Multi-party private set union (MPSU) protocol enables $m$ $(m > 2)$ parties, each holding a set, to collectively compute the union of their sets without revealing any additional information to other parties. There are two main categories of multi-party private set union (MPSU) protocols: The first category builds on public-key techniques, where existing works require a super-linear number of public-key operations, resulting in their poor practical efficiency. The second category builds on oblivious transfer and symmetric-key techniques. The only work in this category, proposed by Liu and Gao (ASIACRYPT 2023), features the best concrete performance among all existing protocols, but still has super-linear computation and communication. Moreover, it does not achieve the standard semi-honest security, as it inherently relies on a non-collusion assumption, which is unlikely to hold in practice. There remains two significant open problems so far: no MPSU protocol achieves semi-honest security based on oblivious transfer and symmetric-key techniques, and no MPSU protocol achieves both linear computation and linear communication complexity. In this work, we resolve both of them. - We propose the first MPSU protocol based on oblivious transfer and symmetric-key techniques in the standard semi-honest model. This protocol is $3.9-10.0 \times$ faster than Liu and Gao in the LAN setting. Concretely, our protocol requires only $4.4$ seconds in online phase for 3 parties with sets of $2^{20}$ items each. - We propose the first MPSU protocol achieving both linear computation and linear communication complexity, based on public-key operations. This protocol has the lowest overall communication costs and shows a factor of $3.0-36.5\times$ improvement in terms of overall communication compared to Liu and Gao.

翻译：多方隐私集合并集（MPSU）协议使得$m$个（$m > 2$）参与者，在各自持有一个集合的情况下，能够共同计算这些集合的并集，而不会向其他参与者泄露任何额外信息。现有的多方隐私集合并集（MPSU）协议主要分为两类：第一类基于公钥技术构建，现有方案需要超线性数量的公钥操作，导致其实用效率低下。第二类基于不经意传输和对称密钥技术构建。该类别中唯一的工作由Liu和Gao（ASIACRYPT 2023）提出，在所有现有协议中具有最佳的实际性能，但仍具有超线性的计算和通信开销。此外，它未能达到标准的半诚实安全性，因为它本质上依赖于一个在实践中不太可能成立的非共谋假设。迄今为止，仍存在两个重要的开放性问题：没有基于不经意传输和对称密钥技术的MPSU协议能够实现半诚实安全性，也没有MPSU协议能够同时实现线性计算和线性通信复杂度。在本工作中，我们同时解决了这两个问题。- 我们提出了首个在标准半诚实模型下基于不经意传输和对称密钥技术的MPSU协议。该协议在局域网（LAN）环境下比Liu和Gao的方案快$3.9-10.0$倍。具体而言，对于3个参与者，每个参与者的集合包含$2^{20}$个元素，我们的协议在线阶段仅需$4.4$秒。- 我们提出了首个基于公钥操作、同时实现线性计算和线性通信复杂度的MPSU协议。该协议具有最低的总通信开销，与Liu和Gao的方案相比，总通信量提升了$3.0-36.5$倍。