation where the receiver learns F(x) for its set from a batched OPRF and the sender sends {F(y)} for its set, a simulator for a malicious sender that extracts only those queried y whose output collides with no other query suffices. Hence OPRF outputs of \\( \\kappa \\) bits, instead of the \\( 2\\kappa \\) bits required by the earlier analysis, give malicious security in the \\( F_{\\mathrm{oprf}} \\)-hybrid model (Theorem 4.1). The authors estimate the saving at 20% to 50% of total communication, the larger figure when the sender's set is much larger than the receiver's.","statement_status":"source_normalized_statement","status":"published","title":"Malicious OPRF-to-PSI transformation with \\( \\kappa \\)-bit instead of \\( 2\\kappa \\)-bit sender messages, by extracting only non-colliding OPRF queries","work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"\\( \\kappa \\)-bit OPRF outputs for malicious PSI","heading":"Overview"},{"content":"The transformation is the standard one (Figure 6, p. 37): the receiver queries the OPRF on its set, the sender evaluates it on its own items and sends the values in random order, and the receiver outputs the items whose values appear. For a malicious sender, the simulator records the set \\( Y^* \\) of the sender's OPRF queries, keeps only queries whose outputs are distinct from those of all other queries, and extracts those whose outputs appear in the message (Theorem 4.1 proof, p. 20). A colliding pair can cause a wrong extraction only if one of its outputs equals the output of a receiver item, an event bounded by a target preimage probability of \\( O(2^{-\\kappa}) \\) per item because the receiver's set is fixed before the function is sampled (§4, pp. 19-20). This analysis is applied to the OPRF of PSI-CONTRIB-2021-RS-VOLE-OPRF in PSI-CONSTRUCTION-2021-RS-MAL.","heading":"Exact contribution"}],"slug":"rs21-malicious-oprf-to-psi","status":"published","subtitle":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","summary":"In the transformation where the receiver learns F(x) for its set from a batched OPRF and the sender sends {F(y)} for its set, a simulator for a malicious sender that extracts only those queried y whose output collides with no other query suffices. Hence OPRF outputs of \\( \\kappa \\) bits, instead of the \\( 2\\kappa \\) bits required by the earlier analysis, give malicious security in the \\( F_{\\mathrm{oprf}} \\)-hybrid model (Theorem 4.1). The authors estimate the saving at 20% to 50% of total communication, the larger figure when the sender's set is much larger than the receiver's.","tableRows":["PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","PSI-CONSTRUCTION-2021-RS-MAL","PSI-CONSTRUCTION-2022-RR-CIRCUIT","PSI-CONSTRUCTION-2022-RR-MAL"],"title":"Malicious OPRF-to-PSI transformation with \\( \\kappa \\)-bit instead of \\( 2\\kappa \\)-bit sender messages, by extracting only non-colliding OPRF queries","type":"result","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-RS-VOLE-OPRF","keywords":["atomic-result","vole-oprf","vector-ole","batched-oprf","paxos-solver","lpn","sublinear-vole","malicious"],"metadata":{"claim_slug":"vole-oprf","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"parties":["two_party"],"security_model":["random_oracle_model"],"technique":["batched_oprf","vole","paxos"]},"historical_context":{"narrative":"Oblivious PRFs built on OT extension paid several \\( \\kappa \\)-bit strings for every position of the receiver's encoded set, and the malicious PaXoS protocol paid more, because its correlation required a long error-correcting code. Rindal and Schoppmann observed that new vector-OLE generators, which expand a short correlated seed into a long correlation, give a correlation over a field at a cost that grows sublinearly in its length, \\( o(m) \\) for \\( m \\) the correlation length. The receiver solves a sparse linear system so that its encoding decodes to a hash of each of its items, then sends the encoding masked by its VOLE share. Linearity lets both parties derive the same value on common items, and hashing with a fresh random offset turns that value into an oblivious PRF.","prior_boundary":"OPRF-based PSI from OT extension, including PaXoS-PSI and SpOT-light, sent about \\( 3.5\\kappa \\) bits per encoded position; malicious PaXoS-PSI needed \\( 5\\kappa \\) bits per position because of its error-correcting code, an encoding of \\( 11.8\\kappa n \\) bits (§7.1, pp. 25-26; Table 1, p. 25).","significance_at_publication":"With the PSI transformation, the authors report under 450 bits per element for \\( n = 2^{20} \\) with malicious security, which they call the lowest for any published PSI protocol (abstract, p. 1), and 57.86 MB against 247.6 MB for PaXoS-PSI at \\( n = 2^{20} \\) in their own runs of both protocols (Table 3, p. 29); the PaXoS-PSI paper reports 202.04 MB for its malicious 2-core variant (PRTY20 Table 2, p. 24).","technical_delta":"Vector OLE with sublinear communication, from LPN-based generators that expand a short seed correlation (§3.1, pp. 13-14), replaces OT extension: the encoding P is sent masked by a VOLE vector, so each position costs \\( \\kappa \\) bits, and linearity of decoding makes both parties' values agree on the receiver's set (§1.3, pp. 3-4; §3.2, pp. 14-15; Figure 4, p. 36). Lemmas 3.2-3.3 (pp. 16-18) prove security, with a malicious receiver's effective set bounded by the PaXoS size bound."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-RS-VOLE-OPRF","keywords":["vole-oprf","vector-ole","batched-oprf","paxos-solver","lpn","sublinear-vole","malicious"],"limitations":["the 2024 revision states that the earlier version did not correctly address extraction of a malicious receiver's effective input (§2, p. 13)","the rate-1 variant with polynomial interpolation is analyzed in theory only (§7.1, p. 24; Table 1, p. 25)"],"paper_id":"PSI-PAPER-2021-RS","qualifiers":["random oracle and \\( F_{\\mathrm{vole}} \\)-hybrid model; the simulators program the random oracle H (Theorem 3.1, p. 16; Lemmas 3.2-3.3, pp. 16-18)","a malicious receiver's effective input may have \\( n' = O(n_Y) \\) elements by the PaXoS size bound, \\( n_Y \\) its declared set size, and \\( n' = m \\), \\( m \\) the PaXoS size, under the authors' Strong OKVS Extraction Conjecture (§2, pp. 11-12; Lemma 3.3, p. 18)","the implementation instantiates VOLE from LPN with regular noise, with iterative bootstrapping and a consistency check for malicious security (§3.1, p. 14; §7.2, p. 26)","the implemented VOLE costs about \\( 2^{17} \\kappa n_Y^{0.05} \\) bits, which dominates for small sets: 27,800 bits per element at \\( n_Y = 2^{10} \\) against 38 at \\( n_Y = 2^{20} \\) (§7.1, pp. 24-25)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-RS § Contributions","primary_source":"Abstract (p. 1); §1.1 and §1.3 (pp. 2-4); §2 (pp. 8-12); §3.1 and Figure 2 (pp. 13-14); §3.2 (pp. 14-15); Figure 3 and Theorem 3.1 (p. 16); Lemmas 3.2-3.3 (pp. 16-18); §7.1 and Table 1 (pp. 24-26); Table 3 (p. 29); Figure 4 (p. 36). IACR ePrint 2021/266, PDF dated 2024-08-08.","primary_source_url":"https://eprint.iacr.org/2021/266","status":"theorem_checked"},"statement":"The receiver solves for P with \\( \\langle \\mathrm{row}(x), P \\rangle = H_F(x) \\) for every x in its set using a PaXoS solver, and sends \\( A = P + A' \\), where the receiver's \\( (A', C) \\) and the sender's \\( (\\Delta, B) \\) form a random VOLE correlation \\( C = A'\\Delta + B \\) of length m. The sender sets \\( K = B + A\\Delta \\); after a coin-tossed offset w, the sender's function is \\( F(x) = H(\\mathrm{Decode}(K, x) - \\Delta H_F(x) + w, x) \\), which the receiver computes as \\( H(\\mathrm{Decode}(C, x) + w, x) \\) for its own inputs. The protocol realizes a batched OPRF against malicious adversaries in the random oracle, \\( F_{\\mathrm{vole}} \\)-hybrid model (Theorem 3.1); the encoding costs \\( \\rho\\kappa \\) bits per input, with \\( \\rho \\) about 2.4 for PaXoS, plus a VOLE whose communication is sublinear in its length.","statement_status":"source_normalized_statement","status":"published","title":"Batched OPRF from vector OLE and a PaXoS encoding, malicious-secure in the random oracle and VOLE-hybrid model, sending about \\( \\rho\\kappa \\) bits per input plus a sublinear VOLE","work_id":"PSI-PAPER-2021-RS","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/266","sections":[{"content":"Batched OPRF from vector OLE","heading":"Overview"},{"content":"The random VOLE functionality gives the sender \\( \\Delta \\) and B and the receiver \\( A' \\) and \\( C = A'\\Delta + B \\) (Figure 2, p. 14). The receiver encodes its set with the PaXoS solver so that the encoding P decodes to \\( H_F(x) \\) on its items (§3.2, p. 14), and derandomizes the VOLE by sending \\( A = P + A' \\) (Figure 4, steps 2-4, p. 36). For x in the receiver's set, linearity gives \\( \\mathrm{Decode}(K, x) - \\Delta H_F(x) = \\mathrm{Decode}(C, x) \\); for other x the difference is a nonzero multiple of the uniform \\( \\Delta \\), so the value is unpredictable to the receiver (§3.2, p. 15; Lemma 3.3, Hybrid 4, p. 18). The sender commits to its half of the offset w before the receiver's message (Figure 4, steps 1 and 5, p. 36), and x is hashed together with the value to extract a malicious sender's queries (§3.2, p. 15). The PaXoS solver is the one of PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO with \\( 2.4n_Y \\) main positions (§2, p. 9). With the transformation of PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS this gives the PSI rows PSI-CONSTRUCTION-2021-RS-SH and PSI-CONSTRUCTION-2021-RS-MAL.","heading":"Exact contribution"},{"content":"MPC-COMP-CORR-PCG: the VOLE generators used are pseudorandom correlations that expand a short seed correlation into a long one; the implementation extends Schoppmann et al.'s primal VOLE with the iterative bootstrapping of Yang et al. (§3.1, pp. 13-14; §7.2, p. 26). These VOLE papers have no record in any topic yet.","heading":"Related records in other topics"}],"slug":"rs21-batched-oprf-from-vector","status":"published","subtitle":"VOLE-PSI: Fast OPRF and Circuit-PSI from Vector-OLE","summary":"The receiver solves for P with \\( \\langle \\mathrm{row}(x), P \\rangle = H_F(x) \\) for every x in its set using a PaXoS solver, and sends \\( A = P + A' \\), where the receiver's \\( (A', C) \\) and the sender's \\( (\\Delta, B) \\) form a random VOLE correlation \\( C = A'\\Delta + B \\) of length m. The sender sets \\( K = B + A\\Delta \\); after a coin-tossed offset w, the sender's function is \\( F(x) = H(\\mathrm{Decode}(K, x) - \\Delta H_F(x) + w, x) \\), which the receiver computes as \\( H(\\mathrm{Decode}(C, x) + w, x) \\) for its own inputs. The protocol realizes a batched OPRF against malicious adversaries in the random oracle, \\( F_{\\mathrm{vole}} \\)-hybrid model (Theorem 3.1); the encoding costs \\( \\rho\\kappa \\) bits per input, with \\( \\rho \\) about 2.4 for PaXoS, plus a VOLE whose communication is sublinear in its length.","tableRows":["PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","PSI-CONSTRUCTION-2021-RS-CIRCUIT","PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","PSI-CONSTRUCTION-2021-RS-MAL","PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","PSI-CONSTRUCTION-2021-RS-SH","PSI-CONSTRUCTION-2022-RR-CIRCUIT","PSI-CONSTRUCTION-2022-RR-FAST","PSI-CONSTRUCTION-2022-RR-MAL","PSI-CONSTRUCTION-2022-RR-SD"],"title":"Batched OPRF from vector OLE and a PaXoS encoding, malicious-secure in the random oracle and VOLE-hybrid model, sending about \\( \\rho\\kappa \\) bits per input plus a sublinear VOLE","type":"result","venue":"EUROCRYPT 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-RS-VOLE-OPRF"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","keywords":["atomic-result","key-agreement","polynomial-encoding","ideal-permutation","oracle-diffie-hellman","elligator","malicious","uc-security","small-sets"],"metadata":{"claim_slug":"ka-to-malicious-psi","contribution_kind":"transform","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["malicious"],"output":["intersection"],"parties":["two_party"],"security_model":["ideal_permutation_model","random_oracle_model"],"technique":["key_agreement"]},"historical_context":{"narrative":"Diffie-Hellman PSI was the cheapest option in communication, but making it secure against malicious parties had cost several times more messages and exponentiations. Cho, Dachman-Soled, and Jarecki had shown that protocol messages can be hidden by placing them as values of a polynomial at the parties' items, though they embedded full equality tests and needed an ideal cipher. Rosulek and Trieu kept the polynomial but placed in it only responses of an ordinary key agreement, let the other party send a single opening message, and replaced the ideal cipher by an ideal permutation, with random oracles giving the simulator a way to extract inputs. Using elliptic curves, the result costs about one group element per item, and on sets of a few hundred items it ran faster than any protocol in their comparison.","prior_boundary":"Cho, Dachman-Soled, and Jarecki embedded the messages of \\( n \\) malicious-secure string equality tests in polynomials, using an ideal cipher (§1.2, p. 5). The most efficient malicious Diffie-Hellman PSI, by De Cristofaro, Kim, and Tsudik, sends \\( 6n \\) group elements plus \\( n \\) hashes and computes \\( 2n \\) fixed-base and \\( 4n \\) variable-base exponentiations (§1.2, p. 6); Jarecki and Liu's protocol relaxes input independence (§1, p. 1).","significance_at_publication":"The authors report the malicious protocol over 30 times faster than De Cristofaro-Kim-Tsudik with 80% less communication (§1.2, p. 6), and, for \\( n = 256 \\), 18-30% faster with 10% less communication than the next best protocol, which is semi-honest (§1.2, p. 5); for sets of at most 512 items they find it best in both communication and computation (§5.2, p. 20).","technical_delta":"Plain two-round key agreement replaces string equality tests, the sender sends a single key-agreement message instead of a polynomial, and an ideal permutation replaces the ideal cipher (§1.2, p. 5); random oracles H1 and H2 let the simulator extract inputs (§4, p. 10; Lemmas 5-6, pp. 10-12). A corrupt receiver's effective set size is bounded unconditionally through a polynomial overfitting game (§4.1, pp. 15-16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","keywords":["key-agreement","polynomial-encoding","ideal-permutation","oracle-diffie-hellman","elligator","malicious","uc-security","small-sets"],"limitations":["the receiver's set-size slack is not removed; a tighter bound would follow from a conjecture that the authors state without proof (§4.1, p. 16)","computation is linear in exponentiations; on 10 Gbps networks OT-extension protocols overtake it between 500 and 1,000 items (§1, p. 2) and from \\( n = 2^{10} \\) in the LAN experiments (§5.2, p. 20)","the optimizations of Appendix B are not proved; the paper leaves their security to the reader (p. 28)"],"paper_id":"PSI-PAPER-2021-RT","qualifiers":["UC security against a malicious sender (Lemma 5, p. 10) and a malicious receiver (Lemma 6, p. 12), in the ideal permutation plus random oracle model (abstract, p. 1)","only the receiver learns the intersection (Figure 2, p. 6)","a corrupt sender's set is enforced to size \\( n \\); a corrupt receiver may input up to \\( n' \\) items, for example fewer than \\( 8n + 4 \\) for \\( n = 2^{10} \\) or \\( 2^{20} \\) and \\( |F| = 2^{256} \\), by an unconditional bound (§4.1, Lemma 10, pp. 15-16)","for a one-round key agreement such as Diffie-Hellman, the sender's two messages combine into a two-round protocol (§4, p. 15)","the implementation instantiates \\( \\Pi \\) with fixed-key Rijndael-256 and the random oracles with SHA2 over Curve25519 with elligator encoding (§5.1, pp. 16-18)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-RT § Contributions","primary_source":"Abstract (p. 1); §1 (pp. 1-2); §1.2 (pp. 4-6); Table 1 (p. 4); Figure 2 (p. 6); §2.4 (p. 7); §3.1 Definitions 1-4 (p. 8); §3.2 (pp. 8-9); §4, Lemma 5 (p. 10); Figure 4 (p. 11); Lemma 6 (p. 12); Lemma 7 (p. 14); §4 'Optimizations' and 'Costs' (p. 15); §4.1, Definition 8, Proposition 9, Lemma 10 (pp. 15-16); §5.1 (pp. 16-18); Table 2 (p. 17); Table 3 (p. 18); §5.2 (pp. 19-20). IACR ePrint 2021/1159, version of October 17, 2021.","primary_source_url":"https://eprint.iacr.org/2021/1159","status":"theorem_checked"},"statement":"The sender sends one key-agreement message m; for each item \\( y_i \\) the receiver computes a fresh response \\( m'_i \\) and sends the polynomial P with \\( P(H_1(y_i)) = \\Pi^{-1}(m'_i) \\); the sender computes \\( k_i = \\mathrm{KA.key1}(a, \\Pi(P(H_1(x_i)))) \\) for each item and sends the shuffled values \\( H_2(x_i, k_i) \\); the receiver outputs the items whose own key yields a value in that set. The protocol is UC-secure against a malicious sender if the key agreement has pseudorandom second messages, and against a malicious receiver if it is non-malleable with at least \\( 2^{\\kappa} \\) keys, with \\( \\Pi \\) an ideal permutation and H1, H2 random oracles. Instantiated with hashed elliptic-curve Diffie-Hellman and elligator encoding, non-malleability is the oracle Diffie-Hellman assumption, and communication is one group element, \\( n \\) field elements, and \\( n \\) strings of \\( 2\\kappa \\) bits.","statement_status":"source_normalized_statement","status":"published","title":"Malicious two-party PSI from any two-round key agreement with pseudorandom second messages and non-malleability, by polynomial encoding of the responses, ideal permutation and random oracle model","work_id":"PSI-PAPER-2021-RT","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1159","sections":[{"content":"Key agreement to malicious PSI","heading":"Overview"},{"content":"Figure 4 (p. 11) needs a key agreement whose second-message space is a field F with pseudorandom messages, an ideal permutation \\( \\Pi \\) on F, and random oracles \\( H_1: \\{0,1\\}^* \\to F \\) and \\( H_2: \\{0,1\\}^* \\times F \\to \\{0,1\\}^{2\\kappa} \\). The simulator against a corrupt sender programs \\( \\Pi \\) so that every output is a key-agreement message with known randomness and extracts from H2 queries (Lemma 5, p. 10); against a corrupt receiver it extracts the items y with an H1 query whose \\( P(H_1(y)) \\) was obtained from \\( \\Pi^{-1} \\) (Lemma 6, p. 12), relying on non-malleability to replace the other keys by random ones (Lemma 7, p. 14). Costs: one key-agreement message and \\( n \\) keys for the sender, \\( n \\) responses and \\( n \\) keys for the receiver, plus interpolation and multi-point evaluation of a degree-\\( n \\) polynomial in \\( O(n \\log^2 n) \\) field operations (§4, p. 15).","heading":"Exact contribution"},{"content":"PKE-RESULT-1976-DH-INTERACTIVE-PUBLIC-CHANNEL-KEY-AGREEMENT: the key agreement used in the instantiation, in its hashed variant with elligator encoding (§3.2, pp. 8-9). Cho-Dachman-Soled-Jarecki (CT-RSA 2016), the stated starting point (§1.2, p. 5), the ideal permutation model, elligator encodings, and the oracle Diffie-Hellman assumption have no record in any topic.","heading":"Related records in other topics"}],"slug":"rt21-key-agreement-to-malicious","status":"published","subtitle":"Compact and Malicious Private Set Intersection for Small Sets","summary":"The sender sends one key-agreement message m; for each item \\( y_i \\) the receiver computes a fresh response \\( m'_i \\) and sends the polynomial P with \\( P(H_1(y_i)) = \\Pi^{-1}(m'_i) \\); the sender computes \\( k_i = \\mathrm{KA.key1}(a, \\Pi(P(H_1(x_i)))) \\) for each item and sends the shuffled values \\( H_2(x_i, k_i) \\); the receiver outputs the items whose own key yields a value in that set. The protocol is UC-secure against a malicious sender if the key agreement has pseudorandom second messages, and against a malicious receiver if it is non-malleable with at least \\( 2^{\\kappa} \\) keys, with \\( \\Pi \\) an ideal permutation and H1, H2 random oracles. Instantiated with hashed elliptic-curve Diffie-Hellman and elligator encoding, non-malleability is the oracle Diffie-Hellman assumption, and communication is one group element, \\( n \\) field elements, and \\( n \\) strings of \\( 2\\kappa \\) bits.","tableRows":["PSI-CONSTRUCTION-2021-RT-MAL"],"title":"Malicious two-party PSI from any two-round key agreement with pseudorandom second messages and non-malleability, by polynomial encoding of the responses, ideal permutation and random oracle model","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","keywords":["atomic-result","diffie-hellman","communication","semi-honest","polynomial-encoding","elligator","ideal-permutation"],"metadata":{"claim_slug":"semi-honest-dh-communication","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["ideal_permutation_model","random_oracle_model"],"technique":["key_agreement"]},"historical_context":{"narrative":"The two-message Diffie-Hellman intersection protocol from the late 1990s remained the reference point for low communication, and later work had trimmed only its computation. Rosulek and Trieu observed that in their key agreement construction one party needs to send only a single opening message, while the other packs one response per item into a polynomial. For honest-but-curious parties the hashing used to extract inputs can be dropped and the returned keys shortened to a statistical length. Two variants result: one relies on an ideal permutation and the computational Diffie-Hellman assumption, the other avoids the permutation at the cost of one extra field element and a stronger oracle assumption. Both send about one group element per item in total, which the authors present as the first communication gain over the classic protocol.","prior_boundary":"The classic semi-honest Diffie-Hellman PSI of Huberman, Franklin, and Hogg, as the paper describes it, sends \\( 2n \\) group elements plus \\( n \\) hashes and computes \\( 4n \\) variable-base exponentiations (§1.2, pp. 5-6); the only improvement the authors know, due to Jarecki and Liu, lowers computation by about 5-15% (§1, p. 2).","significance_at_publication":"The authors call this the first improvement in the communication of Diffie-Hellman PSI in over 20 years, by over 40% (§1, p. 2), with 45% less communication than the next best protocol for \\( n = 256 \\) (§1.2, p. 5); for \\( n_X = 2^{16} \\) and \\( n_Y = 2^{20} \\) it sends 12.58 MB against 46.14 MB (§5.2, p. 19).","technical_delta":"One party sends a single key-agreement message and the other encodes its \\( n \\) responses in one polynomial, so the total is \\( n + 1 \\) group elements plus \\( n \\) hashes, with \\( 3n \\) fixed-base and \\( 2n \\) variable-base exponentiations and two degree-\\( n \\) interpolation or evaluation steps (§1.2, p. 6; Appendix A.1, Figure 5, p. 24; Appendix A.2, Figure 6, p. 26)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","keywords":["diffie-hellman","communication","semi-honest","polynomial-encoding","elligator","ideal-permutation"],"limitations":["the hardness assumptions in Table 1 do not list the random oracle or the ideal permutation (Table 1, p. 4)","computation remains one or two exponentiations per item, so OT-extension protocols are faster on large sets in the LAN setting (§5.2, p. 20)","the comparison with classic Diffie-Hellman PSI uses the paper's own description of that protocol, with \\( n \\) hashes in place of \\( n \\) group elements in one direction (§1.2, pp. 5-6; Table 1, p. 4)"],"paper_id":"PSI-PAPER-2021-RT","qualifiers":["variant 1: secure against a semi-honest sender if the key agreement has pseudorandom messages and \\( \\Pi \\) is an ideal permutation (Lemma 11, p. 24), and against a semi-honest receiver if the key agreement is secure against eavesdroppers (Lemma 12, p. 25)","variant 2: no ideal permutation; secure against a semi-honest receiver if the key agreement is non-malleable with pseudorandom second messages (Lemma 13, p. 27)","hashed Diffie-Hellman key agreement is secure against eavesdroppers under CDH in the random oracle model (§3.2, p. 8)","only the receiver learns the intersection (Figure 5, step 7, p. 24)","the October 2021 revision repaired a bug in the original semi-honest proof and added variant 2 (§1.3, p. 6)"],"source_locator":{"dossier_section":"PSI-PAPER-2021-RT § Contributions","primary_source":"§1 (p. 2); §1.2 (pp. 5-6); §1.3 (p. 6); Table 1 (p. 4); §3.2 (pp. 8-9); §4 (p. 15); Appendix A.1, Figure 5, Lemmas 11-12 (pp. 23-26); Appendix A.2, Figure 6, Lemma 13 (pp. 26-28); Table 2 (p. 17); Table 3 (p. 18); §5.2 (pp. 19-20). IACR ePrint 2021/1159, version of October 17, 2021.","primary_source_url":"https://eprint.iacr.org/2021/1159","status":"theorem_checked"},"statement":"Dropping the random oracles used only for extraction, the receiver interpolates P with \\( \\Pi(P(y_i)) = m'_i \\) and the sender returns its keys shortened to \\( \\lambda + 2 \\log n \\) bits (variant 1), which is secure against semi-honest parties if the key agreement is secure against eavesdroppers with pseudorandom second messages and \\( \\Pi \\) is an ideal permutation; variant 2 drops the ideal permutation by fixing P(0) to a random value, at one extra field element, and needs a non-malleable key agreement. With hashed elliptic-curve Diffie-Hellman and \\( \\phi \\) the bit length of a group element, communication is \\( (\\lambda + \\log(n_X n_Y))n_X + \\phi n_Y + \\phi \\) bits for variant 1 and one more \\( \\phi \\) for variant 2, against \\( (\\phi + \\lambda + \\log(n_X n_Y))n_X + \\phi n_Y \\) bits for classic Diffie-Hellman PSI, under CDH (variant 1) or oracle Diffie-Hellman (variant 2).","statement_status":"source_normalized_statement","status":"published","title":"Semi-honest Diffie-Hellman PSI communication of one key-agreement message, one field element per receiver item, and one short key per sender item, from polynomial-encoded key-agreement responses","work_id":"PSI-PAPER-2021-RT","year":2021},"primaryUrl":"https://eprint.iacr.org/2021/1159","sections":[{"content":"Lower-communication semi-honest Diffie-Hellman PSI","heading":"Overview"},{"content":"Variant 1 (Figure 5, p. 24): the sender sends \\( m = \\mathrm{KA.msg1}(a) \\); the receiver sends P interpolated on \\( (y_i, \\Pi^{-1}(\\mathrm{KA.msg2}(b_i, m))) \\); the sender sends the shuffled keys \\( k_i = \\mathrm{KA.key1}(a, \\Pi(P(x_i))) \\) of length \\( \\lambda + 2 \\log n \\); the receiver outputs \\( y_i \\) with \\( \\mathrm{KA.key2}(b_i, m) \\) in the set. Variant 2 (Figure 6, p. 26): \\( P(y_i) \\) is the key-agreement message itself and \\( P(0) = R \\) for a random R, which lets the simulator program one evaluation point at a time (Appendix A.2, p. 26). Correctness fails with probability at most about \\( n^2/|\\mathrm{KA.K}| \\) (Appendix A.1, p. 24).","heading":"Exact contribution"},{"content":"PKE-RESULT-1976-DH-INTERACTIVE-PUBLIC-CHANNEL-KEY-AGREEMENT: the hashed Diffie-Hellman key agreement used in both variants (§3.2, p. 8).","heading":"Related records in other topics"}],"slug":"rt21-semi-honest-diffie-hellman","status":"published","subtitle":"Compact and Malicious Private Set Intersection for Small Sets","summary":"Dropping the random oracles used only for extraction, the receiver interpolates P with \\( \\Pi(P(y_i)) = m'_i \\) and the sender returns its keys shortened to \\( \\lambda + 2 \\log n \\) bits (variant 1), which is secure against semi-honest parties if the key agreement is secure against eavesdroppers with pseudorandom second messages and \\( \\Pi \\) is an ideal permutation; variant 2 drops the ideal permutation by fixing P(0) to a random value, at one extra field element, and needs a non-malleable key agreement. With hashed elliptic-curve Diffie-Hellman and \\( \\phi \\) the bit length of a group element, communication is \\( (\\lambda + \\log(n_X n_Y))n_X + \\phi n_Y + \\phi \\) bits for variant 1 and one more \\( \\phi \\) for variant 2, against \\( (\\phi + \\lambda + \\log(n_X n_Y))n_X + \\phi n_Y \\) bits for classic Diffie-Hellman PSI, under CDH (variant 1) or oracle Diffie-Hellman (variant 2).","tableRows":["PSI-CONSTRUCTION-2021-RT-SH-V1","PSI-CONSTRUCTION-2021-RT-SH-V2"],"title":"Semi-honest Diffie-Hellman PSI communication of one key-agreement message, one field element per receiver item, and one short key per sender item, from polynomial-encoded key-agreement responses","type":"result","venue":"ACM CCS 2021","year":2021,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","keywords":["atomic-result","subfield-vole","vole-psi","communication","statistical-security","okvs","semi-honest"],"metadata":{"claim_slug":"subfield-vole","contribution_kind":"optimization","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["intersection"],"parties":["two_party"],"security_model":["random_oracle_model"],"set_size_regime":["balanced"],"technique":["subfield_vole","okvs","batched_oprf"]},"historical_context":{"narrative":"In VOLE-based PSI the receiver sends its encoded set masked by a VOLE vector, so every encoded position costs one field element, and the field had to be as large as the computational security parameter. Raghuraman and Rindal separated the two roles of that field. The sender's secret multiplier must be hard to guess, but the encoded values only need to avoid accidental collisions among all pairs of items, which takes about \\( \\lambda + \\log n \\) bits. Subfield VOLE, in which one vector lies in a small base field and everything else in a large extension, provides exactly this split. The receiver's message shrinks to statistical-parameter size per position, and communication no longer grows with \\( \\kappa \\) times the set size.","prior_boundary":"VOLE-PSI performed all VOLE arithmetic over a field of about \\( 2^{\\kappa} \\) elements, so derandomizing the correlation cost about \\( \\kappa \\) bits per OKVS position, and its communication scaled with \\( \\kappa \\) times the set size (abstract, p. 1; §1.2, p. 4).","significance_at_publication":"The authors call it the first PSI with communication \\( O(n\\lambda + n \\log n) \\), not scaling with \\( \\kappa n \\) (abstract, p. 1), and report \\( 180n \\) bits for \\( n = 2^{20} \\) against \\( 426n \\) for VOLE-PSI (§1.1, p. 3; Table 2, p. 25).","technical_delta":"Only \\( \\Delta \\) must come from a large field for security; the encoded values need only be long enough to avoid spurious matches among the \\( n_X n_Y \\) pairs, so the OKVS lives in the base field of a subfield VOLE (§1.2, p. 4; §4, pp. 21-22; Figure 9, p. 23; Figure 12, p. 32); the proof is Theorem 3 (pp. 33-35)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","keywords":["subfield-vole","vole-psi","communication","statistical-security","okvs","semi-honest"],"limitations":["the abstract reports \\( 187n \\) bits for \\( n = 2^{20} \\), while §1.1 (p. 3) and Table 2 (p. 25) give \\( 180n \\)","the low-communication instantiation is slower than the fast one: 1,353 ms against 369 ms for \\( n = 2^{20} \\) on one thread (Table 2, p. 25)","the malicious protocol of the paper does not use subfield VOLE (§4, p. 23)"],"paper_id":"PSI-PAPER-2022-RR","qualifiers":["semi-honest security only, in the \\( F_{\\text{sub-vole}} \\)-hybrid model with random oracles \\( H_{\\mathbb{B}} \\) and \\( H_o \\) (Theorem 3, p. 33)","requires a base field of size \\( |\\mathbb{B}| \\ge 2^{\\lambda + \\log_2(n_Y) + \\log_2(n_X)} \\) and an extension field of size \\( |\\mathbb{F}| \\ge 2^{\\kappa} \\) (Theorem 3, p. 33)","the low-communication instantiation uses the OKVS without clustering, \\( m = 1.23n \\) (§4, p. 22)"],"source_locator":{"dossier_section":"PSI-PAPER-2022-RR § Contributions","primary_source":"Abstract (p. 1); §1.1-1.2 (pp. 3-4); §4 (pp. 21-23); Figure 9 (p. 23); Table 2 (p. 25); Figure 12 (p. 32); Appendix C.1, Theorem 3 (pp. 33-35). IACR ePrint 2022/320, PDF dated 2022-11-02.","primary_source_url":"https://eprint.iacr.org/2022/320","status":"theorem_checked"},"statement":"In semi-honest VOLE-based PSI, a subfield VOLE \\( C = A\\Delta + B \\), with \\( A \\) over a small base field \\( \\mathbb{B} \\) and \\( \\Delta, B, C \\) over an extension \\( \\mathbb{F} \\) of size at least \\( 2^{\\kappa} \\), lets the receiver derandomize the correlation by sending \\( A - P \\), where P is an OKVS over \\( \\mathbb{B} \\) that decodes to \\( H_{\\mathbb{B}}(x) \\) on its items. If \\( |\\mathbb{B}| \\ge 2^{\\lambda + \\log_2(n_X n_Y)} \\), the protocol realizes PSI against semi-honest adversaries in the \\( F_{\\text{sub-vole}} \\)-hybrid model (Theorem 3). The receiver's message is \\( m \\cdot \\log_2 |\\mathbb{B}| \\) bits, \\( m \\) the OKVS size, and total communication is \\( O(n\\lambda + n \\log n) \\).","statement_status":"source_normalized_statement","status":"published","title":"Subfield VOLE in VOLE-based PSI: OKVS entries in a base field of about \\( \\lambda + \\log(n_X n_Y) \\) bits, giving \\( O(n\\lambda + n \\log n) \\) communication, semi-honest","work_id":"PSI-PAPER-2022-RR","year":2022},"primaryUrl":"https://eprint.iacr.org/2022/320","sections":[{"content":"Subfield VOLE in VOLE-based PSI","heading":"Overview"},{"content":"The receiver encodes \\( L = \\{(x, H_{\\mathbb{B}}(x, r'))\\} \\) with the OKVS of PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS over the base field \\( \\mathbb{B} \\), obtains a random subfield VOLE with A over \\( \\mathbb{B} \\) and \\( \\Delta, B, C \\) over \\( \\mathbb{F} \\), and sends \\( A' = A - P \\), which costs \\( m \\cdot \\log_2 |\\mathbb{B}| \\) bits, \\( m \\) the OKVS size, (Figure 9, steps 1-3, p. 23; §4, p. 22). The sender's \\( B' = B + A'\\Delta \\) satisfies \\( C - B' = \\Delta P \\), so by linearity \\( \\mathrm{Decode}(C, x) = \\mathrm{Decode}(B', x) + \\Delta H_{\\mathbb{B}}(x) \\) for each x in the receiver's set; both parties hash these values with \\( H_o \\), and the sender sends its hashed values for its own set (§4, p. 22; Figure 9, steps 4-5, p. 23). Because \\( \\Delta \\) is uniform in a field of size at least \\( 2^{\\kappa} \\), the receiver cannot predict the sender's values outside the intersection (Theorem 3 proof, Hybrid 6, p. 34). The protocol is the semi-honest OPRF-based PSI of PSI-CONTRIB-2021-RS-VOLE-OPRF with the VOLE moved to a subfield. The complete row is PSI-CONSTRUCTION-2022-RR-SD.","heading":"Exact contribution"},{"content":"MPC-COMP-CORR-PCG: the starting point is the subfield VOLE of Couteau, Rindal, and Raghuraman (Silver) and of Boyle et al., CCS 2019 (§4, p. 22); neither paper has a record yet.","heading":"Related records in other topics"}],"slug":"rr22-subfield-vole-psi","status":"published","subtitle":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","summary":"In semi-honest VOLE-based PSI, a subfield VOLE \\( C = A\\Delta + B \\), with \\( A \\) over a small base field \\( \\mathbb{B} \\) and \\( \\Delta, B, C \\) over an extension \\( \\mathbb{F} \\) of size at least \\( 2^{\\kappa} \\), lets the receiver derandomize the correlation by sending \\( A - P \\), where P is an OKVS over \\( \\mathbb{B} \\) that decodes to \\( H_{\\mathbb{B}}(x) \\) on its items. If \\( |\\mathbb{B}| \\ge 2^{\\lambda + \\log_2(n_X n_Y)} \\), the protocol realizes PSI against semi-honest adversaries in the \\( F_{\\text{sub-vole}} \\)-hybrid model (Theorem 3). The receiver's message is \\( m \\cdot \\log_2 |\\mathbb{B}| \\) bits, \\( m \\) the OKVS size, and total communication is \\( O(n\\lambda + n \\log n) \\).","tableRows":["PSI-CONSTRUCTION-2022-RR-SD"],"title":"Subfield VOLE in VOLE-based PSI: OKVS entries in a base field of about \\( \\lambda + \\log(n_X n_Y) \\) bits, giving \\( O(n\\lambda + n \\log n) \\) communication, semi-honest","type":"result","venue":"ACM CCS 2022","year":2022,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2022-RR-SUBFIELD-VOLE"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","keywords":["atomic-result","okvs","triangulation","gap","back-substitution","phase-transition","clustering","doubly-oblivious","failure-probability"],"metadata":{"claim_slug":"triangulation-okvs","contribution_kind":"mechanism","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"technique":["okvs"]},"historical_context":{"narrative":"Sparse encodings such as the three-hash garbled cuckoo table were fast in principle, but their concrete parameters were shaky. The unpeelable core was solved wholesale with many dense columns, and a failure bound of \\( 2^{-40} \\) was reached only through an amplification that doubled the work. Raghuraman and Rindal recast encoding as triangulating a sparse matrix. A greedy pass finds the rows that back-substitution can handle and leaves a gap of a few rows, which a handful of dense columns over a large field resolve. They proved the greedy pass optimal in several cases and measured how the gap behaves around the known phase transition of random hypergraphs, which let them choose the expansion directly for a target security level.","prior_boundary":"The three-hash table of Garimella et al. solved its whole 2-core with \\( \\lambda + |\\text{2-core}| \\) dense columns, needed two graph traversals, and reached failure \\( 2^{-40} \\) only through the star amplification, at expansion 1.32 for \\( n = 2^{20} \\); its 2-core bound came from an experiment (§1, p. 3; §5.1, p. 24).","significance_at_publication":"The authors report encoding \\( 2^{20} \\) items in 653 ms and decoding them in 54 ms, 13 and 64 times faster than the three-hash table, and 143 ms with clustering against 4,912 ms for the star construction (§5.1, p. 23; Table 1, p. 25); with this OKVS their PSI runs in 369 ms for \\( n = 2^{20} \\) on one thread, against 2,073 ms for KKRT on the same laptop (Table 2, p. 25).","technical_delta":"Figure 1 (p. 7) triangulates by repeatedly selecting the sparse column of minimum nonzero weight, so only the rows left in the gap need dense columns (§2, pp. 5-8; Lemmas 1-2, p. 8); clustering confines rows to blocks of about \\( 2^{14} \\) columns for memory locality and threads (§2.1, pp. 9-10). Section 3 proves optimality for \\( w = 2 \\) (Lemma 4, p. 12), for \\( g = 0 \\) (Lemma 9, p. 19), and for duplicate rows (§3.3, p. 20), and derives parameters from Equations (1)-(3) (pp. 14-19; §3.4, p. 21)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","keywords":["okvs","triangulation","gap","back-substitution","phase-transition","clustering","doubly-oblivious","failure-probability"],"limitations":["for \\( w > 2 \\) optimal triangulation is argued to be hard in general, and in the worst case the greedy gap can be as large as the 2-core minus one (§3.2, p. 15; §3.3, p. 20)","the fitted bound of Equation (3) is stated for \\( 3 \\le w \\le 20 \\) and becomes an upper bound outside that range (§3.2, p. 19)"],"paper_id":"PSI-PAPER-2022-RR","qualifiers":["concrete security levels come from empirical curves fitted for \\( 30 \\le \\lambda \\le 128 \\), \\( 3 \\le w \\le 10 \\), and \\( 2^6 \\le n \\le 2^{30} \\), and the line through a common point is a conjectured trend (§3.1, p. 14; §3.2, pp. 17-19)","with dense columns over a large field the values must be field elements; the binary dense variant encodes arbitrary strings (§2, p. 9)","a doubly oblivious variant, used for circuit PSI, appends random rows so that the output is uniform (Figure 1, step 5, p. 7; Theorem 2, p. 31)"],"source_locator":{"dossier_section":"PSI-PAPER-2022-RR § Contributions","primary_source":"Abstract (p. 1); §1-1.2 (pp. 2-4); §2 and Figure 1 (pp. 5-8); Lemmas 1-2 (p. 8); §2.1 (pp. 9-10); §3.1, Lemmas 3-6 and Figures 2-3 (pp. 10-14); §3.2, Lemmas 7-8 and Figures 4-8 (pp. 14-19); §3.3, Lemmas 9-10 (pp. 19-21); §3.4 (p. 21); §5.1 and Table 1 (pp. 23-25); Table 2 (p. 25); Figure 10 (p. 30); Appendix A (pp. 30-31). IACR ePrint 2022/320, PDF dated 2022-11-02.","primary_source_url":"https://eprint.iacr.org/2022/320","status":"theorem_checked"},"statement":"Each key's row has \\( w \\) ones among \\( m' = en \\) sparse positions plus a short dense part, either random bits or powers of a hashed element of a large field. The encoder permutes rows and columns into approximately lower-triangular form, leaving a gap of g rows that it solves with the dense columns in \\( O(g^2) \\) time, and back-substitutes the rest, for \\( O(m + g^2) \\) time in total, \\( m \\) the OKVS size. The greedy triangulation is optimal for \\( w = 2 \\), where \\( g = O(\\log n) \\) at \\( e = 2 \\), and finds a gap of zero whenever one exists; for \\( w \\ge 3 \\) the authors fit empirical curves around the 2-core phase transition into a formula giving the statistical security from \\( n \\), \\( w \\), and \\( e \\). For \\( w = 3 \\) they use \\( e = 1.23 \\) without clustering and \\( e = 1.28 \\) with clusters of about \\( 2^{14} \\) columns.","statement_status":"source_normalized_statement","status":"published","title":"OKVS by sparse triangulation with a small gap: about \\( 1.23n \\) positions for row weight 3, linear-time encoding, and concrete failure-probability bounds","work_id":"PSI-PAPER-2022-RR","year":2022},"primaryUrl":"https://eprint.iacr.org/2022/320","sections":[{"content":"Triangulation OKVS","heading":"Overview"},{"content":"The encoder builds the matrix H whose rows are \\( \\mathrm{row}(k_i) \\) and looks for row and column permutations that put it in the form \\( \\begin{bmatrix} A & B & C \\\\ D & E & F \\end{bmatrix} \\), with F a large lower-triangular sparse block and B, E the dense columns (§2, pp. 5-6). After eliminating C, only a \\( g \\)-row system on the dense columns remains; if it has full row rank, which holds with probability \\( 1 - 2^{-\\lambda} \\) for \\( \\lambda \\) extra binary columns (Lemma 1, p. 8) or with overwhelming probability for Vandermonde-style columns over a large field (Lemma 2, p. 8), the solution follows by back-substitution (§2, p. 6). For \\( w = 2 \\) the rows that can be triangulated form the independent sets of a graphic matroid, so the greedy choice minimizes the gap (Lemmas 3-4, pp. 11-12); duplicate rows, which occur with probability \\( O(n^{2-w}) \\), are the main failure mode and motivate \\( w \\ge 3 \\) (Lemma 6, p. 13; §3.2, p. 16). An exhaustive variant searches subsets of the 2-core and is optimal when the gap is bounded (Figure 10, p. 30; Lemma 10, p. 20). The construction improves on PSI-CONTRIB-2021-GPRTY-3H-GCT and replaces the amplification of PSI-CONTRIB-2021-GPRTY-AMPLIFICATION by direct parameter choice; §5.1 (p. 24) argues that the empirical 2-core bound used there overstates security by a few bits (for example \\( \\lambda = 27 \\) rather than 29).","heading":"Exact contribution"}],"slug":"rr22-triangulation-okvs","status":"published","subtitle":"Blazing Fast PSI from Improved OKVS and Subfield VOLE","summary":"Each key's row has \\( w \\) ones among \\( m' = en \\) sparse positions plus a short dense part, either random bits or powers of a hashed element of a large field. The encoder permutes rows and columns into approximately lower-triangular form, leaving a gap of g rows that it solves with the dense columns in \\( O(g^2) \\) time, and back-substitutes the rest, for \\( O(m + g^2) \\) time in total, \\( m \\) the OKVS size. The greedy triangulation is optimal for \\( w = 2 \\), where \\( g = O(\\log n) \\) at \\( e = 2 \\), and finds a gap of zero whenever one exists; for \\( w \\ge 3 \\) the authors fit empirical curves around the 2-core phase transition into a formula giving the statistical security from \\( n \\), \\( w \\), and \\( e \\). For \\( w = 3 \\) they use \\( e = 1.23 \\) without clustering and \\( e = 1.28 \\) with clusters of about \\( 2^{14} \\) columns.","tableRows":["PSI-CONSTRUCTION-2022-RR-CIRCUIT","PSI-CONSTRUCTION-2022-RR-FAST","PSI-CONSTRUCTION-2022-RR-MAL","PSI-CONSTRUCTION-2022-RR-SD"],"title":"OKVS by sparse triangulation with a small gap: about \\( 1.23n \\) positions for row weight 3, linear-time encoding, and concrete failure-probability bounds","type":"result","venue":"ACM CCS 2022","year":2022,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","keywords":["atomic-result","multiparty-threshold-psi","quasilinear-communication","cardinality-testing","oblivious-transfer","additively-homomorphic-encryption"],"metadata":{"claim_slug":"multiparty-quasilinear","contribution_kind":"construction","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["threshold"],"parties":["multiparty"],"set_size_regime":["balanced"],"technique":["secret_sharing","simple_hashing","additively_homomorphic_encryption"]},"historical_context":{"narrative":"Threshold PSI among many parties had two kinds of protocols that avoid paying for the full sets: those built on fully homomorphic encryption, nearly linear in the threshold, and those built on additively homomorphic encryption, quadratic in it, \\( O(\\kappa \\ell t^2 \\,\\mathrm{polylog}\\, t) \\). One protocol was nearly linear without fully homomorphic encryption, but only under a stricter condition that bounds all elements outside the intersection together. Ghosh and Simkin applied their bucketing compiler to the quadratic multiparty cardinality test of Branco, Döttling, and Pu, after rewriting it with generic secure computation, then reused their earlier step for computing a large intersection. The result releases the intersection when every set is close to it, communicates \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) bits, quasilinear in the threshold \\( t \\), and needs only oblivious transfer or additively homomorphic encryption.","prior_boundary":"Ghosh and Simkin gave \\( O(\\kappa t^2 \\,\\mathrm{polylog}\\, t) \\) for two parties from oblivious transfer and additively homomorphic encryption and \\( O(\\kappa t \\,\\mathrm{polylog}\\, t) \\) from FHE; Branco, Döttling, and Pu gave \\( O(\\kappa\\ell t^2 \\,\\mathrm{polylog}\\, t) \\) for \\( \\ell \\) parties from threshold additively homomorphic encryption; Badrinarayanan et al. gave \\( O(\\kappa\\ell t \\,\\mathrm{polylog}\\, t) \\) when the union exceeds the intersection by at most \\( t \\), and FHE-based protocols matching \\( \\Omega(\\ell t) \\) up to polylog factors (abstract, p. 1; §1, pp. 1-2). The authors state that all three left asymptotically optimal multiparty protocols from assumptions other than FHE open (§1, p. 2).","significance_at_publication":"It gives multiparty threshold PSI for the large-intersection condition with quasilinear rather than quadratic dependence on \\( t \\) from simple assumptions, which the authors describe as a significant theoretical step (abstract, p. 1; §1.2, pp. 2-3).","technical_delta":"The compiler of the paper reduces the threshold handled by the inner multiparty cardinality test to \\( O(\\ln t\\ell) \\), so the quadratic inner protocol contributes only polylogarithmic factors (§4.1, p. 16; Corollary 5, p. 16); the intersection is then computed with the earlier Ghosh-Simkin protocol at \\( \\tilde O(\\kappa\\ell t) \\) (§1.2, p. 2; Corollary 6, p. 16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","keywords":["multiparty-threshold-psi","quasilinear-communication","cardinality-testing","oblivious-transfer","additively-homomorphic-encryption"],"limitations":["no round complexity is stated for the multiparty protocol (Corollaries 5-6, p. 16)","not claimed practical; concretely efficient protocols are left open (§1.2, p. 3)","the bound carries a \\( \\lambda^2 \\) factor and \\( \\mathrm{polylog}(t) \\) factors relative to the \\( \\Omega(\\ell t) \\) lower bound shown in the earlier works (§1, p. 2; abstract, p. 1)"],"paper_id":"PSI-PAPER-2023-GS","qualifiers":["passive security against a static adversary corrupting all but one party, with pairwise private channels and a unit-cost broadcast channel (§2.1, p. 4; Corollary 6, p. 16)","all sets have exactly \\( n \\) elements, and the output condition is an intersection of at least \\( n - t \\) elements (Figure 9, p. 11; abstract, p. 1)","the inner multiparty cardinality test of Branco, Döttling, and Pu is assumed adaptable to generic secure computation at \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\) (§4.1, p. 16)","\\( \\lambda/\\kappa \\) is in \\( O(1) \\), so the bound \\( O(\\lambda\\kappa \\ell t \\,\\mathrm{polylog}\\, t) \\) is \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) in the security parameter (§2, p. 4; abstract, p. 1)"],"source_locator":{"dossier_section":"PSI-PAPER-2023-GS § Contributions","primary_source":"Abstract (p. 1); §1 (pp. 1-2); §1.2 (pp. 2-3); §2.1 (p. 4); §4 with Figure 9 (p. 11); §4.1 with Theorem 8, Corollaries 5-6 (pp. 15-16). IACR ePrint 2023/919, PDF dated 2023-06-12.","primary_source_url":"https://eprint.iacr.org/2023/919","status":"theorem_checked"},"statement":"Assuming oblivious transfer or additively homomorphic encryption, there is a passively secure protocol for \\( \\ell \\) parties holding sets of \\( n \\) elements that outputs the intersection if it has at least \\( n - t \\) elements, with communication \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) bits (Corollary 6): the multiparty cardinality-test compiler is instantiated with the protocol of Branco, Döttling, and Pu, rewritten to use generic secure computation at \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\), run \\( O(\\ln t) \\) times at threshold \\( O(\\ln t) \\) in each of \\( \\lambda t \\) buckets, and followed by the Ghosh-Simkin protocol for computing a large intersection.","statement_status":"source_normalized_statement","status":"published","title":"Multiparty threshold PSI with communication quasilinear in \\( t \\), \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) bits, from oblivious transfer or additively homomorphic encryption, passive security","work_id":"PSI-PAPER-2023-GS","year":2023},"primaryUrl":"https://eprint.iacr.org/2023/919","sections":[{"content":"Quasilinear multiparty threshold PSI without FHE","heading":"Overview"},{"content":"Corollary 5 (p. 16) gives an \\( \\ell \\)-party cardinality test with communication \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) bits from oblivious transfer or additively homomorphic encryption; Corollary 6 (p. 16) combines it with the Ghosh-Simkin intersection step into passively secure \\( \\ell \\)-party threshold PSI with the same communication. The functionality is the large-intersection one, \\( |\\cap X_i| \\ge n - t \\) (Figure 9, p. 11), which for \\( \\ell > 2 \\) differs from the union-based condition under which Badrinarayanan et al. reach \\( O(\\kappa\\ell t \\,\\mathrm{polylog}\\, t) \\) without FHE (§1, p. 2).","heading":"Exact contribution"},{"content":"None.","heading":"Related records in other topics"}],"slug":"gs23-multiparty-threshold-psi-wit","status":"published","subtitle":"Threshold Private Set Intersection with Better Communication Complexity","summary":"Assuming oblivious transfer or additively homomorphic encryption, there is a passively secure protocol for \\( \\ell \\) parties holding sets of \\( n \\) elements that outputs the intersection if it has at least \\( n - t \\) elements, with communication \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) bits (Corollary 6): the multiparty cardinality-test compiler is instantiated with the protocol of Branco, Döttling, and Pu, rewritten to use generic secure computation at \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\), run \\( O(\\ln t) \\) times at threshold \\( O(\\ln t) \\) in each of \\( \\lambda t \\) buckets, and followed by the Ghosh-Simkin protocol for computing a large intersection.","tableRows":["PSI-CONSTRUCTION-2023-GS-MULTIPARTY"],"title":"Multiparty threshold PSI with communication quasilinear in \\( t \\), \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\) bits, from oblivious transfer or additively homomorphic encryption, passive security","type":"result","venue":"PKC 2023","year":2023,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2023-GS-PICT-COMPILER","keywords":["atomic-result","cardinality-testing","compiler","random-partitioning","divide-and-conquer","padding","secret-sharing","threshold-psi"],"metadata":{"claim_slug":"pict-compiler","contribution_kind":"transform","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest"],"output":["threshold"],"parties":["two_party","multiparty"],"set_size_regime":["balanced"],"technique":["secret_sharing","simple_hashing"]},"historical_context":{"narrative":"Threshold PSI protocols spend most of their effort on a single bit: are the parties' sets close enough that their intersection should be released? Known tests for that bit cost a polynomial in the threshold \\( t \\), quadratic in the best multiparty protocols that avoid fully homomorphic encryption. Ghosh and Simkin observed that random partitioning shrinks the threshold. After the elements are hashed into \\( t \\) buckets, each bucket of nearly identical sets differs in only \\( O(\\ln t\\ell) \\) elements, so an expensive test run per bucket with a logarithmic threshold costs only polylogarithmically much. Repeating the partition a security parameter's worth of times makes it likely that one partition works, and secret sharing lets the parties add bucket counts without revealing them. Any polynomial-cost test thus becomes quasilinear, \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\).","prior_boundary":"Every threshold PSI protocol, following Ghosh and Simkin, first runs a cardinality test that outputs one bit and then computes the intersection; the second step already costs \\( \\tilde O(\\kappa\\ell t) \\) from oblivious transfer or additively homomorphic encryption (abstract, p. 1; §1.2, p. 2). Multiparty cardinality tests from assumptions weaker than FHE, such as that of Branco, Döttling, and Pu, cost \\( O(\\kappa\\ell t^2 \\,\\mathrm{polylog}\\, t) \\) (§1, p. 1).","significance_at_publication":"The efficiency of the inner protocol only affects the constant in the \\( \\mathrm{polylog}(t) \\) exponent, so multiparty cardinality tests with quasilinear dependence on \\( t \\) follow from effectively any assumption implying secure computation (§1.2, p. 2).","technical_delta":"Random partitioning into \\( t \\) buckets leaves each bucket, with constant probability per partition, at most \\( O(\\ln t\\ell) \\) elements outside its intersection (Lemma 2, p. 7; Theorem 5, p. 12); \\( \\lambda \\) partitions make some partition good except with probability \\( 2^{-\\lambda} \\) (Theorems 2 and 6, pp. 8, 14). Padding keeps bucket sizes equal so intersection sizes stay meaningful (Lemmas 3 and 5, pp. 11-14), and the exact bucket intersection size is assembled from cardinality tests at each small threshold (Figures 8 and 12; Theorems 4 and 8, pp. 10, 16)."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2023-GS-PICT-COMPILER","keywords":["cardinality-testing","compiler","random-partitioning","divide-and-conquer","padding","secret-sharing","threshold-psi"],"limitations":["the authors consider the results too inefficient for most real-world parameters (§1.2, p. 3)","the two-party instantiation does not improve asymptotically on the existing \\( O(\\kappa t \\,\\mathrm{polylog}\\, t) \\) (p. 4)","Theorems 3 and 7 are stated in hybrid models with ideal functionalities for the bucket counts and comparisons (pp. 9, 15)"],"paper_id":"PSI-PAPER-2023-GS","qualifiers":["static passive adversary corrupting all but one party; pairwise authenticated private channels and a broadcast channel of unit cost; standalone simulation-based security (§2.1, p. 4)","the input PICT must output secret shares, which the authors say all existing protocols can easily be adapted to do (§1.2, footnote 3, p. 2)","the partitions use public random functions; pseudorandom functions with a key known to all parties are said to work equally well (footnote 4, p. 3)","the statistical security parameter \\( \\lambda \\) satisfies \\( \\lambda/\\kappa \\in O(1) \\), and the field has at least \\( 2^{\\lambda} \\) elements (§2, p. 4)","the multiparty version requires all sets to have exactly \\( n \\) elements (Figure 9, p. 11); the two-party version allows sets of at most \\( n \\) elements (Figure 1, p. 5)"],"source_locator":{"dossier_section":"PSI-PAPER-2023-GS § Contributions","primary_source":"Abstract (p. 1); §1.2 (p. 2); §1.3 (pp. 3-4); §2 with Figures 1-5 (pp. 4-6); §3 with Lemmas 1-2, Theorems 2-4, Corollary 1, and Figures 6-8 (pp. 6-10); §4 with Lemmas 3-5, Theorems 5-8, Corollary 4, and Figures 9-12 (pp. 11-16). IACR ePrint 2023/919, PDF dated 2023-06-12.","primary_source_url":"https://eprint.iacr.org/2023/919","status":"theorem_checked"},"statement":"Against a static passive adversary corrupting all but one of \\( \\ell \\) parties, any private intersection cardinality test (PICT) with secret-shared output and communication \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\) yields a PICT for threshold \\( t \\) with communication \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\): the parties hash their sets \\( \\lambda \\) times with public random functions into \\( t \\) buckets, pad every bucket to a common size, obtain for each bucket a secret sharing of its intersection size (or of a default value when the bucket's threshold \\( \\tilde t = O(\\ln t\\ell) \\) is exceeded) by running the given PICT at each threshold up to \\( \\tilde t \\), sum these per partition, and test with generic secure computation whether some partition's sum shows an intersection of at least \\( n - t \\); failure probability is at most \\( 2^{-\\lambda} \\).","statement_status":"source_normalized_statement","status":"published","title":"Compiler from any intersection cardinality test with secret-shared output and \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\) communication to one with \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\), passive security","work_id":"PSI-PAPER-2023-GS","year":2023},"primaryUrl":"https://eprint.iacr.org/2023/919","sections":[{"content":"Compiler for intersection cardinality tests","heading":"Overview"},{"content":"Two-party version (Figure 7, p. 9): for each of \\( \\lambda \\) partitions and each of \\( t \\) buckets, the parties call \\( F_{\\triangle} \\) with threshold \\( \\tilde t = 1 + 3 \\ln 2t \\) and default \\( t + 1 \\), add the shares per partition, and call \\( F_{\\text{vec-leq}} \\) to test whether some sum is at most \\( t \\) (Theorem 3, p. 9). \\( F_{\\triangle} \\) is realized from \\( \\tilde t \\) cardinality tests at thresholds \\( 1, \\ldots, \\tilde t \\) (Figure 8, Theorem 4, p. 10). Multiparty version (Figure 11, p. 15): buckets are padded to size \\( n + 1 \\), \\( F_{\\ell\\text{-}\\cap} \\) returns the bucket intersection size or the default \\( n + 1 \\), \\( F_{\\ell\\text{-min}} \\) removes the padding offset, and \\( F_{\\ell\\text{-vec-intrvl}} \\) tests whether some partition's total lies between \\( n - t \\) and \\( n \\) (Theorem 7, p. 15); \\( F_{\\ell\\text{-}\\cap} \\) is realized from cardinality tests at each threshold (Figure 12, Theorem 8, p. 16).","heading":"Exact contribution"},{"content":"None. Cramer and Damgård's constant-round secure linear algebra, used to instantiate the two-party inner test (p. 10), has no entry yet.","heading":"Related records in other topics"}],"slug":"gs23-bucketing-compiler-for-cardi","status":"published","subtitle":"Threshold Private Set Intersection with Better Communication Complexity","summary":"Against a static passive adversary corrupting all but one of \\( \\ell \\) parties, any private intersection cardinality test (PICT) with secret-shared output and communication \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\) yields a PICT for threshold \\( t \\) with communication \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\): the parties hash their sets \\( \\lambda \\) times with public random functions into \\( t \\) buckets, pad every bucket to a common size, obtain for each bucket a secret sharing of its intersection size (or of a default value when the bucket's threshold \\( \\tilde t = O(\\ln t\\ell) \\) is exceeded) by running the given PICT at each threshold up to \\( \\tilde t \\), sum these per partition, and test with generic secure computation whether some partition's sum shows an intersection of at least \\( n - t \\); failure probability is at most \\( 2^{-\\lambda} \\).","tableRows":["PSI-CONSTRUCTION-2023-GS-MULTIPARTY","PSI-CONSTRUCTION-2023-GS-TWO-PARTY"],"title":"Compiler from any intersection cardinality test with secret-shared output and \\( O(\\kappa\\ell \\,\\mathrm{poly}(t)) \\) communication to one with \\( O(\\lambda^2 \\ell t \\,\\mathrm{polylog}\\, t) \\), passive security","type":"result","venue":"PKC 2023","year":2023,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2023-GS-PICT-COMPILER"},{"evidence":"fulltext_checked","id":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON","keywords":["atomic-result","sok","operation-count","elliptic-curve-elgamal","oblivious-transfer","ole","collusion-resistance","state-of-the-art","use-cases"],"metadata":{"claim_slug":"analytical-cost-comparison","contribution_kind":"research_result","dossier_type":"contribution","evidence":"fulltext_checked","facet_status":"normalized","facets":{"adversary":["semi_honest","augmented_semi_honest"],"output":["intersection"],"parties":["multiparty"]},"historical_context":{"narrative":"Each new multiparty PSI paper had compared itself with a few recent protocols, so older designs based on homomorphic encryption dropped out of view on the strength of measurements taken in other settings. Vos, Conti, and Erkin put the semi-honest, collusion-resistant protocols on one footing. They instantiate the homomorphic designs with elliptic-curve ElGamal and count curve multiplications per element, and they express the protocols built from two-party subprotocols in calls to oblivious transfer, programmable OPRFs, and oblivious linear evaluation. Counted this way, older homomorphic designs become competitive with recent proposals, and the cheapest choice changes with the collusion bound, the error an application tolerates, and the computing power of the assistants. The authors conclude that no single protocol is the state of the art.","prior_boundary":"Each new multiparty PSI paper compared itself with a small subset of earlier protocols, and older works received less attention because of performance comparisons that do not cover all points of comparison (abstract, p. 1; §1, p. 2). The surveyed papers report experiments on different hardware, which the authors caution against comparing directly (§5.1.1, p. 10; §7, p. 12).","significance_at_publication":"The counts show that Hazay and Venkitasubramaniam is cheaper for weak assistants, Cheon et al. for equal computing power and small \\( t_c \\), and Vos et al. for \\( t_c \\) close to the number of parties \\( \\ell \\) with a tolerated error (§7.1, p. 13), and the authors conclude that it is not possible to name one state-of-the-art protocol and that direct comparisons cannot be conclusive until realistic parameters are known (§8, p. 13; §9, p. 14).","technical_delta":"The authors derive or collect asymptotic communication, computation, and rounds for every protocol without known attacks (Table 2, p. 10; Appendix A, pp. 16-17), and worst-case counts of elliptic-curve multiplications for the PHE-based protocols of Sang and Shen, Cheon et al., Hazay and Venkitasubramaniam, and Vos et al., and of OT, OPPRF, or OLE calls for those of Inbar et al., Kolesnikov et al., Chandran et al., Kavousi et al., Nevo et al., Ghosh and Nilges, and Gordon et al. (§7.1-7.2, pp. 12-13; Table 3, p. 13; Appendix B, pp. 17-18), modifying some protocols so that only the leader receives the output."},"historical_context_status":"source_explicit","id":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON","keywords":["sok","operation-count","elliptic-curve-elgamal","oblivious-transfer","ole","collusion-resistance","state-of-the-art","use-cases"],"limitations":["counts of primitive operations, not measured running times or communication; no implementation is evaluated, which the meta-review lists as a concern (§7, p. 12; Appendix C.4, p. 19)","no count is given for Garimella et al., whose multiparty analysis was deferred to an unavailable full version (Table 3, p. 13; Appendix B.2, p. 18)","OT, OPPRF, and OLE counts are not converted into elliptic-curve operations, so the two families are compared separately (§7, p. 12)"],"paper_id":"PSI-PAPER-2024-VCE","qualifiers":["semi-honest protocols with collusion resistance \\( t_c \\) and output to the leader only; server-aided protocols are excluded (§1, p. 2; Definition 1, p. 2)","PHE-based protocols are counted with elliptic-curve ElGamal, with precomputed multiplications taken as four times cheaper and homomorphic additions ignored (§7.1, pp. 12-13; Appendix B.1, p. 17)","2PC-based protocols are counted in sub-protocol calls, with one OPPRF as one OPRF and one OPRF as about 3.5 OTs; OLEs are counted separately, and setup such as base OTs is ignored (§7.2, p. 13; Appendix B.2, p. 18)","where possible, protocols are analyzed in the augmented semi-honest model (§7.2, p. 13)","some protocols are modified before counting, for example so that only the leader receives the output (Appendix B.1, pp. 17-18)"],"source_locator":{"dossier_section":"PSI-PAPER-2024-VCE § Contributions","primary_source":"Abstract (p. 1); §1 (pp. 1-2); Table 2 (p. 10); §7 with Table 3 and the use-case table (pp. 12-13); §8 (pp. 13-14); §9 (p. 14); Appendix A (pp. 16-17); Appendix B (pp. 17-18). IACR ePrint 2023/1777, PDF dated 2023-11-16.","primary_source_url":"https://eprint.iacr.org/2023/1777","status":"section_checked"},"statement":"For semi-honest multiparty PSI protocols that resist \\( t_c \\) colluding parties and give the output to a leader, the latest homomorphic-encryption-based protocols are instantiated with elliptic-curve ElGamal and costed in elliptic-curve multiplications per element, and protocols built from two-party subprotocols are costed in calls to OT, OPPRF (counted as 3.5 OTs), or OLE, for the leader, an assistant, and in total, in the worst case; derived asymptotic communication, computation, and round counts accompany them. On these counts the cheapest protocol changes with the assistants' computing power, the collusion bound \\( t_c \\), the tolerated error, and the number of parties, older homomorphic-encryption protocols instantiated with modern cryptosystems compete with recent proposals, and no single protocol is the state of the art.","statement_status":"source_normalized_statement","status":"published","title":"Worst-case operation counts per element for semi-honest collusion-resistant multiparty PSI protocols, showing that the cheapest protocol depends on the setting","work_id":"PSI-PAPER-2024-VCE","year":2024},"primaryUrl":"https://eprint.iacr.org/2023/1777","sections":[{"content":"Analytical cost comparison of multiparty PSI","heading":"Overview"},{"content":"Table 3 (p. 13) gives, per element, the worst-case elliptic-curve multiplications of the leader, an assistant, and in total for four PHE-based protocols, and the OTs or OLEs for seven 2PC-based protocols; for example, Kolesnikov et al. need \\( 7(\\ell - 1)n \\) OTs at the leader and \\( 3.5(\\ell + 1)(\\ell - 1)n \\) in total, and Nevo et al. \\( 3.5t_c n \\) at the leader (Table 3, p. 13; Appendix B.2, p. 18). Three use cases with assumed values of \\( \\ell \\), \\( t_c \\), set size \\( n \\), and error (mutual customers, common IP addresses, consensus voting) are matched to protocols (§7.3, p. 13). The authors identify improvements in oblivious key-value stores and homomorphic cryptosystems as the most impactful technical advances (§8, p. 13).","heading":"Exact contribution"},{"content":"PKE-PAPER-1985-ELGAMAL: the PHE-based protocols are instantiated with elliptic-curve ElGamal for the count (§7.1, p. 12; Appendix B.1, p. 17).","heading":"Related records in other topics"}],"slug":"vce24-operation-counts-for-semi","status":"published","subtitle":"SoK: Collusion-resistant Multi-party Private Set Intersections in the Semi-honest Model","summary":"For semi-honest multiparty PSI protocols that resist \\( t_c \\) colluding parties and give the output to a leader, the latest homomorphic-encryption-based protocols are instantiated with elliptic-curve ElGamal and costed in elliptic-curve multiplications per element, and protocols built from two-party subprotocols are costed in calls to OT, OPPRF (counted as 3.5 OTs), or OLE, for the leader, an assistant, and in total, in the worst case; derived asymptotic communication, computation, and round counts accompany them. On these counts the cheapest protocol changes with the assistants' computing power, the collusion bound \\( t_c \\), the tolerated error, and the number of parties, older homomorphic-encryption protocols instantiated with modern cryptosystems compete with recent proposals, and no single protocol is the state of the art.","title":"Worst-case operation counts per element for semi-honest collusion-resistant multiparty PSI protocols, showing that the cheapest protocol depends on the setting","type":"result","venue":"IEEE S&P 2024","year":2024,"sourcePath":"data/psi-catalog.json#PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON"},{"evidence":"registry","id":"ASM-DCR","keywords":["factoring","standard"],"metadata":{"aliases":["Decisional Composite Residuosity","composite_residuosity"],"falsifiable":true,"family":"factoring","id":"ASM-DCR","implied_by":[],"implied_by_records":[],"implies":["ASM-FACTORING"],"implies_records":[{"id":"ASM-FACTORING","name":"Integer factorization (factoring)"}],"introduced_in":{"citation":"Pascal Paillier, Public-Key Cryptosystems Based on Composite Degree Residuosity Classes, EUROCRYPT 1999","url":"https://doi.org/10.1007/3-540-48910-X_16"},"kind":"standard","name":"Decisional composite residuosity (DCR)","post_quantum":false,"references":[{"citation":"Pascal Paillier, Public-Key Cryptosystems Based on Composite Degree Residuosity Classes, EUROCRYPT 1999","url":"https://doi.org/10.1007/3-540-48910-X_16"}],"status":"As of 2026-10-10 no way to decide composite residuosity is known other than factoring the modulus; it is broken in quantum polynomial time by Shor's algorithm."},"primaryUrl":"https://doi.org/10.1007/3-540-48910-X_16","sections":[{"content":"Let \\( N = pq \\) be an RSA modulus. An element \\( z \\in \\mathbb{Z}_{N^2}^* \\) is\nan \\( N \\)-th residue if \\( z = y^{N} \\bmod N^2 \\) for some\n\\( y \\in \\mathbb{Z}_{N^2}^* \\). The decisional composite residuosity assumption\nstates that, given \\( N \\), no probabilistic polynomial-time algorithm\ndistinguishes a uniformly random \\( N \\)-th residue modulo \\( N^2 \\) from a\nuniformly random element of \\( \\mathbb{Z}_{N^2}^* \\) with non-negligible\nadvantage.","heading":"Definition"},{"content":"Factoring \\( N \\) breaks DCR, and no other attack is known. DCR gives\nsemantic security of Paillier encryption (`[Paillier99]`), which is\nadditively homomorphic, and is the encryption assumption in Paillier-based\ntwo-party and threshold ECDSA (`[Lindell17]`, `[GG18]`,\n`[CGGMP20]`) and in the LWE-to-Paillier compression of\n`[ADK26]`.","heading":"Status"},{"content":"DCR implies factoring; the converse is open. Paillier (1999)\nalso defines the computational composite residuosity class problem and shows it\nis no harder than RSA with exponent \\( N \\). DCR and quadratic residuosity are not known to be related.","heading":"Relations"}],"slug":"dcr","status":"registry","subtitle":"factoring","summary":"Let \\( N = pq \\) be an RSA modulus.","tags":["factoring","standard"],"title":"Decisional composite residuosity (DCR)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#ASM-DCR"},{"evidence":"registry","id":"ASM-DDH","keywords":["group","standard"],"metadata":{"aliases":["Decisional Diffie-Hellman","decisional Diffie-Hellman","Decisional Diffie–Hellman","ddh"],"falsifiable":true,"family":"group","id":"ASM-DDH","implied_by":["ASM-SXDH"],"implied_by_records":[{"id":"ASM-SXDH","name":"Symmetric external Diffie-Hellman (SXDH)"}],"implies":["ASM-CDH","ASM-DLIN","ASM-KLIN"],"implies_records":[{"id":"ASM-CDH","name":"Computational Diffie-Hellman (CDH)"},{"id":"ASM-DLIN","name":"Decision linear (DLIN)"},{"id":"ASM-KLIN","name":"k-linear assumption (k-Lin)"}],"introduced_in":{"citation":"Stefan Brands, An Efficient Off-line Electronic Cash System Based on the Representation Problem, CWI Technical Report CS-R9323, 1993","url":"https://ir.cwi.nl/pub/5303"},"kind":"standard","name":"Decisional Diffie-Hellman (DDH)","post_quantum":false,"references":[{"citation":"Dan Boneh, The Decision Diffie-Hellman Problem, ANTS-III 1998","url":"https://doi.org/10.1007/BFb0054851"},{"citation":"Stefan Brands, An Efficient Off-line Electronic Cash System Based on the Representation Problem, CWI Technical Report CS-R9323, 1993","url":"https://ir.cwi.nl/pub/5303"},{"citation":"Antoine Joux and Kim Nguyen, Separating Decision Diffie-Hellman from Computational Diffie-Hellman in Cryptographic Groups, J. Cryptology 16, 2003","url":"https://doi.org/10.1007/s00145-003-0052-4"},{"citation":"Alex Escala, Gottfried Herold, Eike Kiltz, Carla Ràfols, Jorge Villar, An Algebraic Framework for Diffie-Hellman Assumptions, CRYPTO 2013","url":"https://doi.org/10.1007/978-3-642-40084-1_8"}],"status":"As of 2026-10-10 DDH is believed hard in prime-order elliptic-curve groups without an efficient pairing and in prime-order subgroups of finite fields; it is false in groups with a symmetric pairing and in full groups \\( \\mathbb{Z}_p^* \\), and it is broken in quantum polynomial time by Shor's algorithm."},"primaryUrl":"https://ir.cwi.nl/pub/5303","sections":[{"content":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order\n\\( p \\). The DDH assumption states that no probabilistic polynomial-time\nalgorithm distinguishes\n\n\\[\n(g, g^{a}, g^{b}, g^{ab}) \\quad \\text{from} \\quad (g, g^{a}, g^{b}, g^{c})\n\\]\n\nfor uniform \\( a, b, c \\in \\mathbb{Z}_p \\) with non-negligible advantage. In the\nmatrix Diffie-Hellman framework DDH is the case \\( k = 1 \\) of k-Lin.","heading":"Definition"},{"content":"DDH fails whenever a group has extra structure that tests the relation: in the\nfull group \\( \\mathbb{Z}_p^* \\) the Legendre symbol leaks whether exponents are\neven, so DDH is used in prime-order subgroups; in groups with an efficiently\ncomputable symmetric pairing \\( e(g^a, g^b) = e(g, g^{ab}) \\) tests the tuple,\nso DDH is easy while CDH may remain hard (Joux and Nguyen 2003). In\nprime-order elliptic-curve groups without an efficient pairing, and in the\nsource groups of asymmetric (Type III) pairings, no attack better than\ncomputing discrete logarithms is known. Boneh's 1998 survey credits Brands\n(1993) with observing that earlier undeniable-signature proposals implicitly\nrelied on DDH.","heading":"Status"},{"content":"DDH implies CDH and hence DL. It implies k-Lin for every \\( k \\ge 1 \\)\nin the same group, in particular DLIN; the converse fails\nin groups with symmetric pairings, where DLIN is believed to hold but DDH does\nnot. SXDH is DDH in both source groups of an asymmetric pairing.\nElGamal (`[ElGamal85]`) and Cramer-Shoup (`[CS98]`)\nencryption, TreePIR (`[LP23b]`) and the Glacius threshold\nSchnorr signature (`[BDLR24]`) rely on DDH.","heading":"Relations"}],"slug":"ddh","status":"registry","subtitle":"group","summary":"Let \\( \\mathbb{G} = \\langle g \\rangle \\) be a cyclic group of prime order \\( p \\).","tags":["group","standard"],"title":"Decisional Diffie-Hellman (DDH)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#ASM-DDH"},{"evidence":"registry","id":"ASM-LWE","keywords":["lattice","standard"],"metadata":{"aliases":["Learning With Errors","Learning With Errors (LWE)","LWE","lwe"],"falsifiable":true,"family":"lattice","id":"ASM-LWE","implied_by":["ASM-GAPSVP","ASM-SUCCINCT-LWE"],"implied_by_records":[{"id":"ASM-GAPSVP","name":"Worst-case approximate lattice problems (GapSVP and SIVP)"},{"id":"ASM-SUCCINCT-LWE","name":"Succinct learning with errors (succinct LWE)"}],"implies":["ASM-SIS","ASM-AGCD","ASM-LWR"],"implies_records":[{"id":"ASM-SIS","name":"Short integer solution (SIS)"},{"id":"ASM-AGCD","name":"Approximate greatest common divisor (AGCD)"},{"id":"ASM-LWR","name":"Learning with rounding (LWR)"}],"introduced_in":{"citation":"Oded Regev, On Lattices, Learning with Errors, Random Linear Codes, and Cryptography, STOC 2005; J. ACM 56(6), 2009","url":"https://doi.org/10.1145/1060590.1060603"},"kind":"standard","name":"Learning with errors (LWE)","post_quantum":true,"references":[{"citation":"Oded Regev, On Lattices, Learning with Errors, Random Linear Codes, and Cryptography, J. ACM 56(6), 2009","url":"https://doi.org/10.1145/1568318.1568324"},{"citation":"Chris Peikert, Public-Key Cryptosystems from the Worst-Case Shortest Vector Problem, STOC 2009","url":"https://doi.org/10.1145/1536414.1536461"},{"citation":"Zvika Brakerski, Adeline Langlois, Chris Peikert, Oded Regev, Damien Stehlé, Classical Hardness of Learning with Errors, STOC 2013","url":"https://doi.org/10.1145/2488608.2488680"},{"citation":"Sanjeev Arora and Rong Ge, New Algorithms for Learning in Presence of Errors, ICALP 2011","url":"https://doi.org/10.1007/978-3-642-22006-7_34"},{"citation":"Martin R. Albrecht, Rachel Player, Sam Scott, On the Concrete Hardness of Learning with Errors, J. Math. Cryptol. 9(3), 2015","url":"https://doi.org/10.1515/jmc-2015-0016"},{"citation":"Yilei Chen, Quantum Algorithms for Lattice Problems, IACR ePrint 2024/555 (claim withdrawn, April 2024)","url":"https://eprint.iacr.org/2024/555"}],"status":"As of 2026-10-10 no classical or quantum polynomial-time algorithm is known for LWE with the parameters covered by the worst-case reductions; a claimed polynomial-time quantum algorithm (Chen, April 2024) was withdrawn by its author after a bug was found."},"primaryUrl":"https://doi.org/10.1145/1060590.1060603","sections":[{"content":"Fix a dimension \\( n \\), a modulus \\( q \\), a number of samples \\( m \\), and an\nerror distribution \\( \\chi \\) over \\( \\mathbb{Z} \\), typically a discrete\nGaussian of width \\( \\alpha q \\) with \\( \\alpha q > 2\\sqrt{n} \\). Sample\n\\( A \\leftarrow \\mathbb{Z}_q^{m \\times n} \\), a secret\n\\( s \\leftarrow \\mathbb{Z}_q^{n} \\) (uniform, or from \\( \\chi^n \\) in the\nequivalent \"normal form\"), and \\( e \\leftarrow \\chi^{m} \\). Set\n\n\\[\nb = A s + e \\bmod q .\n\\]\n\nSearch LWE asks to recover \\( s \\) from \\( (A, b) \\). Decision LWE asks to\ndistinguish \\( (A, b) \\) from \\( (A, u) \\) with \\( u \\) uniform in\n\\( \\mathbb{Z}_q^{m} \\). For polynomial \\( q \\) the two versions are equivalent\nup to polynomial factors.","heading":"Definition"},{"content":"Regev (2005) gave a quantum reduction from the worst-case approximate lattice\nproblems GapSVP and SIVP to LWE with approximation factor\n\\( \\tilde O(n/\\alpha) \\). Peikert (2009) gave a classical reduction from\nGapSVP for exponential modulus \\( q \\ge 2^{n/2} \\), and Brakerski, Langlois,\nPeikert, Regev and Stehlé (2013) extended classical hardness to polynomial\nmodulus by trading dimension for modulus.\n\nThe best known attacks are lattice reduction (primal and dual attacks with\nBKZ), combinatorial BKW-type algorithms, and hybrid attacks; all take time\n\\( 2^{\\Theta(n)} \\) for the parameters used in practice. Concrete security is\nestimated with the lattice estimator introduced by Albrecht, Player and Scott\n(2015) and its later versions; the authors of that paper note that its cost\nmodels have since been superseded. Arora and Ge (2011) solve LWE in time\n\\( 2^{\\tilde O(n^{2\\varepsilon})} \\) when \\( \\alpha q = n^{\\varepsilon} \\) with\n\\( \\varepsilon < 1/2 \\), and in polynomial time when the error takes only a few\nknown values and many samples are available; this rules out very narrow or\nfew-valued error distributions, not the regime with \\( \\alpha q > 2\\sqrt n \\).\n\nIn April 2024 Chen posted a claimed polynomial-time quantum algorithm for LWE\nwith certain polynomial approximation factors (ePrint 2024/555); on 18 April\n2024 the author reported a bug in a step of the algorithm and stated that the\nclaim does not hold.","heading":"Status"},{"content":"Worst-case hardness of GapSVP and SIVP implies LWE hardness (quantumly in\ngeneral; classically for the moduli above). An algorithm for SIS on\nthe transpose of \\( A \\) with norm bound \\( \\beta \\) such that\n\\( \\beta \\alpha q \\ll q \\) distinguishes LWE samples from uniform, so LWE with\nmatching parameters implies SIS.\n\nRing-LWE (ASM-RLWE) and Module-LWE are structured variants over\npolynomial rings; LWE is the rank-\\( n \\), degree-1 case of Module-LWE.\nCheon and Stehlé (2015) reduce LWE to a variant of the approximate GCD problem. Succinct LWE gives the adversary extra trapdoor\ninformation and therefore implies LWE. Evasive LWE is a\nconditional assumption about LWE samples together with preimages and is not\nimplied by LWE.","heading":"Relations"}],"slug":"lwe","status":"registry","subtitle":"lattice","summary":"Fix a dimension \\( n \\), a modulus \\( q \\), a number of samples \\( m \\), and an error distribution \\( \\chi \\) over \\( \\mathbb{Z} \\), typically a discrete Gaussian of width \\( \\alpha q \\) with \\( \\alpha q > 2\\sqrt{n} \\).","tags":["lattice","standard"],"title":"Learning with errors (LWE)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#ASM-LWE"},{"evidence":"registry","id":"ASM-PRF","keywords":["symmetric","standard"],"metadata":{"aliases":["Pseudorandom functions","pseudorandom-function"],"falsifiable":true,"family":"symmetric","id":"ASM-PRF","implied_by":["ASM-PRG","ASM-AES-PRP","ASM-CHACHA20"],"implied_by_records":[{"id":"ASM-PRG","name":"Pseudorandom generators (PRG)"},{"id":"ASM-AES-PRP","name":"AES as a pseudorandom permutation (AES PRP)"},{"id":"ASM-CHACHA20","name":"ChaCha20 block function as a PRF (ChaCha20)"}],"implies":["ASM-PRG"],"implies_records":[{"id":"ASM-PRG","name":"Pseudorandom generators (PRG)"}],"introduced_in":{"citation":"Oded Goldreich, Shafi Goldwasser, Silvio Micali, How to Construct Random Functions, J. ACM 33(4), 1986 (FOCS 1984)","url":"https://doi.org/10.1145/6490.6503"},"kind":"standard","name":"Pseudorandom functions (PRF)","post_quantum":true,"references":[{"citation":"Oded Goldreich, Shafi Goldwasser, Silvio Micali, How to Construct Random Functions, J. ACM 33(4), 1986","url":"https://doi.org/10.1145/6490.6503"},{"citation":"Johan Håstad, Russell Impagliazzo, Leonid A. Levin, Michael Luby, A Pseudorandom Generator from any One-way Function, SIAM J. Comput. 28(4), 1999","url":"https://doi.org/10.1137/S0097539793244708"},{"citation":"Mark Zhandry, How to Construct Quantum Random Functions, FOCS 2012; J. ACM 2021","url":"https://doi.org/10.1109/FOCS.2012.37"}],"status":"As of 2026-10-10 PRFs exist if and only if one-way functions exist, the Goldreich-Goldwasser-Micali construction is secure against quantum queries, and practical instantiations (AES, ChaCha20, SHA-2/SHA-3-based PRFs) have no known attacks on full rounds."},"primaryUrl":"https://doi.org/10.1145/6490.6503","sections":[{"content":"A keyed function family \\( F : \\{0,1\\}^{\\lambda} \\times \\{0,1\\}^{n} \\to\n\\{0,1\\}^{m} \\) is a pseudorandom function if, for a uniformly random key\n\\( k \\), no probabilistic polynomial-time adversary with oracle access to\n\\( F(k, \\cdot) \\) distinguishes it from a uniformly random function\n\\( \\{0,1\\}^n \\to \\{0,1\\}^m \\) with non-negligible advantage. Quantum-secure\nPRFs require indistinguishability even when the adversary queries the oracle\nin superposition.\n\nAs used in topic results, the assumption is that some efficient PRF exists,\ntypically instantiated with a block cipher, a stream-cipher core, or a hash\nfunction in a keyed mode.","heading":"Definition"},{"content":"Goldreich, Goldwasser and Micali (1984) built PRFs from any length-doubling\npseudorandom generator (ASM-PRG); with Håstad, Impagliazzo, Levin and Luby\n(1999) this shows PRFs exist if and only if one-way functions exist. Zhandry\n(2012) proved the GGM construction secure against quantum superposition\nqueries when the underlying generator is quantum-secure. For concrete\ninstantiations, see AES and ChaCha20.","heading":"Status"},{"content":"PRFs and PRGs imply each other. Concrete primitives modelled as PRFs (AES via\nthe PRP/PRF switching lemma, the ChaCha20 block function) imply that PRFs\nexist. PRFs are the assumption behind client-preprocessing PIR such as\n`[ZPSZ24]` and `[LP24]`, behind the\nsymmetric-key pseudorandom correlation functions of `[IKR26]`,\nand behind the PRF and PRF_msg components of SPHINCS+ (`[HKB+19]`).","heading":"Relations"}],"slug":"prf","status":"registry","subtitle":"symmetric","summary":"A keyed function family \\( F : \\{0,1\\}^{\\lambda} \\times \\{0,1\\}^{n} \\to \\{0,1\\}^{m} \\) is a pseudorandom function if, for a uniformly random key \\( k \\), no probabilistic polynomial-time adversary with oracle access to \\( F(k, \\cdot) \\) distinguishes it from a uniformly random function \\( \\{0,1\\}^n \\to \\{0,1\\}^m \\) with non-negligible advantage.","tags":["symmetric","standard"],"title":"Pseudorandom functions (PRF)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#ASM-PRF"},{"evidence":"registry","id":"ASM-PRG","keywords":["symmetric","standard"],"metadata":{"aliases":["Pseudorandom generator security"],"falsifiable":true,"family":"symmetric","id":"ASM-PRG","implied_by":["ASM-PRF"],"implied_by_records":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)"}],"implies":["ASM-PRF"],"implies_records":[{"id":"ASM-PRF","name":"Pseudorandom functions (PRF)"}],"introduced_in":{"citation":"Manuel Blum and Silvio Micali, How to Generate Cryptographically Strong Sequences of Pseudo-Random Bits, SIAM J. Comput. 13(4), 1984 (FOCS 1982)","url":"https://doi.org/10.1137/0213053"},"kind":"standard","name":"Pseudorandom generators (PRG)","post_quantum":true,"references":[{"citation":"Manuel Blum and Silvio Micali, How to Generate Cryptographically Strong Sequences of Pseudo-Random Bits, SIAM J. Comput. 13(4), 1984","url":"https://doi.org/10.1137/0213053"},{"citation":"Andrew C. Yao, Theory and Application of Trapdoor Functions, FOCS 1982","url":"https://doi.org/10.1109/SFCS.1982.45"},{"citation":"Johan Håstad, Russell Impagliazzo, Leonid A. Levin, Michael Luby, A Pseudorandom Generator from any One-way Function, SIAM J. Comput. 28(4), 1999","url":"https://doi.org/10.1137/S0097539793244708"}],"status":"As of 2026-10-10 PRGs exist if and only if one-way functions exist, and practical instantiations (block ciphers in counter mode, stream ciphers such as ChaCha20) have no known attacks on full rounds."},"primaryUrl":"https://doi.org/10.1137/0213053","sections":[{"content":"A deterministic polynomial-time function\n\\( G : \\{0,1\\}^{\\lambda} \\to \\{0,1\\}^{\\ell(\\lambda)} \\) with\n\\( \\ell(\\lambda) > \\lambda \\) is a pseudorandom generator if, for a uniformly\nrandom seed \\( s \\), no probabilistic polynomial-time algorithm distinguishes\n\\( G(s) \\) from a uniformly random \\( \\ell(\\lambda) \\)-bit string with\nnon-negligible advantage.","heading":"Definition"},{"content":"Blum and Micali (1982) and Yao (1982) introduced the notion and built\ngenerators from specific one-way permutations; Håstad, Impagliazzo, Levin and\nLuby (1999) built a PRG from any one-way function. Practical instantiations\nare block ciphers in counter mode and stream ciphers; their status is tracked\nunder AES as a pseudorandom permutation (AES PRP) and ChaCha20 block function as a PRF (ChaCha20).","heading":"Status"},{"content":"A length-doubling PRG yields a PRF by the Goldreich-Goldwasser-Micali tree\nconstruction, and a PRF yields a PRG by evaluation on distinct inputs, so the\ntwo assumptions are equivalent as existence statements (ASM-PRF). Distributed\npoint functions, the basis of two-server PIR in `[GI14]`, are\nbuilt from any PRG.","heading":"Relations"}],"slug":"prg","status":"registry","subtitle":"symmetric","summary":"A deterministic polynomial-time function \\( G : \\{0,1\\}^{\\lambda} \\to \\{0,1\\}^{\\ell(\\lambda)} \\) with \\( \\ell(\\lambda) > \\lambda \\) is a pseudorandom generator if, for a uniformly random seed \\( s \\), no probabilistic polynomial-time algorithm distinguishes \\( G(s) \\) from a uniformly random \\( \\ell(\\lambda) \\)-bit string with non-negligible advantage.","tags":["symmetric","standard"],"title":"Pseudorandom generators (PRG)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#ASM-PRG"},{"evidence":"registry","id":"ASM-RLWE","keywords":["lattice","standard"],"metadata":{"aliases":["Ring Learning With Errors","Ring-LWE","ring-lwe","rlwe"],"falsifiable":true,"family":"lattice","id":"ASM-RLWE","implied_by":["ASM-IDEAL-SVP"],"implied_by_records":[{"id":"ASM-IDEAL-SVP","name":"Worst-case approximate SVP on ideal lattices (Ideal-SVP)"}],"implies":["ASM-RSIS"],"implies_records":[{"id":"ASM-RSIS","name":"Ring short integer solution (Ring-SIS)"}],"introduced_in":{"citation":"Vadim Lyubashevsky, Chris Peikert, Oded Regev, On Ideal Lattices and Learning with Errors over Rings, EUROCRYPT 2010; J. ACM 60(6), 2013","url":"https://doi.org/10.1007/978-3-642-13190-5_1"},"kind":"standard","name":"Ring learning with errors (Ring-LWE)","post_quantum":true,"references":[{"citation":"Vadim Lyubashevsky, Chris Peikert, Oded Regev, On Ideal Lattices and Learning with Errors over Rings, J. ACM 60(6), 2013","url":"https://doi.org/10.1145/2535925"},{"citation":"Damien Stehlé, Ron Steinfeld, Keisuke Tanaka, Keita Xagawa, Efficient Public Key Encryption Based on Ideal Lattices, ASIACRYPT 2009","url":"https://doi.org/10.1007/978-3-642-10366-7_36"},{"citation":"Yara Elias, Kristin E. Lauter, Ekin Ozman, Katherine E. Stange, Provably Weak Instances of Ring-LWE, CRYPTO 2015","url":"https://doi.org/10.1007/978-3-662-47989-6_4"},{"citation":"Chris Peikert, How (Not) to Instantiate Ring-LWE, SCN 2016","url":"https://doi.org/10.1007/978-3-319-44618-9_22"},{"citation":"Ronald Cramer, Léo Ducas, Benjamin Wesolowski, Short Stickelberger Class Relations and Application to Ideal-SVP, EUROCRYPT 2017","url":"https://doi.org/10.1007/978-3-319-56620-7_12"}],"status":"As of 2026-10-10 no attack on Ring-LWE over cyclotomic rings with error distributions covered by the worst-case reduction is known to beat generic lattice reduction; known breaks apply only to non-standard rings or error distributions narrower than the reductions require."},"primaryUrl":"https://doi.org/10.1007/978-3-642-13190-5_1","sections":[{"content":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers\n\\( R \\) (the standard choice is the power-of-two cyclotomic ring\n\\( R = \\mathbb{Z}[x]/(x^n + 1) \\)), let \\( q \\) be a modulus and\n\\( R_q = R / qR \\). Let \\( \\chi \\) be an error distribution on \\( R \\) (a\ndiscrete Gaussian in the canonical embedding, on \\( R \\) or on its dual\n\\( R^\\vee \\)). For a secret \\( s \\in R_q \\), a sample is\n\n\\[\n(a, \\; b = a \\cdot s + e) \\in R_q \\times R_q, \\qquad a \\leftarrow R_q,\\; e \\leftarrow \\chi .\n\\]\n\nSearch Ring-LWE asks to recover \\( s \\) from polynomially many samples.\nDecision Ring-LWE asks to distinguish such samples from uniform pairs in\n\\( R_q \\times R_q \\).","heading":"Definition"},{"content":"Lyubashevsky, Peikert and Regev (2010) gave a quantum reduction from the\nworst-case approximate shortest vector problem on ideal lattices in \\( K \\) to search Ring-LWE, and a search-to-decision reduction for\ncyclotomic rings and suitable moduli. Each sample gives \\( n \\) correlated LWE\nsamples, which is the source of the efficiency gain over plain LWE.\n\nElias, Lauter, Ozman and Stange (2015) broke decision Ring-LWE for explicit\nfamilies of non-cyclotomic fields; Peikert (2016) showed these weak instances\nuse spherical errors far narrower than the hardness theorems require, and that\ninstantiations meeting the worst-case reduction are immune to that attack.\nQuantum algorithms for Ideal-SVP with approximation factor\n\\( 2^{\\tilde O(\\sqrt n)} \\) in cyclotomic fields (Cramer, Ducas and Wesolowski\n2017) do not reach the polynomial factors behind Ring-LWE, and that paper states\nthat Ring-LWE does not appear to be directly affected.","heading":"Status"},{"content":"Worst-case Ideal-SVP hardness implies Ring-LWE by a quantum reduction. Ring-LWE\nis the rank-1 case of Module-LWE. As with LWE and SIS, a Ring-SIS\nsolver with small enough norm distinguishes Ring-LWE samples, so\nRing-LWE with matching parameters implies Ring-SIS. Hardness of plain LWE\n(ASM-LWE) is not known to imply Ring-LWE, and conversely.","heading":"Relations"}],"slug":"rlwe","status":"registry","subtitle":"lattice","summary":"Let \\( K \\) be a number field of degree \\( n \\) with ring of integers \\( R \\) (the standard choice is the power-of-two cyclotomic ring \\( R = \\mathbb{Z}[x]/(x^n + 1) \\)), let \\( q \\) be a modulus and \\( R_q = R / qR \\).","tags":["lattice","standard"],"title":"Ring learning with errors (Ring-LWE)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#ASM-RLWE"},{"evidence":"registry","id":"ASM-ROM","keywords":["idealized_model","idealized_model"],"metadata":{"aliases":[],"falsifiable":false,"family":"idealized_model","id":"ASM-ROM","implied_by":[],"implied_by_records":[],"implies":[],"implies_records":[],"introduced_in":{"citation":"Mihir Bellare and Phillip Rogaway, Random Oracles are Practical: A Paradigm for Designing Efficient Protocols, ACM CCS 1993","url":"https://doi.org/10.1145/168588.168596"},"kind":"idealized_model","name":"Random oracle model (ROM)","post_quantum":"not_applicable","references":[{"citation":"Mihir Bellare and Phillip Rogaway, Random Oracles are Practical: A Paradigm for Designing Efficient Protocols, ACM CCS 1993","url":"https://doi.org/10.1145/168588.168596"},{"citation":"Ran Canetti, Oded Goldreich, Shai Halevi, The Random Oracle Methodology, Revisited, STOC 1998; J. ACM 51(4), 2004","url":"https://doi.org/10.1145/1008731.1008734"},{"citation":"Dan Boneh, Özgür Dagdelen, Marc Fischlin, Anja Lehmann, Christian Schaffner, Mark Zhandry, Random Oracles in a Quantum World, ASIACRYPT 2011","url":"https://doi.org/10.1007/978-3-642-25385-0_3"}],"status":"As of 2026-10-10 the random oracle heuristic is not known to fail for any natural scheme in wide use, but there are artificial schemes that are secure in the ROM and insecure under every concrete hash function (Canetti, Goldreich, Halevi 1998)."},"primaryUrl":"https://doi.org/10.1145/168588.168596","sections":[{"content":"A proof in the random oracle model gives every party, honest or adversarial,\noracle access to a uniformly random function\n\\( H : \\{0,1\\}^* \\to \\{0,1\\}^{\\ell} \\) (or to a random function into a group or\nanother range). The reduction may observe the adversary's oracle queries and\nchoose the answers (\"programming\"), as long as the answers are distributed\nuniformly. A scheme is then deployed with \\( H \\) replaced by a concrete hash\nfunction such as SHA-2 or SHA-3. The model is a heuristic: it is not a\nhardness assumption about any concrete function.\n\nIn the quantum random oracle model (QROM) the adversary may query \\( H \\) in\nsuperposition, which is the appropriate model when the adversary is quantum\nand \\( H \\) is a public hash function.","heading":"Definition"},{"content":"Canetti, Goldreich and Halevi constructed signature and encryption schemes that\nare secure in the random oracle model but insecure for every efficiently\ncomputable instantiation of the oracle. Their schemes are artificial; no\ncomparable failure is known for natural schemes such as RSA-OAEP\n(`[BR94]`), Fiat-Shamir signatures (`[FS86]`) or the\nFujisaki-Okamoto transform (`[FO99]`) when instantiated with\nstandard hash functions. Because the instantiation claim is not a\nstatement about a fixed computational problem, it is not falsifiable in the\nusual sense.\n\nClassical ROM proofs that rewind the adversary or inspect its queries do not\nautomatically carry over to quantum adversaries; Boneh et al. (2011)\nintroduced the QROM for that reason, and many Fiat-Shamir and\nFujisaki-Okamoto results have since been re-proved there.","heading":"Status"},{"content":"The ROM is often combined with a concrete assumption (for example RSA with\nrandom oracles for OAEP, RSA assumption (RSA); or generic groups with random oracles,\nGeneric group model (GGM), including the generic bilinear group model). A security proof \"in the ROM under assumption X\" assumes both the\nidealized hash function and the hardness of X; it says nothing about security\nwith a concrete hash function beyond the heuristic.","heading":"Relations"}],"slug":"rom","status":"registry","subtitle":"idealized model","summary":"A proof in the random oracle model gives every party, honest or adversarial, oracle access to a uniformly random function \\( H : \\{0,1\\}^* \\to \\{0,1\\}^{\\ell} \\) (or to a random function into a group or another range).","tags":["idealized_model","idealized_model"],"title":"Random oracle model (ROM)","type":"assumption","venue":null,"year":null,"sourcePath":"data/psi-catalog.json#ASM-ROM"}],"notation":[{"aliases":[{"paper":"PSI-PAPER-2020-PRTY","writes":"\\kappa"},{"paper":"PSI-PAPER-2016-KKRT","writes":"\\kappa"},{"paper":"PSI-PAPER-2021-BMRR","writes":"\\lambda"},{"paper":"PSI-PAPER-2023-GS","writes":"\\lambda"},{"paper":"PSI-PAPER-2004-FNP","writes":"\\lambda"},{"paper":"PSI-PAPER-2019-GS","writes":"\\lambda"}],"group":"Security","meaning":"Computational security parameter.","regime":"PSI cryptographic security.","short":"computational security","symbol":"\\kappa"},{"aliases":[{"paper":"PSI-PAPER-2020-PRTY","writes":"\\lambda"},{"paper":"PSI-PAPER-2016-KKRT","writes":"\\sigma"},{"paper":"PSI-PAPER-2012-HEK","writes":"k"},{"paper":"PSI-PAPER-2021-BMRR","writes":"\\kappa"},{"paper":"PSI-PAPER-2019-GS","writes":"\\kappa"},{"paper":"PSI-PAPER-2023-GS","writes":"\\epsilon"},{"paper":"PSI-PAPER-2019-PSTY","writes":"\\sigma"}],"group":"Security","meaning":"Statistical security/error parameter.","regime":"PSI statistical failures; exact error expression remains source-specific.","short":"statistical security","symbol":"\\lambda"},{"aliases":[{"paper":"PSI-PAPER-2017-CLR","writes":"N_x"},{"paper":"PSI-PAPER-1999-HFH","writes":"n"},{"paper":"PSI-PAPER-2004-FNP","writes":"k_S"},{"paper":"PSI-PAPER-2010-DT","writes":"w"},{"paper":"PSI-PAPER-2018-PSZ","writes":"n_1"},{"paper":"PSI-PAPER-2018-CHLR","writes":"\\lvert X\\rvert"},{"paper":"PSI-PAPER-2019-KRSSW","writes":"N_s"},{"paper":"PSI-PAPER-2020-PRTY","writes":"n_1"},{"paper":"PSI-PAPER-2021-CONG","writes":"\\lvert X\\rvert"},{"paper":"PSI-PAPER-2021-RS","writes":"n_y"},{"paper":"PSI-PAPER-2021-RT","writes":"n_1"},{"paper":"PSI-PAPER-2022-RR","writes":"n_y"}],"group":"Sets","meaning":"Sender-set cardinality: \\(n_X=\\lvert X\\rvert\\).","regime":"Arbitrary two-party set sizes.","short":"sender's set size","symbol":"n_X"},{"aliases":[{"paper":"PSI-PAPER-2017-CLR","writes":"N_y"},{"paper":"PSI-PAPER-1999-HFH","writes":"m"},{"paper":"PSI-PAPER-2004-FNP","writes":"k_C"},{"paper":"PSI-PAPER-2010-DT","writes":"v"},{"paper":"PSI-PAPER-2018-PSZ","writes":"n_2"},{"paper":"PSI-PAPER-2018-CHLR","writes":"\\lvert Y\\rvert"},{"paper":"PSI-PAPER-2019-KRSSW","writes":"N_c"},{"paper":"PSI-PAPER-2020-PRTY","writes":"n_2"},{"paper":"PSI-PAPER-2021-CONG","writes":"\\lvert Y\\rvert"},{"paper":"PSI-PAPER-2021-RS","writes":"n_x"},{"paper":"PSI-PAPER-2021-RT","writes":"n_2"},{"paper":"PSI-PAPER-2022-RR","writes":"n_x"}],"group":"Sets","meaning":"Receiver-set cardinality: \\(n_Y=\\lvert Y\\rvert\\).","regime":"Arbitrary two-party set sizes.","short":"receiver's set size","symbol":"n_Y"},{"aliases":[{"paper":"PSI-PAPER-2017-RR-CCS","writes":"n"},{"paper":"PSI-PAPER-2021-BMRR","writes":"m"},{"paper":"PSI-PAPER-2023-GS","writes":"n"},{"paper":"PSI-PAPER-2004-FNP","writes":"k"},{"paper":"PSI-PAPER-2020-ION","writes":"M"},{"paper":"PSI-PAPER-2017-KMPRT","writes":"m"},{"paper":"PSI-PAPER-2021-NTY","writes":"m"},{"paper":"PSI-PAPER-2021-GPRTY","writes":"m"},{"paper":"PSI-PAPER-2024-VCE","writes":"k"}],"group":"Sets","meaning":"The size of every party's set when the paper assumes equal sizes (\\( n = n_X = n_Y \\)), or the common padded bound it states.","regime":"Balanced two-party or equal-size multiparty PSI.","short":"each set's size, when equal (\\( n = n_X = n_Y \\))","symbol":"n"},{"aliases":[{"paper":"PSI-PAPER-2017-CLR","writes":"\\sigma"},{"paper":"PSI-PAPER-2017-RR-CCS","writes":"\\sigma"},{"paper":"PSI-PAPER-2019-KRSSW","writes":"\\alpha"},{"paper":"PSI-PAPER-2019-PSTY","writes":"\\lambda"},{"paper":"PSI-PAPER-2016-KKRT","writes":"\\ell"}],"group":"Sets","meaning":"Bit length of an input item before any explicitly stated hashing/compression.","regime":"Bit-string PSI inputs.","short":"item length","symbol":"\\sigma"},{"aliases":[{"paper":"PSI-PAPER-2021-BMRR","writes":"n"},{"paper":"PSI-PAPER-2023-GS","writes":"\\ell"},{"paper":"PSI-PAPER-2004-FNP","writes":"n"},{"paper":"PSI-PAPER-2017-KMPRT","writes":"n"},{"paper":"PSI-PAPER-2021-NTY","writes":"n"},{"paper":"PSI-PAPER-2021-GPRTY","writes":"n"},{"paper":"PSI-PAPER-2024-VCE","writes":"n"}],"group":"Parties","meaning":"Number of parties.","regime":"Multiparty PSI.","short":"parties","symbol":"\\ell"},{"aliases":[{"paper":"PSI-PAPER-2021-BMRR","writes":"T"},{"paper":"PSI-PAPER-2023-GS","writes":"t"}],"group":"Parties","meaning":"Allowed deficit from the intersection under the explicitly named threshold functionality.","regime":"Threshold PSI; per-set deficit and union deficit are different predicates.","short":"threshold deficit","symbol":"t"},{"aliases":[{"paper":"PSI-PAPER-2021-NTY","writes":"t"},{"paper":"PSI-PAPER-2017-KMPRT","writes":"t"},{"paper":"PSI-PAPER-2024-VCE","writes":"t"}],"group":"Parties","meaning":"Maximum number of colluding/corrupted parties.","regime":"Multiparty PSI security.","short":"corrupted parties","symbol":"t_c"},{"aliases":[{"paper":"PSI-PAPER-1999-HFH","writes":"p"},{"paper":"PSI-PAPER-2010-DT","writes":"p"},{"paper":"PSI-PAPER-2019-GS","writes":"p"},{"paper":"PSI-PAPER-2021-BMRR","writes":"p"},{"paper":"PSI-PAPER-2018-CHLR","writes":"t"},{"paper":"PSI-PAPER-2021-CONG","writes":"t"}],"group":"Algebra","meaning":"Prime order of the base field \\(\\mathbb{F}_p\\), or the prime modulus of \\(\\mathbb{Z}_p^*\\).","regime":"PSI over prime fields, discrete-log groups, and FHE plaintext slots.","short":"prime","symbol":"p"},{"aliases":[{"paper":"PSI-PAPER-2010-DT","writes":"n"}],"group":"Algebra","meaning":"RSA or Paillier modulus \\( N = PQ \\).","regime":"RSA- and Paillier-based PSI.","short":"RSA modulus","symbol":"N"},{"aliases":[],"group":"Algebra","meaning":"Ciphertext modulus of a lattice-based homomorphic encryption scheme.","regime":"FHE-based PSI.","short":"ciphertext modulus","symbol":"q"},{"aliases":[],"group":"Algebra","kind":"element","meaning":"An element of the prime-order group of the Diffie-Hellman or OPRF protocol.","regime":"Public-key PSI.","short":"group element size","symbol":"\\mathbb{G}"},{"aliases":[],"group":"Algebra","kind":"element","meaning":"An element of the field the encoding (polynomial, OKVS) or the VOLE works over.","regime":"OKVS-, VOLE- and polynomial-based PSI.","short":"field element size","symbol":"\\mathbb{F}"},{"aliases":[],"group":"Algebra","kind":"element","meaning":"An element of \\( \\mathbb{Z}_N \\) or \\( \\mathbb{Z}_{N^2} \\) (a Paillier ciphertext is one element of \\( \\mathbb{Z}_{N^2} \\)).","regime":"RSA- and Paillier-based PSI.","short":"RSA ring element size","symbol":"\\mathbb{Z}_N"},{"aliases":[],"group":"Algebra","kind":"element","meaning":"An element of the ciphertext ring \\( \\mathbb{Z}_q[X]/(X^m+1) \\); an RLWE ciphertext is two.","regime":"FHE-based PSI.","short":"ring element size","symbol":"\\mathcal{R}_q"}],"primer":{"id":"PSI-PRIMER","keyProblems":["PSI-OP-001","PSI-OP-011","PSI-OP-005"],"sections":[{"content":"Two parties hold sets \\(X\\) and \\(Y\\) and want \\(X\\cap Y\\) without revealing\nanything about the items outside it (PSI-PAPER-2018-PSZ). Usually one party,\nthe receiver, learns the intersection and the other, the sender, learns\nnothing; the set sizes are typically public. With more parties, all of them\ncompute the intersection of their sets and learn nothing else beyond bounds on\nthe set sizes (PSI-PAPER-2018-EKR). Variants release only a function of the\nintersection: its size, a sum of values attached to its items, a decision on\nwhether it is large, or secret shares for a further secure computation. Generic\nsecure computation can compute PSI, and garbled-circuit PSI ran as fast as the\npublic-key protocols of its time, or faster at higher security levels, at much\nhigher bandwidth (PSI-PAPER-2012-HEK); protocols that exploit the structure of\nthe problem are more efficient (PSI-PAPER-2018-EKR). Applications include\nprivate contact discovery from a phone (PSI-PAPER-2017-CLR,\nPSI-PAPER-2019-KRSSW) and aggregate ad-conversion statistics\n(PSI-PAPER-2020-ION).","heading":"What it is"},{"content":"- **Adversaries**: semi-honest parties follow the protocol; augmented\n  semi-honest parties may change their inputs and then follow it\n  (PSI-PAPER-2017-KMPRT); malicious parties deviate arbitrarily. Security can\n  differ by party, as in protocols that are simulation-secure against a\n  malicious receiver but only private against a malicious sender\n  (PSI-PAPER-2018-CHLR).\n- **Set-size slack**: the fastest malicious protocols realize a relaxed\n  functionality in which a corrupt party may effectively input more items than\n  it declared, up to a constant factor (PSI-PAPER-2017-RR-CCS,\n  PSI-PAPER-2020-PRTY, PSI-PAPER-2021-RT).\n- **Balanced and unbalanced**: sets of similar size, or a small receiver set\n  against a much larger sender set, where communication can be sublinear in\n  the larger set (PSI-PAPER-2017-CLR).\n- **Outputs**: the intersection; its cardinality; an intersection-sum, the sum\n  of values attached to matching items (PSI-PAPER-2020-ION); threshold PSI,\n  which releases the intersection only when the sets differ in few items\n  (PSI-PAPER-2019-GS); circuit-PSI, secret shares of per-item results that feed\n  a further secure computation (PSI-PAPER-2018-PSWW, PSI-PAPER-2019-PSTY); and\n  labeled PSI, which returns labels the sender attaches to matching items\n  (PSI-PAPER-2018-CHLR).\n- **Hashing to bins**: items are mapped into bins by simple hashing or by\n  cuckoo hashing, which places each item in one of a few candidate bins,\n  possibly with a stash, so that per-bin work is small; parameters are set\n  for a hashing failure probability such as \\(2^{-40}\\) (PSI-PAPER-2018-PSZ).\n- **Oblivious PRF (OPRF)**: the receiver learns \\(F_k(y)\\) for its items while\n  the sender holds \\(k\\) and sends \\(F_k(x)\\) for its own items, so the\n  receiver compares values (PSI-PAPER-2018-EKR); many instances can be\n  produced at once from OT extension (PSI-PAPER-2016-KKRT).\n- **Oblivious key-value store (OKVS)**: a data structure that encodes\n  key-value pairs and hides the keys when the values are random; a polynomial\n  through the pairs is the simplest one (PSI-PAPER-2021-GPRTY), and PaXoS is a\n  binary one decoded by XOR (PSI-PAPER-2020-PRTY).\n- **Lower bounds**: computing the intersection needs communication linear in\n  the set size, by the complexity of disjointness (PSI-PAPER-2004-FNP;\n  PSI-PAPER-2019-GS); threshold PSI needs \\(\\Omega(t)\\) for two parties\n  (PSI-PAPER-2019-GS) and \\(\\Omega(\\ell t)\\) for \\(\\ell\\) parties over\n  point-to-point channels (PSI-PAPER-2021-BMRR); and PSI implies oblivious\n  transfer, so it has no black-box construction from one-way functions\n  (PSI-PAPER-2004-FNP).","heading":"Core notions"},{"content":"- **Public-key-based**: commutative Diffie-Hellman exponentiation of hashed\n  items (PSI-PAPER-1999-HFH), oblivious polynomial evaluation under additively\n  homomorphic encryption (PSI-PAPER-2004-FNP), RSA blind signatures as the\n  OPRF (PSI-PAPER-2010-DT), and PSI from any two-round key agreement with\n  responses encoded in a polynomial, which suits small sets\n  (PSI-PAPER-2021-RT).\n- **OT- and VOLE-based**: OPRFs from OT extension combined with hashing to\n  bins (PSI-PAPER-2018-PSZ, PSI-PAPER-2016-KKRT); malicious security by dual\n  execution (PSI-PAPER-2017-RR-CCS) and by encoding the receiver's set in a\n  PaXoS, with linear communication (PSI-PAPER-2020-PRTY); general OKVS and\n  amplification of their failure probability (PSI-PAPER-2021-GPRTY); OPRFs\n  from vector oblivious linear evaluation (VOLE) (PSI-PAPER-2021-RS); and\n  subfield VOLE with a triangulation OKVS (PSI-PAPER-2022-RR).\n- **Circuit-based and computing on the intersection**: a sort-compare-shuffle\n  garbled circuit (PSI-PAPER-2012-HEK); hashing-based circuits with\n  \\(\\omega(n)\\) comparisons (PSI-PAPER-2018-PSWW) and with \\(O(n)\\)\n  communication through batched oblivious programmable PRFs (OPPRF)\n  (PSI-PAPER-2019-PSTY, PSI-PAPER-2021-RS); intersection-sum with cardinality\n  from Diffie-Hellman double masking (PSI-PAPER-2020-ION); and threshold PSI\n  from polynomial encodings and cardinality tests (PSI-PAPER-2019-GS,\n  PSI-PAPER-2021-BMRR, PSI-PAPER-2023-GS).\n- **Unbalanced and labeled**: fully homomorphic encryption with batching, so\n  that the sender evaluates the intersection on the receiver's encrypted set\n  (PSI-PAPER-2017-CLR), with OPRF preprocessing and labels\n  (PSI-PAPER-2018-CHLR) and lower computation and communication\n  (PSI-PAPER-2021-CONG); alternatively the server's OPRF-encrypted set is\n  transferred once and queried online (PSI-PAPER-2019-KRSSW).\n- **Multiparty**: zero-sharing delivered through OPPRFs, secure against any\n  number of colluding semi-honest parties (PSI-PAPER-2017-KMPRT), malicious\n  versions over OKVS (PSI-PAPER-2021-GPRTY, PSI-PAPER-2021-NTY), and protocols\n  from homomorphic set representations surveyed in PSI-PAPER-2024-VCE.","heading":"Main approaches"},{"content":"Parameters below occur in efficiency or security bounds. Each meaning is\nscoped to its stated regime. Measured quantities are named in words; protocol\nobjects are defined where used. Source aliases do not equate different regimes.\n\n| Symbol | Meaning | Regime | Paper aliases |\n|---|---|---|---|\n| \\(\\kappa\\) | Computational security parameter. | PSI cryptographic security. | PSI-PAPER-2020-PRTY writes \\(\\kappa\\); PSI-PAPER-2016-KKRT writes \\(\\kappa\\); PSI-PAPER-2021-BMRR writes \\(\\lambda\\); PSI-PAPER-2023-GS writes \\(\\lambda\\); PSI-PAPER-2004-FNP writes \\(\\lambda\\); PSI-PAPER-2019-GS writes \\(\\lambda\\) |\n| \\(\\lambda\\) | Statistical security/error parameter. | PSI statistical failures; exact error expression remains source-specific. | PSI-PAPER-2020-PRTY writes \\(\\lambda\\); PSI-PAPER-2016-KKRT writes \\(\\sigma\\); PSI-PAPER-2012-HEK writes \\(k\\); PSI-PAPER-2021-BMRR writes \\(\\kappa\\); PSI-PAPER-2019-GS writes \\(\\kappa\\); PSI-PAPER-2023-GS writes \\(\\epsilon\\); PSI-PAPER-2019-PSTY writes \\(\\sigma\\) |\n| \\(n_X\\) | Sender-set cardinality: \\(n_X=\\lvert X\\rvert\\). | Arbitrary two-party set sizes. | PSI-PAPER-2017-CLR writes \\(N_x\\); PSI-PAPER-1999-HFH writes \\(n\\); PSI-PAPER-2004-FNP writes \\(k_S\\); PSI-PAPER-2010-DT writes \\(w\\); PSI-PAPER-2018-PSZ writes \\(n_1\\); PSI-PAPER-2018-CHLR writes \\(\\lvert X\\rvert\\); PSI-PAPER-2019-KRSSW writes \\(N_s\\); PSI-PAPER-2020-PRTY writes \\(n_1\\); PSI-PAPER-2021-CONG writes \\(\\lvert X\\rvert\\); PSI-PAPER-2021-RS writes \\(n_y\\); PSI-PAPER-2021-RT writes \\(n_1\\); PSI-PAPER-2022-RR writes \\(n_y\\) |\n| \\(n_Y\\) | Receiver-set cardinality: \\(n_Y=\\lvert Y\\rvert\\). | Arbitrary two-party set sizes. | PSI-PAPER-2017-CLR writes \\(N_y\\); PSI-PAPER-1999-HFH writes \\(m\\); PSI-PAPER-2004-FNP writes \\(k_C\\); PSI-PAPER-2010-DT writes \\(v\\); PSI-PAPER-2018-PSZ writes \\(n_2\\); PSI-PAPER-2018-CHLR writes \\(\\lvert Y\\rvert\\); PSI-PAPER-2019-KRSSW writes \\(N_c\\); PSI-PAPER-2020-PRTY writes \\(n_2\\); PSI-PAPER-2021-CONG writes \\(\\lvert Y\\rvert\\); PSI-PAPER-2021-RS writes \\(n_x\\); PSI-PAPER-2021-RT writes \\(n_2\\); PSI-PAPER-2022-RR writes \\(n_x\\) |\n| \\(n\\) | The size of every party's set when the paper assumes equal sizes (\\( n = n_X = n_Y \\)), or the common padded bound it states. | Balanced two-party or equal-size multiparty PSI. | PSI-PAPER-2017-RR-CCS writes \\(n\\); PSI-PAPER-2021-BMRR writes \\(m\\); PSI-PAPER-2023-GS writes \\(n\\); PSI-PAPER-2004-FNP writes \\(k\\); PSI-PAPER-2020-ION writes \\(M\\); PSI-PAPER-2017-KMPRT writes \\(m\\); PSI-PAPER-2021-NTY writes \\(m\\); PSI-PAPER-2021-GPRTY writes \\(m\\); PSI-PAPER-2024-VCE writes \\(k\\) |\n| \\(\\sigma\\) | Bit length of an input item before any explicitly stated hashing/compression. | Bit-string PSI inputs. | PSI-PAPER-2017-CLR writes \\(\\sigma\\); PSI-PAPER-2017-RR-CCS writes \\(\\sigma\\); PSI-PAPER-2019-KRSSW writes \\(\\alpha\\); PSI-PAPER-2019-PSTY writes \\(\\lambda\\); PSI-PAPER-2016-KKRT writes \\(\\ell\\) |\n| \\(\\ell\\) | Number of parties. | Multiparty PSI. | PSI-PAPER-2021-BMRR writes \\(n\\); PSI-PAPER-2023-GS writes \\(\\ell\\); PSI-PAPER-2004-FNP writes \\(n\\); PSI-PAPER-2017-KMPRT writes \\(n\\); PSI-PAPER-2021-NTY writes \\(n\\); PSI-PAPER-2021-GPRTY writes \\(n\\); PSI-PAPER-2024-VCE writes \\(n\\) |\n| \\(t\\) | Allowed deficit from the intersection under the explicitly named threshold functionality. | Threshold PSI; per-set deficit and union deficit are different predicates. | PSI-PAPER-2021-BMRR writes \\(T\\); PSI-PAPER-2023-GS writes \\(t\\) |\n| \\(t_c\\) | Maximum number of colluding/corrupted parties. | Multiparty PSI security. | PSI-PAPER-2021-NTY writes \\(t\\); PSI-PAPER-2017-KMPRT writes \\(t\\); PSI-PAPER-2024-VCE writes \\(t\\) |\n| \\(p\\) | Prime order of the base field \\(\\mathbb{F}_p\\), or the prime modulus of \\(\\mathbb{Z}_p^*\\). | PSI over prime fields, discrete-log groups, and FHE plaintext slots. | PSI-PAPER-1999-HFH writes \\(p\\); PSI-PAPER-2010-DT writes \\(p\\); PSI-PAPER-2019-GS writes \\(p\\); PSI-PAPER-2021-BMRR writes \\(p\\); PSI-PAPER-2018-CHLR writes \\(t\\); PSI-PAPER-2021-CONG writes \\(t\\) |\n| \\(N\\) | RSA or Paillier modulus \\( N = PQ \\). | RSA- and Paillier-based PSI. | PSI-PAPER-2010-DT writes \\(n\\) |\n| \\(q\\) | Ciphertext modulus of a lattice-based homomorphic encryption scheme. | FHE-based PSI. | No paper spelling asserted. |\n| \\(\\mathbb{G}\\) | An element of the prime-order group of the Diffie-Hellman or OPRF protocol. | Public-key PSI. | No paper spelling asserted. |\n| \\(\\mathbb{F}\\) | An element of the field the encoding (polynomial, OKVS) or the VOLE works over. | OKVS-, VOLE- and polynomial-based PSI. | No paper spelling asserted. |\n| \\(\\mathbb{Z}_N\\) | An element of \\( \\mathbb{Z}_N \\) or \\( \\mathbb{Z}_{N^2} \\) (a Paillier ciphertext is one element of \\( \\mathbb{Z}_{N^2} \\)). | RSA- and Paillier-based PSI. | No paper spelling asserted. |\n| \\(\\mathcal{R}_q\\) | An element of the ciphertext ring \\( \\mathbb{Z}_q[X]/(X^m+1) \\); an RLWE ciphertext is two. | FHE-based PSI. | No paper spelling asserted. |\n\nCosts in the comparison tables are recorded per role, as the papers state\nthem: what each role sends and the work it performs. A figure a paper states\nonly for the whole protocol is recorded as the total; it is never split among\nthe roles, and role figures are never summed into one.\n\n| Role | Meaning | Regime | Paper names |\n|---|---|---|---|\n| Sender | Holds the set \\(X\\), of size \\(n_X\\); in one-sided PSI, the party that does not learn the output. | Two-party PSI. | PSI-PAPER-1999-HFH writes \"Alice\"; PSI-PAPER-2004-FNP writes \"server\"; PSI-PAPER-2010-DT writes \"server\"; PSI-PAPER-2019-KRSSW writes \"server\"; PSI-PAPER-2020-ION writes \"P1\"; PSI-PAPER-2019-GS writes \"Bob\" |\n| Receiver | Holds the set \\(Y\\), of size \\(n_Y\\); in one-sided PSI, the party that learns the output. | Two-party PSI. | PSI-PAPER-1999-HFH writes \"Bob\"; PSI-PAPER-2004-FNP writes \"client (chooser)\"; PSI-PAPER-2010-DT writes \"client\"; PSI-PAPER-2019-KRSSW writes \"client\"; PSI-PAPER-2020-ION writes \"P2\"; PSI-PAPER-2019-GS writes \"Alice\" |\n| Leader | The party that collects the other parties' messages and computes the output. | Multiparty PSI with a designated party. | PSI-PAPER-2017-KMPRT writes \"leader\"; PSI-PAPER-2021-NTY writes \"the last server, P_ℓ\"; PSI-PAPER-2021-BMRR writes \"P_1\" |\n| Per client | Each party that only contributes its set and sends to the leader or the pivot, counted per party. | Multiparty PSI with a designated party. | PSI-PAPER-2017-KMPRT writes \"client\"; PSI-PAPER-2021-NTY writes \"client\"; PSI-PAPER-2021-BMRR writes \"P_i\" |\n| Per party | Each party, when all parties play the same role. | Symmetric multiparty PSI. | No paper name asserted. |\n| Pivot | The party that receives and combines the clients' encodings before the final step (NTY). | Multiparty PSI with clients, a pivot and servers. | PSI-PAPER-2021-NTY writes \"pivot\" |\n| Per server | Each party that holds the clients' PRF keys and runs an OPPRF with the leader (NTY). | Multiparty PSI with clients, a pivot and servers. | PSI-PAPER-2021-NTY writes \"server\" |","heading":"Notation"},{"content":"This topic covers two-party and multiparty PSI and functions of the\nintersection (cardinality, intersection-sum, threshold, circuit outputs,\nlabels) in five subfields: public-key-based, OT- and VOLE-based,\ncircuit-based, unbalanced and labeled, and multiparty PSI. Server-aided and\ndelegated PSI, fuzzy and updatable PSI, private set union, and PSI from trusted\nhardware are outside it; OT extension, VOLE, and garbling belong to secure\nmultiparty computation, and keyword PIR to private information retrieval. The\ncovered papers date from 1999 to 2024; later work, including maliciously\nsecure circuit-PSI, is not yet covered.","heading":"Scope of this atlas"}],"sources":["PSI-PAPER-2018-EKR","PSI-PAPER-2004-FNP","PSI-PAPER-2018-PSZ","PSI-PAPER-2016-KKRT","PSI-PAPER-2021-GPRTY","PSI-PAPER-2017-CLR","PSI-PAPER-1999-HFH","PSI-PAPER-2010-DT","PSI-PAPER-2012-HEK","PSI-PAPER-2017-KMPRT","PSI-PAPER-2017-RR-CCS","PSI-PAPER-2018-CHLR","PSI-PAPER-2018-PSWW","PSI-PAPER-2019-GS","PSI-PAPER-2019-KRSSW","PSI-PAPER-2019-PSTY","PSI-PAPER-2020-ION","PSI-PAPER-2020-PRTY","PSI-PAPER-2021-BMRR","PSI-PAPER-2021-CONG","PSI-PAPER-2021-NTY","PSI-PAPER-2021-RS","PSI-PAPER-2021-RT","PSI-PAPER-2022-RR","PSI-PAPER-2023-GS","PSI-PAPER-2024-VCE"],"startHere":["PSI-PAPER-2018-EKR","PSI-PAPER-2004-FNP","PSI-PAPER-2018-PSZ","PSI-PAPER-2016-KKRT","PSI-PAPER-2021-GPRTY","PSI-PAPER-2017-CLR"],"summary":"Protocols that let parties holding private sets learn the intersection of those sets, or a function of it, without revealing anything else about the items outside it.","title":"Private set intersection"},"propertyAssertions":[{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"PSI-PROP-006D53AB8BD14B","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":"PSI cardinality and intersection-sum"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"PSI-PROP-0133C74E79F6E2","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"PSI-PROP-01BEA913298CB4","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"labeled PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"PSI-PROP-02CBAFF9BF2C72","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"diffie_hellman_homomorphic_tags"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"PSI-PROP-02E1C980EF0289","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":"cacheable-evaluation-keys"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"PSI-PROP-02FD83DDB748DC","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":"oblivious_polynomial_evaluation"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"PSI-PROP-037020228983BE","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":"garbled_circuit_sort_compare_shuffle"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"PSI-PROP-03C23F93C306E9","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"malicious-receiver-security"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"PSI-PROP-03D89E7CB635A8","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":"generic-composition"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"PSI-PROP-047BC3BD479B8A","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":"server-unlinkability"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"PSI-PROP-065E8B85E99CAC","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"symmetric-key-techniques"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"PSI-PROP-069BA973A85A30","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"unbalanced PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"PSI-PROP-06CB1DDA640F2A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"unbalanced PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"PSI-PROP-0732C9DA187B4B","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":"vole_okvs_oprf"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"PSI-PROP-0928A496E483E9","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":"sublinear-in-set-size"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"PSI-PROP-0A088C57348142","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"cuckoo_hashing_circuit_psi"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"PSI-PROP-0A298D28E86A64","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":"vole_okvs_oprf"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"PSI-PROP-0B37F4F0C91A2D","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"client-storage-linear-in-server-set"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"PSI-PROP-0CF5B63504FFFE","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":"no-fhe"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"PSI-PROP-0DFF9002B3F568","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"circuit-PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"PSI-PROP-0E5F88D7063698","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"threshold-abort-variant"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"PSI-PROP-0F1532C822B667","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":"multiparty PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"PSI-PROP-0F371DF4C3800E","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"PSI-PROP-100D7BD9503819","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"PSI-PROP-102A535F98C99D","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"segmented-inputs"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"PSI-PROP-118BE231FB8FAC","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"fhe_polynomial_evaluation_cuckoo_hashing"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"PSI-PROP-11C8214B8777E0","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":"linear-communication"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"PSI-PROP-12AEDC85FD5ABA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":"okvs_ot_extension"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"PSI-PROP-130E07DD421610","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"PSI-PROP-136E1CDB160999","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"communication-sublinear-in-larger-set"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"PSI-PROP-14FCCF46379EC4","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":"communication-nearly-constant-in-larger-set"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"PSI-PROP-172FB24C24B31E","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":"polynomial_threshold_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"PSI-PROP-17CC6105142719","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"symmetric-key-only"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"PSI-PROP-188C713B36D776","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"malicious-receiver-security"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"PSI-PROP-18B1EEE991B42A","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":"no-random-oracle"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"PSI-PROP-19C253E40E9A1A","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":"data-independent-setup"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"PSI-PROP-19E0C28749AFC6","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"multiparty threshold PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"PSI-PROP-1A936D7E6ED4AA","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"offline-sender-preprocessing"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"PSI-PROP-1CC928A3EEC7A4","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":"oprf_cuckoo_hashing"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"PSI-PROP-1DB246BAC5A374","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":"payload-transfer"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"PSI-PROP-1DBB0B8C0F2C64","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"PSI-PROP-1E29F1305C4E06","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":"encrypted_bloom_filter_homomorphic_tags"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"PSI-PROP-1F4577C9D66A2D","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"opprf_cuckoo_hashing_circuit_psi"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"PSI-PROP-2052E54A4A9BB3","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"opprf_conditional_zero_sharing"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"PSI-PROP-21F4DA5EFF52DA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"commutative_exponentiation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"PSI-PROP-2299631EF7C7EA","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"parallelizable"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"PSI-PROP-24DEDD1BDB783A","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":"symmetric-key-only"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"PSI-PROP-259999B04E0E55","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":"multi-threaded"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"PSI-PROP-2697DA6FA0D0CF","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":"associated-values"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"PSI-PROP-273666B8F6DF39","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":"key_agreement_polynomial_encoding"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-BF.md","id":"PSI-PROP-2784DA2C750443","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-BF","value":"encrypted-bloom-filter"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"PSI-PROP-283FC7EBA4ADCC","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"any-symmetric-function-of-intersection"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"PSI-PROP-2AC32339E49F83","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"matching-count"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"PSI-PROP-2B6AA149FB5074","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":"prime_order_group_exponentiation"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"PSI-PROP-2BC3309909785F","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"polynomial_threshold_psi"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"PSI-PROP-2D090A488A89FB","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":"oprf_fhe_polynomial_evaluation_cuckoo_hashing"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"PSI-PROP-2D2AD4A367FA9C","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"sublinear-in-set-size"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"PSI-PROP-2D71E9A8390B22","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"unbalanced PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"PSI-PROP-3150DC3670FF8A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"PSI-PROP-31A6449C4FA7D5","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"PSI-PROP-3257B399BD9CAE","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"large-intersection-condition"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"PSI-PROP-34F67C8A184A95","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":"any-linear-okvs"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"PSI-PROP-3620AD99C34AFD","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"PSI-PROP-369D7E30915188","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":"okvs_ot_extension"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"PSI-PROP-371BB8D4DEA18F","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":"data-independent-setup"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"PSI-PROP-3766D05F9BE8EF","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":"two-party threshold PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"PSI-PROP-3A6967282C7EA1","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":"exact-sender-set-size"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"PSI-PROP-3C4F92CCB17795","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":"opprf_cuckoo_circuit"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"PSI-PROP-3DB036B7279367","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":"sublinear-in-set-size"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"PSI-PROP-3EA2F2C50A052E","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":"no-ideal-permutation"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"PSI-PROP-3F7085FEBD8A68","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"polynomial_threshold_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"PSI-PROP-3FE816DD3D64CD","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"any-symmetric-function-of-intersection"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"PSI-PROP-40B143D6B4DE77","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"oprf_cuckoo_filter_precomputation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"PSI-PROP-4176E8F9BC9A4C","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"unconditional-zero-sharing"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"PSI-PROP-41D25CE6E4942D","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"no-honest-majority"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"PSI-PROP-425F94DC0E6D6B","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"updatable-labels"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"PSI-PROP-427E43FD2BF44D","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"PSI-PROP-42D30E3FE16306","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"multiparty threshold PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"PSI-PROP-442FD7BE6FF7B2","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":"okvs_ot_extension"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"PSI-PROP-4433768DEBA201","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"combined-stash"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"PSI-PROP-4468A02C2DC152","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"labeled PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"PSI-PROP-44DD6668EAF7A0","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"symmetric-key-techniques"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"PSI-PROP-45A54B5E6B255F","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"PSI-PROP-45F23308DF61C4","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":"secret-shared-output"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"PSI-PROP-477C6C5EE9D9B6","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"PSI-PROP-47E3E64AE2CF1C","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"no-fhe"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"PSI-PROP-48E07BE72D392F","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"multiparty PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"PSI-PROP-49667B2437B967","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":"oblivious_polynomial_evaluation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"PSI-PROP-49F9D9FCAAA204","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":"item-length-independent-oprf-cost"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"PSI-PROP-4AF0FEB1705EDC","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"oprf_fhe_polynomial_evaluation_cuckoo_hashing"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"PSI-PROP-4CD56E60B1F405","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"unbalanced PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"PSI-PROP-4DF626843DCB0C","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"PSI-PROP-4FF350A7C24705","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":"no-fhe"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"PSI-PROP-50271514AEF4E9","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":"associated-values"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"PSI-PROP-51F70F894AA184","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"payloads"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"PSI-PROP-5492A7A8EA8E9A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":"okvs_ot_extension"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"PSI-PROP-54A44F6DC6F2D8","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":"PSI cardinality"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"PSI-PROP-54EFDD2D531680","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"unbalanced PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH.md","id":"PSI-PROP-54F5BA912529DF","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","value":"oblivious_polynomial_evaluation"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"PSI-PROP-5532981B5A13DA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"commutative_exponentiation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"PSI-PROP-55360F62DD062B","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":"server-precomputation"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"PSI-PROP-579DD53FEB208D","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"diffie_hellman_homomorphic_tags"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"PSI-PROP-586844783A0BB1","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"PSI-PROP-588E4056585518","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":"linear-communication"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"PSI-PROP-5DB9C0E12434DC","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"unbalanced PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"PSI-PROP-5E1CF8A432ABA7","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"updatable-sender-preprocessing"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"PSI-PROP-5E87CD66777839","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":"quasi-linear-circuit"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"PSI-PROP-5EE27F13937D66","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":"opprf_cuckoo_hashing_circuit_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"PSI-PROP-61430B39C54701","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"precomputation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"PSI-PROP-6347FB1754870D","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"communication-sublinear-in-larger-set"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"PSI-PROP-634C3ED3CD2784","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":"three-opprf-executions"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"PSI-PROP-635FB46D5AA502","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"reusable-sender-preprocessing"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"PSI-PROP-6414EF643D0B2A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":"oblivious_polynomial_evaluation"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"PSI-PROP-65CD4CF9506CD0","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM.md","id":"PSI-PROP-65EF3A6D5097C0","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","value":"commitment_oblivious_encoding"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"PSI-PROP-660B2FCA44D97B","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":"item-length-independent-oprf-cost"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"PSI-PROP-66A7AE3FF7D0F9","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"no-trusted-third-party"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"PSI-PROP-67BB18C41BC67C","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":"generic-composition"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"PSI-PROP-682DF25939350D","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"PSI-PROP-683A3CA79F81A7","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":"dual_execution_oblivious_encoding"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-FIG3.md","id":"PSI-PROP-686E2B1DD41A19","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-FIG3","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-SH.md","id":"PSI-PROP-6881DF6066ED77","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-SH","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-SM.md","id":"PSI-PROP-688C6DA093145F","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-SM","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"PSI-PROP-69049E9882668D","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":"data-independent-setup"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"PSI-PROP-69139B45ACB7C8","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":"two-party threshold PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"PSI-PROP-69B5B557CE788E","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":"role-reversal-for-stash"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"PSI-PROP-6C1DE11741D141","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"malicious-receiver-security"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"PSI-PROP-6C9095F55F2C9C","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"associated-data"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"PSI-PROP-6DE2BD21922E54","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":"server-precomputation"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"PSI-PROP-6E88C1B63F1489","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"circuit-PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"PSI-PROP-6F78137C46E38F","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":"size-hiding-cardinality-test"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"PSI-PROP-704D5255C5E4CA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":"garbled_circuit_pairwise_comparison"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"PSI-PROP-713082F4BE2C63","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":"small-universe"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"PSI-PROP-723AA92EEB4258","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"matching-count"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"PSI-PROP-7398201EBDBFBB","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"communication-sublinear-in-larger-set"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"PSI-PROP-7415ECB20F1617","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"oprf_fhe_polynomial_evaluation_cuckoo_hashing"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"PSI-PROP-765F7D790B1C69","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":"secret-shared-output"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"PSI-PROP-771A7E1B037295","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":"two-party threshold PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"PSI-PROP-776A2C51656E95","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"PSI-PROP-77A22203F641EE","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":"sublinear-in-set-size"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"PSI-PROP-79658243C08E8C","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"reverse-variant"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"PSI-PROP-7A791E3DCF8755","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":"shuffled-oprf"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"PSI-PROP-7D4ED6FCE12F6A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"PSI-PROP-7F23B95DD01BEE","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"oprf_fhe_polynomial_evaluation_cuckoo_hashing"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSZ-OT.md","id":"PSI-PROP-81F13F8A37F331","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSZ-OT","value":"oprf_cuckoo_hashing"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"PSI-PROP-823E01101E97F0","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"multiparty threshold PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"PSI-PROP-82749D02218D31","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"PSI-PROP-82AFD57E82F613","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":"circuit-PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"PSI-PROP-83694F6887CFC7","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"malicious-sender-with-leakage"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"PSI-PROP-83A60A9BC7C8A3","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"PSI cardinality and intersection-sum"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"PSI-PROP-83B5855C265DBF","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":"low-communication"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"PSI-PROP-83CCBFB43A6661","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"star-network"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"PSI-PROP-87D7342066BEFA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":"oprf_shuffle_homomorphic_tags"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"PSI-PROP-8822949969FFCA","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"labels-for-matching-items"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"PSI-PROP-89C7B17CF2AEDF","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"light-receiver-computation"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"PSI-PROP-89D5FD6DC05CAF","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":"multiparty PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH-DFS.md","id":"PSI-PROP-8A1483BFC55517","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH-DFS","value":"linear-communication"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"PSI-PROP-8C4CA0056DCEBB","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"star-network"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"PSI-PROP-8C71C4D7FF6BDF","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"non-constant-stash"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"PSI-PROP-8DA07176D6B156","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"deployed"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-ADVANCED.md","id":"PSI-PROP-8E79DADDEBE305","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-ADVANCED","value":"circuit-PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-MIRROR.md","id":"PSI-PROP-900782E6285169","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-MIRROR","value":"circuit-PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY.md","id":"PSI-PROP-9143E8618EB8C2","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","value":"polynomial_threshold_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"PSI-PROP-92666FCBE238F9","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"arbitrary-length-items"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"PSI-PROP-9459EABA743339","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"communication-sublinear-in-larger-set"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"PSI-PROP-95518A1BEBF32E","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"two-party PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"PSI-PROP-95B817B4A421F3","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"PSI-PROP-96E2AE88013474","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":"empirical-error-analysis"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"PSI-PROP-97A5BDCDB8BDC7","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"server-set-updates"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"PSI-PROP-987B98E75E8FBA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":"circuit-PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-SH.md","id":"PSI-PROP-98C91357C1DD89","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-SH","value":"linear-communication"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"PSI-PROP-98D934F911109E","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"oprf_fhe_polynomial_evaluation_cuckoo_hashing"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"PSI-PROP-9B139895743464","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"okvs_zeroxor"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"PSI-PROP-9B6319CC2941C9","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"opprf_unconditional_zero_sharing"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-SERVER.md","id":"PSI-PROP-9CC382E9F8CBBE","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"PSI-PROP-9E031D5A684DAF","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"symmetric-key-primitives-only"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"PSI-PROP-9EE001035B6C55","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"batched-keyword-pir"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-MAL.md","id":"PSI-PROP-9F572633DE80F1","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-MAL","value":"multi-threaded"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"PSI-PROP-9FCEFFCC05A658","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"no-collusion"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT.md","id":"PSI-PROP-A13CFEC6E2C93A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-PSWW-2D.md","id":"PSI-PROP-A2F3E364A207A6","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-PSWW-2D","value":"cuckoo_hashing_circuit_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-LABELED.md","id":"PSI-PROP-A500B51AA622EA","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-LABELED","value":"reusable-sender-preprocessing"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"PSI-PROP-A50F7FC8CFF6C6","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-WN.md","id":"PSI-PROP-A5A1C7C1415E7B","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-WN","value":"garbled_circuit_sort_compare_shuffle"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"PSI-PROP-A64073ED003FCD","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":"linear-communication"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"PSI-PROP-A65619D795E518","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"no-fhe"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"PSI-PROP-A66EFACE8786E6","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"sublinear-in-set-size"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"PSI-PROP-A6DDFD0FAA0C17","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-LABELED.md","id":"PSI-PROP-A734022D92CCAC","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-LABELED","value":"labels-for-matching-items"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"PSI-PROP-A8D59FE33E9123","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"PSI cardinality and intersection-sum"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-VOLE.md","id":"PSI-PROP-A963B321B8DEA2","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-VOLE","value":"okvs_vole"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"PSI-PROP-AC14C97C0C118D","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"sublinear-in-set-size"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-CARDINALITY.md","id":"PSI-PROP-AD082FE30854C9","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-CARDINALITY","value":"oblivious_polynomial_evaluation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"PSI-PROP-ADB27EAE2EE458","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"linear-communication"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"PSI-PROP-ADB505A3C441F1","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":"sublinear-in-set-size"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF.md","id":"PSI-PROP-ADD977B761FE9C","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","value":"multiparty threshold PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V2.md","id":"PSI-PROP-AE7B2C9E293011","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V2","value":"key_agreement_polynomial_encoding"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"PSI-PROP-AF36F7C14380FE","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":"oprf_okvs_zero_sharing"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH.md","id":"PSI-PROP-AF79285C40639D","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH","value":"two-party matching count"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"PSI-PROP-B009B5BD90FB50","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"malicious-client-security"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-AUG.md","id":"PSI-PROP-B0EC6C19F37B3F","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-AUG","value":"multiparty PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG-FROBENIUS.md","id":"PSI-PROP-B196E4F3D93D2A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG-FROBENIUS","value":"unbalanced PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL-DFS.md","id":"PSI-PROP-B50E0EA20683AA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-INT.md","id":"PSI-PROP-B638DB00CECECD","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","value":"star-network"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"PSI-PROP-B6A253D7EE8100","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":"multi-threaded"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"PSI-PROP-B7FFE9B5596C73","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":"low-communication"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"PSI-PROP-B890BA247E595E","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"no-trusted-third-party"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"PSI-PROP-B8A28E1C05B3DF","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"PSI-PROP-B907C19FE915EF","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":"no-online-client-exponentiation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"PSI-PROP-BC4D9654E193FD","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"precomputation"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-1999-HFH-INTERSECTION.md","id":"PSI-PROP-BD43BCC5D6A755","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-1999-HFH-INTERSECTION","value":"two-party matching count"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"PSI-PROP-BE339E14D39D3A","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":"small-sets"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION.md","id":"PSI-PROP-BEED9DA291F854","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","value":"vole_okvs_oprf"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM.md","id":"PSI-PROP-BF8CE956A28B0C","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","value":"dual_execution_oblivious_encoding"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"PSI-PROP-BFD0423B1015DF","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":"opprf_cuckoo_circuit"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-NO-STASH.md","id":"PSI-PROP-C1A7A30D48C69E","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-NO-STASH","value":"no-stash"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"PSI-PROP-C4A8011FD077A0","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"threshold-abort-variant"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF.md","id":"PSI-PROP-C56BEB33BB7A71","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","value":"polynomial_threshold_psi"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR.md","id":"PSI-PROP-C967AD9B23B3CE","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR","value":"oprf_fhe_polynomial_evaluation_cuckoo_hashing"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"PSI-PROP-CA1E917450AC6A","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"corruption-threshold-calibration"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"PSI-PROP-CA6F0F41523233","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":"PSI cardinality and intersection-sum"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH.md","id":"PSI-PROP-CB48FF17B4AD69","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-SH","value":"data-independent-setup"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"PSI-PROP-CB7AFA4293A38B","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":"garbled_circuit_sort_compare_shuffle"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"PSI-PROP-CBB4E2A7A67223","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"server-set-updates"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-3PARTY.md","id":"PSI-PROP-CC95FB4A4DF334","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-3PARTY","value":"opprf_incremental_chain"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-PWC.md","id":"PSI-PROP-CD2B2980A8E51F","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-PWC","value":"early-reveal"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-ROT.md","id":"PSI-PROP-CD564CFFC56AE9","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-ROT","value":"reverse-variant"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-SH-V1.md","id":"PSI-PROP-CD612EBBD0A28F","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-SH-V1","value":"small-sets"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"PSI-PROP-CE0B9D539E17D2","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":"heuristic-error-analysis"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"PSI-PROP-CF21CE1D01ED4C","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"PSI-PROP-D10B3194E59D79","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"bucketed_cardinality_test_threshold_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-MULTIPARTY.md","id":"PSI-PROP-D58E3CD7F71C24","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-MULTIPARTY","value":"sublinear-in-set-size"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-AHE.md","id":"PSI-PROP-D6BA8EDE44FBEC","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-GS-AHE","value":"polynomial_threshold_psi"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-BWA.md","id":"PSI-PROP-D724B3AB9839E6","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-BWA","value":"garbled_circuit_bit_vector"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION.md","id":"PSI-PROP-D828C2CE953534","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","value":"lightweight-clients"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT.md","id":"PSI-PROP-D83A236E7BA356","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","value":"okvs_ot_extension"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2016-KKRT.md","id":"PSI-PROP-D85794DB7E7F97","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2016-KKRT","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-CONG.md","id":"PSI-PROP-D930DAAC176112","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-CONG","value":"square-root-homomorphic-multiplications"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"PSI-PROP-D9920945B0E04F","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"corruption-threshold-parameter"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION.md","id":"PSI-PROP-DB57D9D4779229","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","value":"vole_okvs_oprf"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"PSI-PROP-DB7FE4D527EB7A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"multiparty PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION.md","id":"PSI-PROP-DC4C0901EFAA90","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","value":"okvs_reduction_to_server_aided_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"PSI-PROP-DCC0B0D4715C76","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":"low-communication"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"PSI-PROP-DDDEBBA8BA9F1C","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":"opprf_cuckoo_hashing_circuit_psi"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-MAL.md","id":"PSI-PROP-DEC6D9245FFB95","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-MAL","value":"vole_okvs_oprf"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"PSI-PROP-E104E039FBB979","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":"secret-shared-output"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-PRTY-MAL.md","id":"PSI-PROP-E15C33A936AE57","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-PRTY-MAL","value":"two-party PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-PSTY-BASIC.md","id":"PSI-PROP-E17CD98A2101AF","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-PSTY-BASIC","value":"payloads"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2023-GS-TWO-PARTY.md","id":"PSI-PROP-E27FCC0157B684","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2023-GS-TWO-PARTY","value":"bucketed_cardinality_test_threshold_psi"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE.md","id":"PSI-PROP-E357E8EACB5827","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","value":"communication-sublinear-in-larger-set"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-GS-FHE.md","id":"PSI-PROP-E6550C957BC72B","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-GS-FHE","value":"two-party threshold PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-FAST.md","id":"PSI-PROP-E6D9D8F84F12BD","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-FAST","value":"vole_okvs_oprf"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"PSI-PROP-E70710CC2545EA","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":"key_agreement_polynomial_encoding"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT.md","id":"PSI-PROP-E711867E57F5B2","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT","value":"circuit-PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"PSI-PROP-E92FA85D1C7124","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"segmented-inputs"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-NR.md","id":"PSI-PROP-E9DF1868B5095A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-NR","value":"oprf_cuckoo_filter_precomputation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-SORT.md","id":"PSI-PROP-EBFDC72B982268","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-SORT","value":"quasi-linear-circuit"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"PSI-PROP-ED65A573558941","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":"oblivious_polynomial_evaluation"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY.md","id":"PSI-PROP-EED9A8656AA486","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY","value":"any-okvs"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-CLR.md","id":"PSI-PROP-EFCD35CC12306F","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-CLR","value":"communication-sublinear-in-larger-set"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2004-FNP-MULTIPARTY.md","id":"PSI-PROP-F09CD65ACDD119","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","value":"multiparty PSI"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"PSI-PROP-F19B7D6A16470E","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"client-storage-linear-in-server-set"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"PSI-PROP-F1EFCE2B4CFFF4","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"malicious-client-security"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2010-DT-BLIND-RSA.md","id":"PSI-PROP-F23069C0A19A6A","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2010-DT-BLIND-RSA","value":"rsa_blind_signature"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH-RLWE.md","id":"PSI-PROP-F4C2734887EE30","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH-RLWE","value":"reverse-variant"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2019-KRSSW-GC.md","id":"PSI-PROP-F5C69D201BE439","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2019-KRSSW-GC","value":"no-online-server-cryptography"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2012-HEK-SCS-HE.md","id":"PSI-PROP-F6A6BD3441126B","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2012-HEK-SCS-HE","value":"linear-shuffle"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2017-KMPRT-SH.md","id":"PSI-PROP-F714334CBCBB59","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2017-KMPRT-SH","value":"multiparty PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-SD.md","id":"PSI-PROP-FB2EBF513BFB87","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-SD","value":"subfield_vole_okvs"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2022-RR-CIRCUIT.md","id":"PSI-PROP-FB43561A965EF3","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2022-RR-CIRCUIT","value":"circuit-PSI"},{"dimension":"primitive","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RT-MAL.md","id":"PSI-PROP-FBA4317CE17141","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RT-MAL","value":"two-party PSI"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR.md","id":"PSI-PROP-FCD7D6120D387C","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","value":"okvs_ot_extension"},{"dimension":"construction_family","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT.md","id":"PSI-PROP-FFA7F1A7737986","review_status":"fulltext_checked","scope":"construction","subject_id":"PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","value":"opprf_cuckoo_circuit"},{"dimension":"capability_tag","evidence_ref":"knowledge/primitives/psi/schemes/PSI-CONSTRUCTION-2020-ION-DDH.md","id":"PSI-PROP-FFDB59B956D9AE","review_status":"scheme_declared","scope":"construction","subject_id":"PSI-CONSTRUCTION-2020-ION-DDH","value":"deployed"}],"researchMap":{"lanes":[{"id":"foundation","label":"Foundation","question":"What is the problem, and what can be established or ruled out?"},{"id":"construction","label":"Construction","question":"How is the goal realized?"},{"id":"efficiency","label":"Efficiency","question":"Which resource cost or trade-off is advanced?"}],"nodes":{"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Diffie-Hellman preference matching","lane_rationale":"The principal claim is a concrete protocol, commutative exponentiation of hashed items, that realizes private matching without a trusted third party; no cost or bound is claimed.","lenses":[],"primary":true,"selection_rationale":"The protocol that later papers call the classic Diffie-Hellman PSI (PSI-PAPER-2021-RT §1, p. 1); recorded as the paper states it, a matching count with a variation that reveals the shared items (Appendix A, p. 85).","thread":"public_key_psi","visibility":"backbone"},"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND":{"anchor_roles":["lower_bound_or_barrier"],"group":"foundation","label":"Lower bound for approximate intersection size","lane_rationale":"A communication lower bound; the rubric routes lower bounds to Foundation.","lenses":["communication"],"primary":false,"selection_rationale":"Shows by reduction from disjointness that multiplicative approximation of intersection size needs linear communication (§6, pp. 13-14), ruling out sublinear private approximation.","split_rationale":"Belongs to the line of communication lower bounds, separate from the paper's polynomial-evaluation protocols: Ghosh and Simkin turn this disjointness-based bound into the \\( \\Omega(t) \\) bound for threshold PSI (PSI-CONTRIB-2019-GS-LOWER-BOUND).","thread":"threshold_psi","visibility":"reviewed_related"},"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE":{"group":"construction","label":"Malicious-secure polynomial-evaluation PSI","lane_rationale":"A stronger-secure protocol, the paper's polynomial-evaluation protocol hardened by cut-and-choose and by random-oracle derandomization; the rubric routes stronger-secure protocols to Construction.","lenses":["malicious-security"],"primary":false,"selection_rationale":"The paper defines malicious adversaries for private matching (§3.2, p. 4) and gives protocols secure against a malicious client, by cut-and-choose in the standard model, and against a malicious server, in the random oracle model (§5, pp. 9-13); the earlier constructions with a linear number of exponentiations had been analyzed only against semi-honest parties (§2, p. 2).","split_rationale":"Belongs to the line of malicious-secure PSI, separate from the semi-honest protocol of PSI-CONTRIB-2004-FNP-OPE-PSI, which it hardens against a malicious client by cut-and-choose and against a malicious server by derandomized replies (FNP04 §5, pp. 9-13).","thread":"public_key_psi","visibility":"reviewed_related"},"PSI-CONTRIB-2004-FNP-OPE-PSI":{"anchor_roles":["model_definition","reusable_mechanism"],"group":"construction","label":"Polynomial-evaluation PSI","lane_rationale":"A new reusable method, set encoding as polynomial roots evaluated under homomorphic encryption, answering how PSI is realized in the standard model.","lenses":["communication","assumptions-setup"],"primary":true,"root":true,"selection_rationale":"Root of the map: the paper formulates private matching, two-party set intersection, with cardinality and threshold variants (§3.1, p. 3) and semi-honest and malicious adversary models (§3.2, p. 4), and this protocol realizes it from oblivious polynomial evaluation with standard-model semi-honest security (abstract, p. 1; Protocol PM-Semi-Honest, p. 6); the paper's malicious and multiparty protocols build on it.","thread":"public_key_psi","visibility":"backbone"},"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Sort-compare-shuffle PSI circuit","lane_rationale":"The principal delta is a reusable circuit design (merge, filter, shuffle) that realizes PSI with generic secure computation; its \\( \\Theta(n \\log n) \\) size follows from the design, so the rubric routes it to Construction.","lenses":["computation"],"primary":true,"selection_rationale":"The quasi-linear generic PSI circuit (Table 1, p. 2; §5, pp. 5-10) that later circuit-PSI papers use as their baseline (PSI-PAPER-2018-PSWW §6.2; PSI-PAPER-2019-PSTY Table 3).","thread":"circuit_psi","visibility":"backbone"},"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Batched related-key OPRF","lane_rationale":"The principal delta is a reusable mechanism, a batched related-key OPRF obtained by using a pseudorandom code in OT extension; the lower cost per instance follows from it, so the rubric routes it to Construction.","lenses":["communication","computation"],"primary":true,"selection_rationale":"Introduces a batched OPRF from OT extension whose OT cost per instance does not depend on input length (abstract, p. 1; §5.3, p. 12); the PSI protocol of the same paper uses it in place of the earlier byte-wise OPRF.","thread":"ot_extension_oprf","visibility":"backbone"},"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"FHE-based PSI, communication logarithmic in the larger set","lane_rationale":"The principal delta is a way to realize PSI, homomorphic evaluation of each bin's root polynomial on the receiver's batched ciphertexts, which the later FHE-based unbalanced line reuses; the communication bound follows from this mechanism, so the rubric routes it to Construction.","lenses":["communication"],"primary":true,"selection_rationale":"The paper presents it as the first secure and practical PSI with low communication overhead from leveled FHE, linear in the smaller set and logarithmic in the larger one (CLR17 §1.4, p. 3; p. 4); CHLR18 and CMGD21 build directly on its framework (CHLR18 §2, pp. 6-7; CMGD21 §3, p. 5).","thread":"fhe_unbalanced","visibility":"backbone"},"PSI-CONTRIB-2017-KMPRT-OPPRF":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Oblivious programmable PRF","lane_rationale":"A reusable mechanism, an OPRF whose outputs the sender can program on chosen points without the receiver noticing; the paper presents it as a new notion with three constructions.","lenses":[],"primary":false,"selection_rationale":"The abstract calls it the technical core and of independent interest (p. 1); NTY reuse its definitions almost verbatim and run OPPRFs inside ZeroXOR (NTY §2, p. 4; Protocol 4.2, p. 10).","split_rationale":"Belongs to the OPPRF line, which it starts, separate from the multiparty protocol of PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI: the batched OPPRF of PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF adapts it, and Nevo, Trieu, and Yanai take its definitions almost verbatim and run OPPRFs inside ZeroXOR (PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED).","thread":"multiparty_opprf_okvs","threads":["multiparty_opprf_okvs","ot_extension_oprf"],"visibility":"backbone"},"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI":{"anchor_roles":["practice_transition"],"group":"construction","label":"Multiparty PSI from OPPRF zero-sharing","lane_rationale":"The principal claim is a concrete multiparty protocol, conditional zero-sharing and reconstruction over OPPRFs, that realizes PSI against any number of colluding semi-honest parties; its cost profile follows from that design.","lenses":["computation","assumptions-setup"],"primary":true,"selection_rationale":"The authors call it the first implemented multiparty PSI protocol (abstract, p. 1), and its public-key operations do not depend on the set size, unlike the earlier protocols of Table 1 (p. 3).","thread":"multiparty_opprf_okvs","visibility":"reviewed_related"},"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Dual-execution malicious PSI","lane_rationale":"A stronger-secure protocol built on a reusable mechanism, dual execution of oblivious encodings; the rubric routes hardened protocols and mechanisms to Construction.","lenses":["computation","assumptions-setup"],"primary":true,"selection_rationale":"Gives the first fully malicious protocol in the OT-based paradigm of Pinkas, Schneider, and Zohner, as the paper states (§1.2, p. 3; Theorem 2, p. 13), with a standard-model instantiation.","thread":"ot_extension_oprf","visibility":"reviewed_related"},"PSI-CONTRIB-2018-CHLR-LABELED-PSI":{"anchor_roles":["capability_boundary","reusable_mechanism"],"group":"construction","label":"Labeled PSI sublinear in the sender's set","lane_rationale":"Realizes a functionality, labeled PSI with communication sublinear in the sender's set, by a concrete mechanism (label-interpolation polynomials); Construction.","lenses":["communication","computation"],"primary":true,"selection_rationale":"Title-level contribution; the paper states that earlier label-returning PSI protocols are linear in the larger set (§1.3, p. 3) and relates the result to single-server keyword PIR (§1.5, p. 5); CMGD21 builds its labeled mode on it (CMGD21 §4, pp. 12-14).","thread":"fhe_unbalanced","visibility":"backbone"},"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER":{"group":"construction","label":"Leaky security against a malicious sender","lane_rationale":"A stronger-secure protocol, labeled PSI with hash-valued labels and a proof of one OPRF key; the rubric routes stronger-secure protocols to Construction.","lenses":["malicious-security"],"primary":false,"selection_rationale":"Restricts a malicious sender, which in the protocol of Chen, Laine, and Rindal could make the receiver output its full set, to the leaky functionality \\( X \\cap Y \\cap \\mathrm{leakage}(Y) \\) under an H-limited FHE assumption (CHLR18 §1.3, p. 3; §7.2-7.3, pp. 16-18; Theorem 3, p. 25).","split_rationale":"Belongs to the line of malicious-secure PSI, separate from the labeled PSI of PSI-CONTRIB-2018-CHLR-LABELED-PSI, whose hash-valued labels it uses as the only output channel to restrict the malicious sender of PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION.","thread":"fhe_unbalanced","visibility":"reviewed_related"},"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER":{"group":"construction","label":"OPRF pre-processing against a malicious receiver","lane_rationale":"A transform, an OPRF applied to both sets before the homomorphic intersection, that raises the protocol's security; the rubric routes transforms and stronger-secure protocols to Construction.","lenses":["malicious-security","communication","computation"],"primary":false,"selection_rationale":"The paper achieves full simulation-based security against a malicious receiver, improving on the semi-honest FHE-based protocol of Chen, Laine, and Rindal (CHLR18 §1.3, p. 3; Theorem 1, p. 15); without noise flooding it uses smaller FHE parameters and reports almost twice the online speed of that protocol (§8.3, p. 21).","split_rationale":"Belongs to the line of malicious-secure PSI, separate from the labeled PSI of PSI-CONTRIB-2018-CHLR-LABELED-PSI: it hardens the FHE-based protocol of PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION against a malicious receiver by an OPRF pre-processing step.","thread":"fhe_unbalanced","visibility":"reviewed_related"},"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Two-dimensional cuckoo hashing for circuit-PSI","lane_rationale":"A new reusable hashing mechanism with its own failure analysis (Theorem 1); its smaller circuits follow from it, so the rubric routes it to Construction.","lenses":["computation"],"primary":true,"selection_rationale":"Lets both parties use cuckoo hashing with one shared bin per common item (§5, pp. 13-14), the protocol PSI-PAPER-2019-PSTY compares against as the previous best.","thread":"circuit_psi","visibility":"reviewed_related"},"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI":{"anchor_roles":["first_feasibility","reusable_mechanism"],"group":"construction","label":"Threshold PSI from additive HE via cardinality testing","lane_rationale":"The paper's main protocol: a reusable decomposition into private cardinality testing and noisy polynomial addition that realizes threshold PSI without FHE; the \\( \\tilde O(t^{2}) \\) bound follows from it.","lenses":["communication"],"primary":true,"selection_rationale":"First threshold PSI protocols with communication depending mainly on t, per the abstract (p. 1); its cardinality test is reused by PSI-PAPER-2021-BMRR.","thread":"threshold_psi","visibility":"backbone"},"PSI-CONTRIB-2019-GS-LOWER-BOUND":{"anchor_roles":["lower_bound_or_barrier"],"group":"foundation","label":"\\( \\Omega(t) \\) communication lower bound for threshold PSI","lane_rationale":"A communication lower bound; the rubric routes lower bounds to Foundation.","lenses":["communication"],"primary":false,"selection_rationale":"Frames the communication complexity of threshold PSI and is the base of the multiparty bound of PSI-PAPER-2021-BMRR (§3, pp. 7-8).","split_rationale":"Belongs to the line of communication lower bounds, separate from the protocol line of PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI: it turns the disjointness-based bound of PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND into \\( \\Omega(t) \\) for threshold PSI, and Badrinarayanan et al. reduce their multiparty \\( \\Omega(nT) \\) bound to it (PSI-CONTRIB-2021-BMRR-LOWER-BOUND).","thread":"threshold_psi","visibility":"backbone"},"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Batched OPPRF with one polynomial hint","lane_rationale":"A reusable mechanism (one-time PPRF with correlated targets, batched hint) with its own theorems; its linear cost follows from the mechanism.","lenses":["communication"],"primary":false,"selection_rationale":"Makes programming all bins cost linear communication (Construction 4, Theorem 5, Theorem 8, pp. 13-16).","split_rationale":"Belongs to the OPPRF line, separate from the circuit-PSI result of PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION: it adapts the polynomial OPPRF of PSI-CONTRIB-2017-KMPRT-OPPRF to a one-query definition with batched hints, and VOLE-PSI replaces it in its circuit-PSI (PSI-CONTRIB-2021-RS-CIRCUIT-PSI).","thread":"circuit_psi","threads":["circuit_psi","ot_extension_oprf"],"visibility":"reviewed_related"},"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION":{"anchor_roles":["capability_boundary"],"group":"efficiency","label":"Linear-communication circuit-PSI","lane_rationale":"The principal claim is a named communication bound, \\( O(n) \\) for circuit-PSI, against \\( \\omega(n) \\) before; the rubric routes achieving an upper cost bound to Efficiency.","lenses":["communication","computation"],"primary":true,"selection_rationale":"The authors call it the first circuit-based PSI with linear communication, matching the lower bound on comparisons (abstract, p. 1; §1.1, p. 4).","thread":"circuit_psi","visibility":"backbone"},"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM":{"anchor_roles":["practice_transition"],"group":"construction","label":"Deployed Diffie-Hellman intersection-sum with cardinality","lane_rationale":"A concrete protocol realizing a new output (intersection-sum with cardinality); efficiency claims concern deployment cost rather than an asymptotic advance.","lenses":[],"primary":true,"selection_rationale":"A PSI variant used in industry for several years (abstract, p. 1), with proofs (Theorems 1-2, p. 6) and deployment costs (Table 2, p. 8).","thread":"public_key_psi","visibility":"backbone"},"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI":{"anchor_roles":["capability_boundary"],"group":"construction","label":"Malicious PSI with linear communication","lane_rationale":"A concrete protocol answering how malicious two-party PSI with linear communication is realized, through the XOR-homomorphism of OOS outputs and a PaXoS encoding; routed to Construction.","lenses":["communication"],"primary":true,"selection_rationale":"The authors describe it as the first concretely efficient malicious PSI with linear communication in the OT-hybrid model with a non-programmable random oracle, and the first to use cuckoo hashing for malicious PSI (abstract, p. 1; §1.1, pp. 2-3).","thread":"paxos_okvs_vole","visibility":"backbone"},"PSI-CONTRIB-2020-PRTY-PAXOS":{"anchor_roles":["model_definition"],"group":"foundation","label":"PaXoS key-value encoding","lane_rationale":"Introduces a notion: the probe-and-XOR of strings, an abstraction of input-independent binary key-value encodings with stated efficiency measures (Definition 3, p. 6; §3.4, pp. 7-8). The protocol and the concrete table are separate contributions.","lenses":[],"primary":false,"selection_rationale":"Defines the interface that PaXoS-PSI is written against (§4, pp. 9-11) and that the OKVS definition later generalizes.","split_rationale":"Belongs to the line of key-value-encoding definitions, separate from the protocol line of PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI: the OKVS definition generalizes PaXoS from binary to linear encodings (PSI-CONTRIB-2021-GPRTY-OKVS).","thread":"paxos_okvs_vole","visibility":"reviewed_related"},"PSI-CONTRIB-2021-BMRR-LOWER-BOUND":{"anchor_roles":["lower_bound_or_barrier"],"group":"foundation","label":"\\( \\Omega(nT) \\) lower bound for multiparty threshold PSI","lane_rationale":"A communication lower bound; Foundation by the rubric.","lenses":["communication"],"primary":false,"selection_rationale":"Extends the two-party bound to n parties (Theorems 4.1 and 4.3, pp. 15-17).","split_rationale":"Belongs to the line of communication lower bounds, separate from the protocols of PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI: it extends the bound of PSI-CONTRIB-2019-GS-LOWER-BOUND to n parties, and it is the \\( \\Omega(nT) \\) bound that the central problem PSI-OP-005 asks protocols without FHE to match.","thread":"threshold_psi","visibility":"reviewed_related"},"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI":{"anchor_roles":["capability_boundary"],"group":"efficiency","label":"\\( \\tilde O(nT) \\) threshold PSI from threshold additive HE","lane_rationale":"The principal claim is a named cost improvement under a weaker assumption: \\( \\tilde O(T) \\) instead of \\( \\tilde O(T^{2}) \\) for two parties from additive HE, \\( \\tilde O(nT) \\) for n parties; the Hankel test is the means.","lenses":["communication","assumptions-setup"],"primary":true,"selection_rationale":"Claimed by the authors to solve the Ghosh-Simkin open problem (abstract, p. 1; §1.2, p. 4); Ghosh and Simkin (2023) credit the two-party bound without FHE to their 2019 construction combined with an observation of this paper (PSI-PAPER-2023-GS, p. 4, footnote 5).","thread":"threshold_psi","visibility":"backbone"},"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER":{"anchor_roles":["reusable_mechanism"],"group":"efficiency","label":"\\( O(\\sqrt{B}) \\) multiplications per sender bin","lane_rationale":"Advances a named resource, ciphertext-ciphertext multiplications of the sender, from linear to square root in the bin size; Efficiency.","lenses":["computation"],"primary":true,"selection_rationale":"First claim of the abstract, \\( O(\\sqrt{|X|}) \\) homomorphic multiplications, called a quadratic improvement over CHLR18 (abstract, p. 1; §1.2, p. 3).","thread":"fhe_unbalanced","visibility":"reviewed_related"},"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY":{"group":"construction","label":"Malicious multiparty PSI from OPRF and OKVS","lane_rationale":"A stronger-secure protocol: an existing multiparty PSI with one modification, the random-oracle hash, shown malicious-secure; the rubric routes a stronger-secure protocol to Construction.","lenses":["computation"],"primary":false,"selection_rationale":"The authors call it the most efficient malicious multiparty PSI to date (§1.3, p. 4; §7.2, p. 22).","split_rationale":"Belongs to the multiparty line, separate from the OKVS definition of PSI-CONTRIB-2021-GPRTY-OKVS: it shows the augmented semi-honest protocol of Kolesnikov et al. malicious-secure with a random-oracle hash, and the protocol of Nevo, Trieu, and Yanai coincides with it at \\( t = n - 1 \\) and becomes cheaper for smaller t (PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED).","thread":"multiparty_opprf_okvs","threads":["multiparty_opprf_okvs","paxos_okvs_vole"],"visibility":"reviewed_related"},"PSI-CONTRIB-2021-GPRTY-OKVS":{"anchor_roles":["model_definition","reusable_mechanism"],"group":"foundation","label":"Oblivious key-value store","lane_rationale":"Introduces the oblivious key-value store with linear, binary, and overfitting notions (Definitions 1-4, pp. 5-7); a definition is routed to Foundation.","lenses":[],"primary":true,"selection_rationale":"Defines the interface under which polynomials, garbled Bloom filters, PaXoS, and later encodings are compared and exchanged in PSI protocols (§2-3, pp. 5-9; §6, pp. 18-20).","thread":"paxos_okvs_vole","visibility":"backbone"},"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED":{"anchor_roles":["capability_boundary"],"group":"efficiency","label":"Malicious multiparty PSI calibrated to t","lane_rationale":"The functionality and security (malicious, \\( t < n \\)) match earlier protocols; the principal delta is cost that decreases with t and client communication \\( O(m \\kappa) \\) (Table 1, p. 2; §1.2, p. 4), assembled from prior mechanisms.","lenses":["communication","computation"],"primary":true,"selection_rationale":"The paper states that it was not known how to make earlier protocols cheaper for smaller t (§1.2, p. 4), and its protocol reduces to that of Garimella et al. only at \\( t = n - 1 \\).","thread":"multiparty_opprf_okvs","threads":["multiparty_opprf_okvs","paxos_okvs_vole"],"visibility":"backbone"},"PSI-CONTRIB-2021-RS-CIRCUIT-PSI":{"group":"construction","label":"Circuit-PSI from VOLE-based OPPRF","lane_rationale":"A concrete circuit-PSI protocol with a new OPPRF built from the VOLE OPRF and XoPaXoS; routed to Construction.","lenses":["computation"],"primary":false,"selection_rationale":"Replaces the polynomial OPPRF of linear-communication circuit-PSI, up to 3 times faster in the authors' measurements (abstract, p. 1; Table 4, p. 29); core in circuit-based PSI.","split_rationale":"Belongs to the circuit-PSI line, separate from the VOLE-based OPRF of PSI-CONTRIB-2021-RS-VOLE-OPRF: it keeps the linear-communication circuit-PSI of PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION and replaces its polynomial OPPRF with one built from the VOLE-based OPRF and XoPaXoS.","thread":"circuit_psi","threads":["circuit_psi","paxos_okvs_vole"],"visibility":"reviewed_related"},"PSI-CONTRIB-2021-RS-VOLE-OPRF":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Batched OPRF from vector OLE","lane_rationale":"A reusable mechanism, a batched OPRF from vector OLE and an OKVS, answering how low-communication OPRF-based PSI is realized; routed to Construction.","lenses":["communication"],"primary":true,"selection_rationale":"Replaces OT extension with sublinear VOLE in OPRF-based PSI, reaching under 450 bits per element with malicious security for \\( n = 2^{20} \\) (abstract, p. 1); extended by the subfield-VOLE PSI of Raghuraman and Rindal.","thread":"paxos_okvs_vole","visibility":"backbone"},"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Key agreement to malicious PSI","lane_rationale":"A transform from key agreement to malicious PSI; the rubric routes transforms and reusable mechanisms to Construction even when they are also fast.","lenses":["communication","computation"],"primary":true,"selection_rationale":"Generic transformation from two-round key agreement to malicious PSI with about one group element per item (abstract, p. 1; Figure 4, p. 11; Lemmas 5-6).","thread":"public_key_psi","visibility":"backbone"},"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE":{"anchor_roles":["capability_boundary"],"group":"efficiency","label":"Subfield-VOLE PSI","lane_rationale":"A named communication improvement: moving the VOLE to a subfield makes communication \\( O(n\\lambda + n \\log n) \\) instead of scaling with \\( \\kappa n \\); routed to Efficiency.","lenses":["communication"],"primary":false,"selection_rationale":"The authors call it the first PSI with communication \\( O(n\\lambda + n \\log n) \\) (abstract, p. 1); \\( 180n \\) bits at \\( n = 2^{20} \\) against \\( 426n \\) for VOLE-PSI (Table 2, p. 25).","split_rationale":"Belongs to the VOLE line, separate from the triangulation OKVS of PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS: it extends the VOLE-PSI protocol of PSI-CONTRIB-2021-RS-VOLE-OPRF to subfield VOLE.","thread":"paxos_okvs_vole","visibility":"reviewed_related"},"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS":{"anchor_roles":["reusable_mechanism"],"group":"efficiency","label":"Triangulation OKVS","lane_rationale":"The principal delta is a named cost of the OKVS: expansion about \\( 1.23n \\) and encoding and decoding 13 and 64 times faster than the three-hash table, with concrete failure analysis replacing amplification; routed to Efficiency.","lenses":["computation"],"primary":true,"selection_rationale":"With it, OKVS-based PSI runs faster than KKRT16 in the authors' measurements (Table 2, p. 25), and the expansion is chosen directly for a target security level (§3.4, p. 21).","thread":"paxos_okvs_vole","visibility":"backbone"},"PSI-CONTRIB-2023-GS-PICT-COMPILER":{"anchor_roles":["reusable_mechanism"],"group":"construction","label":"Bucketing compiler for cardinality tests","lane_rationale":"The principal delta is a reusable transform (random partitioning, padding, and per-bucket small-threshold tests) that applies to any cardinality test; its quasilinear cost follows from it, so the rubric routes it to Construction.","lenses":["communication","assumptions-setup"],"primary":true,"selection_rationale":"Called the key technical contribution in the abstract (p. 1) and the main technical contribution in §1.2 (p. 2); it turns \\( O(\\lambda \\ell \\,\\mathrm{poly}(t)) \\) tests into \\( O(\\lambda^{2} \\ell t \\,\\mathrm{polylog}\\, t) \\).","thread":"threshold_psi","visibility":"reviewed_related"},"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON":{"group":"foundation","label":"Operation counts for semi-honest multiparty PSI","lane_rationale":"An independent comparative analysis of existing protocols' costs; it neither builds a protocol nor improves a cost.","lenses":[],"primary":true,"selection_rationale":"The only new derived result of the systematization (Table 3, p. 13; Appendix B, pp. 17-18), and the basis of its conclusion that no single protocol is the state of the art (§9, p. 14).","thread":"multiparty_opprf_okvs","visibility":"reviewed_related"}},"overview_focus_ids":["malicious-security","communication","computation","assumptions-setup"],"overview_reading_path":["PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","PSI-CONTRIB-2004-FNP-OPE-PSI","PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","PSI-CONTRIB-2021-GPRTY-OKVS","PSI-CONTRIB-2021-RS-VOLE-OPRF"],"problems":[{"id":"malicious-security","kind":"security","label":"Malicious security","question":"How do protocols move from semi-honest to malicious security, and where do they stop short, by securing only one side or by not strictly enforcing a corrupt party's set size?"},{"id":"communication","kind":"cost","label":"Communication","question":"Which results bring communication down toward the size of the sets, or of the threshold in threshold PSI, and which lower bounds limit how far it can fall?"},{"id":"computation","kind":"cost","label":"Computation","question":"Which results reduce the computation of PSI, counted in public-key operations, homomorphic multiplications, circuit size, or symmetric-key work?"},{"id":"assumptions-setup","kind":"assumptions","label":"Assumptions and setup","question":"Which results let PSI rest on weaker assumptions, such as oblivious transfer and symmetric-key primitives in place of homomorphic encryption, additively in place of fully homomorphic encryption, or the standard model in place of random oracles?"}],"reading_collections":[{"coverage_note":"Covers the Diffie-Hellman matching protocol of Huberman, Franklin, and Hogg, which as specified outputs a match count; Freedman-Nissim-Pinkas polynomial-evaluation PSI with balanced-allocation hashing, malicious-client and malicious-server versions, and the reduction showing that PSI implies oblivious transfer; De Cristofaro-Tsudik blind-RSA PSI and linear-cost authorized PSI; and Rosulek-Trieu PSI from key agreement, malicious and semi-honest. Meadows, Hazay-Lindell, and De Cristofaro-Kim-Tsudik have no full text and no results recorded yet, and the 2016 journal version of Freedman-Nissim-Pinkas was not read.","excludes":"Protocols whose cost is dominated by OT extension or VOLE are read under OT- and VOLE-based PSI, even though their base OTs use public-key operations. Diffie-Hellman protocols that output a cardinality or a sum are read under computing on the intersection, and homomorphic-encryption protocols for a small client set under unbalanced and labeled PSI.","id":"psi_public_key","includes":"Diffie-Hellman PSI from commutative exponentiation, PSI from oblivious polynomial evaluation under homomorphic encryption, RSA blind-signature PSI, PSI from algebraic oblivious PRFs, and Bloom-filter protocols with public-key operations, as grouped under public-key-based PSI by Pinkas, Schneider, and Zohner (2018, §1.2).","label":"Public-key-based PSI","members":[{"contribution_id":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","reason":"Commutative exponentiation of hashed items modulo a prime, the Diffie-Hellman mechanism that PSZ18 §1.2 places under public-key-based PSI; the paper gives both a matching count and, as a variation, the shared items (Appendix A, p. 85).","role":"core"},{"contribution_id":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","reason":"A cost reduction inside the polynomial-evaluation protocol; it changes neither output, model, nor set-size regime.","role":"core","thread":"public_key_psi"},{"contribution_id":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE","reason":"Malicious-secure versions of the polynomial-evaluation protocol; adversary is a facet, so the contribution stays with its mechanism.","role":"core"},{"contribution_id":"PSI-CONTRIB-2004-FNP-OPE-PSI","reason":"PSI from oblivious polynomial evaluation under additively homomorphic encryption, which PSZ18 §1.2 (p. 4) lists under public-key-based PSI.","role":"core"},{"contribution_id":"PSI-CONTRIB-2004-FNP-OT-REDUCTION","reason":"A boundary result about the two-party PSI functionality, stated among the preliminaries of the public-key protocols (§3.1, pp. 3-4); it applies to any two-party PSI protocol, not only public-key ones.","role":"core"},{"contribution_id":"PSI-CONTRIB-2010-DT-BLIND-RSA","reason":"RSA blind signatures as the OPRF, the blind-RSA protocol that PSZ18 §1.2 (p. 4) lists under public-key-based PSI.","role":"core","thread":"public_key_psi"},{"contribution_id":"PSI-CONTRIB-2010-DT-LINEAR-APSI","reason":"RSA-based authorized PSI and its prime-order-group PSI version, both built from per-item public-key exponentiations.","role":"core","thread":"public_key_psi"},{"contribution_id":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","reason":"PSI from Diffie-Hellman key agreement, one exponentiation per item; RT21 itself contrasts it with OT-extension protocols (§1, pp. 1-2).","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION","reason":"A communication improvement of semi-honest Diffie-Hellman PSI.","role":"core","thread":"public_key_psi"},{"contribution_id":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","reason":"The variants change only the payload of the polynomial-evaluation protocol (§4.4-4.5, p. 9).","role":"context"},{"contribution_id":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","reason":"Built from the two-party polynomial-evaluation protocol under homomorphic encryption (§7, p. 15).","role":"context"},{"contribution_id":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","reason":"The baseline it measures is the one-more-DL-based protocol of De Cristofaro and Tsudik, read under public-key-based PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","reason":"Its masking is the commutative Diffie-Hellman technique of Meadows and of Huberman, Franklin, and Hogg, read under public-key-based PSI.","role":"context"}],"question":"How can two parties compute the intersection of their sets with protocols built on public-key operations, and what do these protocols cost in exponentiations and communication?"},{"coverage_note":"Covers the batched OPRF of Kolesnikov, Kumaresan, Rosulek, and Trieu and its PSI protocol, the bit-length-independent OT-based protocol and concrete hashing parameters of the Pinkas-Schneider-Zohner journal version, Rindal-Rosulek dual execution and encode-commit, PaXoS and the garbled cuckoo table, OKVS with the three-hash table, failure amplification, and PSI from vector OLE, VOLE-PSI, and the triangulation OKVS and subfield VOLE of Raghuraman and Rindal. Dong-Chen-Wen, the Pinkas-Schneider-Zohner and Phasing conference papers, Rindal-Rosulek EUROCRYPT 2017, SpOT-light, Chase-Miao, Ghosh-Nilges, and Bui-Couteau have no full text and no results recorded yet.","excludes":"OT extension, VOLE, and pseudorandom correlation generators as general primitives are read in the MPC atlas. Protocols that output a function of the intersection are read under computing on the intersection, protocols for a small client set under unbalanced and labeled PSI, and protocols for more than two parties under multiparty PSI.","id":"psi_oprf","includes":"Protocols in the OT-based class of Pinkas, Schneider, and Zohner (2018, §1.2), including Bloom-filter protocols built on OT extension; PSI from an oblivious PRF with cuckoo hashing (Evans, Kolesnikov, and Rosulek, §3.8.1); batched and multipoint OPRFs; PaXoS and OKVS encodings; PSI from vector OLE, subfield VOLE, and OLE; and techniques that make these protocols secure against malicious parties, such as dual execution.","label":"OT- and VOLE-based PSI","members":[{"contribution_id":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","reason":"A batched OPRF built from OT extension, which is the mechanism the OT- and OPRF-based subfield names; it is not a complete protocol and changes neither the output nor the set-size regime.","role":"core"},{"contribution_id":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","reason":"A complete semi-honest two-party PSI protocol from a batched OPRF on OT extension and cuckoo hashing, described for equal set sizes and outputting the intersection.","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT","reason":"A malicious variant of the same OT-based paradigm, built on oblivious encodings from OT extension.","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","reason":"Malicious security for the OT-based paradigm of Pinkas, Schneider, and Zohner; the psi_oprf collection names dual execution among its techniques.","role":"core"},{"contribution_id":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI","reason":"OT-based PSI from per-bin OPRFs on 1-out-of-N OT extension, the OT-based class of PSZ18 §1.2 itself.","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","reason":"Parameters for the cuckoo and simple hashing that the OT-based protocol of §5 relies on (Protocol 3, p. 22).","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","reason":"The concrete PaXoS data structure used by PaXoS-PSI and later as the solver of VOLE-PSI.","role":"core","thread":"paxos_okvs_vole"},{"contribution_id":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","reason":"Two-party PSI from OT extension and a PaXoS encoding, outputting the intersection for balanced sets.","role":"core"},{"contribution_id":"PSI-CONTRIB-2020-PRTY-PAXOS","reason":"A binary key-value encoding defined for OT-extension-based PSI; PaXoS and OKVS encodings are named in the OT- and VOLE-based subfield.","role":"core"},{"contribution_id":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","reason":"A security analysis of the malicious instantiation of PaXoS-PSI, a protocol of this subfield.","role":"core","thread":"paxos_okvs_vole"},{"contribution_id":"PSI-CONTRIB-2021-GPRTY-3H-GCT","reason":"A binary OKVS that shrinks the table of PaXoS-PSI, a two-party OT-extension protocol.","role":"core","thread":"paxos_okvs_vole"},{"contribution_id":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","reason":"A transform for OKVS failure probabilities, used to instantiate the OKVS of the paper's two-party PSI.","role":"core","thread":"paxos_okvs_vole"},{"contribution_id":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE","reason":"Two-party PSI from vector OLE and a linear OKVS, outputting the intersection.","role":"core","thread":"paxos_okvs_vole"},{"contribution_id":"PSI-CONTRIB-2021-GPRTY-OKVS","reason":"The OKVS abstraction, which the subfield definition names, introduced to improve OT- and VOLE-based PSI.","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS","reason":"An analysis of the OPRF-to-PSI transformation for two-party PSI that outputs the intersection.","role":"core","thread":"paxos_okvs_vole"},{"contribution_id":"PSI-CONTRIB-2021-RS-VOLE-OPRF","reason":"A batched OPRF from vector OLE for two-party PSI, the VOLE mechanism the subfield names.","role":"core"},{"contribution_id":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE","reason":"Subfield VOLE in two-party OPRF-based PSI that outputs the intersection.","role":"core"},{"contribution_id":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","reason":"An OKVS construction that improves VOLE-based two-party PSI.","role":"core"},{"contribution_id":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","reason":"Hashing items to bins is the step whose parameters PSZ18 §3 makes concrete for OT-based PSI, citing this paper's asymptotic analysis (PSZ18 §1.3, p. 5).","role":"context"},{"contribution_id":"PSI-CONTRIB-2017-KMPRT-OPPRF","reason":"As a two-party primitive it extends the batched OPRF of KKRT16 that OT-based PSI reads (KMPRT §3.1, pp. 4-5); its malicious PaXoS-based instantiation and two-party uses are read under OT- and VOLE-based PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","reason":"Read in OT- and VOLE-based PSI for its OT-extension technique: correlated-OT precomputation for garbled-circuit and Naor-Reingold OPRF evaluation, which the authors call of independent interest (KRSSW19 §1.1, p. 2; §4.3, p. 8); its core is precomputed unbalanced PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","reason":"An OPPRF built from one-time OPRF instances from OT extension, read next to the batched OPRFs of OT-based PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","reason":"Built on the batched-OPRF PSI of Kolesnikov, Kumaresan, Rosulek, and Trieu, read under OT- and VOLE-based PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","reason":"Built from a malicious two-party OPRF and an OKVS; the OPRF and OKVS mechanisms are read under OT- and VOLE-based PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","reason":"Its OPPRF is built from the VOLE-based OPRF and the XoPaXoS encoding; those mechanisms are read under OT- and VOLE-based PSI.","role":"context"}],"question":"How can two parties compute the intersection from oblivious transfer and its descendants, namely batched oblivious PRFs, sparse OT, PaXoS and OKVS encodings, and vector OLE, and at what communication and computation cost against semi-honest and malicious parties?"},{"coverage_note":"Covers Huang-Evans-Katz garbled-circuit PSI with size auditing and its measurement against custom protocols; mirror and two-dimensional cuckoo hashing for circuits (Pinkas, Schneider, Weinert, and Wieder); linear-communication circuit-PSI with batched OPPRFs and payloads (Pinkas, Schneider, Tkachenko, and Yanai) and the circuit-PSI of VOLE-PSI; intersection-sum with cardinality (Ion et al.); the Freedman-Nissim-Pinkas cardinality and threshold variants and approximation lower bound; Ghosh-Simkin threshold PSI with its lower bound; multiparty threshold PSI of Badrinarayanan, Miao, Raghuraman, and Rindal; and the bucketing compiler for cardinality tests and quasilinear multiparty threshold PSI without FHE of Ghosh and Simkin (2023). Circuit-Phasing has no full text yet.","excludes":"Garbled circuits, GMW, and mixed-protocol frameworks as general protocols are read in the MPC atlas. Protocols that output the plain intersection are read under the subfield of their technique, even when they evaluate a circuit internally.","id":"psi_circuit","includes":"Circuit-based PSI with generic secure computation, from sort-compare-shuffle circuits to cuckoo-hashing circuits with linear communication; circuit-PSI with secret-shared outputs; PSI cardinality and intersection-sum; and threshold PSI, including its communication lower bounds.","label":"Circuit-based PSI and computing on the intersection","members":[{"contribution_id":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","reason":"A communication lower bound for approximating the intersection size, a function of the intersection; TAXONOMY.md reads such lower bounds under computing on the intersection.","role":"core"},{"contribution_id":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","reason":"The output is the intersection size or a threshold decision, which TAXONOMY.md reads under computing on the intersection regardless of technique.","role":"core","thread":"threshold_psi"},{"contribution_id":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM","reason":"Measures generic garbled-circuit PSI, the defining approach of circuit-based PSI, against custom protocols.","role":"core","thread":"circuit_psi"},{"contribution_id":"PSI-CONTRIB-2012-HEK-SIZE-AUDITING","reason":"Computes on the intersection inside the circuit (its size and a threshold test) before deciding what to release.","role":"core","thread":"circuit_psi"},{"contribution_id":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","reason":"A PSI protocol evaluated entirely as a generic garbled circuit; PSI-PAPER-2018-PSZ §1.2 places it under circuit-based PSI, and the subfield definition names sort-compare-shuffle circuits.","role":"core"},{"contribution_id":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","reason":"The hashing scheme for circuit-based PSI computing functions such as PSI-CAT; PSI-PAPER-2018-PSWW §1 is a basis source of the subfield.","role":"core"},{"contribution_id":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","reason":"Circuit-based PSI that computes symmetric functions of the intersection with \\( \\omega(n) \\) comparisons.","role":"core","thread":"circuit_psi"},{"contribution_id":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","reason":"Threshold PSI protocol; the output facet `threshold` cites this paper.","role":"core"},{"contribution_id":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","reason":"Threshold PSI upper bound; threshold output is read under computing on the intersection.","role":"core","thread":"threshold_psi"},{"contribution_id":"PSI-CONTRIB-2019-GS-LOWER-BOUND","reason":"TAXONOMY reads threshold PSI, including its lower bounds, under computing on the intersection.","role":"core"},{"contribution_id":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","reason":"Introduced to make circuit-PSI linear; it is used here only to feed one comparison per bin into the circuit.","role":"core"},{"contribution_id":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","reason":"Circuit-PSI with secret outputs fed to a further circuit, the output facet `circuit` cites this paper.","role":"core"},{"contribution_id":"PSI-CONTRIB-2019-PSTY-PAYLOAD","reason":"Brings associated data of intersecting items into the circuit, for functions such as sums over the intersection.","role":"core","thread":"circuit_psi"},{"contribution_id":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM","reason":"Outputs intersection size and sum, not the intersection; TAXONOMY reads Ion et al. under computing on the intersection although the technique is Diffie-Hellman.","role":"core"},{"contribution_id":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM","reason":"Outputs intersection size and sum over a hidden intersection.","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","reason":"Per LITERATURE_COVERAGE.md and TAXONOMY.md, a multi-party threshold result is core under the subfield of its principal claim; the principal claim concerns the threshold condition.","role":"core","thread":"threshold_psi"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND","reason":"A communication lower bound in terms of the threshold T; threshold PSI lower bounds are read under computing on the intersection (TAXONOMY.md).","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","reason":"Threshold PSI from threshold additive HE, claimed to settle the two-party question of PSI-PAPER-2019-GS; principal claim concerns the threshold.","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","reason":"Threshold PSI with communication sublinear in the set size; principal claim concerns the threshold (the psi_multiparty excludes note).","role":"core","thread":"threshold_psi"},{"contribution_id":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI","reason":"The output is secret shares for a further computation (circuit-PSI), which places the contribution in circuit-based PSI by output.","role":"core"},{"contribution_id":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","reason":"Multi-party threshold PSI whose principal claim concerns the dependence on the threshold t, placed like PSI-PAPER-2021-BMRR per LITERATURE_COVERAGE.md and TAXONOMY.md.","role":"core","thread":"threshold_psi"},{"contribution_id":"PSI-CONTRIB-2023-GS-PICT-COMPILER","reason":"A compiler for intersection cardinality tests, the threshold-PSI building block; threshold PSI is read under computing on the intersection (TAXONOMY.md).","role":"core"},{"contribution_id":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","reason":"The protocol as specified outputs the number of matches to both parties, not the matches (Appendix A, step 5, p. 85), so it is also read as an early intersection-cardinality protocol.","role":"context"},{"contribution_id":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","reason":"The same parameters size the pairwise-comparison circuit for circuit-based PSI (§4.2, pp. 19-20; Table 11, p. 30).","role":"context"},{"contribution_id":"PSI-CONTRIB-2021-RS-VOLE-OPRF","reason":"The circuit-PSI of the same paper builds its OPPRF on this OPRF; that use is read under circuit-based PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS","reason":"Also applied, in a doubly oblivious form, to the circuit-PSI of VOLE-PSI (Table 2, p. 25); that use is read under circuit-based PSI.","role":"context"}],"question":"How can parties learn a function of the intersection, such as its size, a sum over it, whether it is large enough, or secret shares for a further computation, without learning the intersection itself, and how much communication does this require?"},{"coverage_note":"Covers Chen-Laine-Rindal PSI from leveled FHE; Chen-Huang-Laine-Rindal OPRF preprocessing against a malicious receiver, long items, labeled PSI, and malicious-sender security up to bounded leakage; Kales et al. precomputed OPRF-based contact discovery on phones; and the evaluation, encoding, and communication optimizations of Cong et al. Kiss et al. 2017 and Resende-Aranha have no cards, and PSI with computation (Chen-Huang-Laine-Rindal §6) is not recorded.","excludes":"Keyword PIR, SealPIR, and batch codes are read in the PIR atlas, and BFV, batching, and Paillier in the HE atlas. Balanced protocols that are only evaluated on unequal sets, as in Pinkas, Schneider, and Zohner (2018, §6.2.3), are read under the subfield of their technique.","id":"psi_unbalanced","includes":"PSI from fully homomorphic encryption for a small client set, labeled PSI, OPRF preprocessing against malicious parties in this setting, and private contact discovery.","label":"Unbalanced and labeled PSI","members":[{"contribution_id":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","reason":"A complete PSI protocol designed for a small receiver set against a much larger sender set, with communication linear in the smaller and logarithmic in the larger set (CLR17 §1.4, p. 3; p. 4); this is the defining question of the unbalanced subfield.","role":"core"},{"contribution_id":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","reason":"Labeled PSI with communication sublinear in the sender's set, one of the two questions TAXONOMY assigns to this subfield (CHLR18 §5, pp. 11-12).","role":"core"},{"contribution_id":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER","reason":"Security against a malicious sender for FHE-based unbalanced PSI under sublinear communication (CHLR18 §7.3, pp. 17-18; Theorem 3, p. 25).","role":"core"},{"contribution_id":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","reason":"An optimization of FHE-based unbalanced PSI that removes its item-length restriction (CHLR18 §3, pp. 7-8).","role":"core","thread":"fhe_unbalanced"},{"contribution_id":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","reason":"Changes the security model of FHE-based unbalanced PSI (malicious receiver) while keeping communication sublinear in the sender's set (CHLR18 §4, pp. 8-11; Theorem 1, p. 15).","role":"core"},{"contribution_id":"PSI-CONTRIB-2019-KRSSW-COT-PRECOMPUTATION","reason":"Optimizes the online phase of precomputed unbalanced PSI, whose online cost depends only on the client set (KRSSW19 §3.5, p. 6; §§4.3-4.4, pp. 8-10).","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2019-KRSSW-CUCKOO-FILTER-COMPRESSION","reason":"Reduces the one-time transfer of the large server set in precomputed unbalanced PSI (KRSSW19 §4.1, pp. 6-7).","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2019-KRSSW-LOWMC-OPRF","reason":"Reduces the base-phase cost of the garbled-circuit OPRF in precomputed unbalanced PSI for contact discovery (KRSSW19 §4.2, pp. 7-8).","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2019-KRSSW-MOBILE-IMPLEMENTATION","reason":"An implementation result for unbalanced PSI on phones against server sets of \\( 2^{20} \\) to \\( 2^{28} \\) items (KRSSW19 §§5-6, pp. 11-14).","role":"core","thread":"ot_extension_oprf"},{"contribution_id":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS","reason":"Makes the online communication of FHE-based unbalanced PSI nearly independent of the larger set (CMGD21 §3.1, pp. 11-12; §5.4, pp. 18-20).","role":"core","thread":"fhe_unbalanced"},{"contribution_id":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER","reason":"Reduces the sender computation of FHE-based unbalanced and labeled PSI (CMGD21 §3.1, pp. 7-9).","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES","reason":"Reduces receiver-to-sender communication in FHE-based unbalanced PSI (CMGD21 §3.1, pp. 10-11).","role":"core","thread":"fhe_unbalanced"},{"contribution_id":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS","reason":"Changes the item and label encoding of FHE-based unbalanced and labeled PSI (CMGD21 §3.1, p. 7; §4.2, pp. 13-14).","role":"core","thread":"fhe_unbalanced"}],"question":"How can a client with a small set intersect it with a much larger server set using communication sublinear in the server's set, retrieve labels associated with matching items, and stay secure against a malicious client or server?"},{"coverage_note":"Covers the Freedman-Nissim-Pinkas multiparty sketch; Kolesnikov et al. OPPRF-based protocols against semi-honest and augmented semi-honest collusion; the malicious protocol of Garimella et al.; Nevo-Trieu-Yanai protocols without collusion and calibrated to the collusion bound; and the operation counts of the Vos-Conti-Erkin systematization. Multiparty threshold PSI (Badrinarayanan et al.; Ghosh and Simkin 2023) is read as context here and as core under computing on the intersection. Kissner-Song, Hazay-Venkitasubramaniam, and the honest-majority and garbled-Bloom-filter protocols that Vos, Conti, and Erkin compare have no cards yet.","excludes":"Server-aided, delegated, and outsourced PSI, in which a third party without input assists, are not covered. Multi-party threshold PSI is read under computing on the intersection when its principal result concerns the threshold.","id":"psi_multiparty","includes":"Multiparty PSI against colluding semi-honest, augmented semi-honest, or malicious parties, built from oblivious programmable PRFs, OKVS, homomorphic encryption, or secret sharing, and the systematization of Vos, Conti, and Erkin.","label":"Multiparty PSI","members":[{"contribution_id":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE","reason":"n parties compute the intersection of all their lists (§7, p. 15).","role":"core","thread":"public_key_psi"},{"contribution_id":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","reason":"Changes the security model and cost of the multiparty protocol (Theorem 2, p. 14); it has no two-party reading.","role":"core","thread":"multiparty_opprf_okvs"},{"contribution_id":"PSI-CONTRIB-2017-KMPRT-OPPRF","reason":"The OPPRF is introduced as the technical core of multiparty PSI (KMPRT abstract, p. 1) and is the building block of the OPPRF-based multiparty protocols that this subfield reads (KMPRT §5; NTY Protocol 4.2).","role":"core"},{"contribution_id":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","reason":"A complete protocol for \\( n > 2 \\) parties against any number of colluding semi-honest parties (Theorem 1, p. 12).","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","reason":"More than two parties compute the intersection against malicious corruption of any subset; the subfield is fixed by the party count.","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION","reason":"Malicious multiparty PSI with at most one corrupted party (Theorem 3.4, p. 8); its server-aided base case uses a party with input as server, so it is not in the deferred server-aided class.","role":"core","thread":"multiparty_opprf_okvs"},{"contribution_id":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","reason":"Malicious multiparty PSI against \\( t < n \\) colluding parties whose cost depends on t (Theorem 4.5, p. 11; Table 1, p. 2).","role":"core"},{"contribution_id":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON","reason":"Analyzes the costs of semi-honest collusion-resistant multiparty PSI protocols only (§7 and Table 3, pp. 12-13).","role":"core"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES","reason":"The two functionalities differ only for more than two parties, which is read under multiparty PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND","reason":"The bound scales with the number of parties n under \\( n - 1 \\) corruptions, a multiparty PSI setting.","role":"context"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","reason":"The general protocol is n-party with \\( n - 1 \\) collusion, read alongside multiparty PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","reason":"n-party protocol with \\( n - 1 \\) collusion in a star network, read alongside multiparty PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2021-GPRTY-OKVS","reason":"The malicious multiparty protocol of the same paper (Appendix B) is written over an arbitrary OKVS; its multiparty use is read under multiparty PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR","reason":"ℓ parties with all-but-one passive corruption, read alongside multiparty PSI.","role":"context"},{"contribution_id":"PSI-CONTRIB-2023-GS-PICT-COMPILER","reason":"Its main application is the ℓ-party test with all-but-one passive corruption, read alongside multiparty PSI.","role":"context"}],"question":"How can more than two parties compute the intersection of their sets when up to a stated number of them collude, and how close can the cost come to that of two-party PSI?"}],"relations":[{"change_dimensions":["efficiency"],"evidence_locator":"FNP04 §4.2 (pp. 6-8), EUROCRYPT 2004, LNCS 3027, printed pages","evidence_url":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"lineage-083dc1903a19aa8a","map_relation":"lineage","predecessor":"PSI-CONTRIB-2004-FNP-OPE-PSI","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"Balanced-allocation hashing splits the client's polynomial into low-degree bin polynomials, reducing the server's exponentiations from \\( O(k_C k_S) \\) to \\( O(k_C + k_S \\ln \\ln k_C) \\).","successor":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING"},{"change_dimensions":["functionality"],"evidence_locator":"FNP04 §4.4-4.5 (p. 9), EUROCRYPT 2004, LNCS 3027, printed pages","evidence_url":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"lineage-0eec7af57aac0f99","map_relation":"lineage","predecessor":"PSI-CONTRIB-2004-FNP-OPE-PSI","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"Changing the server's payload in PM-Semi-Honest yields the cardinality variant, and random payloads plus a secure circuit yield the threshold variant.","successor":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD"},{"change_dimensions":["security"],"evidence_locator":"FNP04 §5 (pp. 9-13), Protocol PM-Malicious-Client (p. 10), §5.2 and Protocol PM-Malicious-Server (pp. 11-12), EUROCRYPT 2004, LNCS 3027, printed pages","evidence_url":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"lineage-ca29cea1e674c2ea","map_relation":"lineage","predecessor":"PSI-CONTRIB-2004-FNP-OPE-PSI","relation_basis":"technical_dependency","relation_type":"HARDENS","review_status":"fulltext_checked","statement":"The malicious-client protocol modifies PM-Semi-Honest with balanced-allocation hashing by cut-and-choose, and the malicious-server protocol modifies PM-Semi-Honest, given without hashing, by random-oracle derandomization.","successor":"PSI-CONTRIB-2004-FNP-MALICIOUS-OPE"},{"change_dimensions":["model"],"evidence_locator":"FNP04 §7 (pp. 15-17), EUROCRYPT 2004, LNCS 3027, printed pages","evidence_url":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"lineage-90a16291dc71e213","map_relation":"lineage","predecessor":"PSI-CONTRIB-2004-FNP-OPE-PSI","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"Each client encodes its items as in the two-party protocol, and the leader evaluates all client polynomials with XOR-shared payloads.","successor":"PSI-CONTRIB-2004-FNP-MULTIPARTY-OPE"},{"change_dimensions":["security","mechanism"],"evidence_locator":"FNP04 §2 (p. 2) and abstract (p. 1), EUROCRYPT 2004, LNCS 3027, printed pages","evidence_url":"https://doi.org/10.1007/978-3-540-24676-3_1","id":"lineage-de5de00a8309525f","map_relation":"related_work","predecessor":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","relation_basis":"result_progression","relation_type":"CHANGES_SECURITY_MODEL","review_status":"fulltext_checked","statement":"FNP04 contrasts its standard-model semi-honest protocol with earlier \\( O(k) \\)-exponentiation constructions, citing HFH99, that had been analyzed only in the random oracle model against semi-honest parties.","successor":"PSI-CONTRIB-2004-FNP-OPE-PSI"},{"change_dimensions":["implementation","efficiency"],"evidence_locator":"HEK12 §7.3 with footnotes 3-4 (p. 12), Figure 11 and Table 2 (p. 13), NDSS 2012 PDF dated 2011-11-28","evidence_url":"https://www.ndss-symposium.org/ndss2012/private-set-intersection-are-garbled-circuits-better-custom-protocols","id":"lineage-90f2c14f3465c1f2","map_relation":"related_work","predecessor":"PSI-CONTRIB-2010-DT-LINEAR-APSI","relation_basis":"analysis","relation_type":"BENCHMARKS","review_status":"fulltext_checked","statement":"HEK12 reimplement the one-more-DL-based PSI protocol of De Cristofaro and Tsudik as a client-server protocol and measure it against their garbled-circuit protocol at five security levels.","successor":"PSI-CONTRIB-2012-HEK-GC-VERSUS-CUSTOM"},{"change_dimensions":["mechanism"],"evidence_locator":"KKRT16 §5.1 (p. 11), §5.3 (p. 12), Figure 3 (p. 13), IACR ePrint 2016/799, PDF dated 2016-08-20","evidence_url":"https://eprint.iacr.org/2016/799","id":"lineage-f5c982aee190bb71","map_relation":"lineage","predecessor":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"The PSI protocol runs one BaRK-OPRF instance per cuckoo bin and stash position, so each bin consumes one row of a 424-448-bit OT-extension matrix.","successor":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI"},{"change_dimensions":["mechanism","security","efficiency"],"evidence_locator":"KMPRT abstract (p. 1), Table 1 (p. 3), §6.1 (pp. 14-15), IACR ePrint 2017/799, PDF dated 2017-08-24","evidence_url":"https://eprint.iacr.org/2017/799","id":"lineage-203d371127274746","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"Replacing the pairwise OPPRF zero-sharing phase by zero-sharing from PRF seeds lowers client communication from \\( O(m t \\lambda) \\) to \\( O(m \\lambda) \\) bits and the 5-party, \\( 2^{20} \\)-item run from 72 s to 22 s, while relaxing semi-honest to augmented semi-honest security.","successor":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING"},{"change_dimensions":["functionality","mechanism"],"evidence_locator":"KMPRT §3.1 (pp. 4-5), §3.4 (p. 7), §4 (p. 9), IACR ePrint 2017/799, PDF dated 2017-08-24","evidence_url":"https://eprint.iacr.org/2017/799","id":"lineage-28acbbc0d4769b2d","map_relation":"lineage","predecessor":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"KMPRT build every OPPRF from the KKRT batched OPRF, one OPRF instance per bin plus a sender hint, and inherit its related-key and leakage relaxations.","successor":"PSI-CONTRIB-2017-KMPRT-OPPRF"},{"change_dimensions":["functionality","mechanism"],"evidence_locator":"KMPRT §5.1-5.2 (pp. 11-12) and Figure 8 (p. 12), IACR ePrint 2017/799, PDF dated 2017-08-24","evidence_url":"https://eprint.iacr.org/2017/799","id":"lineage-fa57450d19fb2055","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-KMPRT-OPPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"Conditional zero-sharing and conditional reconstruction are both realized as multi-query OPPRF instances, between every pair of parties and from each party to the leader.","successor":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"RR17 §5.3 (pp. 8-10), §6.4 (pp. 15-16), IACR ePrint 2017/769, full version of August 9, 2017","evidence_url":"https://eprint.iacr.org/2017/769","id":"lineage-8fadea4300b28ce6","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","relation_basis":"technical_dependency","relation_type":"CHANGES_MECHANISM","review_status":"fulltext_checked","statement":"Viewing the sender's encodings in dual execution as commitments, the encode-commit protocol replaces them with a standard commitment and masked decommitments.","successor":"PSI-CONTRIB-2017-RR-CCS-ENCODE-COMMIT"},{"change_dimensions":["functionality","mechanism"],"evidence_locator":"CHLR18 §1.3 (p. 3) and §5.1 (pp. 11-12), IACR ePrint 2018/787, PDF dated 2018-08-27","evidence_url":"https://eprint.iacr.org/2018/787","id":"lineage-9f36b125779f01a8","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"CHLR18 extends the CLR17 protocol to labeled PSI: the sender additionally evaluates a label-interpolation polynomial per bin, keeping communication sublinear in the sender's set.","successor":"PSI-CONTRIB-2018-CHLR-LABELED-PSI"},{"change_dimensions":["security","assumption"],"evidence_locator":"CHLR18 §1.3 (p. 3), §7.2 (p. 16), §7.3 (pp. 17-18), Theorem 3 (p. 25), IACR ePrint 2018/787, PDF dated 2018-08-27","evidence_url":"https://eprint.iacr.org/2018/787","id":"lineage-1b25feb4adfb18ba","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"HARDENS","review_status":"fulltext_checked","statement":"CHLR18 restricts what a malicious sender can do in FHE-based unbalanced PSI from forcing the intersection to be the receiver's full set, as in CLR17, to X ∩ Y ∩ leakage(Y), under an H-limited FHE assumption.","successor":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER"},{"change_dimensions":["mechanism","security"],"evidence_locator":"CHLR18 §5.2 (p. 12), §7.3 (p. 17), Figure 8 (p. 25), IACR ePrint 2018/787, PDF dated 2018-08-27","evidence_url":"https://eprint.iacr.org/2018/787","id":"lineage-f35b5649c7dbf77f","map_relation":"lineage","predecessor":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"The leaky malicious-sender protocol uses labeled PSI with hash-valued labels as its only output channel and drops the intersection polynomial.","successor":"PSI-CONTRIB-2018-CHLR-LEAKY-MALICIOUS-SENDER"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"CHLR18 §3 (pp. 7-8) and §8.3 (p. 21), IACR ePrint 2018/787, PDF dated 2018-08-27","evidence_url":"https://eprint.iacr.org/2018/787","id":"lineage-a320878b8208078b","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"CHLR18 replaces the plaintext modulus of the item length used by CLR17 with extension-field SIMD slots, making arbitrary-length (80-bit hashed) items efficient where CLR17 was practically limited to 32 bits.","successor":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS"},{"change_dimensions":["security","mechanism","efficiency"],"evidence_locator":"CHLR18 §1.3 (p. 3), §4.1-4.2 (pp. 9-10), Theorem 1 (p. 15), IACR ePrint 2018/787, PDF dated 2018-08-27","evidence_url":"https://eprint.iacr.org/2018/787","id":"lineage-c5968736fbbe36f7","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"CHANGES_SECURITY_MODEL","review_status":"fulltext_checked","statement":"CHLR18 applies an OPRF to both sets before the CLR17 homomorphic intersection, which removes noise flooding, bin padding, and polynomial randomization and raises security from semi-honest to a malicious receiver (with privacy against a malicious sender).","successor":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER"},{"change_dimensions":["efficiency"],"evidence_locator":"PSWW18 §6.2 (pp. 21-23) and Table 3 (p. 23), IACR ePrint 2018/120, PDF dated 2019-01-24","evidence_url":"https://eprint.iacr.org/2018/120","id":"lineage-41cd7e311da1cf56","map_relation":"lineage","predecessor":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"The 2D cuckoo-hashing circuit has 1.8 to 2.8 times fewer AND gates than sort-compare-shuffle without its shuffle phase for \\( n = 2^{12} \\) and \\( 2^{16} \\), where that circuit was the previous best.","successor":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING"},{"change_dimensions":["efficiency","bounds"],"evidence_locator":"PSWW18 abstract (p. 1), §1.4 (p. 5), and §6.2 (pp. 21-22), IACR ePrint 2018/120, PDF dated 2019-01-24","evidence_url":"https://eprint.iacr.org/2018/120","id":"lineage-5f61f0b2f8198afd","map_relation":"lineage","predecessor":"PSI-CONTRIB-2012-HEK-SORT-COMPARE-SHUFFLE","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"Mirror cuckoo hashing reduces the comparisons of circuit-based PSI from the \\( O(n \\log n) \\) of the sort-compare-shuffle circuit to \\( \\omega(n) \\).","successor":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"PSZ18 §1.2 'OT-Based PSI' (pp. 4-5), Table 1 (p. 5), §5 (p. 22), IACR ePrint 2016/930, PDF dated 2019-07-28","evidence_url":"https://eprint.iacr.org/2016/930","id":"lineage-e7fdd324a8aa7089","map_relation":"related_work","predecessor":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","relation_basis":"result_progression","relation_type":"CHANGES_MECHANISM","review_status":"fulltext_checked","statement":"PSZ18 contrasts its fixed BCH code with KKRT16's pseudorandom code for the same OPRF role, reporting 1.10-1.15 times the communication and noting that its code admits a malicious-receiver extension that the pseudorandom code does not.","successor":"PSI-CONTRIB-2018-PSZ-BIT-LENGTH-INDEPENDENT-OT-PSI"},{"change_dimensions":["efficiency"],"evidence_locator":"PSZ18 §1.3 (p. 5), §3 (p. 12), IACR ePrint 2016/930, PDF dated 2019-07-28; FNP04 §4.2 (pp. 7-8)","evidence_url":"https://eprint.iacr.org/2016/930","id":"lineage-dcd2a3bdeb602878","map_relation":"lineage","predecessor":"PSI-CONTRIB-2004-FNP-BALANCED-ALLOCATION-HASHING","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"PSZ18 supplies concrete parameters for the hashing-to-bins approach that FNP04 introduced for PSI with only an asymptotic analysis.","successor":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS"},{"change_dimensions":["efficiency","functionality"],"evidence_locator":"GS19 abstract (p. 1) and §1 (p. 2), IACR ePrint 2019/175, PDF dated 2020-05-27","evidence_url":"https://eprint.iacr.org/2019/175","id":"lineage-0add6ef17a9fc42d","map_relation":"related_work","predecessor":"PSI-CONTRIB-2004-FNP-CARDINALITY-THRESHOLD","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"Earlier threshold PSI, including the FNP04 threshold decision on the intersection size, communicates at least linearly in the smaller set; GS19 reaches communication depending mainly on t.","successor":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"},{"change_dimensions":["efficiency","functionality"],"evidence_locator":"GS19 §1 (p. 2), IACR ePrint 2019/175, PDF dated 2020-05-27","evidence_url":"https://eprint.iacr.org/2019/175","id":"lineage-4bfbc14ec086e796","map_relation":"related_work","predecessor":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"GS19 lists PSWW18 among threshold PSI solutions whose communication scales at least linearly in the smaller set, and gives protocols whose communication depends mainly on t.","successor":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI"},{"change_dimensions":["functionality","bounds"],"evidence_locator":"GS19 §1 (p. 1) and §3 (pp. 7-8), IACR ePrint 2019/175, PDF dated 2020-05-27","evidence_url":"https://eprint.iacr.org/2019/175","id":"lineage-ba6b1a0b2ee5f328","map_relation":"lineage","predecessor":"PSI-CONTRIB-2004-FNP-APPROX-LOWER-BOUND","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"Ghosh and Simkin reduce threshold PSI to PSI on padded sets and so turn the disjointness-based linear lower bound that they attribute to Freedman, Nissim, and Pinkas into an \\( \\Omega(t) \\) bound in the threshold.","successor":"PSI-CONTRIB-2019-GS-LOWER-BOUND"},{"change_dimensions":["mechanism"],"evidence_locator":"PSTY19 Protocol 7 (p. 16) and §7.3 (p. 24), IACR ePrint 2019/241, PDF dated 2019-02-28","evidence_url":"https://eprint.iacr.org/2019/241","id":"lineage-18eb7c5724fe5661","map_relation":"lineage","predecessor":"PSI-CONTRIB-2016-KKRT-BATCHED-OPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"The batched OPPRF is built in the F_OPRF-hybrid model, and its cost is estimated with the BaRK-OPRF at no more than 450 bits per evaluation.","successor":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"},{"change_dimensions":["mechanism","efficiency","security"],"evidence_locator":"PSTY19 §1 (p. 2), §3.2 (p. 12), and §3.3 (pp. 13-15), IACR ePrint 2019/241, PDF dated 2019-02-28","evidence_url":"https://eprint.iacr.org/2019/241","id":"lineage-9772b3917867498c","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-KMPRT-OPPRF","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"PSTY19 adapts the polynomial OPPRF of KMPRT17 to a one-query definition that allows correlated targets and batches the hints of all bins into one polynomial of total size linear in the programmed points.","successor":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF"},{"change_dimensions":["efficiency"],"evidence_locator":"PSTY19 abstract (p. 1), Table 3 (p. 25), and Table 5 (p. 27), IACR ePrint 2019/241, PDF dated 2019-02-28","evidence_url":"https://eprint.iacr.org/2019/241","id":"lineage-bf28e415bcb9c97a","map_relation":"lineage","predecessor":"PSI-CONTRIB-2018-PSWW-2D-CUCKOO-HASHING","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"The stash-less OPPRF protocol communicates 2.6 to 12.8 times less and runs 2.8 to 5.8 times faster than the 2D cuckoo-hashing protocol, the previous best circuit-based PSI.","successor":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION"},{"change_dimensions":["efficiency","bounds"],"evidence_locator":"PSTY19 §1 (p. 2), §1.4 (p. 7), and §5 (p. 19), IACR ePrint 2019/241, PDF dated 2019-02-28","evidence_url":"https://eprint.iacr.org/2019/241","id":"lineage-0def4c0f3e406b92","map_relation":"lineage","predecessor":"PSI-CONTRIB-2018-PSWW-ALMOST-LINEAR-CIRCUIT","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"PSTY19 reduces the \\( \\omega(n) \\) comparisons of the PSWW18 construction, \\( s \\cdot n \\) of which serve a stash of size \\( \\omega(1) \\), to \\( O(n) \\) comparisons and linear communication.","successor":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"PSTY19 Protocol 9 (p. 17) and Protocol 10 (p. 20), IACR ePrint 2019/241, PDF dated 2019-02-28","evidence_url":"https://eprint.iacr.org/2019/241","id":"lineage-4722b5b9a6638b7a","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"The linear-communication circuit-PSI programs the batched OPPRF so that all of a bin's items share one target, leaving one comparison per bin in the circuit.","successor":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION"},{"change_dimensions":["functionality","mechanism"],"evidence_locator":"PSTY19 §6 (pp. 21-22), IACR ePrint 2019/241, PDF dated 2019-02-28","evidence_url":"https://eprint.iacr.org/2019/241","id":"lineage-b3a480c7eb8c3533","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"Payloads are injected with a second batched OPPRF whose targets differ per item, XORing the bin mask with each item's payload.","successor":"PSI-CONTRIB-2019-PSTY-PAYLOAD"},{"change_dimensions":["functionality","security"],"evidence_locator":"Ion et al. §3.1 (p. 5) and §4.2 (p. 8), IACR ePrint 2019/723, PDF dated 2020-09-05","evidence_url":"https://eprint.iacr.org/2019/723","id":"lineage-836365ea34b95723","map_relation":"lineage","predecessor":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"Ion et al. extend the shuffled commutative-exponentiation intersection-cardinality protocol of Huberman, Franklin, and Hogg with additively homomorphic tags so that one party also learns the sum of values over the intersection.","successor":"PSI-CONTRIB-2020-ION-DDH-INTERSECTION-SUM"},{"change_dimensions":["functionality","mechanism"],"evidence_locator":"Ion et al. §4.3.1 (p. 9) and §5.1 (p. 11), IACR ePrint 2019/723, PDF dated 2020-09-05","evidence_url":"https://eprint.iacr.org/2019/723","id":"lineage-9fc2d85efb9b629c","map_relation":"lineage","predecessor":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"The random-OT protocol follows the batched-OPRF PSI of KKRT16, with its batched random OT, and adds a shuffle and re-masking of the OPRF outputs plus homomorphic tags so that the intersection stays hidden while its sum is computed.","successor":"PSI-CONTRIB-2020-ION-ROT-INTERSECTION-SUM"},{"change_dimensions":["efficiency","mechanism"],"evidence_locator":"PRTY20 §1.1 (pp. 2-3); Table 1 (p. 21); Table 2 (p. 24); Appendix D (pp. 34-35), IACR ePrint 2020/193, PDF dated 2020-02-16","evidence_url":"https://eprint.iacr.org/2020/193","id":"lineage-96e8f62d6e94dc76","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-RR-CCS-MALICIOUS-DUAL-EXECUTION","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"PaXoS-PSI improves on the communication of Rindal-Rosulek dual-execution malicious PSI from \\( O(\\kappa n \\log n) \\) to \\( O(\\kappa n) \\), replacing hashing into small bins with a PaXoS encoding over OOS; for \\( 2^{20} \\) items it reports 202.04 MB against 22,183 MB for the dual-execution variant with 64-bit items and 1,322 MB for the encode-commit variant.","successor":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI"},{"change_dimensions":["model","functionality"],"evidence_locator":"BMRR §1.1 (p. 2) and §2.3 (p. 6), IACR ePrint 2020/600, PDF dated 2021-02-25","evidence_url":"https://eprint.iacr.org/2020/600","id":"lineage-070dcfa004ed7065","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","relation_basis":"model_relation","relation_type":"GENERALIZES","review_status":"fulltext_checked","statement":"BMRR generalize the two-party threshold PSI functionality of GS19 to two multiparty functionalities that coincide for two parties.","successor":"PSI-CONTRIB-2021-BMRR-FUNCTIONALITIES"},{"change_dimensions":["model","bounds"],"evidence_locator":"BMRR Theorems 4.1 and 4.3 with proofs (pp. 15-17), IACR ePrint 2020/600, PDF dated 2021-02-25","evidence_url":"https://eprint.iacr.org/2020/600","id":"lineage-8f1e048f1e7a07d9","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-GS-LOWER-BOUND","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"theorem_checked","statement":"BMRR derive the per-party \\( \\Omega(T) \\) and total \\( \\Omega(nT) \\) bounds for multiparty threshold PSI by reducing from the two-party \\( \\Omega(T) \\) bound of GS19.","successor":"PSI-CONTRIB-2021-BMRR-LOWER-BOUND"},{"change_dimensions":["mechanism","efficiency","model"],"evidence_locator":"BMRR abstract (p. 1), §1.2 (p. 4), §3.3-3.4 (pp. 12-14), Imported Theorem 6.4 (p. 27), IACR ePrint 2020/600, PDF dated 2021-02-25","evidence_url":"https://eprint.iacr.org/2020/600","id":"lineage-8b73bf32498a9b11","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"BMRR keep the monomial encoding, Hankel sparsity test, and noisy-polynomial intersection step of GS19 and replace the general singularity test with a Hankel-specific half-GCD test, lowering two-party communication from \\( \\tilde O(T^{2}) \\) to \\( \\tilde O(T) \\) without FHE.","successor":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI"},{"change_dimensions":["model","mechanism","assumption"],"evidence_locator":"BMRR §3.1 (pp. 11-12) and §5.1 (p. 17), IACR ePrint 2020/600, PDF dated 2021-02-25","evidence_url":"https://eprint.iacr.org/2020/600","id":"lineage-2e6f650b8dada84d","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-GS-FHE-UPPER-BOUND","relation_basis":"technical_dependency","relation_type":"GENERALIZES","review_status":"fulltext_checked","statement":"BMRR start from the two-party FHE protocol of GS19 and generalize it to n parties under threshold FHE, adding random linear factors against unexpected degree reduction.","successor":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"CMGD21 §1.2 (p. 3) and §3.1 (pp. 11-12), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidence_url":"https://eprint.iacr.org/2021/1116","id":"lineage-528421ca432349cf","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"CMGD21 lowers the number of encrypted query powers from \\( O(\\log B) \\), as with CLR17 windowing, to \\( O(1) \\) using depth-free Frobenius operations, reducing communication from \\( \\tilde O(2^{C} C^{2}) \\) to \\( \\tilde O(C^{2}) \\) with \\( C = \\log \\log |X| \\).","successor":"PSI-CONTRIB-2021-CONG-FROBENIUS-POWERS"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"CMGD21 §1.2 (p. 3) and §3.1 (pp. 7-8), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidence_url":"https://eprint.iacr.org/2021/1116","id":"lineage-65a70e917a1cc8fd","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"CMGD21 replaces computing all powers up to the partition size, as in the CLR17 framework retained by CHLR18, with Paterson-Stockmeyer evaluation, reducing non-scalar multiplications per bin from linear to \\( O(\\sqrt{B}) \\).","successor":"PSI-CONTRIB-2021-CONG-PATERSON-STOCKMEYER"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"CMGD21 §1.2 (p. 3) and §3.1 (pp. 9-10), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidence_url":"https://eprint.iacr.org/2021/1116","id":"lineage-25b43e120f5b9601","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-CLR-FHE-SUBLINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"CMGD21 replaces the windowing introduced by CLR17 with extremal postage-stamp bases, sending fewer encrypted powers for the same depth.","successor":"PSI-CONTRIB-2021-CONG-POSTAGE-STAMP-BASES"},{"change_dimensions":["mechanism","functionality"],"evidence_locator":"CMGD21 §4.1-4.2 (pp. 12-14), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidence_url":"https://eprint.iacr.org/2021/1116","id":"lineage-a67fa82303c657d4","map_relation":"lineage","predecessor":"PSI-CONTRIB-2018-CHLR-LABELED-PSI","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"CMGD21 builds its labeled mode on the CHLR18 approach of encrypting labels under part of the OPRF output and interpolating the encrypted labels, adapting it to prime-field chunks.","successor":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"CMGD21 §1.2 (p. 3) and §3.1 (p. 7), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidence_url":"https://eprint.iacr.org/2021/1116","id":"lineage-c3a017a9aca35633","map_relation":"lineage","predecessor":"PSI-CONTRIB-2018-CHLR-LONG-ITEMS","relation_basis":"technical_dependency","relation_type":"CHANGES_MECHANISM","review_status":"fulltext_checked","statement":"CMGD21 replaces the extension-field SIMD slots that CHLR18 used for arbitrary-length items with items split over prime-field slots.","successor":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"},{"change_dimensions":["mechanism","security"],"evidence_locator":"CMGD21 §3 (p. 6) and §3.1 (p. 7), IACR ePrint 2021/1116, PDF dated 2021-11-14","evidence_url":"https://eprint.iacr.org/2021/1116","id":"lineage-1dae74f2df556960","map_relation":"lineage","predecessor":"PSI-CONTRIB-2018-CHLR-OPRF-MALICIOUS-RECEIVER","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"Prime-field slots are safe only because CMGD21 makes the CHLR18 OPRF step mandatory: partial matches of OPRF outputs reveal nothing about the sender's items.","successor":"PSI-CONTRIB-2021-CONG-PRIME-FIELD-SLOTS"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"GPRTY21 §3 (p. 9); §4.1 (pp. 9-11); Figure 1 (p. 8); Table 2 (p. 29), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-9776324dddfe7562","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"The three-hash table generalizes the PaXoS garbled cuckoo table from two to three hash functions, keeping its \\( L \\| R \\) treatment of the 2-core, and reduces the main table from about \\( 2.4n \\) to \\( 1.3n \\) positions.","successor":"PSI-CONTRIB-2021-GPRTY-3H-GCT"},{"change_dimensions":["efficiency"],"evidence_locator":"GPRTY21 §6.3 (p. 19); §8.2 (p. 23); Table 1 (p. 24), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-eba35b0f9f6f4147","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"Used as the binary OKVS of PaXoS-PSI, the three-hash table reduces the malicious protocol's communication 1.61 times for \\( 2^{20} \\) items, because \\( 1.3n \\) OTs replace \\( 2.4n \\).","successor":"PSI-CONTRIB-2021-GPRTY-3H-GCT"},{"change_dimensions":["bounds"],"evidence_locator":"GPRTY21 §1.2 (p. 3); §5 (p. 13), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-73d3fe634ac87be8","map_relation":"related_work","predecessor":"PSI-CONTRIB-2018-PSZ-HASHING-PARAMETERS","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"GPRTY21 responds to the practice, as in PSZ18, of extrapolating cuckoo-hashing failure probabilities from large experiments, by amplifying an empirically validated OKVS failure rate instead.","successor":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION"},{"change_dimensions":["mechanism"],"evidence_locator":"GPRTY21 §7.1 (pp. 20-21); Figure 3 (p. 22), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-698116b09433ed65","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","relation_basis":"technical_dependency","relation_type":"GENERALIZES","review_status":"fulltext_checked","statement":"The generalized protocol adapts PaXoS-PSI to any linear OKVS by replacing the OOS correlation with vector OLE, which removes the error-correcting code.","successor":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE"},{"change_dimensions":["mechanism"],"evidence_locator":"GPRTY21 §6.2 (p. 19), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-741391457e2cc568","map_relation":"related_work","predecessor":"PSI-CONTRIB-2021-RS-VOLE-OPRF","relation_basis":"analysis","relation_type":"GENERALIZES","review_status":"fulltext_checked","statement":"GPRTY21 observes that the VOLE-PSI OPRF combines vector OLE with PaXoS and that any OKVS can replace PaXoS there; its own vector-OLE protocol is derived from PaXoS-PSI.","successor":"PSI-CONTRIB-2021-GPRTY-LINEAR-OKVS-VOLE"},{"change_dimensions":["security"],"evidence_locator":"GPRTY21 §7.2 (pp. 21-22); Appendix B.2 (p. 30); Appendix B.6 (pp. 36-37), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-dc3a7ca50bb927ee","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","relation_basis":"analysis","relation_type":"HARDENS","review_status":"fulltext_checked","statement":"GPRTY21 shows that this protocol, with each OPRF output hashed together with the item by a random oracle and written over any OKVS, is secure against malicious adversaries.","successor":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY"},{"change_dimensions":["model"],"evidence_locator":"GPRTY21 §1.1 (p. 3); §2.1-2.3 (pp. 5-6), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-0453843ff38af71e","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-PAXOS","relation_basis":"model_relation","relation_type":"GENERALIZES","review_status":"fulltext_checked","statement":"The OKVS definition generalizes PaXoS from binary to linear and other key-value encodings and makes obliviousness explicit; a binary OKVS is a PaXoS.","successor":"PSI-CONTRIB-2021-GPRTY-OKVS"},{"change_dimensions":["bounds","model"],"evidence_locator":"GPRTY21 §2.4, Definition 4 and Lemma 5 (pp. 6-7), IACR ePrint 2021/883, PDF dated 2021-11-30","evidence_url":"https://eprint.iacr.org/2021/883","id":"lineage-4e8bd40dca6099cc","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","relation_basis":"analysis","relation_type":"GENERALIZES","review_status":"fulltext_checked","statement":"GPRTY21 observes that the PaXoS bound on encodable random-oracle values uses only correctness, restates it for any key-value store, and formalizes it as the (n, n')-overfitting game.","successor":"PSI-CONTRIB-2021-GPRTY-OKVS"},{"change_dimensions":["mechanism"],"evidence_locator":"NTY §2.0.4 (p. 5), Protocols 3.1 and 3.3 (pp. 6, 8), proof of Theorem 3.2 (p. 7), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidence_url":"https://eprint.iacr.org/2021/1221","id":"lineage-e30c3d24b38d82d6","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-GPRTY-OKVS","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"P1 and the other senders encode their items with PRF values in OKVSs, whose obliviousness the simulation uses to replace them with random encodings.","successor":"PSI-CONTRIB-2021-NTY-MALICIOUS-NO-COLLUSION"},{"change_dimensions":["mechanism","security"],"evidence_locator":"NTY §2.0.5 (p. 5), §4.1 and Protocol 4.2 (p. 10), Protocol C.1 (p. 14), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidence_url":"https://eprint.iacr.org/2021/1221","id":"lineage-46c19ee7b09578d5","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-KMPRT-AUGMENTED-ZERO-SHARING","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"ZeroXOR masks each OPPRF-programmed value with the unconditional zero-sharing of KMPRT, which NTY restate as a functionality and protocol, and uses it against a malicious adversary.","successor":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"},{"change_dimensions":["mechanism","security"],"evidence_locator":"NTY §2 (pp. 4-5), Protocol 4.2 (p. 10), §5 (p. 11), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidence_url":"https://eprint.iacr.org/2021/1221","id":"lineage-db788b4715088ef0","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-KMPRT-OPPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"NTY take the OPPRF definitions almost verbatim from KMPRT and run an OPPRF from each of t parties to P_n inside ZeroXOR.","successor":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"},{"change_dimensions":["efficiency","security"],"evidence_locator":"NTY §5.1 and Tables 3-4 (pp. 11-12), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidence_url":"https://eprint.iacr.org/2021/1221","id":"lineage-5fd7ca4f8463dedb","map_relation":"related_work","predecessor":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"NTY report 10-23 times lower client running time and 1.2-8.5 times lower total running time than the semi-honest KMPRT protocol, while being maliciously secure.","successor":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"},{"change_dimensions":["mechanism","security"],"evidence_locator":"NTY §1.1.1 (p. 2), §2.0.3 (p. 5), Appendix B (p. 14), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidence_url":"https://eprint.iacr.org/2021/1221","id":"lineage-cef3580c527592e5","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"NTY instantiate the OPPRF of ZeroXOR with the maliciously secure PaXoS-based OPPRF, which resists a sender that programs a point in only some cuckoo bins.","successor":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"},{"change_dimensions":["model","efficiency"],"evidence_locator":"NTY §1.1.1 (p. 2), §1.2 (p. 4), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidence_url":"https://eprint.iacr.org/2021/1221","id":"lineage-0fac68423298eae5","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-GPRTY-MALICIOUS-MULTIPARTY","relation_basis":"result_progression","relation_type":"GENERALIZES","review_status":"fulltext_checked","statement":"At \\( t = n - 1 \\) the NTY protocol coincides with that of Garimella et al. up to the OKVS instantiation, with the same performance; for smaller t it removes clients from the zero test and becomes cheaper.","successor":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"NTY §2.0.4 (p. 5), Protocol 4.4 (p. 10), §5 (p. 11), IACR ePrint 2021/1221, PDF dated 2021-09-17","evidence_url":"https://eprint.iacr.org/2021/1221","id":"lineage-a9634dc398e628bd","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-GPRTY-OKVS","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"Each client sends the pivot a single OKVS encoding its items instead of running pairwise OPPRFs, using the OKVS definition of Garimella et al. and PaXoS as the instance they prove oblivious.","successor":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED"},{"change_dimensions":["mechanism"],"evidence_locator":"RS21 §1.4 (p. 6); §5 (p. 21); §6 (p. 22), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-4fc4a35d22101861","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-PSTY-BATCHED-OPPRF","relation_basis":"technical_dependency","relation_type":"CHANGES_MECHANISM","review_status":"fulltext_checked","statement":"VOLE-PSI replaces the polynomial-interpolation OPPRF of PSTY19 with an OPPRF built from the VOLE-based OPRF and a XoPaXoS encoding of the sender's corrections.","successor":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"RS21 §1.4 (p. 6); §6 (pp. 22-23); Table 4 (p. 29), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-0ff462a047ca0607","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-PSTY-LINEAR-COMMUNICATION","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"VOLE-PSI's circuit-PSI keeps the PSTY19 protocol and replaces its polynomial-based OPPRF with one built from the VOLE OPRF and XoPaXoS; for \\( 2^{20} \\) items it runs in 23.3 s against 72.0 s at 5 Gbps with IKNP-based GMW.","successor":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI"},{"change_dimensions":["mechanism","security"],"evidence_locator":"RS21 §2 (pp. 10-11); Figure 1 (p. 7); Theorem 5.1 (pp. 21-22), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-9e26696acbc5e0a8","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"XoPaXoS modifies the PaXoS solver to sample its free positions at random, so that the encoding is uniform for uniform values, as the OPPRF requires.","successor":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI"},{"change_dimensions":["mechanism"],"evidence_locator":"RS21 §5 (p. 21); Figure 8 (p. 38), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-14297ff53e72a7bf","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-RS-VOLE-OPRF","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"The OPPRF of the circuit-PSI is built on the VOLE-based OPRF of the same paper.","successor":"PSI-CONTRIB-2021-RS-CIRCUIT-PSI"},{"change_dimensions":["efficiency","bounds"],"evidence_locator":"RS21 §1.3 (p. 5); §4 (pp. 19-20); §7.1 (p. 26), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-605cd18d47979688","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"VOLE-PSI shows that the \\( 2\\kappa \\)-bit sender values required by the PaXoS-PSI analysis can be reduced to κ bits by extracting only non-colliding OPRF queries.","successor":"PSI-CONTRIB-2021-RS-SHORT-OPRF-OUTPUTS"},{"change_dimensions":["mechanism"],"evidence_locator":"RS21 §1.1 (p. 2); §2 (pp. 9-10); Figure 4 (p. 36), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-c043f2aa142d313f","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-GARBLED-CUCKOO","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"The VOLE-based OPRF encodes the receiver's set with the PaXoS solver with \\( 2.4n \\) main positions.","successor":"PSI-CONTRIB-2021-RS-VOLE-OPRF"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"RS21 §1.4 (p. 6); §7.1 (pp. 25-26); Table 1 (p. 25); Table 3 (p. 29), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-bd30927b213231d4","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-MALICIOUS-PAXOS-PSI","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"VOLE-PSI builds on PaXoS-PSI but replaces OT extension with sublinear VOLE, sending κ rather than about \\( 5\\kappa \\) bits per encoding position with malicious security; for \\( 2^{20} \\) items it reports 57.86 MB against 247.6 MB.","successor":"PSI-CONTRIB-2021-RS-VOLE-OPRF"},{"change_dimensions":["bounds","security"],"evidence_locator":"RS21 §2, Eq. (1) and Conjecture 2.1 (pp. 11-12); Lemma 3.3 (p. 18), IACR ePrint 2021/266, PDF dated 2024-08-08","evidence_url":"https://eprint.iacr.org/2021/266","id":"lineage-62cdf0ea71eefa1e","map_relation":"lineage","predecessor":"PSI-CONTRIB-2020-PRTY-RECEIVER-SET-SIZE-BOUND","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_RESULT","review_status":"fulltext_checked","statement":"The malicious-receiver proof of the VOLE-based OPRF uses the PaXoS bound to limit the receiver's effective set to \\( O(n) \\), and conjectures a tighter bound of m.","successor":"PSI-CONTRIB-2021-RS-VOLE-OPRF"},{"change_dimensions":["efficiency","mechanism"],"evidence_locator":"RT21 §1 (p. 2), §1.2 (pp. 5-6), Table 1 (p. 4), IACR ePrint 2021/1159, version of October 17, 2021","evidence_url":"https://eprint.iacr.org/2021/1159","id":"lineage-d4ab8c47f1ca8dba","map_relation":"lineage","predecessor":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"RT21's semi-honest variants send one key-agreement message, one field element per receiver item, and one short key per sender item, against the classic Diffie-Hellman protocol's group element per item in both directions, which RT21 names as the protocol it improves.","successor":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"},{"change_dimensions":["efficiency","security","mechanism"],"evidence_locator":"RT21 abstract (p. 1), §1 (p. 2), §1.2 (pp. 5-6), IACR ePrint 2021/1159, version of October 17, 2021","evidence_url":"https://eprint.iacr.org/2021/1159","id":"lineage-a052f17ae9f06e23","map_relation":"lineage","predecessor":"PSI-CONTRIB-1999-HFH-DH-PREFERENCE-MATCHING","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"RT21 present their malicious protocol as an improvement of the classic Diffie-Hellman protocol of Huberman, Franklin, and Hogg: \\( n + 1 \\) group elements plus n hashes against \\( 2n \\) group elements plus n hashes, while security rises from semi-honest to malicious.","successor":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI"},{"change_dimensions":["security","efficiency"],"evidence_locator":"RT21 Appendix A.1 (pp. 23-24) and A.2 (p. 26), IACR ePrint 2021/1159, version of October 17, 2021","evidence_url":"https://eprint.iacr.org/2021/1159","id":"lineage-b4ddfe31e1841958","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-RT-KA-TO-MALICIOUS-PSI","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"The semi-honest variants keep the malicious protocol's structure and drop the random oracles H1 and H2 used only for extraction, shortening the sender's keys; variant 2 also drops the ideal permutation.","successor":"PSI-CONTRIB-2021-RT-SEMI-HONEST-DH-COMMUNICATION"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"RR22 §1.2 (p. 4); §4 (pp. 21-23); Figure 9 (p. 23); Table 2 (p. 25), IACR ePrint 2022/320, PDF dated 2022-11-02","evidence_url":"https://eprint.iacr.org/2022/320","id":"lineage-b879ec007f77e33b","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-RS-VOLE-OPRF","relation_basis":"technical_dependency","relation_type":"EXTENDS","review_status":"fulltext_checked","statement":"Raghuraman and Rindal extend the VOLE-PSI protocol to subfield VOLE, so that the OKVS lives in a base field of about \\( \\lambda + \\log(n_x n_y) \\) bits; for \\( 2^{20} \\) items they report \\( 180n \\) bits against \\( 426n \\).","successor":"PSI-CONTRIB-2022-RR-SUBFIELD-VOLE"},{"change_dimensions":["efficiency"],"evidence_locator":"RR22 abstract (p. 1); §1 (p. 2); Table 2 (p. 25), IACR ePrint 2022/320, PDF dated 2022-11-02","evidence_url":"https://eprint.iacr.org/2022/320","id":"lineage-d0fccaee3053d2f3","map_relation":"related_work","predecessor":"PSI-CONTRIB-2016-KKRT-ITEM-LENGTH-INDEPENDENT-PSI","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"With the new OKVS, RR22's fast semi-honest PSI runs in 369 ms for \\( 2^{20} \\) items against 2,073 ms for KKRT16 on the same laptop.","successor":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"RR22 §1 (p. 3); §5.1 and Table 1 (pp. 23-25), IACR ePrint 2022/320, PDF dated 2022-11-02","evidence_url":"https://eprint.iacr.org/2022/320","id":"lineage-b46ee6d66c9a2848","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-GPRTY-3H-GCT","relation_basis":"technical_dependency","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"The triangulation OKVS keeps weight-3 rows but replaces the three-hash table's wholesale 2-core solving and two traversals by greedy triangulation with a few dense columns; encoding \\( 2^{20} \\) items is 13 times faster and the expansion is 1.23 rather than 1.3.","successor":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS"},{"change_dimensions":["bounds","efficiency"],"evidence_locator":"RR22 §5.1 (p. 24), IACR ePrint 2022/320, PDF dated 2022-11-02","evidence_url":"https://eprint.iacr.org/2022/320","id":"lineage-612ef1c09bbffca4","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-GPRTY-AMPLIFICATION","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"Raghuraman and Rindal argue that the empirical 2-core bound behind the star instantiation is in error, likely costing a few bits (λ about 27 rather than 29), and replace amplification by direct parameter selection at expansion 1.23 to 1.28 instead of 1.32.","successor":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS"},{"change_dimensions":["mechanism"],"evidence_locator":"RR22 §1 (p. 2); Appendix A.1-A.2, Definitions 1-3 and Theorems 1-2 (pp. 30-31), IACR ePrint 2022/320, PDF dated 2022-11-02","evidence_url":"https://eprint.iacr.org/2022/320","id":"lineage-128b7a41410a1e58","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-GPRTY-OKVS","relation_basis":"model_relation","relation_type":"INSTANTIATES","review_status":"fulltext_checked","statement":"The triangulation construction is a linear OKVS in the sense of the OKVS abstraction, and RR22 adds a doubly oblivious variant for circuit PSI.","successor":"PSI-CONTRIB-2022-RR-TRIANGULATION-OKVS"},{"change_dimensions":["efficiency","model"],"evidence_locator":"GS23 abstract (p. 1), §1 (p. 1), §1.2 (p. 2), and Corollary 6 (p. 16), IACR ePrint 2023/919, PDF dated 2023-06-12","evidence_url":"https://eprint.iacr.org/2023/919","id":"lineage-42288aa8e99943ea","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","relation_basis":"result_progression","relation_type":"IMPROVES_EFFICIENCY","review_status":"fulltext_checked","statement":"GS23 reuses the GS19 step for computing a large intersection and replaces the quadratic dependence on t of cardinality testing from additive HE by a quasilinear one, now for ℓ parties.","successor":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR"},{"change_dimensions":["functionality","model"],"evidence_locator":"GS23 §1 (pp. 1-2), IACR ePrint 2023/919, PDF dated 2023-06-12","evidence_url":"https://eprint.iacr.org/2023/919","id":"lineage-63817c8ab90c5205","map_relation":"related_work","predecessor":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"GS23 note that the BMRR \\( \\tilde O(\\lambda \\ell t) \\) protocol without FHE is equivalent to two-party threshold PSI for \\( \\ell = 2 \\) but for \\( \\ell > 2 \\) requires fewer than t distinct elements outside the intersection among all sets, a condition GS23's large-intersection protocol does not impose.","successor":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR"},{"change_dimensions":["assumption","efficiency"],"evidence_locator":"GS23 §1 (pp. 1-2) and Corollary 6 (p. 16), IACR ePrint 2023/919, PDF dated 2023-06-12","evidence_url":"https://eprint.iacr.org/2023/919","id":"lineage-bfaadfb3ca2a988a","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-BMRR-TFHE-UPPER-BOUND","relation_basis":"result_progression","relation_type":"CHANGES_ASSUMPTION","review_status":"fulltext_checked","statement":"For the large-intersection condition, where BMRR reach \\( O(nT) \\) only from threshold FHE, GS23 reach \\( O(\\lambda^{2} \\ell t \\,\\mathrm{polylog}\\, t) \\) from oblivious transfer or additively homomorphic encryption, at an extra security-parameter and polylog factor.","successor":"PSI-CONTRIB-2023-GS-MULTIPARTY-QUASILINEAR"},{"change_dimensions":["mechanism","efficiency"],"evidence_locator":"GS23 §1.2 (p. 2) and §3.1 (p. 10), IACR ePrint 2023/919, PDF dated 2023-06-12","evidence_url":"https://eprint.iacr.org/2023/919","id":"lineage-2f15e77caaa6eb7b","map_relation":"lineage","predecessor":"PSI-CONTRIB-2019-GS-AHE-THRESHOLD-PSI","relation_basis":"technical_dependency","relation_type":"BUILDS_ON_MECHANISM","review_status":"fulltext_checked","statement":"GS23 follows the GS19 split into a cardinality test and an intersection step, and instantiates the inner two-party test of its compiler with the GS19 cardinality test, adapted to secret-shared output and run at logarithmic thresholds.","successor":"PSI-CONTRIB-2023-GS-PICT-COMPILER"},{"change_dimensions":["efficiency"],"evidence_locator":"GS23 §1.3, paper outline paragraph, and footnote 5 (p. 4), IACR ePrint 2023/919, PDF dated 2023-06-12","evidence_url":"https://eprint.iacr.org/2023/919","id":"lineage-10580478e94614d6","map_relation":"related_work","predecessor":"PSI-CONTRIB-2021-BMRR-TAHE-THRESHOLD-PSI","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"GS23 credit the two-party \\( O(\\lambda t \\,\\mathrm{polylog}\\, t) \\) bound without FHE to the GS19 construction combined with an observation of BMRR, and say their own two-party protocol does not improve on it asymptotically.","successor":"PSI-CONTRIB-2023-GS-PICT-COMPILER"},{"change_dimensions":["efficiency"],"evidence_locator":"VCE Table 3 (p. 13) and Appendix B.2 (p. 18), IACR ePrint 2023/1777, PDF dated 2023-11-16","evidence_url":"https://eprint.iacr.org/2023/1777","id":"lineage-7e35b01d2529eaf2","map_relation":"lineage","predecessor":"PSI-CONTRIB-2017-KMPRT-SYMMETRIC-KEY-MPSI","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"VCE count \\( 7(n - 1)k \\) OTs at the leader, \\( 3.5(n - 1)k \\) per assistant, and \\( 3.5(n + 1)(n - 1)k \\) in total for the KMPRT protocol, from its OPPRF calls at 3.5 OTs each.","successor":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON"},{"change_dimensions":["efficiency"],"evidence_locator":"VCE §5.3.3 (pp. 11-12), Table 3 (p. 13), Appendix B.2 (p. 18), IACR ePrint 2023/1777, PDF dated 2023-11-16","evidence_url":"https://eprint.iacr.org/2023/1777","id":"lineage-0d99af1bb0131625","map_relation":"lineage","predecessor":"PSI-CONTRIB-2021-NTY-MALICIOUS-THRESHOLD-CALIBRATED","relation_basis":"analysis","relation_type":"ANALYZES","review_status":"fulltext_checked","statement":"VCE count tk OPPRFs at the leader and k per assistant for the ZeroXOR step of NTY, 3.5tk OTs in total, and describe it as outperforming the protocols of Kolesnikov et al., Ben-Efraim et al., and Chandran et al.","successor":"PSI-CONTRIB-2024-VCE-ANALYTICAL-COST-COMPARISON"}],"rubric_version":1,"schema_version":1,"selection_policy":"semantic_contract_anchors","subfield_views":[{"collection_id":"psi_public_key","comparison_groups":[{"id":"public_key_semi_honest","label":"Semi-honest two-party protocols","reason":"Each row is proved secure against semi-honest parties; rows differ in security model (standard model for Freedman-Nissim-Pinkas, random oracle or ideal permutation for the others) and in technique, which the comparison shows.","record_ids":["PSI-CONSTRUCTION-2004-FNP-SH","PSI-CONSTRUCTION-2010-DT-FIG3","PSI-CONSTRUCTION-2010-DT-BLIND-RSA","PSI-CONSTRUCTION-2021-RT-SH-V1","PSI-CONSTRUCTION-2021-RT-SH-V2"],"row_type":"construction"},{"id":"public_key_malicious","label":"Malicious two-party protocols","reason":"Each row resists a malicious party: the Freedman-Nissim-Pinkas rows only a malicious client (standard model) or only a malicious server (random oracle model), Rosulek-Trieu a malicious sender or receiver; the adversary scope stays visible.","record_ids":["PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT","PSI-CONSTRUCTION-2004-FNP-MAL-CLIENT-NOHASH","PSI-CONSTRUCTION-2004-FNP-MAL-SERVER","PSI-CONSTRUCTION-2021-RT-MAL"],"row_type":"construction"},{"id":"public_key_no_stated_model","label":"Protocols without a stated adversary model","reason":"Huberman, Franklin, and Hogg state no adversary model or proof; the row outputs a match count to both parties, as specified.","record_ids":["PSI-CONSTRUCTION-1999-HFH","PSI-CONSTRUCTION-1999-HFH-INTERSECTION"],"row_type":"construction"}],"comparison_note":"Rows are compared as published; differences in adversary, security model, and output are shown, not normalized. The authorized PSI of De Cristofaro and Tsudik has no row.","focus_ids":[],"problem_ids":[],"problem_note":"Public-key-based protocols are rows of the goal of efficient malicious two-party PSI; its concrete problem, malicious PSI deployable for contact discovery, is drawn under unbalanced PSI and referenced here. Malicious-model versions of the linear-cost protocols of De Cristofaro and Tsudik are asked for by that paper alone, and the slack in the set size of a corrupt receiver in Rosulek and Trieu's malicious protocol is shared with the OT- and VOLE-based protocols.","related_problem_ids":["PSI-OP-011"]},{"collection_id":"psi_oprf","comparison_groups":[{"id":"oprf_semi_honest","label":"Semi-honest two-party protocols","reason":"Each row is a complete semi-honest two-party protocol that outputs the intersection, described and measured for equal set sizes; rows differ in OPRF, encoding, and security model.","record_ids":["PSI-CONSTRUCTION-2016-KKRT","PSI-CONSTRUCTION-2018-PSZ-OT","PSI-CONSTRUCTION-2020-PRTY-SH","PSI-CONSTRUCTION-2020-PRTY-SH-DFS","PSI-CONSTRUCTION-2021-RS-SH","PSI-CONSTRUCTION-2021-RS-SH-INTERPOLATION","PSI-CONSTRUCTION-2022-RR-FAST","PSI-CONSTRUCTION-2022-RR-SD"],"row_type":"construction"},{"id":"oprf_malicious","label":"Malicious two-party protocols","reason":"Each row resists malicious parties with output to one party; rows differ in security model, in how strictly a corrupt party's set size is enforced, and in whether costs were measured.","record_ids":["PSI-CONSTRUCTION-2017-RR-CCS-DE-ROM","PSI-CONSTRUCTION-2017-RR-CCS-SM","PSI-CONSTRUCTION-2017-RR-CCS-EC-ROM","PSI-CONSTRUCTION-2020-PRTY-MAL","PSI-CONSTRUCTION-2020-PRTY-MAL-DFS","PSI-CONSTRUCTION-2021-GPRTY-MAL-3HGCT","PSI-CONSTRUCTION-2021-GPRTY-MAL-STAR","PSI-CONSTRUCTION-2021-GPRTY-VOLE","PSI-CONSTRUCTION-2021-RS-MAL","PSI-CONSTRUCTION-2021-RS-MAL-INTERPOLATION","PSI-CONSTRUCTION-2022-RR-MAL"],"row_type":"construction"}],"comparison_note":"Rows are compared as published; measurements come from different machines, networks, and item lengths and are not ranked across papers.","focus_ids":[],"problem_ids":[],"problem_note":"The malicious OT- and VOLE-based protocols are the rows of the goal of efficient malicious two-party PSI that resist both parties, but they have only been run on balanced sets; its concrete problem, malicious PSI deployable for contact discovery, is drawn under unbalanced PSI and referenced here. The fastest malicious protocols bound a corrupt party's set only up to a constant factor, and conjectures about overfitting polynomials and key-value stores would tighten the bound without a common target; concrete failure probabilities of cuckoo hashing and cuckoo-style key-value stores at the parameters in use rest on experiments and extrapolation; and output to both parties under malicious security is named as a challenge without an efficiency target.","related_problem_ids":["PSI-OP-011"]},{"collection_id":"psi_circuit","comparison_groups":[{"id":"garbled_circuit_psi","label":"Garbled-circuit PSI","reason":"Each row evaluates the whole PSI computation as a semi-honest Yao garbled circuit and outputs the intersection; rows differ in circuit design and cost.","record_ids":["PSI-CONSTRUCTION-2012-HEK-SCS-WN","PSI-CONSTRUCTION-2012-HEK-SCS-SORT","PSI-CONSTRUCTION-2012-HEK-SCS-HE","PSI-CONSTRUCTION-2012-HEK-BWA","PSI-CONSTRUCTION-2012-HEK-PWC"],"row_type":"construction"},{"id":"circuit_psi_protocols","label":"Circuit-PSI","reason":"Each row is semi-honest two-party PSI whose per-bin results are secret-shared into a further circuit; rows differ in hashing, OPPRF, and the generic protocol that evaluates the circuit.","record_ids":["PSI-CONSTRUCTION-2018-PSWW-MIRROR","PSI-CONSTRUCTION-2018-PSWW-2D","PSI-CONSTRUCTION-2019-PSTY-BASIC","PSI-CONSTRUCTION-2019-PSTY-ADVANCED","PSI-CONSTRUCTION-2019-PSTY-NO-STASH","PSI-CONSTRUCTION-2021-RS-CIRCUIT","PSI-CONSTRUCTION-2021-RS-CIRCUIT-SILENT","PSI-CONSTRUCTION-2022-RR-CIRCUIT"],"row_type":"construction"},{"id":"cardinality_and_sum","label":"PSI cardinality and intersection-sum","reason":"Each row outputs the intersection size without the intersection; the Ion et al. rows also output a sum of associated values.","record_ids":["PSI-CONSTRUCTION-2004-FNP-CARDINALITY","PSI-CONSTRUCTION-2020-ION-DDH","PSI-CONSTRUCTION-2020-ION-DDH-RLWE","PSI-CONSTRUCTION-2020-ION-ROT","PSI-CONSTRUCTION-2020-ION-BF"],"row_type":"construction"},{"id":"two_party_threshold","label":"Two-party threshold PSI","reason":"Each row reveals the intersection only when the sets differ in few items, with communication governed by the threshold; rows differ in assumption (FHE, additively homomorphic encryption, or oblivious transfer) and in the factors hidden by the bounds.","record_ids":["PSI-CONSTRUCTION-2019-GS-FHE","PSI-CONSTRUCTION-2019-GS-AHE","PSI-CONSTRUCTION-2021-BMRR-AHE-TWO-PARTY","PSI-CONSTRUCTION-2023-GS-TWO-PARTY"],"row_type":"construction"},{"id":"multiparty_threshold","label":"Multiparty threshold PSI","reason":"Each row is multiparty threshold PSI against semi-honest corruption of all but one party; rows differ in the threshold condition (the two functionalities of Badrinarayanan et al., or the large-intersection condition of Ghosh and Simkin 2023) and in assumption.","record_ids":["PSI-CONSTRUCTION-2021-BMRR-TFHE-INT","PSI-CONSTRUCTION-2021-BMRR-TFHE-DIFF","PSI-CONSTRUCTION-2021-BMRR-TAHE-DIFF","PSI-CONSTRUCTION-2023-GS-MULTIPARTY"],"row_type":"construction"}],"comparison_note":"Rows are compared as published; outputs differ by group (intersection, secret shares, cardinality and sum, threshold), and lower bounds are read on the map, not as rows.","focus_ids":[],"problem_ids":["PSI-OP-005"],"problem_note":"One key problem, the last open rung of the goal of multiparty threshold PSI at optimal communication without FHE: multiparty threshold PSI whose communication matches the known lower bound without fully homomorphic encryption. Malicious security for hashing-based circuit-PSI, named open by three papers here, is claimed by protocols published after 2022 that this atlas does not yet cover, so it is not drawn as open; concretely efficient threshold PSI is named as a goal without a threshold.","related_problem_ids":[]},{"collection_id":"psi_unbalanced","comparison_groups":[{"id":"unbalanced_fhe","label":"Unbalanced PSI based on FHE","reason":"Each row has the sender evaluate the intersection homomorphically on the receiver's encrypted set, with communication sublinear in the sender's set; rows differ in adversary and implementation.","record_ids":["PSI-CONSTRUCTION-2017-CLR","PSI-CONSTRUCTION-2018-CHLR","PSI-CONSTRUCTION-2018-CHLR-MAL-LEAKAGE","PSI-CONSTRUCTION-2021-CONG","PSI-CONSTRUCTION-2021-CONG-FROBENIUS"],"row_type":"construction"},{"id":"labeled_psi","label":"Labeled PSI","reason":"Each row returns the labels the sender associates with matching items, from FHE.","record_ids":["PSI-CONSTRUCTION-2018-CHLR-LABELED","PSI-CONSTRUCTION-2021-CONG-LABELED"],"row_type":"construction"},{"id":"unbalanced_oprf","label":"Unbalanced PSI based on OPRF","reason":"Each row sends an OPRF-encrypted filter of the server set once and evaluates the OPRF online, so setup communication is linear in the server set; rows differ in the OPRF.","record_ids":["PSI-CONSTRUCTION-2019-KRSSW-GC","PSI-CONSTRUCTION-2019-KRSSW-NR"],"row_type":"construction"}],"comparison_note":"Rows are compared as published; FHE-based and OPRF-based rows place communication in different phases, which the comparison shows.","focus_ids":[],"problem_ids":["PSI-OP-001","PSI-OP-011"],"problem_note":"Two key problems of the goal of efficient malicious two-party PSI: its asymptotic rung, full security against a malicious sender while communication stays sublinear in the sender's set, and its concrete rung, malicious PSI that meets the contact-discovery requirements Signal's developers stated (\\( 10^{9} \\) users, address books of up to 10,000 contacts, lookups under 2 s).","related_problem_ids":[]},{"collection_id":"psi_multiparty","comparison_groups":[{"id":"multiparty_semi_honest","label":"Semi-honest and augmented semi-honest protocols","reason":"Each row is secure against semi-honest or augmented semi-honest parties; rows differ in collusion bound, party count, and model, which the comparison shows.","record_ids":["PSI-CONSTRUCTION-2004-FNP-MULTIPARTY","PSI-CONSTRUCTION-2017-KMPRT-SH","PSI-CONSTRUCTION-2017-KMPRT-AUG","PSI-CONSTRUCTION-2017-KMPRT-3PARTY"],"row_type":"construction"},{"id":"multiparty_malicious","label":"Malicious protocols","reason":"Each row resists malicious parties with output to one party; the corruption threshold differs, from at most one corrupted party to any strict subset.","record_ids":["PSI-CONSTRUCTION-2021-NTY-NO-COLLUSION","PSI-CONSTRUCTION-2021-NTY-ARBITRARY-COLLUSION","PSI-CONSTRUCTION-2021-GPRTY-MULTIPARTY"],"row_type":"construction"}],"comparison_note":"Rows are compared as published; collusion bound, output recipients, and party count are shown, not normalized.","focus_ids":[],"problem_ids":[],"problem_note":"No question about multiparty PSI is yet named open in a precise form. The key problem on multiparty threshold PSI without fully homomorphic encryption is drawn under circuit-based PSI and referenced here. Collusion-resistant multiparty PSI close to two-party cost is named open by one survey, strict enforcement of corrupt parties' set sizes by one paper, and malicious protocols with output to every party are named as a challenge without an efficiency target.","related_problem_ids":["PSI-OP-005"]}],"threads":[{"color":"#8b6340","description":"Commutative Diffie-Hellman, oblivious polynomial evaluation under homomorphic encryption, blind-RSA, and key-agreement protocols, the public-key-based class of Pinkas, Schneider, and Zohner.","id":"public_key_psi","label":"Public-key PSI"},{"color":"#2f718e","description":"Oblivious PRFs evaluated with OT extension or precomputed OTs: the Pinkas-Schneider-Zohner paradigm, the batched OPRF of Kolesnikov et al., dual execution, and OPRF-based unbalanced PSI with precomputation.","id":"ot_extension_oprf","label":"OT extension and OPRFs"},{"color":"#4f7b60","description":"Key-value encodings (PaXoS, garbled cuckoo tables, OKVS) and the vector-OLE OPRFs built on them, for semi-honest and malicious two-party PSI.","id":"paxos_okvs_vole","label":"PaXoS, OKVS, and VOLE"},{"color":"#73549a","description":"Generic secure computation of PSI and of functions of the intersection, from sort-compare-shuffle circuits to hashing-based circuits and OPPRF-based circuit-PSI.","id":"circuit_psi","label":"Circuit-based PSI"},{"color":"#a34e48","description":"Threshold PSI and its communication bounds, from the disjointness-based lower bound through Ghosh-Simkin to multiparty threshold PSI.","id":"threshold_psi","label":"Threshold PSI"},{"color":"#9a6c2d","description":"Unbalanced and labeled PSI in which the sender evaluates the intersection homomorphically on the receiver's encrypted set, with communication sublinear in the larger set.","id":"fhe_unbalanced","label":"FHE-based unbalanced PSI"},{"color":"#2f7d77","description":"Zero-sharing among more than two parties delivered through oblivious programmable PRFs or OKVS encodings, and analyses of these protocols.","id":"multiparty_opprf_okvs","label":"Multiparty PSI from OPPRF and OKVS"}]},"stats":{"attributeAssertions":587,"constructions":72,"costAssertions":495,"countsByType":{"assumption":45,"construction":72,"goal":2,"open_problem":11,"paper":26,"result":70},"entities":228,"lineageRelationships":69,"propertyAssertions":274,"relationships":444,"unresolvedReferences":0},"unresolved":[],"sourceCommit":"v0.6.0","sourceBoundary":"Published literature snapshot"}