I couldn’t sleep last night so there’s got to be a better title
Alice and Bob (and maybe even Charlie!) want to find common preferences. However, they’re each ashamed of some of their preferences.
Each are only comfortable with another knowing a preference of theirs if that preference is shared by everyone at the table. They also don’t want gossipy Mallory to run a third-party check for them - this has to be possible without trusting anyone or any program with access to the secret data of others. Assume Alice and Bob may be tempted to try and find each others’ secret preferences.
For example:
-
Alice likes
Anime, Comedy, Fantasy, Romance, Thriller -
Bob likes
Anime, Drama, Horror, Romance, Thriller -
Alice is worried Bob will judge their interest in
AnimeandFantasy -
Bob is scared Alice will judge their interest in
Romance -
But both are fine with the other knowing if they are both interested.
Both will discover a mutual interest in Anime and Romance, but Bob will never deduce Alice’s secret interest in Fantasy.
I am interested in both same-room mechanical solutions (such as overlaying sheets of paper with non-preferences painted out, then shining a light through the stack) and online client-server solutions where the server cannot figure out each answer (such as being given an unlabelled ordered set to compare, where Alice and Bob each have the labels - like return {1,1,0,1,0,1,1} AND {1,0,1,0,1,1,1}).
You can do this cryptographically as an interactive zero-knowledge protocol without a third-party.
This is easiest done by splitting it up into separate problems: For any arbitrary interest, a protocol to check if Alice and Bob share that interest. Doing the whole set is then a matter of repeating the protocol across a finite set of possible interests. So we’ll deal with the simpler problem of checking if they share interests.
Let’s assume that Alice and Bob already have an authenticated channel set up (i.e. Eve can’t pretend to be Bob) - e.g. because they’ve previously exchanged public keys through a secure channel.
Zero-Knowledge (ZK) protocols come in Interactive and Non-Interactive flavours. Here, we’ll need an interactive protocol, because otherwise Bob could run the same protocol twice, once saying he does have the interest, and once saying he doesn’t.
This problem is almost identical to the Socialist Millionaire Problem, except you don’t want to leak information if Alice and Bob don’t share the interest.
Alice and Bob calculate their respective x_ij values (where i=0 for Alice, i=1 for Bob), such that x_ij is 0 if participant i has interest j, and a large random number if not.
They then use a Socialist Millionaire Protocol (e.g. the one from the OTR messaging protocol in the above linked article) to check if x_0j is equal to x_1j. If they both picked 0 (have the interest), the protocol tells then their values are the same. If one of them has interest j and one doesn’t, the one with the interest learns the other does not have the interest, while the other party learns nothing (except that the other party didn’t pick the same large random number). If they both don’t have the interest, they only learn that the other picked a different large random number or zero, but can’t tell between the two. Assuming sufficiently large numbers, it is vanishingly unlikely they’d pick the same number.
The interactive protocol can be run in parallel for each interest j, but has a few sequential steps per interest (ensuring neither party can cheat and have more than one choice per interest).
Those are called set and you want to be able to operate on those set secretly. Here is an old paper that could point out to many more stuff
Couldn’t someone just lie? If Alice hates romance and wants to know if Bob is a filthy romance lover, she could just lie and say she likes romance. No matter what system you implement, Alice will now be told “You and Bob both like romance!”
Yes, someone can lie. I wonder how effective any countermeasures may be (e.g. honey tokens to detect someone just saying they love everything), but at the end of the day, I think we are forced to assume all answer truthfully if we want any expectation of secrecy.
Yeah, just like most other things that are not computationally verifiable, this has basically zero Byzantine fault tolerance.


