a590003

construct protocols that are secure even against such adversaries. Furthermore, simulation-based security in the
real/ideal security paradigm being the benchmark for security in cryptography, we would like to obtain protocols
that are secure in this sense. Finally, we would like our protocols to be as widely applicable as possible, thus we
choose to work in the strongest corruption model.
We remark that the outsourcing of multi-party computation has been studied in weaker security models
[KMR11, CKKC13]. We shall discuss these works more in detail later on in this section.
Communication model: minimal interaction between parties. Since we wish to only rely on standard cryptographic
assumptions, we shall work in the pre-processing model. In the pre-processing model, the clients, at the
start of the protocol, execute a preprocessing phase which is a one-time stage in which the clients compute public
as well as private information associated with the function F that they wish to outsource. The computation of
each client in this phase is allowed to be proportional to the computational complexity of evaluating F . Communication
being at a premium, one would like to have protocols in which the interaction between the clients and
the server (and amongst the clients) is minimized. Now, ideally, it would be great if one could obtain a protocol
in which the clients interacted only in the pre-processing phase, then interacted with the server once individually
(by sending and receiving exactly one message) and then obtained the results of the computation. Unfortunately,
this is impossible to achieve in our security model - one can easily see that if the clients did not interact with each
other, after exchanging one message with the server, then one cannot obtain a simulation-based secure protocol
that is secure against a colluding client and server (more specifically, for a fixed input of the honest client, the
colluding client and server would be able to obtain the output of the computation on several inputs of their choice,
thus violating the requirements of a simulation-based definition). Thus, clients need to interact with each other
in order to obtain the results of the computation; the focus would then be on minimizing this interaction.
The above choices (allowing the clients to perform expensive computation and communication during the
off-line phase, but then restricting them to a single message exchange during the on-line phase) might seem
artificial. Yet there are several practical scenarios where this are relevant. Consider the case of military coalitions
where the clients are armies from different countries and are in need to perform joint computations on data that
might need to be kept private by each army. It is conceivable that the off-line phase will be performed over a
trusted network before the deployment of soldiers in the field, and therefore computation and communication are
not at a premium. The situation however changes dramatically during the on-line phase where the input to the
computation is obtained during actual combat operations where battery power and communication bandwidth
might be severely limited.
Advantages of the communication model. Our communication model has two further advantages:
- The foremost advantage of our communication model is that of asynchronicity. Note that during the outsourcing
of computation, none of the clients need be present at the same time. They can send their respective
messages to the servers at various points of time. Only when they wish to verify the computation do
clients have to synchronize and run a computation (which is unavoidable within our framework of security).
- Another advantage of the clients not communicating during the online phase is that clients could batch
together multiple computations and at the end could verify all the computations together.
Description of our model. Given the most natural and useful design choices above, we now describe the model
in which we obtain our protocols. Our protocol for outsourcing multi-party computation consists of three phases:
the preprocessing phase, the online phase, and the offline phase.
The preprocessing phase is a one-time stage in which the clients compute public as well as private information
associated with the function F that they wish to outsource. The computation of each client in this phase is allowed
to be proportional to the computational complexity of evaluating F . We also allow clients to interact with each
other in an arbitrary manner in this phase. This phase is executed only once and is independent of the client’s
inputs.
2
11. How to Delegate Secure Multiparty Computation to the Cloud