On the Communication Required for Unconditionally Secure Multiplication

Damgård, Ivan; Nielsen, Jesper Buus; Polychroniadou, Antigoni; Raskin, Mikhail

doi:10.1007/978-3-662-53008-5_16

Cited by 23 publications

(7 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Indeed, the functions xor and and serve as basic building blocks for private protocols that rely on the boolean-circuit representation of f (more generally, addition and multiplication are used as building blocks for protocols that use the arithmetic-circuit representation of f ). In the context of lower bounds for communication complexity of private protocols, these building blocks also serve as the center of analysis (as a first step for a more general understanding), see, e.g., [8,9,10].…”

Section: Introductionmentioning

confidence: 99%

Lower and Upper Bounds on the Randomness Complexity of Private Computations of AND

Kushilevitz¹,

Ostrovsky²,

Prouff

et al. 2021

SIAM J. Discrete Math.

View full text Add to dashboard Cite

We consider multi-party information-theoretic private protocols, and specifically their randomness complexity. The randomness complexity of private protocols is of interest both because random bits are considered a scarce resource, and because of the relation between that complexity measure and other complexity measures of boolean functions such as the circuit size or the sensitivity of the function being computed [17,12]. More concretely, we consider the randomness complexity of the basic boolean function and, that serves as a building block in the design of many private protocols. We show that and cannot be privately computed using a single random bit, thus giving the first non-trivial lower bound on the 1-private randomness complexity of an explicit boolean function, f : {0, 1} n → {0, 1}. We further show that the function and, on any number of inputs n (one input bit per player), can be privately computed using 8 random bits (and 7 random bits in the special case of n = 3 players), improving the upper bound of 73 random bits implicit in [17]. Together with our lower bound, we thus approach the exact determination of the randomness complexity of and. To the best of our knowledge, the exact randomness complexity of private computation is not known for any Research of E.

show abstract

Section: Introductionmentioning

confidence: 99%

Lower and Upper Bounds on the Randomness Complexity of Private Computations of AND

Kushilevitz¹,

Ostrovsky²,

Prouff

et al. 2021

SIAM J. Discrete Math.

View full text Add to dashboard Cite

show abstract

“…On the Lower Bounds of [IKM + 13, DNPR16]. It should be noted that our protocols do not follow the standard gate-by-gate design of unconditionally secure protocols in the correlated randomness model, hence our result does not contradict the lower bound of [DNPR16]. Moreover, our results apply only to circuits, while the implausibility result of [IKM + 13] assumes the existence of a low-storage protocols for evaluating any function, which our results do not provide.…”

Section: Our Methodsmentioning

confidence: 79%

“…For instance, it was mentioned in [DZ13] that "the results and evidence we know suggest that getting constant overhead [over the circuit size of the function] is the goal we can realistically hope to achieve". More recently in [DNPR16], the authors mentioned that "whether we can have constant round protocols and/or communication complexity much smaller than the size of the circuit and still be efficient (polynomial-time) in the circuit size of the function is a long-standing open problem".…”

Section: Introductionmentioning

confidence: 99%

“…In [DNPR16], the authors made progresses toward understanding why existing protocols have been stuck at the circuit-size barrier, by identifying a property shared by all known efficient protocols in the correlated randomness model, which states (informally) that they evaluate the function in a "gate-by-gate" fashion, and require communication for every multiplication gate. They demonstrated that all protocols following this approach (with passive security and dishonest majority) must inherently have communication proportional to the circuit size of the function.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Note on the Communication Complexity of Multiparty Computation in the Correlated Randomness Model

Couteau

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Secure multiparty computation (MPC) addresses the challenge of evaluating functions on secret inputs without compromising their privacy. A central question in multiparty computation is to understand the amount of communication needed to securely evaluate a circuit of size s. In this work, we revisit this fundamental question in the setting of information-theoretically secure MPC in the correlated randomness model, where a trusted dealer distributes correlated random coins, independent of the inputs, to all parties before the start of the protocol. This setting is of strong theoretical interest, and has led to the most practically efficient MPC protocols known to date. While it is known that protocols with optimal communication (proportional to input plus output size) can be obtained from the LWE assumption, and that protocols with sublinear communication o(s) can be obtained from the DDH assumption, the question of constructing protocols with o(s) communication remains wide open for the important case of informationtheoretic MPC in the correlated randomness model; all known protocols in this model require O(s) communication in the online phase. In this work, we exhibit the first generic multiparty computation protocol in the correlated randomness model with communication sublinear in the circuit size, for a large class of circuits. More precisely, we show the following: any size-s layered circuit (whose nodes can be partitioned into layers so that any edge connects adjacent layers) can be evaluated with O(s/log log s) communication. Our results holds for both boolean and arithmetic circuits, in the honest-but-curious setting, and do not assume honest majority. For boolean circuits, we extend our results to handle malicious corruption.

show abstract

“…Some results on lower bounds for communication complexity of gate-by-gate protocols for arithmetic circuits like ours were obtained by[DNPR16] but they do not seem to be enough to claim such optimality.…”

mentioning

confidence: 87%

Amortized Complexity of Information-Theoretically Secure MPC Revisited

Cascudo

Cramer

Xing

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

A fundamental and widely-applied paradigm due to Franklin and Yung (STOC 1992) on Shamir-secret-sharing based general n-player MPC shows how one may trade the adversary threshold t against amortized communication complexity, by using a so-called packed version of Shamir's scheme. For e.g. the BGW-protocol (with active security), this trade-off means that if t + 2k − 2 < n/3, then k parallel evaluations of the same arithmetic circuit on different inputs can be performed at the overall cost corresponding to a single BGW-execution. In this paper we propose a novel paradigm for amortized MPC that offers a different trade-off, namely with the size of the field of the circuit which is securely computed, instead of the adversary threshold. Thus, unlike the Franklin-Yung paradigm, this leaves the adversary threshold unchanged. Therefore, for instance, this paradigm may yield constructions enjoying the maximal adversary threshold (n−1)/3 in the BGWmodel (secure channels, perfect security, active adversary, synchronous communication). Our idea is to compile an MPC for a circuit over an extension field to a parallel MPC of the same circuit but with inputs defined over its base field and with the same adversary threshold. Key technical handles are our notion of reverse multiplication-friendly embeddings (RMFE) and our proof, by algebraic-geometric means, that these are constant-rate, as well as efficient auxiliary protocols for creating "subspace-randomness" with good amortized complexity. In the BGW-model, we show that the latter can be constructed by combining our tensored-up linear secret sharing with protocols based on hyper-invertible matricesá la Beerliova-Hirt (or variations thereof). Along the way, we suggest alternatives for hyper-invertible matrices with the same functionality but which can be defined over a large enough constant size field, which we believe is of independent interest. As a demonstration of the merits of the novel paradigm, we show that, in the BGW-model and with an optimal adversary threshold (n − 1)/3 ,

show abstract

On the Communication Required for Unconditionally Secure Multiplication

Cited by 23 publications

References 28 publications

Lower and Upper Bounds on the Randomness Complexity of Private Computations of AND

Lower and Upper Bounds on the Randomness Complexity of Private Computations of AND

A Note on the Communication Complexity of Multiparty Computation in the Correlated Randomness Model

Amortized Complexity of Information-Theoretically Secure MPC Revisited

Contact Info

Product

Resources

About