Error Detection in Monotone Span Programs with Application to Communication-Efficient Multi-party Computation

Abstract

Recent improvements in the state-of-the-art of MPC for nonfull-threshold access structures introduced the idea of using a collisionresistant hash functions and redundancy in the secret-sharing scheme to construct a communication-efficient MPC protocol which is computationallysecure against malicious adversaries, with abort. The prior work is based on replicated secret-sharing; in this work we extend this methodology to any LSSS implementing a Q2 access structure. To do so we need to establish a folklore property of error detection for such LSSS and their associated Monotone Span Programs. In doing so we obtain communicationefficient online and offline protocols for MPC in the pre-processing model.

Adding Distributed Decryption and Key Generation to a Ring-LWE Based CCA Encryption Scheme

“…This uses an offline phase to produce multiplication triples and shared random bits (using Maurer's multiplication protocol [22]) and then an online phase which checks for correctness by using the error detection properties of the underlying Reed-Solomon codes. See [18,27] for precise details of how this protocol works. This arithmetic circuit based MPC protocol is used in our distributed key generation phase, and we make crucial use of the ability of the SCALE-MAMBA system to generate shared random bits in the offline phase; as then our online phase becomes essentially a local operation.…”

Zaphod

“…For example in the full-threshold case, one can define an LSSS ⟨•⟩ p and an associated MPC protocol, using the SPDZ [12] system. For general Q2 (actually multiplicative) LSSSs one can utilize the protocol by Smart and Wood [27] to produce an MPC protocol directly using the given LSSS. Whereas using a modified LSSS one can do the same using the protocol given by Chida et al [11].…”

“…Whereas using a modified LSSS one can do the same using the protocol given by Chida et al [11]. The difference between the last two protocols is that [27] provides an online phase with lower communication complexity than [11], at the expense of having to utilize a slightly more expensive offline phase.…”

“…it must correctly guess the MAC key α. For a Q2 access structure, it has been shown [27] that error-detection comes essentially "for free" using a kind of internal redundancy of the LSSS.…”

“…Additions do not require message exchanges, hence we consider them to be "free" in terms of communication. Protocols in this family date back to [4,10], with modern efficient protocols (for various access structures) including those in [5,11,12,27].…”