Amortized Complexity of Information-Theoretically Secure MPC Revisited

Abstract

A fundamental and widely-applied paradigm due to Franklin and Yung (STOC 1992) on Shamir-secret-sharing based general n-player MPC shows how one may trade the adversary threshold t against amortized communication complexity, by using a so-called packed version of Shamir's scheme. For e.g. the BGW-protocol (with active security), this trade-off means that if t + 2k − 2 < n/3, then k parallel evaluations of the same arithmetic circuit on different inputs can be performed at the overall cost corresponding to a single BGW-execution. In this paper we propose a novel paradigm for amortized MPC that offers a different trade-off, namely with the size of the field of the circuit which is securely computed, instead of the adversary threshold. Thus, unlike the Franklin-Yung paradigm, this leaves the adversary threshold unchanged. Therefore, for instance, this paradigm may yield constructions enjoying the maximal adversary threshold (n−1)/3 in the BGWmodel (secure channels, perfect security, active adversary, synchronous communication). Our idea is to compile an MPC for a circuit over an extension field to a parallel MPC of the same circuit but with inputs defined over its base field and with the same adversary threshold. Key technical handles are our notion of reverse multiplication-friendly embeddings (RMFE) and our proof, by algebraic-geometric means, that these are constant-rate, as well as efficient auxiliary protocols for creating "subspace-randomness" with good amortized complexity. In the BGW-model, we show that the latter can be constructed by combining our tensored-up linear secret sharing with protocols based on hyper-invertible matricesá la Beerliova-Hirt (or variations thereof). Along the way, we suggest alternatives for hyper-invertible matrices with the same functionality but which can be defined over a large enough constant size field, which we believe is of independent interest. As a demonstration of the merits of the novel paradigm, we show that, in the BGW-model and with an optimal adversary threshold (n − 1)/3 ,

The quadratic hull of a code and the geometric view on multiplication algorithms

“…We illustrate this with examples, in particular we describe the quadratic hull of all the optimal algorithms computed in [3] for small algebras.In our presentation we actually work with multiplication reductions. This is a generalization of multiplication algorithms, that allows for instance evaluation-interpolation at points of higher degree and/or with multiplicities, and also includes the recently introduced notion of "reverse multiplication-friendly embedding" from [5]. All our results hold in this more general context.…”

Efficient Information-Theoretic Secure Multiparty Computation over $$\mathbb {Z}/p^k\mathbb {Z}$$ via Galois Rings

“…In the setting of perfectly secure MPC with t < n/3, we show that we can efficiently perform robust reconstruction in the presence of errors, we show that the hyperinvertible matrices needed in the protocol can be obtained over R can be obtained by lifting them from the residue field, and we show how to get MPC over Z/p k Z by efficient verification of the inputs, using techniques from [7]. We give the modifications needed to the protocol of [4], to obtain MPC over Z/p k Z with the communication complexity for a circuit C of size |C| of O(n log(n)|C|) elements in Z/p k Z.…”

“…We use an idea from [7] to generate these sharings of random elements in Z/p k Z. Since R is a free module over Z/p k Z of rank d, we can write down a basis of R. In fact, a power basis 1, ξ, .…”

“…2, we present a protocol for constructing sharings over R of random elements in Z/p k Z. The function of RandEl(Z/p k Z) is to amortize away the cost of generating sharings of random elements in Z/p k Z and meanwhile to verify if the shares correspond to a random element in Z/p k Z instead of R. Our protocol is similar to RandElSub(V ) in [7]. Using player elimination, we assume that there are currently n parties taking part in the computation (labeled P 1 , .…”

“…If a party is unhappy, player elimination ensures that we can find a pair of players that contains at least one corrupted player. Like Proposition 4 in [7], we only need to communicate O(n) elements in R per sharing of a random element in Z/p k Z.…”