![](bg3.png)
provides a model for many digital components used
in computer engineering. The generic protocol that
we want to focus on is Yao’s garbled circuits protocol
that is used to evaluate any discrete function that can
be represented as a circuit. That means, in terms of
PSI, that both the Server and the Client put together
their inputs and evaluate the intersection function with
no leaking beyond what is implied by the intersection
output.
In 2012 there was the belief that solutions for PSI
using generic approaches were impractical so Huang,
Evans and Katz decided to explore the validity of
that belief. In (Huang et al., 2012) they perform PSI
using Yao’s generic garbled circuit approach obtain-
ing efficient protocols assuming the semi-honest set-
ting. They consider three classes of protocols for PSI
based on Yas’s garbled circuit technique which takes
any boolean circuit C and yields a secure protocol for
computing C. The main idea of the third is that each
set is sorted locally and then obliviously merged into a
single sorted list. Then each adjacent pair is compared
and if the elements are equal, one of them is kept, and
if not, the pair is replaced by a random value. The
resulting list must be shuffled for not leaking any in-
formation. They concluded that protocols based on
generic secure computation ”can offer performance
that is competitive with the best known custom proto-
cols”.
3.3 Oblivious Transfer-based PSI
Oblivious Transfer. protocol is a type of protocol
in which a sender transfers one of potentially many
pieces of information to a receiver, but remains obliv-
ious as to what piece has been transferred.
In 2004 Freedman, Nissim and Pinkas (Freed-
man et al., 2004) were the first to introduce the con-
cept of private set intersection solved using protocols
based on oblivious polynomial evaluation that acts as
a client-server communication where only the client
learns the output. They obtain O(k) communica-
tion overhead and O(k ln ln k) computation for lists of
length k. The protocol works as follows: C uses inter-
polation to generate the polynomial P(y) =
∑
k
c
u=0
α
u
y
u
of degree k
c
with roots {x
1
, x
2
, ..., x
k
c
} (his input).
C encrypts the coefficients and sends them to S.
∀y ∈ Y , S computes Enc(P(y)) using the homomor-
phic properties to evaluate the polynomial. Then, he
chooses a random r and computes Enc(rP(y) + y).
Finally, he sends all the k
s
ciphertexts permuted back
to the client. C decrypts all k
s
values and outputs the
set intersection.
Freedman et al. (Freedman et al., 2016) tried to
hit it big again in 2016. They proposed two proto-
cols based on the use of homomorphic encryption.
They obtain linear communication and computation
overhead using both Paillier and ElGamal encryption
schemes. They implement the protocols and analyse
with different constants.
In contrast to previous protocols that used secure
polynomial evaluation, Hazay and Lindell (Hazay and
Lindell, 2008) came with a different approach in deal-
ing with secure set intersection problem. They pro-
posed the first protocols based on secure pseudoran-
dom function evaluation. Their work was continued
and improved by Jarecki and Liu in (Jarecki and Liu,
2009). However, the input domain of the PRF is re-
stricted to polynomial size.
Chase and Miao in (Chase and Miao, 2020) make
a positive progress on finding a new PSI protocol
that achieves better communication and computation
trade-offs. Their protocol is based on oblivious trans-
fer, hashing, symmetric-key and bitwise operations.
Their protocol achieves security in the random oracle
model when the B party (the sender who gets nothing
for output) is malicious.
Their PSI protocol’s most important part is a new
multi-point oblivious pseudorandom function proto-
col that is based on oblivious transfer and relies on
symmetric-key, bitwise operations and hashing. The
idea of the protocol is simple: since they can achieve
multi-point OPRF while the second party has mul-
tiple elements as input and his output consists on all
the elements evaluated then the set intersection can be
easily computed in a private manner. The first party
evaluates the PRF on every element in his set and
send all the PRF values to the second party and by
comparison these PRF values, he figures out the in-
tersection of the two sets.
Ruan and Mao (Ruan and Mao, 2020) propose a
new approach to PSI protocol, transforming the prob-
lem of the intersection of sets into the problem of find-
ing roots of polynomials by using point-value poly-
nomial representation. Their protocol stands out be-
cause of the lack of using a cryptosystem.
In this article, the authors represent the sets as
polynomials’ point-value pairs as follows: each party
denotes n elements (s
1
, ..., s
n
) as a n-degree polyno-
mial p(x) =
∏
n
i=1
(x − s
i
). They agree on a list of
d elements {x
1
, ..., x
d
} and evaluate their polynomi-
als on these numerical values, making point-value
pairs {(x
1
, p(x
1
)), ..., x
d
, p(x
d
))}. Because n ≤ d + 1,
the point-value pairs can be seen as a representation
of each polynomial. Next they blind their polyno-
mials by using pseudorandom function {(x
1
, p(x
1
) +
z
1
), ..., (x
d
, p(x
d
) + z
d
)} and exchange the blinded
point-value pairs. The polynomial can be found by
interpolation and the intersection by computing the
SECRYPT 2021 - 18th International Conference on Security and Cryptography
682