Secure Computation with Constant Communication Overhead Using Multiplication Embeddings

Block, Alexander R.; Maji, Hemanta K.; Nguyen, Huy Hung

doi:10.1007/978-3-030-05378-9_20

Cited by 13 publications

(4 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The notion of reverse multiplication friendly embedding was first explicitly defined and studied in the context of secure computation by Cascudo et al in [8] and independently by Block et al in [5]. The former work is in the context of information-theoretically secure protocols, while the latter studied 2-party protocols over small fields where the assumed resource is OLE over an extension field.…”

Section: Related Workmentioning

confidence: 99%

“…For any r ≤ 16, there exists a (2r, 8r) 2 -RMFE. 5 For our numerical comparisons we will mainly consider the constructions with better rate in Theorem 1 and point out that, should one want to use Theorem 2 instead, then some small overhead in communication is introduced.…”

Section: Preliminariesmentioning

confidence: 99%

“…In our case, we will again encounter problems caused by these limitations as we explain next, but can solve them in a different way. 5 Specifically the result is obtained by noticing that the proof of Lemma 4 in [8] can also be used to show the existence of (k, 2k)q-RMFE for any q ≤ k + 1, and then composing (2, 4)2 and (r, 2r)16-RMFEs in the manner of Lemma 5 in the same paper.…”

Section: Preliminariesmentioning

confidence: 99%

“…The point is that we can embed the ring F k q in some extension field of F q in such a way that we can make the operations of both algebraic structures, and in particular the products (in one case the coordinatewise product, in the other the product in the extension field), "somewhat compatible": i.e., we map F k q into a slightly larger field F q m with some dedicated linear "embedding" map φ, that satisfies that for any two vectors x, y in F k q the field product φ(x) • φ(y) contains all information about x * y, in fact there exists a "recovery" linear map ψ such that x * y = ψ(φ(x) • φ(y)). The pair (φ, ψ) is called a (k, m)-reverse multiplication friendly embedding (RMFE) and was introduced in [5,8]. With such tool, [8] embeds k evaluations of a circuit over F q (i.e.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Secret-Sharing Based MPC Protocol for Boolean Circuits with Good Amortized Complexity

Cascudo

Gundersen

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We present a new secure multiparty computation protocol in the preprocessing model that allows for the evaluation of a number of instances of a boolean circuit in parallel, with a small online communication complexity per instance of 10 bits per party and multiplication gate. Our protocol is secure against an active dishonest majority, and can also be transformed, via existing techniques, into a protocol for the evaluation of a single "well-formed" boolean circuit with the same complexity per multiplication gate at the cost of some overhead that depends on the topology of the circuit. Our protocol uses an approach introduced recently in the setting of honest majority and information-theoretical security which, using an algebraic notion called reverse multiplication friendly embeddings, essentially transforms a batch of evaluations of an arithmetic circuit over a small field into one evaluation of another arithmetic circuit over a larger field. To obtain security against a dishonest majority we combine this approach with the well-known SPDZ protocol that operates over a large field. Structurally our protocol is most similar to MiniMAC, a protocol which bases its security on the use of error-correcting codes, but our protocol has a communication complexity which is half of that of MiniMAC when the best available binary codes are used. With respect to certain variant of MiniMAC that utilizes codes over larger fields, our communication complexity is slightly worse; however, that variant of MiniMAC needs a much larger preprocessing than ours. We also show that our protocol also has smaller amortized communication complexity than Committed MPC, a protocol for general fields based on homomorphic commitments, if we use the best available constructions for those commitments. Finally, we construct a preprocessing phase from oblivious transfer based on ideas from MASCOT and Committed MPC.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Preliminariesmentioning

confidence: 99%