Multi-party computation with conversion of secret sharing

  • Authors:

  • Hossein Ghodosi;Josef Pieprzyk;Ron Steinfeld

  • Affiliations:

  • Department of Information Technology, School of Business, James Cook University, Townsville, Australia 4811;Department of Computing, Center for Advanced Computing--Algorithms and Cryptography, Macquarie University, Sydney, Australia 2109;Department of Computing, Center for Advanced Computing--Algorithms and Cryptography, Macquarie University, Sydney, Australia 2109

  • Venue:
  • Designs, Codes and Cryptography
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Classical results in unconditionally secure multi-party computation (MPC) protocols with a passive adversary indicate that every n-variate function can be computed by n participants, such that no set of size t n/2 participants learns any additional information other than what they could derive from their private inputs and the output of the protocol. We study unconditionally secure MPC protocols in the presence of a passive adversary in the trusted setup (`semi-ideal') model, in which the participants are supplied with some auxiliary information (which is random and independent from the participant inputs) ahead of the protocol execution (such information can be purchased as a "commodity" well before a run of the protocol). We present a new MPC protocol in the trusted setup model, which allows the adversary to corrupt an arbitrary number t n of participants. Our protocol makes use of a novel subprotocol for converting an additive secret sharing over a field to a multiplicative secret sharing, and can be used to securely evaluate any n-variate polynomial G over a field F, with inputs restricted to non-zero elements of F. The communication complexity of our protocol is O(驴 · n 2) field elements, where 驴 is the number of non-linear monomials in G. Previous protocols in the trusted setup model require communication proportional to the number of multiplications in an arithmetic circuit for G; thus, our protocol may offer savings over previous protocols for functions with a small number of monomials but a large number of multiplications.