Round-Optimal Secure Multi-party Computation

Abstract

Secure multi-party computation (MPC) is a central cryptographic task that allows a set of mutually distrustful parties to jointly compute some function of their private inputs where security should hold in the presence of an active (i.e. malicious) adversary that can corrupt any number of parties. Despite extensive research, the precise round complexity of this “standard-bearer” cryptographic primitive, under polynomial-time hardness assumptions, is unknown. Recently, Garg, Mukherjee, Pandey and Polychroniadou, in Eurocrypt 2016 demonstrated that the round complexity of any MPC protocol relying on black-box proofs of security in the plain model must be at least four. Following this work, independently Ananth, Choudhuri and Jain, CRYPTO 2017 and Brakerski, Halevi, and Polychroniadou, TCC 2017 made progress towards solving this question and constructed four-round protocols based on the DDH and LWE assumptions, respectively, albeit with super-polynomial hardness. More recently, Ciampi, Ostrovsky, Siniscalchi and Visconti in TCC 2017 closed the gap for two-party protocols by constructing a four-round protocol from polynomial-time assumptions, concretely, trapdoor permutations. In another work, Ciampi, Ostrovsky, Siniscalchi and Visconti TCC 2017 showed how to design a four-round multi-party protocol for the specific case of multi-party coin-tossing based on one-way functions. In this work, we resolve this question by designing a four-round actively secure multi-party (two or more parties) protocol for general functionalities under standard polynomial-time hardness assumptions with a black-box proof of security, specifically, under the assumptions LWE, DDH, QR and DCR.

Secure Multi-party Computation

We briefly present the standard definition for secure multi-party computation and refer to [33, Chapter 7] for more details and motivating discussions. A multi-party protocol problem is cast by specifying a random process that maps pairs of inputs to pairs of outputs (one for each party). We refer to such a process as a functionality and denote it $f:\{0,1\}^*\times \cdots \times \{0,1\}^*\rightarrow \{0,1\}^*\times \cdots \times \{0,1\}^*$, where $f = (f_1,\ldots ,f_n)$. That is, for every tuple of inputs $(x_1,\ldots ,x_n)$, the output-vector is a random variable $(f_1(x_1,\ldots ,x_n),\ldots ,f_n(x_1,\ldots ,x_n))$ ranging over tuples of strings where $P_i$ receives $f_i(x_1,\ldots ,x_n)$. We use the notation $(x_1,\ldots ,x_n) \mapsto (f_1(x_1,\ldots ,x_n),\ldots ,f_n(x_1,\ldots ,x_n))$ to describe a functionality.

We prove the security of our protocols in the presence of an adversary that may actively (i.e. maliciously) or passively (i.e. semi-honest) corrupt parties. Security is analyzed by comparing what an adversary can do in a real protocol execution to what it can do in an ideal scenario. In the ideal scenario, the computation involves an incorruptible trusted third party to whom the parties send their inputs. The trusted party computes the functionality on the inputs and returns to each party its respective output. Informally, the protocol is secure if any adversary interacting in the real protocol (i.e., where no trusted third party exists) can do no more harm than what it could do in the ideal scenario.

1.1 The Honest-but-Curious Setting

In this model the adversary controls one of the parties and follows the protocol specification. However, it may try to learn more information than allowed by looking at the transcript of messages that it received and its internal state. Let $f = (f_1,\ldots , f_n)$ be a multi-party functionality and let $\pi$ be a multi-party protocol for computing f. The view of the ith party in an execution of $\pi$ on inputs $(x_1,\ldots ,x_n)$ is

$$\begin{aligned} {\mathbf{View}}_{\pi ,i}(x_1,\ldots ,x_n) = (x_i, r_i, m^i_1, \ldots ,m^i_t), \end{aligned}$$

where $r_i$ is the content of the first party’s internal random tape, and $m_j^i$ represents the jth message that it received. The output of the ith party in an execution of $\pi$ on $(x_1,\ldots ,x_n)$ is denoted $\mathbf{Output}_{\pi ,i}(x_1,\ldots ,x_n)$ and can be computed from $\mathbf{View}_{\pi ,i}(x_1,\ldots ,x_n)$. We denote the set of corrupted parties by $I\subset [n]$ and the set of honest parties by ${\bar{I}}$. We extend the above view notation to capture any subset of parties, denoting by $\mathbf{View}_{\pi ,T}(\kappa ,x_1,\ldots ,x_n)$ the joint views of all parties in T on $(\kappa ,x_1,\ldots ,x_n)$.

Definition A.1

Let f and $\pi$ be as above. Protocol $\pi$ is said to securely compute f in the presence of honest-but-curious adversaries if for every $I\subset [n]$ there exists a probabilistic polynomial-time algorithm ${\mathcal{S}}$ such that

$$\begin{aligned}&{({\mathcal{S}}(\{x_i,f_i(\kappa ,x_1,\ldots ,x_n)\}_{i\in I}), \{f_i(\kappa ,x_1,\ldots ,x_n)\}_{i\notin I})}_{\kappa \in {\mathbb {N}},x_i\in \{0,1\}^*}\\&{\mathop {\approx }\limits ^{\mathrm{c}}}\{(\mathbf{View}_{\pi ,I}(\kappa ,x_1,\ldots ,x_n), \mathbf{Output}_{\pi ,{\bar{I}}}(\kappa ,x_1,\ldots ,x_n))\}_{\kappa \in {\mathbb {N}},x_i\in \{0,1\}^*} \end{aligned}$$

where $\kappa$ is the security parameter.

1.2 The Active Setting

Execution in the ideal model. In an ideal execution, the parties submit inputs to a trusted party, that computes the output. An honest party receives its input for the computation and just directs it to the trusted party, whereas a corrupted party can replace its input with any other value of the same length. Since we do not consider fairness, the trusted party first sends the outputs of the corrupted parties to the adversary, and the adversary then decides whether the honest parties would receive their outputs from the trusted party or an abort symbol $\bot$. Let f be a multi-party functionality where $f = (f_1,\ldots ,f_n)$, let $\mathcal{A}$ be a non-uniform probabilistic polynomial-time machine, and let $I\subset [n]$ be the set of corrupted parties. Then, the ideal execution of f on inputs $(\kappa ,x_1,\ldots ,x_n)$, auxiliary input z to $\mathcal{A}$ and security parameter $\kappa$, denoted $\mathbf{IDEAL }_{f,\mathcal{A}(z),I}(\kappa ,x_1,\ldots ,x_n)$, is defined as the output pair of the honest party and the adversary $\mathcal{A}$ from the above ideal execution.

Execution in the real model. In the real model there is no trusted third party and the parties interact directly. The adversary $\mathcal{A}$ sends all messages in place of the corrupted party, and may follow an arbitrary polynomial-time strategy. The honest parties follow the instructions of the specified protocol $\pi$.

Let f be as above and let $\pi$ be a multi-party protocol for computing f. Furthermore, let $\mathcal{A}$ be a non-uniform probabilistic polynomial-time machine and let I be the set of corrupted parties. Then, the real execution of $\pi$ on inputs $(\kappa ,x_1,\ldots ,x_n)$, auxiliary input z to $\mathcal{A}$ and security parameter $\kappa$, denoted $\mathbf{REAL }_{\pi ,\mathcal{A}(z),I}(\kappa ,x_1,\ldots ,x_n)$, is defined as the output vector of the honest parties and the adversary $\mathcal{A}$ from the real execution of $\pi$.

Security as emulation of a real execution in the ideal model. Having defined the ideal and real models, we can now define security of protocols. Loosely speaking, the definition asserts that a secure protocol (in the real model) emulates the ideal model (in which a trusted party exists). This is formulated by saying that adversaries in the ideal model are able to simulate executions of the real-model protocol.

Definition A.2

Let f and $\pi$ be as above. Protocol $\pi$ is said to securely compute f with abort in the presence of active adversaries if for every non-uniform probabilistic polynomial-time adversary $\mathcal{A}$ for the real model, there exists a non-uniform probabilistic polynomial-time adversary ${\mathcal{S}}$ for the ideal model, such that for every $I\subset [n]$,

$$\begin{aligned} \left\{ \mathbf{IDEAL }_{f,{\mathcal{S}}(z),I}(\kappa ,x_1,\ldots ,x_n)\right\} _{\kappa \in {\mathbb {N}},x_i,z\in \{0,1\}^*} {\mathop {\approx }\limits ^{\mathrm{c}}}\left\{ \mathbf{REAL }_{\pi ,\mathcal{A}(z),I}(\kappa ,x,y)\right\} _ {\kappa \in {\mathbb {N}},x_i,z\in \{0,1\}^*} \end{aligned}$$

where $\kappa$ is the security parameter.