Semi-homomorphic Encryption and Multiparty Computation

Abstract

Abstract. An additively-homomorphic encryption scheme enables us to compute linear functions of an encrypted input by manipulating only the ciphertexts. We define the relaxed notion of a semihomomorphic encryption scheme, where the plaintext can be recovered as long as the computed function does not increase the size of the input "too much". We show that a number of existing cryptosystems are captured by our relaxed notion. In particular, we give examples of semi-homomorphic encryption schemes based on lattices, subset sum and factoring. We then demonstrate how semi-homomorphic encryption schemes allow us to construct an efficient multiparty computation protocol for arithmetic circuits, UC-secure against a dishonest majority. The protocol consists of a preprocessing phase and an online phase. Neither the inputs nor the function to be computed have to be known during preprocessing. Moreover, the online phase is extremely efficient as it requires no cryptographic operations: the parties only need to exchange additive shares and verify information theoretic MACs. Our contribution is therefore twofold: from a theoretical point of view, we can base multiparty computation on a variety of different assumptions, while on the practical side we offer a protocol with better efficiency than any previous solution.

Linear Overhead Optimally-Resilient Robust MPC Using Preprocessing

“…We will use information-theoretically secure MAC, similar to the one used in [10]. Here a random pair K = (α, β) ∈ F 2 is selected as the MAC key and the MAC tag on a value a ∈ F, under the key K is defined as MAC K (a) def = α · a + β.…”

“…Using F PREP we design a protocol Π ONLINE (see Fig. 6) which realizes F f in the synchronous setting and provides universal composability (UC) security [13,10,22,16]. The protocol is based on the standard Beaver's idea of securely evaluating the circuit in a shared fashion using pre-processed shared random multiplication triples [4] and shared inputs.…”

“…In Appendix B, we present a protocol Π PREP which realizes F PREP in the synchronous setting and achieves UC security. The protocol is a straight forward adaptation of the offline phase protocol of [10,22] to deal with Shamir sharing, instead of additive sharing.…”

“…We refer to [10,13,16,22] for the definition of UC-security. Let A be a real-world adversary corrupting t parties during the execution of Π ONLINE and let C ⊂ P denote the set of corrupted parties.…”

“…Using this protocol, prover P j can prove to P i that it has computed HE.c(γ) as above. The protocol has communication complexity O(κ) bits (see [10] for example).…”