Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication

Abstract

It is known that fully homomorphic encryption (FHE) can be used to build efficient (labeled) Private Set Intersection protocols in the unbalanced setting, where one of the sets is much larger than the other (Chen et al. (CCS\u2717, CCS\u2718)). In this paper we demonstrate multiple algorithmic improvements upon these works. In particular, our protocol has an asymptotically better computation cost, requiring only $O(\sqrt{|X|})$ homomorphic multiplications, and communication complexity sublinear in the larger set size $|X|$. We demonstrate that our protocol is significantly better than that of Chen et al. (CCS\u2718) for many practical parameters, especially in terms of online communication cost. For example, when intersecting $2^{28}$ and $2048$ item sets, our protocol reduces the online computation time by more than 83% and communication by more than 32%. When intersecting $2^{24}$ and $4096$ item sets, our protocol reduces the online computation time by 50% and communication by 52%. Our comparison to other state-of-the-art unbalanced PSI protocols shows that our protocol has the best total communication complexity when $|X| \geq 2^{24}$. For labeled PSI our protocol also outperforms Chen et al. (CCS\u2718). When intersecting $2^{20}$ and $256$ item sets, with the larger set having associated $288$-byte labels, our protocol reduces the online computation time by more than 85% and communication by 36%. Finally, we demonstrate a modification that results in nearly constant communication cost in the larger set size $|X|$, but impractically high computation complexity on today\u27s CPUs. For example, to intersect a $210$-item set with sets of size $2^{22}$, $2^{24}$, or $2^{26}$, our proof-of-concept implementation requires only $0.76$ MB of online communication, which is more than a $24$-fold improvement over Chen et al. (CCS\u2718)