Player Simulation and General Adversary Structures in Perfect Multiparty Computation

Abstract

The goal of secure multiparty computation is to transform a given protocol involving a trusted party into a protocol without need for the trusted party, by simulating the party among the players. Indeed, by the same means, one can simulate an arbitrary player in any given protocol. We formally define what it means to simulate a player by a multiparty protocol among a set of (new) players, and we derive the resilience of the new protocol as a function of the resiliences of the original protocol and the protocol used for the simulation.In contrast to all previous protocols that specify the tolerable adversaries by the number of corruptible players (a threshold), we consider general adversaries characterized by an adversary structure, a set of subsets of the player set, where the adversary may corrupt the players of one set in the structure. Recursively applying the simulation technique to standard threshold multiparty protocols results in protocols secure against general adversaries.The classical results in unconditional multiparty computation among a set of n players state that, in the passive model, any adversary that corrupts less than n=2 players can be tolerated, and in the active model, any adversary that corrupts less than n=3 players can be tolerated. Strictly generalizing these results we prove that in the passive model, every function (more generally, every cooperation specified by involving a trusted party) can be computed securely with respect to a given adversary structure if and only if no two sets in the adversary structure cover the full set of players, and in the active model, if and only if no three sets cover the full set of players. The complexities of the protocols are polynomial in the number of maximal adverse player sets in the adversary structure.

Error decodable secret sharing and one-round perfectly secure message transmission for general adversary structures

“…After providing background results and definitions relating to secret sharing in Section 2, in Section 3 we formally define error decodable secret sharing, and describe an adversary model that allows us to simultaneously generalise both Kurosawa's notion of error decodable secret sharing, and the error correction properties of ReedSolomon codes. We give necessary and sufficient conditions on the adversary structures for a secret-sharing scheme to be error decodable in this model, analogous to conditions previously given in [7,8,11,16,19] (for example) for various related primitives.…”

“…Kurosawa demonstrates that a secret-sharing scheme realising an access structure Σ is error decodable precisely when the access structure satisfies a condition known as Q 3 , first defined by Hirt and Maurer in the context of secure multiparty computation [11].…”

Secret-Sharing Schemes: A Survey

“…Hirt and Maurer [42] considered a more general scenario in which there is an access structure, and the adversary can control any set of parties not in the access structure. That is, they require that any set not in the access structure cannot learn information not implied by the inputs of the parties in the set and the output of the function.…”

“…That is, they require that any set not in the access structure cannot learn information not implied by the inputs of the parties in the set and the output of the function. Similarly to the requirement that 2t < n in the protocol we described above, secure computation against honest-but-curious parties is possible for general functions iff the union of every two sets not in the access structure does not cover the entire set of parties [42]. For every such access structure A, Cramer et al [28] showed that using every linear secret-sharing scheme realizing A, one can construct a protocol for computing any arithmetic circuit such that any set not in the access structure cannot learn any information; the complexity of the protocol is linear in the size of the circuit.…”

Interplay between (Im)perfectness, Synchrony and Connectivity: The Case of Reliable Message Transmission

“…Fault model: We model faults in the network by a fictitious centralized entity called the adversary which has unbounded computing power [9,1]. A single "snapshot" of faults in the network can be described as a set of nodes B ⊆ V \{S,R} 4 , which means that all the nodes in B are faulty.…”