Abstract:Private set intersection cardinality (PSI-CA) and private intersection-sum with cardinality (PSI-CA-sum) are two primitives that enable data owners to learn the intersection cardinality of their data sets, with the difference that PSI-CA-sum additionally outputs the sum of the associated integer values of all the data that belongs to the intersection (i.e., intersection-sum). However, to the best of our knowledge, all existing multi-party PSI-CA (MPSI-CA) protocols are either limited by high computational cost or face security challenges under arbitrary collusion. As for multi-party PSI-CA-sum (MPSI-CA-sum), there is even no formalization for this notion at present, not to mention secure constructions for it. In this paper, we first present an efficient MPSI-CA protocol with two non-colluding parties. This protocol significantly decreases the number of parties involved in expensive interactive procedures, leading to a significant enhancement in runtime efficiency. Our numeric results demonstrate that the running time of this protocol is merely one-quarter of the time required by our proposed MPSI-CA protocol that is secure against arbitrary collusion. Therefore, in scenarios where performance is a priority, this protocol stands out as an excellent choice. Second, we successfully construct the first MPSI-CA protocol that achieves simultaneous practicality and security against arbitrary collusion. Additionally, we also conduct implementation to verify its practicality (while the previous results under arbitrary collusion only present theoretical analysis of performance, lacking real implementation). Numeric results show that by shifting the costly operations to an offline phase, the online computation can be completed in just 12.805 seconds, even in the dishonest majority setting, where 15 parties each hold a set of size 2 16 . Third, we formalize the concept of MPSI-CA-sum and present the first realization that ensures simultaneous practicality and security against arbitrary collusion. The computational complexity of this protocol is roughly twice that of our MPSI-CA protocol. Besides the main results, we introduce the concepts and efficient constructions of two novel building blocks: multi-party secret-shared shuffle and multi-party oblivious zero-sum check, which may be of independent interest.

Efficient Non-Interactive Zero Knowledge Arguments for Set Operations.

Efficient Modular NIZK Arguments from Shift and Product

A More Efficient Computationally Sound Non-Interactive Zero-Knowledge Shuffle Argument

Improvements on Non-Interactive Zero-Knowledge Proof Systems Related to Quadratic Residuosity Languages.

Private Set Intersection for Unequal Set Sizes with Mobile Applications.

A Non-interactive Range Proof with Constant Communication.

Zero-Knowledge MIPs using Homomorphic Commitment Schemes

Compact Proofs of Partial Knowledge for Overlapping CNF Formulae

Two prover perfect zero knowledge for MIP*

Concurrently Knowledge-Extractable Resettable-ZK in the Bare Public-Key Model

Concurrent Knowledge Extraction in the Public-Key Model

Proving in Zero-Knowledge that a Number is the Product of Two Safe Primes

Practical zero-knowledge arguments from ∑-protocols

Generic and Practical Resettable Zero-Knowledge in the Bare Public-Key Model

Zeromorph: Zero-Knowledge Multilinear-Evaluation Proofs from Homomorphic Univariate Commitments

Generalized Tsirelson Inequalities, Commuting-Operator Provers, and Multi-prover Interactive Proof Systems

Constant-Round Concurrently-Secure Rzk in the (real) Bare Public-Key Model

Collaborative CP-NIZKs: Modular, Composable Proofs for Distributed Secrets

Concurrent/Resettable Zero-Knowledge with Concurrent Soundness in the Bare Public-Key Model and Its Applications.

Easy Impossibility Proofs for k-Set Agreement in Message Passing Systems

Practical multi-party private set intersection cardinality and intersection-sum protocols under arbitrary collusion1