I couldn’t sleep last night so there’s got to be a better title

Alice and Bob (and maybe even Charlie!) want to find common preferences. However, they’re each ashamed of some of their preferences.

Each are only comfortable with another knowing a preference of theirs if that preference is shared by everyone at the table. They also don’t want gossipy Mallory to run a third-party check for them - this has to be possible without trusting anyone or any program with access to the secret data of others. Assume Alice and Bob may be tempted to try and find each others’ secret preferences.

For example:

  • Alice likes Anime, Comedy, Fantasy, Romance, Thriller

  • Bob likes Anime, Drama, Horror, Romance, Thriller

  • Alice is worried Bob will judge their interest in Anime and Fantasy

  • Bob is scared Alice will judge their interest in Romance

  • But both are fine with the other knowing if they are both interested.

Both will discover a mutual interest in Anime and Romance, but Bob will never deduce Alice’s secret interest in Fantasy.


I am interested in both same-room mechanical solutions (such as overlaying sheets of paper with non-preferences painted out, then shining a light through the stack) and online client-server solutions where the server cannot figure out each answer (such as being given an unlabelled ordered set to compare, where Alice and Bob each have the labels - like return {1,1,0,1,0,1,1} AND {1,0,1,0,1,1,1}).

  • A1kmm@lemmy.amxl.com
    link
    fedilink
    English
    arrow-up
    4
    ·
    2 hours ago

    You can do this cryptographically as an interactive zero-knowledge protocol without a third-party.

    This is easiest done by splitting it up into separate problems: For any arbitrary interest, a protocol to check if Alice and Bob share that interest. Doing the whole set is then a matter of repeating the protocol across a finite set of possible interests. So we’ll deal with the simpler problem of checking if they share interests.

    Let’s assume that Alice and Bob already have an authenticated channel set up (i.e. Eve can’t pretend to be Bob) - e.g. because they’ve previously exchanged public keys through a secure channel.

    Zero-Knowledge (ZK) protocols come in Interactive and Non-Interactive flavours. Here, we’ll need an interactive protocol, because otherwise Bob could run the same protocol twice, once saying he does have the interest, and once saying he doesn’t.

    This problem is almost identical to the Socialist Millionaire Problem, except you don’t want to leak information if Alice and Bob don’t share the interest.

    Alice and Bob calculate their respective x_ij values (where i=0 for Alice, i=1 for Bob), such that x_ij is 0 if participant i has interest j, and a large random number if not.

    They then use a Socialist Millionaire Protocol (e.g. the one from the OTR messaging protocol in the above linked article) to check if x_0j is equal to x_1j. If they both picked 0 (have the interest), the protocol tells then their values are the same. If one of them has interest j and one doesn’t, the one with the interest learns the other does not have the interest, while the other party learns nothing (except that the other party didn’t pick the same large random number). If they both don’t have the interest, they only learn that the other picked a different large random number or zero, but can’t tell between the two. Assuming sufficiently large numbers, it is vanishingly unlikely they’d pick the same number.

    The interactive protocol can be run in parallel for each interest j, but has a few sequential steps per interest (ensuring neither party can cheat and have more than one choice per interest).

  • threeonefour@piefed.ca
    link
    fedilink
    English
    arrow-up
    2
    ·
    19 hours ago

    Couldn’t someone just lie? If Alice hates romance and wants to know if Bob is a filthy romance lover, she could just lie and say she likes romance. No matter what system you implement, Alice will now be told “You and Bob both like romance!”

    • comfy@lemmy.mlOP
      link
      fedilink
      arrow-up
      1
      ·
      16 hours ago

      Yes, someone can lie. I wonder how effective any countermeasures may be (e.g. honey tokens to detect someone just saying they love everything), but at the end of the day, I think we are forced to assume all answer truthfully if we want any expectation of secrecy.

    • bumblebeer@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      18 hours ago

      Yeah, just like most other things that are not computationally verifiable, this has basically zero Byzantine fault tolerance.