3

Say Bob and Alice are trying to figure out the fruits they like, but don't want to reveal the fruits they dislike. How could they compare their list of liked fruits and reveal only the common set to the other person?

In this scenario, each party knows the full list of possible fruits to pick from. (It's shared information.) But if one person likes a fruit and the other doesn't, the person who doesn't like the fruit shouldn't know that the other does like it. There can't be a third party involved, so this operation needs to happen without sharing information outside of these two people.

Example fruit set: [apple, banana, grape]. (1 indicates interest, 0 indicates disinterest.)

Bob's selection: [1, 1, 0].

Alice's selection: [0, 1, 0].

In this case, how can Bob and Alice figure out that the shared answer set is [0, 1, 0]?

Bob doesn't want to share that he likes apples, because it wasn't a shared interest. (An odd scenario, but it works for the sake of this example...) And from Alice's perspective, she doesn't know anything about Bob's preference for apples or grapes, because she indicated that she doesn't like those. Similarly, Bob doesn't know anything about Alice's preference for grapes, because he indicated that he's not interested in grapes.

Because they don't want to share their preferences with a third party, they want to find a way to find the common set themselves without revealing disinterest. Is this possible?

I'm not well versed in cryptography, but it seems like private set intersection may be what I'm looking for? Is this the right direction?

saucewaffle
  • 31
  • 2

1 Answers1

2

I'm not well versed in cryptography, but it seems like private set intersection may be what I'm looking for?

Yes. In private set intersection (PSI) if we have elements from a universe $U$ (e.g. the set of 128 bit integers) and Alice has $N_A$ elements and Bob has $N_B$ elements, most good PSI protocols will try to give you $O(N_A+N_B)$ communication and computation complexity. However, if $|U|\approx N_A\approx N_B$, e.g. when you have a dictionary of 100 fruits most of which are liked by both parties with high probability, then there's another way to go about this. Namely you could also consider this as a generic 2-party computation of $|U|$ parallel AND gates using the bitvector encoding used in the question.

So, as a guidance:

  1. For small scales, e.g. $|U|\leq 2^8$ use setup-less PSI protocols, e.g. this DH-based one.
  2. For large scales, e.g. $|U|\geq 2^{20}$ and small set sizes, i.e. $N_A,N_B\leq \frac1{\log_2|U|}|U|$ use dedicated PSI protocols, e.g. OT-Phasing.
  3. In all other cases consider using OT-Extension based AND gate evaluation, i.e. one party entering their interest vector as the choice vector and the other party entering an all-zero vector for the zero-bits and their interest vector for the 1 bits. Then have receiver share the received bitvector with the sender.
SEJPM
  • 46,697
  • 9
  • 103
  • 214