a590003

In the online phase clients individually prepare public and private information about their respective inputs
and send a single message to the server. The server, upon receiving these messages from all the clients, sends
back a single message to each of the clients (the messages sent by the server to each of the clients can potentially
be different from one another). Note that we do not allow the clients to communicate directly with each other in
this phase. The computational complexity of the clients in this phase is required to be independent of F .
Finally, in the offline phase, the clients interact with each other to decode the response provided to them by
the server and obtain the result of the computation. We will focus on minimizing the interaction between the
clients in this phase. Furthermore, the computational complexity of the clients in this phase is also required to be
independent of F .
We obtain a protocol that enjoys simulation-based security in the real/ideal paradigm and is secure even
against an adversarial client who colludes with a malicious server. As we will show, requiring security against
a colluding adversary and requiring a simulation based definition of security to be met, present significant
challenges that need to be overcome in order to construct a protocol for outsourcing multi-party computation.
Finally, our protocol makes use of standard cryptographic assumptions (and not random oracles or nonfalsifiable
assumptions). We note here that our solution, just like the solutions for single-party verifiable computation
[GGP10, CKV10], require that the pre-processing phase be executed again, in the event that the output of
a computation is rejected by one of the clients. In other words, we cannot reveal to a malicious server that the
result of the computation was rejected, and then continue with another verifiable computation protocol with the
same pre-processing information.
Alternative approaches to delegating multi-party computation. Note, that if one were to resort to using
random oracles or making use of non-falsifiable hardness assumptions [Nao03], then it is easy to construct multiclient
verifiable computation protocols. Very briefly, the clients can simply send their inputs to the server and
the server can return the result of the computation along with a succinct non-interactive argument (SNARG)
[Mic94, GW11, BCCT12, GLR11, DFH12] proving that it evaluated the output honestly. Privacy of the clients
inputs can be obtained through standard techniques (e.g., via the use of fully homomorphic encryption). However,
this solution is uninteresting from the point of view of the non-standard hardness assumption required to prove it
secure.
Also if we relax the security notion to only consider non-colluding adversaries (that is a malicious client and
a malicious server do not collude), and if we do not wish to obtain the stronger simulation-based definition of
security, then the work of Kamara, Mohassel, and Raykova [KMR11] shows how to outsource multi-party computation.
With the important focus on removing interaction between clients, the work of Choi et al. [CKKC13]
consider multi-client non-interactive verifiable computation in which soundness guarantees are provided against
a malicious server when all clients are honest; they also define privacy guarantees separately against a server and
against a client. We note that this is much weaker than the simulation based security model that we work in that
captures soundness and privacy against malicious clients and server colluding with each other.
Finally, we remark that if we did allow the clients to interact in the online phase (and sacrifice on asynchronicity),
then one can trivially obtain a protocol for outsourcing multi-party computation from any singleparty
protocol for outsourcing computation [GGP10, CKV10, AIK10]; in the online phase, the clients simply
“simulate” a single party by running a secure computation protocol to compute the message sent by the client in
the single-party protocol. As discussed above, in our view, this is a particularly unsatisfactory approach, and of
limited interest.
1.2 Our Results
In this work, we show how to construct a secure protocol for two-party verifiable computation in the preprocessing
model. We highlight the key features in our protocol:
• In our solution, the clients perform work proportional to F only in the pre-processing phase (executed
once), and have computational complexity independent of F in the remainder of the protocol (the online
3
11. How to Delegate Secure Multiparty Computation to the Cloud