Engineering Privacy-Preserving Cryptographic Protocols

Privacy-preserving cryptographic protocols allow to process such sensitive data in a provably secure way. Until today, the design and implementation of privacy-preserving protocols, efficient enough to be used in practical applications, is a challenging and error-prone task even for experts in the field. To make such protocols widely accessible to non-expert users, tools are needed that automatically generate efficient and secure privacy-preserving cryptographic protocols from high-level specifications.

In this talk we present the approach of engineering efficient privacy-preserving protocols. We summarize today's most efficient techniques for secure two-party computation with their respective advantages and disadvantages. We present a framework to modularly combine these basic primitives into efficient protocols. Our corresponding "Tool for Automating Secure Two-partY computations" (TASTY) allows to generate code from a high-level description of such protocols. This tool can be used to automatically generate efficient protocols for privacy-preserving face recognition and ElectroCardioGram classification. Depending on the deployment scenario, the efficiency of such protocols can be further improved, e.g., using tamper-proof hardware such as smartcards.

Finally, we outline our current and future work in the direction of engineering efficient privacy-preserving protocols. As deployment scenarios we target a wide range from resource-constrained mobile devices to large-scale cloud computing. The ultimate goal is to develop languages that allow to program privacy-preserving applications and are as easy to use as today's standard programming languages. The associated tools should automatically generate efficient privacy-preserving protocols that are optimized according to the constraints of the specific deployment scenario. We expect that such languages and tools will have a substantial impact on how data can be efficiently processed in a privacy-preserving way in conformity with data privacy protection laws.