Generate Labels Sample Clauses

Generate Labels. Upon receiving (submit, sid, inputp ) from each pi for session sid, F lbl samples random elements for a CPA-secure encryption scheme (referred to as CPA), and ρpi = {ρpi , j} j∈[N] is a list of N A-bit one-time pads. from a universe U = {0, 1}A and computes a map Λ: Vp1 ∪Vp2 → {0, 1}A such that for any two vertices v1, v2 ∈ Vp1 ∪Vp2 , For i ∈ {1, 2} and j ∈ [| Λ(v1) = Λ(v2) if and only if v1 and v2 are in the same connected component in G1 ∪ G2. V |], let v be the jth vertex in V . F computes f = { pi p , j i p lbl i pi enc CPA.enc(k , Λ(v )} enc pi pi , j j∈[| V |] pi and f = { pi mask ρp , j i F lbl sends (labeling, sid, f enc, f mask) to p1 and (labeling, sid, f enc, f mask) to p2. ⊕ Λ(v )} p , j i j∈[|Vpi |] p1 p2 p2 p1 Fig. 3: Two-Party Component Labeling Functionality F lbl 3 Security Primitives and Cryptographic Assumptions

Generate Labels. Upon receiving (submit, sid, inputp ) from each pi for session sid, F lbl samples elements from a for a CPA-secure encryption scheme (referred to as CPA), and ρpi = {ρpi , j} j∈[N] is a list of N A-bit one-time pads. i ε universe U = {0, 1}A and computes a map Λ: Vp1 ∪Vp2 → U such that with probability 1 − ε, it is the case that for every For i ∈ {1, 2} and j ∈ [| two vertices v1, v2 ∈ Vp1 ∪Vp2 , Λ(v1) = Λ(v2) if and only if v1 and v2 are in the same connected component in G1 ∪ G2. V |], let v be the jth vertex in V . F computes f = { pi p , j i p lbl enc i pi CPA.enc(k , Λ(v )} enc pi p , j i j∈[| V |] pi and f = { pi mask ρp , j i F lbl sends (labeling, sid, f enc, f mask) to p1 and (labeling, sid, f enc, f mask) to p2. ⊕ Λ(v )} p , j i j∈[|Vpi |] p1 p2 p2 p1 ε Fig. 14: Modified Two-Party Component Labeling Functionality F lbl of ε. Reducing bit length of the labels directly improves the cost of the protocol, as the number of gates in the garbled circuit is linear in the bit length of the labels. ∪ Recall that correctness of our protocol requires that for every pair of vertices u, v in G = Xx0 Xx0 , u and v assigned the same label if and only if they are in the same component in G. In our protocol, if u and v are in the same component in G, then they are assigned the same label by construction. If they are not in the same component, then they may be assigned the same label only if there is a spurious collision in the images of two unconnected vertices under H. Our analysis is an application of the birthday bound. Recall that each party has a graph of size N, and consider that H is a random oracle. Let collision be the event that any two distinct vertices in G are mapped to the same image under H. By the birthday bound, it follows that