Avishay Yanai

Distributed point functions (DPF) are increasingly becoming a foundational tool with applications for application-specific and general secure computation. While two-party DPF constructions are readily available for those applications with satisfiable performance, the three-party ones are left behind in both security and efficiency. In this paper we close this gap and propose the first three-party DPF construction that matches the state-of-the-art two-party DPF on all metrics. Namely, it is secure against a malicious adversary corrupting both the dealer and one out of the three evaluators, its function's shares are of the same size and evaluation takes the same time as in the best two-party DPF. Compared to the state-of-the-art three-party DPF, our construction enjoys 40-120× smaller function's share size and shorter evaluation time, for function domains of 2¹⁶ -2⁴⁰, respectively. Apart from DPFs as a stand-alone tool, our construction finds immediate applications to private information retrieval (PIR), writing (PIW) and oblivious RAM (ORAM). To further showcase its applicability, we design and implement an ORAM with access policy, an extension to ORAMs where a policy is being checked before accessing the underlying database. The policy we plug-in is the one suitable for account-based digital currencies, and in particular to central bank digital currencies (CBDCs). Our protocol offers the first design and implementation of a large scale privacy-preserving account-based digital currency. While previous works supported anonymity sets of 64-256 clients and less than 10 transactions per second (tps), our protocol supports anonymity sets in the millions, performing {500,200,58} tps for anonymity sets of {2¹⁶, 2¹⁸, 2²⁰}, respectively. Toward that application, we introduce a new primitive called updatable DPF, which enables a direct computation of a dot product between a DPF and a vector; we believe that updatable DPF and the new dot-product protocol will find interest in other applications.

The security and usability of cryptocurrencies and other blockchain-based applications depend on the secure management of cryptographic keys. However, current approaches for managing these keys often rely on third parties, trusted to be available at a minimum, and even serve as custodians in some solutions, creating single points of failure and limiting the ability of users to fully control their own assets. In this work we first revisit the problem of threshold ECDSA by considering the commonly admissible 'server-aided' model, namely, the presence of a semi-honest and non-colluding service provider. Then, we leverage that model and consider cases where that 'server' is distributed, introducing the novel concept of unstoppable wallets; hence eliminating any single point of failure. Unstoppable wallets are programmable threshold ECDSA wallets that allow users to co-sign transactions with a confidential smart contract, rather than a singular third-party. We construct highly efficient threshold ECDSA protocols that form the basis of unstoppable wallets and prove their security in the server-aided model, achieving the standard notion of fairness and robustness even in case of a dishonest majority among the signers. Our protocols minimize the write-complexity for threshold ECDSA key-generation and signing, while reducing communication and computation overhead. We provide a proof-of-concept implementation of these protocols, written in a smart contract language, deployed on the Secret Network - a blockchain that plays the role of the server. Using that deployment, we showcase the protocols' applicability for two interesting applications, policy checking and wallet exchange, as well as their efficiency by demonstrating low gas costs and fees.