Willow: Secure Aggregation with One-Shot Clients
summary
Protocol lets each client send a one-shot clients ciphertext (single message, dynamic join) and offloads setup/verification to a small committee so client work avoids per-client rounds. Construction uses a hybrid key-homomorphic encryption (short KHE keys encrypted under a decryptor public key, long message encryption aggregated by server) and argues security from Hint-RLWE hardness. Decryptor/verifier are committee-based with cost roughly log n plus committee size; experiments show performance competitive with non-dynamic protocols and a random-oracle lower bound blocks sublinear alternatives in the standard model.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:56Private analytics definition
- 11:34Existing solutions
- 18:56Committee approaches
- 22:25Willow design
- 26:45Efficiency and security
- 30:41Verification and privacy
- 34:42Comparison with OPA
- 37:11Security model
- 38:44Q&A
related talks
31mSecure Aggregation with Lightweight Committees
31mTowards making private telemetry as ubiquitous as TLS
40mAuthentication and Key Exchange
10mSecuring Multi-Cloud APIs Against Quantum Threats
27mConcurrency and Privacy Challenges for Multi-hop HTLCs
51mMessaging Layer Security: Towards a New Era of Secure Group Messaging
33mInteraction Preserving Compilers for Secure Computation
17mThe Simplest Oblivious Transfer Protocol