Private Set Intersection (PSI)

The fundamental property ensuring that each party learns nothing about the other party's private set beyond the elements in the intersection. A malicious participant cannot extract non-intersecting items, even by deviating from the protocol. This is formalized through simulation-based security proofs in the semi-honest and malicious adversary models, guaranteeing that the protocol reveals no more information than an ideal functionality where a trusted third party computes the intersection.

In standard PSI, the size of each party's set may be leaked. Fully private PSI variants extend the protocol to conceal even the cardinality of the intersection and the individual set sizes. This is critical in applications like watchlist screening, where revealing that a query set contains thousands of entries could itself be a sensitive metadata leak. Achieving this property typically requires additional cryptographic overhead, such as padding sets to a fixed upper bound or using additively homomorphic encryption to mask counts.

Modern high-performance PSI protocols are built on Oblivious Transfer (OT) extension, which dramatically reduces computational overhead. Key mechanisms include:

• Base OTs: A small number of expensive public-key operations used to bootstrap the protocol
• OT Extension: Efficiently expands a few base OTs into millions of symmetric-key OTs using hash functions
• Cuckoo Hashing: A data structure that maps elements to bins, enabling sub-linear communication complexity This foundation allows PSI to scale to sets containing billions of items with practical latency.

Protocols secure against active adversaries who may arbitrarily deviate from the specification to extract private information. Achieving malicious security requires additional integrity checks:

• Cut-and-choose techniques: One party proves correct behavior by opening a random subset of commitments
• Consistency checks: Verifying that OT inputs are used consistently across multiple invocations
• Zero-knowledge proofs: Proving correct encryption or hashing without revealing secrets This contrasts with semi-honest security, which assumes parties follow the protocol but may attempt to learn from received messages.

Traditional PSI relies on assumptions like the Decisional Diffie-Hellman problem, which is vulnerable to Shor's algorithm on a sufficiently large quantum computer. Post-quantum PSI variants are being developed using:

• Lattice-based cryptography: Leveraging the Learning With Errors (LWE) problem for OT primitives
• Code-based constructions: Using syndrome decoding hardness assumptions
• Isogeny-based protocols: Exploiting the difficulty of finding paths in supersingular isogeny graphs These ensure long-term confidentiality of intersection results against future quantum adversaries.

A variant where computationally weak clients outsource the heavy cryptographic lifting to untrusted cloud servers without revealing their private sets. The architecture splits trust:

• Client: Encrypts its set and uploads ciphertexts to the server
• Server: Performs the computationally intensive PSI computation on encrypted data
• Result delivery: The server returns encrypted results that only the client can decrypt The server learns nothing about the sets or the intersection, enabling mobile devices and IoT sensors to participate in privacy-preserving matching at scale.

A fundamental building block of many PSI protocols. In OT, a sender transfers one of potentially many pieces of information to a receiver, but remains oblivious as to which piece was selected. Modern PSI constructions rely heavily on OT extension techniques to achieve practical performance at scale.

• Underpins the most efficient PSI implementations
• Enables 1-out-of-N oblivious selection
• Critical for scaling PSI to million-element sets

A mathematical framework that provides provable privacy guarantees by adding calibrated noise to computation outputs. When combined with PSI, differential privacy ensures that the intersection result itself does not leak information about any single individual's membership in the underlying datasets.

• Protects against membership inference on intersection results
• Controlled by the privacy budget (epsilon) parameter
• Essential for regulatory compliance in financial data sharing

A two-party computation protocol where a function is represented as a boolean circuit with encrypted wires. Early PSI protocols used garbled circuits to evaluate set membership, though modern constructions favor more efficient OT-based and hash-based approaches for the specific intersection functionality.

• Represents computation as encrypted logic gates
• Historically important for PSI development
• Still used for complex predicates beyond simple intersection