Perfectly Secure Multiparty Computation and the Computational Overhead of Cryptography

Abstract

Abstract. We study the following two related questions:-What are the minimal computational resources required for general secure multiparty computation in the presence of an honest majority? -What are the minimal resources required for two-party primitives such as zero-knowledge proofs and general secure two-party computation? We obtain a nearly tight answer to the first question by presenting a perfectly secure protocol which allows n players to evaluate an arithmetic circuit of size s by performing a total of O(s log s log 2 n) arithmetic operations, plus an additive term which depends (polynomially) on n and the circuit depth, but only logarithmically on s. Thus, for typical largescale computations whose circuit width is much bigger than their depth and the number of players, the amortized overhead is just polylogarithmic in n and s. The protocol provides perfect security with guaranteed output delivery in the presence of an active, adaptive adversary corrupting a (1/3 − ε) fraction of the players, for an arbitrary constant ε > 0 and sufficiently large n. The best previous protocols in this setting could only offer computational security with a computational overhead of poly(k, log n, log s), where k is a computational security parameter, or perfect security with a computational overhead of O(n log n).We then apply the above result towards making progress on the second question. Concretely, under standard cryptographic assumptions, we obtain zero-knowledge proofs for circuit satisfiability with 2 −k soundness error in which the amortized computational overhead per gate is only polylogarithmic in k, improving over the ω(k) overhead of the best previous protocols. Under stronger cryptographic assumptions, we obtain similar results for general secure two-party computation.

Efficient Non-interactive Secure Computation

“…A special case of this transformation is implicit in [25]. We reduce the general case to honestmajority MPC in the semi-honest model and instantiate it using a recent efficient protocol from [10].…”

“…Our general approach employs perfectly secure MPC protocols for the malicious model. The efficiency improvement will be obtained by plugging in the recent perfectly secure protocol from [10].…”

“…For such an adversary, the protocol provides perfect correctness and, moreover, if the adversary is semi-honest we are also guaranteed privacy. Such a protocol, with the desired complexity, appears in [10]. We now use Π COT to construct a COT protocol π COT as follows.…”

Robust Pseudorandom Generators

“…We combine Lemma 36 with results from [21,33] and with robust r-wise PRGs to compile any circuit C into a 2 −Ω(κ) disjunction resilient circuit C with poly(κ) randomness complexity, where the size of C is within a polylog factor of the size of C whenever C is much larger than its depth, input, and output size.…”

“…We construct C Disj from C and κ via the following steps. First, similarly to [33], we use the efficient MPC protocol from [21] to efficiently generate, given C and κ, a κ-private implementation (I, C , O) of size s = s · polylog(κ) + poly(κ, d, n i , n o ) and randomness locality poly(κ). (The randomness locality feature can be obtained via a "refreshing" approach similarly to the one used in Claim 31.)…”