Key Agreement

A security property ensuring that the compromise of long-term keys does not compromise past session keys. In the context of secure aggregation, this means that even if a client device is later compromised, previously transmitted model updates remain protected.

• Ephemeral keys are generated for each protocol run and destroyed afterward
• Protects historical data even against future key exposure
• Essential for long-term privacy in federated learning deployments
• Commonly achieved through ephemeral Diffie-Hellman variants

The property that each party contributes to the randomness of the final shared secret, preventing any single participant from predetermining or biasing the key. This is critical for the integrity of pairwise masking in secure aggregation.

• Prevents a malicious client from forcing a known mask value
• Ensures the unpredictability of the shared secret
• Achieved through Diffie-Hellman key exchange where both parties generate random private values
• Contrasts with key transport mechanisms where one party chooses the key

The assurance that a party can only compute the shared secret if they possess the correct private key corresponding to their claimed identity. This binds the established key to the authenticated identities of the participants.

• Prevents man-in-the-middle attacks when combined with digital signatures
• Ensures the server in secure aggregation knows which clients contributed to the sum
• Often implemented by signing the ephemeral public keys with a long-term digital signature
• Distinct from explicit key confirmation, which requires additional message exchanges

The practical performance characteristics of the key agreement protocol, measured in computation and communication overhead. For secure aggregation with hundreds or thousands of clients, efficiency is paramount.

• Elliptic Curve Diffie-Hellman (ECDH) offers equivalent security to finite-field DH with smaller keys and faster operations
• A single ECDH operation on Curve25519 takes < 1 millisecond on modern hardware
• Communication overhead is typically 32 bytes per public key
• Post-quantum alternatives like Kyber trade larger key sizes for quantum resistance

The ability of the protocol to recover security after a temporary compromise of a party's state. This property, also called self-healing, ensures that an attacker who briefly steals a key cannot decrypt future communications indefinitely.

• Achieved through continuous key ratcheting mechanisms
• Each new protocol run generates fresh ephemeral keys
• Limits the damage window of any single breach
• Particularly relevant for long-running federated learning systems with persistent clients

The property of a key agreement protocol to remain secure against adversaries equipped with large-scale quantum computers. Classical Diffie-Hellman is vulnerable to Shor's algorithm, driving the adoption of post-quantum alternatives.

• Lattice-based schemes like CRYSTALS-Kyber are NIST-standardized post-quantum key agreement protocols
• Based on the hardness of the Learning With Errors (LWE) problem
• Hybrid constructions combine classical ECDH with post-quantum primitives for defense-in-depth
• Key sizes are larger: Kyber-768 public keys are 1,184 bytes vs. 32 bytes for ECDH

The canonical key agreement protocol that allows two parties to establish a shared secret over a public channel. Each party generates a private key and sends a corresponding public key derived from a common generator. The security relies on the computational hardness of the discrete logarithm problem—an adversary observing the public values cannot feasibly compute the shared secret. In secure aggregation, DH is used to establish the pairwise masks that cancel out during summation.

A technique where each pair of clients in a federated learning round agrees on a shared secret mask via key agreement. Client i adds the mask for pair (i,j) to its update, while client j subtracts it. When the server sums all updates, the masks cancel out, revealing only the aggregate. This ensures the server sees no individual contribution in the clear. Requires synchronization barriers to ensure all clients use consistent masks.

A cryptographic method for distributing a secret among n participants such that only a qualified subset can reconstruct it. In secure aggregation, clients split their pairwise masks into shares and distribute them to other clients. If a client drops out, the remaining clients can reconstruct the dropout's masks from their shares, preserving dropout resilience. The classic scheme is Shamir Secret Sharing, which encodes the secret as a polynomial and distributes points on that polynomial.

A security property ensuring that the compromise of long-term keys does not compromise past session keys. In the context of secure aggregation, this means that even if a client's device is later compromised, previously transmitted model updates remain protected. Protocols achieve this by using ephemeral key pairs generated fresh for each aggregation round, combined with Diffie-Hellman key exchange. This is critical for long-lived federated learning deployments where devices may be lost or stolen.

Also known as honest-but-curious, this security model assumes adversaries follow the protocol specification correctly but may attempt to learn additional information from the protocol transcript. Most practical secure aggregation protocols operate under this model, as it is significantly more efficient than malicious security. The server is trusted to compute the sum correctly but not trusted to inspect individual updates. Malicious security adds zero-knowledge proofs to enforce honest behavior.

A deterministic algorithm that expands a short, uniformly random seed into a longer sequence of bits computationally indistinguishable from true randomness. In secure aggregation, PRGs are used to efficiently generate the large mask vectors from the short shared secrets established via key agreement. This dramatically reduces communication overhead—clients exchange only the seed, then locally expand it into a full mask matching the model update dimensions.