Constant-Round Black-Box Construction of Composable Multi-Party Computation Protocol

Abstract

Abstract. We present the first general MPC protocol that satisfies the following: (1) the construction is black-box, (2) the protocol is universally composable in the plain model, and (3) the number of rounds is constant. The security of our protocol is proven in angel-based UC security under the assumption of the existence of one-way functions that are secure against sub-exponential-time adversaries and constant-round semi-honest oblivious transfer protocols that are secure against quasi-polynomial-time adversaries. We obtain the MPC protocol by constructing a constant-round CCA-secure commitment scheme in a black-box way under the assumption of the existence of one-way functions that are secure against subexponential-time adversaries. To justify the use of such a sub-exponential hardness assumption in obtaining our constant-round CCA-secure commitment scheme, we show that if black-box reductions are used, there does not exist any constant-round CCA-secure commitment scheme under any falsifiable polynomial-time hardness assumptions.

Round-Efficient Black-Box Construction of Composable Multi-Party Computation

“…Thus, with enhanced trapdoor permutations (from which we can construct constant-round semi-honest OT protocols), their result gives an O(n )round protocol. Subsequently, Kiyoshima et al [19] constructed a constant-round protocol from constant-round semi-honest OT protocols that are secure against quasi-polynomial-time adversaries and one-way functions that are secure against subexponential-time adversaries.…”

“…Summarizing the state-of-the-art, for composable protocols in the plain model, we have logarithmic-round non-black-box constructions under a standard polynomialtime hardness assumption [20,14], -a polynomial-round black-box construction under a standard polynomialtime hardness assumption [22], and constant-round black-box or non-black-box constructions under standard super-polynomial-time hardness assumptions [20,14,19].…”

“…Thus, for composable protocols based on standard polynomial-time hardness assumptions, there exists a gap between the round complexity of the non-blackbox protocols (logarithmic rounds [20,14]) and that of the black-box protocols (polynomial rounds [22] We prove our main theorem by constructing a O(log 2 n)-round black-box construction of a CCA-secure commitment scheme [5,20,22,14,19] from one-way functions.…”

“…To construct a commitment scheme that is concurrently extractable without over-extraction, we start from the following scheme (in which the cut-and-choose technique is used in the same way as in the previous works of black-box protocols [7,8,30,22,19]).…”

“…That is, whereas the previous schemes (implicitly or explicitly) use non-malleable commitment schemes from the committer to the receiver, our scheme uses a one-one CCA secure commitment scheme from the receiver to the committer. (Very recently, the same strategy is used in [19]. )…”