Secure Aggregation with Lightweight Committees
summary
Secure aggregation that keeps clients one‑shot and avoids shipping huge ciphertexts uses a short RLWE-based key encrypted under an additively homomorphic wrapper, plus proofs of plaintext knowledge to stop correlated‑ciphertext attacks. Original Willow spreads verification across ~√N committee members; WillowFold replaces that with zero-knowledge PCD with simulation extractability so each committee member does ~log N work and a constant‑size committee suffices, at the cost of much heavier server proof generation and verification. Streaming aggregation and practical parameter choices are implemented and benchmarked.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:24Threat model
- 3:54Committee solutions
- 5:21Homomorphic encryption
- 8:32Malicious clients
- 14:17Zero-knowledge proofs
- 18:13Committee selection
- 20:44Workload distribution
- 21:24WillowFold
- 27:24Performance improvements
- 28:49Q&A
related talks
40mWillow: Secure Aggregation with One-Shot Clients
57mPractical Groth16 Aggregation
56mConsensus Through Herding
40mCryptography in Distributed Systems
34mConsensus with Adaptive Adversaries in the Synchronous and Partially Synchronous Models...
33mInteraction Preserving Compilers for Secure Computation
59mCommit-and-Prove Zero-Knowledge Proof Systems and Extensions
31mSecure Distributed Storage