Models and Protocols for Secure Enclaves

252 / BBB

2026-10-13

Saskia Bayreuther

15:45

In today’s fast-evolving and highly optimized world, the requirements for protocol security are becoming increasingly strong. At the same time, obtaining computation results quickly and efficiently is equally important. In particular, protocols must be able to withstand adversarial threats while operating efficiently in both stand-alone and wider contexts, such as when they are used as subroutines of other protocols or executed in parallel, i.e., under universal composition. However, achieving a high level of security while remaining efficient is challenging. Often, achieving a certain level of security means compromising efficiency, and vice versa. Trusted execution environments (TEEs) or secure enclaves can help to overcome this trade-off. The way in which secure enclaves are modeled has a significant impact on their capabilities. Modeling secure enclaves in such a way as to enable efficient and secure general multi-party computation with minimal setup, i.e., only one enclave per protocol execution, while also achieving properties such as public verifiability, has not yet been realized. Existing models require one enclave per participant for general multi- party computation. However, this requirement is far from how enclaves are used in today’s world. Enclaves are often used by cloud services: clients can outsource their computations in a secure and privacy preserving way by using enclave-enforced cloud services. Therefore, achieving security guarantees of Universal Composability (UC) (FOCS 2001) is highly desirable. At the same time, to make results of a protocol meaningful to other protocols, properties such as public verifiability need to be considered. However, the combination of universally composable security and properties such as public verifiability is hard to achieve and under-researched. At the same time, in UC, these notions are notoriously hard to achieve. Therefore, we make the following contributions. First, we propose a novel enclave model that achieves single-enclave execution and public verifiability. We also explore how enclave modeling impacts fairness guarantees and present a novel fairness notion.

General Multi-Party Computation with Global Public Verifiability from a Single Enclave Only.
As the first part of this thesis, we propose a formal model for secure enclaves. Our model, called G_att, is defined as a global ideal functionality within the UC framework that ensures global public verifiability of outputs even in the event of corruption of all parties. In the model proposed by Pass, Shi, and Tramèr (EUROCRYPT 2017), public verifiability was achieved via signed outputs. Any party holding the verification key can verify the signature attached to an output, even if they did not participate in the protocol execution. However, to prove the security of such publicly verifiable protocols, the adversary in their proof must be able to request a signature for any value from their enclave, not just the correct output. With this backdoor, this notion of public verifiability becomes meaningless. No party can detect adversarial behavior or faulty outputs, since signatures are still valid and generated by a secure enclave. The notion of public verifiability, where parties truly believe the result despite corruption, has proven difficult to achieve in practice and has been approached using different methods. We propose a novel technique that achieves meaningful public verifiability, called global public verifiability, without requiring the adversary to program the output. Secondly, we address the impossibility result by Pass, Shi, and Tramèr that every party must hold an enclave for general multi-party computation. This is due to signatures being added to every output. We circumvent this impossibility by introducing designated-verifier attestations that are only valid for one designated verifier. This result is crucial in making enclave-based protocols more usable while still being efficient.

New Fairness Notion for Secure Two-Party Computation.
At first glance, using secure enclaves for multi-party computation appears to be an effective solution. By definition, a secure enclave guarantees confidentiality and integrity which leads to simple MPC protocols in which the enclaves perform the computation, guaranteeing the properties input privacy and correctness. In the context of composition, another important property of multi-party computation is fairness. Fairness guarantees that if one party receives the result, the others receive it too. However, this is unattainable in a two-party computation setting. Using enclaves enables one to achieve a weakened notion of fairness called ∆-fairness which was introduced by Pass, Shi, and Tramèr. Informally, this guarantees that if a dishonest party receives the output in round r and then stops participating in the protocol, the honest party will receive the output by round ∆(r). In many settings, however, this is not sufficient. Even when it is achieved, a corrupt party is guaranteed to receive their output before the honest party, which gives the corrupt party an advantage in any subsequent interactions. Furthermore, the corrupt party knows the exact value of ∆. This means that they can abort the protocol when it is most advantageous. We propose a novel notion of fairness, called hidden ∆-fairness, which addresses the above issues. First, hidden ∆-fairness ensures that a dishonest party cannot benefit from aborting prematurely or learn the result first with a 50% probability. Secondly, since protocol parameters such as ∆ are randomly selected and kept hidden from participants, a dishonest party can only guess when to abort to gain the greatest advantage.