a590003

to compute F from scratch. The worker W, however, is expected to perform computation proportional to the
size of the circuit representing F . Similar to standard multiparty computation, our corruption model allows an
adversary to maliciously corrupt the worker and one of the clients (a subset of the clients in the multi-party case).
Informally speaking, we require that no such adversary learns anymore than what can be learned from the inputs
of the corrupted clients and their outputs (and any additional auxiliary information that the adversary may have).
Note that the above problem is non-trivial even in the setting where a single client wishes to outsource
its computation to a worker. Specifically, all the known solutions require either the random oracle model, or
appropriate non-black-box assumptions, or allow for a one-time pre-processing phase where the computation of
the client(s) is allowed to be proportional to the size of the circuit representing F . 1 In this work, we wish to only
rely on standard cryptographic assumptions; as such, we choose to work in the pre-processing model.
We now proceed to give a formal description of our model in the remainder of this section. We first present
the syntax for a two-party verifiable computation protocol. We then define security as per the the standard
real/ideal paradigm for secure computation. Throughout this work, for simplicity of exposition, we assume that
the function to be evaluated on the clients’ inputs gives the same outputs to all clients. We note that the general
scenario where the function outputs may be different for each client can be handled using standard techniques.
Two-party Verifiable Computation Protocol. A 2-party verifiable computation protocol between 2 clients (or
delegators) D = {D 1 , D 2 } and a worker W consists of three phases, namely, (a) pre-processing phase, (b) online
phase, and (c) offline phase. Here, the pre-processing phase is executed only once, while the online phase is
executed every time the clients wish to compute F over a new set of inputs. The offline phase may also be
executed each time following the online phase. Alternatively (and crucially), multiple executions of the offline
phase can be batched together (i.e., the clients can outsource several (not fixed apriori) computations of F on
different sets of inputs before they verify and obtain the results of these computations). We now describe the
three phases in detail:
Preprocessing Phase: This is a one-time stage in which the clients compute some public, as well as private,
information associated with the function F . The computation of each client in this phase is allowed to
be proportional to the amount of computation needed to compute F from scratch. Clients are allowed to
interact with each other in an arbitrary manner in this phase. Note that this phase is independent of the
clients inputs and is executed only once.
Online Phase: In this phase, the clients interact with the server in a single round of communication. Let x i the
input held by client D i . In order to outsource the computation of F (on a chosen set of inputs x 1 , x 2 ) to
the worker W, each client D i individually prepares some public and private information about x i and sends
the public information to the worker. On receiving the encoded inputs from each client, W computes an
encoded output and sends it to all the clients. Note that the clients do not directly interact with each other
in this phase. This ensures that clients do not need to interact (and be available online) whenever they wish
to perform some computation.
Offline Phase: On receiving the encoded output from the worker, the clients interact with each other to compute
the actual output F (x 1 , x 2 ) and verify its correctness. We require that the computation of each client in
this phase be independent of F . As we see, we will also minimize the interaction between the clients in
this phase.
Note that the above protocol allows only for a single round of interaction between the clients and the worker.
We require that the computation time of the clients in steps 2 and 3 above be, in total, less than the time required
to compute F from scratch (in fact, in our protocol the computational complexity will be independent of F ).
Furthermore, we would like the worker to perform computation that is roughly the same as computing F .
1 In fact, this is the state of affairs even if we relax the security requirement to only output correctness, and do not require input privacy.
7
11. How to Delegate Secure Multiparty Computation to the Cloud