Private and Threshold Set-Intersection

In this paper we consider the problem of privately computing the set-intersection (private matching) of sets, as well as several variations on this problem: cardinality set-intersection, threshold set-intersection, and over-threshold set-intersection. Cardinality set-intersection is the problem of determining the size of the intersection set, without revealing the actual set. In threshold set-intersection, only the elements which appear at least a threshold number t times in the players’ private inputs are revealed. Over-threshold setintersection is a variation on threshold set-intersection in which not only the threshold set is revealed, but also the popularity of each element in the set. Let there be n ≥ 2 players, c < n dishonestly colluding, each with a private input set of k elements. Our protocols for two parties are comparable to those of Freedman, Nissim, and Pinkas [12], except in the malicious case, in which we achieve security without the use of the expensive cut-and-choose technique. Freedman, Nissim, and Pinkas also address the problem of private set-intersection for multiple parties, giving a protocol secure against honest-but-curious parties with O(nk) total communication complexity, but no protocol secure against malicious adversaries. We give a protocol for this scenario secure against honest-but-curious parties with O(cnk) total communication complexity, and against malicious parties with communication complexity O(nk). There was no previous efficient protocol for the problems of cardinality set-intersection (for n ≥ 3 players or n ≥ 2 malicious players), threshold set-intersection, or over-threshold set-intersection. We give the first efficient protocols for these problems without generic secure circuit computation.