Towards Round-Optimal Secure Multiparty Computations: Multikey FHE Without a CRS

Abstract

Multikey fully homomorphic encryption (MFHE) allows homomorphic operations between ciphertexts encrypted under different keys. In applications for secure multiparty computation (MPC) protocols, MFHE can be more advantageous than usual fully homomorphic encryption (FHE) since users do not need to agree with a common public key before the computation when using MFHE. In EUROCRYPT 2016, Mukherjee and Wichs constructed a secure MPC protocol in only two rounds via MFHE which deals with a common random/reference string (CRS) in key generation. After then, Brakerski et al. replaced the role of CRS with the distributed setup for CRS calculation to form a four round secure MPC protocol. Thus, recent improvements in round complexity of MPC protocols have been made using MFHE. In this paper, we go further to obtain round-efficient and secure MPC protocols. The underlying MFHE schemes in previous works still involve the common value, CRS, it seems to weaken the power of using MFHE to allow users to independently generate their own keys. Therefore, we resolve the issue by constructing an MFHE scheme without CRS based on LWE assumption, and then we obtain a secure MPC protocol against semi-malicious security in three rounds. We also define a new security notion “multikey-CPA security” to prove that a multikey ciphertext cannot be decrypted unless all the secret keys are gathered and our scheme is multikey-CPA secure.

Homomorphic Encryption for Multiple Users With Less Communications

“…It was developed to achieve round optimal multiparty computation [14]. Also there were plausible results to get rid of CRS [15], [16] among multiple users based on GSW scheme. Other works allowed multi-hop (dynamic) property [8], [17] in MKHE schemes.…”

“…We denote an internal adversary of CMKHE by A and an RLWE distinguisher by B. In the security game for internal adversary [16], A performs what he can do such as accessing certain oracle after receiving a challenge ciphertext K b (resp. key b ) from a challenger of a security game, sends the value to B by letting him guess which b was chosen by the challenger.…”

“…There are two types of adversaries; the internal adversary who is a member of joint users, and the external adversary who does not take part in a computation but can see what is transmitted through a public channel. The input security is achieved by the multikey IND-CPA security [16] which models the same adversary as IND-CPA security except that the adversary (internal adversary) can perform the decryption by its own secret key before and after challenge phase (also with challenge message). The output security models adversaries who is an adversary of IND-CPA security except that he (external adversary) can additionally access the partial decryption oracle for each party' secret key before and after challenge step (also with challenge message) [19].…”

“…We show that our scheme is semantically secure in the multi decryptor setting to consider both adversaries. We follow the security game and the proof of [16], [19] Theorem 4: The scheme CMKHE with multi decryptor is semantically secure if underlying single-key BFV is semantically secure under RLWE assumption.…”

“…We denote any kind of adversary of CMKHE by A and the adversary which breaks underlying BFV scheme by B. In each security game per each type of adversary [16], [19], A performs what he can do such as accessing certain oracle after receiving a challenge ciphertext ct b from a challenger of a security game, sends the value to B by letting him guess which b was chosen by the challenger. Then A forwards the answer of B to the challenger.…”